RtlReplaceSidInSd

NTSTATUS __stdcall RtlReplaceSidInSd(VOID *SecurityDescriptor, VOID *OldSid, VOID *NewSid, UINT64 *NumChanges){
  VOID *v4; 
  unsigned __int8 *v8; 
  size_t v9; 
  NTSTATUS result; 
  int v11; 
  int v12; 
  int v13; 
  char *v14; 
  int v15; 
  int v16; 
  int v17; 
  char *v18; 
  __int64 v19; 
  unsigned __int8 *v20; 
  __int64 v21; 
  int v22; 
  int v23; 
  int v24; 
  size_t v25; 
  VOID *v26; 
  __int64 v27; 
  unsigned __int8 *v28; 
  __int64 v29; 
  int v30; 
  int v31; 
  int v32; 
  size_t v33; 
  VOID *v34; 
  UINT8 OwnerDefaulted[4]; 
  size_t v36; 
  PVOID Owner; 
  unsigned __int8 DaclPresent; 

  *(_DWORD *)NumChanges = 0;
  v4 = SecurityDescriptor;
  DaclPresent = 0;
  LODWORD(v8) = RtlSubAuthorityCountSid((INT64)OldSid);
  Owner = 0i64;
  v9 = 4 * *v8;
  v36 = v9;
  result = RtlGetOwnerSecurityDescriptor(v4, &Owner, OwnerDefaulted);
  if( result >= 0 )
  {
    if( Owner )
    {
      if( *(_BYTE *)Owner == *(_BYTE *)OldSid )
      {
        v11 = *((unsigned __int8 *)Owner + 1);
        v12 = *((unsigned __int8 *)OldSid + 1);
        if( (_BYTE)v11 == (_BYTE)v12 || v11 == v12 + 1 )
        {
          v13 = *(_DWORD *)((char *)Owner + 2) - *(_DWORD *)((char *)OldSid + 2);
          if( !v13 )
            v13 = *((unsigned __int16 *)Owner + 3) - *((unsigned __int16 *)OldSid + 3);
          if( !v13 )
          {
            v14 = (char *)Owner + 8;
            if( !memcmp((char *)Owner + 8, (char *)OldSid + 8, v9) )
            {
              memmove(v14, (char *)NewSid + 8, v9);
              ++*(_DWORD *)NumChanges;
            }
          }
        }
      }
    }
    Owner = 0i64;
    result = RtlGetGroupSecurityDescriptor(v4, &Owner, OwnerDefaulted);
    if( result >= 0 )
    {
      if( Owner )
      {
        if( *(_BYTE *)Owner == *(_BYTE *)OldSid )
        {
          v15 = *((unsigned __int8 *)Owner + 1);
          v16 = *((unsigned __int8 *)OldSid + 1);
          if( (_BYTE)v15 == (_BYTE)v16 || v15 == v16 + 1 )
          {
            v17 = *(_DWORD *)((char *)Owner + 2) - *(_DWORD *)((char *)OldSid + 2);
            if( !v17 )
              v17 = *((unsigned __int16 *)Owner + 3) - *((unsigned __int16 *)OldSid + 3);
            if( !v17 )
            {
              v18 = (char *)Owner + 8;
              if( !memcmp((char *)Owner + 8, (char *)OldSid + 8, v9) )
              {
                memmove(v18, (char *)NewSid + 8, v9);
                ++*(_DWORD *)NumChanges;
              }
            }
          }
        }
      }
      Owner = 0i64;
      result = RtlGetDaclSecurityDescriptor(v4, &DaclPresent, (_ACL **)&Owner, OwnerDefaulted);
      if( result >= 0 )
      {
        if( DaclPresent )
        {
          if( Owner )
          {
            v19 = *((unsigned __int16 *)Owner + 2);
            v20 = (unsigned __int8 *)Owner + 8;
            if( *((_WORD *)Owner + 2) )
            {
              while( *v20 > 3u )
              {
                if( *v20 == 4 )
                {
                  v21 = (__int64)&v20[RtlLengthSid((INT64)(v20 + 12)) + 12];
                  goto LABEL_29;
                }
LABEL_38:
                v20 += *((unsigned __int16 *)v20 + 1);
                if( !--v19 )
                {
                  v4 = SecurityDescriptor;
                  goto LABEL_40;
                }
              }
              v21 = (__int64)(v20 + 8);
LABEL_29:
              if( *(_BYTE *)v21 == *(_BYTE *)OldSid )
              {
                v22 = *(unsigned __int8 *)(v21 + 1);
                v23 = *((unsigned __int8 *)OldSid + 1);
                if( (_BYTE)v22 == (_BYTE)v23 || v22 == v23 + 1 )
                {
                  v24 = *(_DWORD *)(v21 + 2) - *(_DWORD *)((char *)OldSid + 2);
                  if( !v24 )
                    v24 = *(unsigned __int16 *)(v21 + 6) - *((unsigned __int16 *)OldSid + 3);
                  if( !v24 )
                  {
                    v25 = v9;
                    v26 = (VOID *)(v21 + 8);
                    if( !memcmp((const VOID *)(v21 + 8), (char *)OldSid + 8, v25) )
                    {
                      memmove(v26, (char *)NewSid + 8, v25);
                      ++*(_DWORD *)NumChanges;
                    }
                    v9 = v36;
                  }
                }
              }
              goto LABEL_38;
            }
          }
        }
LABEL_40:
        Owner = 0i64;
        result = RtlGetSaclSecurityDescriptor(v4, &DaclPresent, (_ACL **)&Owner, OwnerDefaulted);
        if( result >= 0 && DaclPresent && Owner )
        {
          v27 = *((unsigned __int16 *)Owner + 2);
          v28 = (unsigned __int8 *)Owner + 8;
          if( *((_WORD *)Owner + 2) )
          {
            while( *v28 > 3u )
            {
              if( *v28 == 4 )
              {
                v29 = (__int64)&v28[RtlLengthSid((INT64)(v28 + 12)) + 12];
                goto LABEL_48;
              }
LABEL_56:
              v9 = v36;
              v28 += *((unsigned __int16 *)v28 + 1);
              if( !--v27 )
                return 0;
            }
            v29 = (__int64)(v28 + 8);
LABEL_48:
            if( *(_BYTE *)v29 == *(_BYTE *)OldSid )
            {
              v30 = *(unsigned __int8 *)(v29 + 1);
              v31 = *((unsigned __int8 *)OldSid + 1);
              if( (_BYTE)v30 == (_BYTE)v31 || v30 == v31 + 1 )
              {
                v32 = *(_DWORD *)(v29 + 2) - *(_DWORD *)((char *)OldSid + 2);
                if( !v32 )
                  v32 = *(unsigned __int16 *)(v29 + 6) - *((unsigned __int16 *)OldSid + 3);
                if( !v32 )
                {
                  v33 = v9;
                  v34 = (VOID *)(v29 + 8);
                  if( !memcmp((const VOID *)(v29 + 8), (char *)OldSid + 8, v33) )
                  {
                    memmove(v34, (char *)NewSid + 8, v33);
                    ++*(_DWORD *)NumChanges;
                  }
                }
              }
            }
            goto LABEL_56;
          }
          return 0;
        }
      }
    }
  }
  return result;
}

Referenced by: