SepReadSingleCap

__int64 __fastcall SepReadSingleCap(HANDLE KeyHandle, int a2, int a3, __int64 a4, __int64 a5){
  ULONG Length; 
  unsigned int *PoolWithTag; 
  NTSTATUS v8; 
  __int64 v9; 
  int v10; 
  UINT64 v11; 
  char *v12; 
  char *v13; 
  unsigned int *v14; 
  unsigned __int64 v15; 
  __int16 v16; 
  UINT8 *v17; 
  unsigned int v18; 
  unsigned int v19; 
  _QWORD *v20; 
  __int64 v21; 
  __int64 v22; 
  UINT8 *v24; 
  ULONG ResultLength; 
  int v26; 
  __int64 v27; 
  v27 = a4;
  v26 = a3;
  ResultLength = 0;
  Length = a2 + 18;
  PoolWithTag = (unsigned int *)ExAllocatePoolWithTag(PagedPool, (unsigned int)(a2 + 18), 0x70536553ui64);
  if( PoolWithTag )
  {
    v8 = ZwQueryValueKey(KeyHandle, &ContainedCapes, KeyValuePartialInformation, PoolWithTag, Length, &ResultLength);
    if( v8 < 0 )
      goto LABEL_24;
    v9 = PoolWithTag[2] != 0 ? PoolWithTag[2] >> 2 : 0;
    v8 = ZwQueryValueKey(KeyHandle, &CapeName, KeyValuePartialInformation, PoolWithTag, Length, &ResultLength);
    if( v8 < 0 )
      goto LABEL_24;
    v10 = PoolWithTag[2] + ((8 * v9 + 73) & 0xFFFFFFFE);
    v8 = ZwQueryValueKey(KeyHandle, &CapSid, KeyValuePartialInformation, PoolWithTag, Length, &ResultLength);
    if( v8 < 0 )
      goto LABEL_24;
    v11 = PoolWithTag[2] + v10;
    v12 = (char *)ExAllocatePoolWithTag(PagedPool, v11, 0x70536553ui64);
    v13 = v12;
    if( v12 )
    {
      v24 = (UINT8 *)&v12[v11];
      v8 = ZwQueryValueKey(KeyHandle, &CapeFlags, KeyValuePartialInformation, PoolWithTag, Length, &ResultLength);
      if( v8 >= 0 )
      {
        if( PoolWithTag[2] == 4 )
        {
          v14 = PoolWithTag + 3;
          *((_DWORD *)v13 + 14) = PoolWithTag[3];
          v8 = ZwQueryValueKey(KeyHandle, &CapeName, KeyValuePartialInformation, PoolWithTag, Length, &ResultLength);
          if( v8 >= 0 )
          {
            v15 = (unsigned __int64)&v13[8 * (unsigned int)v9 + 73] & 0xFFFFFFFFFFFFFFFEui64;
            if( v15 + PoolWithTag[2] <= (unsigned __int64)v24 )
            {
              v16 = *((_WORD *)PoolWithTag + 4);
              *((_WORD *)v13 + 21) = v16;
              *((_WORD *)v13 + 20) = v16;
              *((_QWORD *)v13 + 6) = v15;
              memmove(
                (UINT8 *)((unsigned __int64)&v13[8 * v9 + 73] & 0xFFFFFFFFFFFFFFFEui64),
                (UINT8 *)PoolWithTag + 12,
                PoolWithTag[2]);
              v17 = (UINT8 *)(PoolWithTag[2] + v15);
              v8 = ZwQueryValueKey(KeyHandle, &CapSid, KeyValuePartialInformation, PoolWithTag, Length, &ResultLength);
              if( v8 < 0 )
                goto LABEL_24;
              if( &v17[PoolWithTag[2]] <= v24 )
              {
                *((_QWORD *)v13 + 3) = v17;
                memmove(v17, (UINT8 *)PoolWithTag + 12, PoolWithTag[2]);
                v8 = ZwQueryValueKey(
                       KeyHandle,
                       &ContainedCapes,
                       KeyValuePartialInformation,
                       PoolWithTag,
                       Length,
                       &ResultLength);
                if( v8 < 0 )
                  goto LABEL_24;
                v18 = 0;
                *((_DWORD *)v13 + 15) = v9;
                if( !(_DWORD)v9 )
                {
LABEL_21:
                  if( RtlValidSid(*((PVOID *)v13 + 3)) )
                    *(_QWORD *)a5 = v13;
                  else
                    v8 = -1073741704;
                  goto LABEL_24;
                }
                v19 = v26;
                v20 = v13 + 64;
                v21 = v27;
                while( 1 )
                {
                  v22 = *v14;
                  if( (unsigned int)v22 >= v19 )
                    break;
                  ++v18;
                  ++v14;
                  *v20++ = v21 + 56 * v22;
                  if( v18 >= (unsigned int)v9 )
                    goto LABEL_21;
                }
              }
            }
            v8 = -1073741789;
          }
        }
        else
        {
          v8 = -1073741811;
        }
      }
    }
    else
    {
      v8 = -1073741670;
    }
LABEL_24:
    ExFreePoolWithTag(PoolWithTag, 0x70536553u);
    return(unsigned int)v8;
  }
  return(unsigned int)-1073741670;
}

Referenced by: