SepGetSidValuesDump

PVOID __fastcall SepGetSidValuesDump(_DWORD *a1, _DWORD *a2){
  int v2; 
  char *PoolWithTag; 
  VOID *v6; 
  unsigned __int8 *v7; 
  char *v8; 
  unsigned int i; 
  ULONG v10; 
  v2 = 0;
  *a2 = 0;
  if( !a1 )
    return 0i64;
  if( !a1[4] )
    return 0i64;
  PoolWithTag = (char *)ExAllocatePoolWithTag(PagedPool, (unsigned int)(*a1 - 24), 0x69536553ui64);
  v6 = PoolWithTag;
  if( !PoolWithTag )
    return 0i64;
  v7 = (unsigned __int8 *)(a1 + 6);
  v8 = PoolWithTag;
  for( i = 0; i < a1[4]; v8 += v10 )
  {
    v10 = 4 * v7[1] + 8;
    RtlCopySid(v10, v8, v7);
    v2 += v10;
    ++i;
    v7 += (4i64 * v7[1] + 11) & 0xFFFFFFFCi64;
  }
  *a2 = v2;
  return v6;
}

Referenced by: