RtlGetSaclSecurityDescriptor

NTSTATUS __stdcall RtlGetSaclSecurityDescriptor(
        VOID *SecurityDescriptor,
        UINT8 *SaclPresent,
        _ACL **Sacl,
        UINT8 *SaclDefaulted){
  __int16 v5; 
  _ACL *v6; 
  __int16 v8; 
  __int64 v9; 

  if( *(_BYTE *)SecurityDescriptor != 1 )
    return -1073741736;
  v5 = *((_WORD *)SecurityDescriptor + 1) & 0x10;
  *SaclPresent = v5 != 0;
  v6 = 0i64;
  if( v5 )
  {
    v8 = *((_WORD *)SecurityDescriptor + 1);
    if( (v8 & 0x10) != 0 )
    {
      if( v8 >= 0 )
      {
        v6 = (_ACL *)*((_QWORD *)SecurityDescriptor + 3);
      }
      else
      {
        v9 = *((unsigned int *)SecurityDescriptor + 3);
        if( (_DWORD)v9 )
          v6 = (_ACL *)((char *)SecurityDescriptor + v9);
      }
    }
    *Sacl = v6;
    *SaclDefaulted = (*((_BYTE *)SecurityDescriptor + 2) & 0x20) != 0;
  }
  return 0;
}

Referenced by:

AdtpBuildContextFromSecurityDescriptor
CmpCopySaclToVirtualKey
CmpExamineSaclForAuditEvent
ExpWnfSpecializeSecurityDescriptor
IopGetSecurityDescriptorInformation
LocalConvertSDToStringSD_Rev1
NtSetSecurityObject
PipChangeDeviceObjectFromRegistryProperties
RtlReplaceSidInSd
SepSDContainsAttributeACE