RtlGetSaclSecurityDescriptor
NTSTATUS __stdcall RtlGetSaclSecurityDescriptor(
VOID *SecurityDescriptor,
UINT8 *SaclPresent,
_ACL **Sacl,
UINT8 *SaclDefaulted){
__int16 v5;
_ACL *v6;
__int16 v8;
__int64 v9;
if( *(_BYTE *)SecurityDescriptor != 1 )
return -1073741736;
v5 = *((_WORD *)SecurityDescriptor + 1) & 0x10;
*SaclPresent = v5 != 0;
v6 = 0i64;
if( v5 )
{
v8 = *((_WORD *)SecurityDescriptor + 1);
if( (v8 & 0x10) != 0 )
{
if( v8 >= 0 )
{
v6 = (_ACL *)*((_QWORD *)SecurityDescriptor + 3);
}
else
{
v9 = *((unsigned int *)SecurityDescriptor + 3);
if( (_DWORD)v9 )
v6 = (_ACL *)((char *)SecurityDescriptor + v9);
}
}
*Sacl = v6;
*SaclDefaulted = (*((_BYTE *)SecurityDescriptor + 2) & 0x20) != 0;
}
return 0;
}Referenced by:
AdtpBuildContextFromSecurityDescriptor
CmpCopySaclToVirtualKey
CmpExamineSaclForAuditEvent
ExpWnfSpecializeSecurityDescriptor
IopGetSecurityDescriptorInformation
LocalConvertSDToStringSD_Rev1
NtSetSecurityObject
PipChangeDeviceObjectFromRegistryProperties
RtlReplaceSidInSd
SepSDContainsAttributeACE