SepHasCriticalAcesRemoved

NTSTATUS __stdcall SepHasCriticalAcesRemoved(VOID *SecurityDescriptor, VOID *a2, _BYTE *a3, _BYTE *a4){
  __int64 AclSize; 
  PACL v9; 
  PACL v10; 
  PACL v11; 
  unsigned int v12; 
  bool v13; 
  _ACL *v14; 
  unsigned int v15; 
  PACL v16; 
  unsigned int i; 
  unsigned __int16 Control[2]; 
  __int16 v20; 
  unsigned int v21; 
  unsigned int Revision; 
  PACL Dacl; 
  PACL v24; 
  unsigned __int8 DaclPresent; 
  __int16 DaclDefaulted; 

  Dacl = 0i64;
  v24 = 0i64;
  DaclPresent = 0;
  Control[0] = 0;
  *a3 = 0;
  if( a4 )
    *a4 = 0;
  LODWORD(AclSize) = RtlGetDaclSecurityDescriptor(SecurityDescriptor, &DaclPresent, &Dacl, (UINT8 *)&DaclDefaulted);
  if( (int)AclSize >= 0 )
  {
    if( DaclPresent )
    {
      v9 = Dacl;
      if( Dacl )
      {
        LODWORD(AclSize) = RtlGetControlSecurityDescriptor(SecurityDescriptor, Control, (UINT64 *)&Revision);
        if( (int)AclSize >= 0 )
        {
          DaclPresent = 0;
          v20 = Control[0] & 0x400;
          RtlGetDaclSecurityDescriptor(a2, &DaclPresent, &v24, (UINT8 *)&DaclDefaulted);
          RtlGetControlSecurityDescriptor(a2, Control, (UINT64 *)&Revision);
          v10 = v9 + 1;
          Revision = 0;
          LODWORD(AclSize) = v9->AceCount;
          DaclDefaulted = Control[0] & 0x400;
          Control[0] &= 0x1000u;
          v21 = AclSize;
          if( (_DWORD)AclSize )
          {
            v11 = v24;
            v12 = AclSize;
            while( 1 )
            {
              if( v10->AclRevision <= 3u )
              {
                v13 = (v10->Sbz1 & 0x20) == 0;
                v14 = v10 + 1;
                LODWORD(AclSize) = *(_DWORD *)&v10->AceCount;
                LODWORD(Dacl) = AclSize;
                if( !v13 )
                  break;
              }
LABEL_11:
              v10 = (PACL)((char *)v10 + v10->AclSize);
              LODWORD(AclSize) = Revision + 1;
              Revision = AclSize;
              if( (unsigned int)AclSize >= v12 )
                return AclSize;
            }
            if( DaclPresent )
            {
              if( v11 )
              {
                v15 = 0;
                v16 = v11 + 1;
                for( i = v11->AceCount; v15 < i; v16 = (PACL)((char *)v16 + AclSize) )
                {
                  if( v16->AclRevision <= 3u && (v16->Sbz1 & 0x20) != 0 )
                  {
                    if( RtlEqualSid(&v16[1], v14) && *(_DWORD *)&v16->AceCount == (_DWORD)Dacl )
                    {
                      v12 = v21;
                      goto LABEL_11;
                    }
                    v14 = v10 + 1;
                  }
                  AclSize = v16->AclSize;
                  ++v15;
                }
              }
            }
            *a3 = 1;
            if( a4 && v20 && Control[0] && DaclDefaulted )
              *a4 = 1;
          }
        }
      }
    }
  }
  return AclSize;
}

Referenced by: