SepAdtIncorporatePerUserPolicy
VOID __stdcall SepAdtIncorporatePerUserPolicy(
UINT64 Subcategory,
UINT8 AccessGranted,
UINT8 AccessDenied,
VOID *AccessToken,
UINT8 *GenerateAudit){
int v5;
if( *((_BYTE *)AccessToken + 118) == 2 )
{
v5 = (*((unsigned __int8 *)AccessToken + ((unsigned __int64)(unsigned int)Subcategory >> 1) + 88) >> (4 * (Subcategory & 1))) & 0xF;
if( v5 )
{
if( AccessGranted && (v5 & 1) != 0 || AccessDenied && (v5 & 4) != 0 )
{
*GenerateAudit = 1;
}
else if( AccessGranted && (v5 & 2) != 0 || AccessDenied && (v5 & 8) != 0 )
{
*GenerateAudit = 0;
}
}
}
}Referenced by:
SeAuditingWithTokenForSubcategory
SepAdtAuditPrivilegeUseWithContext
SepAdtAuditThisEventWithContext