SepAdtIncorporatePerUserPolicy

VOID __stdcall SepAdtIncorporatePerUserPolicy(
        UINT64 Subcategory,
        UINT8 AccessGranted,
        UINT8 AccessDenied,
        VOID *AccessToken,
        UINT8 *GenerateAudit){
  int v5; 

  if( *((_BYTE *)AccessToken + 118) == 2 )
  {
    v5 = (*((unsigned __int8 *)AccessToken + ((unsigned __int64)(unsigned int)Subcategory >> 1) + 88) >> (4 * (Subcategory & 1))) & 0xF;
    if( v5 )
    {
      if( AccessGranted && (v5 & 1) != 0 || AccessDenied && (v5 & 4) != 0 )
      {
        *GenerateAudit = 1;
      }
      else if( AccessGranted && (v5 & 2) != 0 || AccessDenied && (v5 & 8) != 0 )
      {
        *GenerateAudit = 0;
      }
    }
  }
}

Referenced by:

SeAuditingWithTokenForSubcategory
SepAdtAuditPrivilegeUseWithContext
SepAdtAuditThisEventWithContext