SeMaximumAuditMask
VOID __fastcall SeMaximumAuditMask(INT64 a1){
int v1;
void *v2;
_DWORD *v3;
_DWORD *v4;
void *v5;
int v6;
INT64 v8;
__int64 v9;
unsigned __int8 v10;
int v11;
v4 = v3;
*v3 = 0;
v5 = v2;
v6 = v1;
if( a1 )
{
if( *(_WORD *)(a1 + 4) )
{
v8 = a1 + 8;
v9 = *(unsigned __int16 *)(a1 + 4);
do
{
v10 = *(_BYTE *)(v8 + 1);
if( (v10 & 8) == 0 && (*(_BYTE *)v8 == 2 || *(_BYTE *)v8 == 13) )
{
v11 = v6 & *(_DWORD *)(v8 + 4);
if( ((v10 >> 6) & (v11 != 0)) != 0 )
{
if( SepSidInToken(v5, 0i64, (PVOID)(v8 + 8), 1u, 0, 0) )
*v4 |= v11;
}
}
v8 += *(unsigned __int16 *)(v8 + 2);
--v9;
}
while( v9 );
}
}
}Referenced by:
SeMaximumAuditMaskFromGlobalSacl
SeOpenObjectAuditAlarmWithTransaction
SeSecurityDescriptorChangedAuditAlarm