SeMaximumAuditMask

VOID __fastcall SeMaximumAuditMask(INT64 a1){
  int v1; 
  void *v2; 
  _DWORD *v3; 
  _DWORD *v4; 
  void *v5; 
  int v6; 
  INT64 v8; 
  __int64 v9; 
  unsigned __int8 v10; 
  int v11; 
  v4 = v3;
  *v3 = 0;
  v5 = v2;
  v6 = v1;
  if( a1 )
  {
    if( *(_WORD *)(a1 + 4) )
    {
      v8 = a1 + 8;
      v9 = *(unsigned __int16 *)(a1 + 4);
      do
      {
        v10 = *(_BYTE *)(v8 + 1);
        if( (v10 & 8) == 0 && (*(_BYTE *)v8 == 2 || *(_BYTE *)v8 == 13) )
        {
          v11 = v6 & *(_DWORD *)(v8 + 4);
          if( ((v10 >> 6) & (v11 != 0)) != 0 )
          {
            if( SepSidInToken(v5, 0i64, (PVOID)(v8 + 8), 1u, 0, 0) )
              *v4 |= v11;
          }
        }
        v8 += *(unsigned __int16 *)(v8 + 2);
        --v9;
      }
      while( v9 );
    }
  }
}

Referenced by:

SeMaximumAuditMaskFromGlobalSacl
SeOpenObjectAuditAlarmWithTransaction
SeSecurityDescriptorChangedAuditAlarm