SeMaximumAuditMask

VOID __stdcall SeMaximumAuditMask(_ACL *Sacl, UINT64 GrantedAccess, VOID *Token, UINT64 *pAuditMask){
  int v6; 
  _ACL *v8; 
  __int64 AceCount; 
  unsigned __int8 Sbz1; 
  int v11; 

  *(_DWORD *)pAuditMask = 0;
  v6 = GrantedAccess;
  if( Sacl )
  {
    if( Sacl->AceCount )
    {
      v8 = Sacl + 1;
      AceCount = Sacl->AceCount;
      do
      {
        Sbz1 = v8->Sbz1;
        if( (Sbz1 & 8) == 0 && (v8->AclRevision == 2 || v8->AclRevision == 13) )
        {
          v11 = v6 & *(_DWORD *)&v8->AceCount;
          if( ((Sbz1 >> 6) & (v11 != 0)) != 0 )
          {
            if( SepSidInToken(Token, 0i64, &v8[1], 1u, 0, 0) )
              *(_DWORD *)pAuditMask |= v11;
          }
        }
        v8 = (_ACL *)((char *)v8 + v8->AclSize);
        --AceCount;
      }
      while( AceCount );
    }
  }
}

Referenced by:

SeMaximumAuditMaskFromGlobalSacl
SeOpenObjectAuditAlarmWithTransaction
SeSecurityDescriptorChangedAuditAlarm