SeMaximumAuditMask
VOID __stdcall SeMaximumAuditMask(_ACL *Sacl, UINT64 GrantedAccess, VOID *Token, UINT64 *pAuditMask){
int v6;
_ACL *v8;
__int64 AceCount;
unsigned __int8 Sbz1;
int v11;
*(_DWORD *)pAuditMask = 0;
v6 = GrantedAccess;
if( Sacl )
{
if( Sacl->AceCount )
{
v8 = Sacl + 1;
AceCount = Sacl->AceCount;
do
{
Sbz1 = v8->Sbz1;
if( (Sbz1 & 8) == 0 && (v8->AclRevision == 2 || v8->AclRevision == 13) )
{
v11 = v6 & *(_DWORD *)&v8->AceCount;
if( ((Sbz1 >> 6) & (v11 != 0)) != 0 )
{
if( SepSidInToken(Token, 0i64, &v8[1], 1u, 0, 0) )
*(_DWORD *)pAuditMask |= v11;
}
}
v8 = (_ACL *)((char *)v8 + v8->AclSize);
--AceCount;
}
while( AceCount );
}
}
}Referenced by:
SeMaximumAuditMaskFromGlobalSacl
SeOpenObjectAuditAlarmWithTransaction
SeSecurityDescriptorChangedAuditAlarm