SepFilterPrivilegeAudits
UINT8 __stdcall SepFilterPrivilegeAudits(UINT64 Flags, PRIVILEGE_SET *PrivilegeSet){
int v2;
char v3;
unsigned int PrivilegeCount;
_LUID_AND_ATTRIBUTES *Privilege;
__int64 v6;
__int64 **v7;
_DWORD *v8;
_LUID_AND_ATTRIBUTES *v9;
__int64 v10;
_LUID **v11;
_LUID *v12;
v2 = 0;
v3 = Flags;
if( !PrivilegeSet )
return 0;
PrivilegeCount = PrivilegeSet->PrivilegeCount;
if( !PrivilegeSet->PrivilegeCount )
return 0;
Privilege = PrivilegeSet->Privilege;
v6 = PrivilegeCount;
do
{
v7 = SepFilterPrivileges;
v8 = *SepFilterPrivileges;
while( Privilege->Luid.LowPart != *v8 || Privilege->Luid.HighPart != v8[1] )
{
v8 = *++v7;
if( !*v7 )
goto LABEL_10;
}
++v2;
LABEL_10:
++Privilege;
--v6;
}
while( v6 );
if( (v3 & 1) != 0 && PrivilegeCount )
{
v9 = PrivilegeSet->Privilege;
v10 = PrivilegeSet->PrivilegeCount;
do
{
v11 = &SepServicesFilterPrivileges;
v12 = SepServicesFilterPrivileges;
while( v9->Luid.LowPart != v12->LowPart || v9->Luid.HighPart != v12->HighPart )
{
v12 = *++v11;
if( !*v11 )
goto LABEL_17;
}
++v2;
LABEL_17:
++v9;
--v10;
}
while( v10 );
}
return v2 != PrivilegeCount;
}Referenced by:
PfQuerySuperfetchInformation
SePrivilegedServiceAuditAlarm
SepAdtAuditPrivilegeUseWithContext