SepFilterPrivilegeAudits

UINT8 __stdcall SepFilterPrivilegeAudits(UINT64 Flags, PRIVILEGE_SET *PrivilegeSet){
  int v2; 
  char v3; 
  unsigned int PrivilegeCount; 
  _LUID_AND_ATTRIBUTES *Privilege; 
  __int64 v6; 
  __int64 **v7; 
  _DWORD *v8; 
  _LUID_AND_ATTRIBUTES *v9; 
  __int64 v10; 
  _LUID **v11; 
  _LUID *v12; 

  v2 = 0;
  v3 = Flags;
  if( !PrivilegeSet )
    return 0;
  PrivilegeCount = PrivilegeSet->PrivilegeCount;
  if( !PrivilegeSet->PrivilegeCount )
    return 0;
  Privilege = PrivilegeSet->Privilege;
  v6 = PrivilegeCount;
  do
  {
    v7 = SepFilterPrivileges;
    v8 = *SepFilterPrivileges;
    while( Privilege->Luid.LowPart != *v8 || Privilege->Luid.HighPart != v8[1] )
    {
      v8 = *++v7;
      if( !*v7 )
        goto LABEL_10;
    }
    ++v2;
LABEL_10:
    ++Privilege;
    --v6;
  }
  while( v6 );
  if( (v3 & 1) != 0 && PrivilegeCount )
  {
    v9 = PrivilegeSet->Privilege;
    v10 = PrivilegeSet->PrivilegeCount;
    do
    {
      v11 = &SepServicesFilterPrivileges;
      v12 = SepServicesFilterPrivileges;
      while( v9->Luid.LowPart != v12->LowPart || v9->Luid.HighPart != v12->HighPart )
      {
        v12 = *++v11;
        if( !*v11 )
          goto LABEL_17;
      }
      ++v2;
LABEL_17:
      ++v9;
      --v10;
    }
    while( v10 );
  }
  return v2 != PrivilegeCount;
}

Referenced by:

PfQuerySuperfetchInformation
SePrivilegedServiceAuditAlarm
SepAdtAuditPrivilegeUseWithContext