Min version
Vista
Max version
10 TH2
x86 offset
offset:bitpos
Field Name
0x0000
unsigned long
AuditMask