SeAuditingFileOrGlobalEvents

INT8 __fastcall SeAuditingFileOrGlobalEvents(INT8 a1, INT64 a2, INT64 *a3){
  INT8 v5; 
  __int16 v7; 
  __int64 v8; 
  INT64 v9; 
  _UNICODE_STRING Type; 
  _SEP_GLOBAL_SACL *Match; 

  v5 = 0;
  Match = 0i64;
  Type = 0i64;
  RtlInitUnicodeString(&Type, L"File");
  if( SepRmGlobalSaclFind(&Match, 0i64, &Type, 1u) != -1073741772 )
    goto LABEL_9;
  v7 = *(_WORD *)(a2 + 2);
  if( (v7 & 0x10) == 0 )
    return 0;
  if( v7 < 0 )
  {
    v8 = *(unsigned int *)(a2 + 12);
    if( (_DWORD)v8 )
    {
      v9 = a2 + v8;
      goto LABEL_7;
    }
    return 0;
  }
  v9 = *(_QWORD *)(a2 + 24);
LABEL_7:
  if( !v9 )
    return 0;
LABEL_9:
  if( SepAdtAuditThisEventWithContext(0x74ui64, a1, a1 == 0, (_SECURITY_SUBJECT_CONTEXT *)a3)
    || SepAdtAuditThisEventWithContext(0x81ui64, a1, a1 == 0, (_SECURITY_SUBJECT_CONTEXT *)a3)
    || SepAdtAuditThisEventWithContext(3ui64, a1, a1 == 0, (_SECURITY_SUBJECT_CONTEXT *)a3) )
  {
    return 1;
  }
  return v5;
}

Referenced by: