SepAdtLogAuditFailureEvent

NTSTATUS __stdcall SepAdtLogAuditFailureEvent(UINT64 AuditStatus, UINT8 bSynchronous){
  unsigned __int64 v3; 
  unsigned __int32 v4; 
  unsigned __int8 *v5; 
  unsigned __int64 v6; 
  _SE_ADT_PARAMETER_ARRAY AuditParameters; 

  v3 = (unsigned int)AuditStatus;
  memset(&AuditParameters, 0i64, sizeof(AuditParameters));
  if( !SepAdtAuditFailureEventLogged || bSynchronous || *(&stru_140CF2E80 + 1957) >= 0x32u )
  {
    SepAdtAuditFailureEventLogged = 1;
    v4 = _InterlockedExchange((_DWORD *)&stru_140CF2E80 + 1957, 0);
    v5 = (unsigned __int8 *)SeLocalSystemSid;
    AuditParameters.CategoryId = 1;
    *(_DWORD *)&AuditParameters.FlatSubCategoryId = 524390;
    AuditParameters.AuditId = 521;
    AuditParameters.Flags = 2;
    if( bSynchronous )
    {
      AuditParameters.Flags = 18;
LABEL_7:
      AuditParameters.Parameters[AuditParameters.ParameterCount].Type = SeAdtParmTypeSid;
      AuditParameters.Parameters[AuditParameters.ParameterCount].Length = 4 * v5[1] + 8;
      AuditParameters.Parameters[AuditParameters.ParameterCount++].Address = v5;
      AuditParameters.Parameters[AuditParameters.ParameterCount].Type = SeAdtParmTypeString;
      AuditParameters.Parameters[AuditParameters.ParameterCount].Length = 32;
      AuditParameters.Parameters[AuditParameters.ParameterCount++].Address = (void *)&SeSubsystemName;
      AuditParameters.Parameters[AuditParameters.ParameterCount].Type = SeAdtParmTypeHexUlong;
      AuditParameters.Parameters[AuditParameters.ParameterCount].Length = 4;
      AuditParameters.Parameters[AuditParameters.ParameterCount++].Data[0] = v3;
      AuditParameters.Parameters[AuditParameters.ParameterCount].Type = SeAdtParmTypeUlong;
      v6 = (unsigned __int8)SepCrashOnAuditFail;
      AuditParameters.Parameters[AuditParameters.ParameterCount].Length = 1;
      AuditParameters.Parameters[AuditParameters.ParameterCount++].Data[0] = v6;
      AuditParameters.Parameters[AuditParameters.ParameterCount].Type = SeAdtParmTypeUlong;
      AuditParameters.Parameters[AuditParameters.ParameterCount].Length = 4;
      AuditParameters.Parameters[AuditParameters.ParameterCount++].Data[0] = v4;
      SepAdtLogAuditRecord(&AuditParameters);
      return 0;
    }
    if( v4 )
      goto LABEL_7;
  }
  return 0;
}

Referenced by: