SepAdtAuditThisEventByCategoryWithContext

UINT8 __stdcall SepAdtAuditThisEventByCategoryWithContext(
        UINT64 Category,
        UINT64 AuditFlag,
        _SECURITY_SUBJECT_CONTEXT *SubjectSecurityContext){
  unsigned int v3; 
  __int64 v4; 
  char v6; 
  int v7; 
  UINT8 v8; 
  _SECURITY_SUBJECT_CONTEXT *p_SubjectContext; 
  _BYTE *ClientToken; 
  unsigned int v12; 
  __int16 v13; 
  __int16 v14; 
  unsigned int v15; 
  __m128i v16; 
  __m128i v17; 
  __int64 v18; 
  __m128i v19; 
  __m128i v20; 
  __m128i v21; 
  __m128i v22; 
  unsigned __int16 *v23; 
  __int64 v24; 
  int v25; 
  int v26; 
  unsigned int i; 
  int v28; 
  _SECURITY_SUBJECT_CONTEXT SubjectContext; 

  v3 = Category;
  v4 = (unsigned int)Category;
  v6 = AuditFlag;
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  v7 = SeAuditingStateByCategory[(unsigned int)Category];
  if( !v7 )
    return 0;
  if( (v7 & (unsigned int)AuditFlag) != 0 )
    return 1;
  v8 = 0;
  if( SepTokenPolicyCounterByCategory[(unsigned int)Category] )
  {
    if( SubjectSecurityContext )
    {
      p_SubjectContext = SubjectSecurityContext;
    }
    else
    {
      p_SubjectContext = &SubjectContext;
      SeCaptureSubjectContext((INT64)&SubjectContext);
    }
    ClientToken = p_SubjectContext->ClientToken;
    if( p_SubjectContext->ClientToken || (ClientToken = p_SubjectContext->PrimaryToken) != 0i64 )
    {
      if( ClientToken[118] == 2 )
      {
        v12 = 0;
        v13 = 0;
        v14 = 0;
        v15 = 0;
        if( v3 )
        {
          if( v3 >= 8 )
          {
            v16 = 0i64;
            v17 = 0i64;
            do
            {
              v18 = v15 + 4;
              v19 = _mm_unpacklo_epi16(_mm_loadl_epi64((const __m128i *)&AdtpPerCategoryCount[v15]), (__m128i)0i64);
              v15 += 8;
              v16 = _mm_add_epi32(v19, v16);
              v20 = _mm_add_epi32(
                      _mm_unpacklo_epi16(_mm_loadl_epi64((const __m128i *)&AdtpPerCategoryCount[v18]), (__m128i)0i64),
                      v17);
              v17 = v20;
            }
            while( v15 < (v3 & 0xFFFFFFF8) );
            v21 = _mm_add_epi32(v20, v16);
            v22 = _mm_add_epi32(v21, _mm_srli_si128(v21, 8));
            v12 = _mm_cvtsi128_si32(_mm_add_epi32(v22, _mm_srli_si128(v22, 4)));
          }
          if( v15 < v3 )
          {
            v23 = (unsigned __int16 *)(0x140000000i64 + 2i64 * v15 + 13812144);
            v24 = v3 - v15;
            do
            {
              v25 = *v23++;
              v12 += v25;
              --v24;
            }
            while( v24 );
          }
        }
        v26 = AdtpPerCategoryCount[v4];
        for( i = v12 + v26; v12 < i; ++v12 )
        {
          v28 = (unsigned __int8)ClientToken[((unsigned __int64)v12 >> 1) + 88] >> (4 * (v12 & 1));
          if( (v28 & 1) != 0 )
          {
            if( (v6 & 2) != 0 )
              goto LABEL_34;
            ++v13;
          }
          if( (v28 & 4) != 0 )
          {
            if( (v6 & 0x20) != 0 )
              goto LABEL_34;
            ++v14;
          }
        }
        if( (v6 & 1) != 0 && v13 == (_WORD)v26 || (v6 & 0x10) != 0 && v14 == (_WORD)v26 )
LABEL_34:
          v8 = 1;
      }
    }
    else
    {
      SepAuditFailed(3221225596i64);
    }
    if( !SubjectSecurityContext )
      SeReleaseSubjectContext(p_SubjectContext);
  }
  return v8;
}

Referenced by: