SepAdtAuditThisEventWithContext

UINT8 __stdcall SepAdtAuditThisEventWithContext(
        UINT64 CategoryOrSubcategory,
        UINT8 AccessGranted,
        UINT8 AccessDenied,
        _SECURITY_SUBJECT_CONTEXT *SubjectSecurityContext){
  __int64 v7; 
  UINT8 v8; 
  _BOOL8 v10; 
  UINT64 v11; 
  _SECURITY_SUBJECT_CONTEXT *p_SubjectContext; 
  VOID *ClientToken; 
  _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  UINT8 GenerateAudit; 

  memset(&SubjectContext, 0, sizeof(SubjectContext));
  if( (unsigned int)CategoryOrSubcategory <= 8 )
  {
    v10 = AccessGranted != 0;
    v11 = (AccessGranted != 0) | 0x10u;
    if( !AccessDenied )
      v11 = v10;
    return SepAdtAuditThisEventByCategoryWithContext(CategoryOrSubcategory, v11, SubjectSecurityContext);
  }
  else
  {
    v7 = (unsigned int)(CategoryOrSubcategory - 100);
    GenerateAudit = SepAuditingEnabledForSubcategory(CategoryOrSubcategory, AccessGranted, AccessDenied);
    v8 = GenerateAudit;
    if( SepTokenPolicyCounter[v7] )
    {
      if( SubjectSecurityContext )
      {
        p_SubjectContext = SubjectSecurityContext;
      }
      else
      {
        p_SubjectContext = &SubjectContext;
        SeCaptureSubjectContext((INT64)&SubjectContext);
      }
      ClientToken = p_SubjectContext->ClientToken;
      if( p_SubjectContext->ClientToken || (ClientToken = p_SubjectContext->PrimaryToken) != 0i64 )
      {
        SepAdtIncorporatePerUserPolicy((unsigned int)v7, AccessGranted, AccessDenied, ClientToken, &GenerateAudit);
        v8 = GenerateAudit;
      }
      else
      {
        SepAuditFailed(3221225596i64);
      }
      if( !SubjectSecurityContext )
        SeReleaseSubjectContext(p_SubjectContext);
    }
    return v8;
  }
}

Referenced by: