SeCheckAuditPrivilege

UINT8 __stdcall SeCheckAuditPrivilege(_SECURITY_SUBJECT_CONTEXT *SubjectSecurityContext, CHAR PreviousMode){
  _TOKEN *PrimaryToken; 
  UINT8 v5; 
  UINT8 v6; 
  PRIVILEGE_SET Privileges; 

  Privileges.PrivilegeCount = 1;
  PrimaryToken = (_TOKEN *)SubjectSecurityContext->PrimaryToken;
  Privileges.Control = 1;
  Privileges.Privilege[0].Luid = (_LUID)SeAuditPrivilege;
  Privileges.Privilege[0].Attributes = 0;
  v5 = SepPrivilegeCheck(PrimaryToken, Privileges.Privilege, 1ui64, 1ui64, PreviousMode);
  v6 = v5;
  if( PreviousMode )
    SePrivilegedServiceAuditAlarm(0i64, SubjectSecurityContext, &Privileges, v5);
  return v6;
}

Referenced by: