SeAuditingFileOrGlobalEvents

UINT8 __stdcall SeAuditingFileOrGlobalEvents(
        UINT8 AccessGranted,
        PVOID SecurityDescriptor,
        SECURITY_SUBJECT_CONTEXT *SubjectSecurityContext){
  UINT8 v5; 
  __int16 v7; 
  __int64 v8; 
  char *v9; 
  UNICODE_STRING v11; 
  __int64 v12; 
  v5 = 0;
  v12 = 0i64;
  v11 = 0i64;
  RtlInitUnicodeString(&v11, L"File", (WCHAR)SubjectSecurityContext);
  if( (unsigned int)SepRmGlobalSaclFind(&v12, 0i64, &v11, 1) != -1073741772 )
    goto LABEL_9;
  v7 = *((_WORD *)SecurityDescriptor + 1);
  if( (v7 & 0x10) == 0 )
    return 0;
  if( v7 < 0 )
  {
    v8 = *((unsigned int *)SecurityDescriptor + 3);
    if( (_DWORD)v8 )
    {
      v9 = (char *)SecurityDescriptor + v8;
      goto LABEL_7;
    }
    return 0;
  }
  v9 = (char *)*((_QWORD *)SecurityDescriptor + 3);
LABEL_7:
  if( !v9 )
    return 0;
LABEL_9:
  if( SepAdtAuditThisEventWithContext(0x74ui64, AccessGranted, AccessGranted == 0, SubjectSecurityContext)
    || SepAdtAuditThisEventWithContext(0x81ui64, AccessGranted, AccessGranted == 0, SubjectSecurityContext)
    || SepAdtAuditThisEventWithContext(3ui64, AccessGranted, AccessGranted == 0, SubjectSecurityContext) )
  {
    return 1;
  }
  return v5;
}

Referenced by: