SepAdtOpenRegAndSetupNotification
INT64 __stdcall SepAdtOpenRegAndSetupNotification(){
INT64 result;
BOOL Asynchroneous;
BOOL WatchSubtree;
LODWORD(result) = SepRegOpenKey(
(PWCHAR)L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa",
0x211ui64,
&SepAdtRegNotifyHandle);
if( (int)result >= 0 )
{
LOBYTE(WatchSubtree) = 1;
LOBYTE(Asynchroneous) = 0;
qword_140CF42F0 = (__int64)SepAdtRegNotificationCallback;
qword_140CF42F8 = 0i64;
*(_QWORD *)SepAdtLsaRegWatchWorkItem = 0i64;
LODWORD(result) = NtNotifyChangeKey(
SepAdtRegNotifyHandle,
0i64,
SepAdtLsaRegWatchWorkItem,
(PVOID)1,
&SepAdtIoStatusBlock,
5u,
Asynchroneous,
0i64,
0,
WatchSubtree);
}
return result;
}Referenced by:
SepAdtInitializeAuditingOptions