SepAdtOpenRegAndSetupNotification

INT64 __stdcall SepAdtOpenRegAndSetupNotification(){
  INT64 result; 
  BOOL Asynchroneous; 
  BOOL WatchSubtree; 
  LODWORD(result) = SepRegOpenKey(
                      (PWCHAR)L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa",
                      0x211ui64,
                      &SepAdtRegNotifyHandle);
  if( (int)result >= 0 )
  {
    LOBYTE(WatchSubtree) = 1;
    LOBYTE(Asynchroneous) = 0;
    qword_140CF42F0 = (__int64)SepAdtRegNotificationCallback;
    qword_140CF42F8 = 0i64;
    *(_QWORD *)SepAdtLsaRegWatchWorkItem = 0i64;
    LODWORD(result) = NtNotifyChangeKey(
                        SepAdtRegNotifyHandle,
                        0i64,
                        SepAdtLsaRegWatchWorkItem,
                        (PVOID)1,
                        &SepAdtIoStatusBlock,
                        5u,
                        Asynchroneous,
                        0i64,
                        0,
                        WatchSubtree);
  }
  return result;
}

Referenced by:

SepAdtInitializeAuditingOptions