SeCheckAuditPrivilege

UINT8 __stdcall SeCheckAuditPrivilege(_SECURITY_SUBJECT_CONTEXT *SubjectSecurityContext, CHAR PreviousMode){
  void *PrimaryToken; 
  CHAR v5; 
  INT64 v6; 
  UINT8 v7; 
  PRIVILEGE_SET Privileges; 
  Privileges.PrivilegeCount = 1;
  PrimaryToken = SubjectSecurityContext->PrimaryToken;
  Privileges.Control = 1;
  Privileges.Privilege[0].Luid = (_LUID)SeAuditPrivilege;
  Privileges.Privilege[0].Attributes = 0;
  v5 = SepPrivilegeCheck((INT64)PrimaryToken, (INT64)Privileges.Privilege, 1ui64, 1, PreviousMode);
  v7 = v5;
  if( PreviousMode )
  {
    LOBYTE(v6) = v5;
    SePrivilegedServiceAuditAlarm(0i64, SubjectSecurityContext, &Privileges, v6);
  }
  return v7;
}

Referenced by: