SepAdtOpenRegAndSetupNotification

NTSTATUS __stdcall SepAdtOpenRegAndSetupNotification(
        const WCHAR *ValueName,
        _WORK_QUEUE_ITEM *pWorkItem,
        VOID *NotificationCallback,
        VOID *a4,
        VOID **pHandle){
  NTSTATUS result; 

  result = SepRegOpenKey(
             (WCHAR *)L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa",
             0x211ui64,
             (VOID **)&SepAdtRegNotifyHandle);
  if( result >= 0 )
  {
    *(&stru_140CF2E80 + 654) = SepAdtRegNotificationCallback;
    *(&stru_140CF2E80 + 655) = 0i64;
    *(&stru_140CF2E80 + 652) = 0i64;
    return NtNotifyChangeKey(
             SepAdtRegNotifyHandle,
             0,
             (PIO_APC_ROUTINE)((char *)&stru_140CF2E80 + 5216),
             (PVOID)1,
             (PIO_STATUS_BLOCK)&stru_140CF2E80 + 325,
             5u,
             0,
             0i64,
             0,
             1u);
  }
  return result;
}

Referenced by:

SepAdtInitializeAuditingOptions