SepAdtOpenRegAndSetupNotification
NTSTATUS __stdcall SepAdtOpenRegAndSetupNotification(
const WCHAR *ValueName,
_WORK_QUEUE_ITEM *pWorkItem,
VOID *NotificationCallback,
VOID *a4,
VOID **pHandle){
NTSTATUS result;
result = SepRegOpenKey(
(WCHAR *)L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Lsa",
0x211ui64,
(VOID **)&SepAdtRegNotifyHandle);
if( result >= 0 )
{
*(&stru_140CF2E80 + 654) = SepAdtRegNotificationCallback;
*(&stru_140CF2E80 + 655) = 0i64;
*(&stru_140CF2E80 + 652) = 0i64;
return NtNotifyChangeKey(
SepAdtRegNotifyHandle,
0,
(PIO_APC_ROUTINE)((char *)&stru_140CF2E80 + 5216),
(PVOID)1,
(PIO_STATUS_BLOCK)&stru_140CF2E80 + 325,
5u,
0,
0i64,
0,
1u);
}
return result;
}Referenced by:
SepAdtInitializeAuditingOptions