SepRmSetAuditEventWrkr

VOID __stdcall SepRmSetAuditEventWrkr(_RM_COMMAND_MESSAGE *CommandMessage, _RM_REPLY_MESSAGE *ReplyMessage){
  unsigned int v3; 
  int *v4; 
  unsigned __int16 *v5; 
  __int64 v6; 
  unsigned __int16 v7; 
  __int16 v8; 
  __int16 v9; 
  __int64 v10; 
  __int16 v11; 
  int v12; 
  int v13; 
  int v14; 

  v3 = 0;
  ReplyMessage[10] = 0;
  if( !PsIsCurrentThreadInServerSilo() )
  {
    v4 = SeAuditingStateByCategory;
    v5 = AdtpPerCategoryCount;
    v6 = 9i64;
    do
    {
      v7 = *v5;
      v8 = 0;
      v9 = 0;
      if( !*v5 )
        goto LABEL_11;
      v10 = *v5;
      do
      {
        *(_WORD *)&SeAuditingState[2 * v3] = 0;
        v11 = *((_WORD *)CommandMessage + v3 + 22);
        if( (v11 & 1) != 0 )
        {
          SeAuditingState[2 * v3] = 1;
          ++v8;
          v11 = *((_WORD *)CommandMessage + v3 + 22);
        }
        if( (v11 & 2) != 0 )
        {
          SeAuditingState[2 * v3 + 1] = 1;
          ++v9;
        }
        ++v3;
        --v10;
      }
      while( v10 );
      if( v8 )
      {
        if( v8 == v7 )
        {
          v12 = 33;
          v13 = 17;
          v14 = 65;
        }
        else
        {
          v12 = 34;
          v13 = 18;
          v14 = 66;
        }
      }
      else
      {
LABEL_11:
        v12 = 36;
        v13 = 20;
        v14 = 68;
      }
      if( v9 )
      {
        v14 = v12;
        if( v9 == v7 )
          v14 = v13;
      }
      *v4 = v14;
      ++v5;
      ++v4;
      --v6;
    }
    while( v6 );
    SepRmAuditingEnabled = 1;
  }
}

Referenced by: