SeAuditBootConfiguration

void __fastcall SeAuditBootConfiguration(__int64 a1){
  _QWORD *PrimaryToken; 
  void *ClientToken; 
  WCHAR v4; 
  unsigned __int16 Length; 
  ULONG_PTR v6; 
  ULONG_PTR v7; 
  ULONG_PTR v8; 
  ULONG_PTR v9; 
  ULONG_PTR v10; 
  WCHAR v11; 
  __int16 v12; 
  unsigned __int16 v13; 
  ULONG_PTR v14; 
  struct _UNICODE_STRING DestinationString; 
  struct _UNICODE_STRING v16; 
  struct _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  _SE_ADT_PARAMETER_ARRAY Src; 
  SubjectContext.ImpersonationLevel = 0x80000000;
  memset(&SubjectContext.ImpersonationLevel + 1, 0, 20);
  SubjectContext.ClientToken = 0i64;
  memset((INT64)&Src, 0i64);
  Src.CategoryId = 6;
  DestinationString = 0i64;
  *(_DWORD *)&Src.FlatSubCategoryId = 524432;
  v16 = 0i64;
  Src.AuditId = 4826;
  SeCaptureSubjectContext(&SubjectContext);
  PrimaryToken = SubjectContext.PrimaryToken;
  ClientToken = SubjectContext.PrimaryToken;
  Src.Parameters[0].Type = SeAdtParmTypeSid;
  if( SubjectContext.ClientToken )
    ClientToken = SubjectContext.ClientToken;
  Src.Parameters[1].Type = SeAdtParmTypeString;
  if( SubjectContext.ClientToken )
    PrimaryToken = SubjectContext.ClientToken;
  Src.Parameters[1].Length = 32;
  Src.Parameters[2].Type = SeAdtParmTypeLogonId;
  Src.Parameters[2].Length = 8;
  Src.Parameters[0].Address = (PVOID)**((_QWORD **)ClientToken + 19);
  Src.Parameters[0].Length = 4 * *((unsigned __int8 *)Src.Parameters[0].Address + 1) + 8;
  Src.Parameters[1].Address = &SeSubsystemName;
  Src.Parameters[2].Data[0] = PrimaryToken[3];
  if( (int)BcdUtilGetBootOptionString(a1, 0x12000030ui64) >= 0 && (Length = DestinationString.Length) != 0 )
  {
    if( DestinationString.Length == DestinationString.MaximumLength )
    {
      Length = DestinationString.Length - 2;
      DestinationString.Length -= 2;
    }
  }
  else
  {
    RtlInitUnicodeString(&DestinationString, L"-", v4);
    Length = DestinationString.Length;
  }
  Src.Parameters[3].Type = SeAdtParmTypeString;
  Src.Parameters[3].Length = Length + 16;
  Src.Parameters[3].Address = &DestinationString;
  BcdUtilGetBootOptionBoolean(a1, 0x16000040ui64);
  Src.Parameters[4].Length = 4;
  Src.Parameters[4].Type = SeAdtParmTypeMessage;
  Src.Parameters[4].Data[0] = 1843i64;
  BcdUtilGetBootOptionInteger(a1, 0x15000047ui64);
  Src.Parameters[5].Type = SeAdtParmTypeMessage;
  Src.Parameters[5].Length = 4;
  Src.Parameters[5].Data[0] = 1846i64;
  BcdUtilGetBootOptionBoolean(a1, 0x26000141ui64);
  Src.Parameters[6].Type = SeAdtParmTypeMessage;
  Src.Parameters[6].Length = 4;
  Src.Parameters[6].Data[0] = v6;
  BcdUtilGetBootOptionBoolean(a1, 0x260000A0ui64);
  Src.Parameters[7].Type = SeAdtParmTypeMessage;
  Src.Parameters[7].Length = 4;
  Src.Parameters[7].Data[0] = v7;
  BcdUtilGetBootOptionInteger(a1, 0x25000142ui64);
  Src.Parameters[8].Type = SeAdtParmTypeMessage;
  Src.Parameters[8].Length = 4;
  Src.Parameters[8].Data[0] = 1848i64;
  BcdUtilGetBootOptionBoolean(a1, 0x16000049ui64);
  Src.Parameters[9].Type = SeAdtParmTypeMessage;
  Src.Parameters[9].Length = 4;
  Src.Parameters[9].Data[0] = v8;
  BcdUtilGetBootOptionBoolean(a1, 0x1600007Eui64);
  Src.Parameters[10].Type = SeAdtParmTypeMessage;
  Src.Parameters[10].Length = 4;
  Src.Parameters[10].Data[0] = v9;
  BcdUtilGetBootOptionBoolean(a1, 0x16000048ui64);
  Src.Parameters[11].Type = SeAdtParmTypeMessage;
  Src.Parameters[11].Length = 4;
  Src.Parameters[11].Data[0] = v10;
  if( (int)BcdUtilGetBootOptionString(a1, 0x22000117ui64) >= 0 && (v13 = v16.Length) != 0 )
  {
    if( v16.Length == v16.MaximumLength )
      DestinationString.Length = v12 - 2;
  }
  else
  {
    RtlInitUnicodeString(&v16, L"-", v11);
    v13 = v16.Length;
  }
  Src.Parameters[12].Type = SeAdtParmTypeString;
  Src.Parameters[12].Length = v13 + 16;
  Src.Parameters[12].Address = &v16;
  BcdUtilGetBootOptionInteger(a1, 0x250000F0ui64);
  Src.Parameters[13].Type = SeAdtParmTypeMessage;
  Src.Parameters[13].Length = 4;
  Src.Parameters[13].Data[0] = 1848i64;
  BcdUtilGetBootOptionBoolean(a1, 0x260000F2ui64);
  Src.Parameters[14].Type = SeAdtParmTypeMessage;
  Src.Parameters[14].Length = 4;
  Src.ParameterCount = 15;
  Src.Parameters[14].Data[0] = v14;
  SepAdtLogAuditRecord(&Src);
  SeReleaseSubjectContext(&SubjectContext);
}

Referenced by: