SePrivilegedServiceAuditAlarm

VOID __stdcall SePrivilegedServiceAuditAlarm(
        _UNICODE_STRING *ServiceName,
        _SECURITY_SUBJECT_CONTEXT *SubjectSecurityContext,
        PRIVILEGE_SET *Privileges,
        UINT8 AccessGranted){
  _TOKEN *ClientToken; 
  _QWORD **PrimaryToken; 
  void *v10; 
  PSE_EXPORTS v11; 

  ClientToken = (_TOKEN *)SubjectSecurityContext->ClientToken;
  PrimaryToken = (_QWORD **)SubjectSecurityContext->ClientToken;
  if( !SubjectSecurityContext->ClientToken )
    PrimaryToken = (_QWORD **)SubjectSecurityContext->PrimaryToken;
  v10 = (void *)*PrimaryToken[19];
  if( !RtlEqualSid(SeLocalSystemSid, v10) )
  {
    if( (v11 = SeExports, !RtlEqualSid(SeExports->SeNetworkServiceSid, v10))
      && !RtlEqualSid(v11->SeLocalServiceSid, v10)
      || SepFilterPrivilegeAudits(1ui64, Privileges) )
    {
      SepAdtPrivilegedServiceAuditAlarm(
        SubjectSecurityContext,
        (_UNICODE_STRING *)&SeSubsystemName,
        ServiceName,
        ClientToken,
        (_TOKEN *)SubjectSecurityContext->PrimaryToken,
        Privileges,
        AccessGranted);
    }
  }
}

Referenced by: