SepAdtAuditPrivilegeUseWithContext

INT64 __fastcall SepAdtAuditPrivilegeUseWithContext(
        PRIVILEGE_SET *PrivilegeSet,
        INT64 AccessGranted,
        INT64 AccessDenied,
        SECURITY_SUBJECT_CONTEXT *SubjectSecurityContext,
        UINT16 *FlatSubCategoryId){
  UINT8 v7; 
  UINT8 v8; 
  UINT8 v9; 
  INT64 result; 
  char v11; 
  SECURITY_SUBJECT_CONTEXT *p_SubjectContext; 
  void *ClientToken; 
  SECURITY_SUBJECT_CONTEXT *v14; 
  void *PrimaryToken; 
  UINT8 GenerateAudit; 
  UINT8 AtleastOneSensitivePrivilege; 
  char AtleastOneNonSensitivePrivilege[6]; 
  struct _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  AtleastOneSensitivePrivilege = 0;
  AtleastOneNonSensitivePrivilege[0] = 0;
  v7 = AccessDenied;
  v8 = AccessGranted;
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  v9 = SepAuditingEnabledForSubcategory(0x82ui64, AccessGranted, AccessDenied);
  GenerateAudit = v9;
  if( dword_140C1D4D8 )
  {
    if( SubjectSecurityContext )
    {
      p_SubjectContext = SubjectSecurityContext;
    }
    else
    {
      p_SubjectContext = &SubjectContext;
      SeCaptureSubjectContext(&SubjectContext);
    }
    ClientToken = p_SubjectContext->ClientToken;
    if( p_SubjectContext->ClientToken || (ClientToken = p_SubjectContext->PrimaryToken) != 0i64 )
    {
      SepAdtIncorporatePerUserPolicy(0x1Eui64, v8, v7, ClientToken, &GenerateAudit);
      v9 = GenerateAudit;
    }
    else
    {
      SepAuditFailed(3221225596i64);
    }
    if( !SubjectSecurityContext )
      SeReleaseSubjectContext(p_SubjectContext);
  }
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  LODWORD(result) = SepAuditingEnabledForSubcategory(0x83ui64, v8, v7);
  v11 = result;
  GenerateAudit = result;
  if( dword_140C1D4DC )
  {
    if( SubjectSecurityContext )
    {
      v14 = SubjectSecurityContext;
    }
    else
    {
      v14 = &SubjectContext;
      SeCaptureSubjectContext(&SubjectContext);
    }
    PrimaryToken = v14->ClientToken;
    if( v14->ClientToken || (PrimaryToken = v14->PrimaryToken) != 0i64 )
    {
      SepAdtIncorporatePerUserPolicy(0x1Fui64, v8, v7, PrimaryToken, &GenerateAudit);
      v11 = GenerateAudit;
    }
    else
    {
      SepAuditFailed(3221225596i64);
    }
    if( !SubjectSecurityContext )
      SeReleaseSubjectContext(v14);
  }
  if( !v9 && !v11 || !SepFilterPrivilegeAudits(0i64, PrivilegeSet) )
    goto LABEL_5;
  if( v9 && v11 && PrivilegeSet && PrivilegeSet->PrivilegeCount
    || (SepAdtCheckPrivilegeForSensitivity(
          PrivilegeSet,
          &AtleastOneSensitivePrivilege,
          (UINT8 *)AtleastOneNonSensitivePrivilege),
        v9)
    && AtleastOneSensitivePrivilege )
  {
    LOBYTE(result) = 1;
    *FlatSubCategoryId = 130;
    return result;
  }
  if( !v11 || !AtleastOneNonSensitivePrivilege[0] )
  {
LABEL_5:
    LOBYTE(result) = 0;
    return result;
  }
  LOBYTE(result) = 1;
  *FlatSubCategoryId = 131;
  return result;
}

Referenced by: