SepAdtStagingEvent

BOOL __fastcall SepAdtStagingEvent(
        INT64 FlatSubCategoryId,
        _UNICODE_STRING *CapturedSubsystemName,
        VOID **HandleId,
        _UNICODE_STRING *CapturedObjectTypeName,
        _UNICODE_STRING *CapturedObjectName,
        _TOKEN *ClientToken,
        _TOKEN *PrimaryToken,
        UINT64 DesiredAccess,
        UINT64 GrantedAccess,
        UINT8 AccessGranted,
        VOID *ProcessID,
        _ACCESS_STATE *AccessState){
  _LUID AuthenticationId; 
  _SECURITY_DESCRIPTOR *v13; 
  _SECURITY_DESCRIPTOR *v14; 
  __int64 v15; 
  _EPROCESS *CurrentThreadProcess; 
  NTSTATUS AllocatedFullProcessImageName; 
  _SID_AND_ATTRIBUTES *UserAndGroups; 
  _LUID v19; 
  int v20; 
  int v21; 
  int v22; 
  unsigned int v23; 
  int Length; 
  UINT8 IsKernelHandle; 
  unsigned __int64 v26; 
  __int64 v27; 
  unsigned __int64 v28; 
  _SECURITY_DESCRIPTOR *v29; 
  NTSTATUS v30; 
  __int64 v31; 
  UINT64 v32; 
  VOID **PoolWithTag; 
  VOID **v34; 
  int v35; 
  __int64 ParameterCount; 
  __int64 v37; 
  __int64 v38; 
  UINT8 NeedToFree[4]; 
  UINT64 SDLength; 
  _SECURITY_DESCRIPTOR *SecurityDescriptorOut; 
  _SECURITY_DESCRIPTOR *v43; 
  _UNICODE_STRING *ImageName; 
  unsigned __int8 *Sid; 
  _UNICODE_STRING *v46; 
  VOID **v47; 
  _SE_ADT_PARAMETER_ARRAY AuditParameters; 

  v46 = CapturedObjectTypeName;
  AuthenticationId = 0i64;
  v47 = HandleId;
  v13 = 0i64;
  *(_WORD *)&NeedToFree[2] = FlatSubCategoryId;
  v14 = 0i64;
  v15 = *((_QWORD *)AccessState + 9);
  ImageName = 0i64;
  SDLength = 0i64;
  SecurityDescriptorOut = 0i64;
  v43 = 0i64;
  NeedToFree[0] = 0;
  NeedToFree[1] = 0;
  if( !v15
    || !*(_BYTE *)(v15 + 216)
    || (_WORD)FlatSubCategoryId != 116
    && (_WORD)FlatSubCategoryId != 128
    && RtlCompareUnicodeString(CapturedObjectTypeName, &SepFileTypeName, 0) )
  {
    return 1;
  }
  CurrentThreadProcess = (_EPROCESS *)PsGetCurrentThreadProcess();
  AllocatedFullProcessImageName = PsGetAllocatedFullProcessImageNameEx(CurrentThreadProcess, &ImageName);
  if( AllocatedFullProcessImageName >= 0 )
  {
    if( ClientToken )
    {
      AuthenticationId = ClientToken->AuthenticationId;
      UserAndGroups = ClientToken->UserAndGroups;
    }
    else
    {
      UserAndGroups = PrimaryToken->UserAndGroups;
    }
    v19 = PrimaryToken->AuthenticationId;
    Sid = (unsigned __int8 *)UserAndGroups->Sid;
    memset(&AuditParameters, 0i64, sizeof(AuditParameters));
    AuditParameters.CategoryId = 3;
    AuditParameters.AuditId = 4818;
    AuditParameters.FlatSubCategoryId = 129;
    v20 = 16;
    v21 = 8;
    if( (DesiredAccess & 0x2000000) != 0 || (AuditParameters.Type = 8, !AccessGranted) )
      AuditParameters.Type = 16;
    AuditParameters.Parameters[0].Address = Sid;
    AuditParameters.Parameters[0].Type = SeAdtParmTypeSid;
    AuditParameters.Parameters[1].Type = SeAdtParmTypeString;
    v22 = Sid[1];
    AuditParameters.Parameters[1].Address = (void *)&SeSubsystemName;
    AuditParameters.Parameters[2].Type = SeAdtParmTypeLogonId;
    AuditParameters.Parameters[2].Length = 8;
    AuditParameters.Parameters[2].Data[0] = (unsigned __int64)AuthenticationId;
    AuditParameters.Parameters[0].Length = 4 * v22 + 8;
    AuditParameters.Parameters[1].Length = 32;
    if( !ClientToken )
      AuditParameters.Parameters[2].Data[0] = (unsigned __int64)v19;
    AuditParameters.Parameters[3].Address = (void *)&SeSubsystemName;
    AuditParameters.Parameters[3].Type = SeAdtParmTypeString;
    AuditParameters.Parameters[3].Length = 32;
    if( v46 )
    {
      v23 = v46->Length + 16;
      AuditParameters.Parameters[4].Address = v46;
      AuditParameters.Parameters[4].Type = SeAdtParmTypeString;
      AuditParameters.Parameters[4].Length = v23;
      if( CapturedObjectName )
      {
        if( *(_WORD *)&NeedToFree[2] == 116
          || (AuditParameters.Parameters[5].Type = SeAdtParmTypeString, *(_WORD *)&NeedToFree[2] == 128) )
        {
          AuditParameters.Parameters[5].Type = SeAdtParmTypeFileSpec;
        }
        Length = CapturedObjectName->Length;
        AuditParameters.Parameters[5].Address = CapturedObjectName;
        AuditParameters.Parameters[5].Length = Length + 16;
      }
      AuditParameters.Parameters[6].Type = SeAdtParmTypePtr;
      AuditParameters.Parameters[6].Length = 8;
      if( v47 )
      {
        IsKernelHandle = ObpIsKernelHandle(*v47, 0);
        v28 = v27 ^ 0xFFFFFFFF80000000ui64;
        if( !IsKernelHandle )
          v28 = v26;
        AuditParameters.Parameters[6].Data[0] = v28 & 0xFFFFFFFFFFFFFFFCui64;
      }
      else
      {
        AuditParameters.Parameters[6].Data[0] = 0i64;
      }
      AuditParameters.Parameters[7].Data[0] = (unsigned __int64)ProcessID;
      AuditParameters.Parameters[8].Address = ImageName;
      v29 = *(_SECURITY_DESCRIPTOR **)(v15 + 56);
      AuditParameters.Parameters[8].Length = v20 + ImageName->Length;
      AuditParameters.Parameters[7].Type = SeAdtParmTypePtr;
      AuditParameters.Parameters[7].Length = 8;
      AuditParameters.Parameters[8].Type = SeAdtParmTypeFileSpec;
      AllocatedFullProcessImageName = SepCheckAndCopySelfRelativeSD(
                                        v29,
                                        &SecurityDescriptorOut,
                                        (UINT64 *)((char *)&SDLength + 4),
                                        NeedToFree);
      if( AllocatedFullProcessImageName < 0 )
      {
        v13 = SecurityDescriptorOut;
      }
      else
      {
        v30 = SepCheckAndCopySelfRelativeSD(*(_SECURITY_DESCRIPTOR **)(v15 + 64), &v43, &SDLength, &NeedToFree[1]);
        v14 = v43;
        AllocatedFullProcessImageName = v30;
        v13 = SecurityDescriptorOut;
        if( v30 >= 0 )
        {
          if( !SecurityDescriptorOut && !v43 )
            v21 = 0;
          v31 = HIDWORD(SDLength);
          v32 = (unsigned int)(SDLength - v21 + HIDWORD(SDLength) + 152);
          PoolWithTag = ExAllocatePoolWithTag(1ui64, v32, 1883333971i64);
          v34 = PoolWithTag;
          if( PoolWithTag )
          {
            memset(PoolWithTag, 0i64, v32);
            v35 = GrantedAccess;
            *((_DWORD *)v34 + 34) = AccessGranted;
            if( !AccessGranted )
              v35 = DesiredAccess;
            *((_DWORD *)v34 + 33) = 4;
            *(_DWORD *)v34 = v35 & 0xFDFFFFFF;
            *(_OWORD *)((char *)v34 + 4) = *(_OWORD *)(v15 + 88);
            *(_OWORD *)((char *)v34 + 20) = *(_OWORD *)(v15 + 104);
            *(_OWORD *)((char *)v34 + 36) = *(_OWORD *)(v15 + 120);
            *(_OWORD *)((char *)v34 + 52) = *(_OWORD *)(v15 + 136);
            *(_OWORD *)((char *)v34 + 68) = *(_OWORD *)(v15 + 152);
            *(_OWORD *)((char *)v34 + 84) = *(_OWORD *)(v15 + 168);
            *(_OWORD *)((char *)v34 + 100) = *(_OWORD *)(v15 + 184);
            *(_OWORD *)((char *)v34 + 116) = *(_OWORD *)(v15 + 200);
            if( v13 )
              memmove(v34 + 18, v13, v31);
            if( v14 )
              memmove((char *)v34 + v31 + 144, v14, SDLength);
            ParameterCount = 10i64;
            AuditParameters.ParameterCount = 10;
            v37 = 0i64;
            AuditParameters.Parameters[9].Type = SeAdtParmTypeAccessReason;
            AuditParameters.Parameters[9].Length = v32;
            AuditParameters.Parameters[9].Address = v34;
            AuditParameters.Parameters[10].Type = SeAdtParmTypeStagingReason;
            AuditParameters.Parameters[10].Length = v32;
            AuditParameters.Parameters[10].Address = v34;
            while( 1 )
            {
              v38 = v37 + 4 * ParameterCount;
              ++v37;
              AuditParameters.Parameters[0].Data[v38] = 0i64;
              if( v37 >= 2 )
                break;
              ParameterCount = AuditParameters.ParameterCount;
            }
            ++AuditParameters.ParameterCount;
            SepAdtLogAuditRecord(&AuditParameters);
            ExFreePoolWithTag(v34, 0);
          }
          else
          {
            AllocatedFullProcessImageName = -1073741670;
          }
        }
      }
    }
    else
    {
      AllocatedFullProcessImageName = -1073741811;
    }
  }
  if( ImageName )
    ExFreePoolWithTag(ImageName, 0);
  if( NeedToFree[0] && v13 )
    ExFreePoolWithTag(v13, 0);
  if( NeedToFree[1] && v14 )
    ExFreePoolWithTag(v14, 0);
  if( AllocatedFullProcessImageName < 0 )
    SepAuditFailed((unsigned int)AllocatedFullProcessImageName);
  return AllocatedFullProcessImageName >= 0;
}

Referenced by: