SepAdtOpenObjectAuditAlarm

bool __fastcall SepAdtOpenObjectAuditAlarm(
        __int16 a1,
        __int64 a2,
        PVOID *a3,
        unsigned __int16 *a4,
        __int64 a5,
        PVOID P,
        __int64 a7,
        __int64 a8,
        int a9,
        int a10,
        __int64 a11,
        UINT8 AccessGranted,
        __int64 a13,
        int a14,
        __int64 a15,
        int a16,
        __int64 a17,
        __int64 a18,
        __int64 a19){
  _SECURITY_DESCRIPTOR *v19; 
  unsigned __int64 v21; 
  _SECURITY_DESCRIPTOR *v22; 
  __int128 *v24; 
  _EPROCESS *CurrentThreadProcess; 
  NTSTATUS AllocatedFullProcessImageName; 
  unsigned __int8 **v27; 
  unsigned __int64 v28; 
  UINT8 v29; 
  unsigned int v30; 
  _UNICODE_STRING *v31; 
  unsigned __int64 v32; 
  int v33; 
  unsigned int v34; 
  unsigned int v35; 
  int v36; 
  UINT8 IsKernelHandle; 
  unsigned __int64 v38; 
  __int64 v39; 
  unsigned __int64 v40; 
  unsigned __int64 v41; 
  __int64 v42; 
  __int64 v43; 
  _SECURITY_DESCRIPTOR *v44; 
  int v45; 
  __int64 v46; 
  size_t v47; 
  VOID **PoolWithTag; 
  VOID **v49; 
  int v50; 
  __int64 v51; 
  unsigned __int64 v52; 
  int v53; 
  unsigned int v54; 
  unsigned int v55; 
  __int64 v56; 
  unsigned __int16 v57; 
  _WORD *v58; 
  VOID **v59; 
  _OWORD *v60; 
  __int64 v61; 
  unsigned int v62; 
  _DWORD *v63; 
  VOID **v64; 
  __int64 v65; 
  int v66; 
  __int64 v67; 
  _UNICODE_STRING *v68; 
  int v69; 
  unsigned int ParameterCount; 
  int v71; 
  NTSTATUS v72; 
  _SECURITY_DESCRIPTOR *v73; 
  unsigned int v74; 
  UINT8 NeedToFree[8]; 
  _SECURITY_DESCRIPTOR *SecurityDescriptorOut; 
  UINT64 SDLength; 
  PVOID Src; 
  _UNICODE_STRING *v79; 
  __int64 v80; 
  _SECURITY_DESCRIPTOR *v81; 
  PVOID v82; 
  _UNICODE_STRING *ImageName; 
  __int64 v84; 
  unsigned __int8 *v85; 
  PVOID *v86; 
  __int128 *v87; 
  _SECURITY_DESCRIPTOR *v88; 
  _SECURITY_SUBJECT_CONTEXT SubjectSecurityContext; 
  _SE_ADT_PARAMETER_ARRAY AuditParameters; 
  __int128 v91; 

  v19 = (_SECURITY_DESCRIPTOR *)P;
  *(_WORD *)&NeedToFree[4] = a1;
  v21 = 0i64;
  v84 = a19;
  v22 = 0i64;
  v86 = a3;
  v79 = (_UNICODE_STRING *)a2;
  v80 = a8;
  SubjectSecurityContext.PrimaryToken = (void *)a8;
  v88 = (_SECURITY_DESCRIPTOR *)P;
  v81 = (_SECURITY_DESCRIPTOR *)P;
  v82 = 0i64;
  ImageName = 0i64;
  *(_QWORD *)&SubjectSecurityContext.ImpersonationLevel = 0i64;
  SubjectSecurityContext.ProcessAuditId = 0i64;
  v91 = 0i64;
  SDLength = 0i64;
  SecurityDescriptorOut = 0i64;
  Src = 0i64;
  NeedToFree[1] = 0;
  NeedToFree[2] = 0;
  NeedToFree[0] = 0;
  SubjectSecurityContext.ClientToken = (void *)a7;
  if( !SepAdtAuditThisEventWithContext(0x7Bui64, AccessGranted, AccessGranted == 0, &SubjectSecurityContext) )
    return 1;
  v24 = &v91;
  if( a18 )
    v24 = (__int128 *)a18;
  v87 = v24;
  CurrentThreadProcess = (_EPROCESS *)PsGetCurrentThreadProcess();
  AllocatedFullProcessImageName = PsGetAllocatedFullProcessImageNameEx(CurrentThreadProcess, &ImageName);
  if( AllocatedFullProcessImageName >= 0 )
  {
    if( a7 )
    {
      v21 = *(_QWORD *)(a7 + 24);
      v27 = *(unsigned __int8 ***)(a7 + 152);
    }
    else
    {
      v27 = *(unsigned __int8 ***)(v80 + 152);
    }
    v28 = *(_QWORD *)(v80 + 24);
    v85 = *v27;
    memset(&AuditParameters, 0i64, sizeof(AuditParameters));
    v29 = AccessGranted;
    v30 = 8;
    AuditParameters.AuditId = 4656;
    AuditParameters.FlatSubCategoryId = *(_WORD *)&NeedToFree[4];
    AuditParameters.Type = 8;
    if( a14 == 2 )
      v30 = 3;
    AuditParameters.CategoryId = v30;
    if( !AccessGranted )
      AuditParameters.Type = 16;
    v31 = (_UNICODE_STRING *)&SeSubsystemName;
    v32 = 4i64;
    AuditParameters.Parameters[0].Address = v85;
    if( v79 )
      v31 = v79;
    AuditParameters.Parameters[0].Type = SeAdtParmTypeSid;
    AuditParameters.Parameters[1].Type = SeAdtParmTypeString;
    v33 = v85[1];
    AuditParameters.Parameters[1].Address = v31;
    AuditParameters.Parameters[2].Type = SeAdtParmTypeLogonId;
    AuditParameters.Parameters[2].Length = 8;
    AuditParameters.Parameters[2].Data[0] = v21;
    AuditParameters.Parameters[0].Length = 4 * v33 + 8;
    v34 = v31->Length + 16;
    AuditParameters.Parameters[1].Length = v34;
    if( !a7 )
      AuditParameters.Parameters[2].Data[0] = v28;
    AuditParameters.Parameters[3].Type = SeAdtParmTypeString;
    AuditParameters.Parameters[3].Length = v34;
    AuditParameters.Parameters[3].Address = v31;
    if( !a4 )
    {
      AllocatedFullProcessImageName = -1073741811;
LABEL_19:
      v22 = SecurityDescriptorOut;
      goto LABEL_20;
    }
    v35 = *a4 + 16;
    AuditParameters.Parameters[4].Address = a4;
    AuditParameters.Parameters[4].Length = v35;
    AuditParameters.Parameters[4].Type = SeAdtParmTypeString;
    if( a5 )
    {
      if( *(_WORD *)&NeedToFree[4] == 116
        || (AuditParameters.Parameters[5].Type = SeAdtParmTypeString, *(_WORD *)&NeedToFree[4] == 128) )
      {
        AuditParameters.Parameters[5].Type = SeAdtParmTypeFileSpec;
      }
      v36 = *(unsigned __int16 *)a5;
      AuditParameters.Parameters[5].Address = (void *)a5;
      AuditParameters.Parameters[5].Length = v36 + 16;
    }
    AuditParameters.Parameters[6].Type = SeAdtParmTypePtr;
    AuditParameters.Parameters[6].Length = 8;
    if( v86 )
    {
      IsKernelHandle = ObpIsKernelHandle(*v86, 0);
      v40 = v39 ^ 0xFFFFFFFF80000000ui64;
      if( !IsKernelHandle )
        v40 = v38;
      AuditParameters.Parameters[6].Data[0] = v40 & 0xFFFFFFFFFFFFFFFCui64;
    }
    else
    {
      AuditParameters.Parameters[6].Data[0] = 0i64;
    }
    AuditParameters.Parameters[7].Address = v87;
    v41 = (unsigned int)a10;
    AuditParameters.Parameters[7].Type = SeAdtParmTypeGuid;
    AuditParameters.Parameters[7].Length = 16;
    AuditParameters.Parameters[8].Type = SeAdtParmTypeAccessMask;
    AuditParameters.Parameters[8].Length = v32;
    AuditParameters.Parameters[8].Data[1] = v32;
    if( !v29 )
      v41 = (unsigned int)a9;
    v42 = v84;
    AuditParameters.Parameters[8].Data[0] = v41;
    if( v84 && (v43 = *(_QWORD *)(v84 + 72)) != 0 )
    {
      AllocatedFullProcessImageName = SepCheckAndCopySelfRelativeSD(
                                        *(_SECURITY_DESCRIPTOR **)(v43 + 56),
                                        &SecurityDescriptorOut,
                                        (UINT64 *)((char *)&SDLength + 4),
                                        &NeedToFree[1]);
      if( AllocatedFullProcessImageName < 0 )
        goto LABEL_102;
      AllocatedFullProcessImageName = SepCheckAndCopySelfRelativeSD(
                                        *(_SECURITY_DESCRIPTOR **)(*(_QWORD *)(v42 + 72) + 64i64),
                                        (_SECURITY_DESCRIPTOR **)&Src,
                                        &SDLength,
                                        &NeedToFree[2]);
      if( AllocatedFullProcessImageName < 0 )
        goto LABEL_102;
      v44 = SecurityDescriptorOut;
      if( SecurityDescriptorOut || Src )
      {
        v45 = 8;
        goto LABEL_55;
      }
    }
    else
    {
      v44 = SecurityDescriptorOut;
    }
    v45 = 0;
LABEL_55:
    v46 = HIDWORD(SDLength);
    LODWORD(v79) = HIDWORD(SDLength) + SDLength - v45 + 152;
    v47 = (unsigned int)v79;
    PoolWithTag = ExAllocatePoolWithTag(1ui64, (unsigned int)v79, 1883333971i64);
    v49 = PoolWithTag;
    if( !PoolWithTag )
    {
      AllocatedFullProcessImageName = -1073741670;
      goto LABEL_19;
    }
    memset(PoolWithTag, 0i64, v47);
    v50 = a10;
    *((_DWORD *)v49 + 34) = AccessGranted;
    if( !AccessGranted )
      v50 = a9;
    *((_DWORD *)v49 + 33) = 4;
    *(_DWORD *)v49 = v50 & 0xFDFFFFFF;
    if( v84 )
    {
      v51 = *(_QWORD *)(v84 + 72);
      if( v51 )
      {
        *(_OWORD *)((char *)v49 + 4) = *(_OWORD *)(v51 + 88);
        *(_OWORD *)((char *)v49 + 20) = *(_OWORD *)(v51 + 104);
        *(_OWORD *)((char *)v49 + 36) = *(_OWORD *)(v51 + 120);
        *(_OWORD *)((char *)v49 + 52) = *(_OWORD *)(v51 + 136);
        *(_OWORD *)((char *)v49 + 68) = *(_OWORD *)(v51 + 152);
        *(_OWORD *)((char *)v49 + 84) = *(_OWORD *)(v51 + 168);
        *(_OWORD *)((char *)v49 + 100) = *(_OWORD *)(v51 + 184);
        *(_OWORD *)((char *)v49 + 116) = *(_OWORD *)(v51 + 200);
      }
    }
    if( v44 )
      memmove(v49 + 18, v44, v46);
    if( Src )
      memmove((char *)v49 + v46 + 144, Src, SDLength);
    AuditParameters.Parameters[9].Length = (unsigned int)v79;
    v52 = (unsigned int)a10;
    AuditParameters.Parameters[9].Type = SeAdtParmTypeAccessReason;
    AuditParameters.Parameters[9].Address = v49;
    AuditParameters.Parameters[10].Type = SeAdtParmTypeHexUlong;
    AuditParameters.Parameters[10].Length = 4;
    if( !AccessGranted )
      v52 = (unsigned int)a9;
    AuditParameters.Parameters[10].Data[0] = v52;
    if( a11 )
    {
      v53 = *(_DWORD *)a11;
      if( *(_DWORD *)a11 )
      {
        AuditParameters.Parameters[11].Type = SeAdtParmTypePrivs;
        AuditParameters.Parameters[11].Address = (void *)a11;
        AuditParameters.Parameters[11].Length = 12 * v53 + 8;
      }
    }
    v54 = 12;
    AuditParameters.ParameterCount = 12;
    if( a16 )
    {
      v55 = 0;
      v56 = 0i64;
      v57 = 2 - (AccessGranted != 0);
      v58 = (_WORD *)(a15 + 2);
      do
      {
        if( !v55 || (v57 & *v58) != 0 )
          v56 = (unsigned int)(v56 + 1);
        ++v55;
        v58 += 24;
      }
      while( v55 < a16 );
      if( (_DWORD)v56 )
      {
        v59 = ExAllocatePoolWithTag(1ui64, 24 * v56, 1883333971i64);
        v82 = v59;
        if( !v59 )
        {
          AllocatedFullProcessImageName = -1073741670;
LABEL_101:
          ExFreePoolWithTag(v49, 0);
LABEL_102:
          v22 = SecurityDescriptorOut;
          goto LABEL_20;
        }
        v60 = (_OWORD *)(a15 + 4);
        v61 = 0i64;
        v62 = 0;
        v63 = (_DWORD *)a17;
        v64 = v59;
        do
        {
          if( !v62 || (v57 & *((_WORD *)v60 - 1)) != 0 )
          {
            v65 = 3 * v61;
            *(_OWORD *)&v59[v65] = *v60;
            WORD1(v59[v65 + 2]) = *((_WORD *)v60 - 2);
            if( v62 )
            {
              LOWORD(v59[3 * v61 + 2]) = 0;
              if( a17 && AccessGranted )
                HIDWORD(v59[3 * v61 + 2]) = *v63;
            }
            else
            {
              LOWORD(v59[3 * v61 + 2]) = 1;
              HIDWORD(v59[3 * v61 + 2]) = 0;
            }
            v61 = (unsigned int)(v61 + 1);
          }
          ++v62;
          v60 += 3;
          ++v63;
        }
        while( v62 < a16 );
        v66 = 3 * v61;
        AuditParameters.Parameters[12].Address = v64;
        v19 = v88;
        v54 = 13;
        AuditParameters.Parameters[12].Length = 8 * v66;
        AuditParameters.Parameters[12].Type = SeAdtParmTypeObjectTypes;
        AuditParameters.Parameters[12].Data[1] = 4i64;
        AuditParameters.ParameterCount = 13;
        AuditParameters.AuditId = 4661;
      }
    }
    v67 = v54;
    v68 = ImageName;
    AuditParameters.Parameters[v67].Type = SeAdtParmTypeUlongNoConv;
    AuditParameters.Parameters[AuditParameters.ParameterCount].Length = 4;
    AuditParameters.Parameters[AuditParameters.ParameterCount++].Data[0] = *(unsigned int *)(v80 + 128);
    AuditParameters.Parameters[AuditParameters.ParameterCount].Type = SeAdtParmTypePtr;
    AuditParameters.Parameters[AuditParameters.ParameterCount].Length = 8;
    AuditParameters.Parameters[AuditParameters.ParameterCount++].Data[0] = a13;
    AuditParameters.Parameters[AuditParameters.ParameterCount].Type = SeAdtParmTypeFileSpec;
    AuditParameters.Parameters[AuditParameters.ParameterCount].Length = v68->Length + 16;
    v69 = *(unsigned __int16 *)&NeedToFree[4];
    AuditParameters.Parameters[AuditParameters.ParameterCount].Address = v68;
    ParameterCount = ++AuditParameters.ParameterCount;
    v71 = v69 - 116;
    if( (!v71 || v71 == 12) && v19 && AuditParameters.AuditId == 4656 && SepSDContainsAttributeACE(v19) )
    {
      v72 = SepCheckAndCopySelfRelativeSD(v19, &v81, (UINT64 *)((char *)&SDLength + 4), NeedToFree);
      v19 = v81;
      AllocatedFullProcessImageName = v72;
      if( v72 < 0 )
        goto LABEL_99;
      v73 = v81;
      AuditParameters.Parameters[ParameterCount].Type = SeAdtParmTypeResourceAttribute;
      v74 = SepSecurityDescriptorStrictLength(v73);
      AuditParameters.Parameters[AuditParameters.ParameterCount].Length = v74;
      AuditParameters.Parameters[AuditParameters.ParameterCount].Address = v19;
      AuditParameters.Parameters[AuditParameters.ParameterCount].Data[0] = 32i64;
      AuditParameters.Parameters[AuditParameters.ParameterCount].Data[1] = 0i64;
      ParameterCount = AuditParameters.ParameterCount;
    }
    AuditParameters.ParameterCount = ParameterCount + 1;
    SepAdtLogAuditRecord(&AuditParameters);
LABEL_99:
    if( v82 )
      ExFreePoolWithTag(v82, 0);
    goto LABEL_101;
  }
LABEL_20:
  if( ImageName )
    ExFreePoolWithTag(ImageName, 0);
  if( NeedToFree[0] && v19 )
    ExFreePoolWithTag(v19, 0);
  if( NeedToFree[1] && v22 )
    ExFreePoolWithTag(v22, 0);
  if( NeedToFree[2] && Src )
    ExFreePoolWithTag(Src, 0);
  if( AllocatedFullProcessImageName < 0 )
    SepAuditFailed((unsigned int)AllocatedFullProcessImageName);
  return AllocatedFullProcessImageName >= 0;
}

Referenced by: