SeOpenObjectAuditAlarmForNonObObject

VOID __stdcall SeOpenObjectAuditAlarmForNonObObject(
        _UNICODE_STRING *SubsystemName,
        VOID *HandleId,
        _UNICODE_STRING *ObjectTypeName,
        _UNICODE_STRING *ObjectName,
        VOID *SecurityDescriptor,
        _SECURITY_SUBJECT_CONTEXT *SubjectSecurityContext,
        UINT64 DesiredAccess,
        UINT64 GrantedAccess,
        PRIVILEGE_SET *Privileges,
        UINT8 AccessGranted,
        UINT8 *GenerateOnClose){
  UINT8 v11; 
  __int64 *v12; 
  _UNICODE_STRING *v14; 
  UINT8 v16; 
  int v17; 
  VOID *v18; 
  unsigned int *v19; 
  __int16 v20; 
  _ACL *v21; 
  _ACL *v22; 
  __int64 v23; 
  __int64 v24; 
  int v25; 
  unsigned int v26; 
  VOID *v27; 
  _ACL *v28; 
  __int16 v29; 
  __int64 v30; 
  UINT64 v31; 
  UINT8 GenerateAlarm[72]; 
  VOID *HandleIda; 
  _UNICODE_STRING *v34; 

  v34 = ObjectTypeName;
  HandleIda = HandleId;
  v11 = AccessGranted;
  v12 = (__int64 *)SubjectSecurityContext;
  v14 = ObjectTypeName;
  GenerateAlarm[0] = 0;
  v16 = SepAdtAuditThisEventWithContext(0x76ui64, AccessGranted, AccessGranted == 0, SubjectSecurityContext);
  v17 = DesiredAccess;
  AccessGranted = v16;
  if( !v16 )
    goto LABEL_2;
  v18 = (VOID *)*v12;
  if( !*v12 )
    v18 = (VOID *)v12[2];
  v19 = (unsigned int *)SecurityDescriptor;
  v20 = *((_WORD *)SecurityDescriptor + 1);
  if( (v20 & 0x10) != 0 )
  {
    if( v20 >= 0 )
    {
      v21 = (_ACL *)*((_QWORD *)SecurityDescriptor + 3);
    }
    else
    {
      v23 = *((unsigned int *)SecurityDescriptor + 3);
      if( (_DWORD)v23 )
        v21 = (_ACL *)((char *)SecurityDescriptor + v23);
      else
        v21 = 0i64;
    }
    if( v20 >= 0 )
    {
      v22 = (_ACL *)*((_QWORD *)SecurityDescriptor + 3);
      goto LABEL_18;
    }
    v24 = *((unsigned int *)SecurityDescriptor + 3);
    if( (_DWORD)v24 )
    {
      v22 = (_ACL *)((char *)SecurityDescriptor + v24);
      goto LABEL_18;
    }
  }
  else
  {
    v21 = 0i64;
  }
  v22 = 0i64;
LABEL_18:
  v25 = GrantedAccess;
  v26 = GrantedAccess | DesiredAccess;
  SeExamineSacl(
    v22,
    v21,
    v18,
    (unsigned int)GrantedAccess | (unsigned int)DesiredAccess,
    v11,
    &AccessGranted,
    GenerateAlarm);
  v27 = (VOID *)*v12;
  v28 = 0i64;
  if( !*v12 )
    v27 = (VOID *)v12[2];
  v29 = *((_WORD *)v19 + 1);
  if( (v29 & 0x10) != 0 )
  {
    if( v29 >= 0 )
    {
      v28 = (_ACL *)*((_QWORD *)v19 + 3);
    }
    else
    {
      v30 = v19[3];
      if( (_DWORD)v30 )
        v28 = (_ACL *)((char *)v19 + v30);
    }
  }
  SeExamineGlobalSacl(SubsystemName, v28, v27, v26, v11, &AccessGranted, GenerateAlarm);
  if( AccessGranted )
  {
    SepAdtOpenObjectAuditAlarm(
      118,
      (__int64)SubsystemName,
      &HandleIda,
      &v34->Length,
      (__int64)ObjectName,
      v19,
      *v12,
      v12[2],
      v17,
      v25,
      (__int64)Privileges,
      v11,
      (__int64)KeGetCurrentThread()->ApcState.Process->UniqueProcessId,
      2,
      0i64,
      0,
      0i64,
      0i64,
      0i64);
    *GenerateOnClose = 1;
    return;
  }
  v14 = v34;
LABEL_2:
  if( Privileges )
  {
    if( v11 )
    {
      LODWORD(v31) = v17;
      SepAdtPrivilegeObjectAuditAlarm(
        SubsystemName,
        v14,
        ObjectName,
        HandleIda,
        (_TOKEN *)*v12,
        (_TOKEN *)v12[2],
        KeGetCurrentThread()->ApcState.Process->UniqueProcessId,
        v31,
        Privileges,
        v11);
    }
  }
}

Referenced by: