SepAdtObjectReferenceAuditAlarm

VOID __stdcall SepAdtObjectReferenceAuditAlarm(
        VOID *Object,
        _SECURITY_SUBJECT_CONTEXT *SubjectSecurityContext,
        UINT64 DesiredAccess,
        UINT8 AccessGranted){
  _UNICODE_STRING *v4; 
  void *ClientToken; 
  void *PrimaryToken; 
  unsigned __int8 **v10; 
  unsigned __int8 *v11; 
  unsigned __int64 v12; 
  NTSTATUS NameString; 
  int v14; 
  int Length; 
  int v16; 
  unsigned int v17; 
  _UNICODE_STRING *TypeName; 
  _OBJECT_NAME_INFORMATION *ObjectNameInfo; 
  _SE_ADT_PARAMETER_ARRAY AuditParameters; 

  ObjectNameInfo = 0i64;
  v4 = 0i64;
  ClientToken = SubjectSecurityContext->ClientToken;
  PrimaryToken = SubjectSecurityContext->PrimaryToken;
  v17 = DesiredAccess;
  TypeName = 0i64;
  if( ClientToken )
    v10 = (unsigned __int8 **)*((_QWORD *)ClientToken + 19);
  else
    v10 = (unsigned __int8 **)*((_QWORD *)PrimaryToken + 19);
  v11 = *v10;
  v12 = *((_QWORD *)PrimaryToken + 3);
  memset(&AuditParameters, 0i64, sizeof(AuditParameters));
  AuditParameters.CategoryId = 3;
  AuditParameters.FlatSubCategoryId = 120;
  AuditParameters.AuditId = 4691;
  AuditParameters.Type = 8;
  if( !AccessGranted )
    AuditParameters.Type = 16;
  NameString = SepQueryNameString(Object, (PVOID *)&ObjectNameInfo);
  if( NameString >= 0 )
  {
    NameString = SepQueryTypeString(Object, &TypeName);
    if( NameString < 0 )
    {
      v4 = TypeName;
    }
    else
    {
      v14 = v11[1];
      AuditParameters.Parameters[0].Type = SeAdtParmTypeSid;
      AuditParameters.Parameters[0].Address = v11;
      AuditParameters.Parameters[1].Length = 32;
      AuditParameters.Parameters[2].Type = SeAdtParmTypeLogonId;
      AuditParameters.Parameters[0].Length = 4 * v14 + 8;
      AuditParameters.Parameters[1].Address = (void *)&SeSubsystemName;
      AuditParameters.Parameters[1].Type = SeAdtParmTypeString;
      AuditParameters.Parameters[2].Length = 8;
      if( ClientToken )
        AuditParameters.Parameters[2].Data[0] = *((_QWORD *)ClientToken + 3);
      else
        AuditParameters.Parameters[2].Data[0] = v12;
      v4 = TypeName;
      if( TypeName )
      {
        Length = TypeName->Length;
        AuditParameters.Parameters[3].Type = SeAdtParmTypeString;
        AuditParameters.Parameters[3].Length = Length + 16;
        AuditParameters.Parameters[3].Address = TypeName;
      }
      if( ObjectNameInfo )
      {
        v16 = *(_WORD *)ObjectNameInfo;
        AuditParameters.Parameters[4].Type = SeAdtParmTypeString;
        AuditParameters.Parameters[4].Length = v16 + 16;
        AuditParameters.Parameters[4].Address = ObjectNameInfo;
      }
      AuditParameters.Parameters[5].Data[0] = v17;
      AuditParameters.Parameters[6].Data[0] = v17;
      AuditParameters.Parameters[7].Data[0] = (unsigned __int64)SubjectSecurityContext->ProcessAuditId;
      AuditParameters.Parameters[5].Type = SeAdtParmTypeAccessMask;
      AuditParameters.Parameters[5].Length = 4;
      AuditParameters.Parameters[5].Data[1] = 3i64;
      AuditParameters.Parameters[6].Type = SeAdtParmTypeHexUlong;
      AuditParameters.Parameters[6].Length = 4;
      AuditParameters.Parameters[7].Type = SeAdtParmTypePtr;
      AuditParameters.Parameters[7].Length = 8;
      AuditParameters.ParameterCount = 8;
      SepAdtLogAuditRecord(&AuditParameters);
    }
  }
  if( ObjectNameInfo )
    ExFreePoolWithTag(ObjectNameInfo, 0);
  if( v4 )
    ExFreePoolWithTag(v4, 0);
  if( NameString < 0 )
    SepAuditFailed((unsigned int)NameString);
}

Referenced by: