SepAdtCloseObjectAuditAlarm

VOID __stdcall SepAdtCloseObjectAuditAlarm(
        _UNICODE_STRING *CapturedSubsystemName,
        VOID *HandleId,
        _SECURITY_SUBJECT_CONTEXT *SubjectSecurityContext,
        VOID *Object,
        UINT8 IsKernelObject){
  _EPROCESS *CurrentThreadProcess; 
  unsigned __int64 UniqueProcessId; 
  NTSTATUS AllocatedFullProcessImageName; 
  _UNICODE_STRING *v11; 
  unsigned __int64 *ClientToken; 
  _QWORD **PrimaryToken; 
  void *v14; 
  void **v15; 
  unsigned int v16; 
  unsigned __int64 v17; 
  UINT8 IsKernelHandle; 
  __int64 v19; 
  unsigned __int64 v20; 
  _SE_ADT_PARAMETER_TYPE v21; 
  unsigned int v22; 
  UINT16 FlatSubCategoryId; 
  _UNICODE_STRING *ImageName; 
  _SE_ADT_PARAMETER_ARRAY AuditParameters; 

  ImageName = 0i64;
  FlatSubCategoryId = 0;
  if( SepAdtAuditObjectAccessWithContext(
         Object,
         CapturedSubsystemName,
         1u,
         0,
         SubjectSecurityContext,
         IsKernelObject,
         &FlatSubCategoryId)
    && SepAdtAuditThisEventWithContext(0x7Bui64, 1u, 0, SubjectSecurityContext) )
  {
    CurrentThreadProcess = (_EPROCESS *)PsGetCurrentThreadProcess();
    UniqueProcessId = (unsigned __int64)CurrentThreadProcess->UniqueProcessId;
    AllocatedFullProcessImageName = PsGetAllocatedFullProcessImageNameEx(CurrentThreadProcess, &ImageName);
    if( AllocatedFullProcessImageName < 0 )
    {
      SepAuditFailed((unsigned int)AllocatedFullProcessImageName);
    }
    else
    {
      memset(&AuditParameters, 0i64, sizeof(AuditParameters));
      v11 = (_UNICODE_STRING *)&SeSubsystemName;
      ClientToken = (unsigned __int64 *)SubjectSecurityContext->ClientToken;
      AuditParameters.FlatSubCategoryId = FlatSubCategoryId;
      AuditParameters.CategoryId = 3;
      PrimaryToken = (_QWORD **)ClientToken;
      if( CapturedSubsystemName )
        v11 = CapturedSubsystemName;
      AuditParameters.AuditId = 4658;
      AuditParameters.Type = 8;
      AuditParameters.Parameters[0].Type = SeAdtParmTypeSid;
      if( !ClientToken )
        PrimaryToken = (_QWORD **)SubjectSecurityContext->PrimaryToken;
      AuditParameters.Parameters[0].Length = 4 * *(unsigned __int8 *)(*PrimaryToken[19] + 1i64) + 8;
      v14 = ClientToken;
      if( !ClientToken )
        v14 = SubjectSecurityContext->PrimaryToken;
      v15 = (void **)*((_QWORD *)v14 + 19);
      AuditParameters.Parameters[1].Type = SeAdtParmTypeString;
      AuditParameters.Parameters[1].Address = v11;
      AuditParameters.Parameters[2].Type = SeAdtParmTypeLogonId;
      AuditParameters.Parameters[0].Address = *v15;
      v16 = v11->Length + 16;
      AuditParameters.Parameters[2].Length = 8;
      AuditParameters.Parameters[1].Length = v16;
      if( !ClientToken )
        ClientToken = (unsigned __int64 *)SubjectSecurityContext->PrimaryToken;
      v17 = ClientToken[3];
      AuditParameters.Parameters[3].Address = v11;
      AuditParameters.Parameters[3].Length = v16;
      AuditParameters.Parameters[4].Type = SeAdtParmTypePtr;
      AuditParameters.Parameters[2].Data[0] = v17;
      AuditParameters.Parameters[3].Type = SeAdtParmTypeString;
      AuditParameters.Parameters[4].Length = 8;
      IsKernelHandle = ObpIsKernelHandle(HandleId, 0);
      v20 = v19 ^ 0xFFFFFFFF80000000ui64;
      AuditParameters.Parameters[5].Type = v21;
      AuditParameters.Parameters[5].Length = v22;
      AuditParameters.Parameters[5].Data[0] = UniqueProcessId;
      if( !IsKernelHandle )
        v20 = (unsigned __int64)HandleId;
      AuditParameters.Parameters[6].Type = SeAdtParmTypeFileSpec;
      AuditParameters.ParameterCount = 7;
      AuditParameters.Parameters[4].Data[0] = v20 & 0xFFFFFFFFFFFFFFFCui64;
      AuditParameters.Parameters[6].Address = ImageName;
      AuditParameters.Parameters[6].Length = ImageName->Length + 16;
      SepAdtLogAuditRecord(&AuditParameters);
    }
    if( ImageName )
      ExFreePoolWithTag(ImageName, 0);
  }
}

Referenced by: