SeOperationAuditAlarm

VOID __stdcall SeOperationAuditAlarm(
        _UNICODE_STRING *CapturedSubsystemName,
        VOID *Object,
        VOID *HandleId,
        _UNICODE_STRING *ObjectTypeName,
        UINT64 AuditMask,
        VOID *UserSid,
        VOID *SecurityDescriptor){
  void *v7; 
  int v11; 
  _EPROCESS *CurrentThreadProcess; 
  unsigned __int64 UniqueProcessId; 
  NTSTATUS AllocatedFullProcessImageName; 
  void *PrimaryToken; 
  int v16; 
  unsigned __int64 v17; 
  unsigned int v18; 
  int v19; 
  unsigned int v20; 
  _SE_ADT_PARAMETER_TYPE v21; 
  int v22; 
  _SE_ADT_PARAMETER_TYPE v23; 
  unsigned int v24; 
  NTSTATUS v25; 
  unsigned int v26; 
  char NeedToFree[4]; 
  char SDLength[12]; 
  _UNICODE_STRING *ImageName; 
  _OBJECT_NAME_INFORMATION *ObjectNameInfo; 
  _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  _SE_ADT_PARAMETER_ARRAY AuditParameters; 

  v7 = SecurityDescriptor;
  *(_QWORD *)&SDLength[4] = SecurityDescriptor;
  ImageName = 0i64;
  ObjectNameInfo = 0i64;
  *(_DWORD *)SDLength = 0;
  NeedToFree[0] = 0;
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  v11 = SepAdtClassifyObjectIntoSubCategory(Object, ObjectTypeName, 1u, 0);
  CurrentThreadProcess = (_EPROCESS *)PsGetCurrentThreadProcess();
  UniqueProcessId = (unsigned __int64)CurrentThreadProcess->UniqueProcessId;
  AllocatedFullProcessImageName = PsGetAllocatedFullProcessImageNameEx(CurrentThreadProcess, &ImageName);
  if( AllocatedFullProcessImageName < 0 )
  {
LABEL_24:
    SepAuditFailed((unsigned int)AllocatedFullProcessImageName);
    goto LABEL_25;
  }
  memset(&AuditParameters, 0i64, sizeof(AuditParameters));
  AuditParameters.CategoryId = 3;
  AuditParameters.Type = 8;
  AuditParameters.FlatSubCategoryId = v11;
  AuditParameters.AuditId = 4663;
  SeCaptureSubjectContext((INT64)&SubjectContext);
  PrimaryToken = SubjectContext.PrimaryToken;
  AuditParameters.Parameters[0].Type = SeAdtParmTypeSid;
  if( SubjectContext.ClientToken )
    PrimaryToken = SubjectContext.ClientToken;
  AuditParameters.Parameters[1].Length = 32;
  AuditParameters.Parameters[1].Address = (void *)&SeSubsystemName;
  AuditParameters.Parameters[2].Type = SeAdtParmTypeLogonId;
  AuditParameters.Parameters[2].Length = 8;
  AuditParameters.Parameters[0].Address = (void *)**((_QWORD **)PrimaryToken + 19);
  v16 = *((unsigned __int8 *)AuditParameters.Parameters[0].Address + 1);
  AuditParameters.Parameters[1].Type = SeAdtParmTypeString;
  AuditParameters.Parameters[0].Length = 4 * v16 + 8;
  if( SubjectContext.ClientToken )
    v17 = *((_QWORD *)SubjectContext.ClientToken + 3);
  else
    v17 = *((_QWORD *)SubjectContext.PrimaryToken + 3);
  AuditParameters.Parameters[2].Data[0] = v17;
  v18 = ObjectTypeName->Length + 16;
  AuditParameters.Parameters[3].Type = SeAdtParmTypeString;
  AuditParameters.Parameters[4].Type = SeAdtParmTypeString;
  AuditParameters.Parameters[4].Length = v18;
  AuditParameters.Parameters[3].Length = 32;
  AuditParameters.Parameters[3].Address = (void *)&SeSubsystemName;
  AuditParameters.Parameters[4].Address = ObjectTypeName;
  SepQueryNameString(Object, (PVOID *)&ObjectNameInfo);
  if( ObjectNameInfo )
  {
    if( (_WORD)v11 == 116 || (AuditParameters.Parameters[5].Type = SeAdtParmTypeString, (_WORD)v11 == 128) )
      AuditParameters.Parameters[5].Type = SeAdtParmTypeFileSpec;
    v19 = *(_WORD *)ObjectNameInfo;
    AuditParameters.Parameters[5].Address = ObjectNameInfo;
    AuditParameters.Parameters[5].Length = v19 + 16;
  }
  AuditParameters.Parameters[6].Type = SeAdtParmTypePtr;
  AuditParameters.Parameters[6].Length = 8;
  if( ObpIsKernelHandle(HandleId, 0) )
    HandleId = (VOID *)((unsigned __int64)HandleId ^ 0xFFFFFFFF80000000ui64);
  AuditParameters.Parameters[7].Length = 4;
  AuditParameters.Parameters[7].Data[1] = 4i64;
  AuditParameters.Parameters[8].Length = 4;
  AuditParameters.Parameters[7].Data[0] = (unsigned int)AuditMask;
  AuditParameters.Parameters[8].Data[0] = (unsigned int)AuditMask;
  AuditParameters.Parameters[10].Address = ImageName;
  v24 = ImageName->Length + 16;
  AuditParameters.Parameters[6].Data[0] = (unsigned __int64)HandleId & 0xFFFFFFFFFFFFFFFCui64;
  AuditParameters.Parameters[7].Type = SeAdtParmTypeAccessMask;
  AuditParameters.Parameters[8].Type = SeAdtParmTypeHexUlong;
  AuditParameters.Parameters[9].Type = v21;
  AuditParameters.Parameters[9].Length = v20;
  AuditParameters.Parameters[9].Data[0] = UniqueProcessId;
  AuditParameters.Parameters[10].Type = v23;
  AuditParameters.Parameters[10].Length = v24;
  if( v11 != v22 && v11 - v22 != 12 || !SecurityDescriptor )
    goto LABEL_19;
  v25 = SepCheckAndCopySelfRelativeSD(
          (_SECURITY_DESCRIPTOR *)SecurityDescriptor,
          (_SECURITY_DESCRIPTOR **)&SDLength[4],
          (UINT64 *)SDLength,
          (UINT8 *)NeedToFree);
  v7 = *(void **)&SDLength[4];
  AllocatedFullProcessImageName = v25;
  if( v25 >= 0 )
  {
    AuditParameters.Parameters[11].Type = SeAdtParmTypeResourceAttribute;
    v26 = SepSecurityDescriptorStrictLength(*(VOID **)&SDLength[4]);
    AuditParameters.Parameters[11].Data[1] = 0i64;
    AuditParameters.Parameters[11].Length = v26;
    AuditParameters.Parameters[11].Address = v7;
    AuditParameters.Parameters[11].Data[0] = 32i64;
LABEL_19:
    AuditParameters.ParameterCount = 12;
    SepAdtLogAuditRecord(&AuditParameters);
    SeReleaseSubjectContext(&SubjectContext);
  }
  if( NeedToFree[0] && v7 )
    ExFreePoolWithTag(v7, 0);
  if( AllocatedFullProcessImageName < 0 )
    goto LABEL_24;
LABEL_25:
  if( ImageName )
    ExFreePoolWithTag(ImageName, 0);
  if( ObjectNameInfo )
    ExFreePoolWithTag(ObjectNameInfo, 0);
}

Referenced by: