SeReportSecurityEventWithSubCategory

NTSTATUS __stdcall SeReportSecurityEventWithSubCategory(
        UINT64 Flags,
        _UNICODE_STRING *SourceName,
        VOID *UserSid,
        _SE_ADT_PARAMETER_ARRAY *AuditParameters,
        UINT64 AuditFlatSubCategoryId){
  unsigned __int8 *v8; 
  unsigned __int16 Type; 
  __int64 v11; 
  _SECURITY_SUBJECT_CONTEXT *v12; 
  unsigned int AuditId; 
  int v14; 
  __int64 v15; 
  unsigned int v16; 
  unsigned int ParameterCount; 
  int Length; 
  _QWORD SubjectContext[6]; 
  _SE_ADT_PARAMETER_ARRAY AuditParametersa; 

  v8 = 0i64;
  memset(&SubjectContext[1], 0, 32);
  if( (_DWORD)Flags )
    return -1073741811;
  if( !SourceName )
    return -1073741811;
  if( !SourceName->Buffer )
    return -1073741811;
  if( !SourceName->Length )
    return -1073741811;
  if( !AuditParameters )
    return -1073741811;
  if( (unsigned int)(AuditFlatSubCategoryId - 100) > 0x3A )
    return -1073741811;
  if( AuditParameters->ParameterCount > 0x1C )
    return -1073741811;
  Type = AuditParameters->Type;
  if( (Type & 0x18) == 0 )
    return -1073741811;
  LOBYTE(SubjectContext[0]) = KeGetCurrentIrql();
  if( LOBYTE(SubjectContext[0]) < 2u )
  {
    if( UserSid )
    {
      v8 = (unsigned __int8 *)UserSid;
    }
    else
    {
      SeCaptureSubjectContext((INT64)&SubjectContext[1]);
      v11 = SubjectContext[3];
      Type = AuditParameters->Type;
      if( SubjectContext[1] )
        v11 = SubjectContext[1];
      v8 = **(unsigned __int8 ***)(v11 + 152);
    }
    v12 = (_SECURITY_SUBJECT_CONTEXT *)&SubjectContext[1];
    if( v8 == UserSid )
      v12 = 0i64;
    if( !SepAdtAuditThisEventWithContext((unsigned int)AuditFlatSubCategoryId, Type == 8, Type == 16, v12) )
      goto LABEL_11;
    Type = AuditParameters->Type;
    goto LABEL_21;
  }
  if( SepAuditingForSubCategory((unsigned int)AuditFlatSubCategoryId, Type == 8) )
  {
    v8 = (unsigned __int8 *)UserSid;
    if( !UserSid )
      v8 = (unsigned __int8 *)SeLocalSystemSid;
LABEL_21:
    memset(&AuditParametersa, 0i64, sizeof(AuditParametersa));
    AuditId = AuditParameters->AuditId;
    AuditParametersa.CategoryId = AuditParameters->CategoryId;
    v14 = v8[1];
    AuditParametersa.AuditId = AuditId;
    AuditParametersa.FlatSubCategoryId = AuditFlatSubCategoryId;
    AuditParametersa.Type = Type;
    AuditParametersa.Parameters[0].Type = SeAdtParmTypeSid;
    AuditParametersa.Parameters[0].Length = 4 * v14 + 8;
    AuditParametersa.Parameters[1].Address = (void *)&SeSubsystemName;
    AuditParametersa.Parameters[0].Address = v8;
    AuditParametersa.Parameters[1].Type = SeAdtParmTypeString;
    AuditParametersa.Parameters[1].Length = 32;
    AuditParametersa.ParameterCount = 2;
    if( (_DWORD)AuditFlatSubCategoryId == 122 )
    {
      AuditParametersa.Flags |= 6u;
      Length = SourceName->Length;
      AuditParametersa.Parameters[2].Type = SeAdtParmTypeString;
      v15 = 3i64;
      AuditParametersa.Parameters[2].Length = Length + 16;
      AuditParametersa.Parameters[2].Address = SourceName;
      AuditParametersa.ParameterCount = 3;
    }
    else
    {
      v15 = 2i64;
      v16 = AuditParametersa.Flags | 8;
      AuditParametersa.Flags |= 8u;
      if( AuditId < 0x5FF )
        AuditParametersa.Flags = v16 | 2;
    }
    ParameterCount = AuditParameters->ParameterCount;
    memmove(&AuditParametersa.Parameters[v15], AuditParameters->Parameters, 32 * ParameterCount);
    AuditParametersa.ParameterCount += ParameterCount;
    SepAdtLogAuditRecord(&AuditParametersa);
  }
LABEL_11:
  if( LOBYTE(SubjectContext[0]) < 2u && v8 && v8 != UserSid )
    SeReleaseSubjectContext((PSECURITY_SUBJECT_CONTEXT)&SubjectContext[1]);
  return 0;
}

Referenced by: