NtDeleteObjectAuditAlarm

NTSTATUS __stdcall NtDeleteObjectAuditAlarm(_UNICODE_STRING *SubsystemName, VOID *HandleId, UINT8 GenerateOnClose){
  char PreviousMode; 
  int v7; 
  INT64 v8; 
  INT64 v9; 
  INT64 v10; 
  INT64 v11; 
  INT64 IsKernelObject; 
  INT64 v13; 
  _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  _UNICODE_STRING *DestString; 

  memset(&SubjectContext, 0, sizeof(SubjectContext));
  DestString = 0i64;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  if( !GenerateOnClose )
    return 0;
  SeCaptureSubjectContext((INT64)&SubjectContext);
  if( SubjectContext.PrimaryToken )
  {
    if( SeCheckAuditPrivilege(&SubjectContext, PreviousMode) )
    {
      v7 = SepProbeAndCaptureString_U(
             SubsystemName,
             &DestString,
             v9,
             v10,
             v11,
             IsKernelObject,
             v13,
             (INT64)SubjectContext.ClientToken);
      if( v7 >= 0 )
        SepAdtDeleteObjectAuditAlarm(DestString, HandleId, &SubjectContext, 0i64, 0i64, 0);
    }
    else
    {
      v7 = -1073741727;
    }
    SeReleaseSubjectContext(&SubjectContext);
    if( DestString )
      ExFreePoolWithTag(DestString, 0);
    v8 = 3221225626i64;
    if( v7 != -1073741670 )
      return v7;
  }
  else
  {
    v7 = -1073741700;
    v8 = 3221225596i64;
  }
  SepAuditFailed(v8);
  return v7;
}

Referenced by: