SeAuditProcessExit

VOID __stdcall SeAuditProcessExit(_EPROCESS *Process, INT64 ExitStatus){
  unsigned __int64 v3; 
  NTSTATUS AllocatedFullProcessImageName; 
  _ADAPTER_OBJECT *v5; 
  unsigned __int8 **MasterAdapter; 
  unsigned __int8 *v7; 
  unsigned int v8; 
  _UNICODE_STRING *ImageName; 
  _SE_ADT_PARAMETER_ARRAY AuditParameters; 

  ImageName = 0i64;
  v3 = (unsigned int)ExitStatus;
  memset(&AuditParameters, 0i64, sizeof(AuditParameters));
  AllocatedFullProcessImageName = PsGetAllocatedFullProcessImageNameEx(Process, &ImageName);
  if( AllocatedFullProcessImageName < 0 )
  {
    SepAuditFailed((unsigned int)AllocatedFullProcessImageName);
  }
  else
  {
    v5 = (_ADAPTER_OBJECT *)PsReferencePrimaryToken(Process);
    *(_DWORD *)&AuditParameters.FlatSubCategoryId = 524422;
    AuditParameters.AuditId = 4689;
    AuditParameters.CategoryId = 5;
    MasterAdapter = (unsigned __int8 **)v5->MasterAdapter;
    AuditParameters.Parameters[1].Address = (void *)&SeSubsystemName;
    AuditParameters.Parameters[2].Data[0] = (unsigned __int64)v5->AdapterObject.ScatterBufferListHead;
    v7 = *MasterAdapter;
    AuditParameters.Parameters[4].Data[0] = (unsigned __int64)Process->UniqueProcessId;
    AuditParameters.Parameters[0].Type = SeAdtParmTypeSid;
    LODWORD(MasterAdapter) = v7[1];
    AuditParameters.Parameters[0].Address = v7;
    AuditParameters.Parameters[1].Type = SeAdtParmTypeString;
    AuditParameters.Parameters[1].Length = 32;
    AuditParameters.Parameters[2].Type = SeAdtParmTypeLogonId;
    AuditParameters.Parameters[0].Length = 4 * (_DWORD)MasterAdapter + 8;
    AuditParameters.Parameters[5].Address = ImageName;
    AuditParameters.Parameters[2].Length = 8;
    AuditParameters.Parameters[3].Type = SeAdtParmTypeHexUlong;
    v8 = ImageName->Length + 16;
    AuditParameters.Parameters[3].Length = 4;
    AuditParameters.Parameters[5].Length = v8;
    AuditParameters.Parameters[3].Data[0] = v3;
    AuditParameters.Parameters[4].Type = SeAdtParmTypePtr;
    AuditParameters.Parameters[4].Length = 8;
    AuditParameters.Parameters[5].Type = SeAdtParmTypeFileSpec;
    AuditParameters.ParameterCount = 6;
    SepAdtLogAuditRecord(&AuditParameters);
    HalPutDmaAdapter(v5);
  }
  if( ImageName )
    ExFreePoolWithTag(ImageName, 0);
}

Referenced by: