SeAuditTransactionStateChange

VOID __stdcall SeAuditTransactionStateChange(
        _GUID *TransactionId,
        _GUID *ResourceManagerId,
        UINT64 NewTransactionState){
  unsigned __int64 v4; 
  _GUID *v6; 
  _QWORD *PrimaryToken; 
  void *ClientToken; 
  unsigned __int64 v9; 
  unsigned __int8 *v10; 
  _EPROCESS *CurrentThreadProcess; 
  _UNICODE_STRING **v12; 
  int v13; 
  _KPROCESS *v14; 
  unsigned __int64 UniqueProcessId; 
  _UNICODE_STRING *ImageName[3]; 
  _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  _SE_ADT_PARAMETER_ARRAY AuditParameters; 
  __int128 v19; 

  SubjectContext.ClientToken = 0i64;
  v4 = (unsigned int)NewTransactionState;
  SubjectContext.ImpersonationLevel = 0x80000000;
  memset(&SubjectContext.ImpersonationLevel + 1, 0, 20);
  memset(&AuditParameters, 0i64, sizeof(AuditParameters));
  ImageName[0] = 0i64;
  v6 = (_GUID *)&v19;
  AuditParameters.CategoryId = 3;
  AuditParameters.FlatSubCategoryId = 116;
  AuditParameters.AuditId = 4985;
  if( ResourceManagerId )
    v6 = ResourceManagerId;
  v19 = 0i64;
  AuditParameters.Type = 8;
  *(_OWORD *)&ImageName[1] = 0i64;
  if( (_DWORD)v4 == 6 )
    AuditParameters.Type = 16;
  SeCaptureSubjectContext((INT64)&SubjectContext);
  PrimaryToken = SubjectContext.PrimaryToken;
  ClientToken = SubjectContext.PrimaryToken;
  if( SubjectContext.ClientToken )
    ClientToken = SubjectContext.ClientToken;
  if( SubjectContext.ClientToken )
    PrimaryToken = SubjectContext.ClientToken;
  v9 = PrimaryToken[3];
  v10 = (unsigned __int8 *)**((_QWORD **)ClientToken + 19);
  CurrentThreadProcess = (_EPROCESS *)PsGetCurrentThreadProcess();
  if( PsGetAllocatedFullProcessImageNameEx(CurrentThreadProcess, ImageName) < 0
    || (v12 = (_UNICODE_STRING **)ImageName[0]) == 0i64 )
  {
    RtlInitUnicodeString((PUNICODE_STRING)&ImageName[1], L"?");
    v12 = &ImageName[1];
    ImageName[0] = (_UNICODE_STRING *)&ImageName[1];
  }
  v13 = v10[1];
  AuditParameters.Parameters[2].Data[0] = v9;
  AuditParameters.Parameters[0].Type = SeAdtParmTypeSid;
  AuditParameters.Parameters[0].Address = v10;
  AuditParameters.Parameters[1].Type = SeAdtParmTypeString;
  AuditParameters.Parameters[0].Length = 4 * v13 + 8;
  AuditParameters.Parameters[1].Length = 32;
  AuditParameters.Parameters[2].Type = SeAdtParmTypeLogonId;
  AuditParameters.Parameters[1].Address = (void *)&SeSubsystemName;
  AuditParameters.Parameters[2].Length = 8;
  AuditParameters.Parameters[3].Type = SeAdtParmTypeGuid;
  AuditParameters.Parameters[3].Length = 16;
  AuditParameters.Parameters[3].Address = TransactionId;
  AuditParameters.Parameters[4].Type = SeAdtParmTypeUlong;
  AuditParameters.Parameters[4].Length = 4;
  AuditParameters.Parameters[4].Data[0] = v4;
  AuditParameters.Parameters[5].Type = SeAdtParmTypeGuid;
  AuditParameters.Parameters[5].Length = 16;
  AuditParameters.Parameters[5].Address = v6;
  AuditParameters.Parameters[6].Type = SeAdtParmTypePtr;
  AuditParameters.Parameters[6].Length = 8;
  v14 = (_EPROCESS *)PsGetCurrentThreadProcess();
  AuditParameters.Parameters[7].Type = SeAdtParmTypeFileSpec;
  AuditParameters.Parameters[7].Address = v12;
  AuditParameters.ParameterCount = 8;
  UniqueProcessId = (unsigned __int64)v14->UniqueProcessId;
  LODWORD(v14) = *(unsigned __int16 *)v12 + 16;
  AuditParameters.Parameters[6].Data[0] = UniqueProcessId;
  AuditParameters.Parameters[7].Length = (unsigned int)v14;
  SepAdtLogAuditRecord(&AuditParameters);
  SeReleaseSubjectContext(&SubjectContext);
  if( ImageName[0] )
  {
    if( (_UNICODE_STRING **)ImageName[0] != &ImageName[1] )
      ExFreePoolWithTag(ImageName[0], 0);
  }
}

Referenced by: