SepAuditFailed
VOID __stdcall SepAuditFailed(INT64 AuditStatus){
void *v1;
NTSTATUS v2;
NTSTATUS v3;
UINT64 DataSize;
_UNICODE_STRING DestinationString;
int BugCheckParameter4;
DestinationString = 0i64;
v1 = (void *)(int)AuditStatus;
if( SepCrashOnAuditFail )
{
if( *(_QWORD *)&SepAdtRegNotifyHandle )
{
SepAdtLogAuditFailureEvent((unsigned int)AuditStatus, 1u);
RtlInitUnicodeString(&DestinationString, L"CrashOnAuditFail");
BugCheckParameter4 = 2;
do
{
do
{
LODWORD(DataSize) = 4;
v2 = ZwSetValueKey(
*(VOID **)&SepAdtRegNotifyHandle,
&DestinationString,
0i64,
4ui64,
&BugCheckParameter4,
DataSize);
}
while( v2 == -1073741670 );
}
while( v2 == -1073741801 );
if( v2 >= 0 )
{
do
{
do
v3 = ZwFlushKey(*(VOID **)&SepAdtRegNotifyHandle);
while( v3 == -1073741670 );
}
while( v3 == -1073741801 );
}
KeBugCheckEx(0xC0000244, v1, 0i64, 0i64, 0i64);
}
SepCrashOnAuditFail = 0;
}
}Referenced by:
NtCloseObjectAuditAlarm
NtDeleteObjectAuditAlarm
NtOpenObjectAuditAlarm
NtPrivilegeObjectAuditAlarm
NtPrivilegedServiceAuditAlarm
SeAdtRegistryValueChangedAuditAlarm
SeAuditFipsCryptoSelftests
SeAuditProcessCreation
SeAuditProcessExit
SeAuditSystemTimeChange
SeOpenObjectAuditAlarmWithTransaction
SeOpenObjectForDeleteAuditAlarmWithTransaction
SeOperationAuditAlarm
SeSecurityDescriptorChangedAuditAlarm
SeTokenDefaultDaclChangedAuditAlarm
SepAccessCheckAndAuditAlarmWithAdminlessChecks
SepAdtAuditPrivilegeUseWithContext
SepAdtAuditThisEventByCategoryWithContext
SepAdtAuditThisEventWithContext
SepAdtCloseObjectAuditAlarm
SepAdtDeleteObjectAuditAlarm
SepAdtObjectReferenceAuditAlarm
SepAdtOpenObjectAuditAlarm
SepAdtPrivilegeObjectAuditAlarm
SepAdtPrivilegedServiceAuditAlarm
SepAdtSecurityDescriptorChangedAuditAlarm
SepAdtStagingEvent
SepAuditAssignPrimaryToken
SepAuditFailedRaisedIrql
SepInitProcessAuditSd
SepRmCallLsa
SepRmCommandServerThread
SepRmDispatchDataToLsa