CmpReportAuditVirtualizationEvent

__int64 __fastcall CmpReportAuditVirtualizationEvent(__int64 a1, __int64 a2){
  _UNICODE_STRING *p_UnicodeString; 
  _UNICODE_STRING *v5; 
  int AllocatedFullProcessImageName; 
  unsigned int v7; 
  UINT64 v8; 
  unsigned int v9; 
  _EPROCESS *CurrentThreadProcess; 
  UINT64 v11; 
  NTSTATUS v12; 
  UINT64 AuditFlatSubCategoryId; 
  PVOID v15; 
  _UNICODE_STRING UnicodeString; 
  _UNICODE_STRING *ImageName; 
  __int64 Data; 
  _UNICODE_STRING v19; 
  _UNICODE_STRING DestinationString; 
  _SE_ADT_PARAMETER_ARRAY AuditParameters; 

  memset(&AuditParameters, 0i64, sizeof(AuditParameters));
  ImageName = 0i64;
  DestinationString = 0i64;
  p_UnicodeString = 0i64;
  v5 = 0i64;
  v19 = 0i64;
  UnicodeString = 0i64;
  RtlInitUnicodeString(&DestinationString, L"Security");
  AuditParameters.AuditId = 5039;
  AuditParameters.Type = 8;
  AuditParameters.CategoryId = 3;
  AuditParameters.ParameterCount = 0;
  Data = *(_QWORD *)(CmpEffectiveTokenForSubject((INT64 *)a2, 0i64) + 24);
  AllocatedFullProcessImageName = SeSetAuditParameter(&AuditParameters, SeAdtParmTypeLogonId, 0i64, &Data);
  v7 = ++AuditParameters.ParameterCount;
  if( AllocatedFullProcessImageName < 0 )
    goto LABEL_18;
  if( CmpVEEnabled && (*(_DWORD *)(a1 + 184) & 0x1000000) != 0 )
  {
    v15 = 0i64;
    CmpConstructNameWithStatus((_CM_KEY_CONTROL_BLOCK *)a1, (_UNICODE_STRING **)&v15);
    v5 = (_UNICODE_STRING *)v15;
    if( !v15 )
    {
LABEL_5:
      AllocatedFullProcessImageName = -1073741670;
      goto LABEL_18;
    }
    AllocatedFullProcessImageName = CmVirtualKCBToRealPath(a1, &UnicodeString);
    if( AllocatedFullProcessImageName >= 0 )
    {
      p_UnicodeString = &UnicodeString;
LABEL_11:
      AllocatedFullProcessImageName = SeSetAuditParameter(&AuditParameters, SeAdtParmTypeString, v7, p_UnicodeString);
      v8 = ++AuditParameters.ParameterCount;
      if( AllocatedFullProcessImageName >= 0 )
      {
        AllocatedFullProcessImageName = SeSetAuditParameter(&AuditParameters, SeAdtParmTypeString, v8, v5);
        v9 = ++AuditParameters.ParameterCount;
        if( AllocatedFullProcessImageName >= 0 )
        {
          CurrentThreadProcess = (_EPROCESS *)PsGetCurrentThreadProcess();
          AllocatedFullProcessImageName = PsGetAllocatedFullProcessImageNameEx(CurrentThreadProcess, &ImageName);
          if( AllocatedFullProcessImageName >= 0 )
          {
            AllocatedFullProcessImageName = SeSetAuditParameter(
                                              &AuditParameters,
                                              SeAdtParmTypePtr,
                                              v9,
                                              *(VOID **)(a2 + 24));
            v11 = ++AuditParameters.ParameterCount;
            if( AllocatedFullProcessImageName >= 0 )
            {
              v12 = SeSetAuditParameter(&AuditParameters, SeAdtParmTypeFileSpec, v11, ImageName);
              ++AuditParameters.ParameterCount;
              AllocatedFullProcessImageName = v12;
              if( v12 >= 0 )
              {
                LODWORD(AuditFlatSubCategoryId) = 117;
                AllocatedFullProcessImageName = SeReportSecurityEventWithSubCategory(
                                                  0i64,
                                                  &DestinationString,
                                                  0i64,
                                                  &AuditParameters,
                                                  AuditFlatSubCategoryId);
                if( AllocatedFullProcessImageName >= 0 )
                  AllocatedFullProcessImageName = 0;
              }
            }
          }
        }
      }
    }
  }
  else
  {
    v15 = 0i64;
    CmpConstructNameWithStatus((_CM_KEY_CONTROL_BLOCK *)a1, (_UNICODE_STRING **)&v15);
    p_UnicodeString = (_UNICODE_STRING *)v15;
    if( !v15 )
      goto LABEL_5;
    RtlInitUnicodeString(&v19, 0i64);
    AllocatedFullProcessImageName = CmRealKCBToVirtualPath(a1, (__m128i *)&v19, a2, &UnicodeString);
    if( AllocatedFullProcessImageName >= 0 )
    {
      v5 = &UnicodeString;
      goto LABEL_11;
    }
  }
LABEL_18:
  if( ImageName )
    ExFreePoolWithTag(ImageName, 0x61506553u);
  if( p_UnicodeString == &UnicodeString )
  {
    RtlFreeAnsiString(&UnicodeString);
  }
  else if( p_UnicodeString )
  {
    CmpFreeTransientPoolWithTag(p_UnicodeString, 0x624E4D43ui64);
  }
  if( v5 == &UnicodeString )
  {
    RtlFreeAnsiString(&UnicodeString);
  }
  else if( v5 )
  {
    CmpFreeTransientPoolWithTag(v5, 0x624E4D43ui64);
  }
  return(unsigned int)AllocatedFullProcessImageName;
}

Referenced by: