SepAdtPrivilegeObjectAuditAlarm

UINT8 __fastcall SepAdtPrivilegeObjectAuditAlarm(
        _UNICODE_STRING *CapturedSubsystemName,
        _UNICODE_STRING *ObjectTypeName,
        _UNICODE_STRING *AbsoluteObjectName,
        VOID *HandleId,
        _TOKEN *ClientToken,
        _TOKEN *PrimaryToken,
        VOID *ProcessId,
        UINT64 DesiredAccess,
        _PRIVILEGE_SET *CapturedPrivileges,
        UINT8 AccessGranted){
  _UNICODE_STRING *v10; 
  _UNICODE_STRING *v11; 
  _SID_AND_ATTRIBUTES *v13; 
  unsigned __int8 *Sid; 
  __int64 CurrentThreadProcess; 
  int AllocatedFullProcessImageName; 
  _UNICODE_STRING *v17; 
  _LUID AuthenticationId; 
  int v19; 
  ULONG v20; 
  int Length; 
  int v22; 
  UINT8 IsKernelHandle; 
  unsigned __int64 v24; 
  unsigned __int32 v25; 
  ULONG_PTR v26; 
  int v27; 
  __int64 v28; 
  unsigned __int64 v29; 
  unsigned int PrivilegeCount; 
  int v31; 
  UINT16 FlatSubCategoryId[4]; 
  PVOID P; 
  _UNICODE_STRING *v34; 
  PVOID Handle; 
  _SE_ADT_PARAMETER_ARRAY Src; 
  v34 = CapturedSubsystemName;
  v10 = AbsoluteObjectName;
  Handle = HandleId;
  LOBYTE(AbsoluteObjectName) = AccessGranted == 0;
  v11 = ObjectTypeName;
  FlatSubCategoryId[0] = 0;
  P = 0i64;
  LOBYTE(ObjectTypeName) = AccessGranted;
  if( !(unsigned __int8)SepAdtAuditPrivilegeUseWithContext(
                           CapturedPrivileges,
                           (INT64)ObjectTypeName,
                           (INT64)AbsoluteObjectName,
                           0i64,
                           FlatSubCategoryId) )
    return 0;
  v13 = ClientToken ? ClientToken->UserAndGroups : PrimaryToken->UserAndGroups;
  Sid = (unsigned __int8 *)v13->Sid;
  if( RtlEqualSid(SeLocalSystemSid, v13->Sid) )
    return 0;
  CurrentThreadProcess = PsGetCurrentThreadProcess();
  AllocatedFullProcessImageName = PsGetAllocatedFullProcessImageNameEx(CurrentThreadProcess, &P);
  if( AllocatedFullProcessImageName < 0 )
  {
    SepAuditFailed((unsigned int)AllocatedFullProcessImageName);
    return 0;
  }
  v17 = (_UNICODE_STRING *)&SeSubsystemName;
  AuthenticationId = PrimaryToken->AuthenticationId;
  if( v34 )
    v17 = v34;
  memset((INT64)&Src, 0i64);
  Src.CategoryId = 4;
  Src.FlatSubCategoryId = FlatSubCategoryId[0];
  Src.AuditId = 4674;
  Src.Type = 8;
  if( !AccessGranted )
    Src.Type = 16;
  v19 = Sid[1];
  v20 = v17->Length + 16;
  Src.Parameters[0].Address = Sid;
  Src.Parameters[0].Type = SeAdtParmTypeSid;
  Src.Parameters[1].Type = SeAdtParmTypeString;
  Src.Parameters[0].Length = 4 * v19 + 8;
  Src.Parameters[1].Length = v20;
  Src.Parameters[1].Address = v17;
  Src.Parameters[2].Type = SeAdtParmTypeLogonId;
  Src.Parameters[2].Length = 8;
  if( ClientToken )
    Src.Parameters[2].Data[0] = (ULONG_PTR)ClientToken->AuthenticationId;
  else
    Src.Parameters[2].Data[0] = (ULONG_PTR)AuthenticationId;
  Src.Parameters[3].Type = SeAdtParmTypeString;
  Src.Parameters[3].Length = v20;
  Src.Parameters[3].Address = v17;
  if( v11 )
  {
    Length = v11->Length;
    Src.Parameters[4].Type = SeAdtParmTypeString;
    Src.Parameters[4].Length = Length + 16;
    Src.Parameters[4].Address = v11;
  }
  if( v10 )
  {
    v22 = v10->Length;
    Src.Parameters[5].Type = SeAdtParmTypeFileSpec;
    Src.Parameters[5].Length = v22 + 16;
    Src.Parameters[5].Address = v10;
  }
  Src.Parameters[6].Type = SeAdtParmTypePtr;
  Src.Parameters[6].Length = 8;
  IsKernelHandle = ObpIsKernelHandle(Handle, 0);
  v29 = v28 ^ 0xFFFFFFFF80000000ui64;
  Src.Parameters[7].Length = v26;
  Src.Parameters[7].Data[0] = (unsigned int)DesiredAccess;
  if( !IsKernelHandle )
    v29 = v24;
  Src.Parameters[6].Data[0] = v29 & 0xFFFFFFFFFFFFFFFCui64;
  if( v11 )
  {
    Src.Parameters[7].Type = SeAdtParmTypeAccessMask;
    Src.Parameters[7].Data[1] = v26;
  }
  else
  {
    Src.Parameters[7].Type = SeAdtParmTypeUlong;
  }
  if( CapturedPrivileges )
  {
    PrivilegeCount = CapturedPrivileges->PrivilegeCount;
    if( CapturedPrivileges->PrivilegeCount )
    {
      Src.Parameters[8].Type = v25;
      Src.Parameters[8].Address = CapturedPrivileges;
      Src.Parameters[8].Length = 12 * PrivilegeCount + 8;
    }
  }
  Src.Parameters[9].Data[0] = (ULONG_PTR)ProcessId;
  Src.Parameters[9].Type = SeAdtParmTypePtr;
  v31 = *(unsigned __int16 *)P;
  Src.Parameters[9].Length = v25;
  Src.Parameters[10].Length = v27 + v31;
  Src.Parameters[10].Type = SeAdtParmTypeFileSpec;
  Src.Parameters[10].Address = P;
  Src.ParameterCount = 11;
  SepAdtLogAuditRecord(&Src);
  ExFreePoolWithTag(P, 0);
  return 1;
}

Referenced by: