SeTokenDefaultDaclChangedAuditAlarm

void __fastcall SeTokenDefaultDaclChangedAuditAlarm(__int64 a1, void *a2, VOID *a3, _ACL *a4, _ACL *NewDefaultDacl){
  PVOID v5; 
  PVOID v6; 
  PVOID v7; 
  UNICODE_STRING *v10; 
  PVOID **PrimaryToken; 
  int TypeString; 
  NTSTATUS v13; 
  NTSTATUS v14; 
  UINT64 SecurityInformation; 
  PVOID P; 
  PVOID NewSecurityDescriptor; 
  struct _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  __int128 SecurityDescriptor[2]; 
  __int64 v20; 
  __int128 InputSecurityDescriptor[2]; 
  __int64 v22; 
  PVOID OutputSecurityDescriptor; 
  PVOID HandleId; 
  HandleId = a3;
  v5 = 0i64;
  v20 = 0i64;
  v6 = 0i64;
  P = 0i64;
  v7 = 0i64;
  v22 = 0i64;
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  OutputSecurityDescriptor = 0i64;
  NewSecurityDescriptor = 0i64;
  memset(SecurityDescriptor, 0, sizeof(SecurityDescriptor));
  v10 = 0i64;
  memset(InputSecurityDescriptor, 0, sizeof(InputSecurityDescriptor));
  SeCaptureSubjectContext(&SubjectContext);
  PrimaryToken = (PVOID **)SubjectContext.PrimaryToken;
  if( SubjectContext.ClientToken )
    PrimaryToken = (PVOID **)SubjectContext.ClientToken;
  if( PrimaryToken )
  {
    if( !SepAdtAuditThisEventWithContext(0x8Dui64, 1u, 0, &SubjectContext) || SepIsAclEqual(a4, NewDefaultDacl) )
    {
LABEL_5:
      SeReleaseSubjectContext(&SubjectContext);
      return;
    }
    if( a2 )
    {
      TypeString = SepQueryTypeString(a2, (UNICODE_STRING **)&P);
      v5 = P;
      v13 = TypeString;
      if( TypeString < 0 )
      {
LABEL_20:
        if( v5 )
          ExFreePoolWithTag(v5, 0);
        if( v6 )
          SeReleaseSecurityDescriptor(v6, 0, 1u);
        if( v7 )
          SeReleaseSecurityDescriptor(v7, 0, 1u);
        if( v13 < 0 )
          SepAuditFailed((unsigned int)v13);
        goto LABEL_5;
      }
      if( P )
        v10 = (UNICODE_STRING *)P;
    }
    v13 = RtlCreateSecurityDescriptor(SecurityDescriptor, 1ui64);
    if( v13 >= 0 )
    {
      v13 = RtlSetDaclSecurityDescriptor(SecurityDescriptor, 1u, a4, 0);
      if( v13 >= 0 )
      {
        v13 = SeCaptureSecurityDescriptor(SecurityDescriptor, 0, PagedPool, 1u, &OutputSecurityDescriptor);
        if( v13 < 0
          || (v13 = RtlCreateSecurityDescriptor(InputSecurityDescriptor, 1ui64), v13 < 0)
          || (v13 = RtlSetDaclSecurityDescriptor(InputSecurityDescriptor, 1u, NewDefaultDacl, 0), v13 < 0) )
        {
          v6 = OutputSecurityDescriptor;
        }
        else
        {
          v14 = SeCaptureSecurityDescriptor(InputSecurityDescriptor, 0, PagedPool, 1u, &NewSecurityDescriptor);
          v7 = NewSecurityDescriptor;
          v13 = v14;
          v6 = OutputSecurityDescriptor;
          if( v14 >= 0 )
          {
            LODWORD(SecurityInformation) = 4;
            SepAdtSecurityDescriptorChangedAuditAlarm(
              &SubjectContext,
              (UNICODE_STRING *)&SeSubsystemName,
              v10,
              0i64,
              HandleId,
              *PrimaryToken[19],
              OutputSecurityDescriptor,
              SecurityInformation,
              NewSecurityDescriptor);
          }
        }
      }
    }
    goto LABEL_20;
  }
  SepAuditFailed(3221225596i64);
}

Referenced by: