SepAdtTokenRightAdjusted

void __fastcall SepAdtTokenRightAdjusted(
        _TOKEN *Token,
        _LUID_AND_ATTRIBUTES *DisabledPrivileges,
        UINT64 DisabledCount,
        _LUID_AND_ATTRIBUTES *EnabledPrivileges,
        UINT64 EnabledCount,
        INT64 AccessGranted){
  unsigned int v6; 
  int *v9; 
  int *v10; 
  void *ClientToken; 
  void *PrimaryToken; 
  __int64 CurrentThreadProcess; 
  _QWORD *v14; 
  void *v15; 
  ULONG_PTR v16; 
  ULONG_PTR AuthenticationId; 
  int *PoolWithTag; 
  signed __int64 v19; 
  __int64 v20; 
  int *v21; 
  signed __int64 v22; 
  __int64 v23; 
  int v24; 
  ULONG v25; 
  int v26; 
  ULONG v27; 
  int v28; 
  ULONG v29; 
  unsigned int v30; 
  PVOID P; 
  _TOKEN *v32; 
  unsigned __int8 *v33; 
  ULONG_PTR v34; 
  struct _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  _SE_ADT_PARAMETER_ARRAY Src; 
  P = 0i64;
  v6 = DisabledCount;
  v32 = Token;
  v30 = DisabledCount;
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  v9 = 0i64;
  v10 = 0i64;
  SeCaptureSubjectContext(&SubjectContext);
  ClientToken = SubjectContext.ClientToken;
  PrimaryToken = SubjectContext.PrimaryToken;
  if( SubjectContext.ClientToken )
    PrimaryToken = SubjectContext.ClientToken;
  if( (unsigned __int8)SeAuditingWithTokenForSubcategory(0x8Aui64, PrimaryToken)
    && (SepAdtAuditablePrivilege(DisabledPrivileges, v6)
     || SepAdtAuditablePrivilege(EnabledPrivileges, (unsigned int)EnabledCount)) )
  {
    memset((INT64)&Src, 0i64);
    Src.CategoryId = 5;
    Src.FlatSubCategoryId = 138;
    Src.AuditId = 4703;
    Src.Type = 8;
    if( !(_BYTE)AccessGranted )
      Src.Type = 16;
    CurrentThreadProcess = PsGetCurrentThreadProcess();
    if( *(_QWORD *)(CurrentThreadProcess + 1472) )
    {
      v34 = *(_QWORD *)(CurrentThreadProcess + 1088);
      if( (int)PsGetAllocatedFullProcessImageNameEx(CurrentThreadProcess, &P) >= 0 )
      {
        v14 = SubjectContext.PrimaryToken;
        v15 = SubjectContext.PrimaryToken;
        if( ClientToken )
          v15 = ClientToken;
        if( ClientToken )
          v14 = ClientToken;
        v16 = v14[3];
        AuthenticationId = (ULONG_PTR)v32->AuthenticationId;
        v33 = (unsigned __int8 *)**((_QWORD **)v15 + 19);
        if( (_DWORD)EnabledCount )
        {
          PoolWithTag = (int *)ExAllocatePoolWithTag(
                                 PagedPool,
                                 (unsigned int)(12 * EnabledCount) + 20i64,
                                 0x70416553ui64);
          v9 = PoolWithTag;
          if( !PoolWithTag )
            goto LABEL_4;
          PoolWithTag[1] = 1;
          v19 = (char *)PoolWithTag - (char *)EnabledPrivileges;
          *PoolWithTag = EnabledCount;
          v20 = (unsigned int)EnabledCount;
          do
          {
            *(_LUID *)((char *)&EnabledPrivileges->Attributes + v19) = EnabledPrivileges->Luid;
            *(int *)((char *)&EnabledPrivileges[1].Luid.HighPart + v19) = EnabledPrivileges->Attributes;
            ++EnabledPrivileges;
            --v20;
          }
          while( v20 );
        }
        if( v30 )
        {
          v21 = (int *)ExAllocatePoolWithTag(PagedPool, 12 * v30 + 20i64, 0x70416553ui64);
          v10 = v21;
          if( !v21 )
            goto LABEL_4;
          v21[1] = 1;
          v22 = (char *)v21 - (char *)DisabledPrivileges;
          *v21 = v30;
          v23 = v30;
          do
          {
            *(_LUID *)((char *)&DisabledPrivileges->Attributes + v22) = DisabledPrivileges->Luid;
            *(int *)((char *)&DisabledPrivileges[1].Luid.HighPart + v22) = DisabledPrivileges->Attributes;
            ++DisabledPrivileges;
            --v23;
          }
          while( v23 );
        }
        Src.Parameters[0].Address = v33;
        Src.Parameters[0].Type = SeAdtParmTypeSid;
        Src.Parameters[1].Type = SeAdtParmTypeString;
        v24 = v33[1];
        Src.Parameters[1].Length = 32;
        Src.Parameters[2].Type = SeAdtParmTypeLogonId;
        Src.Parameters[2].Length = 8;
        Src.Parameters[0].Length = 4 * v24 + 8;
        Src.Parameters[1].Address = &SeSubsystemName;
        v25 = *(unsigned __int16 *)P + 16;
        Src.Parameters[2].Data[0] = v16;
        Src.Parameters[4].Length = v25;
        Src.Parameters[5].Data[0] = v34;
        Src.Parameters[3].Type = SeAdtParmTypeLogonIdEx;
        Src.Parameters[3].Length = 8;
        Src.Parameters[3].Data[0] = AuthenticationId;
        Src.Parameters[4].Type = SeAdtParmTypeFileSpec;
        Src.Parameters[4].Address = P;
        Src.Parameters[5].Type = SeAdtParmTypePtr;
        Src.Parameters[5].Length = 8;
        if( v9 )
        {
          v26 = *v9;
          Src.Parameters[6].Type = SeAdtParmTypePrivs;
          if( v26 )
            v27 = 12 * v26 + 8;
          else
            v27 = 8;
          Src.Parameters[6].Length = v27;
          Src.Parameters[6].Address = v9;
        }
        if( v10 )
        {
          v28 = *v10;
          Src.Parameters[7].Type = SeAdtParmTypePrivs;
          if( v28 )
            v29 = 12 * v28 + 8;
          else
            v29 = 8;
          Src.Parameters[7].Length = v29;
          Src.Parameters[7].Address = v10;
        }
        Src.ParameterCount = 8;
        SepAdtLogAuditRecord(&Src);
      }
    }
  }
LABEL_4:
  if( P )
    ExFreePoolWithTag(P, 0);
  if( v9 )
    ExFreePoolWithTag(v9, 0);
  if( v10 )
    ExFreePoolWithTag(v10, 0);
  SeReleaseSubjectContext(&SubjectContext);
}

Referenced by: