SeAuditHardLinkCreationWithTransaction

VOID __stdcall SeAuditHardLinkCreationWithTransaction(
        _UNICODE_STRING *FileName,
        _UNICODE_STRING *LinkName,
        UINT8 bSuccess,
        _GUID *TransactionId){
  _GUID *v8; 
  _QWORD *PrimaryToken; 
  _QWORD *ClientToken; 
  void **v11; 
  _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  _SE_ADT_PARAMETER_ARRAY AuditParameters; 
  __int128 v14; 

  SubjectContext.ClientToken = 0i64;
  SubjectContext.ImpersonationLevel = 0x80000000;
  memset(&SubjectContext.ImpersonationLevel + 1, 0, 20);
  memset(&AuditParameters, 0i64, sizeof(AuditParameters));
  AuditParameters.CategoryId = 3;
  AuditParameters.FlatSubCategoryId = 116;
  v8 = (_GUID *)&v14;
  AuditParameters.AuditId = 4664;
  if( TransactionId )
    v8 = TransactionId;
  AuditParameters.Type = 8;
  v14 = 0i64;
  if( !bSuccess )
    AuditParameters.Type = 16;
  SeCaptureSubjectContext((INT64)&SubjectContext);
  PrimaryToken = SubjectContext.PrimaryToken;
  ClientToken = SubjectContext.PrimaryToken;
  AuditParameters.Parameters[0].Type = SeAdtParmTypeSid;
  if( SubjectContext.ClientToken )
    ClientToken = SubjectContext.ClientToken;
  AuditParameters.Parameters[1].Type = SeAdtParmTypeString;
  if( SubjectContext.ClientToken )
    PrimaryToken = SubjectContext.ClientToken;
  AuditParameters.Parameters[1].Length = 32;
  AuditParameters.Parameters[2].Type = SeAdtParmTypeLogonId;
  AuditParameters.Parameters[3].Type = SeAdtParmTypeFileSpec;
  v11 = (void **)ClientToken[19];
  AuditParameters.Parameters[4].Type = SeAdtParmTypeFileSpec;
  AuditParameters.Parameters[2].Length = 8;
  AuditParameters.Parameters[3].Address = FileName;
  AuditParameters.Parameters[0].Address = *v11;
  AuditParameters.Parameters[4].Address = LinkName;
  AuditParameters.Parameters[5].Type = SeAdtParmTypeGuid;
  LODWORD(v11) = *((unsigned __int8 *)AuditParameters.Parameters[0].Address + 1);
  AuditParameters.Parameters[5].Length = 16;
  AuditParameters.Parameters[5].Address = v8;
  AuditParameters.ParameterCount = 6;
  AuditParameters.Parameters[0].Length = 4 * (_DWORD)v11 + 8;
  AuditParameters.Parameters[1].Address = (void *)&SeSubsystemName;
  AuditParameters.Parameters[2].Data[0] = PrimaryToken[3];
  AuditParameters.Parameters[3].Length = FileName->Length + 16;
  AuditParameters.Parameters[4].Length = LinkName->Length + 16;
  SepAdtLogAuditRecord(&AuditParameters);
  SeReleaseSubjectContext(&SubjectContext);
}

Referenced by: