NtPrivilegedServiceAuditAlarm

NTSTATUS __stdcall NtPrivilegedServiceAuditAlarm(
        _UNICODE_STRING *SubsystemName,
        _UNICODE_STRING *ServiceName,
        VOID *ClientToken,
        PRIVILEGE_SET *Privileges,
        UINT8 AccessGranted){
  char PreviousMode; 
  int v10; 
  INT64 v11; 
  INT64 v12; 
  _ADAPTER_OBJECT *v13; 
  unsigned int PrivilegeCount; 
  UINT64 v15; 
  char *v16; 
  VOID **PoolWithTag; 
  _PRIVILEGE_SET *v18; 
  _UNICODE_STRING *v19; 
  _UNICODE_STRING *v20; 
  NTSTATUS v22; 
  INT64 v23; 
  PVOID *Object; 
  POBJECT_HANDLE_INFORMATION HandleInformation; 
  INT64 v26; 
  INT64 v27; 
  int v28; 
  PVOID v29; 
  VOID **v30; 
  _UNICODE_STRING *CapturedServiceName; 
  _UNICODE_STRING *DestString; 
  _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  unsigned int v34; 
  unsigned int v35; 

  v30 = 0i64;
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  DestString = 0i64;
  CapturedServiceName = 0i64;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  SeCaptureSubjectContext((INT64)&SubjectContext);
  if( !SeCheckAuditPrivilege(&SubjectContext, PreviousMode) )
  {
    v22 = -1073741727;
LABEL_36:
    SeReleaseSubjectContext(&SubjectContext);
    return v22;
  }
  v29 = 0i64;
  v10 = ObReferenceObjectByHandle(ClientToken, 8ui64, (_OBJECT_TYPE *)SeTokenObjectType, PreviousMode, &v29, 0i64);
  v28 = v10;
  if( v10 < 0 )
  {
    SeReleaseSubjectContext(&SubjectContext);
    if( v10 == -1073741816 )
      return v10;
    v23 = (unsigned int)v10;
LABEL_33:
    SepAuditFailed(v23);
    return v10;
  }
  v13 = (_ADAPTER_OBJECT *)v29;
  if( *((_DWORD *)v29 + 48) == 2 && *((int *)v29 + 49) < 1 )
  {
    HalPutDmaAdapter((PADAPTER_OBJECT)v29);
    v22 = -1073741659;
    goto LABEL_36;
  }
  if( SubsystemName
    && (v10 = SepProbeAndCaptureString_U(
                SubsystemName,
                &DestString,
                v11,
                v12,
                (INT64)Object,
                (INT64)HandleInformation,
                v26,
                v27),
        v28 = v10,
        v10 < 0)
    || ServiceName
    && (v10 = SepProbeAndCaptureString_U(
                ServiceName,
                &CapturedServiceName,
                v11,
                v12,
                (INT64)Object,
                (INT64)HandleInformation,
                v26,
                v27),
        v28 = v10,
        v10 < 0) )
  {
    v18 = (_PRIVILEGE_SET *)v30;
  }
  else
  {
    if( ((unsigned __int8)Privileges & 3) != 0 )
      ExRaiseDatatypeMisalignment();
    PrivilegeCount = Privileges->PrivilegeCount;
    v34 = PrivilegeCount;
    if( PrivilegeCount >= 0x43 )
    {
      v10 = -1073741811;
      v18 = (_PRIVILEGE_SET *)v30;
    }
    else
    {
      v15 = 12 * PrivilegeCount + 8;
      v35 = 12 * PrivilegeCount + 8;
      if( 12 * PrivilegeCount != -8 )
      {
        v16 = (char *)Privileges + (unsigned int)v15;
        if( (unsigned __int64)v16 > 0x7FFFFFFF0000i64 || v16 < (char *)Privileges )
          MEMORY[0x7FFFFFFF0000] = 0;
      }
      PoolWithTag = ExAllocatePoolWithTag(1ui64, v15, 1917871443i64);
      v18 = (_PRIVILEGE_SET *)PoolWithTag;
      v30 = PoolWithTag;
      if( PoolWithTag )
      {
        memmove(PoolWithTag, Privileges, 12 * PrivilegeCount + 8);
        v18->PrivilegeCount = PrivilegeCount;
        v10 = v28;
      }
      else
      {
        v10 = -1073741670;
      }
    }
    v13 = (_ADAPTER_OBJECT *)v29;
  }
  if( v10 < 0 )
  {
    if( DestString )
      ExFreePoolWithTag(DestString, 0);
    if( CapturedServiceName )
      ExFreePoolWithTag(CapturedServiceName, 0);
    if( v18 )
      ExFreePoolWithTag(v18, 0);
    SeReleaseSubjectContext(&SubjectContext);
    HalPutDmaAdapter(v13);
    if( v10 != -1073741670 )
      return v10;
    v23 = 3221225626i64;
    goto LABEL_33;
  }
  v19 = CapturedServiceName;
  v20 = DestString;
  SepAdtPrivilegedServiceAuditAlarm(
    &SubjectContext,
    DestString,
    CapturedServiceName,
    (_TOKEN *)v13,
    (_TOKEN *)SubjectContext.PrimaryToken,
    v18,
    AccessGranted);
  if( v20 )
    ExFreePoolWithTag(v20, 0);
  if( v19 )
    ExFreePoolWithTag(v19, 0);
  if( v18 )
    ExFreePoolWithTag(v18, 0);
  HalPutDmaAdapter(v13);
  SeReleaseSubjectContext(&SubjectContext);
  return 0;
}

Referenced by: