SepAdtDeleteObjectAuditAlarm

VOID __stdcall SepAdtDeleteObjectAuditAlarm(
        _UNICODE_STRING *CapturedSubsystemName,
        VOID *HandleId,
        _SECURITY_SUBJECT_CONTEXT *SubjectSecurityContext,
        VOID *Object,
        _GUID *TransactionId,
        UINT8 IsKernelObject){
  _EPROCESS *CurrentThreadProcess; 
  NTSTATUS AllocatedFullProcessImageName; 
  _GUID *v11; 
  _UNICODE_STRING *v12; 
  unsigned __int64 *ClientToken; 
  _QWORD **PrimaryToken; 
  void *v15; 
  void **v16; 
  unsigned int v17; 
  unsigned __int64 v18; 
  UINT8 IsKernelHandle; 
  __int64 v20; 
  unsigned __int64 v21; 
  _SE_ADT_PARAMETER_TYPE v22; 
  _KPROCESS *v23; 
  UINT16 FlatSubCategoryId; 
  _UNICODE_STRING *ImageName; 
  _SE_ADT_PARAMETER_ARRAY AuditParameters; 
  __int128 v27; 

  ImageName = 0i64;
  FlatSubCategoryId = 0;
  v27 = 0i64;
  if( SepAdtAuditObjectAccessWithContext(
         Object,
         CapturedSubsystemName,
         1u,
         0,
         0i64,
         IsKernelObject,
         &FlatSubCategoryId) )
  {
    CurrentThreadProcess = (_EPROCESS *)PsGetCurrentThreadProcess();
    AllocatedFullProcessImageName = PsGetAllocatedFullProcessImageNameEx(CurrentThreadProcess, &ImageName);
    if( AllocatedFullProcessImageName < 0 )
    {
      SepAuditFailed((unsigned int)AllocatedFullProcessImageName);
    }
    else
    {
      v11 = (_GUID *)&v27;
      if( TransactionId )
        v11 = TransactionId;
      memset(&AuditParameters, 0i64, sizeof(AuditParameters));
      v12 = (_UNICODE_STRING *)&SeSubsystemName;
      ClientToken = (unsigned __int64 *)SubjectSecurityContext->ClientToken;
      AuditParameters.FlatSubCategoryId = FlatSubCategoryId;
      AuditParameters.CategoryId = 3;
      PrimaryToken = (_QWORD **)ClientToken;
      if( CapturedSubsystemName )
        v12 = CapturedSubsystemName;
      AuditParameters.AuditId = 4660;
      AuditParameters.Type = 8;
      AuditParameters.Parameters[0].Type = SeAdtParmTypeSid;
      if( !ClientToken )
        PrimaryToken = (_QWORD **)SubjectSecurityContext->PrimaryToken;
      AuditParameters.Parameters[0].Length = 4 * *(unsigned __int8 *)(*PrimaryToken[19] + 1i64) + 8;
      v15 = ClientToken;
      if( !ClientToken )
        v15 = SubjectSecurityContext->PrimaryToken;
      v16 = (void **)*((_QWORD *)v15 + 19);
      AuditParameters.Parameters[1].Type = SeAdtParmTypeString;
      AuditParameters.Parameters[1].Address = v12;
      AuditParameters.Parameters[2].Type = SeAdtParmTypeLogonId;
      AuditParameters.Parameters[0].Address = *v16;
      v17 = v12->Length + 16;
      AuditParameters.Parameters[2].Length = 8;
      AuditParameters.Parameters[1].Length = v17;
      if( !ClientToken )
        ClientToken = (unsigned __int64 *)SubjectSecurityContext->PrimaryToken;
      v18 = ClientToken[3];
      AuditParameters.Parameters[3].Address = v12;
      AuditParameters.Parameters[3].Length = v17;
      AuditParameters.Parameters[4].Type = SeAdtParmTypePtr;
      AuditParameters.Parameters[2].Data[0] = v18;
      AuditParameters.Parameters[3].Type = SeAdtParmTypeString;
      AuditParameters.Parameters[4].Length = 8;
      IsKernelHandle = ObpIsKernelHandle(HandleId, 0);
      v21 = v20 ^ 0xFFFFFFFF80000000ui64;
      AuditParameters.Parameters[5].Type = v22;
      AuditParameters.Parameters[5].Length = 8;
      if( !IsKernelHandle )
        v21 = (unsigned __int64)HandleId;
      AuditParameters.Parameters[4].Data[0] = v21 & 0xFFFFFFFFFFFFFFFCui64;
      v23 = (_EPROCESS *)PsGetCurrentThreadProcess();
      AuditParameters.Parameters[6].Type = SeAdtParmTypeFileSpec;
      AuditParameters.Parameters[7].Type = SeAdtParmTypeGuid;
      AuditParameters.Parameters[7].Length = 16;
      AuditParameters.Parameters[5].Data[0] = (unsigned __int64)v23->UniqueProcessId;
      AuditParameters.Parameters[6].Address = ImageName;
      AuditParameters.Parameters[7].Address = v11;
      AuditParameters.ParameterCount = 8;
      AuditParameters.Parameters[6].Length = ImageName->Length + 16;
      SepAdtLogAuditRecord(&AuditParameters);
    }
    if( ImageName )
      ExFreePoolWithTag(ImageName, 0);
  }
}

Referenced by: