SepAdtStagingEvent

BOOL __fastcall SepAdtStagingEvent(
        INT16 a1,
        INT64 a2,
        UINT64 *a3,
        const UNICODE_STRING *a4,
        UINT16 *a5,
        INT64 a6,
        INT64 a7,
        INT64 a8,
        INT64 a9,
        UINT8 a10,
        INT64 a11,
        INT64 a12){
  char *PoolWithTag; 
  ULONG_PTR v13; 
  UINT8 *v14; 
  SECURITY_DESCRIPTOR *v15; 
  __int64 v16; 
  __int64 CurrentThreadProcess; 
  int v18; 
  unsigned __int8 **v19; 
  ULONG_PTR v20; 
  int v21; 
  int v22; 
  int v23; 
  ULONG v24; 
  int v25; 
  UINT8 IsKernelHandle; 
  unsigned __int64 v27; 
  __int64 v28; 
  unsigned __int64 v29; 
  SECURITY_DESCRIPTOR *v30; 
  UINT64 v31; 
  UINT64 v32; 
  char *v33; 
  int v34; 
  __int64 ParameterCount; 
  __int64 v36; 
  __int64 v37; 
  UINT8 NeedToFree[4]; 
  size_t Size; 
  void *Src; 
  SECURITY_DESCRIPTOR *SecurityDescriptorOut; 
  PVOID P; 
  unsigned __int8 *v44; 
  UNICODE_STRING *v45; 
  PVOID *v46; 
  _SE_ADT_PARAMETER_ARRAY result; 
  LODWORD(PoolWithTag) = a12;
  v45 = (UNICODE_STRING *)a4;
  v13 = 0i64;
  v46 = (PVOID *)a3;
  v14 = 0i64;
  *(_WORD *)&NeedToFree[2] = a1;
  v15 = 0i64;
  v16 = *(_QWORD *)(a12 + 72);
  P = 0i64;
  Size = 0i64;
  Src = 0i64;
  SecurityDescriptorOut = 0i64;
  NeedToFree[0] = 0;
  NeedToFree[1] = 0;
  if( v16
    && *(_BYTE *)(v16 + 216)
    && (a1 == 116
     || a1 == 128
     || (LODWORD(PoolWithTag) = RtlCompareUnicodeString(a4, &SepFileTypeName, 0), !(_DWORD)PoolWithTag)) )
  {
    CurrentThreadProcess = PsGetCurrentThreadProcess();
    LODWORD(PoolWithTag) = PsGetAllocatedFullProcessImageNameEx(CurrentThreadProcess, &P);
    v18 = (int)PoolWithTag;
    if( (int)PoolWithTag >= 0 )
    {
      if( a6 )
      {
        v13 = *(_QWORD *)(a6 + 24);
        v19 = *(unsigned __int8 ***)(a6 + 152);
      }
      else
      {
        v19 = *(unsigned __int8 ***)(a7 + 152);
      }
      v20 = *(_QWORD *)(a7 + 24);
      v44 = *v19;
      memset((INT64)&result, 0i64);
      *(_QWORD *)&result.CategoryId = 0x12D200000003i64;
      result.FlatSubCategoryId = 129;
      v21 = 16;
      v22 = 8;
      if( (a8 & 0x2000000) != 0 || (result.Type = 8, !a10) )
        result.Type = 16;
      result.Parameters[0].Address = v44;
      result.Parameters[0].Type = SeAdtParmTypeSid;
      result.Parameters[1].Type = SeAdtParmTypeString;
      v23 = v44[1];
      result.Parameters[1].Address = &SeSubsystemName;
      result.Parameters[2].Type = SeAdtParmTypeLogonId;
      result.Parameters[2].Length = 8;
      result.Parameters[2].Data[0] = v13;
      result.Parameters[0].Length = 4 * v23 + 8;
      LODWORD(PoolWithTag) = 32;
      result.Parameters[1].Length = 32;
      if( !a6 )
        result.Parameters[2].Data[0] = v20;
      result.Parameters[3].Address = &SeSubsystemName;
      result.Parameters[3].Type = SeAdtParmTypeString;
      result.Parameters[3].Length = 32;
      if( v45 )
      {
        v24 = v45->Length + 16;
        result.Parameters[4].Address = v45;
        result.Parameters[4].Type = SeAdtParmTypeString;
        result.Parameters[4].Length = v24;
        if( a5 )
        {
          if( *(_WORD *)&NeedToFree[2] == 116
            || (result.Parameters[5].Type = SeAdtParmTypeString, *(_WORD *)&NeedToFree[2] == 128) )
          {
            result.Parameters[5].Type = SeAdtParmTypeFileSpec;
          }
          v25 = *a5;
          result.Parameters[5].Address = a5;
          result.Parameters[5].Length = v25 + 16;
        }
        result.Parameters[6].Type = SeAdtParmTypePtr;
        result.Parameters[6].Length = 8;
        if( v46 )
        {
          IsKernelHandle = ObpIsKernelHandle(*v46, 0);
          v29 = v28 ^ 0xFFFFFFFF80000000ui64;
          if( !IsKernelHandle )
            v29 = v27;
          result.Parameters[6].Data[0] = v29 & 0xFFFFFFFFFFFFFFFCui64;
        }
        else
        {
          result.Parameters[6].Data[0] = 0i64;
        }
        result.Parameters[7].Data[0] = a11;
        result.Parameters[8].Address = P;
        v30 = *(SECURITY_DESCRIPTOR **)(v16 + 56);
        result.Parameters[8].Length = v21 + *(unsigned __int16 *)P;
        result.Parameters[7].Type = SeAdtParmTypePtr;
        result.Parameters[7].Length = 8;
        result.Parameters[8].Type = SeAdtParmTypeFileSpec;
        LODWORD(PoolWithTag) = SepCheckAndCopySelfRelativeSD(
                                 v30,
                                 (SECURITY_DESCRIPTOR **)&Src,
                                 (size_t *)((char *)&Size + 4),
                                 NeedToFree);
        v18 = (int)PoolWithTag;
        if( (int)PoolWithTag < 0 )
        {
          v14 = (UINT8 *)Src;
        }
        else
        {
          LODWORD(PoolWithTag) = SepCheckAndCopySelfRelativeSD(
                                   *(SECURITY_DESCRIPTOR **)(v16 + 64),
                                   &SecurityDescriptorOut,
                                   &Size,
                                   &NeedToFree[1]);
          v15 = SecurityDescriptorOut;
          v18 = (int)PoolWithTag;
          v14 = (UINT8 *)Src;
          if( (int)PoolWithTag >= 0 )
          {
            if( !Src && !SecurityDescriptorOut )
              v22 = 0;
            v31 = HIDWORD(Size);
            v32 = (unsigned int)(Size - v22 + HIDWORD(Size) + 152);
            PoolWithTag = (char *)ExAllocatePoolWithTag(PagedPool, v32, 0x70416553ui64);
            v33 = PoolWithTag;
            if( PoolWithTag )
            {
              memset((INT64)PoolWithTag, 0i64);
              v34 = a9;
              *((_DWORD *)v33 + 34) = a10;
              if( !a10 )
                v34 = a8;
              *((_DWORD *)v33 + 33) = 4;
              *(_DWORD *)v33 = v34 & 0xFDFFFFFF;
              *(_OWORD *)(v33 + 4) = *(_OWORD *)(v16 + 88);
              *(_OWORD *)(v33 + 20) = *(_OWORD *)(v16 + 104);
              *(_OWORD *)(v33 + 36) = *(_OWORD *)(v16 + 120);
              *(_OWORD *)(v33 + 52) = *(_OWORD *)(v16 + 136);
              *(_OWORD *)(v33 + 68) = *(_OWORD *)(v16 + 152);
              *(_OWORD *)(v33 + 84) = *(_OWORD *)(v16 + 168);
              *(_OWORD *)(v33 + 100) = *(_OWORD *)(v16 + 184);
              *(_OWORD *)(v33 + 116) = *(_OWORD *)(v16 + 200);
              if( v14 )
                memmove((UINT8 *)v33 + 144, v14, v31);
              if( v15 )
                memmove((UINT8 *)&v33[v31 + 144], &v15->Revision, (unsigned int)Size);
              ParameterCount = 10i64;
              result.ParameterCount = 10;
              v36 = 0i64;
              result.Parameters[9].Type = SeAdtParmTypeAccessReason;
              result.Parameters[9].Length = v32;
              result.Parameters[9].Address = v33;
              result.Parameters[10].Type = SeAdtParmTypeStagingReason;
              result.Parameters[10].Length = v32;
              result.Parameters[10].Address = v33;
              while( 1 )
              {
                v37 = v36 + 4 * ParameterCount;
                ++v36;
                result.Parameters[0].Data[v37] = 0i64;
                if( v36 >= 2 )
                  break;
                ParameterCount = result.ParameterCount;
              }
              ++result.ParameterCount;
              SepAdtLogAuditRecord(&result);
              ExFreePoolWithTag(v33, 0);
            }
            else
            {
              v18 = -1073741670;
            }
          }
        }
      }
      else
      {
        v18 = -1073741811;
      }
    }
    if( P )
      ExFreePoolWithTag(P, 0);
    if( NeedToFree[0] && v14 )
      ExFreePoolWithTag(v14, 0);
    if( NeedToFree[1] && v15 )
      ExFreePoolWithTag(v15, 0);
    if( v18 < 0 )
      SepAuditFailed((unsigned int)v18);
    LOBYTE(PoolWithTag) = v18 >= 0;
  }
  else
  {
    LOBYTE(PoolWithTag) = 1;
  }
  return(int)PoolWithTag;
}

Referenced by: