CmpLogHiveFileInaccessible

VOID __fastcall CmpLogHiveFileInaccessible(INT64 a1, INT64 a2, INT64 a3, INT64 a4){
  int v4; 
  INT64 *v6; 
  char v7; 
  WCHAR *v8; 
  void *PrimaryToken; 
  int v10; 
  UINT64 StringSecurityDescriptorLen; 
  PVOID SecurityDescriptor; 
  WCHAR *StringSecurityDescriptor; 
  void *FileHandle; 
  struct _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  struct _IO_STATUS_BLOCK IoStatusBlock; 
  INT64 result[10]; 
  struct _EVENT_DATA_DESCRIPTOR v19; 
  UINT64 *p_StringSecurityDescriptorLen; 
  __int64 v21; 
  char v22[16]; 
  INT64 *v23; 
  int v24; 
  int v25; 
  PVOID *p_SecurityDescriptor; 
  __int64 v27; 
  v4 = a2;
  memset((INT64)result, 0i64);
  v6 = (INT64 *)SeNullSid;
  SecurityDescriptor = 0i64;
  FileHandle = 0i64;
  StringSecurityDescriptor = 0i64;
  ObjectAttributes.RootDirectory = 0i64;
  IoStatusBlock = 0i64;
  v7 = 0;
  v8 = 0i64;
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  *(_QWORD *)&ObjectAttributes.Length = 48i64;
  *(_QWORD *)&ObjectAttributes.Attributes = 576i64;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  ObjectAttributes.ObjectName = (_UNICODE_STRING *)a1;
  if( ZwOpenFile((UNICODE_STRING *)&FileHandle, (PWCHAR)0x20000) >= 0
    && CmpQueryFileSecurityDescriptor(FileHandle, &SecurityDescriptor) >= 0 )
  {
    if( (int)SeConvertSecurityDescriptorToStringSecurityDescriptor(
                SecurityDescriptor,
                (VOID *)1,
                0xCui64,
                &StringSecurityDescriptor,
                &StringSecurityDescriptorLen) >= 0 )
    {
      SeCaptureSubjectContext(&SubjectContext);
      PrimaryToken = SubjectContext.PrimaryToken;
      v7 = 1;
      if( SubjectContext.ClientToken )
        PrimaryToken = SubjectContext.ClientToken;
      SeQueryUserSidToken(PrimaryToken, result, 0x44ui64, 0i64);
      v6 = result;
    }
    v8 = StringSecurityDescriptor;
  }
  if( (unsigned int)dword_140C02130 > 3 && tlgKeywordOn((__int64)&dword_140C02130, 0x200000000008i64) )
  {
    LODWORD(StringSecurityDescriptorLen) = v4;
    p_StringSecurityDescriptorLen = &StringSecurityDescriptorLen;
    v21 = 4i64;
    tlgCreate1Sz_wchar_t((__int64)v22, v8);
    v10 = *((unsigned __int8 *)v6 + 1);
    v23 = v6;
    v25 = 0;
    SecurityDescriptor = (PVOID)0x1000000;
    v27 = 8i64;
    v24 = 4 * v10 + 8;
    p_SecurityDescriptor = &SecurityDescriptor;
    tlgWriteTransfer_EtwWriteTransfer(
      (__int64)&dword_140C02130,
      (unsigned __int8 *)&dword_140022991 + 3,
      0i64,
      0i64,
      6u,
      &v19);
  }
  if( v7 )
    SeReleaseSubjectContext(&SubjectContext);
  if( v8 )
    ExFreePoolWithTag(v8, 0);
  if( FileHandle )
    ZwClose(FileHandle);
}

Referenced by: