SeAuditHardLinkCreationWithTransaction

VOID __stdcall SeAuditHardLinkCreationWithTransaction(
        UNICODE_STRING *FileName,
        UNICODE_STRING *LinkName,
        UINT8 bSuccess,
        GUID *TransactionId){
  GUID *v8; 
  _QWORD *PrimaryToken; 
  _QWORD *ClientToken; 
  PVOID *v11; 
  struct _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  _SE_ADT_PARAMETER_ARRAY Src; 
  __int128 v14; 
  SubjectContext.ClientToken = 0i64;
  SubjectContext.ImpersonationLevel = 0x80000000;
  memset(&SubjectContext.ImpersonationLevel + 1, 0, 20);
  memset((INT64)&Src, 0i64);
  Src.CategoryId = 3;
  Src.FlatSubCategoryId = 116;
  v8 = (GUID *)&v14;
  Src.AuditId = 4664;
  if( TransactionId )
    v8 = TransactionId;
  Src.Type = 8;
  v14 = 0i64;
  if( !bSuccess )
    Src.Type = 16;
  SeCaptureSubjectContext(&SubjectContext);
  PrimaryToken = SubjectContext.PrimaryToken;
  ClientToken = SubjectContext.PrimaryToken;
  Src.Parameters[0].Type = SeAdtParmTypeSid;
  if( SubjectContext.ClientToken )
    ClientToken = SubjectContext.ClientToken;
  Src.Parameters[1].Type = SeAdtParmTypeString;
  if( SubjectContext.ClientToken )
    PrimaryToken = SubjectContext.ClientToken;
  Src.Parameters[1].Length = 32;
  Src.Parameters[2].Type = SeAdtParmTypeLogonId;
  Src.Parameters[3].Type = SeAdtParmTypeFileSpec;
  v11 = (PVOID *)ClientToken[19];
  Src.Parameters[4].Type = SeAdtParmTypeFileSpec;
  Src.Parameters[2].Length = 8;
  Src.Parameters[3].Address = FileName;
  Src.Parameters[0].Address = *v11;
  Src.Parameters[4].Address = LinkName;
  Src.Parameters[5].Type = SeAdtParmTypeGuid;
  LODWORD(v11) = *((unsigned __int8 *)Src.Parameters[0].Address + 1);
  Src.Parameters[5].Length = 16;
  Src.Parameters[5].Address = v8;
  Src.ParameterCount = 6;
  Src.Parameters[0].Length = 4 * (_DWORD)v11 + 8;
  Src.Parameters[1].Address = &SeSubsystemName;
  Src.Parameters[2].Data[0] = PrimaryToken[3];
  Src.Parameters[3].Length = FileName->Length + 16;
  Src.Parameters[4].Length = LinkName->Length + 16;
  SepAdtLogAuditRecord(&Src);
  SeReleaseSubjectContext(&SubjectContext);
}

Referenced by: