SepAuditAssignPrimaryToken

VOID __stdcall SepAuditAssignPrimaryToken(_EPROCESS *Process, PVOID AccessToken){
  __int64 CurrentThreadProcess; 
  __int64 v5; 
  ULONG_PTR v6; 
  PVOID v7; 
  unsigned __int8 *v8; 
  int AllocatedFullProcessImageName; 
  ULONG_PTR v10; 
  int v11; 
  ULONG v12; 
  ULONG v13; 
  PVOID P; 
  PVOID SubjectContext[5]; 
  _SE_ADT_PARAMETER_ARRAY Src; 
  memset(SubjectContext, 0, sizeof(SubjectContext));
  P = 0i64;
  memset((INT64)&Src, 0i64);
  CurrentThreadProcess = PsGetCurrentThreadProcess();
  v5 = CurrentThreadProcess;
  if( *(_QWORD *)(CurrentThreadProcess + 1472) )
  {
    v6 = *(_QWORD *)(CurrentThreadProcess + 1088);
    SeCaptureSubjectContext((_SECURITY_SUBJECT_CONTEXT *)&SubjectContext[1]);
    v7 = SubjectContext[3];
    if( SubjectContext[1] )
      v7 = SubjectContext[1];
    if( v7 )
    {
      v8 = (unsigned __int8 *)**((_QWORD **)v7 + 19);
      AllocatedFullProcessImageName = PsGetAllocatedFullProcessImageNameEx(v5, SubjectContext);
      if( AllocatedFullProcessImageName >= 0 )
      {
        v10 = *((_QWORD *)Process + 136);
        AllocatedFullProcessImageName = PsGetAllocatedFullProcessImageNameEx((__int64)Process, &P);
        if( AllocatedFullProcessImageName >= 0 )
        {
          v11 = v8[1];
          Src.CategoryId = 5;
          Src.Parameters[2].Type = SeAdtParmTypeLogonId;
          *(_DWORD *)&Src.FlatSubCategoryId = 524421;
          Src.AuditId = 4696;
          Src.Parameters[0].Length = 4 * v11 + 8;
          Src.Parameters[0].Type = SeAdtParmTypeSid;
          Src.Parameters[0].Address = v8;
          Src.Parameters[1].Address = &SeSubsystemName;
          Src.Parameters[2].Data[0] = *((_QWORD *)v7 + 3);
          Src.Parameters[3].Data[0] = *((_QWORD *)AccessToken + 3);
          v12 = *(unsigned __int16 *)P + 16;
          Src.Parameters[5].Address = P;
          Src.Parameters[5].Length = v12;
          Src.Parameters[7].Address = SubjectContext[0];
          Src.Parameters[1].Type = SeAdtParmTypeString;
          v13 = *(unsigned __int16 *)SubjectContext[0] + 16;
          Src.Parameters[1].Length = 32;
          Src.Parameters[7].Length = v13;
          Src.Parameters[2].Length = 8;
          Src.Parameters[3].Type = SeAdtParmTypeLogonIdEx;
          Src.Parameters[3].Length = 8;
          Src.Parameters[4].Type = SeAdtParmTypePtr;
          Src.Parameters[4].Length = 8;
          Src.Parameters[4].Data[0] = v10;
          Src.Parameters[5].Type = SeAdtParmTypeFileSpec;
          Src.Parameters[6].Type = SeAdtParmTypePtr;
          Src.Parameters[6].Length = 8;
          Src.Parameters[6].Data[0] = v6;
          Src.Parameters[7].Type = SeAdtParmTypeFileSpec;
          Src.ParameterCount = 8;
          SepAdtLogAuditRecord(&Src);
        }
      }
    }
    else
    {
      AllocatedFullProcessImageName = -1073741700;
    }
    if( P )
      ExFreePoolWithTag(P, 0);
    if( SubjectContext[0] )
      ExFreePoolWithTag(SubjectContext[0], 0);
    if( AllocatedFullProcessImageName < 0 )
      SepAuditFailed((unsigned int)AllocatedFullProcessImageName);
    SeReleaseSubjectContext((_SECURITY_SUBJECT_CONTEXT *)&SubjectContext[1]);
  }
}

Referenced by: