SeAuditPlugAndPlay

void __fastcall SeAuditPlugAndPlay(
        unsigned __int16 *a1,
        unsigned __int16 *a2,
        unsigned __int16 *a3,
        unsigned __int16 *a4,
        unsigned __int16 *a5,
        __int64 a6,
        unsigned __int16 *a7,
        int a8,
        char a9){
  ULONG v13; 
  ULONG v14; 
  _QWORD *PrimaryToken; 
  void *ClientToken; 
  unsigned __int8 *v17; 
  ULONG_PTR v18; 
  __int64 v19; 
  UINT8 pbPreventCoaf[8]; 
  struct _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  _SE_ADT_PARAMETER_ARRAY_EX result; 
  SubjectContext.ClientToken = 0i64;
  SubjectContext.ImpersonationLevel = 0x80000000;
  memset(&SubjectContext.ImpersonationLevel + 1, 0, 20);
  memset((INT64)&result, 0i64);
  pbPreventCoaf[0] = 0;
  if( a8 )
  {
    switch( a8 )
    {
      case 1:
        v13 = 6419;
        break;
      case 2:
        v13 = 6420;
        break;
      case 3:
        v13 = 6421;
        break;
      case 4:
        v13 = 6422;
        break;
      case 5:
        v13 = 6423;
        break;
      case 6:
        v13 = 6424;
        break;
      default:
        return;
    }
    v14 = 0;
  }
  else
  {
    v13 = 6416;
    v14 = 1;
  }
  result.ParameterCount = 0;
  result.AuditId = v13;
  result.CategoryId = 5;
  result.FlatSubCategoryId = 137;
  result.Version = v14;
  result.Type = 8;
  if( !a9 )
    result.Type = 16;
  SeCaptureSubjectContext(&SubjectContext);
  PrimaryToken = SubjectContext.PrimaryToken;
  ClientToken = SubjectContext.PrimaryToken;
  if( SubjectContext.ClientToken )
    ClientToken = SubjectContext.ClientToken;
  if( SubjectContext.ClientToken )
    PrimaryToken = SubjectContext.ClientToken;
  v17 = (unsigned __int8 *)**((_QWORD **)ClientToken + 19);
  v18 = PrimaryToken[3];
  result.Parameters[result.ParameterCount].Type = SeAdtParmTypeSid;
  result.Parameters[result.ParameterCount].Length = 4 * v17[1] + 8;
  result.Parameters[result.ParameterCount++].Address = v17;
  result.Parameters[result.ParameterCount].Type = SeAdtParmTypeString;
  result.Parameters[result.ParameterCount].Length = 32;
  result.Parameters[result.ParameterCount++].Address = &SeSubsystemName;
  result.Parameters[result.ParameterCount].Type = SeAdtParmTypeLogonId;
  result.Parameters[result.ParameterCount].Length = 8;
  result.Parameters[result.ParameterCount++].Data[0] = v18;
  result.Parameters[result.ParameterCount].Type = SeAdtParmTypeString;
  result.Parameters[result.ParameterCount].Length = *a1 + 16;
  result.Parameters[result.ParameterCount++].Address = a1;
  result.Parameters[result.ParameterCount].Type = SeAdtParmTypeString;
  result.Parameters[result.ParameterCount].Length = *a2 + 16;
  result.Parameters[result.ParameterCount].Address = a2;
  v19 = ++result.ParameterCount;
  result.Parameters[v19].Type = SeAdtParmTypeGuid;
  result.Parameters[result.ParameterCount].Length = 16;
  result.Parameters[result.ParameterCount++].Address = (PVOID)a6;
  result.Parameters[result.ParameterCount].Type = SeAdtParmTypeString;
  result.Parameters[result.ParameterCount].Length = *a7 + 16;
  result.Parameters[result.ParameterCount++].Address = a7;
  result.Parameters[result.ParameterCount].Type = SeAdtParmTypeMultiSzString;
  result.Parameters[result.ParameterCount].Length = *a3 + 16;
  result.Parameters[result.ParameterCount++].Address = a3;
  result.Parameters[result.ParameterCount].Type = SeAdtParmTypeMultiSzString;
  result.Parameters[result.ParameterCount].Length = *a4 + 16;
  result.Parameters[result.ParameterCount++].Address = a4;
  result.Parameters[result.ParameterCount].Type = SeAdtParmTypeMultiSzString;
  result.Parameters[result.ParameterCount].Length = *a5 + 16;
  result.Parameters[result.ParameterCount++].Address = a5;
  AdtpWriteToEtwEx(&result, pbPreventCoaf);
  SeReleaseSubjectContext(&SubjectContext);
}

Referenced by: