SeAuditProcessCreation

VOID __fastcall SeAuditProcessCreation(_EPROCESS *Process, _UNICODE_STRING *CommandLine){
  unsigned __int16 *p_Length; 
  unsigned int v4; 
  void *v5; 
  int AllocatedFullProcessImageName; 
  _EPROCESS *v7; 
  _QWORD *v8; 
  _QWORD *v9; 
  int v10; 
  unsigned __int64 v11; 
  __int64 v12; 
  ULONG_PTR v13; 
  WCHAR v14; 
  unsigned __int8 *v15; 
  bool v16; 
  int v17; 
  ULONG v18; 
  ULONG v19; 
  WCHAR v20; 
  char v21; 
  unsigned int NumberOfBytes[3]; 
  PVOID P; 
  _EPROCESS *Processa; 
  unsigned __int8 *v25; 
  struct _UNICODE_STRING DestinationString; 
  _UNICODE_STRING *v27; 
  ULONG_PTR v28; 
  ULONG_PTR v29; 
  ULONG_PTR v30; 
  struct _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  _SE_ADT_PARAMETER_ARRAY Src; 
  char DestinationSid[80]; 
  v27 = CommandLine;
  memset(NumberOfBytes, 0, sizeof(NumberOfBytes));
  p_Length = 0i64;
  Processa = 0i64;
  v4 = 0;
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  P = 0i64;
  v21 = 0;
  DestinationString = 0i64;
  v25 = (unsigned __int8 *)DestinationSid;
  if( !*((_QWORD *)Process + 184) )
    return;
  v5 = (void *)*((_QWORD *)Process + 168);
  v29 = *((_QWORD *)Process + 136);
  v30 = (ULONG_PTR)v5;
  AllocatedFullProcessImageName = PsGetAllocatedFullProcessImageNameEx((__int64)Process, &NumberOfBytes[1]);
  if( AllocatedFullProcessImageName >= 0 )
  {
    if( PsLookupProcessByProcessId(v5, (PEPROCESS *)&Processa) < 0 )
    {
      v4 = 1845;
    }
    else
    {
      v7 = Processa;
      if( *((_QWORD *)Processa + 184) )
        PsGetAllocatedFullProcessImageNameEx((__int64)Processa, &P);
      else
        v4 = 1844;
      ObfDereferenceObjectWithTag(v7, 0x746C6644ui64);
    }
    v8 = PsReferencePrimaryToken((PEPROCESS)Process);
    v9 = v8;
    if( v8 )
    {
      v10 = *(_DWORD *)(v8[27] + 32i64);
      if( (v10 & 4) != 0 )
        v11 = 1938i64;
      else
        v11 = (v10 & 2 | 0xF20ui64) >> 1;
      v12 = *((unsigned int *)v8 + 52);
      v13 = v9[3];
      v28 = v13;
      if( (unsigned int)v12 >= *((_DWORD *)v9 + 31) )
        v25 = (unsigned __int8 *)SeNullSid;
      else
        AllocatedFullProcessImageName = RtlCopySid(0x44u, DestinationSid, *(PSID *)(v9[19] + 16 * v12));
      HalPutDmaAdapter((PADAPTER_OBJECT)v9);
      if( AllocatedFullProcessImageName >= 0 )
      {
        if( SepRmAuditProcessCommandLine )
        {
          if( v27 )
          {
            p_Length = &v27->Length;
            goto LABEL_16;
          }
          if( (unsigned int)PsQueryProcessCommandLine((struct _EX_RUNDOWN_REF *)Process, 0i64, 0, 0, NumberOfBytes) == -1073741820 )
          {
            p_Length = (unsigned __int16 *)ExAllocatePoolWithTag(PagedPool, NumberOfBytes[0], 0x4C436553ui64);
            if( p_Length )
            {
              if( (int)PsQueryProcessCommandLine(
                          (struct _EX_RUNDOWN_REF *)Process,
                          (__int64)p_Length,
                          NumberOfBytes[0],
                          0,
                          NumberOfBytes) >= 0 )
              {
                v21 = 1;
                goto LABEL_16;
              }
              ExFreePoolWithTag(p_Length, 0);
            }
          }
          RtlInitUnicodeString(&DestinationString, &word_1407CF120, v20);
        }
        else
        {
          RtlInitUnicodeString(&DestinationString, &word_1407CF120, v14);
        }
        p_Length = (unsigned __int16 *)&DestinationString;
LABEL_16:
        SeCaptureSubjectContext(&SubjectContext);
        memset((INT64)&Src, 0i64);
        Src.CategoryId = 5;
        *(_DWORD *)&Src.FlatSubCategoryId = 524421;
        Src.AuditId = 4688;
        v15 = (unsigned __int8 *)**((_QWORD **)SubjectContext.PrimaryToken + 19);
        v16 = *((_QWORD *)SubjectContext.PrimaryToken + 3) != __PAIR64__(HIDWORD(v28), v13);
        v17 = v15[1];
        Src.Parameters[2].Data[0] = *((_QWORD *)SubjectContext.PrimaryToken + 3);
        Src.Parameters[3].Data[0] = v29;
        Src.Parameters[0].Address = v15;
        Src.Parameters[0].Length = 4 * v17 + 8;
        Src.Parameters[0].Type = SeAdtParmTypeSid;
        Src.Parameters[1].Address = &SeSubsystemName;
        Src.Parameters[4].Address = *(PVOID *)&NumberOfBytes[1];
        Src.Parameters[1].Type = SeAdtParmTypeString;
        Src.Parameters[1].Length = 32;
        v18 = (unsigned __int16)**(_WORD **)&NumberOfBytes[1] + 16;
        Src.Parameters[2].Type = SeAdtParmTypeLogonId;
        Src.Parameters[4].Length = v18;
        Src.Parameters[6].Data[0] = v30;
        v19 = *p_Length + 16;
        Src.Parameters[2].Length = 8;
        Src.Parameters[3].Type = SeAdtParmTypePtr;
        Src.Parameters[3].Length = 8;
        Src.Parameters[4].Type = SeAdtParmTypeFileSpec;
        Src.Parameters[5].Type = SeAdtParmTypeMessage;
        Src.Parameters[5].Length = 4;
        Src.Parameters[5].Data[0] = v11;
        Src.Parameters[6].Type = SeAdtParmTypePtr;
        Src.Parameters[6].Length = 8;
        Src.Parameters[7].Type = SeAdtParmTypeMultiSzString;
        Src.Parameters[7].Length = v19;
        Src.Parameters[7].Address = p_Length;
        if( v16 )
        {
          Src.Parameters[8].Type = SeAdtParmTypeLogonIdEx;
          Src.Parameters[8].Length = 8;
          Src.Parameters[8].Data[0] = v13;
        }
        else
        {
          Src.Parameters[8].Type = SeAdtParmTypeNoLogonId;
        }
        if( v4 )
        {
          Src.Parameters[9].Data[0] = v4;
          Src.Parameters[9].Type = SeAdtParmTypeMessage;
          Src.Parameters[9].Length = 4;
        }
        else
        {
          Src.Parameters[9].Type = SeAdtParmTypeFileSpec;
          Src.Parameters[9].Address = P;
          Src.Parameters[9].Length = *(unsigned __int16 *)P + 16;
        }
        Src.Parameters[10].Address = v25;
        Src.Parameters[10].Type = SeAdtParmTypeSid;
        Src.ParameterCount = 11;
        Src.Parameters[10].Length = 4 * v25[1] + 8;
        SepAdtLogAuditRecord(&Src);
        SeReleaseSubjectContext(&SubjectContext);
        goto LABEL_21;
      }
    }
    else
    {
      AllocatedFullProcessImageName = -1073741700;
    }
  }
  SepAuditFailed((unsigned int)AllocatedFullProcessImageName);
LABEL_21:
  if( *(_QWORD *)&NumberOfBytes[1] )
    ExFreePoolWithTag(*(PVOID *)&NumberOfBytes[1], 0);
  if( P )
    ExFreePoolWithTag(P, 0);
  if( v21 )
  {
    if( p_Length )
      ExFreePoolWithTag(p_Length, 0);
  }
}

Referenced by: