NtDeleteObjectAuditAlarm

INT64 __fastcall NtDeleteObjectAuditAlarm(_UNICODE_STRING *SubsystemName, void *HandleId, INT64 GenerateOnClose){
  CHAR v5; 
  int v7; 
  INT64 v8; 
  struct _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  PVOID P; 
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  P = 0i64;
  v5 = *((_BYTE *)KeGetCurrentThread() + 562);
  if( !(_BYTE)GenerateOnClose )
    return 0i64;
  SeCaptureSubjectContext(&SubjectContext);
  if( SubjectContext.PrimaryToken )
  {
    if( SeCheckAuditPrivilege(&SubjectContext, v5) )
    {
      v7 = SepProbeAndCaptureString_U(SubsystemName, (_UNICODE_STRING **)&P);
      if( v7 >= 0 )
        SepAdtDeleteObjectAuditAlarm((UNICODE_STRING *)P, HandleId, &SubjectContext, 0i64, 0i64, 0);
    }
    else
    {
      v7 = -1073741727;
    }
    SeReleaseSubjectContext(&SubjectContext);
    if( P )
      ExFreePoolWithTag(P, 0);
    v8 = 3221225626i64;
    if( v7 != -1073741670 )
      return(unsigned int)v7;
  }
  else
  {
    v7 = -1073741700;
    v8 = 3221225596i64;
  }
  SepAuditFailed(v8);
  return(unsigned int)v7;
}

Referenced by: