SepAdtDeleteObjectAuditAlarm

VOID __stdcall SepAdtDeleteObjectAuditAlarm(
        UNICODE_STRING *CapturedSubsystemName,
        PVOID HandleId,
        SECURITY_SUBJECT_CONTEXT *SubjectSecurityContext,
        PVOID Object,
        GUID *TransactionId,
        UINT8 IsKernelObject){
  __int64 CurrentThreadProcess; 
  int AllocatedFullProcessImageName; 
  GUID *v11; 
  UNICODE_STRING *v12; 
  ULONG_PTR *ClientToken; 
  _QWORD **PrimaryToken; 
  void *v15; 
  PVOID *v16; 
  ULONG v17; 
  ULONG_PTR v18; 
  UINT8 IsKernelHandle; 
  __int64 v20; 
  unsigned __int64 v21; 
  SE_ADT_PARAMETER_TYPE v22; 
  __int64 v23; 
  int v24; 
  UINT16 FlatSubCategoryId; 
  PVOID P; 
  _SE_ADT_PARAMETER_ARRAY Src; 
  __int128 v28; 
  LOBYTE(v24) = IsKernelObject;
  P = 0i64;
  FlatSubCategoryId = 0;
  v28 = 0i64;
  if( SepAdtAuditObjectAccessWithContext(Object, CapturedSubsystemName, 1u, 0, 0i64, v24, &FlatSubCategoryId) )
  {
    CurrentThreadProcess = PsGetCurrentThreadProcess();
    AllocatedFullProcessImageName = PsGetAllocatedFullProcessImageNameEx(CurrentThreadProcess, &P);
    if( AllocatedFullProcessImageName < 0 )
    {
      SepAuditFailed((unsigned int)AllocatedFullProcessImageName);
    }
    else
    {
      v11 = (GUID *)&v28;
      if( TransactionId )
        v11 = TransactionId;
      memset((INT64)&Src, 0i64);
      v12 = (UNICODE_STRING *)&SeSubsystemName;
      ClientToken = (ULONG_PTR *)SubjectSecurityContext->ClientToken;
      Src.FlatSubCategoryId = FlatSubCategoryId;
      Src.CategoryId = 3;
      PrimaryToken = (_QWORD **)ClientToken;
      if( CapturedSubsystemName )
        v12 = CapturedSubsystemName;
      Src.AuditId = 4660;
      Src.Type = 8;
      Src.Parameters[0].Type = SeAdtParmTypeSid;
      if( !ClientToken )
        PrimaryToken = (_QWORD **)SubjectSecurityContext->PrimaryToken;
      Src.Parameters[0].Length = 4 * *(unsigned __int8 *)(*PrimaryToken[19] + 1i64) + 8;
      v15 = ClientToken;
      if( !ClientToken )
        v15 = SubjectSecurityContext->PrimaryToken;
      v16 = (PVOID *)*((_QWORD *)v15 + 19);
      Src.Parameters[1].Type = SeAdtParmTypeString;
      Src.Parameters[1].Address = v12;
      Src.Parameters[2].Type = SeAdtParmTypeLogonId;
      Src.Parameters[0].Address = *v16;
      v17 = v12->Length + 16;
      Src.Parameters[2].Length = 8;
      Src.Parameters[1].Length = v17;
      if( !ClientToken )
        ClientToken = (ULONG_PTR *)SubjectSecurityContext->PrimaryToken;
      v18 = ClientToken[3];
      Src.Parameters[3].Address = v12;
      Src.Parameters[3].Length = v17;
      Src.Parameters[4].Type = SeAdtParmTypePtr;
      Src.Parameters[2].Data[0] = v18;
      Src.Parameters[3].Type = SeAdtParmTypeString;
      Src.Parameters[4].Length = 8;
      IsKernelHandle = ObpIsKernelHandle(HandleId, 0);
      v21 = v20 ^ 0xFFFFFFFF80000000ui64;
      Src.Parameters[5].Type = v22;
      Src.Parameters[5].Length = 8;
      if( !IsKernelHandle )
        v21 = (unsigned __int64)HandleId;
      Src.Parameters[4].Data[0] = v21 & 0xFFFFFFFFFFFFFFFCui64;
      v23 = PsGetCurrentThreadProcess();
      Src.Parameters[6].Type = SeAdtParmTypeFileSpec;
      Src.Parameters[7].Type = SeAdtParmTypeGuid;
      Src.Parameters[7].Length = 16;
      Src.Parameters[5].Data[0] = *(_QWORD *)(v23 + 1088);
      Src.Parameters[6].Address = P;
      Src.Parameters[7].Address = v11;
      Src.ParameterCount = 8;
      Src.Parameters[6].Length = *(unsigned __int16 *)P + 16;
      SepAdtLogAuditRecord(&Src);
    }
    if( P )
      ExFreePoolWithTag(P, 0);
  }
}

Referenced by: