SeAuditSystemTimeChange

VOID __stdcall SeAuditSystemTimeChange(LARGE_INTEGER OldTime, LARGE_INTEGER NewTime){
  _QWORD *ClientToken; 
  _QWORD *PrimaryToken; 
  void *v6; 
  unsigned __int8 *v7; 
  __int64 CurrentThreadProcess; 
  int AllocatedFullProcessImageName; 
  int v10; 
  ULONG_PTR v11; 
  ULONG v12; 
  PVOID P; 
  struct _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  _SE_ADT_PARAMETER_ARRAY Src; 
  P = 0i64;
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  SeCaptureSubjectContext(&SubjectContext);
  ClientToken = SubjectContext.ClientToken;
  PrimaryToken = SubjectContext.PrimaryToken;
  v6 = SubjectContext.PrimaryToken;
  if( SubjectContext.ClientToken )
    v6 = SubjectContext.ClientToken;
  v7 = (unsigned __int8 *)**((_QWORD **)v6 + 19);
  CurrentThreadProcess = PsGetCurrentThreadProcess();
  memset((INT64)&Src, 0i64);
  AllocatedFullProcessImageName = PsGetAllocatedFullProcessImageNameEx(CurrentThreadProcess, &P);
  if( AllocatedFullProcessImageName < 0 )
  {
    SepAuditFailed((unsigned int)AllocatedFullProcessImageName);
  }
  else
  {
    v10 = v7[1];
    Src.CategoryId = 1;
    Src.AuditId = 4616;
    *(_DWORD *)&Src.FlatSubCategoryId = 524388;
    Src.Parameters[0].Type = SeAdtParmTypeSid;
    Src.Parameters[0].Length = 4 * v10 + 8;
    Src.Parameters[1].Address = &SeSubsystemName;
    Src.Parameters[0].Address = v7;
    Src.Parameters[1].Type = SeAdtParmTypeString;
    Src.Parameters[1].Length = 32;
    Src.Parameters[2].Type = SeAdtParmTypeLogonId;
    Src.Parameters[2].Length = 8;
    if( ClientToken )
      v11 = ClientToken[3];
    else
      v11 = PrimaryToken[3];
    Src.Parameters[2].Data[0] = v11;
    Src.Parameters[3].Type = SeAdtParmTypeTime;
    Src.Parameters[4].Type = SeAdtParmTypeTime;
    Src.Parameters[5].Data[0] = *(_QWORD *)(CurrentThreadProcess + 1088);
    v12 = *(unsigned __int16 *)P + 16;
    Src.Parameters[6].Address = P;
    Src.Parameters[6].Length = v12;
    Src.Parameters[3].Length = 8;
    Src.Parameters[3].Data[0] = OldTime.QuadPart;
    Src.Parameters[4].Length = 8;
    Src.Parameters[4].Data[0] = NewTime.QuadPart;
    Src.Parameters[5].Type = SeAdtParmTypePtr;
    Src.Parameters[5].Length = 8;
    Src.Parameters[6].Type = SeAdtParmTypeFileSpec;
    Src.ParameterCount = 7;
    SepAdtLogAuditRecord(&Src);
  }
  if( P )
    ExFreePoolWithTag(P, 0);
  SeReleaseSubjectContext(&SubjectContext);
}

Referenced by: