SeTokenDefaultDaclChangedAuditAlarm

VOID __stdcall SeTokenDefaultDaclChangedAuditAlarm(
        _UNICODE_STRING *CapturedSubsystemName,
        VOID *Object,
        VOID *HandleId,
        _ACL *OldDefaultDacl,
        _ACL *NewDefaultDacl){
  _UNICODE_STRING *v5; 
  VOID *v6; 
  VOID *v7; 
  _UNICODE_STRING *v10; 
  VOID ***PrimaryToken; 
  NTSTATUS v12; 
  NTSTATUS v13; 
  NTSTATUS v14; 
  VOID *UserSid; 
  VOID *UserSida; 
  VOID *OldSecurityDescriptor; 
  VOID *OldSecurityDescriptora; 
  UINT64 SecurityInformation; 
  _UNICODE_STRING *TypeName; 
  VOID *NewSecurityDescriptor; 
  _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  __int128 SecurityDescriptor[2]; 
  __int64 v24; 
  __int128 InputSecurityDescriptor[2]; 
  __int64 v26; 
  VOID *OutputSecurityDescriptor; 
  VOID *HandleIda; 

  HandleIda = HandleId;
  v5 = 0i64;
  v24 = 0i64;
  v6 = 0i64;
  TypeName = 0i64;
  v7 = 0i64;
  v26 = 0i64;
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  OutputSecurityDescriptor = 0i64;
  NewSecurityDescriptor = 0i64;
  memset(SecurityDescriptor, 0, sizeof(SecurityDescriptor));
  v10 = 0i64;
  memset(InputSecurityDescriptor, 0, sizeof(InputSecurityDescriptor));
  SeCaptureSubjectContext((INT64)&SubjectContext);
  PrimaryToken = (VOID ***)SubjectContext.PrimaryToken;
  if( SubjectContext.ClientToken )
    PrimaryToken = (VOID ***)SubjectContext.ClientToken;
  if( PrimaryToken )
  {
    if( !SepAdtAuditThisEventWithContext(0x8Dui64, 1u, 0, &SubjectContext)
      || SepIsAclEqual(OldDefaultDacl, NewDefaultDacl) )
    {
LABEL_5:
      SeReleaseSubjectContext(&SubjectContext);
      return;
    }
    if( Object )
    {
      v12 = SepQueryTypeString(Object, &TypeName);
      v5 = TypeName;
      v13 = v12;
      if( v12 < 0 )
      {
LABEL_20:
        if( v5 )
          ExFreePoolWithTag(v5, 0);
        if( v6 )
          SeReleaseSecurityDescriptor(v6, 0, 1u);
        if( v7 )
          SeReleaseSecurityDescriptor(v7, 0, 1u);
        if( v13 < 0 )
          SepAuditFailed((unsigned int)v13);
        goto LABEL_5;
      }
      if( TypeName )
        v10 = TypeName;
    }
    v13 = RtlCreateSecurityDescriptor(SecurityDescriptor, 1ui64);
    if( v13 >= 0 )
    {
      v13 = RtlSetDaclSecurityDescriptor(SecurityDescriptor, 1u, OldDefaultDacl, 0);
      if( v13 >= 0 )
      {
        v13 = SeCaptureSecurityDescriptor(
                SecurityDescriptor,
                0,
                PagedPool,
                1u,
                &OutputSecurityDescriptor,
                (INT64)UserSid,
                (INT64)OldSecurityDescriptor);
        if( v13 < 0
          || (v13 = RtlCreateSecurityDescriptor(InputSecurityDescriptor, 1ui64), v13 < 0)
          || (v13 = RtlSetDaclSecurityDescriptor(InputSecurityDescriptor, 1u, NewDefaultDacl, 0), v13 < 0) )
        {
          v6 = OutputSecurityDescriptor;
        }
        else
        {
          v14 = SeCaptureSecurityDescriptor(
                  InputSecurityDescriptor,
                  0,
                  PagedPool,
                  1u,
                  &NewSecurityDescriptor,
                  (INT64)UserSida,
                  (INT64)OldSecurityDescriptora);
          v7 = NewSecurityDescriptor;
          v13 = v14;
          v6 = OutputSecurityDescriptor;
          if( v14 >= 0 )
          {
            LODWORD(SecurityInformation) = 4;
            SepAdtSecurityDescriptorChangedAuditAlarm(
              &SubjectContext,
              (_UNICODE_STRING *)&SeSubsystemName,
              v10,
              0i64,
              HandleIda,
              *PrimaryToken[19],
              OutputSecurityDescriptor,
              SecurityInformation,
              NewSecurityDescriptor);
          }
        }
      }
    }
    goto LABEL_20;
  }
  SepAuditFailed(3221225596i64);
}

Referenced by: