SeAuditFipsCryptoSelftests

VOID __stdcall SeAuditFipsCryptoSelftests(UINT8 bSuccess, UINT64 SelftestCode){
  ULONG_PTR v3; 
  void *PrimaryToken; 
  __int64 CurrentThreadProcess; 
  ULONG_PTR v6; 
  int AllocatedFullProcessImageName; 
  ULONG v8; 
  PVOID P; 
  struct _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  _SE_ADT_PARAMETER_ARRAY Src; 
  SubjectContext.ClientToken = 0i64;
  v3 = (unsigned int)SelftestCode;
  SubjectContext.ImpersonationLevel = 0x80000000;
  memset(&SubjectContext.ImpersonationLevel + 1, 0, 20);
  memset((INT64)&Src, 0i64);
  P = 0i64;
  Src.CategoryId = 1;
  Src.FlatSubCategoryId = 102;
  SeCaptureSubjectContext(&SubjectContext);
  PrimaryToken = SubjectContext.PrimaryToken;
  Src.Parameters[0].Type = SeAdtParmTypeSid;
  if( SubjectContext.ClientToken )
    PrimaryToken = SubjectContext.ClientToken;
  Src.Parameters[1].Type = SeAdtParmTypeString;
  Src.Parameters[1].Length = 32;
  Src.Parameters[0].Address = (PVOID)**((_QWORD **)PrimaryToken + 19);
  Src.Parameters[0].Length = 4 * *((unsigned __int8 *)Src.Parameters[0].Address + 1) + 8;
  Src.Parameters[1].Address = &SeSubsystemName;
  CurrentThreadProcess = PsGetCurrentThreadProcess();
  v6 = *(_QWORD *)(CurrentThreadProcess + 1088);
  AllocatedFullProcessImageName = PsGetAllocatedFullProcessImageNameEx(CurrentThreadProcess, &P);
  if( AllocatedFullProcessImageName >= 0 )
  {
    Src.Parameters[2].Type = SeAdtParmTypePtr;
    Src.Parameters[2].Length = 8;
    Src.Parameters[2].Data[0] = v6;
    v8 = *(unsigned __int16 *)P + 16;
    Src.Parameters[3].Type = SeAdtParmTypeFileSpec;
    Src.Parameters[3].Length = v8;
    Src.Parameters[3].Address = P;
    Src.ParameterCount = 4;
    if( bSuccess )
    {
      Src.AuditId = 6417;
      Src.Type = 8;
    }
    else
    {
      Src.AuditId = 6418;
      Src.Type = 16;
      Src.Parameters[4].Type = SeAdtParmTypeHexUlong;
      Src.Parameters[4].Length = 4;
      Src.Parameters[4].Data[0] = v3;
      Src.ParameterCount = 5;
    }
    SepAdtLogAuditRecord(&Src);
  }
  SeReleaseSubjectContext(&SubjectContext);
  if( P )
    ExFreePoolWithTag(P, 0);
  if( AllocatedFullProcessImageName < 0 )
    SepAuditFailed((unsigned int)AllocatedFullProcessImageName);
}

Referenced by: