NtPrivilegedServiceAuditAlarm

NTSTATUS __stdcall NtPrivilegedServiceAuditAlarm(
        UNICODE_STRING *SubsystemName,
        UNICODE_STRING *ServiceName,
        PVOID ClientToken,
        PRIVILEGE_SET *Privileges,
        UINT8 AccessGranted){
  CHAR v9; 
  NTSTATUS v10; 
  struct _DMA_ADAPTER *v11; 
  unsigned int PrivilegeCount; 
  UINT64 v13; 
  char *v14; 
  UINT8 *PoolWithTag; 
  _PRIVILEGE_SET *v16; 
  PVOID v17; 
  PVOID v18; 
  NTSTATUS v20; 
  INT64 v21; 
  NTSTATUS v22; 
  PVOID Object; 
  _PRIVILEGE_SET *v24; 
  PVOID v25; 
  PVOID P; 
  struct _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  unsigned int v28; 
  unsigned int v29; 
  v24 = 0i64;
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  P = 0i64;
  v25 = 0i64;
  v9 = *((_BYTE *)KeGetCurrentThread() + 562);
  SeCaptureSubjectContext(&SubjectContext);
  if( !SeCheckAuditPrivilege(&SubjectContext, v9) )
  {
    v20 = -1073741727;
LABEL_36:
    SeReleaseSubjectContext(&SubjectContext);
    return v20;
  }
  Object = 0i64;
  v10 = ObReferenceObjectByHandle(ClientToken, 8u, (POBJECT_TYPE)SeTokenObjectType, v9, &Object, 0i64);
  v22 = v10;
  if( v10 < 0 )
  {
    SeReleaseSubjectContext(&SubjectContext);
    if( v10 == -1073741816 )
      return v10;
    v21 = (unsigned int)v10;
LABEL_33:
    SepAuditFailed(v21);
    return v10;
  }
  v11 = (struct _DMA_ADAPTER *)Object;
  if( *((_DWORD *)Object + 48) == 2 && *((int *)Object + 49) < 1 )
  {
    HalPutDmaAdapter((PADAPTER_OBJECT)Object);
    v20 = -1073741659;
    goto LABEL_36;
  }
  if( SubsystemName && (v10 = SepProbeAndCaptureString_U(SubsystemName, (_UNICODE_STRING **)&P), v22 = v10, v10 < 0)
    || ServiceName && (v10 = SepProbeAndCaptureString_U(ServiceName, (_UNICODE_STRING **)&v25), v22 = v10, v10 < 0) )
  {
    v16 = v24;
  }
  else
  {
    if( ((unsigned __int8)Privileges & 3) != 0 )
      ExRaiseDatatypeMisalignment();
    PrivilegeCount = Privileges->PrivilegeCount;
    v28 = PrivilegeCount;
    if( PrivilegeCount >= 0x43 )
    {
      v10 = -1073741811;
      v16 = v24;
    }
    else
    {
      v13 = 12 * PrivilegeCount + 8;
      v29 = 12 * PrivilegeCount + 8;
      if( 12 * PrivilegeCount != -8 )
      {
        v14 = (char *)Privileges + (unsigned int)v13;
        if( (unsigned __int64)v14 > 0x7FFFFFFF0000i64 || v14 < (char *)Privileges )
          MEMORY[0x7FFFFFFF0000] = 0;
      }
      PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(PagedPool, v13, 0x72506553ui64);
      v16 = (_PRIVILEGE_SET *)PoolWithTag;
      v24 = (_PRIVILEGE_SET *)PoolWithTag;
      if( PoolWithTag )
      {
        memmove(PoolWithTag, (UINT8 *)Privileges, 12 * PrivilegeCount + 8);
        v16->PrivilegeCount = PrivilegeCount;
        v10 = v22;
      }
      else
      {
        v10 = -1073741670;
      }
    }
    v11 = (struct _DMA_ADAPTER *)Object;
  }
  if( v10 < 0 )
  {
    if( P )
      ExFreePoolWithTag(P, 0);
    if( v25 )
      ExFreePoolWithTag(v25, 0);
    if( v16 )
      ExFreePoolWithTag(v16, 0);
    SeReleaseSubjectContext(&SubjectContext);
    HalPutDmaAdapter(v11);
    if( v10 != -1073741670 )
      return v10;
    v21 = 3221225626i64;
    goto LABEL_33;
  }
  v17 = v25;
  v18 = P;
  SepAdtPrivilegedServiceAuditAlarm(
    &SubjectContext,
    (_UNICODE_STRING *)P,
    (_UNICODE_STRING *)v25,
    (_TOKEN *)v11,
    (_TOKEN *)SubjectContext.PrimaryToken,
    v16,
    AccessGranted);
  if( v18 )
    ExFreePoolWithTag(v18, 0);
  if( v17 )
    ExFreePoolWithTag(v17, 0);
  if( v16 )
    ExFreePoolWithTag(v16, 0);
  HalPutDmaAdapter(v11);
  SeReleaseSubjectContext(&SubjectContext);
  return 0;
}

Referenced by: