AdtpBuildPrivilegeAuditString

INT64 __fastcall AdtpBuildPrivilegeAuditString(
        _PRIVILEGE_SET *PrivilegeSet,
        _UNICODE_STRING *pResultantString,
        _EVENT_DATA_DESCRIPTOR *pEtwDataDescriptor,
        WCHAR *pszStringBuffer,
        UINT64 *pdwCurBufferIndex,
        UINT8 *pFreeWhenDone){
  unsigned int PrivilegeCount; 
  unsigned int v7; 
  _UNICODE_STRING *v10; 
  WCHAR v13; 
  unsigned __int16 v14; 
  __int64 v15; 
  unsigned int v16; 
  WCHAR *PoolWithTag; 
  UINT8 *v18; 
  UINT64 Length; 
  wchar_t *Buffer; 
  unsigned int v21; 
  __int64 v22; 
  unsigned __int16 v23; 
  struct _UNICODE_STRING DestinationString; 
  _UNICODE_STRING v25; 
  UNICODE_STRING Name; 
  struct _UNICODE_STRING v27; 
  PrivilegeCount = PrivilegeSet->PrivilegeCount;
  v7 = 0;
  *(_DWORD *)(&v25.MaximumLength + 1) = 0;
  v10 = pResultantString;
  DestinationString = 0i64;
  v27 = 0i64;
  Name = 0i64;
  if( PrivilegeCount )
  {
    if( PrivilegeCount - 1 > 0x41 )
      return 3221225485i64;
    RtlInitUnicodeString(&DestinationString, L"\r\n\t\t\t", (WCHAR)pEtwDataDescriptor);
    RtlInitUnicodeString(&v27, L"?", v13);
    v14 = (unsigned __int16)(LOWORD(PrivilegeSet->PrivilegeCount)
                           * (DestinationString.Length + AdtpWellKnownPrivilegeMaxLen)
                           - DestinationString.Length
                           + 2) >> 1;
    if( pszStringBuffer && (v15 = *(unsigned int *)pdwCurBufferIndex, v16 = v15 + v14, v16 < 0x400) )
    {
      PoolWithTag = &pszStringBuffer[v15];
      *(_DWORD *)pdwCurBufferIndex = v16;
    }
    else
    {
      PoolWithTag = (WCHAR *)ExAllocatePoolWithTag(PagedPool, 2i64 * v14, 0x6B416553ui64);
      if( !PoolWithTag )
        return 3221225495i64;
      *pFreeWhenDone = 1;
    }
    v25.Buffer = PoolWithTag;
    v25.MaximumLength = 2 * v14;
    v18 = (UINT8 *)PoolWithTag;
    if( PrivilegeSet->PrivilegeCount )
    {
      do
      {
        if( AdtpLookupKnownPrivilegeNameQuickly(
               (LUID *)((char *)&PrivilegeSet->Privilege[0].Luid + 8 * v7 + 4 * v7),
               &Name) )
        {
          Length = v27.Length;
          Buffer = v27.Buffer;
        }
        else
        {
          Length = Name.Length;
          Buffer = Name.Buffer;
        }
        memmove(v18, (UINT8 *)Buffer, Length);
        v21 = PrivilegeSet->PrivilegeCount;
        v18 += Length;
        if( v7 < PrivilegeSet->PrivilegeCount - 1 )
        {
          v22 = DestinationString.Length;
          memmove(v18, (UINT8 *)DestinationString.Buffer, DestinationString.Length);
          v21 = PrivilegeSet->PrivilegeCount;
          v18 += v22;
        }
        ++v7;
      }
      while( v7 < v21 );
      v10 = pResultantString;
    }
    *(_WORD *)v18 = 0;
    v23 = (_WORD)v18 - (_WORD)PoolWithTag;
    v25.Length = v23;
    if( pEtwDataDescriptor )
    {
      pEtwDataDescriptor->Ptr = (unsigned __int64)PoolWithTag;
      *(_QWORD *)&pEtwDataDescriptor->Size = (unsigned int)v23 + 2;
    }
    else
    {
      *v10 = v25;
    }
  }
  else if( pEtwDataDescriptor )
  {
    *(_QWORD *)&pEtwDataDescriptor->Size = 4i64;
    pEtwDataDescriptor->Ptr = (unsigned __int64)"-";
  }
  else if( pResultantString )
  {
    RtlInitUnicodeString(pResultantString, L"-", 0);
  }
  return 0i64;
}

Referenced by: