NtCloseObjectAuditAlarm

INT64 __fastcall NtCloseObjectAuditAlarm(_UNICODE_STRING *SubsystemName, VOID *HandleId, UINT8 GenerateOnClose){
  CHAR v5; 
  int v7; 
  struct _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  PVOID P; 
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  P = 0i64;
  v5 = *((_BYTE *)KeGetCurrentThread() + 562);
  if( !GenerateOnClose )
    return 0i64;
  SeCaptureSubjectContext(&SubjectContext);
  if( SeCheckAuditPrivilege(&SubjectContext, v5) )
  {
    v7 = SepProbeAndCaptureString_U(SubsystemName, (_UNICODE_STRING **)&P);
    if( v7 >= 0 )
      SepAdtCloseObjectAuditAlarm((_UNICODE_STRING *)P, HandleId, &SubjectContext, 0i64, 0);
  }
  else
  {
    v7 = -1073741727;
  }
  if( P )
    ExFreePoolWithTag(P, 0);
  SeReleaseSubjectContext(&SubjectContext);
  if( v7 == -1073741670 )
    SepAuditFailed(3221225626i64);
  return(unsigned int)v7;
}

Referenced by: