SepAdtLogAuditRecord

VOID __stdcall SepAdtLogAuditRecord(_SE_ADT_PARAMETER_ARRAY *AuditParameters){
  unsigned __int8 CurrentIrql; 
  POOL_TYPE v3; 
  _QWORD *PoolWithTag; 
  INT64 v5; 
  void *ThreadServerSilo; 
  PVOID *v7; 
  int v8; 
  PVOID v9; 
  unsigned int v10; 
  void *v11; 
  INT64 v12; 
  void *v13; 
  char v14[8]; 
  _KAPC_STATE ApcState; 
  if( !SepRmAuditingEnabled && (AuditParameters->Flags & 2) != 0 )
    return;
  CurrentIrql = KeGetCurrentIrql();
  v3 = NonPagedPoolNx;
  if( CurrentIrql != 2 )
    v3 = PagedPool;
  PoolWithTag = ExAllocatePoolWithTag(v3, 0x40ui64, 0x69416553ui64);
  v5 = (INT64)PoolWithTag;
  if( !PoolWithTag )
  {
    if( AuditParameters->AuditId != 521 )
      SepAuditFailedRaisedIrql(3221225626i64);
    return;
  }
  PoolWithTag[5] = 0i64;
  *((_DWORD *)PoolWithTag + 12) = 0;
  *((_DWORD *)PoolWithTag + 5) = 1;
  *((_DWORD *)PoolWithTag + 8) = 1;
  if( KeIsExecutingInArbitraryThreadContext() )
    ThreadServerSilo = 0i64;
  else
    ThreadServerSilo = (void *)PsGetThreadServerSilo((INT64)KeGetCurrentThread());
  *(_QWORD *)(v5 + 56) = ThreadServerSilo;
  if( ThreadServerSilo )
    ObfReferenceObjectWithTag(ThreadServerSilo, 0x69416553u);
  v7 = (PVOID *)(v5 + 24);
  v8 = SepAdtMarshallAuditRecord(AuditParameters, (void **)(v5 + 24), (_DWORD *)(v5 + 16), v3);
  if( v8 < 0 )
  {
    v13 = *(void **)(v5 + 56);
    if( v13 )
      ObfDereferenceObjectWithTag(v13, 0x69416553ui64);
    ExFreePoolWithTag((PVOID)v5, 0);
    LODWORD(SepAdtLastAuditFailStatus) = v8;
    _InterlockedIncrement(&SepAdtAuditFailureCount);
    if( AuditParameters->AuditId == 521 )
      goto LABEL_33;
    v12 = (unsigned int)v8;
  }
  else
  {
    if( !SepRmAuditingEnabled )
    {
      v9 = *v7;
      if( (*((_DWORD *)*v7 + 5) & 2) != 0 )
      {
        if( *(_QWORD *)(v5 + 56) )
        {
          ObfDereferenceObjectWithTag(*(PVOID *)(v5 + 56), 0x69416553ui64);
          v9 = *(PVOID *)(v5 + 24);
        }
        ExFreePoolWithTag(v9, 0);
        ExFreePoolWithTag((PVOID)v5, 0);
        return;
      }
    }
    v10 = *((_DWORD *)*v7 + 3);
    *(_DWORD *)(v5 + 36) = v10;
    if( AuditParameters->AuditId == 521 && (AuditParameters->Flags & 0x10) != 0 )
    {
      if( v10 <= 0x1D0 )
      {
        memset(&ApcState, 0, sizeof(ApcState));
        KiStackAttachProcess((_KPROCESS *)SepRmLsaCallProcess, 0i64, &ApcState);
        SepRmDispatchDataToLsa(v5);
        KiUnstackDetachProcess(&ApcState, 0i64);
      }
      goto LABEL_33;
    }
    v14[0] = 0;
    if( SepQueueWorkItem((INT64)&SepLsaAuditQueueInfo, v5, (BYTE *)v14) )
      goto LABEL_33;
    v11 = *(void **)(v5 + 56);
    if( v11 )
      ObfDereferenceObjectWithTag(v11, 0x69416553ui64);
    ExFreePoolWithTag(*v7, 0);
    ExFreePoolWithTag((PVOID)v5, 0);
    if( v14[0] )
      goto LABEL_33;
    v12 = 3221225473i64;
  }
  SepAuditFailedRaisedIrql(v12);
LABEL_33:
  if( SepAdtAuditFailureCount && CurrentIrql < 2u && AuditParameters->AuditId != 521 )
    SepAdtLogAuditFailureEvent((unsigned int)SepAdtLastAuditFailStatus, 0);
}

Referenced by: