SepAdtObjectReferenceAuditAlarm

VOID __stdcall SepAdtObjectReferenceAuditAlarm(
        PVOID Object,
        _SECURITY_SUBJECT_CONTEXT *SubjectSecurityContext,
        UINT64 DesiredAccess,
        UINT8 AccessGranted){
  UNICODE_STRING *v4; 
  void *ClientToken; 
  void *PrimaryToken; 
  unsigned __int8 **v10; 
  unsigned __int8 *v11; 
  ULONG_PTR v12; 
  int NameString; 
  int v14; 
  int Length; 
  int v16; 
  unsigned int v17; 
  UNICODE_STRING *TypeName; 
  PVOID P; 
  _SE_ADT_PARAMETER_ARRAY Src; 
  P = 0i64;
  v4 = 0i64;
  ClientToken = SubjectSecurityContext->ClientToken;
  PrimaryToken = SubjectSecurityContext->PrimaryToken;
  v17 = DesiredAccess;
  TypeName = 0i64;
  if( ClientToken )
    v10 = (unsigned __int8 **)*((_QWORD *)ClientToken + 19);
  else
    v10 = (unsigned __int8 **)*((_QWORD *)PrimaryToken + 19);
  v11 = *v10;
  v12 = *((_QWORD *)PrimaryToken + 3);
  memset((INT64)&Src, 0i64);
  Src.CategoryId = 3;
  *(_DWORD *)&Src.FlatSubCategoryId = 524408;
  Src.AuditId = 4691;
  if( !AccessGranted )
    Src.Type = 16;
  NameString = SepQueryNameString(Object, (_OBJECT_NAME_INFORMATION **)&P);
  if( NameString >= 0 )
  {
    NameString = SepQueryTypeString(Object, &TypeName);
    if( NameString < 0 )
    {
      v4 = TypeName;
    }
    else
    {
      v14 = v11[1];
      Src.Parameters[0].Type = SeAdtParmTypeSid;
      Src.Parameters[0].Address = v11;
      Src.Parameters[1].Length = 32;
      Src.Parameters[2].Type = SeAdtParmTypeLogonId;
      Src.Parameters[0].Length = 4 * v14 + 8;
      Src.Parameters[1].Address = &SeSubsystemName;
      Src.Parameters[1].Type = SeAdtParmTypeString;
      Src.Parameters[2].Length = 8;
      if( ClientToken )
        Src.Parameters[2].Data[0] = *((_QWORD *)ClientToken + 3);
      else
        Src.Parameters[2].Data[0] = v12;
      v4 = TypeName;
      if( TypeName )
      {
        Length = TypeName->Length;
        Src.Parameters[3].Type = SeAdtParmTypeString;
        Src.Parameters[3].Length = Length + 16;
        Src.Parameters[3].Address = TypeName;
      }
      if( P )
      {
        v16 = *(unsigned __int16 *)P;
        Src.Parameters[4].Type = SeAdtParmTypeString;
        Src.Parameters[4].Length = v16 + 16;
        Src.Parameters[4].Address = P;
      }
      Src.Parameters[5].Data[0] = v17;
      Src.Parameters[6].Data[0] = v17;
      Src.Parameters[7].Data[0] = (ULONG_PTR)SubjectSecurityContext->ProcessAuditId;
      Src.Parameters[5].Type = SeAdtParmTypeAccessMask;
      Src.Parameters[5].Length = 4;
      Src.Parameters[5].Data[1] = 3i64;
      Src.Parameters[6].Type = SeAdtParmTypeHexUlong;
      Src.Parameters[6].Length = 4;
      Src.Parameters[7].Type = SeAdtParmTypePtr;
      Src.Parameters[7].Length = 8;
      Src.ParameterCount = 8;
      SepAdtLogAuditRecord(&Src);
    }
  }
  if( P )
    ExFreePoolWithTag(P, 0);
  if( v4 )
    ExFreePoolWithTag(v4, 0);
  if( NameString < 0 )
    SepAuditFailed((unsigned int)NameString);
}

Referenced by: