SeAuditHandleDuplication

VOID __stdcall SeAuditHandleDuplication(
        PVOID SourceHandle,
        PVOID NewHandle,
        _EPROCESS *SourceProcess,
        _EPROCESS *TargetProcess){
  __int64 v8; 
  __int64 v9; 
  unsigned __int8 *v10; 
  int v11; 
  UINT8 IsKernelHandle; 
  INT8 v13; 
  ULONG v14; 
  SE_ADT_PARAMETER_TYPE v15; 
  __int64 v16; 
  unsigned __int64 v17; 
  UINT8 v18; 
  __int64 v19; 
  __int64 v20; 
  unsigned __int64 v21; 
  SE_ADT_PARAMETER_TYPE v22; 
  ULONG v23; 
  _QWORD SubjectContext[5]; 
  _SE_ADT_PARAMETER_ARRAY Src; 
  memset(&SubjectContext[1], 0, 32);
  SeCaptureSubjectContext((_SECURITY_SUBJECT_CONTEXT *)&SubjectContext[1]);
  v8 = SubjectContext[3];
  v9 = SubjectContext[3];
  if( SubjectContext[1] )
    v9 = SubjectContext[1];
  v10 = **(unsigned __int8 ***)(v9 + 152);
  memset((INT64)&Src, 0i64);
  v11 = v10[1];
  Src.CategoryId = 3;
  if( SubjectContext[1] )
    v8 = SubjectContext[1];
  *(_DWORD *)&Src.FlatSubCategoryId = 524411;
  Src.Parameters[0].Length = 4 * v11 + 8;
  Src.AuditId = 4690;
  Src.Parameters[1].Address = &SeSubsystemName;
  Src.Parameters[2].Data[0] = *(_QWORD *)(v8 + 24);
  Src.Parameters[0].Type = SeAdtParmTypeSid;
  Src.Parameters[0].Address = v10;
  Src.Parameters[1].Type = SeAdtParmTypeString;
  Src.Parameters[1].Length = 32;
  Src.Parameters[2].Type = SeAdtParmTypeLogonId;
  Src.Parameters[2].Length = 8;
  Src.Parameters[3].Type = SeAdtParmTypePtr;
  Src.Parameters[3].Length = 8;
  IsKernelHandle = ObpIsKernelHandle(SourceHandle, 0);
  Src.Parameters[4].Type = v15;
  v17 = v16 ^ 0xFFFFFFFF80000000ui64;
  Src.Parameters[4].Length = v14;
  Src.Parameters[5].Type = v15;
  if( !IsKernelHandle )
    v17 = (unsigned __int64)SourceHandle;
  Src.Parameters[4].Data[0] = *((_QWORD *)SourceProcess + 136);
  Src.Parameters[5].Length = v14;
  Src.Parameters[3].Data[0] = v17 & 0xFFFFFFFFFFFFFFFCui64;
  v18 = ObpIsKernelHandle(NewHandle, v13);
  v21 = v20 ^ v19;
  Src.Parameters[6].Type = v22;
  Src.Parameters[6].Length = v23;
  if( !v18 )
    v21 = (unsigned __int64)NewHandle;
  Src.Parameters[6].Data[0] = *((_QWORD *)TargetProcess + 136);
  Src.ParameterCount = 7;
  Src.Parameters[5].Data[0] = v21 & 0xFFFFFFFFFFFFFFFCui64;
  SepAdtLogAuditRecord(&Src);
  SeReleaseSubjectContext((_SECURITY_SUBJECT_CONTEXT *)&SubjectContext[1]);
}

Referenced by: