NtPrivilegeObjectAuditAlarm

NTSTATUS __stdcall NtPrivilegeObjectAuditAlarm(
        UNICODE_STRING *SubsystemName,
        PVOID HandleId,
        PVOID ClientToken,
        UINT64 DesiredAccess,
        PRIVILEGE_SET *Privileges,
        UINT8 AccessGranted){
  int v6; 
  CHAR v10; 
  NTSTATUS v11; 
  struct _DMA_ADAPTER *v12; 
  unsigned int PrivilegeCount; 
  UINT64 v14; 
  char *v15; 
  UINT8 *PoolWithTag; 
  _PRIVILEGE_SET *CapturedPrivileges; 
  PVOID v18; 
  INT64 v20; 
  UINT64 DesiredAccessa; 
  PVOID Object; 
  _PRIVILEGE_SET *v23; 
  PVOID P; 
  struct _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  v6 = DesiredAccess;
  P = 0i64;
  v23 = 0i64;
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  v10 = *((_BYTE *)KeGetCurrentThread() + 562);
  SeCaptureSubjectContext(&SubjectContext);
  if( !SeCheckAuditPrivilege(&SubjectContext, v10) )
  {
    v11 = -1073741727;
LABEL_30:
    SeReleaseSubjectContext(&SubjectContext);
    return v11;
  }
  Object = 0i64;
  v11 = ObReferenceObjectByHandle(ClientToken, 8u, (POBJECT_TYPE)SeTokenObjectType, v10, &Object, 0i64);
  if( v11 < 0 )
  {
    SeReleaseSubjectContext(&SubjectContext);
    if( v11 == -1073741816 )
      return v11;
    v20 = (unsigned int)v11;
LABEL_28:
    SepAuditFailed(v20);
    return v11;
  }
  v12 = (struct _DMA_ADAPTER *)Object;
  if( *((_DWORD *)Object + 48) == 2 && *((int *)Object + 49) < 1 )
  {
    HalPutDmaAdapter((PADAPTER_OBJECT)Object);
    v11 = -1073741659;
    goto LABEL_30;
  }
  v11 = SepProbeAndCaptureString_U(SubsystemName, (_UNICODE_STRING **)&P);
  if( v11 < 0 )
  {
LABEL_16:
    CapturedPrivileges = v23;
    goto LABEL_19;
  }
  if( ((unsigned __int8)Privileges & 3) != 0 )
    ExRaiseDatatypeMisalignment();
  PrivilegeCount = Privileges->PrivilegeCount;
  if( Privileges->PrivilegeCount >= 0x43 )
  {
    v11 = -1073741811;
    v12 = (struct _DMA_ADAPTER *)Object;
    goto LABEL_16;
  }
  v14 = 12 * PrivilegeCount + 8;
  if( 12 * PrivilegeCount != -8 )
  {
    v15 = (char *)Privileges + (unsigned int)v14;
    if( (unsigned __int64)v15 > 0x7FFFFFFF0000i64 || v15 < (char *)Privileges )
      MEMORY[0x7FFFFFFF0000] = 0;
  }
  PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(PagedPool, v14, 0x72506553ui64);
  CapturedPrivileges = (_PRIVILEGE_SET *)PoolWithTag;
  v23 = (_PRIVILEGE_SET *)PoolWithTag;
  if( PoolWithTag )
  {
    memmove(PoolWithTag, (UINT8 *)Privileges, 12 * PrivilegeCount + 8);
    CapturedPrivileges->PrivilegeCount = PrivilegeCount;
  }
  else
  {
    v11 = -1073741670;
  }
  v12 = (struct _DMA_ADAPTER *)Object;
LABEL_19:
  if( v11 < 0 )
  {
    if( CapturedPrivileges )
      ExFreePoolWithTag(CapturedPrivileges, 0);
    if( P )
      ExFreePoolWithTag(P, 0);
    SeReleaseSubjectContext(&SubjectContext);
    HalPutDmaAdapter(v12);
    if( v11 != -1073741670 )
      return v11;
    v20 = 3221225626i64;
    goto LABEL_28;
  }
  LODWORD(DesiredAccessa) = v6;
  v18 = P;
  SepAdtPrivilegeObjectAuditAlarm(
    (_UNICODE_STRING *)P,
    0i64,
    0i64,
    HandleId,
    (_TOKEN *)v12,
    (_TOKEN *)SubjectContext.PrimaryToken,
    SubjectContext.ProcessAuditId,
    DesiredAccessa,
    CapturedPrivileges,
    AccessGranted);
  if( CapturedPrivileges )
    ExFreePoolWithTag(CapturedPrivileges, 0);
  if( v18 )
    ExFreePoolWithTag(v18, 0);
  SeReleaseSubjectContext(&SubjectContext);
  HalPutDmaAdapter(v12);
  return 0;
}

Referenced by: