SeOpenObjectForDeleteAuditAlarmWithTransaction

VOID __stdcall SeOpenObjectForDeleteAuditAlarmWithTransaction(
        _UNICODE_STRING *ObjectTypeName,
        PVOID Object,
        _UNICODE_STRING *AbsoluteObjectName,
        PVOID SecurityDescriptor,
        _ACCESS_STATE *AccessState,
        UINT8 ObjectCreated,
        UINT8 AccessGranted,
        CHAR AccessMode,
        _GUID *TransactionId,
        UINT8 *GenerateOnClose){
  _UNICODE_STRING *v11; 
  PVOID v12; 
  UINT8 v13; 
  UINT8 v14; 
  PVOID v15; 
  UNICODE_STRING *v16; 
  UNICODE_STRING *v17; 
  SECURITY_SUBJECT_CONTEXT *v18; 
  int TypeString; 
  unsigned int v20; 
  __int16 v21; 
  struct _ACL *v22; 
  struct _ACL *v23; 
  __int64 v24; 
  __int64 v25; 
  UINT8 v26; 
  __int16 v27; 
  _ACL *v28; 
  __int64 v29; 
  PRIVILEGE_SET *v30; 
  UINT16 *v31; 
  _GUID *v32; 
  _GUID *v33; 
  void *v34; 
  VOID *PoolWithTag; 
  UNICODE_STRING *v36; 
  void *v37; 
  VOID *v38; 
  UNICODE_STRING *v39; 
  BOOL GenerateAudit; 
  __int64 v41; 
  UINT64 GrantedAccess; 
  UINT8 v43; 
  UINT8 v44; 
  UINT8 GenerateAlarm[3]; 
  UINT16 FlatSubCategoryId[2]; 
  INT64 AuditStatus; 
  _PRIVILEGE_SET **v48; 
  PVOID v49; 
  PACCESS_TOKEN Token; 
  PVOID P; 
  v11 = ObjectTypeName;
  v12 = Object;
  v13 = 0;
  v44 = 0;
  v14 = 0;
  GenerateAlarm[0] = 0;
  v15 = 0i64;
  P = 0i64;
  v16 = 0i64;
  v49 = 0i64;
  v17 = 0i64;
  LODWORD(AuditStatus) = 0;
  FlatSubCategoryId[0] = 999;
  if( AccessMode )
  {
    v18 = (SECURITY_SUBJECT_CONTEXT *)((char *)AccessState + 32);
    v48 = (_PRIVILEGE_SET **)*((_QWORD *)AccessState + 9);
    Token = (PACCESS_TOKEN)*((_QWORD *)AccessState + 4);
    if( !Token )
      Token = (PACCESS_TOKEN)*((_QWORD *)AccessState + 6);
    if( ObjectTypeName && ObjectTypeName->Length )
    {
      v17 = ObjectTypeName;
    }
    else if( v12 )
    {
      TypeString = SepQueryTypeString(v12, (UNICODE_STRING **)&v49);
      v15 = v49;
      LODWORD(AuditStatus) = TypeString;
      if( TypeString < 0 )
        goto LABEL_66;
      v11 = ObjectTypeName;
      v18 = (SECURITY_SUBJECT_CONTEXT *)((char *)AccessState + 32);
      v12 = Object;
      if( v49 )
        v17 = (UNICODE_STRING *)v49;
    }
    if( !SecurityDescriptor )
      goto LABEL_34;
    LOBYTE(GenerateAudit) = 1;
    if( !SepAdtAuditObjectAccessWithContext(
            v12,
            v11,
            AccessGranted,
            AccessGranted == 0,
            v18,
            GenerateAudit,
            FlatSubCategoryId) )
      goto LABEL_34;
    v20 = *((_DWORD *)AccessState + 4) | *((_DWORD *)AccessState + 5);
    v21 = *((_WORD *)SecurityDescriptor + 1);
    if( (v21 & 0x10) != 0 )
    {
      if( v21 >= 0 )
      {
        v22 = (struct _ACL *)*((_QWORD *)SecurityDescriptor + 3);
      }
      else
      {
        v24 = *((unsigned int *)SecurityDescriptor + 3);
        if( (_DWORD)v24 )
          v22 = (struct _ACL *)((char *)SecurityDescriptor + v24);
        else
          v22 = 0i64;
      }
      if( v21 >= 0 )
      {
        v23 = (struct _ACL *)*((_QWORD *)SecurityDescriptor + 3);
        goto LABEL_25;
      }
      v25 = *((unsigned int *)SecurityDescriptor + 3);
      if( (_DWORD)v25 )
      {
        v23 = (struct _ACL *)((char *)SecurityDescriptor + v25);
        goto LABEL_25;
      }
    }
    else
    {
      v22 = 0i64;
    }
    v23 = 0i64;
LABEL_25:
    v26 = AccessGranted;
    SeExamineSacl(v23, v22, Token, v20, AccessGranted, &v44, GenerateAlarm);
    v27 = *((_WORD *)SecurityDescriptor + 1);
    if( (v27 & 0x10) == 0 )
      goto LABEL_26;
    if( v27 >= 0 )
    {
      v28 = (_ACL *)*((_QWORD *)SecurityDescriptor + 3);
      goto LABEL_31;
    }
    v29 = *((unsigned int *)SecurityDescriptor + 3);
    if( (_DWORD)v29 )
      v28 = (_ACL *)((char *)SecurityDescriptor + v29);
    else
LABEL_26:
      v28 = 0i64;
LABEL_31:
    SeExamineGlobalSacl(ObjectTypeName, v28, Token, v20, AccessGranted, &v44, GenerateAlarm);
    v13 = v44;
    if( v44 )
    {
      *GenerateOnClose = 1;
LABEL_42:
      *((_BYTE *)AccessState + 9) = 1;
      if( AbsoluteObjectName && AbsoluteObjectName->Length )
      {
        v16 = AbsoluteObjectName;
        goto LABEL_49;
      }
      if( !Object )
      {
LABEL_49:
        if( v26 )
        {
          v33 = (_GUID *)v48;
          LODWORD(GrantedAccess) = *((_DWORD *)AccessState + 5);
          SepAdtOpenObjectForDeleteAuditAlarm(
            FlatSubCategoryId[0],
            (_UNICODE_STRING *)v18,
            (VOID **)AbsoluteObjectName,
            v17,
            v16,
            *((_TOKEN **)AccessState + 4),
            *((_TOKEN **)AccessState + 6),
            v41,
            GrantedAccess,
            *v48,
            v43,
            *((VOID **)AccessState + 7),
            TransactionId);
          if( v16 )
          {
            v34 = (void *)*((_QWORD *)AccessState + 17);
            if( v34 )
            {
              ExFreePoolWithTag(v34, 0);
              *((_WORD *)AccessState + 64) = 0;
              *((_WORD *)AccessState + 65) = 0;
            }
            PoolWithTag = ExAllocatePoolWithTag(PagedPool, v16->MaximumLength, 0x20206553ui64);
            *((_QWORD *)AccessState + 17) = PoolWithTag;
            if( PoolWithTag )
            {
              *((_WORD *)AccessState + 65) = v16->MaximumLength;
              RtlCopyUnicodeString((UNICODE_STRING *)AccessState + 8, v16, v36);
            }
            v33 = (_GUID *)v48;
          }
          if( v17 )
          {
            v37 = (void *)*((_QWORD *)AccessState + 19);
            if( v37 )
            {
              ExFreePoolWithTag(v37, 0);
              *((_WORD *)AccessState + 72) = 0;
              *((_WORD *)AccessState + 73) = 0;
            }
            v38 = ExAllocatePoolWithTag(PagedPool, v17->MaximumLength, 0x20206553ui64);
            *((_QWORD *)AccessState + 19) = v38;
            if( v38 )
            {
              *((_WORD *)AccessState + 73) = v17->MaximumLength;
              RtlCopyUnicodeString((UNICODE_STRING *)AccessState + 9, v17, v39);
            }
          }
          if( TransactionId )
            v33[2] = *TransactionId;
        }
        else
        {
          v32 = TransactionId;
          if( !TransactionId )
            v32 = (_GUID *)(v48 + 4);
          SepAdtOpenObjectAuditAlarm(
            FlatSubCategoryId[0],
            (__int64)&SeSubsystemName,
            0i64,
            &v17->Length,
            (__int64)v16,
            SecurityDescriptor,
            *((_QWORD *)AccessState + 4),
            *((_QWORD *)AccessState + 6),
            *((_DWORD *)AccessState + 6),
            *((_DWORD *)AccessState + 5),
            (__int64)*v48,
            0,
            *((_QWORD *)AccessState + 7),
            2,
            0i64,
            0,
            0i64,
            (__int64)v32,
            (__int64)AccessState);
        }
        goto LABEL_66;
      }
      LODWORD(AuditStatus) = SepQueryNameString(Object, (_OBJECT_NAME_INFORMATION **)&P);
      if( (int)AuditStatus >= 0 )
      {
        if( P )
          v16 = (UNICODE_STRING *)P;
        goto LABEL_49;
      }
LABEL_66:
      if( P )
        ExFreePoolWithTag(P, 0);
      if( v15 )
        ExFreePoolWithTag(v15, 0);
LABEL_70:
      if( (int)AuditStatus < 0 )
        SepAuditFailed((unsigned int)AuditStatus);
      return;
    }
    v14 = GenerateAlarm[0];
LABEL_34:
    if( AccessGranted )
    {
      v30 = *v48;
      if( *v48 )
      {
        if( v30->PrivilegeCount )
        {
          v31 = FlatSubCategoryId;
          LOBYTE(v31) = AccessGranted;
          if( (unsigned __int8)SepAdtAuditPrivilegeUseWithContext(
                                  v30,
                                  (INT64)v31,
                                  0i64,
                                  (SECURITY_SUBJECT_CONTEXT *)AccessState + 1,
                                  FlatSubCategoryId) )
          {
            v13 = 1;
            *((_BYTE *)AccessState + 124) = 1;
          }
        }
      }
    }
    if( !v13 && !v14 )
      goto LABEL_70;
    v26 = AccessGranted;
    goto LABEL_42;
  }
}

Referenced by: