SepAuditAssignPrimaryToken

VOID __stdcall SepAuditAssignPrimaryToken(_EPROCESS *Process, VOID *AccessToken, VOID *ptr32){
  _EPROCESS *CurrentThreadProcess; 
  _EPROCESS *v6; 
  unsigned __int64 UniqueProcessId; 
  _UNICODE_STRING *v8; 
  unsigned __int8 *v9; 
  NTSTATUS AllocatedFullProcessImageName; 
  void *v11; 
  int v12; 
  unsigned int v13; 
  unsigned int v14; 
  _UNICODE_STRING *ImageName; 
  _UNICODE_STRING *SubjectContext[5]; 
  _SE_ADT_PARAMETER_ARRAY AuditParameters; 

  memset(SubjectContext, 0, sizeof(SubjectContext));
  ImageName = 0i64;
  memset(&AuditParameters, 0i64, sizeof(AuditParameters));
  CurrentThreadProcess = (_EPROCESS *)PsGetCurrentThreadProcess();
  v6 = CurrentThreadProcess;
  if( CurrentThreadProcess->SeAuditProcessCreationInfo.ImageFileName )
  {
    UniqueProcessId = (unsigned __int64)CurrentThreadProcess->UniqueProcessId;
    SeCaptureSubjectContext((INT64)&SubjectContext[1]);
    v8 = SubjectContext[3];
    if( SubjectContext[1] )
      v8 = SubjectContext[1];
    if( v8 )
    {
      v9 = *(unsigned __int8 **)v8[9].Buffer;
      AllocatedFullProcessImageName = PsGetAllocatedFullProcessImageNameEx(v6, SubjectContext);
      if( AllocatedFullProcessImageName >= 0 )
      {
        v11 = Process->UniqueProcessId;
        AllocatedFullProcessImageName = PsGetAllocatedFullProcessImageNameEx(Process, &ImageName);
        if( AllocatedFullProcessImageName >= 0 )
        {
          v12 = v9[1];
          AuditParameters.CategoryId = 5;
          AuditParameters.Parameters[2].Type = SeAdtParmTypeLogonId;
          *(_DWORD *)&AuditParameters.FlatSubCategoryId = 524421;
          AuditParameters.AuditId = 4696;
          AuditParameters.Parameters[0].Length = 4 * v12 + 8;
          AuditParameters.Parameters[0].Type = SeAdtParmTypeSid;
          AuditParameters.Parameters[0].Address = v9;
          AuditParameters.Parameters[1].Address = (void *)&SeSubsystemName;
          AuditParameters.Parameters[2].Data[0] = (unsigned __int64)v8[1].Buffer;
          AuditParameters.Parameters[3].Data[0] = *((_QWORD *)AccessToken + 3);
          v13 = ImageName->Length + 16;
          AuditParameters.Parameters[5].Address = ImageName;
          AuditParameters.Parameters[5].Length = v13;
          AuditParameters.Parameters[7].Address = SubjectContext[0];
          AuditParameters.Parameters[1].Type = SeAdtParmTypeString;
          v14 = SubjectContext[0]->Length + 16;
          AuditParameters.Parameters[1].Length = 32;
          AuditParameters.Parameters[7].Length = v14;
          AuditParameters.Parameters[2].Length = 8;
          AuditParameters.Parameters[3].Type = SeAdtParmTypeLogonIdEx;
          AuditParameters.Parameters[3].Length = 8;
          AuditParameters.Parameters[4].Type = SeAdtParmTypePtr;
          AuditParameters.Parameters[4].Length = 8;
          AuditParameters.Parameters[4].Data[0] = (unsigned __int64)v11;
          AuditParameters.Parameters[5].Type = SeAdtParmTypeFileSpec;
          AuditParameters.Parameters[6].Type = SeAdtParmTypePtr;
          AuditParameters.Parameters[6].Length = 8;
          AuditParameters.Parameters[6].Data[0] = UniqueProcessId;
          AuditParameters.Parameters[7].Type = SeAdtParmTypeFileSpec;
          AuditParameters.ParameterCount = 8;
          SepAdtLogAuditRecord(&AuditParameters);
        }
      }
    }
    else
    {
      AllocatedFullProcessImageName = -1073741700;
    }
    if( ImageName )
      ExFreePoolWithTag(ImageName, 0);
    if( SubjectContext[0] )
      ExFreePoolWithTag(SubjectContext[0], 0);
    if( AllocatedFullProcessImageName < 0 )
      SepAuditFailed((unsigned int)AllocatedFullProcessImageName);
    SeReleaseSubjectContext((PSECURITY_SUBJECT_CONTEXT)&SubjectContext[1]);
  }
}

Referenced by: