SeAuditPlugAndPlay

VOID __stdcall SeAuditPlugAndPlay(
        _UNICODE_STRING *DeviceInstanceId,
        _UNICODE_STRING *DeviceDesc,
        _UNICODE_STRING *HardwareIds,
        _UNICODE_STRING *CompatibleIds,
        _UNICODE_STRING *LocationInformation,
        _GUID *ClassId,
        _UNICODE_STRING *ClassName,
        _SE_PLUGPLAY_AUDIT_OPERATION_TYPE AuditOperationType,
        UINT8 AuditSuccess){
  ULONG v13; 
  ULONG v14; 
  _QWORD *PrimaryToken; 
  void *ClientToken; 
  unsigned __int8 *v17; 
  unsigned __int64 v18; 
  __int64 v19; 
  UINT8 pbPreventCoaf[8]; 
  _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  _SE_ADT_PARAMETER_ARRAY_EX AuditParameters; 

  SubjectContext.ClientToken = 0i64;
  SubjectContext.ImpersonationLevel = 0x80000000;
  memset(&SubjectContext.ImpersonationLevel + 1, 0, 20);
  memset(&AuditParameters, 0i64, sizeof(AuditParameters));
  pbPreventCoaf[0] = 0;
  if( AuditOperationType )
  {
    switch( AuditOperationType )
    {
      case SE_PLUGPLAY_AUDIT_DISABLE_REQUEST:
        v13 = 6419;
        break;
      case SE_PLUGPLAY_AUDIT_DISABLE_ACTION:
        v13 = 6420;
        break;
      case SE_PLUGPLAY_AUDIT_ENABLE_REQUEST:
        v13 = 6421;
        break;
      case SE_PLUGPLAY_AUDIT_ENABLE_ACTION:
        v13 = 6422;
        break;
      case SE_PLUGPLAY_AUDIT_INSTALL_BLOCKED:
        v13 = 6423;
        break;
      case SE_PLUGPLAY_AUDIT_INSTALL_UNBLOCKED:
        v13 = 6424;
        break;
      default:
        return;
    }
    v14 = 0;
  }
  else
  {
    v13 = 6416;
    v14 = 1;
  }
  AuditParameters.ParameterCount = 0;
  AuditParameters.AuditId = v13;
  AuditParameters.CategoryId = 5;
  AuditParameters.FlatSubCategoryId = 137;
  AuditParameters.Version = v14;
  AuditParameters.Type = 8;
  if( !AuditSuccess )
    AuditParameters.Type = 16;
  SeCaptureSubjectContext((INT64)&SubjectContext);
  PrimaryToken = SubjectContext.PrimaryToken;
  ClientToken = SubjectContext.PrimaryToken;
  if( SubjectContext.ClientToken )
    ClientToken = SubjectContext.ClientToken;
  if( SubjectContext.ClientToken )
    PrimaryToken = SubjectContext.ClientToken;
  v17 = (unsigned __int8 *)**((_QWORD **)ClientToken + 19);
  v18 = PrimaryToken[3];
  AuditParameters.Parameters[AuditParameters.ParameterCount].Type = SeAdtParmTypeSid;
  AuditParameters.Parameters[AuditParameters.ParameterCount].Length = 4 * v17[1] + 8;
  AuditParameters.Parameters[AuditParameters.ParameterCount++].Address = v17;
  AuditParameters.Parameters[AuditParameters.ParameterCount].Type = SeAdtParmTypeString;
  AuditParameters.Parameters[AuditParameters.ParameterCount].Length = 32;
  AuditParameters.Parameters[AuditParameters.ParameterCount++].Address = (void *)&SeSubsystemName;
  AuditParameters.Parameters[AuditParameters.ParameterCount].Type = SeAdtParmTypeLogonId;
  AuditParameters.Parameters[AuditParameters.ParameterCount].Length = 8;
  AuditParameters.Parameters[AuditParameters.ParameterCount++].Data[0] = v18;
  AuditParameters.Parameters[AuditParameters.ParameterCount].Type = SeAdtParmTypeString;
  AuditParameters.Parameters[AuditParameters.ParameterCount].Length = DeviceInstanceId->Length + 16;
  AuditParameters.Parameters[AuditParameters.ParameterCount++].Address = DeviceInstanceId;
  AuditParameters.Parameters[AuditParameters.ParameterCount].Type = SeAdtParmTypeString;
  AuditParameters.Parameters[AuditParameters.ParameterCount].Length = DeviceDesc->Length + 16;
  AuditParameters.Parameters[AuditParameters.ParameterCount].Address = DeviceDesc;
  v19 = ++AuditParameters.ParameterCount;
  AuditParameters.Parameters[v19].Type = SeAdtParmTypeGuid;
  AuditParameters.Parameters[AuditParameters.ParameterCount].Length = 16;
  AuditParameters.Parameters[AuditParameters.ParameterCount++].Address = ClassId;
  AuditParameters.Parameters[AuditParameters.ParameterCount].Type = SeAdtParmTypeString;
  AuditParameters.Parameters[AuditParameters.ParameterCount].Length = ClassName->Length + 16;
  AuditParameters.Parameters[AuditParameters.ParameterCount++].Address = ClassName;
  AuditParameters.Parameters[AuditParameters.ParameterCount].Type = SeAdtParmTypeMultiSzString;
  AuditParameters.Parameters[AuditParameters.ParameterCount].Length = HardwareIds->Length + 16;
  AuditParameters.Parameters[AuditParameters.ParameterCount++].Address = HardwareIds;
  AuditParameters.Parameters[AuditParameters.ParameterCount].Type = SeAdtParmTypeMultiSzString;
  AuditParameters.Parameters[AuditParameters.ParameterCount].Length = CompatibleIds->Length + 16;
  AuditParameters.Parameters[AuditParameters.ParameterCount++].Address = CompatibleIds;
  AuditParameters.Parameters[AuditParameters.ParameterCount].Type = SeAdtParmTypeMultiSzString;
  AuditParameters.Parameters[AuditParameters.ParameterCount].Length = LocationInformation->Length + 16;
  AuditParameters.Parameters[AuditParameters.ParameterCount++].Address = LocationInformation;
  AdtpWriteToEtwEx(&AuditParameters, pbPreventCoaf);
  SeReleaseSubjectContext(&SubjectContext);
}

Referenced by: