LocalGetStringForRelativeAttribute
NTSTATUS __stdcall LocalGetStringForRelativeAttribute(
_CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 *RelativeAttribute,
UINT64 AttributeSize,
VOID *RootDomainSid,
VOID *DefaultToDomain,
WCHAR **ConditionStr,
WCHAR **DefaultToDomaina,
WCHAR **a7){
unsigned int v7;
void *v9;
NTSTATUS StringForSid;
__int64 ValueCount;
int ValueType;
__int64 Name;
UINT8 *v14;
__int64 v15;
__int64 v16;
unsigned int v17;
unsigned int v18;
__int64 v19;
unsigned int v20;
UINT64 v21;
$BE44A4FCE80D7C8ECAC3D77A2C4713B9 *v22;
__int64 v23;
unsigned int v24;
unsigned __int64 v25;
unsigned int v26;
$BE44A4FCE80D7C8ECAC3D77A2C4713B9 *v27;
__int64 v28;
unsigned int v29;
__int64 v30;
unsigned int v31;
char *v32;
__int64 v33;
_WORD *v34;
unsigned int v35;
$BE44A4FCE80D7C8ECAC3D77A2C4713B9 *p_Values;
__int64 v37;
$BE44A4FCE80D7C8ECAC3D77A2C4713B9 *v38;
unsigned int v39;
$BE44A4FCE80D7C8ECAC3D77A2C4713B9 *v40;
__int64 v41;
__int64 v42;
unsigned int v43;
$BE44A4FCE80D7C8ECAC3D77A2C4713B9 *v44;
__int64 v45;
__int64 v46;
WCHAR *v47;
_WORD *v48;
_WORD *v49;
__int64 v50;
__int64 v51;
char *v52;
VOID *v53;
char *v54;
int v55;
int v56;
int v57;
int v58;
int v59;
$BE44A4FCE80D7C8ECAC3D77A2C4713B9 *v60;
__int64 v61;
__int64 v62;
unsigned int v63;
unsigned __int8 *v64;
__int64 v65;
unsigned int v66;
unsigned int v67;
$BE44A4FCE80D7C8ECAC3D77A2C4713B9 *v68;
VOID *v69;
char *v70;
__int64 v71;
__int64 v72;
__int64 v73;
$BE44A4FCE80D7C8ECAC3D77A2C4713B9 *v74;
__int64 v75;
char *v76;
char *v77;
__int64 v78;
char *v79;
$BE44A4FCE80D7C8ECAC3D77A2C4713B9 *v80;
__int64 v81;
char *v82;
__int64 v83;
__int64 v84;
$BE44A4FCE80D7C8ECAC3D77A2C4713B9 *v85;
__int64 v86;
char *v87;
__int64 v88;
__int64 v89;
_QWORD *v90;
_STRSD_SID_LOOKUP *v92;
int v93;
UINT64 pcbLength;
WCHAR *String;
__int64 v96;
WCHAR *EncodedString;
VOID *RootDomainSida;
WCHAR **v99;
__int16 Src[72];
__int16 DstBuf[40];
RootDomainSida = RootDomainSid;
v7 = AttributeSize;
v99 = a7;
EncodedString = 0i64;
v9 = 0i64;
memset(DstBuf, 0i64, 0x46u);
memset(Src, 0i64, 0x8Cu);
String = 0i64;
pcbLength = 0i64;
if( !RelativeAttribute || !v7 || !a7 )
{
StringForSid = 87;
LABEL_133:
if( v9 )
ExFreePoolWithTag(v9, 0);
goto LABEL_135;
}
if( v7 < 0x14 )
return 1336;
ValueCount = RelativeAttribute->ValueCount;
ValueType = RelativeAttribute->ValueType;
if( !(_DWORD)ValueCount )
return 1336;
ultow_s(RelativeAttribute->Flags, (wchar_t *)DstBuf, 0x23u, 16);
Name = RelativeAttribute->Name;
if( v7 < (unsigned int)Name
|| v7 - (unsigned int)Name < 4
|| RtlStringCbLengthW((WCHAR *)((char *)RelativeAttribute + Name), v7 - (unsigned int)Name, &pcbLength) < 0
|| !(_DWORD)pcbLength )
{
return 1336;
}
StringForSid = EncodeAttributeName(v14, (unsigned int)pcbLength, &EncodedString);
if( !StringForSid )
{
v15 = -1i64;
do
++v15;
while( EncodedString[v15] );
v16 = (unsigned int)(2 * v15);
v96 = v16;
if( (unsigned __int64)(2 * ValueCount) > 0xFFFFFFFF )
goto LABEL_131;
v17 = 2 * ValueCount + 24;
if( v17 < 0x18 )
goto LABEL_131;
v18 = v17 + v16;
if( v17 + (unsigned int)v16 < v17 )
goto LABEL_131;
v19 = -1i64;
do
++v19;
while( DstBuf[v19] );
v20 = v18 + 2 * v19;
if( v20 < v18 || (unsigned __int64)(4 * ValueCount) > 0xFFFFFFFF )
goto LABEL_131;
if( v7 - 16 < 4 * (int)ValueCount )
goto LABEL_28;
v93 = ValueType;
if( ValueType != 1 )
{
switch( ValueType )
{
case 2:
goto LABEL_63;
case 3:
v35 = 0;
p_Values = &RelativeAttribute->Values;
while( 1 )
{
v37 = p_Values->pInt64[0];
if( v7 < (unsigned int)v37
|| v7 - (unsigned int)v37 < 2
|| RtlStringCbLengthW((WCHAR *)((char *)RelativeAttribute + v37), v7 - (unsigned int)v37, &pcbLength) < 0 )
{
goto LABEL_28;
}
if( v20 + (_DWORD)pcbLength + 4 < v20 )
goto LABEL_131;
++v35;
p_Values = v38 + 1;
v20 += pcbLength + 4;
if( v35 >= (unsigned int)ValueCount )
{
ValueType = v93;
goto LABEL_53;
}
}
case 5:
v26 = 0;
v27 = &RelativeAttribute->Values;
while( 1 )
{
v28 = v27->pInt64[0];
if( v7 < (unsigned int)v28 )
goto LABEL_28;
if( v7 - (unsigned int)v28 < 4 )
goto LABEL_28;
v29 = *(unsigned int *)((char *)&RelativeAttribute->Name + v28);
v30 = (unsigned int)(v28 + 4);
if( !v29 )
goto LABEL_28;
v31 = v7 - v30;
if( v7 - (unsigned int)v30 < v29 )
goto LABEL_28;
if( v31 < 8 )
goto LABEL_28;
v32 = (char *)RelativeAttribute + v30;
if( !v32[1] || v31 - 8 < 4 * (unsigned __int64)(unsigned __int8)v32[1] )
goto LABEL_28;
StringForSid = LocalGetStringForSid(v32, &String, RootDomainSida, 0i64, v92, (UINT8)DefaultToDomaina);
if( StringForSid )
goto LABEL_135;
v33 = -1i64;
do
++v33;
while( String[v33] );
LODWORD(v22) = v20 + 2 * v33;
if( (unsigned int)v22 < v20 )
goto LABEL_131;
v20 += 2 * v33;
if( String )
{
ExFreePoolWithTag(String, 0);
String = 0i64;
}
++v26;
++v27;
if( v26 >= (unsigned int)ValueCount )
goto LABEL_52;
}
case 6:
LABEL_63:
v39 = 0;
v40 = &RelativeAttribute->Values;
while( 1 )
{
v41 = v40->pInt64[0];
if( v7 < (unsigned int)v41 || v7 - (unsigned int)v41 < 8 )
break;
ui64tow_s(*(_QWORD *)((char *)&RelativeAttribute->Name + v41), (wchar_t *)Src, 0x46u, 10);
v42 = -1i64;
do
++v42;
while( Src[v42] );
if( v20 + 2 * (_DWORD)v42 < v20 )
goto LABEL_131;
++v39;
++v40;
v20 += 2 * v42;
if( v39 >= (unsigned int)ValueCount )
goto LABEL_52;
}
break;
case 16:
LODWORD(v21) = 0;
v22 = &RelativeAttribute->Values;
while( 1 )
{
v23 = v22->pInt64[0];
if( v7 < (unsigned int)v23 )
break;
if( v7 - (unsigned int)v23 < 4 )
break;
v24 = *(unsigned int *)((char *)&RelativeAttribute->Name + v23);
if( v7 - (unsigned int)v23 - 4 < v24 )
break;
v25 = 4i64 * v24;
if( v25 > 0xFFFFFFFF || (unsigned int)v25 + v20 < v20 )
goto LABEL_131;
v21 = (unsigned int)(v21 + 1);
++v22;
v20 += v25;
if( (unsigned int)v21 >= (unsigned int)ValueCount )
goto LABEL_53;
}
break;
}
LABEL_28:
StringForSid = 1336;
goto LABEL_135;
}
v43 = 0;
v44 = &RelativeAttribute->Values;
do
{
v45 = v44->pInt64[0];
if( v7 < (unsigned int)v45 || v7 - (unsigned int)v45 < 8 )
goto LABEL_28;
i64tow_s(*(_QWORD *)((char *)&RelativeAttribute->Name + v45), (wchar_t *)Src, 0x46u, 10);
v46 = -1i64;
do
++v46;
while( Src[v46] );
if( v20 + 2 * (_DWORD)v46 < v20 )
goto LABEL_131;
++v43;
++v44;
v20 += 2 * v46;
}
while( v43 < (unsigned int)ValueCount );
LABEL_52:
ValueType = v93;
LODWORD(v16) = v96;
LABEL_53:
if( v20 + 3 < v20 )
{
LABEL_131:
StringForSid = 534;
goto LABEL_135;
}
v34 = SddlpAlloc((v20 + 3) & 0xFFFFFFFC, (UINT8)v22, v21);
pcbLength = (UINT64)v34;
if( !v34 )
{
StringForSid = 8;
goto LABEL_135;
}
v47 = EncodedString;
*v34 = 40;
v34[1] = 34;
v48 = v34 + 2;
memmove(v34 + 2, v47, v16);
v49 = &v48[(unsigned __int64)(unsigned int)v16 >> 1];
*(_DWORD *)v49 = 2883618;
switch( ValueType )
{
case 1:
*((_DWORD *)v49 + 1) = 4784212;
break;
case 2:
*((_DWORD *)v49 + 1) = 5570644;
break;
case 3:
*((_DWORD *)v49 + 1) = 5439572;
break;
case 5:
*((_DWORD *)v49 + 1) = 4456532;
break;
case 6:
*((_DWORD *)v49 + 1) = 4325460;
break;
case 16:
*((_DWORD *)v49 + 1) = 5767252;
break;
default:
LABEL_85:
StringForSid = 1336;
LABEL_86:
v9 = (void *)pcbLength;
goto LABEL_133;
}
v50 = -1i64;
v49[4] = 44;
do
++v50;
while( DstBuf[v50] );
*(_DWORD *)(v49 + 5) = 7864368;
v51 = 2i64 * (unsigned int)v50;
v52 = (char *)(v49 + 7);
memmove(v52, DstBuf, 2 * v50);
v54 = &v52[v51];
v55 = ValueType - 1;
if( !v55 )
{
v85 = &RelativeAttribute->Values;
v86 = ValueCount;
do
{
*(_WORD *)v54 = 44;
v87 = v54 + 2;
i64tow_s(*(_QWORD *)((char *)&RelativeAttribute->Name + v85->pInt64[0]), (wchar_t *)Src, 0x46u, 10);
v88 = -1i64;
do
++v88;
while( Src[v88] );
v89 = 2i64 * (unsigned int)v88;
memmove(v87, Src, 2 * v88);
v54 = &v87[v89];
++v85;
--v86;
}
while( v86 );
goto LABEL_129;
}
v56 = v55 - 1;
if( v56 )
{
v57 = v56 - 1;
if( !v57 )
{
v73 = ValueCount;
v74 = &RelativeAttribute->Values;
do
{
*(_DWORD *)v54 = 2228268;
v75 = -1i64;
v76 = v54 + 4;
v77 = (char *)RelativeAttribute + v74->pInt64[0];
do
++v75;
while( *(_WORD *)&v77[2 * v75] );
v78 = 2i64 * (unsigned int)v75;
memmove(v76, v77, 2 * v75);
v79 = &v76[v78];
++v74;
*(_WORD *)v79 = 34;
v54 = v79 + 2;
--v73;
}
while( v73 );
goto LABEL_129;
}
v58 = v57 - 2;
if( !v58 )
{
v67 = 0;
v68 = &RelativeAttribute->Values;
while( 1 )
{
v69 = RootDomainSida;
*(_WORD *)v54 = 44;
v70 = v54 + 2;
StringForSid = LocalGetStringForSid(
(char *)RelativeAttribute + v68->pInt64[0] + 4,
&String,
v69,
v53,
v92,
(UINT8)DefaultToDomaina);
if( StringForSid )
goto LABEL_86;
v71 = -1i64;
do
++v71;
while( String[v71] );
v72 = 2i64 * (unsigned int)v71;
memmove(v70, String, 2 * v71);
v54 = &v70[v72];
if( String )
{
ExFreePoolWithTag(String, 0);
String = 0i64;
}
++v67;
++v68;
if( v67 >= (unsigned int)ValueCount )
goto LABEL_130;
}
}
v59 = v58 - 1;
if( v59 )
{
if( v59 != 10 )
goto LABEL_85;
v60 = &RelativeAttribute->Values;
v61 = ValueCount;
do
{
*(_WORD *)v54 = 44;
v54 += 2;
v62 = v60->pInt64[0];
v63 = *(unsigned int *)((char *)&RelativeAttribute->Name + v62);
v64 = (unsigned __int8 *)RelativeAttribute + (unsigned int)(v62 + 4);
if( v63 )
{
v65 = v63;
do
{
v66 = *v64++;
*(_WORD *)v54 = a0123456789abcd[(unsigned __int64)v66 >> 4];
*((_WORD *)v54 + 1) = a0123456789abcd[v66 & 0xF];
v54 += 4;
--v65;
}
while( v65 );
}
++v60;
--v61;
}
while( v61 );
LABEL_130:
v90 = v99;
*(_DWORD *)v54 = 41;
*v90 = pcbLength;
goto LABEL_135;
}
}
v80 = &RelativeAttribute->Values;
v81 = ValueCount;
do
{
*(_WORD *)v54 = 44;
v82 = v54 + 2;
ui64tow_s(*(_QWORD *)((char *)&RelativeAttribute->Name + v80->pInt64[0]), (wchar_t *)Src, 0x46u, 10);
v83 = -1i64;
do
++v83;
while( Src[v83] );
v84 = 2i64 * (unsigned int)v83;
memmove(v82, Src, 2 * v83);
v54 = &v82[v84];
++v80;
--v81;
}
while( v81 );
LABEL_129:
StringForSid = 0;
goto LABEL_130;
}
LABEL_135:
if( EncodedString )
ExFreePoolWithTag(EncodedString, 0);
if( String )
ExFreePoolWithTag(String, 0);
return StringForSid;
}Referenced by:
LocalGetAceCondition