EmpParseRuleTerm

NTSTATUS __stdcall EmpParseRuleTerm(
        PVOID ParsedInfHandle,
        PSTR RuleTerm,
        PVOID *Record,
        UINT64 **Mapping,
        UINT64 *MappingCount){
  char *v5; 
  VOID **v8; 
  char *v11; 
  char *v12; 
  int GuidFromName; 
  _DWORD *v14; 
  unsigned int Next; 
  unsigned int Next_high; 
  int v17; 
  unsigned int v18; 
  VOID **PoolWithTag; 
  _SINGLE_LIST_ENTRY *v21; 
  UINT64 ExpectedNumberOfEntries; 
  _GUID NameGuid; 

  v5 = RuleTerm + 1;
  v8 = 0i64;
  NameGuid = 0i64;
  strchr((UINT8 *)RuleTerm + 1, 0x28u);
  v12 = v11;
  if( !v11 )
    return -1073741811;
  *v11 = 0;
  if( *RuleTerm == 63 )
  {
    GuidFromName = EmpInfParseGetGuidFromName(ParsedInfHandle, (PSTR)"CallbackGuidDef", v5, &NameGuid);
    if( GuidFromName < 0 )
      return GuidFromName;
    v21 = EmpSearchCallbackDatabase(&NameGuid);
    if( v21 )
    {
      *Record = v21;
      Next = (unsigned int)v21[7].Next;
      Next_high = HIDWORD(v21[7].Next);
      v17 = (int)v21[8].Next;
      goto LABEL_6;
    }
    return -1073741275;
  }
  GuidFromName = EmpInfParseGetGuidFromName(ParsedInfHandle, (PSTR)"RuleNameGuidDef", v5, &NameGuid);
  if( GuidFromName < 0 )
    return GuidFromName;
  EmpSearchRuleDatabase();
  if( !v14 )
    return -1073741275;
  *Record = v14;
  Next = v14[10];
  Next_high = v14[11];
  v17 = v14[12];
LABEL_6:
  *v12 = 40;
  v18 = v17 + Next + Next_high;
  if( v18 )
  {
    PoolWithTag = ExAllocatePoolWithTag(1ui64, 4i64 * v18, 1953713477i64);
    v8 = PoolWithTag;
    if( !PoolWithTag )
      return -1073741670;
    LODWORD(ExpectedNumberOfEntries) = v17;
    if( !EmpParseRuleTermArgMapping(v12, (UINT64 *)PoolWithTag, Next, Next_high, ExpectedNumberOfEntries) )
    {
      GuidFromName = -1073741811;
      ExFreePoolWithTag(v8, 0x74734D45u);
      return GuidFromName;
    }
  }
  *Mapping = (UINT64 *)v8;
  *(_DWORD *)MappingCount = v18;
  return GuidFromName;
}

Referenced by: