SdbpCheckMatchingTextEntry

NTSTATUS __stdcall SdbpCheckMatchingTextEntry(
        VOID *hSDB,
        tagSEARCHDBCONTEXT *pContext,
        const WCHAR *pwszFilePath,
        VOID *pTextToMatch,
        UINT64 dwTextToMatchLengthBytes,
        UINT64 dwFileEncoding,
        UINT64 dwMaxSize,
        INT64 *bEntryMatched,
        INT64 *bBypassCache){
  INT64 *v10; 
  unsigned int v11; 
  NTSTATUS v13; 
  tagSEARCHDBCONTEXT v14; 
  WCHAR *v15; 
  WCHAR **v16; 
  NTSTATUS v17; 
  int *v18; 
  int v19; 
  UINT64 v20; 
  NTSTATUS v21; 
  INT64 v22; 
  INT64 v23; 
  INT64 v24; 
  int v25; 
  unsigned __int64 v26; 
  __int64 v27; 
  INT64 v29; 
  unsigned int v30; 
  unsigned int v31; 
  unsigned int v32; 
  unsigned int v33; 
  size_t v34; 
  WCHAR **v35; 
  char *v36; 
  PSTR v37; 
  int v38; 
  INT8 *v39; 
  UINT64 v40; 
  tagSEARCHPATHPART *pSearchPathPart; 
  WCHAR **szFullPathOut; 
  INT64 a7; 
  WCHAR *FullPath; 
  WCHAR **FileMappingHandleOut; 
  WCHAR *szMatchFile; 

  szMatchFile = (WCHAR *)pwszFilePath;
  v10 = bBypassCache;
  v11 = 0;
  FullPath = 0i64;
  FileMappingHandleOut = 0i64;
  v13 = 0;
  v14 = *pContext;
  v15 = 0i64;
  LODWORD(a7) = 0;
  v16 = 0i64;
  *(_DWORD *)bEntryMatched = 0;
  *(_DWORD *)bBypassCache = 0;
  if( (v14 & 1) == 0 )
  {
    v17 = SdbpInitializeSearchDBContext(pContext);
    v11 = 0;
    if( !v17 )
    {
      AslLogCallPrintf(
        1ui64,
        (INT8 *)"SdbpCheckMatchingTextEntry",
        0x694ui64,
        (INT8 *)"Failed to initialize SEARCHDBCONTEXT");
      goto LABEL_17;
    }
    pwszFilePath = szMatchFile;
  }
  v18 = (int *)*((_QWORD *)pContext + 9);
  v19 = 0;
  if( *v18 <= 0 )
    goto LABEL_15;
  while( 1 )
  {
    v20 = -1i64;
    do
      ++v20;
    while( pwszFilePath[v20] );
    if( !SdbpResolveMatchingFile(hSDB, pContext, (WCHAR *)pwszFilePath, v20, &v18[12 * v19 + 2], &FullPath) )
    {
      AslLogCallPrintf(
        1ui64,
        (INT8 *)"SdbpCheckMatchingTextEntry",
        0x6ACui64,
        (INT8 *)"Failed to resolve matching text file");
      v15 = FullPath;
      goto LABEL_55;
    }
    v15 = FullPath;
    v21 = AslFileMappingCreate(&FileMappingHandleOut, FullPath, 0i64, 0i64, 0i64);
    v16 = FileMappingHandleOut;
    v24 = (unsigned int)v21;
    if( v21 >= 0 )
      v24 = (unsigned int)AslFileMappingEnsureMappedAs(
                            (UINT64)FileMappingHandleOut,
                            0i64,
                            v22,
                            v23,
                            (INT64)pSearchPathPart,
                            (INT64)szFullPathOut,
                            a7,
                            (INT64)FullPath);
    if( !AslFileNotFound(v24) )
      break;
    AslFileMappingDelete((UINT64)v16);
    v11 = 0;
    FileMappingHandleOut = 0i64;
    v16 = 0i64;
    if( v15 )
    {
      ExFreePoolWithTag(v15, 0x74705041u);
      v11 = 0;
    }
    pwszFilePath = szMatchFile;
    ++v19;
    v15 = 0i64;
    FullPath = 0i64;
    if( v19 >= *v18 )
      goto LABEL_15;
  }
  if( v25 < 0 )
  {
    AslLogCallPrintf(1ui64, (INT8 *)"SdbpCheckMatchingTextEntry", 0x6CCui64, (INT8 *)"Failed to map file [%x]");
LABEL_55:
    v13 = 0;
    goto LABEL_17;
  }
  v29 = 1i64;
  if( v19 > 0 )
    *(_DWORD *)bBypassCache = 1;
  if( !v16 )
    goto LABEL_15;
  v30 = v11;
  v31 = dwMaxSize;
  if( (unsigned int)dwMaxSize >= (unsigned __int64)v16[3] )
    v31 = (unsigned int)v16[3];
  FullPath = v16[4];
  if( (unsigned int)dwTextToMatchLengthBytes <= v31 )
  {
    v32 = v11;
    LOBYTE(v32) = (_DWORD)dwFileEncoding == 3;
    v33 = v32 + 1;
    if( !v31 )
    {
LABEL_49:
      v10 = bBypassCache;
      *(_DWORD *)bEntryMatched = a7;
      goto LABEL_16;
    }
    while( 1 )
    {
      if( v30 > (unsigned int)dwTextToMatchLengthBytes )
        v30 += v33 - dwTextToMatchLengthBytes;
      v34 = v31 - v30;
      if( v31 - v30 > 0x1000 )
        v34 = 4096;
      v35 = (WCHAR **)AslAlloc((VOID *)0x1000, v34 + 2, v29);
      FileMappingHandleOut = v35;
      if( !v35 )
        break;
      v36 = (char *)FullPath + v30;
      if( v36 < (char *)FullPath )
      {
        v39 = "Overflow doing pointer addition";
        v40 = 1818i64;
        goto LABEL_53;
      }
      memmove(v35, v36, v34);
      if( !(_DWORD)dwFileEncoding )
        goto LABEL_50;
      if( (unsigned int)dwFileEncoding <= 2 )
      {
        v37 = AslStringSearchA(
                (PSTR)FileMappingHandleOut,
                v34,
                (PSTR)pTextToMatch,
                (unsigned int)dwTextToMatchLengthBytes);
        v38 = a7;
        if( v37 )
          v38 = 1;
        LODWORD(a7) = v38;
      }
      else
      {
        if( (_DWORD)dwFileEncoding != 3 )
        {
LABEL_50:
          v39 = "Unknown file encoding";
          v40 = 1852i64;
          goto LABEL_53;
        }
        if( AslStringSearchW(
               (WCHAR *)FileMappingHandleOut,
               v34 >> 1,
               (WCHAR *)pTextToMatch,
               (unsigned int)dwTextToMatchLengthBytes >> 1) )
        {
          LODWORD(a7) = 1;
        }
      }
      v30 += v34;
      ExFreePoolWithTag(FileMappingHandleOut, 0x74705041u);
      if( v30 >= v31 )
        goto LABEL_49;
    }
    v39 = (INT8 *)"Failed to allocate temp buffer";
    v40 = 1811i64;
LABEL_53:
    AslLogCallPrintf(1ui64, (INT8 *)"SdbpCheckMatchingTextEntry", v40, v39);
    v13 = 0;
    v10 = bBypassCache;
  }
  else
  {
LABEL_15:
    *(_DWORD *)bEntryMatched = v11;
LABEL_16:
    v13 = 1;
  }
LABEL_17:
  v26 = *szMatchFile;
  LOWORD(v26) = v26 - 37;
  if( (unsigned __int16)v26 <= 0x37u )
  {
    v27 = 0x80000000000201i64;
    if( _bittest64(&v27, v26) )
      *(_DWORD *)v10 = 1;
  }
  if( v15 )
    ExFreePoolWithTag(v15, 0x74705041u);
  if( v16 )
    AslFileMappingDelete((UINT64)v16);
  return v13;
}

Referenced by: