AslPathWildcardFindFirst
__int64 __fastcall AslPathWildcardFindFirst(NTSTRSAFE_PWSTR pszDest, unsigned __int64 a2, const WCHAR *a3, __int64 *a4){
__int64 *v4;
WCHAR *v8;
int Next;
int v10;
const CHAR *v11;
UINT64 v12;
VOID *v13;
INT64 v14;
UINT64 v15;
WCHAR *v16;
NTSTATUS Leaves;
VOID *v18;
INT64 v19;
wchar_t *Buffer;
INT64 v21;
__int64 v22;
__int64 v23;
unsigned __int64 v24;
unsigned __int64 v25;
WCHAR v26;
unsigned __int64 v27;
UINT8 *v28;
UINT8 *PoolWithTag;
UINT8 *v30;
void *v31;
const CHAR *v32;
UINT64 v33;
int matched;
unsigned __int64 v35;
unsigned __int128 v36;
unsigned __int64 v37;
__int64 v38;
unsigned __int64 v39;
unsigned __int64 v40;
unsigned __int64 v41;
unsigned __int64 v42;
UINT8 *v43;
UINT8 *v44;
UINT64 v45;
bool v46;
unsigned __int64 v47;
unsigned __int64 v48;
NTSTRSAFE_PCWSTR pszSrc;
INT64 v50;
UNICODE_STRING SourceString;
struct _UNICODE_STRING DestinationString;
struct _UNICODE_STRING v53;
__int128 v54;
unsigned __int64 pusResult;
__int64 *v57;
v57 = a4;
pusResult = a2;
v4 = a4;
if( !pszDest )
return 3221225711i64;
if( !a3 || !*a3 )
return 3221225713i64;
if( !a4 )
return 3221225714i64;
*pszDest = 0;
v50 = 0i64;
LOWORD(pusResult) = 0;
*a4 = 0i64;
DestinationString = 0i64;
v8 = 0i64;
SourceString = 0i64;
v53 = 0i64;
v54 = 0i64;
if( RtlCreateUnicodeString(&DestinationString, (PWCHAR)a3) )
{
v10 = AslPathCleanUstr(&DestinationString.Length);
Next = v10;
if( v10 < 0 )
{
v11 = "AslPathCleanUstr failed [%x]";
v12 = 2225i64;
LABEL_11:
AslLogCallPrintf(1ui64, "AslPathWildcardFindFirst", v12, v11, v10);
goto LABEL_81;
}
v10 = RtlUShortAdd(DestinationString.Length, 4u, (UINT16 *)&pusResult);
Next = v10;
if( v10 < 0 )
{
v11 = "RtlUShortAdd failed [%x]";
v12 = 2231i64;
goto LABEL_11;
}
v15 = (unsigned __int16)pusResult;
v16 = (WCHAR *)AslAlloc(v13, (unsigned __int16)pusResult, v14);
v8 = v16;
if( !v16 )
{
Next = -1073741801;
goto LABEL_81;
}
v10 = RtlStringCbCopyNW(v16, v15, DestinationString.Buffer, DestinationString.Length);
Next = v10;
if( v10 < 0 )
{
v11 = "RtlStringCbCopyNW failed [%x]";
v12 = 2243i64;
goto LABEL_11;
}
Leaves = AslpPathWildcardMakeLeaves(v8);
if( !Leaves )
{
Next = -1073741767;
AslLogCallPrintf(1ui64, "AslPathWildcardFindFirst", 0x8D5ui64, "Failed to split the wildcard path");
goto LABEL_81;
}
if( Leaves == 1 )
{
Buffer = DestinationString.Buffer;
*v4 = -1i64;
if( !AslDoesFileExistNtPath(Buffer) )
{
Next = -2147483642;
goto LABEL_81;
}
v10 = RtlStringCchCopyW(pszDest, 0x104ui64, (PWCHAR)a3);
Next = v10;
if( v10 >= 0 )
{
Next = 0;
goto LABEL_81;
}
v11 = "RtlStringCbCopyNW failed [%x]";
v12 = 2279i64;
goto LABEL_11;
}
v50 = (INT64)AslAlloc(v18, 0x40ui64, v19);
v21 = v50;
if( !v50 )
{
Next = -1073741801;
LABEL_80:
v4 = v57;
goto LABEL_81;
}
*(_DWORD *)v50 = wcsncmp(a3, L"\\??\\", 4ui64) != 0;
*(_QWORD *)(v21 + 8) = v8;
v8 = 0i64;
*(_OWORD *)(v21 + 16) = 0i64;
*(_OWORD *)(v21 + 32) = 0i64;
*(_OWORD *)(v21 + 48) = 0i64;
*(_QWORD *)(v21 + 16) = 0i64;
*(_QWORD *)(v21 + 48) = 16i64;
*(_QWORD *)(v21 + 32) = 0i64;
*(_QWORD *)(v21 + 40) = 0i64;
*(_QWORD *)(v21 + 56) = 0i64;
*(_QWORD *)(v21 + 24) = 32i64;
v22 = *(_QWORD *)(v21 + 48);
v23 = v22 - 1;
v24 = v22 + 7;
if( v24 < 8 )
{
Next = -2147483637;
goto LABEL_45;
}
v25 = *(_QWORD *)(v21 + 24);
v26 = 0;
pusResult = 0i64;
v27 = v24 & ~v23;
if( !is_mul_ok(0i64, v25) || (pusResult = 0i64, !is_mul_ok(v27, v25)) )
{
Next = -2147483637;
goto LABEL_42;
}
v28 = *(UINT8 **)(v21 + 56);
PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(PagedPool, v27 * v25, 0x72615452ui64);
v30 = PoolWithTag;
if( v28 )
{
if( PoolWithTag )
memset((INT64)PoolWithTag, 0i64);
if( !v30 )
goto LABEL_41;
memmove(v30, v28, 0i64);
ExFreePoolWithTag(v28, 0x72615452u);
}
else if( PoolWithTag )
{
memset((INT64)PoolWithTag, 0i64);
}
if( v30 )
{
*(_QWORD *)(v21 + 40) = v27;
*(_QWORD *)(v21 + 56) = v30;
Next = 0;
goto LABEL_42;
}
LABEL_41:
Next = -2147024882;
LABEL_42:
if( !Next )
{
Next = 0;
goto LABEL_48;
}
LABEL_45:
v31 = *(void **)(v21 + 56);
if( v31 )
ExFreePoolWithTag(v31, 0x72615452u);
*(_OWORD *)(v21 + 16) = 0i64;
*(_OWORD *)(v21 + 32) = 0i64;
*(_OWORD *)(v21 + 48) = 0i64;
AslLogCallPrintf(1ui64, "AslpPathWildcardInitStack", 0x844ui64, "RtlArrayInitialize failed [%x]", Next);
LABEL_48:
if( Next < 0 )
{
v32 = "AslpPathWildcardInitStack failed [%x]";
v33 = 2317i64;
LABEL_50:
LODWORD(pszSrc) = Next;
AslLogCallPrintf(1ui64, "AslPathWildcardFindFirst", v33, v32, pszSrc);
goto LABEL_80;
}
RtlInitUnicodeString(&SourceString, *(PCWSTR *)(v21 + 8), v26);
matched = AslpPathWildcardAllocMatchNode(&v53, &SourceString, *(_WORD **)(v21 + 8), 1, 0i64, 0);
Next = matched;
if( matched < 0 )
{
LODWORD(pszSrc) = matched;
AslLogCallPrintf(
1ui64,
"AslPathWildcardFindFirst",
0x91Aui64,
"AslpPathWildcardAllocMatchNode failed to create root of path [%x]",
pszSrc);
goto LABEL_80;
}
v35 = *(_QWORD *)(v21 + 32);
*((_QWORD *)&v36 + 1) = *(_QWORD *)(v21 + 40);
if( v35 < *((_QWORD *)&v36 + 1) )
goto LABEL_72;
v37 = v35 + 1;
if( v35 + 1 <= *((_QWORD *)&v36 + 1) )
{
Next = -2147024809;
LABEL_76:
v46 = Next < 0;
goto LABEL_77;
}
v38 = *(_QWORD *)(v21 + 48) - 1i64;
*(_QWORD *)&v36 = v38 + v37;
if( v38 + v37 < v37 )
{
LABEL_75:
Next = -2147483637;
goto LABEL_76;
}
v39 = *(_QWORD *)(v21 + 24);
v40 = v36 & ~v38;
v41 = *(_QWORD *)(v21 + 40);
v36 = *((unsigned __int64 *)&v36 + 1) * (unsigned __int128)v39;
pusResult = v36;
if( !is_mul_ok(v41, v39) || (v36 = v40 * (unsigned __int128)v39, v42 = v40 * v39, !is_mul_ok(v40, v39)) )
{
Next = -2147483637;
goto LABEL_71;
}
v43 = *(UINT8 **)(v21 + 56);
*(_QWORD *)&v36 = ExAllocatePoolWithTag(PagedPool, v36, 0x72615452ui64);
v44 = (UINT8 *)v36;
if( v43 )
{
if( !(_QWORD)v36 )
goto LABEL_70;
memset(v36, 0i64);
if( !v44 )
goto LABEL_70;
v45 = pusResult;
if( pusResult >= v42 )
v45 = v42;
memmove(v44, v43, v45);
ExFreePoolWithTag(v43, 0x72615452u);
}
else if( (_QWORD)v36 )
{
memset(v36, 0i64);
}
if( v44 )
{
*(_QWORD *)(v21 + 56) = v44;
Next = 0;
*(_QWORD *)(v21 + 40) = v40;
goto LABEL_71;
}
LABEL_70:
Next = -2147024882;
LABEL_71:
v46 = Next < 0;
if( Next )
{
LABEL_77:
if( !v46 )
{
v53 = 0i64;
*v57 = v21;
v54 = 0i64;
Next = AslPathWildcardFindNext(pszDest, *((INT64 *)&v36 + 1), (UINT64 *)v21);
goto LABEL_80;
}
v32 = "AslpPathWildcardPushNode failed [%x]";
v33 = 2336i64;
goto LABEL_50;
}
LABEL_72:
v36 = *(unsigned __int64 *)(v21 + 24) * (unsigned __int128)v35;
if( is_mul_ok(*(_QWORD *)(v21 + 24), v35) )
{
v47 = *(_QWORD *)(v21 + 56);
v48 = v47 + *(_QWORD *)(v21 + 24) * v35;
if( v48 >= v47 )
{
Next = 0;
*(struct _UNICODE_STRING *)v48 = v53;
*(_OWORD *)(v48 + 16) = v54;
++*(_QWORD *)(v21 + 32);
goto LABEL_76;
}
}
goto LABEL_75;
}
Next = -1073741801;
AslLogCallPrintf(1ui64, "AslPathWildcardFindFirst", 0x89Cui64, "RtlCreateUnicodeString failed");
LABEL_81:
RtlFreeAnsiString(&DestinationString);
if( v8 )
ExFreePoolWithTag(v8, 0x74705041u);
if( Next < 0 )
{
AslpPathWildcardFreeFindContext(&v50);
AslpPathWildcardFreeMatchNode(&v53);
*v4 = 0i64;
}
return(unsigned int)Next;
}Referenced by:
SdbpCheckMatchingWildcardFiles