LocalGetStringForRelativeAttribute
UINT64 __stdcall LocalGetStringForRelativeAttribute(
CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 *RelativeAttribute,
UINT64 AttributeSize,
PVOID RootDomainSid,
UINT8 DefaultToDomain,
WCHAR **ConditionStr){
unsigned int v5;
void *v7;
unsigned int StringForSid;
__int64 ValueCount;
int ValueType;
__int64 Name;
UINT8 *v12;
__int64 v13;
__int64 v14;
unsigned int v15;
unsigned int v16;
__int64 v17;
unsigned int v18;
unsigned int v19;
UINT64 pInt64;
__int64 v21;
unsigned int v22;
unsigned __int64 v23;
unsigned int v24;
union _CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1::$F8600A37A74FD5E8A633BFFD12DED29B *v25;
__int64 v26;
unsigned int v27;
__int64 v28;
unsigned int v29;
char *v30;
__int64 v31;
size_t v32;
unsigned int v33;
union _CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1::$F8600A37A74FD5E8A633BFFD12DED29B *p_Values;
__int64 v35;
union _CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1::$F8600A37A74FD5E8A633BFFD12DED29B *v36;
unsigned int v37;
union _CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1::$F8600A37A74FD5E8A633BFFD12DED29B *v38;
__int64 v39;
__int64 v40;
unsigned int v41;
union _CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1::$F8600A37A74FD5E8A633BFFD12DED29B *v42;
__int64 v43;
__int64 v44;
UINT8 *v45;
size_t v46;
size_t v47;
__int64 v48;
UINT64 v49;
UINT8 *v50;
UINT8 v51;
UINT8 *v52;
int v53;
int v54;
int v55;
int v56;
int v57;
union _CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1::$F8600A37A74FD5E8A633BFFD12DED29B *v58;
__int64 v59;
__int64 v60;
unsigned int v61;
unsigned __int8 *v62;
__int64 v63;
unsigned int v64;
unsigned int v65;
union _CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1::$F8600A37A74FD5E8A633BFFD12DED29B *v66;
PVOID v67;
UINT8 *v68;
__int64 v69;
UINT64 v70;
__int64 v71;
union _CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1::$F8600A37A74FD5E8A633BFFD12DED29B *v72;
__int64 v73;
UINT8 *v74;
UINT8 *v75;
UINT64 v76;
UINT8 *v77;
union _CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1::$F8600A37A74FD5E8A633BFFD12DED29B *v78;
__int64 v79;
UINT8 *v80;
__int64 v81;
UINT64 v82;
union _CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1::$F8600A37A74FD5E8A633BFFD12DED29B *v83;
__int64 v84;
UINT8 *v85;
__int64 v86;
UINT64 v87;
size_t *v88;
int v90;
size_t pcbLength;
PVOID P;
__int64 v93;
void *Src;
PVOID RootDomainSida;
size_t *v96;
INT64 result[18];
__int16 DstBuf[40];
__int64 v99;
RootDomainSida = RootDomainSid;
v5 = AttributeSize;
v96 = (size_t *)v99;
Src = 0i64;
v7 = 0i64;
memset((INT64)DstBuf, 0i64);
memset((INT64)result, 0i64);
P = 0i64;
pcbLength = 0i64;
if( !RelativeAttribute || !v5 || !v99 )
{
StringForSid = 87;
LABEL_133:
if( v7 )
ExFreePoolWithTag(v7, 0);
goto LABEL_135;
}
if( v5 < 0x14 )
return 1336;
ValueCount = RelativeAttribute->ValueCount;
ValueType = RelativeAttribute->ValueType;
if( !(_DWORD)ValueCount )
return 1336;
ultow_s(RelativeAttribute->Flags, (wchar_t *)DstBuf, 0x23ui64, 16);
Name = RelativeAttribute->Name;
if( v5 < (unsigned int)Name
|| v5 - (unsigned int)Name < 4
|| (int)RtlStringCbLengthW((const WCHAR *)((char *)RelativeAttribute + Name), v5 - (unsigned int)Name, &pcbLength) < 0
|| !(_DWORD)pcbLength )
{
return 1336;
}
StringForSid = EncodeAttributeName(v12, (unsigned int)pcbLength, (WCHAR **)&Src);
if( !StringForSid )
{
v13 = -1i64;
do
++v13;
while( *((_WORD *)Src + v13) );
v14 = (unsigned int)(2 * v13);
v93 = v14;
if( (unsigned __int64)(2 * ValueCount) > 0xFFFFFFFF )
goto LABEL_131;
v15 = 2 * ValueCount + 24;
if( v15 < 0x18 )
goto LABEL_131;
v16 = v15 + v14;
if( v15 + (unsigned int)v14 < v15 )
goto LABEL_131;
v17 = -1i64;
do
++v17;
while( DstBuf[v17] );
v18 = v16 + 2 * v17;
if( v18 < v16 || (unsigned __int64)(4 * ValueCount) > 0xFFFFFFFF )
goto LABEL_131;
if( v5 - 16 < 4 * (int)ValueCount )
goto LABEL_28;
v90 = ValueType;
if( ValueType != 1 )
{
switch( ValueType )
{
case 2:
goto LABEL_63;
case 3:
v33 = 0;
p_Values = &RelativeAttribute->Values;
while( 1 )
{
v35 = p_Values->pInt64[0];
if( v5 < (unsigned int)v35
|| v5 - (unsigned int)v35 < 2
|| (int)RtlStringCbLengthW(
(const WCHAR *)((char *)RelativeAttribute + v35),
v5 - (unsigned int)v35,
&pcbLength) < 0 )
{
goto LABEL_28;
}
if( v18 + (_DWORD)pcbLength + 4 < v18 )
goto LABEL_131;
++v33;
p_Values = v36 + 1;
v18 += pcbLength + 4;
if( v33 >= (unsigned int)ValueCount )
{
ValueType = v90;
goto LABEL_53;
}
}
case 5:
v24 = 0;
v25 = &RelativeAttribute->Values;
while( 1 )
{
v26 = v25->pInt64[0];
if( v5 < (unsigned int)v26 )
goto LABEL_28;
if( v5 - (unsigned int)v26 < 4 )
goto LABEL_28;
v27 = *(ULONG *)((char *)&RelativeAttribute->Name + v26);
v28 = (unsigned int)(v26 + 4);
if( !v27 )
goto LABEL_28;
v29 = v5 - v28;
if( v5 - (unsigned int)v28 < v27 )
goto LABEL_28;
if( v29 < 8 )
goto LABEL_28;
v30 = (char *)RelativeAttribute + v28;
if( !v30[1] || v29 - 8 < 4 * (unsigned __int64)(unsigned __int8)v30[1] )
goto LABEL_28;
StringForSid = LocalGetStringForSid(v30, (WCHAR **)&P, RootDomainSida, 0);
if( StringForSid )
goto LABEL_135;
v31 = -1i64;
do
++v31;
while( *((_WORD *)P + v31) );
pInt64 = v18 + 2 * (_DWORD)v31;
if( (unsigned int)pInt64 < v18 )
goto LABEL_131;
v18 += 2 * v31;
if( P )
{
ExFreePoolWithTag(P, 0);
P = 0i64;
}
++v24;
++v25;
if( v24 >= (unsigned int)ValueCount )
goto LABEL_52;
}
case 6:
LABEL_63:
v37 = 0;
v38 = &RelativeAttribute->Values;
while( 1 )
{
v39 = v38->pInt64[0];
if( v5 < (unsigned int)v39 || v5 - (unsigned int)v39 < 8 )
break;
ui64tow_s(*(_QWORD *)((char *)&RelativeAttribute->Name + v39), (wchar_t *)result, 0x46ui64, 10);
v40 = -1i64;
do
++v40;
while( *((_WORD *)result + v40) );
if( v18 + 2 * (_DWORD)v40 < v18 )
goto LABEL_131;
++v37;
++v38;
v18 += 2 * v40;
if( v37 >= (unsigned int)ValueCount )
goto LABEL_52;
}
break;
case 16:
v19 = 0;
pInt64 = (UINT64)RelativeAttribute->Values.pInt64;
while( 1 )
{
v21 = *(unsigned int *)pInt64;
if( v5 < (unsigned int)v21 )
break;
if( v5 - (unsigned int)v21 < 4 )
break;
v22 = *(ULONG *)((char *)&RelativeAttribute->Name + v21);
if( v5 - (unsigned int)v21 - 4 < v22 )
break;
v23 = 4i64 * v22;
if( v23 > 0xFFFFFFFF || (unsigned int)v23 + v18 < v18 )
goto LABEL_131;
++v19;
pInt64 += 4i64;
v18 += v23;
if( v19 >= (unsigned int)ValueCount )
goto LABEL_53;
}
break;
}
LABEL_28:
StringForSid = 1336;
goto LABEL_135;
}
v41 = 0;
v42 = &RelativeAttribute->Values;
do
{
v43 = v42->pInt64[0];
if( v5 < (unsigned int)v43 || v5 - (unsigned int)v43 < 8 )
goto LABEL_28;
i64tow_s(*(_QWORD *)((char *)&RelativeAttribute->Name + v43), (wchar_t *)result, 0x46ui64, 10);
v44 = -1i64;
do
++v44;
while( *((_WORD *)result + v44) );
if( v18 + 2 * (_DWORD)v44 < v18 )
goto LABEL_131;
++v41;
++v42;
v18 += 2 * v44;
}
while( v41 < (unsigned int)ValueCount );
LABEL_52:
ValueType = v90;
LODWORD(v14) = v93;
LABEL_53:
if( v18 + 3 < v18 )
{
LABEL_131:
StringForSid = 534;
goto LABEL_135;
}
SddlpAlloc((v18 + 3) & 0xFC, pInt64);
pcbLength = v32;
if( !v32 )
{
StringForSid = 8;
goto LABEL_135;
}
v45 = (UINT8 *)Src;
*(_WORD *)v32 = 40;
*(_WORD *)(v32 + 2) = 34;
v46 = v32 + 4;
memmove((UINT8 *)(v32 + 4), v45, (unsigned int)v14);
v47 = v46 + 2 * ((unsigned __int64)(unsigned int)v14 >> 1);
*(_DWORD *)v47 = 2883618;
switch( ValueType )
{
case 1:
*(_DWORD *)(v47 + 4) = 4784212;
break;
case 2:
*(_DWORD *)(v47 + 4) = 5570644;
break;
case 3:
*(_DWORD *)(v47 + 4) = 5439572;
break;
case 5:
*(_DWORD *)(v47 + 4) = 4456532;
break;
case 6:
*(_DWORD *)(v47 + 4) = 4325460;
break;
case 16:
*(_DWORD *)(v47 + 4) = 5767252;
break;
default:
LABEL_85:
StringForSid = 1336;
LABEL_86:
v7 = (void *)pcbLength;
goto LABEL_133;
}
v48 = -1i64;
*(_WORD *)(v47 + 8) = 44;
do
++v48;
while( DstBuf[v48] );
*(_DWORD *)(v47 + 10) = 7864368;
v49 = 2i64 * (unsigned int)v48;
v50 = (UINT8 *)(v47 + 14);
memmove(v50, (UINT8 *)DstBuf, v49);
v52 = &v50[v49];
v53 = ValueType - 1;
if( !v53 )
{
v83 = &RelativeAttribute->Values;
v84 = ValueCount;
do
{
*(_WORD *)v52 = 44;
v85 = v52 + 2;
i64tow_s(*(_QWORD *)((char *)&RelativeAttribute->Name + v83->pInt64[0]), (wchar_t *)result, 0x46ui64, 10);
v86 = -1i64;
do
++v86;
while( *((_WORD *)result + v86) );
v87 = 2i64 * (unsigned int)v86;
memmove(v85, (UINT8 *)result, v87);
v52 = &v85[v87];
++v83;
--v84;
}
while( v84 );
goto LABEL_129;
}
v54 = v53 - 1;
if( v54 )
{
v55 = v54 - 1;
if( !v55 )
{
v71 = ValueCount;
v72 = &RelativeAttribute->Values;
do
{
*(_DWORD *)v52 = 2228268;
v73 = -1i64;
v74 = v52 + 4;
v75 = (UINT8 *)RelativeAttribute + v72->pInt64[0];
do
++v73;
while( *(_WORD *)&v75[2 * v73] );
v76 = 2i64 * (unsigned int)v73;
memmove(v74, v75, v76);
v77 = &v74[v76];
++v72;
*(_WORD *)v77 = 34;
v52 = v77 + 2;
--v71;
}
while( v71 );
goto LABEL_129;
}
v56 = v55 - 2;
if( !v56 )
{
v65 = 0;
v66 = &RelativeAttribute->Values;
while( 1 )
{
v67 = RootDomainSida;
*(_WORD *)v52 = 44;
v68 = v52 + 2;
StringForSid = LocalGetStringForSid((char *)RelativeAttribute + v66->pInt64[0] + 4, (WCHAR **)&P, v67, v51);
if( StringForSid )
goto LABEL_86;
v69 = -1i64;
do
++v69;
while( *((_WORD *)P + v69) );
v70 = 2i64 * (unsigned int)v69;
memmove(v68, (UINT8 *)P, v70);
v52 = &v68[v70];
if( P )
{
ExFreePoolWithTag(P, 0);
P = 0i64;
}
++v65;
++v66;
if( v65 >= (unsigned int)ValueCount )
goto LABEL_130;
}
}
v57 = v56 - 1;
if( v57 )
{
if( v57 != 10 )
goto LABEL_85;
v58 = &RelativeAttribute->Values;
v59 = ValueCount;
do
{
*(_WORD *)v52 = 44;
v52 += 2;
v60 = v58->pInt64[0];
v61 = *(ULONG *)((char *)&RelativeAttribute->Name + v60);
v62 = (unsigned __int8 *)RelativeAttribute + (unsigned int)(v60 + 4);
if( v61 )
{
v63 = v61;
do
{
v64 = *v62++;
*(_WORD *)v52 = a0123456789abcd[(unsigned __int64)v64 >> 4];
*((_WORD *)v52 + 1) = a0123456789abcd[v64 & 0xF];
v52 += 4;
--v63;
}
while( v63 );
}
++v58;
--v59;
}
while( v59 );
LABEL_130:
v88 = v96;
*(_DWORD *)v52 = 41;
*v88 = pcbLength;
goto LABEL_135;
}
}
v78 = &RelativeAttribute->Values;
v79 = ValueCount;
do
{
*(_WORD *)v52 = 44;
v80 = v52 + 2;
ui64tow_s(*(_QWORD *)((char *)&RelativeAttribute->Name + v78->pInt64[0]), (wchar_t *)result, 0x46ui64, 10);
v81 = -1i64;
do
++v81;
while( *((_WORD *)result + v81) );
v82 = 2i64 * (unsigned int)v81;
memmove(v80, (UINT8 *)result, v82);
v52 = &v80[v82];
++v78;
--v79;
}
while( v79 );
LABEL_129:
StringForSid = 0;
goto LABEL_130;
}
LABEL_135:
if( Src )
ExFreePoolWithTag(Src, 0);
if( P )
ExFreePoolWithTag(P, 0);
return StringForSid;
}Referenced by:
LocalGetAceCondition