LocalGetConditionForString
UINT64 __stdcall LocalGetConditionForString(WCHAR *String, WCHAR **End, UINT8 **Condition, UINT64 *ConditionSize){
UINT64 *v4;
UINT8 **v5;
WCHAR *v6;
int v7;
unsigned int OperandValue;
unsigned int v9;
int v10;
__int64 v11;
unsigned int v12;
unsigned int v13;
__int64 v14;
int v15;
unsigned __int64 v16;
UINT8 *v17;
CHAR *v18;
signed __int64 v19;
INT64 v20;
int v21;
__int64 v22;
UINT8 ConditionToken;
UINT64 Digit;
UINT8 v25;
__int64 v26;
__int64 v27;
UINT8 v28;
UINT8 v29;
NTSTATUS v30;
char v31;
NTSTATUS v32;
char v33;
char v34;
NTSTATUS v35;
char v36;
char v37;
__int64 v38;
int v39;
__int64 v40;
UINT8 v41;
NTSTATUS v42;
__int64 v43;
__int64 v44;
NTSTATUS OperatorIndexByToken;
__int64 v46;
int v47;
char v48;
char v49;
PVOID v50;
__int64 v51;
UINT8 v52;
UINT64 Size;
UINT64 Sizea;
UINT8 Data;
UINT8 v57;
char v58;
UINT8 **Conditiona;
char v60;
UINT64 *ConditionSizea;
UINT64 ConditionPos;
UINT64 MoveBy;
PVOID P;
UINT8 Token[8];
UINT8 v66[256];
ConditionSizea = ConditionSize;
Conditiona = Condition;
v4 = ConditionSize;
*(_QWORD *)Token = End;
v5 = Condition;
v57 = 0;
v6 = String;
LODWORD(MoveBy) = 0;
v7 = 0;
P = 0i64;
OperandValue = 0;
v60 = 0;
v9 = 0;
v58 = 0;
v10 = 0;
if( !String || !End || !Condition || !ConditionSize )
return 87i64;
*Condition = 0i64;
v11 = -1i64;
*(_DWORD *)ConditionSize = 0;
do
++v11;
while( String[v11] );
if( (unsigned int)v11 < 3 || *String != 40 )
{
OperandValue = 1336;
goto LABEL_129;
}
v12 = v11 + 1;
v13 = -1;
if( v12 )
v13 = v12;
*(_DWORD *)ConditionSize = v13;
if( !v12 )
goto LABEL_13;
v14 = v13;
v15 = -1;
v16 = 2 * v14;
if( v16 <= 0xFFFFFFFF )
v15 = v16;
*(_DWORD *)ConditionSize = v15;
if( v16 > 0xFFFFFFFF )
{
LABEL_13:
OperandValue = 534;
goto LABEL_125;
}
SddlpAlloc(v15, 0xFFFFFFFFui64);
*v5 = v17;
if( !v17 )
{
OperandValue = 8;
goto LABEL_125;
}
*(_DWORD *)v17 = 2020897377;
LODWORD(ConditionPos) = 4;
while( 1 )
{
if( !*v6 )
goto LABEL_111;
iswspace(*v6, v18, v19, v20);
if( v21 )
{
v22 = 2i64;
goto LABEL_109;
}
if( v7 == 255 )
{
OperandValue = 1001;
goto LABEL_125;
}
ConditionToken = GetConditionToken(v6, &MoveBy);
Digit = 0i64;
v25 = ConditionToken;
if( !ConditionToken )
{
if( (v9 & 0xFFFFFFFC) != 0 || v9 == 2 || v10 == 3 )
goto LABEL_117;
if( !v10 )
{
v10 = 5;
if( !v7 )
goto LABEL_95;
v44 = v7 - 1;
if( v7 - 1 < 0 )
goto LABEL_95;
while( 1 )
{
v57 = v66[v44];
OperatorIndexByToken = GetOperatorIndexByToken(v57);
if( OperatorIndexByToken != -1 )
break;
--v47;
v44 = v46 - 1;
if( v44 < 0 )
goto LABEL_94;
}
v48 = *((_BYTE *)&Operators + 24 * OperatorIndexByToken + 8);
if( (unsigned __int8)(v48 + 119) > 3u
&& (unsigned __int8)(v48 + 112) > 3u
&& BYTE1((&Operators)[3 * OperatorIndexByToken + 1]) != (_BYTE)Digit )
{
v10 = 4;
}
if( v48 == -121 || v48 == -115 )
v58 = 1;
LABEL_94:
if( v47 < 0 )
LABEL_95:
v10 = 4;
}
v9 = v10;
OperandValue = GetOperandValue(v6, v10 == 4, Digit, (INT64 *)&P, &MoveBy, Digit, Digit, Digit, Digit);
if( OperandValue )
goto LABEL_124;
if( v58 )
{
v58 = 0;
v49 = *((_BYTE *)P + 1);
if( ((v49 + 7) & 0xFC) == 0 && v49 != -6 )
{
LABEL_117:
OperandValue = 1336;
goto LABEL_124;
}
}
v5 = Conditiona;
LODWORD(Sizea) = 1;
OperandValue = AppendCondition(Conditiona, v4, &ConditionPos, (UINT8 *)P + 1, Sizea);
if( OperandValue )
goto LABEL_125;
if( !IsValueSizeFixed(*((_BYTE *)P + 1)) )
{
LODWORD(Size) = 4;
OperandValue = AppendCondition(v5, v4, &ConditionPos, (UINT8 *)v50 + 4, Size);
if( OperandValue )
goto LABEL_125;
v50 = P;
}
if( *((_DWORD *)v50 + 1) )
{
LODWORD(Size) = *((_DWORD *)v50 + 1);
OperandValue = AppendCondition(v5, v4, &ConditionPos, *((UINT8 **)v50 + 1), Size);
if( OperandValue )
goto LABEL_125;
v50 = P;
}
FreeOperandValue(v50);
P = 0i64;
v10 = 3;
goto LABEL_108;
}
if( ConditionToken == 0xFE )
{
if( (v9 & 0xFFFFFFFC) != 0 || v9 == 2 )
goto LABEL_117;
v26 = v7;
v9 = 1;
++v7;
v66[v26] = v25;
goto LABEL_77;
}
v27 = v7;
if( ConditionToken == 0xFF )
{
if( !v7 || v9 == 3 || v9 == 1 )
goto LABEL_118;
v28 = v66[v7 - 1];
v60 = v28 == 0xFE;
while( 1 )
{
v29 = Token[v27-- + 7];
--v7;
v57 = v29;
Data = v29;
if( v29 == 0xFE )
break;
LODWORD(Size) = 1;
OperandValue = AppendCondition(Conditiona, ConditionSizea, &ConditionPos, &Data, Size);
if( OperandValue )
goto LABEL_119;
if( !v27 )
{
v57 = Data;
if( Data != 0xFE )
goto LABEL_118;
break;
}
}
if( !v7 )
{
v6 += (unsigned int)MoveBy;
LABEL_111:
v4 = ConditionSizea;
v51 = v7;
if( v7 )
{
v5 = Conditiona;
while( 1 )
{
v52 = Token[v51-- + 7];
Data = v52;
if( v52 == 0xFE )
break;
LODWORD(Size) = 1;
OperandValue = AppendCondition(v5, v4, &ConditionPos, &Data, Size);
if( OperandValue )
goto LABEL_125;
if( !v51 )
goto LABEL_123;
}
OperandValue = 1336;
}
LABEL_123:
*(_DWORD *)v4 = ConditionPos;
**(_QWORD **)Token = v6;
goto LABEL_124;
}
v30 = GetOperatorIndexByToken(v66[v7 - 1]);
if( v30 != -1
&& v28 != 0xFE
&& *((_BYTE *)&Operators + 24 * v30 + 19) != v31
&& *((_BYTE *)&Operators + 24 * v30 + 8) != 0xA2 )
{
goto LABEL_118;
}
v9 = 2;
goto LABEL_76;
}
v32 = GetOperatorIndexByToken(ConditionToken);
v19 = 3i64 * v32;
v20 = *((unsigned int *)&Operators + 6 * v32 + 3);
HIDWORD(ConditionPos) = *((_DWORD *)&Operators + 6 * v32 + 3);
if( *((_BYTE *)&Operators + 24 * v32 + 18) != v33 && v9 != 4 && (v9 != 2 || v60 == v33) )
goto LABEL_118;
v34 = (char)(&Operators)[3 * v32 + 1];
if( v34 )
{
if( v9 > 1 )
{
if( v9 != 3 )
goto LABEL_118;
v35 = GetOperatorIndexByToken(Token[v7 + 7]);
if( *((_BYTE *)&Operators + 24 * v35 + 19) != v36 )
goto LABEL_118;
}
}
v37 = *((_BYTE *)&Operators + 8 * v19 + 19);
if( !v37 && (v9 & 0xFFFFFFFC) == 0 && v9 != 2 )
goto LABEL_118;
if( (unsigned int)(v10 - 4) <= 1 )
goto LABEL_118;
if( v7 && v37 )
break;
LABEL_64:
if( v34 || !v37 )
v10 = 0;
else
v10 = 5;
if( v7 )
{
while( 1 )
{
v41 = Token[v27 + 7];
if( v41 == 0xFE )
break;
v57 = Token[v27 + 7];
Data = v41;
v42 = GetOperatorIndexByToken(v41);
if( (int)v20 > *((_DWORD *)&Operators + 6 * v42 + 3) )
break;
--v7;
LODWORD(Size) = 1;
--v27;
OperandValue = AppendCondition(Conditiona, ConditionSizea, &ConditionPos, &Data, Size);
if( OperandValue )
goto LABEL_119;
v57 = Data;
if( !v27 )
goto LABEL_75;
v20 = HIDWORD(ConditionPos);
}
v43 = v7++;
v66[v43] = v25;
}
LABEL_75:
v9 = 3;
LABEL_76:
v4 = ConditionSizea;
LABEL_77:
v5 = Conditiona;
LABEL_108:
v22 = 2i64 * (unsigned int)MoveBy;
LABEL_109:
v6 = (WCHAR *)((char *)v6 + v22);
}
v19 = v7 - 1;
if( v7 - 1 < 0 )
goto LABEL_63;
while( GetOperatorIndexByToken(v66[v19]) == -1 )
{
v19 = v38 - 1;
if( v19 < 0 )
goto LABEL_63;
}
v40 = 3i64 * GetOperatorIndexByToken(v66[v39]);
if( !*((_BYTE *)&Operators + 8 * v40 + 19) || *((_BYTE *)&Operators + 8 * v40 + 8) == 0xA2 )
{
LABEL_63:
v20 = HIDWORD(ConditionPos);
goto LABEL_64;
}
LABEL_118:
OperandValue = 1336;
LABEL_119:
v4 = ConditionSizea;
LABEL_124:
v5 = Conditiona;
LABEL_125:
if( P )
FreeOperandValue(P);
if( *(_DWORD *)v4 == 4 || OperandValue )
{
LABEL_129:
if( *v5 )
{
ExFreePoolWithTag(*v5, 0);
*v5 = 0i64;
*(_DWORD *)v4 = 0;
}
}
return OperandValue;
}Referenced by:
LocalGetAclForString