AuthzBasepCompareFQBNOperands
INT64 __fastcall AuthzBasepCompareFQBNOperands(UINT8 a1, INT64 a2, _DWORD *a3){
wchar_t **p_Buffer;
__int64 v5;
__int64 v6;
__int64 v7;
int OperandStringCaseForEvaluation;
unsigned int v9;
struct _UNICODE_STRING *p_Expression;
UINT64 *p_Value1;
unsigned int *v12;
_QWORD *v13;
__int64 v14;
struct _UNICODE_STRING *v15;
struct _UNICODE_STRING *p_Name;
UINT8 IsNameInExpression;
UINT8 v18;
UINT64 v19;
UINT64 v20;
BOOL v21;
int v22;
__int16 *v23;
wchar_t **v24;
__int16 v26[2];
INT64 v27;
struct _UNICODE_STRING *v28;
UINT64 Value1;
UINT64 Value2;
struct _UNICODE_STRING Expression;
struct _UNICODE_STRING Name;
INT64 v33[2];
__int128 v34;
_QWORD *v35;
CHAR v38;
LODWORD(v27) = 0;
*(_OWORD *)v33 = 0i64;
v34 = 0i64;
v35 = 0i64;
Value1 = 0i64;
Value2 = 0i64;
v26[0] = 0;
v38 = 0;
*a3 = 0;
p_Buffer = &Expression.Buffer;
v5 = 2i64;
v6 = 2i64;
do
{
*p_Buffer = 0i64;
p_Buffer += 2;
--v6;
}
while( v6 );
OperandStringCaseForEvaluation = AuthzBasepGetOperandStringCaseForEvaluation(a2, &v38);
if( OperandStringCaseForEvaluation >= 0 )
{
v9 = 0;
p_Expression = &Expression;
v28 = &Expression;
p_Value1 = &Value1;
v12 = (unsigned int *)(v7 + 24);
do
{
if( *(v12 - 3) == 1 )
{
if( !*((_BYTE *)v12 - 20) )
{
OperandStringCaseForEvaluation = -1073741406;
goto LABEL_4;
}
OperandStringCaseForEvaluation = AuthzBasepGetConstantOperand(*((CHAR **)v12 + 1), *v12, (INT64)v33, &v27);
if( OperandStringCaseForEvaluation < 0 )
goto LABEL_4;
if( LOWORD(v33[0]) != 3 )
goto LABEL_4;
OperandStringCaseForEvaluation = AuthzBasepUnicodeStringFromOperandValue(
(__int64)v33,
v38 == 0,
&Expression.Length + 8 * v9,
(_BYTE *)v26 + v9);
if( OperandStringCaseForEvaluation < 0 )
goto LABEL_4;
OperandStringCaseForEvaluation = AuthzBasepGetConstantOperand(
(CHAR *)(*((_QWORD *)v12 + 1) + (unsigned int)v27),
*v12 - (unsigned int)v27,
(INT64)v33,
&v27);
if( OperandStringCaseForEvaluation < 0 )
goto LABEL_4;
if( LOWORD(v33[0]) != 2 )
goto LABEL_4;
v13 = v35;
*p_Value1 = *v35;
if( *((_BYTE *)v13 + 8) == 2 )
goto LABEL_4;
p_Expression = v28;
}
else
{
v14 = *(_QWORD *)(*((_QWORD *)v12 - 1) + 48i64);
*p_Value1 = *(_QWORD *)v14;
*p_Expression = *(struct _UNICODE_STRING *)(v14 + 8);
}
++v9;
v12 += 10;
++p_Value1;
v28 = ++p_Expression;
}
while( v9 < 2 );
if( *(_DWORD *)(a2 + 52) == 1 )
{
v15 = &Expression;
p_Name = &Name;
}
else
{
v15 = &Name;
p_Name = &Expression;
}
IsNameInExpression = RtlIsNameInExpression(p_Name, v15, v38 == 0, 0i64);
v18 = IsNameInExpression;
v19 = Value1;
v20 = Value2;
v21 = Value1 == Value2 && IsNameInExpression;
*a3 = v21;
if( a1 == 0x81 )
{
v22 = !v21;
}
else
{
if( a1 == 0x80 )
goto LABEL_32;
if( !v18 )
{
*a3 = 0;
goto LABEL_32;
}
v22 = AuthzBasepCompareUnsigned(a1, v19, v20);
}
*a3 = v22;
}
else
{
LABEL_4:
*a3 = -1;
}
LABEL_32:
v23 = v26;
v24 = &Expression.Buffer;
do
{
if( *(_BYTE *)v23 )
ExFreePoolWithTag(*v24, 0);
v23 = (__int16 *)((char *)v23 + 1);
v24 += 2;
--v5;
}
while( v5 );
return(unsigned int)OperandStringCaseForEvaluation;
}Referenced by:
AuthzBasepEvaluateExpression
AuthzBasepValueInSet