AuthzBasepCompareFQBNOperands

INT64 __fastcall AuthzBasepCompareFQBNOperands(UINT8 a1, INT64 a2, _DWORD *a3){
  wchar_t **p_Buffer; 
  __int64 v5; 
  __int64 v6; 
  __int64 v7; 
  int OperandStringCaseForEvaluation; 
  unsigned int v9; 
  struct _UNICODE_STRING *p_Expression; 
  UINT64 *p_Value1; 
  unsigned int *v12; 
  _QWORD *v13; 
  __int64 v14; 
  struct _UNICODE_STRING *v15; 
  struct _UNICODE_STRING *p_Name; 
  UINT8 IsNameInExpression; 
  UINT8 v18; 
  UINT64 v19; 
  UINT64 v20; 
  BOOL v21; 
  int v22; 
  __int16 *v23; 
  wchar_t **v24; 
  __int16 v26[2]; 
  INT64 v27; 
  struct _UNICODE_STRING *v28; 
  UINT64 Value1; 
  UINT64 Value2; 
  struct _UNICODE_STRING Expression; 
  struct _UNICODE_STRING Name; 
  INT64 v33[2]; 
  __int128 v34; 
  _QWORD *v35; 
  CHAR v38; 
  LODWORD(v27) = 0;
  *(_OWORD *)v33 = 0i64;
  v34 = 0i64;
  v35 = 0i64;
  Value1 = 0i64;
  Value2 = 0i64;
  v26[0] = 0;
  v38 = 0;
  *a3 = 0;
  p_Buffer = &Expression.Buffer;
  v5 = 2i64;
  v6 = 2i64;
  do
  {
    *p_Buffer = 0i64;
    p_Buffer += 2;
    --v6;
  }
  while( v6 );
  OperandStringCaseForEvaluation = AuthzBasepGetOperandStringCaseForEvaluation(a2, &v38);
  if( OperandStringCaseForEvaluation >= 0 )
  {
    v9 = 0;
    p_Expression = &Expression;
    v28 = &Expression;
    p_Value1 = &Value1;
    v12 = (unsigned int *)(v7 + 24);
    do
    {
      if( *(v12 - 3) == 1 )
      {
        if( !*((_BYTE *)v12 - 20) )
        {
          OperandStringCaseForEvaluation = -1073741406;
          goto LABEL_4;
        }
        OperandStringCaseForEvaluation = AuthzBasepGetConstantOperand(*((CHAR **)v12 + 1), *v12, (INT64)v33, &v27);
        if( OperandStringCaseForEvaluation < 0 )
          goto LABEL_4;
        if( LOWORD(v33[0]) != 3 )
          goto LABEL_4;
        OperandStringCaseForEvaluation = AuthzBasepUnicodeStringFromOperandValue(
                                           (__int64)v33,
                                           v38 == 0,
                                           &Expression.Length + 8 * v9,
                                           (_BYTE *)v26 + v9);
        if( OperandStringCaseForEvaluation < 0 )
          goto LABEL_4;
        OperandStringCaseForEvaluation = AuthzBasepGetConstantOperand(
                                           (CHAR *)(*((_QWORD *)v12 + 1) + (unsigned int)v27),
                                           *v12 - (unsigned int)v27,
                                           (INT64)v33,
                                           &v27);
        if( OperandStringCaseForEvaluation < 0 )
          goto LABEL_4;
        if( LOWORD(v33[0]) != 2 )
          goto LABEL_4;
        v13 = v35;
        *p_Value1 = *v35;
        if( *((_BYTE *)v13 + 8) == 2 )
          goto LABEL_4;
        p_Expression = v28;
      }
      else
      {
        v14 = *(_QWORD *)(*((_QWORD *)v12 - 1) + 48i64);
        *p_Value1 = *(_QWORD *)v14;
        *p_Expression = *(struct _UNICODE_STRING *)(v14 + 8);
      }
      ++v9;
      v12 += 10;
      ++p_Value1;
      v28 = ++p_Expression;
    }
    while( v9 < 2 );
    if( *(_DWORD *)(a2 + 52) == 1 )
    {
      v15 = &Expression;
      p_Name = &Name;
    }
    else
    {
      v15 = &Name;
      p_Name = &Expression;
    }
    IsNameInExpression = RtlIsNameInExpression(p_Name, v15, v38 == 0, 0i64);
    v18 = IsNameInExpression;
    v19 = Value1;
    v20 = Value2;
    v21 = Value1 == Value2 && IsNameInExpression;
    *a3 = v21;
    if( a1 == 0x81 )
    {
      v22 = !v21;
    }
    else
    {
      if( a1 == 0x80 )
        goto LABEL_32;
      if( !v18 )
      {
        *a3 = 0;
        goto LABEL_32;
      }
      v22 = AuthzBasepCompareUnsigned(a1, v19, v20);
    }
    *a3 = v22;
  }
  else
  {
LABEL_4:
    *a3 = -1;
  }
LABEL_32:
  v23 = v26;
  v24 = &Expression.Buffer;
  do
  {
    if( *(_BYTE *)v23 )
      ExFreePoolWithTag(*v24, 0);
    v23 = (__int16 *)((char *)v23 + 1);
    v24 += 2;
    --v5;
  }
  while( v5 );
  return(unsigned int)OperandStringCaseForEvaluation;
}

Referenced by:

AuthzBasepEvaluateExpression
AuthzBasepValueInSet