LocalpGetStringForCondition

__int64 __fastcall LocalpGetStringForCondition(
        __int64 a1,
        int a2,
        void *a3,
        __int64 a4,
        __int64 a5,
        __int64 a6,
        __int64 a7,
        char a8){
  unsigned int v9; 
  _DWORD *v10; 
  unsigned int PrintableAttributeName; 
  int v12; 
  __int64 v13; 
  __int64 v14; 
  UINT8 *v15; 
  UINT8 v16; 
  bool v17; 
  NTSTATUS OperatorIndexByToken; 
  unsigned int v19; 
  __int64 v20; 
  __int64 v21; 
  __int64 v22; 
  __int64 v23; 
  unsigned int v24; 
  WCHAR *v25; 
  WCHAR *v26; 
  UINT64 v27; 
  unsigned __int64 v28; 
  WCHAR *v29; 
  WCHAR *v30; 
  int v31; 
  __int64 v32; 
  PVOID *v33; 
  int v34; 
  _QWORD *v35; 
  WCHAR **v36; 
  bool v38; 
  WCHAR *v39; 
  UINT64 v40; 
  unsigned __int64 v41; 
  WCHAR *v42; 
  WCHAR *v43; 
  char v44; 
  int v45; 
  __int64 v46; 
  PVOID v47; 
  UINT64 pulResult; 
  UINT64 MoveBy; 
  int v50; 
  __int64 v51; 
  _DWORD *v52; 
  __int64 v53; 
  __int64 v54; 
  __int64 v55; 
  PVOID v56[2]; 
  __int64 result[256]; 
  v55 = a5;
  v9 = a2;
  v10 = (_DWORD *)a1;
  v54 = a6;
  v53 = a7;
  v56[0] = a3;
  PrintableAttributeName = 0;
  v50 = a2;
  v52 = (_DWORD *)a1;
  pulResult = 0i64;
  memset((INT64)result, 0i64);
  LODWORD(MoveBy) = 0;
  v12 = 0;
  if( !v10 || !a3 || !v9 )
    return 87i64;
  if( v9 < 6 || *v10 != 2020897377 )
    return 805i64;
  LODWORD(v13) = 4;
  v14 = 0i64;
  HIDWORD(MoveBy) = 4;
  while( 1 )
  {
    if( v14 == 255 )
    {
      PrintableAttributeName = 1001;
      goto LABEL_79;
    }
    v15 = (UINT8 *)v10 + (unsigned int)v13;
    v16 = *v15;
    if( *v15 > 0x51u )
    {
      if( v16 < 0x80u )
        goto LABEL_54;
      if( v16 > 0x93u )
      {
        if( v16 <= 0x9Fu )
          goto LABEL_54;
        if( v16 > 0xA3u )
        {
          if( v16 <= 0xF7u || v16 > 0xFCu )
            goto LABEL_54;
          PrintableAttributeName = GetPrintableAttributeName(
                                     v15,
                                     v9 - (unsigned int)v13,
                                     v16,
                                     (WCHAR **)&pulResult,
                                     &MoveBy);
          if( PrintableAttributeName )
            goto LABEL_51;
          result[v14] = pulResult;
          goto LABEL_39;
        }
      }
      if( (unsigned __int8)(v16 + 96) <= 1u )
      {
        if( v14 < 2 )
          goto LABEL_54;
        PrintableAttributeName = EncloseSubCondition((WCHAR **)&result[v12 - 1]);
        if( PrintableAttributeName )
          goto LABEL_79;
        PrintableAttributeName = EncloseSubCondition((WCHAR **)&result[v12 - 2]);
        v38 = PrintableAttributeName == 0;
      }
      else
      {
        if( v16 != 0xA2 )
        {
LABEL_18:
          OperatorIndexByToken = GetOperatorIndexByToken(*v15);
          if( OperatorIndexByToken < 0 )
            goto LABEL_88;
          v21 = 3i64 * OperatorIndexByToken;
          v22 = -1i64;
          v23 = *(_QWORD *)(v20 + 8 * v21);
          v51 = v21;
          do
            ++v22;
          while( *(_WORD *)(v23 + 2 * v22) );
          v24 = 2 * v22;
          LODWORD(pulResult) = v24;
          if( *(_BYTE *)(v20 + 8 * v21 + 16) )
          {
            if( !v14 )
            {
LABEL_88:
              PrintableAttributeName = v19;
              goto LABEL_79;
            }
            v39 = (WCHAR *)v56[v14 + 1];
            if( ULongAddStringSize(v24, v39, &pulResult) < 0 )
              goto LABEL_87;
            v41 = (unsigned int)(pulResult + 8);
            SddlpAlloc(pulResult + 8, v40);
            v30 = v42;
            if( !v42 )
            {
LABEL_78:
              PrintableAttributeName = 8;
              goto LABEL_79;
            }
            if( v16 == 0xA2 )
            {
              v43 = L"(%ls%ls)";
            }
            else
            {
              v44 = *((_BYTE *)&Operators + 8 * v51 + 8);
              if( (v44 == -121 || v44 == -115)
                && (!wcsnicmp(v39, L"@USER.", 6ui64)
                 || !wcsnicmp(v39, L"@DEVICE.", 8ui64)
                 || !wcsnicmp(v39, (const wchar_t *)L"@TOKEN.", 7ui64)) )
              {
                PrintableAttributeName = 1336;
                goto LABEL_91;
              }
              v43 = (WCHAR *)L"(%ls %ls)";
            }
            RtlStringCchPrintfW(v30, v41 >> 1, v43);
            v34 = 0;
            if( v45 < 0 )
              goto LABEL_90;
            if( v39 )
            {
              ExFreePoolWithTag(v39, 0);
              v34 = 0;
            }
            v32 = 0i64;
            v33 = &v56[v14 + 1];
          }
          else
          {
            if( v14 < 2 )
              goto LABEL_88;
            v25 = (WCHAR *)v56[v14 + 1];
            if( ULongAddStringSize(v24, v25, &pulResult) < 0
              || (v26 = (WCHAR *)v56[v14], ULongAddStringSize((unsigned int)pulResult, v26, &pulResult) < 0) )
            {
LABEL_87:
              PrintableAttributeName = 534;
              goto LABEL_79;
            }
            v28 = (unsigned int)(pulResult + 10);
            SddlpAlloc(pulResult + 10, v27);
            v30 = v29;
            if( !v29 )
              goto LABEL_78;
            RtlStringCchPrintfW(v29, v28 >> 1, (WCHAR *)L"(%ls %ls %ls)");
            if( v31 < 0 )
            {
LABEL_90:
              PrintableAttributeName = 50;
LABEL_91:
              if( v30 )
                ExFreePoolWithTag(v30, 0);
              goto LABEL_79;
            }
            if( v25 )
              ExFreePoolWithTag(v25, 0);
            if( v26 )
              ExFreePoolWithTag(v26, 0);
            v32 = -1i64;
            v33 = &v56[v14];
            v34 = -1;
          }
          LODWORD(v13) = HIDWORD(MoveBy);
          v12 += v34;
          v9 = v50;
          v14 += v32;
          *v33 = v30;
          LODWORD(MoveBy) = 1;
          goto LABEL_40;
        }
        if( v14 < 1 )
          goto LABEL_54;
        PrintableAttributeName = EncloseSubCondition((WCHAR **)&result[v12 - 1]);
        v38 = PrintableAttributeName == 0;
      }
      if( !v38 )
        goto LABEL_79;
      goto LABEL_18;
    }
    if( v16 >= 0x50u )
      goto LABEL_44;
    if( v16 )
    {
      if( v16 != 16 && v16 > 4u && v16 != 24 )
        goto LABEL_54;
LABEL_44:
      PrintableAttributeName = GetPrintableOperandValue(
                                 (char *)v15,
                                 v9 - (unsigned int)v13,
                                 (__int64)&pulResult,
                                 (unsigned int *)&MoveBy,
                                 v55,
                                 v54,
                                 v53,
                                 a8);
      if( PrintableAttributeName )
      {
LABEL_51:
        v30 = (WCHAR *)pulResult;
        goto LABEL_91;
      }
      result[v14] = pulResult;
LABEL_39:
      ++v12;
      ++v14;
LABEL_40:
      pulResult = 0i64;
      goto LABEL_41;
    }
    while( 1 )
    {
      v13 = (unsigned int)(v13 + 1);
      v17 = (_DWORD)v13 == v9;
      if( (unsigned int)v13 >= v9 )
        break;
      if( *((_BYTE *)v52 + v13) )
      {
        v17 = (_DWORD)v13 == v9;
        break;
      }
    }
    if( !v17 )
    {
LABEL_54:
      PrintableAttributeName = 1336;
      goto LABEL_79;
    }
LABEL_41:
    LODWORD(v13) = MoveBy + v13;
    HIDWORD(MoveBy) = v13;
    if( (unsigned int)v13 >= v9 )
      break;
    v10 = v52;
  }
  if( v12 == 1 )
  {
    v35 = v56[0];
    v36 = (WCHAR **)v56[0];
    *(_QWORD *)v56[0] = result[0];
    PrintableAttributeName = EncloseSubCondition(v36);
    if( !PrintableAttributeName )
      return PrintableAttributeName;
    *v35 = 0i64;
    goto LABEL_80;
  }
LABEL_79:
  if( !v12 )
    return PrintableAttributeName;
LABEL_80:
  if( !PrintableAttributeName )
    PrintableAttributeName = 1336;
  v46 = v12;
  do
  {
    v47 = v56[v46-- + 1];
    if( v47 )
      ExFreePoolWithTag(v47, 0);
  }
  while( v46 );
  return PrintableAttributeName;
}

Referenced by:

LocalGetAceCondition