LocalpGetStringForCondition
__int64 __fastcall LocalpGetStringForCondition(
__int64 a1,
int a2,
void *a3,
__int64 a4,
__int64 a5,
__int64 a6,
__int64 a7,
char a8){
unsigned int v9;
_DWORD *v10;
unsigned int PrintableAttributeName;
int v12;
__int64 v13;
__int64 v14;
UINT8 *v15;
UINT8 v16;
bool v17;
NTSTATUS OperatorIndexByToken;
unsigned int v19;
__int64 v20;
__int64 v21;
__int64 v22;
__int64 v23;
unsigned int v24;
WCHAR *v25;
WCHAR *v26;
UINT64 v27;
unsigned __int64 v28;
WCHAR *v29;
WCHAR *v30;
int v31;
__int64 v32;
PVOID *v33;
int v34;
_QWORD *v35;
WCHAR **v36;
bool v38;
WCHAR *v39;
UINT64 v40;
unsigned __int64 v41;
WCHAR *v42;
WCHAR *v43;
char v44;
int v45;
__int64 v46;
PVOID v47;
UINT64 pulResult;
UINT64 MoveBy;
int v50;
__int64 v51;
_DWORD *v52;
__int64 v53;
__int64 v54;
__int64 v55;
PVOID v56[2];
__int64 result[256];
v55 = a5;
v9 = a2;
v10 = (_DWORD *)a1;
v54 = a6;
v53 = a7;
v56[0] = a3;
PrintableAttributeName = 0;
v50 = a2;
v52 = (_DWORD *)a1;
pulResult = 0i64;
memset((INT64)result, 0i64);
LODWORD(MoveBy) = 0;
v12 = 0;
if( !v10 || !a3 || !v9 )
return 87i64;
if( v9 < 6 || *v10 != 2020897377 )
return 805i64;
LODWORD(v13) = 4;
v14 = 0i64;
HIDWORD(MoveBy) = 4;
while( 1 )
{
if( v14 == 255 )
{
PrintableAttributeName = 1001;
goto LABEL_79;
}
v15 = (UINT8 *)v10 + (unsigned int)v13;
v16 = *v15;
if( *v15 > 0x51u )
{
if( v16 < 0x80u )
goto LABEL_54;
if( v16 > 0x93u )
{
if( v16 <= 0x9Fu )
goto LABEL_54;
if( v16 > 0xA3u )
{
if( v16 <= 0xF7u || v16 > 0xFCu )
goto LABEL_54;
PrintableAttributeName = GetPrintableAttributeName(
v15,
v9 - (unsigned int)v13,
v16,
(WCHAR **)&pulResult,
&MoveBy);
if( PrintableAttributeName )
goto LABEL_51;
result[v14] = pulResult;
goto LABEL_39;
}
}
if( (unsigned __int8)(v16 + 96) <= 1u )
{
if( v14 < 2 )
goto LABEL_54;
PrintableAttributeName = EncloseSubCondition((WCHAR **)&result[v12 - 1]);
if( PrintableAttributeName )
goto LABEL_79;
PrintableAttributeName = EncloseSubCondition((WCHAR **)&result[v12 - 2]);
v38 = PrintableAttributeName == 0;
}
else
{
if( v16 != 0xA2 )
{
LABEL_18:
OperatorIndexByToken = GetOperatorIndexByToken(*v15);
if( OperatorIndexByToken < 0 )
goto LABEL_88;
v21 = 3i64 * OperatorIndexByToken;
v22 = -1i64;
v23 = *(_QWORD *)(v20 + 8 * v21);
v51 = v21;
do
++v22;
while( *(_WORD *)(v23 + 2 * v22) );
v24 = 2 * v22;
LODWORD(pulResult) = v24;
if( *(_BYTE *)(v20 + 8 * v21 + 16) )
{
if( !v14 )
{
LABEL_88:
PrintableAttributeName = v19;
goto LABEL_79;
}
v39 = (WCHAR *)v56[v14 + 1];
if( ULongAddStringSize(v24, v39, &pulResult) < 0 )
goto LABEL_87;
v41 = (unsigned int)(pulResult + 8);
SddlpAlloc(pulResult + 8, v40);
v30 = v42;
if( !v42 )
{
LABEL_78:
PrintableAttributeName = 8;
goto LABEL_79;
}
if( v16 == 0xA2 )
{
v43 = L"(%ls%ls)";
}
else
{
v44 = *((_BYTE *)&Operators + 8 * v51 + 8);
if( (v44 == -121 || v44 == -115)
&& (!wcsnicmp(v39, L"@USER.", 6ui64)
|| !wcsnicmp(v39, L"@DEVICE.", 8ui64)
|| !wcsnicmp(v39, (const wchar_t *)L"@TOKEN.", 7ui64)) )
{
PrintableAttributeName = 1336;
goto LABEL_91;
}
v43 = (WCHAR *)L"(%ls %ls)";
}
RtlStringCchPrintfW(v30, v41 >> 1, v43);
v34 = 0;
if( v45 < 0 )
goto LABEL_90;
if( v39 )
{
ExFreePoolWithTag(v39, 0);
v34 = 0;
}
v32 = 0i64;
v33 = &v56[v14 + 1];
}
else
{
if( v14 < 2 )
goto LABEL_88;
v25 = (WCHAR *)v56[v14 + 1];
if( ULongAddStringSize(v24, v25, &pulResult) < 0
|| (v26 = (WCHAR *)v56[v14], ULongAddStringSize((unsigned int)pulResult, v26, &pulResult) < 0) )
{
LABEL_87:
PrintableAttributeName = 534;
goto LABEL_79;
}
v28 = (unsigned int)(pulResult + 10);
SddlpAlloc(pulResult + 10, v27);
v30 = v29;
if( !v29 )
goto LABEL_78;
RtlStringCchPrintfW(v29, v28 >> 1, (WCHAR *)L"(%ls %ls %ls)");
if( v31 < 0 )
{
LABEL_90:
PrintableAttributeName = 50;
LABEL_91:
if( v30 )
ExFreePoolWithTag(v30, 0);
goto LABEL_79;
}
if( v25 )
ExFreePoolWithTag(v25, 0);
if( v26 )
ExFreePoolWithTag(v26, 0);
v32 = -1i64;
v33 = &v56[v14];
v34 = -1;
}
LODWORD(v13) = HIDWORD(MoveBy);
v12 += v34;
v9 = v50;
v14 += v32;
*v33 = v30;
LODWORD(MoveBy) = 1;
goto LABEL_40;
}
if( v14 < 1 )
goto LABEL_54;
PrintableAttributeName = EncloseSubCondition((WCHAR **)&result[v12 - 1]);
v38 = PrintableAttributeName == 0;
}
if( !v38 )
goto LABEL_79;
goto LABEL_18;
}
if( v16 >= 0x50u )
goto LABEL_44;
if( v16 )
{
if( v16 != 16 && v16 > 4u && v16 != 24 )
goto LABEL_54;
LABEL_44:
PrintableAttributeName = GetPrintableOperandValue(
(char *)v15,
v9 - (unsigned int)v13,
(__int64)&pulResult,
(unsigned int *)&MoveBy,
v55,
v54,
v53,
a8);
if( PrintableAttributeName )
{
LABEL_51:
v30 = (WCHAR *)pulResult;
goto LABEL_91;
}
result[v14] = pulResult;
LABEL_39:
++v12;
++v14;
LABEL_40:
pulResult = 0i64;
goto LABEL_41;
}
while( 1 )
{
v13 = (unsigned int)(v13 + 1);
v17 = (_DWORD)v13 == v9;
if( (unsigned int)v13 >= v9 )
break;
if( *((_BYTE *)v52 + v13) )
{
v17 = (_DWORD)v13 == v9;
break;
}
}
if( !v17 )
{
LABEL_54:
PrintableAttributeName = 1336;
goto LABEL_79;
}
LABEL_41:
LODWORD(v13) = MoveBy + v13;
HIDWORD(MoveBy) = v13;
if( (unsigned int)v13 >= v9 )
break;
v10 = v52;
}
if( v12 == 1 )
{
v35 = v56[0];
v36 = (WCHAR **)v56[0];
*(_QWORD *)v56[0] = result[0];
PrintableAttributeName = EncloseSubCondition(v36);
if( !PrintableAttributeName )
return PrintableAttributeName;
*v35 = 0i64;
goto LABEL_80;
}
LABEL_79:
if( !v12 )
return PrintableAttributeName;
LABEL_80:
if( !PrintableAttributeName )
PrintableAttributeName = 1336;
v46 = v12;
do
{
v47 = v56[v46-- + 1];
if( v47 )
ExFreePoolWithTag(v47, 0);
}
while( v46 );
return PrintableAttributeName;
}Referenced by:
LocalGetAceCondition