EmpEvaluateTargetRule
__int64 __fastcall EmpEvaluateTargetRule(__int64 a1, __int64 a2, int a3){
_QWORD *Pool;
VOID *v5;
__int64 v6;
__int64 v7;
unsigned int v8;
unsigned int v9;
void *v10;
unsigned int v11;
unsigned int v12;
unsigned int v13;
_QWORD *v14;
__int64 v15;
unsigned int i;
int v17;
__int64 v18;
unsigned int v20;
__int64 v21;
__int64 v22;
VOID *PoolWithTag;
int v24;
unsigned int v27;
Pool = 0i64;
v22 = *(_QWORD *)(a1 + 8);
v5 = 0i64;
v6 = *(unsigned int *)(v22 + 40);
v7 = *(unsigned int *)(v22 + 44);
v8 = 1;
v21 = *(_QWORD *)(a1 + 16);
v9 = 0;
PoolWithTag = ExAllocatePoolWithTag(PagedPool, 0x1000ui64, 0x76654D45ui64);
v10 = PoolWithTag;
if( PoolWithTag )
v9 = 4096;
v20 = v9;
v24 = v9;
if( !(_DWORD)v6 && !(_DWORD)v7 )
{
v27 = 1;
goto LABEL_9;
}
v27 = *(_DWORD *)(a1 + 24) / (unsigned int)(v7 + v6);
if( (_DWORD)v6 )
{
Pool = (_QWORD *)EmpAllocatePool(8 * v6);
if( !Pool )
goto LABEL_22;
}
if( !(_DWORD)v7 || (v5 = (VOID *)EmpAllocatePool(4 * v7)) != 0i64 )
{
if( !v27 )
{
LABEL_18:
if( v5 )
EmpFreePool(v5, (UINT64)v10, v9);
goto LABEL_20;
}
LABEL_9:
v11 = v7 + v6;
v12 = 0;
do
{
v13 = 0;
if( (_DWORD)v6 )
{
v14 = Pool;
do
{
v15 = v12 * v11 + v13++;
*v14++ = *((_QWORD *)EmpStringTable + *(unsigned int *)(v21 + 4 * v15));
}
while( v13 < (unsigned int)v6 );
}
for( i = v6; i < v11; *((_DWORD *)v5 + v18) = v17 )
{
v17 = *(_DWORD *)(v21 + 4i64 * (v12 * v11 + i));
v18 = i - (unsigned int)v6;
++i;
}
v8 = EmpEvaluateNodeLink(
*(_QWORD *)(v22 + 96),
(__int64)Pool,
v6,
(__int64)v5,
v7,
a2,
a3,
0i64,
0,
(ULONGLONG)PoolWithTag,
v24);
if( v8 - 1 <= 1 )
break;
++v12;
}
while( v12 < v27 );
v10 = PoolWithTag;
v9 = v20;
goto LABEL_18;
}
LABEL_20:
if( Pool )
EmpFreePool(Pool, (UINT64)v10, v9);
LABEL_22:
if( v10 )
ExFreePoolWithTag(v10, 0x76654D45u);
return v8;
}Referenced by:
EmClientRuleEvaluate
EmpEvaluateUpdateRuleEvalState