EmpParseRuleExpression
INT64 __fastcall EmpParseRuleExpression(PVOID ParsedInfHandle, PSTR KeyName, INT64 a3, UINT64 *a4){
NTSTATUS v5;
_QWORD *v6;
_QWORD *v7;
PSTR ValueFromSectionAndKeyName;
_DWORD *PoolWithTag;
_QWORD *v10;
CHAR v11;
char *v12;
unsigned int v13;
int v14;
__int64 v15;
__int64 v16;
unsigned int v17;
_QWORD *v18;
_QWORD *v19;
_QWORD *v20;
_QWORD *v22;
_QWORD *v23;
_QWORD *v24;
unsigned int v25;
__int64 v26;
VOID *v27;
__int64 v28;
_QWORD *v29;
_QWORD *v30;
void *v31;
void *v32;
ULONG v33;
void *i;
_QWORD *v35;
__int64 v36;
_QWORD *v37;
_QWORD *v38;
__int64 v39;
_QWORD *v40;
UINT64 MappingCount;
UINT64 LineIndex;
UINT64 *Mapping;
PVOID Record;
int v46;
LODWORD(LineIndex) = 0;
Record = 0i64;
Mapping = 0i64;
MappingCount = 0i64;
v5 = 0;
v6 = 0i64;
v7 = 0i64;
ValueFromSectionAndKeyName = EmpInfParseGetValueFromSectionAndKeyName(
ParsedInfHandle,
(PSTR)"Rule",
KeyName,
a4,
(UINT64)&LineIndex);
if( !ValueFromSectionAndKeyName )
{
v5 = -1073741275;
goto LABEL_55;
}
PoolWithTag = ExAllocatePoolWithTag(PagedPool, 0x10ui64, 0x74734D45ui64);
v10 = PoolWithTag;
if( PoolWithTag )
{
*PoolWithTag = 0;
*((_QWORD *)PoolWithTag + 1) = 0i64;
}
do
{
if( *ValueFromSectionAndKeyName != 37 )
{
if( *ValueFromSectionAndKeyName == 38 )
goto LABEL_46;
if( *ValueFromSectionAndKeyName != 63 )
{
if( *ValueFromSectionAndKeyName != 124 )
goto LABEL_61;
LABEL_46:
if( *(_DWORD *)v10 < 2u )
goto LABEL_61;
v6 = ExAllocatePoolWithTag(PagedPool, 0x38ui64, 0x74734D45ui64);
if( !v6
|| (v6[1] = ExAllocatePoolWithTag(PagedPool, 0x20ui64, 0x74734D45ui64),
v27 = ExAllocatePoolWithTag(PagedPool, 0x20ui64, 0x74734D45ui64),
v28 = v6[1],
v6[4] = v27,
!v28)
|| !v27 )
{
LABEL_60:
v5 = -1073741670;
goto LABEL_28;
}
*(_BYTE *)v6 = *ValueFromSectionAndKeyName;
*(_DWORD *)(v28 + 16) = 0;
*(_QWORD *)(v6[1] + 24i64) = 0i64;
*(_DWORD *)(v6[4] + 16i64) = 0;
*(_QWORD *)(v6[4] + 24i64) = 0i64;
if( !EmpRuleParserStackPop((__int64)v10, (_DWORD *)v6[4], (_QWORD *)(v6[4] + 8i64), v6 + 6, (_DWORD *)v6 + 10)
|| !EmpRuleParserStackPop((__int64)v10, (_DWORD *)v6[1], (_QWORD *)(v6[1] + 8i64), v6 + 3, (_DWORD *)v6 + 4) )
{
goto LABEL_59;
}
EmpRuleParserStackPush((__int64)v10, 2, (__int64)v6, 0i64, 0);
goto LABEL_24;
}
}
v5 = EmpParseRuleTerm(ParsedInfHandle, ValueFromSectionAndKeyName, &Record, &Mapping, &MappingCount);
if( v5 < 0 )
goto LABEL_28;
v11 = *ValueFromSectionAndKeyName;
v12 = (char *)Record;
LOBYTE(v46) = v11;
if( v11 == 63 )
{
v13 = *((_DWORD *)Record + 14);
v14 = *((_DWORD *)Record + 15);
}
else
{
v13 = *((_DWORD *)Record + 10);
v14 = *((_DWORD *)Record + 11);
}
v15 = v14 + v13;
if( (unsigned int)v15 > (unsigned int)MappingCount )
goto LABEL_61;
v16 = 0i64;
if( v13 )
{
while( *((_DWORD *)Mapping + v16) < *(_DWORD *)(a3 + 40) )
{
v16 = (unsigned int)(v16 + 1);
if( (unsigned int)v16 >= v13 )
goto LABEL_14;
}
goto LABEL_61;
}
LABEL_14:
v17 = v13;
if( v13 < (unsigned int)v15 )
{
while( *((_DWORD *)Mapping + v17) < *(_DWORD *)(a3 + 44) )
{
if( ++v17 >= (unsigned int)v15 )
goto LABEL_17;
}
goto LABEL_61;
}
LABEL_17:
while( (unsigned int)v15 < (unsigned int)MappingCount )
{
v25 = *((_DWORD *)Mapping + v15);
if( v25 >= *(_DWORD *)(a3 + 48) )
goto LABEL_61;
v26 = (_BYTE)v46 == 63 ? *((_QWORD *)Record + (_DWORD)v15 - v14 - v13 + 9) : *(_QWORD *)(*((_QWORD *)Record + 7)
+ 8i64
* ((_DWORD)v15 - v14 - v13));
if( *(_QWORD *)(*(_QWORD *)(a3 + 56) + 8i64 * v25) != v26 )
goto LABEL_61;
v15 = (unsigned int)(v15 + 1);
}
if( (_BYTE)v46 == 63 )
{
v22 = ExAllocatePoolWithTag(PagedPool, 0x10ui64, 0x74694D45ui64);
if( !v22 )
goto LABEL_60;
*v22 = v12;
v23 = v12 + 48;
v22[1] = *(_QWORD *)(a3 + 64);
*(_QWORD *)(a3 + 64) = v22 + 1;
if( !EmpInfParseSearchDependencyList((_QWORD **)v12 + 6, a3) )
{
v24 = ExAllocatePoolWithTag(PagedPool, 0x18ui64, 0x74694D45ui64);
if( !v24 )
goto LABEL_60;
*v24 = a3;
v24[1] = *v23;
*v23 = v24 + 1;
}
EmpRuleParserStackPush((__int64)v10, 0, (__int64)v12, (__int64)Mapping, MappingCount);
}
else
{
v18 = ExAllocatePoolWithTag(PagedPool, 0x18ui64, 0x74694D45ui64);
if( !v18 )
goto LABEL_60;
*v18 = v12;
v19 = v12 + 32;
v18[1] = *(_QWORD *)(a3 + 72);
*(_QWORD *)(a3 + 72) = v18 + 1;
if( !EmpInfParseSearchDependencyList((_QWORD **)v12 + 4, a3) )
{
v20 = ExAllocatePoolWithTag(PagedPool, 0x18ui64, 0x74694D45ui64);
if( !v20 )
goto LABEL_60;
*v20 = a3;
v20[1] = *v19;
*v19 = v20 + 1;
}
EmpRuleParserStackPush((__int64)v10, 1, (__int64)v12, (__int64)Mapping, MappingCount);
}
LABEL_24:
++HIDWORD(MappingCount);
ValueFromSectionAndKeyName = CmpGetSectionLineIndex(
ParsedInfHandle,
(PSTR)"Rule",
(unsigned int)LineIndex,
HIDWORD(MappingCount));
}
while( ValueFromSectionAndKeyName );
if( *(_DWORD *)v10 == 1 )
{
v7 = ExAllocatePoolWithTag(PagedPool, 0x20ui64, 0x74694D45ui64);
if( EmpRuleParserStackPop((__int64)v10, v7, v7 + 1, v7 + 3, (_DWORD *)v7 + 4) )
{
*(_QWORD *)(a3 + 96) = v7;
goto LABEL_28;
}
LABEL_59:
v5 = -1073741275;
goto LABEL_28;
}
LABEL_61:
v5 = -1073741811;
LABEL_28:
if( v10 )
{
while( v10[1] )
EmpRuleParserStackPop((__int64)v10, &LineIndex, &Mapping, &Record, &v46);
ExFreePoolWithTag(v10, 0x74734D45u);
}
if( v5 < 0 )
{
if( !v6 )
goto LABEL_55;
v31 = (void *)v6[1];
if( v31 )
ExFreePoolWithTag(v31, 0x74734D45u);
v32 = (void *)v6[4];
if( v32 )
ExFreePoolWithTag(v32, 0x74734D45u);
v33 = 1953713477;
for( i = v6; ; i = v35 )
{
ExFreePoolWithTag(i, v33);
LABEL_55:
v29 = *(_QWORD **)(a3 + 72);
if( !v29 )
break;
v35 = v29 - 1;
*(_QWORD *)(a3 + 72) = *v29;
v36 = *(v29 - 1);
v37 = *(_QWORD **)(v36 + 32);
if( *(v37 - 1) == a3 )
{
if( v37 )
*(_QWORD *)(v36 + 32) = *v37;
ExFreePoolWithTag(v37 - 1, 0x74694D45u);
}
v33 = 1953058117;
}
while( 1 )
{
v30 = *(_QWORD **)(a3 + 64);
if( !v30 )
break;
v38 = v30 - 1;
*(_QWORD *)(a3 + 64) = *v30;
v39 = *(v30 - 1);
v40 = *(_QWORD **)(v39 + 48);
if( *(v40 - 1) == a3 )
{
if( v40 )
*(_QWORD *)(v39 + 48) = *v40;
ExFreePoolWithTag(v40 - 1, 0x74694D45u);
}
ExFreePoolWithTag(v38, 0x74694D45u);
}
if( v7 )
ExFreePoolWithTag(v7, 0x74694D45u);
}
return(unsigned int)v5;
}Referenced by:
EmpParseRules