GetOperandValue
UINT64 __stdcall GetOperandValue(
WCHAR *Condition,
UINT8 IsAttribute,
UINT8 IsArray,
_OPERAND_VALUE **Value,
UINT64 *MoveBy,
VOID *RootDomainSid,
VOID *DomainSid,
_STRSD_SID_LOOKUP *tSidLookupDomOrRootDomRelativeTable,
UINT8 DefaultToDomain){
UINT64 *v9;
unsigned int AttributeName;
char v14;
_OPERAND_VALUE *v15;
void *v16;
_OPERAND_VALUE *v18;
WCHAR *v19;
UINT8 v20;
__int64 v21;
_OPERAND_VALUE *v22;
UINT8 v23;
VOID *v24;
unsigned int v25;
unsigned int v26;
unsigned int v27;
unsigned int v28;
VOID *v29;
__int64 v30;
bool v31;
char v32;
__int64 v33;
_OPERAND_VALUE *v34;
VOID *v35;
UINT8 v36;
UINT64 v37;
int v38;
_OPERAND_VALUE *v39;
__int64 v40;
VOID *v41;
__int64 v42;
__int64 v43;
__int64 v44;
__int64 v45;
__int64 v46;
UINT64 v47;
WCHAR *v48;
UINT64 v49;
UINT64 v50;
WCHAR v51;
UINT64 v52;
__int16 v53;
WCHAR *v54;
_OPERAND_VALUE *v55;
_QWORD *v56;
_OPERAND_VALUE *v57;
VOID *PoolTag;
UINT64 PoolTaga;
INT64 PoolTagb;
UINT8 v61;
INT64 flags;
INT64 flagsa;
INT64 error;
INT64 errora;
_OPERAND_VALUE *Valuea;
VOID *SID;
WCHAR *endptr;
WCHAR *End;
UINT8 Digit;
v9 = MoveBy;
LODWORD(DomainSid) = 0;
LOBYTE(RootDomainSid) = 0;
Digit = 0;
endptr = 0i64;
AttributeName = 0;
SID = 0i64;
v14 = 0;
DefaultToDomain = 0;
Valuea = 0i64;
End = 0i64;
LODWORD(tSidLookupDomOrRootDomRelativeTable) = 0;
*(_DWORD *)MoveBy = 0;
v15 = (_OPERAND_VALUE *)SddlpAlloc(0x10ui64, IsAttribute, IsArray);
*Value = v15;
if( !v15 )
goto LABEL_2;
if( IsAttribute || !wcsnicmp(Condition, L"@", 1u) )
{
AttributeName = GetAttributeName(Condition, Value, v9);
LABEL_80:
if( AttributeName )
goto LABEL_81;
goto LABEL_7;
}
if( *Condition == 34 )
{
AttributeName = GetStringOperandValue(Condition, Value, v9);
if( !AttributeName )
goto LABEL_7;
goto LABEL_80;
}
if( *Condition == 123 )
{
v18 = *Value;
LODWORD(DomainSid) = 1;
*((_BYTE *)v18 + 1) = 80;
if( Condition[1] )
{
while( 1 )
{
AttributeName = GetNextNoneWhiteSpace(Condition, (UINT64 *)&DomainSid);
if( AttributeName )
goto LABEL_81;
v19 = &Condition[(unsigned int)DomainSid];
if( *v19 == 123 )
goto LABEL_37;
AttributeName = GetOperandValue(v19, 0, 0, &Valuea, v9, 0i64, 0i64, 0i64, 0);
if( AttributeName )
goto LABEL_81;
if( IsArray )
{
if( v14 && v14 != *((_BYTE *)Valuea + 1) )
goto LABEL_37;
v14 = *((_BYTE *)Valuea + 1);
}
v20 = IsValueSizeFixed(*((_BYTE *)Valuea + 1));
v22 = *Value;
v23 = v20;
v24 = (VOID *)*((_QWORD *)*Value + 1);
v25 = v20 != 0 ? 1 : 5;
if( v24 )
{
v26 = v22[1];
v27 = v26 + *(_DWORD *)(v21 + 4);
if( v27 < v26 || (v28 = v25 + v27, v25 + v27 < v27) )
{
LABEL_38:
AttributeName = 534;
goto LABEL_81;
}
v29 = SddlpReAlloc(v26, v28, v24, v21, PoolTaga);
*((_QWORD *)v22 + 1) = v29;
if( !v29 )
goto LABEL_2;
}
else
{
v28 = v25 + *(_DWORD *)(v21 + 4);
if( v28 < v25 )
goto LABEL_38;
*((_QWORD *)v22 + 1) = SddlpAlloc(v28, v25, 0i64);
}
v30 = *((_QWORD *)v22 + 1);
if( !v30 )
goto LABEL_2;
*(_BYTE *)((unsigned int)v22[1] + v30) = *((_BYTE *)Valuea + 1);
if( !v23 )
*(_DWORD *)((unsigned int)v22[1] + *((_QWORD *)v22 + 1) + 1i64) = Valuea[1];
memmove(
(VOID *)(*((_QWORD *)v22 + 1) + (unsigned int)v22[1] + (-(__int64)(v23 != 0) & 0xFFFFFFFFFFFFFFFCui64) + 5),
*((const VOID **)Valuea + 1),
Valuea[1]);
v22[1] = v28;
FreeOperandValue(Valuea);
Valuea = 0i64;
LODWORD(DomainSid) = *(_DWORD *)v9 + (_DWORD)DomainSid;
AttributeName = GetNextNoneWhiteSpace(Condition, (UINT64 *)&DomainSid);
if( AttributeName )
goto LABEL_81;
if( Condition[(unsigned int)DomainSid] != 44 )
{
v31 = Condition[(unsigned int)DomainSid] == 125;
v16 = 0i64;
if( !v31 )
goto LABEL_41;
*(_DWORD *)v9 = (_DWORD)DomainSid + 1;
goto LABEL_8;
}
LODWORD(DomainSid) = (_DWORD)DomainSid + 1;
if( !Condition[(unsigned int)DomainSid] )
goto LABEL_7;
}
}
goto LABEL_7;
}
v32 = 3;
if( !wcsnicmp(Condition, L"SID", 3u) )
{
LODWORD(DomainSid) = 3;
AttributeName = GetNextNoneWhiteSpace(Condition, (UINT64 *)&DomainSid);
if( AttributeName )
goto LABEL_81;
if( Condition[(unsigned int)DomainSid] == 40 )
{
v33 = (unsigned int)((_DWORD)DomainSid + 1);
AttributeName = LocalGetSidForString(&Condition[v33], &SID, &End, &DefaultToDomain, PoolTag, v61);
if( AttributeName
|| (LODWORD(DomainSid) = v33 + &End[-v33] - Condition,
(AttributeName = GetNextNoneWhiteSpace(Condition, (UINT64 *)&DomainSid)) != 0) )
{
v16 = SID;
}
else
{
v31 = Condition[(unsigned int)DomainSid] == 41;
v16 = SID;
if( v31 )
{
v34 = *Value;
v35 = SID;
*(_DWORD *)v9 = (_DWORD)DomainSid + 1;
*((_BYTE *)v34 + 1) = 81;
v34[1] = RtlLengthSid((INT64)v35);
v31 = DefaultToDomain == 0;
*((_QWORD *)v34 + 1) = v16;
v16 = 0i64;
*(_BYTE *)v34 = v31;
goto LABEL_8;
}
LABEL_41:
AttributeName = 1336;
}
goto LABEL_82;
}
goto LABEL_37;
}
GetBinaryOperandLen(Condition, (UINT64 *)&DomainSid);
if( *Condition == 35 )
{
v38 = (int)DomainSid;
if( (unsigned int)DomainSid >= 2 )
{
v39 = *Value;
LODWORD(v40) = (unsigned int)DomainSid >> 1;
*(_DWORD *)v9 = (_DWORD)DomainSid;
*((_BYTE *)v39 + 1) = 24;
v39[1] = v40;
v41 = SddlpAlloc((unsigned int)v40, v36, v37);
*((_QWORD *)*Value + 1) = v41;
if( !v41 )
{
LABEL_2:
AttributeName = 8;
LABEL_81:
v16 = 0i64;
goto LABEL_82;
}
v42 = v38 - 1;
while( v42 >= 1 )
{
if( !GetDigitFromChar(Condition[v42], (UINT8 *)&RootDomainSid) || !GetDigitFromChar(Condition[v43 - 1], &Digit) )
goto LABEL_2;
v40 = (unsigned int)(v40 - 1);
v42 = v44 - 2;
*(_BYTE *)(v40 + *(_QWORD *)(v45 + 8)) = (unsigned __int8)RootDomainSid | (16 * Digit);
}
LABEL_7:
v16 = 0i64;
goto LABEL_8;
}
LABEL_37:
AttributeName = 1336;
goto LABEL_81;
}
v46 = (unsigned int)DomainSid;
if( !(_DWORD)DomainSid )
goto LABEL_37;
*(_DWORD *)v9 = (_DWORD)DomainSid;
LODWORD(PoolTag) = 1;
v47 = wcstoxq(
0i64,
Condition,
&endptr,
0i64,
(INT64)PoolTag,
(INT64 *)&tSidLookupDomOrRootDomRelativeTable,
flags,
error);
v48 = endptr;
v49 = 0i64;
v50 = v47;
if( endptr == Condition && !v47 )
goto LABEL_37;
if( endptr != &Condition[v46] || (_DWORD)tSidLookupDomOrRootDomRelativeTable )
goto LABEL_37;
v51 = *Condition;
if( *Condition == 45 )
{
++Condition;
LODWORD(PoolTagb) = 1;
v52 = wcstoxq(
0i64,
Condition,
&endptr,
0i64,
PoolTagb,
(INT64 *)&tSidLookupDomOrRootDomRelativeTable,
flagsa,
errora);
if( v52 >= v50 && v52 )
goto LABEL_37;
v51 = *Condition;
v53 = 2;
v48 = endptr;
}
else if( v51 == 43 )
{
++Condition;
v53 = 1;
v51 = *Condition;
}
else
{
v53 = 3;
}
if( v51 == 48 )
{
v54 = Condition + 1;
if( v54 >= v48 || ((*v54 - 88) & 0xFFDF) != 0 )
v32 = 1;
}
else
{
v32 = 2;
}
v55 = *Value;
*((_BYTE *)v55 + 1) = 4;
v55[1] = 10;
v56 = SddlpAlloc(0xAui64, (UINT8)v48, v49);
v57 = *Value;
v16 = 0i64;
*((_QWORD *)*Value + 1) = v56;
if( v56 )
{
*v56 = v50;
*(_WORD *)(*((_QWORD *)v57 + 1) + 8i64) = v53;
*(_BYTE *)(*((_QWORD *)v57 + 1) + 9i64) = v32;
goto LABEL_8;
}
AttributeName = 8;
LABEL_82:
FreeOperandValue(*Value);
*Value = 0i64;
LABEL_8:
if( Valuea )
FreeOperandValue(Valuea);
if( v16 && DefaultToDomain )
ExFreePoolWithTag(v16, 0);
return AttributeName;
}Referenced by:
GetOperandValue
LocalGetConditionForString