GetPrintableOperandValue
UINT64 __stdcall GetPrintableOperandValue(
UINT8 *Condition,
UINT64 ConditionSize,
WCHAR **ValueStr,
UINT64 *MoveBy,
VOID *RootDomainSid,
VOID *DomainSid,
_STRSD_SID_LOOKUP *tSidLookupDomOrRootDomRelativeTable,
UINT8 DefaultToDomain){
int v10;
unsigned int PrintableOperandValue;
UINT8 v13;
size_t v14;
WCHAR *v15;
unsigned __int64 v16;
size_t v18;
VOID *v19;
UINT8 v20;
UINT64 v21;
__int64 v22;
__int64 v23;
unsigned __int64 v24;
unsigned __int64 v25;
WCHAR *v26;
unsigned int v27;
WCHAR *v28;
unsigned int v29;
unsigned int v30;
__int64 v31;
UINT8 *v32;
unsigned int v33;
WCHAR *v34;
UINT64 v35;
__int64 v36;
WCHAR *v37;
unsigned __int64 v38;
unsigned int v39;
unsigned __int64 v40;
unsigned int v41;
unsigned __int64 v42;
unsigned __int64 v43;
WCHAR *v44;
unsigned int v45;
__int64 v46;
int v47;
__int64 v48;
unsigned __int64 v49;
__int64 v50;
UINT8 v51;
UINT8 v52;
WCHAR *v53;
WCHAR *v54;
__int16 v55;
WCHAR *v56;
__int64 v57;
WCHAR v58;
WCHAR *v59;
WCHAR v60;
WCHAR v61;
_STRSD_SID_LOOKUP *PoolTag;
UINT64 PoolTaga;
unsigned int v64;
PVOID P;
UINT64 pulResult;
unsigned int v67;
UINT64 ulSize;
_STRSD_SID_LOOKUP *v69;
VOID *v70;
UINT64 v71;
__int64 i;
WCHAR pszFormat[12];
char Sid[80];
v70 = DomainSid;
v10 = ConditionSize;
v69 = tSidLookupDomOrRootDomRelativeTable;
v71 = (UINT64)RootDomainSid;
PrintableOperandValue = 0;
P = 0i64;
LODWORD(pulResult) = 0;
if( Condition && ValueStr && (_DWORD)ConditionSize )
{
*(_DWORD *)MoveBy = 1;
v13 = *Condition;
if( !*Condition )
{
LABEL_90:
PrintableOperandValue = 1336;
goto LABEL_12;
}
if( v13 > 4u )
{
switch( v13 )
{
case 0x10u:
if( (unsigned int)(ConditionSize - 1) >= 4 )
{
v14 = *(_DWORD *)(Condition + 1);
*(_DWORD *)MoveBy = 5;
if( (int)ConditionSize - 5 >= v14 )
{
if( v14 + 6 >= v14 )
{
v15 = (WCHAR *)SddlpAlloc(v14 + 6, ConditionSize, (UINT64)ValueStr);
*ValueStr = v15;
if( v15 )
{
*v15 = 34;
memmove(*ValueStr + 1, &Condition[*(unsigned int *)MoveBy], v14);
v16 = (unsigned __int64)v14 >> 1;
(*ValueStr)[v16 + 1] = 34;
(*ValueStr)[v16 + 2] = 0;
*(_DWORD *)MoveBy += v14;
goto LABEL_12;
}
break;
}
return 534;
}
}
return 1336;
case 0x18u:
if( (unsigned int)(ConditionSize - 1) < 4 )
return 1336;
v39 = *(_DWORD *)(Condition + 1);
*(_DWORD *)MoveBy = 5;
if( (int)ConditionSize - 5 < v39 || !v39 )
return 1336;
v40 = 2i64 * v39;
if( v40 > 0xFFFFFFFF )
return 534;
v41 = v40 + 2;
if( (int)v40 + 2 < (unsigned int)v40 )
return 534;
v42 = 2i64 * v41;
if( v42 > 0xFFFFFFFF )
return 534;
v43 = (unsigned int)v42;
v44 = (WCHAR *)SddlpAlloc((unsigned int)v42, v41, (UINT64)ValueStr);
*ValueStr = v44;
if( v44 )
{
v45 = 0;
*v44 = 35;
v46 = 0i64;
do
{
v47 = 2 * v45;
v48 = v46 + *(unsigned int *)MoveBy;
++v45;
++v46;
v49 = Condition[v48];
(*ValueStr)[v47 + 1] = a0123456789abcd[v49 >> 4];
(*ValueStr)[v47 + 2] = a0123456789abcd[v49 & 0xF];
}
while( v45 < v39 );
PrintableOperandValue = 0;
(*ValueStr)[(v43 >> 1) - 1] = 0;
*(_DWORD *)MoveBy += v39;
goto LABEL_12;
}
break;
case 0x50u:
if( (unsigned int)(ConditionSize - 1) < 4 )
return 1336;
v27 = *(_DWORD *)(Condition + 1);
*(_DWORD *)MoveBy = 5;
if( !v27 || (int)ConditionSize - 5 < v27 )
return 1336;
ulSize = 6i64;
v28 = (WCHAR *)SddlpAlloc(6ui64, ConditionSize, (UINT64)ValueStr);
*ValueStr = v28;
if( v28 )
{
*v28 = 123;
v29 = 0;
v30 = *(_DWORD *)MoveBy;
v64 = *(_DWORD *)MoveBy;
HIDWORD(pulResult) = 0;
v31 = v30;
for( i = v30; ; v31 = i )
{
v32 = &Condition[v31 + v29];
if( *v32 == 80 )
break;
PrintableOperandValue = GetPrintableOperandValue(
v32,
v10 - v29 - v30,
(WCHAR **)&P,
MoveBy,
(VOID *)v71,
v70,
v69,
DefaultToDomain);
if( PrintableOperandValue )
goto LABEL_12;
HIDWORD(pulResult) += *(_DWORD *)MoveBy;
if( ULongAddStringSize((unsigned int)ulSize, (PWCHAR)P, &pulResult) < 0 )
goto LABEL_30;
v33 = pulResult + 4;
v67 = pulResult + 4;
if( (int)pulResult + 4 < (unsigned int)pulResult )
goto LABEL_30;
v34 = *ValueStr;
LODWORD(pulResult) = pulResult + 4;
v35 = v33;
v36 = -1i64;
do
++v36;
while( v34[v36] );
v37 = (WCHAR *)SddlpReAlloc(2 * v36, v35, v34, 0, PoolTaga);
*ValueStr = v37;
if( !v37 )
goto LABEL_64;
if( RtlStringCchPrintfW(
&v37[((unsigned __int64)(unsigned int)ulSize >> 1) - 2],
(unsigned __int64)(v67 - (unsigned int)ulSize + 4) >> 1,
(WCHAR *)L"%ls, ") < 0 )
goto LABEL_28;
if( P )
ExFreePoolWithTag(P, 0);
v29 = HIDWORD(pulResult);
v30 = v64;
P = 0i64;
ulSize = v67;
if( v27 <= HIDWORD(pulResult) )
{
v38 = (unsigned __int64)v67 >> 1;
(*ValueStr)[v38 - 4] = 125;
(*ValueStr)[v38 - 3] = 0;
*(_DWORD *)MoveBy = v64 + v27;
goto LABEL_12;
}
}
goto LABEL_90;
}
break;
case 0x51u:
if( (unsigned int)(ConditionSize - 1) < 4 )
return 1336;
v18 = *(_DWORD *)(Condition + 1);
*(_DWORD *)MoveBy = 5;
if( v18 > 0x44 || (int)ConditionSize - 5 < v18 )
return 1336;
memmove(Sid, Condition + 5, v18);
PrintableOperandValue = LocalGetStringForSid(Sid, (WCHAR **)&P, RootDomainSid, v19, PoolTag, DefaultToDomain);
if( PrintableOperandValue )
goto LABEL_12;
*(_DWORD *)MoveBy += v18;
v22 = -1i64;
do
++v22;
while( *((_WORD *)P + v22) );
v23 = (unsigned int)(v22 + 6);
if( (unsigned int)v23 < (unsigned int)v22 || (v24 = 2 * v23, v24 > 0xFFFFFFFF) )
{
LABEL_30:
PrintableOperandValue = 534;
goto LABEL_12;
}
v25 = (unsigned int)v24;
v26 = (WCHAR *)SddlpAlloc((unsigned int)v24, v20, v21);
*ValueStr = v26;
if( !v26 )
break;
if( RtlStringCchPrintfW(v26, v25 >> 1, (WCHAR *)L"SID(%ls)") >= 0 )
goto LABEL_12;
LABEL_28:
PrintableOperandValue = 50;
goto LABEL_12;
default:
goto LABEL_90;
}
LABEL_64:
PrintableOperandValue = 8;
goto LABEL_12;
}
if( (unsigned int)(ConditionSize - 1) < 0xA )
return 1336;
v50 = *(_QWORD *)(Condition + 1);
v51 = Condition[9];
v52 = Condition[10];
v53 = (WCHAR *)SddlpAlloc(0x40ui64, ConditionSize, (UINT64)ValueStr);
*ValueStr = v53;
v54 = v53;
if( !v53 )
goto LABEL_64;
if( v51 == 1 )
{
v55 = 43;
}
else
{
if( v51 != 2 )
{
LABEL_68:
v56 = pszFormat;
v57 = 8i64;
if( v52 == 1 )
{
*v54++ = 48;
do
{
if( v57 == -2147483638 )
break;
v58 = *(WCHAR *)((char *)v56 + (char *)L"%I64o" - (char *)pszFormat);
if( !v58 )
break;
*v56++ = v58;
--v57;
}
while( v57 );
}
else if( v52 == 3 )
{
*(_DWORD *)v54 = 7864368;
v54 += 2;
do
{
if( v57 == -2147483638 )
break;
v60 = *(WCHAR *)((char *)v56 + (char *)L"%I64x" - (char *)pszFormat);
if( !v60 )
break;
*v56++ = v60;
--v57;
}
while( v57 );
}
else
{
do
{
if( v57 == -2147483638 )
break;
v61 = *(WCHAR *)((char *)v56 + (char *)L"%I64u" - (char *)pszFormat);
if( !v61 )
break;
*v56++ = v61;
--v57;
}
while( v57 );
}
v59 = v56 - 1;
if( v57 )
v59 = v56;
*v59 = 0;
if( !v57 || (v50 || v52 != 1) && RtlStringCchPrintfW(v54, 32 - (v54 - *ValueStr), pszFormat) < 0 )
goto LABEL_28;
*(_DWORD *)MoveBy += 10;
LABEL_12:
if( P )
ExFreePoolWithTag(P, 0);
return PrintableOperandValue;
}
v55 = 45;
}
*v54++ = v55;
goto LABEL_68;
}
return 87i64;
}Referenced by:
GetPrintableOperandValue
LocalpGetStringForCondition