SepReadAndPopulateCapes
NTSTATUS __stdcall SepReadAndPopulateCapes(_HANDLE KeyHandle){
int v1;
unsigned int *v2;
VOID ***v3;
VOID **v4;
VOID **PoolWithTag;
size_t *v6;
int v7;
unsigned int v8;
VOID *v9;
NTSTATUS Key;
int ValueKey;
unsigned int v12;
char v13;
unsigned int v15;
size_t v16;
VOID **v17;
unsigned int v18;
char *v19;
char *v20;
char *v21;
__int16 v22;
char *v23;
__int64 v24;
NTSTATUS v25;
unsigned int v26;
unsigned int v27;
size_t v28;
unsigned int v29;
char *v30;
VOID *v31;
INT64 v32;
__int64 v33;
char *v34;
UINT64 *ResultLength;
UINT64 *ResultLengtha;
UINT64 *ResultLengthb;
UINT64 *ResultLengthc;
UINT64 *ResultLengthd;
UINT64 *ResultLengthe;
UINT64 *ResultLengthf;
UINT64 *ResultLengthg;
UINT64 *ResultLengthh;
char v44;
char NumberOfBytes[12];
unsigned int v46;
unsigned int v47;
unsigned __int64 v48;
unsigned int v49;
VOID ***v50;
unsigned int *v51;
WCHAR pszDest[344];
char KeyInformation[560];
v50 = v3;
v4 = 0i64;
memset(NumberOfBytes, 0, sizeof(NumberOfBytes));
v44 = 0;
PoolWithTag = (VOID **)KeyInformation;
v6 = 0i64;
v51 = v2;
v7 = v1;
v8 = 560;
v9 = *(VOID **)&KeyHandle;
Key = ZwQueryKey(*(VOID **)&KeyHandle, KeyFullInformation, KeyInformation, 0x230ui64, (UINT64 *)NumberOfBytes);
ValueKey = Key;
if( Key >= 0 )
goto LABEL_2;
if( Key != -2147483643 && Key != -1073741789 )
goto LABEL_4;
PoolWithTag = ExAllocatePoolWithTag(1ui64, *(unsigned int *)NumberOfBytes, 1884513619i64);
if( !PoolWithTag )
{
ValueKey = -1073741670;
v13 = 0;
goto LABEL_15;
}
v8 = *(_DWORD *)NumberOfBytes;
v44 = 1;
ValueKey = ZwQueryKey(v9, KeyFullInformation, PoolWithTag, *(unsigned int *)NumberOfBytes, (UINT64 *)NumberOfBytes);
if( ValueKey >= 0 )
{
LABEL_2:
v12 = *((_DWORD *)PoolWithTag + 5);
v47 = v12;
if( !v12 )
{
*v50 = 0i64;
*v51 = 0;
goto LABEL_4;
}
v15 = v7 + 18;
v16 = 56 * v12;
v6 = (size_t *)ExAllocatePoolWithTag(1ui64, v15, 1884513619i64);
if( v6 )
{
v46 = 0;
if( v47 )
{
do
{
ValueKey = RtlStringCbPrintfW(pszDest, 0x157ui64, (WCHAR *)L"%s\\%d");
if( ValueKey < 0 )
goto LABEL_10;
ValueKey = SepRegOpenKey(pszDest, 0x201ui64, (VOID **)&NumberOfBytes[4]);
if( ValueKey < 0 )
goto LABEL_10;
v25 = ZwQueryKey(*(VOID **)&NumberOfBytes[4], KeyFullInformation, PoolWithTag, v8, (UINT64 *)NumberOfBytes);
ValueKey = v25;
if( v25 < 0 )
{
if( v25 != -2147483643 && v25 != -1073741789 )
goto LABEL_4;
v13 = v44;
if( v44 )
ExFreePoolWithTag(PoolWithTag, 0x70536553u);
PoolWithTag = ExAllocatePoolWithTag(1ui64, *(unsigned int *)NumberOfBytes, 1884513619i64);
if( !PoolWithTag )
{
ValueKey = -1073741670;
goto LABEL_15;
}
v8 = *(_DWORD *)NumberOfBytes;
v44 = 1;
ValueKey = ZwQueryKey(
*(VOID **)&NumberOfBytes[4],
KeyFullInformation,
PoolWithTag,
*(unsigned int *)NumberOfBytes,
(UINT64 *)NumberOfBytes);
if( ValueKey < 0 )
goto LABEL_10;
}
v26 = *((_DWORD *)PoolWithTag + 10) + 18;
if( v26 > v15 )
{
v6 = (size_t *)SepRmCapPoolExpand(v6, v26);
if( !v6 )
goto LABEL_36;
v15 = v26;
}
LODWORD(ResultLengthd) = v15;
ValueKey = ZwQueryValueKey(
*(VOID **)&NumberOfBytes[4],
&CapeName,
KeyValuePartialInformation,
v6,
(UINT64)ResultLengthd,
(UINT64 *)NumberOfBytes);
if( ValueKey < 0 )
goto LABEL_10;
LODWORD(ResultLengthe) = v15;
v27 = v6[2] + ((v16 + 1) & 0xFFFFFFFE);
ValueKey = ZwQueryValueKey(
*(VOID **)&NumberOfBytes[4],
&CapePredicate,
KeyValuePartialInformation,
v6,
(UINT64)ResultLengthe,
(UINT64 *)NumberOfBytes);
if( ValueKey < 0 )
goto LABEL_10;
v28 = v6[2] + v27;
LODWORD(ResultLengthf) = v15;
ValueKey = ZwQueryValueKey(
*(VOID **)&NumberOfBytes[4],
&CapeSD,
KeyValuePartialInformation,
v6,
(UINT64)ResultLengthf,
(UINT64 *)NumberOfBytes);
if( ValueKey < 0 )
goto LABEL_10;
LODWORD(ResultLengthg) = v15;
v29 = v6[2] + ((v28 + 7) & 0xFFFFFFF8);
ValueKey = ZwQueryValueKey(
*(VOID **)&NumberOfBytes[4],
&CapeStagedSD,
KeyValuePartialInformation,
v6,
(UINT64)ResultLengthg,
(UINT64 *)NumberOfBytes);
if( ValueKey < 0 )
goto LABEL_10;
v16 = v6[2] + ((v29 + 7) & 0xFFFFFFF8);
ZwClose(*(_HANDLE *)&NumberOfBytes[4]);
*(_QWORD *)&NumberOfBytes[4] = 0i64;
}
while( ++v46 < v47 );
}
v17 = ExAllocatePoolWithTag(1ui64, v16, 1884513619i64);
v4 = v17;
if( v17 )
{
memset(v17, 0i64, v16);
v18 = v47;
v48 = (unsigned __int64)v4 + v16;
v19 = (char *)&v4[7 * v47];
v46 = 0;
if( v47 )
{
v20 = (char *)(v4 + 1);
do
{
ValueKey = RtlStringCbPrintfW(pszDest, 0x157ui64, (WCHAR *)L"%s\\%d");
if( ValueKey < 0 )
goto LABEL_10;
ValueKey = SepRegOpenKey(pszDest, 0x201ui64, (VOID **)&NumberOfBytes[4]);
if( ValueKey < 0 )
goto LABEL_10;
LODWORD(ResultLength) = v15;
ValueKey = ZwQueryValueKey(
*(VOID **)&NumberOfBytes[4],
&CapeFlags,
KeyValuePartialInformation,
v6,
(UINT64)ResultLength,
(UINT64 *)NumberOfBytes);
if( ValueKey < 0 )
goto LABEL_10;
if( v6[2] != 4 )
{
ValueKey = -1073741811;
goto LABEL_10;
}
LODWORD(v4[7 * v46 + 6]) = v6[3];
LODWORD(ResultLengtha) = v15;
ValueKey = ZwQueryValueKey(
*(VOID **)&NumberOfBytes[4],
&CapeName,
KeyValuePartialInformation,
v6,
(UINT64)ResultLengtha,
(UINT64 *)NumberOfBytes);
if( ValueKey < 0 )
goto LABEL_10;
v21 = (char *)((unsigned __int64)(v19 + 1) & 0xFFFFFFFFFFFFFFFEui64);
if( (unsigned __int64)&v21[v6[2]] > v48 )
goto LABEL_68;
v22 = *((_WORD *)v6 + 4);
*((_WORD *)v20 - 3) = v22;
*((_WORD *)v20 - 4) = v22;
*(_QWORD *)v20 = v21;
memmove(v21, v6 + 3, v6[2]);
v23 = &v21[v6[2]];
LODWORD(ResultLengthb) = v15;
ValueKey = ZwQueryValueKey(
*(VOID **)&NumberOfBytes[4],
&CapePredicate,
KeyValuePartialInformation,
v6,
(UINT64)ResultLengthb,
(UINT64 *)NumberOfBytes);
if( ValueKey < 0 )
goto LABEL_10;
v24 = v6[2];
if( (unsigned __int64)&v23[v24] > v48 )
goto LABEL_68;
*((_DWORD *)v20 + 2) = v24;
if( v6[2] )
{
*((_QWORD *)v20 + 2) = v23;
memmove(v23, v6 + 3, v6[2]);
}
else
{
*((_QWORD *)v20 + 2) = 0i64;
}
v30 = &v23[v6[2]];
LODWORD(ResultLengthc) = v15;
ValueKey = ZwQueryValueKey(
*(VOID **)&NumberOfBytes[4],
&CapeSD,
KeyValuePartialInformation,
v6,
(UINT64)ResultLengthc,
(UINT64 *)NumberOfBytes);
if( ValueKey < 0 )
goto LABEL_10;
v31 = (VOID *)((unsigned __int64)(v30 + 7) & 0xFFFFFFFFFFFFFFF8ui64);
if( (unsigned __int64)v31 + v6[2] > v48 )
goto LABEL_68;
*((_QWORD *)v20 + 3) = v31;
memmove(v31, v6 + 3, v6[2]);
v32 = *((_QWORD *)v20 + 3);
v49 = v6[2];
if( !SeValidSecurityDescriptor(v49, v32) )
goto LABEL_64;
LODWORD(ResultLengthh) = v15;
ValueKey = ZwQueryValueKey(
*(VOID **)&NumberOfBytes[4],
&CapeStagedSD,
KeyValuePartialInformation,
v6,
(UINT64)ResultLengthh,
(UINT64 *)NumberOfBytes);
if( ValueKey < 0 )
goto LABEL_10;
v33 = v6[2];
v34 = (char *)(((unsigned __int64)v31 + v49 + 7) & 0xFFFFFFFFFFFFFFF8ui64);
if( (unsigned __int64)&v34[v33] > v48 )
{
LABEL_68:
ValueKey = -1073741789;
goto LABEL_10;
}
if( (_DWORD)v33 )
{
*((_QWORD *)v20 + 4) = v34;
memmove(v34, v6 + 3, v6[2]);
if( !SeValidSecurityDescriptor(v6[2], *((_QWORD *)v20 + 4)) )
{
LABEL_64:
ValueKey = -1073741703;
goto LABEL_10;
}
}
else
{
*((_QWORD *)v20 + 4) = 0i64;
}
v19 = &v34[v6[2]];
ZwClose(*(_HANDLE *)&NumberOfBytes[4]);
v20 += 56;
*(_QWORD *)&NumberOfBytes[4] = 0i64;
v18 = v47;
}
while( ++v46 < v47 );
}
*v50 = v4;
*v51 = v18;
LABEL_4:
if( ValueKey >= 0 )
{
v13 = v44;
goto LABEL_6;
}
goto LABEL_10;
}
}
LABEL_36:
ValueKey = -1073741670;
}
LABEL_10:
v13 = v44;
LABEL_15:
if( *(_QWORD *)&NumberOfBytes[4] )
ZwClose(*(_HANDLE *)&NumberOfBytes[4]);
if( v4 )
ExFreePoolWithTag(v4, 0x70536553u);
LABEL_6:
if( v13 && PoolWithTag )
ExFreePoolWithTag(PoolWithTag, 0x70536553u);
if( v6 )
ExFreePoolWithTag(v6, 0x70536553u);
return ValueKey;
}Referenced by:
SepBuildCapPolicyTable