KiOpLocateDecodeEntry
NTSTATUS __stdcall KiOpLocateDecodeEntry(INT64 a1){
char v1;
__int64 *v2;
__int64 *v3;
unsigned __int8 v5;
int v6;
char v7;
NTSTATUS result;
char v9;
char v10;
v1 = *(_BYTE *)(a1 + 57);
v2 = &qword_1400026A8;
v3 = KiOpOneByteTable;
if( v1 )
v2 = (__int64 *)&pAttributes;
if( v1 )
v3 = KiOpTwoByteTable;
while( v3 != v2 )
{
v5 = *(_BYTE *)(a1 + 56);
if( v5 < *(_BYTE *)v3 )
goto LABEL_7;
if( v5 > (unsigned __int8)(*(_BYTE *)v3 + *((_BYTE *)v3 + 1) - 1) )
goto LABEL_7;
v6 = *((_DWORD *)v3 + 1);
if( v6 )
{
if( (v6 & *(_DWORD *)(a1 + 48)) == 0 )
goto LABEL_7;
}
v7 = *((_BYTE *)v3 + 8);
if( v7 != -1 || *((_BYTE *)v3 + 9) != 0xFF || *((_BYTE *)v3 + 10) != 0xFF )
{
if( !*(_BYTE *)(a1 + 80) )
{
result = KiOpFetchNextByte(a1, (_BYTE *)(a1 + 65));
if( result < 0 )
return result;
*(_BYTE *)(a1 + 80) = 1;
v7 = *((_BYTE *)v3 + 8);
}
if( v7 != -1 && v7 != ((*(_BYTE *)(a1 + 65) >> 3) & 7) )
goto LABEL_7;
v9 = *((_BYTE *)v3 + 10);
if( v9 != -1 && v9 != (*(_BYTE *)(a1 + 65) & 7) )
goto LABEL_7;
v10 = *((_BYTE *)v3 + 9);
if( v10 != -1 )
{
if( (*(_BYTE *)(a1 + 65) & 0xC0) == 0xC0 )
{
if( v10 != 3 )
goto LABEL_7;
}
else if( v10 == 3 )
{
goto LABEL_7;
}
}
}
if( (*((_DWORD *)v3 + 3) & 0xF4000000) == 0 || (*((_DWORD *)v3 + 3) & 0xF4000000 & *(_DWORD *)(a1 + 60)) != 0 )
{
*(_QWORD *)(a1 + 88) = v3;
return 0;
}
LABEL_7:
v3 += 3;
}
return 0;
}Referenced by:
KiOpDecode