GetAttributeName

UINT64 __stdcall GetAttributeName(WCHAR *Condition, _OPERAND_VALUE **Value, UINT64 *MoveBy){
  WCHAR *v5; 
  unsigned int v6; 
  unsigned int v7; 
  __int16 v8; 
  UINT16 v9; 
  unsigned int v10; 
  const wchar_t *v11; 
  UINT64 v12; 
  _OPERAND_VALUE *v13; 
  unsigned int v14; 
  bool v15; 
  VOID *v16; 
  _OPERAND_VALUE *v17; 
  _OPERAND_VALUE *v18; 
  __int64 v19; 
  WCHAR *v20; 
  WCHAR *DecodedString; 

  DecodedString = 0i64;
  v5 = Condition;
  v6 = 0;
  v7 = 0;
  if( wcsnicmp(Condition, L"@", 1u) )
  {
    while( 1 )
    {
      v9 = v5[v7];
      if( v9 > 0xFFu )
        break;
      if( !iswalnum(v9) )
      {
        v10 = 0;
        v11 = L":./_@";
        while( *v11 != v9 )
        {
          ++v10;
          ++v11;
          if( v10 >= 5 )
            goto LABEL_10;
        }
      }
      if( !v5[v7] )
        break;
      ++v7;
    }
  }
  else
  {
    while( IsLegalAttributeChar2(v5[v7]) && v8 )
      ++v7;
  }
LABEL_10:
  if( v7 >= 8 && !wcsnicmp(v5, L"@DEVICE.", 8u) )
  {
    if( v7 != 8 )
    {
      v13 = *Value;
      v14 = 2 * v7 - 16;
      v5 += 8;
      *((_BYTE *)*Value + 1) = -5;
      goto LABEL_31;
    }
    return 1336;
  }
  if( v7 < 0xA || wcsnicmp(v5, L"@RESOURCE.", 0xAu) )
  {
    if( v7 < 6 || wcsnicmp(v5, L"@USER.", 6u) )
    {
      if( v7 < 7 || wcsnicmp(v5, L"@TOKEN.", 7u) )
      {
        if( !v7 || !wcsnicmp(v5, L"@", 1u) )
          return 1336;
        v13 = *Value;
        v14 = 2 * v7;
        *((_BYTE *)*Value + 1) = -8;
      }
      else
      {
        if( v7 == 7 )
          return 1336;
        v13 = *Value;
        v14 = 2 * v7 - 14;
        v5 += 7;
        *((_BYTE *)*Value + 1) = -4;
      }
    }
    else
    {
      if( v7 == 6 )
        return 1336;
      v13 = *Value;
      v14 = 2 * v7 - 12;
      v5 += 6;
      *((_BYTE *)*Value + 1) = -7;
    }
  }
  else
  {
    if( v7 == 10 )
      return 1336;
    v13 = *Value;
    v14 = 2 * v7 - 20;
    v5 += 10;
    *((_BYTE *)*Value + 1) = -6;
  }
LABEL_31:
  v13[1] = v14;
  v15 = *((_BYTE *)v13 + 1) == 0xF8;
  *(_DWORD *)MoveBy = v7;
  if( v15 )
  {
    v16 = SddlpAlloc(v14, v14, v12);
    v17 = *Value;
    *((_QWORD *)*Value + 1) = v16;
    if( v16 )
      memmove(v16, v5, v17[1]);
    else
      return 8;
  }
  else
  {
    v6 = DecodeAttributeName((UINT8 *)v5, v14, &DecodedString);
    if( !v6 )
    {
      v18 = *Value;
      v19 = -1i64;
      v20 = DecodedString;
      *((_QWORD *)*Value + 1) = DecodedString;
      do
        ++v19;
      while( v20[v19] );
      v18[1] = 2 * v19;
    }
  }
  return v6;
}

Referenced by: