LocalpGetStringForCondition
NTSTATUS __stdcall LocalpGetStringForCondition(
UINT8 *Condition,
UINT64 ConditionSize,
WCHAR **ConditionStr,
VOID *RootDomainSid,
VOID *DomainSid,
_STRSD_SID_LOOKUP *tSidLookupDomOrRootDomRelativeTable,
UINT8 DefaultToDomain){
unsigned int v8;
UINT8 *v9;
NTSTATUS PrintableAttributeName;
int v11;
__int64 v12;
__int64 v13;
UINT8 *v14;
UINT8 v15;
bool v16;
NTSTATUS OperatorIndexByToken;
NTSTATUS v18;
__int64 v19;
__int64 v20;
__int64 v21;
__int64 v22;
unsigned int v23;
wchar_t *v24;
wchar_t *v25;
UINT8 v26;
UINT64 v27;
UINT64 v28;
WCHAR *v29;
__int64 v30;
PWCHAR *v31;
int v32;
PWCHAR v33;
WCHAR **v34;
bool v36;
wchar_t *v37;
UINT8 v38;
UINT64 v39;
UINT64 v40;
WCHAR *v41;
char v42;
NTSTATUS v43;
__int64 v44;
PWCHAR v45;
UINT64 pulResult;
UINT64 MoveBy;
unsigned int v48;
__int64 v49;
UINT8 *v50;
_STRSD_SID_LOOKUP *v51;
VOID *v52;
VOID *RootDomainSida;
PWCHAR v54[2];
__int64 v55[256];
UINT8 v56;
RootDomainSida = DomainSid;
v8 = ConditionSize;
v9 = Condition;
v52 = tSidLookupDomOrRootDomRelativeTable;
v51 = (_STRSD_SID_LOOKUP *)DefaultToDomain;
v54[0] = (PWCHAR)ConditionStr;
PrintableAttributeName = 0;
v48 = ConditionSize;
v50 = Condition;
pulResult = 0i64;
memset(v55, 0i64, sizeof(v55));
LODWORD(MoveBy) = 0;
v11 = 0;
if( !v9 || !ConditionStr || !v8 )
return 87;
if( v8 < 6 || *(_DWORD *)v9 != 2020897377 )
return 805;
LODWORD(v12) = 4;
v13 = 0i64;
HIDWORD(MoveBy) = 4;
while( 1 )
{
if( v13 == 255 )
{
PrintableAttributeName = 1001;
goto LABEL_79;
}
v14 = &v9[(unsigned int)v12];
v15 = *v14;
if( *v14 > 0x51u )
{
if( v15 < 0x80u )
goto LABEL_54;
if( v15 > 0x93u )
{
if( v15 <= 0x9Fu )
goto LABEL_54;
if( v15 > 0xA3u )
{
if( v15 <= 0xF7u || v15 > 0xFCu )
goto LABEL_54;
PrintableAttributeName = GetPrintableAttributeName(
v14,
v8 - (unsigned int)v12,
v15,
(WCHAR **)&pulResult,
&MoveBy);
if( PrintableAttributeName )
goto LABEL_51;
v55[v13] = pulResult;
goto LABEL_39;
}
}
if( (unsigned __int8)(v15 + 96) <= 1u )
{
if( v13 < 2 )
goto LABEL_54;
PrintableAttributeName = EncloseSubCondition((WCHAR **)&v55[v11 - 1]);
if( PrintableAttributeName )
goto LABEL_79;
PrintableAttributeName = EncloseSubCondition((WCHAR **)&v55[v11 - 2]);
v36 = PrintableAttributeName == 0;
}
else
{
if( v15 != 0xA2 )
{
LABEL_18:
OperatorIndexByToken = GetOperatorIndexByToken(*v14);
if( OperatorIndexByToken < 0 )
goto LABEL_88;
v20 = 3i64 * OperatorIndexByToken;
v21 = -1i64;
v22 = *(_QWORD *)(v19 + 8 * v20);
v49 = v20;
do
++v21;
while( *(_WORD *)(v22 + 2 * v21) );
v23 = 2 * v21;
LODWORD(pulResult) = v23;
if( *(_BYTE *)(v19 + 8 * v20 + 16) )
{
if( !v13 )
{
LABEL_88:
PrintableAttributeName = v18;
goto LABEL_79;
}
v37 = v54[v13 + 1];
if( ULongAddStringSize(v23, v37, &pulResult) < 0 )
goto LABEL_87;
v40 = (unsigned int)(pulResult + 8);
v29 = (WCHAR *)SddlpAlloc(v40, v38, v39);
if( !v29 )
{
LABEL_78:
PrintableAttributeName = 8;
goto LABEL_79;
}
if( v15 == 0xA2 )
{
v41 = L"(%ls%ls)";
}
else
{
v42 = *((_BYTE *)&Operators + 8 * v49 + 8);
if( (v42 == -121 || v42 == -115)
&& (!wcsnicmp(v37, L"@USER.", 6u) || !wcsnicmp(v37, L"@DEVICE.", 8u) || !wcsnicmp(v37, L"@TOKEN.", 7u)) )
{
PrintableAttributeName = 1336;
goto LABEL_91;
}
v41 = (WCHAR *)L"(%ls %ls)";
}
v43 = RtlStringCchPrintfW(v29, v40 >> 1, v41);
v32 = 0;
if( v43 < 0 )
goto LABEL_90;
if( v37 )
{
ExFreePoolWithTag(v37, 0);
v32 = 0;
}
v30 = 0i64;
v31 = &v54[v13 + 1];
}
else
{
if( v13 < 2 )
goto LABEL_88;
v24 = v54[v13 + 1];
if( ULongAddStringSize(v23, v24, &pulResult) < 0
|| (v25 = v54[v13], ULongAddStringSize((unsigned int)pulResult, v25, &pulResult) < 0) )
{
LABEL_87:
PrintableAttributeName = 534;
goto LABEL_79;
}
v28 = (unsigned int)(pulResult + 10);
v29 = (WCHAR *)SddlpAlloc(v28, v26, v27);
if( !v29 )
goto LABEL_78;
if( RtlStringCchPrintfW(v29, v28 >> 1, (WCHAR *)L"(%ls %ls %ls)") < 0 )
{
LABEL_90:
PrintableAttributeName = 50;
LABEL_91:
if( v29 )
ExFreePoolWithTag(v29, 0);
goto LABEL_79;
}
if( v24 )
ExFreePoolWithTag(v24, 0);
if( v25 )
ExFreePoolWithTag(v25, 0);
v30 = -1i64;
v31 = &v54[v13];
v32 = -1;
}
LODWORD(v12) = HIDWORD(MoveBy);
v11 += v32;
v8 = v48;
v13 += v30;
*v31 = v29;
LODWORD(MoveBy) = 1;
goto LABEL_40;
}
if( v13 < 1 )
goto LABEL_54;
PrintableAttributeName = EncloseSubCondition((WCHAR **)&v55[v11 - 1]);
v36 = PrintableAttributeName == 0;
}
if( !v36 )
goto LABEL_79;
goto LABEL_18;
}
if( v15 >= 0x50u )
goto LABEL_44;
if( v15 )
{
if( v15 != 16 && v15 > 4u && v15 != 24 )
goto LABEL_54;
LABEL_44:
PrintableAttributeName = GetPrintableOperandValue(
v14,
v8 - (unsigned int)v12,
(WCHAR **)&pulResult,
&MoveBy,
RootDomainSida,
v52,
v51,
v56);
if( PrintableAttributeName )
{
LABEL_51:
v29 = (WCHAR *)pulResult;
goto LABEL_91;
}
v55[v13] = pulResult;
LABEL_39:
++v11;
++v13;
LABEL_40:
pulResult = 0i64;
goto LABEL_41;
}
while( 1 )
{
v12 = (unsigned int)(v12 + 1);
v16 = (_DWORD)v12 == v8;
if( (unsigned int)v12 >= v8 )
break;
if( v50[v12] )
{
v16 = (_DWORD)v12 == v8;
break;
}
}
if( !v16 )
{
LABEL_54:
PrintableAttributeName = 1336;
goto LABEL_79;
}
LABEL_41:
LODWORD(v12) = MoveBy + v12;
HIDWORD(MoveBy) = v12;
if( (unsigned int)v12 >= v8 )
break;
v9 = v50;
}
if( v11 == 1 )
{
v33 = v54[0];
v34 = (WCHAR **)v54[0];
*(_QWORD *)v54[0] = v55[0];
PrintableAttributeName = EncloseSubCondition(v34);
if( !PrintableAttributeName )
return PrintableAttributeName;
*(_QWORD *)v33 = 0i64;
goto LABEL_80;
}
LABEL_79:
if( !v11 )
return PrintableAttributeName;
LABEL_80:
if( !PrintableAttributeName )
PrintableAttributeName = 1336;
v44 = v11;
do
{
v45 = v54[v44-- + 1];
if( v45 )
ExFreePoolWithTag(v45, 0);
}
while( v44 );
return PrintableAttributeName;
}Referenced by:
LocalGetAceCondition