LocalGetRelativeAttributeForString
NTSTATUS __stdcall LocalGetRelativeAttributeForString(
WCHAR *String,
WCHAR **End,
_CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 **RelativeAttribute,
UINT64 *RelativeAttributeSize){
unsigned int v4;
_CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 *v5;
unsigned int v6;
unsigned int v7;
bool v8;
NTSTATUS SidForString;
WCHAR *v10;
int v11;
CHAR *v12;
UINT64 v13;
INT64 v14;
UINT8 *v15;
WCHAR *i;
__int16 v17;
WCHAR *v18;
CHAR *v19;
UINT64 v20;
INT64 v21;
__int64 v22;
unsigned int v23;
int v25;
int v26;
CHAR *v27;
UINT64 v28;
INT64 v29;
WCHAR *j;
int v31;
int v32;
CHAR *v33;
UINT64 v34;
INT64 v35;
_WORD *v36;
int v37;
WCHAR *v38;
WCHAR *v39;
UINT64 v40;
WCHAR v41;
UINT64 kk;
int v43;
unsigned int v44;
unsigned __int16 v45;
unsigned int v46;
UINT64 mm;
int v48;
WCHAR v49;
UINT64 m;
int v51;
void *v52;
WCHAR *v53;
NTSTATUS v54;
unsigned int v55;
int v56;
WCHAR v57;
CHAR *v58;
UINT64 v59;
INT64 v60;
int v61;
int v62;
_WORD *v63;
WCHAR *v64;
int v65;
int v66;
unsigned __int64 v67;
WCHAR v68;
UINT16 v69;
UINT64 v70;
UINT64 v71;
INT64 v72;
WCHAR *v73;
UINT64 v74;
INT64 v75;
int v76;
int v77;
unsigned int v78;
WCHAR v79;
UINT64 v80;
UINT64 v81;
INT64 v82;
WCHAR *v83;
UINT64 k;
int v85;
unsigned __int64 v86;
unsigned __int64 v87;
unsigned int v88;
int v89;
unsigned int v90;
_CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 *v91;
int v92;
unsigned int v93;
size_t v94;
unsigned int v95;
unsigned int v96;
WCHAR *v97;
CHAR *v98;
UINT64 v99;
INT64 v100;
UINT64 *v101;
WCHAR v102;
CHAR *v103;
UINT64 v104;
INT64 v105;
int v106;
int v107;
WCHAR *ii;
CHAR *v109;
unsigned int v110;
WCHAR *v111;
unsigned int v112;
WCHAR *v113;
__int64 v114;
__int64 v115;
__int64 v116;
__int64 v117;
UINT8 *v118;
int v119;
int v120;
UINT64 n;
int v122;
VOID *v123;
NTSTATUS v124;
__int64 v125;
int v126;
WCHAR **v127;
WCHAR v128;
UINT64 jj;
int v130;
WCHAR *v131;
unsigned int v132;
WCHAR v133;
WCHAR v134;
__int64 v135;
int v136;
UINT64 v137;
UINT64 v138;
INT64 v139;
CHAR *v140;
UINT64 v141;
INT64 v142;
int v143;
int v144;
UINT64 v145;
UINT64 v146;
INT64 v147;
CHAR *v148;
UINT64 v149;
INT64 v150;
int v151;
int v152;
VOID *flags;
UINT8 error;
INT64 v155;
INT64 v156;
_CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 *v157;
int v158;
char v159[12];
unsigned int v160;
char Flags[12];
WCHAR *DecodedString;
__int64 v163;
UINT8 FreeSid;
WCHAR **v165;
_CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 **v166;
UINT64 *v167;
UINT8 v168[8];
unsigned int Digit;
UINT16 ValueType;
UINT8 v171;
v167 = RelativeAttributeSize;
v166 = RelativeAttribute;
v165 = End;
v4 = 0;
v5 = 0i64;
v157 = 0i64;
v6 = 0;
DecodedString = 0i64;
v7 = 0;
ValueType = 0;
memset(Flags, 0, sizeof(Flags));
v158 = 0;
FreeSid = 0;
v171 = 0;
v168[0] = 0;
memset(v159, 0, sizeof(v159));
if( !String || !End || !RelativeAttribute || !RelativeAttributeSize )
{
SidForString = 87;
goto LABEL_25;
}
v8 = *String == 40;
*RelativeAttribute = 0i64;
*(_DWORD *)RelativeAttributeSize = 0;
if( !v8 )
return 1336;
v10 = String + 1;
iswspace(String[1], (CHAR *)End, (UINT64)RelativeAttribute, (INT64)RelativeAttributeSize);
while( v11 )
iswspace(*++v10, v12, v13, v14);
if( *v10 != 34 )
return 1336;
v15 = (UINT8 *)(v10 + 1);
for( i = (WCHAR *)v15; IsLegalAttributeChar2(*i) && v17; ++i )
{
if( v6 + 1 < v6 )
return 534;
++v6;
}
if( v17 != 34 || !v6 )
return 1336;
v18 = i + 1;
SidForString = DecodeAttributeName(v15, 2 * v6, &DecodedString);
if( !SidForString )
{
v22 = -1i64;
do
++v22;
while( DecodedString[v22] );
v163 = (unsigned int)(v22 + 1);
v23 = 2 * v163 + 20;
Digit = v23;
if( (unsigned int)(2 * v163) >= 0xFFFFFFEC )
{
SidForString = 534;
LABEL_24:
v5 = 0i64;
goto LABEL_25;
}
while( 1 )
{
iswspace(*v18, v19, v20, v21);
if( !v25 )
break;
++v18;
}
if( *v18 != 44 )
goto LABEL_34;
do
iswspace(*++v18, v19, v20, v21);
while( v26 );
SidForString = GetValueType(v18, (WCHAR **)&v159[4], &ValueType);
if( SidForString )
goto LABEL_24;
for( j = *(WCHAR **)&v159[4]; ; ++j )
{
iswspace(*j, v27, v28, v29);
if( !v31 )
break;
}
if( *j != 44 )
goto LABEL_34;
do
iswspace(*++j, v27, v28, v29);
while( v32 );
SidForString = GetFlags(j, (WCHAR **)&v159[4], (UINT64 *)Flags);
if( SidForString )
goto LABEL_24;
v36 = *(_WORD **)&v159[4];
if( (*(_WORD *)Flags & 0xFFC0) != 0 )
goto LABEL_34;
while( 1 )
{
iswspace((unsigned __int16)*v36, v33, v34, v35);
if( !v37 )
break;
++v36;
}
if( *v36 != 44 )
goto LABEL_34;
v38 = v36 + 1;
v39 = v38;
v40 = 0xFFFFFFFFi64;
if( ValueType == 1 )
{
v79 = *v38;
if( *v38 )
{
while( 1 )
{
*(_DWORD *)v159 = 0;
LODWORD(flags) = 0;
v80 = wcstoxq(0i64, v39, (WCHAR **)&v159[4], 0i64, (INT64)flags, (INT64 *)v159, v155, v156);
if( *(WCHAR **)&v159[4] == v39 && !v80 )
goto LABEL_142;
if( *(_DWORD *)v159 )
goto LABEL_155;
v83 = *(WCHAR **)&v159[4];
++v7;
for( k = (unsigned __int16)**(_WORD **)&v159[4]; ; k = *v83 )
{
iswspace(k, v33, v81, v82);
if( !v85 )
break;
++v83;
}
v79 = *v83;
if( *v83 != 44 )
{
if( v79 != 41 )
goto LABEL_142;
break;
}
v39 = v83 + 1;
if( !*v39 )
goto LABEL_142;
}
}
if( v79 != 41 )
{
LABEL_142:
SidForString = 1336;
LABEL_143:
v5 = 0i64;
goto LABEL_25;
}
v86 = 8i64 * v7;
if( v86 > 0xFFFFFFFF || (v78 = v86 + v23, (unsigned int)v86 + v23 < v23) )
{
LABEL_155:
SidForString = 534;
goto LABEL_143;
}
LABEL_148:
v23 = v78;
goto LABEL_149;
}
if( ValueType != 2 )
{
if( ValueType == 3 )
{
v57 = *v38;
if( *v38 )
{
do
{
iswspace(v57, v33, v40, v35);
if( v61 )
{
do
iswspace(*++v39, v58, v59, v60);
while( v62 );
v23 = Digit;
}
LOWORD(v58) = 34;
if( *v39 != 34 )
break;
v63 = v39 + 1;
while( *v63 != 34 && *v63 )
{
++v63;
if( v4 + 1 < v4 )
goto LABEL_131;
++v4;
}
if( v4 + 1 < v4 )
goto LABEL_131;
++v4;
if( *v63 != 34 )
break;
v64 = v63 + 1;
++v7;
iswspace(*v64, v58, v59, v60);
if( v65 )
{
do
iswspace(*++v64, v33, v40, v35);
while( v66 );
v23 = Digit;
}
v57 = *v64;
if( *v64 != 44 )
{
if( v57 != 41 )
break;
goto LABEL_109;
}
v39 = v64 + 1;
v57 = *v39;
}
while( *v39 );
}
else
{
LABEL_109:
if( v57 == 41 )
{
v67 = 2i64 * v4;
LABEL_129:
if( v67 > 0xFFFFFFFF )
goto LABEL_131;
v78 = v67 + v23;
if( (unsigned int)v67 + v23 < v23 )
goto LABEL_131;
goto LABEL_148;
}
}
LABEL_86:
SidForString = 1336;
LABEL_132:
v5 = v157;
goto LABEL_25;
}
if( ValueType == 5 )
{
v49 = *v38;
if( *v38 )
{
while( 1 )
{
for( m = v49; ; m = *v39 )
{
iswspace(m, v33, v40, v35);
if( !v51 )
break;
++v39;
}
SidForString = LocalGetSidForString(v39, (VOID **)&Flags[4], (WCHAR **)&v159[4], &FreeSid, flags, error);
if( SidForString )
goto LABEL_132;
v52 = *(void **)&Flags[4];
if( !*(_QWORD *)&Flags[4] )
{
LABEL_125:
v5 = 0i64;
goto LABEL_25;
}
v53 = *(WCHAR **)&v159[4];
++v7;
v54 = RtlLengthSid(*(INT64 *)&Flags[4]);
v55 = v54 + v23;
if( v54 + v23 < v23 )
goto LABEL_131;
v23 = v55 + 4;
if( v55 + 4 < v55 )
goto LABEL_131;
if( FreeSid )
{
ExFreePoolWithTag(v52, 0);
*(_QWORD *)&Flags[4] = 0i64;
}
while( 1 )
{
iswspace(*v53, v33, v40, v35);
if( !v56 )
break;
++v53;
}
v49 = *v53;
if( *v53 != 44 )
{
if( v49 != 41 )
goto LABEL_86;
break;
}
v39 = v53 + 1;
v49 = *v39;
if( !*v39 )
goto LABEL_86;
}
}
if( v49 != 41 )
goto LABEL_86;
LABEL_149:
v87 = 4i64 * (v7 - 1);
if( v87 <= 0xFFFFFFFF )
{
v88 = v87 + v23;
if( (unsigned int)v87 + v23 >= v23 )
{
v89 = v88 + 3;
if( v88 + 3 < v88 )
{
v89 = -1;
SidForString = 534;
}
v90 = v89 & 0xFFFFFFFC;
v160 = v90;
v91 = (_CLAIM_SECURITY_ATTRIBUTE_RELATIVE_V1 *)SddlpAlloc(v90, (UINT8)v33, 0xFFFFFFFFui64);
v157 = v91;
v5 = v91;
if( !v91 )
{
SidForString = 8;
goto LABEL_25;
}
v92 = v163;
v91->ValueType = ValueType;
v93 = *(_DWORD *)Flags;
v5->Reserved = 0;
v5->Flags = v93;
v94 = 2 * v92;
v95 = 4 * v7 + 16;
v5->ValueCount = v7;
v96 = v95 + 2 * v92;
v97 = DecodedString;
v5->Name = v95;
memmove((char *)v5 + v95, v97, v94);
v101 = (UINT64 *)((char *)&v5->Name + v96);
if( ValueType == 1 )
{
v102 = *v38;
if( *v38 )
{
while( 1 )
{
*(_DWORD *)v159 = 0;
LODWORD(flags) = 0;
v145 = wcstoxq(0i64, v38, (WCHAR **)&v159[4], 0i64, (INT64)flags, (INT64 *)v159, v155, v156);
if( *(WCHAR **)&v159[4] == v38 && !v145 )
goto LABEL_239;
if( *(_DWORD *)v159 )
{
LABEL_240:
SidForString = 534;
goto LABEL_25;
}
v5->Values.pInt64[v158] = v96;
*v101 = v145;
v96 += 8;
v38 = *(WCHAR **)&v159[4];
v101 = (UINT64 *)((char *)&v5->Name + v96);
iswspace((unsigned __int16)**(_WORD **)&v159[4], (CHAR *)(unsigned int)++v158, v146, v147);
if( v151 )
{
do
iswspace(*++v38, v148, v149, v150);
while( v152 );
v90 = v160;
}
v102 = *v38;
if( *v38 != 44 )
goto LABEL_198;
if( !*++v38 )
goto LABEL_239;
}
}
goto LABEL_198;
}
if( ValueType == 2 )
goto LABEL_220;
if( ValueType != 3 )
{
if( ValueType == 5 )
{
v102 = *v38;
if( *v38 )
{
while( 1 )
{
for( n = v102; ; n = *v38 )
{
iswspace(n, v98, v99, v100);
if( !v122 )
break;
++v38;
}
SidForString = LocalGetSidForString(
v38,
(VOID **)&Flags[4],
(WCHAR **)&v159[4],
&FreeSid,
flags,
error);
if( SidForString )
goto LABEL_25;
v123 = *(VOID **)&Flags[4];
if( !*(_QWORD *)&Flags[4] )
goto LABEL_25;
v124 = RtlLengthSid(*(INT64 *)&Flags[4]);
v5->Values.pInt64[v158] = v96;
v125 = v96 + 4;
v96 = v124 + v125;
*(_DWORD *)v101 = v124;
memmove((char *)v5 + v125, v123, v124);
++v158;
v38 = *(WCHAR **)&v159[4];
v101 = (UINT64 *)((char *)&v5->Name + v96);
if( FreeSid )
{
ExFreePoolWithTag(v123, 0);
*(_QWORD *)&Flags[4] = 0i64;
}
while( 1 )
{
iswspace(*v38, v98, v99, v100);
if( !v126 )
break;
++v38;
}
v102 = *v38;
if( *v38 != 44 )
{
if( v102 != 41 )
goto LABEL_239;
v90 = v160;
goto LABEL_198;
}
v102 = *++v38;
if( !*v38 )
goto LABEL_239;
}
}
goto LABEL_198;
}
if( ValueType != 6 )
{
if( ValueType != 16 )
goto LABEL_239;
v102 = *v38;
if( *v38 )
{
while( 1 )
{
iswspace(v102, v98, v99, v100);
if( v106 )
{
do
iswspace(*++v38, v103, v104, v105);
while( v107 );
v90 = v160;
}
for( ii = v38; GetDigitFromChar(*ii, (UINT8 *)&Digit); ii = v111 + 1 )
;
v112 = v110 >> 1;
v5->Values.pInt64[v158] = v96;
*(_DWORD *)v101 = v112;
v96 += v112 + 4;
v113 = v111 - 1;
while( v113 > v38 )
{
if( !GetDigitFromChar(*v113, &v171) || !GetDigitFromChar(*(_WORD *)(v114 - 2), v168) )
goto LABEL_239;
v113 = (WCHAR *)(v115 - 4);
LOBYTE(v109) = v171 | (16 * v168[0]);
*(_BYTE *)(v117 + v116) = (_BYTE)v109;
}
if( v113 == v38 )
{
if( !GetDigitFromChar(*v113, &v171) )
goto LABEL_239;
*v118 = v171;
}
v38 = v111;
++v158;
v101 = (UINT64 *)((char *)&v5->Name + v96);
iswspace(*v111, v109, (UINT64)v113, (INT64)v111);
if( v119 )
{
do
iswspace(*++v38, v98, v99, v100);
while( v120 );
v90 = v160;
}
v102 = *v38;
if( *v38 != 44 )
break;
v102 = *++v38;
if( !*v38 )
goto LABEL_239;
}
}
LABEL_198:
if( v102 == 41 )
{
LABEL_199:
v127 = v165;
*v166 = v5;
*(_DWORD *)v167 = v90;
*v127 = v38 + 1;
goto LABEL_25;
}
LABEL_239:
SidForString = 1336;
goto LABEL_25;
}
LABEL_220:
v102 = *v38;
if( *v38 )
{
while( 1 )
{
*(_DWORD *)v159 = 0;
LODWORD(flags) = 1;
v137 = wcstoxq(0i64, v38, (WCHAR **)&v159[4], 0i64, (INT64)flags, (INT64 *)v159, v155, v156);
if( *(WCHAR **)&v159[4] == v38 && !v137 )
goto LABEL_239;
if( *(_DWORD *)v159 )
goto LABEL_240;
v5->Values.pInt64[v158] = v96;
*v101 = v137;
v96 += 8;
v38 = *(WCHAR **)&v159[4];
v101 = (UINT64 *)((char *)&v5->Name + v96);
iswspace((unsigned __int16)**(_WORD **)&v159[4], (CHAR *)(unsigned int)++v158, v138, v139);
if( v143 )
{
do
iswspace(*++v38, v140, v141, v142);
while( v144 );
v5 = v157;
}
v102 = *v38;
if( *v38 != 44 )
goto LABEL_198;
if( !*++v38 )
goto LABEL_239;
}
}
goto LABEL_198;
}
v128 = *v38;
if( *v38 )
{
while( 1 )
{
for( jj = v128; ; jj = *v38 )
{
iswspace(jj, v98, v99, v100);
if( !v130 )
break;
++v38;
}
if( *v38 != 34 )
break;
v131 = v38 + 1;
v132 = 0;
if( v38[1] != 34 )
{
v133 = v38[1];
do
{
v134 = v133;
if( !v133 )
break;
++v131;
++v132;
v134 = *v131;
v133 = *v131;
}
while( *v131 != 34 );
if( v134 != 34 )
break;
}
v157->Values.pInt64[v158] = v96;
v96 += 2 * v132 + 2;
v135 = 2i64 * v132;
memmove(v101, v38 + 1, 2 * v132);
v38 = v131 + 1;
*(_WORD *)((char *)v101 + v135) = 0;
v101 = (UINT64 *)((char *)&v157->Name + v96);
++v158;
while( 1 )
{
iswspace(*v38, v98, v99, v100);
if( !v136 )
break;
++v38;
}
v128 = *v38;
if( *v38 != 44 )
{
v5 = v157;
if( v128 != 41 )
goto LABEL_239;
v90 = v160;
goto LABEL_218;
}
v128 = *++v38;
if( !*v38 )
goto LABEL_86;
}
}
else
{
LABEL_218:
if( v128 == 41 )
goto LABEL_199;
}
goto LABEL_86;
}
}
LABEL_131:
SidForString = 534;
goto LABEL_132;
}
if( ValueType != 6 )
{
if( ValueType == 16 )
{
v41 = *v38;
if( *v38 )
{
while( 1 )
{
for( kk = v41; ; kk = *v39 )
{
iswspace(kk, v33, v40, v35);
if( !v43 )
break;
++v39;
}
while( GetDigitFromChar(*v39, (UINT8 *)&Digit) )
{
++v39;
if( v44 < (unsigned int)v35 )
goto LABEL_155;
}
v40 = v44 >> 1;
++v7;
v46 = v40 + v23;
if( (unsigned int)v40 + v23 < v23 )
goto LABEL_155;
v23 = v46 + 4;
if( v46 + 4 < v46 )
goto LABEL_155;
for( mm = v45; ; mm = *v39 )
{
iswspace(mm, v33, v40, v35);
if( !v48 )
break;
++v39;
}
v41 = *v39;
if( *v39 != 44 )
{
if( v41 != 41 )
goto LABEL_142;
break;
}
v41 = *++v39;
if( !*v39 )
goto LABEL_142;
}
}
if( v41 != 41 )
goto LABEL_142;
goto LABEL_149;
}
LABEL_34:
SidForString = 1336;
goto LABEL_24;
}
}
v68 = *v38;
if( !*v38 )
goto LABEL_127;
v69 = ValueType;
while( 1 )
{
*(_DWORD *)v159 = 0;
LODWORD(flags) = 1;
v70 = wcstoxq(0i64, v39, (WCHAR **)&v159[4], 0i64, (INT64)flags, (INT64 *)v159, v155, v156);
if( *(WCHAR **)&v159[4] == v39 && !v70 )
{
SidForString = 1336;
goto LABEL_125;
}
if( *(_DWORD *)v159 )
goto LABEL_131;
if( v69 == 6 && v70 > 1 )
goto LABEL_86;
v73 = *(WCHAR **)&v159[4];
++v7;
iswspace((unsigned __int16)**(_WORD **)&v159[4], 0i64, v71, v72);
if( v76 )
{
do
iswspace(*++v73, v33, v74, v75);
while( v77 );
v69 = ValueType;
}
v68 = *v73;
if( *v73 != 44 )
break;
v39 = v73 + 1;
if( !*v39 )
goto LABEL_86;
}
if( v68 == 41 )
{
LABEL_127:
if( v68 == 41 )
{
v67 = 8i64 * v7;
goto LABEL_129;
}
}
goto LABEL_86;
}
LABEL_25:
if( DecodedString )
ExFreePoolWithTag(DecodedString, 0);
if( SidForString && v5 )
ExFreePoolWithTag(v5, 0);
return SidForString;
}Referenced by:
LocalGetAclForString