SdbpResolveMatchingFile

NTSTATUS __stdcall SdbpResolveMatchingFile(
        VOID *hSDB,
        tagSEARCHDBCONTEXT *pContext,
        WCHAR *szMatchFile,
        UINT64 nMatchFileLength,
        tagSEARCHPATHPART *pSearchPathPart,
        WCHAR **szFullPathOut){
  WCHAR **v6; 
  int v7; 
  NTSTATUS v11; 
  tagSEARCHPATHPART *v12; 
  NTSTATUS v13; 
  UINT64 v14; 
  VOID *v15; 
  INT64 v16; 
  UINT64 v17; 
  WCHAR *v18; 
  WCHAR *v19; 
  UINT64 v20; 
  __int64 v21; 
  INT8 *v23; 
  UINT64 v24; 
  unsigned __int64 v25; 
  unsigned __int64 v26; 
  INT8 *v27; 
  UINT64 v28; 
  INT64 ResolveForWow64; 
  UINT64 pullResult; 
  WCHAR *NetworkPathNtOut; 
  __int16 v34; 

  v6 = szFullPathOut;
  v7 = nMatchFileLength;
  pullResult = 0i64;
  NetworkPathNtOut = 0i64;
  *szFullPathOut = 0i64;
  v34 = -1;
  v11 = 0;
  LOWORD(szFullPathOut) = -1;
  if( !(_DWORD)nMatchFileLength )
  {
    v23 = "Invalid match file length";
    v24 = 561i64;
    goto LABEL_28;
  }
  v12 = pSearchPathPart;
  if( *szMatchFile != 37 )
  {
    v25 = (unsigned int)pSearchPathPart[2];
    v26 = v25 + (unsigned int)nMatchFileLength;
    if( v26 >= v25 )
    {
      v14 = v26 + 1;
      if( v26 + 1 >= v26 )
        goto LABEL_6;
      v24 = 617i64;
    }
    else
    {
      v24 = 612i64;
    }
LABEL_42:
    v23 = (INT8 *)"Invalid path size";
    goto LABEL_28;
  }
  if( AslEnvGetProcessWowInfo(&szFullPathOut, &v34) < 0 )
  {
    v23 = (INT8 *)"AslEnvGetProcessWowInfo failed [%x]";
    v24 = 582i64;
    goto LABEL_28;
  }
  AslImageFileToArchitecture(*((_WORD *)hSDB + 288));
  LOWORD(ResolveForWow64) = (_WORD)szFullPathOut;
  v13 = AslEnvExpandStrings2(*((PVOID *)pContext + 7), szMatchFile, 0i64, 0i64, &pullResult, ResolveForWow64);
  if( (int)(v13 + 0x80000000) >= 0 && v13 != -1073741789 )
  {
    v23 = (INT8 *)"AslEnvExpandStrings2 failed [%x]";
    v24 = 599i64;
LABEL_28:
    AslLogCallPrintf(1ui64, (INT8 *)"SdbpResolveMatchingFile", v24, v23);
    return v11;
  }
  v14 = 2 * pullResult;
LABEL_6:
  if( v14 + 20 < v14 )
  {
    v24 = 623i64;
    goto LABEL_42;
  }
  pullResult = v14 + 20;
  if( RtlULongLongMult(v14 + 20, 2ui64, &pullResult) < 0 )
  {
    v23 = "Invalid buffer size";
    v24 = 628i64;
    goto LABEL_28;
  }
  v17 = pullResult;
  if( pullResult < 0x208 )
    v17 = 520i64;
  v18 = (WCHAR *)AslAlloc(v15, v17, v16);
  v19 = v18;
  if( !v18 )
  {
    v23 = (INT8 *)"Out of memory";
    v24 = 636i64;
    goto LABEL_28;
  }
  if( *szMatchFile != 37 )
  {
    memmove(v18, *(const VOID **)v12, 2 * v12[2]);
    memmove(&v19[v12[2]], szMatchFile, 2 * (v7 + 1));
    v20 = v17 >> 1;
    goto LABEL_14;
  }
  if( AslEnvGetProcessWowInfo(&szFullPathOut, &v34) < 0 )
  {
    v27 = (INT8 *)"AslEnvGetProcessWowInfo failed [%x]";
    v28 = 648i64;
LABEL_37:
    AslLogCallPrintf(1ui64, (INT8 *)"SdbpResolveMatchingFile", v28, v27);
    goto LABEL_21;
  }
  AslImageFileToArchitecture(*((_WORD *)hSDB + 288));
  LOWORD(ResolveForWow64) = (_WORD)szFullPathOut;
  v20 = v17 >> 1;
  if( AslEnvExpandStrings2(*((PVOID *)pContext + 7), szMatchFile, v19, v20, &pullResult, ResolveForWow64) >= 0 )
  {
LABEL_14:
    if( AslPathClean(v19, v19, v20) >= 0 )
    {
      if( AslPathToNetworkPathNt(&NetworkPathNtOut, v19) >= 0 )
      {
        ExFreePoolWithTag(v19, 0x74705041u);
        v19 = NetworkPathNtOut;
      }
      else if( wcsnicmp(v19, L"\\??\\", 4u) )
      {
        v21 = -1i64;
        do
          ++v21;
        while( v19[v21] );
        memmove(v19 + 4, v19, 2 * v21 + 2);
        *(_QWORD *)v19 = *(_QWORD *)L"\\??\\";
      }
      *v6 = v19;
      v11 = 1;
      v19 = 0i64;
      goto LABEL_21;
    }
    v27 = (INT8 *)"AslPathClean failed [%x]";
    v28 = 690i64;
    goto LABEL_37;
  }
  AslLogCallPrintf(
    1ui64,
    (INT8 *)"SdbpResolveMatchingFile",
    0x299ui64,
    (INT8 *)"AslEnvExpandStrings2 failed to expand strings for %ws [%x]");
LABEL_21:
  if( v19 )
    ExFreePoolWithTag(v19, 0x74705041u);
  return v11;
}

Referenced by: