EmpParseRules

NTSTATUS __stdcall EmpParseRules(VOID *ParsedInfHandle){
  unsigned int v2; 
  int GuidFromName; 
  unsigned int v4; 
  char *KeyName; 
  VOID **PoolWithTag; 
  VOID **v7; 
  _GUID *v8; 
  _QWORD *v9; 
  VOID **v10; 
  __int64 v11; 
  INT8 *SectionLineIndex; 
  INT8 *v13; 
  unsigned int SectionLineIndexValueCount; 
  unsigned int v15; 
  bool v16; 
  unsigned int v17; 
  VOID **v19; 
  unsigned int v20; 
  char *v21; 
  _SINGLE_LIST_ENTRY *v22; 
  _SINGLE_LIST_ENTRY *v23; 
  VOID **v24; 
  unsigned int i; 
  void *v26; 
  __int64 v27; 
  __int64 v28; 
  __int64 v29; 
  _QWORD *v30; 
  __int64 v31; 
  _QWORD *v32; 
  unsigned int SectionLineCount; 
  _GUID NameGuid; 

  NameGuid = 0i64;
  v2 = 0;
  GuidFromName = 0;
  SectionLineCount = EmpInfParseGetSectionLineCount(ParsedInfHandle, (INT8 *)"RuleDef");
  v4 = SectionLineCount;
  if( SectionLineCount )
  {
    do
    {
      KeyName = CmpGetKeyName(ParsedInfHandle, (PSTR)"RuleDef", v2);
      if( !KeyName )
        return 0;
      PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x68ui64, 1953058117i64);
      v7 = PoolWithTag;
      if( !PoolWithTag )
        return -1073741670;
      PoolWithTag[7] = 0i64;
      *((_DWORD *)PoolWithTag + 4) = 1;
      v8 = (_GUID *)PoolWithTag;
      *((_BYTE *)PoolWithTag + 20) = 0;
      PoolWithTag[8] = 0i64;
      PoolWithTag[9] = 0i64;
      PoolWithTag[4] = 0i64;
      v9 = PoolWithTag + 10;
      v9[1] = v9;
      *v9 = v9;
      *((_DWORD *)v7 + 12) = 0;
      *((_DWORD *)v7 + 10) = 0;
      GuidFromName = EmpInfParseGetGuidFromName(ParsedInfHandle, (PSTR)"RuleNameGuidDef", KeyName, v8);
      v10 = v7;
      if( GuidFromName < 0 || (EmpSearchRuleDatabase(), v11) )
      {
        ExFreePoolWithTag(v10, 0x74694D45u);
      }
      else
      {
        SectionLineIndex = CmpGetSectionLineIndex(ParsedInfHandle, (PSTR)"RuleDef", v2, 0i64);
        if( !SectionLineIndex )
          goto LABEL_29;
        *((_DWORD *)v7 + 10) = strtoul(SectionLineIndex, 0i64, 10i64);
        v13 = CmpGetSectionLineIndex(ParsedInfHandle, (PSTR)"RuleDef", v2, 1ui64);
        if( !v13 )
          goto LABEL_29;
        *((_DWORD *)v7 + 11) = strtoul(v13, 0i64, 10i64);
        SectionLineIndexValueCount = CmpGetSectionLineIndexValueCount(ParsedInfHandle, (PSTR)"RuleDef", v2);
        v15 = SectionLineIndexValueCount;
        if( SectionLineIndexValueCount < 2 )
          goto LABEL_29;
        v16 = SectionLineIndexValueCount == 2;
        v17 = SectionLineIndexValueCount - 2;
        *((_DWORD *)v7 + 12) = v17;
        if( !v16 )
        {
          v19 = ExAllocatePoolWithTag(1ui64, 8i64 * v17, 1953058117i64);
          v7[7] = v19;
          if( !v19 )
          {
            ExFreePoolWithTag(v7, 0x74694D45u);
            return -1073741670;
          }
          memset(v19, 0i64, 8 * *((_DWORD *)v7 + 12));
          v20 = 2;
          if( v15 > 2 )
          {
            while( 1 )
            {
              v21 = CmpGetSectionLineIndex(ParsedInfHandle, (PSTR)"RuleDef", v2, v20);
              GuidFromName = EmpInfParseGetGuidFromName(ParsedInfHandle, (PSTR)"EntryTypeGuidDef", v21, &NameGuid);
              if( GuidFromName < 0 )
                break;
              v22 = EmpSearchEntryDatabase(&NameGuid);
              if( !v22 )
                break;
              v23 = v22 + 9;
              *((_QWORD *)v7[7] + v20 - 2) = v22;
              if( !EmpInfParseSearchDependencyList(v22 + 9, (_EMP_RULE_DB_RECORD *)v7) )
              {
                v24 = ExAllocatePoolWithTag(1ui64, 0x18ui64, 1953058117i64);
                if( !v24 )
                {
                  GuidFromName = -1073741670;
LABEL_22:
                  v4 = SectionLineCount;
                  goto LABEL_23;
                }
                *v24 = v7;
                v24[1] = v23->Next;
                v23->Next = (_SINGLE_LIST_ENTRY *)(v24 + 1);
              }
              if( ++v20 >= v15 )
                goto LABEL_22;
            }
            v4 = SectionLineCount;
LABEL_32:
            v16 = v20 == 2;
            v27 = v20 - 2;
            if( !v16 )
            {
              v28 = 0i64;
              do
              {
                v29 = *(_QWORD *)((char *)v7[7] + v28);
                v30 = *(_QWORD **)(v29 + 72);
                if( (VOID **)*(v30 - 1) == v7 )
                {
                  if( v30 )
                    *(_QWORD *)(v29 + 72) = *v30;
                  ExFreePoolWithTag(v30 - 1, 0x74694D45u);
                }
                v28 += 8i64;
                --v27;
              }
              while( v27 );
            }
            goto LABEL_27;
          }
LABEL_23:
          if( GuidFromName < 0 )
            goto LABEL_32;
        }
        GuidFromName = EmpParseRuleExpression(ParsedInfHandle, KeyName, (_EMP_RULE_DB_RECORD *)v7);
        if( GuidFromName < 0 )
        {
          for( i = 0; i < *((_DWORD *)v7 + 12); ++i )
          {
            v31 = *((_QWORD *)v7[7] + i);
            v32 = *(_QWORD **)(v31 + 72);
            if( (VOID **)*(v32 - 1) == v7 )
            {
              if( v32 )
                *(_QWORD *)(v31 + 72) = *v32;
              ExFreePoolWithTag(v32 - 1, 0x74694D45u);
            }
          }
LABEL_27:
          v26 = v7[7];
          if( v26 )
            ExFreePoolWithTag(v26, 0x74694D45u);
LABEL_29:
          ExFreePoolWithTag(v7, 0x74694D45u);
          GuidFromName = 0;
          goto LABEL_12;
        }
        ++dword_140C50884;
        v7[3] = (VOID *)EmpRuleListHead;
        EmpRuleListHead = (__int64)(v7 + 3);
      }
LABEL_12:
      ++v2;
    }
    while( v2 < v4 );
  }
  return GuidFromName;
}

Referenced by: