SdbQueryDataExTagID

NTSTATUS __fastcall SdbQueryDataExTagID(
        _DB *pdb,
        UINT64 tiExe,
        const WCHAR *lpszDataName,
        UINT64 *lpdwDataType,
        VOID *lpBuffer,
        UINT64 *lpcbBufferSize,
        UINT64 *ptiData){
  int DWORDTag; 
  WORD *v8; 
  unsigned int v9; 
  __int64 v11; 
  int v12; 
  UINT64 v13; 
  WCHAR *v14; 
  WCHAR *pszName; 
  WORD *v16; 
  WORD *v17; 
  unsigned int FirstNamedTag; 
  unsigned int FirstTag; 
  unsigned int TagDataSize; 
  __int64 *StringTagPtr; 
  UINT16 v22; 
  unsigned int v23; 
  NTSTATUS v24; 
  __int64 v26; 
  INT8 *v27; 
  UINT64 v28; 
  __int64 v29; 
  WCHAR *P; 
  __int64 QWORDTag; 
  int Src; 
  int v33; 
  UINT64 *v34; 

  v34 = lpdwDataType;
  v33 = HIDWORD(lpszDataName);
  DWORDTag = 0;
  v8 = (WORD *)L"Policy";
  v9 = tiExe;
  Src = 0;
  QWORDTag = 0i64;
  if( __PAIR128__((unsigned __int64)lpcbBufferSize, (unsigned __int64)lpBuffer) == 0 )
  {
    AslLogCallPrintf(
      1ui64,
      (INT8 *)"SdbQueryDataExTagID",
      0x1546ui64,
      (INT8 *)"One of lpBuffer or lpcbBufferSize should not be null");
    return 87;
  }
  v11 = -1i64;
  do
    ++v11;
  while( aPolicy[v11] );
  v12 = v11 + 1;
  v13 = v12;
  v14 = (WCHAR *)AslAlloc(pdb, 2 * v12, (INT64)lpszDataName);
  P = v14;
  if( !v14 )
  {
    AslLogCallPrintf(
      1ui64,
      (INT8 *)"SdbQueryDataExTagID",
      0x1552ui64,
      (INT8 *)"Cannot allocate temporary buffer for parsing the name \"%ws\"");
    return 8;
  }
  pszName = v14;
  while( 1 )
  {
    v16 = wcschr(v8, 92);
    v17 = v16;
    if( v16 )
    {
      v26 = v16 - v8;
      if( RtlStringCchCopyNW(P, v13, v8, v26) < 0 )
      {
LABEL_62:
        v24 = 122;
        goto LABEL_33;
      }
      P[v26] = 0;
      v8 = v17 + 1;
      pszName = P;
    }
    else
    {
      if( RtlStringCchCopyW(pszName, v13, v8) < 0 )
        goto LABEL_62;
      v8 = 0i64;
    }
    FirstNamedTag = SdbFindFirstNamedTag(pdb, v9, 0x700Fu, 0x6001u, pszName);
    v9 = FirstNamedTag;
    if( !v8 || !*v8 )
      break;
    if( !FirstNamedTag )
      goto LABEL_45;
  }
  if( !FirstNamedTag )
  {
LABEL_45:
    v24 = 1168;
    goto LABEL_33;
  }
  FirstTag = SdbFindFirstTag(pdb, FirstNamedTag, 0x4018u);
  if( FirstTag )
    DWORDTag = SdbReadDWORDTag(pdb, FirstTag, 0);
  else
    AslLogCallPrintf(
      1ui64,
      (INT8 *)"SdbQueryDataExTagID",
      0x1583ui64,
      (INT8 *)"The entry 0x%x does not have valuetype information");
  TagDataSize = 0;
  StringTagPtr = 0i64;
  switch( DWORDTag )
  {
    case 0:
      goto LABEL_54;
    case 1:
      v22 = 24606;
      break;
    case 3:
      v22 = -28667;
      break;
    case 4:
      v22 = 16409;
      break;
    case 11:
      v22 = 20487;
      break;
    default:
      AslLogCallPrintf(
        1ui64,
        (INT8 *)"SdbQueryDataExTagID",
        0x15A8ui64,
        (INT8 *)"The entry 0x%x contains bad valuetype information 0x%x");
      v24 = 1358;
      goto LABEL_33;
  }
  v23 = SdbFindFirstTag(pdb, v9, v22);
  if( !v23 )
  {
    AslLogCallPrintf(1ui64, (INT8 *)"SdbQueryDataExTagID", 0x15B4ui64, (INT8 *)"The entry 0x%x contains no value");
    goto LABEL_45;
  }
  switch( DWORDTag )
  {
    case 1:
      StringTagPtr = (__int64 *)SdbGetStringTagPtr(pdb, v23);
      if( StringTagPtr )
      {
        v29 = -1i64;
        do
          ++v29;
        while( *((_WORD *)StringTagPtr + v29) );
        TagDataSize = 2 * v29 + 2;
        goto LABEL_54;
      }
      v27 = (INT8 *)"The entry 0x%x contains bad string value 0x%x";
      v28 = 5572i64;
      goto LABEL_44;
    case 3:
      TagDataSize = SdbGetTagDataSize(pdb, v23);
      StringTagPtr = (__int64 *)SdbpGetMappedTagData(pdb, v23);
      if( StringTagPtr )
        goto LABEL_54;
      v27 = "The entry 0x%x contains bad binary value 0x%x";
      v28 = 5586i64;
LABEL_44:
      AslLogCallPrintf(1ui64, (INT8 *)"SdbQueryDataExTagID", v28, v27);
      goto LABEL_45;
    case 4:
      Src = SdbReadDWORDTag(pdb, v23, 0);
      StringTagPtr = (__int64 *)&Src;
      TagDataSize = 4;
      goto LABEL_23;
  }
  QWORDTag = SdbReadQWORDTag(pdb, v23, 0i64);
  StringTagPtr = &QWORDTag;
  TagDataSize = 8;
LABEL_54:
  v24 = 0;
  if( TagDataSize )
  {
LABEL_23:
    if( lpBuffer && lpcbBufferSize && *(_DWORD *)lpcbBufferSize >= TagDataSize )
    {
      memmove(lpBuffer, StringTagPtr, *(_DWORD *)lpcbBufferSize);
      v24 = 0;
    }
    else
    {
      v24 = 122;
    }
  }
  if( lpcbBufferSize )
    *(_DWORD *)lpcbBufferSize = TagDataSize;
  if( v34 )
    *(_DWORD *)v34 = DWORDTag;
  if( ptiData )
    *(_DWORD *)ptiData = v9;
LABEL_33:
  ExFreePoolWithTag(P, 0x74705041u);
  return v24;
}

Referenced by: