SdbpResolveMatchingFile

INT64 __fastcall SdbpResolveMatchingFile(INT64 a1, INT64 a2, const WCHAR *a3, UINT64 a4, INT64 a5, WCHAR **a6){
  WCHAR **v6; 
  int v7; 
  unsigned int v11; 
  INT64 v12; 
  int ProcessWowInfo; 
  NTSTATUS v14; 
  ULONGLONG v15; 
  VOID *v16; 
  INT64 v17; 
  UINT64 v18; 
  UINT8 *v19; 
  WCHAR *v20; 
  int v21; 
  __int16 v22; 
  UINT64 v23; 
  NTSTATUS v24; 
  __int64 v25; 
  unsigned __int64 v27; 
  unsigned __int64 v28; 
  UINT64 v29; 
  const CHAR *v30; 
  UINT64 v31; 
  UINT64 *ReturnedLength; 
  INT64 ResolveForWow64; 
  INT64 ResolveForWow64a; 
  __int16 v35; 
  ULONGLONG pullResult; 
  WCHAR *NetworkPathNtOut; 
  __int16 v40; 
  v6 = a6;
  v7 = a4;
  pullResult = 0i64;
  NetworkPathNtOut = 0i64;
  *a6 = 0i64;
  v40 = -1;
  v11 = 0;
  LOWORD(a6) = -1;
  if( !(_DWORD)a4 )
  {
    AslLogCallPrintf(1ui64, "SdbpResolveMatchingFile", 0x231ui64, "Invalid match file length");
    return v11;
  }
  v12 = a5;
  if( *a3 != 37 )
  {
    v27 = *(unsigned int *)(a5 + 8);
    v28 = v27 + (unsigned int)a4;
    if( v28 >= v27 )
    {
      v15 = v28 + 1;
      if( v28 + 1 >= v28 )
        goto LABEL_6;
      v29 = 617i64;
    }
    else
    {
      v29 = 612i64;
    }
LABEL_43:
    AslLogCallPrintf(1ui64, "SdbpResolveMatchingFile", v29, "Invalid path size");
    return v11;
  }
  ProcessWowInfo = AslEnvGetProcessWowInfo(&a6, &v40);
  if( ProcessWowInfo < 0 )
  {
    AslLogCallPrintf(1ui64, "SdbpResolveMatchingFile", 0x246ui64, "AslEnvGetProcessWowInfo failed [%x]", ProcessWowInfo);
    return v11;
  }
  AslImageFileToArchitecture(*(_WORD *)(a1 + 576));
  LOWORD(ResolveForWow64) = (_WORD)a6;
  v14 = AslEnvExpandStrings2(*(PVOID *)(a2 + 56), (PWCHAR)a3, 0i64, 0i64, &pullResult, ResolveForWow64);
  if( (int)(v14 + 0x80000000) >= 0 && v14 != -1073741789 )
  {
    LODWORD(ReturnedLength) = v14;
    AslLogCallPrintf(1ui64, "SdbpResolveMatchingFile", 0x257ui64, "AslEnvExpandStrings2 failed [%x]", ReturnedLength);
    return v11;
  }
  v15 = 2 * pullResult;
LABEL_6:
  if( v15 + 20 < v15 )
  {
    v29 = 623i64;
    goto LABEL_43;
  }
  pullResult = v15 + 20;
  if( RtlULongLongMult(v15 + 20, 2ui64, &pullResult) < 0 )
  {
    AslLogCallPrintf(1ui64, "SdbpResolveMatchingFile", 0x274ui64, "Invalid buffer size");
    return v11;
  }
  v18 = pullResult;
  if( pullResult < 0x208 )
    v18 = 520i64;
  v19 = (UINT8 *)AslAlloc(v16, v18, v17);
  v20 = (WCHAR *)v19;
  if( !v19 )
  {
    AslLogCallPrintf(1ui64, "SdbpResolveMatchingFile", 0x27Cui64, "Out of memory");
    return v11;
  }
  if( *a3 != 37 )
  {
    memmove(v19, *(UINT8 **)v12, 2i64 * *(unsigned int *)(v12 + 8));
    memmove((UINT8 *)&v20[*(unsigned int *)(v12 + 8)], (UINT8 *)a3, 2i64 * (unsigned int)(v7 + 1));
    v23 = v18 >> 1;
    goto LABEL_16;
  }
  v21 = AslEnvGetProcessWowInfo(&a6, &v40);
  if( v21 < 0 )
  {
    v30 = "AslEnvGetProcessWowInfo failed [%x]";
    v31 = 648i64;
LABEL_38:
    LODWORD(ReturnedLength) = v21;
    AslLogCallPrintf(1ui64, "SdbpResolveMatchingFile", v31, v30, ReturnedLength);
    goto LABEL_23;
  }
  v22 = AslImageFileToArchitecture(*(_WORD *)(a1 + 576));
  if( v22 == -1 )
    v22 = v40;
  v35 = v22;
  LOWORD(ResolveForWow64) = (_WORD)a6;
  v23 = v18 >> 1;
  v24 = AslEnvExpandStrings2(*(PVOID *)(a2 + 56), (PWCHAR)a3, v20, v23, &pullResult, ResolveForWow64);
  if( v24 >= 0 )
  {
LABEL_16:
    v21 = AslPathClean(v20, v20, v23);
    if( v21 >= 0 )
    {
      if( (int)AslPathToNetworkPathNt(&NetworkPathNtOut, v20) >= 0 )
      {
        ExFreePoolWithTag(v20, 0x74705041u);
        v20 = NetworkPathNtOut;
      }
      else if( wcsnicmp(v20, L"\\??\\", 4ui64) )
      {
        v25 = -1i64;
        do
          ++v25;
        while( v20[v25] );
        memmove((UINT8 *)v20 + 8, (UINT8 *)v20, 2 * v25 + 2);
        *(_QWORD *)v20 = *(_QWORD *)L"\\??\\";
      }
      *v6 = v20;
      v11 = 1;
      v20 = 0i64;
      goto LABEL_23;
    }
    v30 = "AslPathClean failed [%x]";
    v31 = 690i64;
    goto LABEL_38;
  }
  LODWORD(ResolveForWow64a) = v24;
  AslLogCallPrintf(
    1ui64,
    "SdbpResolveMatchingFile",
    0x299ui64,
    "AslEnvExpandStrings2 failed to expand strings for %ws [%x]",
    a3,
    ResolveForWow64a,
    v35);
LABEL_23:
  if( v20 )
    ExFreePoolWithTag(v20, 0x74705041u);
  return v11;
}

Referenced by: