RtlpIsNameInExpressionPrivate
UINT8 __stdcall RtlpIsNameInExpressionPrivate(
_UNICODE_STRING *Expression,
_UNICODE_STRING *Name,
UINT8 IgnoreCase,
WCHAR *UpcaseTable){
__int64 Length;
unsigned __int16 v5;
char v6;
_UNICODE_STRING *v8;
_UNICODE_STRING *v9;
unsigned __int16 v10;
__int16 v11;
__int16 *v12;
unsigned int v13;
unsigned __int16 v14;
unsigned __int64 v15;
__int64 v16;
unsigned int v17;
unsigned int v18;
__int64 v19;
unsigned int v20;
__int16 v21;
__int16 *v22;
unsigned int v23;
__int16 v24;
__int64 v25;
UINT8 v26;
__int64 v27;
__int64 v28;
__int16 v29;
bool v30;
wchar_t v31;
__int64 v32;
__int64 v33;
unsigned __int16 v34;
__int64 v35;
__int16 v36;
_UNICODE_STRING v39;
unsigned __int16 MaximumLength;
unsigned __int16 v41;
unsigned __int64 v42;
__int64 v43;
unsigned __int64 v44;
unsigned __int16 v45;
__int64 v46;
VOID **PoolWithTag;
__int64 v48;
__int128 v49;
__int128 v50;
__int16 *v51;
__int128 v52;
char v53;
__int16 v54;
wchar_t v56;
char v57;
unsigned __int16 v58;
_UNICODE_STRING Namea;
_UNICODE_STRING *v60;
_UNICODE_STRING *v61;
PVOID P;
unsigned int v63;
__int16 v64;
char v65;
__int64 v66;
Length = Name->Length;
v5 = 0;
v57 = (char)UpcaseTable;
v6 = (char)UpcaseTable;
v60 = Name;
v8 = Name;
v61 = Expression;
v9 = Expression;
v56 = 0;
P = 0i64;
v53 = 0;
if( !(_WORD)Length )
return Expression->Length + (_DWORD)Length == 0;
v10 = Expression->Length;
if( !Expression->Length )
return Expression->Length + (_DWORD)Length == 0;
if( v10 == 2 && *Expression->Buffer == 42 )
return 1;
if( *Expression->Buffer == 42 )
{
v39 = *Expression;
*(_DWORD *)(&Namea.MaximumLength + 1) = HIDWORD(*(_QWORD *)&Expression->Length);
MaximumLength = v39.MaximumLength;
v41 = v39.Length;
v42 = _mm_srli_si128((__m128i)v39, 8).m128i_u64[0];
v43 = (unsigned __int16)(v41 - 2);
Namea.Length = v43;
Namea.MaximumLength = MaximumLength - 2;
Namea.Buffer = (wchar_t *)(v42 + 2);
if( !RtlDoesNameContainWildCards(&Namea) )
{
if( (unsigned __int16)Length < (unsigned __int16)(v10 - 2) )
return 0;
v44 = (Length - (unsigned __int64)(unsigned __int16)v43) >> 1;
if( !IgnoreCase )
return memcmp((const VOID *)(v42 + 2), &v60->Buffer[(unsigned int)v44], (unsigned __int16)v43) == 0;
v45 = (unsigned __int16)v43 >> 1;
if( v45 )
{
do
{
v46 = *(unsigned __int16 *)(v42 + 2 + 2i64 * v5);
if( v6 )
LOWORD(v46) = *(_WORD *)(v66 + 2 * v46);
if( *(_WORD *)(v66 + 2i64 * v60->Buffer[(unsigned int)v44 + v5]) != (_WORD)v46 )
return 0;
++v5;
}
while( v5 < v45 );
}
return 1;
}
v9 = v61;
v8 = v60;
}
v64 = 0;
v11 = 2 * v10;
*(_QWORD *)&Namea.Length = &v65;
v54 = v11;
v12 = &v64;
v13 = 1;
v58 = 0;
v14 = 0;
while( 2 )
{
if( v14 >= v8->Length )
{
v53 = 1;
if( v12[v13 - 1] == v11 )
{
LABEL_49:
v36 = v12[v13 - 1];
if( P )
ExFreePoolWithTag(P, 0);
return v36 == v11;
}
}
else
{
v15 = (unsigned __int64)v14 >> 1;
v14 += 2;
v58 = v14;
v56 = v8->Buffer[v15];
}
LODWORD(v16) = 0;
v17 = 0;
v18 = 0;
while( 2 )
{
v19 = (unsigned int)v16;
v16 = (unsigned int)(v16 + 1);
v20 = ((unsigned int)(unsigned __int16)v12[v19] + 1) >> 1;
v21 = 0;
v22 = *(__int16 **)&Namea.Length;
while( 1 )
{
v23 = v9->Length;
if( (_WORD)v20 == (_WORD)v23 )
goto LABEL_27;
LOWORD(v20) = v21 + v20;
v24 = 2 * v20;
if( (_WORD)v20 == (_WORD)v23 )
break;
v25 = v9->Buffer[(unsigned __int64)(unsigned __int16)v20 >> 1];
v26 = IgnoreCase;
if( IgnoreCase && v57 )
LOWORD(v25) = *(_WORD *)(v66 + 2 * v25);
if( v17 >= 0xE && !P )
{
v63 = v23 >> 1;
PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 8i64 * ((v23 >> 1) + 1), 1852986182i64);
P = PoolWithTag;
if( !PoolWithTag )
RtlRaiseStatus(-1073741801);
v48 = *(_QWORD *)&Namea.Length;
v22 = (__int16 *)PoolWithTag;
v9 = v61;
v14 = v58;
v8 = v60;
v49 = *(_OWORD *)*(_QWORD *)&Namea.Length;
*(_QWORD *)&Namea.Length = PoolWithTag;
*(_OWORD *)PoolWithTag = v49;
v50 = *(_OWORD *)(v48 + 16);
LODWORD(v48) = v63;
*((_OWORD *)PoolWithTag + 1) = v50;
v51 = (__int16 *)PoolWithTag + (unsigned int)(2 * v48 + 2);
v26 = IgnoreCase;
*(_OWORD *)v51 = *(_OWORD *)v12;
v52 = *((_OWORD *)v12 + 1);
v12 = v51;
*((_OWORD *)v51 + 1) = v52;
}
if( (_WORD)v25 == 42 )
goto LABEL_17;
if( (_WORD)v25 == 60 )
{
if( v56 != 46 || v53 )
goto LABEL_17;
v34 = v14;
if( v14 >= v8->Length )
{
LABEL_47:
v9 = v61;
v35 = v17++;
v22[v35] = v24 + 3;
v21 = 2;
}
else
{
while( v8->Buffer[(unsigned __int64)v34 >> 1] != 46 )
{
v34 += 2;
if( v34 >= v8->Length )
goto LABEL_47;
}
v9 = v61;
LABEL_17:
v27 = v17;
v28 = v17 + 1;
v22[v27] = v24;
v21 = 2;
v22[v28] = v24 + 3;
v17 = v28 + 1;
}
}
else
{
v29 = v24 + 4;
if( (_WORD)v25 == 62 )
{
v21 = 2;
if( !v53 )
{
if( v56 != 46 )
goto LABEL_41;
v21 = 2;
}
}
else
{
if( (_WORD)v25 != 34 )
{
if( !v53 )
{
v30 = (_WORD)v25 == 63;
goto LABEL_23;
}
goto LABEL_27;
}
if( !v53 )
{
v30 = v56 == 46;
LABEL_23:
if( v30 || (!v26 ? (v31 = v56) : (v31 = *(_WORD *)(v66 + 2i64 * v56)), (_WORD)v25 == v31) )
{
LABEL_41:
v33 = v17++;
v22[v33] = v29;
}
LABEL_27:
v11 = v54;
goto LABEL_28;
}
v21 = 2;
}
}
}
v11 = v54;
v32 = v17++;
v22[v32] = v54;
LABEL_28:
if( (unsigned int)v16 < v13 )
{
while( v18 < v17 )
{
do
{
if( (unsigned __int16)v12[v16] >= (unsigned __int16)v22[v18] )
break;
v16 = (unsigned int)(v16 + 1);
}
while( (unsigned int)v16 < v13 );
++v18;
if( (unsigned int)v16 >= v13 )
goto LABEL_29;
}
continue;
}
break;
}
LABEL_29:
if( v17 )
{
v13 = v17;
*(_QWORD *)&Namea.Length = v12;
v12 = v22;
if( v53 )
goto LABEL_49;
continue;
}
break;
}
if( P )
ExFreePoolWithTag(P, 0);
return 0;
}Referenced by:
RtlIsNameInExpression
RtlIsNameInUnUpcasedExpression