RtlDecompressFragmentLZNT1
INT64 __stdcall RtlDecompressFragmentLZNT1(
UINT8 *UncompressedFragment,
UINT64 UncompressedFragmentSize,
UINT8 *CompressedBuffer,
UINT64 CompressedBufferSize){
UINT8 *v4;
UINT8 *v5;
UINT8 *v6;
NTSTATUS v7;
__int16 v8;
UINT8 *v9;
unsigned int v10;
__int64 v11;
__int64 v12;
int v13;
unsigned int v14;
__int64 v15;
bool v16;
UINT8 *v18;
UINT64 v19;
int v20;
INT64 a6;
UINT8 *EndOfUncompressedBufferPlus1;
struct _KEVENT Event;
__int64 v24;
int v25;
unsigned int v26;
INT32 FinalUncompressedChunkSize;
size_t Size;
int v29;
INT64 v30;
__int64 v31;
BYTE *UncompressedBuffer;
v26 = UncompressedFragmentSize;
v25 = (int)UncompressedFragment;
v4 = CompressedBuffer;
EndOfUncompressedBufferPlus1 = &UncompressedFragment[(unsigned int)UncompressedFragmentSize];
v5 = UncompressedFragment;
LODWORD(Size) = 0;
v6 = &CompressedBuffer[(unsigned int)CompressedBufferSize];
memset(&Event, 0, sizeof(Event));
v7 = 0;
KeInitializeEvent(&Event, SynchronizationEvent, 0);
v8 = *(_WORD *)v4;
v24 = 1i64;
v9 = v4;
v10 = v29;
while( 1 )
{
FinalUncompressedChunkSize = 4096;
v11 = (v8 & 0xFFFu) + 3;
if( v10 < 0x1000 )
break;
v9 += v11;
if( v9 > v6 )
goto LABEL_41;
v10 -= 4096;
v4 = v9;
if( v9 <= v6 - 2 )
{
v8 = *(_WORD *)v9;
if( *(_WORD *)v9 )
continue;
}
*(_DWORD *)v31 = 0;
goto LABEL_19;
}
v12 = (unsigned int)v11;
if( &v9[v11] > v6 )
{
LABEL_41:
v7 = -1073741246;
*(_DWORD *)v31 = (_DWORD)v4;
goto LABEL_19;
}
v13 = v30;
v14 = v26;
while( 1 )
{
v15 = 4096 - v10;
if( (unsigned int)v15 >= v14 )
v15 = v14;
LODWORD(Size) = v15;
if( v8 >= 0 )
{
v19 = (unsigned int)v15;
if( &v4[v10 + 2 + v15] > v6 )
goto LABEL_41;
v18 = &v4[v10 + 2];
LABEL_32:
memmove(v5, v18, v19);
goto LABEL_13;
}
if( v10 || (_DWORD)v15 != 4096 )
break;
if( v13 )
{
LODWORD(a6) = v13;
v7 = LZNT1DecompressChunkNewThread((INT64)&Event, v5, EndOfUncompressedBufferPlus1, v4 + 2, (INT64)&v4[v12], a6);
if( v7 < 0 )
goto LABEL_35;
LODWORD(Size) = v13;
}
else
{
v7 = LZNT1DecompressChunk(v5, EndOfUncompressedBufferPlus1, v4 + 2, (INT64)&v4[v12], (INT32 *)&Size);
if( v7 < 0 )
{
LABEL_35:
v20 = Size;
goto LABEL_39;
}
}
LABEL_13:
v10 = 0;
v5 += (unsigned int)Size;
v16 = v26 == (_DWORD)Size;
v14 = v26 - Size;
v26 -= Size;
if( v16 )
goto LABEL_18;
v4 += v12;
if( v4 > v6 - 2 )
goto LABEL_18;
v8 = *(_WORD *)v4;
if( !*(_WORD *)v4 )
goto LABEL_18;
FinalUncompressedChunkSize = 4096;
v12 = (v8 & 0xFFF) + 3i64;
if( &v4[v12] > v6 )
goto LABEL_41;
}
v7 = LZNT1DecompressChunk(
UncompressedBuffer,
UncompressedBuffer + 4096,
v4 + 2,
(INT64)&v4[v12],
&FinalUncompressedChunkSize);
if( v7 >= 0 )
{
v18 = &UncompressedBuffer[v10];
if( FinalUncompressedChunkSize - v10 < (unsigned int)Size )
{
memmove(v5, v18, FinalUncompressedChunkSize - v10);
LODWORD(v5) = FinalUncompressedChunkSize - v10 + (_DWORD)v5;
LABEL_18:
*(_DWORD *)v31 = (_DWORD)v5 - v25;
goto LABEL_19;
}
v19 = (unsigned int)Size;
goto LABEL_32;
}
v20 = FinalUncompressedChunkSize;
LABEL_39:
*(_DWORD *)v31 = v20;
LABEL_19:
if( _InterlockedExchangeAdd((volatile signed __int32 *)&v24, 0xFFFFFFFF) == 1 )
KeSetEvent(&Event, 0);
KeWaitForSingleObject(&Event, Executive, 0, 0, 0i64);
if( v7 >= 0 && v24 < 0 )
return(unsigned int)HIDWORD(v24);
return(unsigned int)v7;
}Referenced by:
No references.