EmpParseRules

INT64 __fastcall EmpParseRules(VOID *ParsedInfHandle){
  unsigned int v2; 
  int GuidFromName; 
  unsigned int v4; 
  CHAR *KeyName; 
  _QWORD *PoolWithTag; 
  __int64 v7; 
  GUID *v8; 
  _QWORD *v9; 
  void *v10; 
  CHAR *SectionLineIndex; 
  CHAR *v12; 
  unsigned int SectionLineIndexValueCount; 
  UINT64 *v14; 
  unsigned int v15; 
  bool v16; 
  unsigned int v17; 
  VOID *v19; 
  unsigned int v20; 
  CHAR *v21; 
  SINGLE_LIST_ENTRY *v22; 
  SINGLE_LIST_ENTRY *v23; 
  _SINGLE_LIST_ENTRY *v24; 
  unsigned int i; 
  void *v26; 
  __int64 v27; 
  __int64 v28; 
  __int64 v29; 
  _QWORD *v30; 
  __int64 v31; 
  _QWORD *v32; 
  unsigned int SectionLineCount; 
  GUID NameGuid; 
  NameGuid = 0i64;
  v2 = 0;
  GuidFromName = 0;
  SectionLineCount = EmpInfParseGetSectionLineCount(ParsedInfHandle, (PSTR)"RuleDef");
  v4 = SectionLineCount;
  if( SectionLineCount )
  {
    do
    {
      KeyName = CmpGetKeyName(ParsedInfHandle, (CHAR *)"RuleDef", v2);
      if( !KeyName )
        return 0;
      PoolWithTag = ExAllocatePoolWithTag(PagedPool, 0x68ui64, 0x74694D45ui64);
      v7 = (__int64)PoolWithTag;
      if( !PoolWithTag )
        return(unsigned int)-1073741670;
      PoolWithTag[7] = 0i64;
      *((_DWORD *)PoolWithTag + 4) = 1;
      v8 = (GUID *)PoolWithTag;
      *((_BYTE *)PoolWithTag + 20) = 0;
      PoolWithTag[8] = 0i64;
      PoolWithTag[9] = 0i64;
      PoolWithTag[4] = 0i64;
      v9 = PoolWithTag + 10;
      v9[1] = v9;
      *v9 = v9;
      *(_DWORD *)(v7 + 48) = 0;
      *(_DWORD *)(v7 + 40) = 0;
      GuidFromName = EmpInfParseGetGuidFromName(ParsedInfHandle, (PSTR)"RuleNameGuidDef", KeyName, v8);
      v10 = (void *)v7;
      if( GuidFromName < 0 || EmpSearchRuleDatabase((const GUID *)v7) )
      {
        ExFreePoolWithTag(v10, 0x74694D45u);
      }
      else
      {
        SectionLineIndex = CmpGetSectionLineIndex(ParsedInfHandle, (PSTR)"RuleDef", v2, 0i64);
        if( !SectionLineIndex )
          goto LABEL_29;
        *(_DWORD *)(v7 + 40) = strtoul(SectionLineIndex, 0i64, 10i64);
        v12 = CmpGetSectionLineIndex(ParsedInfHandle, (PSTR)"RuleDef", v2, 1ui64);
        if( !v12 )
          goto LABEL_29;
        *(_DWORD *)(v7 + 44) = strtoul(v12, 0i64, 10i64);
        SectionLineIndexValueCount = CmpGetSectionLineIndexValueCount(ParsedInfHandle, (CHAR *)"RuleDef", v2);
        v15 = SectionLineIndexValueCount;
        if( SectionLineIndexValueCount < 2 )
          goto LABEL_29;
        v16 = SectionLineIndexValueCount == 2;
        v17 = SectionLineIndexValueCount - 2;
        *(_DWORD *)(v7 + 48) = v17;
        if( !v16 )
        {
          v19 = ExAllocatePoolWithTag(PagedPool, 8i64 * v17, 0x74694D45ui64);
          *(_QWORD *)(v7 + 56) = v19;
          if( !v19 )
          {
            ExFreePoolWithTag((PVOID)v7, 0x74694D45u);
            return(unsigned int)-1073741670;
          }
          memset((INT64)v19, 0i64);
          v20 = 2;
          if( v15 > 2 )
          {
            while( 1 )
            {
              v21 = CmpGetSectionLineIndex(ParsedInfHandle, (PSTR)"RuleDef", v2, v20);
              GuidFromName = EmpInfParseGetGuidFromName(ParsedInfHandle, (PSTR)"EntryTypeGuidDef", v21, &NameGuid);
              if( GuidFromName < 0 )
                break;
              v22 = EmpSearchEntryDatabase(&NameGuid);
              if( !v22 )
                break;
              v23 = v22 + 9;
              *(_QWORD *)(*(_QWORD *)(v7 + 56) + 8i64 * (v20 - 2)) = v22;
              if( !EmpInfParseSearchDependencyList(&v22[9], v7) )
              {
                v24 = (_SINGLE_LIST_ENTRY *)ExAllocatePoolWithTag(PagedPool, 0x18ui64, 0x74694D45ui64);
                if( !v24 )
                {
                  GuidFromName = -1073741670;
LABEL_22:
                  v4 = SectionLineCount;
                  goto LABEL_23;
                }
                v24->Next = (_SINGLE_LIST_ENTRY *)v7;
                v24[1].Next = v23->Next;
                v23->Next = v24 + 1;
              }
              if( ++v20 >= v15 )
                goto LABEL_22;
            }
            v4 = SectionLineCount;
LABEL_32:
            v16 = v20 == 2;
            v27 = v20 - 2;
            if( !v16 )
            {
              v28 = 0i64;
              do
              {
                v29 = *(_QWORD *)(v28 + *(_QWORD *)(v7 + 56));
                v30 = *(_QWORD **)(v29 + 72);
                if( *(v30 - 1) == v7 )
                {
                  if( v30 )
                    *(_QWORD *)(v29 + 72) = *v30;
                  ExFreePoolWithTag(v30 - 1, 0x74694D45u);
                }
                v28 += 8i64;
                --v27;
              }
              while( v27 );
            }
            goto LABEL_27;
          }
LABEL_23:
          if( GuidFromName < 0 )
            goto LABEL_32;
        }
        GuidFromName = EmpParseRuleExpression(ParsedInfHandle, KeyName, v7, v14);
        if( GuidFromName < 0 )
        {
          for( i = 0; i < *(_DWORD *)(v7 + 48); ++i )
          {
            v31 = *(_QWORD *)(*(_QWORD *)(v7 + 56) + 8i64 * i);
            v32 = *(_QWORD **)(v31 + 72);
            if( *(v32 - 1) == v7 )
            {
              if( v32 )
                *(_QWORD *)(v31 + 72) = *v32;
              ExFreePoolWithTag(v32 - 1, 0x74694D45u);
            }
          }
LABEL_27:
          v26 = *(void **)(v7 + 56);
          if( v26 )
            ExFreePoolWithTag(v26, 0x74694D45u);
LABEL_29:
          ExFreePoolWithTag((PVOID)v7, 0x74694D45u);
          GuidFromName = 0;
          goto LABEL_12;
        }
        ++EmpNumberOfRules;
        *(_QWORD *)(v7 + 24) = EmpRuleListHead;
        EmpRuleListHead = v7 + 24;
      }
LABEL_12:
      ++v2;
    }
    while( v2 < v4 );
  }
  return(unsigned int)GuidFromName;
}

Referenced by: