SepReadAndPopulateCapes
NTSTATUS __stdcall SepReadAndPopulateCapes(HANDLE KeyHandle){
int v1;
unsigned int *v2;
char **v3;
char *v4;
char *PoolWithTag;
UINT8 *v6;
int v7;
ULONG v8;
NTSTATUS Key;
NTSTATUS v11;
unsigned int v12;
char v13;
ULONG v15;
unsigned int v16;
char *v17;
unsigned int v18;
UINT8 *v19;
char *v20;
UINT8 *v21;
__int16 v22;
UINT8 *v23;
__int64 v24;
NTSTATUS v25;
unsigned int v26;
UINT8 *v27;
unsigned int v28;
unsigned int v29;
unsigned int v30;
UINT8 *v31;
UINT8 *v32;
VOID *v33;
__int64 v34;
UINT8 *v35;
char v36;
ULONG Length;
HANDLE Handle;
unsigned int v39;
unsigned int v40;
unsigned __int64 v41;
unsigned int v42;
char **v43;
unsigned int *v44;
wchar_t pszDest[344];
char KeyInformation[560];
v43 = v3;
v4 = 0i64;
Length = 0;
v36 = 0;
PoolWithTag = KeyInformation;
v6 = 0i64;
Handle = 0i64;
v44 = v2;
v7 = v1;
v8 = 560;
Key = ZwQueryKey(KeyHandle, KeyFullInformation, KeyInformation, 0x230ui64, (UINT64 *)&Length);
v11 = Key;
if( Key >= 0 )
goto LABEL_2;
if( Key != -2147483643 && Key != -1073741789 )
goto LABEL_4;
PoolWithTag = (char *)ExAllocatePoolWithTag(PagedPool, Length, 0x70536553ui64);
if( !PoolWithTag )
{
v11 = -1073741670;
v13 = 0;
goto LABEL_15;
}
v8 = Length;
v36 = 1;
v11 = ZwQueryKey(KeyHandle, KeyFullInformation, PoolWithTag, Length, (UINT64 *)&Length);
if( v11 >= 0 )
{
LABEL_2:
v12 = *((_DWORD *)PoolWithTag + 5);
v40 = v12;
if( !v12 )
{
*v43 = 0i64;
*v44 = 0;
goto LABEL_4;
}
v15 = v7 + 18;
v16 = 56 * v12;
v6 = (UINT8 *)ExAllocatePoolWithTag(PagedPool, v15, 0x70536553ui64);
if( v6 )
{
v39 = 0;
if( v40 )
{
do
{
v11 = RtlStringCbPrintfW(pszDest, 0x157ui64, (WCHAR *)L"%s\\%d");
if( v11 < 0 )
goto LABEL_10;
v11 = SepRegOpenKey(pszDest, 0x201ui64, &Handle);
if( v11 < 0 )
goto LABEL_10;
v25 = ZwQueryKey(Handle, KeyFullInformation, PoolWithTag, v8, (UINT64 *)&Length);
v11 = v25;
if( v25 < 0 )
{
if( v25 != -2147483643 && v25 != -1073741789 )
goto LABEL_4;
v13 = v36;
if( v36 )
ExFreePoolWithTag(PoolWithTag, 0x70536553u);
PoolWithTag = (char *)ExAllocatePoolWithTag(PagedPool, Length, 0x70536553ui64);
if( !PoolWithTag )
{
v11 = -1073741670;
goto LABEL_15;
}
v8 = Length;
v36 = 1;
v11 = ZwQueryKey(Handle, KeyFullInformation, PoolWithTag, Length, (UINT64 *)&Length);
if( v11 < 0 )
goto LABEL_10;
}
v26 = *((_DWORD *)PoolWithTag + 10) + 18;
if( v26 > v15 )
{
LODWORD(v27) = SepRmCapPoolExpand(v6, v26);
v6 = v27;
if( !v27 )
goto LABEL_36;
v15 = v26;
}
v11 = ZwQueryValueKey(Handle, &CapeName, KeyValuePartialInformation, v6, v15, &Length);
if( v11 < 0 )
goto LABEL_10;
v28 = *((_DWORD *)v6 + 2) + ((v16 + 1) & 0xFFFFFFFE);
v11 = ZwQueryValueKey(Handle, &CapePredicate, KeyValuePartialInformation, v6, v15, &Length);
if( v11 < 0 )
goto LABEL_10;
v29 = *((_DWORD *)v6 + 2) + v28;
v11 = ZwQueryValueKey(Handle, &CapeSD, KeyValuePartialInformation, v6, v15, &Length);
if( v11 < 0 )
goto LABEL_10;
v30 = *((_DWORD *)v6 + 2) + ((v29 + 7) & 0xFFFFFFF8);
v11 = ZwQueryValueKey(Handle, &CapeStagedSD, KeyValuePartialInformation, v6, v15, &Length);
if( v11 < 0 )
goto LABEL_10;
v16 = *((_DWORD *)v6 + 2) + ((v30 + 7) & 0xFFFFFFF8);
ZwClose(Handle);
Handle = 0i64;
}
while( ++v39 < v40 );
}
v17 = (char *)ExAllocatePoolWithTag(PagedPool, v16, 0x70536553ui64);
v4 = v17;
if( v17 )
{
memset((INT64)v17, 0i64);
v18 = v40;
v41 = (unsigned __int64)&v4[v16];
v19 = (UINT8 *)&v4[56 * v40];
v39 = 0;
if( v40 )
{
v20 = v4 + 8;
do
{
v11 = RtlStringCbPrintfW(pszDest, 0x157ui64, (WCHAR *)L"%s\\%d");
if( v11 < 0 )
goto LABEL_10;
v11 = SepRegOpenKey(pszDest, 0x201ui64, &Handle);
if( v11 < 0 )
goto LABEL_10;
v11 = ZwQueryValueKey(Handle, &CapeFlags, KeyValuePartialInformation, v6, v15, &Length);
if( v11 < 0 )
goto LABEL_10;
if( *((_DWORD *)v6 + 2) != 4 )
{
v11 = -1073741811;
goto LABEL_10;
}
*(_DWORD *)&v4[56 * v39 + 48] = *((_DWORD *)v6 + 3);
v11 = ZwQueryValueKey(Handle, &CapeName, KeyValuePartialInformation, v6, v15, &Length);
if( v11 < 0 )
goto LABEL_10;
v21 = (UINT8 *)((unsigned __int64)(v19 + 1) & 0xFFFFFFFFFFFFFFFEui64);
if( (unsigned __int64)&v21[*((unsigned int *)v6 + 2)] > v41 )
goto LABEL_68;
v22 = *((_WORD *)v6 + 4);
*((_WORD *)v20 - 3) = v22;
*((_WORD *)v20 - 4) = v22;
*(_QWORD *)v20 = v21;
memmove(v21, v6 + 12, *((unsigned int *)v6 + 2));
v23 = &v21[*((unsigned int *)v6 + 2)];
v11 = ZwQueryValueKey(Handle, &CapePredicate, KeyValuePartialInformation, v6, v15, &Length);
if( v11 < 0 )
goto LABEL_10;
v24 = *((unsigned int *)v6 + 2);
if( (unsigned __int64)&v23[v24] > v41 )
goto LABEL_68;
*((_DWORD *)v20 + 2) = v24;
if( *((_DWORD *)v6 + 2) )
{
*((_QWORD *)v20 + 2) = v23;
memmove(v23, v6 + 12, *((unsigned int *)v6 + 2));
}
else
{
*((_QWORD *)v20 + 2) = 0i64;
}
v31 = &v23[*((unsigned int *)v6 + 2)];
v11 = ZwQueryValueKey(Handle, &CapeSD, KeyValuePartialInformation, v6, v15, &Length);
if( v11 < 0 )
goto LABEL_10;
v32 = (UINT8 *)((unsigned __int64)(v31 + 7) & 0xFFFFFFFFFFFFFFF8ui64);
if( (unsigned __int64)&v32[*((unsigned int *)v6 + 2)] > v41 )
goto LABEL_68;
*((_QWORD *)v20 + 3) = v32;
memmove(v32, v6 + 12, *((unsigned int *)v6 + 2));
v33 = (VOID *)*((_QWORD *)v20 + 3);
v42 = *((_DWORD *)v6 + 2);
if( !SeValidSecurityDescriptor(v42, v33) )
goto LABEL_64;
v11 = ZwQueryValueKey(Handle, &CapeStagedSD, KeyValuePartialInformation, v6, v15, &Length);
if( v11 < 0 )
goto LABEL_10;
v34 = *((unsigned int *)v6 + 2);
v35 = (UINT8 *)((unsigned __int64)&v32[v42 + 7] & 0xFFFFFFFFFFFFFFF8ui64);
if( (unsigned __int64)&v35[v34] > v41 )
{
LABEL_68:
v11 = -1073741789;
goto LABEL_10;
}
if( (_DWORD)v34 )
{
*((_QWORD *)v20 + 4) = v35;
memmove(v35, v6 + 12, *((unsigned int *)v6 + 2));
if( !SeValidSecurityDescriptor(*((unsigned int *)v6 + 2), *((VOID **)v20 + 4)) )
{
LABEL_64:
v11 = -1073741703;
goto LABEL_10;
}
}
else
{
*((_QWORD *)v20 + 4) = 0i64;
}
v19 = &v35[*((unsigned int *)v6 + 2)];
ZwClose(Handle);
v20 += 56;
Handle = 0i64;
v18 = v40;
}
while( ++v39 < v40 );
}
*v43 = v4;
*v44 = v18;
LABEL_4:
if( v11 >= 0 )
{
v13 = v36;
goto LABEL_6;
}
goto LABEL_10;
}
}
LABEL_36:
v11 = -1073741670;
}
LABEL_10:
v13 = v36;
LABEL_15:
if( Handle )
ZwClose(Handle);
if( v4 )
ExFreePoolWithTag(v4, 0x70536553u);
LABEL_6:
if( v13 && PoolWithTag )
ExFreePoolWithTag(PoolWithTag, 0x70536553u);
if( v6 )
ExFreePoolWithTag(v6, 0x70536553u);
return v11;
}Referenced by:
SepBuildCapPolicyTable