SdbpGetProcessHistory

PWCHAR __stdcall SdbpGetProcessHistory(PWCHAR pEnvironment, PWCHAR szDir, PWCHAR szName){
  unsigned __int64 v3; 
  PWCHAR v4; 
  __int64 v5; 
  __int64 v6; 
  PWCHAR v7; 
  unsigned __int64 v8; 
  INT64 v9; 
  WCHAR *NtSystemRoot; 
  __int64 v11; 
  WCHAR *v12; 
  UINT16 *v13; 
  UINT16 v14; 
  UINT16 v15; 
  __int16 v16; 
  PWCHAR v17; 
  int v18; 
  unsigned __int64 v19; 
  UINT64 v20; 
  UINT8 *v21; 
  WCHAR *v22; 
  PWCHAR result; 
  unsigned __int64 v24; 
  WCHAR *v25; 
  UINT8 *v26; 
  UINT8 *v27; 
  WCHAR *v28; 
  WCHAR *v29; 
  const wchar_t *v30; 
  UINT16 *v31; 
  UINT16 v32; 
  __int16 v33; 
  int v34; 
  PWCHAR v35; 
  __int64 v36; 
  UINT8 *v37; 
  v3 = -1i64;
  v4 = pEnvironment;
  v5 = -1i64;
  do
    ++v5;
  while( szDir[v5] );
  v6 = -1i64;
  do
    ++v6;
  while( szName[v6] );
  v7 = pEnvironment;
  if( wcsnicmp(L"__PROCESS_HISTORY", L"systemroot", 0xAui64) )
  {
    if( v4 && *v4 )
    {
      do
      {
        v12 = v7;
        v13 = (UINT16 *)L"__PROCESS_HISTORY";
        do
        {
          if( !*v7 )
            break;
          NLS_UPCASE(*v13);
          v15 = NLS_UPCASE(v14);
          if( v15 != v16 )
            break;
          ++v7;
          ++v13;
        }
        while( v13 < L"" );
        if( v13 == L"" && *v7 == 61 )
        {
          v9 = 1i64;
LABEL_18:
          v17 = v7;
          if( *v7 )
          {
            v8 = 0i64;
            do
            {
              if( (__int64)(v8 & 0xFFFFFFFFFFFFFFFEui64) >= 65534 )
                break;
              ++v7;
              v8 += 2i64;
            }
            while( *v7 );
          }
          if( (_DWORD)v9 )
          {
            v11 = v7 - (v17 + 1);
            goto LABEL_34;
          }
        }
        else
        {
          v9 = 0i64;
          while( *v7 )
          {
            if( *v7 == 61 && v7 != v12 )
              goto LABEL_18;
            ++v7;
          }
        }
        ++v7;
      }
      while( *v7 );
    }
    v18 = -1073741568;
    v19 = (unsigned int)(v6 + v5 + 1);
  }
  else
  {
    NtSystemRoot = RtlGetNtSystemRoot();
    v11 = -1i64;
    do
      ++v11;
    while( NtSystemRoot[v11] );
LABEL_34:
    v8 = (unsigned int)(v6 + v5 + 2);
    v18 = -1073741789;
    v19 = v8 + v11 + 1;
  }
  v20 = 2 * v19;
  v21 = (UINT8 *)AslAlloc((VOID *)v8, v20, v9);
  v22 = (WCHAR *)v21;
  if( !v21 )
  {
    AslLogCallPrintf(1ui64, "SdbpGetProcessHistory", 0x8BDui64, "Unable to allocate process history buffer");
    return 0i64;
  }
  *(_WORD *)v21 = 0;
  if( v18 != -1073741789 )
    goto LABEL_69;
  v24 = v20 >> 1;
  if( !wcsnicmp(L"__PROCESS_HISTORY", L"systemroot", 0xAui64) )
  {
    v25 = RtlGetNtSystemRoot();
    do
      ++v3;
    while( v25[v3] );
    if( v3 >= v24 )
      goto LABEL_67;
    v26 = (UINT8 *)v25;
    goto LABEL_41;
  }
  if( !v4 || !*v4 )
    goto LABEL_69;
  while( 1 )
  {
    v29 = v4;
    v30 = L"__PROCESS_HISTORY";
    do
    {
      if( !*v4 )
        break;
      NLS_UPCASE(*v4);
      v32 = NLS_UPCASE(*v31);
      if( v33 != v32 )
        break;
      ++v4;
      ++v30;
    }
    while( v30 < L"" );
    if( v30 != L"" || *v4 != 61 )
    {
      v34 = 0;
      while( *v4 )
      {
        if( *v4 == 61 && v4 != v29 )
          goto LABEL_53;
        ++v4;
      }
      goto LABEL_58;
    }
    v34 = 1;
LABEL_53:
    v35 = v4;
    if( *v4 )
    {
      v36 = 0i64;
      do
      {
        if( (__int64)(v36 & 0xFFFFFFFFFFFFFFFEui64) >= 65534 )
          break;
        ++v4;
        v36 += 2i64;
      }
      while( *v4 );
    }
    if( v34 )
      break;
LABEL_58:
    if( !*++v4 )
      goto LABEL_69;
  }
  v26 = (UINT8 *)(v35 + 1);
  v3 = ((char *)v4 - (char *)v26) >> 1;
  if( v3 < v24 )
  {
LABEL_41:
    memmove(v21, v26, 2 * v3);
    v27 = &v21[2 * v3];
    *(_WORD *)v27 = 0;
    v28 = (WCHAR *)(v27 - 2);
    if( *((_WORD *)v27 - 1) != 59 )
    {
      v28 = &v22[v3];
      *(_WORD *)v27 = 59;
    }
    v21 = (UINT8 *)(v28 + 1);
    goto LABEL_69;
  }
LABEL_67:
  if( v24 )
    *(_WORD *)v21 = 0;
LABEL_69:
  memmove(v21, (UINT8 *)szDir, 2i64 * (unsigned int)v5);
  v37 = &v21[2 * (unsigned int)v5];
  memmove(v37, (UINT8 *)szName, 2i64 * (unsigned int)v6);
  result = v22;
  *(_WORD *)&v37[2 * (unsigned int)v6] = 0;
  return result;
}

Referenced by: