EmpEvaluateUpdateRuleEvalState

VOID __fastcall EmpEvaluateUpdateRuleEvalState(INT64 a1, INT64 a2){
  __int64 v2; 
  int v3; 
  char *PoolWithTag; 
  __int64 v7; 
  unsigned int v8; 
  __int64 v9; 
  _QWORD **v10; 
  _QWORD *v11; 
  __int64 i; 
  __int64 v13; 
  __int64 v14; 
  __int64 v15; 
  v2 = *(_QWORD *)(a1 + 8);
  v3 = 0;
  PoolWithTag = 0i64;
  v7 = *(unsigned int *)(v2 + 48);
  if( *(_BYTE *)(v2 + 20) )
  {
    v8 = 0;
    if( (_DWORD)v7 )
    {
      v9 = *(_QWORD *)(v2 + 56);
      do
      {
        v10 = (_QWORD **)(*(_QWORD *)&PoolWithTag[v9] + 56i64);
        v11 = *v10;
        while( v11 != v10 )
        {
          ((void(__fastcall *)(_QWORD, _QWORD))*(v11 - 2))(*(_QWORD *)&PoolWithTag[*(_QWORD *)(v2 + 56)], *(v11 - 1));
          v9 = *(_QWORD *)(v2 + 56);
          v11 = (_QWORD *)*v11;
          v10 = (_QWORD **)(*(_QWORD *)&PoolWithTag[v9] + 56i64);
        }
        if( *(_QWORD *)(*(_QWORD *)&PoolWithTag[v9] + 40i64) == *(_QWORD *)&PoolWithTag[v9] + 40i64 )
        {
          *(_DWORD *)(v2 + 16) = 0;
          return;
        }
        ++v8;
        PoolWithTag += 8;
      }
      while( v8 < (unsigned int)v7 );
      PoolWithTag = (char *)ExAllocatePoolWithTag(PagedPool, 8 * v7, 0x76654D45ui64);
      if( PoolWithTag )
      {
        for( i = 0i64; (unsigned int)i < *(_DWORD *)(v2 + 48); i = (unsigned int)(i + 1) )
        {
          v13 = *(_QWORD *)(*(_QWORD *)(v2 + 56) + 8 * i);
          if( v13 != a2 )
            *(_QWORD *)(v13 + 32) = *(_QWORD *)(v13 + 40);
        }
        goto LABEL_20;
      }
    }
    else
    {
      while( (unsigned int)EmpEvaluateTargetRule(a1, (__int64)PoolWithTag, v7) != 2 )
      {
        if( EmpEvaluatePermuteRuleEntries(v2, v7, a2, 0) )
          goto LABEL_5;
LABEL_20:
        if( (_DWORD)v7 )
        {
          v14 = 0i64;
          v15 = v7;
          do
          {
            *(_QWORD *)&PoolWithTag[v14] = *(_QWORD *)(*(_QWORD *)(v14 + *(_QWORD *)(v2 + 56)) + 32i64) - 16i64;
            v14 += 8i64;
            --v15;
          }
          while( v15 );
        }
      }
      v3 = 2;
LABEL_5:
      *(_DWORD *)(v2 + 16) = v3;
      if( PoolWithTag )
        ExFreePoolWithTag(PoolWithTag, 0x76654D45u);
    }
  }
  else
  {
    *(_DWORD *)(v2 + 16) = 1;
  }
}

Referenced by: