SepAdtMarshallAuditRecord

__int64 __fastcall SepAdtMarshallAuditRecord(void *Src, void **a2, _DWORD *a3, POOL_TYPE a4){
  unsigned int v4; 
  char *v5; 
  unsigned int v6; 
  UINT8 *v10; 
  unsigned int v11; 
  unsigned int v12; 
  char *i; 
  unsigned int v14; 
  unsigned int v15; 
  void *PoolWithTag; 
  unsigned int v17; 
  int v18; 
  UINT8 *v19; 
  signed __int64 *v20; 
  int v21; 
  unsigned __int16 *v22; 
  UINT8 *v23; 
  UINT8 *v24; 
  __int16 v25; 
  unsigned int *v27; 
  __int64 *v28; 
  __int64 v29; 
  __int64 v30; 
  unsigned int *v31; 
  UINT8 *v32; 
  signed __int64 v33; 
  UINT8 *v34; 
  UINT8 *v35; 
  int v36; 
  UINT8 **v37; 
  _QWORD *v38; 
  UINT64 v39; 
  unsigned int v40; 
  signed __int64 *v41; 
  v4 = *((_DWORD *)Src + 2);
  v5 = (char *)Src + 24;
  v6 = 0;
  v10 = (UINT8 *)Src;
  v11 = 0;
  v12 = 0;
  for( i = (char *)Src + 24; v12 < v4; v11 += v14 )
  {
    if( *(_DWORD *)i == 17 )
    {
      v27 = (unsigned int *)*((_QWORD *)i + 3);
      v14 = 16 * (*v27 + 1);
      if( *v27 )
      {
        v28 = (__int64 *)(*((_QWORD *)v27 + 1) + 8i64);
        v29 = *v27;
        do
        {
          v30 = *v28;
          v28 += 2;
          v14 += (4 * *(unsigned __int8 *)(v30 + 1) + 15) & 0xFFFFFFF8;
          --v29;
        }
        while( v29 );
        v10 = (UINT8 *)Src;
      }
    }
    else
    {
      v14 = (*((_DWORD *)i + 1) + 7) & 0xFFFFFFF8;
    }
    if( v14 + v11 < v11 )
      return(unsigned int)-1073741811;
    ++v12;
    i += 32;
  }
  v15 = 32 * v4 + 24 + v11;
  PoolWithTag = ExAllocatePoolWithTag(a4, v15, 0x70416553ui64);
  *a2 = PoolWithTag;
  if( !PoolWithTag )
  {
    *a3 = 0;
    return(unsigned int)-1073741670;
  }
  *a3 = (a4 != PagedPool) + 4;
  memmove((UINT8 *)*a2, v10, 1048 - 32i64 * (unsigned int)(32 - *((_DWORD *)v10 + 2)));
  v17 = 0;
  v40 = 0;
  *((_DWORD *)*a2 + 3) = v15;
  *((_DWORD *)*a2 + 5) |= 1u;
  v18 = *((_DWORD *)v10 + 2);
  v19 = (UINT8 *)((char *)*a2 - 32 * (unsigned int)(32 - v18) + 1048);
  if( v18 )
  {
    v20 = (signed __int64 *)((char *)*a2 + 48);
    v41 = v20;
    do
    {
      v21 = *(_DWORD *)v5;
      if( *(int *)v5 > 22 )
      {
        if( v21 <= 24 )
          goto LABEL_29;
        if( v21 > 27 )
        {
          if( v21 <= 31 )
            goto LABEL_29;
          switch( v21 )
          {
            case ' ':
              *((_DWORD *)*a2 + 5) |= 2u;
              goto LABEL_29;
            case '!':
              goto LABEL_29;
            case '"':
LABEL_25:
              v22 = (unsigned __int16 *)*((_QWORD *)v5 + 3);
              v23 = v19;
              *v20 = v19 - (_BYTE *)*a2;
              v24 = v19 + 16;
              memmove(v24, *((UINT8 **)v22 + 1), *v22);
              v25 = *v22;
              *(_WORD *)v23 = *v22;
              *((_WORD *)v23 + 1) = v25;
              *((_QWORD *)v23 + 1) = v24 - (_BYTE *)*a2;
              v19 = &v24[(*v22 + 7i64) & 0xFFFFFFF8i64];
              goto LABEL_26;
          }
        }
      }
      else
      {
        if( v21 == 22 )
        {
          *((_DWORD *)*a2 + 5) |= 2u;
          goto LABEL_27;
        }
        if( v21 > 0 )
        {
          if( v21 <= 2 )
            goto LABEL_25;
          if( v21 == 4 )
            goto LABEL_29;
          if( v21 > 7 )
          {
            if( v21 > 9 && v21 != 13 )
            {
              if( v21 == 17 )
              {
                v31 = (unsigned int *)*((_QWORD *)v5 + 3);
                v32 = v19;
                *(_OWORD *)v19 = *(_OWORD *)v31;
                v33 = v19 - (_BYTE *)*a2;
                v19 += 16;
                *v20 = v33;
                v34 = v19;
                v35 = (UINT8 *)*((_QWORD *)v31 + 1);
                if( *v31 )
                {
                  memmove(v19, v35, 16i64 * *v31);
                  v34 = v19;
                  v17 = v40;
                  *((_QWORD *)v32 + 1) = v19 - (_BYTE *)*a2;
                  v36 = *v31;
                  v19 += 16 * *v31;
                }
                else
                {
                  *((_QWORD *)v32 + 1) = 0i64;
                  v36 = *v31;
                }
                if( v36 )
                {
                  v37 = (UINT8 **)(v35 + 8);
                  v38 = v34 + 8;
                  do
                  {
                    *v38 = v19 - (_BYTE *)*a2;
                    v39 = 4i64 * (*v37)[1] + 8;
                    memmove(v19, *v37, v39);
                    ++v6;
                    v38 += 2;
                    v19 += (v39 + 7) & 0xFFFFFFFFFFFFFFF8ui64;
                    v37 += 2;
                  }
                  while( v6 < *v31 );
                  v20 = v41;
                  v6 = 0;
                  v17 = v40;
                }
                v10 = (UINT8 *)Src;
              }
              goto LABEL_27;
            }
LABEL_29:
            memmove(v19, *((UINT8 **)v5 + 3), *((unsigned int *)v5 + 1));
            *v20 = v19 - (_BYTE *)*a2;
            v19 += (*((unsigned int *)v5 + 1) + 7i64) & 0xFFFFFFFFFFFFFFF8ui64;
LABEL_26:
            v17 = v40;
          }
        }
      }
LABEL_27:
      ++v17;
      v20 += 4;
      v5 += 32;
      v40 = v17;
      v41 = v20;
    }
    while( v17 < *((_DWORD *)v10 + 2) );
  }
  return v6;
}

Referenced by: