AdtpPackageParameters
NTSTATUS __stdcall AdtpPackageParameters(
_SE_ADT_PARAMETER_ARRAY *AuditParameters,
_SE_ADT_PARAMETER_ARRAY_EX *AuditParametersEx,
PWCHAR szStringBuffer,
UNICODE_STRING *UnicodeStringArray,
EVENT_DATA_DESCRIPTOR *EtwDataDescriptors,
UINT16 *DescriptorIndex,
UINT8 *FreeWhenDone){
UNICODE_STRING *v7;
struct _UNICODE_STRING *v8;
unsigned __int16 v9;
unsigned __int16 v10;
NTSTATUS v11;
ULONG ParameterCount;
SE_ADT_PARAMETER_ARRAY_ENTRY *Parameters;
int v14;
unsigned int v15;
UINT16 *v16;
__int64 v17;
EVENT_DATA_DESCRIPTOR *v18;
__int64 v19;
int Type;
PVOID *v21;
__int64 v22;
NTSTATUS v23;
unsigned __int8 *v24;
char v25;
SE_ADT_PARAMETER_TYPE v26;
int v27;
UINT16 *v28;
EVENT_DATA_DESCRIPTOR *v29;
__int64 v30;
unsigned __int16 v31;
__int64 v32;
int v33;
UINT16 *v34;
unsigned __int16 v35;
UINT16 *v36;
__int64 v37;
int v38;
__int64 v39;
UNICODE_STRING *v40;
UNICODE_STRING *v41;
_UNICODE_STRING *v42;
int v43;
int v45;
int v46;
int v47;
__int64 v48;
int v49;
int v50;
__int64 v51;
unsigned __int16 v52;
int v53;
__int64 v54;
__int64 v55;
unsigned __int8 *v56;
unsigned int v57;
UINT8 valid;
__int64 v59;
bool v60;
unsigned int v61;
__int64 v62;
unsigned int *v63;
unsigned int v64;
unsigned int v65;
int v66;
int v67;
int v68;
__int64 *Address;
__int64 v70;
unsigned int v71;
__int64 v72;
_UNICODE_STRING *v73;
__int64 v74;
wchar_t *Buffer;
unsigned __int16 v76;
int v77;
__int64 v78;
unsigned __int16 v79;
int v80;
unsigned int v81;
__int64 v82;
int v83;
int v84;
UINT64 v85;
int v86;
sockaddr *v87;
EVENT_DATA_DESCRIPTOR *v88;
_UNICODE_STRING *v89;
int v90;
__int64 v91;
NTSTATUS v92;
__int64 v93;
EVENT_DATA_DESCRIPTOR *v94;
__int64 v95;
__int64 v96;
int v97;
__int64 v98;
__int64 v99;
unsigned __int8 *v100;
int v101;
UINT16 *v102;
SE_ADT_ACCESS_REASON *v103;
ULONG ObjectTypeIndex;
__int64 v105;
_UNICODE_STRING *v106;
int v107;
__int64 v108;
unsigned int v109;
UNICODE_STRING *Destination;
_UNICODE_STRING *DestinationString;
char FreeWhenDone2[2];
unsigned __int16 v113;
UINT64 pdwCurBufferIndex;
unsigned int v115;
SE_ADT_PARAMETER_ARRAY_ENTRY *v116;
unsigned __int8 *v117;
UINT8 FreeWhenDone1;
int FreeSid;
WCHAR *pszStringBuffer;
__int64 v121;
pszStringBuffer = &UnicodeStringArray->Length;
FreeSid = (int)szStringBuffer;
v7 = UnicodeStringArray;
v8 = 0i64;
v113 = 0;
v9 = 0;
LODWORD(pdwCurBufferIndex) = 0;
v10 = 0;
v11 = 0;
if( AuditParameters )
{
if( !AuditParametersEx )
{
ParameterCount = AuditParameters->ParameterCount;
Parameters = AuditParameters->Parameters;
goto LABEL_4;
}
LABEL_68:
v11 = -1073741811;
goto LABEL_39;
}
if( !AuditParametersEx )
goto LABEL_68;
ParameterCount = AuditParametersEx->ParameterCount;
Parameters = AuditParametersEx->Parameters;
LABEL_4:
v14 = 2;
v116 = Parameters;
v115 = ParameterCount;
v15 = 2;
HIDWORD(pdwCurBufferIndex) = 2;
if( ParameterCount > 2 )
{
v16 = DescriptorIndex;
LODWORD(v17) = 1;
v18 = &AdtpNullSid;
while( 1 )
{
if( v9 >= 0x2Au || v10 >= 0xEu )
goto LABEL_68;
v19 = v15;
Type = Parameters[v19].Type;
if( Type > 16 )
break;
if( Type == 16 )
{
v43 = AdtpBuildStringListString(
(unsigned int *)Parameters[v19].Address,
(__int64)v18,
(wchar_t **)&v16[8 * v9],
(__int64)v7,
&pdwCurBufferIndex,
(char *)(v9 + v121));
goto LABEL_35;
}
if( Type > 8 )
{
v45 = Type - 9;
if( v45 )
{
v46 = v45 - 1;
if( v46 )
{
v47 = v46 - 1;
if( !v47 )
goto LABEL_51;
v66 = v47 - 1;
if( !v66 )
goto LABEL_51;
v67 = v66 - 1;
if( v67 )
{
v68 = v67 - 1;
if( v68 && v68 != 1 )
goto LABEL_68;
LABEL_51:
v48 = 2i64 * v9;
*(_QWORD *)&v16[4 * v48] = Parameters[v19].Data;
*(_QWORD *)&v16[4 * v48 + 4] = 8i64;
}
else
{
Address = AdtpNullGuid;
if( Parameters[v19].Address )
Address = (__int64 *)Parameters[v19].Address;
v70 = 2i64 * v9;
*(_QWORD *)&v16[4 * v70] = Address;
*(_QWORD *)&v16[4 * v70 + 4] = 16i64;
}
}
else
{
LABEL_118:
v99 = 2i64 * v9;
*(_QWORD *)&v16[4 * v99] = Parameters[v19].Data;
*(_QWORD *)&v16[4 * v99 + 4] = 4i64;
}
LABEL_52:
v9 += v17;
goto LABEL_38;
}
v71 = Parameters[v19].Data[1];
if( v71 >= v15 )
goto LABEL_68;
v72 = v71;
if( Parameters[v72].Type != (_DWORD)v17 )
goto LABEL_68;
v73 = (_UNICODE_STRING *)&EtwDataDescriptors[v10];
AdtpBuildObjectTypeStrings(
(_UNICODE_STRING *)Parameters[1].Address,
(_UNICODE_STRING *)Parameters[v72].Address,
(_SE_ADT_OBJECT_TYPE *)Parameters[v19].Address,
Parameters[v19].Length / 0x18,
v73,
(UINT8 *)(v9 + v121));
v74 = 2i64 * v9;
Buffer = v73->Buffer;
v14 = 2;
v76 = v113;
v77 = v73->Length + 2;
v8 = 0i64;
*(_DWORD *)&v16[4 * v74 + 6] = 0;
*(_QWORD *)&v16[4 * v74] = Buffer;
LODWORD(v17) = 1;
*(_DWORD *)&v16[4 * v74 + 4] = v77;
LABEL_101:
v10 = v76 + 1;
++v9;
LABEL_30:
v113 = v10;
LABEL_31:
v7 = (UNICODE_STRING *)pszStringBuffer;
goto LABEL_37;
}
switch( Type )
{
case 8:
v63 = (unsigned int *)Parameters[v19].Address;
if( !v63 )
goto LABEL_68;
v64 = *v63;
v65 = *v63 ? 12 * v64 + 8 : 8;
if( Parameters[v19].Length < v65 || v64 > 0x42 )
goto LABEL_68;
v43 = AdtpBuildPrivilegeAuditString(
(_PRIVILEGE_SET *)Parameters[v19].Address,
0i64,
(_EVENT_DATA_DESCRIPTOR *)&v16[8 * v9],
&v7->Length,
&pdwCurBufferIndex,
(UINT8 *)(v9 + v121));
goto LABEL_35;
case 0:
AdtpEtwBuildDashString((_EVENT_DATA_DESCRIPTOR *)&v16[8 * v9]);
goto LABEL_52;
case 1:
if( !AdtpIsCorrectlyFormedUnicodeString((UNICODE_STRING *)Parameters[v19].Address) )
goto LABEL_68;
LABEL_34:
v43 = AdtpEtwBuildString(
(_EVENT_DATA_DESCRIPTOR *)&v16[8 * v9],
v42,
&v7->Length,
&pdwCurBufferIndex,
(UINT8 *)(v9 + v121));
LABEL_35:
v8 = 0i64;
v11 = v43;
if( v43 < 0 )
goto LABEL_39;
v10 = v113;
LODWORD(v17) = 1;
++v9;
v14 = 2;
goto LABEL_37;
case 2:
v40 = (UNICODE_STRING *)Parameters[v19].Address;
if( !AdtpIsCorrectlyFormedUnicodeString(v40) )
goto LABEL_68;
AdtpSubstituteDriveLetter(v41);
v42 = v40;
goto LABEL_34;
case 3:
v43 = AdtpBuildUlongString(
LODWORD(Parameters[v19].Data[0]),
0i64,
(_EVENT_DATA_DESCRIPTOR *)&v16[8 * v9],
&v7->Length,
&pdwCurBufferIndex,
(UINT8 *)(v9 + v121));
goto LABEL_35;
case 4:
v56 = (unsigned __int8 *)Parameters[v19].Address;
v57 = 4 * v56[1] + 8;
if( Parameters[v19].Length < v57 || (valid = RtlValidSid(Parameters[v19].Address), v8 = 0i64, !valid) )
{
v11 = -1073741704;
goto LABEL_39;
}
v10 = v113;
LODWORD(v17) = 1;
v14 = 2;
v59 = 2i64 * v9++;
*(_QWORD *)&v16[4 * v59] = v56;
*(_DWORD *)&v16[4 * v59 + 4] = v57;
*(_DWORD *)&v16[4 * v59 + 6] = 0;
goto LABEL_31;
case 5:
goto LABEL_18;
}
if( Type != 6 )
{
if( Type != 7 )
goto LABEL_68;
v61 = Parameters[v19].Data[1];
if( v61 >= HIDWORD(pdwCurBufferIndex) )
goto LABEL_68;
v62 = v61;
if( Parameters[v62].Type != (_DWORD)v17 )
goto LABEL_68;
v43 = AdtpBuildAccessesString(
(const UNICODE_STRING *)Parameters[1].Address,
(const UNICODE_STRING *)Parameters[v62].Address,
Parameters[v19].Data[0],
0,
v8,
(__int64)&v16[8 * v9],
(__int64)v7,
(__int64)&pdwCurBufferIndex,
v9 + v121);
goto LABEL_35;
}
v51 = 2i64 * v9;
v52 = v17 + v9;
v53 = 4 * BYTE1(AdtpNullSid.Ptr) + 8;
*(_QWORD *)&v16[4 * v51] = v18;
*(_DWORD *)&v16[4 * v51 + 4] = v53;
*(_DWORD *)&v16[4 * v51 + 6] = (_DWORD)v8;
do
{
AdtpEtwBuildDashString((_EVENT_DATA_DESCRIPTOR *)&v16[8 * v52]);
v52 += v17;
}
while( v54 != v17 );
v55 = 2i64 * v52;
v9 = v17 + v52;
*(_QWORD *)&v16[4 * v55] = &AdtpNullLuid;
*(_QWORD *)&v16[4 * v55 + 4] = 8i64;
LABEL_37:
v18 = &AdtpNullSid;
LABEL_38:
v15 = v17 + HIDWORD(pdwCurBufferIndex);
HIDWORD(pdwCurBufferIndex) = v15;
if( v15 >= v115 )
goto LABEL_39;
}
if( Type > 27 )
{
switch( Type )
{
case 28:
v106 = (_UNICODE_STRING *)&EtwDataDescriptors[v10];
v107 = AdtpBuildSockAddrString(
(sockaddr *)Parameters[v19].Address,
v106,
(UINT8 *)(v9 + v121),
0i64,
(UINT8 *)v8);
v8 = 0i64;
v11 = v107;
if( v107 < 0 )
goto LABEL_39;
LODWORD(v17) = 1;
v14 = 2;
v108 = 2i64 * v9;
v109 = v106->Length + 2;
++v9;
v10 = v113 + 1;
*(_QWORD *)&v16[4 * v108] = v106->Buffer;
*(_QWORD *)&v16[4 * v108 + 4] = v109;
goto LABEL_30;
case 29:
goto LABEL_129;
case 30:
if( (struct _UNICODE_STRING *)Parameters[v19].Data[0] != v8
|| (struct _UNICODE_STRING *)Parameters[v19].Data[1] != v8 )
{
goto LABEL_68;
}
LABEL_129:
v103 = (SE_ADT_ACCESS_REASON *)Parameters[v19].Address;
ObjectTypeIndex = v103->ObjectTypeIndex;
if( ObjectTypeIndex >= HIDWORD(pdwCurBufferIndex) )
goto LABEL_68;
v105 = ObjectTypeIndex;
if( Parameters[v105].Type != SeAdtParmTypeString )
goto LABEL_68;
v43 = AdtpBuildAccessReasonAuditString(
(UNICODE_STRING *)Parameters[1].Address,
(UNICODE_STRING *)Parameters[v105].Address,
v103,
Type == 30,
Destination,
(EVENT_DATA_DESCRIPTOR *)&v16[8 * v9],
&v7->Length,
&pdwCurBufferIndex,
(UINT8 *)(v9 + v121));
goto LABEL_35;
case 31:
if( LODWORD(Parameters[v19].Data[0]) != 32 || (struct _UNICODE_STRING *)Parameters[v19].Data[1] != v8 )
goto LABEL_68;
v43 = AdtpBuildSecurityDescriptorUnicodeString(
0x20ui64,
(SECURITY_DESCRIPTOR *)Parameters[v19].Address,
0i64,
(EVENT_DATA_DESCRIPTOR *)&v16[8 * v9],
&v7->Length,
&pdwCurBufferIndex,
(UINT8 *)(v9 + v121));
goto LABEL_35;
}
v49 = Type - 31 - v14;
if( !v49 )
{
LABEL_18:
v21 = (PVOID *)&v117;
v22 = v10;
LOBYTE(FreeSid) = (_BYTE)v8;
FreeWhenDone1 = (unsigned __int8)v8;
FreeWhenDone2[0] = (char)v8;
v117 = (unsigned __int8 *)v8;
if( Type != 35 )
v21 = (PVOID *)v8;
v23 = AdtpBuildLogonIdStrings(
(_LUID *)Parameters[v19].Data,
v21,
(UINT8 *)&FreeSid,
(_UNICODE_STRING *)&EtwDataDescriptors[v22],
&FreeWhenDone1,
(_UNICODE_STRING *)&EtwDataDescriptors[v22 + 1],
(UINT8 *)FreeWhenDone2);
v11 = v23;
if( Type == 35 )
{
v25 = FreeSid;
v24 = v117;
}
else
{
v24 = (unsigned __int8 *)Parameters->Address;
v25 = 0;
}
if( v23 < 0 )
goto LABEL_39;
v26 = Parameters[v19].Type;
if( v26 == SeAdtParmTypeLogonId || v26 == SeAdtParmTypeLogonIdEx )
{
if( !v24 )
{
v24 = (unsigned __int8 *)&AdtpNullSid;
v25 = 0;
}
v27 = 4 * v24[1] + 8;
v28 = &v16[8 * v9];
*((_DWORD *)v28 + 3) = 0;
*(_QWORD *)v28 = v24;
*((_DWORD *)v28 + 2) = v27;
*(_BYTE *)(v9 + v121) = v25;
}
else
{
if( Type != 33 )
{
if( v25 && v24 )
ExFreeHeapPool(v24);
goto LABEL_28;
}
v100 = (unsigned __int8 *)Parameters[v19].Address;
v101 = 4 * v100[1] + 8;
v102 = &v16[8 * v9];
*((_DWORD *)v102 + 3) = 0;
*(_QWORD *)v102 = v100;
*((_DWORD *)v102 + 2) = v101;
*(_BYTE *)(v9 + v121) = v25;
}
++v9;
LABEL_28:
v29 = EtwDataDescriptors;
v30 = v121;
v31 = v113;
v32 = *(_QWORD *)&EtwDataDescriptors[v22].Size;
v33 = LOWORD(EtwDataDescriptors[v22].Ptr) + 2;
v34 = &v16[8 * v9];
*((_DWORD *)v34 + 3) = 0;
*(_QWORD *)v34 = v32;
LOBYTE(v32) = FreeWhenDone1;
*((_DWORD *)v34 + 2) = v33;
*(_BYTE *)(v9 + v30) = v32;
v35 = v9 + 1;
++v31;
v36 = &v16[8 * v35];
v37 = *(_QWORD *)&v29[v31].Size;
v38 = LOWORD(v29[v31].Ptr) + 2;
*((_DWORD *)v36 + 3) = 0;
*(_QWORD *)v36 = v37;
LOBYTE(v37) = FreeWhenDone2[0];
*((_DWORD *)v36 + 2) = v38;
*(_BYTE *)(v35 + v30) = v37;
LODWORD(v17) = 1;
v8 = 0i64;
++v35;
v10 = v31 + 1;
v39 = 2i64 * v35;
v9 = v35 + 1;
*(_QWORD *)&v16[4 * v39] = Parameters[v19].Data;
*(_QWORD *)&v16[4 * v39 + 4] = 8i64;
LABEL_29:
v14 = 2;
goto LABEL_30;
}
v50 = v49 - 1;
if( !v50 )
{
v43 = AdtpBuildMultiSzStringListString(
(UNICODE_STRING *)Parameters[v19].Address,
(EVENT_DATA_DESCRIPTOR *)&v16[8 * v9],
(UINT8 *)(v9 + v121));
goto LABEL_35;
}
v60 = v50 == 1;
}
else
{
switch( Type )
{
case 27:
goto LABEL_118;
case 17:
v43 = AdtpBuildSidListString(
(unsigned int *)Parameters[v19].Address,
(__int64)v18,
(__int64)&v16[8 * v9],
(__int64)v7,
&pdwCurBufferIndex,
(char *)(v9 + v121));
goto LABEL_35;
case 18:
v98 = 2i64 * v9;
*(_QWORD *)&v16[4 * v98] = &FreeWhenDone1;
*(_QWORD *)&v16[4 * v98 + 4] = 8i64;
goto LABEL_52;
case 19:
v92 = AdtpBuildUserAccountControlString(
LODWORD(Parameters[v19].Data[0]),
LODWORD(Parameters[v19].Data[1]),
(UNICODE_STRING *)&EtwDataDescriptors[v113],
(UINT8 *)(v121 + v9),
(UNICODE_STRING *)&EtwDataDescriptors[(unsigned int)v10 + 1],
(UINT8 *)(v121 + (unsigned int)v9 + 1),
(UNICODE_STRING *)&EtwDataDescriptors[(unsigned int)v10 + 2],
(UINT8 *)(v121 + (unsigned int)v9 + 2));
v8 = 0i64;
v11 = v92;
if( v92 < 0 )
goto LABEL_39;
v10 = v113;
v93 = 3i64;
v94 = EtwDataDescriptors;
do
{
v95 = v10++;
v95 *= 2i64;
v96 = 2i64 * v9++;
v97 = *((unsigned __int16 *)&v94->Ptr + 4 * v95);
*(_QWORD *)&v16[4 * v96] = *((_QWORD *)&v94->Size + v95);
*(_QWORD *)&v16[4 * v96 + 4] = (unsigned int)(v97 + 2);
--v93;
}
while( v93 );
Parameters = v116;
LODWORD(v17) = 1;
goto LABEL_29;
case 20:
do
{
AdtpEtwBuildDashString((_EVENT_DATA_DESCRIPTOR *)&v16[8 * v9]);
v9 += v17;
}
while( v91 != v17 );
goto LABEL_37;
case 21:
v43 = AdtpBuildMessageString(
LODWORD(Parameters[v19].Data[0]),
v18,
&v16[8 * v9],
(UINT64 *)&v7->Length,
(UINT8 *)&pdwCurBufferIndex);
goto LABEL_35;
}
v83 = Type - 21 - v14;
if( !v83 )
{
v87 = (sockaddr *)Parameters[v19].Address;
v88 = EtwDataDescriptors;
v89 = (_UNICODE_STRING *)&EtwDataDescriptors[v10];
v90 = AdtpBuildSockAddrString(v87, v89, (UINT8 *)(v9 + v121), v89 + 1, (UINT8 *)(v9 + v121 + 1));
v8 = 0i64;
v11 = v90;
if( v90 < 0 )
goto LABEL_39;
v78 = 2i64 * v9;
v14 = 2;
v79 = v113;
v80 = v89->Length + 2;
*(_QWORD *)&v16[4 * v78] = v89->Buffer;
*(_DWORD *)&v16[4 * v78 + 4] = v80;
LODWORD(v17) = 1;
*(_DWORD *)&v16[4 * v78 + 6] = 0;
v76 = v79 + 1;
++v9;
v81 = LOWORD(v88[v76].Ptr) + 2;
v82 = 2i64 * v9;
*(_QWORD *)&v16[4 * v82] = *(_QWORD *)&v88[v76].Size;
*(_QWORD *)&v16[4 * v82 + 4] = v81;
goto LABEL_101;
}
v84 = v83 - 1;
if( !v84 )
{
v85 = LODWORD(Parameters[v19].Data[0]);
++HIDWORD(pdwCurBufferIndex);
v7 = (UNICODE_STRING *)pszStringBuffer;
v86 = AdtpBuildSecurityDescriptorChangeString(
v85,
(_SECURITY_DESCRIPTOR *)Parameters[v19].Address,
(_SECURITY_DESCRIPTOR *)Parameters[HIDWORD(pdwCurBufferIndex)].Address,
(_UNICODE_STRING *)&v16[8 * v9 + 8],
(_EVENT_DATA_DESCRIPTOR *)&v16[8 * v9],
(UINT8 *)(v9 + v121),
DestinationString,
(_EVENT_DATA_DESCRIPTOR *)&v16[8 * v9 + 8],
(UINT8 *)(v9 + 1i64 + v121),
pszStringBuffer,
&pdwCurBufferIndex);
v8 = 0i64;
v11 = v86;
if( v86 < 0 )
goto LABEL_39;
v10 = v113;
v14 = 2;
v9 += 2;
LODWORD(v17) = 1;
goto LABEL_37;
}
v60 = v84 == v14;
}
if( !v60 )
goto LABEL_68;
goto LABEL_18;
}
LABEL_39:
*(_WORD *)FreeWhenDone = v9;
return v11;
}Referenced by:
AdtpWriteToEtw
AdtpWriteToEtwEx