SdbQueryDataExTagID

INT64 __fastcall SdbQueryDataExTagID(
        RTL_RUN_ONCE *a1,
        UINT64 a2,
        INT64 a3,
        INT64 *a4,
        VOID *dst,
        UINT64 *a6,
        UINT64 *a7){
  int DWORDTag; 
  WCHAR *v8; 
  unsigned int v9; 
  __int64 v11; 
  UINT64 v12; 
  WCHAR *v13; 
  WCHAR *v14; 
  WCHAR *v15; 
  WCHAR *v16; 
  unsigned int FirstNamedTag; 
  unsigned int FirstTag; 
  unsigned int TagDataSize; 
  UINT8 *StringTagPtr; 
  INT16 v21; 
  unsigned int v22; 
  unsigned int v23; 
  __int64 v25; 
  const CHAR *v26; 
  UINT64 v27; 
  __int64 v28; 
  wchar_t *Str1; 
  WCHAR *P; 
  INT64 QWORDTag; 
  int Src; 
  int v33; 
  INT64 *v34; 
  v34 = a4;
  v33 = HIDWORD(a3);
  DWORDTag = 0;
  v8 = (WCHAR *)L"Policy";
  v9 = a2;
  Src = 0;
  QWORDTag = 0i64;
  if( __PAIR128__((unsigned __int64)a6, (unsigned __int64)dst) == 0 )
  {
    AslLogCallPrintf(1ui64, "SdbQueryDataExTagID", 0x1546ui64, "One of lpBuffer or lpcbBufferSize should not be null");
    return 87;
  }
  v11 = -1i64;
  do
    ++v11;
  while( aPolicy[v11] );
  v12 = (int)v11 + 1;
  v13 = (WCHAR *)AslAlloc(a1, 2 * v12, a3);
  P = v13;
  if( !v13 )
  {
    AslLogCallPrintf(
      1ui64,
      "SdbQueryDataExTagID",
      0x1552ui64,
      "Cannot allocate temporary buffer for parsing the name \"%ws\"",
      L"Policy");
    return 8;
  }
  v14 = v13;
  while( 1 )
  {
    v15 = wcschr(v8, 0x5Cu);
    v16 = v15;
    if( v15 )
    {
      v25 = v15 - v8;
      if( (int)RtlStringCchCopyNW(P, v12, v8, v25) < 0 )
      {
LABEL_62:
        v23 = 122;
        goto LABEL_33;
      }
      P[v25] = 0;
      v8 = v16 + 1;
      v14 = P;
    }
    else
    {
      if( RtlStringCchCopyW(v14, v12, v8) < 0 )
        goto LABEL_62;
      v8 = 0i64;
    }
    FirstNamedTag = SdbFindFirstNamedTag(a1, v9, 28687, 24577, v14);
    v9 = FirstNamedTag;
    if( !v8 || !*v8 )
      break;
    if( !FirstNamedTag )
      goto LABEL_45;
  }
  if( !FirstNamedTag )
  {
LABEL_45:
    v23 = 1168;
    goto LABEL_33;
  }
  FirstTag = SdbFindFirstTag((INT64)a1, FirstNamedTag, 16408);
  if( FirstTag )
  {
    DWORDTag = SdbReadDWORDTag((INT64)a1, FirstTag, 0i64);
  }
  else
  {
    LODWORD(Str1) = v9;
    AslLogCallPrintf(
      1ui64,
      "SdbQueryDataExTagID",
      0x1583ui64,
      "The entry 0x%x does not have valuetype information",
      Str1);
  }
  TagDataSize = 0;
  StringTagPtr = 0i64;
  switch( DWORDTag )
  {
    case 0:
      goto LABEL_54;
    case 1:
      v21 = 24606;
      break;
    case 3:
      v21 = -28667;
      break;
    case 4:
      v21 = 16409;
      break;
    case 11:
      v21 = 20487;
      break;
    default:
      LODWORD(Str1) = v9;
      AslLogCallPrintf(
        1ui64,
        "SdbQueryDataExTagID",
        0x15A8ui64,
        "The entry 0x%x contains bad valuetype information 0x%x",
        Str1,
        DWORDTag);
      v23 = 1358;
      goto LABEL_33;
  }
  v22 = SdbFindFirstTag((INT64)a1, v9, v21);
  if( !v22 )
  {
    LODWORD(Str1) = v9;
    AslLogCallPrintf(1ui64, "SdbQueryDataExTagID", 0x15B4ui64, "The entry 0x%x contains no value", Str1);
    goto LABEL_45;
  }
  switch( DWORDTag )
  {
    case 1:
      StringTagPtr = (UINT8 *)SdbGetStringTagPtr(a1, v22);
      if( StringTagPtr )
      {
        v28 = -1i64;
        do
          ++v28;
        while( *(_WORD *)&StringTagPtr[2 * v28] );
        TagDataSize = 2 * v28 + 2;
        goto LABEL_54;
      }
      v26 = "The entry 0x%x contains bad string value 0x%x";
      v27 = 5572i64;
      goto LABEL_44;
    case 3:
      TagDataSize = SdbGetTagDataSize((INT64)a1, v22);
      StringTagPtr = (UINT8 *)SdbpGetMappedTagData((INT64)a1, v22);
      if( StringTagPtr )
        goto LABEL_54;
      v26 = "The entry 0x%x contains bad binary value 0x%x";
      v27 = 5586i64;
LABEL_44:
      LODWORD(Str1) = v9;
      AslLogCallPrintf(1ui64, "SdbQueryDataExTagID", v27, v26, Str1, v22);
      goto LABEL_45;
    case 4:
      Src = SdbReadDWORDTag((INT64)a1, v22, 0i64);
      StringTagPtr = (UINT8 *)&Src;
      TagDataSize = 4;
      goto LABEL_23;
  }
  QWORDTag = SdbReadQWORDTag((INT64)a1, v22, 0i64);
  StringTagPtr = (UINT8 *)&QWORDTag;
  TagDataSize = 8;
LABEL_54:
  v23 = 0;
  if( TagDataSize )
  {
LABEL_23:
    if( dst && a6 && *(_DWORD *)a6 >= TagDataSize )
    {
      memmove((UINT8 *)dst, StringTagPtr, *(unsigned int *)a6);
      v23 = 0;
    }
    else
    {
      v23 = 122;
    }
  }
  if( a6 )
    *(_DWORD *)a6 = TagDataSize;
  if( v34 )
    *(_DWORD *)v34 = DWORDTag;
  if( a7 )
    *(_DWORD *)a7 = v9;
LABEL_33:
  ExFreePoolWithTag(P, 0x74705041u);
  return v23;
}

Referenced by: