AppendOutputFuncList

decompiled_code:
__int64 __fastcall AppendOutputFuncList(__int64 a1, __int64 a2, __int64 *a3)
{
_QWORD *v4; // rdx
__int64 result; // rax
__int64 v6; // rcx

v4 = (_QWORD *)SnortAlloc(24LL);
result = *a3;
if ( *a3 )
{
do
{
v6 = result;
result = *(_QWORD *)(result + 16);
}
while ( result );
*(_QWORD *)(v6 + 16) = v4;
v4[1] = a1;
*v4 = a2;
}
else
{
*a3 = (__int64)v4;
v4[1] = a1;
*v4 = a2;
}
return result;
}

canonical_decompiled_code:
__int64 __fastcall func0(__int64 a1, __int64 a2, __int64 *a3)
{
_QWORD *v4; // rdx
__int64 result; // rax
__int64 v6; // rcx

v4 = (_QWORD *)SnortAlloc(24LL);
result = *a3;
if ( *a3 )
{
do
{
v6 = result;
result = *(_QWORD *)(result + 16);
}
while ( result );
*(_QWORD *)(v6 + 16) = v4;
v4[1] = a1;
*v4 = a2;
}
else
{
*a3 = (__int64)v4;
v4[1] = a1;
*v4 = a2;
}
return result;
}

original_code:
void AppendOutputFuncList(OutputFunc func, void *arg, OutputFuncNode **list)
{
    OutputFuncNode *node;
    if (list == ((void *)0))
        return;
    node = (OutputFuncNode *)SnortAlloc(sizeof(OutputFuncNode));
    if (*list == ((void *)0))
    {
        *list = node;
    }
    else
    {
        OutputFuncNode *tmp = *list;
        while (tmp->next != ((void *)0))
            tmp = tmp->next;
        tmp->next = node;
    }
    node->func = func;
    node->arg = arg;
}

canonical_original_code:
void AppendOutputFuncList(void (*func)(struct _Packet *, void *, unsigned int, void *), void *arg, struct _OutputFuncNode **list)
{
    struct _OutputFuncNode *node;
    if (list == ((void *)0))
        return;
    node = (struct _OutputFuncNode *)SnortAlloc(sizeof(OutputFuncNode));
    if (*list == ((void *)0))
    {
        *list = node;
    }
    else
    {
        struct _OutputFuncNode *tmp = *list;
        while (tmp->next != ((void *)0))
            tmp = tmp->next;
        tmp->next = node;
    }
    node->func = func;
    node->arg = arg;
}

variable_types: void (*)(struct _Packet { struct pcap_pkthdr { struct timeval { long tv_sec; long tv_usec; } ts; unsigned int caplen; unsigned int len; } *pkth; unsigned char *pkt; struct _EtherARP { struct _ARPHdr { unsigned short ar_hrd; unsigned short ar_pro; unsigned char ar_hln; unsigned char ar_pln; unsigned short ar_op; } ea_hdr; unsigned char arp_sha[6]; unsigned char arp_spa[4]; unsigned char arp_tha[6]; unsigned char arp_tpa[4]; } *ah; struct _EtherHdr { unsigned char ether_dst[6]; unsigned char ether_src[6]; unsigned short ether_type; } *eh; struct _VlanTagHdr { unsigned short vth_pri_cfi_vlan; unsigned short vth_proto; } *vh; struct _EthLlc { unsigned char dsap; unsigned char ssap; } *ehllc; struct _EthLlcOther { unsigned char ctrl; unsigned char org_code[3]; unsigned short proto_id; } *ehllcother; struct _GREHdr { unsigned char flags; unsigned char version; unsigned short ether_type; } *greh; unsigned int *mpls; struct _IPHdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct in_addr { unsigned int s_addr; } ip_src; struct in_addr ip_dst; } *iph; struct _IPHdr *inner_iph; struct _IPHdr *outer_iph; struct _TCPHdr { unsigned short th_sport; unsigned short th_dport; unsigned int th_seq; unsigned int th_ack; unsigned char th_offx2; unsigned char th_flags; unsigned short th_win; unsigned short th_sum; unsigned short th_urp; } *tcph; struct _UDPHdr { unsigned short uh_sport; unsigned short uh_dport; unsigned short uh_len; unsigned short uh_chk; } *udph; struct _ICMPHdr { unsigned char type; unsigned char code; unsigned short csum; union { unsigned char pptr; struct in_addr gwaddr; struct idseq { unsigned short id; unsigned short seq; } idseq; int sih_void; struct pmtu { unsigned short ipm_void; unsigned short nextmtu; } pmtu; struct rtradv { unsigned char num_addrs; unsigned char wpa; unsigned short lifetime; } rtradv; } icmp_hun; union { struct ts { unsigned int otime; unsigned int rtime; unsigned int ttime; } ts; struct ih_ip { struct _IPHdr *ip; } ip; struct ra_addr { unsigned int addr; unsigned int preference; } radv; unsigned int mask; char data[1]; } icmp_dun; } *icmph; unsigned char *data; unsigned char *ip_data; unsigned char *outer_ip_data; unsigned char *ip_frag_start; unsigned char *ip_options_data; unsigned char *tcp_options_data; void *ssnptr; void *fragtracker; void *flow; void *streamptr; struct _IPv4Hdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct _ip { int family; int bits; union { unsigned int u6_addr8[16]; unsigned int u6_addr16[8]; unsigned int u6_addr32[4]; } ip; } ip_src; struct _ip ip_dst; } *ip4h; struct _IPv6Hdr { unsigned int vcl; unsigned short len; unsigned char next; unsigned char hop_lmt; struct _ip ip_src; struct _ip ip_dst; } *ip6h; struct _ICMP6 { unsigned char type; unsigned char code; unsigned short csum; } *icmp6h; struct _IPH_API { struct _ip *(*iph_ret_src)(struct _Packet *); struct _ip *(*iph_ret_dst)(struct _Packet *); unsigned short (*iph_ret_tos)(struct _Packet *); unsigned char (*iph_ret_ttl)(struct _Packet *); unsigned short (*iph_ret_len)(struct _Packet *); unsigned int (*iph_ret_id)(struct _Packet *); unsigned char (*iph_ret_proto)(struct _Packet *); unsigned short (*iph_ret_off)(struct _Packet *); unsigned char (*iph_ret_ver)(struct _Packet *); unsigned char (*iph_ret_hlen)(struct _Packet *); struct _ip *(*orig_iph_ret_src)(struct _Packet *); struct _ip *(*orig_iph_ret_dst)(struct _Packet *); unsigned short (*orig_iph_ret_tos)(struct _Packet *); unsigned char (*orig_iph_ret_ttl)(struct _Packet *); unsigned short (*orig_iph_ret_len)(struct _Packet *); unsigned int (*orig_iph_ret_id)(struct _Packet *); unsigned char (*orig_iph_ret_proto)(struct _Packet *); unsigned short (*orig_iph_ret_off)(struct _Packet *); unsigned char (*orig_iph_ret_ver)(struct _Packet *); unsigned char (*orig_iph_ret_hlen)(struct _Packet *); char ver; } *iph_api; struct _IPH_API *orig_iph_api; struct _IPH_API *outer_iph_api; struct _IPH_API *outer_orig_iph_api; struct _IPv4Hdr inner_ip4h; struct _IPv6Hdr inner_ip6h; struct _IPv4Hdr outer_ip4h; struct _IPv6Hdr outer_ip6h; struct _MplsHdr { unsigned int label; unsigned char exp; unsigned char bos; unsigned char ttl; } mplsHdr; int family; int orig_family; int outer_family; int bytes_to_inspect; unsigned int preprocessor_bits; unsigned int preproc_reassembly_pkt_bits; unsigned int caplen; unsigned int http_pipeline_count; unsigned int packet_flags; unsigned int proto_bits; unsigned short dsize; unsigned short ip_dsize; unsigned short alt_dsize; unsigned short actual_ip_len; unsigned short outer_ip_dsize; unsigned short frag_offset; unsigned short ip_frag_len; unsigned short ip_options_len; unsigned short tcp_options_len; unsigned short sp; unsigned short dp; unsigned short orig_sp; unsigned short orig_dp; short application_protocol_ordinal; unsigned char frag_flag; unsigned char mf; unsigned char df; unsigned char rf; unsigned char uri_count; unsigned char csum_flags; unsigned char encapsulated; unsigned char ip_option_count; unsigned char tcp_option_count; unsigned char ip6_extension_count; unsigned char ip6_frag_index; unsigned char ip_lastopt_bad; unsigned char tcp_lastopt_bad; struct _Fddi_hdr { unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; } *fddihdr; struct _Fddi_llc_saps { unsigned char dsap; unsigned char ssap; } *fddisaps; struct _Fddi_llc_sna { unsigned char ctrl_fld[2]; } *fddisna; struct _Fddi_llc_iparp { unsigned char ctrl_fld; unsigned char protid[3]; unsigned short ethertype; } *fddiiparp; struct _Fddi_llc_other { unsigned char ctrl_fld[1]; } *fddiother; struct _Trh_hdr { unsigned char ac; unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; } *trh; struct _Trh_llc { unsigned char dsap; unsigned char ssap; unsigned char protid[3]; unsigned short ethertype; } *trhllc; struct _Trh_mr { unsigned short bcast_len_dir_lf_res; unsigned short rseg[8]; } *trhmr; struct _Pflog1_hdr { unsigned int af; char intf[16]; short rule; unsigned short reason; unsigned short action; unsigned short dir; } *pf1h; struct _Pflog2_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned char dir; unsigned char pad[3]; } *pf2h; struct _Pflog3_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned int uid; unsigned int pid; unsigned int rule_uid; unsigned int rule_pid; unsigned char dir; unsigned char pad[3]; } *pf3h; struct _SLLHdr { unsigned short sll_pkttype; unsigned short sll_hatype; unsigned short sll_halen; unsigned char sll_addr[8]; unsigned short sll_protocol; } *sllh; struct _WifiHdr { unsigned short frame_control; unsigned short duration_id; unsigned char addr1[6]; unsigned char addr2[6]; unsigned char addr3[6]; unsigned short seq_control; unsigned char addr4[6]; } *wifih; struct _PPPoEHdr { struct _EtherHdr ethhdr; unsigned char ver_type; unsigned char code; unsigned short session; unsigned short length; } *pppoeh; struct _EtherEapol { unsigned char version; unsigned char eaptype; unsigned short len; } *eplh; struct _EAPHdr { unsigned char code; unsigned char id; unsigned short len; } *eaph; unsigned char *eaptype; struct _EapolKey { unsigned char type; unsigned char length[2]; unsigned char counter[8]; unsigned char iv[16]; unsigned char index; unsigned char sig[16]; } *eapolk; struct _Options { unsigned char code; unsigned char len; unsigned char *data; } ip_options[40]; struct _Options tcp_options[40]; struct _IP6Option { unsigned char type; unsigned char *data; } ip6_extensions[40]; unsigned short configPolicyId; int linktype; } *, void *, unsigned int, void *)

variable_types: struct _OutputFuncNode { void *arg; void (*func)(struct _Packet *, void *, unsigned int, void *); struct _OutputFuncNode *next; } **

variable_types: struct _OutputFuncNode { void *arg; void (*func)(struct _Packet { struct pcap_pkthdr { struct timeval { long tv_sec; long tv_usec; } ts; unsigned int caplen; unsigned int len; } *pkth; unsigned char *pkt; struct _EtherARP { struct _ARPHdr { unsigned short ar_hrd; unsigned short ar_pro; unsigned char ar_hln; unsigned char ar_pln; unsigned short ar_op; } ea_hdr; unsigned char arp_sha[6]; unsigned char arp_spa[4]; unsigned char arp_tha[6]; unsigned char arp_tpa[4]; } *ah; struct _EtherHdr { unsigned char ether_dst[6]; unsigned char ether_src[6]; unsigned short ether_type; } *eh; struct _VlanTagHdr { unsigned short vth_pri_cfi_vlan; unsigned short vth_proto; } *vh; struct _EthLlc { unsigned char dsap; unsigned char ssap; } *ehllc; struct _EthLlcOther { unsigned char ctrl; unsigned char org_code[3]; unsigned short proto_id; } *ehllcother; struct _GREHdr { unsigned char flags; unsigned char version; unsigned short ether_type; } *greh; unsigned int *mpls; struct _IPHdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct in_addr { unsigned int s_addr; } ip_src; struct in_addr ip_dst; } *iph; struct _IPHdr *inner_iph; struct _IPHdr *outer_iph; struct _TCPHdr { unsigned short th_sport; unsigned short th_dport; unsigned int th_seq; unsigned int th_ack; unsigned char th_offx2; unsigned char th_flags; unsigned short th_win; unsigned short th_sum; unsigned short th_urp; } *tcph; struct _UDPHdr { unsigned short uh_sport; unsigned short uh_dport; unsigned short uh_len; unsigned short uh_chk; } *udph; struct _ICMPHdr { unsigned char type; unsigned char code; unsigned short csum; union { unsigned char pptr; struct in_addr gwaddr; struct idseq { unsigned short id; unsigned short seq; } idseq; int sih_void; struct pmtu { unsigned short ipm_void; unsigned short nextmtu; } pmtu; struct rtradv { unsigned char num_addrs; unsigned char wpa; unsigned short lifetime; } rtradv; } icmp_hun; union { struct ts { unsigned int otime; unsigned int rtime; unsigned int ttime; } ts; struct ih_ip { struct _IPHdr *ip; } ip; struct ra_addr { unsigned int addr; unsigned int preference; } radv; unsigned int mask; char data[1]; } icmp_dun; } *icmph; unsigned char *data; unsigned char *ip_data; unsigned char *outer_ip_data; unsigned char *ip_frag_start; unsigned char *ip_options_data; unsigned char *tcp_options_data; void *ssnptr; void *fragtracker; void *flow; void *streamptr; struct _IPv4Hdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct _ip { int family; int bits; union { unsigned int u6_addr8[16]; unsigned int u6_addr16[8]; unsigned int u6_addr32[4]; } ip; } ip_src; struct _ip ip_dst; } *ip4h; struct _IPv6Hdr { unsigned int vcl; unsigned short len; unsigned char next; unsigned char hop_lmt; struct _ip ip_src; struct _ip ip_dst; } *ip6h; struct _ICMP6 { unsigned char type; unsigned char code; unsigned short csum; } *icmp6h; struct _IPH_API { struct _ip *(*iph_ret_src)(struct _Packet *); struct _ip *(*iph_ret_dst)(struct _Packet *); unsigned short (*iph_ret_tos)(struct _Packet *); unsigned char (*iph_ret_ttl)(struct _Packet *); unsigned short (*iph_ret_len)(struct _Packet *); unsigned int (*iph_ret_id)(struct _Packet *); unsigned char (*iph_ret_proto)(struct _Packet *); unsigned short (*iph_ret_off)(struct _Packet *); unsigned char (*iph_ret_ver)(struct _Packet *); unsigned char (*iph_ret_hlen)(struct _Packet *); struct _ip *(*orig_iph_ret_src)(struct _Packet *); struct _ip *(*orig_iph_ret_dst)(struct _Packet *); unsigned short (*orig_iph_ret_tos)(struct _Packet *); unsigned char (*orig_iph_ret_ttl)(struct _Packet *); unsigned short (*orig_iph_ret_len)(struct _Packet *); unsigned int (*orig_iph_ret_id)(struct _Packet *); unsigned char (*orig_iph_ret_proto)(struct _Packet *); unsigned short (*orig_iph_ret_off)(struct _Packet *); unsigned char (*orig_iph_ret_ver)(struct _Packet *); unsigned char (*orig_iph_ret_hlen)(struct _Packet *); char ver; } *iph_api; struct _IPH_API *orig_iph_api; struct _IPH_API *outer_iph_api; struct _IPH_API *outer_orig_iph_api; struct _IPv4Hdr inner_ip4h; struct _IPv6Hdr inner_ip6h; struct _IPv4Hdr outer_ip4h; struct _IPv6Hdr outer_ip6h; struct _MplsHdr { unsigned int label; unsigned char exp; unsigned char bos; unsigned char ttl; } mplsHdr; int family; int orig_family; int outer_family; int bytes_to_inspect; unsigned int preprocessor_bits; unsigned int preproc_reassembly_pkt_bits; unsigned int caplen; unsigned int http_pipeline_count; unsigned int packet_flags; unsigned int proto_bits; unsigned short dsize; unsigned short ip_dsize; unsigned short alt_dsize; unsigned short actual_ip_len; unsigned short outer_ip_dsize; unsigned short frag_offset; unsigned short ip_frag_len; unsigned short ip_options_len; unsigned short tcp_options_len; unsigned short sp; unsigned short dp; unsigned short orig_sp; unsigned short orig_dp; short application_protocol_ordinal; unsigned char frag_flag; unsigned char mf; unsigned char df; unsigned char rf; unsigned char uri_count; unsigned char csum_flags; unsigned char encapsulated; unsigned char ip_option_count; unsigned char tcp_option_count; unsigned char ip6_extension_count; unsigned char ip6_frag_index; unsigned char ip_lastopt_bad; unsigned char tcp_lastopt_bad; struct _Fddi_hdr { unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; } *fddihdr; struct _Fddi_llc_saps { unsigned char dsap; unsigned char ssap; } *fddisaps; struct _Fddi_llc_sna { unsigned char ctrl_fld[2]; } *fddisna; struct _Fddi_llc_iparp { unsigned char ctrl_fld; unsigned char protid[3]; unsigned short ethertype; } *fddiiparp; struct _Fddi_llc_other { unsigned char ctrl_fld[1]; } *fddiother; struct _Trh_hdr { unsigned char ac; unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; } *trh; struct _Trh_llc { unsigned char dsap; unsigned char ssap; unsigned char protid[3]; unsigned short ethertype; } *trhllc; struct _Trh_mr { unsigned short bcast_len_dir_lf_res; unsigned short rseg[8]; } *trhmr; struct _Pflog1_hdr { unsigned int af; char intf[16]; short rule; unsigned short reason; unsigned short action; unsigned short dir; } *pf1h; struct _Pflog2_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned char dir; unsigned char pad[3]; } *pf2h; struct _Pflog3_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned int uid; unsigned int pid; unsigned int rule_uid; unsigned int rule_pid; unsigned char dir; unsigned char pad[3]; } *pf3h; struct _SLLHdr { unsigned short sll_pkttype; unsigned short sll_hatype; unsigned short sll_halen; unsigned char sll_addr[8]; unsigned short sll_protocol; } *sllh; struct _WifiHdr { unsigned short frame_control; unsigned short duration_id; unsigned char addr1[6]; unsigned char addr2[6]; unsigned char addr3[6]; unsigned short seq_control; unsigned char addr4[6]; } *wifih; struct _PPPoEHdr { struct _EtherHdr ethhdr; unsigned char ver_type; unsigned char code; unsigned short session; unsigned short length; } *pppoeh; struct _EtherEapol { unsigned char version; unsigned char eaptype; unsigned short len; } *eplh; struct _EAPHdr { unsigned char code; unsigned char id; unsigned short len; } *eaph; unsigned char *eaptype; struct _EapolKey { unsigned char type; unsigned char length[2]; unsigned char counter[8]; unsigned char iv[16]; unsigned char index; unsigned char sig[16]; } *eapolk; struct _Options { unsigned char code; unsigned char len; unsigned char *data; } ip_options[40]; struct _Options tcp_options[40]; struct _IP6Option { unsigned char type; unsigned char *data; } ip6_extensions[40]; unsigned short configPolicyId; int linktype; } *, void *, unsigned int, void *); struct _OutputFuncNode *next; } *

user_defined_types: struct _Packet { struct pcap_pkthdr *pkth; unsigned char *pkt; struct _EtherARP *ah; struct _EtherHdr *eh; struct _VlanTagHdr *vh; struct _EthLlc *ehllc; struct _EthLlcOther *ehllcother; struct _GREHdr *greh; unsigned int *mpls; struct _IPHdr *iph; struct _IPHdr *inner_iph; struct _IPHdr *outer_iph; struct _TCPHdr *tcph; struct _UDPHdr *udph; struct _ICMPHdr *icmph; unsigned char *data; unsigned char *ip_data; unsigned char *outer_ip_data; unsigned char *ip_frag_start; unsigned char *ip_options_data; unsigned char *tcp_options_data; void *ssnptr; void *fragtracker; void *flow; void *streamptr; struct _IPv4Hdr *ip4h; struct _IPv6Hdr *ip6h; struct _ICMP6 *icmp6h; struct _IPH_API *iph_api; struct _IPH_API *orig_iph_api; struct _IPH_API *outer_iph_api; struct _IPH_API *outer_orig_iph_api; struct _IPv4Hdr inner_ip4h; struct _IPv6Hdr inner_ip6h; struct _IPv4Hdr outer_ip4h; struct _IPv6Hdr outer_ip6h; struct _MplsHdr mplsHdr; int family; int orig_family; int outer_family; int bytes_to_inspect; unsigned int preprocessor_bits; unsigned int preproc_reassembly_pkt_bits; unsigned int caplen; unsigned int http_pipeline_count; unsigned int packet_flags; unsigned int proto_bits; unsigned short dsize; unsigned short ip_dsize; unsigned short alt_dsize; unsigned short actual_ip_len; unsigned short outer_ip_dsize; unsigned short frag_offset; unsigned short ip_frag_len; unsigned short ip_options_len; unsigned short tcp_options_len; unsigned short sp; unsigned short dp; unsigned short orig_sp; unsigned short orig_dp; short application_protocol_ordinal; unsigned char frag_flag; unsigned char mf; unsigned char df; unsigned char rf; unsigned char uri_count; unsigned char csum_flags; unsigned char encapsulated; unsigned char ip_option_count; unsigned char tcp_option_count; unsigned char ip6_extension_count; unsigned char ip6_frag_index; unsigned char ip_lastopt_bad; unsigned char tcp_lastopt_bad; struct _Fddi_hdr *fddihdr; struct _Fddi_llc_saps *fddisaps; struct _Fddi_llc_sna *fddisna; struct _Fddi_llc_iparp *fddiiparp; struct _Fddi_llc_other *fddiother; struct _Trh_hdr *trh; struct _Trh_llc *trhllc; struct _Trh_mr *trhmr; struct _Pflog1_hdr *pf1h; struct _Pflog2_hdr *pf2h; struct _Pflog3_hdr *pf3h; struct _SLLHdr *sllh; struct _WifiHdr *wifih; struct _PPPoEHdr *pppoeh; struct _EtherEapol *eplh; struct _EAPHdr *eaph; unsigned char *eaptype; struct _EapolKey *eapolk; struct _Options ip_options[40]; struct _Options tcp_options[40]; struct _IP6Option ip6_extensions[40]; unsigned short configPolicyId; int linktype; }

user_defined_types: struct pcap_pkthdr { struct timeval ts; unsigned int caplen; unsigned int len; }

user_defined_types: struct _EtherARP { struct _ARPHdr ea_hdr; unsigned char arp_sha[6]; unsigned char arp_spa[4]; unsigned char arp_tha[6]; unsigned char arp_tpa[4]; }

user_defined_types: struct _IPHdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct in_addr ip_src; struct in_addr ip_dst; }

user_defined_types: struct _ICMPHdr { unsigned char type; unsigned char code; unsigned short csum; union { unsigned char pptr; struct in_addr gwaddr; struct idseq idseq; int sih_void; struct pmtu pmtu; struct rtradv rtradv; } icmp_hun; union { struct ts ts; struct ih_ip ip; struct ra_addr radv; unsigned int mask; char data[1]; } icmp_dun; }

user_defined_types: struct _IPv4Hdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct _ip ip_src; struct _ip ip_dst; }


RegisterInputPlugins

decompiled_code:
__int64 RegisterInputPlugins()
{
LogMessage("Initializing Input Plugins!\n");
return Unified2Setup();
}

canonical_decompiled_code:
__int64 func1()
{
LogMessage("Initializing Input Plugins!\n");
return Unified2Setup();
}

original_code:
void RegisterInputPlugins()
{
    LogMessage("Initializing Input Plugins!\n");
 Unified2Setup();
}

return_type: void


GetInputPlugin

decompiled_code:
__int64 __fastcall GetInputPlugin(char *s1)
{
__int64 v1; // r12

v1 = InputList;
if ( !s1 )
return 0LL;
if ( !InputList )
{
LABEL_7:
FatalError("unknown input plugin: '%s'\n", s1);
return 0LL;
}
while ( strcasecmp(s1, *(const char **)v1) )
{
v1 = *(_QWORD *)(v1 + 40);
if ( !v1 )
goto LABEL_7;
}
return v1;
}

canonical_decompiled_code:
__int64 __fastcall func2(char *s1)
{
__int64 v1; // r12

v1 = InputList;
if ( !s1 )
return 0LL;
if ( !InputList )
{
LABEL_7:
FatalError("unknown input plugin: '%s'\n", s1);
return 0LL;
}
while ( strcasecmp(s1, *(const char **)v1) )
{
v1 = *(_QWORD *)(v1 + 40);
if ( !v1 )
goto LABEL_7;
}
return v1;
}

original_code:
InputFuncNode *GetInputPlugin(char *keyword)
{
    InputFuncNode *node = InputList;
    if (keyword == ((void *)0))
        return ((void *)0);
    while ((node != ((void *)0)) && (strcasecmp(keyword, node->keyword) != 0))
    {
        node = node->next;
    }
    if (node == ((void *)0))
    {
        FatalError("unknown input plugin: '%s'\n", keyword);
    }
    return node;
}

canonical_original_code:
struct _InputFuncNode *GetInputPlugin(char *keyword)
{
    struct _InputFuncNode *node = InputList;
    if (keyword == ((void *)0))
        return ((void *)0);
    while ((node != ((void *)0)) && (strcasecmp(keyword, node->keyword) != 0))
    {
        node = node->next;
    }
    if (node == ((void *)0))
    {
        FatalError("unknown input plugin: '%s'\n", keyword);
    }
    return node;
}

variable_types:
keyword
char *

variable_types: struct _InputFuncNode { char *keyword; int configured_flag; void *arg; int (*readRecordHeader)(void *); int (*readRecord)(void *); struct _InputFuncNode *next; } *


RegisterInputPlugin

decompiled_code:
__int64 __fastcall RegisterInputPlugin(char *s2, const void *a2)
{
__int64 *v2; // r13
_QWORD *v3; // r12
__int64 v4; // rbx
__int64 v5; // rax
__int64 v6; // rax
__int64 v7; // rbx
__int64 v8; // rax
__int64 result; // rax

v2 = (__int64 *)SnortAlloc(24LL);
v3 = (_QWORD *)SnortAlloc(48LL);
DebugMessageFile = "plugbase.c";
DebugMessageLine = 142;
DebugMessageFunc(4LL, "Registering keyword:input => %s:%p\n", s2, a2);
v4 = input_config_funcs;
if ( !input_config_funcs )
{
input_config_funcs = v2;
goto LABEL_8;
}
while ( strcasecmp(*(const char **)v4, s2) )
{
v5 = *(_QWORD *)(v4 + 16);
if ( !v5 )
goto LABEL_7;
LABEL_4:
v4 = v5;
}
free(v2);
FatalError("Duplicate input keyword: %s\n", s2);
v5 = *(_QWORD *)(v4 + 16);
if ( v5 )
goto LABEL_4;
LABEL_7:
*(_QWORD *)(v4 + 16) = v2;
LABEL_8:
v6 = SnortStrdup(s2);
v2[1] = (__int64)a2;
*v2 = v6;
v7 = InputList;
if ( InputList )
{
while ( 1 )
{
if ( !strcasecmp(*(const char **)v7, s2) )
{
free(v3);
FatalError("Duplicate input keyword: %s\n", s2);
v8 = *(_QWORD *)(v7 + 40);
if ( !v8 )
{
LABEL_14:
*(_QWORD *)(v7 + 40) = v3;
goto LABEL_15;
}
}
else
{
v8 = *(_QWORD *)(v7 + 40);
if ( !v8 )
goto LABEL_14;
}
v7 = v8;
}
}
InputList = v3;
LABEL_15:
result = SnortStrdup(s2);
*v3 = result;
return result;
}

canonical_decompiled_code:
__int64 __fastcall func3(char *s2, const void *a2)
{
__int64 *v2; // r13
_QWORD *v3; // r12
__int64 v4; // rbx
__int64 v5; // rax
__int64 v6; // rax
__int64 v7; // rbx
__int64 v8; // rax
__int64 result; // rax

v2 = (__int64 *)SnortAlloc(24LL);
v3 = (_QWORD *)SnortAlloc(48LL);
DebugMessageFile = "plugbase.c";
DebugMessageLine = 142;
DebugMessageFunc(4LL, "Registering keyword:input => %s:%p\n", s2, a2);
v4 = input_config_funcs;
if ( !input_config_funcs )
{
input_config_funcs = v2;
goto LABEL_8;
}
while ( strcasecmp(*(const char **)v4, s2) )
{
v5 = *(_QWORD *)(v4 + 16);
if ( !v5 )
goto LABEL_7;
LABEL_4:
v4 = v5;
}
free(v2);
FatalError("Duplicate input keyword: %s\n", s2);
v5 = *(_QWORD *)(v4 + 16);
if ( v5 )
goto LABEL_4;
LABEL_7:
*(_QWORD *)(v4 + 16) = v2;
LABEL_8:
v6 = SnortStrdup(s2);
v2[1] = (__int64)a2;
*v2 = v6;
v7 = InputList;
if ( InputList )
{
while ( 1 )
{
if ( !strcasecmp(*(const char **)v7, s2) )
{
free(v3);
FatalError("Duplicate input keyword: %s\n", s2);
v8 = *(_QWORD *)(v7 + 40);
if ( !v8 )
{
LABEL_14:
*(_QWORD *)(v7 + 40) = v3;
goto LABEL_15;
}
}
else
{
v8 = *(_QWORD *)(v7 + 40);
if ( !v8 )
goto LABEL_14;
}
v7 = v8;
}
}
InputList = v3;
LABEL_15:
result = SnortStrdup(s2);
*v3 = result;
return result;
}

original_code:
void RegisterInputPlugin(char *keyword, InputConfigFunc func)
{
    InputConfigFuncNode *node = (InputConfigFuncNode *)SnortAlloc(sizeof(InputConfigFuncNode));
    InputFuncNode *node2 = (InputFuncNode *)SnortAlloc(sizeof(InputFuncNode));
    DebugMessageFile = "plugbase.c"; DebugMessageLine = 142; DebugMessageFunc(0x00000004,"Registering keyword:input => %s:%p\n", keyword, func);;
    if (input_config_funcs == ((void *)0))
    {
        input_config_funcs = node;
    }
    else
    {
        InputConfigFuncNode *tmp = input_config_funcs;
        InputConfigFuncNode *last;
        do
        {
            if (strcasecmp(tmp->keyword, keyword) == 0)
            {
                free(node);
                FatalError("Duplicate input keyword: %s\n", keyword);
            }
            last = tmp;
            tmp = tmp->next;
        } while (tmp != ((void *)0));
        last->next = node;
    }
    node->keyword = SnortStrdup(keyword);
    node->func = func;
    if (InputList == ((void *)0))
    {
        InputList = node2;
    }
    else
    {
        InputFuncNode *tmp2 = InputList;
        InputFuncNode *last2;
        do
        {
            if (strcasecmp(tmp2->keyword, keyword) == 0)
            {
                free(node2);
                FatalError("Duplicate input keyword: %s\n", keyword);
            }
            last2 = tmp2;
            tmp2 = tmp2->next;
        } while (tmp2 != ((void *)0));
        last2->next = node2;
    }
    node2->keyword = SnortStrdup(keyword);
}

canonical_original_code:
void RegisterInputPlugin(char *keyword, void (*func)(char *))
{
    struct _InputConfigFuncNode *node = (InputConfigFuncNode *)SnortAlloc(sizeof(InputConfigFuncNode));
    struct _InputFuncNode *node2 = (InputFuncNode *)SnortAlloc(sizeof(InputFuncNode));
    DebugMessageFile = "plugbase.c"; DebugMessageLine = 142; DebugMessageFunc(0x00000004,"Registering keyword:input => %s:%p\n", keyword, func);;
    if (input_config_funcs == ((void *)0))
    {
        input_config_funcs = node;
    }
    else
    {
        struct _InputConfigFuncNode *tmp = input_config_funcs;
        struct _InputConfigFuncNode *last;
        do
        {
            if (strcasecmp(tmp->keyword, keyword) == 0)
            {
                free(node);
                FatalError("Duplicate input keyword: %s\n", keyword);
            }
            last = tmp;
            tmp = tmp->next;
        } while (tmp != ((void *)0));
        last->next = node;
    }
    node->keyword = SnortStrdup(keyword);
    node->func = func;
    if (InputList == ((void *)0))
    {
        InputList = node2;
    }
    else
    {
        struct _InputFuncNode *tmp2 = InputList;
        struct _InputFuncNode *last2;
        do
        {
            if (strcasecmp(tmp2->keyword, keyword) == 0)
            {
                free(node2);
                FatalError("Duplicate input keyword: %s\n", keyword);
            }
            last2 = tmp2;
            tmp2 = tmp2->next;
        } while (tmp2 != ((void *)0));
        last2->next = node2;
    }
    node2->keyword = SnortStrdup(keyword);
}

variable_types:
func
void (*)(char *)

variable_types: struct _InputConfigFuncNode { char *keyword; void (*func)(char *); struct _InputConfigFuncNode *next; } *

user_defined_types: struct _InputFuncNode { char *keyword; int configured_flag; void *arg; int (*readRecordHeader)(void *); int (*readRecord)(void *); struct _InputFuncNode *next; }


GetInputConfigFunc

decompiled_code:
__int64 __fastcall GetInputConfigFunc(char *s2)
{
__int64 v1; // rbx

v1 = input_config_funcs;
if ( !s2 || !input_config_funcs )
return 0LL;
while ( strcasecmp(*(const char **)v1, s2) )
{
v1 = *(_QWORD *)(v1 + 16);
if ( !v1 )
return 0LL;
}
return *(_QWORD *)(v1 + 8);
}

canonical_decompiled_code:
__int64 __fastcall func4(char *s2)
{
__int64 v1; // rbx

v1 = input_config_funcs;
if ( !s2 || !input_config_funcs )
return 0LL;
while ( strcasecmp(*(const char **)v1, s2) )
{
v1 = *(_QWORD *)(v1 + 16);
if ( !v1 )
return 0LL;
}
return *(_QWORD *)(v1 + 8);
}

original_code:
InputConfigFunc GetInputConfigFunc(char *keyword)
{
    InputConfigFuncNode *head = input_config_funcs;
    if (keyword == ((void *)0))
        return ((void *)0);
    while (head != ((void *)0))
    {
        if (strcasecmp(head->keyword, keyword) == 0)
           return head->func;
        head = head->next;
    }
    return ((void *)0);
}

canonical_original_code:
void (*GetInputConfigFunc(char *keyword))(char *)
{
    struct _InputConfigFuncNode *head = input_config_funcs;
    if (keyword == ((void *)0))
        return ((void *)0);
    while (head != ((void *)0))
    {
        if (strcasecmp(head->keyword, keyword) == 0)
           return head->func;
        head = head->next;
    }
    return ((void *)0);
}

return_type: void (*)(char *)

user_defined_types: struct _InputConfigFuncNode { char *keyword; void (*func)(char *); struct _InputConfigFuncNode *next; }


DumpInputPlugins

original_code:
void DumpInputPlugins()
{
    InputConfigFuncNode *idx = input_config_funcs;
    InputFuncNode *ifn = ((void *)0);
    LogMessage("-------------------------------------------------\n");
    LogMessage(" Keyword     |          Input @ \n");
    LogMessage("-------------------------------------------------\n");
    while(idx != ((void *)0))
    {
        LogMessage("%-13s: init() = %p\n", idx->keyword, idx->func);
        ifn = GetInputPlugin(idx->keyword);
  if ((ifn != ((void *)0)) && ifn->configured_flag)
  {
   LogMessage("%-13s:   - readRecordHeader() = %p\n",
       ifn->keyword, ifn->readRecordHeader);
   LogMessage("%-13s:   - readRecord()       = %p\n",
       ifn->keyword, ifn->readRecord);
  }
        idx = idx->next;
    }
    LogMessage("-------------------------------------------------\n\n");
}

canonical_original_code:
void DumpInputPlugins()
{
    struct _InputConfigFuncNode *idx = input_config_funcs;
    struct _InputFuncNode *ifn = ((void *)0);
    LogMessage("-------------------------------------------------\n");
    LogMessage(" Keyword     |          Input @ \n");
    LogMessage("-------------------------------------------------\n");
    while(idx != ((void *)0))
    {
        LogMessage("%-13s: init() = %p\n", idx->keyword, idx->func);
        ifn = GetInputPlugin(idx->keyword);
  if ((ifn != ((void *)0)) && ifn->configured_flag)
  {
   LogMessage("%-13s:   - readRecordHeader() = %p\n",
       ifn->keyword, ifn->readRecordHeader);
   LogMessage("%-13s:   - readRecord()       = %p\n",
       ifn->keyword, ifn->readRecord);
  }
        idx = idx->next;
    }
    LogMessage("-------------------------------------------------\n\n");
}


AddArgToInputList

decompiled_code:
__int64 __fastcall AddArgToInputList(char *a1, __int64 a2)
{
if ( !a1 )
return 0xFFFFFFFFLL;
*(_QWORD *)(GetInputPlugin(a1) + 16) = a2;
return 0LL;
}

canonical_decompiled_code:
__int64 __fastcall func6(char *a1, __int64 a2)
{
if ( !a1 )
return 0xFFFFFFFFLL;
*(_QWORD *)(func2(a1) + 16) = a2;
return 0LL;
}

original_code:
int AddArgToInputList(char *keyword, void *arg)
{
    InputFuncNode *node;
    if(keyword == ((void *)0))
        return -1;
    node = GetInputPlugin(keyword);
    node->arg = arg;
 return 0;
}

canonical_original_code:
int AddArgToInputList(char *keyword, void *arg)
{
    struct _InputFuncNode *node;
    if(keyword == ((void *)0))
        return -1;
    node = GetInputPlugin(keyword);
    node->arg = arg;
 return 0;
}

variable_types:
arg
void *

return_type: int


InputFuncNodeConfigured

decompiled_code:
_BOOL8 __fastcall InputFuncNodeConfigured(__int64 a1)
{
_BOOL8 result; // rax

if ( *(_QWORD *)(a1 + 24) )
result = *(_QWORD *)(a1 + 32) != 0LL;
else
result = 0LL;
return result;
}

canonical_decompiled_code:
_BOOL8 __fastcall func7(__int64 a1)
{
_BOOL8 result; // rax

if ( *(_QWORD *)(a1 + 24) )
result = *(_QWORD *)(a1 + 32) != 0LL;
else
result = 0LL;
return result;
}

original_code:
int InputFuncNodeConfigured(InputFuncNode *ifn)
{
 if (!ifn->readRecordHeader || !ifn->readRecord)
  return 0;
 return 1;
}

canonical_original_code:
int InputFuncNodeConfigured(struct _InputFuncNode *ifn)
{
 if (!ifn->readRecordHeader || !ifn->readRecord)
  return 0;
 return 1;
}


AddReadRecordHeaderFuncToInputList

decompiled_code:
__int64 __fastcall AddReadRecordHeaderFuncToInputList(char *s1, const void *a2)
{
__int64 v2; // rax
_BOOL4 v3; // eax
__int64 v4; // rdx

if ( !s1 )
return 0xFFFFFFFFLL;
DebugMessageFile = "plugbase.c";
DebugMessageLine = 277;
DebugMessageFunc(4LL, "Registering keyword:readRecordHeader => %s:%p\n", s1, a2);
v2 = GetInputPlugin(s1);
*(_QWORD *)(v2 + 24) = a2;
v3 = InputFuncNodeConfigured(v2);
*(_DWORD *)(v4 + 8) = v3;
return 0LL;
}

canonical_decompiled_code:
__int64 __fastcall func8(char *s1, const void *a2)
{
__int64 v2; // rax
_BOOL4 v3; // eax
__int64 v4; // rdx

if ( !s1 )
return 0xFFFFFFFFLL;
DebugMessageFile = "plugbase.c";
DebugMessageLine = 277;
DebugMessageFunc(4LL, "Registering keyword:readRecordHeader => %s:%p\n", s1, a2);
v2 = func2(s1);
*(_QWORD *)(v2 + 24) = a2;
v3 = func7(v2);
*(_DWORD *)(v4 + 8) = v3;
return 0LL;
}

original_code:
int AddReadRecordHeaderFuncToInputList(char *keyword, int (*readRecordHeader)(void *))
{
    InputFuncNode *node;
    if(keyword == ((void *)0))
        return -1;
    DebugMessageFile = "plugbase.c"; DebugMessageLine = 277; DebugMessageFunc(0x00000004,"Registering keyword:readRecordHeader => %s:%p\n", keyword, readRecordHeader);;
    node = GetInputPlugin(keyword);
    node->readRecordHeader = readRecordHeader;
 node->configured_flag = InputFuncNodeConfigured(node);
 return 0;
}

canonical_original_code:
int AddReadRecordHeaderFuncToInputList(char *keyword, int (*readRecordHeader)(void *))
{
    struct _InputFuncNode *node;
    if(keyword == ((void *)0))
        return -1;
    DebugMessageFile = "plugbase.c"; DebugMessageLine = 277; DebugMessageFunc(0x00000004,"Registering keyword:readRecordHeader => %s:%p\n", keyword, readRecordHeader);;
    node = GetInputPlugin(keyword);
    node->readRecordHeader = readRecordHeader;
 node->configured_flag = InputFuncNodeConfigured(node);
 return 0;
}

variable_types:
readRecordHeader
int (*)(void *)


AddReadRecordFuncToInputList

decompiled_code:
__int64 __fastcall AddReadRecordFuncToInputList(char *s1, const void *a2)
{
__int64 v2; // rax
_BOOL4 v3; // eax
__int64 v4; // rdx

if ( !s1 )
return 0xFFFFFFFFLL;
DebugMessageFile = "plugbase.c";
DebugMessageLine = 295;
DebugMessageFunc(4LL, "Registering keyword:readRecord => %s:%p\n", s1, a2);
v2 = GetInputPlugin(s1);
*(_QWORD *)(v2 + 32) = a2;
v3 = InputFuncNodeConfigured(v2);
*(_DWORD *)(v4 + 8) = v3;
return 0LL;
}

canonical_decompiled_code:
__int64 __fastcall func9(char *s1, const void *a2)
{
__int64 v2; // rax
_BOOL4 v3; // eax
__int64 v4; // rdx

if ( !s1 )
return 0xFFFFFFFFLL;
DebugMessageFile = "plugbase.c";
DebugMessageLine = 295;
DebugMessageFunc(4LL, "Registering keyword:readRecord => %s:%p\n", s1, a2);
v2 = func2(s1);
*(_QWORD *)(v2 + 32) = a2;
v3 = func7(v2);
*(_DWORD *)(v4 + 8) = v3;
return 0LL;
}

original_code:
int AddReadRecordFuncToInputList(char *keyword, int (*readRecord)(void *))
{
    InputFuncNode *node;
    if(keyword == ((void *)0))
        return -1;
    DebugMessageFile = "plugbase.c"; DebugMessageLine = 295; DebugMessageFunc(0x00000004,"Registering keyword:readRecord => %s:%p\n", keyword, readRecord);;
    node = GetInputPlugin(keyword);
    node->readRecord = readRecord;
 node->configured_flag = InputFuncNodeConfigured(node);
    return 0;
}

canonical_original_code:
int AddReadRecordFuncToInputList(char *keyword, int (*readRecord)(void *))
{
    struct _InputFuncNode *node;
    if(keyword == ((void *)0))
        return -1;
    DebugMessageFile = "plugbase.c"; DebugMessageLine = 295; DebugMessageFunc(0x00000004,"Registering keyword:readRecord => %s:%p\n", keyword, readRecord);;
    node = GetInputPlugin(keyword);
    node->readRecord = readRecord;
 node->configured_flag = InputFuncNodeConfigured(node);
    return 0;
}

variable_types:
readRecord
int (*)(void *)


RegisterOutputPlugins

decompiled_code:
__int64 RegisterOutputPlugins()
{
LogMessage("Initializing Output Plugins!\n");
AlertCuSetup();
PlatypusSetup();
return SguilSetup();
}

canonical_decompiled_code:
__int64 func10()
{
LogMessage("Initializing Output Plugins!\n");
AlertCuSetup();
PlatypusSetup();
return SguilSetup();
}

original_code:
void RegisterOutputPlugins(void)
{
    LogMessage("Initializing Output Plugins!\n");
    AlertCuSetup();
 PlatypusSetup();
 SguilSetup();
}

canonical_original_code:
void RegisterOutputPlugins()
{
    LogMessage("Initializing Output Plugins!\n");
    AlertCuSetup();
 PlatypusSetup();
 SguilSetup();
}


GetOutputConfigFunc

decompiled_code:
const char *__fastcall GetOutputConfigFunc(char *s2)
{
const char **v1; // rbx

v1 = (const char **)output_config_funcs;
if ( !s2 || !output_config_funcs )
return 0LL;
while ( strcasecmp(*v1, s2) )
{
v1 = (const char **)v1[3];
if ( !v1 )
return 0LL;
}
return v1[2];
}

canonical_decompiled_code:
const char *__fastcall func12(char *s2)
{
const char **v1; // rbx

v1 = (const char **)output_config_funcs;
if ( !s2 || !output_config_funcs )
return 0LL;
while ( strcasecmp(*v1, s2) )
{
v1 = (const char **)v1[3];
if ( !v1 )
return 0LL;
}
return v1[2];
}

original_code:
OutputConfigFunc GetOutputConfigFunc(char *keyword)
{
    OutputConfigFuncNode *head = output_config_funcs;
    if (keyword == ((void *)0))
        return ((void *)0);
    while (head != ((void *)0))
    {
        if (strcasecmp(head->keyword, keyword) == 0)
           return head->func;
        head = head->next;
    }
    return ((void *)0);
}

canonical_original_code:
void (*GetOutputConfigFunc(char *keyword))(char *)
{
    struct _OutputConfigFuncNode *head = output_config_funcs;
    if (keyword == ((void *)0))
        return ((void *)0);
    while (head != ((void *)0))
    {
        if (strcasecmp(head->keyword, keyword) == 0)
           return head->func;
        head = head->next;
    }
    return ((void *)0);
}

variable_types: struct _OutputConfigFuncNode { char *keyword; int output_type_flags; void (*func)(char *); struct _OutputConfigFuncNode *next; } *


GetOutputTypeFlags

decompiled_code:
__int64 __fastcall GetOutputTypeFlags(char *s2)
{
const char **v1; // rbx

if ( !s2 )
return 0LL;
v1 = (const char **)output_config_funcs;
if ( !output_config_funcs )
return 0LL;
while ( strcasecmp(*v1, s2) )
{
v1 = (const char **)v1[3];
if ( !v1 )
return 0LL;
}
return *((unsigned int *)v1 + 2);
}

canonical_decompiled_code:
__int64 __fastcall func13(char *s2)
{
const char **v1; // rbx

if ( !s2 )
return 0LL;
v1 = (const char **)output_config_funcs;
if ( !output_config_funcs )
return 0LL;
while ( strcasecmp(*v1, s2) )
{
v1 = (const char **)v1[3];
if ( !v1 )
return 0LL;
}
return *((unsigned int *)v1 + 2);
}

original_code:
int GetOutputTypeFlags(char *keyword)
{
    OutputConfigFuncNode *head = output_config_funcs;
    if (keyword == ((void *)0))
        return 0;
    while (head != ((void *)0))
    {
        if (strcasecmp(head->keyword, keyword) == 0)
           return head->output_type_flags;
        head = head->next;
    }
    return 0;
}

canonical_original_code:
int GetOutputTypeFlags(char *keyword)
{
    struct _OutputConfigFuncNode *head = output_config_funcs;
    if (keyword == ((void *)0))
        return 0;
    while (head != ((void *)0))
    {
        if (strcasecmp(head->keyword, keyword) == 0)
           return head->output_type_flags;
        head = head->next;
    }
    return 0;
}

user_defined_types: struct _OutputConfigFuncNode { char *keyword; int output_type_flags; void (*func)(char *); struct _OutputConfigFuncNode *next; }


FreeOutputConfigFuncs

decompiled_code:
void FreeOutputConfigFuncs()
{
void **v0; // rbx
void **v1; // rbp

v0 = (void **)output_config_funcs;
if ( output_config_funcs )
{
do
{
v1 = v0;
v0 = (void **)v0[3];
if ( *v1 )
free(*v1);
free(v1);
}
while ( v0 );
}
}

canonical_decompiled_code:
void func14()
{
void **v0; // rbx
void **v1; // rbp

v0 = (void **)output_config_funcs;
if ( output_config_funcs )
{
do
{
v1 = v0;
v0 = (void **)v0[3];
if ( *v1 )
free(*v1);
free(v1);
}
while ( v0 );
}
}

original_code:
void FreeOutputConfigFuncs(void)
{
    OutputConfigFuncNode *head = output_config_funcs;
    OutputConfigFuncNode *tmp;
    while (head != ((void *)0))
    {
        tmp = head->next;
        if (head->keyword != ((void *)0))
            free(head->keyword);
        free(head);
        head = tmp;
    }
}

canonical_original_code:
void FreeOutputConfigFuncs()
{
    struct _OutputConfigFuncNode *head = output_config_funcs;
    struct _OutputConfigFuncNode *tmp;
    while (head != ((void *)0))
    {
        tmp = head->next;
        if (head->keyword != ((void *)0))
            free(head->keyword);
        free(head);
        head = tmp;
    }
}


FreeOutputList

decompiled_code:
void __fastcall FreeOutputList(void *ptr)
{
void *v1; // rbx
void *v2; // rdi

if ( ptr )
{
v1 = ptr;
do
{
v2 = v1;
v1 = (void *)*((_QWORD *)v1 + 2);
free(v2);
}
while ( v1 );
}
}

canonical_decompiled_code:
void __fastcall func15(void *ptr)
{
void *v1; // rbx
void *v2; // rdi

if ( ptr )
{
v1 = ptr;
do
{
v2 = v1;
v1 = (void *)*((_QWORD *)v1 + 2);
free(v2);
}
while ( v1 );
}
}

original_code:
void FreeOutputList(OutputFuncNode *list)
{
    while (list != ((void *)0))
    {
        OutputFuncNode *tmp = list;
        list = list->next;
        free(tmp);
    }
}

canonical_original_code:
void FreeOutputList(struct _OutputFuncNode *list)
{
    while (list != ((void *)0))
    {
        struct _OutputFuncNode *tmp = list;
        list = list->next;
        free(tmp);
    }
}

user_defined_types: struct _OutputFuncNode { void *arg; void (*func)(struct _Packet *, void *, unsigned int, void *); struct _OutputFuncNode *next; }

user_defined_types: struct _MplsHdr { unsigned int label; unsigned char exp; unsigned char bos; unsigned char ttl; }

user_defined_types: struct _EtherHdr { unsigned char ether_dst[6]; unsigned char ether_src[6]; unsigned short ether_type; }

user_defined_types: struct _VlanTagHdr { unsigned short vth_pri_cfi_vlan; unsigned short vth_proto; }

user_defined_types: struct _EthLlc { unsigned char dsap; unsigned char ssap; }

user_defined_types: struct _EthLlcOther { unsigned char ctrl; unsigned char org_code[3]; unsigned short proto_id; }

user_defined_types: struct _GREHdr { unsigned char flags; unsigned char version; unsigned short ether_type; }

user_defined_types: struct _TCPHdr { unsigned short th_sport; unsigned short th_dport; unsigned int th_seq; unsigned int th_ack; unsigned char th_offx2; unsigned char th_flags; unsigned short th_win; unsigned short th_sum; unsigned short th_urp; }

user_defined_types: struct _UDPHdr { unsigned short uh_sport; unsigned short uh_dport; unsigned short uh_len; unsigned short uh_chk; }

user_defined_types: struct _IPv6Hdr { unsigned int vcl; unsigned short len; unsigned char next; unsigned char hop_lmt; struct _ip ip_src; struct _ip ip_dst; }

user_defined_types: struct _ICMP6 { unsigned char type; unsigned char code; unsigned short csum; }

user_defined_types: struct _IPH_API { struct _ip *(*iph_ret_src)(struct _Packet *); struct _ip *(*iph_ret_dst)(struct _Packet *); unsigned short (*iph_ret_tos)(struct _Packet *); unsigned char (*iph_ret_ttl)(struct _Packet *); unsigned short (*iph_ret_len)(struct _Packet *); unsigned int (*iph_ret_id)(struct _Packet *); unsigned char (*iph_ret_proto)(struct _Packet *); unsigned short (*iph_ret_off)(struct _Packet *); unsigned char (*iph_ret_ver)(struct _Packet *); unsigned char (*iph_ret_hlen)(struct _Packet *); struct _ip *(*orig_iph_ret_src)(struct _Packet *); struct _ip *(*orig_iph_ret_dst)(struct _Packet *); unsigned short (*orig_iph_ret_tos)(struct _Packet *); unsigned char (*orig_iph_ret_ttl)(struct _Packet *); unsigned short (*orig_iph_ret_len)(struct _Packet *); unsigned int (*orig_iph_ret_id)(struct _Packet *); unsigned char (*orig_iph_ret_proto)(struct _Packet *); unsigned short (*orig_iph_ret_off)(struct _Packet *); unsigned char (*orig_iph_ret_ver)(struct _Packet *); unsigned char (*orig_iph_ret_hlen)(struct _Packet *); char ver; }

user_defined_types: struct _Fddi_hdr { unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; }

user_defined_types: struct _Fddi_llc_saps { unsigned char dsap; unsigned char ssap; }

user_defined_types: struct _Fddi_llc_sna { unsigned char ctrl_fld[2]; }

user_defined_types: struct _Fddi_llc_iparp { unsigned char ctrl_fld; unsigned char protid[3]; unsigned short ethertype; }

user_defined_types: struct _Fddi_llc_other { unsigned char ctrl_fld[1]; }

user_defined_types: struct _Trh_hdr { unsigned char ac; unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; }

user_defined_types: struct _Trh_llc { unsigned char dsap; unsigned char ssap; unsigned char protid[3]; unsigned short ethertype; }

user_defined_types: struct _Trh_mr { unsigned short bcast_len_dir_lf_res; unsigned short rseg[8]; }

user_defined_types: struct _Pflog1_hdr { unsigned int af; char intf[16]; short rule; unsigned short reason; unsigned short action; unsigned short dir; }

user_defined_types: struct _Pflog2_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned char dir; unsigned char pad[3]; }

user_defined_types: struct _Pflog3_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned int uid; unsigned int pid; unsigned int rule_uid; unsigned int rule_pid; unsigned char dir; unsigned char pad[3]; }

user_defined_types: struct _SLLHdr { unsigned short sll_pkttype; unsigned short sll_hatype; unsigned short sll_halen; unsigned char sll_addr[8]; unsigned short sll_protocol; }

user_defined_types: struct _WifiHdr { unsigned short frame_control; unsigned short duration_id; unsigned char addr1[6]; unsigned char addr2[6]; unsigned char addr3[6]; unsigned short seq_control; unsigned char addr4[6]; }

user_defined_types: struct _PPPoEHdr { struct _EtherHdr ethhdr; unsigned char ver_type; unsigned char code; unsigned short session; unsigned short length; }

user_defined_types: struct _EtherEapol { unsigned char version; unsigned char eaptype; unsigned short len; }

user_defined_types: struct _EAPHdr { unsigned char code; unsigned char id; unsigned short len; }

user_defined_types: struct _EapolKey { unsigned char type; unsigned char length[2]; unsigned char counter[8]; unsigned char iv[16]; unsigned char index; unsigned char sig[16]; }

user_defined_types: struct _Options { unsigned char code; unsigned char len; unsigned char *data; }

user_defined_types: struct _IP6Option { unsigned char type; unsigned char *data; }

user_defined_types: struct timeval { long tv_sec; long tv_usec; }

user_defined_types: struct _ARPHdr { unsigned short ar_hrd; unsigned short ar_pro; unsigned char ar_hln; unsigned char ar_pln; unsigned short ar_op; }

user_defined_types: struct _ip { int family; int bits; union { unsigned int u6_addr8[16]; unsigned int u6_addr16[8]; unsigned int u6_addr32[4]; } ip; }

user_defined_types: struct idseq { unsigned short id; unsigned short seq; }

user_defined_types: struct pmtu { unsigned short ipm_void; unsigned short nextmtu; }

user_defined_types: struct rtradv { unsigned char num_addrs; unsigned char wpa; unsigned short lifetime; }

user_defined_types: struct ts { unsigned int otime; unsigned int rtime; unsigned int ttime; }

user_defined_types: struct ra_addr { unsigned int addr; unsigned int preference; }


DumpOutputPlugins

user_defined_types: struct _OutputConfigFuncNode { char *keyword; int output_type_flags; void (*func)(char *); struct _OutputConfigFuncNode *next; }


AddFuncToOutputList

decompiled_code:
__int64 __fastcall AddFuncToOutputList(__int64 a1, __int64 a2, __int64 a3)
{
if ( (_DWORD)a2 == 1 )
return AppendOutputFuncList(a1, a3, (__int64 *)&AlertList);
if ( (_DWORD)a2 == 2 )
return AppendOutputFuncList(a1, a3, (__int64 *)&LogList);
return FatalError("Unknown output type: %i. Possible bug, please report.\n", a2);
}

canonical_decompiled_code:
__int64 __fastcall func17(__int64 a1, __int64 a2, __int64 a3)
{
if ( (_DWORD)a2 == 1 )
return func0(a1, a3, (__int64 *)&AlertList);
if ( (_DWORD)a2 == 2 )
return func0(a1, a3, (__int64 *)&LogList);
return FatalError("Unknown output type: %i. Possible bug, please report.\n", a2);
}

original_code:
void AddFuncToOutputList(OutputFunc func, OutputType type, void *arg)
{
    switch (type)
    {
        case OUTPUT_TYPE__ALERT:
            AppendOutputFuncList(func, arg, &AlertList);
            break;
        case OUTPUT_TYPE__LOG:
            AppendOutputFuncList(func, arg, &LogList);
            break;
        default:
            FatalError("Unknown output type: %i. Possible bug, please "
                       "report.\n", type);
    }
}

canonical_original_code:
void AddFuncToOutputList(void (*func)(struct _Packet *, void *, unsigned int, void *), enum _OutputType type, void *arg)
{
    switch (type)
    {
        case OUTPUT_TYPE__ALERT:
            AppendOutputFuncList(func, arg, &AlertList);
            break;
        case OUTPUT_TYPE__LOG:
            AppendOutputFuncList(func, arg, &LogList);
            break;
        default:
            FatalError("Unknown output type: %i. Possible bug, please "
                       "report.\n", type);
    }
}

variable_types: enum _OutputType { OUTPUT_TYPE__ALERT=1, OUTPUT_TYPE__LOG=2, OUTPUT_TYPE__SPECIAL=3, OUTPUT_TYPE__MAX=4 }

user_defined_types: struct _Packet { struct pcap_pkthdr *pkth; unsigned char *pkt; struct _EtherARP *ah; struct _EtherHdr *eh; struct _VlanTagHdr *vh; struct _EthLlc *ehllc; struct _EthLlcOther *ehllcother; struct _GREHdr *greh; unsigned int *mpls; struct _IPHdr *iph; struct _IPHdr *inner_iph; struct _IPHdr *outer_iph; struct _TCPHdr *tcph; struct _UDPHdr *udph; struct _ICMPHdr *icmph; unsigned char *data; unsigned char *ip_data; unsigned char *outer_ip_data; unsigned char *ip_frag_start; unsigned char *ip_options_data; unsigned char *tcp_options_data; void *ssnptr; void *fragtracker; void *flow; void *streamptr; struct _IPv4Hdr *ip4h; struct _IPv6Hdr *ip6h; struct _ICMP6 *icmp6h; struct _IPH_API *iph_api; struct _IPH_API *orig_iph_api; struct _IPH_API *outer_iph_api; struct _IPH_API *outer_orig_iph_api; struct _IPv4Hdr inner_ip4h; struct _IPv6Hdr inner_ip6h; struct _IPv4Hdr outer_ip4h; struct _IPv6Hdr outer_ip6h; struct _MplsHdr mplsHdr; int family; int orig_family; int outer_family; int bytes_to_inspect; unsigned int preprocessor_bits; unsigned int preproc_reassembly_pkt_bits; unsigned int caplen; unsigned int http_pipeline_count; unsigned int packet_flags; unsigned int proto_bits; unsigned short dsize; unsigned short ip_dsize; unsigned short alt_dsize; unsigned short actual_ip_len; unsigned short outer_ip_dsize; unsigned short frag_offset; unsigned short ip_frag_len; unsigned short ip_options_len; unsigned short tcp_options_len; unsigned short sp; unsigned short dp; unsigned short orig_sp; unsigned short orig_dp; short application_protocol_ordinal; unsigned char frag_flag; unsigned char mf; unsigned char df; unsigned char rf; unsigned char uri_count; unsigned char csum_flags; unsigned char encapsulated; unsigned char ip_option_count; unsigned char tcp_option_count; unsigned char ip6_extension_count; unsigned char ip6_frag_index; unsigned char ip_lastopt_bad; unsigned char tcp_lastopt_bad; struct _Fddi_hdr *fddihdr; struct _Fddi_llc_saps *fddisaps; struct _Fddi_llc_sna *fddisna; struct _Fddi_llc_iparp *fddiiparp; struct _Fddi_llc_other *fddiother; struct _Trh_hdr *trh; struct _Trh_llc *trhllc; struct _Trh_mr *trhmr; struct _Pflog1_hdr *pf1h; struct _Pflog2_hdr *pf2h; struct _Pflog3_hdr *pf3h; struct _SLLHdr *sllh; struct _WifiHdr *wifih; struct _PPPoEHdr *pppoeh; struct _EtherEapol *eplh; struct _EAPHdr *eaph; unsigned char *eaptype; struct _EapolKey *eapolk; struct _Options ip_options[40]; struct _Options tcp_options[40]; struct _IP6Option ip6_extensions[40]; unsigned short configPolicyId; int linktype; }

user_defined_types: struct _MplsHdr { unsigned int label; unsigned char exp; unsigned char bos; unsigned char ttl; }

user_defined_types: struct pcap_pkthdr { struct timeval ts; unsigned int caplen; unsigned int len; }

user_defined_types: struct _EtherARP { struct _ARPHdr ea_hdr; unsigned char arp_sha[6]; unsigned char arp_spa[4]; unsigned char arp_tha[6]; unsigned char arp_tpa[4]; }

user_defined_types: struct _EtherHdr { unsigned char ether_dst[6]; unsigned char ether_src[6]; unsigned short ether_type; }

user_defined_types: struct _VlanTagHdr { unsigned short vth_pri_cfi_vlan; unsigned short vth_proto; }

user_defined_types: struct _EthLlc { unsigned char dsap; unsigned char ssap; }

user_defined_types: struct _EthLlcOther { unsigned char ctrl; unsigned char org_code[3]; unsigned short proto_id; }

user_defined_types: struct _GREHdr { unsigned char flags; unsigned char version; unsigned short ether_type; }

user_defined_types: struct _IPHdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct in_addr ip_src; struct in_addr ip_dst; }

user_defined_types: struct _TCPHdr { unsigned short th_sport; unsigned short th_dport; unsigned int th_seq; unsigned int th_ack; unsigned char th_offx2; unsigned char th_flags; unsigned short th_win; unsigned short th_sum; unsigned short th_urp; }

user_defined_types: struct _UDPHdr { unsigned short uh_sport; unsigned short uh_dport; unsigned short uh_len; unsigned short uh_chk; }

user_defined_types: struct _ICMPHdr { unsigned char type; unsigned char code; unsigned short csum; union { unsigned char pptr; struct in_addr gwaddr; struct idseq idseq; int sih_void; struct pmtu pmtu; struct rtradv rtradv; } icmp_hun; union { struct ts ts; struct ih_ip ip; struct ra_addr radv; unsigned int mask; char data[1]; } icmp_dun; }

user_defined_types: struct _IPv4Hdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct _ip ip_src; struct _ip ip_dst; }

user_defined_types: struct _IPv6Hdr { unsigned int vcl; unsigned short len; unsigned char next; unsigned char hop_lmt; struct _ip ip_src; struct _ip ip_dst; }

user_defined_types: struct _ICMP6 { unsigned char type; unsigned char code; unsigned short csum; }

user_defined_types: struct _IPH_API { struct _ip *(*iph_ret_src)(struct _Packet *); struct _ip *(*iph_ret_dst)(struct _Packet *); unsigned short (*iph_ret_tos)(struct _Packet *); unsigned char (*iph_ret_ttl)(struct _Packet *); unsigned short (*iph_ret_len)(struct _Packet *); unsigned int (*iph_ret_id)(struct _Packet *); unsigned char (*iph_ret_proto)(struct _Packet *); unsigned short (*iph_ret_off)(struct _Packet *); unsigned char (*iph_ret_ver)(struct _Packet *); unsigned char (*iph_ret_hlen)(struct _Packet *); struct _ip *(*orig_iph_ret_src)(struct _Packet *); struct _ip *(*orig_iph_ret_dst)(struct _Packet *); unsigned short (*orig_iph_ret_tos)(struct _Packet *); unsigned char (*orig_iph_ret_ttl)(struct _Packet *); unsigned short (*orig_iph_ret_len)(struct _Packet *); unsigned int (*orig_iph_ret_id)(struct _Packet *); unsigned char (*orig_iph_ret_proto)(struct _Packet *); unsigned short (*orig_iph_ret_off)(struct _Packet *); unsigned char (*orig_iph_ret_ver)(struct _Packet *); unsigned char (*orig_iph_ret_hlen)(struct _Packet *); char ver; }

user_defined_types: struct _Fddi_hdr { unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; }

user_defined_types: struct _Fddi_llc_saps { unsigned char dsap; unsigned char ssap; }

user_defined_types: struct _Fddi_llc_sna { unsigned char ctrl_fld[2]; }

user_defined_types: struct _Fddi_llc_iparp { unsigned char ctrl_fld; unsigned char protid[3]; unsigned short ethertype; }

user_defined_types: struct _Fddi_llc_other { unsigned char ctrl_fld[1]; }

user_defined_types: struct _Trh_hdr { unsigned char ac; unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; }

user_defined_types: struct _Trh_llc { unsigned char dsap; unsigned char ssap; unsigned char protid[3]; unsigned short ethertype; }

user_defined_types: struct _Trh_mr { unsigned short bcast_len_dir_lf_res; unsigned short rseg[8]; }

user_defined_types: struct _Pflog1_hdr { unsigned int af; char intf[16]; short rule; unsigned short reason; unsigned short action; unsigned short dir; }

user_defined_types: struct _Pflog2_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned char dir; unsigned char pad[3]; }

user_defined_types: struct _Pflog3_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned int uid; unsigned int pid; unsigned int rule_uid; unsigned int rule_pid; unsigned char dir; unsigned char pad[3]; }

user_defined_types: struct _SLLHdr { unsigned short sll_pkttype; unsigned short sll_hatype; unsigned short sll_halen; unsigned char sll_addr[8]; unsigned short sll_protocol; }


CallOutputPlugins

decompiled_code:
__int64 __fastcall CallOutputPlugins(int a1, __int64 a2, __int64 a3, unsigned int a4)
{
__int64 v6; // rbx
__int64 result; // rax
__int64 i; // rbx
__int64 j; // rbx

if ( a1 == 3 )
{
for ( i = AlertList; i; i = *(_QWORD *)(i + 16) )
result = (*(__int64 (__fastcall **)(__int64, __int64, _QWORD, _QWORD))(i + 8))(a2, a3, a4, *(_QWORD *)i);
for ( j = LogList; j; j = *(_QWORD *)(j + 16) )
result = (*(__int64 (__fastcall **)(__int64, __int64, _QWORD, _QWORD))(j + 8))(a2, a3, a4, *(_QWORD *)j);
}
else
{
if ( a1 == 1 )
{
v6 = AlertList;
}
else
{
if ( a1 != 2 )
return result;
v6 = LogList;
}
while ( v6 )
{
result = (*(__int64 (__fastcall **)(__int64, __int64, _QWORD, _QWORD))(v6 + 8))(a2, a3, a4, *(_QWORD *)v6);
v6 = *(_QWORD *)(v6 + 16);
}
}
return result;
}

canonical_decompiled_code:
__int64 __fastcall func18(int a1, __int64 a2, __int64 a3, unsigned int a4)
{
__int64 v6; // rbx
__int64 result; // rax
__int64 i; // rbx
__int64 j; // rbx

if ( a1 == 3 )
{
for ( i = AlertList; i; i = *(_QWORD *)(i + 16) )
result = (*(__int64 (__fastcall **)(__int64, __int64, _QWORD, _QWORD))(i + 8))(a2, a3, a4, *(_QWORD *)i);
for ( j = LogList; j; j = *(_QWORD *)(j + 16) )
result = (*(__int64 (__fastcall **)(__int64, __int64, _QWORD, _QWORD))(j + 8))(a2, a3, a4, *(_QWORD *)j);
}
else
{
if ( a1 == 1 )
{
v6 = AlertList;
}
else
{
if ( a1 != 2 )
return result;
v6 = LogList;
}
while ( v6 )
{
result = (*(__int64 (__fastcall **)(__int64, __int64, _QWORD, _QWORD))(v6 + 8))(a2, a3, a4, *(_QWORD *)v6);
v6 = *(_QWORD *)(v6 + 16);
}
}
return result;
}

original_code:
void CallOutputPlugins(OutputType out_type, Packet *packet, void *event, uint32_t event_type)
{
 OutputFuncNode *idx = ((void *)0);
    if (out_type == OUTPUT_TYPE__SPECIAL)
    {
        idx = AlertList;
     while (idx != ((void *)0))
     {
      idx->func(packet, event, event_type, idx->arg);
      idx = idx->next;
     }
        idx = LogList;
     while (idx != ((void *)0))
     {
      idx->func(packet, event, event_type, idx->arg);
      idx = idx->next;
     }
    }
    else
    {
     switch(out_type)
     {
      case OUTPUT_TYPE__ALERT:
       idx = AlertList;
       break;
      case OUTPUT_TYPE__LOG:
       idx = LogList;
       break;
            default:
                break;
     }
     while (idx != ((void *)0))
     {
      idx->func(packet, event, event_type, idx->arg);
      idx = idx->next;
     }
    }
}

canonical_original_code:
void CallOutputPlugins(enum _OutputType out_type, struct _Packet *packet, void *event, unsigned int event_type)
{
 struct _OutputFuncNode *idx = ((void *)0);
    if (out_type == OUTPUT_TYPE__SPECIAL)
    {
        idx = AlertList;
     while (idx != ((void *)0))
     {
      idx->func(packet, event, event_type, idx->arg);
      idx = idx->next;
     }
        idx = LogList;
     while (idx != ((void *)0))
     {
      idx->func(packet, event, event_type, idx->arg);
      idx = idx->next;
     }
    }
    else
    {
     switch(out_type)
     {
      case OUTPUT_TYPE__ALERT:
       idx = AlertList;
       break;
      case OUTPUT_TYPE__LOG:
       idx = LogList;
       break;
            default:
                break;
     }
     while (idx != ((void *)0))
     {
      idx->func(packet, event, event_type, idx->arg);
      idx = idx->next;
     }
    }
}

variable_types: struct _Packet { struct pcap_pkthdr { struct timeval { long tv_sec; long tv_usec; } ts; unsigned int caplen; unsigned int len; } *pkth; unsigned char *pkt; struct _EtherARP { struct _ARPHdr { unsigned short ar_hrd; unsigned short ar_pro; unsigned char ar_hln; unsigned char ar_pln; unsigned short ar_op; } ea_hdr; unsigned char arp_sha[6]; unsigned char arp_spa[4]; unsigned char arp_tha[6]; unsigned char arp_tpa[4]; } *ah; struct _EtherHdr { unsigned char ether_dst[6]; unsigned char ether_src[6]; unsigned short ether_type; } *eh; struct _VlanTagHdr { unsigned short vth_pri_cfi_vlan; unsigned short vth_proto; } *vh; struct _EthLlc { unsigned char dsap; unsigned char ssap; } *ehllc; struct _EthLlcOther { unsigned char ctrl; unsigned char org_code[3]; unsigned short proto_id; } *ehllcother; struct _GREHdr { unsigned char flags; unsigned char version; unsigned short ether_type; } *greh; unsigned int *mpls; struct _IPHdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct in_addr { unsigned int s_addr; } ip_src; struct in_addr ip_dst; } *iph; struct _IPHdr *inner_iph; struct _IPHdr *outer_iph; struct _TCPHdr { unsigned short th_sport; unsigned short th_dport; unsigned int th_seq; unsigned int th_ack; unsigned char th_offx2; unsigned char th_flags; unsigned short th_win; unsigned short th_sum; unsigned short th_urp; } *tcph; struct _UDPHdr { unsigned short uh_sport; unsigned short uh_dport; unsigned short uh_len; unsigned short uh_chk; } *udph; struct _ICMPHdr { unsigned char type; unsigned char code; unsigned short csum; union { unsigned char pptr; struct in_addr gwaddr; struct idseq { unsigned short id; unsigned short seq; } idseq; int sih_void; struct pmtu { unsigned short ipm_void; unsigned short nextmtu; } pmtu; struct rtradv { unsigned char num_addrs; unsigned char wpa; unsigned short lifetime; } rtradv; } icmp_hun; union { struct ts { unsigned int otime; unsigned int rtime; unsigned int ttime; } ts; struct ih_ip { struct _IPHdr *ip; } ip; struct ra_addr { unsigned int addr; unsigned int preference; } radv; unsigned int mask; char data[1]; } icmp_dun; } *icmph; unsigned char *data; unsigned char *ip_data; unsigned char *outer_ip_data; unsigned char *ip_frag_start; unsigned char *ip_options_data; unsigned char *tcp_options_data; void *ssnptr; void *fragtracker; void *flow; void *streamptr; struct _IPv4Hdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct _ip { int family; int bits; union { unsigned int u6_addr8[16]; unsigned int u6_addr16[8]; unsigned int u6_addr32[4]; } ip; } ip_src; struct _ip ip_dst; } *ip4h; struct _IPv6Hdr { unsigned int vcl; unsigned short len; unsigned char next; unsigned char hop_lmt; struct _ip ip_src; struct _ip ip_dst; } *ip6h; struct _ICMP6 { unsigned char type; unsigned char code; unsigned short csum; } *icmp6h; struct _IPH_API { struct _ip *(*iph_ret_src)(struct _Packet *); struct _ip *(*iph_ret_dst)(struct _Packet *); unsigned short (*iph_ret_tos)(struct _Packet *); unsigned char (*iph_ret_ttl)(struct _Packet *); unsigned short (*iph_ret_len)(struct _Packet *); unsigned int (*iph_ret_id)(struct _Packet *); unsigned char (*iph_ret_proto)(struct _Packet *); unsigned short (*iph_ret_off)(struct _Packet *); unsigned char (*iph_ret_ver)(struct _Packet *); unsigned char (*iph_ret_hlen)(struct _Packet *); struct _ip *(*orig_iph_ret_src)(struct _Packet *); struct _ip *(*orig_iph_ret_dst)(struct _Packet *); unsigned short (*orig_iph_ret_tos)(struct _Packet *); unsigned char (*orig_iph_ret_ttl)(struct _Packet *); unsigned short (*orig_iph_ret_len)(struct _Packet *); unsigned int (*orig_iph_ret_id)(struct _Packet *); unsigned char (*orig_iph_ret_proto)(struct _Packet *); unsigned short (*orig_iph_ret_off)(struct _Packet *); unsigned char (*orig_iph_ret_ver)(struct _Packet *); unsigned char (*orig_iph_ret_hlen)(struct _Packet *); char ver; } *iph_api; struct _IPH_API *orig_iph_api; struct _IPH_API *outer_iph_api; struct _IPH_API *outer_orig_iph_api; struct _IPv4Hdr inner_ip4h; struct _IPv6Hdr inner_ip6h; struct _IPv4Hdr outer_ip4h; struct _IPv6Hdr outer_ip6h; struct _MplsHdr { unsigned int label; unsigned char exp; unsigned char bos; unsigned char ttl; } mplsHdr; int family; int orig_family; int outer_family; int bytes_to_inspect; unsigned int preprocessor_bits; unsigned int preproc_reassembly_pkt_bits; unsigned int caplen; unsigned int http_pipeline_count; unsigned int packet_flags; unsigned int proto_bits; unsigned short dsize; unsigned short ip_dsize; unsigned short alt_dsize; unsigned short actual_ip_len; unsigned short outer_ip_dsize; unsigned short frag_offset; unsigned short ip_frag_len; unsigned short ip_options_len; unsigned short tcp_options_len; unsigned short sp; unsigned short dp; unsigned short orig_sp; unsigned short orig_dp; short application_protocol_ordinal; unsigned char frag_flag; unsigned char mf; unsigned char df; unsigned char rf; unsigned char uri_count; unsigned char csum_flags; unsigned char encapsulated; unsigned char ip_option_count; unsigned char tcp_option_count; unsigned char ip6_extension_count; unsigned char ip6_frag_index; unsigned char ip_lastopt_bad; unsigned char tcp_lastopt_bad; struct _Fddi_hdr { unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; } *fddihdr; struct _Fddi_llc_saps { unsigned char dsap; unsigned char ssap; } *fddisaps; struct _Fddi_llc_sna { unsigned char ctrl_fld[2]; } *fddisna; struct _Fddi_llc_iparp { unsigned char ctrl_fld; unsigned char protid[3]; unsigned short ethertype; } *fddiiparp; struct _Fddi_llc_other { unsigned char ctrl_fld[1]; } *fddiother; struct _Trh_hdr { unsigned char ac; unsigned char fc; unsigned char daddr[6]; unsigned char saddr[6]; } *trh; struct _Trh_llc { unsigned char dsap; unsigned char ssap; unsigned char protid[3]; unsigned short ethertype; } *trhllc; struct _Trh_mr { unsigned short bcast_len_dir_lf_res; unsigned short rseg[8]; } *trhmr; struct _Pflog1_hdr { unsigned int af; char intf[16]; short rule; unsigned short reason; unsigned short action; unsigned short dir; } *pf1h; struct _Pflog2_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned char dir; unsigned char pad[3]; } *pf2h; struct _Pflog3_hdr { char length; unsigned char af; unsigned char action; unsigned char reason; char ifname[16]; char ruleset[16]; unsigned int rulenr; unsigned int subrulenr; unsigned int uid; unsigned int pid; unsigned int rule_uid; unsigned int rule_pid; unsigned char dir; unsigned char pad[3]; } *pf3h; struct _SLLHdr { unsigned short sll_pkttype; unsigned short sll_hatype; unsigned short sll_halen; unsigned char sll_addr[8]; unsigned short sll_protocol; } *sllh; struct _WifiHdr { unsigned short frame_control; unsigned short duration_id; unsigned char addr1[6]; unsigned char addr2[6]; unsigned char addr3[6]; unsigned short seq_control; unsigned char addr4[6]; } *wifih; struct _PPPoEHdr { struct _EtherHdr ethhdr; unsigned char ver_type; unsigned char code; unsigned short session; unsigned short length; } *pppoeh; struct _EtherEapol { unsigned char version; unsigned char eaptype; unsigned short len; } *eplh; struct _EAPHdr { unsigned char code; unsigned char id; unsigned short len; } *eaph; unsigned char *eaptype; struct _EapolKey { unsigned char type; unsigned char length[2]; unsigned char counter[8]; unsigned char iv[16]; unsigned char index; unsigned char sig[16]; } *eapolk; struct _Options { unsigned char code; unsigned char len; unsigned char *data; } ip_options[40]; struct _Options tcp_options[40]; struct _IP6Option { unsigned char type; unsigned char *data; } ip6_extensions[40]; unsigned short configPolicyId; int linktype; } *

variable_types:
event
void *

user_defined_types: enum _OutputType { OUTPUT_TYPE__ALERT=1, OUTPUT_TYPE__LOG=2, OUTPUT_TYPE__SPECIAL=3, OUTPUT_TYPE__MAX=4 }

user_defined_types: struct _Packet { struct pcap_pkthdr *pkth; unsigned char *pkt; struct _EtherARP *ah; struct _EtherHdr *eh; struct _VlanTagHdr *vh; struct _EthLlc *ehllc; struct _EthLlcOther *ehllcother; struct _GREHdr *greh; unsigned int *mpls; struct _IPHdr *iph; struct _IPHdr *inner_iph; struct _IPHdr *outer_iph; struct _TCPHdr *tcph; struct _UDPHdr *udph; struct _ICMPHdr *icmph; unsigned char *data; unsigned char *ip_data; unsigned char *outer_ip_data; unsigned char *ip_frag_start; unsigned char *ip_options_data; unsigned char *tcp_options_data; void *ssnptr; void *fragtracker; void *flow; void *streamptr; struct _IPv4Hdr *ip4h; struct _IPv6Hdr *ip6h; struct _ICMP6 *icmp6h; struct _IPH_API *iph_api; struct _IPH_API *orig_iph_api; struct _IPH_API *outer_iph_api; struct _IPH_API *outer_orig_iph_api; struct _IPv4Hdr inner_ip4h; struct _IPv6Hdr inner_ip6h; struct _IPv4Hdr outer_ip4h; struct _IPv6Hdr outer_ip6h; struct _MplsHdr mplsHdr; int family; int orig_family; int outer_family; int bytes_to_inspect; unsigned int preprocessor_bits; unsigned int preproc_reassembly_pkt_bits; unsigned int caplen; unsigned int http_pipeline_count; unsigned int packet_flags; unsigned int proto_bits; unsigned short dsize; unsigned short ip_dsize; unsigned short alt_dsize; unsigned short actual_ip_len; unsigned short outer_ip_dsize; unsigned short frag_offset; unsigned short ip_frag_len; unsigned short ip_options_len; unsigned short tcp_options_len; unsigned short sp; unsigned short dp; unsigned short orig_sp; unsigned short orig_dp; short application_protocol_ordinal; unsigned char frag_flag; unsigned char mf; unsigned char df; unsigned char rf; unsigned char uri_count; unsigned char csum_flags; unsigned char encapsulated; unsigned char ip_option_count; unsigned char tcp_option_count; unsigned char ip6_extension_count; unsigned char ip6_frag_index; unsigned char ip_lastopt_bad; unsigned char tcp_lastopt_bad; struct _Fddi_hdr *fddihdr; struct _Fddi_llc_saps *fddisaps; struct _Fddi_llc_sna *fddisna; struct _Fddi_llc_iparp *fddiiparp; struct _Fddi_llc_other *fddiother; struct _Trh_hdr *trh; struct _Trh_llc *trhllc; struct _Trh_mr *trhmr; struct _Pflog1_hdr *pf1h; struct _Pflog2_hdr *pf2h; struct _Pflog3_hdr *pf3h; struct _SLLHdr *sllh; struct _WifiHdr *wifih; struct _PPPoEHdr *pppoeh; struct _EtherEapol *eplh; struct _EAPHdr *eaph; unsigned char *eaptype; struct _EapolKey *eapolk; struct _Options ip_options[40]; struct _Options tcp_options[40]; struct _IP6Option ip6_extensions[40]; unsigned short configPolicyId; int linktype; }

user_defined_types: struct _OutputFuncNode { void *arg; void (*func)(struct _Packet *, void *, unsigned int, void *); struct _OutputFuncNode *next; }

user_defined_types: struct pcap_pkthdr { struct timeval ts; unsigned int caplen; unsigned int len; }

user_defined_types: struct _EtherARP { struct _ARPHdr ea_hdr; unsigned char arp_sha[6]; unsigned char arp_spa[4]; unsigned char arp_tha[6]; unsigned char arp_tpa[4]; }

user_defined_types: struct _IPHdr { unsigned char ip_verhl; unsigned char ip_tos; unsigned short ip_len; unsigned short ip_id; unsigned short ip_off; unsigned char ip_ttl; unsigned char ip_proto; unsigned short ip_csum; struct in_addr ip_src; struct in_addr ip_dst; }

user_defined_types: struct _ICMPHdr { unsigned char type; unsigned char code; unsigned short csum; union { unsigned char pptr; struct in_addr gwaddr; struct idseq idseq; int sih_void; struct pmtu pmtu; struct rtradv rtradv; } icmp_hun; union { struct ts ts; struct ih_ip ip; struct ra_addr radv; unsigned int mask; char data[1]; } icmp_dun; }


PostConfigInitPlugins

decompiled_code:
__int64 __fastcall PostConfigInitPlugins(__int64 a1)
{
__int64 v1; // rbx
__int64 result; // rax

if ( a1 )
{
v1 = a1;
do
{
result = (*(__int64 (__fastcall **)(_QWORD, _QWORD))(v1 + 8))(0LL, *(_QWORD *)v1);
v1 = *(_QWORD *)(v1 + 16);
}
while ( v1 );
}
return result;
}

canonical_decompiled_code:
__int64 __fastcall func19(__int64 a1)
{
__int64 v1; // rbx
__int64 result; // rax

if ( a1 )
{
v1 = a1;
do
{
result = (*(__int64 (__fastcall **)(_QWORD, _QWORD))(v1 + 8))(0LL, *(_QWORD *)v1);
v1 = *(_QWORD *)(v1 + 16);
}
while ( v1 );
}
return result;
}

original_code:
void PostConfigInitPlugins(PluginSignalFuncNode *post_config_funcs)
{
    while (post_config_funcs != ((void *)0))
    {
        post_config_funcs->func(0, post_config_funcs->arg);
        post_config_funcs = post_config_funcs->next;
    }
}

canonical_original_code:
void PostConfigInitPlugins(struct _PluginSignalFuncNode *post_config_funcs)
{
    while (post_config_funcs != ((void *)0))
    {
        post_config_funcs->func(0, post_config_funcs->arg);
        post_config_funcs = post_config_funcs->next;
    }
}

variable_types: struct _PluginSignalFuncNode { void *arg; void (*func)(int, void *); struct _PluginSignalFuncNode *next; } *


AddFuncToSignalList

original_code:
void AddFuncToSignalList(PluginSignalFunc func, void *arg, PluginSignalFuncNode **list)
{
    PluginSignalFuncNode *node;
    if (list == ((void *)0))
        return;
    node = (PluginSignalFuncNode *)SnortAlloc(sizeof(PluginSignalFuncNode));
    if (*list == ((void *)0))
    {
        *list = node;
    }
    else
    {
        PluginSignalFuncNode *tmp = *list;
        while (tmp->next != ((void *)0))
            tmp = tmp->next;
        tmp->next = node;
    }
    node->func = func;
    node->arg = arg;
}

canonical_original_code:
void AddFuncToSignalList(void (*func)(int, void *), void *arg, struct _PluginSignalFuncNode **list)
{
    struct _PluginSignalFuncNode *node;
    if (list == ((void *)0))
        return;
    node = (struct _PluginSignalFuncNode *)SnortAlloc(sizeof(PluginSignalFuncNode));
    if (*list == ((void *)0))
    {
        *list = node;
    }
    else
    {
        struct _PluginSignalFuncNode *tmp = *list;
        while (tmp->next != ((void *)0))
            tmp = tmp->next;
        tmp->next = node;
    }
    node->func = func;
    node->arg = arg;
}

variable_types:
func
void (*)(int, void *)

variable_types: struct _PluginSignalFuncNode { void *arg; void (*func)(int, void *); struct _PluginSignalFuncNode *next; } **


AddFuncToRestartList

decompiled_code:
void __fastcall AddFuncToRestartList(__int64 a1, __int64 a2)
{
AddFuncToSignalList(a1, a2, &plugin_restart_funcs);
}

canonical_decompiled_code:
void __fastcall func21(__int64 a1, __int64 a2)
{
func20(a1, a2, &plugin_restart_funcs);
}

original_code:
void AddFuncToRestartList(PluginSignalFunc func, void *arg)
{
    AddFuncToSignalList(func, arg, &plugin_restart_funcs);
}

canonical_original_code:
void AddFuncToRestartList(void (*func)(int, void *), void *arg)
{
    AddFuncToSignalList(func, arg, &plugin_restart_funcs);
}


AddFuncToCleanExitList

decompiled_code:
void __fastcall AddFuncToCleanExitList(__int64 a1, __int64 a2)
{
AddFuncToSignalList(a1, a2, &plugin_clean_exit_funcs);
}

canonical_decompiled_code:
void __fastcall func22(__int64 a1, __int64 a2)
{
func20(a1, a2, &plugin_clean_exit_funcs);
}

original_code:
void AddFuncToCleanExitList(PluginSignalFunc func, void *arg)
{
    AddFuncToSignalList(func, arg, &plugin_clean_exit_funcs);
}

canonical_original_code:
void AddFuncToCleanExitList(void (*func)(int, void *), void *arg)
{
    AddFuncToSignalList(func, arg, &plugin_clean_exit_funcs);
}


AddFuncToShutdownList

decompiled_code:
void __fastcall AddFuncToShutdownList(__int64 a1, __int64 a2)
{
AddFuncToSignalList(a1, a2, &plugin_shutdown_funcs);
}

canonical_decompiled_code:
void __fastcall func23(__int64 a1, __int64 a2)
{
func20(a1, a2, &plugin_shutdown_funcs);
}

original_code:
void AddFuncToShutdownList(PluginSignalFunc func, void *arg)
{
    AddFuncToSignalList(func, arg, &plugin_shutdown_funcs);
}

canonical_original_code:
void AddFuncToShutdownList(void (*func)(int, void *), void *arg)
{
    AddFuncToSignalList(func, arg, &plugin_shutdown_funcs);
}


AddFuncToPostConfigList

decompiled_code:
void __fastcall AddFuncToPostConfigList(__int64 a1, __int64 a2)
{
__int64 v2; // rbx

v2 = barnyard2_conf_for_parsing;
if ( !barnyard2_conf_for_parsing )
FatalError("%s(%d) Barnyard2 config for parsing is NULL.\n", "plugbase.c", 623LL);
AddFuncToSignalList(a1, a2, (__int64 *)(v2 + 71024));
}

canonical_decompiled_code:
void __fastcall func24(__int64 a1, __int64 a2)
{
__int64 v2; // rbx

v2 = barnyard2_conf_for_parsing;
if ( !barnyard2_conf_for_parsing )
FatalError("%s(%d) Barnyard2 config for parsing is NULL.\n", "plugbase.c", 623LL);
func20(a1, a2, (__int64 *)(v2 + 71024));
}

original_code:
void AddFuncToPostConfigList(PluginSignalFunc func, void *arg)
{
    Barnyard2Config *bc = barnyard2_conf_for_parsing;
    if (bc == ((void *)0))
    {
        FatalError("%s(%d) Barnyard2 config for parsing is NULL.\n",
                   "plugbase.c", 623);
    }
    AddFuncToSignalList(func, arg, &bc->plugin_post_config_funcs);
}

canonical_original_code:
void AddFuncToPostConfigList(void (*func)(int, void *), void *arg)
{
    struct _Barnyard2Config *bc = barnyard2_conf_for_parsing;
    if (bc == ((void *)0))
    {
        FatalError("%s(%d) Barnyard2 config for parsing is NULL.\n",
                   "plugbase.c", 623);
    }
    AddFuncToSignalList(func, arg, &bc->plugin_post_config_funcs);
}

variable_types: struct _Barnyard2Config { enum _RunMode { RUN_MODE__VERSION=1, RUN_MODE__CONTINUOUS=2, RUN_MODE__BATCH=3, RUN_MODE__TEST=4 } run_mode; int run_mode_flags; int run_flags; int output_flags; int logging_flags; struct _VarEntry { char *name; char *value; unsigned char flags; struct _VarEntry *prev; struct _VarEntry *next; } *var_table; int checksums_mode; char ignore_ports[65536]; char *config_file; char *config_dir; char *hostname; char *interface; char *class_file; char *sid_msg_file; char *gen_msg_file; char *reference_file; char *log_dir; char *orig_log_dir; char *chroot_dir; unsigned char verbose; unsigned char localtime; char *bpf_filter; int thiszone; int quiet_flag; int verbose_flag; int verbose_bytedump_flag; int show2hdr_flag; int char_data_flag; int data_flag; int obfuscation_flag; int alert_on_each_packet_in_stream_flag; int logtosyslog_flag; int test_mode_flag; int use_utc; int include_year; int line_buffer_flag; char nostamp; int user_id; int group_id; unsigned int file_mask; unsigned long homenet; unsigned long netmask; unsigned int obfuscation_net; unsigned int obfuscation_mask; int batch_mode_flag; int batch_total_files; char **batch_filelist; int process_new_records_only_flag; struct _Waldo { int fd; char filepath[1024]; unsigned char mode; unsigned char state; struct _WaldoData { char spool_dir[1024]; char spool_filebase[1024]; unsigned int timestamp; unsigned int record_idx; } data; } waldo; char *archive_dir; int daemon_flag; int daemon_restart_flag; char pid_filename[1024]; char pid_path[1024]; char pidfile_suffix[-1]; char create_pid_file; char nolock_pid_file; int done_processing; int restart_flag; int print_version; int usr_signal; int cant_hup_signal; struct _ClassType { char *type; unsigned int id; char *name; unsigned int priority; struct _ClassType *next; } *classifications; struct _ReferenceSystemNode { char *name; char *url; struct _ReferenceSystemNode *next; } *references; struct _InputConfig { char *keyword; char *opts; char *file_name; int file_line; struct _InputConfig *next; } *input_configs; struct _OutputConfig { char *keyword; char *opts; char *file_name; int file_line; struct _OutputConfig *next; } *output_configs; struct _PluginSignalFuncNode { void *arg; void (*func)(int, void *); struct _PluginSignalFuncNode *next; } *plugin_post_config_funcs; } *

user_defined_types: struct _Barnyard2Config { enum _RunMode run_mode; int run_mode_flags; int run_flags; int output_flags; int logging_flags; struct _VarEntry *var_table; int checksums_mode; char ignore_ports[65536]; char *config_file; char *config_dir; char *hostname; char *interface; char *class_file; char *sid_msg_file; char *gen_msg_file; char *reference_file; char *log_dir; char *orig_log_dir; char *chroot_dir; unsigned char verbose; unsigned char localtime; char *bpf_filter; int thiszone; int quiet_flag; int verbose_flag; int verbose_bytedump_flag; int show2hdr_flag; int char_data_flag; int data_flag; int obfuscation_flag; int alert_on_each_packet_in_stream_flag; int logtosyslog_flag; int test_mode_flag; int use_utc; int include_year; int line_buffer_flag; char nostamp; int user_id; int group_id; unsigned int file_mask; unsigned long homenet; unsigned long netmask; unsigned int obfuscation_net; unsigned int obfuscation_mask; int batch_mode_flag; int batch_total_files; char **batch_filelist; int process_new_records_only_flag; struct _Waldo waldo; char *archive_dir; int daemon_flag; int daemon_restart_flag; char pid_filename[1024]; char pid_path[1024]; char pidfile_suffix[-1]; char create_pid_file; char nolock_pid_file; int done_processing; int restart_flag; int print_version; int usr_signal; int cant_hup_signal; struct _ClassType *classifications; struct _ReferenceSystemNode *references; struct _InputConfig *input_configs; struct _OutputConfig *output_configs; struct _PluginSignalFuncNode *plugin_post_config_funcs; }

user_defined_types: struct _Waldo { int fd; char filepath[1024]; unsigned char mode; unsigned char state; struct _WaldoData data; }


FreePluginSigFuncs

decompiled_code:
void __fastcall FreePluginSigFuncs(void *ptr)
{
void *v1; // rbx
void *v2; // rdi

if ( ptr )
{
v1 = ptr;
do
{
v2 = v1;
v1 = (void *)*((_QWORD *)v1 + 2);
free(v2);
}
while ( v1 );
}
}

canonical_decompiled_code:
void __fastcall func25(void *ptr)
{
void *v1; // rbx
void *v2; // rdi

if ( ptr )
{
v1 = ptr;
do
{
v2 = v1;
v1 = (void *)*((_QWORD *)v1 + 2);
free(v2);
}
while ( v1 );
}
}

original_code:
void FreePluginSigFuncs(PluginSignalFuncNode *head)
{
    while (head != ((void *)0))
    {
        PluginSignalFuncNode *tmp = head;
        head = head->next;
        free(tmp);
    }
}

canonical_original_code:
void FreePluginSigFuncs(struct _PluginSignalFuncNode *head)
{
    while (head != ((void *)0))
    {
        struct _PluginSignalFuncNode *tmp = head;
        head = head->next;
        free(tmp);
    }
}

user_defined_types: struct _PluginSignalFuncNode { void *arg; void (*func)(int, void *); struct _PluginSignalFuncNode *next; }


decompiled_code:
__int64 sfvt_alloc_table()
{
return SnortAlloc(8LL);
}

canonical_decompiled_code:
__int64 func0()
{
return SnortAlloc(8LL);
}

original_code:
vartable_t * sfvt_alloc_table(void)
{
    return (vartable_t *)SnortAlloc(sizeof(vartable_t));
}

canonical_original_code:
struct _vartable_t *sfvt_alloc_table()
{
    return (struct _vartable_t *)SnortAlloc(sizeof(vartable_t));
}

return_type: struct _vartable_t { struct _var_t { enum _modes { SFIP_LIST=0, SFIP_TABLE=1 } mode; struct _ip_node { struct _ip { int family; int bits; union { unsigned int u6_addr8[16]; unsigned int u6_addr16[8]; unsigned int u6_addr32[4]; } ip; } *ip; struct _ip_node *next; int flags; int addr_flags; } *head; struct _ip_node *neg_head; struct _var_t *next; char *name; } *head; } *

user_defined_types: struct _vartable_t { struct _var_t *head; }

user_defined_types: struct _var_t { enum _modes mode; struct _ip_node *head; struct _ip_node *neg_head; struct _var_t *next; char *name; }

user_defined_types: struct _ip_node { struct _ip *ip; struct _ip_node *next; int flags; int addr_flags; }


original_code:
SFIP_RET sfvt_add_str(vartable_t *table, char *str)
{
    sfip_var_t *var;
    sfip_var_t *swp;
    sfip_var_t *p;
    int ret;
    SFIP_RET status;
    if(!table || !str) return SFIP_FAILURE;
    if( (var = sfvar_alloc(table, str, &status)) == ((void *)0) )
    {
         return status;
    }
    if(!table->head)
    {
        table->head = var;
        return SFIP_SUCCESS;
    }
    if((ret = strcmp(var->name, table->head->name)) < 0)
    {
        var->next = table->head;
        table->head = var;
        return SFIP_SUCCESS;
    }
    else if(ret == 0)
    {
        var->next = table->head->next;
        sfvar_free(table->head);
        table->head = var;
        return SFIP_DUPLICATE;
    }
    if(!table->head->next)
    {
        table->head->next = var;
        return SFIP_SUCCESS;
    }
    else if(!strcmp(var->name, table->head->next->name))
    {
        var->next = table->head->next->next;
        sfvar_free(table->head->next);
        table->head->next = var;
        return SFIP_DUPLICATE;
    }
    for(p = table->head; p->next; p=p->next)
    {
        if((ret = strcmp(var->name, p->next->name)) < 0)
        {
            swp = p->next;
            p->next = var;
            var->next = swp;
            return SFIP_SUCCESS;
        }
        else if(ret == 0)
        {
            var->next = p->next->next;
            sfvar_free(p->next);
            p->next = var;
            return SFIP_DUPLICATE;
        }
    }
    p->next = var;
    return SFIP_SUCCESS;
}

canonical_original_code:
enum _return_values sfvt_add_str(struct _vartable_t *table, char *str)
{
    struct _var_t *var;
    struct _var_t *swp;
    struct _var_t *p;
    int ret;
    enum _return_values status;
    if(!table || !str) return SFIP_FAILURE;
    if( (var = sfvar_alloc(table, str, &status)) == ((void *)0) )
    {
         return status;
    }
    if(!table->head)
    {
        table->head = var;
        return SFIP_SUCCESS;
    }
    if((ret = strcmp(var->name, table->head->name)) < 0)
    {
        var->next = table->head;
        table->head = var;
        return SFIP_SUCCESS;
    }
    else if(ret == 0)
    {
        var->next = table->head->next;
        sfvar_free(table->head);
        table->head = var;
        return SFIP_DUPLICATE;
    }
    if(!table->head->next)
    {
        table->head->next = var;
        return SFIP_SUCCESS;
    }
    else if(!strcmp(var->name, table->head->next->name))
    {
        var->next = table->head->next->next;
        sfvar_free(table->head->next);
        table->head->next = var;
        return SFIP_DUPLICATE;
    }
    for(p = table->head; p->next; p=p->next)
    {
        if((ret = strcmp(var->name, p->next->name)) < 0)
        {
            swp = p->next;
            p->next = var;
            var->next = swp;
            return SFIP_SUCCESS;
        }
        else if(ret == 0)
        {
            var->next = p->next->next;
            sfvar_free(p->next);
            p->next = var;
            return SFIP_DUPLICATE;
        }
    }
    p->next = var;
    return SFIP_SUCCESS;
}

variable_types: struct _vartable_t { struct _var_t { enum _modes { SFIP_LIST=0, SFIP_TABLE=1 } mode; struct _ip_node { struct _ip { int family; int bits; union { unsigned int u6_addr8[16]; unsigned int u6_addr16[8]; unsigned int u6_addr32[4]; } ip; } *ip; struct _ip_node *next; int flags; int addr_flags; } *head; struct _ip_node *neg_head; struct _var_t *next; char *name; } *head; } *

variable_types:
str
char *

variable_types: ret int

variable_types: enum _return_values { SFIP_SUCCESS=0, SFIP_FAILURE=1, SFIP_LESSER=2, SFIP_GREATER=3, SFIP_EQUAL=4, SFIP_ARG_ERR=5, SFIP_CIDR_ERR=6, SFIP_INET_PARSE_ERR=7, SFIP_INVALID_MASK=8, SFIP_ALLOC_ERR=9, SFIP_CONTAINS=10, SFIP_NOT_CONTAINS=11, SFIP_DUPLICATE=12, SFIP_LOOKUP_FAILURE=13, SFIP_UNMATCHED_BRACKET=14, SFIP_NOT_ANY=15, SFIP_CONFLICT=16 }


decompiled_code:
__int64 __fastcall sfvt_define(__int64 *a1, const char *a2, const char *a3)
{
int v4; // ebp
size_t v5; // r14
void *v6; // rax
void *v7; // rbp
unsigned int v8; // er12

if ( !a2 || !a3 )
return 5LL;
v4 = strlen(a2);
v5 = (int)(v4 + strlen(a3) + 2);
v6 = malloc(v5);
v7 = v6;
if ( !v6 )
return 1;
SnortSnprintf(v6, v5, "%s %s", a2, a3);
v8 = sfvt_add_str(a1, (__int64)v7);
free(v7);
return v8;
}

canonical_decompiled_code:
__int64 __fastcall func2(__int64 *a1, const char *a2, const char *a3)
{
int v4; // ebp
size_t v5; // r14
void *v6; // rax
void *v7; // rbp
unsigned int v8; // er12

if ( !a2 || !a3 )
return 5LL;
v4 = strlen(a2);
v5 = (int)(v4 + strlen(a3) + 2);
v6 = malloc(v5);
v7 = v6;
if ( !v6 )
return 1;
SnortSnprintf(v6, v5, "%s %s", a2, a3);
v8 = func1(a1, (__int64)v7);
free(v7);
return v8;
}

original_code:
SFIP_RET sfvt_define(vartable_t *table, char *name, char *value)
{
    char *buf;
    int len;
    SFIP_RET ret;
    if(!name || !value) return SFIP_ARG_ERR;
    len = strlen(name) + strlen(value) + 2;
    if((buf = (char*)malloc(len)) == ((void *)0))
    {
        return SFIP_FAILURE;
    }
    SnortSnprintf(buf, len, "%s %s", name, value);
    ret = sfvt_add_str(table, buf);
    free(buf);
    return ret;
}

canonical_original_code:
enum _return_values sfvt_define(struct _vartable_t *table, char *name, char *value)
{
    char *buf;
    int len;
    enum _return_values ret;
    if(!name || !value) return SFIP_ARG_ERR;
    len = strlen(name) + strlen(value) + 2;
    if((buf = (char *)malloc(len)) == ((void *)0))
    {
        return SFIP_FAILURE;
    }
    SnortSnprintf(buf, len, "%s %s", name, value);
    ret = sfvt_add_str(table, buf);
    free(buf);
    return ret;
}

variable_types:
name
char *

variable_types:
value
char *

variable_types:
buf
char *

variable_types: len int

return_type: enum _return_values { SFIP_SUCCESS=0, SFIP_FAILURE=1, SFIP_LESSER=2, SFIP_GREATER=3, SFIP_EQUAL=4, SFIP_ARG_ERR=5, SFIP_CIDR_ERR=6, SFIP_INET_PARSE_ERR=7, SFIP_INVALID_MASK=8, SFIP_ALLOC_ERR=9, SFIP_CONTAINS=10, SFIP_NOT_CONTAINS=11, SFIP_DUPLICATE=12, SFIP_LOOKUP_FAILURE=13, SFIP_UNMATCHED_BRACKET=14, SFIP_NOT_ANY=15, SFIP_CONFLICT=16 }

user_defined_types: enum _modes { SFIP_LIST=0, SFIP_TABLE=1 }

user_defined_types: struct _ip { int family; int bits; union { unsigned int u6_addr8[16]; unsigned int u6_addr16[8]; unsigned int u6_addr32[4]; } ip; }


decompiled_code:
__int64 __fastcall sfvt_add_to_var(__int64 a1, __int64 a2, __int64 a3)
{
__int64 result; // rax

if ( a3 == 0 || a2 == 0 || !a1 )
return 5LL;
result = sfvar_parse_iplist(a1, a2, a3, 0LL);
if ( !(_DWORD)result )
result = sfvar_validate(a2);
return result;
}

canonical_decompiled_code:
__int64 __fastcall func3(__int64 a1, __int64 a2, __int64 a3)
{
__int64 result; // rax

if ( a3 == 0 || a2 == 0 || !a1 )
return 5LL;
result = sfvar_parse_iplist(a1, a2, a3, 0LL);
if ( !(_DWORD)result )
result = sfvar_validate(a2);
return result;
}

original_code:
SFIP_RET sfvt_add_to_var(vartable_t *table, sfip_var_t *dst, char *src)
{
    int ret;
    if(!table || !dst || !src) return SFIP_ARG_ERR;
    if((ret = sfvar_parse_iplist(table, dst, src, 0)) == SFIP_SUCCESS)
        return sfvar_validate(dst);
    return ret;
}

canonical_original_code:
enum _return_values sfvt_add_to_var(struct _vartable_t *table, struct _var_t *dst, char *src)
{
    int ret;
    if(!table || !dst || !src) return SFIP_ARG_ERR;
    if((ret = sfvar_parse_iplist(table, dst, src, 0)) == SFIP_SUCCESS)
        return sfvar_validate(dst);
    return ret;
}

variable_types:
dst
struct _var_t *

variable_types:
src
char *

user_defined_types: enum _return_values { SFIP_SUCCESS=0, SFIP_FAILURE=1, SFIP_LESSER=2, SFIP_GREATER=3, SFIP_EQUAL=4, SFIP_ARG_ERR=5, SFIP_CIDR_ERR=6, SFIP_INET_PARSE_ERR=7, SFIP_INVALID_MASK=8, SFIP_ALLOC_ERR=9, SFIP_CONTAINS=10, SFIP_NOT_CONTAINS=11, SFIP_DUPLICATE=12, SFIP_LOOKUP_FAILURE=13, SFIP_UNMATCHED_BRACKET=14, SFIP_NOT_ANY=15, SFIP_CONFLICT=16 }


decompiled_code:
__int64 __fastcall sfvt_lookup_var(__int64 *a1, const char *a2)
{
const char *v2; // r13
char v3; // bl
const unsigned __int16 *v4; // rcx
const char *v5; // rax
__int64 v6; // r12
int v7; // eax
int v8; // ebx
size_t v9; // r14
const char *v10; // rbp

if ( !a1 )
return 0LL;
v2 = a2;
if ( !a2 )
return 0LL;
v3 = *a2;
if ( *a2 == 36 )
{
v3 = a2[1];
v2 = a2 + 1;
}
if ( !v3 )
return 0LL;
v4 = *_ctype_b_loc();
v5 = v2;
do
{
if ( (v4[v3] & 0x2000) != 0 )
break;
if ( (unsigned __int8)(v3 - 92) <= 1u )
break;
v3 = *++v5;
}
while ( v3 );
v6 = *a1;
v7 = (_DWORD)v5 - (_DWORD)v2;
v8 = v7;
if ( !*a1 || !v7 )
return 0LL;
v9 = v7;
do
{
v10 = *(const char **)(v6 + 32);
if ( v8 == (unsigned int)strlen(v10) && !strncmp(v10, v2, v9) )
break;
v6 = *(_QWORD *)(v6 + 24);
}
while ( v6 );
return v6;
}

canonical_decompiled_code:
__int64 __fastcall func4(__int64 *a1, const char *a2)
{
const char *v2; // r13
char v3; // bl
const unsigned __int16 *v4; // rcx
const char *v5; // rax
__int64 v6; // r12
int v7; // eax
int v8; // ebx
size_t v9; // r14
const char *v10; // rbp

if ( !a1 )
return 0LL;
v2 = a2;
if ( !a2 )
return 0LL;
v3 = *a2;
if ( *a2 == 36 )
{
v3 = a2[1];
v2 = a2 + 1;
}
if ( !v3 )
return 0LL;
v4 = *_ctype_b_loc();
v5 = v2;
do
{
if ( (v4[v3] & 0x2000) != 0 )
break;
if ( (unsigned __int8)(v3 - 92) <= 1u )
break;
v3 = *++v5;
}
while ( v3 );
v6 = *a1;
v7 = (_DWORD)v5 - (_DWORD)v2;
v8 = v7;
if ( !*a1 || !v7 )
return 0LL;
v9 = v7;
do
{
v10 = *(const char **)(v6 + 32);
if ( v8 == (unsigned int)strlen(v10) && !strncmp(v10, v2, v9) )
break;
v6 = *(_QWORD *)(v6 + 24);
}
while ( v6 );
return v6;
}

original_code:
sfip_var_t *sfvt_lookup_var(vartable_t *table, char *name)
{
    sfip_var_t *p;
    int len;
    char *end;
    if(!table || !name) return ((void *)0);
    if(*name == '$') name++;
    for(end=name;
        *end && !((*__ctype_b_loc ())[(int) (((int)*end))] & (unsigned short int) _ISspace) && *end != '\\' && *end != ']';
        end++) ;
    len = end - name;
    for(p=table->head; len && p; p=p->next)
    {
        int name_len = strlen(p->name);
        if((len == name_len) && !strncmp(p->name, name, len)) return p;
    }
    return ((void *)0);
}

canonical_original_code:
struct _var_t *sfvt_lookup_var(struct _vartable_t *table, char *name)
{
    struct _var_t *p;
    int len;
    char *end;
    if(!table || !name) return ((void *)0);
    if(*name == '$') name++;
    for(end=name;
        *end && !((*__ctype_b_loc ())[(int) (((int)*end))] & (unsigned short) _ISspace) && *end != '\\' && *end != ']';
        end++) ;
    len = end - name;
    for(p=table->head; len && p; p=p->next)
    {
        int name_len = strlen(p->name);
        if((len == name_len) && !strncmp(p->name, name, len)) return p;
    }
    return ((void *)0);
}

variable_types: struct _vartable_t { struct _var_t *head; } *

variable_types: struct _var_t { enum _modes { SFIP_LIST=0, SFIP_TABLE=1 } mode; struct _ip_node { struct _ip { int family; int bits; union { unsigned int u6_addr8[16]; unsigned int u6_addr16[8]; unsigned int u6_addr32[4]; } ip; } *ip; struct _ip_node *next; int flags; int addr_flags; } *head; struct _ip_node *neg_head; struct _var_t *next; char *name; } *

variable_types:
end
char *


decompiled_code:
void __fastcall sfvt_free_table(void *ptr)
{
__int64 v2; // rbx
__int64 v3; // rdi

if ( ptr )
{
v2 = *(_QWORD *)ptr;
while ( v2 )
{
v3 = v2;
v2 = *(_QWORD *)(v2 + 24);
sfvar_free(v3);
}
free(ptr);
}
}

canonical_decompiled_code:
void __fastcall func5(void *ptr)
{
__int64 v2; // rbx
__int64 v3; // rdi

if ( ptr )
{
v2 = *(_QWORD *)ptr;
while ( v2 )
{
v3 = v2;
v2 = *(_QWORD *)(v2 + 24);
sfvar_free(v3);
}
free(ptr);
}
}

original_code:
void sfvt_free_table(vartable_t *table)
{
    sfip_var_t *p, *tmp;
    if (!table) return;
    p = table->head;
    while (p)
    {
        tmp = p->next;
        sfvar_free(p);
        p = tmp;
    }
    free(table);
}

canonical_original_code:
void sfvt_free_table(struct _vartable_t *table)
{
    struct _var_t *p; struct _var_t *tmp;
    if (!table) return;
    p = table->head;
    while (p)
    {
        tmp = p->next;
        sfvar_free(p);
        p = tmp;
    }
    free(table);
}