HvpGenerateLogEntry

NTSTATUS __stdcall HvpGenerateLogEntry(_HHIVE *Hive, UINT8 **Entry, UINT64 *EntrySize){
  unsigned int *v3; 
  unsigned int CurrentLogOffset; 
  bool v6; 
  unsigned int v7; 
  int v8; 
  UINT64 v9; 
  unsigned int v10; 
  VOID **PoolWithTag; 
  int v12; 
  INT64 v13; 
  __int64 v14; 
  NTSTATUS v15; 
  UINT8 *v16; 
  INT64 v17; 
  INT64 v18; 
  unsigned int v19; 
  PVOID *v20; 
  PVOID *v22; 
  INT64 v23; 
  INT64 v24; 
  INT64 v25; 
  INT64 v26; 
  UINT64 a3; 
  UINT64 EntrySizea; 
  INT64 a2; 
  UINT64 a4; 
  UINT8 **v31; 
  UINT64 *v32; 
  unsigned int *v33; 

  v33 = v3;
  v32 = EntrySize;
  v31 = Entry;
  CurrentLogOffset = Hive->CurrentLogOffset;
  a2 = 0i64;
  a3 = 0i64;
  v6 = CurrentLogOffset == 0;
  LODWORD(EntrySizea) = 0;
  LODWORD(a4) = 0;
  HvpGenerateLogMetadata(&Hive->DirtyVector, 0i64, (UINT64 *)((char *)&a3 + 4));
  v7 = RtlNumberOfSetBits((UINT64 *)&Hive->DirtyVector.SizeOfBitMap);
  v8 = HIDWORD(a3);
  CmpLogDirtyVectorUse((_CMHIVE *)Hive, DirtyDataCaptureStart, HIDWORD(a3), v7);
  v9 = (unsigned int)(8 * v8);
  v10 = (v9 + (CurrentLogOffset != 0 ? 4135 : 4647) + (Hive->DirtyCount << 9)) & 0xFFFFF000;
  PoolWithTag = ExAllocatePoolWithTag(5ui64, v9, 1867074883i64);
  if( !PoolWithTag )
    return -1073741801;
  v12 = HvpAllocateLogBuffers((PVOID **)&a2, &EntrySizea, v10);
  v14 = (unsigned int)EntrySizea;
  v15 = v12;
  if( v12 < 0 )
  {
    v20 = (PVOID *)a2;
  }
  else
  {
    LODWORD(v25) = v8;
    v16 = (UINT8 *)a2;
    LODWORD(v23) = v10;
    HvpGenerateLogEntryHeader((INT64)Hive, a2, v13, &a4, &a3, v23, v25, v6);
    LODWORD(v26) = HIDWORD(a3);
    HvpGenerateLogEntryMetadata((INT64)Hive, (INT64)v16, v17, &a4, &a3, (INT64)PoolWithTag, v26);
    HvpGenerateLogEntryDirtyData(Hive, (INT64)v16, v18, &a4, &a3, v24);
    v19 = *(_DWORD *)&v16[24 * (unsigned int)a4 + 16];
    if( (unsigned int)a3 < v19 )
      memset((VOID *)(*(_QWORD *)&v16[24 * (unsigned int)a4 + 8] + (unsigned int)a3), 0i64, v19 - a3);
    HvpGenerateLogEntryChecksums(v16, (unsigned int)v14);
    *v31 = v16;
    *(_DWORD *)v32 = v14;
    *v33 = v10;
    v20 = 0i64;
    v15 = 0;
  }
  ExFreePoolWithTag(PoolWithTag, 0);
  if( v20 )
  {
    if( (_DWORD)v14 )
    {
      v22 = v20 + 1;
      do
      {
        if( *v22 )
        {
          ExFreePoolWithTag(*v22, 0);
          *v22 = 0i64;
        }
        v22 += 3;
        --v14;
      }
      while( v14 );
    }
    ExFreePoolWithTag(v20, 0);
  }
  return v15;
}

Referenced by: