HvWriteHivePrimaryFile

NTSTATUS __stdcall HvWriteHivePrimaryFile(PVOID Hive, UINT8 UseCapturedData, UINT64 Flags){
  int v4; 
  UINT8 v6; 
  _HBASE_BLOCK *v7; 
  unsigned int v8; 
  int v9; 
  __int64 v10; 
  __int64(__fastcall *v11)(PVOID, _QWORD, __int128 *, __int64, int); 
  NTSTATUS v12; 
  VOID **PoolWithTag; 
  unsigned int v14; 
  unsigned int v15; 
  bool v16; 
  int v18; 
  __int64 v19; 
  __int64 v20; 
  __int128 v21; 
  __int64 v22; 
  UINT64 Current; 
  UINT64 Offset; 
  UINT64 Length; 
  UINT8 *Address; 

  Address = 0i64;
  LODWORD(Offset) = 0;
  v22 = 0i64;
  LODWORD(Length) = 0;
  v4 = Flags & 1;
  v6 = 0;
  v21 = 0i64;
  if( !UseCapturedData )
  {
    if( *((_DWORD *)Hive + 32) )
    {
      v7 = (_HBASE_BLOCK *)*((_QWORD *)Hive + 8);
      v7->Length = *((_DWORD *)Hive + 68);
      v7->Cluster = 1;
      goto LABEL_4;
    }
LABEL_23:
    v12 = 0;
    goto LABEL_22;
  }
  if( !*((_QWORD *)Hive + 219) )
    goto LABEL_23;
  v7 = (_HBASE_BLOCK *)*((_QWORD *)Hive + 221);
LABEL_4:
  v8 = *((_DWORD *)Hive + 45);
  v7->Sequence2 = v8;
  v7->Sequence1 = v8 + 1;
  v9 = HvpHeaderCheckSum(v7);
  v16 = CmpFailPrimarySave == 1;
  *(_DWORD *)(v10 + 508) = v9;
  if( v16 )
    goto LABEL_26;
  v11 = (__int64(__fastcall *)(PVOID, _QWORD, __int128 *, __int64, int))*((_QWORD *)Hive + 5);
  *((_QWORD *)&v21 + 1) = v10;
  LODWORD(v22) = 4096;
  v6 = 1;
  v12 = v11(Hive, 0i64, &v21, 1i64, v4);
  if( v12 < 0 )
  {
LABEL_22:
    v16 = UseCapturedData == 0;
    goto LABEL_19;
  }
  if( CmpFailPrimarySave == 2 )
  {
LABEL_26:
    v12 = -1073741823;
    goto LABEL_22;
  }
  if( UseCapturedData )
  {
    PoolWithTag = (VOID **)*((_QWORD *)Hive + 219);
    v14 = *((_DWORD *)Hive + 440);
  }
  else
  {
    PoolWithTag = ExAllocatePoolWithTag(1ui64, 24i64 * *((unsigned int *)Hive + 32), 1649626435i64);
    if( !PoolWithTag )
    {
      v12 = -1073741801;
      goto LABEL_22;
    }
    v14 = 0;
    for( LODWORD(Current) = 0; v14 < *((_DWORD *)Hive + 32); LODWORD(Offset) = v19 + v18 )
    {
      if( !HvpFindNextDirtyBlock(Hive, (_RTL_BITMAP *)Hive + 7, &Current, &Address, &Length, &Offset, 0) )
        break;
      v18 = Offset;
      v19 = v14++;
      v20 = 3 * v19;
      PoolWithTag[v20 + 1] = Address;
      LODWORD(v19) = Length;
      LODWORD(PoolWithTag[v20]) = v18;
      LODWORD(PoolWithTag[v20 + 2]) = v19;
    }
  }
  if( CmpFailPrimarySave == 3 )
    goto LABEL_20;
  v12 = (*((__int64(__fastcall **)(PVOID, _QWORD, VOID **, _QWORD, int))Hive + 5))(Hive, 0i64, PoolWithTag, v14, v4);
  if( v12 < 0 )
    goto LABEL_17;
  if( CmpFailPrimarySave == 4 )
    goto LABEL_20;
  v12 = CmpFileFlushAndPurge((_HHIVE *)Hive, 0i64);
  if( v12 < 0 )
    goto LABEL_17;
  if( CmpFailPrimarySave == 5 )
  {
LABEL_20:
    v12 = -1073741823;
  }
  else
  {
    if( UseCapturedData )
      v15 = RtlNumberOfSetBits((UINT64 *)Hive + 216);
    else
      v15 = *((_DWORD *)Hive + 32);
    CmpTraceHiveFlushWrotePrimaryFile(v15, v15 << 9);
    v6 = 0;
    v12 = 0;
  }
LABEL_17:
  if( !PoolWithTag )
    goto LABEL_22;
  v16 = UseCapturedData == 0;
  if( !UseCapturedData )
  {
    ExFreePoolWithTag(PoolWithTag, 0);
    goto LABEL_22;
  }
LABEL_19:
  HvpFinishPrimaryWrite((_HHIVE *)Hive, v12 >= 0, v6, v16);
  return v12;
}

Referenced by: