HvpViewMapShrinkStorage
struct _PRIVILEGE_SET *__fastcall HvpViewMapShrinkStorage(UINT64 a1, INT64 a2){
__int64 v2;
__int64 v3;
struct _PRIVILEGE_SET *p_Privileges;
__int64 v5;
UINT64 v7;
unsigned __int64 v8;
unsigned __int64 v9;
__int64 v10;
unsigned __int64 *Luid;
__int64 v12;
VOID *v13;
struct _PRIVILEGE_SET *result;
struct _PRIVILEGE_SET Privileges;
v2 = *(_QWORD *)(a1 + 8);
v3 = (unsigned int)(a2 + 4096);
p_Privileges = &Privileges;
v5 = v3;
Privileges.Privilege[0].Luid = (_LUID)&Privileges;
*(_QWORD *)&Privileges.PrivilegeCount = &Privileges;
if( v3 < v2 )
{
v7 = a1 + 40;
do
{
v8 = *(_QWORD *)v7;
if( (*(_BYTE *)(v7 + 8) & 1) != 0 && v8 )
v8 ^= v7;
while( v8 )
{
if( v5 < *(_QWORD *)(v8 + 40) )
{
v9 = *(_QWORD *)v8;
}
else
{
if( v5 < *(_QWORD *)(v8 + 48) )
break;
v9 = *(_QWORD *)(v8 + 8);
}
if( (*(_BYTE *)(v7 + 8) & 1) != 0 && v9 )
v8 ^= v9;
else
v8 = v9;
}
v10 = *(_QWORD *)(v8 + 48);
HvpViewMapMakeViewRangeInvalid(a1, (_QWORD *)v8, v5, v10);
if( *(_QWORD *)(v8 + 40) == *(_QWORD *)(v8 + 48) )
{
RtlRbRemoveNode((unsigned __int64 *)v7, v8);
Luid = (unsigned __int64 *)Privileges.Privilege[0].Luid;
if( **(struct _PRIVILEGE_SET ***)&Privileges.Privilege[0].Luid != &Privileges )
goto LABEL_22;
*(_LUID *)(v8 + 8) = Privileges.Privilege[0].Luid;
*(_QWORD *)v8 = &Privileges;
*Luid = v8;
Privileges.Privilege[0].Luid = (_LUID)v8;
}
v5 = v10;
}
while( v10 < v2 );
p_Privileges = *(struct _PRIVILEGE_SET **)&Privileges.PrivilegeCount;
}
*(_QWORD *)(a1 + 8) = v3;
v12 = *(_QWORD *)&p_Privileges->PrivilegeCount;
if( (struct _PRIVILEGE_SET *)p_Privileges->Privilege[0].Luid != &Privileges )
LABEL_22:
__fastfail(3u);
while( 1 )
{
if( *(struct _PRIVILEGE_SET **)(v12 + 8) != p_Privileges )
goto LABEL_22;
*(_QWORD *)&Privileges.PrivilegeCount = v12;
*(_QWORD *)(v12 + 8) = &Privileges;
result = &Privileges;
if( p_Privileges == &Privileges )
return result;
v13 = *(VOID **)&p_Privileges[2].Privilege[0].Attributes;
if( v13 )
CmSiUnmapViewOfSection((INT64)&Privileges, *(PVOID **)(a1 + 24), v13);
CmSiFreeMemory(p_Privileges);
p_Privileges = *(struct _PRIVILEGE_SET **)&Privileges.PrivilegeCount;
if( *(struct _PRIVILEGE_SET **)(*(_QWORD *)&Privileges.PrivilegeCount + 8i64) != &Privileges )
goto LABEL_22;
v12 = **(_QWORD **)&Privileges.PrivilegeCount;
}
}Referenced by:
HvFreeHivePartial
HvpAddBin