HvpApplyLegacyLogFile
__int64 __fastcall HvpApplyLegacyLogFile(
_DWORD *a1,
__int64 a2,
unsigned int *a3,
__int64 a4,
ULONG_PTR a5,
__int64 (__fastcall *a6)(_QWORD, _QWORD, __int64),
void (__fastcall *a7)(_DWORD *, _QWORD),
struct _RTL_BITMAP *a8){
unsigned int v9;
unsigned int v10;
int Routine;
ULONG v12;
ULONG v13;
INT64 v14;
_DWORD *v15;
unsigned int v16;
UINT8 **a5a;
UINT8 **a5b;
INT64 a5c;
UINT64 v21;
UINT64 DataSize;
INT64 v23;
struct _RTL_BITMAP BitMapHeader;
_HHIVE *Hive;
ULONG_PTR BugCheckParameter2;
void(__fastcall *v27)(_DWORD *, _QWORD);
INT64 a2a;
__int64 v29;
int v30;
int v31;
__int128 v32;
BugCheckParameter2 = a5;
v9 = a1[10];
v27 = a7;
v10 = v9 >> 12;
Hive = (_HHIVE *)a3;
LODWORD(v23) = 0;
*(&BitMapHeader.SizeOfBitMap + 1) = 0;
DataSize = 0i64;
v29 = 0i64;
v32 = 0i64;
LODWORD(v21) = 0;
Routine = HvpRecoverDataReadRoutine((_HHIVE *)a3, (VOID *)0x200, v10 + 4, (UINT64)&DataSize, a5a);
if( Routine >= 0 )
{
if( *(_DWORD *)DataSize == 1414678852 )
{
BitMapHeader.SizeOfBitMap = a1[10] >> 9;
BitMapHeader.Buffer = (unsigned int *)(DataSize + 4);
v12 = RtlNumberOfSetBits(&BitMapHeader);
if( v12 )
{
v13 = v12 << 9;
HvpGenerateLogMetadata(&BitMapHeader, 0i64, &v21);
v14 = a6((unsigned int)(8 * v21), 0i64, 859000131i64);
v15 = (_DWORD *)v14;
if( v14 )
{
HvpGenerateLogMetadata(&BitMapHeader, v14, &v21);
v16 = v21;
v30 = a1[10];
LODWORD(a2a) = 1162638920;
v31 = v21;
HIDWORD(a2a) = v13 + 8 * (v21 + 5);
if( HvpIsMetadataArrayCoherent((unsigned int *)&a2a, (__int64)v15, v21) )
{
Routine = HvpRecoverDataReadRoutine(Hive, (VOID *)((v10 + 1027) & 0xFFFFFE00), v13, (UINT64)&DataSize, a5b);
if( Routine >= 0 )
{
LODWORD(a5c) = v13;
Routine = HvpApplyLogEntryDataToFileBackedHive(
BugCheckParameter2,
(INT64)&a2a,
(INT64)v15,
DataSize,
a5c,
(INT64)&v23);
if( Routine >= 0 )
{
if( (v29 & 1) != 0 )
a1[36] |= 1u;
if( a8 )
HvpUpdateRecoveryVector(v15, v16, a8);
Routine = 1073741833;
}
}
}
else
{
Routine = -1073741492;
}
v27(v15, 8 * v16);
}
else
{
return(unsigned int)-1073741801;
}
}
else
{
return 0;
}
}
else if( BYTE3(NlsMbCodePageTag) || (CmpBootType & 6) != 0 )
{
a1[1022] |= 4u;
return 1073741833;
}
else
{
return(unsigned int)-1073741492;
}
}
return(unsigned int)Routine;
}Referenced by:
HvApplyLogFile