HvpMapHiveImage
INT64 __fastcall HvpMapHiveImage(UINT64 a1, INT64 a2, INT64 a3, INT64 a4, VOID *Context){
INT64 v6;
unsigned int v7;
NTSTATUS v8;
int v9;
unsigned int v10;
UINT8 *v11;
INT64 v12;
int v13;
void *v14;
INT64 v16;
INT64 v17;
void *v18;
UINT8 *Data;
UINT64 v20;
INT64 v21;
Data = 0i64;
LODWORD(v20) = 0;
v21 = 0i64;
v6 = *(_QWORD *)(a1 + 56);
v7 = 0;
do
{
LABEL_2:
v8 = HvpReadHiveDataFromFile(Context, &Data, &v20);
v9 = v8;
if( v8 < 0 )
{
if( v8 == -1073741807 )
{
return 0;
}
else
{
LODWORD(v16) = 0;
SetFailureLocation(v6, 0i64, 7i64, (unsigned int)v8, v16);
}
return(unsigned int)v9;
}
v10 = 0;
}
while( !(_DWORD)v20 );
while( 1 )
{
v11 = &Data[v10];
v9 = HvpAllocateBin(a1, 4096i64, 0i64, 0x31334D43ui64, &v21);
if( v9 < 0 )
break;
memmove((UINT8 *)v21, v11, 0x1000ui64);
v9 = HvpProtectBin(v12, 0x1000ui64, (VOID *)v21, 0);
if( v9 < 0 )
{
v13 = 32;
goto LABEL_10;
}
HvpPointMapEntriesToBuffer(a1, v21, 4096i64, v7, 1, 0i64);
v21 = 0i64;
v7 += 4096;
v10 += 4096;
if( v10 >= (unsigned int)v20 )
goto LABEL_2;
}
v13 = 16;
LABEL_10:
LODWORD(v17) = v13;
SetFailureLocation(v6, 0i64, 7i64, (unsigned int)v9, v17);
if( v21 )
HvpFreeBin((_HHIVE *)a1, 0x1000u, (HSTORAGE_TYPE)v21, v14, v18);
return(unsigned int)v9;
}Referenced by:
HvpMapHiveImageFromFile