HvWriteExternal

INT64 __fastcall HvWriteExternal(UINT64 P2){
  unsigned int v1; 
  unsigned int v3; 
  int v4; 
  unsigned int v5; 
  INT64 CellMap; 
  unsigned int v7; 
  int v8; 
  int v9; 
  UINT8 *PoolWithTag; 
  UINT8 *v11; 
  __int64(__fastcall *v12)(UINT64, __int64, __int128 *, __int64, _DWORD); 
  int v13; 
  unsigned int v14; 
  INT64 v15; 
  unsigned __int64 v16; 
  int v17; 
  int(__fastcall *v18)(UINT64, __int64, __int128 *); 
  int v19; 
  __int128 v22; 
  __int64 v23; 
  v1 = 0;
  v22 = 0i64;
  v23 = 0i64;
  if( !*(_QWORD *)(P2 + 1552) )
    return 3221225485i64;
  v3 = *(_DWORD *)(P2 + 272);
  v4 = CmpDoFileSetSizeEx(P2, 2ui64, v3 + 4096, 0);
  if( v4 < 0 )
    return(unsigned int)v4;
  v5 = 0;
  if( v3 )
  {
    while( 1 )
    {
      CellMap = HvpGetCellMap(P2, v5);
      if( !CellMap )
        KeBugCheckEx(0x51u, 1ui64, P2, v7, 0xCE4ui64);
      v8 = *(_DWORD *)((*(_QWORD *)(CellMap + 8) & 0xFFFFFFFFFFFFFFF0ui64) + 8);
      v5 = v8 + v7;
      if( v5 > *(_DWORD *)(P2 + 272) || (v8 & 0xFFF) != 0 )
        break;
      if( v5 >= v3 )
        goto LABEL_8;
    }
    return(unsigned int)-1073741492;
  }
LABEL_8:
  if( v5 < *(_DWORD *)(P2 + 272) )
    return(unsigned int)v4;
  v9 = 4096;
  PoolWithTag = (UINT8 *)ExAllocatePoolWithTag(PagedPoolCacheAligned, 0x1000ui64, 0x20204D43ui64);
  v11 = PoolWithTag;
  if( !PoolWithTag )
    return 3221225626i64;
  memmove(PoolWithTag, *(UINT8 **)(P2 + 64), 0x1000ui64);
  *((_DWORD *)v11 + 10) = v3;
  *((_DWORD *)v11 + 11) = 1;
  *((_DWORD *)v11 + 127) = HvpHeaderCheckSum(v11);
  v12 = *(__int64(__fastcall **)(UINT64, __int64, __int128 *, __int64, _DWORD))(P2 + 40);
  *((_QWORD *)&v22 + 1) = v11;
  LODWORD(v23) = 4096;
  v13 = v12(P2, 2i64, &v22, 1i64, 0);
  ExFreePoolWithTag(v11, 0);
  if( v13 >= 0 )
  {
    v14 = 0;
    if( v3 )
    {
      while( 1 )
      {
        v15 = HvpGetCellMap(P2, v14);
        if( !v15 )
          KeBugCheckEx(0x51u, 1ui64, P2, v14, 0xD39ui64);
        v16 = *(_QWORD *)(v15 + 8) & 0xFFFFFFFFFFFFFFF0ui64;
        v17 = *(_DWORD *)(v16 + 8);
        *((_QWORD *)&v22 + 1) = v16;
        v18 = *(int(__fastcall **)(UINT64, __int64, __int128 *))(P2 + 40);
        LODWORD(v22) = v9;
        LODWORD(v23) = v17;
        if( v18(P2, 2i64, &v22) < 0 )
          break;
        v9 += v17;
        v14 += v17;
        if( v14 >= v3 )
          goto LABEL_15;
      }
      return(unsigned int)-1073741491;
    }
    else
    {
LABEL_15:
      LOBYTE(v19) = CmpFileFlush((_HHIVE *)P2, 2ui64);
      if( v19 < 0 )
        return(unsigned int)-1073741491;
      return v1;
    }
  }
  return 3221225805i64;
}

Referenced by:

CmSaveKey
CmSaveMergedKeys