HvpMapHiveImageFromViewMap
NTSTATUS __stdcall HvpMapHiveImageFromViewMap(_HHIVE *Hive, INT64 a2, UINT64 a3){
int v4;
int v5;
UINT8 v6;
_QWORD *v7;
unsigned int v8;
unsigned int v9;
_HMAP_ENTRY *CellMap;
__int64 v11;
unsigned __int64 v12;
int v13;
_HMAP_ENTRY *v14;
unsigned __int64 v15;
__int64 v16;
v4 = a3;
v5 = a2;
v6 = CmpClaimGlobalQuota((unsigned int)a3);
LODWORD(v7) = 0;
if( v6 )
{
v8 = 0;
v9 = v5 + v4;
if( v9 )
{
do
{
CellMap = HvpGetCellMap(Hive, v8);
v12 = *(_QWORD *)v11;
v8 = v13 + 4096;
v14 = CellMap;
if( (*(_BYTE *)(v11 + 8) & 1) != 0 )
{
if( v12 )
v12 ^= v11;
else
v12 = (unsigned __int64)v7;
}
while( v12 )
{
if( v8 >= *(__int64 *)(v12 + 40) )
{
if( v8 < *(__int64 *)(v12 + 48) )
break;
v15 = *(_QWORD *)(v12 + 8);
}
else
{
v15 = *(_QWORD *)v12;
}
if( (*(_BYTE *)(v11 + 8) & 1) != 0 && v15 )
v12 ^= v15;
else
v12 = v15;
}
v16 = *(_QWORD *)(v12 + 56) - *(_QWORD *)(v12 + 24);
v14->BlockOffset = (unsigned __int64)v7;
v14->MemAlloc = 4096;
v14->PermanentBinAddress = (v8 + v16) | 1;
}
while( v8 < v9 );
}
}
else
{
LODWORD(v7) = -1073741670;
}
return(int)v7;
}Referenced by:
HvpPerformLogFileRecovery