HvpRecoverDataReadRoutine
NTSTATUS __stdcall HvpRecoverDataReadRoutine(
_HHIVE *Hive,
VOID *Context,
UINT64 FileOffset,
UINT64 DataSize,
UINT8 **Data){
_CELL_DATA *(__fastcall *TransientPoolWithTag)(_HHIVE *, unsigned int, _HV_GET_CELL_CONTEXT *);
unsigned int v6;
NTSTATUS v8;
__int64 v9;
int v10;
_CELL_DATA *(__fastcall *GetCellRoutine)(_HHIVE *, unsigned int, _HV_GET_CELL_CONTEXT *);
unsigned int v12;
unsigned int v13;
unsigned int v14;
unsigned int ReleaseCellRoutine;
char *v16;
TransientPoolWithTag = 0i64;
v6 = (unsigned int)Context;
if( (int)Context + (int)FileOffset < (unsigned int)Context && (_DWORD)Context + (_DWORD)FileOffset )
return -1073741811;
v9 = *(_QWORD *)&Hive->Signature;
v10 = *(_DWORD *)(*(_QWORD *)&Hive->Signature + 136i64) << 9;
GetCellRoutine = Hive->GetCellRoutine;
v12 = (unsigned int)Context & ~(v10 - 1);
v13 = (~(v10 - 1) & ((_DWORD)Context + v10 + FileOffset - 1)) - v12;
v14 = v13;
if( v13 < 0x10000 )
v14 = 0x10000;
if( !GetCellRoutine )
goto LABEL_13;
ReleaseCellRoutine = (unsigned int)Hive->ReleaseCellRoutine;
if( ReleaseCellRoutine < v14 )
CmSiFreeMemory((PPRIVILEGE_SET)GetCellRoutine);
else
TransientPoolWithTag = Hive->GetCellRoutine;
Hive->GetCellRoutine = 0i64;
LODWORD(Hive->ReleaseCellRoutine) = 0;
if( ReleaseCellRoutine < v14 )
ReleaseCellRoutine = v14;
if( !TransientPoolWithTag )
{
LABEL_13:
TransientPoolWithTag = (_CELL_DATA *(__fastcall *)(_HHIVE *, unsigned int, _HV_GET_CELL_CONTEXT *))CmpAllocateTransientPoolWithTag(1ui64, v13);
if( !TransientPoolWithTag )
return -1073741801;
ReleaseCellRoutine = v13;
}
v8 = (*(__int64(__fastcall **)(__int64, _QWORD, _QWORD, _CELL_DATA *(__fastcall *)(_HHIVE *, unsigned int, _HV_GET_CELL_CONTEXT *), unsigned int))(v9 + 48))(
v9,
HIDWORD(Hive->ReleaseCellRoutine),
v12,
TransientPoolWithTag,
v13);
if( v8 >= 0 )
{
Hive->GetCellRoutine = TransientPoolWithTag;
LODWORD(Hive->ReleaseCellRoutine) = ReleaseCellRoutine;
v16 = (char *)TransientPoolWithTag + v6 % (*(_DWORD *)(v9 + 136) << 9);
TransientPoolWithTag = 0i64;
v8 = 0;
*(_QWORD *)DataSize = v16;
}
if( TransientPoolWithTag )
CmSiFreeMemory((PPRIVILEGE_SET)TransientPoolWithTag);
return v8;
}Referenced by:
HvpApplyIncrementalLogFile
HvpApplyLegacyLogFile