HvpGenerateLogEntry

INT64 __fastcall HvpGenerateLogEntry(_HHIVE *Hive, UINT8 **Entry, UINT *EntrySize){
  unsigned int *v3; 
  unsigned int CurrentLogOffset; 
  bool v6; 
  ULONG v7; 
  int v8; 
  UINT64 v9; 
  unsigned int v10; 
  void *PoolWithTag; 
  int v12; 
  INT64 v13; 
  __int64 v14; 
  unsigned int v15; 
  UINT8 *v16; 
  INT64 v17; 
  INT64 v18; 
  UINT8 *v19; 
  PVOID *v21; 
  INT64 a6; 
  INT64 a6a; 
  INT64 v24; 
  INT64 v25; 
  UINT64 Context1; 
  UINT64 EntrySizea; 
  UINT8 *LogEntry; 
  UINT64 a4; 
  UINT8 **v30; 
  UINT *v31; 
  unsigned int *v32; 
  v32 = v3;
  v31 = EntrySize;
  v30 = Entry;
  CurrentLogOffset = Hive->CurrentLogOffset;
  LogEntry = 0i64;
  Context1 = 0i64;
  v6 = CurrentLogOffset == 0;
  LODWORD(EntrySizea) = 0;
  LODWORD(a4) = 0;
  HvpGenerateLogMetadata(&Hive->DirtyVector, 0i64, (UINT64 *)((char *)&Context1 + 4));
  v7 = RtlNumberOfSetBits(&Hive->DirtyVector);
  v8 = HIDWORD(Context1);
  CmpLogDirtyVectorUse((_CMHIVE *)Hive, DirtyDataCaptureStart, HIDWORD(Context1), v7);
  v9 = (unsigned int)(8 * v8);
  v10 = (v9 + (CurrentLogOffset != 0 ? 4135 : 4647) + (Hive->DirtyCount << 9)) & 0xFFFFF000;
  PoolWithTag = ExAllocatePoolWithTag(PagedPoolCacheAligned, v9, 0x6F494D43ui64);
  if( PoolWithTag )
  {
    v12 = HvpAllocateLogBuffers((PVOID **)&LogEntry, &EntrySizea, v10);
    v14 = (unsigned int)EntrySizea;
    v15 = v12;
    if( v12 < 0 )
    {
      v19 = LogEntry;
    }
    else
    {
      LODWORD(v24) = v8;
      v16 = LogEntry;
      LODWORD(a6) = v10;
      HvpGenerateLogEntryHeader((INT64)Hive, (INT64)LogEntry, v13, &a4, &Context1, a6, v24, v6);
      LODWORD(v25) = HIDWORD(Context1);
      HvpGenerateLogEntryMetadata((INT64)Hive, (INT64)v16, v17, &a4, &Context1, (INT64)PoolWithTag, v25);
      HvpGenerateLogEntryDirtyData((INT64)Hive, (INT64)v16, v18, &a4, &Context1, a6a);
      if( (unsigned int)Context1 < *(_DWORD *)&v16[24 * (unsigned int)a4 + 16] )
        memset(*(_QWORD *)&v16[24 * (unsigned int)a4 + 8] + (unsigned int)Context1, 0i64);
      HvpGenerateLogEntryChecksums(v16, (unsigned int)v14);
      *v30 = v16;
      *v31 = v14;
      *v32 = v10;
      v19 = 0i64;
      v15 = 0;
    }
    ExFreePoolWithTag(PoolWithTag, 0);
    if( v19 )
    {
      if( (_DWORD)v14 )
      {
        v21 = (PVOID *)(v19 + 8);
        do
        {
          if( *v21 )
          {
            ExFreePoolWithTag(*v21, 0);
            *v21 = 0i64;
          }
          v21 += 3;
          --v14;
        }
        while( v14 );
      }
      ExFreePoolWithTag(v19, 0);
    }
  }
  else
  {
    return(unsigned int)-1073741801;
  }
  return v15;
}

Referenced by: