HvHiveStartMemoryBacked
VOID __fastcall HvHiveStartMemoryBacked(INT64 a1, UINT64 a2, INT64 a3, UINT64 a4){
int v5;
__int64 v6;
__int64 v7;
INT64 v8;
int v9;
int v10;
__int64 v11;
char v12;
int v13;
__int64 v14;
_OWORD *v15;
_OWORD *v16;
__int128 v17;
int v18;
int v19;
__int64 v20;
int v21;
int v22;
int v23;
__int64 v24;
int v25;
int v26;
int v27;
int v28;
int v29;
__int64 v30;
__int64 v31;
INT64 v32;
_DWORD *v33;
_QWORD *v34;
int v35;
_UNICODE_STRING *FileName;
_OWORD *v37;
_OWORD *v38;
_BYTE *v39;
int *v40;
INT64 v41;
*(_QWORD *)(a1 + 56) = v41;
v5 = a3;
if( (_DWORD)a2 == 2
|| (unsigned int)a2 >= 5
|| (a3 & 0xFF617CEC) != 0
|| (unsigned int)a4 > 2
|| (unsigned int)(v35 - 1) > 7
|| !v33 && (((_DWORD)a2 - 1) & 0xFFFFFFFC) == 0 )
{
__fastfail(5u);
}
if( v39 )
*v39 = 0;
if( v34 )
{
*(_QWORD *)(a1 + 24) = *v34;
*(_QWORD *)(a1 + 32) = v34[1];
*(_QWORD *)(a1 + 40) = v34[3];
*(_QWORD *)(a1 + 48) = v34[4];
}
v6 = 4i64;
if( (_DWORD)a4 )
{
v21 = 4;
if( (_DWORD)a4 == 1 )
v21 = 1;
*(_DWORD *)(a1 + 164) = v21;
}
else
{
*(_DWORD *)(a1 + 164) = 0;
}
*(_DWORD *)(a1 + 160) = a3;
*(_QWORD *)(a1 + 8) = HvpGetCellPaged;
*(_DWORD *)(a1 + 136) = v35;
*(_DWORD *)(a1 + 208) = 2;
*(_QWORD *)(a1 + 16) = HvpReleaseCellPaged;
*(_DWORD *)(a1 + 132) = 4096;
v7 = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart;
*(_QWORD *)(a1 + 192) = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart;
*(_BYTE *)(a1 + 190) = 1;
switch( (_DWORD)a2 )
{
case 0:
LODWORD(a2) = (a3 & 1) == 0;
v8 = (*(__int64(__fastcall **)(_QWORD, UINT64, __int64))(a1 + 24))(*(unsigned int *)(a1 + 132), a2, 825314627i64);
if( v8 )
{
if( (((v35 << 9) - 1) & (unsigned int)v8) == 0 )
{
if( v40 )
*v40 = 825314627;
LABEL_19:
memset(v8, 0i64);
*(_DWORD *)(v8 + 36) = -1;
*(_DWORD *)v8 = 1718052210;
*(_DWORD *)(v8 + 4) = 1;
*(_DWORD *)(v8 + 8) = 1;
*(_DWORD *)(v8 + 32) = 1;
*(_DWORD *)(v8 + 44) = 1;
HvpFillFileName((_HBASE_BLOCK *)v8, FileName);
*(_DWORD *)(v8 + 144) = 0;
v9 = v5 & 0x80000;
if( v9 )
*(_DWORD *)(v8 + 144) = 2;
*(_DWORD *)(v8 + 20) = 1;
v10 = v9 != 0 ? 6 : 3;
*(_DWORD *)(v8 + 24) = v10;
*(_DWORD *)(a1 + 212) = v10;
*(_DWORD *)(v8 + 164) = 1836346738;
*(_DWORD *)(a1 + 168) = 1;
*(_DWORD *)(a1 + 180) = 1;
*(_DWORD *)(a1 + 172) = 1;
*(_QWORD *)(v8 + 12) = v7;
if( v37 )
{
*(_OWORD *)(v8 + 112) = *v37;
*(_OWORD *)(v8 + 128) = *v37;
}
if( v38 )
*(_OWORD *)(v8 + 148) = *v38;
*(_QWORD *)(a1 + 64) = v8;
*(_DWORD *)(v8 + 4088) = 0;
return;
}
(*(void(__fastcall **)(INT64, _QWORD))(a1 + 32))(v8, *(unsigned int *)(a1 + 132));
LOBYTE(v24) = 1;
v8 = (*(__int64(__fastcall **)(__int64, __int64, __int64))(a1 + 24))(4096i64, v24, 842091843i64);
if( v8 )
{
*(_DWORD *)(a1 + 132) = 4096;
if( v40 )
*v40 = 842091843;
goto LABEL_19;
}
LODWORD(v32) = 112;
}
else
{
LODWORD(v32) = 96;
}
goto LABEL_54;
case 4:
*(_QWORD *)(a1 + 64) = v33;
v22 = v33[5];
v23 = v33[6] - 4096;
*(_BYTE *)(a1 + 140) |= 3u;
*(_QWORD *)(a1 + 8) = HvpGetCellFlat;
*(_QWORD *)(a1 + 16) = HvpReleaseCellFlat;
*(_DWORD *)(a1 + 212) = v23 + (v22 << 12);
*(_DWORD *)(a1 + 272) = v33[10];
*(_DWORD *)(a1 + 208) = 1;
if( v40 )
*v40 = 0;
return;
case 3:
if( HvIsInPlaceBaseBlockValid(v33) )
{
v27 = v33[5];
v28 = v33[6];
*(_BYTE *)(a1 + 140) &= ~2u;
*(_QWORD *)(a1 + 64) = v33;
*(_DWORD *)(a1 + 208) = v26;
*(_DWORD *)(a1 + 212) = v28 - 4096 + (v27 << 12);
v33[1022] = v25;
v29 = v33[1];
*(_DWORD *)(a1 + 168) = v29;
*(_DWORD *)(a1 + 180) = v29;
*(_DWORD *)(a1 + 172) = v29;
v19 = HvpAdjustHiveFreeDisplay(a1, (unsigned int)v33[10], 0i64);
if( v19 < 0 )
{
LODWORD(v32) = 144;
goto LABEL_56;
}
v19 = HvpBuildMapForMemoryBackedHive((PVOID)a1);
if( v19 < 0 )
{
LODWORD(v32) = 160;
goto LABEL_56;
}
if( v40 )
*v40 = 0;
return;
}
LODWORD(v32) = 128;
LABEL_65:
v19 = -1073741492;
goto LABEL_56;
}
if( *v33 != 1718052210
|| v33[7]
|| v33[8] != 1
|| v33[5] > 1u
|| (unsigned int)(v33[6] - 3) > 3
|| v33[10] > 0x7FFFE000u
|| (unsigned int)HvpHeaderCheckSum(v33) != v33[127] )
{
LODWORD(v32) = 176;
goto LABEL_65;
}
v13 = 858869059;
LOBYTE(v11) = v12;
v14 = (*(__int64(__fastcall **)(_QWORD, __int64, __int64))(a1 + 24))(*(unsigned int *)(a1 + 132), v11, 858869059i64);
*(_QWORD *)(a1 + 64) = v14;
if( !v14 )
{
LODWORD(v32) = 192;
goto LABEL_54;
}
if( (((v35 << 9) - 1) & (unsigned int)v14) != 0 )
{
(*(void(__fastcall **)(__int64, _QWORD))(a1 + 32))(v14, *(unsigned int *)(a1 + 132));
v13 = 875646275;
LOBYTE(v30) = 1;
v31 = (*(__int64(__fastcall **)(__int64, __int64, __int64))(a1 + 24))(4096i64, v30, 875646275i64);
*(_QWORD *)(a1 + 64) = v31;
if( v31 )
{
*(_DWORD *)(a1 + 132) = 4096;
goto LABEL_39;
}
LODWORD(v32) = 208;
LABEL_54:
v19 = -1073741670;
LABEL_56:
SetFailureLocation(v41, 0i64, 25i64, (unsigned int)v19, v32);
return;
}
LABEL_39:
if( v40 )
*v40 = v13;
v15 = *(_OWORD **)(a1 + 64);
v16 = v33;
do
{
*v15 = *v16;
v15[1] = v16[1];
v15[2] = v16[2];
v15[3] = v16[3];
v15[4] = v16[4];
v15[5] = v16[5];
v15[6] = v16[6];
v15 += 8;
v17 = v16[7];
v16 += 8;
*(v15 - 1) = v17;
--v6;
}
while( v6 );
*(_DWORD *)(*(_QWORD *)(a1 + 64) + 4092i64) = v33[1023];
*(_DWORD *)(*(_QWORD *)(a1 + 64) + 4088i64) = v33[1022];
v18 = v33[1];
*(_DWORD *)(a1 + 168) = v18;
*(_DWORD *)(a1 + 180) = v18;
*(_DWORD *)(a1 + 172) = v18;
*(_DWORD *)(a1 + 212) = *(_DWORD *)(*(_QWORD *)(a1 + 64) + 24i64)
- 4096
+ (*(_DWORD *)(*(_QWORD *)(a1 + 64) + 20i64) << 12);
v19 = HvpAdjustHiveFreeDisplay(a1, (unsigned int)v33[10], 0i64);
if( v19 < 0 )
{
(*(void(__fastcall **)(_QWORD, _QWORD))(a1 + 32))(*(_QWORD *)(a1 + 64), *(unsigned int *)(a1 + 132));
*(_QWORD *)(a1 + 64) = 0i64;
LODWORD(v32) = 224;
goto LABEL_56;
}
if( (int)HvpBuildMapForMemoryBackedHive((PVOID)a1) < 0 )
{
LODWORD(v32) = 240;
SetFailureLocation(v41, 0i64, 25i64, 3221225804i64, v32);
(*(void(__fastcall **)(_QWORD, _QWORD))(a1 + 32))(*(_QWORD *)(a1 + 64), *(unsigned int *)(a1 + 132));
*(_QWORD *)(a1 + 64) = 0i64;
}
else
{
v20 = *(_QWORD *)(a1 + 64);
if( (*(_DWORD *)(v20 + 144) & 1) != 0 && v39 )
{
*v39 = 1;
v20 = *(_QWORD *)(a1 + 64);
}
*(_DWORD *)(v20 + 144) &= ~1u;
HvpFillFileName(*(_HBASE_BLOCK **)(a1 + 64), FileName);
}
}Referenced by:
CmpCreateHive
CmpGetSystemControlValues