HvValidateOrInvalidatePrimaryFileHeader
INT64 __fastcall HvValidateOrInvalidatePrimaryFileHeader(INT64 a1, CHAR a2, CHAR a3, CHAR a4){
int v7;
_DWORD *v8;
int v9;
int v10;
__int64(__fastcall *v11)(INT64, _QWORD, int *, __int64, int);
int v12;
_DWORD *PoolWithTag;
_OWORD *v15;
__int64 v16;
_OWORD *v17;
__int128 v18;
int v19[2];
_DWORD *v20;
int v21;
int v22;
v19[1] = 0;
v22 = 0;
if( *(_QWORD *)(a1 + 1536) )
{
v7 = a4 & 1;
if( a3 )
{
v8 = *(_DWORD **)(a1 + 1768);
}
else
{
PoolWithTag = ExAllocatePoolWithTag(PagedPool, 0x1000ui64, 0x6F494D43ui64);
v8 = PoolWithTag;
if( !PoolWithTag )
return(unsigned int)-1073741801;
memset((INT64)PoolWithTag, 0i64);
v15 = *(_OWORD **)(a1 + 64);
v16 = 4i64;
v17 = v8;
do
{
*v17 = *v15;
v17[1] = v15[1];
v17[2] = v15[2];
v17[3] = v15[3];
v17[4] = v15[4];
v17[5] = v15[5];
v17[6] = v15[6];
v17 += 8;
v18 = v15[7];
v15 += 8;
*(v17 - 1) = v18;
--v16;
}
while( v16 );
}
v9 = *(_DWORD *)(a1 + 168);
v10 = v9 - 1;
if( a2 )
v10 = *(_DWORD *)(a1 + 168);
v8[2] = v10;
v8[1] = v9;
v8[127] = HvpHeaderCheckSum(v8);
v11 = *(__int64(__fastcall **)(INT64, _QWORD, int *, __int64, int))(a1 + 40);
v19[0] = 0;
v20 = v8;
v21 = 4096;
v12 = v11(a1, 0i64, v19, 1i64, v7);
if( v12 >= 0 )
{
v12 = CmpFileFlushAndPurge(a1, 0i64);
if( v12 >= 0 )
{
*(_BYTE *)(a1 + 190) = a2;
v12 = 0;
*(_DWORD *)(a1 + 180) = v8[2];
}
}
if( !a3 )
ExFreePoolWithTag(v8, 0);
}
else
{
return 0;
}
return(unsigned int)v12;
}Referenced by:
CmpFlushHive
HvpPerformLogFileRecovery