HvpRecoverDataReadRoutine

INT64 __fastcall HvpRecoverDataReadRoutine(
        _HHIVE *Hive,
        VOID *Context,
        UINT64 FileOffset,
        UINT64 DataSize,
        UINT8 **Data){
  _CELL_DATA *(__fastcall *v5)(_HHIVE *, unsigned int, _HV_GET_CELL_CONTEXT *); 
  unsigned int v6; 
  int v8; 
  __int64 v9; 
  int v10; 
  _CELL_DATA *(__fastcall *GetCellRoutine)(_HHIVE *, unsigned int, _HV_GET_CELL_CONTEXT *); 
  unsigned int v12; 
  unsigned int v13; 
  unsigned int v14; 
  unsigned int ReleaseCellRoutine; 
  _CELL_DATA *(__fastcall *v16)(_HHIVE *, unsigned int, _HV_GET_CELL_CONTEXT *); 
  char *v17; 
  v5 = 0i64;
  v6 = (unsigned int)Context;
  if( (int)Context + (int)FileOffset < (unsigned int)Context && (_DWORD)Context + (_DWORD)FileOffset )
  {
    return(unsigned int)-1073741811;
  }
  else
  {
    v9 = *(_QWORD *)&Hive->Signature;
    v10 = *(_DWORD *)(*(_QWORD *)&Hive->Signature + 136i64) << 9;
    GetCellRoutine = Hive->GetCellRoutine;
    v12 = (unsigned int)Context & ~(v10 - 1);
    v13 = (~(v10 - 1) & ((_DWORD)Context + v10 + FileOffset - 1)) - v12;
    v14 = v13;
    if( v13 < 0x10000 )
      v14 = 0x10000;
    if( !GetCellRoutine )
      goto LABEL_13;
    ReleaseCellRoutine = (unsigned int)Hive->ReleaseCellRoutine;
    if( ReleaseCellRoutine < v14 )
      CmSiFreeMemory((PPRIVILEGE_SET)GetCellRoutine);
    else
      v5 = Hive->GetCellRoutine;
    Hive->GetCellRoutine = 0i64;
    LODWORD(Hive->ReleaseCellRoutine) = 0;
    if( ReleaseCellRoutine < v14 )
      ReleaseCellRoutine = v14;
    if( !v5 )
    {
LABEL_13:
      CmpAllocateTransientPoolWithTag((_HHIVE *)1, v13, 0x6F494D43ui64, (_CHILD_LIST *)DataSize);
      v5 = v16;
      if( !v16 )
        return(unsigned int)-1073741801;
      ReleaseCellRoutine = v13;
    }
    v8 = (*(__int64(__fastcall **)(__int64, _QWORD, _QWORD, _CELL_DATA *(__fastcall *)(_HHIVE *, unsigned int, _HV_GET_CELL_CONTEXT *), unsigned int))(v9 + 48))(
           v9,
           HIDWORD(Hive->ReleaseCellRoutine),
           v12,
           v5,
           v13);
    if( v8 >= 0 )
    {
      Hive->GetCellRoutine = v5;
      LODWORD(Hive->ReleaseCellRoutine) = ReleaseCellRoutine;
      v17 = (char *)v5 + v6 % (*(_DWORD *)(v9 + 136) << 9);
      v5 = 0i64;
      v8 = 0;
      *(_QWORD *)DataSize = v17;
    }
    if( v5 )
      CmSiFreeMemory((PPRIVILEGE_SET)v5);
  }
  return(unsigned int)v8;
}

Referenced by:

HvpApplyIncrementalLogFile
HvpApplyLegacyLogFile