HvpRecoverDataReadRoutine
INT64 __fastcall HvpRecoverDataReadRoutine(
_HHIVE *Hive,
VOID *Context,
UINT64 FileOffset,
UINT64 DataSize,
UINT8 **Data){
_CELL_DATA *(__fastcall *v5)(_HHIVE *, unsigned int, _HV_GET_CELL_CONTEXT *);
unsigned int v6;
int v8;
__int64 v9;
int v10;
_CELL_DATA *(__fastcall *GetCellRoutine)(_HHIVE *, unsigned int, _HV_GET_CELL_CONTEXT *);
unsigned int v12;
unsigned int v13;
unsigned int v14;
unsigned int ReleaseCellRoutine;
_CELL_DATA *(__fastcall *v16)(_HHIVE *, unsigned int, _HV_GET_CELL_CONTEXT *);
char *v17;
v5 = 0i64;
v6 = (unsigned int)Context;
if( (int)Context + (int)FileOffset < (unsigned int)Context && (_DWORD)Context + (_DWORD)FileOffset )
{
return(unsigned int)-1073741811;
}
else
{
v9 = *(_QWORD *)&Hive->Signature;
v10 = *(_DWORD *)(*(_QWORD *)&Hive->Signature + 136i64) << 9;
GetCellRoutine = Hive->GetCellRoutine;
v12 = (unsigned int)Context & ~(v10 - 1);
v13 = (~(v10 - 1) & ((_DWORD)Context + v10 + FileOffset - 1)) - v12;
v14 = v13;
if( v13 < 0x10000 )
v14 = 0x10000;
if( !GetCellRoutine )
goto LABEL_13;
ReleaseCellRoutine = (unsigned int)Hive->ReleaseCellRoutine;
if( ReleaseCellRoutine < v14 )
CmSiFreeMemory((PPRIVILEGE_SET)GetCellRoutine);
else
v5 = Hive->GetCellRoutine;
Hive->GetCellRoutine = 0i64;
LODWORD(Hive->ReleaseCellRoutine) = 0;
if( ReleaseCellRoutine < v14 )
ReleaseCellRoutine = v14;
if( !v5 )
{
LABEL_13:
CmpAllocateTransientPoolWithTag((_HHIVE *)1, v13, 0x6F494D43ui64, (_CHILD_LIST *)DataSize);
v5 = v16;
if( !v16 )
return(unsigned int)-1073741801;
ReleaseCellRoutine = v13;
}
v8 = (*(__int64(__fastcall **)(__int64, _QWORD, _QWORD, _CELL_DATA *(__fastcall *)(_HHIVE *, unsigned int, _HV_GET_CELL_CONTEXT *), unsigned int))(v9 + 48))(
v9,
HIDWORD(Hive->ReleaseCellRoutine),
v12,
v5,
v13);
if( v8 >= 0 )
{
Hive->GetCellRoutine = v5;
LODWORD(Hive->ReleaseCellRoutine) = ReleaseCellRoutine;
v17 = (char *)v5 + v6 % (*(_DWORD *)(v9 + 136) << 9);
v5 = 0i64;
v8 = 0;
*(_QWORD *)DataSize = v17;
}
if( v5 )
CmSiFreeMemory((PPRIVILEGE_SET)v5);
}
return(unsigned int)v8;
}Referenced by:
HvpApplyIncrementalLogFile
HvpApplyLegacyLogFile