HvSnapshotHiveToOffsetArray
INT64 __fastcall HvSnapshotHiveToOffsetArray(INT64 a1, INT64 *a2, CHAR **a3, UINT64 *a4){
unsigned int v4;
unsigned int v6;
INT64 CellMap;
int v11;
int v12;
unsigned int v13;
unsigned int v14;
__int64 v15;
CHAR *PoolWithTag;
unsigned int v17;
unsigned int v18;
UINT8 *v19;
CHAR *v20;
unsigned int v21;
_DWORD *v22;
int v23;
UINT8 *v24;
__int64 v25;
unsigned int v26;
unsigned int v27;
unsigned int v28;
int i;
unsigned int v30;
VOID *v31;
__int64 v32;
__int64 v33;
unsigned int v34;
unsigned int v35;
INT64 v36;
int v37;
unsigned int v38;
__int64 v39;
CHAR *v40;
UINT8 *v42;
UINT8 *Src;
int Srca;
unsigned int v45;
__int64 v46;
int v47;
*a3 = 0i64;
v4 = 0;
*(_DWORD *)a2 = 0;
v6 = *(_DWORD *)(a1 + 272);
Src = *(UINT8 **)(a1 + 64);
if( v6 )
{
while( 1 )
{
CellMap = HvpGetCellMap(a1, v4);
if( *(_DWORD *)(*(_QWORD *)(CellMap + 8) & 0xFFFFFFFFFFFFFFF0ui64) != 1852400232 )
break;
if( *(_DWORD *)((*(_QWORD *)(CellMap + 8) & 0xFFFFFFFFFFFFFFF0ui64) + 4) != v11 )
break;
v12 = *(_DWORD *)((*(_QWORD *)(CellMap + 8) & 0xFFFFFFFFFFFFFFF0ui64) + 8);
v4 = v12 + v11;
if( v4 > v6 || (v12 & 0xFFF) != 0 )
break;
if( v4 >= v6 )
goto LABEL_7;
}
v17 = -1073741492;
goto LABEL_35;
}
LABEL_7:
v13 = v6 + 4096;
v14 = (v6 + 4096) >> 20;
v15 = v14 + 1;
if( ((v6 + 4096) & 0xFFFFF) == 0 )
v15 = v14;
PoolWithTag = (CHAR *)ExAllocatePoolWithTag(PagedPool, 24 * v15, 0x20204D43ui64);
*a3 = PoolWithTag;
if( PoolWithTag )
{
memset((INT64)PoolWithTag, 0i64);
*(_DWORD *)a4 = v13;
v18 = 0x100000;
if( v13 < 0x100000 )
v18 = v6 + 4096;
v19 = (UINT8 *)ExAllocatePoolWithTag(PagedPool, v18, 0x20204D43ui64);
v20 = *a3;
*((_QWORD *)*a3 + 1) = v19;
if( v19 )
{
*(_DWORD *)v20 = 0;
v21 = 4096;
*((_DWORD *)v20 + 4) = v18;
memmove(v19, Src, 0x1000ui64);
v22 = (_DWORD *)*((_QWORD *)v20 + 1);
v22[2] = v22[1];
v22[10] = v6;
v23 = HvpHeaderCheckSum(v22);
v24 = 0i64;
*(_DWORD *)(v25 + 508) = v23;
v26 = *(_DWORD *)(a1 + 272);
v27 = 0;
v28 = 0;
v45 = 0;
Srca = 4096;
*(_DWORD *)a2 = 1;
v42 = 0i64;
if( !v26 )
return 0;
for( i = 1; ; i = v47 )
{
v47 = i;
if( v21 == v18 )
{
v30 = v26 - v27;
v18 = 0x100000;
if( v30 < 0x100000 )
v18 = v30;
v31 = ExAllocatePoolWithTag(PagedPool, v18, 0x20204D43ui64);
v32 = *(unsigned int *)a2;
v20 = *a3;
v33 = 3 * v32;
*(_QWORD *)&(*a3)[24 * v32 + 8] = v31;
if( !v31 )
goto LABEL_10;
i = v32 + 1;
v24 = v42;
v21 = 0;
*(_DWORD *)&v20[8 * v33] = Srca;
*(_DWORD *)&v20[8 * v33 + 16] = v18;
v47 = i;
*(_DWORD *)a2 = i;
}
if( v28 )
break;
v36 = HvpGetCellMap(a1, v27);
if( !v36 )
{
v17 = -1073741275;
goto LABEL_35;
}
v42 = (UINT8 *)(*(_QWORD *)(v36 + 8) & 0xFFFFFFFFFFFFFFF0ui64);
v38 = *((_DWORD *)v42 + 2);
v28 = v18 - v21 < v38 ? v38 - (v18 - v21) : 0;
if( v38 > v18 - v21 )
v38 = v18 - v21;
v46 = v38;
memmove(
(UINT8 *)(*(_QWORD *)&v20[24 * (v37 - 1) + 8] + v21),
(UINT8 *)(*(_QWORD *)(v36 + 8) & 0xFFFFFFFFFFFFFFF0ui64),
v38);
v39 = v46;
Srca += v46;
v27 += v46;
v21 += v46;
v45 = v27;
if( !v28 )
goto LABEL_26;
v24 = &v42[v39];
v42 += v39;
LABEL_27:
v26 = *(_DWORD *)(a1 + 272);
if( v27 >= v26 )
return 0;
}
v34 = v28;
if( v28 > v18 )
v34 = v18;
v35 = v34;
memmove(*(UINT8 **)&v20[24 * (i - 1) + 8], v24, v34);
v45 += v35;
v28 -= v35;
v21 += v35;
Srca += v35;
v27 = v45;
LABEL_26:
v24 = v42;
goto LABEL_27;
}
}
LABEL_10:
v17 = -1073741801;
LABEL_35:
v40 = *a3;
if( *a3 )
{
if( *(_DWORD *)a2 )
{
do
ExFreePoolWithTag(*(PVOID *)&(*a3)[24 * --*(_DWORD *)a2 + 8], 0);
while( *(_DWORD *)a2 );
v40 = *a3;
}
ExFreePoolWithTag(v40, 0);
*(_DWORD *)a2 = 0;
}
return v17;
}Referenced by:
CmDumpKey
CmpFlushBackupHive