HvpApplyLegacyLogFile
__int64 __fastcall HvpApplyLegacyLogFile(
_DWORD *a1,
__int64 a2,
_HHIVE *r8_0,
__int64 a4,
__int64 a5,
__int64 (__fastcall *a6)(_QWORD, _QWORD, __int64),
void (__fastcall *a7)(_DWORD *, _QWORD),
_RTL_BITMAP *a8){
unsigned int v9;
unsigned int v10;
NTSTATUS Routine;
NTSTATUS v12;
unsigned int v13;
INT64 v14;
_DWORD *v15;
unsigned int v16;
UINT8 **v18;
UINT8 **v19;
UINT64 a3;
UINT64 DataSize;
int v22;
_RTL_BITMAP Address;
_HHIVE *Hive;
ULONG_PTR BugCheckParameter2[2];
void(__fastcall *v26)(_DWORD *, _QWORD);
INT64 v27;
__int64 v28;
int v29;
int v30;
__int128 v31;
*(_QWORD *)BugCheckParameter2 = a5;
v9 = a1[10];
v26 = a7;
v10 = v9 >> 12;
Hive = r8_0;
v22 = 0;
*(&Address.SizeOfBitMap + 1) = 0;
DataSize = 0i64;
v28 = 0i64;
v31 = 0i64;
LODWORD(a3) = 0;
Routine = HvpRecoverDataReadRoutine(r8_0, (VOID *)0x200, v10 + 4, (UINT64)&DataSize, v18);
if( Routine >= 0 )
{
if( *(_DWORD *)DataSize == 1414678852 )
{
Address.SizeOfBitMap = a1[10] >> 9;
Address.Buffer = (unsigned int *)(DataSize + 4);
v12 = RtlNumberOfSetBits((UINT64 *)&Address.SizeOfBitMap);
if( v12 )
{
v13 = v12 << 9;
HvpGenerateLogMetadata(&Address, 0i64, &a3);
v14 = a6((unsigned int)(8 * a3), 0i64, 859000131i64);
v15 = (_DWORD *)v14;
if( v14 )
{
HvpGenerateLogMetadata(&Address, v14, &a3);
v16 = a3;
v29 = a1[10];
LODWORD(v27) = 1162638920;
v30 = a3;
HIDWORD(v27) = v13 + 8 * (a3 + 5);
if( HvpIsMetadataArrayCoherent((unsigned int *)&v27, (__int64)v15, a3) )
{
Routine = HvpRecoverDataReadRoutine(Hive, (VOID *)((v10 + 1027) & 0xFFFFFE00), v13, (UINT64)&DataSize, v19);
if( Routine >= 0 )
{
Routine = HvpApplyLogEntryDataToFileBackedHive(BugCheckParameter2[0], (INT64)&v27, (INT64)v15);
if( Routine >= 0 )
{
if( (v28 & 1) != 0 )
a1[36] |= 1u;
if( a8 )
HvpUpdateRecoveryVector(v15, v16, a8);
Routine = 1073741833;
}
}
}
else
{
Routine = -1073741492;
}
v26(v15, 8 * v16);
}
else
{
return(unsigned int)-1073741801;
}
}
else
{
return 0;
}
}
else if( BYTE3(NlsMbCodePageTag) || (*(&CmpDummyThreadEvent + 2744) & 6) != 0 )
{
a1[1022] |= 4u;
return 1073741833;
}
else
{
return(unsigned int)-1073741492;
}
}
return(unsigned int)Routine;
}Referenced by:
HvApplyLogFile