HvApplyLogFile
NTSTATUS __stdcall HvApplyLogFile(
_HHIVE *Hive,
UINT64 FirstSequence,
VOID *ReadRoutineContext,
_RTL_BITMAP *RecoveredDataVector,
UINT64 *LastSequence,
UINT64 *EntriesRecovered){
NTSTATUS v7;
int v9;
int v10;
int v11;
__int64(__fastcall *v12)(_QWORD, _QWORD, __int64);
void(__fastcall *v13)(_DWORD *, _QWORD);
_RTL_BITMAP *v14;
_DWORD *v15;
_DWORD *v16;
_DWORD *v17;
if( !*(_BYTE *)(FirstSequence + 20) )
return HvpApplyIncrementalLogFile(
(__int64)Hive,
*(_DWORD *)(FirstSequence + 8),
*(unsigned int *)(FirstSequence + 16),
(__int64)RecoveredDataVector,
(_HHIVE *)RecoveredDataVector,
v9,
(__int64)EntriesRecovered,
v10,
v11,
(__int64)v14,
(__int64)v15,
(__int64)v16,
(__int64)v17);
v7 = HvpApplyLegacyLogFile(
Hive,
FirstSequence,
(_HHIVE *)RecoveredDataVector,
(__int64)RecoveredDataVector,
(__int64)EntriesRecovered,
v12,
v13,
v14);
if( v7 >= 0 )
{
if( v15 )
*v15 = *(_DWORD *)(FirstSequence + 12) + 1;
if( v16 )
*v16 = 1;
if( v17 )
*v17 = 0;
}
return v7;
}Referenced by:
HvpPerformLogFileRecovery