HvStoreModifiedData

_HV_STORE_DATA_RESULT __stdcall HvStoreModifiedData(PVOID Hive, UINT8 CaptureBaseBlock, UINT8 CaptureUnreconciledData){
  bool v3; 
  unsigned int *v5; 
  UINT8 *v6; 
  unsigned int *v7; 
  VOID **v8; 
  size_t v9; 
  UINT64 v10; 
  VOID **PoolWithTag; 
  NTSTATUS v12; 
  unsigned int v13; 
  unsigned int v14; 
  int v15; 
  _HV_STORE_DATA_RESULT v16; 
  VOID **v18; 
  __int64 v19; 
  _OWORD *v20; 
  _OWORD *v21; 
  __int128 v22; 
  VOID **v23; 
  VOID **v24; 
  char *v25; 
  UINT8 *v26; 
  int v27; 
  int v28; 
  int v29; 
  unsigned int v30; 
  PVOID v31; 
  PVOID *v32; 
  __int64 v33; 
  PVOID *v34; 
  __int64 v35; 
  size_t Size; 
  UINT64 EntrySize; 
  unsigned int v38; 
  unsigned int SizeOfBitMap; 
  int v40; 
  UINT8 *Entry; 
  PVOID P; 
  UINT64 Current; 
  _RTL_BITMAP Destination; 
  UINT8 *Address; 
  _RTL_BITMAP Source; 
  unsigned int v47; 
  UINT64 Offset; 

  v3 = (*((_DWORD *)Hive + 40) & 0x8000) == 0;
  Address = 0i64;
  v5 = 0i64;
  LODWORD(Offset) = 0;
  v6 = 0i64;
  Entry = 0i64;
  v7 = 0i64;
  EntrySize = 0i64;
  v8 = 0i64;
  v40 = 0;
  v47 = 0;
  P = 0i64;
  Source = 0i64;
  Destination = 0i64;
  if( !v3 )
    return 1;
  *((_DWORD *)Hive + 430) = HvpTruncateBins((_HHIVE *)Hive);
  if( (*((_DWORD *)Hive + 40) & 1) != 0 )
    return 1;
  v9 = *((_DWORD *)Hive + 27);
  v10 = v9;
  Size = v9;
  if( *((_DWORD *)Hive + 26) )
  {
    PoolWithTag = ExAllocatePoolWithTag(1ui64, v9, 808799555i64);
    v5 = (unsigned int *)PoolWithTag;
    if( !PoolWithTag )
      return 2;
    memmove(PoolWithTag, *((const VOID **)Hive + 12), v10);
    SizeOfBitMap = *((_DWORD *)Hive + 22);
    Source.SizeOfBitMap = SizeOfBitMap;
    Source.Buffer = v5;
    v12 = HvpGenerateLogEntry((_HHIVE *)Hive, &Entry, &EntrySize);
    v6 = Entry;
    if( v12 < 0 )
      goto LABEL_48;
  }
  else
  {
    SizeOfBitMap = Source.SizeOfBitMap;
  }
  if( !CaptureUnreconciledData && !CaptureBaseBlock )
    goto LABEL_8;
  v18 = ExAllocatePoolWithTag(1ui64, 0x1000ui64, 808799555i64);
  P = v18;
  if( v18 )
  {
    memset(v18, 0i64, 0x1000u);
    v19 = 4i64;
    *(_DWORD *)(*((_QWORD *)Hive + 8) + 40i64) = *((_DWORD *)Hive + 68);
    v20 = (_OWORD *)*((_QWORD *)Hive + 8);
    v21 = P;
    do
    {
      *v21 = *v20;
      v21[1] = v20[1];
      v21[2] = v20[2];
      v21[3] = v20[3];
      v21[4] = v20[4];
      v21[5] = v20[5];
      v21[6] = v20[6];
      v21 += 8;
      v22 = v20[7];
      v20 += 8;
      *(v21 - 1) = v22;
      --v19;
    }
    while( v19 );
    if( !CaptureUnreconciledData )
    {
LABEL_8:
      v13 = Destination.SizeOfBitMap;
LABEL_9:
      v14 = *((_DWORD *)Hive + 68);
      if( *((_DWORD *)Hive + 446) < v14 || *((_DWORD *)Hive + 430) )
        *((_DWORD *)Hive + 446) = v14;
      if( *((_DWORD *)Hive + 26) )
      {
        *((_DWORD *)Hive + 420) = SizeOfBitMap;
        *((_QWORD *)Hive + 211) = v5;
        v5 = 0i64;
        *((_DWORD *)Hive + 424) = Size;
        *((_DWORD *)Hive + 428) = EntrySize;
        v15 = v40;
        *((_QWORD *)Hive + 213) = v6;
        v6 = 0i64;
        *((_DWORD *)Hive + 429) = v15;
        HvResetDirtyData((_HHIVE *)Hive);
      }
      if( CaptureBaseBlock || CaptureUnreconciledData )
      {
        v31 = P;
        P = 0i64;
        v3 = *((_BYTE *)Hive + 191) == 0;
        *((_QWORD *)Hive + 221) = v31;
        if( !v3 )
          *((_BYTE *)Hive + 1724) = 1;
        if( CaptureUnreconciledData )
        {
          *((_QWORD *)Hive + 217) = v7;
          v7 = 0i64;
          *((_DWORD *)Hive + 432) = v13;
          *((_QWORD *)Hive + 219) = v8;
          v8 = 0i64;
          *((_DWORD *)Hive + 436) = Size;
          *((_DWORD *)Hive + 440) = v47;
          if( *((_QWORD *)Hive + 15) )
          {
            RtlClearAllBits((PRTL_BITMAP)Hive + 7);
            *((_DWORD *)Hive + 32) = 0;
            *((_BYTE *)Hive + 191) = 0;
          }
        }
      }
      v16 = StoreDataSuccess;
      goto LABEL_16;
    }
    v23 = ExAllocatePoolWithTag(1ui64, v10, 808799555i64);
    v7 = (unsigned int *)v23;
    if( v23 )
    {
      memmove(v23, *((const VOID **)Hive + 15), v10);
      LODWORD(Entry) = *((_DWORD *)Hive + 28);
      Destination.SizeOfBitMap = (unsigned int)Entry;
      Destination.Buffer = v7;
      if( *((_DWORD *)Hive + 26) )
        RtlMergeBitMaps(&Destination, &Source);
      v47 = HvpCountSetRangesInVector(&Destination);
      v24 = ExAllocatePoolWithTag(1ui64, 24i64 * v47, 842353987i64);
      v8 = v24;
      if( v24 )
      {
        memset(v24, 0i64, 24 * v47);
        v38 = 0;
        LODWORD(Current) = 0;
        if( v47 )
        {
          v25 = (char *)(v8 + 1);
          do
          {
            if( !HvpFindNextDirtyBlock(
                    Hive,
                    &Destination,
                    &Current,
                    &Address,
                    (UINT64 *)((char *)&EntrySize + 4),
                    &Offset,
                    1u) )
              break;
            v26 = Address;
            if( !Address )
              goto LABEL_48;
            v27 = Offset;
            v28 = HIDWORD(EntrySize);
            *((_DWORD *)v25 + 2) = HIDWORD(EntrySize);
            *((_DWORD *)v25 - 2) = v27;
            v29 = v28 + v27;
            v30 = v38 + 1;
            *(_QWORD *)v25 = v26;
            v25 += 24;
            LODWORD(Offset) = v29;
            v38 = v30;
          }
          while( v30 < v47 );
        }
        memmove(v7, *((const VOID **)Hive + 15), Size);
        v13 = (unsigned int)Entry;
        goto LABEL_9;
      }
    }
  }
LABEL_48:
  v16 = StoreDataFailure;
LABEL_16:
  if( v5 )
    ExFreePoolWithTag(v5, 0);
  if( v6 )
  {
    if( (_DWORD)EntrySize )
    {
      v32 = (PVOID *)(v6 + 8);
      v33 = (unsigned int)EntrySize;
      do
      {
        if( *v32 )
        {
          ExFreePoolWithTag(*v32, 0);
          *v32 = 0i64;
        }
        v32 += 3;
        --v33;
      }
      while( v33 );
    }
    ExFreePoolWithTag(v6, 0);
  }
  if( v7 )
    ExFreePoolWithTag(v7, 0);
  if( v8 )
  {
    if( v47 )
    {
      v34 = v8 + 1;
      v35 = v47;
      do
      {
        if( *v34 )
          ExFreePoolWithTag(*v34, 0);
        v34 += 3;
        --v35;
      }
      while( v35 );
    }
    ExFreePoolWithTag(v8, 0);
  }
  if( P )
    ExFreePoolWithTag(P, 0);
  return v16;
}

Referenced by: