解读 DecompressManifest
//----- (10226B2C)--------------------------------------------------------
int __fastcall Windows::WCP::Implementation::Rtl::DecompressManifest(
int a1, //dwFlags
Windows::WCP::Rtl *a2,// pManifestContents
_DWORD *a3
)
{
v13 =a1;
v17 =(unsigned __int32)a2;
if (a1 & 0xFFFFFFFE) // dwFlags
{
}
if (!a2 ) // pManifestContents
{
}
v6 =0;
if (a3 )
*a3= 0;
v18 =0;
v4 =Windows::WCP::Implementation::Rtl::IsManifestCompressed(a2,(bool *)&v18);
v4 = Windows::Rtl::InitializeDeltaCompressor(&ThisModuleMarker,v11);
v4 = LoadDictionary(v7,(const unsigned __int16 *)&v23);
v14 = 0;
v15 =0;
v16 =0;
v8 =Windows::Rtl::DeltaDecompressBuffer(
(Windows::Rtl*)2,
(unsigned__int32)&v23,
(struct_LBLOB *)4,
v17,
(struct_LBLOB *)&v14,
v12);
v4 =v8;
v23 = 0;
v24 =0;
v25 =0;
v4 =RtlDuplicateLBlob((int)&v14,(int)&v23);
v20 = *(const char **)v17;
v21 =*(_DWORD*)(v17+ 4);
v22 =*(constchar **)(v17 + 8);
v10 =v17;
// v17 就是 a2
// v23 是释放后的 pManifestContents的内容,交换到 a2
*(_DWORD *)v17 =v23;
v10 +=4;
*(_DWORD *)v10 =v24;
*(_DWORD *)(v10 + 4) = v25;
v23 =(unsigned __int32)v20;
v24 =v21;
v25 =v22;
Windows::Rtl::AutoBlob<Windows::Auto<_LBLOB>>::Close((int)&v23);
Windows::Rtl::AutoDeltaBlob::Close((Windows::Rtl::AutoDeltaBlob *)&v14);
return 0;
}