解读 DecompressManifest

解读 DecompressManifest

 

 

//----- (10226B2C)--------------------------------------------------------
int __fastcall Windows::WCP::Implementation::Rtl::DecompressManifest(

int a1, //dwFlags

Windows::WCP::Rtl *a2,// pManifestContents

_DWORD *a3

)
{

  v13 =a1;
  v17 =(unsigned __int32)a2;
  if (a1 & 0xFFFFFFFE)  // dwFlags
  {
  }
  if (!a2 )  // pManifestContents
  {
  }
  v6 =0;
  if (a3 )
    *a3= 0;
  v18 =0;
  v4 =Windows::WCP::Implementation::Rtl::IsManifestCompressed(a2,(bool *)&v18);

  v4 = Windows::Rtl::InitializeDeltaCompressor(&ThisModuleMarker,v11);

  v4 = LoadDictionary(v7,(const unsigned __int16 *)&v23);

  v14 = 0;
  v15 =0;
  v16 =0;
  v8 =Windows::Rtl::DeltaDecompressBuffer(
         (Windows::Rtl*)2,
         (unsigned__int32)&v23,
         (struct_LBLOB *)4,
         v17,
         (struct_LBLOB *)&v14,
         v12);
  v4 =v8;

  v23 = 0;
  v24 =0;
  v25 =0;
  v4 =RtlDuplicateLBlob((int)&v14,(int)&v23);

  v20 = *(const char **)v17;
  v21 =*(_DWORD*)(v17+ 4);
  v22 =*(constchar **)(v17 + 8);
  v10 =v17; 

// v17 就是 a2

// v23 是释放后的 pManifestContents的内容，交换到 a2
  *(_DWORD *)v17 =v23;
  v10 +=4;
  *(_DWORD *)v10 =v24;
  *(_DWORD *)(v10 + 4) = v25;
  v23 =(unsigned __int32)v20;
  v24 =v21;
  v25 =v22;
  Windows::Rtl::AutoBlob<Windows::Auto<_LBLOB>>::Close((int)&v23);
  Windows::Rtl::AutoDeltaBlob::Close((Windows::Rtl::AutoDeltaBlob *)&v14);
  return 0;
}