解读 CopyFileContents

解读 CopyFileContents

 

 

 

//----- (100F1216)--------------------------------------------------------
int __fastcall CopyFileContents(inta1, int a2, int a3, int a4)
{

  v38 =C00000E5;
  v4 =a3;
  v5 =a2;
  if (a3 )
  {
    if (a4 )
    {
      v29 =0;
      v30 =0;
      v31 =0;
      v37 =0i64;
      v38 =0;
      if (!a2 )
      {
        Windows::Auto<Windows::Rtl::SystemImplementation::DirectFileSystemProvider*>::Allocate(&v38);
        v5 =v38;
        v4 =a3;
      }
      v8 =*(_DWORD*)v5;
      v9 =v4;
// SysQueryInformationFile

      v6 = (*(int(__thiscall **)(int, int, char *, char *,signed int, signed int))(v8+ 48))(
             v5,
             v9,
             &v35,
             &v32,
             24,
             5);
      if (v6 >= 0)
      {
        v34 =v33;
        v10 =*(_DWORD*)v5;
// SysSetInformationFile

        v6 = (*(int(__thiscall **)(int, _DWORD, int, char *, __int64 *,signed int, signed int, _DWORD))(v10 + 52))(
               v5,
               0,
               a4,
               &v35,
               (__int64*)&v34,
               8,
               20,
               0);
        if ( v6 >= 0 )
        {
          v27 =HIDWORD(v33);
          HIDWORD(v11) = v33;
          v12 =0x400000;
          if ( v33 <=0x400000 )
            v12 = v33;
          v6 =RtlAllocateLBlob(v12, (int)&v29);
          if ( v6 >=0 )
          {
            LODWORD(v11) = v27;
            if ( !__PAIR__(HIDWORD(v11), v27) )
            {
LABEL_22:
              Windows::Auto<Windows::Rtl::SystemImplementation::DirectFileSystemProvider*>::~Auto<Windows::Rtl::SystemImplementation::DirectFileSystemProvider*>(&v38);
              Windows::Rtl::AutoBlob<Windows::Auto<_LBLOB>>::Close((int)&v29);
              return 0;
            }
            HIDWORD(v13) = 0;
            while ( 1 )
            {
              LODWORD(v13) = (unsignedint)v11 >HIDWORD(v13)
                          || (unsignedint)v11 >=HIDWORD(v13)&& HIDWORD(v11) >= v30 ?v30 : HIDWORD(v11);
              v14 = *(_DWORD *)v5;
              v15 = HIDWORD(v13);
              v16 = HIDWORD(v13);
              v17 = v13;
              v18 = v31;
              v19 = HIDWORD(v13);
              v20 =HIDWORD(v13);
              v21 = HIDWORD(v13);
              v22 = HIDWORD(v13);
// SysReadFile

              v6 = (*(int(__thiscall **)(int, int, int, int, int,int, char *, constchar *, int, __int64*, int, int))(v14 + 40))(
                     v5,
                     v22,
                     a3,
                     v21,
                     v20,
                     v19,
                     &v35,
                     v18,
                     v17,
                     &v37,
                     v16,
                     v15);
              if ( v6 <0 )
                break;
              v23 = *(_DWORD *)v5;
              v24 = v36;
              v25 = v31;
// SysWriteFile

              v6 = (*(int(__thiscall **)(int, _DWORD, int, _DWORD, _DWORD,_DWORD, char *, const char*, unsigned int, __int64*, _DWORD, _DWORD))(v23 + 44))(
                     v5,
                     0,
                     a4,
                     0,
                     0,
                     0,
                     &v35,
                     v25,
                     v24,
                     &v37,
                     0,
                     0);
              if ( v6 <0 )
                break;
              LODWORD(v11) = (__PAIR__(v27, HIDWORD(v11)) - v36) >>32;
              HIDWORD(v11) -= v36;
              v13 = HIDWORD(v11);
              v27 = v11;
              v37 += v36;
              if ( !v11 )
                goto LABEL_22;
            }
          }
        }
      }
      Windows::Auto<Windows::Rtl::SystemImplementation::DirectFileSystemProvider*>::~Auto<Windows::Rtl::SystemImplementation::DirectFileSystemProvider*>(&v38);
      Windows::Rtl::AutoBlob<Windows::Auto<_LBLOB>>::Close((int)&v29);
    }
    else
    {
     Windows::ErrorHandling::Rtl::CBaseFrame<Windows::ErrorHandling::Rtl::CVoidRaiseFrame>::SetInvalidParameter_NullPointer(&v38);
      v28 ="base\\wcp\\sil\\merged\\ntu\\ntsystem.cpp";
      v29 =(int)"Windows::Rtl::SystemImplementation::CopyFileContents";
      v30 =4806;
      v31 ="Not-null check failed: Target";
     Windows::ErrorHandling::Rtl::CBaseFrame<Windows::ErrorHandling::Rtl::CVoidRaiseFrame>::ReportErrorOrigination(
        v7,
        (int)&v28);
      v6 =v38;
    }
  }
  else
  {
    v6 =0;
  }
  return v6;
}