解读 CopyFileContents
//----- (100F1216)--------------------------------------------------------
int __fastcall CopyFileContents(inta1, int a2, int a3, int a4)
{
v38 =C00000E5;
v4 =a3;
v5 =a2;
if (a3 )
{
if (a4 )
{
v29 =0;
v30 =0;
v31 =0;
v37 =0i64;
v38 =0;
if (!a2 )
{
Windows::Auto<Windows::Rtl::SystemImplementation::DirectFileSystemProvider*>::Allocate(&v38);
v5 =v38;
v4 =a3;
}
v8 =*(_DWORD*)v5;
v9 =v4;
// SysQueryInformationFile
v6 = (*(int(__thiscall **)(int, int, char *, char *,signed int, signed int))(v8+ 48))(
v5,
v9,
&v35,
&v32,
24,
5);
if (v6 >= 0)
{
v34 =v33;
v10 =*(_DWORD*)v5;
// SysSetInformationFile
v6 = (*(int(__thiscall **)(int, _DWORD, int, char *, __int64 *,signed int, signed int, _DWORD))(v10 + 52))(
v5,
0,
a4,
&v35,
(__int64*)&v34,
8,
20,
0);
if ( v6 >= 0 )
{
v27 =HIDWORD(v33);
HIDWORD(v11) = v33;
v12 =0x400000;
if ( v33 <=0x400000 )
v12 = v33;
v6 =RtlAllocateLBlob(v12, (int)&v29);
if ( v6 >=0 )
{
LODWORD(v11) = v27;
if ( !__PAIR__(HIDWORD(v11), v27) )
{
LABEL_22:
Windows::Auto<Windows::Rtl::SystemImplementation::DirectFileSystemProvider*>::~Auto<Windows::Rtl::SystemImplementation::DirectFileSystemProvider*>(&v38);
Windows::Rtl::AutoBlob<Windows::Auto<_LBLOB>>::Close((int)&v29);
return 0;
}
HIDWORD(v13) = 0;
while ( 1 )
{
LODWORD(v13) = (unsignedint)v11 >HIDWORD(v13)
|| (unsignedint)v11 >=HIDWORD(v13)&& HIDWORD(v11) >= v30 ?v30 : HIDWORD(v11);
v14 = *(_DWORD *)v5;
v15 = HIDWORD(v13);
v16 = HIDWORD(v13);
v17 = v13;
v18 = v31;
v19 = HIDWORD(v13);
v20 =HIDWORD(v13);
v21 = HIDWORD(v13);
v22 = HIDWORD(v13);
// SysReadFile
v6 = (*(int(__thiscall **)(int, int, int, int, int,int, char *, constchar *, int, __int64*, int, int))(v14 + 40))(
v5,
v22,
a3,
v21,
v20,
v19,
&v35,
v18,
v17,
&v37,
v16,
v15);
if ( v6 <0 )
break;
v23 = *(_DWORD *)v5;
v24 = v36;
v25 = v31;
// SysWriteFile
v6 = (*(int(__thiscall **)(int, _DWORD, int, _DWORD, _DWORD,_DWORD, char *, const char*, unsigned int, __int64*, _DWORD, _DWORD))(v23 + 44))(
v5,
0,
a4,
0,
0,
0,
&v35,
v25,
v24,
&v37,
0,
0);
if ( v6 <0 )
break;
LODWORD(v11) = (__PAIR__(v27, HIDWORD(v11)) - v36) >>32;
HIDWORD(v11) -= v36;
v13 = HIDWORD(v11);
v27 = v11;
v37 += v36;
if ( !v11 )
goto LABEL_22;
}
}
}
}
Windows::Auto<Windows::Rtl::SystemImplementation::DirectFileSystemProvider*>::~Auto<Windows::Rtl::SystemImplementation::DirectFileSystemProvider*>(&v38);
Windows::Rtl::AutoBlob<Windows::Auto<_LBLOB>>::Close((int)&v29);
}
else
{
Windows::ErrorHandling::Rtl::CBaseFrame<Windows::ErrorHandling::Rtl::CVoidRaiseFrame>::SetInvalidParameter_NullPointer(&v38);
v28 ="base\\wcp\\sil\\merged\\ntu\\ntsystem.cpp";
v29 =(int)"Windows::Rtl::SystemImplementation::CopyFileContents";
v30 =4806;
v31 ="Not-null check failed: Target";
Windows::ErrorHandling::Rtl::CBaseFrame<Windows::ErrorHandling::Rtl::CVoidRaiseFrame>::ReportErrorOrigination(
v7,
(int)&v28);
v6 =v38;
}
}
else
{
v6 =0;
}
return v6;
}