KeSaveStateForHibernate

NTSTATUS __fastcall KeSaveStateForHibernate(INT64 a1, INT64 a2, INT64 a3, INT64 a4){
  NTSTATUS result; 
  void *retaddr; 
  char v7; 

  RtlCaptureContext((PCONTEXT)(a1 + 240));
  *(_WORD *)(a1 + 304) = 43;
  *(_WORD *)(a1 + 302) = 83;
  *(_QWORD *)(a1 + 224) = __readmsr(0xC0000100);
  *(_QWORD *)(a1 + 168) = __readmsr(0xC0000101);
  *(_QWORD *)(a1 + 176) = __readmsr(0xC0000102);
  *(_QWORD *)(a1 + 184) = __readmsr(0xC0000081);
  *(_QWORD *)(a1 + 192) = __readmsr(0xC0000082);
  *(_QWORD *)(a1 + 200) = __readmsr(0xC0000083);
  *(_QWORD *)(a1 + 208) = __readmsr(0xC0000084);
  *(_QWORD *)(a1 + 488) = retaddr;
  *(_QWORD *)(a1 + 392) = &v7;
  KiSaveProcessorControlState((_KPROCESSOR_STATE *)a1);
  *(_QWORD *)(a1 + 16) &= 0xFFFFFFFFFFFFFFFCui64;
  *(_QWORD *)(a1 + 24) &= ~0x800000ui64;
  _fxsave((void *)(a1 + 496));
  return result;
}

Referenced by: