PopWriteImageHeader

VOID __stdcall PopWriteImageHeader(
        _POP_HIBER_CONTEXT *HiberContext,
        PO_MEMORY_IMAGE *MemImage,
        UINT64 PoWakeCheck,
        UINT64 StartCount){
  unsigned __int64 BugCheckParameter4; 
  __int64 WakeCheck; 
  unsigned __int64 v8; 
  UINT64 PerformanceCounter; 
  unsigned int v10; 
  __int64 v11; 
  __int64 v12; 
  __int64 v13; 
  _PO_HIBER_PERF *p_PerfInfo; 
  _OWORD *v15; 
  __int128 v16; 
  unsigned int v17; 
  void(*FinishRoutine)(void); 

  BugCheckParameter4 = (unsigned int)PoWakeCheck;
  WakeCheck = MemImage->WakeCheck;
  if( (_DWORD)WakeCheck != (_DWORD)PoWakeCheck )
  {
    DbgPrint("MemImage->WakeCheck %lx doesn't make PoWakeCheck %lx\n", WakeCheck, (unsigned int)PoWakeCheck);
    KeBugCheckEx(0xA0u, (PVOID)0x109, (PVOID)0xA, (PVOID)MemImage->WakeCheck, (PVOID)BugCheckParameter4);
  }
  v8 = __rdtsc();
  *(&stru_140C23628 + 53) = (((unsigned __int64)HIDWORD(v8) << 32) | (unsigned int)v8) - StartCount;
  *(&stru_140C23628 + 219) = (dword_140C23460 >> 4) - 1;
  PerformanceCounter = KeQueryPerformanceCounter(0i64);
  v10 = 0;
  for( *(&stru_140C23628 + 59) = PerformanceCounter;
        v10 < HiberContext->ProcessorCount;
        *(&stru_140C23628 + 55) += *(unsigned __int64 *)((char *)&HiberContext->ProcessorContext->SharedBufferTicks + v11) )
  {
    v11 = v10++;
    v11 <<= 7;
    *(&stru_140C23628 + 103) += *(unsigned __int64 *)((char *)&HiberContext->ProcessorContext->PagesProcessed + v11);
    *(&stru_140C23628 + 54) += *(unsigned __int64 *)((char *)&HiberContext->ProcessorContext->CompressTicks + v11);
  }
  *(&stru_140C23628 + 105) = *(&stru_140C23628 + 108);
  *(&stru_140C23628 + 107) = *(&stru_140C23628 + 218);
  *(&stru_140C23628 + 108) += *(&stru_140C23628 + 104);
  v12 = *(&stru_140C23628 + 102);
  *(&stru_140C23628 + 218) += *(&stru_140C23628 + 212);
  MemImage->NumPagesForLoader = *(&stru_140C23628 + 102);
  if( byte_140C23481 )
    MemImage->NumPagesForLoader = *(&stru_140C23628 + 103) + v12;
  v13 = 3i64;
  p_PerfInfo = &MemImage->PerfInfo;
  v15 = (_OWORD *)((char *)&stru_140C23628 + 400);
  do
  {
    *(_OWORD *)&p_PerfInfo->HiberIoTicks = *v15;
    *(_OWORD *)&p_PerfInfo->HiberInitTicks = v15[1];
    *(_OWORD *)&p_PerfInfo->HiberCompressTicks = v15[2];
    *(_OWORD *)&p_PerfInfo->HiberChecksumTicks = v15[3];
    *(_OWORD *)&p_PerfInfo->TotalHibernateTime.anonymous_0.LowPart = v15[4];
    *(_OWORD *)&p_PerfInfo->POSTTime = v15[5];
    *(_OWORD *)&p_PerfInfo->ResumeAppTicks = v15[6];
    p_PerfInfo = (_PO_HIBER_PERF *)((char *)p_PerfInfo + 128);
    v16 = v15[7];
    v15 += 8;
    *(_OWORD *)&p_PerfInfo[-1].AdjustedTotalResumeTime = v16;
    --v13;
  }
  while( v13 );
  *(_OWORD *)&p_PerfInfo->HiberIoTicks = *v15;
  *(_OWORD *)&p_PerfInfo->HiberInitTicks = v15[1];
  *(_OWORD *)&p_PerfInfo->HiberCompressTicks = v15[2];
  *(_OWORD *)&p_PerfInfo->HiberChecksumTicks = v15[3];
  *(_OWORD *)&p_PerfInfo->TotalHibernateTime.anonymous_0.LowPart = v15[4];
  *(_OWORD *)&p_PerfInfo->POSTTime = v15[5];
  *(_OWORD *)&p_PerfInfo->ResumeAppTicks = v15[6];
  p_PerfInfo->ResumeLibraryInitTicks = *((_QWORD *)v15 + 14);
  MemImage->Signature = 1380075848;
  tcpxsum(0i64);
  MemImage->CheckSum = v17;
  PopWriteHiberPages(HiberContext, MemImage, 1ui64, 0i64);
  FinishRoutine = HiberContext->DumpStack->Init.FinishRoutine;
  if( FinishRoutine )
    FinishRoutine();
}

Referenced by: