PopBuildMemoryImageHeader

INT64 __fastcall PopBuildMemoryImageHeader(_POP_HIBER_CONTEXT *HiberContext, UINT64 Phase){
  PO_MEMORY_IMAGE *MemoryImage; 
  _MDL *LoaderMdl; 
  unsigned __int64 BitlockerKeyPFN; 
  _MDL *BootLoaderLogMdl; 
  unsigned __int64 v7; 
  _MDL *FirmwareRuntimeInformationMdl; 
  _POP_HIBER_CONTEXT *Flink; 
  _POP_HIBER_CONTEXT *v10; 
  unsigned __int64 v11; 
  unsigned int *Pages; 
  unsigned int *v13; 
  unsigned __int64 *BitlockerKeyPfns; 
  __int64 v16; 
  unsigned __int64 *v17; 
  __int64 v18; 
  unsigned __int64 v19; 
  UINT8 *v20; 
  UINT64 Tag; 
  UINT64 Taga; 
  if( !(_DWORD)Phase )
  {
    MemoryImage = HiberContext->MemoryImage;
    LODWORD(Tag) = 1735223629;
    PoSetHiberRange(HiberContext, 2ui64, MemoryImage, 0x3E0ui64, Tag);
    memset((INT64)MemoryImage, 0i64);
    MemoryImage->PageSize = 4096;
    MemoryImage->LengthSelf = 992;
    MemoryImage->PageSelf = (unsigned __int64)MmGetPhysicalAddress(MemoryImage).QuadPart >> 12;
    MemoryImage->SystemTime.QuadPart = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart;
    MemoryImage->InterruptTime = *(_QWORD *)&KUSER_SHARED_DATA.InterruptTime.LowPart;
    MemoryImage->HiberVa = qword_140C23470;
    MemoryImage->NoHiberPtes = 10;
    MemoryImage->FeatureFlags = KeFeatureBits;
    MemoryImage->ImageType = (unsigned __int16)KeProcessorArchitecture;
    MemoryImage->HiberFlags = HiberContext->HiberFlags;
    MemoryImage->HiberSimulateFlags = -54;
    MemoryImage->Hiberboot = byte_140C23480;
    MemoryImage->HighestPhysicalPage = MmGetHighestPhysicalPage(0i64);
    MemoryImage->SecureLaunched = PopSecureLaunched;
    MemoryImage->SecureBoot = HiberContext->SecureBoot;
    LoaderMdl = HiberContext->LoaderMdl;
    if( LoaderMdl )
      MemoryImage->NoFreePages = LoaderMdl->ByteCount >> 12;
    BitlockerKeyPFN = HiberContext->BitlockerKeyPFN;
    if( BitlockerKeyPFN )
    {
      BitlockerKeyPfns = MemoryImage->BitlockerKeyPfns;
      v16 = 3i64;
      MemoryImage->BitlockerKeyPfns[0] = BitlockerKeyPFN;
      v17 = &MemoryImage->BitlockerKeyPfns[1];
      do
      {
        v18 = *BitlockerKeyPfns++;
        *v17++ = v18 + 1;
        --v16;
      }
      while( v16 );
    }
    MemoryImage->RestoreProcessorStateRoutine = 0i64;
    BootLoaderLogMdl = HiberContext->BootLoaderLogMdl;
    if( BootLoaderLogMdl )
    {
      v7 = (unsigned __int64)BootLoaderLogMdl->ByteCount >> 12;
      memmove((UINT8 *)MemoryImage->BootLoaderLogPages, (UINT8 *)&BootLoaderLogMdl[1], 8 * v7);
    }
    else
    {
      LODWORD(v7) = 0;
    }
    MemoryImage->NoBootLoaderLogPages = v7;
    FirmwareRuntimeInformationMdl = HiberContext->FirmwareRuntimeInformationMdl;
    if( FirmwareRuntimeInformationMdl )
    {
      v19 = (FirmwareRuntimeInformationMdl->ByteCount >> 12) + ((FirmwareRuntimeInformationMdl->ByteCount & 0xFFF) != 0);
      if( v19 > 1 )
        v19 = 1i64;
      v20 = (UINT8 *)&FirmwareRuntimeInformationMdl[1];
      memmove((UINT8 *)MemoryImage->FirmwareRuntimeInformation, v20, 8 * v19);
      for( MemoryImage->FirmwareRuntimeInformationPages = v19; v19; --v19 )
      {
        LODWORD(Taga) = 1682794822;
        PoSetHiberRange(HiberContext, 0xC000ui64, *(VOID **)v20, 1ui64, Taga);
        v20 += 8;
      }
    }
    else
    {
      MemoryImage->FirmwareRuntimeInformationPages = 0;
    }
    Flink = (_POP_HIBER_CONTEXT *)HiberContext->ClonedRanges.Flink;
    while( Flink != (_POP_HIBER_CONTEXT *)&HiberContext->ClonedRanges )
    {
      v10 = Flink;
      Flink = *(_POP_HIBER_CONTEXT **)&Flink->Reset;
      v11 = (unsigned __int64)((v10->DiscardMap.SizeOfBitMap - v10->HvCaptureCompletedBarrier) << 12) >> 12;
      Pages = (unsigned int *)PopAllocatePages(v11);
      v13 = Pages;
      if( Pages )
      {
        LODWORD(Taga) = 1131179886;
        PoSetHiberRange(HiberContext, 0x8000ui64, Pages, v11 << 12, Taga);
      }
      else
      {
        HiberContext->Status = -1073741670;
      }
      v10->DiscardMap.Buffer = v13;
      if( !v13 )
        return 3221225626i64;
    }
    MemoryImage->HardwareSignature = HiberContext->HardwareConfigurationSignature;
    MemoryImage->SkipMemoryMapValidation = PopHiberSkipMemoryMapValidation;
  }
  return(unsigned int)HiberContext->Status;
}

Referenced by: