PopBcdRegenerateResumeObject
INT64 __stdcall PopBcdRegenerateResumeObject(PVOID StoreHandle, PVOID LoaderObjectHandle, PVOID *ResumeObjectHandleOut){
PVOID v3;
int Object;
void *v7;
UINT64 v8;
int v9;
_UNICODE_STRING *v10;
const WCHAR *v11;
UINT64 v12;
UINT64 v13;
UINT64 DataSize;
UINT64 DataSizea;
UINT64 DataSizeb;
__int128 BufferSizeOut;
VOID *ObjectHandle;
PVOID BufferOut;
int v21[2];
GUID Data;
GUID v23;
LODWORD(BufferSizeOut) = 0;
v3 = 0i64;
memset((char *)&BufferSizeOut + 4, 0, 12);
ObjectHandle = 0i64;
BufferOut = 0i64;
v21[0] = 1;
v21[1] = 270532612;
v23 = 0i64;
Data = 0i64;
Object = BcdCreateObject((__int64)StoreHandle, 0i64, v21, (__int64 *)&ObjectHandle);
if( Object < 0 )
{
v7 = ObjectHandle;
}
else
{
Object = PopBcdReadElement(
LoaderObjectHandle,
0x12000004ui64,
(PVOID *)&BufferSizeOut + 1,
(UINT64 *)&BufferSizeOut);
if( Object < 0 )
{
v7 = ObjectHandle;
}
else
{
PopBcdReadElement(LoaderObjectHandle, 0x12000005ui64, &BufferOut, (UINT64 *)((char *)&BufferSizeOut + 4));
v7 = ObjectHandle;
LODWORD(DataSize) = BufferSizeOut;
v9 = BcdSetElementDataWithFlags(ObjectHandle, 0x12000004ui64, v8, *((VOID **)&BufferSizeOut + 1), DataSize);
v3 = BufferOut;
Object = v9;
if( v9 >= 0 )
{
if( !BufferOut
|| (LODWORD(DataSizea) = DWORD1(BufferSizeOut),
Object = BcdSetElementDataWithFlags(v7, 0x12000005ui64, (UINT64)v10, BufferOut, DataSizea),
Object >= 0) )
{
Object = PopBcdSetDefaultResumeObjectElements(v7, LoaderObjectHandle, v10, v11);
if( Object >= 0 )
{
LODWORD(DataSizea) = 16;
Data = GUID_RESUME_LOADER_SETTINGS_GROUP;
Object = BcdSetElementDataWithFlags(v7, 0x14000006ui64, v12, &Data, DataSizea);
if( Object >= 0 )
{
Object = BcdQueryObject(v7, 0i64, 0i64, &v23);
if( Object >= 0 )
{
LODWORD(DataSizeb) = 16;
Object = BcdSetElementDataWithFlags(LoaderObjectHandle, 0x23000003ui64, v13, &v23, DataSizeb);
if( Object >= 0 )
{
*ResumeObjectHandleOut = v7;
v7 = 0i64;
}
}
}
}
}
}
}
if( *((_QWORD *)&BufferSizeOut + 1) )
ExFreePoolWithTag(*((PVOID *)&BufferSizeOut + 1), 0);
if( v3 )
ExFreePoolWithTag(v3, 0);
}
if( v7 )
{
if( Object < 0 )
BcdDeleteObject(v7);
else
BcdCloseObject(v7);
}
return(unsigned int)Object;
}Referenced by:
PopBcdEstablishResumeObject