PopSanityCheckHiberFile

INT64 __stdcall PopSanityCheckHiberFile(
        PVOID FileHandle,
        FILE_OBJECT *FileObject,
        LARGE_INTEGER *FileSize,
        LARGE_INTEGER **Mcb,
        UINT64 *McbSize){
  NTSTATUS Status; 
  LONGLONG v9; 
  __int64 v10; 
  LARGE_INTEGER v11; 
  LARGE_INTEGER *v13; 
  _IO_STATUS_BLOCK v14; 
  v13 = 0i64;
  v14 = 0i64;
  Status = ZwFsControlFile(FileHandle, 0i64, 0i64, 0i64, &v14, 0x9003Bu, FileSize, 8u, &v13, 8u);
  if( Status == 259 )
  {
    KeWaitForSingleObject(&FileObject->Event, Executive, 0, 0, 0i64);
    Status = v14.Status;
  }
  if( Status >= 0 )
  {
    v9 = 0i64;
    LODWORD(v10) = 0;
    if( v13->QuadPart )
    {
      v11 = *v13;
      do
      {
        v9 += v11.QuadPart;
        if( v13[(unsigned int)(v10 + 1)].HighPart < 0 )
          return(unsigned int)-1073741823;
        v10 = (unsigned int)(v10 + 2);
        v11 = v13[v10];
      }
      while( v11.QuadPart );
    }
    if( v9 < FileSize->QuadPart )
      return(unsigned int)-1073741823;
    *Mcb = v13;
    *(_DWORD *)McbSize = 8 * v10 + 16;
  }
  return(unsigned int)Status;
}

Referenced by: