PopBuildMemoryImageHeader

NTSTATUS __stdcall PopBuildMemoryImageHeader(VOID *HiberContext, UINT64 Phase){
  UINT64 v3; 
  unsigned __int64 v4; 
  __int64 v5; 
  __int64 v6; 
  __int64 v7; 
  __int64 v8; 
  unsigned __int64 v9; 
  __int64 v10; 
  _QWORD *v11; 
  _QWORD *v12; 
  unsigned __int64 v13; 
  VOID *Pages; 
  VOID *v15; 
  __int64 *v17; 
  __int64 v18; 
  _QWORD *v19; 
  __int64 v20; 
  unsigned __int64 v21; 
  VOID **v22; 
  UINT64 Tag; 
  UINT64 Taga; 

  if( !(_DWORD)Phase )
  {
    v3 = *((_QWORD *)HiberContext + 25);
    LODWORD(Tag) = 1735223629;
    PoSetHiberRange(HiberContext, 2ui64, (VOID *)v3, 0x3E0ui64, Tag);
    memset((VOID *)v3, 0i64, 0x1000u);
    *(_DWORD *)(v3 + 24) = 4096;
    *(_DWORD *)(v3 + 12) = 992;
    LODWORD(v4) = MmGetPhysicalAddress(v3);
    *(_QWORD *)(v3 + 16) = v4 >> 12;
    *(_QWORD *)(v3 + 32) = *(_QWORD *)&KUSER_SHARED_DATA.SystemTime.LowPart;
    *(_QWORD *)(v3 + 40) = *(_QWORD *)&KUSER_SHARED_DATA.InterruptTime.LowPart;
    *(_QWORD *)(v3 + 64) = qword_140C23470;
    *(_DWORD *)(v3 + 60) = 10;
    *(_QWORD *)(v3 + 48) = KeFeatureBits;
    *(_DWORD *)(v3 + 4) = (unsigned __int16)KeProcessorArchitecture;
    *(_BYTE *)(v3 + 56) = *((_BYTE *)HiberContext + 1);
    *(_BYTE *)(v3 + 57) = -54;
    *(_BYTE *)(v3 + 868) = byte_140C23480;
    LODWORD(v5) = MmGetHighestPhysicalPage(0i64);
    *(_QWORD *)(v3 + 920) = v5;
    *(_BYTE *)(v3 + 869) = *(&stru_140C23628 + 2812);
    *(_BYTE *)(v3 + 870) = *((_BYTE *)HiberContext + 453);
    v6 = *((_QWORD *)HiberContext + 15);
    if( v6 )
      *(_DWORD *)(v3 + 72) = *(_DWORD *)(v6 + 40) >> 12;
    v7 = *((_QWORD *)HiberContext + 39);
    if( v7 )
    {
      v17 = (__int64 *)(v3 + 928);
      v18 = 3i64;
      *(_QWORD *)(v3 + 928) = v7;
      v19 = (_QWORD *)(v3 + 936);
      do
      {
        v20 = *v17++;
        *v19++ = v20 + 1;
        --v18;
      }
      while( v18 );
    }
    *(_QWORD *)(v3 + 912) = 0i64;
    v8 = *((_QWORD *)HiberContext + 27);
    if( v8 )
    {
      v9 = (unsigned __int64)*(unsigned int *)(v8 + 40) >> 12;
      memmove((VOID *)(v3 + 664), (const VOID *)(v8 + 48), 8 * v9);
    }
    else
    {
      LODWORD(v9) = 0;
    }
    *(_DWORD *)(v3 + 660) = v9;
    v10 = *((_QWORD *)HiberContext + 28);
    if( v10 )
    {
      v21 = (*(_DWORD *)(v10 + 40) >> 12) + (unsigned int)((*(_DWORD *)(v10 + 40) & 0xFFF) != 0);
      if( v21 > 1 )
        v21 = 1i64;
      v22 = (VOID **)(v10 + 48);
      memmove((VOID *)(v3 + 648), v22, 8 * v21);
      for( *(_DWORD *)(v3 + 640) = v21; v21; --v21 )
      {
        LODWORD(Taga) = 1682794822;
        PoSetHiberRange(HiberContext, 0xC000ui64, *v22++, 1ui64, Taga);
      }
    }
    else
    {
      *(_DWORD *)(v3 + 640) = 0;
    }
    v11 = (_QWORD *)*((_QWORD *)HiberContext + 8);
    while( v11 != (_QWORD *)((char *)HiberContext + 64) )
    {
      v12 = v11;
      v11 = (_QWORD *)*v11;
      v13 = (unsigned __int64)(unsigned int)((*((_DWORD *)v12 + 8) - *((_DWORD *)v12 + 6)) << 12) >> 12;
      Pages = PopAllocatePages(v13);
      v15 = Pages;
      if( Pages )
      {
        LODWORD(Taga) = 1131179886;
        PoSetHiberRange(HiberContext, 0x8000ui64, Pages, v13 << 12, Taga);
      }
      else
      {
        *((_DWORD *)HiberContext + 47) = -1073741670;
      }
      v12[5] = v15;
      if( !v15 )
        return -1073741670;
    }
    *(_DWORD *)(v3 + 960) = *((_DWORD *)HiberContext + 112);
    *(_BYTE *)(v3 + 986) = PopHiberSkipMemoryMapValidation;
  }
  return *((_DWORD *)HiberContext + 47);
}

Referenced by: