PopBcdSetupResumeObject

NTSTATUS __stdcall PopBcdSetupResumeObject(VOID *ResumeObjectHandle){
  size_t v2; 
  VOID **PoolWithTag; 
  _DWORD *v4; 
  VOID *v5; 
  int v6; 
  VOID *v7; 
  UINT64 DataSize; 
  UINT64 DataSizea; 
  _UNICODE_STRING DestinationString; 

  v2 = PoHiberFileRoot.Length + 22;
  DestinationString = 0i64;
  PoolWithTag = ExAllocatePoolWithTag(1ui64, v2, 1684226640i64);
  v4 = PoolWithTag;
  if( !PoolWithTag )
    return -1073741670;
  memset(PoolWithTag, 0i64, v2);
  *v4 = 2;
  memmove(v4 + 5, PoHiberFileRoot.Buffer, PoHiberFileRoot.Length);
  LODWORD(DataSize) = v2;
  v6 = BcdSetElementDataWithFlags(ResumeObjectHandle, 0x21000001ui64, v5, v4, DataSize);
  if( v6 >= 0 )
  {
    RtlInitUnicodeString(&DestinationString, L"\\hiberfil.sys");
    LODWORD(DataSizea) = DestinationString.Length + 2;
    v6 = BcdSetElementDataWithFlags(ResumeObjectHandle, 0x22000002ui64, v7, DestinationString.Buffer, DataSizea);
  }
  ExFreePoolWithTag(v4, 0);
  return v6;
}

Referenced by: