PopBcdSetDefaultResumeObjectElements

NTSTATUS __stdcall PopBcdSetDefaultResumeObjectElements(
        VOID *ResumeObjectHandle,
        VOID *LoaderObjectHandle,
        _UNICODE_STRING *HiberfileDeviceName,
        const WCHAR *HiberfilePath){
  _BYTE *v6; 
  VOID **PoolWithTag; 
  int Element; 
  VOID *v9; 
  VOID *v10; 
  VOID *v11; 
  NTSTATUS v12; 
  WORD *v13; 
  const wchar_t *v14; 
  __int64 v15; 
  __int64 v16; 
  __int64 v17; 
  __int64 v18; 
  VOID *v19; 
  VOID *v20; 
  VOID *v21; 
  int v22; 
  VOID *v23; 
  char v24; 
  UINT64 *DataSizea; 
  UINT64 *DataSizeaa; 
  UINT64 *DataSizeab; 
  __int16 v29[2]; 
  UINT64 v30; 
  char BufferSizeOut[12]; 
  VOID *BufferOut; 
  NTSTATUS ElementDataWithFlags; 
  NTSTATUS v34; 
  NTSTATUS v35; 
  __int64 DataSize[2]; 
  _UNICODE_STRING *v37; 
  const WCHAR *v38; 

  v38 = HiberfilePath;
  v37 = HiberfileDeviceName;
  LOWORD(v38) = 0;
  LOWORD(v37) = 0;
  DataSize[0] = 0i64;
  v29[0] = 0;
  BufferOut = 0i64;
  memset(BufferSizeOut, 0, sizeof(BufferSizeOut));
  v6 = 0i64;
  PoolWithTag = 0i64;
  HIDWORD(v30) = 0;
  Element = PopBcdReadElement(LoaderObjectHandle, 0x11000001ui64, &BufferOut, (UINT64 *)BufferSizeOut);
  if( Element >= 0 )
  {
    Element = PopBcdReadElement(
                LoaderObjectHandle,
                0x12000002ui64,
                (VOID **)&BufferSizeOut[4],
                (UINT64 *)((char *)&v30 + 4));
    if( Element < 0 )
    {
      v6 = *(_BYTE **)&BufferSizeOut[4];
    }
    else
    {
      HIDWORD(v30) = 8;
      ElementDataWithFlags = BcdGetElementDataWithFlags(
                               LoaderObjectHandle,
                               0x15000052ui64,
                               v9,
                               DataSize,
                               (UINT64 *)((char *)&v30 + 4));
      LODWORD(v30) = 2;
      v34 = BcdGetElementDataWithFlags(LoaderObjectHandle, 0x16000054ui64, v10, &v37, &v30);
      LODWORD(v30) = 2;
      v12 = BcdGetElementDataWithFlags(LoaderObjectHandle, 0x16000046ui64, v11, v29, &v30);
      v6 = *(_BYTE **)&BufferSizeOut[4];
      v35 = v12;
      v13 = wcsrchr(*(WORD **)&BufferSizeOut[4], 92);
      if( v13 )
      {
        v14 = L"winresume.efi";
        if( *(&ExBootDevicesRemovedEvent + 276) != 2 )
          v14 = L"winresume.exe";
        v15 = -1i64;
        v16 = ((char *)v13 - v6 + 2) >> 1;
        v17 = -1i64;
        do
          ++v17;
        while( v14[v17] );
        *(_DWORD *)&BufferSizeOut[4] = 2 * (v16 + v17) + 2;
        PoolWithTag = ExAllocatePoolWithTag(1ui64, *(unsigned int *)&BufferSizeOut[4], 1684226640i64);
        if( PoolWithTag )
        {
          v18 = 2i64 * (unsigned int)v16;
          memmove(PoolWithTag, v6, v18);
          do
            ++v15;
          while( v14[v15] );
          memmove((char *)PoolWithTag + v18, v14, 2 * v15 + 2);
          LODWORD(DataSizea) = *(_DWORD *)BufferSizeOut;
          Element = BcdSetElementDataWithFlags(ResumeObjectHandle, 0x11000001ui64, v19, BufferOut, (UINT64)DataSizea);
          if( Element >= 0 )
          {
            LODWORD(DataSizeaa) = *(_DWORD *)&BufferSizeOut[4];
            Element = BcdSetElementDataWithFlags(
                        ResumeObjectHandle,
                        0x12000002ui64,
                        v20,
                        PoolWithTag,
                        (UINT64)DataSizeaa);
            if( Element >= 0 )
            {
              if( ElementDataWithFlags >= 0 )
              {
                LODWORD(DataSizeab) = HIDWORD(v30);
                BcdSetElementDataWithFlags(ResumeObjectHandle, 0x15000052ui64, v21, DataSize, (UINT64)DataSizeab);
              }
              v22 = v30;
              if( v34 >= 0 )
              {
                LODWORD(DataSizeab) = v30;
                BcdSetElementDataWithFlags(ResumeObjectHandle, 0x16000054ui64, v21, &v37, (UINT64)DataSizeab);
              }
              if( v35 >= 0 )
              {
                LODWORD(DataSizeab) = v22;
                BcdSetElementDataWithFlags(ResumeObjectHandle, 0x16000046ui64, v21, v29, (UINT64)DataSizeab);
              }
              Element = PopBcdSetupResumeObject(ResumeObjectHandle);
              if( Element >= 0 )
              {
                v24 = (char)v38;
                LODWORD(DataSizeab) = 2;
                if( (_BYTE)KdDebuggerEnabled )
                  v24 = 1;
                LOBYTE(v38) = v24;
                Element = BcdSetElementDataWithFlags(ResumeObjectHandle, 0x26000006ui64, v23, &v38, (UINT64)DataSizeab);
                if( Element >= 0 )
                  Element = 0;
              }
            }
          }
        }
        else
        {
          Element = -1073741670;
        }
      }
      else
      {
        Element = -1073741788;
      }
    }
  }
  if( BufferOut )
    ExFreePoolWithTag(BufferOut, 0);
  if( v6 )
    ExFreePoolWithTag(v6, 0);
  if( PoolWithTag )
    ExFreePoolWithTag(PoolWithTag, 0);
  return Element;
}

Referenced by: