PopBcdEstablishResumeObject

NTSTATUS __stdcall PopBcdEstablishResumeObject(VOID *StoreHandle, VOID **ResumeObjectHandleOut){
  VOID *v3; 
  int ElementDataWithFlags; 
  VOID *v6; 
  NTSTATUS v7; 
  VOID *v8; 
  _UNICODE_STRING *v9; 
  const WCHAR *v10; 
  NTSTATUS v12; 
  __int16 v13[2]; 
  char DataSizea[12]; 
  VOID *ObjectHandle; 
  _BCD_OBJECT_DESCRIPTION Description; 
  _GUID DataSize; 

  v13[0] = 0;
  Description = 0i64;
  v3 = 0i64;
  *(_QWORD *)&DataSizea[4] = 0i64;
  ObjectHandle = 0i64;
  DataSize = 0i64;
  ElementDataWithFlags = BcdOpenObject(StoreHandle, &GUID_CURRENT_BOOT_ENTRY, (VOID **)&DataSizea[4]);
  if( ElementDataWithFlags < 0 )
    goto LABEL_10;
  *(_DWORD *)DataSizea = 16;
  ElementDataWithFlags = BcdGetElementDataWithFlags(
                           *(VOID **)&DataSizea[4],
                           0x23000003ui64,
                           v6,
                           &DataSize,
                           (UINT64 *)DataSizea);
  if( ElementDataWithFlags >= 0 )
  {
    v7 = BcdOpenObject(StoreHandle, &DataSize, &ObjectHandle);
    v3 = ObjectHandle;
    ElementDataWithFlags = v7;
    if( v7 >= 0 )
    {
      ElementDataWithFlags = BcdQueryObject(ObjectHandle, 1ui64, &Description, 0i64);
      if( ElementDataWithFlags >= 0 )
      {
        if( (Description.Type & 0xF0000000) == 0x10000000
          && (Description.Type & 0xF00000) == 0x200000
          && (Description.Type & 0xFFFFF) == 4 )
        {
          *(_DWORD *)DataSizea = 2;
          ElementDataWithFlags = BcdGetElementDataWithFlags(v3, 0x26000003ui64, v8, v13, (UINT64 *)DataSizea);
          if( ElementDataWithFlags < 0 || !LOBYTE(v13[0]) )
            ElementDataWithFlags = PopBcdSetDefaultResumeObjectElements(v3, *(VOID **)&DataSizea[4], v9, v10);
          goto LABEL_10;
        }
        ElementDataWithFlags = -1073741275;
      }
    }
    if( v3 )
    {
      BcdCloseObject(v3);
      v3 = 0i64;
      ObjectHandle = 0i64;
    }
  }
  if( !InitIsWinPEMode )
  {
    v12 = PopBcdRegenerateResumeObject(StoreHandle, *(VOID **)&DataSizea[4], &ObjectHandle);
    v3 = ObjectHandle;
    ElementDataWithFlags = v12;
  }
  if( ElementDataWithFlags >= 0 )
    ElementDataWithFlags = 0;
  else
    v3 = 0i64;
LABEL_10:
  if( *(_QWORD *)&DataSizea[4] )
    BcdCloseObject(*(VOID **)&DataSizea[4]);
  if( ElementDataWithFlags < 0 )
  {
    if( !v3 )
      return ElementDataWithFlags;
    goto LABEL_16;
  }
  if( !ResumeObjectHandleOut )
  {
LABEL_16:
    BcdCloseObject(v3);
    return ElementDataWithFlags;
  }
  *ResumeObjectHandleOut = v3;
  return ElementDataWithFlags;
}

Referenced by:

PopAllocateHiberContext