PopWriteHeaderPages

NTSTATUS __stdcall PopWriteHeaderPages(POP_HIBER_CONTEXT *HiberContext, PO_MEMORY_IMAGE *MemImage){
  POP_HIBER_CONTEXT v2; 
  VOID *v4; 
  __int64 v6; 
  unsigned int v7; 
  unsigned int v8; 
  int *v9; 
  _DWORD *v10; 
  __int64 v11; 
  int v12; 
  unsigned int v13; 
  size_t v14; 
  unsigned int v15; 
  unsigned int v16; 
  unsigned int v17; 
  __int64 ResumeContextCheck; 
  unsigned __int64 v19; 
  size_t v20; 
  unsigned int v21; 
  unsigned int v22; 
  __int64 WakeCheck; 
  unsigned __int64 v24; 
  unsigned int v25; 
  __int64 v26; 
  unsigned __int64 v27; 

  v2 = HiberContext[38];
  v4 = (VOID *)*((_QWORD *)HiberContext + 18);
  HiberContext[46] = 0;
  memset(v4, 0i64, v2 << 12);
  v6 = *((_QWORD *)HiberContext + 15);
  if( !v6 )
    return -1073741801;
  v7 = *(&stru_140C23628 + 702);
  v8 = *(_DWORD *)(v6 + 40) >> 12;
  MemImage->NoFreePages = v8;
  if( v8 < v7 )
    return -1073741801;
  v9 = (int *)(*((_QWORD *)HiberContext + 15) + 48i64);
  if( v7 )
  {
    v10 = v4;
    v11 = v7;
    do
    {
      v12 = *v9;
      v9 += 2;
      *v10++ = v12;
      --v11;
    }
    while( v11 );
  }
  PopWriteHiberPages(
    (_POP_HIBER_CONTEXT *)HiberContext,
    v4,
    (4 * (unsigned __int64)*(&stru_140C23628 + 702) + 4095) >> 12,
    (unsigned int)(HiberContext[62] + 2));
  MemImage->NoFreePages = *(&stru_140C23628 + 702);
  tcpxsum(0i64);
  MemImage->FreeMapCheck = v13;
  MemImage->HiberResumeXhciHandoffSkip = *(&stru_140C23628 + 2820);
  if( *((_QWORD *)HiberContext + 30) )
  {
    v14 = HiberContext[38] << 12;
    HiberContext[46] = 1;
    memset(v4, 0i64, v14);
    memmove(v4, *((const VOID **)HiberContext + 30), HiberContext[62] << 12);
    tcpxsum(0i64);
    MemImage->ResumeContextCheck = v15;
    v16 = HiberContext[62];
    MemImage->ResumeContextPages = v16;
    PopWriteHiberPages((_POP_HIBER_CONTEXT *)HiberContext, v4, v16, 2ui64);
    tcpxsum(0i64);
    ResumeContextCheck = MemImage->ResumeContextCheck;
    v19 = v17;
    if( (_DWORD)ResumeContextCheck != v17 )
    {
      DbgPrint("Checksum for resume context page changed from %lx to %lx\n", ResumeContextCheck, v17);
      KeBugCheckEx(0xA0u, (PVOID)3, (PVOID)MemImage->ResumeContextCheck, (PVOID)v19, (PVOID)0x1CDB);
    }
  }
  v20 = HiberContext[38] << 12;
  HiberContext[46] = 2;
  memset(v4, 0i64, v20);
  memmove(v4, *((const VOID **)HiberContext + 22), 0x5C0u);
  tcpxsum(0i64);
  MemImage->WakeCheck = v21;
  PopWriteHiberPages((_POP_HIBER_CONTEXT *)HiberContext, v4, 1ui64, 1ui64);
  tcpxsum(0i64);
  WakeCheck = MemImage->WakeCheck;
  v24 = v22;
  if( (_DWORD)WakeCheck != v22 )
  {
    DbgPrint("Checksum for context page changed from %lx to %lx\n", WakeCheck, v22);
    KeBugCheckEx(0xA0u, (PVOID)3, (PVOID)MemImage->WakeCheck, (PVOID)v24, (PVOID)0x1CF1);
  }
  tcpxsum(0i64);
  v26 = MemImage->WakeCheck;
  v27 = v25;
  if( (_DWORD)v26 != v25 )
  {
    DbgPrint("Checksum for partial context page %lx doesn't match full %lx\n", v26, v25);
    KeBugCheckEx(0xA0u, (PVOID)4, (PVOID)MemImage->WakeCheck, (PVOID)v27, (PVOID)0x1CF8);
  }
  return 0;
}

Referenced by: