PopPreallocateHibernateMemory
NTSTATUS __stdcall PopPreallocateHibernateMemory(){
__int64 v0;
unsigned __int64 v1;
unsigned int v2;
int v3;
unsigned __int64 v4;
unsigned int v5;
unsigned int v6;
__int64 v7;
__int64 v8;
__int64 v9;
unsigned int v10;
VOID **PoolWithTag;
INT64 v12;
VOID *v13;
VOID **v14;
NTSTATUS result;
__int64 v16;
__int64 v17;
__int64 v18;
__int64 v19;
__int64 v20;
__int64 v21;
if( *(&ExBootDevicesRemovedEvent + 276) == 2 )
v0 = 102400i64;
else
v0 = v16;
LODWORD(v1) = MmGetHighestPhysicalPage(0i64);
v4 = (v1 + 32) & 0xFFFFFFFFFFFFFFE0ui64;
if( v4 < v1 || v4 > 0xFFFFFFFF )
return -1073741670;
v18 = v2;
v5 = ((unsigned int)v4 >> 3) + v2;
v19 = v5;
v20 = (v5 + ((unsigned int)v4 >> 3) + 7) & 0xFFFFFFF8;
v6 = ((((v5 + ((unsigned int)v4 >> 3) + 7) & 0xFFFFFFF8) + 247) & 0xFFFFFFF8) + 176;
v21 = (((v5 + ((unsigned int)v4 >> 3) + 7) & 0xFFFFFFF8) + 247) & 0xFFFFFFF8;
if( v3 == 2 )
{
v7 = ((((v5 + ((unsigned int)v4 >> 3) + 7) & 0xFFFFFFF8) + 247) & 0xFFFFFFF8) + 176;
v6 = ((((v5 + ((unsigned int)v4 >> 3) + 7) & 0xFFFFFFF8) + 247) & 0xFFFFFFF8) + 232;
}
else
{
v7 = v17;
}
v8 = v6;
v9 = (v6 + 135) & 0xFFFFFFF8;
if( (HvlpFlags & 2) == 0 || (result = HvlpPreallocatePageListResources(), result >= 0) )
{
v10 = (((v9 + 4159) & 0xFFFFF000) + 0x3FFF) & 0xFFFFF000;
PoolWithTag = ExAllocatePoolWithTag(1ui64, v10, 1919052136i64);
v14 = PoolWithTag;
if( PoolWithTag )
{
if( MmObtainChargesToLockPagedPool(PoolWithTag, v10, v12, v13) )
{
qword_140C234A8 = (__int64)(v14 + 512);
Length = v10;
PagedPoolVa = v14;
qword_140C234A0 = (__int64)v14;
if( *(&ExBootDevicesRemovedEvent + 276) == 2 )
qword_140C234F8 = (__int64)v14 + v0;
else
qword_140C234F8 = 0i64;
LODWORD(xmmword_140C234C0) = v4;
*((_QWORD *)&xmmword_140C234C0 + 1) = (char *)v14 + v18;
LODWORD(xmmword_140C234B0) = v4;
*((_QWORD *)&xmmword_140C234B0 + 1) = (char *)v14 + v19;
qword_140C234D0 = (__int64)v14 + v20;
if( *(&ExBootDevicesRemovedEvent + 276) == 2 )
qword_140C23500 = (__int64)v14 + v7;
else
qword_140C23500 = 0i64;
SharedContext = (INT64)v14 + v9;
qword_140C234E0 = (char *)v14 + (((_DWORD)v9 + 4159) & 0xFFFFF000);
qword_140C234E8 = (char *)v14 + v8;
qword_140C234F0 = (__int64)v14 + v21;
return 0;
}
ExFreePoolWithTag(v14, 0x72626968u);
}
return -1073741670;
}
return result;
}Referenced by:
PopEnableHiberFile