PopValidateHiberFileSize

NTSTATUS __stdcall PopValidateHiberFileSize(
        UINT64 HiberFileSize,
        UINT64 *MaxHiberFileSize,
        INT64 a3,
        INT64 a4,
        INT64 a5,
        INT64 a6,
        INT64 a7,
        INT64 a8){
  __int64 v11; 
  int VolumeInformationFile; 
  __int64 v13; 
  __int64 v14; 
  UINT64 v15; 
  UINT64 FileInformationClass; 
  UINT64 FileInformationClassa; 
  UINT64 OpenOptions; 
  VOID *FileHandle; 
  _IO_STATUS_BLOCK IoStatusBlock; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int128 FsInformation; 
  __int128 v24; 
  __int128 FileInformation; 
  __int64 v26; 

  *(&ObjectAttributes.Length + 1) = 0;
  v26 = 0i64;
  *(&ObjectAttributes.Attributes + 1) = 0;
  FileHandle = 0i64;
  FsInformation = 0i64;
  v11 = 0i64;
  v24 = 0i64;
  FileInformation = 0i64;
  IoStatusBlock = 0i64;
  if( FileObject )
  {
    VolumeInformationFile = ZwQueryInformationFile(
                              *(VOID **)&PopHiberInfo,
                              &IoStatusBlock,
                              &FileInformation,
                              0x18ui64,
                              FileStandardInformation);
    if( VolumeInformationFile < 0 )
    {
LABEL_15:
      v15 = 0i64;
      goto LABEL_10;
    }
    v13 = FileInformation;
  }
  else
  {
    v13 = 0i64;
  }
  LODWORD(OpenOptions) = 32;
  ObjectAttributes.ObjectName = &PoHiberFileRoot;
  ObjectAttributes.Length = 48;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 576;
  LODWORD(FileInformationClass) = 3;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  VolumeInformationFile = ZwOpenFile(
                            &FileHandle,
                            0xC0000000ui64,
                            &ObjectAttributes,
                            &IoStatusBlock,
                            FileInformationClass,
                            OpenOptions);
  if( VolumeInformationFile < 0 )
    goto LABEL_15;
  LODWORD(FileInformationClassa) = 7;
  VolumeInformationFile = ZwQueryVolumeInformationFile(
                            (UINT64)FileHandle,
                            (UINT64)&IoStatusBlock,
                            (UINT64)&FsInformation,
                            0x20ui64,
                            FileInformationClassa);
  ZwClose((_HANDLE)FileHandle);
  if( VolumeInformationFile < 0 )
    goto LABEL_15;
  VolumeInformationFile = -1073741823;
  v11 = v24 * (unsigned int)(HIDWORD(v24) * DWORD2(v24));
  v14 = v11 - 0x10000000;
  if( v11 - 0x10000000 <= 0 )
    v14 = 0i64;
  v15 = v13 + v14;
  if( v11 - 0x10000000 >= (__int64)(HiberFileSize - v13) )
    VolumeInformationFile = 0;
LABEL_10:
  if( MaxHiberFileSize )
    *MaxHiberFileSize = v15;
  if( a3 )
    *(_QWORD *)a3 = v11;
  return VolumeInformationFile;
}

Referenced by: