PopResizeHiberFile
NTSTATUS __stdcall PopResizeHiberFile(
UINT64 NewTargetSize,
UINT64 *NewActualSize,
INT64 a3,
INT64 a4,
INT64 a5,
INT64 a6,
INT64 a7,
INT64 a8){
NTSTATUS v10;
_LARGE_INTEGER v11;
int Status;
INT64 v13;
INT64 FileInformationClass;
UINT64 FileInformationClassa;
UINT64 FileInformationClassb;
INT64 v18;
UINT64 MaxHiberFileSize;
_LARGE_INTEGER *Mcb;
_LARGE_INTEGER FileInformation;
INT8 v22[8];
_IO_STATUS_BLOCK IoStatusBlock;
UINT64 McbSize;
_LARGE_INTEGER FileSize;
MaxHiberFileSize = 0i64;
Mcb = 0i64;
LODWORD(McbSize) = 0;
IoStatusBlock = 0i64;
if( !FileObject )
goto LABEL_17;
if( qword_140C23450 == (PVOID)NewTargetSize )
{
LABEL_15:
Status = 0;
goto LABEL_16;
}
v10 = PopValidateHiberFileSize(
NewTargetSize,
&MaxHiberFileSize,
a3,
a4,
FileInformationClass,
v18,
MaxHiberFileSize,
(INT64)Mcb);
v11.QuadPart = MaxHiberFileSize;
if( v10 >= 0 )
v11.QuadPart = NewTargetSize;
FileSize = v11;
if( v11.QuadPart <= 0 )
{
LABEL_17:
Status = -1073741823;
goto LABEL_16;
}
FileInformation = v11;
LODWORD(FileInformationClassa) = 19;
Status = ZwSetInformationFile(
*(UINT64 *)&PopHiberInfo,
(UINT64)&IoStatusBlock,
(INT8 *)&FileInformation,
8ui64,
FileInformationClassa);
if( Status == 259 )
{
KeWaitForSingleObject((UINT64)FileObject + 152, 0, 0, 0, 0i64);
Status = IoStatusBlock.Status;
}
if( Status >= 0 )
{
*(_LARGE_INTEGER *)v22 = FileSize;
LODWORD(FileInformationClassb) = 20;
Status = ZwSetInformationFile(*(UINT64 *)&PopHiberInfo, (UINT64)&IoStatusBlock, v22, 8ui64, FileInformationClassb);
if( Status == 259 )
{
KeWaitForSingleObject((UINT64)FileObject + 152, 0, 0, 0, 0i64);
Status = IoStatusBlock.Status;
}
if( Status >= 0 )
{
Status = PopSanityCheckHiberFile(*(VOID **)&PopHiberInfo, (_FILE_OBJECT *)FileObject, &FileSize, &Mcb, &McbSize);
if( Status >= 0 )
{
Status = PopSetHiberFileMcb(Mcb, McbSize);
if( Status >= 0 )
{
qword_140C23450 = (PVOID)FileSize.QuadPart;
FsRtlIssueFileNotificationFsctl(
(_FILE_OBJECT *)FileObject,
v13,
(INT128 *)&FILE_TYPE_NOTIFICATION_GUID_HIBERNATION_FILE);
goto LABEL_15;
}
}
}
}
LABEL_16:
*NewActualSize = (UINT64)qword_140C23450;
return Status;
}Referenced by:
No references.