MmMarkHiberPhase

VOID __stdcall MmMarkHiberPhase(){
  __int64 v0; 
  UINT64 v1; 
  void *ShadowMapping; 
  UINT64 v3; 
  _MMPTE *v4; 
  VOID *v5; 
  UINT64 v6; 
  __int64 v7; 
  __int64 v8; 
  _MMPTE *v9; 
  _QWORD **v10; 
  _QWORD *v11; 
  _QWORD *i; 
  _QWORD **v13; 
  VOID *v14; 
  _QWORD *v15; 
  _QWORD *v16; 
  UINT64 Tag; 
  UINT64 Tagc; 
  UINT64 Taga; 
  UINT64 Tagd; 
  UINT64 Tage; 
  UINT64 Tagb; 
  _MM_KERNEL_DUMP_CONTEXT Context[2]; 
  __int64 v24; 
  __int128 v25; 
  __int128 v26; 

  v25 = 0i64;
  v26 = 0i64;
  MiMarkKernelPageTablePages();
  v24 = 0i64;
  *(_QWORD *)Context = MiGatherHiberRange;
  v0 = 2i64;
  MiGatherHiberRange(Context, (VOID *)(PsInitialSystemProcess->Pcb.DirectoryTableBase >> 12), 1ui64, 2ui64);
  MiMarkNonPagedHiberPhasePages(
    MmGetPfnDb(),
    (_MMPTE *)((char *)&MmGetPfnDb()[*(&stru_140C50B28 + 852)].u4.EntireField + 7),
    (_MMPTE *)0x200,
    v1);
  LODWORD(Tag) = 1634168141;
  PoSetHiberRange(0i64, 0x14000ui64, *(&stru_140C4DB30 + 507), 1ui64, Tag);
  LODWORD(Tagc) = 1651535181;
  PoSetHiberRange(0i64, 0x10000ui64, KeGetCurrentThread()->ApcState.Process, 0xA40ui64, Tagc);
  ShadowMapping = KeGetCurrentThread()->ApcState.Process->Vm.Shared.ShadowMapping;
  if( ShadowMapping )
  {
    LODWORD(Taga) = 1651535181;
    PoSetHiberRange(0i64, 0x10000ui64, ShadowMapping, 0x1000ui64, Taga);
  }
  if( MiIsRetpolineEnabled() )
  {
    LODWORD(Taga) = 1651535181;
    PoSetHiberRange(
      0i64,
      0x10000ui64,
      BitMap.Buffer,
      8 * ((BitMap.SizeOfBitMap >> 6) + ((BitMap.SizeOfBitMap & 0x3F) != 0)),
      Taga);
    LODWORD(Tagd) = 1651535181;
    PoSetHiberRange(0i64, 0x10000ui64, (VOID *)qword_140C4C9A8, (unsigned int)(dword_140C4C9C8 << 12), Tagd);
  }
  MiMarkNonPagedHiberPhasePages(
    *(&stru_140C4DB30 + 139),
    (_MMPTE *)(*(&stru_140C4DB30 + 139) + *(&stru_140C4DB30 + 140) - 1i64),
    0i64,
    v3);
  LODWORD(Taga) = 1685286221;
  PoSetHiberRange(0i64, 0x10000ui64, &KUSER_SHARED_DATA, 0x1000ui64, Taga);
  LODWORD(Tage) = 1685286221;
  PoSetHiberRange(0i64, 0x10000ui64, MmUnloadedDrivers, 0x7D0ui64, Tage);
  v7 = 0i64;
  v8 = 50i64;
  do
  {
    v9 = *(_MMPTE **)((char *)MmUnloadedDrivers + v7 + 8);
    if( v9 )
    {
      LODWORD(Tagb) = 1685286221;
      PoSetHiberRange(0i64, 0x10000ui64, v9, *(unsigned __int16 *)((char *)MmUnloadedDrivers + v7), Tagb);
    }
    v7 += 40i64;
    --v8;
  }
  while( v8 );
  v10 = (_QWORD **)((char *)&stru_140C4DB30 + 3680);
  do
  {
    v11 = *v10;
    i = 0i64;
    while( v11 )
    {
      i = v11;
      v11 = (_QWORD *)*v11;
    }
    while( i )
    {
      v13 = (_QWORD **)i[1];
      v14 = i;
      v15 = i;
      if( v13 )
      {
        v16 = *v13;
        for( i = (_QWORD *)i[1]; v16; v16 = (_QWORD *)*v16 )
          i = v16;
      }
      else
      {
        while( 1 )
        {
          i = (_QWORD *)(i[2] & 0xFFFFFFFFFFFFFFFCui64);
          if( !i || (_QWORD *)*i == v15 )
            break;
          v15 = i;
        }
      }
      LODWORD(Tagb) = 1867083085;
      PoSetHiberRange(0i64, 0x10000ui64, v14, 0x440ui64, Tagb);
    }
    ++v10;
    --v0;
  }
  while( v0 );
  MiMarkHiberNotCachedPages(v5, v4, v9, v6);
}

Referenced by: