KeMarkHiberPhase

VOID __stdcall KeMarkHiberPhase(_KPCR *Pcr){
  unsigned __int16 *FiberData; 
  char *StackBase; 
  __int64 *v3; 
  unsigned int i; 
  __int64 v5; 
  VOID *v6; 
  _QWORD **v7; 
  __int64 v8; 
  _QWORD *j; 
  unsigned int v10; 
  VOID *v11; 
  VOID *v12; 
  _QWORD *v13; 
  VOID *v14; 
  UINT64 v15; 
  _QWORD *k; 
  UINT64 Tag; 
  UINT64 Tage; 
  UINT64 Tagf; 
  UINT64 Tagg; 
  UINT64 Taga; 
  UINT64 Tagh; 
  UINT64 Tagi; 
  UINT64 Tagj; 
  UINT64 Tagb; 
  UINT64 Tagc; 
  UINT64 Tagk; 
  UINT64 Tagd; 

  FiberData = (unsigned __int16 *)Pcr->NtTib.FiberData;
  StackBase = (char *)Pcr->NtTib.StackBase;
  LODWORD(Tag) = 1668310347;
  if( *((_DWORD *)FiberData + 9) )
  {
    PoSetHiberRange(0i64, 0x10000ui64, Pcr, ((((_DWORD)KeNumberProcessors_0 << 6) + 51903) & 0xFFFFF000) + 28672, Tag);
  }
  else
  {
    PoSetHiberRange(0i64, 0x10000ui64, Pcr, 0xB080ui64, Tag);
    LODWORD(Tage) = 1668310347;
    PoSetHiberRange(0i64, 0x10000ui64, FiberData, 0xAF00ui64, Tage);
    LODWORD(Tagf) = 1668310347;
    PoSetHiberRange(0i64, 0x10000ui64, StackBase, 0x68ui64, Tagf);
    LODWORD(Tagg) = 1668310347;
    PoSetHiberRange(0i64, 0x10000ui64, &Size, 0i64, Tagg);
    v3 = (__int64 *)(StackBase + 36);
    for( i = 1; i <= 4; ++i )
    {
      v5 = *v3;
      if( i - 1 <= 3 )
      {
        if( KiKvaShadow )
        {
          LODWORD(Taga) = 1668310347;
          PoSetHiberRange(0i64, 0x10000ui64, (VOID *)(v5 - 464), 0x200ui64, Taga);
          v6 = (VOID *)(*(_QWORD *)(v5 + 8) - 24544i64);
        }
        else
        {
          v6 = (VOID *)(v5 - 24576);
        }
        LODWORD(Taga) = 1668310347;
        PoSetHiberRange(0i64, 0x10000ui64, v6, 0x6000ui64, Taga);
      }
      ++v3;
    }
  }
  LODWORD(Taga) = 1936745803;
  PoSetHiberRange(0i64, 0x10000ui64, *((VOID **)FiberData + 45), FiberData[179], Taga);
  LODWORD(Tagh) = 1936745803;
  PoSetHiberRange(0i64, 0x10000ui64, *((VOID **)FiberData + 43), FiberData[171], Tagh);
  LODWORD(Tagi) = 1953719627;
  PoSetHiberRange(
    0i64,
    0x10000ui64,
    (VOID *)(((*((_QWORD *)FiberData + 1570) + 4095i64) & 0xFFFFFFFFFFFFF000ui64) - (unsigned int)KeKernelStackSize),
    (unsigned int)KeKernelStackSize,
    Tagi);
  LODWORD(Tagj) = 1702061387;
  PoSetHiberRange(
    0i64,
    0x10000ui64,
    (VOID *)(((*((_QWORD *)FiberData + 4069) + 4095i64) & 0xFFFFFFFFFFFFF000ui64) - 24576),
    0x6000ui64,
    Tagj);
  v7 = (_QWORD **)(FiberData + 6240);
  v8 = 2i64;
  do
  {
    for( j = *v7; j; j = (_QWORD *)*j )
    {
      LODWORD(Tagb) = 1885627723;
      PoSetHiberRange(0i64, 0x10000ui64, j - 1, 0x40ui64, Tagb);
    }
    v7 += 5;
    --v8;
  }
  while( v8 );
  v10 = 1232;
  if( ((unsigned __int64)KeFeatureBits & 0x800000) != 0 )
    v10 = KeXStateLength + 807;
  LODWORD(Tagb) = 2020828491;
  PoSetHiberRange(0i64, 0x10000ui64, *((VOID **)FiberData + 4280), v10, Tagb);
  v11 = (VOID *)*((_QWORD *)FiberData + 216);
  if( v11 )
  {
    LODWORD(Tagc) = 1936942411;
    PoSetHiberRange(
      0i64,
      0x10000ui64,
      v11,
      KUSER_SHARED_DATA.XState.AllFeatureSize
    - (unsigned __int64)KUSER_SHARED_DATA.XState.Size
    + (unsigned int)KiIptSaveAreaLength
    + 64i64,
      Tagc);
  }
  v12 = (VOID *)*((_QWORD *)FiberData + 4096);
  if( v12 )
  {
    LODWORD(Tagc) = 1934189899;
    PoSetHiberRange(0i64, 0x10000ui64, v12, 0x428ui64, Tagc);
  }
  if( qword_140C2B138 )
  {
    LODWORD(Tagc) = 1920103501;
    PoSetHiberRange(0i64, 0x10000ui64, qword_140C2B138, 16 * (unsigned int)(unsigned __int8)qword_140C2B128, Tagc);
  }
  if( qword_140C2B140 )
  {
    LODWORD(Tagc) = 1920103501;
    PoSetHiberRange(0i64, 0x10000ui64, qword_140C2B140, 0x58ui64, Tagc);
  }
  v13 = (_QWORD *)*((_QWORD *)FiberData + 1);
  LODWORD(Tagc) = 1752458571;
  v14 = (VOID *)((v13[6] + 4095i64) & 0xFFFFFFFFFFFFF000ui64);
  v15 = v13[7] - (_QWORD)v14;
  PoSetHiberRange(0i64, 0x10000ui64, v13, 0x898ui64, Tagc);
  LODWORD(Tagk) = 1953719627;
  PoSetHiberRange(0i64, 0x10000ui64, v14, v15, Tagk);
  for( k = (_QWORD *)*(&KiSwapEvent + 46); k != (_QWORD *)((char *)&KiSwapEvent + 368); k = (_QWORD *)*k )
  {
    LODWORD(Tagd) = 1953719627;
    PoSetHiberRange(0i64, 0x10000ui64, k, 0x30ui64, Tagd);
  }
  LODWORD(Tagd) = 1886156869;
  PoSetHiberRange(0i64, 0x10000ui64, *(&ExBootDevicesRemovedEvent + 103), 0x1000ui64, Tagd);
}

Referenced by: