MiConvertHiberPhasePte

NTSTATUS __stdcall MiConvertHiberPhasePte(INT64 a1, INT64 *a2, INT64 a3){
  INT64 PteShadow; 
  int v4; 
  __int64 v7; 
  unsigned __int64 v9; 
  int v10; 
  __int64 v11; 
  int v12; 
  unsigned __int64 v13; 
  int v14; 
  UINT64 v15; 

  PteShadow = *a2;
  v4 = a3;
  if( a2 >= (INT64 *)MmGetPml4eBase() && a2 <= (INT64 *)MmGetPxeUserLimit() )
    PteShadow = MiReadPteShadow((__int64)a2, *a2);
  v7 = *(_QWORD *)(a1 + 168);
  v15 = PteShadow;
  if( v7 )
  {
    if( (PteShadow & 1) != 0 && !v4 )
    {
      v9 = PteShadow;
      LOBYTE(v10) = MiPteInShadowRange((UINT64)&v15);
      if( v10 )
        v9 = MiReadPteShadow((__int64)&v15, PteShadow);
      v11 = (v9 >> 12) & 0xFFFFFFFFFi64;
      MiIsPfn(v11);
      if( v12 )
      {
        if( v11 != *(&stru_140C4DB30 + 498)
          && v11 != *(&stru_140C4DB30 + 495)
          && !_bittest64(*(const signed __int64 **)(v7 + 8), (unsigned int)v11) )
        {
          v13 = PteShadow & 0xFFFFFFFFFFFFFBFAui64 | 0x404;
          v15 = v13;
          MiPteInShadowRange((UINT64)a2);
LABEL_22:
          *a2 = v13;
        }
      }
    }
  }
  else if( (PteShadow & 1) == 0 && (PteShadow & 0x400) != 0 && (PteShadow & 4) != 0 )
  {
    v13 = PteShadow & 0xFFFFFFFFFFFFFBFAui64 | 1;
    v15 = v13;
    LOBYTE(v14) = MiPteInShadowRange((UINT64)a2);
    if( v14 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 )
      v13 |= 0x8000000000000000ui64;
    goto LABEL_22;
  }
  return 0;
}

Referenced by: