MmMarkHiberPhase

VOID __stdcall MmMarkHiberPhase(){
  __int64 v0; 
  UINT64 v1; 
  VOID *v2; 
  UINT64 v3; 
  MMPTE *v4; 
  void *v5; 
  UINT64 v6; 
  __int64 v7; 
  __int64 v8; 
  MMPTE *v9; 
  _QWORD **v10; 
  _QWORD *v11; 
  _QWORD *i; 
  _QWORD **v13; 
  VOID *v14; 
  _QWORD *v15; 
  _QWORD *v16; 
  UINT64 Tag; 
  UINT64 Tagc; 
  UINT64 Taga; 
  UINT64 Tagd; 
  UINT64 Tage; 
  UINT64 Tagb; 
  INT64 v23[2]; 
  __int128 v24; 
  __int128 v25; 
  v24 = 0i64;
  v25 = 0i64;
  MiMarkKernelPageTablePages();
  v23[1] = 0i64;
  v23[0] = (INT64)MiGatherHiberRange;
  v0 = 2i64;
  MiGatherHiberRange((INT64)v23, (VOID *)(*((_QWORD *)PsInitialSystemProcess + 5) >> 12), 1i64, 2i64);
  MiMarkNonPagedHiberPhasePages(
    MmGetPfnDb(),
    (_MMPTE *)((char *)MmGetPfnDb() + 48 * HighestPhysicalPage + 47),
    (_MMPTE *)0x200,
    v1);
  LODWORD(Tag) = 1634168141;
  PoSetHiberRange(0i64, 0x14000ui64, qword_140C4EB08, 1ui64, Tag);
  LODWORD(Tagc) = 1651535181;
  PoSetHiberRange(0i64, 0x10000ui64, *((VOID **)KeGetCurrentThread() + 23), 0xA40ui64, Tagc);
  v2 = *(VOID **)(*((_QWORD *)KeGetCurrentThread() + 23) + 1928i64);
  if( v2 )
  {
    LODWORD(Taga) = 1651535181;
    PoSetHiberRange(0i64, 0x10000ui64, v2, 0x1000ui64, Taga);
  }
  if( MiIsRetpolineEnabled() )
  {
    LODWORD(Taga) = 1651535181;
    PoSetHiberRange(
      0i64,
      0x10000ui64,
      qword_140C4C9A0,
      8 * (((unsigned __int64)qword_140C4C998 >> 6) + ((qword_140C4C998 & 0x3F) != 0)),
      Taga);
    LODWORD(Tagd) = 1651535181;
    PoSetHiberRange(0i64, 0x10000ui64, Base, (unsigned int)(dword_140C4C9C8 << 12), Tagd);
  }
  MiMarkNonPagedHiberPhasePages(qword_140C4DF88, (_MMPTE *)((char *)qword_140C4DF88 + qword_140C4DF90 - 1), 0i64, v3);
  LODWORD(Taga) = 1685286221;
  PoSetHiberRange(0i64, 0x10000ui64, &KUSER_SHARED_DATA, 0x1000ui64, Taga);
  LODWORD(Tage) = 1685286221;
  PoSetHiberRange(0i64, 0x10000ui64, MmUnloadedDrivers, 0x7D0ui64, Tage);
  v7 = 0i64;
  v8 = 50i64;
  do
  {
    v9 = *(MMPTE **)((char *)MmUnloadedDrivers + v7 + 8);
    if( v9 )
    {
      LODWORD(Tagb) = 1685286221;
      PoSetHiberRange(0i64, 0x10000ui64, v9, *(unsigned __int16 *)((char *)MmUnloadedDrivers + v7), Tagb);
    }
    v7 += 40i64;
    --v8;
  }
  while( v8 );
  v10 = (_QWORD **)&xmmword_140C4E988 + 1;
  do
  {
    v11 = *v10;
    i = 0i64;
    while( v11 )
    {
      i = v11;
      v11 = (_QWORD *)*v11;
    }
    while( i )
    {
      v13 = (_QWORD **)i[1];
      v14 = i;
      v15 = i;
      if( v13 )
      {
        v16 = *v13;
        for( i = (_QWORD *)i[1]; v16; v16 = (_QWORD *)*v16 )
          i = v16;
      }
      else
      {
        while( 1 )
        {
          i = (_QWORD *)(i[2] & 0xFFFFFFFFFFFFFFFCui64);
          if( !i || (_QWORD *)*i == v15 )
            break;
          v15 = i;
        }
      }
      LODWORD(Tagb) = 1867083085;
      PoSetHiberRange(0i64, 0x10000ui64, v14, 0x440ui64, Tagb);
    }
    ++v10;
    --v0;
  }
  while( v0 );
  MiMarkHiberNotCachedPages(v5, v4, v9, v6);
}

Referenced by: