KeMarkHiberPhase

VOID __stdcall KeMarkHiberPhase(KPCR *Pcr){
  __int64 v1; 
  char *v2; 
  __int64 *v3; 
  unsigned int i; 
  __int64 v5; 
  VOID *v6; 
  _QWORD **v7; 
  __int64 v8; 
  _QWORD *j; 
  unsigned int v10; 
  VOID *v11; 
  VOID *v12; 
  _QWORD *v13; 
  VOID *v14; 
  UINT64 v15; 
  PVOID *k; 
  UINT64 Tag; 
  UINT64 Tage; 
  UINT64 Tagf; 
  UINT64 Tagg; 
  UINT64 Taga; 
  UINT64 Tagh; 
  UINT64 Tagi; 
  UINT64 Tagj; 
  UINT64 Tagb; 
  UINT64 Tagc; 
  UINT64 Tagk; 
  UINT64 Tagd; 
  v1 = *((_QWORD *)Pcr + 4);
  v2 = (char *)*((_QWORD *)Pcr + 1);
  LODWORD(Tag) = 1668310347;
  if( *(_DWORD *)(v1 + 36) )
  {
    PoSetHiberRange(0i64, 0x10000ui64, Pcr, ((((_DWORD)KeNumberProcessors_0 << 6) + 51903) & 0xFFFFF000) + 28672, Tag);
  }
  else
  {
    PoSetHiberRange(0i64, 0x10000ui64, Pcr, 0xB080ui64, Tag);
    LODWORD(Tage) = 1668310347;
    PoSetHiberRange(0i64, 0x10000ui64, (VOID *)v1, 0xAF00ui64, Tage);
    LODWORD(Tagf) = 1668310347;
    PoSetHiberRange(0i64, 0x10000ui64, v2, 0x68ui64, Tagf);
    LODWORD(Tagg) = 1668310347;
    PoSetHiberRange(0i64, 0x10000ui64, &KiBootProcessorIdtSize, 0i64, Tagg);
    v3 = (__int64 *)(v2 + 36);
    for( i = 1; i <= 4; ++i )
    {
      v5 = *v3;
      if( i - 1 <= 3 )
      {
        if( (_BYTE)KiKvaShadow )
        {
          LODWORD(Taga) = 1668310347;
          PoSetHiberRange(0i64, 0x10000ui64, (VOID *)(v5 - 464), 0x200ui64, Taga);
          v6 = (VOID *)(*(_QWORD *)(v5 + 8) - 24544i64);
        }
        else
        {
          v6 = (VOID *)(v5 - 24576);
        }
        LODWORD(Taga) = 1668310347;
        PoSetHiberRange(0i64, 0x10000ui64, v6, 0x6000ui64, Taga);
      }
      ++v3;
    }
  }
  LODWORD(Taga) = 1936745803;
  PoSetHiberRange(0i64, 0x10000ui64, *(VOID **)(v1 + 360), *(unsigned __int16 *)(v1 + 358), Taga);
  LODWORD(Tagh) = 1936745803;
  PoSetHiberRange(0i64, 0x10000ui64, *(VOID **)(v1 + 344), *(unsigned __int16 *)(v1 + 342), Tagh);
  LODWORD(Tagi) = 1953719627;
  PoSetHiberRange(
    0i64,
    0x10000ui64,
    (VOID *)(((*(_QWORD *)(v1 + 12560) + 4095i64) & 0xFFFFFFFFFFFFF000ui64) - (unsigned int)KeKernelStackSize),
    (unsigned int)KeKernelStackSize,
    Tagi);
  LODWORD(Tagj) = 1702061387;
  PoSetHiberRange(
    0i64,
    0x10000ui64,
    (VOID *)(((*(_QWORD *)(v1 + 32552) + 4095i64) & 0xFFFFFFFFFFFFF000ui64) - 24576),
    0x6000ui64,
    Tagj);
  v7 = (_QWORD **)(v1 + 12480);
  v8 = 2i64;
  do
  {
    for( j = *v7; j; j = (_QWORD *)*j )
    {
      LODWORD(Tagb) = 1885627723;
      PoSetHiberRange(0i64, 0x10000ui64, j - 1, 0x40ui64, Tagb);
    }
    v7 += 5;
    --v8;
  }
  while( v8 );
  v10 = 1232;
  if( (KeFeatureBits & 0x800000) != 0 )
    v10 = KeXStateLength + 807;
  LODWORD(Tagb) = 2020828491;
  PoSetHiberRange(0i64, 0x10000ui64, *(VOID **)(v1 + 34240), v10, Tagb);
  v11 = *(VOID **)(v1 + 1728);
  if( v11 )
  {
    LODWORD(Tagc) = 1936942411;
    PoSetHiberRange(
      0i64,
      0x10000ui64,
      v11,
      KUSER_SHARED_DATA.XState.AllFeatureSize
    - (unsigned __int64)KUSER_SHARED_DATA.XState.Size
    + (unsigned int)KiIptSaveAreaLength
    + 64i64,
      Tagc);
  }
  v12 = *(VOID **)(v1 + 0x8000);
  if( v12 )
  {
    LODWORD(Tagc) = 1934189899;
    PoSetHiberRange(0i64, 0x10000ui64, v12, 0x428ui64, Tagc);
  }
  if( qword_140C2B138 )
  {
    LODWORD(Tagc) = 1920103501;
    PoSetHiberRange(0i64, 0x10000ui64, qword_140C2B138, 16 * (unsigned int)(unsigned __int8)qword_140C2B128, Tagc);
  }
  if( qword_140C2B140 )
  {
    LODWORD(Tagc) = 1920103501;
    PoSetHiberRange(0i64, 0x10000ui64, qword_140C2B140, 0x58ui64, Tagc);
  }
  v13 = *(_QWORD **)(v1 + 8);
  LODWORD(Tagc) = 1752458571;
  v14 = (VOID *)((v13[6] + 4095i64) & 0xFFFFFFFFFFFFF000ui64);
  v15 = v13[7] - (_QWORD)v14;
  PoSetHiberRange(0i64, 0x10000ui64, v13, 0x898ui64, Tagc);
  LODWORD(Tagk) = 1953719627;
  PoSetHiberRange(0i64, 0x10000ui64, v14, v15, Tagk);
  for( k = (PVOID *)KeBugCheckReasonCallbackListHead; k != &KeBugCheckReasonCallbackListHead; k = (PVOID *)*k )
  {
    LODWORD(Tagd) = 1953719627;
    PoSetHiberRange(0i64, 0x10000ui64, k, 0x30ui64, Tagd);
  }
  LODWORD(Tagd) = 1886156869;
  PoSetHiberRange(0i64, 0x10000ui64, ExLeapSecondData, 0x1000ui64, Tagd);
}

Referenced by: