MiConvertHiberPhasePte

INT64 __fastcall MiConvertHiberPhasePte(INT64 a1, INT64 *a2, INT64 a3){
  unsigned __int64 PteShadow; 
  int v4; 
  __int64 v7; 
  __int64 v9; 
  unsigned __int64 v10; 
  UINT64 v11; 
  PteShadow = *a2;
  v4 = a3;
  if( a2 >= (INT64 *)MmGetPml4eBase() && a2 <= (INT64 *)MmGetPxeUserLimit() )
    PteShadow = MiReadPteShadow((UNICODE_STRING *)a2, (UNICODE_STRING *)*a2, a3, (WCHAR *)(unsigned int)a3);
  v7 = *(_QWORD *)(a1 + 168);
  v11 = PteShadow;
  if( v7 )
  {
    if( (PteShadow & 1) != 0 && !v4 )
    {
      v9 = (PteShadow >> 12) & 0xFFFFFFFFFi64;
      if( (unsigned int)MiIsPfn(v9) )
      {
        if( v9 != qword_140C4EAC0
          && v9 != qword_140C4EAA8
          && !_bittest64(*(const signed __int64 **)(v7 + 8), (unsigned int)(PteShadow >> 12)) )
        {
          v10 = PteShadow & 0xFFFFFFFFFFFFFBFAui64 | 0x404;
          v11 = v10;
          goto LABEL_17;
        }
      }
    }
  }
  else if( (PteShadow & 1) == 0 && (PteShadow & 0x400) != 0 && (PteShadow & 4) != 0 )
  {
    v10 = PteShadow & 0xFFFFFFFFFFFFFBFAui64 | 1;
    v11 = v10;
LABEL_17:
    *a2 = v10;
  }
  return 0i64;
}

Referenced by: