PspMapSiloSharedDataView

NTSTATUS __stdcall PspMapSiloSharedDataView(_EPROCESS *Process){
  _EJOB *v2; 
  _EJOB *v3; 
  NTSTATUS result; 
  _DWORD *Peb; 
  _EWOW64PROCESS *WoW64Process; 
  UINT64 AllocationType; 
  UINT64 Win32Protect; 
  VOID *CapturedBase; 
  UINT64 CapturedViewSize; 
  _LARGE_INTEGER SectionOffset; 

  LODWORD(v2) = PsGetProcessServerSilo((INT64)Process);
  v3 = v2;
  if( PsIsHostSilo(v2) )
    return 0;
  CapturedBase = 0i64;
  SectionOffset.QuadPart = 0i64;
  CapturedViewSize = 0i64;
  LODWORD(Win32Protect) = 2;
  LODWORD(AllocationType) = 0x400000;
  result = MmMapViewOfSection(
             *(VOID **)(*((_QWORD *)v3 + 159) + 1136i64),
             Process,
             &CapturedBase,
             0i64,
             0i64,
             &SectionOffset,
             &CapturedViewSize,
             ViewShare,
             AllocationType,
             Win32Protect);
  if( result >= 0 )
  {
    Process->Peb->SharedData = CapturedBase;
    Peb = 0i64;
    WoW64Process = Process->WoW64Process;
    if( WoW64Process )
      Peb = WoW64Process->Peb;
    if( Peb )
      Peb[20] = (_DWORD)CapturedBase;
    return 0;
  }
  return result;
}

Referenced by: