MiMapProcessExecutable

NTSTATUS __stdcall MiMapProcessExecutable(
        _EPROCESS *ProcessToInitialize,
        _SECTION *Section,
        UINT64 *CreateFlags,
        VOID *NoAccessVa){
  union {unsigned int LongFlags;_MMSECTION_FLAGS Flags;} v4; 
  int v8; 
  __int64 v9; 
  NTSTATUS v10; 
  INT64 v11; 
  NTSTATUS v12; 
  int v13; 
  unsigned int v14; 
  NTSTATUS v15; 
  int v16; 
  NTSTATUS result; 
  INT64 v18; 
  char v19; 
  INT64 v20; 
  INT64 v21; 
  INT64 v22; 
  INT64 v23; 
  INT64 v24; 
  INT64 v25; 
  INT64 v26; 
  UINT64 v27[2]; 
  __int128 v28; 
  INT64 v29; 
  INT64 v30; 

  v4.LongFlags = (unsigned int)Section->u;
  *(_OWORD *)v27 = 0i64;
  v28 = 0i64;
  if( (v4.LongFlags & 0x20) == 0 )
    return -1073741751;
  if( (*(_DWORD *)CreateFlags & 0x80u) == 0 || (result = MiSessionCreate((UINT64 *)ProcessToInitialize), result >= 0) )
  {
    LODWORD(v23) = 0;
    v8 = *(_DWORD *)CreateFlags;
    v30 = 0i64;
    v29 = 0i64;
    v9 = 4i64;
    v24 = 0i64;
    LODWORD(v22) = 1;
    LODWORD(v21) = 4;
    LODWORD(v20) = (v8 & 0x10) << 25;
    v25 = 5i64;
    v26 = 32i64;
    v10 = MmMapViewOfSectionEx(
            Section,
            (INT64)ProcessToInitialize,
            &v29,
            (INT64)&v24,
            (INT64)&v30,
            v20,
            v21,
            (INT64)&v25,
            v22,
            v23,
            0i64);
    v11 = v29;
    v12 = v10;
    ProcessToInitialize->SectionBaseAddress = (void *)v29;
    if( v10 >= 0 )
    {
      v13 = *(_DWORD *)CreateFlags;
      v14 = 0;
      if( (*(_DWORD *)CreateFlags & 0x10) != 0 )
      {
        MiFillPteHierarchy(v11, v27);
        do
        {
          v18 = v27[--v9];
          v19 = MI_READ_PTE_LOCK_FREE(v18);
          if( (v19 & 1) == 0 )
            break;
          if( v19 < 0 )
          {
            v14 = 1;
            break;
          }
        }
        while( v9 != 1 );
        if( v14 )
          v14 &= -((v13 & 0x20) != 0);
        else
          *(_DWORD *)CreateFlags = v13 & 0xFFFFFFEF;
      }
      v15 = PsMapSystemDlls(ProcessToInitialize, v14);
      if( v15 < 0 )
        v12 = v15;
      if( v12 >= 0 )
      {
        v16 = MiCfgInitializeProcess(ProcessToInitialize);
        if( v16 < 0 )
          return v16;
      }
    }
    return v12;
  }
  return result;
}

Referenced by:

MmInitializeProcessAddressSpace