PspLocateInPEManifest

NTSTATUS __stdcall PspLocateInPEManifest(_EPROCESS *CurrentProcess, PSP_CREATE_PROCESS_CONTEXT *CreateContext){
  _EWOW64PROCESS *WoW64Process; 
  VOID *SectionBaseAddress; 
  NTSTATUS result; 
  PSP_CREATE_PROCESS_CONTEXT v6; 
  unsigned __int16 Machine; 
  __int64 v8; 
  UINT64 InitResIds[5]; 
  UINT64 Size; 

  WoW64Process = CurrentProcess->WoW64Process;
  SectionBaseAddress = CurrentProcess->SectionBaseAddress;
  if( WoW64Process )
  {
    Machine = WoW64Process->Machine;
    if( Machine == 332 || Machine == 452 )
    {
      result = MmCheckImageMapping((INT64)CurrentProcess);
      if( result < 0 )
        return result;
      SectionBaseAddress = (VOID *)(v8 | 1);
    }
  }
  InitResIds[2] = 0i64;
  Size = 0i64;
  InitResIds[0] = 24i64;
  InitResIds[1] = 1i64;
  result = LdrResSearchResource(
             SectionBaseAddress,
             InitResIds,
             3ui64,
             0x30ui64,
             (VOID **)CreateContext + 38,
             &Size,
             0i64,
             0i64);
  if( result >= 0 )
  {
    v6 = Size;
    if( Size > 0xFFFFFFFF )
      return -1073741701;
    *((_BYTE *)CreateContext + 8) |= 0x20u;
    CreateContext[78] = v6;
    *(_DWORD *)(*((_QWORD *)CreateContext + 26) + 8i64) |= 0x2000u;
    return 0;
  }
  if( (unsigned int)(result + 1073741687) <= 2 || result == -1073741308 )
    return 0;
  return result;
}

Referenced by: