MiCreateSectionForDriver

NTSTATUS __fastcall MiCreateSectionForDriver(UNICODE_STRING *ImageFileName, VOID *a2, INT64 a3, VOID **a4){
  int v5; 
  VOID *v6; 
  NTSTATUS result; 
  int v9; 
  int SessionId; 
  NTSTATUS v11; 
  LARGE_INTEGER *ShareAccess; 
  INT64 ShareAccessa; 
  UINT64 OpenOptions; 
  UINT64 v15; 
  INT64 v16; 
  INT64 v17; 
  UINT64 v18; 
  INT64 v19; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  UNICODE_STRING FileHandle; 
  VOID *v22; 
  byte_140C4CA28 = 1;
  v22 = 0i64;
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  v5 = a3;
  *a4 = 0i64;
  v6 = a2;
  *(_QWORD *)&FileHandle.Length = 0i64;
  if( a2 )
    goto LABEL_5;
  if( (_BYTE)KdDebuggerEnabled
    && !(_BYTE)KdDebuggerNotPresent
    && (int)KdPullRemoteFile(ImageFileName, 0i64, a3, (UINT64)a4) >= 0 )
  {
    DbgPrintEx(0x66u, 2u, "MmLoadSystemImage: Pulled %wZ from kd\n", ImageFileName);
  }
  ObjectAttributes.Length = 48;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 576;
  ObjectAttributes.ObjectName = ImageFileName;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  result = ZwOpenFile(&FileHandle, (PWCHAR)0x20);
  if( result >= 0 )
  {
    v6 = *(VOID **)&FileHandle.Length;
LABEL_5:
    ObjectAttributes.Length = 48;
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.Attributes = 576;
    ObjectAttributes.ObjectName = 0i64;
    v9 = (((v5 & 1) << 21) + 0x100000) | 0x400000;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    if( v5 >= 0 )
      v9 = ((v5 & 1) << 21) + 0x100000;
    if( (v5 & 1) != 0 )
      SessionId = MmGetSessionIdEx(*((_QWORD *)KeGetCurrentThread() + 23));
    else
      SessionId = -1;
    LODWORD(v19) = 0;
    LODWORD(v18) = SessionId;
    LODWORD(v15) = ((unsigned int)v5 >> 27) & 8;
    LODWORD(OpenOptions) = v9;
    LODWORD(ShareAccess) = 16;
    v11 = MiCreateSystemSection(
            &v22,
            (INT64)a2,
            &ObjectAttributes,
            (INT64)a4,
            ShareAccess,
            OpenOptions,
            v15,
            v6,
            v16,
            v17,
            v18,
            v19,
            0);
    if( *(_QWORD *)&FileHandle.Length )
      ObCloseHandle(*(PVOID *)&FileHandle.Length, 0);
    if( v11 < 0 )
    {
      MiLogFailedDriverLoad(ImageFileName, 0i64, 0i64, (unsigned int)v11, ShareAccessa);
      return v11;
    }
    else
    {
      *a4 = v22;
      return 0;
    }
  }
  return result;
}

Referenced by: