PspMapSystemDll

__int64 __fastcall PspMapSystemDll(_EPROCESS *a1, __int64 a2, int a3, int a4){
  struct DMA_ADAPTER *v8; 
  bool v9; 
  unsigned __int64 v10; 
  unsigned int v11; 
  PVOID v13; 
  IMAGE_NT_HEADERS *v14; 
  unsigned __int64 ImageBase_high; 
  INT64 v16; 
  INT64 v17; 
  INT64 v18; 
  INT64 v19; 
  INT64 v20; 
  PVOID BaseAddress; 
  INT64 v22; 
  INT64 v23; 
  MEMORY_RANGE_ENTRY VirtualAddresses; 
  __int128 v25; 
  __int64 v26; 
  INT64 v27[2]; 
  __int128 v28; 
  int VmInformation; 
  v8 = (struct DMA_ADAPTER *)PspReferenceSystemDll(a2);
  if( !v8 )
    return 3221225473i64;
  BaseAddress = 0i64;
  v23 = 0i64;
  v22 = 0i64;
  v27[0] = 1i64;
  v27[1] = (INT64)&v25;
  v26 = 0i64;
  v28 = 0i64;
  LOBYTE(v28) = 5;
  v9 = (*(_BYTE *)(a2 + 16) & 8) == 0;
  v25 = 0i64;
  *((_QWORD *)&v28 + 1) = 32i64;
  v10 = _mm_srli_si128((__m128i)0i64, 8).m128i_u64[0];
  if( v9 )
    v10 = 0x7FFFFFFEFFFFi64;
  LODWORD(v20) = 0;
  LODWORD(v19) = 2;
  *((_QWORD *)&v25 + 1) = v10;
  LODWORD(v18) = 4;
  LODWORD(v16) = a3 != 0 ? 0x20000000 : 0;
  v11 = MmMapViewOfSectionEx(
          v8,
          (INT64)a1,
          (INT64 *)&BaseAddress,
          (INT64)&v23,
          (INT64)&v22,
          v16,
          v18,
          (INT64)v27,
          v19,
          v20,
          0i64);
  ObFastDereferenceObject((INT64 *)a2, v8);
  if( v11 != 1073741827 )
    goto LABEL_5;
  if( a1 != (_EPROCESS *)PsInitialSystemProcess )
  {
    v11 = -1073741800;
LABEL_5:
    if( (v11 & 0x80000000) != 0 )
      return v11;
  }
  if( a4 )
  {
    v13 = BaseAddress;
    v11 = 0;
    v14 = RtlImageNtHeader(BaseAddress);
    if( v14->OptionalHeader.Magic == 267 )
      ImageBase_high = HIDWORD(v14->OptionalHeader.ImageBase);
    else
      ImageBase_high = v14->OptionalHeader.ImageBase;
    *(_QWORD *)(a2 + 40) = ImageBase_high;
    *(_QWORD *)(a2 + 48) = v13;
    return v11;
  }
  if( *(PVOID *)(a2 + 40) == BaseAddress )
  {
    VirtualAddresses.VirtualAddress = BaseAddress;
    LODWORD(v17) = 4;
    VmInformation = 1;
    VirtualAddresses.NumberOfBytes = 4096i64;
    ZwSetInformationVirtualMemory(
      (PVOID)0xFFFFFFFFFFFFFFFFi64,
      (VIRTUAL_MEMORY_INFORMATION_CLASS)4,
      1ui64,
      &VirtualAddresses,
      &VmInformation,
      v17);
    return v11;
  }
  return 3221225473i64;
}

Referenced by: