AslpFileLargeMapCreate

__int64 __fastcall AslpFileLargeMapCreate(_QWORD *a1, __int64 a2, INT64 a3){
  char *v5; 
  _QWORD *v6; 
  unsigned int v7; 
  PVOID *v8; 
  NTSTATUS v9; 
  const CHAR *v10; 
  UINT64 v11; 
  __int64 v12; 
  unsigned __int64 v13; 
  UINT64 *v14; 
  PVOID *v15; 
  LARGE_INTEGER *v16; 
  __int64 v17; 
  UINT64 SectionPageProtection; 
  __int64 SectionPageProtectiona; 
  UINT64 AllocationAttributes; 
  HANDLE FileHandle; 
  UINT64 AllocationType; 
  UINT64 AllocationTypea; 
  UINT64 Win32Protect; 
  UINT64 Win32Protecta; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  _QWORD *a1a; 
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  v5 = (char *)AslAlloc(a1, 0x50ui64, a3);
  a1a = v5;
  v6 = v5;
  if( !v5 )
    return(unsigned int)-1073741801;
  v8 = (PVOID *)(v5 + 8);
  ObjectAttributes.Length = 48;
  FileHandle = *(HANDLE *)a2;
  LODWORD(AllocationAttributes) = 0x8000000;
  LODWORD(SectionPageProtection) = 2;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 512;
  ObjectAttributes.ObjectName = 0i64;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  v9 = ZwCreateSection(
         (PVOID *)v5 + 1,
         0xF0005ui64,
         &ObjectAttributes,
         0i64,
         SectionPageProtection,
         AllocationAttributes,
         FileHandle);
  v7 = v9;
  if( v9 < 0 )
  {
    v10 = "ZwCreateSection failed [%x]";
    v11 = 345i64;
LABEL_5:
    LODWORD(SectionPageProtectiona) = v9;
    AslLogCallPrintf(1ui64, "AslpFileLargeMapCreate", v11, v10, SectionPageProtectiona);
    goto LABEL_19;
  }
  v6[8] = (*(_QWORD *)(a2 + 16) - 4096i64) & 0xFFFFFFFFFFFF0000ui64;
  LODWORD(Win32Protect) = 2;
  LODWORD(AllocationType) = 5242880;
  v9 = ZwMapViewOfSection(
         *v8,
         (PVOID)0xFFFFFFFFFFFFFFFFi64,
         (PVOID *)v6 + 6,
         0i64,
         0i64,
         (LARGE_INTEGER *)v6 + 8,
         v6 + 7,
         ViewUnmap,
         AllocationType,
         Win32Protect);
  v7 = v9;
  if( v9 < 0 )
  {
    v10 = "ZwMapViewOfSection failed to map the end of the file [%x]";
    v11 = 373i64;
    goto LABEL_5;
  }
  v12 = MmSecureVirtualMemoryEx(v6[6], v6[7], 2, 0);
  v6[9] = v12;
  if( !v12 )
  {
    AslLogCallPrintf(1ui64, "AslpFileLargeMapCreate", 0x17Cui64, "MmSecureVirtualMemory failed to secure the end view");
LABEL_10:
    v7 = -1073741823;
    goto LABEL_19;
  }
  v13 = 0x20000000i64;
  v14 = v6 + 3;
  v15 = (PVOID *)(v6 + 2);
  v16 = (LARGE_INTEGER *)(v6 + 4);
  do
  {
    *v14 = v13;
    v16->QuadPart = 0i64;
    LODWORD(Win32Protecta) = 2;
    LODWORD(AllocationTypea) = 5242880;
    v9 = ZwMapViewOfSection(
           *v8,
           (PVOID)0xFFFFFFFFFFFFFFFFi64,
           v15,
           0i64,
           0i64,
           v16,
           v14,
           ViewUnmap,
           AllocationTypea,
           Win32Protecta);
    v13 >>= 1;
    v7 = v9;
  }
  while( v9 == -1073741801 && v13 >= 0x100000 );
  v6 = a1a;
  if( v9 < 0 )
  {
    v10 = "ZwMapViewOfSection failed to map the start of the file [%x]";
    v11 = 415i64;
    goto LABEL_5;
  }
  v17 = MmSecureVirtualMemoryEx((unsigned __int64)*v15, *v14, 2, 0);
  v6[5] = v17;
  if( !v17 )
  {
    AslLogCallPrintf(
      1ui64,
      "AslpFileLargeMapCreate",
      0x1A6ui64,
      "MmSecureVirtualMemory failed to secure the start view");
    goto LABEL_10;
  }
  *v6 = a2;
  v7 = 0;
  *a1 = v6;
  v6 = 0i64;
  a1a = 0i64;
LABEL_19:
  if( v6 )
    AslpFileLargeMapDelete(&a1a);
  return v7;
}

Referenced by: