CmFcpManagerCreateSection

INT64 __fastcall CmFcpManagerCreateSection(_LARGE_INTEGER a1, INT64 a2, INT64 a3, _QWORD *a4){
  NTSTATUS v7; 
  PVOID *Object; 
  UINT64 v10; 
  union _LARGE_INTEGER MaximumSize; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  void *SectionHandle; 
  PVOID v14; 
  memset(&ObjectAttributes.Length + 1, 0, 20);
  *(&ObjectAttributes.Attributes + 1) = 0;
  SectionHandle = 0i64;
  ObjectAttributes.SecurityQualityOfService = 0i64;
  ObjectAttributes.SecurityDescriptor = (void *)a3;
  MaximumSize = a1;
  LODWORD(v10) = 0x8000000;
  LODWORD(Object) = 4;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 512;
  v7 = ZwCreateSection(&SectionHandle, 6ui64, &ObjectAttributes, &MaximumSize, (UINT64)Object, v10, 0i64);
  if( v7 >= 0 )
  {
    v14 = 0i64;
    v7 = ObReferenceObjectByHandle(SectionHandle, 6u, MmSectionObjectType, 0, &v14, 0i64);
    if( v7 >= 0 )
    {
      v7 = 0;
      a4[1] = v14;
      *a4 = a2;
      a4[2] = a1.QuadPart;
    }
  }
  if( SectionHandle )
    ZwClose(SectionHandle);
  return(unsigned int)v7;
}

Referenced by: