FsRtlCreateSectionForDataScan

NTSTATUS __stdcall FsRtlCreateSectionForDataScan(
        VOID **SectionHandle,
        VOID **SectionObject,
        _LARGE_INTEGER *SectionFileSize,
        _FILE_OBJECT *FileObject,
        UINT64 DesiredAccess,
        _OBJECT_ATTRIBUTES *ObjectAttributes,
        _LARGE_INTEGER *MaximumSize,
        UINT64 SectionPageProtection,
        UINT64 AllocationAttributes,
        UINT64 Flags){
  VOID **v12; 
  _ETHREAD *CurrentThread; 
  int v14; 
  int inserted; 
  _OBJECT_ATTRIBUTES *QuadPart; 
  int v17; 
  NTSTATUS v18; 
  _FILE_OBJECT *FileObjectForSection; 
  _FILE_OBJECT *v20; 
  VOID *v21; 
  NTSTATUS result; 
  char *v23; 
  _FILE_OBJECT *v24; 
  UINT64 CompressionAlignment; 
  VOID *SectionObjecta; 
  _LARGE_INTEGER FileSize; 
  PVOID Handle; 

  v12 = SectionObject;
  FileSize.QuadPart = 0i64;
  SectionObjecta = 0i64;
  Handle = 0i64;
  CompressionAlignment = 0i64;
  if( (SectionPageProtection & 0xFFFFFFF9) != 0 || !(_DWORD)SectionPageProtection )
    return -1073741578;
  if( (AllocationAttributes & 0xFF7FFFFF) != 0x8000000 )
    return -1073741577;
  if( !FileObject->SectionObjectPointer )
    return -1073741792;
  KeGetCurrentThread()[1].TrapFrame = (_KTRAP_FRAME *)1;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  v23 = (char *)&CompressionAlignment + 4;
  v14 = FsRtlAcquireToCreateMappedSection(
          FileObject,
          (unsigned int)SectionPageProtection,
          (UINT64 *)1,
          &CompressionAlignment);
  if( v14 < 0 )
  {
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
    result = v14;
    KeGetCurrentThread()[1].TrapFrame = 0i64;
  }
  else
  {
    inserted = FsRtlGetFileSize(FileObject, &FileSize);
    if( inserted >= 0 )
    {
      QuadPart = (_OBJECT_ATTRIBUTES *)FileSize.QuadPart;
      if( FileSize.QuadPart )
      {
        v17 = CompressionAlignment;
        while( 1 )
        {
          LODWORD(v24) = v17;
          LODWORD(v23) = AllocationAttributes;
          v18 = MmCreateSectionEx(
                  &SectionObjecta,
                  ObjectAttributes,
                  QuadPart,
                  (_LARGE_INTEGER *)(unsigned int)SectionPageProtection,
                  (UINT64)v23,
                  0i64,
                  FileObject,
                  v24,
                  0i64);
          inserted = v18;
          if( v18 != -1073741740 )
            break;
          KeDelayExecutionThread(0, 0, (_LARGE_INTEGER *)&FsRtlHalfSecond);
        }
        if( v18 >= 0 )
        {
          FileObjectForSection = MmGetFileObjectForSection(SectionObjecta);
          v20 = FileObjectForSection;
          if( FileObjectForSection )
          {
            CcZeroEndOfLastPage(FileObjectForSection);
            ObfDereferenceObjectWithTag(v20, 0x746C6644ui64);
          }
        }
        v12 = SectionObject;
      }
      else
      {
        inserted = -1073741807;
      }
    }
    FsRtlReleaseFile(FileObject);
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
    KeGetCurrentThread()[1].TrapFrame = 0i64;
    if( inserted >= 0 )
    {
      v21 = SectionObjecta;
      ObfReferenceObjectWithTag(SectionObjecta, 0x746C6644ui64);
      inserted = ObInsertObject(v21, 0i64, DesiredAccess, 0i64, 0i64, &Handle);
      if( inserted < 0 )
      {
        ObfDereferenceObjectWithTag(v21, 0x746C6644ui64);
      }
      else
      {
        *SectionHandle = Handle;
        *v12 = v21;
        if( SectionFileSize )
          *SectionFileSize = FileSize;
      }
    }
    return inserted;
  }
  return result;
}

Referenced by: