NtGetNlsSectionPtr

NTSTATUS __stdcall NtGetNlsSectionPtr(
        UINT64 SectionType,
        UINT64 SectionData,
        VOID *ContextData,
        VOID **SectionPointer,
        UINT64 *SectionSize,
        INT64 a6,
        INT64 a7,
        INT64 a8){
  unsigned int v9; 
  unsigned int v10; 
  char PreviousMode; 
  __int64 v12; 
  __int64 v13; 
  NTSTATUS result; 
  int Section; 
  _UNICODE_STRING *v16; 
  _ADAPTER_OBJECT *v17; 
  NTSTATUS v18; 
  PVOID *Object; 
  PVOID *Objecta; 
  POBJECT_HANDLE_INFORMATION HandleInformation; 
  POBJECT_HANDLE_INFORMATION HandleInformationa; 
  UINT64 AllocationType; 
  UINT64 Win32Protect; 
  VOID *SectionHandle; 
  VOID *FileHandle; 
  PVOID SectionToMap; 
  VOID *CapturedBase; 
  UINT64 ViewSize; 
  _LARGE_INTEGER SectionOffset; 
  _UNICODE_STRING v31; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  _OBJECT_ATTRIBUTES v34; 
  _IO_STATUS_BLOCK IoStatusBlock; 
  __int16 SectionName[64]; 
  __int16 FileName[64]; 

  v9 = SectionData;
  v10 = SectionType;
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  v31 = 0i64;
  FileHandle = 0i64;
  SectionHandle = 0i64;
  IoStatusBlock = 0i64;
  CapturedBase = 0i64;
  ViewSize = 0i64;
  if( !SectionPointer )
    return -1073741582;
  if( !SectionSize )
    return -1073741581;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  if( PreviousMode )
  {
    v12 = (__int64)SectionPointer;
    if( (unsigned __int64)SectionPointer >= 0x7FFFFFFF0000i64 )
      v12 = 0x7FFFFFFF0000i64;
    *(_QWORD *)v12 = *(_QWORD *)v12;
    v13 = (__int64)SectionSize;
    if( (unsigned __int64)SectionSize >= 0x7FFFFFFF0000i64 )
      v13 = 0x7FFFFFFF0000i64;
    *(_QWORD *)v13 = *(_QWORD *)v13;
    if( ContextData )
    {
      if( ((unsigned __int8)ContextData & 3) != 0 )
        ExRaiseDatatypeMisalignment();
      if( (unsigned __int64)ContextData + 4 > 0x7FFFFFFF0000i64 || (char *)ContextData + 4 < ContextData )
        MEMORY[0x7FFFFFFF0000] = 0;
    }
  }
  result = RtlpInitNlsSectionName(
             v10,
             (unsigned int)SectionData,
             (WCHAR *)SectionName,
             (_UNICODE_STRING *)SectionPointer,
             &v31);
  if( result >= 0 )
  {
    ObjectAttributes.Length = 48;
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.Attributes = 720;
    ObjectAttributes.ObjectName = &v31;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    if( v10 - 11 > 1 )
    {
      Section = -1073741823;
    }
    else
    {
      Section = ZwOpenSection(&SectionHandle, 4ui64, &ObjectAttributes);
      if( Section < 0 )
      {
        *(&v34.Length + 1) = 0;
        *(&v34.Attributes + 1) = 0;
        DestinationString = 0i64;
        result = RtlpInitNlsFileName(v10, v9, (WCHAR *)FileName, v16, &DestinationString);
        if( result < 0 )
          return result;
        v34.Length = 48;
        v34.RootDirectory = 0i64;
        v34.Attributes = 576;
        v34.ObjectName = &DestinationString;
        *(_OWORD *)&v34.SecurityDescriptor = 0i64;
        LODWORD(HandleInformation) = 0;
        LODWORD(Object) = 1;
        result = ZwOpenFile(&FileHandle, 0x100000ui64, &v34, &IoStatusBlock, (UINT64)Object, (UINT64)HandleInformation);
        if( result < 0 )
          return result;
        LODWORD(HandleInformationa) = 0x8000000;
        LODWORD(Objecta) = 2;
        Section = ZwCreateSection(
                    (UINT64)&SectionHandle,
                    4ui64,
                    (INT64)&ObjectAttributes,
                    0i64,
                    (INT64)Objecta,
                    (INT64)HandleInformationa,
                    (UINT64)FileHandle);
        ZwClose((_HANDLE)FileHandle);
      }
    }
    if( Section >= 0 )
    {
      SectionToMap = 0i64;
      Section = ObReferenceObjectByHandle(SectionHandle, 0xF001Fui64, MmSectionObjectType, 0, &SectionToMap, 0i64);
      ZwClose((_HANDLE)SectionHandle);
      if( Section >= 0 )
      {
        SectionOffset.QuadPart = 0i64;
        if( PreviousMode )
        {
          LODWORD(Win32Protect) = 2;
          LODWORD(AllocationType) = 0x400000;
          v17 = (_ADAPTER_OBJECT *)SectionToMap;
          v18 = MmMapViewOfSection(
                  SectionToMap,
                  KeGetCurrentThread()->ApcState.Process,
                  &CapturedBase,
                  0i64,
                  0i64,
                  &SectionOffset,
                  &ViewSize,
                  ViewShare,
                  AllocationType,
                  Win32Protect);
        }
        else
        {
          v17 = (_ADAPTER_OBJECT *)SectionToMap;
          v18 = MmMapViewInSystemSpace(SectionToMap, &CapturedBase, &ViewSize);
        }
        Section = v18;
        HalPutDmaAdapter(v17);
        if( Section >= 0 )
        {
          *SectionPointer = CapturedBase;
          *SectionSize = ViewSize;
        }
      }
    }
    return Section;
  }
  return result;
}

Referenced by: