PspMapSystemDll

NTSTATUS __stdcall PspMapSystemDll(
        _EPROCESS *Process,
        PSP_SYSTEM_DLL_DATA *DllData,
        UINT64 UseLargePages,
        UINT64 InitialMap){
  int v5; 
  int v6; 
  VOID *v8; 
  bool v9; 
  unsigned __int64 v10; 
  int v11; 
  INT64 v13; 
  __int64 v14; 
  __int64 v15; 
  INT64 v16; 
  INT64 v17; 
  INT64 v18; 
  INT64 v19; 
  INT64 v20; 
  INT64 v21; 
  INT64 v22; 
  INT64 v23; 
  _MEMORY_RANGE_ENTRY VirtualAddresses; 
  __int128 v25; 
  __int64 v26; 
  INT64 v27[2]; 
  __int128 v28; 
  int VmInformation; 

  v5 = InitialMap;
  v6 = UseLargePages;
  v8 = (VOID *)PspReferenceSystemDll((_EX_FAST_REF *)DllData);
  if( !v8 )
    return -1073741823;
  v21 = 0i64;
  v23 = 0i64;
  v22 = 0i64;
  v27[0] = 1i64;
  v27[1] = (INT64)&v25;
  v26 = 0i64;
  v28 = 0i64;
  LOBYTE(v28) = 5;
  v9 = (DllData[4] & 8) == 0;
  v25 = 0i64;
  *((_QWORD *)&v28 + 1) = 32i64;
  v10 = _mm_srli_si128((__m128i)0i64, 8).m128i_u64[0];
  if( v9 )
    v10 = 0x7FFFFFFEFFFFi64;
  LODWORD(v20) = 0;
  LODWORD(v19) = 2;
  *((_QWORD *)&v25 + 1) = v10;
  LODWORD(v18) = 4;
  LODWORD(v16) = v6 != 0 ? 0x20000000 : 0;
  v11 = MmMapViewOfSectionEx(v8, (INT64)Process, &v21, (INT64)&v23, (INT64)&v22, v16, v18, (INT64)v27, v19, v20, 0i64);
  ObFastDereferenceObject((_EX_FAST_REF *)DllData, v8);
  if( v11 != 1073741827 )
    goto LABEL_5;
  if( Process != PsInitialSystemProcess )
  {
    v11 = -1073741800;
LABEL_5:
    if( v11 < 0 )
      return v11;
  }
  if( v5 )
  {
    v13 = v21;
    v11 = 0;
    LODWORD(v14) = RtlImageNtHeader(v21);
    if( *(_WORD *)(v14 + 24) == 267 )
      v15 = *(unsigned int *)(v14 + 52);
    else
      v15 = *(_QWORD *)(v14 + 48);
    *((_QWORD *)DllData + 5) = v15;
    *((_QWORD *)DllData + 6) = v13;
    return v11;
  }
  if( *((_QWORD *)DllData + 5) == v21 )
  {
    VirtualAddresses.VirtualAddress = (PVOID)v21;
    LODWORD(v17) = 4;
    VmInformation = 1;
    *(_QWORD *)&VirtualAddresses.NumberOfBytes = 4096i64;
    ZwSetInformationVirtualMemory(
      (VOID *)0xFFFFFFFFFFFFFFFFi64,
      (_VIRTUAL_MEMORY_INFORMATION_CLASS)4,
      1ui64,
      &VirtualAddresses,
      &VmInformation,
      v17);
    return v11;
  }
  return -1073741823;
}

Referenced by: