RtlFileMapMapView

NTSTATUS __stdcall RtlFileMapMapView(_RTL_FILE_MAP *FileMap, UINT8 MapAsImage){
  int Section; 
  VOID *v5; 
  INT64 FileInformationClass; 
  INT64 AllocationAttributes; 
  VOID *FileHandle; 
  UINT64 AllocationType; 
  UINT64 Win32Protect; 
  VOID *SectionHandle; 
  VOID *BaseAddress; 
  UINT64 ViewSize; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  _IO_STATUS_BLOCK IoStatusBlock; 
  __int128 FileInformation; 
  __int64 v18; 

  SectionHandle = 0i64;
  BaseAddress = 0i64;
  ViewSize = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  v18 = 0i64;
  IoStatusBlock = 0i64;
  FileInformation = 0i64;
  if( *((_QWORD *)FileMap + 3) )
    return -1073741554;
  Section = ZwQueryInformationFile(
              *(VOID **)FileMap,
              &IoStatusBlock,
              &FileInformation,
              0x18ui64,
              FileStandardInformation);
  if( Section >= 0 )
  {
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.ObjectName = 0i64;
    ObjectAttributes.Length = 48;
    FileHandle = *(VOID **)FileMap;
    ObjectAttributes.Attributes = 512;
    LODWORD(AllocationAttributes) = MapAsImage != 0 ? 285212672 : 0x8000000;
    LODWORD(FileInformationClass) = 2;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    Section = ZwCreateSection(
                (UINT64)&SectionHandle,
                0xF0005ui64,
                (INT64)&ObjectAttributes,
                0i64,
                FileInformationClass,
                AllocationAttributes,
                (UINT64)FileHandle);
    if( Section >= 0 )
    {
      LODWORD(Win32Protect) = 2;
      LODWORD(AllocationType) = 5242880;
      Section = ZwMapViewOfSection(
                  SectionHandle,
                  (VOID *)0xFFFFFFFFFFFFFFFFi64,
                  &BaseAddress,
                  0i64,
                  0i64,
                  0i64,
                  &ViewSize,
                  ViewUnmap,
                  AllocationType,
                  Win32Protect);
      if( Section >= 0 )
      {
        v5 = MmSecureVirtualMemory(BaseAddress, ViewSize, 2ui64);
        if( v5 )
        {
          Section = 0;
          *((_QWORD *)FileMap + 1) = SectionHandle;
          *((_QWORD *)FileMap + 3) = BaseAddress;
          *((_QWORD *)FileMap + 4) = ViewSize;
          *((_QWORD *)FileMap + 2) = *((_QWORD *)&FileInformation + 1);
          *(_WORD *)((char *)FileMap + 49) = 257;
          *((_BYTE *)FileMap + 51) = MapAsImage;
          *((_QWORD *)FileMap + 5) = v5;
          return Section;
        }
        Section = -1073741823;
      }
    }
  }
  if( SectionHandle )
    ZwClose((_HANDLE)SectionHandle);
  if( BaseAddress )
    ZwUnmapViewOfSection((VOID *)0xFFFFFFFFFFFFFFFFi64, BaseAddress);
  return Section;
}

Referenced by: