DbgkMapViewOfSection

VOID __stdcall DbgkMapViewOfSection(
        _EPROCESS *Process,
        VOID *SectionObject,
        VOID *BaseAddress,
        UINT64 SectionOffset,
        UINT64 ViewSize){
  _ETHREAD *CurrentThread; 
  _ETHREAD *v9; 
  _TEB *Teb; 
  __int64 v11; 
  __int64 v12; 
  _DBGKM_APIMSG ApiMsg[68]; 
  _DBGKM_APIMSG v14; 
  _DBGKM_APIMSG v15; 

  memset(ApiMsg, 0i64, sizeof(ApiMsg));
  if( KeGetCurrentThread()->PreviousMode )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    if( (CurrentThread->CrossThreadFlags & 4) == 0 )
    {
      if( Process->DebugPort )
      {
        v9 = (_ETHREAD *)KeGetCurrentThread();
        if( (v9->Tcb._bf_0 & 0x400) != 0 || v9->Tcb.ApcStateIndex == 1 )
          Teb = 0i64;
        else
          Teb = (_TEB *)v9->Tcb.Teb;
        if( Teb && Process == CurrentThread->Tcb.Process )
        {
          if( (unsigned int)DbgkpSuppressDbgMsg(Teb) )
            return;
          *(_QWORD *)&ApiMsg[18] = &Teb->NtTib.ArbitraryUserPointer;
        }
        if( SectionObject )
          *(_QWORD *)&ApiMsg[12] = DbgkpSectionToFileHandle(SectionObject);
        else
          *(_QWORD *)&ApiMsg[12] = 0i64;
        *(_QWORD *)&ApiMsg[14] = BaseAddress;
        ApiMsg[16] = v14;
        ApiMsg[17] = v15;
        if( BaseAddress )
        {
          LODWORD(v11) = RtlImageNtHeader((UINT64)BaseAddress);
          v12 = v11;
        }
        else
        {
          v12 = 0i64;
        }
        if( v12 )
        {
          ApiMsg[16] = *(_DWORD *)(v12 + 12);
          ApiMsg[17] = *(_DWORD *)(v12 + 16);
        }
        ApiMsg[0] = 5242920;
        ApiMsg[1] = 8;
        ApiMsg[10] = 5;
        DbgkpSendApiMessage(Process, 1ui64, ApiMsg);
        if( *(_QWORD *)&ApiMsg[12] )
          ObCloseHandle(*(VOID **)&ApiMsg[12], 0);
      }
    }
  }
}

Referenced by: