EmpMapPhysicalAddress

VOID *__stdcall EmpMapPhysicalAddress(VOID **SectionHandle, VOID **BaseAddress, _KAPC_STATE *ApcState){
  VOID **v3; 
  VOID *v4; 
  VOID **v5; 
  char *v7; 
  UINT64 AllocationType; 
  UINT64 Win32Protect; 
  _LARGE_INTEGER SectionOffset; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  UINT64 CommitSize; 
  VOID *BaseAddressa; 
  _KAPC_STATE *ApcStatea; 

  CommitSize = (UINT64)SectionHandle;
  *(_QWORD *)&ObjectAttributes.Length = 48i64;
  v4 = 0i64;
  *(_QWORD *)&ObjectAttributes.Attributes = 576i64;
  *v3 = 0i64;
  v5 = v3;
  DestinationString = 0i64;
  RtlInitUnicodeString(&DestinationString, L"\\Device\\PhysicalMemory");
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = &DestinationString;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  if( ZwOpenSection((VOID **)ApcState, 4ui64, &ObjectAttributes) >= 0 )
  {
    BaseAddressa = 0i64;
    CommitSize = 8i64;
    SectionOffset.QuadPart = 1044480i64;
    KiStackAttachProcess(PsInitialSystemProcess, 0i64, ApcStatea);
    LODWORD(Win32Protect) = 4;
    LODWORD(AllocationType) = 0;
    if( ZwMapViewOfSection(
           ApcState->ApcListHead[0].Flink,
           (VOID *)0xFFFFFFFFFFFFFFFFi64,
           &BaseAddressa,
           0i64,
           CommitSize,
           &SectionOffset,
           &CommitSize,
           ViewUnmap,
           AllocationType,
           Win32Protect) < 0 )
    {
      KiUnstackDetachProcess(ApcStatea, 0i64);
      ZwClose((_HANDLE)ApcState->ApcListHead[0].Flink);
      ApcState->ApcListHead[0].Flink = 0i64;
    }
    else
    {
      v7 = (char *)BaseAddressa;
      *v5 = BaseAddressa;
      return v7 + 4085;
    }
  }
  return v4;
}

Referenced by: