MiSectionInitialization

NTSTATUS __stdcall MiSectionInitialization(){
  _QWORD *Pool; 
  _QWORD *v1; 
  UINT64 ObjectBodySize; 
  UINT64 PagedPoolCharge; 
  UINT64 v5; 
  _UNICODE_STRING TypeName; 
  __int64 v7[2]; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  _OBJECT_TYPE_INITIALIZER ObjectTypeInitializer; 
  PVOID Object; 
  PVOID Handle; 

  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  Object = 0i64;
  Handle = 0i64;
  *(&stru_140C4DB30 + 984) = -1;
  stru_140C4C6C8.Root = 0i64;
  TypeName.Buffer = L"Section";
  v7[1] = (__int64)L"\\Device\\PhysicalMemory";
  *(_QWORD *)&TypeName.Length = 1048590i64;
  v7[0] = 3014700i64;
  memset(&ObjectTypeInitializer, 0i64, sizeof(ObjectTypeInitializer));
  ObjectTypeInitializer._bf_0 |= 4u;
  ObjectTypeInitializer.OpenProcedure = (int(__fastcall *)(_OB_OPEN_REASON, char, _EPROCESS *, void *, unsigned int *, unsigned int))MiSectionOpen;
  ObjectTypeInitializer.Length = 120;
  ObjectTypeInitializer.CloseProcedure = (void(__fastcall *)(_EPROCESS *, void *, unsigned __int64, unsigned __int64))MiSectionClose;
  ObjectTypeInitializer.PoolType = PagedPool;
  ObjectTypeInitializer.DeleteProcedure = (void(__fastcall *)(void *))MiSectionDelete;
  ObjectTypeInitializer.InvalidAttributes = 256;
  ObjectTypeInitializer.DefaultPagedPoolCharge = 64;
  ObjectTypeInitializer.ValidAccessMask = 983071;
  ObjectTypeInitializer.GenericMapping = (_GENERIC_MAPPING)MiSectionMapping;
  ObjectTypeInitializer.ObjectTypeCode = 128;
  if( ObCreateObjectType(&TypeName, &ObjectTypeInitializer, 0i64, &MmSectionObjectType) >= 0 )
  {
    Pool = MiAllocatePool(256i64, 0x48ui64, 0x67536D4Dui64);
    if( Pool )
    {
      memset(&qword_140C4C6F0, 0i64, 0x110u);
      Pool[5] = 0i64;
      dword_140C4C7B8 |= 0x400u;
      ObjectAttributes.RootDirectory = 0i64;
      ObjectAttributes.ObjectName = (_UNICODE_STRING *)v7;
      qword_140C4C6F0 = (__int64)&qword_140C4C780;
      LODWORD(v5) = 0;
      qword_140C4C780 = (__int64)Pool;
      qword_140C4C798 = 1i64;
      LODWORD(PagedPoolCharge) = 64;
      *Pool = &qword_140C4C780;
      LODWORD(ObjectBodySize) = 64;
      ObjectAttributes.Length = 48;
      ObjectAttributes.Attributes = 65552;
      *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
      if( ObCreateObject(
             0,
             MmSectionObjectType,
             &ObjectAttributes,
             0,
             0i64,
             ObjectBodySize,
             PagedPoolCharge,
             v5,
             &Object) < 0 )
      {
        ExFreePoolWithTag(Pool, 0);
      }
      else
      {
        v1 = Object;
        *((_QWORD *)Object + 5) = &qword_140C4C780;
        v1[6] = 0xFFFFFFFFFFFFi64;
        *((_DWORD *)v1 + 14) = 0;
        *((_DWORD *)v1 + 15) = *((_DWORD *)v1 + 15) & 0xFFFFF000 | 0x40;
        if( ObInsertObject(v1, 0i64, 4, 0i64, 0i64, &Handle) >= 0 )
        {
          ObCloseHandle(Handle, 0);
          return 1;
        }
      }
    }
  }
  return 0;
}

Referenced by: