MiMapImageInSystemProcess

VOID __fastcall MiMapImageInSystemProcess(
        _CONTROL_AREA *ControlArea,
        UINT64 MapFlags,
        VOID **CapturedBase,
        UINT64 *CapturedViewSize){
  _SEGMENT *Segment; 
  _SECTION_INHERIT InheritDisposition; 
  UINT64 v8; 
  _EPROCESS *Process; 
  UINT64 v10; 
  __int64 v11; 
  __int64 v12; 
  UINT64 *CapturedViewSizea; 
  _SECTION *Section; 
  UINT64 v15[16]; 
  VOID *CapturedBasea; 

  Segment = ControlArea->Segment;
  InheritDisposition = (int)MapFlags;
  *CapturedViewSize = _InterlockedCompareExchange64(
                        (volatile signed __int64 *)&ControlArea->Segment->SizeOfSegment,
                        -1i64,
                        -1i64);
  if( (unsigned __int64)_InterlockedCompareExchange64((volatile signed __int64 *)&Segment->SizeOfSegment, -1i64, -1i64) < 0x100000000i64 )
  {
    v8 = *CapturedViewSize;
    if( *CapturedViewSize <= 0x7FFFFFFF0000i64 )
    {
      *CapturedBase = 0i64;
      CapturedBasea = 0i64;
      Process = KeGetCurrentThread()->ApcState.Process;
      memset(v15, 0i64, sizeof(v15));
      LODWORD(v10) = MiGetUserReservationHighestAddress((INT64)Process, 0i64);
      LODWORD(Section) = 1;
      LOBYTE(v15[13]) = v11;
      LODWORD(CapturedViewSizea) = 2;
      LODWORD(v15[5]) = 0x40000;
      v15[12] = (UINT64)Process;
      v15[11] = (UINT64)Process;
      MiMapViewOfImageSection(
        ControlArea,
        (_EPROCESS *)v15,
        (_EPROCESS *)CapturedBase,
        &CapturedBasea,
        (_LARGE_INTEGER *)(v11 & v12),
        CapturedViewSizea,
        Section,
        InheritDisposition,
        v15[0],
        v10,
        0x10000ui64,
        (v8 + 4095) & 0xFFFFFFFFFFFFF000ui64,
        v8);
    }
  }
}

Referenced by: