MiCreateSectionForDriver

NTSTATUS *__fastcall MiCreateSectionForDriver(_UNICODE_STRING *ImageFileName, VOID *a2, UINT64 a3, VOID **a4){
  int v5; 
  VOID *v6; 
  NTSTATUS *result; 
  int v9; 
  NTSTATUS SessionId; 
  NTSTATUS v11; 
  _LARGE_INTEGER *ShareAccess; 
  INT64 ShareAccessa; 
  UINT64 OpenOptions; 
  UINT64 v15; 
  INT64 v16; 
  INT64 v17; 
  UINT64 v18; 
  INT64 v19; 
  _IO_STATUS_BLOCK IoStatusBlock; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  VOID *FileHandle; 
  VOID *v23; 

  byte_140C4CA28 = 1;
  v23 = 0i64;
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  v5 = a3;
  *a4 = 0i64;
  v6 = a2;
  FileHandle = 0i64;
  IoStatusBlock = 0i64;
  if( a2 )
    goto LABEL_5;
  if( (_BYTE)KdDebuggerEnabled
    && !(_BYTE)KdDebuggerNotPresent
    && KdPullRemoteFile(ImageFileName, 0i64, a3, (UINT64)a4) >= 0 )
  {
    DbgPrintEx(0x66u, 2u, "MmLoadSystemImage: Pulled %wZ from kd\n", ImageFileName);
  }
  LODWORD(OpenOptions) = 0;
  ObjectAttributes.Length = 48;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 576;
  ObjectAttributes.ObjectName = ImageFileName;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  LODWORD(ShareAccess) = 5;
  LODWORD(result) = ZwOpenFile(
                      &FileHandle,
                      0x20ui64,
                      &ObjectAttributes,
                      &IoStatusBlock,
                      (UINT64)ShareAccess,
                      OpenOptions);
  if( (int)result >= 0 )
  {
    v6 = FileHandle;
LABEL_5:
    ObjectAttributes.Length = 48;
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.Attributes = 576;
    ObjectAttributes.ObjectName = 0i64;
    v9 = (((v5 & 1) << 21) + 0x100000) | 0x400000;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    if( v5 >= 0 )
      v9 = ((v5 & 1) << 21) + 0x100000;
    if( (v5 & 1) != 0 )
      SessionId = MmGetSessionIdEx(KeGetCurrentThread()->ApcState.Process);
    else
      SessionId = -1;
    LODWORD(v19) = 0;
    LODWORD(v18) = SessionId;
    LODWORD(v15) = ((unsigned int)v5 >> 27) & 8;
    LODWORD(OpenOptions) = v9;
    LODWORD(ShareAccess) = 16;
    v11 = MiCreateSystemSection(
            &v23,
            (INT64)a2,
            &ObjectAttributes,
            (INT64)a4,
            ShareAccess,
            OpenOptions,
            v15,
            v6,
            v16,
            v17,
            v18,
            v19,
            0);
    if( FileHandle )
      ObCloseHandle(FileHandle, 0);
    if( v11 < 0 )
    {
      MiLogFailedDriverLoad(ImageFileName, 0i64, 0i64, (unsigned int)v11, ShareAccessa);
      return(NTSTATUS *)(unsigned int)v11;
    }
    else
    {
      *a4 = v23;
      return 0i64;
    }
  }
  return result;
}

Referenced by: