VmCreateMemoryProcess

NTSTATUS __stdcall VmCreateMemoryProcess(
        _EPROCESS *Parent,
        _UNICODE_STRING *ProcessName,
        UINT64 CreateFlags,
        VOID *a4,
        INT64 a5,
        INT64 a6){
  int v6; 
  PS_PROTECTION v7; 
  int MinimalProcess; 
  __int16 v10; 
  __int16 v11; 
  __int16 v12; 
  UINT64 CreateFlagsa; 
  VOID **ProcessHandle; 
  PVOID Object; 
  UINT64 RegionSize; 
  VOID *BaseAddress; 

  BaseAddress = 0i64;
  v6 = (int)a4;
  RegionSize = 0i64;
  v7.Level = (unsigned __int8)ProcessName;
  LOBYTE(a4) = Parent->Protection.Level;
  if( (v6 & 0xFFFFFFC0) != 0 )
    return -1073741811;
  v10 = ((v6 & 1) << 13) | 0x4000;
  if( (v6 & 2) == 0 )
    v10 = (v6 & 1) << 13;
  v11 = v10;
  if( (v6 & 4) == 0 )
    v11 = v10;
  v12 = v11 | 0x400;
  if( (v6 & 0x10) == 0 )
    v12 = v11;
  MinimalProcess = PsCreateMinimalProcess(Parent, v7, 0i64, (UINT64)a4, (VOID **)CreateFlags);
  if( MinimalProcess >= 0 )
  {
    BaseAddress = (VOID *)0x10000;
    RegionSize = 4294901760i64;
    if( (v12 & 0x6000) != 0
      || (LODWORD(ProcessHandle) = 1,
          LODWORD(CreateFlagsa) = 0x2000,
          MinimalProcess = ZwAllocateVirtualMemory(
                             0i64,
                             &BaseAddress,
                             0i64,
                             &RegionSize,
                             CreateFlagsa,
                             (UINT64)ProcessHandle),
          MinimalProcess >= 0) )
    {
      if( (v6 & 8) == 0 )
      {
        Object = 0i64;
        ObReferenceObjectByHandle(0i64, 0i64, (_OBJECT_TYPE *)PsProcessType, 0, &Object, 0i64);
        _InterlockedOr((volatile signed __int32 *)Object + 543, 0x2000u);
        HalPutDmaAdapter((PADAPTER_OBJECT)Object);
      }
      *(_QWORD *)a6 = 0i64;
      return 0;
    }
  }
  return MinimalProcess;
}

Referenced by: