IopIsNotNativeDriverImage

UINT8 __stdcall IopIsNotNativeDriverImage(_UNICODE_STRING *ImageFileName){
  bool v1; 
  __int64 v3; 
  UINT64 ShareAccess; 
  INT64 ShareAccessa; 
  UINT64 OpenOptions; 
  INT64 OpenOptionsa; 
  UINT64 AllocationType; 
  UINT64 Win32Protect; 
  VOID *FileHandle; 
  VOID *SectionHandle; 
  VOID *BaseAddress; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  UINT64 ViewSize; 
  _IO_STATUS_BLOCK v15; 
  _KAPC_STATE ApcState; 

  v1 = 0;
  FileHandle = 0i64;
  v15 = 0i64;
  *(_QWORD *)&ObjectAttributes.Length = 48i64;
  *(_QWORD *)&ObjectAttributes.Attributes = 576i64;
  SectionHandle = 0i64;
  memset(&ApcState, 0, sizeof(ApcState));
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = ImageFileName;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  LODWORD(OpenOptions) = 0;
  LODWORD(ShareAccess) = 5;
  if( ZwOpenFile(&FileHandle, 0x20ui64, &ObjectAttributes, &v15, ShareAccess, OpenOptions) < 0 )
    return 0;
  ObjectAttributes.Length = 48;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 576;
  ObjectAttributes.ObjectName = 0i64;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  LODWORD(OpenOptionsa) = 0x8000000;
  LODWORD(ShareAccessa) = 2;
  if( ZwCreateSection(
         (UINT64)&SectionHandle,
         8ui64,
         (INT64)&ObjectAttributes,
         0i64,
         ShareAccessa,
         OpenOptionsa,
         (UINT64)FileHandle) < 0 )
  {
LABEL_4:
    ZwClose((_HANDLE)FileHandle);
    return 0;
  }
  BaseAddress = 0i64;
  ViewSize = 0i64;
  KiStackAttachProcess(PsInitialSystemProcess, 0i64, &ApcState);
  LODWORD(Win32Protect) = 2;
  LODWORD(AllocationType) = 0;
  if( ZwMapViewOfSection(
         SectionHandle,
         (VOID *)0xFFFFFFFFFFFFFFFFi64,
         &BaseAddress,
         0i64,
         0i64,
         0i64,
         &ViewSize,
         ViewShare,
         AllocationType,
         Win32Protect) < 0 )
  {
    KiUnstackDetachProcess(&ApcState, 0i64);
    ZwClose((_HANDLE)SectionHandle);
    goto LABEL_4;
  }
  LODWORD(v3) = RtlImageNtHeader((UINT64)BaseAddress);
  if( v3 )
    v1 = *(_WORD *)(v3 + 4) != 0x8664;
  ZwUnmapViewOfSection((VOID *)0xFFFFFFFFFFFFFFFFi64, BaseAddress);
  KiUnstackDetachProcess(&ApcState, 0i64);
  ZwClose((_HANDLE)SectionHandle);
  ZwClose((_HANDLE)FileHandle);
  return v1;
}

Referenced by: