PspLocateSystemDll

NTSTATUS __stdcall PspLocateSystemDll(PSP_SYSTEM_DLL_DATA *DllData, UINT64 SectionCreateFlags){
  _UNICODE_STRING *v2; 
  int v3; 
  NTSTATUS result; 
  NTSTATUS v6; 
  NTSTATUS v7; 
  NTSTATUS v8; 
  VOID *v9; 
  NTSTATUS v10; 
  UINT64 OutputBufferLength; 
  UINT64 *ReturnLength; 
  UINT64 *ReturnLengtha; 
  __int64 SectionInformation; 
  _UNICODE_STRING InputBuffer; 
  _IO_STATUS_BLOCK IoStatusBlock; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  VOID *FileHandle; 
  PVOID SectionHandle; 
  PVOID Object; 

  v2 = (_UNICODE_STRING *)(DllData + 6);
  v3 = SectionCreateFlags;
  SectionInformation = 0i64;
  FileHandle = 0i64;
  IoStatusBlock = 0i64;
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  InputBuffer = 0i64;
  SectionHandle = 0i64;
  if( (NtGlobalFlag & 0x40000) != 0 )
  {
    LODWORD(OutputBufferLength) = 0;
    InputBuffer = *v2;
    ZwSystemDebugControl(
      SysDbgClearUmAttachPid|SysDbgSetTracepoint,
      &InputBuffer,
      0x10ui64,
      0i64,
      OutputBufferLength,
      0i64);
  }
  ObjectAttributes.ObjectName = v2;
  LODWORD(ReturnLength) = 0;
  ObjectAttributes.Length = 48;
  LODWORD(OutputBufferLength) = 1;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 576;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  result = ZwOpenFile(
             &FileHandle,
             0x100020ui64,
             &ObjectAttributes,
             &IoStatusBlock,
             OutputBufferLength,
             (UINT64)ReturnLength);
  if( result >= 0 )
  {
    ObjectAttributes.ObjectName = 0i64;
    LODWORD(ReturnLengtha) = v3 | 2;
    v6 = MmCreateSpecialImageSection(&SectionHandle, &ObjectAttributes, 0i64, 0xCu, FileHandle, (UINT64)ReturnLengtha);
    if( v6 < 0 )
      KeBugCheckEx(0x6Bu, (PVOID)v6, (PVOID)3, 0i64, 0i64);
    ObCloseHandle(FileHandle, 0);
    Object = 0i64;
    v7 = ObReferenceObjectByHandle(SectionHandle, 0xF001Fui64, MmSectionObjectType, 0, &Object, 0i64);
    if( v7 < 0 )
      KeBugCheckEx(0x6Bu, (PVOID)v7, (PVOID)4, 0i64, 0i64);
    ObCloseHandle(SectionHandle, 0);
    v8 = MmGetSectionInformation(Object, SectionRelocationInformation, &SectionInformation);
    if( v8 < 0 )
      KeBugCheckEx(0x6Bu, (PVOID)v8, (PVOID)8, 0i64, 0i64);
    v9 = Object;
    *((_QWORD *)DllData + 8) = SectionInformation;
    ObInitializeFastReference((_EX_FAST_REF *)DllData, v9);
    *((_QWORD *)DllData + 1) = 0i64;
    v10 = PspMapSystemDll(KeGetCurrentThread()->ApcState.Process, DllData, 0i64, 1ui64);
    if( v10 < 0 )
      KeBugCheckEx(0x6Bu, (PVOID)v10, (PVOID)5, 0i64, 0i64);
    return 0;
  }
  return result;
}

Referenced by: