KsepSdbMapToMemory

NTSTATUS __stdcall KsepSdbMapToMemory(PCWSTR SourceString){
  __int64 v1; 
  __int64 v2; 
  _ADAPTER_OBJECT *v3; 
  _DB **inited; 
  int Section; 
  __int64 v6; 
  NTSTATUS v8; 
  INT64 v9; 
  __int64 v10; 
  __int64 v11; 
  __int64 v12; 
  __int64 v13; 
  UINT64 ShareAccess; 
  INT64 ShareAccessa; 
  UINT64 OpenOptions; 
  INT64 OpenOptionsa; 
  VOID *MappedBase; 
  PVOID Object; 
  UINT64 ViewSize; 
  _UNICODE_STRING DestinationString; 
  _IO_STATUS_BLOCK IoStatusBlock; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  VOID *FileHandle; 
  VOID *SectionHandle; 

  *(_QWORD *)&ObjectAttributes.Length = 48i64;
  *(_QWORD *)&ObjectAttributes.Attributes = 576i64;
  v2 = v1;
  FileHandle = 0i64;
  SectionHandle = 0i64;
  MappedBase = 0i64;
  DestinationString = 0i64;
  v3 = 0i64;
  inited = 0i64;
  IoStatusBlock = 0i64;
  RtlInitUnicodeString(&DestinationString, SourceString);
  LODWORD(OpenOptions) = 0;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.RootDirectory = 0i64;
  LODWORD(ShareAccess) = 5;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  Section = ZwOpenFile(&FileHandle, 0x80000000ui64, &ObjectAttributes, &IoStatusBlock, ShareAccess, OpenOptions);
  if( Section >= 0 )
  {
    LODWORD(OpenOptionsa) = 0x8000000;
    ObjectAttributes.Length = 48;
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.Attributes = 576;
    ObjectAttributes.ObjectName = 0i64;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    LODWORD(ShareAccessa) = 2;
    Section = ZwCreateSection(
                (UINT64)&SectionHandle,
                4ui64,
                (INT64)&ObjectAttributes,
                0i64,
                ShareAccessa,
                OpenOptionsa,
                (UINT64)FileHandle);
    if( Section < 0 )
    {
      v10 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
      KsepHistoryErrors[2 * v10 + 1] = Section;
      KsepHistoryErrors[2 * v10] = 590528;
      if( (KsepDebugFlag & 2) != 0 )
        KsepDebugPrint(0i64, "KSE: ZwCreateSection Failed!\n");
      KsepLogError(0, "KSE: ZwCreateSection Failed!\n");
    }
    else
    {
      Object = 0i64;
      v8 = ObReferenceObjectByHandle(SectionHandle, 0xF001Fui64, MmSectionObjectType, 0, &Object, 0i64);
      v3 = (_ADAPTER_OBJECT *)Object;
      Section = v8;
      if( v8 < 0 )
      {
        v11 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
        KsepHistoryErrors[2 * v11 + 1] = Section;
        KsepHistoryErrors[2 * v11] = 590542;
        if( (KsepDebugFlag & 2) != 0 )
          KsepDebugPrint(0i64, "KSE: ObRefByHandle(section) failed!\n");
        KsepLogError(0, "KSE: ObRefByHandle(section) failed!\n");
      }
      else
      {
        ViewSize = 0i64;
        Section = MmMapViewInSystemSpace(Object, &MappedBase, &ViewSize);
        if( Section < 0 )
        {
          v12 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
          KsepHistoryErrors[2 * v12 + 1] = Section;
          KsepHistoryErrors[2 * v12] = 590555;
          if( (KsepDebugFlag & 2) != 0 )
            KsepDebugPrint(0i64, "KSE: Unable to map view of section!\n");
          KsepLogError(0, "KSE: Unable to map view of section!\n");
        }
        else
        {
          inited = (_DB **)SdbInitDatabaseInMemory(MappedBase, (unsigned int)ViewSize, v9);
          if( !inited )
          {
            Section = -1073741823;
            v13 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
            KsepHistoryErrors[2 * v13 + 1] = -1073741823;
            KsepHistoryErrors[2 * v13] = 590564;
            if( (KsepDebugFlag & 2) != 0 )
              KsepDebugPrint(0i64, "KSE: SdbInitDatabaseInMemory Failed!\n");
            KsepLogError(0, "KSE: SdbInitDatabaseInMemory Failed!\n");
            goto LABEL_6;
          }
          Section = 0;
        }
      }
    }
  }
  else
  {
    v6 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
    KsepHistoryErrors[2 * v6 + 1] = Section;
    KsepHistoryErrors[2 * v6] = 590506;
    if( (KsepDebugFlag & 2) != 0 )
      KsepDebugPrint(0i64, "KSE: ZwOpenFile failed opening DB file!\n");
    KsepLogError(0, "KSE: ZwOpenFile failed opening DB file!\n");
  }
  if( Section >= 0 )
  {
    *(_QWORD *)(v2 + 16) = FileHandle;
    *(_QWORD *)(v2 + 24) = SectionHandle;
    *(_QWORD *)(v2 + 8) = MappedBase;
    *(_QWORD *)(v2 + 32) = v3;
    *(_QWORD *)v2 = inited;
    *(_DWORD *)(v2 + 48) = SdbGetDatabaseEdition(inited[1]);
    return Section;
  }
LABEL_6:
  if( MappedBase )
    MmUnmapViewInSystemSpace(MappedBase);
  if( v3 )
    HalPutDmaAdapter(v3);
  if( SectionHandle )
    ZwClose((_HANDLE)SectionHandle);
  if( FileHandle )
    ZwClose((_HANDLE)FileHandle);
  return Section;
}

Referenced by: