PiInitializeDDB

INT64 __stdcall PiInitializeDDB(PCWSTR SourceString){
  char v1; 
  _OWORD *v2; 
  char v3; 
  _QWORD *v4; 
  NTSTATUS v5; 
  WCHAR v6; 
  VOID *inited; 
  int v9; 
  const WCHAR *v10; 
  UINT64 ShareAccess; 
  UINT64 OpenOptions; 
  UINT64 AllocationType; 
  UINT64 Win32Protect; 
  void *SectionHandle; 
  void *FileHandle; 
  UNICODE_STRING InsertionString1; 
  ULONG_PTR ViewSize; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  struct _UNICODE_STRING DestinationString; 
  struct _IO_STATUS_BLOCK IoStatusBlock; 
  PVOID BaseAddress; 
  *(_QWORD *)&ObjectAttributes.Length = 48i64;
  *(_QWORD *)&ObjectAttributes.Attributes = 576i64;
  v3 = v1;
  ViewSize = 0i64;
  FileHandle = 0i64;
  *v2 = 0i64;
  SectionHandle = 0i64;
  v2[1] = 0i64;
  v4 = v2;
  BaseAddress = 0i64;
  DestinationString = 0i64;
  IoStatusBlock = 0i64;
  RtlInitUnicodeString(&DestinationString, SourceString, (WCHAR)v2);
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.RootDirectory = 0i64;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  v5 = ZwOpenFile((UNICODE_STRING *)&FileHandle, (PWCHAR)0x80000000i64);
  if( v5 >= 0 )
  {
    LODWORD(OpenOptions) = 0x8000000;
    ObjectAttributes.Length = 48;
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.Attributes = 576;
    ObjectAttributes.ObjectName = 0i64;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    LODWORD(ShareAccess) = 2;
    v5 = ZwCreateSection(&SectionHandle, 4ui64, &ObjectAttributes, 0i64, ShareAccess, OpenOptions, FileHandle);
    if( v5 < 0 )
    {
      if( (PiLoggedErrorEventsMask & 0x20) == 0 )
      {
        v9 = PiLoggedErrorEventsMask | 0x20;
        v10 = L"DATABASE SECTION FAILED";
        goto LABEL_17;
      }
    }
    else
    {
      LODWORD(Win32Protect) = 2;
      LODWORD(AllocationType) = 0;
      v5 = ZwMapViewOfSection(
             SectionHandle,
             (PVOID)0xFFFFFFFFFFFFFFFFi64,
             &BaseAddress,
             0i64,
             0i64,
             0i64,
             &ViewSize,
             ViewShare,
             AllocationType,
             Win32Protect);
      if( v5 < 0 )
      {
        if( (PiLoggedErrorEventsMask & 0x40) == 0 )
        {
          v9 = PiLoggedErrorEventsMask | 0x40;
          v10 = L"DATABASE MAPPING FAILED";
          goto LABEL_17;
        }
      }
      else
      {
        inited = SdbInitDatabaseInMemory(BaseAddress, (unsigned int)ViewSize);
        if( inited )
        {
          *v4 = inited;
          v4[3] = FileHandle;
          v4[2] = SectionHandle;
          v4[1] = BaseAddress;
          BaseAddress = 0i64;
          SectionHandle = 0i64;
          FileHandle = 0i64;
          goto LABEL_4;
        }
        v5 = -1073741823;
        if( (PiLoggedErrorEventsMask & 0x80u) == 0 )
        {
          v9 = PiLoggedErrorEventsMask | 0x80;
          v10 = L"INIT DATABASE FAILED";
          goto LABEL_17;
        }
      }
    }
  }
  else if( !InitIsWinPEMode && !v3 && (PiLoggedErrorEventsMask & 0x10) == 0 )
  {
    v9 = PiLoggedErrorEventsMask | 0x10;
    v10 = L"DATABASE OPEN FAILED";
LABEL_17:
    PiLoggedErrorEventsMask = v9;
    InsertionString1 = 0i64;
    RtlInitUnicodeString(&InsertionString1, v10, v6);
    LODWORD(ShareAccess) = 0;
    PnpLogEvent(&InsertionString1, 0i64, 3221226349i64, 0i64, ShareAccess);
  }
LABEL_4:
  if( BaseAddress )
    ZwUnmapViewOfSection((HANDLE)0xFFFFFFFFFFFFFFFFi64, BaseAddress);
  if( SectionHandle )
    ZwClose(SectionHandle);
  if( FileHandle )
    ZwClose(FileHandle);
  return(unsigned int)v5;
}

Referenced by: