NtGetNlsSectionPtr

NTSTATUS __stdcall NtGetNlsSectionPtr(
        UINT64 SectionType,
        UINT64 SectionData,
        PVOID ContextData,
        PVOID *SectionPointer,
        UINT64 *SectionSize){
  unsigned int v6; 
  unsigned int v7; 
  char v8; 
  __int64 v9; 
  __int64 v10; 
  NTSTATUS result; 
  int v12; 
  UNICODE_STRING *v13; 
  struct _DMA_ADAPTER *Buffer; 
  int v15; 
  PVOID *Object; 
  POBJECT_HANDLE_INFORMATION HandleInformation; 
  void *SectionHandle; 
  UNICODE_STRING FileHandle; 
  PVOID MappedBase; 
  ULONG_PTR ViewSize[3]; 
  __int128 v22; 
  __int128 v23; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  struct _OBJECT_ATTRIBUTES v25; 
  struct _IO_STATUS_BLOCK IoStatusBlock; 
  __int16 SectionName[64]; 
  __int16 FileName[64]; 
  v6 = SectionData;
  v7 = SectionType;
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  v22 = 0i64;
  *(_QWORD *)&FileHandle.Length = 0i64;
  SectionHandle = 0i64;
  IoStatusBlock = 0i64;
  MappedBase = 0i64;
  ViewSize[0] = 0i64;
  if( !SectionPointer )
    return -1073741582;
  if( !SectionSize )
    return -1073741581;
  v8 = *((_BYTE *)KeGetCurrentThread() + 562);
  if( v8 )
  {
    v9 = (__int64)SectionPointer;
    if( (unsigned __int64)SectionPointer >= 0x7FFFFFFF0000i64 )
      v9 = 0x7FFFFFFF0000i64;
    *(_QWORD *)v9 = *(_QWORD *)v9;
    v10 = (__int64)SectionSize;
    if( (unsigned __int64)SectionSize >= 0x7FFFFFFF0000i64 )
      v10 = 0x7FFFFFFF0000i64;
    *(_QWORD *)v10 = *(_QWORD *)v10;
    if( ContextData )
    {
      if( ((unsigned __int8)ContextData & 3) != 0 )
        ExRaiseDatatypeMisalignment();
      if( (unsigned __int64)ContextData + 4 > 0x7FFFFFFF0000i64 || (char *)ContextData + 4 < ContextData )
        MEMORY[0x7FFFFFFF0000] = 0;
    }
  }
  result = RtlpInitNlsSectionName(v7, (unsigned int)SectionData, (PWCHAR)SectionName, (UNICODE_STRING *)SectionPointer);
  if( result >= 0 )
  {
    ObjectAttributes.Length = 48;
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.Attributes = 720;
    ObjectAttributes.ObjectName = (_UNICODE_STRING *)&v22;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    if( v7 - 11 > 1 )
    {
      v12 = -1073741823;
    }
    else
    {
      v12 = ZwOpenSection(&SectionHandle, 4ui64, &ObjectAttributes);
      if( v12 < 0 )
      {
        *(&v25.Length + 1) = 0;
        *(&v25.Attributes + 1) = 0;
        v23 = 0i64;
        Object = (PVOID *)&v23;
        result = RtlpInitNlsFileName(v7, v6, (PWCHAR)FileName, v13);
        if( result < 0 )
          return result;
        v25.Length = 48;
        v25.RootDirectory = 0i64;
        v25.Attributes = 576;
        v25.ObjectName = (_UNICODE_STRING *)&v23;
        *(_OWORD *)&v25.SecurityDescriptor = 0i64;
        result = ZwOpenFile(&FileHandle, (PWCHAR)0x100000);
        if( result < 0 )
          return result;
        LODWORD(HandleInformation) = 0x8000000;
        LODWORD(Object) = 2;
        v12 = ZwCreateSection(
                &SectionHandle,
                4ui64,
                &ObjectAttributes,
                0i64,
                (UINT64)Object,
                (UINT64)HandleInformation,
                *(PVOID *)&FileHandle.Length);
        ZwClose(*(HANDLE *)&FileHandle.Length);
      }
    }
    if( v12 >= 0 )
    {
      FileHandle.Buffer = 0i64;
      v12 = ObReferenceObjectByHandle(
              SectionHandle,
              0xF001Fu,
              MmSectionObjectType,
              0,
              (PVOID *)&FileHandle.Buffer,
              0i64);
      ZwClose(SectionHandle);
      if( v12 >= 0 )
      {
        ViewSize[1] = 0i64;
        Buffer = (struct _DMA_ADAPTER *)FileHandle.Buffer;
        if( v8 )
          v15 = MmMapViewOfSection((_LOADER_PARAMETER_BLOCK *)FileHandle.Buffer, *((_QWORD *)KeGetCurrentThread() + 23));
        else
          v15 = MmMapViewInSystemSpace(FileHandle.Buffer, &MappedBase, ViewSize);
        v12 = v15;
        HalPutDmaAdapter(Buffer);
        if( v12 >= 0 )
        {
          *SectionPointer = MappedBase;
          *SectionSize = ViewSize[0];
        }
      }
    }
    return v12;
  }
  return result;
}

Referenced by: