MiMapImageInSystemProcess

NTSTATUS __stdcall MiMapImageInSystemProcess(
        _CONTROL_AREA *ControlArea,
        UINT64 MapFlags,
        PVOID *CapturedBase,
        UINT64 *CapturedViewSize){
  __int64 v4; 
  _SECTION_INHERIT InheritDisposition; 
  UINT64 v8; 
  INT64 v9; 
  UINT64 UserReservationHighestAddress; 
  __int64 v11; 
  __int64 v13; 
  UINT64 *CapturedViewSizea; 
  _SECTION *Section; 
  INT64 result; 
  int v17; 
  INT64 v18; 
  INT64 v19; 
  char v20; 
  VOID *CapturedBasea; 
  v4 = *(_QWORD *)ControlArea;
  InheritDisposition = (int)MapFlags;
  *CapturedViewSize = _InterlockedCompareExchange64(
                        (volatile signed __int64 *)(*(_QWORD *)ControlArea + 24i64),
                        -1i64,
                        -1i64);
  if( (unsigned __int64)_InterlockedCompareExchange64((volatile signed __int64 *)(v4 + 24), -1i64, -1i64) >= 0x100000000i64 )
    return -1073741793;
  v8 = *CapturedViewSize;
  if( *CapturedViewSize > 0x7FFFFFFF0000i64 )
    return -1073741793;
  *CapturedBase = 0i64;
  CapturedBasea = 0i64;
  v9 = *((_QWORD *)KeGetCurrentThread() + 23);
  memset((INT64)&result, 0i64);
  UserReservationHighestAddress = MiGetUserReservationHighestAddress(v9, 0i64);
  LODWORD(Section) = 1;
  v20 = v11;
  LODWORD(CapturedViewSizea) = 2;
  v17 = 0x40000;
  v19 = v9;
  v18 = v9;
  return MiMapViewOfImageSection(
           ControlArea,
           (_EPROCESS *)&result,
           (_EPROCESS *)CapturedBase,
           &CapturedBasea,
           (_LARGE_INTEGER *)(v11 & v13),
           CapturedViewSizea,
           Section,
           InheritDisposition,
           result,
           UserReservationHighestAddress,
           0x10000ui64,
           (v8 + 4095) & 0xFFFFFFFFFFFFF000ui64,
           v8);
}

Referenced by: