ApiSetpLoadSchemaImage

NTSTATUS __stdcall ApiSetpLoadSchemaImage(UNICODE_STRING *SchemaPath, PVOID *ViewBaseAddress, UINT64 *ViewSize){
  ULONG_PTR *v3; 
  ULONG_PTR *v4; 
  int v6; 
  UINT64 ShareAccess; 
  UINT64 AllocationAttributes; 
  UINT64 v10; 
  UINT64 Win32Protect; 
  PVOID BaseAddress; 
  ULONG_PTR ViewSizea; 
  OBJECT_ATTRIBUTES v14; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  struct _IO_STATUS_BLOCK IoStatusBlock; 
  void *SectionHandle; 
  UNICODE_STRING FileHandle; 
  BaseAddress = 0i64;
  ViewSizea = 0i64;
  v4 = v3;
  *(&ObjectAttributes.Length + 1) = 0;
  memset(&ObjectAttributes.Attributes + 1, 0, 20);
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = (_UNICODE_STRING *)ViewBaseAddress;
  *(_QWORD *)&FileHandle.Length = -1i64;
  memset(&v14, 0, sizeof(v14));
  SectionHandle = (void *)-1i64;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 576;
  IoStatusBlock = 0i64;
  v6 = ZwOpenFile(&FileHandle, (PWCHAR)0x80000000i64);
  if( v6 >= 0 )
  {
    v14.RootDirectory = 0i64;
    v14.ObjectName = 0i64;
    LODWORD(AllocationAttributes) = 0x8000000;
    LODWORD(ShareAccess) = 2;
    v14.Length = 48;
    v14.Attributes = 576;
    *(_OWORD *)&v14.SecurityDescriptor = 0i64;
    v6 = ZwCreateSection(
           &SectionHandle,
           4ui64,
           &v14,
           0i64,
           ShareAccess,
           AllocationAttributes,
           *(PVOID *)&FileHandle.Length);
    if( v6 >= 0 )
    {
      LODWORD(Win32Protect) = 2;
      LODWORD(v10) = 0;
      v6 = ZwMapViewOfSection(
             SectionHandle,
             (PVOID)0xFFFFFFFFFFFFFFFFi64,
             &BaseAddress,
             0i64,
             0i64,
             0i64,
             &ViewSizea,
             ViewUnmap,
             v10,
             Win32Protect);
      if( v6 >= 0 )
      {
        *ViewSize = (UINT64)BaseAddress;
        *v4 = ViewSizea;
      }
    }
  }
  if( SectionHandle != (void *)-1i64 )
    ZwClose(SectionHandle);
  if( *(_QWORD *)&FileHandle.Length != -1i64 )
    ZwClose(*(HANDLE *)&FileHandle.Length);
  return v6;
}

Referenced by: