MmMapApiSetView

VOID __fastcall MmMapApiSetView(_EPROCESS *TargetProcess){
  _EJOB *v2; 
  _EJOB *v3; 
  void *ApiSetSection; 
  _DWORD *Peb; 
  _EWOW64PROCESS *WoW64Process; 
  unsigned __int16 Machine; 
  UINT64 AllocationType; 
  UINT64 Win32Protect; 
  VOID *CapturedBase; 
  UINT64 CapturedViewSize; 
  _LARGE_INTEGER SectionOffset; 

  CapturedBase = 0i64;
  SectionOffset.QuadPart = 0i64;
  CapturedViewSize = 0i64;
  LODWORD(v2) = PsGetProcessServerSilo((INT64)TargetProcess);
  v3 = v2;
  if( PsIsHostSilo(v2) )
    ApiSetSection = SectionToMap;
  else
    ApiSetSection = PsGetServerSiloGlobals(v3)->ApiSetSection;
  LODWORD(Win32Protect) = 2;
  LODWORD(AllocationType) = 0x400000;
  if( MmMapViewOfSection(
         ApiSetSection,
         TargetProcess,
         &CapturedBase,
         0i64,
         0i64,
         &SectionOffset,
         &CapturedViewSize,
         ViewShare,
         AllocationType,
         Win32Protect) >= 0 )
  {
    TargetProcess->Peb->ApiSetMap = CapturedBase;
    Peb = 0i64;
    WoW64Process = TargetProcess->WoW64Process;
    if( WoW64Process )
      Peb = WoW64Process->Peb;
    if( Peb )
    {
      if( WoW64Process && ((Machine = WoW64Process->Machine, Machine == 332) || Machine == 452) )
        Peb[14] = (_DWORD)CapturedBase;
      else
        *((_QWORD *)Peb + 13) = CapturedBase;
    }
  }
}

Referenced by: