MiMapImageInSystemSpace

NTSTATUS __stdcall MiMapImageInSystemSpace(
        _CONTROL_AREA *ControlArea,
        UINT64 MapFlags,
        _MI_SYSTEM_SPACE_IMAGE *SystemImageInfo){
  int v4; 
  unsigned int SizeOfHeaders; 
  _CONTROL_AREA *v7; 
  unsigned int TotalNumberOfPtes; 
  _FILE_OBJECT *v9; 
  _FILE_OBJECT *v10; 
  NTSTATUS SessionId; 
  unsigned int v12; 
  NTSTATUS v13; 
  NTSTATUS v14; 
  _EPROCESS *v15; 
  _MMSUPPORT_INSTANCE *AnyMultiplexedVm; 
  NTSTATUS result; 
  _EPROCESS *SystemProcess; 
  int v19; 
  NTSTATUS v20; 
  __int64 CapturedViewSize[2]; 
  __int64 OpaqueSection[14]; 
  VOID *MappedBase; 
  __int64 v24; 
  UINT64 ViewSize; 

  v4 = MapFlags;
  MappedBase = 0i64;
  memset(OpaqueSection, 0i64, 0x40u);
  *(_QWORD *)SystemImageInfo = 0i64;
  SizeOfHeaders = ControlArea->Segment->u2.ImageInformation->InternalImageInformation.SizeOfHeaders;
  if( !SizeOfHeaders )
    return -1073741701;
  if( MiControlAreaRequiresCharge((INT64)ControlArea) == 1 )
  {
    v7 = 0i64;
  }
  else
  {
    result = MiReferenceActiveSubsection((_SUBSECTION *)&ControlArea[1], 0x288ui64, 0x11u);
    if( result < 0 )
      return result;
    v7 = ControlArea;
  }
  *((_QWORD *)SystemImageInfo + 1) = v7;
  if( (v4 & 1) != 0 )
    TotalNumberOfPtes = ControlArea->Segment->TotalNumberOfPtes;
  else
    TotalNumberOfPtes = (SizeOfHeaders >> 12) + ((SizeOfHeaders & 0xFFF) != 0);
  OpaqueSection[6] = (unsigned __int64)TotalNumberOfPtes << 12;
  v9 = MiReferenceControlAreaFile(ControlArea);
  v10 = v9;
  if( (v9->DeviceObject->Characteristics & 0x10) != 0 )
    OpaqueSection[5] = (unsigned __int64)v9 | 1;
  else
    OpaqueSection[5] = (__int64)ControlArea;
  SessionId = MmGetSessionIdEx(KeGetCurrentThread()->ApcState.Process);
  LODWORD(OpaqueSection[7]) |= 0x20u;
  v24 = 0i64;
  v12 = v4 | 8;
  HIDWORD(OpaqueSection[7]) = HIDWORD(OpaqueSection[7]) & 0x80000002 | ((SessionId & 0x7FFFF) << 12) | 2;
  ViewSize = TotalNumberOfPtes << 12;
  MiMapViewInSystemSpace(OpaqueSection, &Session, &MappedBase, &ViewSize);
  v14 = v13;
  MiDereferenceControlAreaFile(ControlArea, v10);
  if( v14 >= 0 )
  {
    AnyMultiplexedVm = MiGetAnyMultiplexedVm(MiWorkingSetTypeSystemViews, v15);
LABEL_10:
    *((_QWORD *)SystemImageInfo + 3) = AnyMultiplexedVm;
    *(_QWORD *)SystemImageInfo = MappedBase;
    result = 0;
    SystemImageInfo[4] = TotalNumberOfPtes;
    return result;
  }
  if( (v12 & 2) != 0 )
  {
    CapturedViewSize[0] = 0i64;
    SystemProcess = MiGetControlAreaPartition(ControlArea, v15)->Core.PartitionObject->SystemProcess;
    KiStackAttachProcess(SystemProcess, 0i64, (_KAPC_STATE *)(SystemImageInfo + 8));
    MiMapImageInSystemProcess(ControlArea, v12, &MappedBase, (UINT64 *)CapturedViewSize);
    v20 = v19;
    if( v19 >= 0 )
    {
      AnyMultiplexedVm = &SystemProcess->Vm.Instance;
      goto LABEL_10;
    }
    KiUnstackDetachProcess((_KAPC_STATE *)(SystemImageInfo + 8), 0i64);
    if( *((_QWORD *)SystemImageInfo + 1) )
      MiReturnCrossPartitionControlAreaCharges((INT64)ControlArea);
    return v20;
  }
  else
  {
    if( *((_QWORD *)SystemImageInfo + 1) )
      MiReturnCrossPartitionControlAreaCharges((INT64)ControlArea);
    return v14;
  }
}

Referenced by: