MiMapProcessExecutable

INT64 __fastcall MiMapProcessExecutable(ULONG_PTR a1, _DWORD *a2, unsigned int *a3){
  int v3; 
  unsigned int v7; 
  __int64 v8; 
  NTSTATUS v9; 
  INT64 v10; 
  int v11; 
  unsigned int v12; 
  int v13; 
  int v14; 
  int v15; 
  INT64 result; 
  INT64 v17; 
  char v18; 
  INT64 v19; 
  INT64 v20; 
  INT64 v21; 
  INT64 v22; 
  INT64 v23; 
  INT64 v24; 
  INT64 v25; 
  UINT64 v26[2]; 
  __int128 v27; 
  INT64 v28; 
  INT64 v29; 
  v3 = a2[14];
  *(_OWORD *)v26 = 0i64;
  v27 = 0i64;
  if( (v3 & 0x20) == 0 )
    return 3221225545i64;
  if( (*a3 & 0x80u) == 0 || (result = MiSessionCreate(a1), (int)result >= 0) )
  {
    LODWORD(v22) = 0;
    v7 = *a3;
    v29 = 0i64;
    v28 = 0i64;
    v8 = 4i64;
    v23 = 0i64;
    LODWORD(v21) = 1;
    LODWORD(v20) = 4;
    LODWORD(v19) = (v7 & 0x10) << 25;
    v24 = 5i64;
    v25 = 32i64;
    v9 = MmMapViewOfSectionEx(a2, a1, &v28, (INT64)&v23, (INT64)&v29, v19, v20, (INT64)&v24, v21, v22, 0i64);
    v10 = v28;
    v11 = v9;
    *(_QWORD *)(a1 + 1312) = v28;
    if( v9 >= 0 )
    {
      v12 = *a3;
      v13 = 0;
      if( (*a3 & 0x10) != 0 )
      {
        MiFillPteHierarchy(v10, v26);
        do
        {
          v17 = v26[--v8];
          v18 = MI_READ_PTE_LOCK_FREE(v17);
          if( (v18 & 1) == 0 )
            break;
          if( v18 < 0 )
          {
            v13 = 1;
            break;
          }
        }
        while( v8 != 1 );
        if( v13 )
          v13 = (v12 & 0x20) != 0 ? v13 : 0;
        else
          *a3 = v12 & 0xFFFFFFEF;
      }
      v14 = PsMapSystemDlls(a1, v13);
      if( v14 < 0 )
        v11 = v14;
      if( v11 >= 0 )
      {
        v15 = MiCfgInitializeProcess(a1);
        if( v15 < 0 )
          return(unsigned int)v15;
      }
    }
    return(unsigned int)v11;
  }
  return result;
}

Referenced by: