EmpMapPhysicalAddress

NTSTATUS __stdcall EmpMapPhysicalAddress(PVOID *SectionHandle, PVOID *BaseAddress, KAPC_STATE *ApcState){
  PVOID *v3; 
  NTSTATUS v4; 
  PVOID *v5; 
  int v7; 
  UINT64 AllocationType; 
  UINT64 Win32Protect; 
  LARGE_INTEGER SectionOffset; 
  struct _UNICODE_STRING DestinationString; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  SIZE_T CommitSize; 
  PVOID BaseAddressa; 
  _KAPC_STATE *ApcStatea; 
  CommitSize = (SIZE_T)SectionHandle;
  *(_QWORD *)&ObjectAttributes.Length = 48i64;
  v4 = 0;
  *(_QWORD *)&ObjectAttributes.Attributes = 576i64;
  *v3 = 0i64;
  v5 = v3;
  DestinationString = 0i64;
  RtlInitUnicodeString(&DestinationString, L"\\Device\\PhysicalMemory", (WCHAR)ApcState);
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = &DestinationString;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  if( ZwOpenSection((PVOID *)ApcState, 4ui64, &ObjectAttributes) >= 0 )
  {
    BaseAddressa = 0i64;
    CommitSize = 8i64;
    SectionOffset.QuadPart = 1044480i64;
    KiStackAttachProcess(PsInitialSystemProcess, 0i64, ApcStatea);
    LODWORD(Win32Protect) = 4;
    LODWORD(AllocationType) = 0;
    if( ZwMapViewOfSection(
           ApcState->ApcListHead[0].Flink,
           (PVOID)0xFFFFFFFFFFFFFFFFi64,
           &BaseAddressa,
           0i64,
           CommitSize,
           &SectionOffset,
           &CommitSize,
           ViewUnmap,
           AllocationType,
           Win32Protect) < 0 )
    {
      KiUnstackDetachProcess(ApcStatea, 0i64);
      ZwClose(ApcState->ApcListHead[0].Flink);
      ApcState->ApcListHead[0].Flink = 0i64;
    }
    else
    {
      v7 = (int)BaseAddressa;
      *v5 = BaseAddressa;
      return v7 + 4085;
    }
  }
  return v4;
}

Referenced by: