NtCreateEnclave

NTSTATUS __stdcall NtCreateEnclave(
        VOID *ProcessHandle,
        VOID **BaseAddress,
        UINT64 ZeroBits,
        UINT64 Size,
        UINT64 InitialCommitment,
        UINT64 EnclaveType,
        VOID *EnclaveInformation,
        UINT64 EnclaveInformationLength,
        UINT64 *EnclaveError){
  VOID *Pool; 
  char PreviousMode; 
  __int64 v11; 
  UINT64 v12; 
  NTSTATUS Enclave; 
  int v14; 
  CHAR v15; 
  __int64 v16; 
  VOID *v17; 
  UINT64 Tag; 
  VOID **Object; 
  UINT64 v21; 
  CHAR AccessMode; 
  unsigned __int64 v25[2]; 
  PVOID Process; 
  UINT64 v27; 
  UINT64 ZeroBitsa[2]; 
  _KAPC_STATE ApcState; 

  v27 = Size;
  ZeroBitsa[1] = (UINT64)BaseAddress;
  ZeroBitsa[0] = ZeroBits;
  v25[1] = (unsigned __int64)EnclaveError;
  Process = 0i64;
  memset(&ApcState, 0, sizeof(ApcState));
  v25[0] = 0i64;
  Pool = 0i64;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  AccessMode = PreviousMode;
  if( EnclaveError && PreviousMode == 1 )
  {
    v11 = (__int64)EnclaveError;
    if( (unsigned __int64)EnclaveError >= 0x7FFFFFFF0000i64 )
      v11 = 0x7FFFFFFF0000i64;
    *(_DWORD *)v11 = *(_DWORD *)v11;
  }
  if( (_DWORD)EnclaveType == 1 )
  {
LABEL_16:
    if( *(&stru_140C4DB30 + 530) )
    {
      v14 = 4096;
      v12 = InitialCommitment;
      goto LABEL_18;
    }
LABEL_14:
    Enclave = -1073741637;
    goto LABEL_47;
  }
  if( (_DWORD)EnclaveType == 2 )
  {
    if( (UKUSER_SHARED_DATA.EnclaveFeatureMask[0] & 4) == 0 )
      goto LABEL_14;
    goto LABEL_16;
  }
  if( (unsigned int)(EnclaveType - 16) > 1 )
    goto LABEL_14;
  v12 = InitialCommitment;
  if( InitialCommitment )
  {
LABEL_10:
    Enclave = -1073741581;
    goto LABEL_47;
  }
  if( (unsigned int)EnclaveInformationLength > 0x24 )
    goto LABEL_12;
  v14 = 0;
LABEL_18:
  if( MiValidateZeroBits(ZeroBitsa) < 0 )
  {
    Enclave = -1073741583;
    goto LABEL_47;
  }
  if( !v27 )
  {
    Enclave = -1073741582;
    goto LABEL_47;
  }
  if( v12 > v27 )
    goto LABEL_10;
  v15 = AccessMode;
  if( AccessMode == 1 )
  {
    v16 = (__int64)BaseAddress;
    if( (unsigned __int64)BaseAddress >= 0x7FFFFFFF0000i64 )
      v16 = 0x7FFFFFFF0000i64;
    *(_QWORD *)v16 = *(_QWORD *)v16;
  }
  v25[0] = (unsigned __int64)*BaseAddress;
  if( (_DWORD)EnclaveInformationLength )
  {
    if( v14 && (_DWORD)EnclaveInformationLength != v14 )
    {
LABEL_12:
      Enclave = -1073741820;
      goto LABEL_47;
    }
    Pool = MiAllocatePool(
             256i64,
             ((unsigned int)EnclaveInformationLength + 4095i64) & 0xFFFFFFFFFFFFF000ui64,
             0x44456D4Dui64);
    if( !Pool )
    {
      Enclave = -1073741670;
      goto LABEL_47;
    }
    if( AccessMode == 1 )
    {
      if( (unsigned __int64)(unsigned int)EnclaveInformationLength - 1 > 0xFFFE )
      {
        if( ((unsigned __int8)EnclaveInformation & 3) != 0 )
          ExRaiseDatatypeMisalignment();
        if( (unsigned __int64)EnclaveInformation + (unsigned int)EnclaveInformationLength > 0x7FFFFFFF0000i64
          || (char *)EnclaveInformation + (unsigned int)EnclaveInformationLength < EnclaveInformation )
        {
          MEMORY[0x7FFFFFFF0000] = 0;
        }
      }
      else if( ((unsigned __int8)EnclaveInformation & 3) != 0 )
      {
        ExRaiseDatatypeMisalignment();
      }
    }
    memmove(Pool, EnclaveInformation, EnclaveInformationLength);
    v15 = AccessMode;
  }
  if( ProcessHandle == (VOID *)-1i64 )
  {
    v17 = KeGetCurrentThread()->ApcState.Process;
  }
  else
  {
    LODWORD(Tag) = 1834380621;
    Enclave = ObpReferenceObjectByHandleWithTag(
                ProcessHandle,
                8ui64,
                (_OBJECT_TYPE *)PsProcessType,
                v15,
                Tag,
                &Process,
                0i64,
                0i64);
    if( Enclave < 0 )
      goto LABEL_47;
    v17 = Process;
    KiStackAttachProcess(Process, 0i64, &ApcState);
  }
  LODWORD(v21) = EnclaveInformationLength;
  LODWORD(Object) = EnclaveType;
  Enclave = MiCreateEnclave((INT64)v17, v25, ZeroBitsa[0], v27, v12, (INT64)Object, (INT64)Pool, v21);
  if( ProcessHandle != (VOID *)-1i64 )
  {
    KiUnstackDetachProcess(&ApcState, 0i64);
    ObfDereferenceObjectWithTag(v17, 0x6D566D4Dui64);
  }
LABEL_47:
  if( Pool )
    ExFreePoolWithTag(Pool, 0);
  if( Enclave >= 0 )
    *BaseAddress = (VOID *)v25[0];
  if( EnclaveError )
    *(_DWORD *)EnclaveError = 0;
  return Enclave;
}

Referenced by: