MiAllocateEnclaveVad

INT64 __stdcall MiAllocateEnclaveVad(UINT64 Size, PVOID rdx0, UINT64 ZeroBits){
  INT64 v3; 
  UINT64 v4; 
  _ETHREAD *CurrentThread; 
  int v7; 
  _BOOL8 v8; 
  _EPROCESS *v9; 
  UINT64 ProtectionMask; 
  __int64 v11; 
  __int64 v12; 
  INT64 v14; 
  __int64 v15; 
  int inserted; 
  void *v17; 
  int v18; 
  UINT64 UserReservationHighestAddress; 
  unsigned __int64 v20; 
  int v21; 
  UINT64 v22; 
  unsigned __int64 v23; 
  UINT64 *HINTHonored; 
  PVOID *v25; 
  INT64 v26; 
  __int64 *v27; 
  v26 = v3;
  v4 = ZeroBits;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v7 = Size;
  v8 = (unsigned int)(Size - 16) <= 1;
  v9 = (_EPROCESS *)*((_QWORD *)CurrentThread + 23);
  if( (unsigned __int64)rdx0 >= 0xFFFFFFFFFFFFF000ui64 || (char *)rdx0 + 4096 == (PVOID)4096 )
    return 3221225485i64;
  if( (unsigned int)(Size - 16) > 1 )
  {
    ProtectionMask = (UINT64)rdx0;
    if( (((unsigned __int64)rdx0 - 1) & (unsigned __int64)rdx0) != 0 )
      ProtectionMask = (unsigned __int64)rdx0 & ~((__int64)rdx0 - 1);
    if( ProtectionMask < 0x10000 )
      ProtectionMask = 0x10000i64;
    if( ProtectionMask >= 0x7FFFFFFF0000i64 )
      return 3221225485i64;
  }
  else
  {
    ProtectionMask = 0x200000i64;
  }
  if( (unsigned __int64)rdx0 >= 0x7FFFFFFF0000i64
    || ZeroBits
    && (ZeroBits > 0x7FFFFFFEFFFFi64
     || 0x7FFFFFFF0000i64 - ZeroBits < (unsigned __int64)rdx0
     || ((ProtectionMask - 1) & ZeroBits) != 0
     || v3) )
  {
    return 3221225485i64;
  }
  LODWORD(v11) = MiAllocatePool((struct _SLIST_ENTRY *)0x40);
  v12 = v11;
  if( !v11 )
    return 3221225626i64;
  if( v8 )
  {
LABEL_29:
    v18 = *(_DWORD *)(v12 + 48);
    *(_QWORD *)(v12 + 40) = 0i64;
    *(_QWORD *)(v12 + 16) = -2i64;
    *(_DWORD *)(v12 + 48) = v18 & 0xFDEFF07F | 0x2100200;
    LOCK_ADDRESS_SPACE((__int64)CurrentThread, (__int64)v9);
    UserReservationHighestAddress = MiGetUserReservationHighestAddress((INT64)v9, v26);
    if( v4 )
    {
      v20 = ((unsigned __int64)rdx0 + v4 - 1) | 0xFFF;
      MiIsVaRangeAvailable(v9, (VOID *)v4, v20 - v4 + 1, 0i64);
      if( !v21 )
      {
        inserted = -1073741800;
        goto LABEL_23;
      }
    }
    else
    {
      LODWORD(v25) = 0;
      LODWORD(HINTHonored) = 6;
      inserted = MiSelectUserAddress(
                   0i64,
                   0i64,
                   UserReservationHighestAddress,
                   (UINT64)rdx0,
                   ProtectionMask,
                   0i64,
                   HINTHonored,
                   v25);
      if( inserted < 0 )
        goto LABEL_23;
      v4 = 0i64;
      v20 = (unsigned __int64)rdx0 - 1;
    }
    v22 = v4 >> 12;
    v23 = v20 >> 12;
    *(_BYTE *)(v12 + 32) = BYTE4(v22);
    *(_BYTE *)(v12 + 33) = BYTE4(v23);
    *(_DWORD *)(v12 + 24) = v22;
    *(_DWORD *)(v12 + 28) = v23;
    inserted = MiInsertVadCharges(v12, (ULONG_PTR)v9);
    if( inserted >= 0 )
    {
      MiLockVad((__int64)CurrentThread, v12);
      MiInsertPrivateVad(v12, (INT64)v9);
      MiReferenceVad(v12);
      UNLOCK_ADDRESS_SPACE_UNORDERED((__int64)CurrentThread, (__int64)v9);
      *v27 = v12;
      return 0i64;
    }
    goto LABEL_23;
  }
  *(_DWORD *)(v11 + 64) |= 1u;
  v14 = MiReservePtes((INT64)&qword_140C4EC80, 1ui64);
  *(_QWORD *)(v12 + 80) = v14;
  if( !v14 )
  {
    ExFreePoolWithTag((PVOID)v12, 0);
    return 3221225626i64;
  }
  if( v7 != 2
    || (*(_DWORD *)(v12 + 72) |= 1u,
        LODWORD(v15) = MiAllocatePool((struct _SLIST_ENTRY *)0x40),
        (*(_QWORD *)(v12 + 88) = v15) != 0i64) )
  {
    *(_DWORD *)(v12 + 48) = *(_DWORD *)(v12 + 48) & 0xFFFFFF8F | 0x30;
    *(_QWORD *)(v12 + 120) = 0i64;
    goto LABEL_29;
  }
  inserted = -1073741670;
LABEL_23:
  UNLOCK_ADDRESS_SPACE((__int64)CurrentThread, (__int64)v9);
  if( (*(_DWORD *)(v12 + 64) & 1) != 0 )
  {
    v17 = *(void **)(v12 + 88);
    if( v17 )
      ExFreePoolWithTag(v17, 0);
    MiReleasePtes((INT64)&qword_140C4EC80, *(_QWORD *)(v12 + 80), 1ui64);
  }
  ExFreePoolWithTag((PVOID)v12, 0);
  return(unsigned int)inserted;
}

Referenced by: