NtInitializeEnclave

NTSTATUS __stdcall NtInitializeEnclave(
        PVOID ProcessHandle,
        PVOID BaseAddress,
        PVOID EnclaveInformation,
        UINT64 EnclaveInformationLength,
        UINT64 *EnclaveError){
  UINT64 v5; 
  UINT8 *v8; 
  KPROCESSOR_MODE v9; 
  __int64 v10; 
  NTSTATUS v11; 
  UINT8 *v12; 
  _ETHREAD *CurrentThread; 
  _EPROCESS *v14; 
  PVOID v15; 
  KPROCESSOR_MODE v17; 
  PVOID Object; 
  UINT8 *v19; 
  PVOID v20; 
  UINT64 *v21; 
  UINT64 a2; 
  struct _KAPC_STATE ApcState; 
  v5 = (unsigned int)EnclaveInformationLength;
  a2 = (UINT64)BaseAddress;
  v20 = ProcessHandle;
  v21 = EnclaveError;
  memset(&ApcState, 0, sizeof(ApcState));
  Object = 0i64;
  v8 = 0i64;
  v19 = 0i64;
  v9 = *((_BYTE *)KeGetCurrentThread() + 562);
  v17 = v9;
  if( EnclaveError && v9 == 1 )
  {
    v10 = (__int64)EnclaveError;
    if( (unsigned __int64)EnclaveError >= 0x7FFFFFFF0000i64 )
      v10 = 0x7FFFFFFF0000i64;
    *(_DWORD *)v10 = *(_DWORD *)v10;
  }
  if( !(_DWORD)EnclaveInformationLength )
    goto LABEL_18;
  if( (unsigned int)EnclaveInformationLength <= 0x1000 )
  {
    LODWORD(v12) = MiAllocatePool((struct _SLIST_ENTRY *)0x100);
    v8 = v12;
    v19 = v12;
    if( !v12 )
    {
      v11 = -1073741670;
      goto LABEL_23;
    }
    if( v17 == 1
      && v5 - 1 > 0xFFFE
      && (_DWORD)v5
      && ((unsigned __int64)EnclaveInformation + v5 > 0x7FFFFFFF0000i64
       || (char *)EnclaveInformation + v5 < EnclaveInformation) )
    {
      MEMORY[0x7FFFFFFF0000] = 0;
    }
    memmove(v12, (UINT8 *)EnclaveInformation, v5);
    v9 = v17;
LABEL_18:
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    v14 = (_EPROCESS *)*((_QWORD *)CurrentThread + 23);
    if( ProcessHandle == (PVOID)-1i64 )
    {
      Object = (PVOID)*((_QWORD *)CurrentThread + 23);
    }
    else
    {
      v11 = ObReferenceObjectByHandleWithTag(
              ProcessHandle,
              8u,
              (POBJECT_TYPE)PsProcessType,
              v9,
              0x6D566D4Du,
              &Object,
              0i64);
      if( v11 < 0 )
        goto LABEL_23;
      KeStackAttachProcess((PRKPROCESS)Object, &ApcState);
    }
    v11 = MiInitializeEnclave(v14, a2, v8, v5);
    goto LABEL_23;
  }
  v11 = -1073741820;
LABEL_23:
  v15 = Object;
  if( Object && ProcessHandle != (PVOID)-1i64 )
  {
    KeUnstackDetachProcess(&ApcState);
    ObfDereferenceObjectWithTag(v15, 0x6D566D4Dui64);
  }
  if( EnclaveError )
    *(_DWORD *)EnclaveError = 0;
  if( v8 )
    ExFreePoolWithTag(v8, 0);
  return v11;
}

Referenced by: