MiAllocateEnclaveVad

__int64 __fastcall MiAllocateEnclaveVad(int a1, UINT64 a2, unsigned __int64 a3, INT64 a4, _QWORD *a5){
  unsigned __int64 v5; 
  _ETHREAD *CurrentThread; 
  _BOOL4 v9; 
  _EPROCESS *Process; 
  UINT64 ProtectionMask; 
  _DWORD *Pool; 
  _DWORD *v13; 
  _MMPTE *v15; 
  VOID *v16; 
  NTSTATUS inserted; 
  _KTBFLUSH_TYPE v18; 
  void *v19; 
  int v20; 
  UINT64 v21; 
  UINT64 v22; 
  int v23; 
  unsigned __int64 v24; 
  UINT64 v25; 
  _EPROCESS *v26; 
  UINT64 *HINTHonored; 
  PVOID *v28; 

  v5 = a3;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v9 = (unsigned int)(a1 - 16) <= 1;
  Process = CurrentThread->Tcb.ApcState.Process;
  if( a2 >= 0xFFFFFFFFFFFFF000ui64 || a2 == 0 )
    return 3221225485i64;
  if( (unsigned int)(a1 - 16) > 1 )
  {
    ProtectionMask = a2;
    if( ((a2 - 1) & a2) != 0 )
      ProtectionMask = a2 & ~(a2 - 1);
    if( ProtectionMask < 0x10000 )
      ProtectionMask = 0x10000i64;
    if( ProtectionMask >= 0x7FFFFFFF0000i64 )
      return 3221225485i64;
  }
  else
  {
    ProtectionMask = 0x200000i64;
  }
  if( a2 >= 0x7FFFFFFF0000i64
    || a3 && (a3 > 0x7FFFFFFEFFFFi64 || 0x7FFFFFFF0000i64 - a3 < a2 || ((ProtectionMask - 1) & a3) != 0 || a4) )
  {
    return 3221225485i64;
  }
  Pool = MiAllocatePool(64i64, 0x88ui64, 0x45646156ui64);
  v13 = Pool;
  if( !Pool )
    return 3221225626i64;
  if( v9 )
  {
LABEL_29:
    v20 = v13[12];
    *((_QWORD *)v13 + 5) = 0i64;
    *((_QWORD *)v13 + 2) = -2i64;
    v13[12] = v20 & 0xFDEFF07F | 0x2100200;
    LOCK_ADDRESS_SPACE(CurrentThread, Process);
    LODWORD(v21) = MiGetUserReservationHighestAddress((INT64)Process, a4);
    if( v5 )
    {
      v22 = (v5 + a2 - 1) | 0xFFF;
      MiIsVaRangeAvailable(Process, (VOID *)v5, v22 - v5 + 1, 0i64);
      if( !v23 )
      {
        inserted = -1073741800;
        goto LABEL_23;
      }
    }
    else
    {
      LODWORD(v28) = 0;
      LODWORD(HINTHonored) = 6;
      inserted = MiSelectUserAddress(0i64, 0i64, v21, a2, ProtectionMask, 0i64, HINTHonored, v28);
      if( inserted < 0 )
        goto LABEL_23;
      v5 = 0i64;
      v22 = a2 - 1;
    }
    v24 = v5 >> 12;
    v25 = v22 >> 12;
    *((_BYTE *)v13 + 32) = BYTE4(v24);
    *((_BYTE *)v13 + 33) = BYTE4(v25);
    v13[6] = v24;
    v13[7] = v25;
    inserted = MiInsertVadCharges((_MMVAD_SHORT *)v13, (ULONG_PTR)Process);
    if( inserted >= 0 )
    {
      MiLockVad(CurrentThread, (_MMVAD_SHORT *)v13);
      MiInsertPrivateVad((_MMVAD_SHORT *)v13, (_MI_PHYSICAL_VIEW *)Process, v26);
      MiReferenceVad((_MMVAD_SHORT *)v13);
      UNLOCK_ADDRESS_SPACE_UNORDERED(CurrentThread, Process);
      *a5 = v13;
      return 0i64;
    }
    goto LABEL_23;
  }
  Pool[16] |= 1u;
  v15 = MiReservePtes((_MI_SYSTEM_PTE_TYPE *)((char *)&stru_140C4DB30 + 4432), 1ui64);
  *((_QWORD *)v13 + 10) = v15;
  if( !v15 )
  {
    ExFreePoolWithTag(v13, 0);
    return 3221225626i64;
  }
  if( a1 != 2
    || (v13[18] |= 1u, v16 = MiAllocatePool(64i64, 0x1000ui64, 0x6E45694Dui64), (*((_QWORD *)v13 + 11) = v16) != 0i64) )
  {
    v13[12] = v13[12] & 0xFFFFFF8F | 0x30;
    *((_QWORD *)v13 + 15) = 0i64;
    goto LABEL_29;
  }
  inserted = -1073741670;
LABEL_23:
  UNLOCK_ADDRESS_SPACE(CurrentThread, Process);
  if( (v13[16] & 1) != 0 )
  {
    v19 = (void *)*((_QWORD *)v13 + 11);
    if( v19 )
      ExFreePoolWithTag(v19, 0);
    MiReleasePtes((_MI_SYSTEM_PTE_TYPE *)((char *)&stru_140C4DB30 + 4432), *((_MMPTE **)v13 + 10), 1ui64, v18);
  }
  ExFreePoolWithTag(v13, 0);
  return(unsigned int)inserted;
}

Referenced by: