NtInitializeEnclave

NTSTATUS __stdcall NtInitializeEnclave(
        VOID *ProcessHandle,
        VOID *BaseAddress,
        VOID *EnclaveInformation,
        UINT64 EnclaveInformationLength,
        UINT64 *EnclaveError){
  __int64 v5; 
  VOID *Pool; 
  char PreviousMode; 
  __int64 v10; 
  int v11; 
  _ETHREAD *CurrentThread; 
  _EPROCESS *Process; 
  VOID *v14; 
  UINT64 Tag; 
  char v17; 
  PVOID Object; 
  VOID *v19; 
  VOID *v20; 
  UINT64 *v21; 
  UINT64 a2; 
  _KAPC_STATE ApcState; 

  v5 = (unsigned int)EnclaveInformationLength;
  a2 = (UINT64)BaseAddress;
  v20 = ProcessHandle;
  v21 = EnclaveError;
  memset(&ApcState, 0, sizeof(ApcState));
  Object = 0i64;
  Pool = 0i64;
  v19 = 0i64;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  v17 = PreviousMode;
  if( EnclaveError && PreviousMode == 1 )
  {
    v10 = (__int64)EnclaveError;
    if( (unsigned __int64)EnclaveError >= 0x7FFFFFFF0000i64 )
      v10 = 0x7FFFFFFF0000i64;
    *(_DWORD *)v10 = *(_DWORD *)v10;
  }
  if( !(_DWORD)EnclaveInformationLength )
    goto LABEL_18;
  if( (unsigned int)EnclaveInformationLength <= 0x1000 )
  {
    Pool = MiAllocatePool(256i64, (unsigned int)EnclaveInformationLength, 0x44456D4Dui64);
    v19 = Pool;
    if( !Pool )
    {
      v11 = -1073741670;
      goto LABEL_23;
    }
    if( v17 == 1
      && (unsigned __int64)(v5 - 1) > 0xFFFE
      && (_DWORD)v5
      && ((unsigned __int64)EnclaveInformation + v5 > 0x7FFFFFFF0000i64
       || (char *)EnclaveInformation + v5 < EnclaveInformation) )
    {
      MEMORY[0x7FFFFFFF0000] = 0;
    }
    memmove(Pool, EnclaveInformation, v5);
    PreviousMode = v17;
LABEL_18:
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    Process = CurrentThread->Tcb.ApcState.Process;
    if( ProcessHandle == (VOID *)-1i64 )
    {
      Object = CurrentThread->Tcb.ApcState.Process;
    }
    else
    {
      LODWORD(Tag) = 1834380621;
      v11 = ObReferenceObjectByHandleWithTag(
              ProcessHandle,
              8ui64,
              (_OBJECT_TYPE *)PsProcessType,
              PreviousMode,
              Tag,
              &Object,
              0i64);
      if( v11 < 0 )
        goto LABEL_23;
      KeStackAttachProcess((PRKPROCESS)Object, &ApcState);
    }
    v11 = MiInitializeEnclave(Process, a2, Pool, (unsigned int)v5);
    goto LABEL_23;
  }
  v11 = -1073741820;
LABEL_23:
  v14 = Object;
  if( Object && ProcessHandle != (VOID *)-1i64 )
  {
    KeUnstackDetachProcess(&ApcState);
    ObfDereferenceObjectWithTag(v14, 0x6D566D4Dui64);
  }
  if( EnclaveError )
    *(_DWORD *)EnclaveError = 0;
  if( Pool )
    ExFreePoolWithTag(Pool, 0);
  return v11;
}

Referenced by: