NtAllocateVirtualMemory

NTSTATUS __fastcall NtAllocateVirtualMemory(
        VOID *ProcessHandle,
        VOID **BaseAddress,
        UINT64 ZeroBits,
        UINT64 *RegionSize,
        UINT64 AllocationType,
        UINT64 Protect){
  unsigned __int64 v8; 
  char v9; 
  __int64 v10; 
  __int64 v11; 
  VOID *v12; 
  unsigned __int64 v13; 
  NTSTATUS VirtualMemoryPrepare; 
  UINT64 *v15; 
  INT64 v17; 
  UINT64 v18; 
  UINT64 v19; 
  INT8 PreviousMode; 
  UINT64 InternalFlags; 
  _MMVAD_SHORT **OutVad; 
  _MMVAD_SHORT **OutVada; 
  CHAR v24; 
  unsigned __int64 v25; 
  UINT64 ZeroBitsa; 
  UINT64 v27; 
  UINT64 v28; 
  void *Object[3]; 
  INT8 v30[80]; 
  __int64 ProcessHandlea[16]; 

  v8 = 0i64;
  v27 = 0i64;
  v28 = 0i64;
  memset(v30, 0i64, 0x48u);
  v9 = KeGetCurrentThread()->PreviousMode;
  v24 = v9;
  if( v9 )
  {
    v10 = (__int64)BaseAddress;
    if( (unsigned __int64)BaseAddress >= 0x7FFFFFFF0000i64 )
      v10 = 0x7FFFFFFF0000i64;
    *(_QWORD *)v10 = *(_QWORD *)v10;
    v11 = (__int64)RegionSize;
    if( (unsigned __int64)RegionSize >= 0x7FFFFFFF0000i64 )
      v11 = 0x7FFFFFFF0000i64;
    *(_QWORD *)v11 = *(_QWORD *)v11;
  }
  v12 = *BaseAddress;
  v27 = (UINT64)*BaseAddress;
  v13 = *RegionSize;
  v28 = *RegionSize;
  *(_DWORD *)&v30[32] = AllocationType & 0x7F;
  if( (AllocationType & 0x44000) != 0 )
    return -1073741811;
  memset(ProcessHandlea, 0i64, sizeof(ProcessHandlea));
  ZeroBitsa = 0i64;
  Object[0] = 0i64;
  v25 = 0i64;
  LODWORD(OutVad) = 0;
  LODWORD(v17) = AllocationType & 0xFFFFFF80;
  VirtualMemoryPrepare = MiAllocateVirtualMemoryPrepare(
                           ProcessHandle,
                           (__int64)v12,
                           ZeroBits,
                           v13,
                           v17,
                           Protect,
                           (__int64)v30,
                           v9,
                           (INT64)OutVad,
                           0,
                           0i64,
                           (__int64)ProcessHandlea,
                           (__int64)Object);
  if( VirtualMemoryPrepare >= 0 )
  {
    if( *(_QWORD *)&v30[24] )
    {
      if( *(_QWORD *)&v30[24] == -3i64 )
      {
        v8 = 1i64;
        v25 = 1i64;
      }
      else
      {
        VirtualMemoryPrepare = PsReferencePartitionByHandle(*(VOID **)&v30[24], 2ui64, v24, 0x61566D4Du, &v25);
        v8 = v25;
        if( VirtualMemoryPrepare < 0 )
          goto LABEL_13;
      }
    }
    if( v30[48] == 1 && (AllocationType & 0x20400000) != 0x400000 )
    {
      VirtualMemoryPrepare = -1073741811;
LABEL_21:
      if( ProcessHandlea[0] )
        ++*(&stru_140C4DB30 + 639);
      else
        ++*(&stru_140C4DB30 + 638);
      goto LABEL_14;
    }
    VirtualMemoryPrepare = MiAllocateVirtualMemory(
                             ProcessHandlea,
                             (PVOID *)v8,
                             (UINT64)&ZeroBitsa,
                             v15,
                             v18,
                             v19,
                             PreviousMode,
                             InternalFlags,
                             OutVada);
    if( VirtualMemoryPrepare >= 0 )
    {
      v12 = (VOID *)ZeroBitsa;
      v27 = ZeroBitsa;
      v13 = ProcessHandlea[3];
      v28 = ProcessHandlea[3];
    }
  }
LABEL_13:
  if( VirtualMemoryPrepare < 0 )
    goto LABEL_21;
LABEL_14:
  if( v8 >= 2 )
    PsDereferencePartition(v8);
  if( Object[0] )
    ObfDereferenceObjectWithTag(Object[0], 0x6D566D4Dui64);
  if( VirtualMemoryPrepare >= 0 )
  {
    *BaseAddress = v12;
    *RegionSize = v13;
  }
  return VirtualMemoryPrepare;
}

Referenced by: