MiCreateHardwareEnclave

NTSTATUS __stdcall MiCreateHardwareEnclave(INT64 a1, INT64 a2, UINT64 a3, VOID *a4){
  _ETHREAD *CurrentThread; 
  _EPROCESS *Process; 
  unsigned __int64 v8; 
  _MI_PARTITION *VmPartition; 
  int Enclave; 
  UINT64 v12; 
  INT64 v13; 
  UINT64 v14; 
  __int64 v15; 
  __int64 v16; 
  int v17; 
  _EWOW64PROCESS *WoW64Process; 
  unsigned __int16 Machine; 
  bool v20; 
  int v21; 
  _QWORD *v22; 
  _QWORD *v23; 
  UINT64 *v24; 
  UINT64 *ReturnedError; 
  VOID *EnclaveBaseAddress; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  Process = CurrentThread->Tcb.ApcState.Process;
  EnclaveBaseAddress = (VOID *)((*(unsigned int *)(a2 + 24) | ((unsigned __int64)*(unsigned __int8 *)(a2 + 32) << 32)) << 12);
  v8 = ((*(unsigned int *)(a2 + 28) | ((unsigned __int64)*(unsigned __int8 *)(a2 + 33) << 32)) << 12) | 0xFFF;
  VmPartition = MiGetVmPartition(&Process->Vm, (_EPROCESS *)a2);
  if( !ExAcquireRundownProtection((_EX_RUNDOWN_REF *)&stru_140C4DB30 + 538) )
    return -1073741558;
  if( !a3 || (Enclave = MiReserveEnclavePages(a2, (INT64)VmPartition, (a3 >> 12) + ((a3 & 0xFFF) != 0)), Enclave >= 0) )
  {
    LODWORD(v12) = MiGetEnclavePage(VmPartition, 0i64);
    v13 = v12;
    if( v12 == -1i64 )
    {
      Enclave = -1073741801;
    }
    else
    {
      v14 = *(_QWORD *)(a2 + 80);
      MiInitializeEnclavePfn(v12, (_MMPTE *)v14, 4ui64);
      LODWORD(v15) = MiMakeValidPte((_XSTATE_CONFIGURATION *)v14, v13, 2684354564i64);
      v16 = v15;
      LOBYTE(v17) = MiPteInShadowRange(v14);
      if( v17 && (KeGetCurrentThread()->ApcState.Process->Flags3 & 0x1000) != 0 && (v16 & 1) != 0 )
        v16 |= 0x8000000000000000ui64;
      *(_QWORD *)v14 = v16;
      WoW64Process = Process->WoW64Process;
      v20 = 0;
      if( WoW64Process )
      {
        Machine = WoW64Process->Machine;
        if( Machine == 332 || Machine == 452 )
          v20 = 1;
      }
      v21 = ((*(_DWORD *)(a2 + 72) & 1) << 8) | 1;
      if( v20 )
        v21 = (*(_DWORD *)(a2 + 72) & 1) << 8;
      LODWORD(ReturnedError) = v21;
      Enclave = KeCreateEnclave(
                  (VOID *)((__int64)((v14 << 25) - ((_QWORD)MmGetPteBase() << 25)) >> 16),
                  EnclaveBaseAddress,
                  v8 - (_QWORD)EnclaveBaseAddress + 1,
                  a4,
                  v24,
                  ReturnedError);
      if( Enclave >= 0 )
      {
        *(_QWORD *)(a2 + 112) = Process;
        --CurrentThread->Tcb.SpecialApcDisable;
        ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)&stru_140C4DB30 + 537, 0i64);
        v22 = (_QWORD *)*(&stru_140C4DB30 + 536);
        v23 = (_QWORD *)(a2 + 120);
        if( (_UNKNOWN *)**(&stru_140C4DB30 + 536) != (_UNKNOWN *)((char *)&stru_140C4DB30 + 4280) )
          __fastfail(3u);
        *v23 = (char *)&stru_140C4DB30 + 4280;
        v23[1] = v22;
        *v22 = v23;
        *(&stru_140C4DB30 + 536) = v23;
        if( (_InterlockedExchangeAdd64((_QWORD *)&stru_140C4DB30 + 537, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
          ExfTryToWakePushLock((_EX_PUSH_LOCK *)&stru_140C4DB30 + 537);
        KeAbPostRelease((char *)&stru_140C4DB30 + 4296);
        KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
        Enclave = 0;
      }
    }
  }
  ExReleaseRundownProtection((_EX_RUNDOWN_REF *)&stru_140C4DB30 + 538);
  return Enclave;
}

Referenced by: