PsLoadVsmEnclaveData

__int64 __fastcall PsLoadVsmEnclaveData(_EX_PUSH_LOCK *a1, UINT64 a2, unsigned int er8_0, unsigned int a4, INT64 a5){
  VOID **PoolWithTag; 
  NTSTATUS EnclaveData; 
  unsigned int v12; 
  int v13; 
  _ETHREAD *CurrentThread; 
  unsigned __int64 v15; 
  _RTL_BALANCED_NODE **v16; 
  BOOL v17; 
  _QWORD *bf_0; 
  _QWORD *v19; 
  _ETHREAD *v20; 
  unsigned int SessionId; 
  unsigned __int8 v22; 
  int v23; 
  _KLOCK_ENTRY *v24; 
  bool v25; 
  __int64 v26; 
  int v27; 
  unsigned int v28; 
  __int64 v29; 
  __int64 a3[6]; 
  INT64 v31; 

  LODWORD(v31) = 0;
  if( er8_0 == 4 )
  {
    PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x28ui64, 1950708560i64);
    if( !PoolWithTag )
      return 3221225626i64;
  }
  else
  {
    PoolWithTag = 0i64;
  }
  EnclaveData = VslLoadEnclaveData(a1[3]._bf_0, a2, er8_0, a4, a5, (INT64)&v31);
  v12 = EnclaveData;
  if( PoolWithTag )
  {
    if( EnclaveData < 0 )
    {
      ExFreePoolWithTag(PoolWithTag, 0);
    }
    else
    {
      v13 = v31;
      *((_DWORD *)PoolWithTag + 9) = 0;
      *((_DWORD *)PoolWithTag + 8) = v13;
      PoolWithTag[3] = (VOID *)a2;
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      --CurrentThread->Tcb.KernelApcDisable;
      v15 = (unsigned __int64)&a1[14];
      ExAcquirePushLockExclusiveEx(a1 + 14, 0i64);
      v16 = (_RTL_BALANCED_NODE **)&a1[13];
      v17 = 0;
      bf_0 = (_QWORD *)a1[13]._bf_0;
      if( bf_0 )
      {
        while( 1 )
        {
          if( MiHotPatchImageTreeCompare(a2, (INT64)bf_0) < 0 )
          {
            v19 = (_QWORD *)*bf_0;
            if( !*bf_0 )
            {
              v17 = 0;
              break;
            }
          }
          else
          {
            v19 = (_QWORD *)bf_0[1];
            if( !v19 )
            {
              v17 = 1;
              break;
            }
          }
          bf_0 = v19;
        }
      }
      RtlAvlInsertNodeEx(v16, (UINT64)bf_0, v17, (_RTL_BALANCED_NODE *)PoolWithTag);
      if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v15, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
        ExfTryToWakePushLock((_EX_PUSH_LOCK *)v15);
      LODWORD(a3[0]) = 0;
      v20 = (_ETHREAD *)KeGetCurrentThread();
      if( MiGetSystemRegionType(v15) == 1 )
        SessionId = MmGetSessionIdEx(v20->Tcb.ApcState.Process);
      else
        SessionId = -1;
      --v20->Tcb.SpecialApcDisable;
      v22 = ++v20->Tcb.AbAllocationRegionCount;
      v23 = ((char)v20->Tcb.AbEntrySummary | (char)v20->Tcb.AbOrphanedEntrySummary) ^ 0x3F;
      while( 1 )
      {
        v25 = !_BitScanReverse((unsigned int *)&v26, v23);
        if( v25 )
          goto LABEL_26;
        v24 = &v20->Tcb.LockEntries[v26];
        v23 &= ~(1 << v26);
        if( (v24->AcquiredByte & 1) != 0
          && (v24->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 1) == 0
          && (v24->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 & 0x7FFFFFFFFFFFFFFCi64) == (v15 & 0x7FFFFFFFFFFFFFFCi64)
          && v24->LockState.SessionId == SessionId )
        {
          v24->AcquiredByte &= ~1u;
          if( v24->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 )
            break;
        }
      }
      if( !v24 )
      {
LABEL_26:
        if( (*(&v20->Tcb.MiscFlags + 1) & 0x10000) == 0 )
          KeBugCheckEx(0x162u, v20, (PVOID)v15, (PVOID)SessionId, 0i64);
        goto LABEL_33;
      }
      v24->CrossThreadReleasableAndBusyByte |= 2u;
      if( v24->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 < 0 )
        KiAbEntryRemoveFromTree(v24);
      v27 = v24->BoostBitmap.AllFields & 0x1FFFF;
      v28 = v24->BoostBitmap.AllFields & 0xFFFE0000;
      v24->ThreadLocalFlags &= ~1u;
      LODWORD(a3[0]) = v27;
      v24->BoostBitmap.AllFields = v28;
      v24->LockState.$E8276A2CF8B819ED32D1B6FEB35D730A::_bf_0 = 0i64;
      v29 = v24 - v20->Tcb.LockEntries;
      if( v22 == 1 )
        v20->Tcb.AbEntrySummary |= 1 << v29;
      else
        _InterlockedOr8((volatile signed __int8 *)&v20->Tcb.AbOrphanedEntrySummary, 1 << v29);
LABEL_33:
      --v20->Tcb.AbAllocationRegionCount;
      KiAbThreadRemoveBoosts(&v20->Tcb, (VOID *)v15, (UINT64 *)a3);
      v25 = v20->Tcb.SpecialApcDisable++ == -1;
      if( v25 && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)v20->Tcb.ApcState.ApcListHead[0].Flink != &v20->Tcb.152 )
        KiCheckForKernelApcDelivery();
      KeLeaveCriticalRegionThread(KeGetCurrentThread());
    }
  }
  return v12;
}

Referenced by: