NtAllocateVirtualMemory

NTSTATUS __stdcall NtAllocateVirtualMemory(
        PVOID ProcessHandle,
        PVOID *BaseAddress,
        UINT64 ZeroBits,
        UINT64 *RegionSize,
        UINT64 AllocationType,
        UINT64 Protect){
  unsigned __int64 v8; 
  CHAR a8; 
  __int64 v10; 
  __int64 v11; 
  PVOID v12; 
  __int64 v13; 
  NTSTATUS VirtualMemoryPrepare; 
  INT64 a5; 
  INT64 a6; 
  INT64 a9; 
  INT64 a10; 
  INT8 v20; 
  unsigned __int64 v21; 
  PVOID v22; 
  PVOID v23; 
  UINT64 v24; 
  PVOID Object[3]; 
  INT64 a7[3]; 
  VOID *v27; 
  int v28; 
  char v29; 
  INT64 result[3]; 
  UINT64 v31; 
  v8 = 0i64;
  v23 = 0i64;
  v24 = 0i64;
  memset((INT64)a7, 0i64);
  a8 = *((_BYTE *)KeGetCurrentThread() + 562);
  v20 = a8;
  if( a8 )
  {
    v10 = (__int64)BaseAddress;
    if( (unsigned __int64)BaseAddress >= 0x7FFFFFFF0000i64 )
      v10 = 0x7FFFFFFF0000i64;
    *(_QWORD *)v10 = *(_QWORD *)v10;
    v11 = (__int64)RegionSize;
    if( (unsigned __int64)RegionSize >= 0x7FFFFFFF0000i64 )
      v11 = 0x7FFFFFFF0000i64;
    *(_QWORD *)v11 = *(_QWORD *)v11;
  }
  v12 = *BaseAddress;
  v23 = *BaseAddress;
  v13 = *RegionSize;
  v24 = *RegionSize;
  v28 = AllocationType & 0x7F;
  if( (AllocationType & 0x44000) != 0 )
    return -1073741811;
  memset((INT64)result, 0i64);
  v22 = 0i64;
  Object[0] = 0i64;
  v21 = 0i64;
  LODWORD(a10) = 0;
  LODWORD(a9) = 0;
  LODWORD(a6) = Protect;
  LODWORD(a5) = AllocationType & 0xFFFFFF80;
  VirtualMemoryPrepare = MiAllocateVirtualMemoryPrepare(
                           ProcessHandle,
                           (INT64)v12,
                           ZeroBits,
                           v13,
                           a5,
                           a6,
                           (INT64)a7,
                           a8,
                           a9,
                           a10,
                           0i64,
                           (INT64)result,
                           (INT64)Object);
  if( VirtualMemoryPrepare >= 0 )
  {
    if( v27 )
    {
      if( v27 == (VOID *)-3i64 )
      {
        v8 = 1i64;
        v21 = 1i64;
      }
      else
      {
        VirtualMemoryPrepare = PsReferencePartitionByHandle(v27, 2ui64, v20, 0x61566D4Dui64, &v21);
        v8 = v21;
        if( VirtualMemoryPrepare < 0 )
          goto LABEL_13;
      }
    }
    if( v29 == 1 && (AllocationType & 0x20400000) != 0x400000 )
    {
      VirtualMemoryPrepare = -1073741811;
LABEL_21:
      if( result[0] )
        ++dword_140C4E52C;
      else
        ++dword_140C4E528;
      goto LABEL_14;
    }
    VirtualMemoryPrepare = MiAllocateVirtualMemory((__int64)result, (__int64 *)v8, (__int64 *)&v22);
    if( VirtualMemoryPrepare >= 0 )
    {
      v12 = v22;
      v23 = v22;
      v13 = v31;
      v24 = v31;
    }
  }
LABEL_13:
  if( VirtualMemoryPrepare < 0 )
    goto LABEL_21;
LABEL_14:
  if( v8 >= 2 )
    PsDereferencePartition(v8);
  if( Object[0] )
    ObfDereferenceObjectWithTag(Object[0], 0x6D566D4Dui64);
  if( VirtualMemoryPrepare >= 0 )
  {
    *BaseAddress = v12;
    *RegionSize = v13;
  }
  return VirtualMemoryPrepare;
}

Referenced by: