PsGetProcessEnclaveModuleInfo

INT64 __fastcall PsGetProcessEnclaveModuleInfo(INT64 a1, CHAR **a2, UINT64 *a3){
  _ETHREAD *CurrentThread; 
  int EnclaveModuleList; 
  unsigned int v6; 
  _DEVICE_OBJECT *PoolWithTag; 
  INT64 v8; 
  __int64 v9; 
  __int64 v10; 
  __int64 *v11; 
  __int64 v12; 
  __int64 *i; 
  __int64 v14; 
  __int64 v15; 
  __int64 *v16; 
  __int64 v17; 
  __int64 *j; 
  __int64 v19; 
  _ETHREAD *v20; 
  unsigned int SessionId; 
  char v22; 
  int v23; 
  bool v24; 
  __int64 v25; 
  unsigned __int64 v26; 
  int v27; 
  unsigned int v28; 
  __int64 v29; 
  UINT64 v30; 
  UINT64 v31; 
  int v33; 
  INT64 v34; 
  __int64 v35; 
  __int64 *v36; 
  _QWORD *v37; 
  unsigned int UniqueIdBuffer; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  UniqueIdBuffer = 0;
  EnclaveModuleList = 0;
  v6 = 0;
  PoolWithTag = 0i64;
  --*((_WORD *)CurrentThread + 242);
  v8 = a1 + 2264;
  v34 = a1 + 2264;
  ExAcquirePushLockExclusiveEx(a1 + 2264, 0i64);
  v9 = *(_QWORD *)(a1 + 2248);
  if( v9 )
  {
    v10 = *(_QWORD *)(v9 + 8);
    v11 = (__int64 *)v10;
    v35 = *(_QWORD *)(a1 + 2248);
    v36 = (__int64 *)v10;
    v37 = (_QWORD *)v10;
    while( 1 )
    {
      if( !v11 )
        goto LABEL_8;
      if( (*v11 & 0x8000000000000002ui64) == 0x8000000000000002ui64 )
      {
        v10 = (__int64)v37;
        v11 = v36;
      }
      v12 = *v11;
      if( (*v11 & 1) != 0 )
      {
LABEL_8:
        for( i = (__int64 *)(v10 + 8); ; ++i )
        {
          if( (unsigned __int64)i >= *(_QWORD *)(v9 + 8) + 8 * ((unsigned __int64)*(unsigned int *)(v9 + 4) >> 5) )
          {
            v12 = 0i64;
            goto LABEL_13;
          }
          v12 = *i;
          if( (*i & 1) == 0 )
            break;
        }
        v11 = (__int64 *)*i;
        v37 = i;
        v10 = (__int64)i;
        v36 = (__int64 *)v12;
      }
      else
      {
        v11 = (__int64 *)*v11;
        v36 = (__int64 *)v12;
      }
LABEL_13:
      if( !v12 )
        break;
      ++v6;
    }
    if( v6 )
    {
      PoolWithTag = (_DEVICE_OBJECT *)ExAllocatePoolWithTag(PagedPool, 16i64 * v6, 0x56455350ui64);
      if( PoolWithTag )
      {
        v14 = *(_QWORD *)(a1 + 2248);
        v35 = v14;
        v15 = *(_QWORD *)(v14 + 8);
        v37 = (_QWORD *)v15;
        v16 = (__int64 *)v15;
        v36 = (__int64 *)v15;
        do
        {
          if( !v16 )
            goto LABEL_25;
          if( (*v16 & 0x8000000000000002ui64) == 0x8000000000000002ui64 )
          {
            v15 = (__int64)v37;
            v16 = v36;
          }
          v17 = *v16;
          if( (*v16 & 1) != 0 )
          {
LABEL_25:
            for( j = (__int64 *)(v15 + 8); ; ++j )
            {
              if( (unsigned __int64)j >= *(_QWORD *)(v14 + 8) + 8 * ((unsigned __int64)*(unsigned int *)(v14 + 4) >> 5) )
              {
                v17 = 0i64;
                goto LABEL_30;
              }
              v19 = *j;
              if( (*j & 1) == 0 )
                break;
            }
            v16 = (__int64 *)*j;
            v37 = j;
            v15 = (__int64)j;
            v36 = (__int64 *)v19;
            v17 = v19;
          }
          else
          {
            v16 = (__int64 *)*v16;
            v36 = (__int64 *)v17;
          }
LABEL_30:
          if( !v17 )
            break;
          EnclaveModuleList = MmGetEnclaveModuleList(
                                *(_QWORD *)(v17 + 32),
                                (_QWORD *)PoolWithTag + 2 * UniqueIdBuffer,
                                (UINT64 *)PoolWithTag + 2 * UniqueIdBuffer + 1);
          if( EnclaveModuleList < 0 )
            break;
          ++UniqueIdBuffer;
        }
        while( UniqueIdBuffer < v6 );
        v8 = v34;
      }
      else
      {
        EnclaveModuleList = -1073741801;
      }
    }
  }
  if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v8, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock((volatile INT64 *)v8);
  v20 = (_ETHREAD *)KeGetCurrentThread();
  v33 = 0;
  if( (unsigned int)MiGetSystemRegionType(v8) == 1 )
    SessionId = MmGetSessionIdEx(*((_QWORD *)v20 + 23));
  else
    SessionId = -1;
  --*((_WORD *)v20 + 243);
  v22 = ++*((_BYTE *)v20 + 794);
  v23 = (*((char *)v20 + 792) | *((char *)v20 + 870)) ^ 0x3F;
  v24 = !_BitScanReverse((unsigned int *)&v25, v23);
  if( v24 )
    goto LABEL_47;
  while( 1 )
  {
    v26 = *((_QWORD *)v20 + 100) + 96 * v25;
    v23 &= ~(1 << v25);
    if( (*(_BYTE *)(v26 + 26) & 1) != 0
      && (*(_DWORD *)(v26 + 32) & 1) == 0
      && (*(_QWORD *)(v26 + 32) & 0x7FFFFFFFFFFFFFFCi64) == (v8 & 0x7FFFFFFFFFFFFFFCi64)
      && *(_DWORD *)(v26 + 40) == SessionId )
    {
      *(_BYTE *)(v26 + 26) &= ~1u;
      if( *(_QWORD *)(v26 + 32) )
        break;
    }
    v24 = !_BitScanReverse((unsigned int *)&v25, v23);
    if( v24 )
      goto LABEL_47;
  }
  if( !v26 )
  {
LABEL_47:
    if( (*((_DWORD *)v20 + 30) & 0x10000) == 0 )
      KeBugCheckEx(0x162u, (ULONG_PTR)v20, v8, SessionId, 0i64);
  }
  else
  {
    *(_BYTE *)(v26 + 32) |= 2u;
    if( *(__int64 *)(v26 + 32) < 0 )
      KiAbEntryRemoveFromTree(v26);
    v27 = *(_DWORD *)(v26 + 88) & 0x1FFFF;
    v28 = *(_DWORD *)(v26 + 88) & 0xFFFE0000;
    *(_BYTE *)(v26 + 25) &= ~1u;
    v33 = v27;
    *(_DWORD *)(v26 + 88) = v28;
    *(_QWORD *)(v26 + 32) = 0i64;
    v29 = (__int64)(v26 - *((_QWORD *)v20 + 100)) / 96;
    if( v22 == 1 )
      *((_BYTE *)v20 + 792) |= 1 << v29;
    else
      _InterlockedOr8((volatile signed __int8 *)v20 + 870, 1 << v29);
  }
  --*((_BYTE *)v20 + 794);
  KiAbThreadRemoveBoosts((ULONG_PTR)v20, v8, (unsigned int *)&v33);
  v24 = (*((_WORD *)v20 + 243))++ == 0xFFFF;
  if( v24 && *((_ETHREAD **)v20 + 19) != (_ETHREAD *)((char *)v20 + 152) )
    KiCheckForKernelApcDelivery();
  KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  if( EnclaveModuleList < 0 )
  {
    PsFreeEnclaveModuleInfo(PoolWithTag, (VOID *)UniqueIdBuffer, v30, v31);
  }
  else
  {
    *a2 = (CHAR *)PoolWithTag;
    *(_DWORD *)a3 = v6;
  }
  return(unsigned int)EnclaveModuleList;
}

Referenced by: