MiCaptureBootDriverRetpolineInfo

NTSTATUS __stdcall MiCaptureBootDriverRetpolineInfo(PVOID Base, UINT64 Size, UINT64 *a3){
  __int64 v4; 
  NTSTATUS RetpolineRelocationInformation; 
  INT64 a5; 
  unsigned __int64 v8; 
  int v9; 
  INT64 v10; 
  INT64 a6; 
  UINT64 v13[2]; 
  __int128 v14; 
  INT64 a7; 
  __int64 v16; 

  LODWORD(a7) = 0;
  v16 = 0i64;
  v4 = (unsigned int)Size;
  *(_OWORD *)v13 = 0i64;
  v14 = 0i64;
  RetpolineRelocationInformation = RtlImageNtHeaderEx(0, (unsigned __int64)Base, (unsigned int)Size, &v16);
  if( RetpolineRelocationInformation >= 0 )
  {
    LODWORD(a5) = LdrImageDirectoryEntryToLoadConfig(Base);
    if( a5 && *(int *)a5 >= 228 )
    {
      v8 = *(_QWORD *)(a5 + 120);
      v9 = 0;
      if( v8 && v8 >= (unsigned __int64)Base && v8 < (unsigned __int64)Base + v4 - 8 )
        v9 = v8 - (_DWORD)Base;
      LODWORD(a6) = *(_DWORD *)a5;
      RetpolineRelocationInformation = MiCaptureDynamicRelocationTableRva(
                                         Base,
                                         (unsigned int)v4,
                                         0i64,
                                         *(_WORD *)(v16 + 24),
                                         a5,
                                         a6,
                                         (INT64)&a7);
      if( RetpolineRelocationInformation >= 0 )
      {
        RetpolineRelocationInformation = MiCaptureRetpolineRelocationTables(
                                           (CHAR *)Base,
                                           (unsigned int)v4,
                                           v10,
                                           (unsigned int)a7,
                                           v13);
        if( RetpolineRelocationInformation >= 0 )
        {
          RetpolineRelocationInformation = MiCreateRetpolineRelocationInformation((__int64)v13, v9, v4, a3);
          MiFreeImageRetpolineContext(v13);
        }
      }
    }
    else
    {
      return -1073741637;
    }
  }
  return RetpolineRelocationInformation;
}

Referenced by: