RtlFindHotPatchInformation

NTSTATUS __stdcall RtlFindHotPatchInformation(VOID *Base){
  __int64 v2; 
  __int64 v3; 
  char *v4; 
  char *v5; 
  __int64 v6; 
  unsigned int v7; 
  char *v8; 
  unsigned int v9; 
  unsigned int v10; 
  unsigned int v11; 
  unsigned int v12; 
  NTSTATUS v13; 
  UINT64 Size; 

  LODWORD(Size) = 0;
  LODWORD(v2) = RtlImageNtHeader((UINT64)Base);
  v3 = v2;
  v4 = (char *)RtlImageDirectoryEntryToData(Base, 1u, 0xAu, &Size);
  if( !v4 )
    return 0;
  if( (unsigned int)Size <= 4 )
    return 0;
  if( (_DWORD)Size != *(_DWORD *)v4 )
    return 0;
  if( (unsigned int)Size < 0xF4 )
    return 0;
  if( &v4[(unsigned int)Size] < v4 )
    return 0;
  v5 = (char *)Base + *(unsigned int *)(v3 + 80);
  if( v4 >= v5 )
    return 0;
  if( &v4[(unsigned int)Size] > v5 )
    return 0;
  _mm_lfence();
  v6 = *((unsigned int *)v4 + 60);
  if( (unsigned int)v6 >= 0xFFFFFFF8 || (_DWORD)v6 == 0 )
    return 0;
  v7 = *(_DWORD *)(v3 + 80);
  if( (int)v6 + 8 > v7 )
    return 0;
  v8 = (char *)Base + v6;
  switch( *(_DWORD *)((char *)Base + v6) )
  {
    case 1:
      v9 = 20;
      break;
    case 2:
      v9 = 24;
      break;
    case 3:
      v9 = 28;
      break;
    default:
      return 0;
  }
  v10 = *((_DWORD *)v8 + 1);
  if( v10 >= v9 )
  {
    if( *((_DWORD *)v8 + 2) )
    {
      if( v10 + (unsigned int)v6 > v10 && v10 + (unsigned int)v6 <= v7 )
      {
        v11 = *((_DWORD *)v8 + 4);
        if( v11 <= 0x3FFFFFF9 )
        {
          v12 = 4 * v11 + *((_DWORD *)v8 + 3);
          if( v12 > 4 * v11 && v12 <= v10 && v11 == 1 && RtlFindHotPatchBase((UINT64 *)v8) )
            return v13;
        }
      }
    }
  }
  return 0;
}

Referenced by: