KiDetermineRetpolineEnablement
void __fastcall KiDetermineRetpolineEnablement(__int64 a1, __int64 a2, CHAR a3){
UINT8 *v4;
__int64 v5;
UINT8 *v6;
__int64 v7;
__int64 v8;
__int128 v9;
v4 = *(UINT8 **)(a1 + 216);
v9 = 0i64;
if( !v4 || (strstr(v4, (UINT8 *)"SAFEBOOT:", a3), !v5) )
{
v6 = *(UINT8 **)(a1 + 216);
if( !v6 || (strstr(v6, (UINT8 *)"MININT", a3), !v7) )
{
if( (KiFeatureSettings & 0x20000) != 0 || (*(_DWORD *)(*(_QWORD *)(a1 + 240) + 132i64) & 0x1000) != 0 )
_InterlockedAnd((volatile signed __int32 *)&KiSpeculationFeatures, 0xFBFFFFFF);
else
_InterlockedOr((volatile signed __int32 *)&KiSpeculationFeatures, 0x4000000u);
if( !KiIsPgiKernel() )
{
KiDetectHardwareSpecControlFeatures((__int64)KeGetCurrentPrcb(), 0, &v9, 0i64);
if( (KiFeatureSettings & 5) == 0 && (v9 & 4) != 0 )
{
v8 = *(_QWORD *)(a1 + 240);
if( *(_DWORD *)(v8 + 3468) )
{
if( !*(_DWORD *)(v8 + 3464)
&& (v9 & 1) == 0
&& ((KiFeatureSettings & 0x200) != 0 || (KiFeatureSettings & 0x100) == 0 && (v9 & 0x200) == 0) )
{
_InterlockedOr((volatile signed __int32 *)&KiSpeculationFeatures, 0x2000000u);
}
}
}
}
}
}
}Referenced by:
KiInitializeBootStructures