KiIsPgiKernel
INT8 __stdcall KiIsPgiKernel(){
_DWORD *v0;
_DWORD *i;
int v2;
_DWORD *v4;
_DWORD *v5;
UINT64 Size;
LODWORD(Size) = 0;
v0 = RtlImageDirectoryEntryToData((VOID *)0x140000000i64, 1u, 6u, &Size);
if( v0 )
{
for( i = &v0[7 * ((unsigned int)Size / 0x1Cui64)]; v0 < i; v0 += 7 )
{
v2 = v0[3];
if( v2 == 10 )
{
v4 = (_DWORD *)(0x140000000i64 + (unsigned int)v0[5]);
v5 = &v4[(unsigned __int64)(unsigned int)v0[4] >> 2];
while( v4 < v5 )
{
if( *v4 == 1346849024 )
return 1;
++v4;
}
}
else if( v2 == 13 && v0[4] >= 0x10u && *(_DWORD *)((unsigned int)v0[5] + 0x140000000i64) == 1346849024 )
{
return 1;
}
}
}
return 0;
}Referenced by:
KiDetermineRetpolineEnablement