KiIsPgiKernel

INT8 __stdcall KiIsPgiKernel(){
  _DWORD *v0; 
  _DWORD *i; 
  int v2; 
  _DWORD *v4; 
  _DWORD *v5; 
  UINT64 Size; 

  LODWORD(Size) = 0;
  v0 = RtlImageDirectoryEntryToData((VOID *)0x140000000i64, 1u, 6u, &Size);
  if( v0 )
  {
    for( i = &v0[7 * ((unsigned int)Size / 0x1Cui64)]; v0 < i; v0 += 7 )
    {
      v2 = v0[3];
      if( v2 == 10 )
      {
        v4 = (_DWORD *)(0x140000000i64 + (unsigned int)v0[5]);
        v5 = &v4[(unsigned __int64)(unsigned int)v0[4] >> 2];
        while( v4 < v5 )
        {
          if( *v4 == 1346849024 )
            return 1;
          ++v4;
        }
      }
      else if( v2 == 13 && v0[4] >= 0x10u && *(_DWORD *)((unsigned int)v0[5] + 0x140000000i64) == 1346849024 )
      {
        return 1;
      }
    }
  }
  return 0;
}

Referenced by:

KiDetermineRetpolineEnablement