MiApplyRetpolineFixupsToKernelAndHal

INT64 __fastcall MiApplyRetpolineFixupsToKernelAndHal(INT64 a1){
  __int64 v1; 
  __int64 v3; 
  __int64 *v4; 
  unsigned int(*v5)(void); 
  unsigned int v6; 
  int updated; 
  char *v9; 
  IMAGE_NT_HEADERS *v10; 
  const CHAR *v11; 
  unsigned int v12; 
  int v13; 
  unsigned int v14; 
  INT64 v15; 
  __int64 v16; 
  IMAGE_NT_HEADERS *v17; 
  const CHAR *v18; 
  int v19; 
  __int64 *v20; 
  unsigned int v21; 
  __int64 v22; 
  const CHAR *v23; 
  PVOID a5; 
  UINT64 v25; 
  int v26; 
  INT64 a6; 
  INT64 a9; 
  __int64 v29; 
  INT64 a8; 
  INT64 a7[2]; 
  INT64 result[14]; 
  v1 = *(_QWORD *)(a1 + 240);
  v29 = 0i64;
  v3 = *(_QWORD *)(a1 + 16);
  dword_140C4C98C = *(_DWORD *)(v1 + 3468) >> 12;
  if( (KiSpeculationFeatures & 0x2000000) != 0
    && (v29 = v3,
        v9 = *(char **)(v3 + 48),
        v10 = RtlImageNtHeader(v9),
        v11 = RtlLookupImageSectionByName((INT64)v10, "RETPOL"),
        v12 = *((_DWORD *)v11 + 2),
        Base = &v9[*((unsigned int *)v11 + 3)],
        dword_140C4C9C8 = (v12 >> 12) + ((v12 & 0xFFF) != 0),
        dword_140C4C9C8 > (unsigned int)dword_140C4C98C) )
  {
    updated = -1073741811;
  }
  else if( ((KiSpeculationFeatures & 0x2000000) != 0 || (KiSpeculationFeatures & 0x4000000) != 0)
         && (MiFlags & 0x10000) != 0 )
  {
    v13 = KiSpeculationFeatures;
    v14 = (KiSpeculationFeatures >> 25) & 1;
    memset((INT64)result, 0i64);
    v15 = v14 | 2;
    if( (v13 & 0x4000000) == 0 )
      v15 = v14;
    result[1] = v15;
    updated = VslpEnterIumSecureMode(2u, 220, 0i64, (INT64)result);
  }
  else if( (KiSpeculationFeatures & 0x2000000) != 0 )
  {
    v16 = v29;
    v17 = RtlImageNtHeader(*(PVOID *)(v29 + 48));
    v18 = RtlLookupImageSectionByName((INT64)v17, "INITKDBG");
    v19 = 0;
    v20 = &v29;
    LODWORD(a7[0]) = *((_DWORD *)v18 + 3);
    v21 = 1;
    LODWORD(a8) = *((_DWORD *)v18 + 2);
    while( 1 )
    {
      v22 = *v20;
      v23 = RtlLookupImageSectionByName((INT64)v17, "MINIEX");
      a5 = Base;
      v25 = *(unsigned int *)(v22 + 64);
      v26 = *((_DWORD *)v23 + 3);
      *((_DWORD *)&a7[-1] + v21) = *((_DWORD *)v23 + 2);
      LODWORD(a9) = v21 + 1;
      *((_DWORD *)a7 + v21) = v26;
      LODWORD(a6) = 1;
      updated = RtlPerformRetpolineRelocationsOnImageEx(
                  *(PVOID *)(v22 + 48),
                  *(_QWORD *)(v22 + 48),
                  v25,
                  (INT64)a5,
                  (INT64)a5,
                  a6,
                  (INT64)a7,
                  (INT64)&a8,
                  a9);
      if( updated < 0 )
        break;
      v21 = 0;
      ++v19;
      ++v20;
      if( v19 )
      {
        updated = RtlCopyRetpolineStubsUnwindInfo(
                    *(VOID **)(v16 + 48),
                    *(_QWORD *)(v16 + 48),
                    (UINT64 *)Base,
                    (INT64)Base);
        if( updated < 0 )
          break;
        goto LABEL_6;
      }
    }
  }
  else
  {
LABEL_6:
    if( (KiSpeculationFeatures & 0x4000000) != 0 )
    {
      v4 = *(__int64 **)(a1 + 16);
      v5 = (unsigned int(*)(void))((unsigned __int64)MiIsBootImageTargetFullyRetpolined & -(__int64)((KiSpeculationFeatures & 0x2000000) != 0));
      v6 = 0;
      while( 1 )
      {
        updated = RtlUpdateImportRelocationsInImage(
                    (PVOID)v4[6],
                    v4[6],
                    *((unsigned int *)v4 + 16),
                    v5,
                    (__int64)Base,
                    (__int64)Base,
                    1,
                    (KiSpeculationFeatures & 0x2000000) == 0);
        if( ((updated + 0x80000000) & 0x80000000) == 0 && updated != -1073741637 )
          break;
        *((_DWORD *)v4 + 26) |= 0x80u;
        ++v6;
        v4 = (__int64 *)*v4;
        if( v6 >= 2 )
          goto LABEL_10;
      }
    }
    else
    {
LABEL_10:
      updated = 0;
    }
  }
  dword_140C4C9CC = updated;
  return(unsigned int)updated;
}

Referenced by: