KeQuerySpeculationControlInformation

INT64 __stdcall KeQuerySpeculationControlInformation(UINT8 *dst, size_t Size, UINT64 *a3){
  unsigned int v5; 
  unsigned int v6; 
  int v7; 
  ULONG_PTR v8; 
  int v9; 
  int v10; 
  __int64 v11; 
  unsigned int v12; 
  int v13; 
  int v14; 
  char v15; 
  unsigned __int64 Src; 
  if( (unsigned int)Size >= 4 )
  {
    v5 = Size;
    if( (unsigned int)Size >= 8 )
      v5 = 8;
    *(_DWORD *)a3 = v5;
    v6 = (((KiSpeculationFeatures & 0x100000) != 0) ^ (unsigned __int8)(KiSpeculationFeatures >> 17)) & 2 ^ (KiSpeculationFeatures >> 20) & 1;
    Src = ((unsigned __int8)v6 ^ (unsigned __int8)(KiSpeculationFeatures >> 17)) & 4 ^ (unsigned __int64)v6;
    v7 = 16;
    if( (KiSpeculationFeatures & 0x10) != 0 || (KiSpeculationFeatures & 0x40) != 0 )
      LODWORD(Src) = Src | 8;
    if( (KiSpeculationFeatures & 4) != 0 )
      LODWORD(Src) = Src | 0x10;
    if( (KiSpeculationFeatures & 0x100000) != 0 && (KiSpeculationFeatures & 0x200000) != 0 )
      LODWORD(Src) = Src | 0x2000;
    LODWORD(Src) = ((unsigned __int8)Src ^ (unsigned __int8)(2 * KiSpeculationFeatures)) & 0x20 ^ Src;
    LODWORD(Src) = (((unsigned __int8)Src ^ (unsigned __int8)KiSpeculationFeatures) & 0x40 ^ Src) & 0xFFFFFF7F | (4 * (KiSpeculationFeatures & 0x20 | 0x40));
    LODWORD(Src) = ((unsigned __int16)Src ^ (unsigned __int16)(4 * KiSpeculationFeatures)) & 0x200 ^ Src;
    LODWORD(Src) = ((unsigned __int16)Src ^ (unsigned __int16)(KiSpeculationFeatures >> 12)) & 0x400 ^ Src;
    LODWORD(Src) = ((unsigned __int16)Src ^ (unsigned __int16)(KiSpeculationFeatures >> 12)) & 0x800 ^ Src;
    LODWORD(Src) = ((unsigned __int16)Src ^ (unsigned __int16)~(16 * KiSpeculationFeatures)) & 0x1000 ^ Src;
    LODWORD(Src) = ((unsigned __int16)Src ^ (unsigned __int16)(KiSpeculationFeatures >> 11)) & 0x4000 ^ Src;
    LODWORD(Src) = (Src ^ (KiSpeculationFeatures >> 11)) & 0x8000 ^ Src;
    v8 = KeFeatureBits2;
    v15 = KiKvaShadow;
    if( !(_BYTE)KiKvaShadow || (v9 = 637534208, (KeFeatureBits2 & 8) == 0) )
      v9 = 603979776;
    v10 = v9 | Src & 0xFCFEFFFF | ((_DWORD)KeFeatureBits2 << 19) & 0x1000000 | ((KiSpeculationFeatures & 1 | 0x80) << 16) & 0xFDFFFFFF;
    v11 = (unsigned __int16)KeFeatureBits2 & 0x8000;
    if( (KeFeatureBits2 & 0x8000) != 0 && KiDisableTsx || !KiTsxSupported )
    {
      v12 = v10 | 0x18000000;
    }
    else if( (KeFeatureBits2 & 0x10000) != 0 || (KeFeatureBits2 & 0x28) == 8 && (unsigned int)KeKvaShadowingActive() )
    {
      v12 = v10 & 0xE7FFFFFF | 0x10000000;
    }
    else if( v11 )
    {
      v12 = v10 & 0xE7FFFFFF | 0x8000000;
    }
    else
    {
      v12 = v10 & 0xE7FFFFFF;
    }
    if( (v8 & 0x10000) != 0 || !KiTsxSupportedAtBoot )
      v13 = 0x40000000;
    else
      v13 = 0;
    LODWORD(Src) = v13 | v12 & 0xBFFFFFFF;
    HvlQueryL1tfMitigationInformation((INT64 *)&Src);
    v14 = HIDWORD(Src) ^ (BYTE4(Src) ^ (unsigned __int8)(v8 >> 19)) & 7;
    if( v15 )
    {
      if( KiIsFbClearSupported() )
        v7 = 24;
    }
    HIDWORD(Src) = v7 | v14 & 0xFFFFFFF7;
    memset((INT64)dst, 0i64);
    memmove(dst, (UINT8 *)&Src, v5);
    return 0i64;
  }
  else
  {
    *(_DWORD *)a3 = 8;
    return 3221225476i64;
  }
}

Referenced by: