MiCaptureBootDriverRetpolineInfo

INT64 __stdcall MiCaptureBootDriverRetpolineInfo(PVOID Base, UINT64 Size, UINT64 *a3){
  __int64 v4; 
  int RetpolineRelocationInformation; 
  INT64 a5; 
  unsigned __int64 v8; 
  unsigned int v9; 
  INT64 v10; 
  INT64 a6; 
  UINT64 a1[9]; 
  INT64 a7; 
  IMAGE_NT_HEADERS *v15; 
  LODWORD(a7) = 0;
  v15 = 0i64;
  v4 = (unsigned int)Size;
  memset(a1, 0, 32);
  RetpolineRelocationInformation = RtlImageNtHeaderEx(0i64, Base, (unsigned int)Size, &v15);
  if( RetpolineRelocationInformation >= 0 )
  {
    LODWORD(a5) = LdrImageDirectoryEntryToLoadConfig(Base);
    if( a5 && *(int *)a5 >= 228 )
    {
      v8 = *(_QWORD *)(a5 + 120);
      v9 = 0;
      if( v8 && v8 >= (unsigned __int64)Base && v8 < (unsigned __int64)Base + v4 - 8 )
        v9 = v8 - (_DWORD)Base;
      LODWORD(a6) = *(_DWORD *)a5;
      RetpolineRelocationInformation = MiCaptureDynamicRelocationTableRva(
                                         Base,
                                         (unsigned int)v4,
                                         0i64,
                                         v15->OptionalHeader.Magic,
                                         a5,
                                         a6,
                                         (INT64)&a7);
      if( RetpolineRelocationInformation >= 0 )
      {
        RetpolineRelocationInformation = MiCaptureRetpolineRelocationTables(
                                           (CHAR *)Base,
                                           (unsigned int)v4,
                                           v10,
                                           (unsigned int)a7,
                                           a1);
        if( RetpolineRelocationInformation >= 0 )
        {
          RetpolineRelocationInformation = MiCreateRetpolineRelocationInformation((INT64)a1, v9, (unsigned int)v4, a3);
          MiFreeImageRetpolineContext(a1);
        }
      }
    }
    else
    {
      return(unsigned int)-1073741637;
    }
  }
  return(unsigned int)RetpolineRelocationInformation;
}

Referenced by: