KsepEngineReadFlags

__int64 __fastcall KsepEngineReadFlags(unsigned int *a1){
  unsigned int v1; 
  NTSTATUS v3; 
  NTSTATUS v4; 
  unsigned int v5; 
  __int64 v6; 
  __int64 v8; 
  __int64 v9; 
  __int64 v10; 
  __int64 v11; 
  unsigned int v12; 
  __int64 v13; 
  UINT64 v14; 
  UINT64 v15; 
  UINT64 Value; 
  HANDLE KeyHandle; 
  KeyHandle = 0i64;
  LODWORD(Value) = 0;
  v1 = 0;
  if( !a1 )
  {
    v8 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
    dword_140C2A864[2 * v8] = -1073740768;
    KsepHistoryErrors[2 * v8] = 262244;
    if( (KsepDebugFlag & 4) != 0 )
      RtlAssert("Engine != NULL", "minkernel\\ntos\\kshim\\kseregistry.c", 0x64u, 0i64);
  }
  *a1 = 0;
  v3 = KsepRegistryOpenKey(
         (PWCHAR)L"\\Registry\\Machine\\System\\CurrentControlSet\\Policies\\Microsoft\\Compatibility",
         0i64,
         &KeyHandle);
  if( v3 )
  {
    if( v3 == -1073741772 )
      a1[2] |= 2u;
  }
  else
  {
    LODWORD(v14) = 0;
    LODWORD(v15) = 0;
    if( !(unsigned int)KsepRegistryQueryDWORD(KeyHandle, (WCHAR *)L"DisableDeviceFlags", &v14) && (_DWORD)v14 == 1 )
    {
      a1[2] |= 4u;
      v1 = 2;
    }
    if( !(unsigned int)KsepRegistryQueryDWORD(KeyHandle, (WCHAR *)L"DisableDriverShims", &v15) && (_DWORD)v15 == 1 )
    {
      v1 |= 1u;
      a1[2] |= 8u;
    }
    v9 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryMessagesIndex, 1u) + 1) & 0x3F;
    HIDWORD(KsepHistoryMessages[v9]) = 0;
    LODWORD(KsepHistoryMessages[v9]) = 262275;
    if( (KsepDebugFlag & 1) != 0 )
      KsepDebugPrint(0i64, "KSE: Engine has group policy flags: %08x\n", v1);
    KsepLogInfo(0, "KSE: Engine has group policy flags: %08x\n", v1);
    KsepRegistryCloseKey(KeyHandle);
    KeyHandle = 0i64;
  }
  v4 = KsepRegistryOpenKey(
         (PWCHAR)L"\\Registry\\Machine\\System\\CurrentControlSet\\Control\\Compatibility",
         0i64,
         &KeyHandle);
  v5 = v4;
  if( v4 == -1073741772 )
  {
    a1[2] |= 1u;
    goto LABEL_8;
  }
  if( v4 < 0 )
  {
    v10 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
    dword_140C2A864[2 * v10] = v5;
    KsepHistoryErrors[2 * v10] = 262304;
    if( (KsepDebugFlag & 2) != 0 )
      KsepDebugPrint(0i64, "KSE: Error reading compatibility key: status: %08x\n", v5);
    KsepLogError(0, "KSE: Error reading compatibility key: status: %08x\n", v5);
  }
  else
  {
    v5 = KsepRegistryQueryDWORD(KeyHandle, (WCHAR *)L"DisableFlags", &Value);
    if( v5 == -1073741772 )
    {
LABEL_8:
      v5 = 0;
      goto LABEL_9;
    }
    if( (v5 & 0x80000000) == 0 )
    {
      v12 = Value & 3;
      *a1 = v12;
      if( (v12 & 1) != 0 )
        a1[2] |= 0x20u;
      if( (v12 & 2) != 0 )
        a1[2] |= 0x10u;
      v13 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryMessagesIndex, 1u) + 1) & 0x3F;
      HIDWORD(KsepHistoryMessages[v13]) = 0;
      LODWORD(KsepHistoryMessages[v13]) = 262343;
      if( (KsepDebugFlag & 1) != 0 )
        KsepDebugPrint(0i64, "KSE: Engine initialized with registry flags: %08x\n", *a1);
      KsepLogInfo(0, "KSE: Engine initialized with registry flags: %08x\n", *a1);
    }
    else
    {
      v11 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
      dword_140C2A864[2 * v11] = v5;
      KsepHistoryErrors[2 * v11] = 262326;
      if( (KsepDebugFlag & 2) != 0 )
        KsepDebugPrint(0i64, "KSE: Error reading compatibility value [%ws]: status: %08x\n", L"DisableFlags", v5);
      KsepLogError(0, "KSE: Error reading compatibility value [%ws]: status: %08x\n", L"DisableFlags", v5);
    }
  }
LABEL_9:
  *a1 |= v1;
  v6 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryMessagesIndex, 1u) + 1) & 0x3F;
  HIDWORD(KsepHistoryMessages[v6]) = 0;
  LODWORD(KsepHistoryMessages[v6]) = 262354;
  if( (KsepDebugFlag & 1) != 0 )
    KsepDebugPrint(0i64, "KSE: Engine flags(after registry/group policy): %08x\n", *a1);
  KsepLogInfo(0, "KSE: Engine flags(after registry/group policy): %08x\n", *a1);
  KsepRegistryCloseKey(KeyHandle);
  return v5;
}

Referenced by: