KsepShimDatabaseTime

NTSTATUS __stdcall KsepShimDatabaseTime(PCWSTR SourceString){
  _QWORD *v1; 
  WCHAR v2; 
  _QWORD *v3; 
  NTSTATUS v4; 
  int v5; 
  __int64 v6; 
  char v7; 
  __int64 v9; 
  void *FileHandle; 
  struct _UNICODE_STRING DestinationString; 
  struct _IO_STATUS_BLOCK IoStatusBlock; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int128 FileInformation; 
  __int128 v15; 
  __int64 v16; 
  *(&ObjectAttributes.Length + 1) = 0;
  *v1 = 0i64;
  *(&ObjectAttributes.Attributes + 1) = 0;
  FileHandle = 0i64;
  v3 = v1;
  v16 = 0i64;
  DestinationString = 0i64;
  IoStatusBlock = 0i64;
  FileInformation = 0i64;
  v15 = 0i64;
  RtlInitUnicodeString(&DestinationString, SourceString, v2);
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = &DestinationString;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 576;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  v4 = ZwOpenFile((UNICODE_STRING *)&FileHandle, (PWCHAR)0x80000000i64);
  v5 = v4;
  if( v4 >= 0 )
  {
    v5 = ZwQueryInformationFile(FileHandle, &IoStatusBlock, &FileInformation, 0x28ui64, FileBasicInformation);
    if( v5 < 0 )
    {
      v9 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
      KsepHistoryErrors[2 * v9 + 1] = v5;
      KsepHistoryErrors[2 * v9] = 590737;
      if( (KsepDebugFlag & 2) != 0 )
        KsepDebugPrint(0i64, "KSE: ZwQueryInformationFile failed getting DB file!\n");
      KsepLogError(0, "KSE: ZwQueryInformationFile failed getting DB file!\n");
    }
    else
    {
      *v3 = v15;
    }
  }
  else
  {
    v6 = ((unsigned __int8)_InterlockedExchangeAdd(&KsepHistoryErrorsIndex, 1u) + 1) & 0x3F;
    KsepHistoryErrors[2 * v6 + 1] = v4;
    v7 = KsepDebugFlag;
    KsepHistoryErrors[2 * v6] = 590724;
    if( (v7 & 2) != 0 )
      KsepDebugPrint(0i64, "KSE: ZwOpenFile failed opening DB file!\n");
    KsepLogError(0, "KSE: ZwOpenFile failed opening DB file!\n");
  }
  if( FileHandle )
    ZwClose(FileHandle);
  return v5;
}

Referenced by: