RtlQueryValidationRunlevel

NTSTATUS __fastcall RtlQueryValidationRunlevel(INT64 a1){
  INT64 v1; 
  int v2; 
  unsigned int GlobalValidationRunlevel; 
  INT64 Length; 
  UINT64 Lengtha; 
  UINT64 *ResultLength; 
  UINT64 v9; 
  VOID *KeyHandle; 
  __int128 KeyValueInformation; 
  int v12; 

  v2 = 0;
  KeyHandle = 0i64;
  LODWORD(v9) = 0;
  v12 = 0;
  KeyValueInformation = 0i64;
  GlobalValidationRunlevel = KUSER_SHARED_DATA.GlobalValidationRunlevel;
  if( a1
    && KUSER_SHARED_DATA.GlobalValidationRunlevel != -1
    && ZwOpenKey(
         &KeyHandle,
         1ui64,
         (_OBJECT_ATTRIBUTES *)&ObjectAttributes,
         v1,
         Length,
         (INT64)ResultLength,
         v9,
         (INT64)KeyHandle) >= 0 )
  {
    LODWORD(Lengtha) = 20;
    if( ZwQueryValueKey(
           KeyHandle,
           (_UNICODE_STRING *)a1,
           KeyValuePartialInformation,
           &KeyValueInformation,
           Lengtha,
           &v9) >= 0
      && *(_QWORD *)((char *)&KeyValueInformation + 4) == 0x400000004i64 )
    {
      v2 = HIDWORD(KeyValueInformation);
    }
    NtClose((UINT64)KeyHandle);
  }
  return v2 | GlobalValidationRunlevel;
}

Referenced by: