ExpGetLicenseTamperState

INT64 __fastcall ExpGetLicenseTamperState(INT64 a1, _DWORD *a2){
  INT64 result; 
  __int64 v5; 
  UINT64 *v6; 
  unsigned __int64 v7; 
  NTSTATUS updated; 
  UINT64 *v9; 
  UINT8 *v10; 
  __int128 v11; 
  __int128 v12; 
  __int128 v13; 
  __int128 v14; 
  __int128 v15; 
  v13 = 0i64;
  v14 = 0i64;
  v15 = 0i64;
  if( !*(_QWORD *)(a1 + 46832) )
  {
    result = *(unsigned int *)(a1 + 46988);
    *a2 = result;
    return result;
  }
  result = ExpGetKernelDataProtection(a1, &v13);
  if( (int)result >= 0 )
  {
    result = DWORD2(v13);
    *a2 = DWORD2(v13);
    return result;
  }
  if( (_DWORD)result == -1073741275 )
  {
    v5 = *(_QWORD *)(a1 + 46832);
    v6 = (UINT64 *)*(unsigned int *)(a1 + 46824);
    LOBYTE(v7) = -1;
    HIDWORD(v11) = 0;
    *(_DWORD *)((char *)&v12 + 9) = 0;
    *(_WORD *)((char *)&v12 + 13) = 0;
    HIBYTE(v12) = 0;
    if( !v5 )
    {
      result = 3221225485i64;
LABEL_17:
      if( (int)result >= 0 )
      {
        DWORD2(v13) = 4;
        result = ExpSetKernelDataProtection(a1, (__int64)&v13, v7, 0);
      }
      goto LABEL_19;
    }
    if( (_DWORD)v6 && a1 == -24 )
      goto LABEL_19;
    *(_QWORD *)&v11 = 0i64;
    DWORD2(v11) = 4;
    *(_QWORD *)&v12 = 0i64;
    BYTE8(v12) = 1;
    updated = ExpLicUpdateChecksum((UINT8 *)(v5 + 20), v6);
    if( updated )
      goto LABEL_14;
    if( (_DWORD)v9 )
    {
      if( 16 * (__int64)v9 > v7 )
        goto LABEL_14;
      updated = ExpLicUpdateChecksum(v10, v9);
    }
    if( !updated )
    {
LABEL_15:
      result = 0i64;
      v13 = v11;
      v14 = 0ui64;
      v15 = v12;
      goto LABEL_17;
    }
LABEL_14:
    *(_QWORD *)&v11 = 0i64;
    DWORD2(v11) = 4;
    goto LABEL_15;
  }
LABEL_19:
  *a2 = 4;
  return result;
}

Referenced by: