DbgkpLkmdSqmIsOptedIn

BOOL __fastcall DbgkpLkmdSqmIsOptedIn(){
  BOOL result; 
  void *KeyHandle; 
  ULONG ResultLength; 
  struct _UNICODE_STRING ValueName; 
  __int64 v4[2]; 
  __int64 v5[2]; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int128 KeyValueInformation; 
  int v8; 
  KeyHandle = 0i64;
  ResultLength = 0;
  HIDWORD(ObjectAttributes.RootDirectory) = 0;
  *(_QWORD *)(&ObjectAttributes.Length + 1) = 0i64;
  memset(&ObjectAttributes.Attributes + 1, 0, 20);
  v8 = 0;
  v4[0] = 8388734i64;
  v4[1] = (__int64)L"\\Registry\\Machine\\Software\\Policies\\Microsoft\\SQMClient\\Windows";
  v5[1] = (__int64)L"\\Registry\\Machine\\Software\\Microsoft\\SQMClient\\Windows";
  ValueName.Buffer = L"CEIPEnable";
  ObjectAttributes.ObjectName = (_UNICODE_STRING *)v4;
  KeyValueInformation = 0i64;
  v5[0] = 7209068i64;
  *(_QWORD *)&ValueName.Length = 1441812i64;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 576;
  if( ZwOpenKey(&KeyHandle, 0x20019u, &ObjectAttributes) >= 0 )
  {
    if( ZwQueryValueKey(KeyHandle, &ValueName, KeyValuePartialInformation, &KeyValueInformation, 0x14u, &ResultLength) >= 0
      && *(_QWORD *)((char *)&KeyValueInformation + 4) == 0x400000004i64 )
    {
      goto LABEL_4;
    }
    ZwClose(KeyHandle);
  }
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = (_UNICODE_STRING *)v5;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 576;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  result = ZwOpenKey(&KeyHandle, 0x20019u, &ObjectAttributes);
  if( result >= 0 )
  {
    if( ZwQueryValueKey(KeyHandle, &ValueName, KeyValuePartialInformation, &KeyValueInformation, 0x14u, &ResultLength) >= 0
      && *(_QWORD *)((char *)&KeyValueInformation + 4) == 0x400000004i64 )
    {
LABEL_4:
      result = ZwClose(KeyHandle);
      LOBYTE(result) = HIDWORD(KeyValueInformation) == 1;
      return result;
    }
    result = ZwClose(KeyHandle);
  }
  LOBYTE(result) = 0;
  return result;
}

Referenced by: