RtlQueryValidationRunlevel

__int64 __fastcall RtlQueryValidationRunlevel(PUNICODE_STRING ValueName){
  int v1; 
  unsigned int GlobalValidationRunlevel; 
  ULONG ResultLength; 
  void *KeyHandle; 
  __int128 KeyValueInformation; 
  int v8; 
  v1 = 0;
  KeyHandle = 0i64;
  ResultLength = 0;
  v8 = 0;
  KeyValueInformation = 0i64;
  GlobalValidationRunlevel = KUSER_SHARED_DATA.GlobalValidationRunlevel;
  if( ValueName
    && KUSER_SHARED_DATA.GlobalValidationRunlevel != -1
    && ZwOpenKey(&KeyHandle, 1u, (POBJECT_ATTRIBUTES)&ObjectAttributes) >= 0 )
  {
    if( ZwQueryValueKey(KeyHandle, ValueName, KeyValuePartialInformation, &KeyValueInformation, 0x14u, &ResultLength) >= 0
      && *(_QWORD *)((char *)&KeyValueInformation + 4) == 0x400000004i64 )
    {
      v1 = HIDWORD(KeyValueInformation);
    }
    NtClose(KeyHandle);
  }
  return v1 | GlobalValidationRunlevel;
}

Referenced by: