PopIsRemoteDesktopEnabled

INT8 __stdcall PopIsRemoteDesktopEnabled(){
  INT8 v0; 
  INT64 v1; 
  INT64 Length; 
  UINT64 Lengtha; 
  UINT64 *ResultLength; 
  UINT64 v6; 
  VOID *KeyHandle; 
  _UNICODE_STRING v8; 
  _UNICODE_STRING DestinationString; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int128 KeyValueInformation; 
  int v12; 

  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  LODWORD(v6) = 0;
  v0 = 0;
  v8 = 0i64;
  v12 = 0;
  KeyValueInformation = 0i64;
  DestinationString = 0i64;
  RtlInitUnicodeString(&DestinationString, L"fDenyTSConnections");
  RtlInitUnicodeString(&v8, L"\\Registry\\Machine\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server");
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = &v8;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 576;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  if( ZwOpenKey(&KeyHandle, 0x20019ui64, &ObjectAttributes, v1, Length, (INT64)ResultLength, v6, 0i64) >= 0 )
  {
    LODWORD(Lengtha) = 20;
    if( ZwQueryValueKey(KeyHandle, &DestinationString, KeyValuePartialInformation, &KeyValueInformation, Lengtha, &v6) >= 0
      && (*(_QWORD *)((char *)&KeyValueInformation + 4) != 0x400000004i64 || !HIDWORD(KeyValueInformation)) )
    {
      v0 = 1;
    }
  }
  if( KeyHandle )
    ZwClose((_HANDLE)KeyHandle);
  return v0;
}

Referenced by: