Of course the UE knows that there is a scrambling code applied to information on the physical layer of LTE.
The type of scrambling is a 1-to-1 "multiplication" (exclusive or) of the so-called scrambling sequence with LTE data that has had forward error correction applied to it. Scrambling occurs on both control and data channels, however, the same scrambling sequence is not used all the time, for each individual channel, specifically, for example, the scrambling sequence is going to be different for the MIB than for user data on the PDSCH.
Fortunately, the scrambling sequence is always created by the same shift register architecture, but different seeds are used that depend on the amount of information that the UE "knows" at the time. This architecture is mathematically defined in Section 7.2 of 36.211. I personally find pictures like the figure below more intuitive
This is not the LFSR for the LTE scrambling code, but gives the idea how indices of the equations in Section 7.2 of 36.211 can be visualized by "tapping" from specific memory elements of the LFSR to create an output sequence. It also helps explain the concept of why some type of initial sequence or seed sequence is required to obtain different sequences from the same overall shift register architecture.
So, as hinted to above, the different scrambling sequences that are used depend on seed used, and that seed changes as a function of the "knowledge" that the UE has obtained as it traverses through the "attach" procedure. So let's walk through it to explain what's going on...
The first thing the UE does is to identify the PSS and SSS from which it obtains timing and derives a parameter referred to as the Physical Layer Cell ID. So for MIB , the initialization (or seed) sequence is merely this Physical Layer Cell ID. This can be seen in Section 6.6.1 of 36.211.
The UE must next download SIB information, which is multiplexed onto the PDSCH, and as such must also read PCFICH and decode PDCCH. The initilization for the control format indicator (the number found on the PCFICH) is given in 36.211 Section 6.7.1 by a more complicated function that involves both the Physical Layer Cell ID and the subframe number that is being used.
It must now search for the SI-RNTI in the PDCCH. The initialization sequence is the same as for the PCFICH.
Next it must descramble the PDSCH message that actually contains the SIB information ... Initialization sequence given by the first equation in the graphic below, again where the RNTI is the SI-RNTI and n_s is the slot number being searched:
The UE now has enough information to transmit a Random Access Preamble on the RACH. After doing that, it must search for the Random Access Response (RAR) on the PDSCH ... Remember that the RAR will be tagged by the RA-RNTI in the control channel, and the RA-RNTI must be used to de-scramble the PDSCH information.
The RAR contains the UE's Temporary C-RNTI as well as an uplink grant in which to transmit RRC_Connection_Request message in the PUSCH. This message is scrambled with the following Initialization, which will look very familiar, but is actually the first instance of the UE using its C-RNTI (Section 5.31 of 36.211):
Upon passing contention resolution, the Temporary C-RNTI becomes "permanent", subsequent PDSCH and PUSCH messages utilize C-RNTI in scrambling sequence initialization.
So the Answer to the question got a little complicated, but in summary, the UE always knows how to generate the scrambling sequence, it needs the seed/initialization. And this varies as the UE gets deeper into the connection process, and it doesn't really know "everything" until it it passes contention resolution and its Temporary C-RNTI becomes permanent
