ExpReadLeapSecondData

VOID __stdcall ExpReadLeapSecondData(BOOL *a1, CHAR a2){
  _ETHREAD *CurrentThread; 
  VOID **PoolWithTag; 
  VOID **v6; 
  VOID *v7; 
  bool v8; 
  unsigned int v9; 
  NTSTATUS v10; 
  unsigned int updated; 
  PIO_STATUS_BLOCK IoStatusBlock; 
  PIO_STATUS_BLOCK IoStatusBlocka; 
  PIO_STATUS_BLOCK IoStatusBlockb; 
  UINT64 ResultLength; 
  _HANDLE KeyHandle[2]; 
  char KeyValueInformation[4]; 
  int v18; 
  int v19; 
  int v20; 

  LODWORD(ResultLength) = 0;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  *(_QWORD *)KeyHandle = 0i64;
  PoolWithTag = 0i64;
  v6 = 0i64;
  --CurrentThread->Tcb.KernelApcDisable;
  ExAcquirePushLockExclusiveEx(&ExpLeapSecondDataLock, 0i64);
  if( ExpLeapSecondDataRegistryNotify )
  {
    v7 = *(VOID **)ExpLeapSecondDataRegistryNotify;
    PoolWithTag = (VOID **)ExpLeapSecondDataRegistryNotify;
    *(_QWORD *)KeyHandle = *(_QWORD *)ExpLeapSecondDataRegistryNotify;
  }
  else
  {
    if( ExpGetLeapSecondDataRegistryKeyHandle(KeyHandle) < 0 )
      goto LABEL_22;
    PoolWithTag = ExAllocatePoolWithTag(0x200ui64, 0x38ui64, 1683189836i64);
    if( !PoolWithTag )
      goto LABEL_22;
    v7 = *(VOID **)KeyHandle;
  }
  PoolWithTag[3] = ExpLeapSecondDataRegistryNotifyHandler;
  PoolWithTag[4] = 0i64;
  PoolWithTag[1] = 0i64;
  if( ZwNotifyChangeKey(
         (_HANDLE)v7,
         0,
         (PIO_APC_ROUTINE)(PoolWithTag + 1),
         (PVOID)1,
         (PIO_STATUS_BLOCK)(PoolWithTag + 5),
         4u,
         0,
         0i64,
         0,
         1u) < 0 )
    goto LABEL_22;
  LODWORD(IoStatusBlock) = 20;
  v8 = 1;
  if( ZwQueryValueKey(
         v7,
         (_UNICODE_STRING *)&ExpLeapSecondRegkeyValueEnabled,
         KeyValuePartialInformation,
         KeyValueInformation,
         (UINT64)IoStatusBlock,
         &ResultLength) >= 0
    && v18 == 4
    && v19 == 4 )
  {
    v8 = v20 != 0;
  }
  *a1 = v8;
  v9 = *((_DWORD *)a1 + 1);
  LODWORD(IoStatusBlocka) = 0;
  v10 = ZwQueryValueKey(
          v7,
          (_UNICODE_STRING *)&ExpLeapSecondRegkeyValueLeapSeconds,
          KeyValuePartialInformation,
          0i64,
          (UINT64)IoStatusBlocka,
          &ResultLength);
  if( v10 != -1073741789 )
    goto LABEL_14;
  v6 = ExAllocatePoolWithTag(1ui64, (unsigned int)ResultLength, 1683189836i64);
  if( v6 )
  {
    LODWORD(IoStatusBlockb) = ResultLength;
    v10 = ZwQueryValueKey(
            v7,
            (_UNICODE_STRING *)&ExpLeapSecondRegkeyValueLeapSeconds,
            KeyValuePartialInformation,
            v6,
            (UINT64)IoStatusBlockb,
            &ResultLength);
LABEL_14:
    if( v10 >= 0 )
    {
      updated = ExpParseAndUpdateLeapSecondData((INT64)v6, (INT64)a1);
      LODWORD(ExLeapSecondDataLastParseResult) = updated;
      if( updated )
        EtwTraceLeapSecondDataParseFailure(updated);
    }
  }
  if( a2 )
  {
    ExAcquireTimeRefreshLock(1u);
    ExpRefreshTimeZoneInformation();
    ExReleaseTimeRefreshLock();
  }
  EtwTraceLeapSecondDataUpdate(1i64, *a1, *((unsigned int *)a1 + 1), v9);
  if( !ExpLeapSecondDataRegistryNotify )
  {
    ExpLeapSecondDataRegistryNotify = (__int64)PoolWithTag;
    *PoolWithTag = v7;
  }
  PoolWithTag = 0i64;
  *(_QWORD *)KeyHandle = 0i64;
LABEL_22:
  if( (_InterlockedExchangeAdd64(&ExpLeapSecondDataLock._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock(&ExpLeapSecondDataLock);
  KeAbPostRelease(&ExpLeapSecondDataLock);
  KeLeaveCriticalRegionThread(KeGetCurrentThread());
  if( v6 )
    ExFreePoolWithTag(v6, 0x6453704Cu);
  if( PoolWithTag )
  {
    ExFreePoolWithTag(PoolWithTag, 0x6453704Cu);
    ExpLeapSecondDataRegistryNotify = 0i64;
  }
  if( *(_QWORD *)KeyHandle )
    ZwClose(KeyHandle[0]);
}

Referenced by: