ExpGetGlobalLocaleSection

INT64 __fastcall ExpGetGlobalLocaleSection(VOID **SectionPointer, UINT64 *CurrentVersion){
  wchar_t *Buffer; 
  int v4; 
  INT64 result; 
  void *v6; 
  NTSTATUS v7; 
  _ETHREAD *CurrentThread; 
  wchar_t *v9; 
  wchar_t *v10; 
  char v11; 
  unsigned __int64 *p_TrapFrame; 
  __int64 v13; 
  wchar_t *v14; 
  wchar_t v15; 
  wchar_t *v16; 
  WCHAR v17; 
  NTSTATUS v18; 
  __int64 v19; 
  UINT64 Length; 
  PULONG ResultLength; 
  UNICODE_STRING FileHandle; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  ULONG v24; 
  void *KeyHandle; 
  void *SectionHandle; 
  struct _UNICODE_STRING DestinationString; 
  struct _IO_STATUS_BLOCK IoStatusBlock; 
  char KeyValueInformation[4]; 
  int v30; 
  int v31; 
  int v32; 
  wchar_t pszDest[264]; 
  Buffer = (wchar_t *)NlsLocaleSectionPointer;
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  IoStatusBlock = 0i64;
  *(_QWORD *)&FileHandle.Length = 0i64;
  SectionHandle = 0i64;
  v4 = 0;
  KeyHandle = 0i64;
  v24 = 0;
  DestinationString = 0i64;
  if( (unsigned __int64)NlsLocaleSectionPointer > 1 )
  {
    ObfReferenceObject(NlsLocaleSectionPointer);
LABEL_3:
    *SectionPointer = Buffer;
    return 0i64;
  }
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = (_UNICODE_STRING *)L"ln";
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 576;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  if( ZwOpenKey(&KeyHandle, 1u, &ObjectAttributes) >= 0 )
  {
    if( ZwQueryValueKey(
           KeyHandle,
           (PUNICODE_STRING)&NlsTableVersionKeyName,
           KeyValuePartialInformation,
           KeyValueInformation,
           0x14u,
           &v24) >= 0
      && v30 == 4
      && v31 == 4 )
    {
      v4 = v32;
      p_TrapFrame = 0i64;
      if( v32 == 5243136 )
        p_TrapFrame = &stru_1407D9590.TrapFrame;
      if( p_TrapFrame )
      {
        v13 = 260i64;
        v14 = pszDest;
        do
        {
          if( v13 == -2147483386 )
            break;
          v15 = *(wchar_t *)((char *)v14 + (char *)&stru_1407D9590.MxCsr - (char *)pszDest);
          if( !v15 )
            break;
          *v14++ = v15;
          --v13;
        }
        while( v13 );
        v16 = v14 - 1;
        if( v13 )
          v16 = v14;
        *v16 = 0;
        if( v13 && RtlStringCchCatW(pszDest, 0x104ui64, (PWCHAR)p_TrapFrame) >= 0 )
        {
          RtlInitUnicodeString(&DestinationString, pszDest, v17);
          ObjectAttributes.ObjectName = &DestinationString;
          ObjectAttributes.Length = 48;
          ObjectAttributes.RootDirectory = 0i64;
          ObjectAttributes.Attributes = 576;
          *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
          v18 = ZwOpenFile(&FileHandle, (PWCHAR)0x100000);
          v19 = *(_QWORD *)&FileHandle.Length;
          if( v18 < 0 )
            v19 = 0i64;
          *(_QWORD *)&FileHandle.Length = v19;
        }
      }
    }
    ZwClose(KeyHandle);
  }
  v6 = *(void **)&FileHandle.Length;
  if( *(_QWORD *)&FileHandle.Length )
  {
LABEL_11:
    LODWORD(ResultLength) = 0x8000000;
    ObjectAttributes.Length = 48;
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.Attributes = 576;
    ObjectAttributes.ObjectName = 0i64;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    LODWORD(Length) = 2;
    v7 = ZwCreateSection(&SectionHandle, 4ui64, &ObjectAttributes, 0i64, Length, (UINT64)ResultLength, v6);
    ZwClose(*(HANDLE *)&FileHandle.Length);
    if( v7 < 0 )
      return(unsigned int)v7;
    FileHandle.Buffer = 0i64;
    v7 = ObReferenceObjectByHandle(SectionHandle, 0xF001Fu, MmSectionObjectType, 0, (PVOID *)&FileHandle.Buffer, 0i64);
    Buffer = FileHandle.Buffer;
    ZwClose(SectionHandle);
    if( v7 < 0 )
      return(unsigned int)v7;
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)CurrentThread + 242);
    ExAcquirePushLockExclusiveEx((UINT64)&NlsSectionLock, 0i64);
    v9 = (wchar_t *)NlsLocaleSectionPointer;
    if( NlsLocaleSectionPointer == (PVOID)1 )
    {
      v10 = FileHandle.Buffer;
      NlsTableVersion = v4;
      ObfReferenceObject(FileHandle.Buffer);
      NlsLocaleSectionPointer = v10;
    }
    else if( NlsLocaleSectionPointer )
    {
      HalPutDmaAdapter((PADAPTER_OBJECT)FileHandle.Buffer);
      Buffer = v9;
      ObfReferenceObject(v9);
    }
    v11 = _InterlockedExchangeAdd64((volatile signed __int64 *)&NlsSectionLock, 0xFFFFFFFFFFFFFFFFui64);
    if( (v11 & 2) != 0 && (v11 & 4) == 0 )
      ExfTryToWakePushLock((volatile INT64 *)&NlsSectionLock);
    KeAbPostRelease(&NlsSectionLock);
    KeLeaveCriticalRegionThread((__int64)CurrentThread);
    goto LABEL_3;
  }
  ObjectAttributes.ObjectName = (_UNICODE_STRING *)L">@";
  ObjectAttributes.Length = 48;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.Attributes = 576;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  LODWORD(result) = ZwOpenFile(&FileHandle, (PWCHAR)0x100000);
  if( (int)result >= 0 )
  {
    v6 = *(void **)&FileHandle.Length;
    v4 = 263424;
    goto LABEL_11;
  }
  return result;
}

Referenced by: