ExpReadLeapSecondData

VOID __fastcall ExpReadLeapSecondData(BOOL *a1, CHAR a2){
  _ETHREAD *CurrentThread; 
  char *PoolWithTag; 
  void *v6; 
  HANDLE v7; 
  bool v8; 
  unsigned int v9; 
  NTSTATUS v10; 
  unsigned int updated; 
  BOOL WatchTree; 
  BOOL Asynchronous; 
  ULONG ResultLength; 
  HANDLE KeyHandle; 
  char KeyValueInformation[4]; 
  int v17; 
  int v18; 
  int v19; 
  ResultLength = 0;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  KeyHandle = 0i64;
  PoolWithTag = 0i64;
  v6 = 0i64;
  --*((_WORD *)CurrentThread + 242);
  ExAcquirePushLockExclusiveEx((UINT64)&ExpLeapSecondDataLock, 0i64);
  if( ExpLeapSecondDataRegistryNotify )
  {
    v7 = *(HANDLE *)ExpLeapSecondDataRegistryNotify;
    PoolWithTag = (char *)ExpLeapSecondDataRegistryNotify;
    KeyHandle = *(HANDLE *)ExpLeapSecondDataRegistryNotify;
  }
  else
  {
    if( ExpGetLeapSecondDataRegistryKeyHandle(&KeyHandle) < 0 )
      goto LABEL_22;
    PoolWithTag = (char *)ExAllocatePoolWithTag(NonPagedPoolNx, 0x38ui64, 0x6453704Cui64);
    if( !PoolWithTag )
      goto LABEL_22;
    v7 = KeyHandle;
  }
  LOBYTE(Asynchronous) = 1;
  *((_QWORD *)PoolWithTag + 3) = ExpLeapSecondDataRegistryNotifyHandler;
  LOBYTE(WatchTree) = 0;
  *((_QWORD *)PoolWithTag + 4) = 0i64;
  *((_QWORD *)PoolWithTag + 1) = 0i64;
  if( ZwNotifyChangeKey(
         v7,
         0i64,
         (PIO_APC_ROUTINE)(PoolWithTag + 8),
         (PVOID)1,
         (PIO_STATUS_BLOCK)(PoolWithTag + 40),
         4u,
         WatchTree,
         0i64,
         0,
         Asynchronous) < 0 )
    goto LABEL_22;
  v8 = 1;
  if( ZwQueryValueKey(
         v7,
         (PUNICODE_STRING)&ExpLeapSecondRegkeyValueEnabled,
         KeyValuePartialInformation,
         KeyValueInformation,
         0x14u,
         &ResultLength) >= 0
    && v17 == 4
    && v18 == 4 )
  {
    v8 = v19 != 0;
  }
  *(_BYTE *)a1 = v8;
  v9 = a1[1];
  v10 = ZwQueryValueKey(
          v7,
          (PUNICODE_STRING)&ExpLeapSecondRegkeyValueLeapSeconds,
          KeyValuePartialInformation,
          0i64,
          0,
          &ResultLength);
  if( v10 != -1073741789 )
    goto LABEL_14;
  v6 = ExAllocatePoolWithTag(PagedPool, ResultLength, 0x6453704Cui64);
  if( v6 )
  {
    v10 = ZwQueryValueKey(
            v7,
            (PUNICODE_STRING)&ExpLeapSecondRegkeyValueLeapSeconds,
            KeyValuePartialInformation,
            v6,
            ResultLength,
            &ResultLength);
LABEL_14:
    if( v10 >= 0 )
    {
      updated = ExpParseAndUpdateLeapSecondData((INT64)v6, (INT64)a1);
      LODWORD(ExLeapSecondDataLastParseResult) = updated;
      if( updated )
        EtwTraceLeapSecondDataParseFailure(updated);
    }
  }
  if( a2 )
  {
    ExAcquireTimeRefreshLock(1u);
    ExpRefreshTimeZoneInformation();
    ExReleaseTimeRefreshLock();
  }
  EtwTraceLeapSecondDataUpdate(1i64, *(unsigned __int8 *)a1, a1[1], v9);
  if( !ExpLeapSecondDataRegistryNotify )
  {
    ExpLeapSecondDataRegistryNotify = (__int64)PoolWithTag;
    *(_QWORD *)PoolWithTag = v7;
  }
  PoolWithTag = 0i64;
  KeyHandle = 0i64;
LABEL_22:
  if( (_InterlockedExchangeAdd64((volatile signed __int64 *)&ExpLeapSecondDataLock, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock((volatile INT64 *)&ExpLeapSecondDataLock);
  KeAbPostRelease(&ExpLeapSecondDataLock);
  KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  if( v6 )
    ExFreePoolWithTag(v6, 0x6453704Cu);
  if( PoolWithTag )
  {
    ExFreePoolWithTag(PoolWithTag, 0x6453704Cu);
    ExpLeapSecondDataRegistryNotify = 0i64;
  }
  if( KeyHandle )
    ZwClose(KeyHandle);
}

Referenced by: