WbRemoveWarbirdProcess

NTSTATUS __fastcall WbRemoveWarbirdProcess(INT64 a1){
  _ETHREAD *CurrentThread; 
  _BYTE *v3; 
  NTSTATUS v4; 
  _ETHREAD *v6; 
  _BYTE *v7; 
  _BYTE *v8; 
  char v9; 
  UINT64 v10; 
  _LARGE_INTEGER v11; 
  VOID *v12; 
  __int64 v13; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v13 = 0i64;
  --CurrentThread->Tcb.SpecialApcDisable;
  v3 = KeAbPreAcquire(&LockPointer, 0i64, 0i64);
  if( _InterlockedCompareExchange64(&LockPointer._bf_0, 17i64, 0i64) )
    ExfAcquirePushLockSharedEx(&LockPointer, v3, &LockPointer);
  if( v3 )
    v3[26] |= 1u;
  v4 = sub_14065EAF4(a1, 0i64);
  if( _InterlockedCompareExchange64(&LockPointer._bf_0, 0i64, 17i64) != 17 )
    ExfReleasePushLockShared(&LockPointer);
  KeAbPostRelease(&LockPointer);
  KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
  if( v4 >= 0 )
  {
    v6 = (_ETHREAD *)KeGetCurrentThread();
    --v6->Tcb.SpecialApcDisable;
    v7 = KeAbPreAcquire(&LockPointer, 0i64, 0i64);
    v8 = v7;
    if( _interlockedbittestandset64((volatile signed __int32 *)&LockPointer, 0i64) )
      ExfAcquirePushLockExclusiveEx(&LockPointer, v7, &LockPointer);
    if( v8 )
      v8[26] |= 1u;
    v4 = sub_14065D374((__int64)&qword_140C53AD0, a1, 8u, -1, &v13);
    v9 = _InterlockedExchangeAdd64(&LockPointer._bf_0, 0xFFFFFFFFFFFFFFFFui64);
    if( (v9 & 2) != 0 && (v9 & 4) == 0 )
      ExfTryToWakePushLock(&LockPointer);
    KeAbPostRelease(&LockPointer);
    KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
    sub_14065E8E4(v13, v10, v11, v12);
  }
  return v4;
}

Referenced by: