WbGetWarbirdProcess

NTSTATUS __stdcall WbGetWarbirdProcess(INT64 a1, INT64 a2, INT64 **a3){
  __int64 v3; 
  _ETHREAD *CurrentThread; 
  int v6; 
  _BYTE *v8; 
  NTSTATUS v9; 
  UINT64 v10; 
  _LARGE_INTEGER v11; 
  VOID *v12; 
  _ETHREAD *v14; 
  _BYTE *v15; 
  INT64 v16; 
  _BYTE *v17; 
  INT64 v18; 
  char v19; 
  UINT64 v20; 
  INT64 v21; 

  v3 = 0i64;
  v21 = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v6 = a2;
  --CurrentThread->Tcb.SpecialApcDisable;
  v8 = KeAbPreAcquire(&LockPointer, 0i64, 0i64);
  if( _InterlockedCompareExchange64(&LockPointer._bf_0, 17i64, 0i64) )
    ExfAcquirePushLockSharedEx(&LockPointer, v8, &LockPointer);
  if( v8 )
    v8[26] |= 1u;
  v9 = sub_14065EAF4(a1, &v21);
  if( _InterlockedCompareExchange64(&LockPointer._bf_0, 0i64, 17i64) != 17 )
    ExfReleasePushLockShared(&LockPointer);
  KeAbPostRelease(&LockPointer);
  KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
  if( v9 == -1073741198 )
  {
    if( !v6 )
      goto LABEL_24;
    v9 = WbCreateWarbirdProcess(a1, &v21);
    if( v9 < 0 )
      goto LABEL_24;
    v14 = (_ETHREAD *)KeGetCurrentThread();
    --v14->Tcb.SpecialApcDisable;
    v15 = KeAbPreAcquire(&LockPointer, 0i64, 0i64);
    v17 = v15;
    if( _interlockedbittestandset64((volatile signed __int32 *)&LockPointer, 0i64) )
      ExfAcquirePushLockExclusiveEx(&LockPointer, v15, &LockPointer);
    if( v17 )
      v17[26] |= 1u;
    v18 = v21;
    LODWORD(v20) = -1;
    v9 = sub_14065FDF0(&qword_140C53AD0, v21, v16, *(_QWORD *)v21, 8, v20);
    if( v9 >= 0 )
      _InterlockedIncrement64((volatile signed __int64 *)(v18 + 232));
    v19 = _InterlockedExchangeAdd64(&LockPointer._bf_0, 0xFFFFFFFFFFFFFFFFui64);
    if( (v19 & 2) != 0 && (v19 & 4) == 0 )
      ExfTryToWakePushLock(&LockPointer);
    KeAbPostRelease(&LockPointer);
    KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
  }
  if( v9 < 0 || !a3 )
  {
LABEL_24:
    v3 = v21;
    goto LABEL_11;
  }
  *a3 = (INT64 *)v21;
LABEL_11:
  sub_14065E8E4(v3, v10, v11, v12);
  return v9;
}

Referenced by: