WbGetInitializedEncryptionSegment
NTSTATUS __stdcall WbGetInitializedEncryptionSegment(
INT64 a1,
wil_details_FeatureReportingCache *a2,
UINT64 a3,
INT64 **a4){
INT64 v7;
int WarbirdEncryptionSegment;
_ETHREAD *CurrentThread;
_EX_PUSH_LOCK *v11;
_BYTE *v12;
INT64 v13;
_BYTE *v14;
char v15;
INT64 v16;
PVOID P[2];
INT64 v18[2];
INT64 v19[2];
v7 = 0i64;
v16 = 0i64;
*(_OWORD *)v19 = 0i64;
*(_OWORD *)P = 0i64;
WarbirdEncryptionSegment = WbValidateEncryptionSegmentArguments((INT64)a2, (unsigned int)a3, P, (INT64)v19);
if( WarbirdEncryptionSegment < 0 )
goto LABEL_7;
WarbirdEncryptionSegment = WbGetWarbirdEncryptionSegment(a1, (INT64)v19, (INT64 **)&v16);
if( WarbirdEncryptionSegment < 0 )
goto LABEL_19;
v7 = v16;
if( !*(_DWORD *)(v16 + 16) )
{
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
--CurrentThread->Tcb.SpecialApcDisable;
v11 = (_EX_PUSH_LOCK *)(v16 + 8);
v12 = KeAbPreAcquire((VOID *)(v16 + 8), 0i64, 0i64);
v14 = v12;
if( _interlockedbittestandset64((volatile signed __int32 *)v11, 0i64) )
ExfAcquirePushLockExclusiveEx(v11, v12, v11);
if( v14 )
v14[26] |= 1u;
if( !*(_DWORD *)(v7 + 16) )
{
*(_OWORD *)v18 = *(_OWORD *)P;
WarbirdEncryptionSegment = WbInitializeEncryptionSegment(v18, a2, v16, v13);
}
v15 = _InterlockedExchangeAdd64(&v11->_bf_0, 0xFFFFFFFFFFFFFFFFui64);
if( (v15 & 2) != 0 && (v15 & 4) == 0 )
ExfTryToWakePushLock(v11);
KeAbPostRelease(v11);
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
if( WarbirdEncryptionSegment >= 0 )
{
v7 = v16;
goto LABEL_4;
}
LABEL_19:
v7 = v16;
goto LABEL_7;
}
LABEL_4:
WarbirdEncryptionSegment = *(_DWORD *)(v7 + 20);
if( WarbirdEncryptionSegment >= 0 && a4 )
{
*a4 = (INT64 *)v7;
v7 = 0i64;
}
LABEL_7:
sub_1405D2184((volatile signed __int64 *)v7);
if( P[1] )
ExFreePoolWithTag(P[1], 0x42524157u);
return WarbirdEncryptionSegment;
}Referenced by:
WbDecryptEncryptionSegment
WbReEncryptEncryptionSegment