WbHeapExecutionUnloadModule

INT64 __fastcall WbHeapExecutionUnloadModule(INT64 a1, INT64 a2){
  _ETHREAD *CurrentThread; 
  int v3; 
  UINT64 *v6; 
  _BYTE *v7; 
  _BYTE *v8; 
  unsigned int i; 
  __int64 v10; 
  char v11; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v3 = 0;
  --*((_WORD *)CurrentThread + 243);
  v6 = (UINT64 *)(a1 + 48);
  LODWORD(v7) = KeAbPreAcquire((PVOID)(a1 + 48), 0i64, 0i64);
  v8 = v7;
  if( _interlockedbittestandset64((volatile signed __int32 *)v6, 0i64) )
    ExfAcquirePushLockExclusiveEx(v6, v7, v6);
  if( v8 )
    v8[26] |= 1u;
  for( i = 0; i < *(_DWORD *)(a1 + 12); ++i )
  {
    v10 = *(_QWORD *)(i * *(_DWORD *)(a1 + 8) + *(_QWORD *)(a1 + 24));
    if( v10 )
    {
      if( *(_QWORD *)(v10 + 64) == a2 )
      {
        v3 = sub_14065D374(a1 + 8, 0i64, 0i64, i, 0i64);
        if( v3 >= 0 )
        {
          sub_14065EF2C(a1, v10);
          --i;
        }
      }
    }
  }
  v11 = _InterlockedExchangeAdd64((volatile signed __int64 *)v6, 0xFFFFFFFFFFFFFFFFui64);
  if( (v11 & 2) != 0 && (v11 & 4) == 0 )
    ExfTryToWakePushLock((volatile INT64 *)v6);
  KeAbPostRelease(v6);
  KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
  return(unsigned int)v3;
}

Referenced by:

WbProcessModuleUnload