WbAddWarbirdEncryptionSegment

INT64 __fastcall WbAddWarbirdEncryptionSegment(INT64 a1, INT64 a2, _QWORD *a3){
  int v3; 
  _ETHREAD *CurrentThread; 
  UINT64 *v8; 
  _BYTE *v9; 
  _BYTE *v10; 
  int v11; 
  INT64 v12; 
  int v13; 
  char v14; 
  __int64 v16; 
  INT64 a5; 
  UINT64 a6; 
  INT64 a4; 
  volatile INT64 *a3a; 
  INT64 a2a; 
  int v22; 
  int v23; 
  v3 = *(_DWORD *)(a2 + 24);
  v23 = 0;
  a3a = 0i64;
  LODWORD(a4) = 0;
  v22 = v3;
  a2a = *(_QWORD *)(a2 + 32);
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --*((_WORD *)CurrentThread + 243);
  v8 = (UINT64 *)(a1 + 176);
  LODWORD(v9) = KeAbPreAcquire((PVOID)(a1 + 176), 0i64, 0i64);
  v10 = v9;
  if( _interlockedbittestandset64((volatile signed __int32 *)v8, 0i64) )
    ExfAcquirePushLockExclusiveEx(v8, v9, v8);
  if( v10 )
    v10[26] |= 1u;
  v11 = sub_1405D21B8(a1, (INT64)&a2a, &a3a, &a4);
  v13 = v11;
  if( v11 )
  {
    if( v11 == -1073741198 )
    {
      LODWORD(a6) = a4;
      LODWORD(a5) = 16;
      v13 = sub_14065FDF0((INT64 *)(a1 + 136), a2, v12, (INT64)&a2a, a5, a6);
      if( v13 >= 0 )
        v13 = sub_1405D23E0((volatile INT64 *)a2);
    }
  }
  else if( a3 )
  {
    sub_1405D23E0(a3a);
    a3a = 0i64;
    *a3 = v16;
  }
  sub_1405D2184(a3a);
  v14 = _InterlockedExchangeAdd64((volatile signed __int64 *)v8, 0xFFFFFFFFFFFFFFFFui64);
  if( (v14 & 2) != 0 && (v14 & 4) == 0 )
    ExfTryToWakePushLock((volatile INT64 *)v8);
  KeAbPostRelease(v8);
  KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
  return(unsigned int)v13;
}

Referenced by: