WbRemoveWarbirdProcess

INT64 __fastcall WbRemoveWarbirdProcess(INT64 rcx0){
  _ETHREAD *CurrentThread; 
  _BYTE *v3; 
  _BYTE *v4; 
  int v5; 
  _ETHREAD *v7; 
  _BYTE *v8; 
  _BYTE *v9; 
  char v10; 
  volatile signed __int64 *a1; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  a1 = 0i64;
  --*((_WORD *)CurrentThread + 243);
  LODWORD(v3) = KeAbPreAcquire(&qword_140C53AF8, 0i64, 0i64);
  v4 = v3;
  if( _InterlockedCompareExchange64((volatile signed __int64 *)&qword_140C53AF8, 17i64, 0i64) )
    ExfAcquirePushLockSharedEx(&qword_140C53AF8, v3, &qword_140C53AF8);
  if( v4 )
    v4[26] |= 1u;
  v5 = sub_14065EAF4(rcx0, 0i64);
  if( _InterlockedCompareExchange64((volatile signed __int64 *)&qword_140C53AF8, 0i64, 17i64) != 17 )
    ExfReleasePushLockShared((INT64 *)&qword_140C53AF8);
  KeAbPostRelease(&qword_140C53AF8);
  KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
  if( v5 >= 0 )
  {
    v7 = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)v7 + 243);
    LODWORD(v8) = KeAbPreAcquire(&qword_140C53AF8, 0i64, 0i64);
    v9 = v8;
    if( _interlockedbittestandset64((volatile signed __int32 *)&qword_140C53AF8, 0i64) )
      ExfAcquirePushLockExclusiveEx(&qword_140C53AF8, v8, &qword_140C53AF8);
    if( v9 )
      v9[26] |= 1u;
    v5 = sub_14065D374((INT64)&qword_140C53AD0, rcx0, 8ui64, 0xFFFFFFFFi64, &a1);
    v10 = _InterlockedExchangeAdd64((volatile signed __int64 *)&qword_140C53AF8, 0xFFFFFFFFFFFFFFFFui64);
    if( (v10 & 2) != 0 && (v10 & 4) == 0 )
      ExfTryToWakePushLock((volatile INT64 *)&qword_140C53AF8);
    KeAbPostRelease(&qword_140C53AF8);
    KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
    sub_14065E8E4(a1);
  }
  return(unsigned int)v5;
}

Referenced by: