WbInPlaceEncryptionUnloadModule

INT64 __fastcall WbInPlaceEncryptionUnloadModule(INT64 a1, INT64 a2){
  _ETHREAD *CurrentThread; 
  int v3; 
  UINT64 *v6; 
  _BYTE *v7; 
  _BYTE *v8; 
  unsigned int i; 
  char v10; 
  __int64 v12; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v3 = 0;
  --*((_WORD *)CurrentThread + 243);
  v6 = (UINT64 *)(a1 + 176);
  LODWORD(v7) = KeAbPreAcquire((PVOID)(a1 + 176), 0i64, 0i64);
  v8 = v7;
  if( _interlockedbittestandset64((volatile signed __int32 *)v6, 0i64) )
    ExfAcquirePushLockExclusiveEx(v6, v7, v6);
  if( v8 )
    v8[26] |= 1u;
  for( i = 0; i < *(_DWORD *)(a1 + 140); ++i )
  {
    v12 = *(_QWORD *)(i * *(_DWORD *)(a1 + 136) + *(_QWORD *)(a1 + 152));
    if( v12 )
    {
      if( *(_QWORD *)(v12 + 32) == a2 )
      {
        v3 = sub_14065D374(a1 + 136, 0i64, 0i64, i, 0i64);
        if( v3 >= 0 )
        {
          sub_1405D2184((volatile INT64 *)v12);
          --i;
        }
      }
    }
  }
  v10 = _InterlockedExchangeAdd64((volatile signed __int64 *)v6, 0xFFFFFFFFFFFFFFFFui64);
  if( (v10 & 2) != 0 && (v10 & 4) == 0 )
    ExfTryToWakePushLock((volatile INT64 *)v6);
  KeAbPostRelease(v6);
  KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
  return(unsigned int)v3;
}

Referenced by: