WbGetWarbirdProcess

INT64 __fastcall WbGetWarbirdProcess(INT64 a1, INT64 rdx0, INT64 **a3){
  volatile signed __int64 *v3; 
  _ETHREAD *CurrentThread; 
  int v6; 
  _BYTE *v8; 
  _BYTE *v9; 
  int v10; 
  _ETHREAD *v12; 
  _BYTE *v13; 
  INT64 v14; 
  _BYTE *v15; 
  INT64 v16; 
  char v17; 
  INT64 a5; 
  UINT64 a6; 
  INT64 a2; 
  v3 = 0i64;
  a2 = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v6 = rdx0;
  --*((_WORD *)CurrentThread + 243);
  LODWORD(v8) = KeAbPreAcquire(&qword_140C53AF8, 0i64, 0i64);
  v9 = v8;
  if( _InterlockedCompareExchange64((volatile signed __int64 *)&qword_140C53AF8, 17i64, 0i64) )
    ExfAcquirePushLockSharedEx(&qword_140C53AF8, v8, &qword_140C53AF8);
  if( v9 )
    v9[26] |= 1u;
  v10 = sub_14065EAF4(a1, &a2);
  if( _InterlockedCompareExchange64((volatile signed __int64 *)&qword_140C53AF8, 0i64, 17i64) != 17 )
    ExfReleasePushLockShared((INT64 *)&qword_140C53AF8);
  KeAbPostRelease(&qword_140C53AF8);
  KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
  if( v10 == -1073741198 )
  {
    if( !v6 )
      goto LABEL_24;
    v10 = WbCreateWarbirdProcess(a1, &a2);
    if( v10 < 0 )
      goto LABEL_24;
    v12 = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)v12 + 243);
    LODWORD(v13) = KeAbPreAcquire(&qword_140C53AF8, 0i64, 0i64);
    v15 = v13;
    if( _interlockedbittestandset64((volatile signed __int32 *)&qword_140C53AF8, 0i64) )
      ExfAcquirePushLockExclusiveEx(&qword_140C53AF8, v13, &qword_140C53AF8);
    if( v15 )
      v15[26] |= 1u;
    v16 = a2;
    LODWORD(a6) = -1;
    LODWORD(a5) = 8;
    v10 = sub_14065FDF0(&qword_140C53AD0, a2, v14, *(_QWORD *)a2, a5, a6);
    if( v10 >= 0 )
      _InterlockedIncrement64((volatile signed __int64 *)(v16 + 232));
    v17 = _InterlockedExchangeAdd64((volatile signed __int64 *)&qword_140C53AF8, 0xFFFFFFFFFFFFFFFFui64);
    if( (v17 & 2) != 0 && (v17 & 4) == 0 )
      ExfTryToWakePushLock((volatile INT64 *)&qword_140C53AF8);
    KeAbPostRelease(&qword_140C53AF8);
    KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
  }
  if( v10 < 0 || !a3 )
  {
LABEL_24:
    v3 = (volatile signed __int64 *)a2;
    goto LABEL_11;
  }
  *a3 = (INT64 *)a2;
LABEL_11:
  sub_14065E8E4(v3);
  return(unsigned int)v10;
}

Referenced by: