WbGetWarbirdEncryptionSegment
INT64 __fastcall WbGetWarbirdEncryptionSegment(INT64 rcx0, INT64 a2, volatile INT64 **r8_0){
_ETHREAD *CurrentThread;
UINT64 *v7;
_BYTE *v8;
_BYTE *v9;
int v10;
volatile INT64 *v11;
int v13;
volatile INT64 *v14;
volatile INT64 *a1;
INT64 a4;
volatile INT64 *a3;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
a3 = 0i64;
a1 = 0i64;
--*((_WORD *)CurrentThread + 243);
v7 = (UINT64 *)(rcx0 + 176);
LODWORD(v8) = KeAbPreAcquire((PVOID)(rcx0 + 176), 0i64, 0i64);
v9 = v8;
if( _InterlockedCompareExchange64((volatile signed __int64 *)v7, 17i64, 0i64) )
ExfAcquirePushLockSharedEx(v7, v8, v7);
if( v9 )
v9[26] |= 1u;
v10 = sub_1405D21B8(rcx0, a2, &a3, &a4);
if( _InterlockedCompareExchange64((volatile signed __int64 *)v7, 0i64, 17i64) != 17 )
ExfReleasePushLockShared((INT64 *)v7);
KeAbPostRelease(v7);
KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
if( v10 == -1073741198 )
{
v13 = sub_1405D1CA0(a2, &a3);
v11 = a3;
v10 = v13;
if( v13 < 0 )
goto LABEL_11;
v10 = WbAddWarbirdEncryptionSegment(rcx0, (INT64)a3, &a1);
if( v10 < 0 )
goto LABEL_11;
v14 = a1;
if( a1 )
{
sub_1405D2184(v11);
v11 = v14;
}
}
else
{
v11 = a3;
if( v10 < 0 )
goto LABEL_11;
}
if( r8_0 )
{
*r8_0 = v11;
v11 = 0i64;
}
LABEL_11:
sub_1405D2184(v11);
sub_1405D2184(a1);
return(unsigned int)v10;
}Referenced by:
WbGetInitializedEncryptionSegment