WbInPlaceEncryptionUnloadModule

NTSTATUS __stdcall WbInPlaceEncryptionUnloadModule(INT64 a1, INT64 a2){
  _ETHREAD *CurrentThread; 
  NTSTATUS v3; 
  _EX_PUSH_LOCK *v6; 
  _BYTE *v7; 
  _BYTE *v8; 
  unsigned int i; 
  char v10; 
  __int64 v12; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v3 = 0;
  --CurrentThread->Tcb.SpecialApcDisable;
  v6 = (_EX_PUSH_LOCK *)(a1 + 176);
  v7 = KeAbPreAcquire((VOID *)(a1 + 176), 0i64, 0i64);
  v8 = v7;
  if( _interlockedbittestandset64((volatile signed __int32 *)v6, 0i64) )
    ExfAcquirePushLockExclusiveEx(v6, v7, v6);
  if( v8 )
    v8[26] |= 1u;
  for( i = 0; i < *(_DWORD *)(a1 + 140); ++i )
  {
    v12 = *(_QWORD *)(i * *(_DWORD *)(a1 + 136) + *(_QWORD *)(a1 + 152));
    if( v12 )
    {
      if( *(_QWORD *)(v12 + 32) == a2 )
      {
        v3 = sub_14065D374(a1 + 136, 0i64, 0, i, 0i64);
        if( v3 >= 0 )
        {
          sub_1405D2184((volatile signed __int64 *)v12);
          --i;
        }
      }
    }
  }
  v10 = _InterlockedExchangeAdd64(&v6->_bf_0, 0xFFFFFFFFFFFFFFFFui64);
  if( (v10 & 2) != 0 && (v10 & 4) == 0 )
    ExfTryToWakePushLock(v6);
  KeAbPostRelease(v6);
  KiLeaveGuardedRegionUnsafe((__int64)KeGetCurrentThread());
  return v3;
}

Referenced by: