PspLookupProcessQuotaBlock

_EPROCESS_QUOTA_BLOCK *__stdcall PspLookupProcessQuotaBlock(
        VOID *Key,
        UINT64 Len,
        UINT64 UseDefault,
        _EPROCESS_QUOTA_BLOCK *NewBlock){
  _ETHREAD *CurrentThread; 
  int v6; 
  unsigned int v8; 
  _EPROCESS_QUOTA_BLOCK *v9; 
  _EX_PUSH_LOCK *v10; 
  _EX_PUSH_LOCK *i; 
  _EX_PUSH_LOCK *v13; 
  _QWORD *QuotaList; 
  __int64 v16; 
  _QWORD *v17; 
  _EX_PUSH_LOCK **bf_0; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v6 = UseDefault;
  v8 = PspHashKeyValue(Key, Len);
  --CurrentThread->Tcb.KernelApcDisable;
  v9 = 0i64;
  v10 = &PspQuotaBlockTable[3 * v8];
  if( NewBlock )
    ExAcquirePushLockExclusiveEx(v10, 0i64);
  else
    ExAcquirePushLockSharedEx(v10, 0i64);
  if( Key )
  {
    for( i = (_EX_PUSH_LOCK *)v10[1]._bf_0; ; i = (_EX_PUSH_LOCK *)i->_bf_0 )
    {
      if( i == &v10[1] )
        goto LABEL_6;
      if( RtlEqualSid(Key, &i[7]) )
        break;
    }
    v9 = (_EPROCESS_QUOTA_BLOCK *)&i[-65];
  }
  else
  {
    if( !v6 )
      goto LABEL_6;
    v9 = PspDefaultQuotaBlock;
  }
  if( v9 )
  {
    if( (unsigned int)PspSafeReferenceQuotaBlock(v9) )
    {
      _InterlockedIncrement((volatile signed __int32 *)&v9->ProcessCount);
    }
    else
    {
      if( NewBlock && !v6 )
      {
        QuotaList = v9->QuotaList;
        v16 = *QuotaList;
        if( *(_QWORD **)(*QuotaList + 8i64) != QuotaList )
          goto LABEL_31;
        v17 = (_QWORD *)QuotaList[1];
        if( (_QWORD *)*v17 != QuotaList )
          goto LABEL_31;
        *v17 = v16;
        *(_QWORD *)(v16 + 8) = v17;
        *QuotaList = 0i64;
      }
      v9 = 0i64;
    }
  }
LABEL_6:
  if( NewBlock )
  {
    if( v9 )
    {
LABEL_17:
      PspUnlockQuotaListExclusive(CurrentThread, (UINT64)v10);
      return v9;
    }
    v13 = (_EX_PUSH_LOCK *)NewBlock->QuotaList;
    if( v6 )
    {
      PspDefaultQuotaBlock = NewBlock;
      v13->_bf_0 = 1i64;
      goto LABEL_17;
    }
    bf_0 = (_EX_PUSH_LOCK **)v10[2]._bf_0;
    if( *bf_0 == &v10[1] )
    {
      v13->_bf_0 = (__int64)&v10[1];
      *(_QWORD *)&NewBlock->QuotaList[8] = bf_0;
      *bf_0 = v13;
      v10[2]._bf_0 = (__int64)v13;
      goto LABEL_17;
    }
LABEL_31:
    __fastfail(3u);
  }
  PspUnlockQuotaListShared(CurrentThread, v10);
  return v9;
}

Referenced by: