NtQueryInformationJobObject
NTSTATUS __stdcall NtQueryInformationJobObject(
VOID *JobHandle,
_JOBOBJECTINFOCLASS JobObjectInformationClass,
VOID *JobObjectInformation,
UINT64 JobObjectInformationLength,
UINT64 *ReturnLength){
__int64 v5;
PKINTERRUPT_ROUTINE *v8;
__int64 v9;
unsigned int v10;
int v11;
_ETHREAD *v12;
CHAR PreviousMode;
__int64 v14;
NTSTATUS result;
_EJOB *v16;
_EJOB *v17;
__int128 *p_IoAttributionInfo;
NTSTATUS SiloRootDirectoryPath;
UINT64 *v20;
VOID *v21;
bool v22;
int v23;
int v24;
_DWORD *v25;
_QWORD *v26;
__int64 v27;
__int64 v28;
__int64 v29;
__int64 v30;
__int64 v31;
int i;
_DWORD *v33;
int v34;
int *v35;
_BYTE *v36;
int v37;
int v38;
UINT8 *v39;
int v40;
_DWORD *v41;
__int64 v42;
UINT64 v43;
__int64 *v44;
__int64 v45;
_ETHREAD *v46;
__int64 v47;
int k;
_DWORD *v49;
__int64 v50;
int v51;
_DWORD *v52;
_DWORD *v53;
int v54;
__int32 v55;
__int32 v56;
__int32 v57;
__int32 v58;
__int64 v59;
int v60;
int j;
int v62;
_EJOB *v63;
unsigned int v64;
int v65;
UINT16 v66;
_QWORD *v67;
UINT16 v68;
int v69;
unsigned int v70;
int v71;
int v72;
unsigned int v73;
_KAFFINITY_EX *v74;
int v75;
char *v76;
_QWORD *v77;
UINT16 v78;
unsigned int v79;
__int64 v80;
int v81;
int v82;
_EJOB *v83;
_EJOB *v84;
int v85;
int v86;
int v87;
char v88;
_EJOB *v89;
_ESERVERSILO_GLOBALS *ServerSiloGlobals;
size_t v91;
__int64 v92;
_EJOB *JobSilo;
unsigned __int16 Length;
UINT64 Tag;
char v96;
char v98;
unsigned int v99;
bool v100;
bool v101;
CHAR v102;
UINT16 Group;
INT64 v104;
_ETHREAD *CurrentThread;
unsigned int v106;
_EJOB *Job;
size_t Size;
__int16 v109;
char v110;
VOID *Handle;
_EJOB *ServerSilo;
int v113;
int v114;
int v115;
_DWORD OverQuotaRate[7];
int v117;
__int64 v118;
__int64 v119;
__int64 v120;
__int64 v121;
VOID **ApiSetSchema;
_UNICODE_STRING DirectoryName;
__int128 v124;
__int128 v125;
UINT64 *ApiSetSchemaSize;
__int64 v127;
__int64 JobObjectInformationa[14];
__int128 v129;
__int128 v130;
__int128 v131;
__int128 v132[5];
__int128 v133;
__int128 v134;
__int128 v135;
__int128 v136;
__int128 v137;
__int128 v138;
__int64 v139;
_BYTE v140[40];
__int128 v141;
__int128 v142;
int v143;
__int128 v144;
_QWORD v145[10];
_QWORD v146[12];
__int64 v147[20];
char WakeInfo[64];
_JOBOBJECT_IO_ATTRIBUTION_INFORMATION IoAttributionInfo;
_OWORD v150[11];
char Information[448];
char v152[320];
__int16 Src[20];
v5 = (unsigned int)JobObjectInformationLength;
LODWORD(v104) = JobObjectInformationLength;
Handle = JobHandle;
*(_QWORD *)&OverQuotaRate[3] = JobObjectInformation;
*(_QWORD *)&OverQuotaRate[5] = ReturnLength;
memset(Information, 0i64, sizeof(Information));
memset(v150, 0i64, 0xA8u);
v100 = 0;
v114 = 0;
v119 = 0i64;
v115 = 0;
v141 = 0i64;
v142 = 0i64;
v143 = 0;
v144 = 0i64;
v118 = 0i64;
v113 = 0;
v121 = 0i64;
memset(v147, 0i64, 0x98u);
v129 = 0i64;
Group = 0;
memset(&IoAttributionInfo, 0i64, sizeof(IoAttributionInfo));
Job = 0i64;
v117 = 0;
memset(JobObjectInformationa, 0i64, 0x68u);
memset(v145, 0i64, sizeof(v145));
memset(v146, 0i64, 0x58u);
memset(v140, 0, sizeof(v140));
v130 = 0i64;
memset(v132, 0i64, 0x48u);
v133 = 0i64;
v134 = 0i64;
v135 = 0i64;
v136 = 0i64;
v137 = 0i64;
v138 = 0i64;
v139 = 0i64;
OverQuotaRate[0] = 0;
*(_QWORD *)&DirectoryName.Length = 0i64;
v120 = 0i64;
memset(WakeInfo, 0i64, sizeof(WakeInfo));
v131 = 0i64;
v124 = 0i64;
v125 = 0i64;
ServerSilo = 0i64;
v98 = 0;
v101 = 0;
v9 = (unsigned int)(JobObjectInformationClass - 1);
if( (unsigned int)v9 > 0x2E )
return -1073741821;
switch( JobObjectInformationClass )
{
case JobObjectExtendedLimitInformation:
if( (_DWORD)v5 == 144 || (_DWORD)v5 == 152 )
goto LABEL_7;
return -1073741820;
case JobObjectNotificationLimitInformation:
if( (_DWORD)v5 == 48 )
goto LABEL_7;
v22 = (_DWORD)v5 == 56;
goto LABEL_88;
case JobObjectLimitViolationInformation:
if( (_DWORD)v5 == 80 )
goto LABEL_7;
v22 = (_DWORD)v5 == 88;
LABEL_88:
if( v22 )
goto LABEL_7;
return -1073741820;
case JobObjectExtendedAccountingInformation:
if( (_DWORD)v5 == 432 )
goto LABEL_7;
v22 = (_DWORD)v5 == 448;
goto LABEL_88;
case JobObjectWakeInformation:
if( (_DWORD)v5 == 40 )
goto LABEL_7;
v22 = (_DWORD)v5 == 64;
goto LABEL_88;
case JobObjectMemoryUsageInformation:
if( (_DWORD)v5 == 16 )
goto LABEL_7;
v22 = (_DWORD)v5 == 40;
goto LABEL_88;
case JobObjectContainerId:
if( (_DWORD)v5 == 16 )
goto LABEL_7;
v22 = (_DWORD)v5 == 36;
goto LABEL_88;
}
if( JobObjectInformationClass != JobObjectMemoryPartitionInformation )
{
v10 = PspJobInfoLengths[(int)v9];
v99 = v10;
if( (_DWORD)v5 == v10 )
goto LABEL_8;
if( (JobObjectInformationClass == JobObjectBasicProcessIdList
|| JobObjectInformationClass == JobObjectSecurityLimitInformation
|| JobObjectInformationClass == JobObjectGroupInformation
|| JobObjectInformationClass == JobObjectGroupInformationEx
|| JobObjectInformationClass == JobObjectIoRateControlInformation
|| JobObjectInformationClass == JobObjectSiloRootDirectory)
&& (unsigned int)v5 >= v10 )
{
LABEL_7:
v99 = v5;
v10 = v5;
LABEL_8:
v11 = 1;
goto LABEL_9;
}
return -1073741820;
}
if( (_DWORD)v5 != 1 )
return -1073741820;
v11 = 1;
v10 = 1;
v99 = 1;
LABEL_9:
Size = v10;
v12 = (_ETHREAD *)KeGetCurrentThread();
CurrentThread = v12;
PreviousMode = v12->Tcb.PreviousMode;
v102 = PreviousMode;
if( PreviousMode )
{
if( (_DWORD)v5 )
{
if( ((PspJobInfoAlign[(int)v9] - 1) & (unsigned int)JobObjectInformation) != 0 )
ExRaiseDatatypeMisalignment();
v9 = 0x7FFFFFFF0000i64;
if( (unsigned __int64)JobObjectInformation + v5 > 0x7FFFFFFF0000i64
|| (char *)JobObjectInformation + v5 < JobObjectInformation )
{
MEMORY[0x7FFFFFFF0000] = 0;
}
}
else
{
v9 = 0x7FFFFFFF0000i64;
}
if( ReturnLength )
{
v14 = (__int64)ReturnLength;
if( (unsigned __int64)ReturnLength >= 0x7FFFFFFF0000i64 )
v14 = 0x7FFFFFFF0000i64;
*(_DWORD *)v14 = *(_DWORD *)v14;
}
PreviousMode = v102;
}
if( Handle )
{
LODWORD(Tag) = 2035381072;
result = ObpReferenceObjectByHandleWithTag(
Handle,
4ui64,
(_OBJECT_TYPE *)PsJobType,
PreviousMode,
Tag,
(VOID **)&Job,
0i64,
0i64);
if( result < 0 )
return result;
v17 = Job;
goto LABEL_25;
}
v16 = v12->Tcb.ApcState.Process->Job;
Job = v16;
v17 = v16;
if( v16 )
{
ObfReferenceObjectWithTag(v16, 0x79517350ui64);
LABEL_25:
v12 = CurrentThread;
goto LABEL_26;
}
if( ((JobObjectInformationClass - 31) & 0xFFFFFFF7) != 0 )
return -1073741790;
LABEL_26:
v106 = v10;
v96 = 0;
p_IoAttributionInfo = 0i64;
SiloRootDirectoryPath = 0;
if( JobObjectInformationClass > JobObjectWakeInformation )
{
if( JobObjectInformationClass > JobObjectSiloBasicInformation )
{
v55 = JobObjectInformationClass - 37;
if( v55 )
{
v56 = v55 - 1;
if( v56 )
{
v57 = v56 - 1;
if( !v57 )
{
if( v17 )
{
PsGetJobServerSilo(v17, &ServerSilo);
v89 = ServerSilo;
}
else
{
LODWORD(v89) = HalSystemVectorDispatchEntry((UINT32)v16, (PKINTERRUPT_ROUTINE **)v9, v8);
}
ServerSiloGlobals = PsGetServerSiloGlobals(v89);
v21 = JobObjectInformation;
memmove(JobObjectInformation, ServerSiloGlobals->UserSharedData, v91);
v96 = 1;
v20 = ReturnLength;
goto LABEL_40;
}
v58 = v57 - 3;
if( !v58 )
{
PspLockJobShared(v17, v12);
SiloRootDirectoryPath = PspQueryJobIoAttribution(v17, &IoAttributionInfo);
PspUnlockJob(v17, CurrentThread);
p_IoAttributionInfo = (__int128 *)&IoAttributionInfo;
goto LABEL_38;
}
v85 = v58 - 1;
if( !v85 )
{
SiloRootDirectoryPath = 0;
v88 = v98;
if( (unsigned __int64)(*((_QWORD *)v17 + 195) - 1i64) <= 0xFFFFFFFFFFFFFFFDui64 )
v88 = 1;
v98 = v88;
p_IoAttributionInfo = (__int128 *)&v98;
goto LABEL_38;
}
v86 = v85 - 1;
if( !v86 )
{
v144 = *(_OWORD *)((char *)v17 + 1256);
p_IoAttributionInfo = &v144;
goto LABEL_37;
}
v87 = v86 - 2;
if( !v87 )
{
PspLockJobShared(v17, v12);
v121 = *((_QWORD *)v17 + 197);
PspUnlockJob(v17, CurrentThread);
p_IoAttributionInfo = (__int128 *)&v121;
goto LABEL_37;
}
if( v87 == 1 )
{
v101 = (*((_DWORD *)v17 + 331) & 2) != 0;
p_IoAttributionInfo = (__int128 *)&v101;
goto LABEL_37;
}
goto LABEL_212;
}
PsGetJobServerSilo(v17, &ServerSilo);
v63 = ServerSilo;
if( !PsIsHostSilo(ServerSilo) )
{
v92 = *((_QWORD *)v63 + 159);
*(_QWORD *)((char *)&v124 + 4) = *(_QWORD *)(v92 + 1112);
BYTE12(v124) = *(_BYTE *)(v92 + 1176);
if( v102 )
{
v125 = 0i64;
}
else
{
ApiSetSchema = 0i64;
MmQueryApiSetSchema(&ApiSetSchema, &ApiSetSchemaSize);
*(_QWORD *)&v125 = PsGetServerSiloGlobals(v63)->ApiSetSchema;
*((_QWORD *)&v125 + 1) = *ApiSetSchema;
}
LODWORD(v124) = PsGetServerSiloServiceSessionId((INT64)v63);
SiloRootDirectoryPath = 0;
p_IoAttributionInfo = &v124;
goto LABEL_38;
}
}
else
{
JobSilo = PspGetJobSilo(v17);
if( JobSilo )
{
DirectoryName.Buffer = 0i64;
SiloRootDirectoryPath = ObGetSiloRootDirectoryPath(JobSilo, &DirectoryName);
if( SiloRootDirectoryPath >= 0 )
{
v96 = 1;
Length = DirectoryName.Length;
v10 = DirectoryName.Length + 16;
v99 = v10;
if( v10 > (unsigned int)v104 )
{
SiloRootDirectoryPath = -1073741789;
v21 = JobObjectInformation;
v20 = ReturnLength;
}
else
{
v21 = JobObjectInformation;
*(_WORD *)JobObjectInformation = DirectoryName.Length;
*((_WORD *)JobObjectInformation + 1) = Length;
*((_QWORD *)JobObjectInformation + 1) = (char *)JobObjectInformation + 16;
memmove((char *)JobObjectInformation + 16, DirectoryName.Buffer, Length);
v20 = ReturnLength;
if( ReturnLength )
*(_DWORD *)ReturnLength = v10;
}
ExFreePoolWithTag(DirectoryName.Buffer, 0);
goto LABEL_40;
}
goto LABEL_38;
}
}
}
else
{
if( JobObjectInformationClass != JobObjectSiloBasicInformation )
{
switch( JobObjectInformationClass )
{
case JobObjectBackgroundInformation:
v100 = (*((_DWORD *)v17 + 330) & 0x400) != 0;
p_IoAttributionInfo = (__int128 *)&v100;
goto LABEL_37;
case JobObjectInterferenceInformation:
v21 = JobObjectInformation;
SiloRootDirectoryPath = PspQueryJobHierarchyInterferenceCount(v17, JobObjectInformation, v8, v12);
if( SiloRootDirectoryPath < 0 )
{
v82 = 0;
}
else
{
v96 = 1;
v82 = 8;
}
v106 = v82;
goto LABEL_62;
case JobObjectMemoryUsageInformation:
*(_OWORD *)&v140[24] = 0i64;
PspLockJobMemoryLimitsShared(v17, v12);
*(_QWORD *)&v140[8] = *((_QWORD *)v17 + 76) << 12;
*(_QWORD *)v140 = *((_QWORD *)v17 + 122) << 12;
*(_QWORD *)&v140[16] = *((_QWORD *)v17 + 167) << 12;
v17 = Job;
PspUnlockJobMemoryLimitsShared(Job, CurrentThread);
p_IoAttributionInfo = (__int128 *)v140;
goto LABEL_37;
case JobObjectSharedCommit:
v120 = *((_QWORD *)v17 + 167);
p_IoAttributionInfo = (__int128 *)&v120;
SiloRootDirectoryPath = 0;
v17 = Job;
goto LABEL_38;
case JobObjectContainerId:
v141 = *(_OWORD *)((char *)v17 + 1240);
if( (_DWORD)v104 == 36 )
{
v142 = *(_OWORD *)((char *)v17 + 1256);
v143 = *((_DWORD *)v17 + 309);
}
p_IoAttributionInfo = &v141;
goto LABEL_37;
case JobObjectIoRateControlInformation:
SiloRootDirectoryPath = -1073741822;
goto LABEL_38;
case JobObjectNetRateControlInformation:
PspLockJobShared(v17, v12);
v80 = *((_QWORD *)v17 + 164);
if( v80 )
{
DWORD2(v130) = 1;
v81 = *(_DWORD *)(v80 + 48);
if( (v81 & 1) != 0 )
{
v11 = 3;
DWORD2(v130) = 3;
*(_QWORD *)&v130 = *(_QWORD *)(v80 + 40);
}
if( (v81 & 2) != 0 )
{
DWORD2(v130) = v11 | 4;
BYTE12(v130) = *(_BYTE *)(v80 + 64);
}
}
PspUnlockJob(v17, CurrentThread);
p_IoAttributionInfo = &v130;
goto LABEL_37;
case JobObjectNotificationLimitInformation2:
goto LABEL_124;
case JobObjectLimitViolationInformation2:
goto LABEL_94;
}
goto LABEL_212;
}
if( (*((_DWORD *)v17 + 330) & 0x40000000) != 0 )
{
LODWORD(v131) = *((_DWORD *)v17 + 309);
LODWORD(v83) = PsGetParentSilo((INT64)v17);
v84 = v83;
if( PsIsHostSilo(v83) )
DWORD1(v131) = 0;
else
DWORD1(v131) = *((_DWORD *)v84 + 309);
DWORD2(v131) = *((_DWORD *)v17 + 306);
BYTE12(v131) = PspIsSiloInServerSilo(v17);
p_IoAttributionInfo = &v131;
goto LABEL_37;
}
}
SiloRootDirectoryPath = -1073740535;
goto LABEL_38;
}
if( JobObjectInformationClass == JobObjectWakeInformation )
{
SiloRootDirectoryPath = PspAllocateAndQueryNotificationChannel(v12, v17, (_JOBOBJECT_WAKE_INFORMATION *)WakeInfo);
v21 = JobObjectInformation;
v20 = ReturnLength;
if( SiloRootDirectoryPath >= 0 )
{
p_IoAttributionInfo = (__int128 *)WakeInfo;
SiloRootDirectoryPath = 0;
}
goto LABEL_40;
}
if( JobObjectInformationClass > JobObjectGroupInformation )
{
if( JobObjectInformationClass != JobObjectNotificationLimitInformation )
{
if( JobObjectInformationClass != JobObjectLimitViolationInformation )
{
if( JobObjectInformationClass != JobObjectGroupInformationEx )
{
switch( JobObjectInformationClass )
{
case JobObjectCpuRateControlInformation:
PspLockJobShared(v17, v12);
v59 = *((_QWORD *)v17 + 126);
if( v59 )
{
v60 = *(_DWORD *)(v59 + 40);
if( (v60 & 0x40) == 0 )
{
HIDWORD(v118) = *(_DWORD *)(v59 + 44);
v70 = ((v60 & 4 | 2u) >> 1) | 4;
if( (v60 & 1) == 0 )
v70 = (v60 & 4 | 2u) >> 1;
v71 = v70 | 8;
if( (v60 & 2) == 0 )
v71 = v70;
v72 = v71 | 0x10;
if( (v60 & 0x20) == 0 )
v72 = v71;
LODWORD(v118) = v72;
}
}
PspUnlockJob(v17, CurrentThread);
p_IoAttributionInfo = (__int128 *)&v118;
goto LABEL_37;
case JobObjectCompletionFilter:
v115 = *((_DWORD *)v17 + 219);
p_IoAttributionInfo = (__int128 *)&v115;
goto LABEL_37;
case JobObjectCompletionCounter:
v119 = *((_QWORD *)v17 + 59);
p_IoAttributionInfo = (__int128 *)&v119;
goto LABEL_37;
case JobObjectFreezeInformation:
LODWORD(v129) = 7;
WORD3(v129) = 0;
PspLockJobShared(v17, v12);
v69 = *((_DWORD *)v17 + 330);
BYTE4(v129) = (v69 & 0x200) != 0;
BYTE5(v129) = (v69 & 0x80000) != 0;
*((_QWORD *)&v129 + 1) = *((_QWORD *)v17 + 119);
PspUnlockJob(v17, CurrentThread);
p_IoAttributionInfo = &v129;
goto LABEL_37;
}
goto LABEL_36;
}
if( ReturnLength )
{
v73 = v104;
if( (v104 & 0xF) == 0 )
{
PspLockJobShared(v17, v12);
if( (*((_DWORD *)v17 + 64) & 0x10) != 0 )
v74 = (_KAFFINITY_EX *)((char *)v17 + 264);
else
v74 = &KeActiveProcessors;
v150[0] = *(_OWORD *)&v74->Count;
v150[1] = *(_OWORD *)&v74->Bitmap[1];
v150[2] = *(_OWORD *)&v74->Bitmap[3];
v150[3] = *(_OWORD *)&v74->Bitmap[5];
v150[4] = *(_OWORD *)&v74->Bitmap[7];
v150[5] = *(_OWORD *)&v74->Bitmap[9];
v150[6] = *(_OWORD *)&v74->Bitmap[11];
v150[7] = *(_OWORD *)&v74->Bitmap[13];
v150[8] = *(_OWORD *)&v74->Bitmap[15];
v150[9] = *(_OWORD *)&v74->Bitmap[17];
*(_QWORD *)&v150[10] = v74->Bitmap[19];
PspUnlockJob(v17, CurrentThread);
v75 = LOWORD(v150[0]);
memset(v152, 0i64, 16 * LOWORD(v150[0]));
if( (_WORD)v75 )
{
v76 = v152;
v77 = (_QWORD *)v150 + 1;
v78 = Group;
do
{
*((_WORD *)v76 + 4) = v78;
*(_QWORD *)v76 = *v77;
++v78;
++v77;
v76 += 16;
}
while( v78 < (unsigned __int16)v75 );
}
v79 = 16 * v75;
v106 = v79;
SiloRootDirectoryPath = v73 < 16 * v75 ? 0xC0000023 : 0;
v10 = v73;
if( v73 >= v79 )
v10 = v79;
Size = v10;
v96 = 1;
v21 = JobObjectInformation;
memmove(JobObjectInformation, v152, v10);
v20 = ReturnLength;
goto LABEL_40;
}
}
LABEL_188:
SiloRootDirectoryPath = -1073741811;
goto LABEL_38;
}
LABEL_94:
JobObjectInformationa[9] = 0i64;
*(_OWORD *)&JobObjectInformationa[11] = 0i64;
v109 = 0;
v110 = 0;
PspQueryJobHierarchyAccountingInformation(v17, (_JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION *)Information);
JobObjectInformationa[1] = *(_QWORD *)&Information[72];
JobObjectInformationa[3] = *(_QWORD *)&Information[80];
JobObjectInformationa[5] = *(_QWORD *)Information;
PspLockJobExclusive(v17, CurrentThread);
v24 = *((_DWORD *)v17 + 330);
if( (v24 & 8) == 0 || (v24 & 0x4000) == 0 )
{
_InterlockedAnd((volatile signed __int32 *)v17 + 330, 0xFFFFFFFB);
v17 = Job;
}
ExAcquirePushLockSharedEx((_EX_PUSH_LOCK *)v17 + 129, 0i64);
JobObjectInformationa[7] = *((_QWORD *)v17 + 122) << 12;
PspUnlockJobMemoryLimitsShared(v17, 0i64);
v25 = (_DWORD *)*((_QWORD *)v17 + 123);
if( v25 )
{
LODWORD(JobObjectInformationa[0]) = *v25;
HIDWORD(JobObjectInformationa[0]) = *(_DWORD *)(*((_QWORD *)v17 + 123) + 4i64);
v26 = (_QWORD *)*((_QWORD *)v17 + 123);
v27 = v26[9];
if( !v27 )
v27 = v26[1];
JobObjectInformationa[2] = v27;
v28 = v26[10];
if( !v28 )
v28 = v26[2];
JobObjectInformationa[4] = v28;
v29 = v26[11];
if( !v29 )
v29 = v26[3];
JobObjectInformationa[6] = v29;
v30 = v26[12];
if( !v30 )
v30 = v26[4];
JobObjectInformationa[10] = v30 << 12;
v31 = v26[13];
if( !v31 )
v31 = v26[5];
JobObjectInformationa[8] = v31 << 12;
for( i = 0; i < 3; i = v34 + 1 )
{
v33 = (_DWORD *)PspLimitViolationRateControlToleranceLimitField((__int64)JobObjectInformationa, i);
v37 = v35[16];
if( v37 )
*v36 = 1;
else
v37 = *v35;
*v33 = v37;
}
}
else
{
JobObjectInformationa[0] = 0i64;
JobObjectInformationa[2] = 0i64;
JobObjectInformationa[4] = 0i64;
JobObjectInformationa[6] = 0i64;
JobObjectInformationa[10] = 0i64;
JobObjectInformationa[8] = 0i64;
for( j = 0; j < 3; j = v62 + 1 )
*(_DWORD *)PspLimitViolationRateControlToleranceLimitField((__int64)JobObjectInformationa, j) = 0;
}
v38 = 0;
v39 = (UINT8 *)&v109;
ServerSilo = (_EJOB *)60;
do
{
if( *((_QWORD *)v17 + 123)
&& (v40 = PspRateControlLimitFlag((PSP_JOB_RATE_CONTROL_TYPE)v38), (v40 & *v41) != 0) )
{
v43 = *(unsigned int *)((char *)v41 + v42);
}
else
{
v43 = 1i64;
}
OverQuotaRate[1] = v43;
PspQueryRateControlHistory(v17, v43, *v39, (UINT64 *)OverQuotaRate, (_PSP_JOB_RATE_CONTROL_TYPE)v38);
if( v38 )
{
if( v38 == 1 )
v44 = &JobObjectInformationa[11];
else
v44 = &JobObjectInformationa[9];
}
else
{
v44 = &JobObjectInformationa[12];
}
*(_DWORD *)v44 = OverQuotaRate[0];
++v38;
ServerSilo = (_EJOB *)((char *)ServerSilo + 4);
++v39;
}
while( v38 < 3 );
v45 = *((_QWORD *)v17 + 123);
v46 = CurrentThread;
if( v45 )
{
*(_DWORD *)(v45 + 4) = 0;
memset((VOID *)(*((_QWORD *)v17 + 123) + 72i64), 0i64, 0x40u);
}
PspUnlockJob(v17, v46);
if( (_DWORD)v104 == 88 )
{
v146[1] = JobObjectInformationa[1];
v146[2] = JobObjectInformationa[2];
v146[3] = JobObjectInformationa[3];
v146[4] = JobObjectInformationa[4];
v146[5] = JobObjectInformationa[5];
v146[6] = JobObjectInformationa[6];
v146[7] = JobObjectInformationa[7];
v146[8] = JobObjectInformationa[10];
v146[9] = JobObjectInformationa[8];
v146[10] = JobObjectInformationa[9];
v146[0] = JobObjectInformationa[0] & 0x27820400278204i64;
p_IoAttributionInfo = (__int128 *)v146;
}
else if( (_DWORD)v104 == 80 )
{
v145[1] = JobObjectInformationa[1];
v145[2] = JobObjectInformationa[2];
v145[3] = JobObjectInformationa[3];
v145[4] = JobObjectInformationa[4];
v145[5] = JobObjectInformationa[5];
v145[6] = JobObjectInformationa[6];
v145[7] = JobObjectInformationa[7];
v145[8] = JobObjectInformationa[8];
v145[9] = JobObjectInformationa[9];
v145[0] = JobObjectInformationa[0] & 0x7020400070204i64;
p_IoAttributionInfo = (__int128 *)v145;
}
else
{
p_IoAttributionInfo = (__int128 *)JobObjectInformationa;
}
SiloRootDirectoryPath = 0;
goto LABEL_38;
}
LABEL_124:
PspLockJobShared(v17, v12);
v47 = *((_QWORD *)v17 + 123);
if( v47 )
{
DWORD2(v132[2]) = *(_DWORD *)v47;
v132[0] = *(_OWORD *)(v47 + 8);
*(_QWORD *)&v132[1] = *(_QWORD *)(v47 + 24);
*(_QWORD *)&v132[3] = *(_QWORD *)(v47 + 32) << 12;
*((_QWORD *)&v132[1] + 1) = *(_QWORD *)(v47 + 40) << 12;
for( k = 0; k < 3; k = v54 + 1 )
{
v49 = (_DWORD *)PspNotificationLimitRateControlToleranceField((__int64)v132, k);
*v49 = *(_DWORD *)(v50 - 12);
v52 = (_DWORD *)PspNotificationLimitRateControlToleranceIntervalField((__int64)v132, v51);
*v52 = *v53;
}
}
PspUnlockJob(v17, CurrentThread);
if( (_DWORD)v104 == 56 )
{
v136 = v132[0];
*(_QWORD *)&v137 = *(_QWORD *)&v132[1];
*((_QWORD *)&v137 + 1) = *(_QWORD *)&v132[3];
v138 = *(__int128 *)((char *)&v132[1] + 8);
v139 = DWORD2(v132[2]) & 0x278204i64;
p_IoAttributionInfo = &v136;
}
else if( (_DWORD)v104 == 48 )
{
v133 = v132[0];
v134 = v132[1];
*(_QWORD *)&v135 = *(_QWORD *)&v132[2];
*((_QWORD *)&v135 + 1) = DWORD2(v132[2]) & 0x70204i64;
p_IoAttributionInfo = &v133;
}
else
{
p_IoAttributionInfo = v132;
}
goto LABEL_37;
}
if( JobObjectInformationClass == JobObjectGroupInformation )
{
if( ReturnLength )
{
v64 = v104;
if( (v104 & 1) == 0 )
{
PspLockJobShared(v17, v12);
v65 = 0;
v66 = *((_WORD *)v17 + 132);
if( v66 )
{
v67 = (_QWORD *)((char *)v17 + 272);
v68 = Group;
do
{
if( *v67 )
Src[v65++] = v68;
++v68;
++v67;
}
while( v68 < v66 );
}
PspUnlockJob(v17, CurrentThread);
v10 = 2 * v65;
v106 = v10;
v96 = 1;
SiloRootDirectoryPath = v64 < v10 ? 0xC0000023 : 0;
if( v10 > v64 )
v10 = Size;
Size = v10;
v21 = JobObjectInformation;
memmove(JobObjectInformation, Src, v10);
v20 = ReturnLength;
goto LABEL_40;
}
}
goto LABEL_188;
}
if( JobObjectInformationClass != JobObjectBasicAccountingInformation )
{
switch( JobObjectInformationClass )
{
case JobObjectBasicLimitInformation:
LABEL_79:
PspLockJobShared(v17, v12);
v147[3] = *((_QWORD *)v17 + 30);
v147[4] = *((_QWORD *)v17 + 31);
LODWORD(v147[5]) = *((_DWORD *)v17 + 65);
LODWORD(v147[7]) = *((unsigned __int8 *)v17 + 873);
HIDWORD(v147[7]) = *((_DWORD *)v17 + 121);
KeIsSingleGroupAffinityEx((_KAFFINITY_EX *)((char *)v17 + 264), &Group);
if( v23 )
v147[6] = *((_QWORD *)v17 + Group + 34);
else
v147[6] = 0i64;
v147[0] = *((_QWORD *)v17 + 28);
v147[1] = *((_QWORD *)v17 + 29);
LODWORD(v147[2]) = (PspGetJobLimitInformationValidFlags(
(unsigned int)JobObjectInformationClass,
(unsigned int)v104) | 0x7FFF) & *((_DWORD *)v17 + 64);
if( JobObjectInformationClass == JobObjectExtendedLimitInformation )
{
ExAcquirePushLockSharedEx((_EX_PUSH_LOCK *)v17 + 129, 0i64);
v147[14] = *((_QWORD *)v17 + 72) << 12;
v147[15] = *((_QWORD *)v17 + 73) << 12;
v147[17] = *((_QWORD *)v17 + 76) << 12;
v147[18] = *((_QWORD *)v17 + 74) << 12;
PspUnlockJobMemoryLimitsShared(v17, 0i64);
PspUnlockJob(v17, CurrentThread);
v147[16] = *((_QWORD *)v17 + 75) << 12;
}
else
{
PspUnlockJob(v17, CurrentThread);
}
SiloRootDirectoryPath = 0;
p_IoAttributionInfo = (__int128 *)v147;
goto LABEL_38;
case JobObjectBasicProcessIdList:
v106 = 0;
v21 = JobObjectInformation;
SiloRootDirectoryPath = PspQueryJobHierarchyProcessIdList(v17, (__int64)JobObjectInformation, v104, &v106);
v96 = 1;
LABEL_62:
v20 = ReturnLength;
goto LABEL_40;
case JobObjectBasicUIRestrictions:
PspLockJobShared(v17, v12);
v114 = *((_DWORD *)v17 + 112);
PspUnlockJob(v17, CurrentThread);
p_IoAttributionInfo = (__int128 *)&v114;
goto LABEL_37;
case JobObjectSecurityLimitInformation:
v127 = 0i64;
v96 = 1;
*(_OWORD *)JobObjectInformation = 0i64;
*((_OWORD *)JobObjectInformation + 1) = 0i64;
*((_QWORD *)JobObjectInformation + 4) = v127;
v20 = ReturnLength;
goto LABEL_39;
case JobObjectEndOfJobTimeInformation:
v113 = *((_DWORD *)v17 + 113);
p_IoAttributionInfo = (__int128 *)&v113;
goto LABEL_37;
}
if( JobObjectInformationClass != JobObjectBasicAndIoAccountingInformation )
{
if( JobObjectInformationClass == JobObjectExtendedLimitInformation )
goto LABEL_79;
if( JobObjectInformationClass == JobObjectJobSetInformation )
{
--v12->Tcb.SpecialApcDisable;
ExAcquirePushLockSharedEx(&PspJobListLock, 0i64);
PspUnlockJobListShared(CurrentThread);
p_IoAttributionInfo = (__int128 *)&v117;
goto LABEL_37;
}
LABEL_212:
SiloRootDirectoryPath = -1073741821;
goto LABEL_38;
}
}
LABEL_36:
PspQueryJobHierarchyAccountingInformation(v17, (_JOBOBJECT_EXTENDED_ACCOUNTING_INFORMATION *)Information);
p_IoAttributionInfo = (__int128 *)Information;
LABEL_37:
SiloRootDirectoryPath = 0;
LABEL_38:
v20 = ReturnLength;
LABEL_39:
v21 = JobObjectInformation;
LABEL_40:
if( v17 )
ObfDereferenceObjectWithTag(v17, 0x79517350ui64);
if( SiloRootDirectoryPath >= 0 && !v96 )
memmove(v21, p_IoAttributionInfo, v10);
if( v20 )
*(_DWORD *)v20 = v106;
return SiloRootDirectoryPath;
}Referenced by:
No references.