PspEstablishJobHierarchy

NTSTATUS __fastcall PspEstablishJobHierarchy(_EJOB *Job, _EPROCESS *Process, PVOID Object, INT64 a4){
  int v5; 
  int v8; 
  _QWORD *v9; 
  VOID **PoolWithTag; 
  unsigned __int64 v12; 
  _KSCHEDULING_GROUP *v13; 
  __int64 v14; 
  VOID *v15; 
  PVOID *v16; 
  _QWORD *v17; 
  char v18; 
  int i; 
  INT64 *v20; 
  VOID *v21; 
  _EJOB *v22; 
  __int64 v23; 
  _QWORD *v24; 
  _EJOB *v25; 
  INT64 JobPostCallback[2]; 
  _EPROCESS *v27; 
  VOID *v28; 
  VOID *v29; 
  UINT64 v30; 

  v5 = a4;
  *(_OWORD *)JobPostCallback = 0i64;
  v27 = 0i64;
  if( (_DWORD)a4 != 1 )
  {
    if( (_DWORD)a4 != 2 )
    {
      if( (_DWORD)a4 == 3 )
      {
        PspUnlinkJobProcess((_EJOB *)Object, Process);
        MmLinkJobProcess(Job, Process);
        ObfReferenceObjectWithTag(Job, 0x73507350ui64);
        ObfDereferenceObjectWithTag(Object, 0x73507350ui64);
        v24 = (_QWORD *)*((_QWORD *)Job + 169);
        if( !*((_DWORD *)Job + 337) )
        {
          if( !v24 )
            goto LABEL_67;
          v24 = (_QWORD *)v24[169];
        }
        IoSetDiskIoAttributionOnProcess(v24, Process);
        goto LABEL_67;
      }
      if( (_DWORD)a4 == 4 || (_DWORD)a4 == 5 )
        goto LABEL_13;
      if( (_DWORD)a4 != 6 )
      {
        if( (_DWORD)a4 != 7 )
        {
          v8 = -1073741811;
          goto LABEL_6;
        }
LABEL_13:
        PoolWithTag = 0i64;
        v12 = *((_QWORD *)Object + 138) + 1i64;
        if( v12 > 2 )
        {
          PoolWithTag = ExAllocatePoolWithTag(1ui64, 8 * v12 - 16, 1649046352i64);
          if( !PoolWithTag )
            return -1073741670;
        }
        if( (unsigned int)(v5 - 4) <= 1 )
        {
          v8 = PspBindProcessSessionToJob(Job, Process);
          if( v8 < 0 )
            goto LABEL_39;
        }
        v13 = (_KSCHEDULING_GROUP *)*((_QWORD *)Job + 127);
        if( v13 )
        {
          KeRemoveSchedulingGroup(v13);
          if( (*((_DWORD *)Object + 330) & 0x20) == 0 )
          {
            v8 = PspAddSchedulingGroupToJobChain((_EJOB *)Object, 0i64);
            if( v8 < 0 )
            {
              KeInsertSchedulingGroup(
                (_KSCHEDULING_GROUP *)(*((_QWORD *)Job + 126) + 128i64),
                *(_KSCHEDULING_GROUP_POLICY *)(*((_QWORD *)Job + 126) + 128i64),
                0i64);
LABEL_39:
              if( PoolWithTag )
                ExFreePoolWithTag(PoolWithTag, 0x624A7350u);
              goto LABEL_6;
            }
          }
          KeInsertSchedulingGroup(
            (_KSCHEDULING_GROUP *)(*((_QWORD *)Job + 126) + 128i64),
            *(_KSCHEDULING_GROUP_POLICY *)(*((_QWORD *)Job + 126) + 128i64),
            (_KSCHEDULING_GROUP *)(*((_QWORD *)Object + 126) + 128i64));
        }
        else
        {
          v14 = *((_QWORD *)Object + 127);
          if( v14 )
            *((_QWORD *)Job + 127) = v14;
        }
        v15 = Job;
        if( v5 != 4 )
          v15 = Object;
        ObfReferenceObjectWithTag(v15, 0x73507350ui64);
        v16 = (PVOID *)*((_QWORD *)Object + 133);
        v17 = (_QWORD *)((char *)Job + 1040);
        if( *v16 != (char *)Object + 1056 )
          __fastfail(3u);
        *v17 = (char *)Object + 1056;
        *((_QWORD *)Job + 131) = v16;
        *v16 = v17;
        *((_QWORD *)Object + 133) = v17;
        *((_QWORD *)Job + 134) = Object;
        *((_QWORD *)Job + 135) = *((_QWORD *)Object + 135);
        v18 = *((_BYTE *)Object + 874) + 1;
        *((_QWORD *)Job + 138) = v12;
        *((_BYTE *)Job + 874) = v18;
        if( v12 > 2 )
        {
          if( v12 > 3 )
          {
            v23 = *((_QWORD *)Object + 138) - 2i64;
            if( *((_QWORD *)Object + 138) != 2i64 )
            {
              do
              {
                PoolWithTag[v23] = *(VOID **)(*((_QWORD *)Object + 139) + 8 * v23 - 8);
                --v23;
              }
              while( v23 );
            }
          }
          *PoolWithTag = (VOID *)*((_QWORD *)Object + 134);
          *((_QWORD *)Job + 139) = PoolWithTag;
          PoolWithTag = 0i64;
        }
        if( v5 == 4 )
        {
          PspUnlinkJobProcess((_EJOB *)Object, Process);
          MmLinkJobProcess(Job, Process);
        }
        PspSetEffectiveJobLimits(Job, 0i64);
        *((_DWORD *)Job + 214) += *((_DWORD *)Object + 214);
        *((_DWORD *)Job + 216) += *((_DWORD *)Object + 216);
        *((_DWORD *)Job + 215) += *((_DWORD *)Object + 215);
        *((_DWORD *)Job + 217) += *((_DWORD *)Object + 217);
        *((_QWORD *)Job + 197) = *((_QWORD *)Object + 197);
        if( (*((_DWORD *)Object + 330) & 0x1841000) != 0 )
          _InterlockedOr((volatile signed __int32 *)Job + 330, *((_DWORD *)Object + 330) & 0x1841000);
        for( i = 0; i < 3; ++i )
        {
          if( (unsigned int)(i - 1) > 1 )
          {
            v22 = (_EJOB *)*((_QWORD *)Object + 104);
            if( v22 )
              PspSetEffectiveRateControlJob(Job, v22);
          }
        }
        if( *((_DWORD *)Object + 337) )
        {
          v20 = (INT64 *)Object;
        }
        else
        {
          v20 = (INT64 *)*((_QWORD *)Object + 169);
          if( v20 )
            goto LABEL_60;
        }
        if( !v20 )
        {
          if( *((_DWORD *)Job + 337) && v5 == 4 )
            IoSetDiskIoAttributionOnProcess(*((VOID **)Job + 169), Process);
          goto LABEL_34;
        }
LABEL_60:
        LODWORD(v25) = 5;
        LOBYTE(v27) = 1;
        PspEnumJobsAndProcessesInJobHierarchy(
          Job,
          (INT64 *)PspSetJobIoAttributionJobPreCallback,
          0i64,
          0i64,
          JobPostCallback,
          v25,
          (VOID *)JobPostCallback[0],
          v20,
          v27,
          v28,
          v29,
          v30);
LABEL_34:
        v21 = (VOID *)*((_QWORD *)Object + 195);
        if( v21 )
        {
          ObfReferenceObjectWithTag(v21, 0x624A7350ui64);
          *((_QWORD *)Job + 195) = *((_QWORD *)Object + 195);
          *((_QWORD *)Job + 196) = *((_QWORD *)Object + 196);
        }
        if( v5 == 7 )
          _interlockedbittestandset((volatile signed __int32 *)Job + 331, 0);
        v8 = 0;
        goto LABEL_39;
      }
      _interlockedbittestandset((volatile signed __int32 *)Job + 331, 0);
    }
LABEL_67:
    v8 = 0;
    goto LABEL_6;
  }
  v8 = PspBindProcessSessionToJob(Job, Process);
  if( v8 >= 0 )
  {
    ObfReferenceObjectWithTag(Job, 0x73507350ui64);
    MmLinkJobProcess(Job, Process);
  }
  v9 = (_QWORD *)*((_QWORD *)Job + 169);
  if( !*((_DWORD *)Job + 337) )
  {
    if( !v9 )
      goto LABEL_6;
    v9 = (_QWORD *)v9[169];
  }
  IoSetDiskIoAttributionOnProcess(v9, Process);
LABEL_6:
  if( Process && v8 >= 0 && PsCpuFairShareEnabled )
  {
    if( PsGetProcessSessionId((INT64)Process) )
      PspEstablishDfssHierarchy((__int64)Job, Process, v5);
  }
  return v8;
}

Referenced by: