PspEnforceLimitsProcessCallback

NTSTATUS __fastcall PspEnforceLimitsProcessCallback(PVOID Object, UINT64 *a2){
  _EPROCESS_VALUES Values; 

  memset(&Values, 0i64, sizeof(Values));
  if( (*((_DWORD *)Object + 280) & 2) == 0 )
  {
    PsQueryStatisticsProcess((_EPROCESS *)Object, &Values);
    PspAddAccountingValues((_EPROCESS_VALUES *)(*((_QWORD *)Object + 162) + 1120i64), &Values);
    if( !a2[2] && *a2 && Values.UserTime > *a2 && ObReferenceObjectSafeWithTag((INT64)Object, 1649046352i64) )
      a2[2] = (UINT64)Object;
  }
  return 0;
}

Referenced by: