PspGetJobMemoryUsageNotificationViolations
__int64 __fastcall PspGetJobMemoryUsageNotificationViolations(
__int64 a1,
unsigned __int64 a2,
unsigned __int64 a3,
__int16 a4){
__int64 v4;
unsigned __int64 v5;
__int64 result;
unsigned __int64 v7;
v4 = *(_QWORD *)(a1 + 984);
if( (*(_DWORD *)v4 & 0x200000) == 0 )
a3 = a2;
v5 = *(_QWORD *)(v4 + 40);
result = 0i64;
if( v5 && (a4 & 0x200) != 0 && a3 > v5 )
result = 512i64;
v7 = *(_QWORD *)(v4 + 32);
if( v7 && (a4 & 0x8000) != 0 && a3 < v7 )
return(unsigned int)result | 0x8000;
return result;
}Referenced by:
NtSetInformationJobObject
PspEnforceLimitsJobPostCallback