PspSetQuotaLimits

NTSTATUS __stdcall PspSetQuotaLimits(
        PVOID ProcessHandle,
        PVOID ProcessInformation,
        UINT64 ProcessInformationLength,
        INT8 PreviousMode){
  int v5; 
  char v8; 
  NTSTATUS v9; 
  int v10; 
  NTSTATUS v11; 
  CHAR v12; 
  char v13; 
  _QWORD *v14; 
  __int64 v15; 
  INT64 v16; 
  bool v17; 
  NTSTATUS v18; 
  PVOID v19; 
  struct DMA_ADAPTER *v20; 
  INT64 Tag; 
  char v22; 
  char v23; 
  BYTE v24; 
  char v25; 
  PVOID Object; 
  _ETHREAD *CurrentThread; 
  _QWORD *v28; 
  _QUOTA_LIMITS_EX result; 
  struct _SECURITY_SUBJECT_CONTEXT SubjectContext; 
  char Privileges[24]; 
  struct _KAPC_STATE ApcState; 
  v5 = ProcessInformationLength;
  v8 = 0;
  Object = 0i64;
  memset((INT64)&result, 0i64);
  memset(&ApcState, 0, sizeof(ApcState));
  v24 = 0;
  memset(&SubjectContext, 0, sizeof(SubjectContext));
  memset(Privileges, 0, sizeof(Privileges));
  if( v5 == 48 )
  {
    *(_OWORD *)&result.PagedPoolLimit = *(_OWORD *)ProcessInformation;
    *(_OWORD *)&result.MinimumWorkingSetSize = *((_OWORD *)ProcessInformation + 1);
    *(_OWORD *)&result.PagefileLimit = *((_OWORD *)ProcessInformation + 2);
    memset(&result.Reserved1, 0, 40);
    v22 = 1;
  }
  else
  {
    if( v5 != 88 )
      return -1073741820;
    v22 = 0;
    result = *(_QUOTA_LIMITS_EX *)ProcessInformation;
  }
  if( (result.Flags & 0xFFFFFFE0) != 0 || (result.Flags & 3) == 3 || (result.Flags & 0xC) == 12 )
    return -1073741811;
  if( (result.Flags & 1) != 0 )
  {
    v10 = 4;
  }
  else
  {
    v10 = 0;
    if( (result.Flags & 2) != 0 )
      v10 = 8;
  }
  if( (result.Flags & 4) != 0 )
  {
    v10 |= 1u;
  }
  else if( (result.Flags & 8) != 0 )
  {
    v10 |= 2u;
  }
  if( result.Reserved2 | result.Reserved3 | result.Reserved4 | result.CpuRateLimit.RateData )
    return -1073741811;
  v9 = ObReferenceObjectByHandleWithTag(
         ProcessHandle,
         0x100u,
         (POBJECT_TYPE)PsProcessType,
         PreviousMode,
         0x79517350u,
         &Object,
         0i64);
  if( v9 >= 0 )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    v11 = 0;
    if( *((__int64 **)Object + 173) != PspSystemQuotaBlock
      || result.MinimumWorkingSetSize && result.MaximumWorkingSetSize )
    {
      if( result.MinimumWorkingSetSize && result.MaximumWorkingSetSize )
      {
        if( result.MinimumWorkingSetSize == -1i64 && result.MaximumWorkingSetSize == -1i64 )
        {
          v23 = 1;
          v12 = 0;
          v25 = 0;
        }
        else
        {
          v23 = 0;
          v12 = PspSinglePrivCheck(result.MaximumWorkingSetSize, -1i64, PreviousMode, (INT64)&SubjectContext);
          v25 = 1;
        }
        v13 = 0;
        v14 = Object;
        v28 = Object;
        while( 1 )
        {
          KeStackAttachProcess((PRKPROCESS)Object, &ApcState);
          --*((_WORD *)CurrentThread + 243);
          v15 = v14[162];
          if( v15 )
          {
            ExAcquireResourceExclusiveLite((ERESOURCE *)(v15 + 56), 1u);
            if( (*(_DWORD *)(v15 + 848) & 1) != 0 )
            {
              v10 = 1;
              v12 = 1;
              v8 = 1;
              if( !v23 )
              {
                result.MinimumWorkingSetSize = *(_QWORD *)(v15 + 792);
                result.MaximumWorkingSetSize = *(_QWORD *)(v15 + 800);
              }
            }
            PspLockWorkingSetChangeExclusiveUnsafe();
            ExReleaseResourceLite((PERESOURCE)(v15 + 56));
          }
          LODWORD(Tag) = v10;
          v11 = MmAdjustWorkingSetSizeEx(
                  result.MinimumWorkingSetSize,
                  result.MaximumWorkingSetSize,
                  0i64,
                  v12,
                  Tag,
                  &v24);
          if( v11 < 0 && v8 == 1 )
            MmEnforceWorkingSetLimit((ULONG_PTR)Object, v10);
          if( v15 )
            PspUnlockWorkingSetChangeExclusiveUnsafe();
          KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
          KeUnstackDetachProcess(&ApcState);
          if( v24 == 1 && !v8 )
            v13 = 1;
          v17 = v28[162] == v15;
          v14 = v28;
          if( v17 )
            break;
          v8 = 0;
        }
        if( v25 == 1 && Privileges[20] )
        {
          if( v13 == 1 )
          {
            LOBYTE(v16) = Privileges[21];
            SePrivilegedServiceAuditAlarm(
              (UNICODE_STRING *)&PspWorkingSetAdjustService,
              &SubjectContext,
              (PRIVILEGE_SET *)Privileges,
              v16);
          }
          SeReleaseSubjectContext(&SubjectContext);
        }
      }
    }
    else
    {
      if( v22 == 1 )
      {
        memset((INT64)&result, 0i64);
        result.Flags = 16;
      }
      if( !SeSinglePrivilegeCheck(*(_QWORD *)&SeIncreaseQuotaPrivilege, PreviousMode) )
      {
        v18 = -1073741727;
LABEL_53:
        ObfDereferenceObjectWithTag(Object, 0x79517350ui64);
        return v18;
      }
      v19 = Object;
      v20 = (struct DMA_ADAPTER *)PsReferencePrimaryToken((PEPROCESS)Object);
      v18 = PspAssignProcessQuotaBlock(&result, (_EPROCESS *)v19, v20);
      ObFastDereferenceObject((INT64 *)v19 + 151, v20);
      if( v18 < 0 )
        goto LABEL_53;
    }
    ObfDereferenceObjectWithTag(Object, 0x79517350ui64);
    return v11;
  }
  return v9;
}

Referenced by: