PspAddProcessToWorkingSetChangeList

VOID __stdcall PspAddProcessToWorkingSetChangeList(_EPROCESS *Process){
  __int64 v2; 
  _QWORD *PoolWithTag; 
  _QWORD *v4; 
  if( (*((_DWORD *)Process + 280) & 1) == 0 )
  {
    v2 = *((_QWORD *)Process + 162);
    if( (*(_DWORD *)(v2 + 848) & 1) != 0 )
    {
      if( ObReferenceObjectSafeWithTag(Process, 0x624A7350ui64) )
      {
        PoolWithTag = ExAllocatePoolWithTag(PagedPool, 0x28ui64, 0x72437350ui64);
        if( PoolWithTag )
        {
          PoolWithTag[2] = Process;
          PoolWithTag[4] = *(_QWORD *)(v2 + 800);
          PoolWithTag[3] = *(_QWORD *)(v2 + 792);
          v4 = (_QWORD *)qword_140C130A8;
          if( *(__int64 **)qword_140C130A8 != &PspWorkingSetChangeHead )
            __fastfail(3u);
          *PoolWithTag = &PspWorkingSetChangeHead;
          PoolWithTag[1] = v4;
          *v4 = PoolWithTag;
          qword_140C130A8 = (__int64)PoolWithTag;
        }
        else
        {
          ObfDereferenceObjectWithTag(Process, 0x624A7350ui64);
        }
      }
    }
    else
    {
      MmEnforceWorkingSetLimit((ULONG_PTR)Process, 2);
    }
  }
}

Referenced by: