PspAssignProcessQuotaBlock

INT64 __stdcall PspAssignProcessQuotaBlock(_QUOTA_LIMITS_EX *QuotaLimits, _EPROCESS *TargetProcess, PVOID ProcessToken){
  INT64 v5; 
  unsigned __int8 v6; 
  char *v7; 
  ULONG v8; 
  volatile INT32 *v9; 
  int UserQuotaLimits; 
  _ETHREAD *CurrentThread; 
  INT64 *v12; 
  _BYTE *v13; 
  volatile INT32 *PoolWithTag; 
  INT64 v16; 
  UINT64 DestinationSidLength; 
  INT64 v18; 
  char SourceSid[80]; 
  int v20[4]; 
  DestinationSidLength = 0i64;
  v5 = (INT64)QuotaLimits;
  v18 = (INT64)QuotaLimits;
  memset((INT64)SourceSid, 0i64);
  v6 = 0;
  v7 = 0i64;
  SeQueryUserSidToken(ProcessToken, SourceSid, 0x44ui64, &DestinationSidLength);
  if( v5 && (*(_DWORD *)(v5 + 80) & 0x10) != 0 )
  {
    v8 = 0;
    v6 = 1;
    LODWORD(DestinationSidLength) = 0;
  }
  else
  {
    v8 = DestinationSidLength;
    v7 = SourceSid;
  }
  v9 = (volatile INT32 *)PspLookupProcessQuotaBlock(v7, v8, v6, 0i64);
  if( v9 )
    goto LABEL_10;
  if( v5 )
  {
    v12 = 0i64;
  }
  else
  {
    UserQuotaLimits = PspReadUserQuotaLimits(SourceSid, (_DWORD *)&DestinationSidLength + 1, (unsigned int *)v20);
    if( UserQuotaLimits < 0 )
      return(unsigned int)UserQuotaLimits;
    if( HIDWORD(DestinationSidLength) )
    {
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      v12 = &PspDefaultResourceLimits;
      v13 = (_BYTE *)PspQuotaBlockTable;
      v7 = 0i64;
      LODWORD(DestinationSidLength) = 0;
      v6 = 1;
      --*((_WORD *)CurrentThread + 242);
      ExAcquirePushLockSharedEx((UINT64)v13, 0i64);
      v9 = (volatile INT32 *)PspDefaultQuotaBlock;
      if( PspDefaultQuotaBlock && (unsigned int)PspSafeReferenceQuotaBlock(PspDefaultQuotaBlock) )
      {
        PspUnlockQuotaListShared(CurrentThread, v13);
        _InterlockedIncrement(v9 + 129);
        goto LABEL_10;
      }
      PspUnlockQuotaListShared(CurrentThread, v13);
      v8 = DestinationSidLength;
    }
    else
    {
      v12 = (INT64 *)v20;
    }
    v5 = v18;
  }
  PoolWithTag = (volatile INT32 *)ExAllocatePoolWithTag(NonPagedPoolNxCacheAligned, v8 + 576i64, 0x62517350ui64);
  v9 = PoolWithTag;
  if( PoolWithTag )
  {
    UserQuotaLimits = PspInitializeQuotaBlock(v5, v12, (INT64)PoolWithTag);
    if( UserQuotaLimits < 0 )
    {
LABEL_28:
      if( v9 )
      {
        _InterlockedAdd(v9 + 129, 0xFFFFFFFF);
        PspDereferenceQuotaBlock(v9);
      }
      return(unsigned int)UserQuotaLimits;
    }
    if( v7 )
      RtlCopySid(v8, (PSID)(v9 + 144), SourceSid);
    v16 = PspLookupProcessQuotaBlock(v7, v8, v6, (INT64)v9);
    if( v16 )
    {
      _InterlockedAdd(v9 + 129, 0xFFFFFFFF);
      PspDereferenceQuotaBlock(v9);
      v9 = (volatile INT32 *)v16;
    }
LABEL_10:
    if( !*((_QWORD *)TargetProcess + 173) )
    {
      *((_QWORD *)TargetProcess + 173) = v9;
      return 0i64;
    }
    if( (__int64 *)_InterlockedCompareExchange64(
                      (volatile signed __int64 *)TargetProcess + 173,
                      (signed __int64)v9,
                      (signed __int64)PspSystemQuotaBlock) == PspSystemQuotaBlock )
      return 0i64;
    UserQuotaLimits = -1073741823;
    goto LABEL_28;
  }
  return(unsigned int)-1073741670;
}

Referenced by: