PspEstablishDfssHierarchy

int __fastcall PspEstablishDfssHierarchy(__int64 a1, _EPROCESS *a2, int a3){
  VOID *SessionObjectByProcess; 
  _KSCHEDULING_GROUP *SessionSchedulingGroupByProcess; 
  _EPROCESS *v6; 
  int v7; 
  VOID *v8; 
  VOID *v9; 

  LODWORD(SessionObjectByProcess) = a3 - 1;
  if( ((a3 - 1) & 0xFFFFFFFD) == 0 )
  {
    SessionSchedulingGroupByProcess = MmGetSessionSchedulingGroupByProcess(a2);
    SessionObjectByProcess = MmGetSessionObjectByProcess(v6);
    v8 = SessionObjectByProcess;
    if( *(_QWORD *)(*(_QWORD *)(a1 + 1080) + 1008i64)
      || *(_KSCHEDULING_GROUP **)(a1 + 1016) == SessionSchedulingGroupByProcess )
    {
      if( v7 == 1 )
      {
        SessionObjectByProcess = *(VOID **)(a1 + 1080);
        if( SessionObjectByProcess == (VOID *)a1
          && *(_QWORD *)(a1 + 1008)
          && !*(_DWORD *)(a1 + 216)
          && *(VOID **)(a1 + 1112) != v8 )
        {
          KeRemoveSchedulingGroup(*(_KSCHEDULING_GROUP **)(a1 + 1016));
          KeInsertSchedulingGroup(
            (_KSCHEDULING_GROUP *)(*(_QWORD *)(a1 + 1008) + 128i64),
            *(_KSCHEDULING_GROUP_POLICY *)(*(_QWORD *)(a1 + 1008) + 128i64),
            SessionSchedulingGroupByProcess);
          v9 = *(VOID **)(a1 + 1112);
          if( v9 )
            ObfDereferenceObjectWithTag(v9, 0x624A7350ui64);
          *(_QWORD *)(a1 + 1112) = v8;
          LODWORD(SessionObjectByProcess) = ObfReferenceObjectWithTag(v8, 0x624A7350ui64);
        }
      }
    }
    else
    {
      if( *(_KSCHEDULING_GROUP **)(*(_QWORD *)(a1 + 1080) + 1016i64) != SessionSchedulingGroupByProcess )
      {
        *(_QWORD *)(*(_QWORD *)(a1 + 1080) + 1016i64) = SessionSchedulingGroupByProcess;
        SessionObjectByProcess = *(VOID **)(a1 + 1080);
        *((_QWORD *)SessionObjectByProcess + 139) = v8;
      }
      *(_QWORD *)(a1 + 1016) = SessionSchedulingGroupByProcess;
    }
  }
  return(int)SessionObjectByProcess;
}

Referenced by: