PspChangeJobMemoryUsageByProcess

UINT8 __stdcall PspChangeJobMemoryUsageByProcess(UINT64 Flags, INT64 Amount, _EPROCESS *Process, _EJOB *TerminatingJob){
  char v5; 
  UINT8 v6; 
  _ETHREAD *CurrentThread; 
  _EJOB *v8; 
  _EJOB *CommitChargeJob; 
  _EJOB *v10; 
  unsigned __int64 CommitCharge; 
  unsigned __int64 v12; 
  unsigned __int64 v13; 
  int v14; 
  int v15; 
  unsigned __int64 v16; 
  __int64 v17; 
  unsigned __int64 v20; 
  int v21; 
  unsigned __int64 v22; 
  unsigned __int64 v23; 
  unsigned __int64 v24; 
  _EJOB *v25; 
  _EJOB *v26; 
  _EJOB *i; 
  int v28; 
  _EJOB *v29; 
  _EJOB *RootJob; 
  _EJOB *RootJoba; 
  unsigned __int64 v32; 
  char v33; 
  _EPROCESS *v34; 
  _EJOB *v35; 

  v35 = TerminatingJob;
  v34 = Process;
  v33 = Flags;
  v5 = Flags;
  if( (Flags & 2) == 0 || !Process->Job )
    return 1;
  v6 = 1;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v28 = 0;
  v29 = 0i64;
  RootJob = (_EJOB *)*((_QWORD *)Process->CommitChargeJob + 135);
  if( CurrentThread )
    --CurrentThread->Tcb.SpecialApcDisable;
  if( RootJob )
  {
    ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)RootJob + 129, 0i64);
    TerminatingJob = v35;
    Process = v34;
  }
  v8 = RootJob;
  if( (v5 & 4) != 0 )
  {
    CommitChargeJob = TerminatingJob;
    TerminatingJob = 0i64;
    v35 = 0i64;
  }
  else
  {
    CommitChargeJob = Process->CommitChargeJob;
  }
  RootJoba = CommitChargeJob;
  v10 = CommitChargeJob;
  if( CommitChargeJob != TerminatingJob )
  {
    while( 1 )
    {
      CommitCharge = 0i64;
      if( v10 != v8 )
        ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)v10 + 129, 0i64);
      v12 = *((_QWORD *)v10 + 122);
      v13 = v12 + Amount;
      if( Amount <= 0 )
      {
        if( v13 > v12 )
        {
          PspUnlockJobMemoryLimitsExclusive(v10, v8, 0i64);
          v26 = v10;
          if( !v6 )
            v26 = v29;
          v6 = 0;
          v29 = v26;
          goto LABEL_28;
        }
      }
      else if( v13 < v12 )
      {
        PspUnlockJobMemoryLimitsExclusive(v10, v8, 0i64);
        v25 = v10;
        if( !v6 )
          v25 = v29;
        v6 = 0;
        v29 = v25;
        goto LABEL_28;
      }
      v14 = 0;
      v15 = *((_DWORD *)v10 + 64);
      v16 = v13 + *((_QWORD *)v10 + 167);
      v32 = v16;
      if( (v15 & 0x200000) != 0 && v16 > *((_QWORD *)v10 + 74) && Amount > 0 )
        v14 = 1;
      if( (v15 & 0x200) != 0 && v13 > *((_QWORD *)v10 + 73) && Amount > 0 || v14 )
        break;
      if( v6 )
      {
        *((_QWORD *)v10 + 122) = v13;
LABEL_19:
        if( v6 )
        {
          v17 = *((_QWORD *)v10 + 123);
          if( v17 )
          {
            v20 = *(_QWORD *)(v17 + 40);
            if( (*(_DWORD *)v17 & 0x200000) == 0 )
              v16 = v13;
            v21 = 0;
            if( v20 && Amount > 0 && v16 > v20 )
              v21 = 512;
            v22 = *(_QWORD *)(v17 + 32);
            if( v22 && Amount <= 0 && v16 < v22 )
              v21 |= 0x8000u;
            v28 |= v21;
          }
        }
      }
      if( Amount > 0 )
      {
        if( v13 > *((_QWORD *)v10 + 76) )
          *((_QWORD *)v10 + 76) = v13;
        CommitCharge = v34->CommitCharge;
      }
      if( v10 != v8 )
      {
        if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v10 + 129, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
          ExfTryToWakePushLock((_EX_PUSH_LOCK *)v10 + 129);
        KeAbPostRelease((char *)v10 + 1032);
      }
      if( CommitCharge && CommitCharge > *((_QWORD *)v10 + 75) )
      {
        _m_prefetchw((char *)v10 + 600);
        v23 = *((_QWORD *)v10 + 75);
        do
        {
          v24 = v23;
          v23 = _InterlockedCompareExchange64((volatile signed __int64 *)v10 + 75, CommitCharge, v23);
        }
        while( v23 != v24 && CommitCharge > v23 );
      }
LABEL_28:
      v10 = (_EJOB *)*((_QWORD *)v10 + 134);
      if( v10 == v35 )
      {
        if( v6 )
        {
          if( v28 )
            PspScheduleEnforcementWorker(v8);
        }
        else
        {
          for( i = RootJoba; i != v29; i = (_EJOB *)*((_QWORD *)i + 134) )
          {
            if( i != v8 )
              ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)i + 129, 0i64);
            *((_QWORD *)i + 122) -= Amount;
            PspUnlockJobMemoryLimitsExclusive(i, v8, 0i64);
          }
        }
        goto LABEL_32;
      }
    }
    if( (v33 & 1) != 0 )
    {
      *((_QWORD *)v10 + 122) = v13;
    }
    else if( v6 )
    {
      v29 = v10;
      v6 = 0;
    }
    if( *((_QWORD *)v10 + 57) && (*((_DWORD *)v10 + 219) & 0x200) != 0 && (v34->Flags2 & 0x24) == 4 )
    {
      _InterlockedOr((volatile signed __int32 *)&v34->1120, 0x20u);
      PspSendJobNotification(v10, 0xAui64, v34->UniqueProcessId, 1u);
      v16 = v32;
    }
    goto LABEL_19;
  }
LABEL_32:
  if( v8 )
  {
    if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v8 + 129, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock((_EX_PUSH_LOCK *)v8 + 129);
    KeAbPostRelease((char *)v8 + 1032);
  }
  if( CurrentThread )
  {
    if( CurrentThread->Tcb.SpecialApcDisable++ == -1
      && ($F25F8C4BA33AF922A5F1AF68CD89DDDF *)CurrentThread->Tcb.ApcState.ApcListHead[0].Flink != &CurrentThread->Tcb.152 )
    {
      KiCheckForKernelApcDelivery();
    }
  }
  return v6;
}

Referenced by: