NtSetInformationJobObject
NTSTATUS __stdcall NtSetInformationJobObject(
VOID *JobHandle,
_JOBOBJECTINFOCLASS JobObjectInformationClass,
VOID *JobObjectInformation,
UINT64 JobObjectInformationLength){
__int64 v4;
__int64 v5;
unsigned int v7;
char PreviousMode;
unsigned __int16 *v9;
UINT64 v10;
NTSTATUS result;
INT64 v12;
NTSTATUS v13;
char *v14;
int v15;
INT64 v16;
_BYTE *MiniCompletionPacket;
_IO_MINI_COMPLETION_PACKET_USER *v18;
NTSTATUS v19;
INT64 v20;
__int64 v21;
unsigned __int64 v22;
__int64 v23;
unsigned __int64 v24;
unsigned __int64 v25;
int v26;
int j;
int v28;
PSP_JOB_RATE_CONTROL_TYPE v29;
int v30;
int v31;
int *v32;
int *v33;
VOID ***v34;
VOID **v35;
VOID **v36;
int v37;
int k;
_DWORD *v39;
__int64 v40;
int v41;
_DWORD *v42;
_DWORD *v43;
int v44;
bool v45;
INT64 *v46;
__int64 v47;
int JobMemoryUsageNotificationViolations;
UINT64 v49;
__int64 v50;
int v51;
_ERESOURCE *v52;
INT64 v53;
int v54;
int v55;
INT8 v56;
INT64 v57;
int v58;
UINT16 v59;
UINT64 *v60;
unsigned int v61;
unsigned int v62;
_DWORD *v63;
char *v64;
int *v65;
int v66;
char v67;
char v68;
char v69;
_LIST_ENTRY *v70;
char v71;
_ETHREAD *v72;
char v73;
int v74;
int v75;
_JOB_RATE_CONTROL_HEADER *RateControl;
_JOB_RATE_CONTROL_HEADER *v77;
_JOB_RATE_CONTROL_HEADER **v78;
_JOB_RATE_CONTROL_HEADER *v79;
_KSCHEDULING_GROUP **p_OverQuotaHistory;
_ERESOURCE *v81;
VOID *v82;
__int64 v83;
unsigned int v84;
unsigned int Value;
_KSCHEDULING_GROUP **v86;
char v87;
_DWORD *v88;
unsigned __int16 v89;
POOL_TYPE v90;
_WORD *v91;
WCHAR *v92;
_ERESOURCE *v93;
NTSTATUS Silo;
unsigned int v95;
unsigned int v96;
unsigned int v97;
char v98;
int v99;
int v100;
char v101;
int v102;
__int64 v103;
_ERESOURCE *PoolWithTag;
unsigned __int8 v105;
UINT32 v106;
unsigned __int16 Group;
__int64 v108;
char *v109;
char *i;
_EX_PUSH_LOCK *v111;
unsigned __int16 v112;
__m128i v113;
__int64 v114;
INT64 v115;
_SECURITY_IMPERSONATION_LEVEL *p_ImpersonationLevel;
unsigned __int8 v117;
PERESOURCE v118;
_EX_PUSH_LOCK *v119;
__int64 bf_0;
INT8 v121;
UINT32 v122;
INT8 v123;
INT8 v124;
unsigned __int64 v125;
unsigned __int64 v126;
VOID **v127;
UINT64 v128;
_ETHREAD *v129;
_EJOB *v130;
INT64 v131;
signed __int8 v132;
int v133[8];
ULONG Tag[2];
PVOID *Object;
POBJECT_HANDLE_INFORMATION HandleInformation;
INT64 *v137;
_EPROCESS *AccessMode;
PVOID DeferredContext;
VOID *Context;
UINT64 Flags;
int v142;
VOID *ObjectHandle;
_EX_PUSH_LOCK *PushLock;
UINT16 v145;
_KSCHEDULING_GROUP_POLICY Weights;
_ETHREAD *CurrentThread;
PERESOURCE Resource;
PERESOURCE v149;
UINT8 v150;
char v151;
char v152;
unsigned int v153;
NTSTATUS JobLimitInformationValidFlags;
unsigned int v155;
_EJOB *RootJob;
UINT64 SessionId;
_KSCHEDULING_GROUP_POLICY CpuRates;
VOID *Src;
INT64 JobPostCallback[2];
UINT64 ProcessorMask;
_SECURITY_SUBJECT_CONTEXT SubjectContext;
__int64 v163;
void *JobObjectInformationa;
PSECURITY_SUBJECT_CONTEXT v165;
POOL_TYPE v166;
__int64 v167;
PVOID v168;
__m128i Base;
INT64 v170;
VOID **v171;
UINT16 a2[8];
unsigned int v173;
int v174;
unsigned int v175;
_HANDLE Handle[4];
PVOID P[2];
__int128 v178;
__int128 v179;
int v180;
char *Parameters;
int v182;
int v183;
__int64 v184;
_JOBOBJECT_FREEZE_INFORMATION v185;
__int128 v186;
__int64 v187;
__int64 v188;
VOID *v189;
VOID *v190;
__int128 v191[5];
_JOBOBJECT_IO_RATE_CONTROL_INFORMATION_NATIVE_V2 ControlInfo[36];
PRIVILEGE_SET RequiredPrivileges;
__int64 v194[10];
_JOBOBJECT_FREEZE_INFORMATION FreezeInformation;
__m128i v196;
__m128i v197;
__m128i v198;
INT64 v199;
__int64 v200[20];
__m128i v201;
__m128i v202;
__m128i v203;
_KAFFINITY_EX Affinity;
__int64 v205[200];
v4 = (unsigned int)JobObjectInformationLength;
PushLock = (_EX_PUSH_LOCK *)JobObjectInformation;
v5 = JobObjectInformationClass;
ObjectHandle = JobHandle;
LODWORD(Context) = JobObjectInformationClass;
Src = JobObjectInformation;
memset(Affinity.Bitmap, 0i64, sizeof(Affinity.Bitmap));
*(_OWORD *)Handle = 0i64;
JobObjectInformationa = 0i64;
v167 = 0i64;
WORD2(Flags) = 0;
v170 = 0i64;
memset(v200, 0i64, 0x98u);
FreezeInformation = 0i64;
Base = 0i64;
memset(v191, 0i64, 0x48u);
v168 = 0i64;
memset(ControlInfo, 0i64, sizeof(ControlInfo));
DeferredContext = 0i64;
LODWORD(SessionId) = 0;
memset(v205, 0i64, sizeof(v205));
v178 = 0i64;
v179 = 0i64;
memset(&SubjectContext, 0, sizeof(SubjectContext));
v163 = 0i64;
memset(v194, 0i64, 0x48u);
v201 = 0i64;
v202 = 0i64;
v203 = 0i64;
v196 = 0i64;
v197 = 0i64;
v198 = 0i64;
v199 = 0i64;
Weights = 0i64;
memset(&RequiredPrivileges, 0, sizeof(RequiredPrivileges));
RootJob = 0i64;
*(_OWORD *)JobPostCallback = 0i64;
CpuRates = 0i64;
v185 = 0i64;
v186 = 0i64;
v187 = 0i64;
*(_OWORD *)a2 = 0i64;
*(_OWORD *)P = 0i64;
if( (unsigned int)(v5 - 1) > 0x2E )
return -1073741821;
switch( (_DWORD)v5 )
{
case 9:
if( (_DWORD)v4 == 144 || (_DWORD)v4 == 152 )
goto LABEL_6;
return -1073741820;
case 0xC:
if( (_DWORD)v4 == 48 )
goto LABEL_6;
v45 = (_DWORD)v4 == 56;
LABEL_98:
if( v45 )
goto LABEL_6;
return -1073741820;
case 0x1F:
if( (_DWORD)v4 == 48 || (_DWORD)v4 == 96 )
goto LABEL_6;
v45 = (_DWORD)v4 == 144;
goto LABEL_98;
}
v7 = dword_1409860CC[v5];
if( (_DWORD)v4 != v7 && ((_DWORD)v5 != 11 && (_DWORD)v5 != 14 || (unsigned int)v4 < v7) )
return -1073741820;
LABEL_6:
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
PreviousMode = CurrentThread->Tcb.PreviousMode;
LOBYTE(AccessMode) = PreviousMode;
BYTE6(Flags) = PreviousMode;
if( PreviousMode )
{
v9 = (unsigned __int16 *)Src;
if( (_DWORD)v4 )
{
if( ((dword_14098618C[v5] - 1) & (unsigned int)Src) != 0 )
ExRaiseDatatypeMisalignment();
if( (unsigned __int64)Src + v4 > 0x7FFFFFFF0000i64 || (char *)Src + v4 < Src )
MEMORY[0x7FFFFFFF0000] = 0;
}
PreviousMode = (char)AccessMode;
}
else
{
v9 = (unsigned __int16 *)Src;
}
if( !JobHandle )
return -1073741816;
v10 = 16i64;
if( (_DWORD)v5 != 5 )
v10 = 2i64;
Tag[0] = 2035381072;
result = ObReferenceObjectByHandleWithTag(
JobHandle,
v10,
(_OBJECT_TYPE *)PsJobType,
PreviousMode,
*(UINT64 *)Tag,
&DeferredContext,
0i64);
if( result >= 0 )
{
v13 = 0;
LODWORD(Flags) = 0;
LOBYTE(v142) = 0;
--CurrentThread->Tcb.SpecialApcDisable;
if( (int)v5 <= 24 )
{
if( (_DWORD)v5 == 24 )
{
v49 = *(_QWORD *)v9;
v188 = *(_QWORD *)v9;
v14 = (char *)DeferredContext;
ExAcquireResourceExclusiveLite((UINT64)DeferredContext + 56, 1, v12);
if( (*((_DWORD *)v14 + 330) & 0x20) != 0 )
{
v50 = *((_QWORD *)v14 + 126);
v51 = *(_DWORD *)(v50 + 40);
if( (v51 & 0x10) == 0 )
{
*(_DWORD *)(v50 + 40) = v51 | 0x10;
KeInitializeDpc((PRKDPC)(v50 + 48), PspJobCycleTimeNotificationDpcRoutine, v14);
}
KeSetSchedulingGroupCycleNotification((_KSCHEDULING_GROUP *)(v50 + 128), (_KDPC *)(v50 + 48), v49);
goto LABEL_116;
}
LABEL_376:
v13 = -1073741811;
goto LABEL_117;
}
if( (int)v5 > 12 )
{
if( (_DWORD)v5 != 14 )
{
if( (_DWORD)v5 != 15 )
{
if( (_DWORD)v5 != 16 )
{
if( (_DWORD)v5 == 18 )
{
FreezeInformation = *(_JOBOBJECT_FREEZE_INFORMATION *)v9;
if( FreezeInformation.Flags && (FreezeInformation.Flags & 0xFFFFFFF8) == 0 )
{
v14 = (char *)DeferredContext;
v13 = PspFreezeJobTree((_EJOB *)DeferredContext, &FreezeInformation);
if( v13 >= 0 )
*(_DWORD *)v9 = FreezeInformation.Flags;
goto LABEL_35;
}
goto LABEL_380;
}
if( (_DWORD)v5 != 21 )
{
if( (_DWORD)v5 != 22 )
{
if( (_DWORD)v5 == 23 )
{
if( *(_BYTE *)v9 != 1 )
{
v13 = -1073741811;
LODWORD(Flags) = -1073741811;
v14 = (char *)DeferredContext;
goto LABEL_35;
}
LODWORD(Object) = 0;
v14 = (char *)DeferredContext;
PspEnumJobsAndProcessesInJobHierarchy(
(_EJOB *)DeferredContext,
0i64,
(_EJOB *)PspEnableTimerVirtualization,
PspEnableProcessTimerVirtualization,
0i64,
(_EJOB *)Object,
HandleInformation,
v137,
AccessMode,
DeferredContext,
Context,
Flags);
LABEL_34:
v13 = 0;
LABEL_35:
KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
ObfDereferenceObjectWithTag(v14, 0x79517350ui64);
return v13;
}
LABEL_455:
v13 = -1073741821;
goto LABEL_278;
}
BYTE4(Flags) = *(_BYTE *)v9;
v14 = (char *)DeferredContext;
ExAcquireResourceExclusiveLite((UINT64)DeferredContext + 56, 1, v12);
if( (*((_DWORD *)v14 + 330) & 0x20) != 0 )
{
v83 = *((_QWORD *)v14 + 126);
v84 = *(_DWORD *)(v83 + 40);
if( (v84 & 0x40) == 0 )
{
if( (v84 & 1) != 0 || (v84 & 0x20) != 0 )
{
v13 = -1073741637;
goto LABEL_117;
}
if( ((v84 >> 3) & 1) != (BYTE4(Flags) != 0) )
{
*(_DWORD *)(v83 + 40) = (BYTE4(Flags) != 0 ? 8 : 0) | v84 & 0xFFFFFFF7;
KeSetSchedulingGroupRankBias(
(_KSCHEDULING_GROUP *)(*((_QWORD *)v14 + 126) + 128i64),
BYTE4(Flags));
PspEnumProcessesInJobHierarchy(v14, PspSetProcessCacheIsolationCallback, (char *)&Flags + 4, 1i64);
LABEL_116:
v13 = 0;
LABEL_117:
v52 = (_ERESOURCE *)(v14 + 56);
LABEL_118:
ExReleaseResourceLite(v52);
goto LABEL_35;
}
}
}
goto LABEL_376;
}
v150 = *(_BYTE *)v9;
v14 = (char *)DeferredContext;
v19 = PspSetBackgroundJobTree(DeferredContext, v150);
LABEL_63:
v13 = v19;
if( v19 < 0 )
goto LABEL_35;
goto LABEL_34;
}
v174 = *(_DWORD *)v9;
v15 = v174;
v14 = (char *)DeferredContext;
if( (v174 & 0xFFFFC001) == 0 )
{
ExAcquireResourceExclusiveLite((UINT64)DeferredContext + 56, 1, v12);
if( v14 )
ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)v14 + 129, 0i64);
*((_DWORD *)v14 + 219) = v15;
PspUnlockJobMemoryLimitsExclusive((_EJOB *)v14, 0i64, 0i64);
goto LABEL_33;
}
LABEL_426:
v13 = -1073741811;
goto LABEL_35;
}
memmove(&v167, v9, v4);
v73 = v167;
if( (v167 & 0xFFFFFFE0) == 0 )
{
v74 = HIDWORD(v167);
Weights.Value = HIDWORD(v167);
LODWORD(Context) = v167 & 1;
if( (v167 & 1) == 0 )
goto LABEL_178;
if( (v167 & 2) != 0 )
{
if( (v167 & 0x10) == 0 && (unsigned __int16)(WORD2(v167) - 1) <= 8u )
goto LABEL_178;
}
else if( (unsigned __int16)(WORD2(v167) - 1) <= 0x270Fu
&& ((v167 & 0x10) == 0 || (v167 & 4) == 0 && HIWORD(v167) >= WORD2(v167) && HIWORD(v167) <= 0x2710u) )
{
LABEL_178:
v14 = (char *)DeferredContext;
PspLockJobChain((_EJOB *)DeferredContext, CurrentThread);
v75 = *((_DWORD *)v14 + 330);
if( (_DWORD)Context )
{
if( (v75 & 0x20) == 0 )
{
RateControl = PspAllocateRateControl(PspJobCpuRateControl);
v77 = RateControl;
if( !RateControl )
{
v13 = -1073741670;
goto LABEL_204;
}
*((_QWORD *)v14 + 126) = RateControl;
LABEL_190:
v78 = (_JOB_RATE_CONTROL_HEADER **)(v14 + 1008);
*(_DWORD *)(*((_QWORD *)v14 + 126) + 40i64) = 0;
*(_DWORD *)(*((_QWORD *)v14 + 126) + 44i64) = v74;
if( (_DWORD)Context )
{
if( (v73 & 4) != 0 )
{
LODWORD((*v78)[1].RateControlQuotaReference) |= 1u;
Weights.MaxRate = v74;
}
if( (v73 & 2) != 0 )
{
LODWORD((*v78)[1].RateControlQuotaReference) |= 4u;
Weights.AllFlags = 0;
}
else
{
Weights.AllFlags = 1;
if( (v73 & 0x14) == 0 )
Weights.MaxRate = 10000;
}
if( (v73 & 8) != 0 )
LODWORD((*v78)[1].RateControlQuotaReference) |= 2u;
if( (v73 & 0x10) != 0 )
LODWORD((*v78)[1].RateControlQuotaReference) |= 0x20u;
v79 = *v78;
p_OverQuotaHistory = (_KSCHEDULING_GROUP **)&(*v78)[3].OverQuotaHistory;
if( *v78 == v77 )
{
*p_OverQuotaHistory = (_KSCHEDULING_GROUP *)Weights;
v13 = PspAddSchedulingGroupToJobChain(*((_EJOB **)v14 + 134), (_EJOB *)v14);
LODWORD(Flags) = v13;
if( v13 < 0 )
{
if( *v78 )
{
PspFreeRateControl(*v78, PspJobCpuRateControl);
*v78 = 0i64;
}
goto LABEL_204;
}
_InterlockedOr((volatile signed __int32 *)v14 + 330, 0x20u);
v14 = (char *)DeferredContext;
}
else
{
CpuRates = (_KSCHEDULING_GROUP_POLICY)&(*v78)[3].OverQuotaHistory;
if( ((__int64)v79[1].RateControlQuotaReference & 4) != 0 )
KeSetSchedulingGroupWeights(1ui64, (_KSCHEDULING_GROUP **)&CpuRates, &Weights);
else
KeSetSchedulingGroupCpuRates(p_OverQuotaHistory, &CpuRates, (_KSCHEDULING_GROUP_POLICY)&Weights);
}
JobObjectInformationa = (*v78)[1].RateControlQuotaReference;
}
else
{
Weights.AllFlags = 3;
Weights.Value = 655370000;
LODWORD((*v78)[1].RateControlQuotaReference) |= 0x40u;
Value = Weights.Value;
HIDWORD((*v78)[1].RateControlQuotaReference) = Weights.Value;
CpuRates = (_KSCHEDULING_GROUP_POLICY)&(*v78)[3].OverQuotaHistory;
BYTE5(Flags) = (*(_DWORD *)(*(_QWORD *)&CpuRates + 4i64) & 4) != 0;
*((_QWORD *)v14 + 128) += KeQuerySchedulingGroupReadyTime(*(_KSCHEDULING_GROUP **)&CpuRates);
KeSetSchedulingGroupCpuRates(v86, &CpuRates, (_KSCHEDULING_GROUP_POLICY)&Weights);
HIDWORD(JobObjectInformationa) = Value;
if( BYTE5(Flags) )
{
BYTE5(Flags) = 0;
PspEnumProcessesInJobHierarchy(v14, PspSetProcessCacheIsolationCallback, (char *)&Flags + 5, 1i64);
}
}
v13 = 0;
LABEL_204:
v129 = CurrentThread;
v130 = (_EJOB *)v14;
LABEL_205:
PspUnlockJobChain(v130, v129);
goto LABEL_35;
}
}
else if( (v75 & 0x20) == 0 )
{
v13 = -1073741811;
goto LABEL_204;
}
v77 = 0i64;
goto LABEL_190;
}
}
LABEL_380:
v13 = -1073741811;
goto LABEL_278;
}
LABEL_292:
ObjectHandle = 0i64;
v149 = 0i64;
v95 = 16;
if( (_DWORD)v5 != 14 )
v95 = 2;
v155 = v95;
v96 = (unsigned int)v4 / v95;
if( (unsigned int)v4 % v95 )
{
v13 = -1073741820;
goto LABEL_278;
}
HIDWORD(SessionId) = (unsigned int)v4 / v95;
*(_DWORD *)&Affinity.Count = 1310721;
memset(&Affinity.Reserved, 0i64, 0xA4u);
v112 = KeQueryActiveGroupCount() - 1;
LOWORD(v142) = v112;
while( v96 )
{
if( (_DWORD)v5 == 14 )
{
v113 = *(__m128i *)v9;
Base = v113;
LOWORD(v114) = _mm_extract_epi16(v113, 4);
Base.m128i_i16[4] = v114;
v145 = v114;
ProcessorMask = v113.m128i_i64[0];
}
else
{
v114 = *v9;
v145 = v114;
if( (unsigned __int16)v114 > v112 )
goto LABEL_396;
ProcessorMask = KeActiveProcessors.Bitmap[v114];
LOWORD(v114) = v145;
}
if( (unsigned __int16)v114 > v112
|| (v114 = (unsigned __int16)v114, Affinity.Bitmap[(unsigned __int16)v114])
|| ProcessorMask != (ProcessorMask & KeActiveProcessors.Bitmap[v114]) )
{
LABEL_396:
v13 = -1073741811;
LODWORD(Flags) = -1073741811;
break;
}
KeAddGroupAffinityEx(&Affinity.Count, v145, ProcessorMask);
v96 = --HIDWORD(SessionId);
v9 = (unsigned __int16 *)((char *)Src + v155);
Src = v9;
v13 = Flags;
v112 = v142;
}
v14 = (char *)DeferredContext;
if( v13 < 0 )
goto LABEL_35;
PushLock = (_EX_PUSH_LOCK *)((char *)DeferredContext + 432);
if( *((_QWORD *)DeferredContext + 54) )
goto LABEL_402;
PoolWithTag = (_ERESOURCE *)ExAllocatePoolWithTag(1ui64, 0x28ui64, 1632269136i64);
ObjectHandle = PoolWithTag;
if( PoolWithTag )
{
v149 = (PERESOURCE)PsChargeSharedPoolQuota(KeGetCurrentThread()->ApcState.Process, 0x28ui64, 0i64);
if( v149 )
{
v14 = (char *)DeferredContext;
LABEL_402:
SeCaptureSubjectContextEx(
CurrentThread,
CurrentThread->Tcb.ApcState.Process,
(PSECURITY_SUBJECT_CONTEXT)&SubjectContext.ImpersonationLevel);
p_ImpersonationLevel = &SubjectContext.ImpersonationLevel;
if( (_BYTE)AccessMode )
{
RequiredPrivileges.PrivilegeCount = 1;
RequiredPrivileges.Control = 1;
RequiredPrivileges.Privilege[0].Luid = SeDebugPrivilege;
RequiredPrivileges.Privilege[0].Attributes = 0;
v117 = SePrivilegeCheck(
(UINT64 *)&RequiredPrivileges.PrivilegeCount,
(INT64)&SubjectContext.ImpersonationLevel,
1);
LODWORD(SubjectContext.ClientToken) ^= (LODWORD(SubjectContext.ClientToken) ^ v117) & 1;
}
else
{
LODWORD(SubjectContext.ClientToken) |= 1u;
}
Resource = (PERESOURCE)(v14 + 56);
ExAcquireResourceExclusiveLite((UINT64)(v14 + 56), 1, v115);
v13 = PspEnumProcessesInJobHierarchy(v14, PspSetAffinityLimitCallback, &SubjectContext, 1i64);
LODWORD(Flags) = v13;
v118 = v149;
if( v13 >= 0 )
{
v119 = PushLock;
bf_0 = PushLock->_bf_0;
if( PushLock->_bf_0 )
{
v178 = *(_OWORD *)(bf_0 + 8);
v179 = *(_OWORD *)(bf_0 + 24);
p_ImpersonationLevel = (_SECURITY_IMPERSONATION_LEVEL *)&v178;
}
else
{
PushLock->_bf_0 = (__int64)ObjectHandle;
*((_QWORD *)v14 + 55) = v118;
ObjectHandle = 0i64;
p_ImpersonationLevel = 0i64;
bf_0 = v119->_bf_0;
}
*(_SECURITY_SUBJECT_CONTEXT *)bf_0 = SubjectContext;
*(_QWORD *)(bf_0 + 32) = v163;
JobPostCallback[0] = (INT64)v14;
HIDWORD(JobPostCallback[1]) = *((_DWORD *)v14 + 64);
LODWORD(JobPostCallback[1]) = -17;
*(_KAFFINITY_EX *)(v14 + 264) = Affinity;
if( (_DWORD)v5 == 14 && KeIsEmptyAffinityEx((WORD *)v14 + 132) )
{
*((_DWORD *)v14 + 64) &= ~0x10u;
_InterlockedAnd((volatile signed __int32 *)v14 + 330, 0xFFFFFFFD);
}
else
{
*((_DWORD *)v14 + 64) |= 0x10u;
_InterlockedOr((volatile signed __int32 *)v14 + 330, 2u);
}
LODWORD(Object) = 5;
v14 = (char *)DeferredContext;
PspEnumJobsAndProcessesInJobHierarchy(
(_EJOB *)DeferredContext,
(INT64 *)PspSetJobLimitsJobPreCallback,
0i64,
PspSetJobLimitsProcessCallback,
JobPostCallback,
(_EJOB *)Object,
HandleInformation,
v137,
AccessMode,
DeferredContext,
Context,
Flags);
v13 = Flags;
}
ExReleaseResourceLite(Resource);
if( p_ImpersonationLevel )
SeReleaseSubjectContext((PSECURITY_SUBJECT_CONTEXT)p_ImpersonationLevel);
if( !ObjectHandle )
goto LABEL_35;
ExFreePoolWithTag(ObjectHandle, 0x614A7350u);
v111 = (_EX_PUSH_LOCK *)v118;
goto LABEL_418;
}
goto LABEL_342;
}
LABEL_341:
v13 = -1073741670;
goto LABEL_35;
}
if( (_DWORD)v5 != 12 )
{
if( (_DWORD)v5 == 2 )
goto LABEL_120;
if( (_DWORD)v5 != 4 )
{
switch( (_DWORD)v5 )
{
case 5:
v185 = *(_JOBOBJECT_FREEZE_INFORMATION *)v9;
v186 = *((_OWORD *)v9 + 1);
v187 = *((_QWORD *)v9 + 4);
v13 = (v185.Flags & 0xFFFFFFF0) != 0 ? -1073741811 : -1073741637;
goto LABEL_278;
case 6:
v173 = *(_DWORD *)v9;
v97 = v173;
v14 = (char *)DeferredContext;
if( v173 <= 1 )
{
ExAcquireResourceExclusiveLite((UINT64)DeferredContext + 56, 1, v12);
*((_DWORD *)v14 + 113) = v97;
goto LABEL_117;
}
goto LABEL_426;
case 7:
ObjectHandle = 0i64;
*(_OWORD *)Handle = *(_OWORD *)v9;
if( !*(_QWORD *)&Handle[2] )
{
v14 = (char *)DeferredContext;
ExAcquireResourceExclusiveLite((UINT64)DeferredContext + 56, 1, v12);
if( v14 )
ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)v14 + 129, 0i64);
v82 = (VOID *)*((_QWORD *)v14 + 57);
*((_QWORD *)v14 + 57) = 0i64;
PspUnlockJobMemoryLimitsExclusive((_EJOB *)v14, 0i64, 0i64);
ExReleaseResourceLite((PERESOURCE)(v14 + 56));
if( v82 )
ObfDereferenceObjectWithTag(v82, 0x624A7350ui64);
goto LABEL_35;
}
Tag[0] = 1649046352;
v13 = ObReferenceObjectByHandleWithTag(
*(VOID **)&Handle[2],
2ui64,
IoCompletionObjectType,
(INT8)AccessMode,
*(UINT64 *)Tag,
&v168,
0i64);
v14 = (char *)DeferredContext;
if( v13 < 0 )
{
v18 = 0i64;
}
else
{
if( *((_QWORD *)DeferredContext + 125) )
{
MiniCompletionPacket = 0i64;
goto LABEL_46;
}
MiniCompletionPacket = IoAllocateMiniCompletionPacket(
(INT64)PspNotificationPacketCallback,
(INT64)DeferredContext);
ObjectHandle = MiniCompletionPacket;
if( MiniCompletionPacket )
{
LABEL_46:
ExAcquireResourceExclusiveLite((UINT64)(v14 + 56), 1, v16);
if( *((_QWORD *)v14 + 57)
|| (*((_DWORD *)v14 + 64) & 0x2000) != 0 && (*((_DWORD *)v14 + 330) & 1) != 0 )
{
ExReleaseResourceLite((PERESOURCE)(v14 + 56));
ObfDereferenceObjectWithTag(v168, 0x624A7350ui64);
v13 = -1073741811;
v18 = (_IO_MINI_COMPLETION_PACKET_USER *)ObjectHandle;
}
else
{
if( *((_QWORD *)v14 + 125) )
{
v18 = (_IO_MINI_COMPLETION_PACKET_USER *)ObjectHandle;
}
else
{
*((_QWORD *)v14 + 125) = MiniCompletionPacket;
v18 = 0i64;
}
ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)v14 + 129, 0i64);
*((_QWORD *)v14 + 58) = *(_QWORD *)Handle;
*((_QWORD *)v14 + 57) = v168;
*((_QWORD *)v14 + 59) = 0i64;
PspUnlockJobMemoryLimitsExclusive((_EJOB *)v14, 0i64, 0i64);
if( (*((_DWORD *)v14 + 219) & 0x40) != 0 )
PspEnumProcessesInJobHierarchy(v14, PspAssociateCompletionPortCallback, v14, 1i64);
ExReleaseResourceLite((PERESOURCE)(v14 + 56));
}
goto LABEL_53;
}
v13 = -1073741670;
v18 = 0i64;
}
LABEL_53:
if( v18 )
IoFreeMiniCompletionPacket(v18);
goto LABEL_35;
}
if( (_DWORD)v5 != 9 )
{
if( (_DWORD)v5 != 11 )
goto LABEL_455;
goto LABEL_292;
}
LABEL_120:
memmove(v200, v9, v4);
if( (unsigned int)v4 < 0x98 )
memset((char *)v200 + v4, 0i64, 152 - v4);
JobLimitInformationValidFlags = PspGetJobLimitInformationValidFlags((unsigned int)v5, (unsigned int)v4);
v54 = ~JobLimitInformationValidFlags;
LODWORD(v149) = ~JobLimitInformationValidFlags;
v55 = v200[2];
if( (~JobLimitInformationValidFlags & v200[2]) != 0 )
goto LABEL_380;
LODWORD(v205[32]) = v200[2];
Resource = 0i64;
PushLock = 0i64;
v165 = 0i64;
HIDWORD(v205[32]) = (v200[2] & 8) != 0 ? LODWORD(v200[5]) : 0;
if( (v200[2] & 0x20) != 0 )
{
if( LODWORD(v200[7]) > 6 )
goto LABEL_380;
v56 = (char)AccessMode;
if( (unsigned int)(LODWORD(v200[7]) - 3) <= 1 )
{
LOBYTE(v53) = (_BYTE)AccessMode;
v98 = SeCheckPrivilegedObject(SeIncreaseBasePriorityPrivilege, ObjectHandle, 2ui64, v53) & 1;
LOBYTE(v99) = 4 * v98;
v142 = v99;
if( !v98 )
goto LABEL_311;
v55 = v200[2];
}
BYTE1(v205[109]) = v200[7];
}
else
{
BYTE1(v205[109]) = 0;
v56 = (char)AccessMode;
}
if( (v55 & 0x80u) != 0 )
{
v100 = HIDWORD(v200[7]);
if( HIDWORD(v200[7]) >= 0xA )
goto LABEL_380;
if( HIDWORD(v200[7]) > 5 )
{
LOBYTE(v53) = v56;
v101 = SeCheckPrivilegedObject(SeIncreaseBasePriorityPrivilege, ObjectHandle, 2ui64, v53) & 1;
LOBYTE(v102) = 4 * v101;
v142 = v102;
if( !v101 )
goto LABEL_311;
v55 = v200[2];
v100 = HIDWORD(v200[7]);
}
HIDWORD(v205[60]) = v100;
}
else
{
HIDWORD(v205[60]) = 5;
}
if( (v55 & 2) != 0 )
{
if( !v200[0] )
goto LABEL_380;
v205[28] = v200[0];
}
else
{
v205[28] = 0i64;
}
v155 = v55 & 4;
if( (v55 & 4) != 0 )
{
if( !v200[1] )
goto LABEL_380;
v205[29] = v200[1];
}
if( (v55 & 1) == 0 )
{
v205[30] = 0i64;
v205[31] = 0i64;
goto LABEL_132;
}
v103 = v200[3];
if( !v200[3] && !v200[4]
|| v200[3] == -1 && v200[4] == -1
|| v200[3] > (unsigned __int64)v200[4]
|| v200[3] < 0x14000ui64 )
{
goto LABEL_380;
}
if( v200[3] <= PspMinimumWorkingSet )
{
LABEL_330:
v205[30] = v103;
v205[31] = v200[4];
LABEL_132:
if( (v55 & 0x100) != 0 )
{
if( v200[14] < 0x1000ui64 )
goto LABEL_380;
v205[72] = (unsigned __int64)v200[14] >> 12;
}
else
{
v205[72] = 0i64;
}
if( (v55 & 0x200) != 0 )
{
if( v200[15] < 0x1000ui64 )
goto LABEL_380;
v205[73] = (unsigned __int64)v200[15] >> 12;
}
else
{
v205[73] = 0i64;
}
if( (v55 & 0x200000) != 0 )
{
if( v200[18] < 0x1000ui64 )
goto LABEL_380;
v205[74] = (unsigned __int64)v200[18] >> 12;
}
else
{
v205[74] = 0i64;
}
LODWORD(v205[33]) = 1310721;
memset((char *)&v205[33] + 4, 0i64, 0xA4u);
LODWORD(Context) = v205[32];
v14 = (char *)DeferredContext;
if( (v205[32] & 0x10) != 0 )
{
if( (*((_DWORD *)DeferredContext + 330) & 2) != 0 || !v200[6] )
goto LABEL_426;
if( !*((_QWORD *)DeferredContext + 54) )
{
PoolWithTag = (_ERESOURCE *)ExAllocatePoolWithTag(1ui64, 0x28ui64, 1632269136i64);
Resource = PoolWithTag;
if( !PoolWithTag )
goto LABEL_341;
PushLock = (_EX_PUSH_LOCK *)PsChargeSharedPoolQuota(
KeGetCurrentThread()->ApcState.Process,
0x28ui64,
0i64);
if( !PushLock )
{
LABEL_342:
v106 = 1632269136;
v81 = PoolWithTag;
LABEL_344:
ExFreePoolWithTag(v81, v106);
v13 = -1073741670;
goto LABEL_278;
}
v14 = (char *)DeferredContext;
LODWORD(Context) = v205[32];
v13 = Flags;
}
SeCaptureSubjectContextEx(
CurrentThread,
CurrentThread->Tcb.ApcState.Process,
(PSECURITY_SUBJECT_CONTEXT)&SubjectContext.ImpersonationLevel);
v165 = (PSECURITY_SUBJECT_CONTEXT)&SubjectContext.ImpersonationLevel;
if( (_BYTE)AccessMode )
{
RequiredPrivileges.PrivilegeCount = 1;
RequiredPrivileges.Control = 1;
RequiredPrivileges.Privilege[0].Luid = SeDebugPrivilege;
RequiredPrivileges.Privilege[0].Attributes = 0;
v105 = SePrivilegeCheck(
(UINT64 *)&RequiredPrivileges.PrivilegeCount,
(INT64)&SubjectContext.ImpersonationLevel,
1);
LODWORD(SubjectContext.ClientToken) ^= (LODWORD(SubjectContext.ClientToken) ^ v105) & 1;
}
else
{
LODWORD(SubjectContext.ClientToken) |= 1u;
}
v58 = v142;
LOBYTE(v58) = v142 | 2;
v142 = v58;
v54 = (int)v149;
}
else
{
LOBYTE(v58) = v142;
}
LOBYTE(AccessMode) = v58;
v149 = (PERESOURCE)(v14 + 56);
ExAcquireResourceExclusiveLite((UINT64)(v14 + 56), 1, v57);
v61 = (unsigned int)Context;
if( ((unsigned __int8)Context & 4) == 0 )
{
if( ((unsigned __int8)Context & 0x40) != 0 )
{
v61 = *((_DWORD *)v14 + 64) & 4 | (unsigned int)Context;
v205[29] = *((_QWORD *)v14 + 29);
}
else
{
v205[29] = 0i64;
}
}
v62 = v61 & 0xFFFFFFBF;
LODWORD(v205[32]) = v62;
if( ((unsigned __int8)AccessMode & 2) != 0 )
{
if( (*((_DWORD *)v14 + 330) & 2) == 0 )
{
if( (*((_DWORD *)v14 + 64) & 0x10) != 0 )
{
KeFirstGroupAffinityEx(&Base, (_BYTE)v14 + 8, v59, v60);
Group = Base.m128i_u16[4];
}
else
{
Group = KeGetCurrentPrcb()->Group;
Base.m128i_i16[4] = Group;
}
if( v200[6] == (KeActiveProcessors.Bitmap[Group] & v200[6]) )
{
if( LOWORD(v205[33]) <= (unsigned int)Base.m128i_i16[4] )
LOWORD(v205[33]) = Base.m128i_i16[4] + 1;
v205[Group + 34] |= v200[6];
v14 = (char *)DeferredContext;
v13 = PspEnumProcessesInJobHierarchy(
DeferredContext,
PspSetAffinityLimitCallback,
&SubjectContext,
1i64);
LODWORD(Flags) = v13;
if( v13 >= 0 )
{
v108 = *((_QWORD *)v14 + 54);
if( v108 )
{
v178 = *(_OWORD *)(v108 + 8);
v179 = *(_OWORD *)(v108 + 24);
v165 = (PSECURITY_SUBJECT_CONTEXT)&v178;
}
else
{
*((_QWORD *)v14 + 54) = Resource;
*((_QWORD *)v14 + 55) = PushLock;
Resource = 0i64;
v165 = 0i64;
v108 = *((_QWORD *)v14 + 54);
}
*(_SECURITY_SUBJECT_CONTEXT *)v108 = SubjectContext;
*(_QWORD *)(v108 + 32) = v163;
goto LABEL_145;
}
}
else
{
v13 = -1073741811;
LODWORD(Flags) = -1073741811;
v14 = (char *)DeferredContext;
}
LABEL_352:
v68 = v142;
LABEL_156:
v69 = v68 & 1;
if( v69 )
{
PspLockWorkingSetChangeExclusiveUnsafe();
_InterlockedOr((volatile signed __int32 *)v14 + 330, 0x100u);
v14 = (char *)DeferredContext;
v109 = (char *)DeferredContext + 40;
for( i = (char *)*((_QWORD *)DeferredContext + 5); i != v109; i = *(char **)i )
{
if( (*((_DWORD *)i - 90) & 1) == 0 )
PspAddProcessToWorkingSetChangeList((_EPROCESS *)(i - 1480));
}
v13 = Flags;
}
ExReleaseResourceLite(v149);
if( v69 )
PspApplyWorkingSetLimits((_EJOB *)v14, v70);
if( v165 )
SeReleaseSubjectContext(v165);
if( !Resource )
goto LABEL_35;
ExFreePoolWithTag(Resource, 0x614A7350u);
v111 = PushLock;
LABEL_418:
PsReturnSharedPoolQuota(v111, 0x28u, 0);
goto LABEL_35;
}
}
else if( (v62 & 0x4000) == 0 || (*((_DWORD *)v14 + 330) & 2) != 0 )
{
LABEL_145:
v63 = v14 + 256;
ObjectHandle = v14 + 256;
if( (*((_DWORD *)v14 + 64) & 1) != 0 && (v205[32] & 1) == 0 )
{
_InterlockedOr(v133, 0);
if( (stru_140C130B0._bf_0 & 1) != 0 )
{
ExfAcquireReleasePushLockExclusive(&stru_140C130B0);
v63 = ObjectHandle;
}
v13 = Flags;
v14 = (char *)DeferredContext;
}
JobPostCallback[0] = (INT64)v14;
HIDWORD(JobPostCallback[1]) = *v63;
*((_QWORD *)v14 + 30) = v205[30];
*((_QWORD *)v14 + 31) = v205[31];
*((_DWORD *)v14 + 65) = HIDWORD(v205[32]);
if( ((unsigned __int8)AccessMode & 2) != 0 )
{
*(_OWORD *)(v14 + 264) = *(_OWORD *)&v205[33];
*(_OWORD *)(v14 + 280) = *(_OWORD *)&v205[35];
*(_OWORD *)(v14 + 296) = *(_OWORD *)&v205[37];
*(_OWORD *)(v14 + 312) = *(_OWORD *)&v205[39];
*(_OWORD *)(v14 + 328) = *(_OWORD *)&v205[41];
*(_OWORD *)(v14 + 344) = *(_OWORD *)&v205[43];
*(_OWORD *)(v14 + 360) = *(_OWORD *)&v205[45];
*(_OWORD *)(v14 + 376) = *(_OWORD *)&v205[47];
*(_OWORD *)(v14 + 392) = *(_OWORD *)&v205[49];
*(_OWORD *)(v14 + 408) = *(_OWORD *)&v205[51];
*((_QWORD *)v14 + 53) = v205[53];
v63 = ObjectHandle;
}
v14[873] = BYTE1(v205[109]);
*((_DWORD *)v14 + 121) = HIDWORD(v205[60]);
*((_QWORD *)v14 + 28) = v205[28];
v64 = v14 + 232;
*((_QWORD *)v14 + 29) = v205[29];
if( (_DWORD)v5 == 9 )
{
ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)v14 + 129, 0i64);
v65 = (int *)ObjectHandle;
*(_DWORD *)ObjectHandle = LODWORD(v205[32]) | *(_DWORD *)ObjectHandle & v54;
*((_QWORD *)v14 + 72) = v205[72];
*((_QWORD *)v14 + 73) = v205[73];
*((_QWORD *)v14 + 74) = v205[74];
PspUnlockJobMemoryLimitsExclusive((_EJOB *)v14, 0i64, 0i64);
v66 = *v65;
v64 = v14 + 232;
}
else
{
v66 = LODWORD(v205[32]) | *v63 & v54;
*v63 = v66;
v65 = (int *)ObjectHandle;
}
LODWORD(JobPostCallback[1]) = ~(HIDWORD(JobPostCallback[1]) | v66);
if( v155 )
{
PspEnumProcessesInJobHierarchy(v14, PspSetJobTimeLimitCallback, v64, 1i64);
*((_QWORD *)v14 + 23) = 0i64;
*((_QWORD *)v14 + 24) = 0i64;
KeResetEvent((_KEVENT *)v14);
}
if( (*v65 & 6) != 0 )
{
_InterlockedAdd64(&PspJobTimeLimitsRequest, 1ui64);
v14 = (char *)DeferredContext;
v13 = Flags;
}
v67 = JobPostCallback[1];
LODWORD(Object) = 5;
PspEnumJobsAndProcessesInJobHierarchy(
(_EJOB *)v14,
(INT64 *)PspSetJobLimitsJobPreCallback,
(_EJOB *)PspSetJobLimitsJobPostCallback,
PspSetJobLimitsProcessCallback,
JobPostCallback,
(_EJOB *)Object,
HandleInformation,
v137,
AccessMode,
DeferredContext,
Context,
Flags);
v68 = (unsigned __int8)AccessMode | 1;
if( (v67 & 1) != 0 )
v68 = (char)AccessMode;
goto LABEL_156;
}
v13 = -1073741811;
LODWORD(Flags) = -1073741811;
goto LABEL_352;
}
if( SeSinglePrivilegeCheck(*(_QWORD *)&SeIncreaseBasePriorityPrivilege, v56) )
{
v55 = v200[2];
v103 = v200[3];
goto LABEL_330;
}
LABEL_311:
v13 = -1073741727;
goto LABEL_278;
}
v153 = *(_DWORD *)v9;
if( (v153 & 0xFFFFFF00) != 0 )
goto LABEL_380;
v87 = 8;
v14 = (char *)DeferredContext;
PspLockJobChain((_EJOB *)DeferredContext, CurrentThread);
if( (unsigned __int8)PspDoesJobHierarchyPermitUILimits((INT64)v14) )
{
if( *((_DWORD *)v14 + 120) == -2 )
{
v13 = -1073741790;
}
else
{
v14 = (char *)DeferredContext;
PspBindProcessSessionToJob((_EJOB *)DeferredContext, KeGetCurrentThread()->ApcState.Process);
LODWORD(SessionId) = *v88;
if( (unsigned int)SessionId > 0xFFFFFFFD )
goto LABEL_243;
if( v153 == *((_DWORD *)v14 + 112) )
goto LABEL_243;
v183 = 0;
PspUnlockJobChain((_EJOB *)v14, CurrentThread);
v87 = 0;
Parameters = v14;
v182 = 0;
v184 = v153;
v13 = PsInvokeWin32Callout(Win32JobCallout, &Parameters, PsWin32SessionAttachSingle, &SessionId);
LODWORD(Flags) = v13;
if( v13 >= 0 )
{
LABEL_243:
*((_DWORD *)v14 + 112) = v153;
_InterlockedOr((volatile signed __int32 *)v14 + 330, 0x10u);
v14 = (char *)DeferredContext;
v13 = Flags;
}
}
}
else
{
v13 = -1073741637;
}
v129 = CurrentThread;
v130 = (_EJOB *)v14;
if( (unsigned __int8)v87 >= 8u )
goto LABEL_205;
LABEL_245:
PspUnlockJob(v130, v129);
goto LABEL_35;
}
LABEL_65:
if( (_DWORD)v4 == 56 )
{
v196 = *(__m128i *)&PushLock->_bf_0;
v197 = *(__m128i *)&PushLock[2]._bf_0;
v198 = *(__m128i *)&PushLock[4]._bf_0;
v199 = PushLock[6]._bf_0;
v20 = (unsigned int)v199;
LODWORD(v194[5]) = v199;
v21 = v196.m128i_i64[0];
v194[0] = v196.m128i_i64[0];
v22 = _mm_srli_si128(v196, 8).m128i_u64[0];
v194[1] = v22;
v23 = v197.m128i_i64[0];
v194[2] = v197.m128i_i64[0];
v24 = _mm_srli_si128(v197, 8).m128i_u64[0];
v194[6] = v24;
v25 = v198.m128i_i64[0];
v194[3] = v198.m128i_i64[0];
v194[4] = __PAIR64__(_mm_cvtsi128_si32(_mm_srli_si128(v198, 12)), _mm_cvtsi128_si32(_mm_srli_si128(v198, 8)));
v26 = 2589188;
JobLimitInformationValidFlags = 2589188;
}
else
{
if( (_DWORD)v4 == 48 )
{
v201 = *(__m128i *)&PushLock->_bf_0;
v202 = *(__m128i *)&PushLock[2]._bf_0;
v203 = *(__m128i *)&PushLock[4]._bf_0;
v20 = (unsigned int)_mm_cvtsi128_si32(_mm_srli_si128(v203, 8));
LODWORD(v194[5]) = v20;
v21 = v201.m128i_i64[0];
v194[0] = v201.m128i_i64[0];
v22 = _mm_srli_si128(v201, 8).m128i_u64[0];
v194[1] = v22;
v23 = v202.m128i_i64[0];
v194[2] = v202.m128i_i64[0];
v25 = _mm_srli_si128(v202, 8).m128i_u64[0];
v194[3] = v25;
v194[4] = __PAIR64__(_mm_cvtsi128_si32(_mm_srli_si128(v203, 4)), _mm_cvtsi128_si32(v203));
v26 = 459268;
JobLimitInformationValidFlags = 459268;
}
else
{
memmove(v194, v9, v4);
v26 = 2064900;
JobLimitInformationValidFlags = 2064900;
v20 = LODWORD(v194[5]);
v25 = v194[3];
v23 = v194[2];
v22 = v194[1];
v21 = v194[0];
}
v24 = v194[6];
}
if( (~v26 & (unsigned int)v20) != 0 )
goto LABEL_380;
if( (v20 & 0x8000) != 0 )
{
if( v24 < 0x1000 )
goto LABEL_380;
}
else
{
v24 = 0i64;
v194[6] = 0i64;
}
if( (v20 & 0x200) != 0 )
{
if( v25 < 0x1000 || v25 < v24 )
goto LABEL_380;
}
else
{
v194[3] = 0i64;
}
if( (v20 & 4) != 0 )
{
if( !v23 )
goto LABEL_380;
}
else
{
v194[2] = 0i64;
}
if( (v20 & 0x10000) != 0 )
{
if( !v21 )
goto LABEL_380;
}
else
{
v194[0] = 0i64;
}
if( (v20 & 0x20000) != 0 )
{
if( !v22 )
goto LABEL_380;
}
else
{
v194[1] = 0i64;
}
for( j = 0; j < 3; j = v31 + 1 )
{
PspNotificationLimitRateControlToleranceField((__int64)v194, j);
PspNotificationLimitRateControlToleranceIntervalField((__int64)v194, v28);
v30 = PspRateControlLimitFlag(v29);
if( (v30 & (unsigned int)v20) != 0 )
{
if( !*v32 || *v32 > 3 || !*v33 || *v33 > 3 )
goto LABEL_380;
}
else
{
*v32 = 0;
*v33 = 0;
v20 = LODWORD(v194[5]);
}
}
v14 = (char *)DeferredContext;
v34 = (VOID ***)((char *)DeferredContext + 984);
if( *((_QWORD *)DeferredContext + 123) )
{
v35 = 0i64;
PushLock = 0i64;
}
else
{
v35 = ExAllocatePoolWithTag(1ui64, 0x88ui64, 1649046352i64);
if( !v35 )
goto LABEL_341;
PushLock = (_EX_PUSH_LOCK *)PsChargeSharedPoolQuota(KeGetCurrentThread()->ApcState.Process, 0x88ui64, 0i64);
v81 = (_ERESOURCE *)v35;
if( !PushLock )
{
v106 = 1649046352;
goto LABEL_344;
}
memset(v35, 0i64, 0x88u);
v14 = (char *)DeferredContext;
}
Resource = (PERESOURCE)(v14 + 56);
ExAcquireResourceExclusiveLite((UINT64)(v14 + 56), 1, v20);
if( *v34 )
{
if( v35 )
{
ExFreePoolWithTag(v35, 0x624A7350u);
PsReturnSharedPoolQuota(PushLock, 0x88u, 0);
}
}
else
{
*v34 = v35;
*((_QWORD *)v14 + 124) = PushLock;
}
v36 = *v34;
v37 = *(_DWORD *)*v34;
v36[1] = (VOID *)v194[0];
v36[2] = (VOID *)v194[1];
v36[3] = (VOID *)v194[2];
for( k = 0; k < 3; k = v44 + 1 )
{
v39 = (_DWORD *)PspNotificationLimitRateControlToleranceField((__int64)v194, k);
*(_DWORD *)(v40 - 12) = *v39;
v42 = (_DWORD *)PspNotificationLimitRateControlToleranceIntervalField((__int64)v194, v41);
*v43 = *v42;
}
PushLock = (_EX_PUSH_LOCK *)(v14 + 1032);
ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)v14 + 129, 0i64);
v36[4] = (VOID *)((unsigned __int64)v194[6] >> 12);
v36[5] = (VOID *)((unsigned __int64)v194[3] >> 12);
*(_DWORD *)*v34 = v194[5];
PspUnlockJobMemoryLimitsExclusive((_EJOB *)v14, 0i64, 0i64);
if( (*(_DWORD *)*v34 & 0xFFFF7DFF) != 0 )
{
_InterlockedAdd64(&PspJobTimeLimitsRequest, 1ui64);
v14 = (char *)DeferredContext;
}
if( v37 )
{
v46 = (INT64 *)*v34;
if( *(_DWORD *)*v34 )
goto LABEL_104;
}
else
{
v46 = (INT64 *)*v34;
if( !*(_DWORD *)*v34 )
{
LABEL_104:
ExReleaseResourceLite(Resource);
ExAcquirePushLockSharedEx(PushLock, 0i64);
v47 = *((_QWORD *)v14 + 167);
v14 = (char *)DeferredContext;
JobMemoryUsageNotificationViolations = PspGetJobMemoryUsageNotificationViolations(
(_EJOB *)DeferredContext,
*((_QWORD *)DeferredContext + 122),
*((_QWORD *)DeferredContext + 122) + v47,
0x8200ui64);
PspUnlockJobMemoryLimitsShared((_EJOB *)v14, 0i64);
if( JobMemoryUsageNotificationViolations )
{
PspScheduleEnforcementWorker(*((_EJOB **)v14 + 135));
v14 = (char *)DeferredContext;
}
goto LABEL_34;
}
}
LODWORD(Object) = 5;
PspEnumJobsAndProcessesInJobHierarchy(
(_EJOB *)v14,
(INT64 *)PspSetJobNotificationCountCallback,
0i64,
0i64,
v46,
(_EJOB *)Object,
HandleInformation,
v137,
AccessMode,
DeferredContext,
Context,
Flags);
goto LABEL_104;
}
if( (int)v5 > 40 )
{
if( (_DWORD)v5 == 41 )
{
v180 = *(_DWORD *)v9;
v14 = (char *)DeferredContext;
if( !PspJobIsAppSilo((INT64)DeferredContext) || (_DWORD)v131 != 2 )
goto LABEL_426;
v93 = (_ERESOURCE *)(v14 + 56);
ExAcquireResourceExclusiveLite((UINT64)(v14 + 56), 1, v131);
if( *((_DWORD *)v14 + 306) )
{
v13 = -1073740529;
}
else
{
v132 = _interlockedbittestandset((volatile signed __int32 *)v14 + 330, 0x1Du);
v14 = (char *)DeferredContext;
if( v132 )
{
v13 = 255;
}
else
{
PspBeginSiloTeardown((INT64)DeferredContext);
v13 = 0;
}
}
goto LABEL_477;
}
if( (_DWORD)v5 == 42 )
{
v71 = 0;
v191[0] = *(_OWORD *)v9;
v191[1] = *((_OWORD *)v9 + 1);
v191[2] = *((_OWORD *)v9 + 2);
v191[3] = *((_OWORD *)v9 + 3);
*(_QWORD *)&v191[4] = *((_QWORD *)v9 + 8);
if( (v191[0] & 0xFFFFFFFC) != 0 || (v191[0] & 3) == 0 )
{
v13 = -1073741811;
v14 = (char *)DeferredContext;
}
else
{
v71 = 8;
v72 = CurrentThread;
v14 = (char *)DeferredContext;
PspLockRootJobExclusive((_EJOB *)DeferredContext, CurrentThread, &RootJob);
PspLockJobConditionally((_EJOB *)v14, &RootJob);
v13 = PspSetJobIoAttribution((_EJOB *)v14, v191[0] & 1, 1u, 1ui64);
if( v13 >= 0 )
{
PspUnlockJobConditionally((_EJOB *)v14, &RootJob);
PspUnlockJob(RootJob, v72);
v71 = 0;
}
}
if( (unsigned __int8)v71 < 8u )
goto LABEL_35;
PspUnlockJobConditionally((_EJOB *)v14, &RootJob);
v129 = CurrentThread;
v130 = RootJob;
goto LABEL_245;
}
if( (_DWORD)v5 != 43 )
{
if( (_DWORD)v5 != 44 )
{
if( (_DWORD)v5 != 45 )
{
if( (_DWORD)v5 == 46 )
{
v170 = *(_QWORD *)v9;
v14 = (char *)DeferredContext;
v19 = PspSetEnergyTrackingStateJobTree(DeferredContext, (INT64)&v170);
goto LABEL_63;
}
if( (_DWORD)v5 != 47 )
goto LABEL_455;
v152 = *(_BYTE *)v9;
if( v152 != 1 )
goto LABEL_380;
v124 = SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, (INT8)AccessMode);
v14 = (char *)DeferredContext;
if( v124 )
{
if( (*((_DWORD *)DeferredContext + 330) & 0x40000000) != 0 )
{
v13 = PspSetJobSiloThreadImpersonationPolicy((INT64)DeferredContext, 2i64) == 0 ? 0xC0000022 : 0;
goto LABEL_35;
}
goto LABEL_426;
}
LABEL_424:
v13 = -1073741727;
goto LABEL_35;
}
v14 = (char *)DeferredContext;
if( (*((_DWORD *)DeferredContext + 330) & 0x40000000) != 0 )
{
v171 = 0i64;
*(_OWORD *)a2 = *(_OWORD *)v9;
v125 = _mm_srli_si128(*(__m128i *)a2, 8).m128i_u64[0];
if( !v125 || (unsigned __int16)(a2[0] - 1) > 0x206u || (a2[0] & 1) != 0 )
{
v13 = -1073741811;
LODWORD(Flags) = -1073741811;
goto LABEL_35;
}
if( (_BYTE)AccessMode == 1 )
{
if( (v125 & 1) != 0 )
ExRaiseDatatypeMisalignment();
if( v125 + a2[0] > 0x7FFFFFFF0000i64 || v125 + a2[0] < v125 )
MEMORY[0x7FFFFFFF0000] = 0;
}
v126 = a2[0];
v127 = ExAllocatePoolWithTag(1ui64, a2[0], 1918071632i64);
v92 = (WCHAR *)v127;
v171 = v127;
if( !v127 )
{
v13 = -1073741670;
LODWORD(Flags) = -1073741670;
goto LABEL_35;
}
memmove(v127, (const VOID *)v125, v126);
v128 = v126 >> 1;
if( wcsnlen(v92, v128) == v128 )
{
*(_QWORD *)&a2[4] = v92;
v13 = PspAssignSiloSystemRootPath((_EJOB *)v14, a2);
}
else
{
v13 = -1073741811;
}
if( !v92 )
goto LABEL_35;
v122 = 1918071632;
goto LABEL_442;
}
LABEL_425:
v13 = -1073740535;
goto LABEL_35;
}
v14 = (char *)DeferredContext;
v93 = (_ERESOURCE *)((char *)DeferredContext + 56);
ExAcquireResourceExclusiveLite((UINT64)DeferredContext + 56, 1, v12);
if( *((int *)v14 + 330) >= 0 )
{
*(_OWORD *)(v14 + 1256) = *(_OWORD *)v9;
_InterlockedOr((volatile signed __int32 *)v14 + 330, 0x80000000);
ExReleaseResourceLite(v93);
v13 = 0;
LABEL_278:
v14 = (char *)DeferredContext;
goto LABEL_35;
}
v13 = -1073741791;
LABEL_477:
v52 = v93;
goto LABEL_118;
}
v190 = *(VOID **)v9;
v14 = (char *)DeferredContext;
Silo = PspSetJobMemoryPartition((_EJOB *)DeferredContext, (INT8)AccessMode, v190);
LABEL_283:
v13 = Silo;
goto LABEL_35;
}
switch( (_DWORD)v5 )
{
case 0x28:
v123 = SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, (INT8)AccessMode);
v14 = (char *)DeferredContext;
if( !v123 )
goto LABEL_424;
if( (*((_DWORD *)DeferredContext + 330) & 0x40000000) == 0 )
goto LABEL_425;
if( !PspSetJobSiloThreadImpersonationPolicy((INT64)DeferredContext, 4i64) )
goto LABEL_426;
v189 = *(VOID **)v9;
v151 = *((_BYTE *)v9 + 8);
Silo = PspConvertSiloToServerSilo((_EJOB *)v14, (INT8)AccessMode, v189);
goto LABEL_283;
case 0x19:
v14 = (char *)DeferredContext;
ExAcquireResourceExclusiveLite((UINT64)DeferredContext + 56, 1, v12);
KeResetEvent((_KEVENT *)v14);
LABEL_33:
ExReleaseResourceLite((PERESOURCE)(v14 + 56));
goto LABEL_34;
case 0x1B:
v14 = (char *)DeferredContext;
if( DeferredContext )
ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)DeferredContext + 129, 0i64);
*((_QWORD *)v14 + 76) = 0i64;
*((_QWORD *)v14 + 75) = 0i64;
PspUnlockJobMemoryLimitsExclusive((_EJOB *)v14, 0i64, 0i64);
goto LABEL_34;
}
if( (_DWORD)v5 != 31 )
{
switch( (_DWORD)v5 )
{
case ' ':
v14 = (char *)DeferredContext;
Silo = PspSetNetRateControl(v9, (unsigned int)v4, (_EJOB *)DeferredContext);
break;
case '!':
goto LABEL_65;
v14 = (char *)DeferredContext;
Silo = PspCreateSilo((_EJOB *)DeferredContext);
break;
case '%':
v121 = SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, (INT8)AccessMode);
v14 = (char *)DeferredContext;
if( !v121 )
goto LABEL_424;
if( (*((_DWORD *)DeferredContext + 330) & 0x40000000) == 0 )
goto LABEL_425;
if( !PspSetJobSiloThreadImpersonationPolicy((INT64)DeferredContext, 4i64) )
goto LABEL_426;
v175 = *(_DWORD *)v9;
Silo = ObCreateSiloRootDirectory((_EJOB *)v14, v175);
break;
default:
goto LABEL_455;
}
goto LABEL_283;
}
memmove(ControlInfo, v9, v4);
if( *(_QWORD *)&ControlInfo[6] )
{
v89 = ControlInfo[10];
v90 = PagedPool;
if( !LOWORD(ControlInfo[10]) )
goto LABEL_263;
if( (ControlInfo[6] & 1) != 0 )
ExRaiseDatatypeMisalignment();
if( *(_QWORD *)&ControlInfo[6] + (unsigned __int64)LOWORD(ControlInfo[10]) > 0x7FFFFFFF0000i64
|| *(_QWORD *)&ControlInfo[6] + (unsigned __int64)LOWORD(ControlInfo[10]) < *(_QWORD *)&ControlInfo[6] )
{
MEMORY[0x7FFFFFFF0000] = 0;
v89 = ControlInfo[10];
}
if( !v89 || (v89 & 1) != 0 )
{
LABEL_263:
v13 = -1073741811;
LODWORD(Flags) = -1073741811;
v14 = (char *)DeferredContext;
goto LABEL_274;
}
v166 = PagedPool;
if( (_BYTE)AccessMode == 1 )
v90 = 9;
v166 = v90;
P[1] = ExAllocatePoolWithQuotaTag(v90, v89 + 2i64, 0x624A7350ui64);
if( !P[1] )
{
v13 = -1073741801;
LODWORD(Flags) = -1073741801;
v14 = (char *)DeferredContext;
LABEL_274:
v92 = (WCHAR *)P[1];
if( !P[1] )
goto LABEL_35;
v122 = 0;
LABEL_442:
ExFreePoolWithTag(v92, v122);
goto LABEL_35;
}
v91 = P[1];
memmove(P[1], *(const VOID **)&ControlInfo[6], LOWORD(ControlInfo[10]));
v91[(unsigned __int64)LOWORD(ControlInfo[10]) >> 1] = 0;
*(_QWORD *)&ControlInfo[6] = v91;
}
if( (ControlInfo[9] & 0xFFFFFFF0) != 0 )
{
v13 = -1073741811;
}
else
{
if( !*(_QWORD *)&ControlInfo[20] && !*(_QWORD *)&ControlInfo[14] && !*(_QWORD *)&ControlInfo[4]
|| PspIsContextAdmin() )
{
v14 = (char *)DeferredContext;
v13 = PspSetJobIoRateControl(DeferredContext, ControlInfo);
goto LABEL_274;
}
v13 = -1073741790;
}
v14 = (char *)DeferredContext;
goto LABEL_274;
}
return result;
}Referenced by:
No references.