PspApplyWorkingSetLimits

VOID __stdcall PspApplyWorkingSetLimits(_EJOB *Job, _LIST_ENTRY *WorkingSetChangeList){
  __int64 v3; 
  __int64 v4; 
  _QWORD *v5; 
  VOID **v6; 
  __int64 v7; 
  PVOID P; 
  PVOID *p_P; 
  _KAPC_STATE ApcState; 

  p_P = &P;
  P = &P;
  memset(&ApcState, 0, sizeof(ApcState));
  while( 1 )
  {
    v3 = PspWorkingSetChangeHead;
    if( (__int64 *)PspWorkingSetChangeHead == &PspWorkingSetChangeHead )
      break;
    if( *(__int64 **)(PspWorkingSetChangeHead + 8) != &PspWorkingSetChangeHead
      || (v4 = *(_QWORD *)PspWorkingSetChangeHead,
          *(_QWORD *)(*(_QWORD *)PspWorkingSetChangeHead + 8i64) != PspWorkingSetChangeHead)
      || (PspWorkingSetChangeHead = *(_QWORD *)PspWorkingSetChangeHead,
          *(_QWORD *)(v4 + 8) = &PspWorkingSetChangeHead,
          v5 = p_P,
          *p_P != &P) )
    {
LABEL_12:
      __fastfail(3u);
    }
    *(_QWORD *)(v3 + 8) = p_P;
    *(_QWORD *)v3 = &P;
    *v5 = v3;
    p_P = (PVOID *)v3;
    KeStackAttachProcess(*(PRKPROCESS *)(v3 + 16), &ApcState);
    MmAdjustWorkingSetSize(*(_QWORD *)(v3 + 24), *(_QWORD *)(v3 + 32), 0i64, 1u);
    MmEnforceWorkingSetLimit(*(_EPROCESS **)(v3 + 16), 1ui64);
    KeUnstackDetachProcess(&ApcState);
  }
  _InterlockedAnd((volatile signed __int32 *)Job + 330, 0xFFFFFEFF);
  PspUnlockWorkingSetChangeExclusiveUnsafe();
  while( 1 )
  {
    v6 = (VOID **)P;
    if( P == &P )
      break;
    if( *((PVOID **)P + 1) != &P )
      goto LABEL_12;
    v7 = *(_QWORD *)P;
    if( *(PVOID *)(*(_QWORD *)P + 8i64) != P )
      goto LABEL_12;
    P = *(PVOID *)P;
    *(_QWORD *)(v7 + 8) = &P;
    ObfDereferenceObjectWithTag(v6[2], 0x624A7350ui64);
    ExFreePoolWithTag(v6, 0x72437350u);
  }
}

Referenced by: