PspSetJobIoAttribution

NTSTATUS __stdcall PspSetJobIoAttribution(_EJOB *Job, UINT8 Enable, UINT8 UserReference, UINT64 NumberOfReferences){
  char v4; 
  int v5; 
  unsigned int v9; 
  unsigned int v10; 
  _EPROCESS *v11; 
  _EPROCESS *v12; 
  NTSTATUS v13; 
  const _EVENT_DESCRIPTOR *v14; 
  REGHANDLE v15; 
  unsigned int v17; 
  int v18; 
  unsigned int v19; 
  _EJOB *v20; 
  VOID *v21; 
  INT64 *v22; 
  _EPROCESS *v23; 
  INT64 JobPostCallback[2]; 
  UINT64 v25; 
  _EVENT_DATA_DESCRIPTOR UserData; 
  _EPROCESS **v27; 
  int v28; 
  int v29; 
  INT64 **v30; 
  int v31; 
  int v32; 

  v4 = 0;
  v25 = 0i64;
  v5 = NumberOfReferences;
  *(_OWORD *)JobPostCallback = 0i64;
  if( !Enable )
  {
    if( !UserReference )
      goto LABEL_22;
    v17 = *((_DWORD *)Job + 336);
    if( v17 < (unsigned int)NumberOfReferences )
    {
      v12 = 0i64;
      v13 = -1073741811;
      goto LABEL_14;
    }
    v18 = v17 - NumberOfReferences;
    *((_DWORD *)Job + 336) = v18;
    if( v18 )
    {
      v12 = (_EPROCESS *)*((_QWORD *)Job + 169);
    }
    else
    {
LABEL_22:
      v19 = *((_DWORD *)Job + 337);
      v12 = (_EPROCESS *)*((_QWORD *)Job + 169);
      if( v19 > (unsigned int)NumberOfReferences )
      {
        *((_DWORD *)Job + 337) = v19 - NumberOfReferences;
      }
      else
      {
        PspRemoveIoAttribution(Job);
        *((_DWORD *)Job + 337) = 0;
      }
    }
    goto LABEL_11;
  }
  if( PspIsSetJobIoAttribution(Job, Enable) )
  {
    v12 = 0i64;
    v13 = -1073741637;
    goto LABEL_14;
  }
  if( UserReference )
  {
    v9 = *((_DWORD *)Job + 336);
    if( v9 + v5 < v9 )
    {
      v12 = 0i64;
      v13 = -1073741670;
      goto LABEL_14;
    }
    if( v9 )
    {
      *((_DWORD *)Job + 336) = v9 + v5;
LABEL_26:
      v12 = (_EPROCESS *)*((_QWORD *)Job + 169);
      goto LABEL_11;
    }
    *((_DWORD *)Job + 336) = v5;
    v4 = 1;
  }
  v10 = *((_DWORD *)Job + 337);
  if( v10 + v5 < v10 )
  {
    v12 = 0i64;
    v13 = -1073741670;
    goto LABEL_12;
  }
  if( v10 )
  {
    *((_DWORD *)Job + 337) = v10 + v5;
    goto LABEL_26;
  }
  v11 = (_EPROCESS *)IoDiskIoAttributionAllocate(Job, 0i64);
  v12 = v11;
  if( v11 )
  {
    IoStartDiskIoAttributionForContext(v11);
    LODWORD(v20) = 5;
    LOBYTE(v25) = 1;
    PspEnumJobsAndProcessesInJobHierarchy(
      Job,
      (INT64 *)PspSetJobIoAttributionJobPreCallback,
      0i64,
      PspSetJobIoAttributionProcessCallback,
      JobPostCallback,
      v20,
      v21,
      v22,
      v23,
      v12,
      Job,
      v25);
    *((_DWORD *)Job + 337) = v5;
    *((_QWORD *)Job + 169) = v12;
LABEL_11:
    v4 = 0;
    v13 = 0;
    goto LABEL_12;
  }
  v12 = 0i64;
  v13 = -1073741801;
LABEL_12:
  if( v4 )
    *((_DWORD *)Job + 336) -= v5;
LABEL_14:
  LODWORD(v21) = *((_DWORD *)Job + 309);
  v14 = (const _EVENT_DESCRIPTOR *)PsDiskIoAttributionStart;
  v23 = v12;
  v15 = *(&ExBootDevicesRemovedEvent + 245);
  if( !Enable )
    v14 = &PsDiskIoAttributionStop;
  LODWORD(v22) = v13;
  if( EtwEventEnabled(*(&ExBootDevicesRemovedEvent + 245), v14) )
  {
    UserData.Reserved = 0;
    v29 = 0;
    v32 = 0;
    UserData.Ptr = (unsigned __int64)&v21;
    UserData.Size = 4;
    v27 = &v23;
    v31 = 4;
    v30 = &v22;
    v28 = 8;
    EtwWrite(v15, v14, 0, 3u, &UserData);
  }
  return v13;
}

Referenced by: