PspImplicitAssignProcessToJob

NTSTATUS __stdcall PspImplicitAssignProcessToJob(PVOID BaseJob, PVOID Process, UINT64 CreateFlags){
  _ETHREAD *CurrentThread; 
  INT16 v4; 
  _EJOB *v7; 
  _EJOB *v8; 
  int v9; 
  int v11; 
  _EJOB *v12; 
  _EPROCESS *v13; 
  volatile signed __int32 *v14; 
  __int64 v15; 
  int v16; 
  int v17; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v4 = CreateFlags;
  PspLockJobChain((_EJOB *)BaseJob, CurrentThread);
  if( (v4 & 0x400) != 0 )
  {
    LODWORD(v7) = PsGetEffectiveServerSilo((INT64)BaseJob);
    v8 = v7;
  }
  else
  {
    v8 = (_EJOB *)BaseJob;
    if( BaseJob )
    {
      do
      {
        v11 = *((_DWORD *)v8 + 64);
        if( (v11 & 0x1000) == 0 )
        {
          if( (v4 & 1) == 0 )
            goto LABEL_3;
          if( (v11 & 0x800) == 0 )
            break;
        }
        v8 = (_EJOB *)*((_QWORD *)v8 + 134);
      }
      while( v8 );
    }
    if( (v4 & 1) != 0 && v8 == BaseJob && (*((_DWORD *)v8 + 330) & 0x40000000) == 0 )
    {
      v9 = -1073741790;
      goto LABEL_5;
    }
  }
LABEL_3:
  if( !v8 )
  {
    v9 = 0;
LABEL_5:
    PspUnlockJobChain((_EJOB *)BaseJob, CurrentThread);
    return v9;
  }
  if( !PspValidateJobAssignmentMemoryPartition((INT64)v8, 0i64, (INT64)Process, 1i64) )
  {
    v9 = -1073741637;
    goto LABEL_5;
  }
  v9 = PspValidateJobChainLimits(v8, v12, v13, v4);
  if( v9 < 0 )
    goto LABEL_5;
  v9 = PspEstablishJobHierarchy(v8, (_EPROCESS *)Process, 0i64, 1i64);
  if( v9 < 0 )
    goto LABEL_5;
  PspIncrementJobChainProcessCounts(v8, 0i64, (INT64)Process, v4);
  PspApplyJobChainLimitsToProcess((__int64)v8, 0i64, (INT64)Process);
  if( (*((_DWORD *)v8 + 330) & 0x1000) != 0 )
  {
    v14 = (volatile signed __int32 *)((char *)Process + 2472);
    v15 = 7i64;
    do
    {
      _interlockedbittestandset(v14++, 0x1Fu);
      --v15;
    }
    while( v15 );
    _interlockedbittestandset((volatile signed __int32 *)Process + 627, 0x1Fu);
  }
  PspUnlockJobChain((_EJOB *)BaseJob, CurrentThread);
  v16 = PspApplyWorkingSetLimitsToProcess((_EPROCESS *)Process);
  if( v16 >= 0 )
  {
    MmAssignProcessToJob((_EPROCESS *)Process, 0i64);
    if( !v17 )
      return -1073741756;
  }
  return v16;
}

Referenced by: