PspApplyWorkingSetLimitsToProcess

NTSTATUS __stdcall PspApplyWorkingSetLimitsToProcess(_EPROCESS *Process){
  _ETHREAD *CurrentThread; 
  _EJOB *volatile Job; 
  int v4; 
  INT64 v5; 
  unsigned int v6; 
  _PEB *Peb; 
  volatile signed __int32 *v8; 
  _EWOW64PROCESS *WoW64Process; 
  UINT64 WorkingSetMinimumInBytes; 
  UINT64 WorkingSetMaximumInBytes; 
  _KAPC_STATE ApcState; 

  memset(&ApcState, 0, sizeof(ApcState));
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  Job = Process->Job;
  v4 = 0;
  KiStackAttachProcess(Process, 0i64, &ApcState);
  --CurrentThread->Tcb.SpecialApcDisable;
  ExAcquireResourceExclusiveLite((UINT64)Job + 56, 1, v5);
  WorkingSetMinimumInBytes = *((_QWORD *)Job + 99);
  WorkingSetMaximumInBytes = *((_QWORD *)Job + 100);
  v6 = ((*((_DWORD *)Job + 212) & 1) == 0) + 1;
  ExAcquirePushLockExclusiveEx(&stru_140C130B0, 0i64);
  _InterlockedOr((volatile signed __int32 *)Job + 330, 0x100u);
  ExReleaseResourceLite((PERESOURCE)((char *)Job + 56));
  if( v6 == 2 || (v4 = MmAdjustWorkingSetSize(WorkingSetMinimumInBytes, WorkingSetMaximumInBytes, 0i64, 1u), v4 >= 0) )
  {
    MmEnforceWorkingSetLimit(Process, v6);
    _InterlockedAnd((volatile signed __int32 *)Job + 330, 0xFFFFFEFF);
    if( (_InterlockedExchangeAdd64(&stru_140C130B0._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(&stru_140C130B0);
    KeAbPostRelease(&stru_140C130B0);
    KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
    Peb = Process->Peb;
    if( Peb )
    {
      if( (Process->Flags & 8) != 0 )
      {
        v4 = 0;
      }
      else if( ExAcquireRundownProtection(&Process->RundownProtect) )
      {
        v8 = 0i64;
        WoW64Process = Process->WoW64Process;
        if( WoW64Process )
          v8 = (volatile signed __int32 *)WoW64Process->Peb;
        _interlockedbittestandset((volatile signed __int32 *)&Peb->80, 0);
        if( v8 )
          _interlockedbittestandset(v8 + 10, 0);
        ExReleaseRundownProtection(&Process->RundownProtect);
      }
      else
      {
        v4 = -1073741558;
      }
    }
  }
  else
  {
    _InterlockedAnd((volatile signed __int32 *)Job + 330, 0xFFFFFEFF);
    if( (_InterlockedExchangeAdd64(&stru_140C130B0._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(&stru_140C130B0);
    KeAbPostRelease(&stru_140C130B0);
    KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
  }
  KiUnstackDetachProcess(&ApcState, 0i64);
  return v4;
}

Referenced by: