PspGetJobAssignmentDisposition

VOID __stdcall PspGetJobAssignmentDisposition(){
  _EX_RUNDOWN_REF *v0; 
  INT64 v1; 
  _DWORD *v2; 
  _DWORD *v3; 
  _EPROCESS *v4; 
  INT64 v5; 
  _EX_RUNDOWN_REF *v6; 
  INT64 v7; 
  INT64 v8; 
  __int64 v9; 
  __int64 v10; 
  _DWORD *v11; 

  v3 = v2;
  v4 = (_EPROCESS *)v0;
  v5 = v1;
  if( v0 )
  {
    v6 = v0 + 139;
    if( ExAcquireRundownProtection(v0 + 139) )
    {
      if( (v4->Flags & 8) == 0 )
      {
        if( v4->Job )
        {
          if( PspIsProcessInJob(v4, (_EJOB *)v5) == 292 )
          {
            *v3 = 2;
          }
          else
          {
            v7 = v5;
            if( v5 )
            {
              while( (_EJOB *volatile)v7 != v4->Job )
              {
                v7 = *(_QWORD *)(v7 + 1072);
                if( !v7 )
                  goto LABEL_11;
              }
              *v3 = 3;
            }
            else
            {
LABEL_11:
              if( PsIsJobParentImmutable(v5) || *(_DWORD *)(v5 + 212) )
              {
                if( PspIsJobMovable(v8) )
                  *v3 = 5;
              }
              else
              {
                *v3 = 4;
              }
            }
          }
        }
        else
        {
          *v3 = 1;
        }
      }
      ExReleaseRundownProtection(v6);
    }
  }
  else if( !PsIsJobParentImmutable(v1) && !*(_DWORD *)(v9 + 212) && *(_QWORD *)(v9 + 1560) != -1i64 )
  {
    *v11 = (v10 != 0) + 6;
  }
}

Referenced by: