PspRemoveProcessFromJobChain

VOID __fastcall PspRemoveProcessFromJobChain(_EPROCESS *Process, INT64 a2, CHAR a3, UINT64 a4){
  char v4; 
  unsigned int v5; 
  bool v6; 
  CHAR v7; 
  _ETHREAD *CurrentThread; 
  bool v10; 
  int v11; 
  _EJOB *v12; 
  _QWORD *v13; 
  char v14; 
  _EJOB *RootJob; 
  _EJOB *ImmediateJob; 
  _ETHREAD *v17; 
  _EPROCESS_VALUES Values; 

  v4 = 0;
  v5 = a4;
  v6 = (Process->Flags3 & 0x1000) == 0;
  v7 = a3;
  ImmediateJob = 0i64;
  RootJob = 0i64;
  if( v6 || (a3 & 1) != 0 )
  {
    memset(&Values, 0i64, sizeof(Values));
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    v17 = CurrentThread;
    v10 = !_interlockedbittestandset((volatile signed __int32 *)&Process->1120, 0);
    v14 = 0;
    if( (v7 & 2) != 0 && (Process->Flags & 0x4000000) != 0 && (Process->Flags3 & 0x40) == 0 )
    {
      PsTerminateProcess((ULONG_PTR)Process, v5);
      v14 = 1;
    }
    v11 = 1;
    PspLockRootJobFromProcess(Process, CurrentThread, &ImmediateJob, &RootJob);
    if( (v7 & 4) != 0 && !_interlockedbittestandset((volatile signed __int32 *)&Process->1120, 1u) )
    {
      _InterlockedAnd((volatile signed __int32 *)&Process->1120, 0xFFFFFFDF);
      PsQueryStatisticsProcess(Process, &Values);
      v4 = 1;
    }
    v12 = ImmediateJob;
    if( ImmediateJob )
    {
      do
      {
        PspLockJobConditionally(v12, &RootJob);
        if( v10 )
        {
          --*((_DWORD *)v12 + 54);
          if( (Process->Flags3 & 0x20) != 0 )
            --*((_DWORD *)v12 + 307);
        }
        if( (v7 & 8) != 0 && v10 )
          ++*((_DWORD *)v12 + 55);
        if( a2
          && (!*(_QWORD *)a2 || *(_EJOB **)a2 == v12)
          && *((_QWORD *)v12 + 57)
          && ((1 << *(_QWORD *)(a2 + 8)) & *((_DWORD *)v12 + 219)) != 0 )
        {
          PspSendJobNotification(v12, *(_QWORD *)(a2 + 8), *(VOID **)(a2 + 16), 0);
        }
        if( v4 )
        {
          PspFoldProcessAccountingIntoJob(v12, Process, &Values);
          if( v12 == Process->Job && *((_DWORD *)v12 + 308) != PspEnforcementSequenceNumber )
            v11 = 0;
          if( v11 == 1 )
          {
            v13 = (_QWORD *)((char *)v12 + 1120);
            if( (char *)v12 + 1120 < (char *)v12 + 1224 )
            {
              while( !*v13 )
              {
                if( ++v13 >= (_QWORD *)v12 + 153 )
                  goto LABEL_11;
              }
              PspSubtractAccountingValues((_EPROCESS_VALUES *)((char *)v12 + 1120), &Values);
              v11 = 2;
            }
          }
        }
LABEL_11:
        PspUnlockJobConditionally(v12, &RootJob);
        v12 = (_EJOB *)*((_QWORD *)v12 + 134);
      }
      while( v12 );
      v12 = ImmediateJob;
      CurrentThread = v17;
      v7 = a3;
    }
    PspLockJobConditionally(v12, &RootJob);
    if( (v7 & 1) != 0 )
    {
      PspUnlinkJobProcess(v12, Process);
      PspUnlockJobConditionally(v12, &RootJob);
      PspUnlockJob(RootJob, CurrentThread);
    }
    else
    {
      if( v10 && (Process->Flags2 & 4) != 0 && !v14 )
        PspRequestProcessExecutionState((INT64)Process, 0i64, 0);
      PspUnlockJobConditionally(v12, &RootJob);
      PspUnlockJob(RootJob, CurrentThread);
      --CurrentThread->Tcb.KernelApcDisable;
      PspChangeProcessExecutionState(Process);
      KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
    }
  }
}

Referenced by: