PspFreezeJobTree

INT64 __fastcall PspFreezeJobTree(INT64 a1, INT64 rdx0){
  int v4; 
  int v5; 
  __int128 v7; 
  __int128 v8; 
  __int128 v9; 
  int v10; 
  int v11; 
  __int64 v12; 
  _DWORD a2[2]; 
  __int64 v14[2]; 
  INT64 v15[2]; 
  INT64 result[2]; 
  __int128 v17; 
  __int128 v18; 
  __int128 v19; 
  v14[1] = 0i64;
  *(_QWORD *)a2 = 0i64;
  *(_OWORD *)v15 = 0i64;
  memset((INT64)result, 0i64);
  v14[0] = rdx0;
  v4 = 0;
  LODWORD(v12) = 0;
  ExAcquireResourceExclusiveLite((ERESOURCE *)(a1 + 56), 1u);
  v5 = *(_DWORD *)rdx0;
  if( (*(_DWORD *)rdx0 & 1) != 0 )
  {
    v10 = *(_DWORD *)(a1 + 1320) & 0x200;
    if( *(_BYTE *)(rdx0 + 4) )
    {
      if( v10 )
        goto LABEL_35;
    }
    else if( !v10 )
    {
      goto LABEL_35;
    }
  }
  if( (v5 & 4) != 0 )
  {
    v11 = *(_DWORD *)(a1 + 1320) & 0x80000;
    if( *(_BYTE *)(rdx0 + 5) )
    {
      if( !v11 )
        goto LABEL_3;
    }
    else if( v11 )
    {
      goto LABEL_3;
    }
LABEL_35:
    LODWORD(v12) = -1073741811;
    ExReleaseResourceLite((PERESOURCE)(a1 + 56));
    return(unsigned int)v12;
  }
LABEL_3:
  if( (v5 & 2) != 0 )
  {
    if( (*(_DWORD *)(a1 + 1320) & 0x800) != 0 )
    {
      PspComputeReportWakeFilter((_DWORD *)a1, (INT64)a2, (_QWORD *)(rdx0 + 8), 1);
      if( *(_QWORD *)a2 )
      {
        v7 = *(_OWORD *)(a1 + 896);
        *(_OWORD *)result = *(_OWORD *)(a1 + 880);
        v8 = *(_OWORD *)(a1 + 912);
        v17 = v7;
        v9 = *(_OWORD *)(a1 + 928);
        v18 = v8;
        v19 = v9;
      }
    }
    *(_QWORD *)(a1 + 952) = *(_QWORD *)(rdx0 + 8);
    v5 = *(_DWORD *)rdx0;
  }
  if( (v5 & 1) != 0 )
  {
    if( *(_BYTE *)(rdx0 + 4) )
      _interlockedbittestandset((volatile signed __int32 *)(a1 + 1320), 9u);
    else
      _interlockedbittestandreset((volatile signed __int32 *)(a1 + 1320), 9u);
    v5 = *(_DWORD *)rdx0;
    v4 = 5;
  }
  if( (v5 & 4) != 0 )
  {
    if( *(_BYTE *)(rdx0 + 5) )
      _interlockedbittestandset((volatile signed __int32 *)(a1 + 1320), 0x13u);
    else
      _interlockedbittestandreset((volatile signed __int32 *)(a1 + 1320), 0x13u);
    v4 = 5;
  }
  if( v4 )
    PspEnumJobsAndProcessesInJobHierarchy(
      (PVOID)a1,
      (__int64(__fastcall *)(__int64, __int64))PspSetJobFreezeCountCallback,
      0i64,
      (__int64(__fastcall *)(_QWORD *, __int64))PspSetProcessFreezeStateCallback,
      (__int64)v14,
      v4);
  ExReleaseResourceLite((PERESOURCE)(a1 + 56));
  if( v4 )
  {
    PspEnumJobsAndProcessesInJobHierarchy(
      (PVOID)a1,
      0i64,
      (unsigned int(__fastcall *)(__int64, __int64))PspExecuteJobFreezeThawCallback,
      0i64,
      (__int64)&v12,
      0);
    if( (int)v12 < 0 )
    {
      *(_DWORD *)rdx0 &= ~4u;
      LODWORD(v15[0]) = 4;
      BYTE5(v15[0]) = 0;
      PspFreezeJobTree(a1, (INT64)v15);
      LODWORD(v12) = 262;
    }
  }
  PspDispatchWakeNotification((VOID *)a1, a2, (INT64)result);
  return(unsigned int)v12;
}

Referenced by:

NtSetInformationJobObject
PspFreezeJobTree