PspRemoveProcessFromJobChain

void __fastcall PspRemoveProcessFromJobChain(ULONG_PTR BugCheckParameter1, _QWORD *a2, char a3, unsigned int a4){
  char v4; 
  bool v6; 
  char v7; 
  _ETHREAD *CurrentThread; 
  bool v10; 
  int v11; 
  _EJOB *v12; 
  _EPROCESS_VALUES *p_Accounting; 
  char v14; 
  _EJOB *RootJob; 
  _EJOB *ImmediateJob; 
  _ETHREAD *v17; 
  __int64 result[20]; 
  v4 = 0;
  v6 = (*(_DWORD *)(BugCheckParameter1 + 2172) & 0x1000) == 0;
  v7 = a3;
  ImmediateJob = 0i64;
  RootJob = 0i64;
  if( v6 || (a3 & 1) != 0 )
  {
    memset((INT64)result, 0i64);
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    v17 = CurrentThread;
    v10 = !_interlockedbittestandset((volatile signed __int32 *)(BugCheckParameter1 + 1120), 0);
    v14 = 0;
    if( (v7 & 2) != 0
      && (*(_DWORD *)(BugCheckParameter1 + 1124) & 0x4000000) != 0
      && (*(_BYTE *)(BugCheckParameter1 + 2172) & 0x40) == 0 )
    {
      PsTerminateProcess(BugCheckParameter1, a4);
      v14 = 1;
    }
    v11 = 1;
    PspLockRootJobFromProcess((_EPROCESS *)BugCheckParameter1, CurrentThread, &ImmediateJob, &RootJob);
    if( (v7 & 4) != 0 && !_interlockedbittestandset((volatile signed __int32 *)(BugCheckParameter1 + 1120), 1u) )
    {
      _InterlockedAnd((volatile signed __int32 *)(BugCheckParameter1 + 1120), 0xFFFFFFDF);
      PsQueryStatisticsProcess((_EPROCESS *)BugCheckParameter1, (_EPROCESS_VALUES *)result);
      v4 = 1;
    }
    v12 = ImmediateJob;
    if( ImmediateJob )
    {
      do
      {
        PspLockJobConditionally(v12, &RootJob);
        if( v10 )
        {
          --v12->ActiveProcesses;
          if( (*(_DWORD *)(BugCheckParameter1 + 2172) & 0x20) != 0 )
            --v12->ActiveAuxiliaryProcessCount;
        }
        if( (v7 & 8) != 0 && v10 )
          ++v12->TotalTerminatedProcesses;
        if( a2 && (!*a2 || (_EJOB *)*a2 == v12) && v12->CompletionPort && ((1 << a2[1]) & v12->CompletionFilter) != 0 )
          PspSendJobNotification(v12, a2[1], (PVOID)a2[2], 0);
        if( v4 )
        {
          PspFoldProcessAccountingIntoJob((INT64)v12, BugCheckParameter1, result);
          if( v12 == *(_EJOB **)(BugCheckParameter1 + 1296) && v12->SequenceNumber != PspEnforcementSequenceNumber )
            v11 = 0;
          if( v11 == 1 )
          {
            p_Accounting = &v12->Accounting;
            if( &v12->Accounting < (_EPROCESS_VALUES *)&v12->ShadowActiveProcessCount )
            {
              while( !p_Accounting->KernelTime )
              {
                p_Accounting = (_EPROCESS_VALUES *)((char *)p_Accounting + 8);
                if( p_Accounting >= (_EPROCESS_VALUES *)&v12->ShadowActiveProcessCount )
                  goto LABEL_11;
              }
              PspSubtractAccountingValues(&v12->Accounting, (_EPROCESS_VALUES *)result);
              v11 = 2;
            }
          }
        }
LABEL_11:
        PspUnlockJobConditionally(v12, &RootJob);
        v12 = v12->ParentJob;
      }
      while( v12 );
      v12 = ImmediateJob;
      CurrentThread = v17;
      v7 = a3;
    }
    PspLockJobConditionally(v12, &RootJob);
    if( (v7 & 1) != 0 )
    {
      PspUnlinkJobProcess((__int64)v12, BugCheckParameter1);
      PspUnlockJobConditionally(v12, &RootJob);
      PspUnlockJob((__int64)RootJob, (__int64)CurrentThread);
    }
    else
    {
      if( v10 && (*(_DWORD *)(BugCheckParameter1 + 1120) & 4) != 0 && !v14 )
        PspRequestProcessExecutionState(BugCheckParameter1, 0i64, 0);
      PspUnlockJobConditionally(v12, &RootJob);
      PspUnlockJob((__int64)RootJob, (__int64)CurrentThread);
      --*((_WORD *)CurrentThread + 242);
      PspChangeProcessExecutionState(BugCheckParameter1);
      KeLeaveCriticalRegionThread((__int64)CurrentThread);
    }
  }
}

Referenced by: