NtSetInformationJobObject
INT64 __fastcall NtSetInformationJobObject(
VOID *JobHandle,
INT64 JobObjectInformationClass,
VOID *JobObjectInformation,
INT64 JobObjectInformationLength,
INT64 a5,
INT64 a6,
INT64 a7,
INT64 a8){
UINT64 v8;
__int64 v9;
unsigned int v11;
char v12;
UINT8 *v13;
ACCESS_MASK v14;
INT64 v15;
void *v16;
int v17;
char *v18;
int v19;
_WNF_STATE_NAME_LIFETIME v20;
void *v21;
void *v22;
void *v23;
void *v24;
_WNF_STATE_NAME *v25;
NTSTATUS v26;
int v27;
INT64 v28;
unsigned __int64 v29;
__int64 v30;
unsigned __int64 v31;
unsigned __int64 v32;
int v33;
INT64 j;
INT64 v35;
unsigned int v36;
int v37;
int v38;
int *v39;
int *v40;
int v41;
struct _ERESOURCE **v42;
struct _ERESOURCE *v43;
struct _ERESOURCE *v44;
int Flink;
INT64 k;
_DWORD *v47;
__int64 v48;
INT64 v49;
_DWORD *v50;
_DWORD *v51;
int v52;
bool v53;
struct _ERESOURCE *v54;
__int64 v55;
int JobMemoryUsageNotificationViolations;
UINT64 v57;
__int64 v58;
int v59;
struct _ERESOURCE *v60;
int v61;
_JOBOBJECTINFOCLASS v62;
INT8 v63;
int v64;
UINT16 v65;
UINT64 *v66;
__int32 v67;
unsigned int v68;
_DWORD *v69;
__int64 v70;
int *v71;
int v72;
char v73;
char v74;
char v75;
_LIST_ENTRY *v76;
char v77;
_ETHREAD *v78;
UINT8 v79;
int v80;
int v81;
CHAR *RateControl;
CHAR **v83;
UINT64 v84;
UINT8 v85;
UINT8 v86;
CHAR ***v87;
CHAR **v88;
_KSCHEDULING_GROUP_POLICY *v89;
struct _ERESOURCE *v90;
void *v91;
__int64 v92;
unsigned int v93;
unsigned int Value;
__int64 v95;
UINT64 v96;
char v97;
_DWORD *v98;
unsigned __int16 v99;
POOL_TYPE v100;
UINT8 *v101;
wchar_t *v102;
struct _ERESOURCE *v103;
int Silo;
unsigned int v105;
unsigned int v106;
unsigned int v107;
char v108;
int v109;
int v110;
char v111;
int v112;
__int64 v113;
struct _ERESOURCE *PoolWithTag;
UINT8 v115;
ULONG v116;
unsigned __int16 v117;
__int64 v118;
UINT64 v119;
UINT8 v120;
UINT8 v121;
char *v122;
char *i;
void *v124;
unsigned __int16 v125;
__m128i v126;
__int64 v127;
_SECURITY_IMPERSONATION_LEVEL *p_ImpersonationLevel;
UINT8 v129;
PERESOURCE v130;
__int64 *v131;
__int64 v132;
char v133;
ULONG v134;
char v135;
char v136;
UINT8 *v137;
UINT64 v138;
UINT8 *v139;
size_t v140;
_ETHREAD *v141;
_EJOB *v142;
int v143;
signed __int8 v144;
int v145[8];
ULONG Tag[2];
PVOID *Object;
POBJECT_HANDLE_INFORMATION HandleInformation;
KPROCESSOR_MODE AccessMode;
PVOID DeferredContext;
_JOBOBJECTINFOCLASS JobObjectInformationClassa;
int v152;
UINT8 Enable;
char v154[3];
int v155;
PVOID P;
ULONG_PTR BugCheckParameter2;
UINT16 v158;
_KSCHEDULING_GROUP_POLICY CpuRates;
_ETHREAD *Thread;
PERESOURCE Resource;
PERESOURCE v162;
UINT8 v163;
UINT8 v164;
UINT8 v165;
unsigned int v166;
int JobLimitInformationValidFlags;
unsigned int v168;
_EJOB *RootJob;
UINT64 v170;
_KSCHEDULING_GROUP *SchedulingGroups;
void *Src;
__int64 v173[2];
UINT64 ProcessorMask;
struct _SECURITY_SUBJECT_CONTEXT SubjectContext;
__int64 v176;
CHAR *JobObjectInformationa;
PSECURITY_SUBJECT_CONTEXT v178;
POOL_TYPE v179;
UINT8 dst[8];
PVOID v181;
__m128i Base;
INT64 v183;
UINT8 *v184;
UINT16 a2[8];
unsigned int v186;
int v187;
unsigned int v188;
HANDLE Handle[2];
PVOID v190[2];
__int128 v191;
__int128 v192;
int v193;
char *v194;
int v195;
int v196;
__int64 v197;
__m128i v198;
__int128 v199;
__int64 v200;
UINT64 v201;
PVOID v202;
__int64 v203;
INT64 v204[2];
__int128 v205;
__int128 v206;
__int128 v207;
__int64 v208;
INT64 v209[3];
UINT8 *v210;
int v211;
unsigned __int16 v212;
__int64 v213;
__int64 v214;
struct _PRIVILEGE_SET RequiredPrivileges;
INT64 v216;
unsigned __int64 v217;
__int64 v218;
unsigned __int64 v219;
int v220;
int v221;
int v222;
unsigned __int64 v223;
INT64 v224[2];
__m128i v225;
__m128i v226;
__m128i v227;
__int64 v228;
INT64 result;
__int64 v230;
_JOBOBJECTINFOCLASS v231;
unsigned __int64 v232;
unsigned __int64 v233;
int v234;
__int64 v235;
unsigned int v236;
unsigned int v237;
unsigned __int64 v238;
unsigned __int64 v239;
unsigned __int64 v240;
__m128i v241;
__m128i v242;
__m128i v243;
_KAFFINITY_EX Affinity;
INT64 v245[28];
INT64 v246;
__int64 v247;
__int64 v248;
unsigned __int64 v249;
_JOBOBJECTINFOCLASS v250;
int v251;
_OWORD v252[10];
__int64 v253;
int v254;
unsigned __int64 v255;
unsigned __int64 v256;
unsigned __int64 v257;
char v258;
v8 = (unsigned int)JobObjectInformationLength;
BugCheckParameter2 = (ULONG_PTR)JobObjectInformation;
v9 = (int)JobObjectInformationClass;
P = JobHandle;
JobObjectInformationClassa = (int)JobObjectInformationClass;
Src = JobObjectInformation;
memset((INT64)Affinity.Bitmap, 0i64);
*(_OWORD *)Handle = 0i64;
JobObjectInformationa = 0i64;
*(_QWORD *)dst = 0i64;
Enable = 0;
v183 = 0i64;
memset((INT64)&result, 0i64);
*(_OWORD *)v224 = 0i64;
Base = 0i64;
memset((INT64)v204, 0i64);
v181 = 0i64;
memset((INT64)v209, 0i64);
DeferredContext = 0i64;
LODWORD(v170) = 0;
memset((INT64)v245, 0i64);
v191 = 0i64;
v192 = 0i64;
memset(&SubjectContext, 0, sizeof(SubjectContext));
v176 = 0i64;
memset((INT64)&v216, 0i64);
v241 = 0i64;
v242 = 0i64;
v243 = 0i64;
v225 = 0i64;
v226 = 0i64;
v227 = 0i64;
v228 = 0i64;
CpuRates = 0i64;
v154[0] = 0;
memset(&RequiredPrivileges, 0, sizeof(RequiredPrivileges));
RootJob = 0i64;
*(_OWORD *)v173 = 0i64;
SchedulingGroups = 0i64;
v198 = 0i64;
v199 = 0i64;
v200 = 0i64;
*(_OWORD *)a2 = 0i64;
*(_OWORD *)v190 = 0i64;
if( (unsigned int)(v9 - 1) > 0x2E )
return 3221225475i64;
switch( (_DWORD)v9 )
{
case 9:
if( (_DWORD)v8 == 144 || (_DWORD)v8 == 152 )
goto LABEL_6;
return 3221225476i64;
case 0xC:
if( (_DWORD)v8 == 48 )
goto LABEL_6;
v53 = (_DWORD)v8 == 56;
LABEL_98:
if( v53 )
goto LABEL_6;
return 3221225476i64;
case 0x1F:
if( (_DWORD)v8 == 48 || (_DWORD)v8 == 96 )
goto LABEL_6;
v53 = (_DWORD)v8 == 144;
goto LABEL_98;
}
v11 = dword_1409860CC[v9];
if( (_DWORD)v8 != v11 && ((_DWORD)v9 != 11 && (_DWORD)v9 != 14 || (unsigned int)v8 < v11) )
return 3221225476i64;
LABEL_6:
Thread = (_ETHREAD *)KeGetCurrentThread();
v12 = *((_BYTE *)Thread + 562);
AccessMode = v12;
v154[1] = v12;
if( v12 )
{
v13 = (UINT8 *)Src;
if( (_DWORD)v8 )
{
if( ((dword_14098618C[v9] - 1) & (unsigned int)Src) != 0 )
ExRaiseDatatypeMisalignment();
if( (unsigned __int64)Src + v8 > 0x7FFFFFFF0000i64 || (char *)Src + v8 < Src )
MEMORY[0x7FFFFFFF0000] = 0;
}
v12 = AccessMode;
}
else
{
v13 = (UINT8 *)Src;
}
if( !JobHandle )
return 3221225480i64;
v14 = 16;
if( (_DWORD)v9 != 5 )
v14 = 2;
LODWORD(v15) = ObReferenceObjectByHandleWithTag(
JobHandle,
v14,
(POBJECT_TYPE)PsJobType,
v12,
0x79517350u,
&DeferredContext,
0i64);
if( (int)v15 >= 0 )
{
v17 = 0;
v152 = 0;
LOBYTE(v155) = 0;
--*((_WORD *)Thread + 243);
if( (int)v9 <= 24 )
{
if( (_DWORD)v9 == 24 )
{
v57 = *(_QWORD *)v13;
v201 = *(_QWORD *)v13;
v18 = (char *)DeferredContext;
ExAcquireResourceExclusiveLite((ERESOURCE *)((char *)DeferredContext + 56), 1u);
if( (*((_DWORD *)v18 + 330) & 0x20) != 0 )
{
v58 = *((_QWORD *)v18 + 126);
v59 = *(_DWORD *)(v58 + 40);
if( (v59 & 0x10) == 0 )
{
*(_DWORD *)(v58 + 40) = v59 | 0x10;
KeInitializeDpc((PRKDPC)(v58 + 48), PspJobCycleTimeNotificationDpcRoutine, v18);
}
KeSetSchedulingGroupCycleNotification((_KSCHEDULING_GROUP *)(v58 + 128), (_KDPC *)(v58 + 48), v57);
goto LABEL_116;
}
LABEL_376:
v17 = -1073741811;
goto LABEL_117;
}
if( (int)v9 > 12 )
{
if( (_DWORD)v9 != 14 )
{
if( (_DWORD)v9 != 15 )
{
if( (_DWORD)v9 != 16 )
{
if( (_DWORD)v9 == 18 )
{
*(_OWORD *)v224 = *(_OWORD *)v13;
if( LODWORD(v224[0]) && (v224[0] & 0xFFFFFFF8) == 0 )
{
v18 = (char *)DeferredContext;
v17 = PspFreezeJobTree((INT64)DeferredContext, (INT64)v224);
if( v17 >= 0 )
*(_DWORD *)v13 = v224[0];
goto LABEL_35;
}
goto LABEL_380;
}
if( (_DWORD)v9 != 21 )
{
if( (_DWORD)v9 != 22 )
{
if( (_DWORD)v9 == 23 )
{
if( *v13 != 1 )
{
v17 = -1073741811;
v152 = -1073741811;
v18 = (char *)DeferredContext;
goto LABEL_35;
}
v18 = (char *)DeferredContext;
PspEnumJobsAndProcessesInJobHierarchy(
DeferredContext,
0i64,
(unsigned int(__fastcall *)(__int64, __int64))PspEnableTimerVirtualization,
(__int64(__fastcall *)(_QWORD *, __int64))PspEnableProcessTimerVirtualization,
0i64,
0);
LABEL_34:
v17 = 0;
LABEL_35:
KiLeaveGuardedRegionUnsafe((__int64)Thread);
ObfDereferenceObjectWithTag(v18, 0x79517350ui64);
return(unsigned int)v17;
}
LABEL_455:
v17 = -1073741821;
goto LABEL_278;
}
Enable = *v13;
v18 = (char *)DeferredContext;
ExAcquireResourceExclusiveLite((ERESOURCE *)((char *)DeferredContext + 56), 1u);
if( (*((_DWORD *)v18 + 330) & 0x20) != 0 )
{
v92 = *((_QWORD *)v18 + 126);
v93 = *(_DWORD *)(v92 + 40);
if( (v93 & 0x40) == 0 )
{
if( (v93 & 1) != 0 || (v93 & 0x20) != 0 )
{
v17 = -1073741637;
goto LABEL_117;
}
if( ((v93 >> 3) & 1) != (Enable != 0) )
{
*(_DWORD *)(v92 + 40) = (Enable != 0 ? 8 : 0) | v93 & 0xFFFFFFF7;
KeSetSchedulingGroupRankBias((_KSCHEDULING_GROUP *)(*((_QWORD *)v18 + 126) + 128i64), Enable);
PspEnumProcessesInJobHierarchy(
v18,
(__int64(__fastcall *)(_QWORD *, __int64))PspSetProcessCacheIsolationCallback,
(__int64)&Enable,
1);
LABEL_116:
v17 = 0;
LABEL_117:
v60 = (struct _ERESOURCE *)(v18 + 56);
LABEL_118:
ExReleaseResourceLite(v60);
goto LABEL_35;
}
}
}
goto LABEL_376;
}
v163 = *v13;
v18 = (char *)DeferredContext;
v26 = PspSetBackgroundJobTree((_EJOB *)DeferredContext, v163);
LABEL_63:
v17 = v26;
if( v26 < 0 )
goto LABEL_35;
goto LABEL_34;
}
v187 = *(_DWORD *)v13;
v19 = v187;
v18 = (char *)DeferredContext;
if( (v187 & 0xFFFFC001) == 0 )
{
ExAcquireResourceExclusiveLite((ERESOURCE *)((char *)DeferredContext + 56), 1u);
if( v18 )
ExAcquirePushLockExclusiveEx((UINT64)(v18 + 1032), 0i64);
*((_DWORD *)v18 + 219) = v19;
PspUnlockJobMemoryLimitsExclusive((_EJOB *)v18, 0i64, 0i64);
goto LABEL_33;
}
LABEL_426:
v17 = -1073741811;
goto LABEL_35;
}
memmove(dst, v13, v8);
v79 = dst[0];
if( (*(_DWORD *)dst & 0xFFFFFFE0) == 0 )
{
v80 = *(_DWORD *)&dst[4];
CpuRates.Value = *(_DWORD *)&dst[4];
JobObjectInformationClassa = dst[0] & 1;
if( (dst[0] & 1) == 0 )
goto LABEL_178;
if( (dst[0] & 2) != 0 )
{
if( (dst[0] & 0x10) == 0 && (unsigned __int16)(*(_WORD *)&dst[4] - 1) <= 8u )
goto LABEL_178;
}
else if( (unsigned __int16)(*(_WORD *)&dst[4] - 1) <= 0x270Fu
&& ((dst[0] & 0x10) == 0
|| (dst[0] & 4) == 0 && *(_WORD *)&dst[6] >= *(_WORD *)&dst[4] && *(_WORD *)&dst[6] <= 0x2710u) )
{
LABEL_178:
v18 = (char *)DeferredContext;
PspLockJobChain((__int64)DeferredContext, (__int64)Thread, 0);
v81 = *((_DWORD *)v18 + 330);
if( JobObjectInformationClassa )
{
if( (v81 & 0x20) == 0 )
{
RateControl = PspAllocateRateControl(2i64);
v83 = (CHAR **)RateControl;
if( !RateControl )
{
v17 = -1073741670;
goto LABEL_204;
}
*((_QWORD *)v18 + 126) = RateControl;
LABEL_190:
v87 = (CHAR ***)(v18 + 1008);
*(_DWORD *)(*((_QWORD *)v18 + 126) + 40i64) = 0;
*(_DWORD *)(*((_QWORD *)v18 + 126) + 44i64) = v80;
if( JobObjectInformationClassa )
{
if( (v79 & 4) != 0 )
{
*((_DWORD *)*v87 + 10) |= 1u;
CpuRates.MaxRate = v80;
}
if( (v79 & 2) != 0 )
{
*((_DWORD *)*v87 + 10) |= 4u;
CpuRates.AllFlags = 0;
}
else
{
CpuRates.AllFlags = 1;
if( (v79 & 0x14) == 0 )
CpuRates.MaxRate = 10000;
}
if( (v79 & 8) != 0 )
*((_DWORD *)*v87 + 10) |= 2u;
if( (v79 & 0x10) != 0 )
*((_DWORD *)*v87 + 10) |= 0x20u;
v88 = *v87;
v89 = (_KSCHEDULING_GROUP_POLICY *)(*v87 + 16);
if( *v87 == v83 )
{
*v89 = CpuRates;
v17 = PspAddSchedulingGroupToJobChain(*((_EJOB **)v18 + 134), (_EJOB *)v18);
v152 = v17;
if( v17 < 0 )
{
if( *v87 )
{
PspFreeRateControl(*v87, 2i64);
*v87 = 0i64;
}
goto LABEL_204;
}
_InterlockedOr((volatile signed __int32 *)v18 + 330, 0x20u);
v18 = (char *)DeferredContext;
}
else
{
SchedulingGroups = (_KSCHEDULING_GROUP *)(*v87 + 16);
if( ((_DWORD)v88[5] & 4) != 0 )
KeSetSchedulingGroupWeights(1ui64, (INT64)&SchedulingGroups, (INT64)&CpuRates);
else
KeSetSchedulingGroupCpuRates((UINT64)v89, &SchedulingGroups, &CpuRates);
}
JobObjectInformationa = (*v87)[5];
}
else
{
CpuRates.AllFlags = 3;
CpuRates.Value = 655370000;
*((_DWORD *)*v87 + 10) |= 0x40u;
Value = CpuRates.Value;
*((_DWORD *)*v87 + 11) = CpuRates.Value;
SchedulingGroups = (_KSCHEDULING_GROUP *)(*v87 + 16);
v154[0] = (SchedulingGroups->Policy.AllFlags & 4) != 0;
KeQuerySchedulingGroupReadyTime(SchedulingGroups);
*((_QWORD *)v18 + 128) += v95;
KeSetSchedulingGroupCpuRates(v96, &SchedulingGroups, &CpuRates);
HIDWORD(JobObjectInformationa) = Value;
if( v154[0] )
{
v154[0] = 0;
PspEnumProcessesInJobHierarchy(
v18,
(__int64(__fastcall *)(_QWORD *, __int64))PspSetProcessCacheIsolationCallback,
(__int64)v154,
1);
}
}
v17 = 0;
LABEL_204:
v141 = Thread;
v142 = (_EJOB *)v18;
LABEL_205:
PspUnlockJobChain((__int64)v142, (__int64)v141, 0);
goto LABEL_35;
}
}
else if( (v81 & 0x20) == 0 )
{
v17 = -1073741811;
goto LABEL_204;
}
v83 = 0i64;
goto LABEL_190;
}
}
LABEL_380:
v17 = -1073741811;
goto LABEL_278;
}
LABEL_292:
P = 0i64;
v162 = 0i64;
v105 = 16;
if( (_DWORD)v9 != 14 )
v105 = 2;
v168 = v105;
v106 = (unsigned int)v8 / v105;
if( (unsigned int)v8 % v105 )
{
v17 = -1073741820;
goto LABEL_278;
}
HIDWORD(v170) = (unsigned int)v8 / v105;
*(_DWORD *)&Affinity.Count = 1310721;
memset((INT64)&Affinity.Reserved, 0i64);
v125 = KeQueryActiveGroupCount() - 1;
LOWORD(v155) = v125;
while( v106 )
{
if( (_DWORD)v9 == 14 )
{
v126 = *(__m128i *)v13;
Base = v126;
LOWORD(v127) = _mm_extract_epi16(v126, 4);
Base.m128i_i16[4] = v127;
v158 = v127;
ProcessorMask = v126.m128i_i64[0];
}
else
{
v127 = *(unsigned __int16 *)v13;
v158 = v127;
if( (unsigned __int16)v127 > v125 )
goto LABEL_396;
ProcessorMask = KeActiveProcessors.Bitmap[v127];
LOWORD(v127) = v158;
}
if( (unsigned __int16)v127 > v125
|| (v127 = (unsigned __int16)v127, Affinity.Bitmap[(unsigned __int16)v127])
|| ProcessorMask != (ProcessorMask & KeActiveProcessors.Bitmap[v127]) )
{
LABEL_396:
v17 = -1073741811;
v152 = -1073741811;
break;
}
KeAddGroupAffinityEx(&Affinity, v158, ProcessorMask);
v106 = --HIDWORD(v170);
v13 = (UINT8 *)Src + v168;
Src = v13;
v17 = v152;
v125 = v155;
}
v18 = (char *)DeferredContext;
if( v17 < 0 )
goto LABEL_35;
BugCheckParameter2 = (ULONG_PTR)DeferredContext + 432;
if( *((_QWORD *)DeferredContext + 54) )
goto LABEL_402;
PoolWithTag = (struct _ERESOURCE *)ExAllocatePoolWithTag(PagedPool, 0x28ui64, 0x614A7350ui64);
P = PoolWithTag;
if( PoolWithTag )
{
v162 = (PERESOURCE)PsChargeSharedPoolQuota(*((_QWORD *)KeGetCurrentThread() + 23), 0x28ui64, 0i64);
if( v162 )
{
v18 = (char *)DeferredContext;
LABEL_402:
SeCaptureSubjectContextEx(
Thread,
*((_EPROCESS **)Thread + 23),
(_SECURITY_SUBJECT_CONTEXT *)&SubjectContext.ImpersonationLevel);
p_ImpersonationLevel = &SubjectContext.ImpersonationLevel;
if( AccessMode )
{
RequiredPrivileges.PrivilegeCount = 1;
RequiredPrivileges.Control = 1;
RequiredPrivileges.Privilege[0].Luid = SeDebugPrivilege;
RequiredPrivileges.Privilege[0].Attributes = 0;
v129 = SePrivilegeCheck(
&RequiredPrivileges,
(SECURITY_SUBJECT_CONTEXT *)&SubjectContext.ImpersonationLevel,
1);
LODWORD(SubjectContext.ClientToken) ^= (LODWORD(SubjectContext.ClientToken) ^ v129) & 1;
}
else
{
LODWORD(SubjectContext.ClientToken) |= 1u;
}
Resource = (PERESOURCE)(v18 + 56);
ExAcquireResourceExclusiveLite((ERESOURCE *)(v18 + 56), 1u);
v17 = PspEnumProcessesInJobHierarchy(
v18,
(__int64(__fastcall *)(_QWORD *, __int64))PspSetAffinityLimitCallback,
(__int64)&SubjectContext,
1);
v152 = v17;
v130 = v162;
if( v17 >= 0 )
{
v131 = (__int64 *)BugCheckParameter2;
v132 = *(_QWORD *)BugCheckParameter2;
if( *(_QWORD *)BugCheckParameter2 )
{
v191 = *(_OWORD *)(v132 + 8);
v192 = *(_OWORD *)(v132 + 24);
p_ImpersonationLevel = (_SECURITY_IMPERSONATION_LEVEL *)&v191;
}
else
{
*(_QWORD *)BugCheckParameter2 = P;
*((_QWORD *)v18 + 55) = v130;
P = 0i64;
p_ImpersonationLevel = 0i64;
v132 = *v131;
}
*(struct _SECURITY_SUBJECT_CONTEXT *)v132 = SubjectContext;
*(_QWORD *)(v132 + 32) = v176;
v173[0] = (__int64)v18;
HIDWORD(v173[1]) = *((_DWORD *)v18 + 64);
LODWORD(v173[1]) = -17;
*(_KAFFINITY_EX *)(v18 + 264) = Affinity;
if( (_DWORD)v9 == 14 && (unsigned int)KeIsEmptyAffinityEx((_WORD *)v18 + 132) )
{
*((_DWORD *)v18 + 64) &= ~0x10u;
_InterlockedAnd((volatile signed __int32 *)v18 + 330, 0xFFFFFFFD);
}
else
{
*((_DWORD *)v18 + 64) |= 0x10u;
_InterlockedOr((volatile signed __int32 *)v18 + 330, 2u);
}
v18 = (char *)DeferredContext;
PspEnumJobsAndProcessesInJobHierarchy(
DeferredContext,
(__int64(__fastcall *)(__int64, __int64))PspSetJobLimitsJobPreCallback,
0i64,
(__int64(__fastcall *)(_QWORD *, __int64))PspSetJobLimitsProcessCallback,
(__int64)v173,
5);
v17 = v152;
}
ExReleaseResourceLite(Resource);
if( p_ImpersonationLevel )
SeReleaseSubjectContext((_SECURITY_SUBJECT_CONTEXT *)p_ImpersonationLevel);
if( !P )
goto LABEL_35;
ExFreePoolWithTag(P, 0x614A7350u);
v124 = v130;
goto LABEL_418;
}
goto LABEL_342;
}
LABEL_341:
v17 = -1073741670;
goto LABEL_35;
}
if( (_DWORD)v9 != 12 )
{
if( (_DWORD)v9 == 2 )
goto LABEL_120;
if( (_DWORD)v9 != 4 )
{
switch( (_DWORD)v9 )
{
case 5:
v198 = *(__m128i *)v13;
v199 = *((_OWORD *)v13 + 1);
v200 = *((_QWORD *)v13 + 4);
v17 = (v198.m128i_i32[0] & 0xFFFFFFF0) != 0 ? -1073741811 : -1073741637;
goto LABEL_278;
case 6:
v186 = *(_DWORD *)v13;
v107 = v186;
v18 = (char *)DeferredContext;
if( v186 <= 1 )
{
ExAcquireResourceExclusiveLite((ERESOURCE *)((char *)DeferredContext + 56), 1u);
*((_DWORD *)v18 + 113) = v107;
goto LABEL_117;
}
goto LABEL_426;
case 7:
P = 0i64;
*(_OWORD *)Handle = *(_OWORD *)v13;
if( !Handle[1] )
{
v18 = (char *)DeferredContext;
ExAcquireResourceExclusiveLite((ERESOURCE *)((char *)DeferredContext + 56), 1u);
if( v18 )
ExAcquirePushLockExclusiveEx((UINT64)(v18 + 1032), 0i64);
v91 = (void *)*((_QWORD *)v18 + 57);
*((_QWORD *)v18 + 57) = 0i64;
PspUnlockJobMemoryLimitsExclusive((_EJOB *)v18, 0i64, 0i64);
ExReleaseResourceLite((PERESOURCE)(v18 + 56));
if( v91 )
ObfDereferenceObjectWithTag(v91, 0x624A7350ui64);
goto LABEL_35;
}
v17 = ObReferenceObjectByHandleWithTag(
Handle[1],
2u,
IoCompletionObjectType,
AccessMode,
0x624A7350u,
&v181,
0i64);
v18 = (char *)DeferredContext;
if( v17 < 0 )
{
v25 = 0i64;
}
else
{
if( *((_QWORD *)DeferredContext + 125) )
{
v24 = 0i64;
goto LABEL_46;
}
IoAllocateMiniCompletionPacket(
PspNotificationPacketCallback,
(_IO_MINI_COMPLETION_PACKET_USER *)DeferredContext,
v21,
v22);
v24 = v23;
P = v23;
if( v23 )
{
LABEL_46:
ExAcquireResourceExclusiveLite((ERESOURCE *)(v18 + 56), 1u);
if( *((_QWORD *)v18 + 57)
|| (*((_DWORD *)v18 + 64) & 0x2000) != 0 && (*((_DWORD *)v18 + 330) & 1) != 0 )
{
ExReleaseResourceLite((PERESOURCE)(v18 + 56));
ObfDereferenceObjectWithTag(v181, 0x624A7350ui64);
v17 = -1073741811;
v25 = (_WNF_STATE_NAME *)P;
}
else
{
if( *((_QWORD *)v18 + 125) )
{
v25 = (_WNF_STATE_NAME *)P;
}
else
{
*((_QWORD *)v18 + 125) = v24;
v25 = 0i64;
}
ExAcquirePushLockExclusiveEx((UINT64)(v18 + 1032), 0i64);
*((HANDLE *)v18 + 58) = Handle[0];
*((_QWORD *)v18 + 57) = v181;
*((_QWORD *)v18 + 59) = 0i64;
PspUnlockJobMemoryLimitsExclusive((_EJOB *)v18, 0i64, 0i64);
if( (*((_DWORD *)v18 + 219) & 0x40) != 0 )
PspEnumProcessesInJobHierarchy(
v18,
(__int64(__fastcall *)(_QWORD *, __int64))PspAssociateCompletionPortCallback,
(__int64)v18,
1);
ExReleaseResourceLite((PERESOURCE)(v18 + 56));
}
goto LABEL_53;
}
v17 = -1073741670;
v25 = 0i64;
}
LABEL_53:
if( v25 )
IoFreeMiniCompletionPacket(
v25,
v20,
(_WNF_DATA_SCOPE)v21,
(UINT8)v22,
*(const _WNF_TYPE_ID **)Tag,
(UINT64)Object,
HandleInformation);
goto LABEL_35;
}
if( (_DWORD)v9 != 9 )
{
if( (_DWORD)v9 != 11 )
goto LABEL_455;
goto LABEL_292;
}
LABEL_120:
memmove((UINT8 *)&result, v13, v8);
if( (unsigned int)v8 < 0x98 )
memset((INT64)&result + v8, 0i64);
JobLimitInformationValidFlags = PspGetJobLimitInformationValidFlags((unsigned int)v9, (unsigned int)v8);
v61 = ~JobLimitInformationValidFlags;
LODWORD(v162) = ~JobLimitInformationValidFlags;
v62 = v231;
if( (~JobLimitInformationValidFlags & v231) != 0 )
goto LABEL_380;
v250 = v231;
Resource = 0i64;
BugCheckParameter2 = 0i64;
v178 = 0i64;
v251 = (v231 & 8) != 0 ? v234 : 0;
if( (v231 & 0x20) != 0 )
{
if( v236 > 6 )
goto LABEL_380;
v63 = AccessMode;
if( v236 - 3 <= 1 )
{
v108 = SeCheckPrivilegedObject(*(_LUID *)SeIncreaseBasePriorityPrivilege, P, 2u, AccessMode) & 1;
LOBYTE(v109) = 4 * v108;
v155 = v109;
if( !v108 )
goto LABEL_311;
v62 = v231;
}
v258 = v236;
}
else
{
v258 = 0;
v63 = AccessMode;
}
if( (v62 & 0x80u) != 0 )
{
v110 = v237;
if( v237 >= 0xA )
goto LABEL_380;
if( v237 > 5 )
{
v111 = SeCheckPrivilegedObject(*(_LUID *)SeIncreaseBasePriorityPrivilege, P, 2u, v63) & 1;
LOBYTE(v112) = 4 * v111;
v155 = v112;
if( !v111 )
goto LABEL_311;
v62 = v231;
v110 = v237;
}
v254 = v110;
}
else
{
v254 = 5;
}
if( (v62 & 2) != 0 )
{
if( !result )
goto LABEL_380;
v246 = result;
}
else
{
v246 = 0i64;
}
v168 = v62 & 4;
if( (v62 & 4) != 0 )
{
if( !v230 )
goto LABEL_380;
v247 = v230;
}
if( (v62 & 1) == 0 )
{
v248 = 0i64;
v249 = 0i64;
goto LABEL_132;
}
v113 = v232;
if( !v232 && !v233 || v232 == -1i64 && v233 == -1i64 || v232 > v233 || v232 < 0x14000 )
goto LABEL_380;
if( v232 <= PspMinimumWorkingSet )
{
LABEL_330:
v248 = v113;
v249 = v233;
LABEL_132:
if( (v62 & 0x100) != 0 )
{
if( v238 < 0x1000 )
goto LABEL_380;
v255 = v238 >> 12;
}
else
{
v255 = 0i64;
}
if( (v62 & 0x200) != 0 )
{
if( v239 < 0x1000 )
goto LABEL_380;
v256 = v239 >> 12;
}
else
{
v256 = 0i64;
}
if( (v62 & 0x200000) != 0 )
{
if( v240 < 0x1000 )
goto LABEL_380;
v257 = v240 >> 12;
}
else
{
v257 = 0i64;
}
LODWORD(v252[0]) = 1310721;
memset((INT64)v252 + 4, 0i64);
JobObjectInformationClassa = v250;
v18 = (char *)DeferredContext;
if( (v250 & 0x10) != 0 )
{
if( (*((_DWORD *)DeferredContext + 330) & 2) != 0 || !v235 )
goto LABEL_426;
if( !*((_QWORD *)DeferredContext + 54) )
{
PoolWithTag = (struct _ERESOURCE *)ExAllocatePoolWithTag(PagedPool, 0x28ui64, 0x614A7350ui64);
Resource = PoolWithTag;
if( !PoolWithTag )
goto LABEL_341;
BugCheckParameter2 = PsChargeSharedPoolQuota(*((_QWORD *)KeGetCurrentThread() + 23), 0x28ui64, 0i64);
if( !BugCheckParameter2 )
{
LABEL_342:
v116 = 1632269136;
v90 = PoolWithTag;
LABEL_344:
ExFreePoolWithTag(v90, v116);
v17 = -1073741670;
goto LABEL_278;
}
v18 = (char *)DeferredContext;
JobObjectInformationClassa = v250;
v17 = v152;
}
SeCaptureSubjectContextEx(
Thread,
*((_EPROCESS **)Thread + 23),
(_SECURITY_SUBJECT_CONTEXT *)&SubjectContext.ImpersonationLevel);
v178 = (PSECURITY_SUBJECT_CONTEXT)&SubjectContext.ImpersonationLevel;
if( AccessMode )
{
RequiredPrivileges.PrivilegeCount = 1;
RequiredPrivileges.Control = 1;
RequiredPrivileges.Privilege[0].Luid = SeDebugPrivilege;
RequiredPrivileges.Privilege[0].Attributes = 0;
v115 = SePrivilegeCheck(
&RequiredPrivileges,
(SECURITY_SUBJECT_CONTEXT *)&SubjectContext.ImpersonationLevel,
1);
LODWORD(SubjectContext.ClientToken) ^= (LODWORD(SubjectContext.ClientToken) ^ v115) & 1;
}
else
{
LODWORD(SubjectContext.ClientToken) |= 1u;
}
v64 = v155;
LOBYTE(v64) = v155 | 2;
v155 = v64;
v61 = (int)v162;
}
else
{
LOBYTE(v64) = v155;
}
AccessMode = v64;
v162 = (PERESOURCE)(v18 + 56);
ExAcquireResourceExclusiveLite((ERESOURCE *)(v18 + 56), 1u);
v67 = JobObjectInformationClassa;
if( (JobObjectInformationClassa & 4) == 0 )
{
if( (JobObjectInformationClassa & 0x40) != 0 )
{
v67 = *((_DWORD *)v18 + 64) & 4 | JobObjectInformationClassa;
v247 = *((_QWORD *)v18 + 29);
}
else
{
v247 = 0i64;
}
}
v68 = v67 & 0xFFFFFFBF;
v250 = v68;
if( (AccessMode & 2) != 0 )
{
if( (*((_DWORD *)v18 + 330) & 2) == 0 )
{
if( (*((_DWORD *)v18 + 64) & 0x10) != 0 )
{
KeFirstGroupAffinityEx(&Base, (_BYTE)v18 + 8, v65, v66);
v117 = Base.m128i_u16[4];
}
else
{
v117 = *((unsigned __int8 *)KeGetCurrentPrcb() + 208);
Base.m128i_i16[4] = v117;
}
if( v235 == (KeActiveProcessors.Bitmap[v117] & v235) )
{
if( LOWORD(v252[0]) <= (unsigned int)Base.m128i_i16[4] )
LOWORD(v252[0]) = Base.m128i_i16[4] + 1;
*((_QWORD *)v252 + v117 + 1) |= v235;
v18 = (char *)DeferredContext;
v17 = PspEnumProcessesInJobHierarchy(
DeferredContext,
(__int64(__fastcall *)(_QWORD *, __int64))PspSetAffinityLimitCallback,
(__int64)&SubjectContext,
1);
v152 = v17;
if( v17 >= 0 )
{
v118 = *((_QWORD *)v18 + 54);
if( v118 )
{
v191 = *(_OWORD *)(v118 + 8);
v192 = *(_OWORD *)(v118 + 24);
v178 = (PSECURITY_SUBJECT_CONTEXT)&v191;
}
else
{
*((_QWORD *)v18 + 54) = Resource;
*((_QWORD *)v18 + 55) = BugCheckParameter2;
Resource = 0i64;
v178 = 0i64;
v118 = *((_QWORD *)v18 + 54);
}
*(struct _SECURITY_SUBJECT_CONTEXT *)v118 = SubjectContext;
*(_QWORD *)(v118 + 32) = v176;
goto LABEL_145;
}
}
else
{
v17 = -1073741811;
v152 = -1073741811;
v18 = (char *)DeferredContext;
}
LABEL_352:
v74 = v155;
LABEL_156:
v75 = v74 & 1;
if( v75 )
{
PspLockWorkingSetChangeExclusiveUnsafe();
_InterlockedOr((volatile signed __int32 *)v18 + 330, 0x100u);
v18 = (char *)DeferredContext;
v122 = (char *)DeferredContext + 40;
for( i = (char *)*((_QWORD *)DeferredContext + 5); i != v122; i = *(char **)i )
{
if( (*((_DWORD *)i - 90) & 1) == 0 )
PspAddProcessToWorkingSetChangeList((PEPROCESS)(i - 1480));
}
v17 = v152;
}
ExReleaseResourceLite(v162);
if( v75 )
PspApplyWorkingSetLimits((_EJOB *)v18, v76);
if( v178 )
SeReleaseSubjectContext(v178);
if( !Resource )
goto LABEL_35;
ExFreePoolWithTag(Resource, 0x614A7350u);
v124 = (void *)BugCheckParameter2;
LABEL_418:
PsReturnSharedPoolQuota(v124, 0x28ui64, 0i64);
goto LABEL_35;
}
}
else if( (v68 & 0x4000) == 0 || (*((_DWORD *)v18 + 330) & 2) != 0 )
{
LABEL_145:
v69 = v18 + 256;
P = v18 + 256;
if( (*((_DWORD *)v18 + 64) & 1) != 0 && (v250 & 1) == 0 )
{
_InterlockedOr(v145, 0);
if( (qword_140C130B0 & 1) != 0 )
{
ExfAcquireReleasePushLockExclusive(&qword_140C130B0);
v69 = P;
}
v17 = v152;
v18 = (char *)DeferredContext;
}
v173[0] = (__int64)v18;
HIDWORD(v173[1]) = *v69;
*((_QWORD *)v18 + 30) = v248;
*((_QWORD *)v18 + 31) = v249;
*((_DWORD *)v18 + 65) = v251;
if( (AccessMode & 2) != 0 )
{
*(_OWORD *)(v18 + 264) = v252[0];
*(_OWORD *)(v18 + 280) = v252[1];
*(_OWORD *)(v18 + 296) = v252[2];
*(_OWORD *)(v18 + 312) = v252[3];
*(_OWORD *)(v18 + 328) = v252[4];
*(_OWORD *)(v18 + 344) = v252[5];
*(_OWORD *)(v18 + 360) = v252[6];
*(_OWORD *)(v18 + 376) = v252[7];
*(_OWORD *)(v18 + 392) = v252[8];
*(_OWORD *)(v18 + 408) = v252[9];
*((_QWORD *)v18 + 53) = v253;
v69 = P;
}
v18[873] = v258;
*((_DWORD *)v18 + 121) = v254;
*((_QWORD *)v18 + 28) = v246;
v70 = (__int64)(v18 + 232);
*((_QWORD *)v18 + 29) = v247;
if( (_DWORD)v9 == 9 )
{
ExAcquirePushLockExclusiveEx((UINT64)(v18 + 1032), 0i64);
v71 = (int *)P;
*(_DWORD *)P = v250 | *(_DWORD *)P & v61;
*((_QWORD *)v18 + 72) = v255;
*((_QWORD *)v18 + 73) = v256;
*((_QWORD *)v18 + 74) = v257;
PspUnlockJobMemoryLimitsExclusive((_EJOB *)v18, 0i64, 0i64);
v72 = *v71;
v70 = (__int64)(v18 + 232);
}
else
{
v72 = v250 | *v69 & v61;
*v69 = v72;
v71 = (int *)P;
}
LODWORD(v173[1]) = ~(HIDWORD(v173[1]) | v72);
if( v168 )
{
PspEnumProcessesInJobHierarchy(
v18,
(__int64(__fastcall *)(_QWORD *, __int64))PspSetJobTimeLimitCallback,
v70,
1);
*((_QWORD *)v18 + 23) = 0i64;
*((_QWORD *)v18 + 24) = 0i64;
KeResetEvent(v18, v119, v120, v121, *(IRP **)Tag);
}
if( (*v71 & 6) != 0 )
{
_InterlockedAdd64(&PspJobTimeLimitsRequest, 1ui64);
v18 = (char *)DeferredContext;
v17 = v152;
}
v73 = v173[1];
PspEnumJobsAndProcessesInJobHierarchy(
v18,
(__int64(__fastcall *)(__int64, __int64))PspSetJobLimitsJobPreCallback,
(unsigned int(__fastcall *)(__int64, __int64))PspSetJobLimitsJobPostCallback,
(__int64(__fastcall *)(_QWORD *, __int64))PspSetJobLimitsProcessCallback,
(__int64)v173,
5);
v74 = AccessMode | 1;
if( (v73 & 1) != 0 )
v74 = AccessMode;
goto LABEL_156;
}
v17 = -1073741811;
v152 = -1073741811;
goto LABEL_352;
}
if( SeSinglePrivilegeCheck(*(INT64 *)SeIncreaseBasePriorityPrivilege, v63) )
{
v62 = v231;
v113 = v232;
goto LABEL_330;
}
LABEL_311:
v17 = -1073741727;
goto LABEL_278;
}
v166 = *(_DWORD *)v13;
if( (v166 & 0xFFFFFF00) != 0 )
goto LABEL_380;
v97 = 8;
v18 = (char *)DeferredContext;
PspLockJobChain((__int64)DeferredContext, (__int64)Thread, 0);
if( PspDoesJobHierarchyPermitUILimits((INT64)v18, 0) )
{
if( *((_DWORD *)v18 + 120) == -2 )
{
v17 = -1073741790;
}
else
{
v18 = (char *)DeferredContext;
PspBindProcessSessionToJob((_EJOB *)DeferredContext, *((_EPROCESS **)KeGetCurrentThread() + 23));
LODWORD(v170) = *v98;
if( (unsigned int)v170 > 0xFFFFFFFD )
goto LABEL_243;
if( v166 == *((_DWORD *)v18 + 112) )
goto LABEL_243;
v196 = 0;
PspUnlockJobChain((__int64)v18, (__int64)Thread, 1);
v97 = 0;
v194 = v18;
v195 = 0;
v197 = v166;
v17 = PsInvokeWin32Callout(6i64, &v194, 1i64, &v170);
v152 = v17;
if( v17 >= 0 )
{
LABEL_243:
*((_DWORD *)v18 + 112) = v166;
_InterlockedOr((volatile signed __int32 *)v18 + 330, 0x10u);
v18 = (char *)DeferredContext;
v17 = v152;
}
}
}
else
{
v17 = -1073741637;
}
v141 = Thread;
v142 = (_EJOB *)v18;
if( (unsigned __int8)v97 >= 8u )
goto LABEL_205;
LABEL_245:
PspUnlockJob((__int64)v142, (__int64)v141);
goto LABEL_35;
}
LABEL_65:
if( (_DWORD)v8 == 56 )
{
v225 = *(__m128i *)BugCheckParameter2;
v226 = *(__m128i *)(BugCheckParameter2 + 16);
v227 = *(__m128i *)(BugCheckParameter2 + 32);
v228 = *(_QWORD *)(BugCheckParameter2 + 48);
v27 = v228;
v222 = v228;
v28 = v225.m128i_i64[0];
v216 = v225.m128i_i64[0];
v29 = _mm_srli_si128(v225, 8).m128i_u64[0];
v217 = v29;
v30 = v226.m128i_i64[0];
v218 = v226.m128i_i64[0];
v31 = _mm_srli_si128(v226, 8).m128i_u64[0];
v223 = v31;
v32 = v227.m128i_i64[0];
v219 = v227.m128i_i64[0];
v220 = _mm_cvtsi128_si32(_mm_srli_si128(v227, 8));
v221 = _mm_cvtsi128_si32(_mm_srli_si128(v227, 12));
v33 = 2589188;
JobLimitInformationValidFlags = 2589188;
}
else
{
if( (_DWORD)v8 == 48 )
{
v241 = *(__m128i *)BugCheckParameter2;
v242 = *(__m128i *)(BugCheckParameter2 + 16);
v243 = *(__m128i *)(BugCheckParameter2 + 32);
v27 = _mm_cvtsi128_si32(_mm_srli_si128(v243, 8));
v222 = v27;
v28 = v241.m128i_i64[0];
v216 = v241.m128i_i64[0];
v29 = _mm_srli_si128(v241, 8).m128i_u64[0];
v217 = v29;
v30 = v242.m128i_i64[0];
v218 = v242.m128i_i64[0];
v32 = _mm_srli_si128(v242, 8).m128i_u64[0];
v219 = v32;
v220 = _mm_cvtsi128_si32(v243);
v221 = _mm_cvtsi128_si32(_mm_srli_si128(v243, 4));
v33 = 459268;
JobLimitInformationValidFlags = 459268;
}
else
{
memmove((UINT8 *)&v216, v13, v8);
v33 = 2064900;
JobLimitInformationValidFlags = 2064900;
v27 = v222;
v32 = v219;
v30 = v218;
v29 = v217;
v28 = v216;
}
v31 = v223;
}
if( (~v33 & v27) != 0 )
goto LABEL_380;
if( (v27 & 0x8000) != 0 )
{
if( v31 < 0x1000 )
goto LABEL_380;
}
else
{
v31 = 0i64;
v223 = 0i64;
}
if( (v27 & 0x200) != 0 )
{
if( v32 < 0x1000 || v32 < v31 )
goto LABEL_380;
}
else
{
v219 = 0i64;
}
if( (v27 & 4) != 0 )
{
if( !v30 )
goto LABEL_380;
}
else
{
v218 = 0i64;
}
if( (v27 & 0x10000) != 0 )
{
if( !v28 )
goto LABEL_380;
}
else
{
v216 = 0i64;
}
if( (v27 & 0x20000) != 0 )
{
if( !v29 )
goto LABEL_380;
}
else
{
v217 = 0i64;
}
for( j = 0i64; (int)j < 3; j = (unsigned int)(v38 + 1) )
{
PspNotificationLimitRateControlToleranceField((INT64)&v216, j);
PspNotificationLimitRateControlToleranceIntervalField((INT64)&v216, v35);
v37 = PspRateControlLimitFlag(v36);
if( (v37 & v41) != 0 )
{
if( !*v39 || *v39 > 3 || !*v40 || *v40 > 3 )
goto LABEL_380;
}
else
{
*v39 = 0;
*v40 = 0;
}
}
v18 = (char *)DeferredContext;
v42 = (struct _ERESOURCE **)((char *)DeferredContext + 984);
if( *((_QWORD *)DeferredContext + 123) )
{
v43 = 0i64;
BugCheckParameter2 = 0i64;
}
else
{
v43 = (struct _ERESOURCE *)ExAllocatePoolWithTag(PagedPool, 0x88ui64, 0x624A7350ui64);
if( !v43 )
goto LABEL_341;
BugCheckParameter2 = PsChargeSharedPoolQuota(*((_QWORD *)KeGetCurrentThread() + 23), 0x88ui64, 0i64);
v90 = v43;
if( !BugCheckParameter2 )
{
v116 = 1649046352;
goto LABEL_344;
}
memset((INT64)v43, 0i64);
v18 = (char *)DeferredContext;
}
Resource = (PERESOURCE)(v18 + 56);
ExAcquireResourceExclusiveLite((ERESOURCE *)(v18 + 56), 1u);
if( *v42 )
{
if( v43 )
{
ExFreePoolWithTag(v43, 0x624A7350u);
PsReturnSharedPoolQuota((PVOID)BugCheckParameter2, 0x88ui64, 0i64);
}
}
else
{
*v42 = v43;
*((_QWORD *)v18 + 124) = BugCheckParameter2;
}
v44 = *v42;
Flink = (int)(*v42)->SystemResourcesList.Flink;
v44->SystemResourcesList.Blink = (_LIST_ENTRY *)v216;
v44->OwnerTable = (_OWNER_ENTRY *)v217;
*(_QWORD *)&v44->ActiveCount = v218;
for( k = 0i64; (int)k < 3; k = (unsigned int)(v52 + 1) )
{
v47 = (_DWORD *)PspNotificationLimitRateControlToleranceField((INT64)&v216, k);
*(_DWORD *)(v48 - 12) = *v47;
v50 = (_DWORD *)PspNotificationLimitRateControlToleranceIntervalField((INT64)&v216, v49);
*v51 = *v50;
}
BugCheckParameter2 = (ULONG_PTR)(v18 + 1032);
ExAcquirePushLockExclusiveEx((UINT64)(v18 + 1032), 0i64);
v44->SharedWaiters = (void *)(v223 >> 12);
v44->ExclusiveWaiters = (void *)(v219 >> 12);
LODWORD((*v42)->SystemResourcesList.Flink) = v222;
PspUnlockJobMemoryLimitsExclusive((_EJOB *)v18, 0i64, 0i64);
if( ((__int64)(*v42)->SystemResourcesList.Flink & 0xFFFF7DFF) != 0 )
{
_InterlockedAdd64(&PspJobTimeLimitsRequest, 1ui64);
v18 = (char *)DeferredContext;
}
if( Flink )
{
v54 = *v42;
if( LODWORD((*v42)->SystemResourcesList.Flink) )
goto LABEL_104;
}
else
{
v54 = *v42;
if( !LODWORD((*v42)->SystemResourcesList.Flink) )
{
LABEL_104:
ExReleaseResourceLite(Resource);
ExAcquirePushLockSharedEx(BugCheckParameter2, 0i64);
v55 = *((_QWORD *)v18 + 167);
v18 = (char *)DeferredContext;
JobMemoryUsageNotificationViolations = PspGetJobMemoryUsageNotificationViolations(
(__int64)DeferredContext,
*((_QWORD *)DeferredContext + 122),
*((_QWORD *)DeferredContext + 122) + v55,
33280);
PspUnlockJobMemoryLimitsShared((__int64)v18, 0i64);
if( JobMemoryUsageNotificationViolations )
{
PspScheduleEnforcementWorker(*((_EJOB **)v18 + 135));
v18 = (char *)DeferredContext;
}
goto LABEL_34;
}
}
PspEnumJobsAndProcessesInJobHierarchy(
v18,
(__int64(__fastcall *)(__int64, __int64))PspSetJobNotificationCountCallback,
0i64,
0i64,
(__int64)v54,
5);
goto LABEL_104;
}
if( (int)v9 > 40 )
{
if( (_DWORD)v9 == 41 )
{
v193 = *(_DWORD *)v13;
v18 = (char *)DeferredContext;
if( !PspJobIsAppSilo((INT64)DeferredContext) || v143 != 2 )
goto LABEL_426;
v103 = (struct _ERESOURCE *)(v18 + 56);
ExAcquireResourceExclusiveLite((ERESOURCE *)(v18 + 56), 1u);
if( *((_DWORD *)v18 + 306) )
{
v17 = -1073740529;
}
else
{
v144 = _interlockedbittestandset((volatile signed __int32 *)v18 + 330, 0x1Du);
v18 = (char *)DeferredContext;
if( v144 )
{
v17 = 255;
}
else
{
PspBeginSiloTeardown((INT64)DeferredContext);
v17 = 0;
}
}
goto LABEL_477;
}
if( (_DWORD)v9 == 42 )
{
v77 = 0;
*(_OWORD *)v204 = *(_OWORD *)v13;
v205 = *((_OWORD *)v13 + 1);
v206 = *((_OWORD *)v13 + 2);
v207 = *((_OWORD *)v13 + 3);
v208 = *((_QWORD *)v13 + 8);
if( (v204[0] & 0xFFFFFFFC) != 0 || (v204[0] & 3) == 0 )
{
v17 = -1073741811;
v18 = (char *)DeferredContext;
}
else
{
v77 = 8;
v78 = Thread;
v18 = (char *)DeferredContext;
PspLockRootJobExclusive((_EJOB *)DeferredContext, Thread, &RootJob);
PspLockJobConditionally((_EJOB *)v18, &RootJob);
v17 = PspSetJobIoAttribution((_EJOB *)v18, v204[0] & 1, 1u, 1ui64);
if( v17 >= 0 )
{
PspUnlockJobConditionally((_EJOB *)v18, &RootJob);
PspUnlockJob((__int64)RootJob, (__int64)v78);
v77 = 0;
}
}
if( (unsigned __int8)v77 < 8u )
goto LABEL_35;
PspUnlockJobConditionally((_EJOB *)v18, &RootJob);
v141 = Thread;
v142 = RootJob;
goto LABEL_245;
}
if( (_DWORD)v9 != 43 )
{
if( (_DWORD)v9 != 44 )
{
if( (_DWORD)v9 != 45 )
{
if( (_DWORD)v9 == 46 )
{
v183 = *(_QWORD *)v13;
v18 = (char *)DeferredContext;
v26 = PspSetEnergyTrackingStateJobTree(DeferredContext, (INT64)&v183);
goto LABEL_63;
}
if( (_DWORD)v9 != 47 )
goto LABEL_455;
v165 = *v13;
if( v165 != 1 )
goto LABEL_380;
v136 = SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, AccessMode);
v18 = (char *)DeferredContext;
if( v136 )
{
if( (*((_DWORD *)DeferredContext + 330) & 0x40000000) != 0 )
{
v17 = PspSetJobSiloThreadImpersonationPolicy((INT64)DeferredContext, 2i64) == 0 ? 0xC0000022 : 0;
goto LABEL_35;
}
goto LABEL_426;
}
LABEL_424:
v17 = -1073741727;
goto LABEL_35;
}
v18 = (char *)DeferredContext;
if( (*((_DWORD *)DeferredContext + 330) & 0x40000000) != 0 )
{
v184 = 0i64;
*(_OWORD *)a2 = *(_OWORD *)v13;
v137 = (UINT8 *)_mm_srli_si128(*(__m128i *)a2, 8).m128i_u64[0];
if( !v137 || (unsigned __int16)(a2[0] - 1) > 0x206u || (a2[0] & 1) != 0 )
{
v17 = -1073741811;
v152 = -1073741811;
goto LABEL_35;
}
if( AccessMode == 1 )
{
if( ((unsigned __int8)v137 & 1) != 0 )
ExRaiseDatatypeMisalignment();
if( (unsigned __int64)&v137[a2[0]] > 0x7FFFFFFF0000i64 || &v137[a2[0]] < v137 )
MEMORY[0x7FFFFFFF0000] = 0;
}
v138 = a2[0];
v139 = (UINT8 *)ExAllocatePoolWithTag(PagedPool, a2[0], 0x72537350ui64);
v102 = (wchar_t *)v139;
v184 = v139;
if( !v139 )
{
v17 = -1073741670;
v152 = -1073741670;
goto LABEL_35;
}
memmove(v139, v137, v138);
v140 = v138 >> 1;
if( wcsnlen(v102, v140) == v140 )
{
*(_QWORD *)&a2[4] = v102;
v17 = PspAssignSiloSystemRootPath((_EJOB *)v18, a2);
}
else
{
v17 = -1073741811;
}
if( !v102 )
goto LABEL_35;
v134 = 1918071632;
goto LABEL_442;
}
LABEL_425:
v17 = -1073740535;
goto LABEL_35;
}
v18 = (char *)DeferredContext;
v103 = (struct _ERESOURCE *)((char *)DeferredContext + 56);
ExAcquireResourceExclusiveLite((ERESOURCE *)((char *)DeferredContext + 56), 1u);
if( *((int *)v18 + 330) >= 0 )
{
*(_OWORD *)(v18 + 1256) = *(_OWORD *)v13;
_InterlockedOr((volatile signed __int32 *)v18 + 330, 0x80000000);
ExReleaseResourceLite(v103);
v17 = 0;
LABEL_278:
v18 = (char *)DeferredContext;
goto LABEL_35;
}
v17 = -1073741791;
LABEL_477:
v60 = v103;
goto LABEL_118;
}
v203 = *(_QWORD *)v13;
LOBYTE(v16) = AccessMode;
v18 = (char *)DeferredContext;
Silo = PspSetJobMemoryPartition(DeferredContext, v16);
LABEL_283:
v17 = Silo;
goto LABEL_35;
}
switch( (_DWORD)v9 )
{
case 0x28:
v135 = SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, AccessMode);
v18 = (char *)DeferredContext;
if( !v135 )
goto LABEL_424;
if( (*((_DWORD *)DeferredContext + 330) & 0x40000000) == 0 )
goto LABEL_425;
if( !PspSetJobSiloThreadImpersonationPolicy((INT64)DeferredContext, 4i64) )
goto LABEL_426;
v202 = *(PVOID *)v13;
v164 = v13[8];
Silo = PspConvertSiloToServerSilo((_EJOB *)v18, AccessMode, v202);
goto LABEL_283;
case 0x19:
v18 = (char *)DeferredContext;
ExAcquireResourceExclusiveLite((ERESOURCE *)((char *)DeferredContext + 56), 1u);
KeResetEvent(v18, v84, v85, v86, *(IRP **)Tag);
LABEL_33:
ExReleaseResourceLite((PERESOURCE)(v18 + 56));
goto LABEL_34;
case 0x1B:
v18 = (char *)DeferredContext;
if( DeferredContext )
ExAcquirePushLockExclusiveEx((UINT64)DeferredContext + 1032, 0i64);
*((_QWORD *)v18 + 76) = 0i64;
*((_QWORD *)v18 + 75) = 0i64;
PspUnlockJobMemoryLimitsExclusive((_EJOB *)v18, 0i64, 0i64);
goto LABEL_34;
}
if( (_DWORD)v9 != 31 )
{
switch( (_DWORD)v9 )
{
case ' ':
v18 = (char *)DeferredContext;
Silo = PspSetNetRateControl(v13, (unsigned int)v8, (_EJOB *)DeferredContext);
break;
case '!':
goto LABEL_65;
case '#':
v18 = (char *)DeferredContext;
Silo = PspCreateSilo((_EJOB *)DeferredContext);
break;
case '%':
v133 = SeSinglePrivilegeCheck(*(_QWORD *)&SeTcbPrivilege, AccessMode);
v18 = (char *)DeferredContext;
if( !v133 )
goto LABEL_424;
if( (*((_DWORD *)DeferredContext + 330) & 0x40000000) == 0 )
goto LABEL_425;
if( !PspSetJobSiloThreadImpersonationPolicy((INT64)DeferredContext, 4i64) )
goto LABEL_426;
v188 = *(_DWORD *)v13;
Silo = ObCreateSiloRootDirectory((_EJOB *)v18, v188);
break;
default:
goto LABEL_455;
}
goto LABEL_283;
}
memmove((UINT8 *)v209, v13, v8);
if( v210 )
{
v99 = v212;
v100 = PagedPool;
if( !v212 )
goto LABEL_263;
if( ((unsigned __int8)v210 & 1) != 0 )
ExRaiseDatatypeMisalignment();
if( (unsigned __int64)&v210[v212] > 0x7FFFFFFF0000i64 || &v210[v212] < v210 )
{
MEMORY[0x7FFFFFFF0000] = 0;
v99 = v212;
}
if( !v99 || (v99 & 1) != 0 )
{
LABEL_263:
v17 = -1073741811;
v152 = -1073741811;
v18 = (char *)DeferredContext;
goto LABEL_274;
}
v179 = PagedPool;
if( AccessMode == 1 )
v100 = 9;
v179 = v100;
v190[1] = ExAllocatePoolWithQuotaTag(v100, v99 + 2i64, 0x624A7350ui64);
if( !v190[1] )
{
v17 = -1073741801;
v152 = -1073741801;
v18 = (char *)DeferredContext;
LABEL_274:
v102 = (wchar_t *)v190[1];
if( !v190[1] )
goto LABEL_35;
v134 = 0;
LABEL_442:
ExFreePoolWithTag(v102, v134);
goto LABEL_35;
}
v101 = (UINT8 *)v190[1];
memmove((UINT8 *)v190[1], v210, v212);
*(_WORD *)&v101[2 * ((unsigned __int64)v212 >> 1)] = 0;
v210 = v101;
}
if( (v211 & 0xFFFFFFF0) != 0 )
{
v17 = -1073741811;
}
else
{
if( !v214 && !v213 && !v209[2] || PspIsContextAdmin() )
{
v18 = (char *)DeferredContext;
v17 = PspSetJobIoRateControl((unsigned __int64)DeferredContext, (__int64)v209);
goto LABEL_274;
}
v17 = -1073741790;
}
v18 = (char *)DeferredContext;
goto LABEL_274;
}
return v15;
}Referenced by:
No references.