PsSetProcessWin32Process

NTSTATUS __stdcall PsSetProcessWin32Process(VOID *Process, VOID *Win32Process, VOID *PrevWin32Process){
  _ETHREAD *CurrentThread; 
  NTSTATUS v4; 
  _EX_PUSH_LOCK *v8; 
  VOID **PoolWithTag; 
  _WORK_QUEUE_ITEM *v11; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v4 = 0;
  --CurrentThread->Tcb.KernelApcDisable;
  v8 = (_EX_PUSH_LOCK *)((char *)Process + 1080);
  ExAcquirePushLockExclusiveEx((_EX_PUSH_LOCK *)Process + 135, 0i64);
  if( Win32Process )
  {
    if( (*((_DWORD *)Process + 281) & 8) != 0 || *((_QWORD *)Process + 161) )
    {
      v4 = -1073741558;
    }
    else
    {
      *((_QWORD *)Process + 161) = Win32Process;
      if( ((*((_QWORD *)Process + 302) | (*((_QWORD *)Process + 302) >> 30)) & 0x3FFFFFFFi64) != 0 )
      {
        PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x28ui64, 1698982228i64);
        v11 = (_WORK_QUEUE_ITEM *)PoolWithTag;
        if( PoolWithTag )
        {
          ObfReferenceObjectWithTag(Process, 0x624A7350ui64);
          v11[1].List.Flink = (_LIST_ENTRY *)Process;
          v11->WorkerRoutine = (void(__fastcall *)(void *))PspTimerDelayWorkerRoutine;
          v11->Parameter = v11;
          v11->List.Flink = 0i64;
          ExQueueWorkItem(v11, NormalWorkQueue);
        }
      }
    }
  }
  else if( *((VOID **)Process + 161) == PrevWin32Process )
  {
    *((_QWORD *)Process + 161) = 0i64;
  }
  else
  {
    v4 = -1073741823;
  }
  if( (_InterlockedExchangeAdd64(&v8->_bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock(v8);
  KeAbPostRelease(v8);
  KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
  return v4;
}

Referenced by: