PsSetProcessWin32Process

INT64 __stdcall PsSetProcessWin32Process(_EPROCESS *Process, PVOID Win32Process, PVOID PrevWin32Process){
  _ETHREAD *CurrentThread; 
  unsigned int v4; 
  volatile INT64 *v8; 
  WORK_QUEUE_ITEM *PoolWithTag; 
  WORK_QUEUE_ITEM *v11; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v4 = 0;
  --*((_WORD *)CurrentThread + 242);
  v8 = (volatile INT64 *)((char *)Process + 1080);
  ExAcquirePushLockExclusiveEx((UINT64)Process + 1080, 0i64);
  if( Win32Process )
  {
    if( (*((_DWORD *)Process + 281) & 8) != 0 || *((_QWORD *)Process + 161) )
    {
      v4 = -1073741558;
    }
    else
    {
      *((_QWORD *)Process + 161) = Win32Process;
      if( ((*((_QWORD *)Process + 302) | (*((_QWORD *)Process + 302) >> 30)) & 0x3FFFFFFFi64) != 0 )
      {
        PoolWithTag = (WORK_QUEUE_ITEM *)ExAllocatePoolWithTag(PagedPool, 0x28ui64, 0x65446954ui64);
        v11 = PoolWithTag;
        if( PoolWithTag )
        {
          ObfReferenceObjectWithTag(Process, 0x624A7350u);
          v11[1].List.Flink = (_LIST_ENTRY *)Process;
          v11->WorkerRoutine = (void(__fastcall *)(void *))PspTimerDelayWorkerRoutine;
          v11->Parameter = v11;
          v11->List.Flink = 0i64;
          ExQueueWorkItem(v11, NormalWorkQueue);
        }
      }
    }
  }
  else if( *((PVOID *)Process + 161) == PrevWin32Process )
  {
    *((_QWORD *)Process + 161) = 0i64;
  }
  else
  {
    v4 = -1073741823;
  }
  if( (_InterlockedExchangeAdd64(v8, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
    ExfTryToWakePushLock(v8);
  KeAbPostRelease((PVOID)v8);
  KeLeaveCriticalRegionThread((__int64)CurrentThread);
  return v4;
}

Referenced by: