PspQueryQuotaLimits

NTSTATUS __stdcall PspQueryQuotaLimits(
        PVOID ProcessHandle,
        PVOID ProcessInformation,
        UINT64 ProcessInformationLength,
        UINT64 *ReturnLength,
        INT8 PreviousMode){
  UINT64 v5; 
  NTSTATUS result; 
  _QWORD *v9; 
  NTSTATUS v10; 
  int v11; 
  int v12; 
  UINT HardEnforcementFlags; 
  PVOID Object; 
  __int64 Src[2]; 
  UINT64 MinimumWorkingSetSize; 
  UINT64 MaximumWorkingSetSize[2]; 
  int v18; 
  int v19; 
  __int64 v20; 
  int v21; 
  UINT64 PrivateWorkingSetSize; 
  UINT64 WorkingSetSize; 
  UINT64 PeakWorkingSetSize; 
  struct _KAPC_STATE ApcState; 
  KPROCESSOR_MODE AccessMode; 
  v5 = (unsigned int)ReturnLength;
  memset((INT64)Src, 0i64);
  Object = 0i64;
  HardEnforcementFlags = 0;
  memset(&ApcState, 0, sizeof(ApcState));
  if( (_DWORD)v5 != 48 && (_DWORD)v5 != 88 )
    return -1073741820;
  result = ObReferenceObjectByHandleWithTag(
             ProcessHandle,
             0x1000u,
             (POBJECT_TYPE)PsProcessType,
             AccessMode,
             0x79517350u,
             &Object,
             0i64);
  if( result >= 0 )
  {
    v9 = (_QWORD *)*((_QWORD *)Object + 173);
    Src[0] = v9[24];
    Src[1] = v9[8];
    MaximumWorkingSetSize[1] = v9[40];
    v20 = v9[56];
    v18 = -1;
    v19 = -1;
    KeStackAttachProcess((PRKPROCESS)Object, &ApcState);
    v10 = MmQueryWorkingSetInformation(
            &PeakWorkingSetSize,
            &WorkingSetSize,
            &PrivateWorkingSetSize,
            &MinimumWorkingSetSize,
            MaximumWorkingSetSize,
            &HardEnforcementFlags);
    KeUnstackDetachProcess(&ApcState);
    v11 = 2 - ((HardEnforcementFlags & 4) != 0);
    if( (HardEnforcementFlags & 1) != 0 )
      v12 = v11 | 4;
    else
      v12 = v11 | 8;
    v21 = v12;
    ObfDereferenceObjectWithTag(Object, 0x79517350ui64);
    if( v10 >= 0 )
    {
      memmove((UINT8 *)ProcessInformationLength, (UINT8 *)Src, v5);
      if( PreviousMode )
        *(_DWORD *)PreviousMode = v5;
    }
    return v10;
  }
  return result;
}

Referenced by: