PsGetProcessDeepFreezeStats

VOID __stdcall PsGetProcessDeepFreezeStats(_EPROCESS *Process, _PS_DEEP_FREEZE_STATS *DeepFreezeStats){
  _ETHREAD *CurrentThread; 
  _EX_PUSH_LOCK *p_ProcessLock; 
  volatile unsigned __int64 InterruptTimeBias; 
  unsigned __int64 FreezeUnbiasedTime; 
  unsigned __int64 v8; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  p_ProcessLock = &Process->ProcessLock;
  ExAcquirePushLockSharedEx(&Process->ProcessLock, 0i64);
  DeepFreezeStats->TotalFrozenUnbiasedTime = Process->TotalUnbiasedFrozenTime;
  DeepFreezeStats->FreezeUnbiasedTime = Process->LastFreezeInterruptTime;
  do
  {
    InterruptTimeBias = KUSER_SHARED_DATA.InterruptTimeBias;
    DeepFreezeStats->CurrentTime = *(_QWORD *)&KUSER_SHARED_DATA.InterruptTime.LowPart;
  }
  while( InterruptTimeBias != KUSER_SHARED_DATA.InterruptTimeBias );
  if( _InterlockedCompareExchange64(&p_ProcessLock->_bf_0, 0i64, 17i64) != 17 )
    ExfReleasePushLockShared(p_ProcessLock);
  KeAbPostRelease(p_ProcessLock);
  KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
  FreezeUnbiasedTime = DeepFreezeStats->FreezeUnbiasedTime;
  v8 = DeepFreezeStats->CurrentTime - InterruptTimeBias;
  DeepFreezeStats->CurrentUnbiasedTime = v8;
  if( FreezeUnbiasedTime )
    DeepFreezeStats->TotalFrozenUnbiasedTime += v8 - FreezeUnbiasedTime;
}

Referenced by:

NtQueryInformationProcess
PfpPrivSourceEnum
PsSetProcessTelemetryAppState