PsQueryStatisticsProcess

VOID __stdcall PsQueryStatisticsProcess(_EPROCESS *Process, _EPROCESS_VALUES *Values){
  unsigned int KernelTime; 
  unsigned int UserTime; 
  unsigned int ReadyTime; 
  unsigned __int64 KernelWaitTime; 
  unsigned __int64 UserWaitTime; 
  _EPROCESS *i; 
  __int64 v10; 
  _KTHREAD_VALUES Valuesa[2]; 
  __int128 v12; 
  _EX_PUSH_LOCK *Lock; 
  _KTHREAD *Thread; 

  Thread = (_ETHREAD *)KeGetCurrentThread();
  *(_OWORD *)&Valuesa[0].WaitTime = 0i64;
  --Thread->Tcb.KernelApcDisable;
  v12 = 0i64;
  Lock = &Process->ThreadListLock;
  ExAcquirePushLockSharedEx(&Process->ThreadListLock, 0i64);
  KernelTime = Process->Pcb.KernelTime;
  UserTime = Process->Pcb.UserTime;
  ReadyTime = Process->Pcb.ReadyTime;
  KernelWaitTime = Process->Pcb.KernelWaitTime;
  UserWaitTime = Process->Pcb.UserWaitTime;
  Values->CycleTime = Process->Pcb.CycleTime;
  Values->ContextSwitches = Process->Pcb.ContextSwitches;
  Values->ReadOperationCount = Process->ReadOperationCount.QuadPart;
  Values->WriteOperationCount = Process->WriteOperationCount.QuadPart;
  Values->OtherOperationCount = Process->OtherOperationCount.QuadPart;
  Values->ReadTransferCount = Process->ReadTransferCount.QuadPart;
  Values->WriteTransferCount = Process->WriteTransferCount.QuadPart;
  Values->OtherTransferCount = Process->OtherTransferCount.QuadPart;
  for( i = (_EPROCESS *)Process->ThreadListHead.Flink;
        i != (_EPROCESS *)&Process->ThreadListHead;
        UserWaitTime += *((_QWORD *)&v12 + 1) )
  {
    KernelTime += HIDWORD(i[-1].VadHint);
    UserTime += HIDWORD(i[-1].TimerResolutionStackRecord);
    KeQueryValuesThread((_KTHREAD *)&i[-1].Session, Valuesa);
    Values->CycleTime += (unsigned __int64)i[-1].ImageFilePointer;
    Values->ContextSwitches += HIDWORD(i[-1].Vm.Instance.AgeDistribution[0]);
    Values->ReadOperationCount += i[-1].EnclaveLock._bf_0;
    Values->WriteOperationCount += *(_QWORD *)&i[-1].HighPriorityFaultsAllowed;
    Values->OtherOperationCount += (__int64)i[-1].EnergyContext;
    Values->ReadTransferCount += (__int64)i[-1].VmContext;
    Values->WriteTransferCount += i[-1].SequenceNumber;
    Values->OtherTransferCount += i[-1].CreateInterruptTime;
    i = *(_EPROCESS **)i->Pcb.gap0;
    ReadyTime += *(_DWORD *)&Valuesa[0].State;
    KernelWaitTime += v12;
  }
  if( _InterlockedCompareExchange64(&Lock->_bf_0, 0i64, 17i64) != 17 )
    ExfReleasePushLockShared(Lock);
  KeAbPostRelease(Lock);
  KeLeaveCriticalRegionThread(&Thread->Tcb);
  v10 = (unsigned int)KeMaximumIncrement;
  Values->KernelTime = (unsigned int)KeMaximumIncrement * (unsigned __int64)KernelTime;
  Values->UserTime = v10 * UserTime;
  Values->ReadyTime = v10 * ReadyTime;
  Values->KernelWaitTime = KernelWaitTime * (unsigned int)v10;
  Values->UserWaitTime = UserWaitTime * v10;
}

Referenced by: