PspFoldProcessAccountingIntoJob

VOID __stdcall PspFoldProcessAccountingIntoJob(_EJOB *Job, _EPROCESS *Process, _EPROCESS_VALUES *Values){
  unsigned __int64 UserTime; 
  unsigned __int64 KernelTime; 
  __int64 v8; 
  _QWORD *v9; 
  _PROCESS_DISK_COUNTERS *DiskCounters; 
  unsigned __int64 CommitChargePeak; 
  unsigned __int64 v12; 
  unsigned __int64 v13; 
  char EnergyValues[432]; 

  memset(EnergyValues, 0i64, sizeof(EnergyValues));
  UserTime = Values->UserTime;
  KernelTime = Values->KernelTime;
  *((_QWORD *)Job + 128) += Values->ReadyTime;
  *((_QWORD *)Job + 22) += Values->CycleTime;
  *((_QWORD *)Job + 20) += UserTime;
  *((_QWORD *)Job + 21) += KernelTime;
  *((_QWORD *)Job + 23) += UserTime;
  v8 = 6i64;
  *((_QWORD *)Job + 24) += KernelTime;
  v9 = (_QWORD *)((char *)Job + 488);
  *((_QWORD *)Job + 25) += Values->ContextSwitches;
  do
  {
    *v9 += *(_QWORD *)((char *)v9 + (char *)Values - (char *)Job - 448);
    ++v9;
    --v8;
  }
  while( v8 );
  *((_DWORD *)Job + 52) += Process->Vm.Instance.PageFaultCount;
  *((_QWORD *)Job + 198) += Values->KernelWaitTime;
  *((_QWORD *)Job + 199) += Values->UserWaitTime;
  DiskCounters = Process->DiskCounters;
  if( DiskCounters )
  {
    *((_QWORD *)Job + 67) += DiskCounters->BytesRead;
    *((_QWORD *)Job + 68) += DiskCounters->BytesWritten;
    *((_QWORD *)Job + 69) += DiskCounters->ReadOperationCount;
    *((_QWORD *)Job + 70) += DiskCounters->WriteOperationCount;
    *((_QWORD *)Job + 71) += DiskCounters->FlushOperationCount;
  }
  CommitChargePeak = Process->CommitChargePeak;
  if( CommitChargePeak > *((_QWORD *)Job + 75) )
  {
    _m_prefetchw((char *)Job + 600);
    v12 = *((_QWORD *)Job + 75);
    do
    {
      v13 = v12;
      v12 = _InterlockedCompareExchange64((volatile signed __int64 *)Job + 75, CommitChargePeak, v12);
    }
    while( v12 != v13 && CommitChargePeak > v12 );
  }
  if( PoEnergyEstimationEnabled() )
  {
    PsQueryProcessEnergyValues(Process, (_PROCESS_ENERGY_VALUES *)EnergyValues);
    PsAddProcessEnergyValues(*((_QWORD *)Job + 166), (INT64)EnergyValues);
  }
}

Referenced by:

PspRemoveProcessFromJobChain