PspQueryJobHierarchyAccountingInformation
void __fastcall PspQueryJobHierarchyAccountingInformation(char *Object, __int64 a2){
_ETHREAD *CurrentThread;
BOOL v5;
int v6;
_EJOB **v7;
__int64 v8;
__int64 v9;
__int64 v10;
INT64 v11;
_OWORD *v12;
__int64 v13;
INT64 *v14;
__int128 v15;
__int128 v16;
__int128 v17;
__int128 v18;
__int128 v19;
__int128 v20;
__int128 v21;
__int64 v22;
_EJOB *ExceptionList[2];
INT64 result[13];
__int64 v25;
__int64 v26;
__int64 v27;
__int64 v28;
__int64 v29;
__int64 v30;
__int64 v31;
__int64 v32;
__int64 v33;
__int64 v34;
__int64 v35;
__int64 v36;
__int64 v37;
__int64 v38;
__int64 v39;
__int64 v40;
__int64 v41;
__int64 v42;
int v43;
INT64 v44[54];
ExceptionList[0] = 0i64;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
memset((INT64)result, 0i64);
PspLockRootJobShared((__int64)Object, (__int64)CurrentThread, ExceptionList);
v6 = 0;
v7 = ExceptionList;
while( Object != (char *)*v7 )
{
++v6;
++v7;
if( v6 )
{
LOBYTE(v5) = 1;
ExAcquireResourceSharedLite((PERESOURCE)(Object + 56), v5);
break;
}
}
PspEnumJobsAndProcessesInJobHierarchy(
Object,
0i64,
0i64,
(__int64(__fastcall *)(_QWORD *, __int64))PspQueryProcessAccountingInformationCallback,
(__int64)result,
1);
v8 = v26;
*(_QWORD *)a2 = v26 + *((_QWORD *)Object + 20);
*(_QWORD *)(a2 + 16) = *((_QWORD *)Object + 23) + v8;
v9 = v25;
*(_QWORD *)(a2 + 8) = v25 + *((_QWORD *)Object + 21);
*(_QWORD *)(a2 + 24) = *((_QWORD *)Object + 24) + v9;
*(_DWORD *)(a2 + 32) = v43 + *((_DWORD *)Object + 52);
*(_DWORD *)(a2 + 36) = *((_DWORD *)Object + 53);
*(_DWORD *)(a2 + 40) = *((_DWORD *)Object + 54);
*(_DWORD *)(a2 + 44) = *((_DWORD *)Object + 55);
*(_QWORD *)(a2 + 48) = v30 + *((_QWORD *)Object + 61);
*(_QWORD *)(a2 + 56) = v31 + *((_QWORD *)Object + 62);
*(_QWORD *)(a2 + 64) = v32 + *((_QWORD *)Object + 63);
*(_QWORD *)(a2 + 72) = v33 + *((_QWORD *)Object + 64);
*(_QWORD *)(a2 + 80) = v34 + *((_QWORD *)Object + 65);
*(_QWORD *)(a2 + 88) = v35 + *((_QWORD *)Object + 66);
*(_QWORD *)(a2 + 96) = v38 + *((_QWORD *)Object + 67);
*(_QWORD *)(a2 + 104) = v39 + *((_QWORD *)Object + 68);
*(_QWORD *)(a2 + 112) = v40 + *((_QWORD *)Object + 69);
*(_QWORD *)(a2 + 120) = v41 + *((_QWORD *)Object + 70);
*(_QWORD *)(a2 + 128) = v42 + *((_QWORD *)Object + 71);
*(_QWORD *)(a2 + 136) = v29 + *((_QWORD *)Object + 25);
*(_QWORD *)(a2 + 144) = v28 + *((_QWORD *)Object + 22);
*(_QWORD *)(a2 + 152) = v27 + *((_QWORD *)Object + 128);
*(_QWORD *)(a2 + 432) = v36 + *((_QWORD *)Object + 198);
*(_QWORD *)(a2 + 440) = v37 + *((_QWORD *)Object + 199);
v10 = *((_QWORD *)Object + 126);
if( v10 )
{
KeQuerySchedulingGroupReadyTime((_KSCHEDULING_GROUP *)(v10 + 128));
*(_QWORD *)(a2 + 152) += v22;
}
v11 = *((_QWORD *)Object + 166);
v12 = (_OWORD *)(a2 + 160);
if( v11 )
{
PsAddProcessEnergyValues((INT64)v44, v11);
v13 = 2i64;
v14 = v44;
do
{
v15 = *((_OWORD *)v14 + 1);
*v12 = *(_OWORD *)v14;
v16 = *((_OWORD *)v14 + 2);
v12[1] = v15;
v17 = *((_OWORD *)v14 + 3);
v12[2] = v16;
v18 = *((_OWORD *)v14 + 4);
v12[3] = v17;
v19 = *((_OWORD *)v14 + 5);
v12[4] = v18;
v20 = *((_OWORD *)v14 + 6);
v12[5] = v19;
v21 = *((_OWORD *)v14 + 7);
v14 += 16;
v12[6] = v20;
v12 += 8;
*(v12 - 1) = v21;
--v13;
}
while( v13 );
*v12 = *(_OWORD *)v14;
}
else
{
memset((INT64)v12, 0i64);
}
PspUnlockJobConditionally((_EJOB *)Object, ExceptionList);
PspUnlockJob((__int64)ExceptionList[0], (__int64)CurrentThread);
}Referenced by:
NtQueryInformationJobObject