PspQueryJobHierarchyAccountingInformation

void __fastcall PspQueryJobHierarchyAccountingInformation(char *Object, __int64 a2){
  _ETHREAD *CurrentThread; 
  BOOL v5; 
  int v6; 
  _EJOB **v7; 
  __int64 v8; 
  __int64 v9; 
  __int64 v10; 
  INT64 v11; 
  _OWORD *v12; 
  __int64 v13; 
  INT64 *v14; 
  __int128 v15; 
  __int128 v16; 
  __int128 v17; 
  __int128 v18; 
  __int128 v19; 
  __int128 v20; 
  __int128 v21; 
  __int64 v22; 
  _EJOB *ExceptionList[2]; 
  INT64 result[13]; 
  __int64 v25; 
  __int64 v26; 
  __int64 v27; 
  __int64 v28; 
  __int64 v29; 
  __int64 v30; 
  __int64 v31; 
  __int64 v32; 
  __int64 v33; 
  __int64 v34; 
  __int64 v35; 
  __int64 v36; 
  __int64 v37; 
  __int64 v38; 
  __int64 v39; 
  __int64 v40; 
  __int64 v41; 
  __int64 v42; 
  int v43; 
  INT64 v44[54]; 
  ExceptionList[0] = 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  memset((INT64)result, 0i64);
  PspLockRootJobShared((__int64)Object, (__int64)CurrentThread, ExceptionList);
  v6 = 0;
  v7 = ExceptionList;
  while( Object != (char *)*v7 )
  {
    ++v6;
    ++v7;
    if( v6 )
    {
      LOBYTE(v5) = 1;
      ExAcquireResourceSharedLite((PERESOURCE)(Object + 56), v5);
      break;
    }
  }
  PspEnumJobsAndProcessesInJobHierarchy(
    Object,
    0i64,
    0i64,
    (__int64(__fastcall *)(_QWORD *, __int64))PspQueryProcessAccountingInformationCallback,
    (__int64)result,
    1);
  v8 = v26;
  *(_QWORD *)a2 = v26 + *((_QWORD *)Object + 20);
  *(_QWORD *)(a2 + 16) = *((_QWORD *)Object + 23) + v8;
  v9 = v25;
  *(_QWORD *)(a2 + 8) = v25 + *((_QWORD *)Object + 21);
  *(_QWORD *)(a2 + 24) = *((_QWORD *)Object + 24) + v9;
  *(_DWORD *)(a2 + 32) = v43 + *((_DWORD *)Object + 52);
  *(_DWORD *)(a2 + 36) = *((_DWORD *)Object + 53);
  *(_DWORD *)(a2 + 40) = *((_DWORD *)Object + 54);
  *(_DWORD *)(a2 + 44) = *((_DWORD *)Object + 55);
  *(_QWORD *)(a2 + 48) = v30 + *((_QWORD *)Object + 61);
  *(_QWORD *)(a2 + 56) = v31 + *((_QWORD *)Object + 62);
  *(_QWORD *)(a2 + 64) = v32 + *((_QWORD *)Object + 63);
  *(_QWORD *)(a2 + 72) = v33 + *((_QWORD *)Object + 64);
  *(_QWORD *)(a2 + 80) = v34 + *((_QWORD *)Object + 65);
  *(_QWORD *)(a2 + 88) = v35 + *((_QWORD *)Object + 66);
  *(_QWORD *)(a2 + 96) = v38 + *((_QWORD *)Object + 67);
  *(_QWORD *)(a2 + 104) = v39 + *((_QWORD *)Object + 68);
  *(_QWORD *)(a2 + 112) = v40 + *((_QWORD *)Object + 69);
  *(_QWORD *)(a2 + 120) = v41 + *((_QWORD *)Object + 70);
  *(_QWORD *)(a2 + 128) = v42 + *((_QWORD *)Object + 71);
  *(_QWORD *)(a2 + 136) = v29 + *((_QWORD *)Object + 25);
  *(_QWORD *)(a2 + 144) = v28 + *((_QWORD *)Object + 22);
  *(_QWORD *)(a2 + 152) = v27 + *((_QWORD *)Object + 128);
  *(_QWORD *)(a2 + 432) = v36 + *((_QWORD *)Object + 198);
  *(_QWORD *)(a2 + 440) = v37 + *((_QWORD *)Object + 199);
  v10 = *((_QWORD *)Object + 126);
  if( v10 )
  {
    KeQuerySchedulingGroupReadyTime((_KSCHEDULING_GROUP *)(v10 + 128));
    *(_QWORD *)(a2 + 152) += v22;
  }
  v11 = *((_QWORD *)Object + 166);
  v12 = (_OWORD *)(a2 + 160);
  if( v11 )
  {
    PsAddProcessEnergyValues((INT64)v44, v11);
    v13 = 2i64;
    v14 = v44;
    do
    {
      v15 = *((_OWORD *)v14 + 1);
      *v12 = *(_OWORD *)v14;
      v16 = *((_OWORD *)v14 + 2);
      v12[1] = v15;
      v17 = *((_OWORD *)v14 + 3);
      v12[2] = v16;
      v18 = *((_OWORD *)v14 + 4);
      v12[3] = v17;
      v19 = *((_OWORD *)v14 + 5);
      v12[4] = v18;
      v20 = *((_OWORD *)v14 + 6);
      v12[5] = v19;
      v21 = *((_OWORD *)v14 + 7);
      v14 += 16;
      v12[6] = v20;
      v12 += 8;
      *(v12 - 1) = v21;
      --v13;
    }
    while( v13 );
    *v12 = *(_OWORD *)v14;
  }
  else
  {
    memset((INT64)v12, 0i64);
  }
  PspUnlockJobConditionally((_EJOB *)Object, ExceptionList);
  PspUnlockJob((__int64)ExceptionList[0], (__int64)CurrentThread);
}

Referenced by:

NtQueryInformationJobObject