PsQueryTotalCycleTimeProcess

__int64 __fastcall PsQueryTotalCycleTimeProcess(__int64 a1, unsigned __int64 *a2){
  _KTHREAD *CurrentThread; 
  INT64 *v5; 
  __int64 v6; 
  _QWORD **v7; 
  _QWORD *v8; 
  __int64 v9; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  KeFlushProcessWriteBuffers(1u);
  KeUpdateTotalCyclesCurrentThread((_KTHREAD *)CurrentThread, a2);
  --*((_WORD *)CurrentThread + 242);
  v5 = (INT64 *)(a1 + 2144);
  ExAcquirePushLockSharedEx(a1 + 2144, 0i64);
  v6 = *(_QWORD *)(a1 + 864);
  v7 = (_QWORD **)(a1 + 1504);
  v8 = *v7;
  while( v8 != v7 )
  {
    v9 = *(v8 - 148);
    v8 = (_QWORD *)*v8;
    v6 += v9;
  }
  if( _InterlockedCompareExchange64(v5, 0i64, 17i64) != 17 )
    ExfReleasePushLockShared(v5);
  KeAbPostRelease(v5);
  KeLeaveCriticalRegionThread((__int64)CurrentThread);
  return v6;
}

Referenced by: