PsQueryTotalCycleTimeProcess

NTSTATUS __fastcall PsQueryTotalCycleTimeProcess(INT64 a1, UINT64 *a2){
  _ETHREAD *CurrentThread; 
  _EX_PUSH_LOCK *v5; 
  __int64 v6; 
  _QWORD **v7; 
  _QWORD *v8; 
  __int64 v9; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  KeFlushProcessWriteBuffers(1u);
  KeUpdateTotalCyclesCurrentThread(&CurrentThread->Tcb, a2);
  --CurrentThread->Tcb.KernelApcDisable;
  v5 = (_EX_PUSH_LOCK *)(a1 + 2144);
  ExAcquirePushLockSharedEx((_EX_PUSH_LOCK *)(a1 + 2144), 0i64);
  v6 = *(_QWORD *)(a1 + 864);
  v7 = (_QWORD **)(a1 + 1504);
  v8 = *v7;
  while( v8 != v7 )
  {
    v9 = *(v8 - 148);
    v8 = (_QWORD *)*v8;
    LODWORD(v6) = v9 + v6;
  }
  if( _InterlockedCompareExchange64(&v5->_bf_0, 0i64, 17i64) != 17 )
    ExfReleasePushLockShared(v5);
  KeAbPostRelease(v5);
  KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
  return v6;
}

Referenced by: