PsQueryStatisticsProcess

VOID __fastcall PsQueryStatisticsProcess(_EPROCESS *Process, _EPROCESS_VALUES *Values){
  unsigned int v4; 
  unsigned int v5; 
  unsigned int v6; 
  __int64 v7; 
  __int64 v8; 
  _EPROCESS *i; 
  __int64 v10; 
  __int128 v11; 
  __int128 v12; 
  INT64 *Lock; 
  _ETHREAD *CurrentThread; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v11 = 0i64;
  --*((_WORD *)CurrentThread + 242);
  v12 = 0i64;
  Lock = (INT64 *)((char *)Process + 2144);
  ExAcquirePushLockSharedEx((UINT64)Process + 2144, 0i64);
  v4 = *((_DWORD *)Process + 223);
  v5 = *((_DWORD *)Process + 224);
  v6 = *((_DWORD *)Process + 225);
  v7 = *((_QWORD *)Process + 125);
  v8 = *((_QWORD *)Process + 126);
  Values->CycleTime = *((_QWORD *)Process + 108);
  Values->ContextSwitches = *((_QWORD *)Process + 109);
  Values->ReadOperationCount = *((_QWORD *)Process + 194);
  Values->WriteOperationCount = *((_QWORD *)Process + 195);
  Values->OtherOperationCount = *((_QWORD *)Process + 196);
  Values->ReadTransferCount = *((_QWORD *)Process + 197);
  Values->WriteTransferCount = *((_QWORD *)Process + 198);
  Values->OtherTransferCount = *((_QWORD *)Process + 199);
  for( i = (_EPROCESS *)*((_QWORD *)Process + 188); i != (_EPROCESS *)((char *)Process + 1504); v8 += *((_QWORD *)&v12 + 1) )
  {
    v4 += *((_DWORD *)i - 151);
    v5 += *((_DWORD *)i - 131);
    KeQueryValuesThread((__int64)i - 1256, (__int64)&v11);
    Values->CycleTime += *((_QWORD *)i - 148);
    Values->ContextSwitches += *((unsigned int *)i - 229);
    Values->ReadOperationCount += *((_QWORD *)i - 45);
    Values->WriteOperationCount += *((_QWORD *)i - 44);
    Values->OtherOperationCount += *((_QWORD *)i - 43);
    Values->ReadTransferCount += *((_QWORD *)i - 42);
    Values->WriteTransferCount += *((_QWORD *)i - 41);
    Values->OtherTransferCount += *((_QWORD *)i - 40);
    i = *(_EPROCESS **)i;
    v6 += DWORD1(v11);
    v7 += v12;
  }
  if( _InterlockedCompareExchange64(Lock, 0i64, 17i64) != 17 )
    ExfReleasePushLockShared(Lock);
  KeAbPostRelease(Lock);
  KeLeaveCriticalRegionThread((__int64)CurrentThread);
  v10 = KeMaximumIncrement;
  Values->KernelTime = KeMaximumIncrement * (unsigned __int64)v4;
  Values->UserTime = v10 * v5;
  Values->ReadyTime = v10 * v6;
  Values->KernelWaitTime = v7 * (unsigned int)v10;
  Values->UserWaitTime = v8 * v10;
}

Referenced by: