KeQueryAffinityProcess

VOID __stdcall KeQueryAffinityProcess(_EPROCESS *Process, _KAFFINITY_EX *Affinity, UINT64 *GroupMask, UINT16 *NodeList){
  unsigned __int8 CurrentIrql; 
  CurrentIrql = KeGetCurrentIrql();
  __writecr8(2ui64);
  ExAcquireSpinLockSharedAtDpcLevel((PEX_SPIN_LOCK)Process + 16);
  *(_OWORD *)&Affinity->Count = *((_OWORD *)Process + 5);
  *(_OWORD *)&Affinity->Bitmap[1] = *((_OWORD *)Process + 6);
  *(_OWORD *)&Affinity->Bitmap[3] = *((_OWORD *)Process + 7);
  *(_OWORD *)&Affinity->Bitmap[5] = *((_OWORD *)Process + 8);
  *(_OWORD *)&Affinity->Bitmap[7] = *((_OWORD *)Process + 9);
  *(_OWORD *)&Affinity->Bitmap[9] = *((_OWORD *)Process + 10);
  *(_OWORD *)&Affinity->Bitmap[11] = *((_OWORD *)Process + 11);
  Affinity = (_KAFFINITY_EX *)((char *)Affinity + 128);
  *(_OWORD *)&Affinity[-1].Bitmap[18] = *((_OWORD *)Process + 12);
  *(_OWORD *)&Affinity->Count = *((_OWORD *)Process + 13);
  *(_OWORD *)&Affinity->Bitmap[1] = *((_OWORD *)Process + 14);
  Affinity->Bitmap[3] = *((_QWORD *)Process + 30);
  if( GroupMask )
    *(_DWORD *)GroupMask = *((_DWORD *)Process + 159);
  if( NodeList )
  {
    *(_OWORD *)NodeList = *(_OWORD *)((char *)Process + 772);
    *((_OWORD *)NodeList + 1) = *(_OWORD *)((char *)Process + 788);
    *((_QWORD *)NodeList + 4) = *(_QWORD *)((char *)Process + 804);
  }
  ExReleaseSpinLockSharedFromDpcLevel((PEX_SPIN_LOCK)Process + 16);
  __writecr8(CurrentIrql);
}

Referenced by: