PspQueryRateControlHistory

void __fastcall PspQueryRateControlHistory(__int64 a1, int a2, char a3, _DWORD *a4, int a5){
  char v6; 
  __int64 v9; 
  __int64 *v10; 
  __int64 v11; 
  unsigned int v12; 
  unsigned int v13; 
  __int64 v14; 
  int v15; 
  int v16; 
  unsigned int v17; 
  void *v18; 
  unsigned int v19; 
  unsigned int v20; 
  __int64 *v21; 
  ULONG v22; 
  VOID *PoolWithTag; 
  __int64 v24; 
  _DWORD a3a[3]; 
  __int64 a2a; 
  struct _RTL_BITMAP BitMapHeader; 
  INT64 v29[2]; 
  __int128 v30; 
  a3a[0] = 0;
  a3a[1] = 0;
  v6 = a3;
  a2a = 0i64;
  *a4 = 0;
  *(_OWORD *)v29 = 0i64;
  v30 = 0i64;
  BitMapHeader = 0i64;
  if( a5 == 1 )
  {
    v11 = a1 + 1360;
  }
  else
  {
    v9 = a1 + 1312;
    v10 = (__int64 *)(a1 + 1008);
    if( !a5 )
      v10 = (__int64 *)v9;
    v11 = *v10;
  }
  if( v11 )
  {
    if( a5 )
    {
      if( a5 == 1 )
      {
        if( (int)PspJobIoRateQueryHistory(a1, &a2a, a3a, &a3a[1]) < 0 )
          return;
      }
      else
      {
        KeQuerySchedulingGroupHistory(
          (_KSCHEDULING_GROUP *)(v11 + 128),
          (UINT64 *)&a2a,
          (UINT64 *)a3a,
          (UINT64 *)&a3a[1]);
      }
      v12 = a3a[0];
      v13 = a3a[1];
      v14 = a2a;
    }
    else
    {
      LODWORD(v29[1]) = 1;
      v29[0] = *(_QWORD *)(v11 + 56);
      if( (int)PspNetRateControlDispatch((INT64)v29) < 0 )
        return;
      v14 = v30;
      v12 = DWORD2(v30);
      v13 = HIDWORD(v30);
    }
    v15 = a2 - 2;
    if( v15 )
    {
      if( v15 == 1 )
        v16 = 600000;
      else
        v16 = 10000;
    }
    else
    {
      v16 = 60000;
    }
    v17 = (v12 + v16 - 1) / v12;
    v18 = *(void **)(v11 + 24);
    v19 = v17;
    v20 = (v17 + 7) >> 3;
    if( v20 < 8 )
      v20 = 8;
    if( *(_QWORD *)(v11 + 24) && *(_QWORD *)(v11 + 32) < (unsigned __int64)v20 )
    {
      ExFreePoolWithTag(v18, 0x624A7350u);
      *(_QWORD *)(v11 + 24) = 0i64;
      *(_QWORD *)(v11 + 32) = 0i64;
      v18 = 0i64;
    }
    if( v18 )
    {
      if( v13 >= 8 * v20 )
      {
        memset((INT64)v18, 0i64);
      }
      else if( v13 )
      {
        RtlCopyBitMap((RTL_BITMAP *)(v11 + 8), (RTL_BITMAP *)(v11 + 8), v13);
        RtlClearBits((RTL_BITMAP *)(v11 + 8), 0i64, v13);
      }
    }
    else
    {
      PoolWithTag = ExAllocatePoolWithTag(PagedPool, v20, 0x624A7350ui64);
      *(_QWORD *)(v11 + 24) = PoolWithTag;
      if( !PoolWithTag )
        return;
      memset((INT64)PoolWithTag, 0i64);
      v24 = *(_QWORD *)(v11 + 24);
      *(_DWORD *)(v11 + 8) = 8 * v20;
      *(_QWORD *)(v11 + 16) = v24;
      *(_QWORD *)(v11 + 32) = v20;
      v6 = a3;
    }
    v21 = *(__int64 **)(v11 + 24);
    BitMapHeader.SizeOfBitMap = v19;
    if( v13 > 0x40 )
      LOBYTE(v13) = 64;
    *v21 = v14 & ((1i64 << v13) - 1) | *v21 & ~((1i64 << v13) - 1);
    BitMapHeader.Buffer = *(unsigned int **)(v11 + 24);
    v22 = 100 * RtlNumberOfSetBits(&BitMapHeader) / v19;
    if( v22 >= 0x3C )
    {
      *a4 = 3;
    }
    else if( v22 >= 0x28 )
    {
      *a4 = 2;
    }
    else if( v22 >= 0x14 )
    {
      *a4 = 1;
    }
    if( v6 )
      memset(*(_QWORD *)(v11 + 24), 0i64);
  }
}

Referenced by:

NtQueryInformationJobObject
PspEnforceLimitsJobPreCallback