PsQueryCpuQuotaInformation

NTSTATUS __stdcall PsQueryCpuQuotaInformation(
        PVOID SystemInformation,
        UINT64 SystemInformationLength,
        INT8 PreviousMode,
        UINT64 *ReturnLength){
  UINT64 v6; 
  unsigned int v9; 
  __int64 v10; 
  void *i; 
  INT64 v12; 
  void *v13; 
  INT64 v14; 
  unsigned __int16 *SessionSchedulingGroupByProcess; 
  v6 = (unsigned int)SystemInformationLength;
  if( !PsCpuFairShareEnabled )
    return -1073741399;
  if( PreviousMode && !SeSinglePrivilegeCheck(*(_QWORD *)&SeIncreaseQuotaPrivilege, PreviousMode) )
    return -1073741727;
  if( (_DWORD)v6 )
  {
    if( (((_BYTE)v6 - 4) & 7) != 0 || (unsigned int)v6 < 4 )
      return -1073741820;
    v9 = (unsigned int)(v6 - 4) >> 3;
    if( PreviousMode == 1 )
      ProbeForWrite(SystemInformation, v6, 4ui64);
  }
  else
  {
    v9 = 0;
    SystemInformation = 0i64;
  }
  v10 = 0i64;
  for( i = 0i64; ; i = v13 )
  {
    LODWORD(v12) = MiGetNextSession(i, SystemInformationLength);
    v13 = (void *)v12;
    if( !v12 )
      break;
    SessionSchedulingGroupByProcess = (unsigned __int16 *)MmGetSessionSchedulingGroupByProcess(v12);
    if( SessionSchedulingGroupByProcess )
    {
      if( (unsigned int)v10 < v9 )
      {
        *((_DWORD *)SystemInformation + 2 * v10 + 1) = MmGetSessionIdEx(v14);
        *((_DWORD *)SystemInformation + 2 * v10 + 2) = *SessionSchedulingGroupByProcess;
      }
      v10 = (unsigned int)(v10 + 1);
    }
  }
  if( SystemInformation )
    *(_DWORD *)SystemInformation = v10;
  *(_DWORD *)ReturnLength = 8 * v10 + 4;
  return v9 < (unsigned int)v10 ? 0xC0000023 : 0;
}

Referenced by: