PsQueryRuntimeProcess

UINT64 __stdcall PsQueryRuntimeProcess(_EPROCESS *Process, UINT64 *UserTime){
  _ETHREAD *CurrentThread; 
  _EX_PUSH_LOCK *p_ThreadListLock; 
  unsigned int KernelTime; 
  unsigned int v7; 
  _LIST_ENTRY *p_ThreadListHead; 
  _LIST_ENTRY *i; 
  UINT64 result; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  p_ThreadListLock = &Process->ThreadListLock;
  ExAcquirePushLockSharedEx(&Process->ThreadListLock, 0i64);
  KernelTime = Process->Pcb.KernelTime;
  v7 = Process->Pcb.UserTime;
  p_ThreadListHead = &Process->ThreadListHead;
  for( i = p_ThreadListHead->Flink; i != p_ThreadListHead; i = i->Flink )
  {
    KernelTime += HIDWORD(i[-38].Flink);
    v7 += HIDWORD(i[-33].Flink);
  }
  if( _InterlockedCompareExchange64(&p_ThreadListLock->_bf_0, 0i64, 17i64) != 17 )
    ExfReleasePushLockShared(p_ThreadListLock);
  KeAbPostRelease(p_ThreadListLock);
  KeLeaveCriticalRegionThread(&CurrentThread->Tcb);
  result = KernelTime;
  *(_DWORD *)UserTime = v7;
  return result;
}

Referenced by: