PsEnumProcesses

NTSTATUS __fastcall PsEnumProcesses(INT64 a1, INT64 *CallBack, _EPROCESS *a3, VOID *a4, VOID *Context){
  _EPROCESS *v7; 
  _LIST_ENTRY *NextProcess; 
  _LIST_ENTRY *v9; 
  NTSTATUS v10; 

  v7 = 0i64;
  while( 1 )
  {
    NextProcess = PsGetNextProcess(v7);
    v9 = NextProcess;
    if( !NextProcess )
      break;
    v10 = ((__int64(__fastcall *)(_LIST_ENTRY *, INT64 *))a1)(NextProcess, CallBack);
    v7 = (_EPROCESS *)v9;
    if( v10 < 0 )
    {
      ObfDereferenceObjectWithTag(v9, 0x6E457350ui64);
      return v10;
    }
  }
  return 0;
}

Referenced by: