ExQueryProcessHandleInformation

INT64 __fastcall ExQueryProcessHandleInformation(UINT64 *a1, _QWORD *a2, INT64 a3, INT64 *a4){
  void **v5; 
  unsigned int v6; 
  int v7; 
  unsigned int v8; 
  _HANDLE_TABLE_ENTRY *v9; 
  _HANDLE_TABLE_ENTRY *NextHandleTableEntry; 
  unsigned int v11; 
  _HANDLE_TABLE_ENTRY *v12; 
  __int64 *v13; 
  $97D278A0CD42BCAC54E6F6C01CA8A55F v14; 
  int v15; 
  int v16; 
  int v17; 
  __int64 v18; 
  __int64 v19; 
  int v20; 
  int v22[8]; 
  int v23; 
  int v24; 
  _EXHANDLE pHandle; 
  unsigned __int64 v26; 
  __int64 v27; 
  __int64 v28; 
  _EX_PUSH_LOCK *v29; 
  int v31; 
  v29 = (_EX_PUSH_LOCK *)a1;
  pHandle = 0i64;
  v5 = (void **)(a2 + 2);
  v26 = (unsigned int)(a3 - 16) / 0x28ui64;
  v6 = 0;
  v7 = 16;
  v8 = 0;
  v9 = 0i64;
  while( 1 )
  {
    NextHandleTableEntry = ExpGetNextHandleTableEntry((_HANDLE_TABLE *)a1, v9, &pHandle);
    v12 = NextHandleTableEntry;
    if( !NextHandleTableEntry )
      break;
    if( v6 >= v11 )
    {
      if( (*(_WORD *)&pHandle.0 & 0x3FC) != 0 && NextHandleTableEntry->LowValue )
      {
        v7 += 40;
        v8 = -1073741820;
      }
    }
    else if( ExLockHandleTableEntry((__int64)v29, &NextHandleTableEntry->LowValue) )
    {
      v13 = (__int64 *)((v12->LowValue >> 16) & 0xFFFFFFFFFFFFFFF0ui64);
      v14 = v12->LeafHandleValue.0;
      v15 = (v12->LowValue >> 17) & 7 | 8;
      if( (*(_DWORD *)&v14 & 0x2000000) == 0 )
        LOBYTE(v15) = (v12->LowValue >> 17) & 7;
      v16 = v15 & 7;
      v31 = v16;
      v17 = *(unsigned __int8 *)(ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ *(unsigned __int8 *)(((v12->LowValue >> 16) & 0xFFFFFFFFFFFFFFF0ui64) + 0x18) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)(WORD1(v12->LowValue) & 0xFFF0) >> 8)]
                               + 40);
      v24 = v17;
      v18 = *v13;
      v27 = *v13;
      v19 = v13[1];
      v28 = v19;
      v20 = *(_DWORD *)&v14 & 0x1FFFFFF;
      v23 = v20;
      _InterlockedExchangeAdd64(&v12->VolatileLowValue, 1ui64);
      _InterlockedOr(v22, 0);
      if( v29[6].Value )
      {
        ExfUnblockPushLock(v29 + 6, 0i64);
        v16 = v31;
        v20 = v23;
        v17 = v24;
        v18 = v27;
        v19 = v28;
      }
      v7 += 40;
      ++v6;
      *v5 = pHandle.GenericHandleOverlay;
      v5[1] = (void *)v19;
      v5[2] = (void *)v18;
      *((_DWORD *)v5 + 6) = v20;
      *((_DWORD *)v5 + 7) = v17;
      *((_DWORD *)v5 + 8) = v16;
      *((_DWORD *)v5 + 9) = 0;
      *a2 = v6;
      v5 += 5;
    }
    v9 = v12;
    a1 = (UINT64 *)v29;
  }
  if( a4 )
    *(_DWORD *)a4 = v7;
  return v8;
}

Referenced by: