ExHandleTableQuery
signed __int64 __fastcall ExHandleTableQuery(unsigned int *a1, _DWORD *a2, _DWORD *a3){
unsigned int *v3;
signed __int64 v4;
unsigned int *v5;
__int64 v6;
__int64 v9;
int v10;
signed __int64 result;
v3 = a1 + 16;
v4 = 0i64;
v5 = &a1[16 * (unsigned __int64)(unsigned int)ExpFreeListCount + 16];
v6 = 0i64;
if( a1 + 16 < v5 )
{
do
{
v9 = (int)v3[6];
v10 = v3[7];
if( (int)v9 > v10 )
v10 = v3[6];
v4 += v9;
v3 += 16;
v6 += (unsigned int)v10;
}
while( v3 < v5 );
if( v4 < 0 )
{
v4 = 0i64;
}
else if( v4 > 0xFFFFFFFFi64 )
{
v4 = 0xFFFFFFFFi64;
}
if( v6 > 0xFFFFFFFFi64 )
v6 = 0xFFFFFFFFi64;
}
if( v4 > (__int64)((255 * ((unsigned __int64)*a1 >> 2)) >> 8) )
v4 = (255 * ((unsigned __int64)*a1 >> 2)) >> 8;
result = v4;
if( v6 <= v4 )
result = v6;
if( a2 )
*a2 = v4;
if( a3 )
*a3 = result;
return result;
}Referenced by:
ExpCopyProcessInfo
ObGetProcessHandleCount