ExQueryProcessHandleInformation

NTSTATUS __stdcall ExQueryProcessHandleInformation(
        _HANDLE_TABLE *HandleTable,
        PROCESS_HANDLE_SNAPSHOT_INFORMATION *ProcessHandleInformation,
        UINT64 Length,
        UINT64 *RequiredLength){
  PROCESS_HANDLE_SNAPSHOT_INFORMATION *v5; 
  unsigned int v6; 
  int v7; 
  NTSTATUS v8; 
  _HANDLE_TABLE_ENTRY *v9; 
  _HANDLE_TABLE_ENTRY *NextHandleTableEntry; 
  unsigned int v11; 
  _HANDLE_TABLE_ENTRY *v12; 
  __int64 *v13; 
  __int32 bf_0; 
  int v15; 
  int v16; 
  int v17; 
  __int64 v18; 
  __int64 v19; 
  int v20; 
  int v22[8]; 
  int v23; 
  int v24; 
  _EXHANDLE pHandle; 
  unsigned __int64 v26; 
  __int64 v27; 
  __int64 v28; 
  _HANDLE_TABLE *HandleTablea; 
  int v31; 

  HandleTablea = HandleTable;
  pHandle = 0i64;
  v5 = ProcessHandleInformation + 4;
  v26 = (unsigned int)(Length - 16) / 0x28ui64;
  v6 = 0;
  v7 = 16;
  v8 = 0;
  v9 = 0i64;
  while( 1 )
  {
    NextHandleTableEntry = ExpGetNextHandleTableEntry(HandleTable, v9, &pHandle);
    v12 = NextHandleTableEntry;
    if( !NextHandleTableEntry )
      break;
    if( v6 >= v11 )
    {
      if( (pHandle._bf_0 & 0x3FC) != 0 && NextHandleTableEntry->LowValue )
      {
        v7 += 40;
        v8 = -1073741820;
      }
    }
    else if( ExLockHandleTableEntry(HandleTablea, NextHandleTableEntry) )
    {
      v13 = (__int64 *)((v12->LowValue >> 16) & 0xFFFFFFFFFFFFFFF0ui64);
      bf_0 = v12->LeafHandleValue.$E5B3C52FE72490EE6A49ADBB8529F30E::_bf_0;
      v15 = (v12->LowValue >> 17) & 7 | 8;
      if( (bf_0 & 0x2000000) == 0 )
        LOBYTE(v15) = (v12->LowValue >> 17) & 7;
      v16 = v15 & 7;
      v31 = v16;
      v17 = *(unsigned __int8 *)(ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ *(unsigned __int8 *)(((v12->LowValue >> 16) & 0xFFFFFFFFFFFFFFF0ui64) + 0x18) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)(WORD1(v12->LowValue) & 0xFFF0) >> 8)]
                               + 40);
      v24 = v17;
      v18 = *v13;
      v27 = *v13;
      v19 = v13[1];
      v28 = v19;
      v20 = bf_0 & 0x1FFFFFF;
      v23 = v20;
      _InterlockedExchangeAdd64(&v12->VolatileLowValue, 1ui64);
      _InterlockedOr(v22, 0);
      if( HandleTablea->HandleContentionEvent._bf_0 )
      {
        ExfUnblockPushLock(&HandleTablea->HandleContentionEvent._bf_0, 0i64);
        v16 = v31;
        v20 = v23;
        v17 = v24;
        v18 = v27;
        v19 = v28;
      }
      v7 += 40;
      ++v6;
      *(_EXHANDLE *)v5 = pHandle;
      *((_QWORD *)v5 + 1) = v19;
      *((_QWORD *)v5 + 2) = v18;
      v5[6] = v20;
      v5[7] = v17;
      v5[8] = v16;
      v5[9] = 0;
      *(_QWORD *)ProcessHandleInformation = v6;
      v5 += 10;
    }
    v9 = v12;
    HandleTable = HandleTablea;
  }
  if( RequiredLength )
    *(_DWORD *)RequiredLength = v7;
  return v8;
}

Referenced by: