ObEnumerateObjectsByType

NTSTATUS __stdcall ObEnumerateObjectsByType(
        _OBJECT_TYPE *ObjectType,
        UINT8 *EnumerationRoutine,
        VOID *a3,
        _UNICODE_STRING *a4,
        UINT64 a5,
        UINT64 a6,
        VOID *a7,
        VOID *Parameter){
  NTSTATUS v8; 
  _OBJECT_TYPE_ARRAY *TypeArray; 
  _OBJECT_TYPE_ARRAY *v10; 
  int v11; 
  __int64 v12; 
  __int64 v13; 
  _UNICODE_STRING ObjectName; 

  ObjectName = 0i64;
  v8 = 0;
  TypeArray = ObpCreateTypeArray(IoDriverObjectType);
  v10 = TypeArray;
  if( TypeArray )
  {
    v11 = 0;
    if( *TypeArray )
    {
      while( 1 )
      {
        v12 = *(_QWORD *)&v10[2 * v11 + 2];
        if( v12 )
        {
          v13 = (*(_BYTE *)(v12 + 58) & 2) != 0 ? v12
                                                + 32
                                                - *((unsigned __int8 *)&dword_140C25D60 + (*(_BYTE *)(v12 + 58) & 3)) : 0i64;
          if( v13 )
            ObjectName = *(_UNICODE_STRING *)(v13 + 8);
          else
            ObjectName = 0i64;
          if( !IovpBuildDriverObjectList(
                  (VOID *)(v12 + 80),
                  &ObjectName,
                  *(_QWORD *)(v12 + 40),
                  *(_QWORD *)(v12 + 32),
                  0i64) )
            break;
        }
        if( ++v11 >= (unsigned int)*v10 )
          goto LABEL_14;
      }
      v8 = -2147483622;
    }
LABEL_14:
    ObpDestroyTypeArray(v10);
  }
  return v8;
}

Referenced by: