PsEnumProcessThreads
NTSTATUS __stdcall PsEnumProcessThreads(
_EPROCESS *Process,
INT64 *CallBack,
_EPROCESS *a3,
_ETHREAD *a4,
VOID *a5,
VOID *Context){
NTSTATUS v6;
_ETHREAD *v8;
_EPROCESS *i;
_LIST_ENTRY **NextProcessThread;
_ETHREAD *v12;
v6 = 0;
v8 = 0i64;
for( i = Process; ; Process = i )
{
NextProcessThread = PsGetNextProcessThread(Process, v8);
v12 = (_ETHREAD *)NextProcessThread;
if( !NextProcessThread )
break;
v6 = ((__int64(__fastcall *)(_EPROCESS *, _LIST_ENTRY **, _EPROCESS *))CallBack)(i, NextProcessThread, a3);
if( v6 < 0 )
{
ObfDereferenceObjectWithTag(v12, 0x6E457350ui64);
return v6;
}
v8 = v12;
}
return v6;
}Referenced by:
EtwpProcessEnumCallback