ExpGetNextCallback

UINT64 __fastcall ExpGetNextCallback(PVOID Object){
  _ETHREAD *CurrentThread; 
  int v2; 
  void **v3; 
  void **v5; 

  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v2 = 0;
  v3 = 0i64;
  --CurrentThread->Tcb.SpecialApcDisable;
  ExAcquirePushLockSharedEx((_EX_PUSH_LOCK *)&ExBootDevicesRemovedEvent + 14, 0i64);
  v5 = (void **)*(&ExBootDevicesRemovedEvent + 12);
  if( Object )
    v5 = (void **)*((_QWORD *)Object + 5);
  while( v5 != (void **)((char *)&ExBootDevicesRemovedEvent + 96) )
  {
    v3 = v5 - 5;
    if( ObReferenceObjectSafeWithTag((INT64)(v5 - 5), 1850046533i64) )
    {
      v2 = 1;
      break;
    }
    v5 = (void **)*v5;
  }
  ExReleasePushLockEx((ULONG_PTR)&ExBootDevicesRemovedEvent + 112, 0);
  KiLeaveGuardedRegionUnsafe((__int64)CurrentThread);
  if( Object )
    ObfDereferenceObjectWithTag(Object, 0x6E457845ui64);
  return(unsigned __int64)v3 & -(__int64)(v2 != 0);
}

Referenced by: