EtwpObjectHandleEnumCallback

UINT8 __stdcall EtwpObjectHandleEnumCallback(
        _HANDLE_TABLE *ObjectTable,
        _HANDLE_TABLE_ENTRY *ObjectTableEntry,
        VOID *HandleId,
        VOID *Context){
  bool v4; 
  int v5; 
  UINT16 v7; 
  unsigned __int64 v8; 
  VOID *v11; 
  unsigned int v12; 
  _WORD *v13; 
  unsigned int v14; 
  unsigned int v15; 
  int v16; 
  unsigned int v17; 
  UINT64 v18; 
  VOID **PoolWithTag; 
  NTSTATUS v20; 
  int v21; 
  __int64 v22; 
  __int64 v23; 
  UINT64 NumberOfBytes; 
  unsigned __int64 v26; 
  int v27; 
  unsigned int v28; 
  __int16 v29; 
  int v30; 
  __int16 v31; 
  __int64 *v32; 
  __int64 v33[2]; 
  int v34; 
  int v35; 

  v4 = *((_BYTE *)Context + 64) != 0;
  LODWORD(NumberOfBytes) = 0;
  v5 = *((_DWORD *)Context + 11);
  v7 = 4391 - v4;
  v8 = (ObjectTableEntry->LowValue >> 16) & 0xFFFFFFFFFFFFFFF0ui64;
  v30 = 0;
  v31 = 0;
  v27 = v5;
  v11 = (VOID *)(v8 + 48);
  v28 = (unsigned int)HandleId;
  v26 = v8 + 48;
  if( *((_BYTE *)Context + 68) )
    v28 = (unsigned int)HandleId | 0x80000000;
  v12 = 1;
  v13 = (_WORD *)*((_QWORD *)Context + 1);
  v29 = (unsigned __int8)(BYTE1(v8) ^ ObHeaderCookie ^ *(_BYTE *)(v8 + 24));
  if( v13 )
  {
    v14 = 0;
    if( !*v13 )
    {
LABEL_8:
      ExUnlockHandleTableEntry(ObjectTable, ObjectTableEntry);
      return 0;
    }
    v15 = *(_DWORD *)(ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ BYTE1(v8) ^ (unsigned __int64)*(unsigned __int8 *)(v8 + 24)]
                    + 192);
    while( !(unsigned int)ExCheckSingleFilter(v15, *(unsigned int *)&v13[2 * v14 + 2]) )
    {
      v14 = v16 + 1;
      if( v14 >= v17 )
        goto LABEL_8;
    }
  }
  ObfReferenceObjectWithTag(v11, 0x54777445ui64);
  ExUnlockHandleTableEntry(ObjectTable, ObjectTableEntry);
  v18 = *((unsigned __int16 *)Context + 12);
  PoolWithTag = (VOID **)*((_QWORD *)Context + 2);
  v32 = (__int64 *)&v26;
  LODWORD(NumberOfBytes) = v18;
  v33[0] = 18i64;
  while( 1 )
  {
    v20 = ObQueryNameString(v11, (_OBJECT_NAME_INFORMATION *)PoolWithTag, v18, &NumberOfBytes);
    if( v20 != -1073741820 )
      break;
    if( PoolWithTag != *((VOID ***)Context + 2) )
      ExFreePoolWithTag(PoolWithTag, 0);
    PoolWithTag = ExAllocatePoolWithTag(1ui64, (unsigned int)NumberOfBytes, 1953985605i64);
    if( !PoolWithTag )
      break;
    v18 = (unsigned int)NumberOfBytes;
  }
  ObfDereferenceObjectWithTag(v11, 0x54777445ui64);
  if( !v20 )
  {
    v21 = 0x2000;
    if( *(_WORD *)PoolWithTag < 0x2000u )
      v21 = *(unsigned __int16 *)PoolWithTag;
    v12 = 2;
    v33[1] = (__int64)PoolWithTag[1];
    v34 = v21;
    v35 = 0;
  }
  v22 = 2i64 * v12;
  v33[v22] = 2i64;
  v23 = *((_QWORD *)Context + 4);
  v33[v22 - 1] = (__int64)&EtwpNull;
  EtwpLogKernelEvent((__int64)&v32, *(_ETW_SILODRIVERSTATE **)(v23 + 1080), *(_DWORD *)v23, v12 + 1, v7, 0x401802u);
  if( PoolWithTag && PoolWithTag != *((VOID ***)Context + 2) )
    ExFreePoolWithTag(PoolWithTag, 0);
  return 0;
}

Referenced by: