ExpGetHandleInformation

NTSTATUS __stdcall ExpGetHandleInformation(PVOID SystemInformation, UINT64 SystemInformationLength, UINT64 *a3){
  unsigned int v4; 
  NTSTATUS result; 
  NTSTATUS v6; 
  _SYSTEM_HANDLE_INFORMATION *HandleInformation; 
  VOID *LockVariable; 

  *(_DWORD *)a3 = 0;
  HandleInformation = 0i64;
  v4 = SystemInformationLength;
  LockVariable = 0i64;
  result = ExLockUserBuffer(
             SystemInformation,
             SystemInformationLength,
             KeGetCurrentThread()->PreviousMode,
             IoWriteAccess,
             (VOID **)&HandleInformation,
             &LockVariable);
  if( result >= 0 )
  {
    v6 = ObGetHandleInformation(HandleInformation, v4, a3);
    ExUnlockUserBuffer(LockVariable);
    return v6;
  }
  return result;
}

Referenced by: