ExEnumHandleTable

__int64 __fastcall ExEnumHandleTable(
        unsigned int *a1,
        __int64 (__fastcall *a2)(unsigned int *, __int64 *, __int64, __int64),
        __int64 a3,
        __int64 *a4){
  _ETHREAD *CurrentThread; 
  unsigned __int8 v5; 
  _HANDLE_TABLE_ENTRY *NextHandleTableEntry; 
  INT64 LowValue; 
  __int64 Value; 
  unsigned __int64 v13; 
  _EXHANDLE pHandle[7]; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v5 = 0;
  pHandle[0].Value = 0i64;
  --*((_WORD *)CurrentThread + 242);
  NextHandleTableEntry = ExpGetNextHandleTableEntry((_HANDLE_TABLE *)a1, 0i64, pHandle);
  if( !NextHandleTableEntry )
    goto LABEL_13;
  do
  {
    while( 1 )
    {
      _m_prefetchw(NextHandleTableEntry);
      LowValue = NextHandleTableEntry->LowValue;
      if( (NextHandleTableEntry->LowValue & 1) != 0 )
        break;
      if( LowValue )
      {
        ExpBlockOnLockedHandleEntry((_HANDLE_TABLE *)a1, NextHandleTableEntry, LowValue);
      }
      else
      {
        Value = pHandle[0].Value;
LABEL_5:
        v13 = Value + 4;
        if( (Value ^ (unsigned __int64)(Value + 4)) >= 0x400 )
          NextHandleTableEntry = ExpLookupHandleTableEntry((_HANDLE_TABLE *)a1, (_EXHANDLE)(Value + 8));
        else
          ++NextHandleTableEntry;
        pHandle[0].Value = v13;
        if( !NextHandleTableEntry )
          goto LABEL_13;
      }
    }
  }
  while( LowValue != _InterlockedCompareExchange64(&NextHandleTableEntry->VolatileLowValue, LowValue - 1, LowValue) );
  Value = pHandle[0].Value;
  v5 = a2(a1, &NextHandleTableEntry->LowValue, pHandle[0].Value, a3);
  if( !v5 )
    goto LABEL_5;
  if( a4 )
    *a4 = Value;
LABEL_13:
  KeLeaveCriticalRegionThread((__int64)CurrentThread);
  return v5;
}

Referenced by:

EtwpObjectHandleRundown
IoRevokeHandlesForProcess
IopQueryProcessIdsUsingFile
NtQueryInformationProcess
ObFindHandleForObject
ObInitProcess
ObShutdownSystem
PnpHandleEnumerateHandlesAgainstDeviceObject