IoEnumerateRegisteredFiltersList

NTSTATUS __stdcall IoEnumerateRegisteredFiltersList(
        PDRIVER_OBJECT *DriverObjectList,
        ULONG DriverObjectListSize,
        PULONG ActualNumberDriverObjects){
  _ETHREAD *CurrentThread; 
  ULONG v4; 
  PRESOURCELIST(__stdcall *v8)(UINT32, INTERRUPTSYNCMODE); 
  ULONG v9; 
  bool v10; 
  PRESOURCELIST(__stdcall *v11)(UINT32, INTERRUPTSYNCMODE); 
  unsigned int i; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v4 = 0;
  --*((_WORD *)CurrentThread + 242);
  if( !ExAcquireResourceExclusiveLite(&IopDatabaseResource, 0) )
  {
    if( IopGetFsRegistrationInProgress() )
    {
      i = -1073741267;
      goto LABEL_8;
    }
    ExAcquireResourceExclusiveLite(&IopDatabaseResource, 1u);
  }
  v8 = *(PRESOURCELIST(__stdcall **)(UINT32, INTERRUPTSYNCMODE))IopFsNotifyChangeQueueHead;
  v9 = DriverObjectListSize >> 3;
  while( v8 != IopFsNotifyChangeQueueHead )
  {
    v8 = *(PRESOURCELIST(__stdcall **)(UINT32, INTERRUPTSYNCMODE))v8;
    ++v4;
  }
  v10 = v9 < v4;
  *ActualNumberDriverObjects = v4;
  v11 = *(PRESOURCELIST(__stdcall **)(UINT32, INTERRUPTSYNCMODE))IopFsNotifyChangeQueueHead;
  for( i = v10 ? 0xC0000023 : 0; v9; --v9 )
  {
    if( v11 == IopFsNotifyChangeQueueHead )
      break;
    ObfReferenceObject(*((PVOID *)v11 + 2));
    *DriverObjectList++ = (PDRIVER_OBJECT)*((_QWORD *)v11 + 2);
    v11 = *(PRESOURCELIST(__stdcall **)(UINT32, INTERRUPTSYNCMODE))v11;
  }
  ExReleaseResourceLite(&IopDatabaseResource);
LABEL_8:
  KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
  return i;
}

Referenced by: