PnpHandleEnumerateHandlesAgainstDeviceObject

INT64 __fastcall PnpHandleEnumerateHandlesAgainstDeviceObject(INT64 a1, INT64 a2, INT64 a3){
  unsigned int v3; 
  struct _EX_RUNDOWN_REF *v6; 
  unsigned int *v8; 
  struct _EX_RUNDOWN_REF *NextProcess; 
  struct _EX_RUNDOWN_REF *v10; 
  __int128 v12; 
  __int128 v13; 
  v3 = 0;
  v12 = 0i64;
  v6 = 0i64;
  v13 = 0i64;
  while( 1 )
  {
    NextProcess = (struct _EX_RUNDOWN_REF *)PsGetNextProcess(v6);
    v10 = NextProcess;
    if( !NextProcess )
      break;
    v8 = (unsigned int *)ObReferenceProcessHandleTable(NextProcess);
    if( v8 )
    {
      *(_QWORD *)&v12 = a1;
      *((_QWORD *)&v12 + 1) = v10;
      *(_QWORD *)&v13 = a2;
      *((_QWORD *)&v13 + 1) = a3;
      v3 = (unsigned __int8)ExEnumHandleTable(
                              v8,
                              (__int64(__fastcall *)(unsigned int *, __int64 *, __int64, __int64))PnpHandleProcessWalkWorker,
                              (__int64)&v12,
                              0i64);
      ExReleaseRundownProtection(v10 + 139);
      if( v3 )
      {
        ObfDereferenceObjectWithTag(v10, 0x6E457350ui64);
        return v3;
      }
    }
    v6 = v10;
  }
  return v3;
}

Referenced by: