EtwpObjectHandleEnumCallback

UINT8 __fastcall EtwpObjectHandleEnumCallback(
        _HANDLE_TABLE *ObjectTable,
        _HANDLE_TABLE_ENTRY *ObjectTableEntry,
        VOID *HandleId,
        VOID *Context){
  bool v4; 
  int v5; 
  __int16 v7; 
  unsigned __int64 v8; 
  void *v11; 
  unsigned int v12; 
  _WORD *v13; 
  unsigned int v14; 
  unsigned int v15; 
  int v16; 
  unsigned int v17; 
  UINT64 v18; 
  _OBJECT_NAME_INFORMATION *PoolWithTag; 
  int v20; 
  int Length; 
  __int64 v22; 
  unsigned int *v23; 
  UINT64 Flag; 
  UINT64 v26; 
  UINT64 ReturnLength; 
  unsigned __int64 v28; 
  int v29; 
  unsigned int v30; 
  __int16 v31; 
  int v32; 
  __int16 v33; 
  EVENT_DATA_DESCRIPTOR EventData; 
  wchar_t *Buffer; 
  int v36; 
  int v37; 
  v4 = *((_BYTE *)Context + 64) != 0;
  LODWORD(ReturnLength) = 0;
  v5 = *((_DWORD *)Context + 11);
  v7 = 4391 - v4;
  v8 = (ObjectTableEntry->LowValue >> 16) & 0xFFFFFFFFFFFFFFF0ui64;
  v32 = 0;
  v33 = 0;
  v29 = v5;
  v11 = (void *)(v8 + 48);
  v30 = (unsigned int)HandleId;
  v28 = v8 + 48;
  if( *((_BYTE *)Context + 68) )
    v30 = (unsigned int)HandleId | 0x80000000;
  v12 = 1;
  v13 = (_WORD *)*((_QWORD *)Context + 1);
  v31 = (unsigned __int8)(BYTE1(v8) ^ ObHeaderCookie ^ *(_BYTE *)(v8 + 24));
  if( v13 )
  {
    v14 = 0;
    if( !*v13 )
    {
LABEL_8:
      ExUnlockHandleTableEntry(ObjectTable, ObjectTableEntry);
      return 0;
    }
    v15 = *(_DWORD *)(ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ BYTE1(v8) ^ (unsigned __int64)*(unsigned __int8 *)(v8 + 24)]
                    + 192);
    while( !(unsigned int)ExCheckSingleFilter(v15, *(unsigned int *)&v13[2 * v14 + 2]) )
    {
      v14 = v16 + 1;
      if( v14 >= v17 )
        goto LABEL_8;
    }
  }
  ObfReferenceObjectWithTag(v11, 0x54777445u);
  ExUnlockHandleTableEntry(ObjectTable, ObjectTableEntry);
  v18 = *((unsigned __int16 *)Context + 12);
  PoolWithTag = (_OBJECT_NAME_INFORMATION *)*((_QWORD *)Context + 2);
  EventData.Ptr = (unsigned __int64)&v28;
  LODWORD(ReturnLength) = v18;
  *(_QWORD *)&EventData.Size = 18i64;
  while( 1 )
  {
    v20 = ObQueryNameString(v11, PoolWithTag, v18, &ReturnLength);
    if( v20 != -1073741820 )
      break;
    if( PoolWithTag != *((_OBJECT_NAME_INFORMATION **)Context + 2) )
      ExFreePoolWithTag(PoolWithTag, 0);
    PoolWithTag = (_OBJECT_NAME_INFORMATION *)ExAllocatePoolWithTag(
                                                PagedPool,
                                                (unsigned int)ReturnLength,
                                                0x74777445ui64);
    if( !PoolWithTag )
      break;
    v18 = (unsigned int)ReturnLength;
  }
  ObfDereferenceObjectWithTag(v11, 0x54777445ui64);
  if( !v20 )
  {
    Length = 0x2000;
    if( PoolWithTag->Name.Length < 0x2000u )
      Length = PoolWithTag->Name.Length;
    v12 = 2;
    Buffer = PoolWithTag->Name.Buffer;
    v36 = Length;
    v37 = 0;
  }
  v22 = 2i64 * v12;
  LODWORD(v26) = 4200450;
  LOWORD(Flag) = v7;
  *((_QWORD *)&EventData.Size + v22) = 2i64;
  v23 = (unsigned int *)*((_QWORD *)Context + 4);
  *(&EventData.Ptr + v22) = (unsigned __int64)&EtwpNull;
  EtwpLogKernelEvent(&EventData, *((_QWORD *)v23 + 135), *v23, v12 + 1, Flag, v26);
  if( PoolWithTag && PoolWithTag != *((_OBJECT_NAME_INFORMATION **)Context + 2) )
    ExFreePoolWithTag(PoolWithTag, 0);
  return 0;
}

Referenced by: