NTSTATUS __stdcall MiGetAweVadPartition(INT64 a1){
__int64 v1;
__int64 ********LockedVadEvent;
if( (*(_DWORD *)(a1 + 48) & 0x3100000) == 34603008 )
{
return *(_QWORD *)(*(&stru_140C4DB30 + 267) + 8i64 * KeGetCurrentThread()->ApcState.Process->Vm.Instance.PartitionId);
}
else
{
LockedVadEvent = MiLocateLockedVadEvent(a1, 256);
LODWORD(v1) = MiGetAweInfoPartition((INT64)LockedVadEvent[5]);
}
return v1;
}