MiResolveMemoryEvent

NTSTATUS __stdcall MiResolveMemoryEvent(INT64 a1, INT64 a2, INT64 a3, PVOID *a4){
  _MI_PARTITION *ThreadPartition; 
  int v6; 
  __int64 v7; 
  NTSTATUS result; 
  PVOID Object; 

  ThreadPartition = MiGetThreadPartition(KeGetCurrentThread(), (_EPROCESS *)a2);
  Object = 0i64;
  *(_OWORD *)v7 = *(_OWORD *)&MiMemoryEventNames[8 * v6];
  *(_QWORD *)(v7 + 8) += 2i64;
  *(_WORD *)v7 -= 2;
  *(_WORD *)(v7 + 2) -= 2;
  result = ObReferenceObjectByHandle(ThreadPartition->Core.RootDirectory, 0xF000Fui64, 0i64, 0, &Object, 0i64);
  *a4 = Object;
  return result;
}

Referenced by: