MmManagePartitionGetMemoryEvents

INT64 __fastcall MmManagePartitionGetMemoryEvents(PVOID **a1, INT64 a2, KPROCESSOR_MODE AccessMode){
  PVOID *v3; 
  ULONG v6; 
  void **Handle; 
  PVOID *v8; 
  PVOID *v9; 
  NTSTATUS v10; 
  v3 = *a1;
  if( *(_DWORD *)a2 != 1 )
    return 3221225485i64;
  v6 = *(_DWORD *)(a2 + 4);
  if( (v6 & (AccessMode != 0 ? 7666 : 73714)) != v6 )
    return 3221225485i64;
  Handle = (void **)(a2 + 16);
  *(_QWORD *)(a2 + 16) = 0i64;
  v8 = (PVOID *)(a2 + 24);
  *(_QWORD *)(a2 + 24) = 0i64;
  v9 = (PVOID *)(a2 + 32);
  *(_QWORD *)(a2 + 32) = 0i64;
  v10 = ObOpenObjectByPointer(
          v3[37],
          v6,
          0i64,
          *(_DWORD *)(a2 + 8),
          (POBJECT_TYPE)ExEventObjectType,
          AccessMode,
          Handle);
  if( v10 < 0
    || (v10 = ObOpenObjectByPointer(
                v3[38],
                *(_DWORD *)(a2 + 4),
                0i64,
                *(_DWORD *)(a2 + 8),
                (POBJECT_TYPE)ExEventObjectType,
                AccessMode,
                (PHANDLE)(a2 + 24)),
        v10 < 0)
    || (v10 = ObOpenObjectByPointer(
                v3[39],
                *(_DWORD *)(a2 + 4),
                0i64,
                *(_DWORD *)(a2 + 8),
                (POBJECT_TYPE)ExEventObjectType,
                AccessMode,
                (PHANDLE)(a2 + 32)),
        v10 < 0) )
  {
    if( *Handle )
      ObCloseHandle(*Handle, AccessMode);
    if( *v8 )
      ObCloseHandle(*v8, AccessMode);
    if( *v9 )
      ObCloseHandle(*v9, AccessMode);
  }
  return(unsigned int)v10;
}

Referenced by: