MiGetCombineDomain

NTSTATUS __stdcall MiGetCombineDomain(INT64 a1, INT64 a2){
  __int64 v2; 

  if( (_DWORD)a1 == 1 )
  {
    return *(_QWORD *)(a2 + 864);
  }
  else if( (_DWORD)a1 == 2 )
  {
    LODWORD(v2) = 0;
  }
  else
  {
    return *(_QWORD *)(a2 - 32);
  }
  return v2;
}

Referenced by:

MiCapturePfnVm
MiSharePages