CmSiProcessTupleStartFromHandle

INT64 __fastcall CmSiProcessTupleStartFromHandle(INT64 a1, VOID *a2){
  NTSTATUS v3; 
  PVOID Object; 
  Object = 0i64;
  v3 = ObReferenceObjectByHandle(a2, 0x1FFFFFu, 0i64, 0, &Object, 0i64);
  if( v3 < 0 )
  {
    if( Object )
      ObfDereferenceObjectWithTag(Object, 0x746C6644ui64);
  }
  else
  {
    v3 = 0;
    *(&CmpRegistryProcess + 1) = (INT64)Object;
    CmpRegistryProcess = (INT64)a2;
  }
  return(unsigned int)v3;
}

Referenced by:

CmpInitializeRegistryProcess