DbgkPostModuleMessage

NTSTATUS __fastcall DbgkPostModuleMessage(PVOID Object, PVOID a2, PVOID ProcessVa, UINT64 a4, INT64 a5, KEVENT *Event){
  int v9; 
  NTSTATUS v10; 
  __int64 v11; 
  NTSTATUS v12; 
  PVOID P[2]; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  struct _IO_STATUS_BLOCK IoStatusBlock; 
  INT64 result[5]; 
  int v17; 
  UNICODE_STRING FileHandle; 
  int v19; 
  int v20; 
  v9 = a4;
  IoStatusBlock = 0i64;
  *(_OWORD *)P = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  memset((INT64)result, 0i64);
  v20 = a5;
  v17 = 5;
  FileHandle.Buffer = (wchar_t *)ProcessVa;
  v19 = v9;
  if( MmGetFileNameForAddress(ProcessVa, (_UNICODE_STRING *)P) >= 0 )
  {
    ObjectAttributes.ObjectName = (_UNICODE_STRING *)P;
    ObjectAttributes.Length = 48;
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.Attributes = 1600;
    *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
    v10 = ZwOpenFile(&FileHandle, (PWCHAR)0x80100000i64);
    v11 = *(_QWORD *)&FileHandle.Length;
    if( v10 < 0 )
      v11 = 0i64;
    *(_QWORD *)&FileHandle.Length = v11;
    ExFreePoolWithTag(P[1], 0);
  }
  if( Event )
  {
    DbgkpQueueMessage((_EPROCESS *)Object, (_ETHREAD *)a2);
  }
  else
  {
    DbgkpSendApiMessage(Object, 3, (__int64)result);
    v12 = -1073741823;
  }
  if( v12 < 0 )
  {
    if( *(_QWORD *)&FileHandle.Length )
      return ObCloseHandle(*(PVOID *)&FileHandle.Length, 0);
  }
  return v12;
}

Referenced by: