_MI_PARTITION *__stdcall MiGetVmPartition(VOID *InputPartitionObject, _EPROCESS *NewProcess){ return *(_MI_PARTITION **)(*(&stru_140C4DB30 + 267) + 8i64 * *((unsigned __int16 *)InputPartitionObject + 87)); }