NtQueryEvent

INT64 __fastcall NtQueryEvent(
        VOID *EventHandle,
        _EVENT_INFORMATION_CLASS EventInformationClass,
        VOID *EventInformation,
        UINT64 EventInformationLength,
        UINT64 *ReturnLength){
  KPROCESSOR_MODE v7; 
  UINT64 *v8; 
  __int64 v9; 
  NTSTATUS v10; 
  int CrossVmEvent; 
  struct _DMA_ADAPTER *v12; 
  INT64 v14; 
  PVOID Object; 
  PVOID v16; 
  PVOID v17; 
  INT64 v18; 
  LODWORD(v18) = 0;
  LODWORD(v14) = 0;
  if( EventInformationClass )
    return 3221225475i64;
  if( (_DWORD)EventInformationLength != 8 )
    return 3221225476i64;
  v7 = *((_BYTE *)KeGetCurrentThread() + 562);
  if( v7 )
  {
    ProbeForWrite(EventInformation, 8ui64, 4ui64);
    v8 = ReturnLength;
    if( ReturnLength )
    {
      v9 = 0x7FFFFFFF0000i64;
      if( (unsigned __int64)ReturnLength < 0x7FFFFFFF0000i64 )
        v9 = (__int64)ReturnLength;
      *(_DWORD *)v9 = *(_DWORD *)v9;
    }
  }
  else
  {
    v8 = ReturnLength;
  }
  Object = 0i64;
  v10 = ObReferenceObjectByHandle(EventHandle, 1u, (POBJECT_TYPE)ExEventObjectType, v7, &Object, 0i64);
  CrossVmEvent = v10;
  v12 = (struct _DMA_ADAPTER *)Object;
  v17 = Object;
  LODWORD(Object) = v10;
  if( v10 < 0 )
  {
    if( v10 == -1073741788 )
    {
      if( ExCrossVmEventObjectType )
      {
        v16 = 0i64;
        CrossVmEvent = ObReferenceObjectByHandle(EventHandle, 1u, ExCrossVmEventObjectType, v7, &v16, 0i64);
        v12 = (struct _DMA_ADAPTER *)v16;
        v17 = v16;
        LODWORD(Object) = CrossVmEvent;
        if( CrossVmEvent >= 0 )
        {
          CrossVmEvent = ExpQueryCrossVmEvent((INT64)v16, (INT64)&v18, (INT64)&v14);
          LODWORD(Object) = CrossVmEvent;
        }
      }
    }
  }
  else
  {
    LODWORD(v14) = *(_DWORD *)(&v12->Size + 1);
    LODWORD(v18) = v12->Version & 0x7F;
  }
  if( CrossVmEvent >= 0 )
  {
    if( v7 )
    {
      *(_DWORD *)EventInformation = v18;
      *((_DWORD *)EventInformation + 1) = v14;
      if( v8 )
        *(_DWORD *)v8 = 8;
    }
    else
    {
      *(_DWORD *)EventInformation = v18;
      *((_DWORD *)EventInformation + 1) = v14;
      if( v8 )
        *(_DWORD *)v8 = 8;
    }
  }
  if( v12 )
    HalPutDmaAdapter(v12);
  return(unsigned int)CrossVmEvent;
}

Referenced by: