SmRegistrationInfoFill

INT64 __fastcall SmRegistrationInfoFill(VOID **a1, INT8 AccessMode, _QWORD *a3){
  void *v3; 
  NTSTATUS v6; 
  void *v7; 
  void *v9; 
  v3 = *a1;
  v9 = 0i64;
  v6 = ObOpenObjectByPointer(v3, 0, 0i64, 0x1F0003u, (POBJECT_TYPE)ExEventObjectType, AccessMode, &v9);
  if( v6 < 0 )
  {
    v7 = v9;
  }
  else
  {
    v7 = 0i64;
    *a3 = v9;
    v6 = 0;
    v9 = 0i64;
  }
  if( v7 )
    ObCloseHandle(v7, AccessMode);
  return(unsigned int)v6;
}

Referenced by:

SmGetRegistrationInfo