MmManagePartitionGetMemoryEvents

NTSTATUS __stdcall MmManagePartitionGetMemoryEvents(PVOID **a1, INT64 a2, _KPROCESSOR_MODE AccessMode){
  PVOID *v3; 
  INT8 v4; 
  UINT64 v6; 
  VOID **Handle; 
  VOID **v8; 
  VOID **v9; 
  int v10; 
  _KPROCESSOR_MODE AccessModea; 
  _KPROCESSOR_MODE AccessModeb; 
  _KPROCESSOR_MODE AccessModec; 

  v3 = *a1;
  v4 = AccessMode;
  if( *(_DWORD *)a2 != 1 )
    return -1073741811;
  v6 = *(unsigned int *)(a2 + 4);
  if( ((unsigned int)v6 & ((_BYTE)AccessMode != 0 ? 7666 : 73714)) != (_DWORD)v6 )
    return -1073741811;
  Handle = (VOID **)(a2 + 16);
  *(_QWORD *)(a2 + 16) = 0i64;
  v8 = (VOID **)(a2 + 24);
  *(_QWORD *)(a2 + 24) = 0i64;
  v9 = (VOID **)(a2 + 32);
  *(_QWORD *)(a2 + 32) = 0i64;
  LOBYTE(AccessModea) = AccessMode;
  v10 = ObOpenObjectByPointer(
          v3[37],
          v6,
          0i64,
          *(_DWORD *)(a2 + 8),
          (POBJECT_TYPE)ExEventObjectType,
          AccessModea,
          Handle);
  if( v10 < 0
    || (LOBYTE(AccessModeb) = v4,
        v10 = ObOpenObjectByPointer(
                v3[38],
                *(unsigned int *)(a2 + 4),
                0i64,
                *(_DWORD *)(a2 + 8),
                (POBJECT_TYPE)ExEventObjectType,
                AccessModeb,
                (VOID **)(a2 + 24)),
        v10 < 0)
    || (LOBYTE(AccessModec) = v4,
        v10 = ObOpenObjectByPointer(
                v3[39],
                *(unsigned int *)(a2 + 4),
                0i64,
                *(_DWORD *)(a2 + 8),
                (POBJECT_TYPE)ExEventObjectType,
                AccessModec,
                (VOID **)(a2 + 32)),
        v10 < 0) )
  {
    if( *Handle )
      ObCloseHandle(*Handle, v4);
    if( *v8 )
      ObCloseHandle(*v8, v4);
    if( *v9 )
      ObCloseHandle(*v9, v4);
  }
  return v10;
}

Referenced by: