NtQueryEvent

__int64 __fastcall NtQueryEvent(VOID *Handle, int a2, _DWORD *a3, _KPROCESSOR_MODE a4, __int64 a5){
  char PreviousMode; 
  _DWORD *v8; 
  __int64 v9; 
  NTSTATUS v10; 
  NTSTATUS CrossVmEvent; 
  _ADAPTER_OBJECT *v12; 
  INT64 v14; 
  PVOID Object; 
  PVOID v16; 
  PVOID v17; 
  INT64 v18; 

  LODWORD(v18) = 0;
  LODWORD(v14) = 0;
  if( a2 )
    return 3221225475i64;
  if( a4 != 8 )
    return 3221225476i64;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  if( PreviousMode )
  {
    ProbeForWrite((UINT64)a3, 8i64, 4i64);
    v8 = (_DWORD *)a5;
    if( a5 )
    {
      v9 = 0x7FFFFFFF0000i64;
      if( (unsigned __int64)a5 < 0x7FFFFFFF0000i64 )
        v9 = a5;
      *(_DWORD *)v9 = *(_DWORD *)v9;
    }
  }
  else
  {
    v8 = (_DWORD *)a5;
  }
  Object = 0i64;
  v10 = ObReferenceObjectByHandle(Handle, 1ui64, (_OBJECT_TYPE *)ExEventObjectType, PreviousMode, &Object, 0i64);
  CrossVmEvent = v10;
  v12 = (_ADAPTER_OBJECT *)Object;
  v17 = Object;
  LODWORD(Object) = v10;
  if( v10 < 0 )
  {
    if( v10 == -1073741788 )
    {
      if( *(&WheapDeferredInternalLogsEventLock + 55) )
      {
        v16 = 0i64;
        CrossVmEvent = ObReferenceObjectByHandle(
                         Handle,
                         1ui64,
                         *(&WheapDeferredInternalLogsEventLock + 55),
                         PreviousMode,
                         &v16,
                         0i64);
        v12 = (_ADAPTER_OBJECT *)v16;
        v17 = v16;
        LODWORD(Object) = CrossVmEvent;
        if( CrossVmEvent >= 0 )
        {
          CrossVmEvent = ExpQueryCrossVmEvent((INT64)v16, (INT64)&v18, (INT64)&v14);
          LODWORD(Object) = CrossVmEvent;
        }
      }
    }
  }
  else
  {
    LODWORD(v14) = *(_DWORD *)(&v12->AdapterObject.DmaHeader.Size + 1);
    LODWORD(v18) = v12->AdapterObject.DmaHeader.Version & 0x7F;
  }
  if( CrossVmEvent >= 0 )
  {
    if( PreviousMode )
    {
      *a3 = v18;
      a3[1] = v14;
      if( v8 )
        *v8 = 8;
    }
    else
    {
      *a3 = v18;
      a3[1] = v14;
      if( v8 )
        *v8 = 8;
    }
  }
  if( v12 )
    HalPutDmaAdapter(v12);
  return(unsigned int)CrossVmEvent;
}

Referenced by: