KeInitializeEvent
NTSTATUS __fastcall KeInitializeEvent(INT64 a1, INT8 a2, UINT8 a3){
NTSTATUS result;
*(_DWORD *)(a1 + 4) = a3;
result = a1 + 8;
*(_QWORD *)(a1 + 16) = a1 + 8;
*(_QWORD *)(a1 + 8) = a1 + 8;
*(_BYTE *)a1 = a2;
*(_WORD *)(a1 + 1) = 1536;
return result;
}Referenced by:
AlpcpInitSystem
AlpcpWaitForPortReferences
AnFwConfigureProgressResources
CmCompleteRegistryInitialization
CmLoadAppKey
CmpAllocatePostBlock
CmpFileFlushAndPurge
CmpInitializeMachineHiveLoadedCallbacks
CmpInitializeRegistryProcess
CmpInitializeSystemHivesLoad
CmpLockRegistryFreezeAware
CmpWaitOnHiveWriteQueue
CreateTlgAggregateSession
DbgkpLkmdLaunchSnapApc
DbgkpQueueMessage
EmPowerPagingEnabled
EtwpCovSampCaptureContextStart
EtwpCovSampCaptureFlush
EtwpInitLoggerContext
ExEnableHandleTracing
ExSwapinWorkerThreads
ExpWorkQueueDestroy
ExpWorkQueueManagerInitialize
FsRtlBalanceReads
FsRtlGetDirectImageOriginalBase
FsRtlGetFileSize
FsRtlInitializeTunnelCache
FsRtlIssueDeviceIoControl
FsRtlIssueFileNotificationFsctl
FsRtlKernelFsControlFile
FsRtlNotifyInitializeSync
FsRtlQueryCachedVdl
FsRtlQueryInformationFile
FsRtlQueryKernelEaFile
FsRtlSetFileSize
FsRtlSetKernelEaFile
FsRtlpAllocateOplock
HalpCallWakeAlarmDriver
HalpInitializeInterruptRemappingBspLate
HalpPostPnpInitialize
HalpQueryAcpiRealTimeClock
HalpQueryAcpiWakeAlarmSystemPowerState
HalpQueryPccInterface
HalpSetAcpiRealTimeClock
IoCancelFileOpen
IoCreateDevice
IoCreateStreamFileObjectEx2
IoReplacePartitionUnit
IoReportTargetDeviceChange
IoSetInformation
IoShutdownSystem
IoVerifyVolume
IoVolumeDeviceNameToGuidPath
IoVolumeDeviceToDosName
IoVolumeDeviceToGuidPath
IopAllocRealFileObject
IopAllocatePassiveInterruptBlock
IopCancelIrpsInThreadList
IopCancelIrpsInThreadListForCurrentProcess
IopCancelSynchronousIrpsForThread
IopCloseFile
IopCreateArcName
IopDeleteFile
IopDestroyActiveConnectBlock
IopFilterResourceRequirementsCall
IopFreeBandwidthContract
IopGetFileInformation
IopGetSetObjectId
IopGetSetSecurityObject
IopGetVolumeId
IopInitializeActiveConnectBlock
IopInitializePlugPlayServices
IopInvalidateVolumesForDevice
IopIssueSystemEnvironmentRequest
IopLoadFileSystemDriver
IopMountVolume
IopParseDevice
IopQueryXxxInformation
IopSetEaOrQuotaInformationFile
IopSetRemoteLink
IopShutdownBaseFileSystems
IopSynchronousCall
IopUnloadDriver
IovpUnloadDriver
KeInitializeSecondaryInterruptServices
KeInitializeUmsThread
MiInSwapStore
MiInitializePartition
MiInitializeSections
MiReadImageHeaders
MiSessionObjectCreate
MiZeroAllPageFiles
MiZeroPageFileFirstPage
MmCleanProcessAddressSpace
MmStoreRegister
NT_DISK::Control
NtApphelpCacheControl
NtCreateDebugObject
NtCreateEvent
NtFlushBuffersFileEx
NtGetMUIRegistryInfo
NtInitiatePowerAction
NtMapCMFModule
NtQueryEaFile
NtQueryInformationFile
NtQueryQuotaInformationFile
NtQueryVolumeInformationFile
NtSetEaFile
NtSetVolumeInformationFile
NtUnlockFile
PfTAccessTracingInitialize
PfTInitialize
PfpPrefetchRequestPerform
PfpScenCtxInitialize
PiControlGetSetDeviceStatus
PiDrvDbLoadNode
PiIrpQueryRemoveDevice
PiQueueDeviceRequest
PiUEventNotifyUserMode
PipProcessDevNodeTree
PnpQueryInterface
PnpQueueQueryAndRemoveEvent
PnpRequestHwProfileChangeNotification
PnpStartDeviceNode
PnprInitiateReplaceOperation
PopBatteryAdd
PopBuildDeviceNotifyList
PopCaptureTimeOnProcZero
PopDeactiveThermalRequest
PopDisableCoolingExtension
PopFanAdd
PopFlushVolumes
PopFxRegisterComponentPerfStates
PopFxRegisterDeviceWorker
PopInitSystemSleeperThread
PopPepRegisterDevice
PopReadPagesFromHiberFile
PopThermalZoneAdd
PpIrpAllocateDeviceUsageNotification
PsCreateVsmEnclave
PsSetVmProcessorHostProcess
PspPrepareEnclaveThreadWait
PspQueueDeferredWorkAndWait
RawInitializeVcb
RawPerformDevIoCtrl
RawQueryFileSystemInformation
RawQueryFsSizeInfo
RtlDecompressBufferLZNT1
RtlDecompressFragmentLZNT1
RtlpCtInitializeNotificationEvent
SepRmCommandServerThread
SmKmSendDeviceControl
SmKmSendUsageNotification
SmKmStoreFileWriteHeader
SmProcessResizeRequest
SmProcessStatsRequest
SmStoreCompressionStop
SmStorePhysicalRequestIssue
TtmiCreateEventQueue
VfIrpSendSynchronousIrp
VfPendingInitPhase1
VfPoolInitPhase1
VhdiVerifyBootDisk
ViFilterDispatchPnp
VrpWaitForDiffHiveEntryTransitionOwnerToLeave
WdtpAllocateTimer
WheaAttemptClearPoison
WheaAttemptPhysicalPageOffline
WheaInitialize
WmipCreateGuidObject
WmipForwardWmiIrp
WmipQueueLegacyEtwWork
WmipWaitForCollectionEnabled
sub_140A37A14