PfpCreateEvent

INT64 __stdcall PfpCreateEvent(UNICODE_STRING *EventName, EVENT_TYPE EventType, KEVENT **EventOut){
  int Acl; 
  int v7; 
  UINT32 v8; 
  struct _ACL *PoolWithTag; 
  ACL *v10; 
  PVOID Object; 
  __int128 SecurityDescriptor[2]; 
  __int64 v14; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  void *EventHandle; 
  v14 = 0i64;
  EventHandle = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  memset(SecurityDescriptor, 0, sizeof(SecurityDescriptor));
  Acl = RtlCreateSecurityDescriptor(SecurityDescriptor, 1ui64);
  if( Acl >= 0 )
  {
    v7 = RtlLengthSid(SeAliasAdminsSid);
    v8 = RtlLengthSid(SeLocalSystemSid) + 32 + v7;
    PoolWithTag = (struct _ACL *)ExAllocatePoolWithTag(PagedPool, v8, 0x6C636144ui64);
    v10 = PoolWithTag;
    if( PoolWithTag )
    {
      Acl = RtlCreateAcl(PoolWithTag, v8, 2u);
      if( Acl >= 0 )
      {
        Acl = RtlpAddKnownAce(v10, 2ui64, 0i64, 0x1F0003ui64, SeAliasAdminsSid, 0);
        if( Acl >= 0 )
        {
          Acl = RtlpAddKnownAce(v10, 2ui64, 0i64, 0x1F0003ui64, SeLocalSystemSid, 0);
          if( Acl >= 0 )
          {
            Acl = RtlSetDaclSecurityDescriptor(SecurityDescriptor, 1u, v10, 0);
            if( Acl >= 0 )
            {
              ObjectAttributes.Length = 48;
              ObjectAttributes.SecurityDescriptor = SecurityDescriptor;
              ObjectAttributes.RootDirectory = 0i64;
              ObjectAttributes.Attributes = 656;
              ObjectAttributes.ObjectName = EventName;
              ObjectAttributes.SecurityQualityOfService = 0i64;
              Acl = ZwCreateEvent(&EventHandle, 0x1F0003ui64, &ObjectAttributes, EventType, 0);
              if( Acl >= 0 )
              {
                Object = 0i64;
                Acl = ObReferenceObjectByHandle(
                        EventHandle,
                        0x1F0003u,
                        (POBJECT_TYPE)ExEventObjectType,
                        0,
                        &Object,
                        0i64);
                *EventOut = (KEVENT *)Object;
                if( Acl >= 0 )
                  Acl = 0;
              }
            }
          }
        }
      }
    }
    else
    {
      Acl = -1073741670;
    }
    if( EventHandle )
      ZwClose(EventHandle);
    if( v10 )
      ExFreePoolWithTag(v10, 0);
  }
  return(unsigned int)Acl;
}

Referenced by: