SepAdtOpenEtwReadyEvent

VOID __fastcall SepAdtOpenEtwReadyEvent(){
  PVOID *v0; 
  WCHAR v1; 
  PVOID *v2; 
  struct _UNICODE_STRING v3; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  *(&ObjectAttributes.Length + 1) = 0;
  *(&ObjectAttributes.Attributes + 1) = 0;
  v2 = v0;
  v3 = 0i64;
  RtlInitUnicodeString(&v3, L"\\ADT_ETW_CHANNEL_INIT", v1);
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = &v3;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 640;
  *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
  NtCreateEvent(v2, 0x100003ui64, &ObjectAttributes, NotificationEvent, 0);
}

Referenced by:

SepAdtInitializeAuditingOptions
SepRmCallLsa