SepAdtOpenEtwReadyEvent
VOID __fastcall SepAdtOpenEtwReadyEvent(){
PVOID *v0;
WCHAR v1;
PVOID *v2;
struct _UNICODE_STRING v3;
struct _OBJECT_ATTRIBUTES ObjectAttributes;
*(&ObjectAttributes.Length + 1) = 0;
*(&ObjectAttributes.Attributes + 1) = 0;
v2 = v0;
v3 = 0i64;
RtlInitUnicodeString(&v3, L"\\ADT_ETW_CHANNEL_INIT", v1);
ObjectAttributes.RootDirectory = 0i64;
ObjectAttributes.ObjectName = &v3;
ObjectAttributes.Length = 48;
ObjectAttributes.Attributes = 640;
*(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
NtCreateEvent(v2, 0x100003ui64, &ObjectAttributes, NotificationEvent, 0);
}Referenced by:
SepAdtInitializeAuditingOptions
SepRmCallLsa