FsRtlNotifyInitializeSync
NTSTATUS __fastcall FsRtlNotifyInitializeSync(INT64 *a1){
VOID **PoolWithTag;
NTSTATUS result;
*a1 = 0i64;
PoolWithTag = ExAllocatePoolWithTag(0x210ui64, 0x48ui64, 1316115270i64);
PoolWithTag[1] = 0i64;
*((_DWORD *)PoolWithTag + 4) = 0;
*(_DWORD *)PoolWithTag = 1;
result = KeInitializeEvent((INT64)(PoolWithTag + 3), 1, 0);
PoolWithTag[7] = 0i64;
*((_DWORD *)PoolWithTag + 16) = 0;
*a1 = (INT64)PoolWithTag;
return result;
}Referenced by:
FsRtlNotifyFilterChangeDirectoryLite
FsRtlNotifyFilterReportChangeLiteEx