FsRtlNotifyInitializeSync

NTSTATUS __fastcall FsRtlNotifyInitializeSync(INT64 *a1){
  VOID **PoolWithTag; 
  NTSTATUS result; 

  *a1 = 0i64;
  PoolWithTag = ExAllocatePoolWithTag(0x210ui64, 0x48ui64, 1316115270i64);
  PoolWithTag[1] = 0i64;
  *((_DWORD *)PoolWithTag + 4) = 0;
  *(_DWORD *)PoolWithTag = 1;
  result = KeInitializeEvent((INT64)(PoolWithTag + 3), 1, 0);
  PoolWithTag[7] = 0i64;
  *((_DWORD *)PoolWithTag + 16) = 0;
  *a1 = (INT64)PoolWithTag;
  return result;
}

Referenced by:

FsRtlNotifyFilterChangeDirectoryLite
FsRtlNotifyFilterReportChangeLiteEx