DbgkpCreateNotificationEvent

NTSTATUS __stdcall DbgkpCreateNotificationEvent(_UNICODE_STRING *EventName, _KEVENT **Event){
  NTSTATUS result; 
  NTSTATUS v5; 
  int v6; 
  int v7; 
  int v8; 
  unsigned int v9; 
  VOID **PoolWithTag; 
  UINT64 v11; 
  _ACL *v12; 
  int Acl; 
  _ACL *v14; 
  VOID *Sid; 
  void *EventHandle; 
  _UNICODE_STRING CapName; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int128 SecurityDescriptor[2]; 
  __int64 v20; 
  char CapabilitySid[48]; 
  char CapabilityGroupSid[48]; 

  *(_QWORD *)&CapName.Length = 2621478i64;
  v20 = 0i64;
  EventHandle = 0i64;
  *(&ObjectAttributes.Length + 1) = 0;
  CapName.Buffer = (wchar_t *)&stru_1407CDE30._MxCsr;
  *(&ObjectAttributes.Attributes + 1) = 0;
  memset(SecurityDescriptor, 0, sizeof(SecurityDescriptor));
  result = RtlDeriveCapabilitySidsFromName(&CapName, CapabilityGroupSid, CapabilitySid);
  if( result >= 0 )
  {
    result = RtlCreateSecurityDescriptor(SecurityDescriptor, 1ui64);
    if( result >= 0 )
    {
      v5 = RtlLengthSid((INT64)SeWorldSid);
      v6 = RtlLengthSid((INT64)SeLocalSystemSid) + v5;
      v7 = RtlLengthSid((INT64)SeLocalSid) + v6;
      v8 = RtlLengthSid((INT64)SeAllAppPackagesSid) + v7;
      v9 = v8 + RtlLengthSid((INT64)CapabilitySid) + 68;
      PoolWithTag = ExAllocatePoolWithTag(1ui64, v9, 1818452292i64);
      v12 = (_ACL *)PoolWithTag;
      if( !PoolWithTag )
        return -1073741670;
      Acl = RtlCreateAcl((PACL)PoolWithTag, (_ACL)v9, 2ui64, v11);
      v14 = v12;
      if( Acl >= 0 )
      {
        Acl = RtlpAddKnownAce(v12, 2ui64, 0i64, 0x120001ui64, SeLocalSid, 0);
        v14 = v12;
        if( Acl >= 0 )
        {
          Acl = RtlpAddKnownAce(v12, 2ui64, 0i64, 0x120001ui64, SeAllAppPackagesSid, 0);
          v14 = v12;
          if( Acl >= 0 )
          {
            Acl = RtlpAddKnownAce(v12, 2ui64, 0i64, 0x120001ui64, CapabilitySid, 0);
            v14 = v12;
            if( Acl >= 0 )
            {
              Acl = RtlpAddKnownAce(v12, 2ui64, 0i64, 0x1F0003ui64, SeLocalSystemSid, 0);
              v14 = v12;
              if( Acl >= 0 )
              {
                Acl = RtlpAddKnownAce(v12, 2ui64, 0i64, 0x120001ui64, SeWorldSid, 0);
                if( Acl >= 0 )
                {
                  Acl = RtlSetDaclSecurityDescriptor(SecurityDescriptor, 1u, v12, 0);
                  if( Acl >= 0 )
                  {
                    ObjectAttributes.Length = 48;
                    ObjectAttributes.SecurityDescriptor = SecurityDescriptor;
                    ObjectAttributes.RootDirectory = 0i64;
                    ObjectAttributes.Attributes = 528;
                    ObjectAttributes.ObjectName = EventName;
                    ObjectAttributes.SecurityQualityOfService = 0i64;
                    Acl = ZwCreateEvent((UINT64)&EventHandle, 0x1F0003ui64, (INT64)&ObjectAttributes, 0i64, 0);
                    ExFreePoolWithTag(v12, 0);
                    if( Acl >= 0 )
                    {
                      LODWORD(Sid) = 1801937476;
                      Acl = ObpReferenceObjectByHandleWithTag(
                              EventHandle,
                              2ui64,
                              (_OBJECT_TYPE *)ExEventObjectType,
                              0,
                              (UINT64)Sid,
                              (VOID **)Event,
                              0i64,
                              0i64);
                      ZwClose((_HANDLE)EventHandle);
                    }
                    return Acl;
                  }
                }
                v14 = v12;
              }
            }
          }
        }
      }
      ExFreePoolWithTag(v14, 0);
      return Acl;
    }
  }
  return result;
}

Referenced by: