NtCreateEvent

NTSTATUS __fastcall NtCreateEvent(UINT64 a1, UINT64 a2, INT64 a3, UINT64 a4, UINT8 a5){
  INT8 v5; 
  unsigned int v6; 
  _QWORD *v7; 
  unsigned __int8 v8; 
  NTSTATUS result; 
  VOID *Flags; 
  UINT64 Flagsa; 
  UINT64 ObjectBodySize; 
  UINT64 PagedPoolCharge; 
  UINT64 NonPagedPoolCharge; 
  PRKEVENT Event; 
  PVOID Handle; 

  v5 = a4;
  v6 = a2;
  v7 = (_QWORD *)a1;
  Event = 0i64;
  Handle = 0i64;
  v8 = KeGetCurrentThread()->$87BC921A506A176A34DE473FC146A343::gap0[10];
  if( v8 )
  {
    if( a1 >= 0x7FFFFFFF0000i64 )
      a1 = 0x7FFFFFFF0000i64;
    *(_QWORD *)a1 = *(_QWORD *)a1;
  }
  if( (unsigned int)a4 > 1 )
    return -1073741811;
  LODWORD(NonPagedPoolCharge) = 0;
  LODWORD(PagedPoolCharge) = 0;
  LODWORD(ObjectBodySize) = 24;
  result = ObCreateObjectEx(
             v8,
             (_OBJECT_TYPE *)ExEventObjectType,
             (_OBJECT_ATTRIBUTES *)a3,
             v8,
             Flags,
             ObjectBodySize,
             PagedPoolCharge,
             NonPagedPoolCharge,
             (VOID **)&Event,
             0i64);
  if( result >= 0 )
  {
    KeInitializeEvent((INT64)Event, v5, a5);
    LODWORD(Flagsa) = 0;
    result = ObInsertObjectEx(Event, 0i64, v6, 0i64, Flagsa, 0i64, &Handle);
    LODWORD(Event) = result;
    if( result >= 0 )
      *v7 = Handle;
  }
  return result;
}

Referenced by: