IoCreateNotificationEvent

KEVENT *__stdcall IoCreateNotificationEvent(UNICODE_STRING *EventName, PVOID *EventHandle){
  NTSTATUS v3; 
  KEVENT *v4; 
  KEVENT *result; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  void *EventHandlea; 
  PVOID Object; 
  *(&ObjectAttributes.Length + 1) = 0;
  memset(&ObjectAttributes.Attributes + 1, 0, 20);
  EventHandlea = 0i64;
  ObjectAttributes.RootDirectory = 0i64;
  ObjectAttributes.ObjectName = EventName;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 640;
  if( ZwCreateEvent(&EventHandlea, 0x1F0003ui64, &ObjectAttributes, NotificationEvent, 1u) < 0 )
    return 0i64;
  Object = 0i64;
  v3 = ObReferenceObjectByHandle(EventHandlea, 0, (POBJECT_TYPE)ExEventObjectType, 0, &Object, 0i64);
  v4 = (KEVENT *)Object;
  if( v3 < 0 )
    v4 = 0i64;
  else
    HalPutDmaAdapter((PADAPTER_OBJECT)Object);
  result = v4;
  *EventHandle = EventHandlea;
  return result;
}

Referenced by: