DbgkpCreateNotificationEvent

NTSTATUS __stdcall DbgkpCreateNotificationEvent(_UNICODE_STRING *EventName, _KEVENT **Event){
  NTSTATUS result; 
  int v5; 
  int v6; 
  int v7; 
  int v8; 
  UINT32 v9; 
  struct _ACL *PoolWithTag; 
  ACL *v11; 
  NTSTATUS Acl; 
  ACL *v13; 
  void *EventHandle; 
  UNICODE_STRING SourceString; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int128 SecurityDescriptor[2]; 
  __int64 v18; 
  char Sid[48]; 
  char CapabilityGroupSid[48]; 
  *(_QWORD *)&SourceString.Length = 2621478i64;
  v18 = 0i64;
  EventHandle = 0i64;
  *(&ObjectAttributes.Length + 1) = 0;
  SourceString.Buffer = (wchar_t *)&stru_1407CDE30.MxCsr;
  *(&ObjectAttributes.Attributes + 1) = 0;
  memset(SecurityDescriptor, 0, sizeof(SecurityDescriptor));
  result = RtlDeriveCapabilitySidsFromName(&SourceString, CapabilityGroupSid, Sid);
  if( result >= 0 )
  {
    result = RtlCreateSecurityDescriptor(SecurityDescriptor, 1ui64);
    if( result >= 0 )
    {
      v5 = RtlLengthSid(SeWorldSid);
      v6 = RtlLengthSid(SeLocalSystemSid) + v5;
      v7 = RtlLengthSid(SeLocalSid) + v6;
      v8 = RtlLengthSid(SeAllAppPackagesSid) + v7;
      v9 = v8 + RtlLengthSid(Sid) + 68;
      PoolWithTag = (struct _ACL *)ExAllocatePoolWithTag(PagedPool, v9, 0x6C636144ui64);
      v11 = PoolWithTag;
      if( !PoolWithTag )
        return -1073741670;
      Acl = RtlCreateAcl(PoolWithTag, v9, 2u);
      v13 = v11;
      if( Acl >= 0 )
      {
        Acl = RtlpAddKnownAce(v11, 2ui64, 0i64, 0x120001ui64, SeLocalSid, 0);
        v13 = v11;
        if( Acl >= 0 )
        {
          Acl = RtlpAddKnownAce(v11, 2ui64, 0i64, 0x120001ui64, SeAllAppPackagesSid, 0);
          v13 = v11;
          if( Acl >= 0 )
          {
            Acl = RtlpAddKnownAce(v11, 2ui64, 0i64, 0x120001ui64, Sid, 0);
            v13 = v11;
            if( Acl >= 0 )
            {
              Acl = RtlpAddKnownAce(v11, 2ui64, 0i64, 0x1F0003ui64, SeLocalSystemSid, 0);
              v13 = v11;
              if( Acl >= 0 )
              {
                Acl = RtlpAddKnownAce(v11, 2ui64, 0i64, 0x120001ui64, SeWorldSid, 0);
                if( Acl >= 0 )
                {
                  Acl = RtlSetDaclSecurityDescriptor(SecurityDescriptor, 1u, v11, 0);
                  if( Acl >= 0 )
                  {
                    ObjectAttributes.Length = 48;
                    ObjectAttributes.SecurityDescriptor = SecurityDescriptor;
                    ObjectAttributes.RootDirectory = 0i64;
                    ObjectAttributes.Attributes = 528;
                    ObjectAttributes.ObjectName = EventName;
                    ObjectAttributes.SecurityQualityOfService = 0i64;
                    Acl = ZwCreateEvent(&EventHandle, 0x1F0003ui64, &ObjectAttributes, NotificationEvent, 0);
                    ExFreePoolWithTag(v11, 0);
                    if( Acl >= 0 )
                    {
                      Acl = ObpReferenceObjectByHandleWithTag(
                              (ULONG_PTR)EventHandle,
                              2,
                              (__int64)ExEventObjectType,
                              0,
                              0x6B676244u,
                              (__int64)Event,
                              0i64,
                              0i64);
                      ZwClose(EventHandle);
                    }
                    return Acl;
                  }
                }
                v13 = v11;
              }
            }
          }
        }
      }
      ExFreePoolWithTag(v13, 0);
      return Acl;
    }
  }
  return result;
}

Referenced by: