MiCreateMemoryEvent

NTSTATUS __stdcall MiCreateMemoryEvent(_UNICODE_STRING *EventName, _KEVENT **Event){
  void *v2; 
  void *v3; 
  _UNICODE_STRING v4; 
  __int64 v5; 
  void *v6; 
  _ADAPTER_OBJECT *v8; 
  int SymbolicLink; 
  NTSTATUS v10; 
  void **v11; 
  void *v12; 
  _UNICODE_STRING v14; 
  __int64 v15[3]; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  void *EventHandle; 
  PVOID Object; 
  VOID *v19; 
  int v20; 
  _ADAPTER_OBJECT **v21; 
  void **v22; 

  v4 = *EventName;
  v5 = (int)Event;
  v6 = v3;
  v19 = 0i64;
  *(&ObjectAttributes.Length + 1) = 0;
  v8 = 0i64;
  *(&ObjectAttributes.Attributes + 1) = 0;
  EventHandle = 0i64;
  v14 = v4;
  if( v2 )
  {
    ++v14.Buffer;
    v14.Length -= 2;
    v14.MaximumLength -= 2;
  }
  ObjectAttributes.RootDirectory = v2;
  ObjectAttributes.ObjectName = &v14;
  ObjectAttributes.Length = 48;
  ObjectAttributes.Attributes = 512;
  ObjectAttributes.SecurityDescriptor = v3;
  ObjectAttributes.SecurityQualityOfService = 0i64;
  SymbolicLink = ZwCreateEvent((UINT64)&EventHandle, 0x1F0003ui64, (INT64)&ObjectAttributes, 0i64, 0);
  if( SymbolicLink >= 0 )
  {
    Object = 0i64;
    v10 = ObReferenceObjectByHandle(EventHandle, 2ui64, (_OBJECT_TYPE *)ExEventObjectType, 0, &Object, 0i64);
    v8 = (_ADAPTER_OBJECT *)Object;
    SymbolicLink = v10;
    if( v10 >= 0 )
    {
      if( !v20 )
      {
LABEL_8:
        SymbolicLink = 0;
        v11 = v22;
        *v21 = v8;
        v8 = 0i64;
        *v11 = EventHandle;
        v12 = 0i64;
        EventHandle = 0i64;
        goto LABEL_9;
      }
      ObjectAttributes.Length = 48;
      v15[1] = (__int64)MiResolveMemoryEvent;
      ObjectAttributes.RootDirectory = 0i64;
      ObjectAttributes.Attributes = 528;
      ObjectAttributes.ObjectName = EventName;
      ObjectAttributes.SecurityDescriptor = v6;
      ObjectAttributes.SecurityQualityOfService = 0i64;
      v15[0] = 1i64;
      v15[2] = v5;
      SymbolicLink = ObCreateSymbolicLink(
                       (_XSTATE_CONFIGURATION *)&v19,
                       0xF0001ui64,
                       (EVT_WDFCX_DEVICE_PRE_SELF_MANAGED_IO_SUSPEND *)&ObjectAttributes,
                       (_XSTATE_CONFIGURATION *)v15,
                       0);
      if( SymbolicLink >= 0 )
      {
        ObCloseHandle(v19, 0);
        goto LABEL_8;
      }
    }
  }
  v12 = EventHandle;
LABEL_9:
  if( v12 )
    ObCloseHandle(v12, 0);
  if( v8 )
    HalPutDmaAdapter(v8);
  return SymbolicLink;
}

Referenced by: