PfpCreateEvent

__int64 __fastcall PfpCreateEvent(_UNICODE_STRING *a1, EVENT_TYPE a2, PVOID *a3){
  NTSTATUS Acl; 
  NTSTATUS v7; 
  unsigned int v8; 
  VOID **PoolWithTag; 
  UINT64 v10; 
  _ACL *v11; 
  PVOID Object; 
  __int128 SecurityDescriptor[2]; 
  __int64 v15; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  void *EventHandle; 

  v15 = 0i64;
  EventHandle = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  memset(SecurityDescriptor, 0, sizeof(SecurityDescriptor));
  Acl = RtlCreateSecurityDescriptor(SecurityDescriptor, 1ui64);
  if( Acl >= 0 )
  {
    v7 = RtlLengthSid((INT64)SeAliasAdminsSid);
    v8 = RtlLengthSid((INT64)SeLocalSystemSid) + 32 + v7;
    PoolWithTag = ExAllocatePoolWithTag(1ui64, v8, 1818452292i64);
    v11 = (_ACL *)PoolWithTag;
    if( PoolWithTag )
    {
      Acl = RtlCreateAcl((PACL)PoolWithTag, (_ACL)v8, 2ui64, v10);
      if( Acl >= 0 )
      {
        Acl = RtlpAddKnownAce(v11, 2ui64, 0i64, 0x1F0003ui64, SeAliasAdminsSid, 0);
        if( Acl >= 0 )
        {
          Acl = RtlpAddKnownAce(v11, 2ui64, 0i64, 0x1F0003ui64, SeLocalSystemSid, 0);
          if( Acl >= 0 )
          {
            Acl = RtlSetDaclSecurityDescriptor(SecurityDescriptor, 1u, v11, 0);
            if( Acl >= 0 )
            {
              ObjectAttributes.Length = 48;
              ObjectAttributes.SecurityDescriptor = SecurityDescriptor;
              ObjectAttributes.RootDirectory = 0i64;
              ObjectAttributes.Attributes = 656;
              ObjectAttributes.ObjectName = a1;
              ObjectAttributes.SecurityQualityOfService = 0i64;
              Acl = ZwCreateEvent((UINT64)&EventHandle, 0x1F0003ui64, (INT64)&ObjectAttributes, (unsigned int)a2, 0);
              if( Acl >= 0 )
              {
                Object = 0i64;
                Acl = ObReferenceObjectByHandle(
                        EventHandle,
                        0x1F0003ui64,
                        (_OBJECT_TYPE *)ExEventObjectType,
                        0,
                        &Object,
                        0i64);
                *a3 = Object;
                if( Acl >= 0 )
                  Acl = 0;
              }
            }
          }
        }
      }
    }
    else
    {
      Acl = -1073741670;
    }
    if( EventHandle )
      ZwClose((_HANDLE)EventHandle);
    if( v11 )
      ExFreePoolWithTag(v11, 0);
  }
  return(unsigned int)Acl;
}

Referenced by: