SmKmFileInfoDuplicate

__int64 __fastcall SmKmFileInfoDuplicate(_OWORD *a1, __int64 a2){
  NTSTATUS v4; 
  void *v5; 
  SIZE_T v6; 
  UINT8 *NonPaged; 
  int v8; 
  __int128 v9; 
  __int128 v10; 
  __int128 v11; 
  PVOID *Object; 
  UINT64 AccessMode; 
  PHANDLE Handle; 
  void *TargetHandle[2]; 
  __int128 v17; 
  __int128 v18; 
  __int128 v19; 
  HANDLE TargetProcessHandle; 
  PVOID v21; 
  TargetProcessHandle = 0i64;
  memset((INT64)TargetHandle, 0i64);
  v4 = ObOpenObjectByPointer(SmKmGlobals, 0x200u, 0i64, 0, 0i64, 0, &TargetProcessHandle);
  if( v4 >= 0 )
  {
    if( !*(_QWORD *)a2
      || (LODWORD(Handle) = 6,
          LODWORD(AccessMode) = 0,
          LODWORD(Object) = 0,
          v4 = ZwDuplicateObject(
                 TargetProcessHandle,
                 *(PVOID *)a2,
                 TargetProcessHandle,
                 TargetHandle,
                 (UINT64)Object,
                 AccessMode,
                 (UINT64)Handle),
          v4 >= 0)
      && (v21 = 0i64,
          v4 = ObReferenceObjectByHandle(TargetHandle[0], 0x10003u, 0i64, 0, &v21, 0i64),
          TargetHandle[1] = v21,
          v4 >= 0) )
    {
      v5 = *(void **)(a2 + 16);
      if( v5 )
      {
        *(_QWORD *)&v17 = *(_QWORD *)(a2 + 16);
        ObfReferenceObject(v5);
        *((_QWORD *)&v17 + 1) = *(_QWORD *)(a2 + 24);
      }
      v6 = (unsigned int)(16 * *(_DWORD *)(a2 + 56));
      NonPaged = (UINT8 *)SSHSupportAllocateNonPaged(v6, 0x74586D73u);
      *(_QWORD *)&v19 = NonPaged;
      if( NonPaged )
      {
        memmove(NonPaged, *(UINT8 **)(a2 + 48), v6);
        v8 = *(_DWORD *)(a2 + 56);
        v9 = v17;
        *a1 = *(_OWORD *)TargetHandle;
        DWORD2(v19) = v8;
        v10 = v18;
        a1[1] = v9;
        v11 = v19;
        a1[2] = v10;
        a1[3] = v11;
        memset((INT64)TargetHandle, 0i64);
        v4 = 0;
      }
      else
      {
        v4 = -1073741670;
      }
    }
  }
  if( TargetProcessHandle )
    ZwClose(TargetProcessHandle);
  SmKmFileInfoCleanup((__int64)TargetHandle);
  return(unsigned int)v4;
}

Referenced by: