DbgkpOpenHandles

VOID __fastcall DbgkpOpenHandles(INT64 a1, VOID *a2, VOID *a3){
  void *v5; 
  __int64 v6; 
  _QWORD *v7; 
  __int64 v8; 
  _QWORD *v9; 
  char v10; 
  char v11; 
  switch( *(_DWORD *)a1 )
  {
    case 2:
      v9 = (_QWORD *)(a1 + 24);
      if( ObOpenObjectByPointer(a3, 0, 0i64, 0x12007Bu, (POBJECT_TYPE)PsThreadType, 0, (PHANDLE)(a1 + 24)) < 0 )
        *v9 = 0i64;
      break;
    case 3:
      v7 = (_QWORD *)(a1 + 32);
      if( ObOpenObjectByPointer(a3, 0, 0i64, 0x12007Bu, (POBJECT_TYPE)PsThreadType, 0, (PHANDLE)(a1 + 32)) < 0 )
        *v7 = 0i64;
      if( ObOpenObjectByPointer(a2, 0, 0i64, 0x12067Bu, (POBJECT_TYPE)PsProcessType, 0, (PHANDLE)(a1 + 24)) < 0 )
        *(_QWORD *)(a1 + 24) = 0i64;
      v5 = *(void **)(a1 + 48);
      if( v5 )
      {
        v11 = 0;
        v8 = *((_QWORD *)KeGetCurrentThread() + 23);
        if( (int)ObDuplicateObject(v8, v5, v8, a1 + 48, 0, 0, 2, v11) < 0 )
          *(_QWORD *)(a1 + 48) = 0i64;
        goto LABEL_14;
      }
      break;
    case 9:
      v5 = *(void **)(a1 + 24);
      if( v5 )
      {
        v10 = 0;
        v6 = *((_QWORD *)KeGetCurrentThread() + 23);
        if( (int)ObDuplicateObject(v6, v5, v6, a1 + 24, 0, 0, 2, v10) < 0 )
          *(_QWORD *)(a1 + 24) = 0i64;
LABEL_14:
        ObCloseHandle(v5, 0);
      }
      break;
  }
}

Referenced by: