NtDebugActiveProcess

NTSTATUS __stdcall NtDebugActiveProcess(PVOID ProcessHandle, PVOID DebugObjectHandle){
  KPROCESSOR_MODE v3; 
  NTSTATUS result; 
  UINT64 v5; 
  _ETHREAD *CurrentThread; 
  struct _EX_RUNDOWN_REF *v7; 
  _QWORD *v8; 
  NTSTATUS v9; 
  __int64 v10; 
  __int16 v11; 
  unsigned __int64 Count; 
  __int16 v13; 
  bool v14; 
  KEVENT *v15; 
  unsigned int v16; 
  struct _EX_RUNDOWN_REF *v17; 
  PVOID v18; 
  PVOID Object; 
  v18 = 0i64;
  v3 = *((_BYTE *)KeGetCurrentThread() + 562);
  v17 = 0i64;
  result = ObReferenceObjectByHandleWithTag(
             ProcessHandle,
             0x800u,
             (POBJECT_TYPE)PsProcessType,
             v3,
             0x4F676244u,
             &v18,
             0i64);
  if( result >= 0 )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    v7 = (struct _EX_RUNDOWN_REF *)v18;
    v8 = (_QWORD *)*((_QWORD *)CurrentThread + 23);
    if( v18 == v8 || v18 == PsInitialSystemProcess )
    {
      v9 = -1073741790;
    }
    else
    {
      LOBYTE(v5) = v3;
      if( PsTestProtectedProcessIncompatibility(v5, *((_QWORD *)CurrentThread + 23), (__int64)v18) )
      {
        v9 = -1073740014;
      }
      else if( (v7[124].Count & 1) == 0 || (v9 = PsRequestDebugSecureProcess((INT64)v7, 1u), v9 >= 0) )
      {
        v10 = v8[176];
        if( !v10
          || (v11 = *(_WORD *)(v10 + 8), v11 != 332) && v11 != 452
          || (Count = v7[176].Count) != 0 && ((v13 = *(_WORD *)(Count + 8), v13 == 332) || v13 == 452) )
        {
          Object = 0i64;
          v9 = ObReferenceObjectByHandle(DebugObjectHandle, 2u, DbgkDebugObjectType, v3, &Object, 0i64);
          if( v9 >= 0 )
          {
            v14 = ExAcquireRundownProtection(v7 + 139);
            v15 = (KEVENT *)Object;
            if( v14 )
            {
              v16 = DbgkpPostFakeProcessCreateMessages((ULONG_PTR)v7, (struct _KEVENT *)Object, &v17);
              v9 = DbgkpSetProcessDebugObject((_EPROCESS *)v7, v15, v16, v17);
              ExReleaseRundownProtection(v7 + 139);
            }
            else
            {
              v9 = -1073741558;
            }
            HalPutDmaAdapter((PADAPTER_OBJECT)v15);
          }
        }
        else
        {
          v9 = -1073741637;
        }
      }
    }
    ObfDereferenceObjectWithTag(v7, 0x4F676244ui64);
    return v9;
  }
  return result;
}

Referenced by: