NtRemoveProcessDebug

NTSTATUS __stdcall NtRemoveProcessDebug(PVOID ProcessHandle, PVOID DebugObjectHandle){
  char v3; 
  NTSTATUS v4; 
  UINT64 v5; 
  _QWORD *v6; 
  NTSTATUS v7; 
  INT64 v8; 
  PVOID Object; 
  struct _OBJECT_HANDLE_INFORMATION v10; 
  INT64 result[14]; 
  v3 = *((_BYTE *)KeGetCurrentThread() + 562);
  v10 = 0i64;
  v4 = ObpReferenceObjectByHandleWithTag(
         (ULONG_PTR)ProcessHandle,
         2048,
         (__int64)PsProcessType,
         v3,
         0x4F676244u,
         (__int64)&v10,
         0i64,
         0i64);
  if( v4 >= 0 )
  {
    LOBYTE(v5) = v3;
    v6 = (_QWORD *)v10;
    if( PsTestProtectedProcessIncompatibility(v5, *((_QWORD *)KeGetCurrentThread() + 23), *(_QWORD *)&v10) )
    {
      v7 = -1073740014;
    }
    else
    {
      v8 = v6[124];
      if( (v8 & 1) == 0
        || (memset((INT64)result, 0i64),
            result[2] = 0i64,
            result[1] = v8,
            v7 = VslpEnterIumSecureMode(2u, 12, 0i64, (INT64)result),
            v7 >= 0) )
      {
        Object = 0i64;
        v7 = ObReferenceObjectByHandle(DebugObjectHandle, 2u, DbgkDebugObjectType, v3, &Object, 0i64);
        if( v7 >= 0 )
        {
          v7 = DbgkClearProcessDebugObject((ULONG_PTR)v6, (__int64)Object);
          HalPutDmaAdapter((PADAPTER_OBJECT)Object);
        }
      }
    }
    ObfDereferenceObjectWithTag(v6, 0x4F676244ui64);
    return v7;
  }
  return v4;
}

Referenced by: