NtDuplicateObject

NTSTATUS __stdcall NtDuplicateObject(
        PVOID SourceProcessHandle,
        PVOID SourceHandle,
        PVOID TargetProcessHandle,
        PVOID *TargetHandle,
        UINT64 DesiredAccess,
        UINT64 HandleAttributes,
        UINT64 Options){
  PVOID v10; 
  KPROCESSOR_MODE v11; 
  NTSTATUS result; 
  int v13; 
  PVOID v14; 
  PVOID v15; 
  NTSTATUS v16; 
  __int64 v17; 
  PVOID v18; 
  PVOID Object; 
  void *v20; 
  v10 = 0i64;
  v20 = 0i64;
  Object = 0i64;
  v18 = 0i64;
  v11 = *((_BYTE *)KeGetCurrentThread() + 562);
  if( TargetHandle && v11 )
  {
    v17 = (__int64)TargetHandle;
    if( (unsigned __int64)TargetHandle >= 0x7FFFFFFF0000i64 )
      v17 = 0x7FFFFFFF0000i64;
    *(_QWORD *)v17 = *(_QWORD *)v17;
    *TargetHandle = 0i64;
  }
  result = ObReferenceObjectByHandleWithTag(
             SourceProcessHandle,
             0x40u,
             (POBJECT_TYPE)PsProcessType,
             v11,
             0x7544624Fu,
             &Object,
             0i64);
  if( result >= 0 )
  {
    if( TargetProcessHandle )
    {
      v13 = ObReferenceObjectByHandleWithTag(
              TargetProcessHandle,
              0x40u,
              (POBJECT_TYPE)PsProcessType,
              v11,
              0x7544624Fu,
              &v18,
              0i64);
      if( v13 < 0 )
      {
        v18 = 0i64;
        goto LABEL_7;
      }
    }
    else
    {
      v13 = 0;
    }
    v10 = v18;
LABEL_7:
    v14 = SourceHandle;
    v15 = Object;
    v16 = ObDuplicateObject(Object, v14, v10, &v20, DesiredAccess, HandleAttributes, Options, v11);
    if( TargetHandle )
      *TargetHandle = v20;
    ObfDereferenceObjectWithTag(v15, 0x7544624Fui64);
    if( v10 )
      ObfDereferenceObjectWithTag(v10, 0x7544624Fui64);
    if( v13 < 0 )
      return v13;
    return v16;
  }
  return result;
}

Referenced by: