ObCompleteObjectDuplication

INT64 __fastcall ObCompleteObjectDuplication(
        _OB_DUPLICATE_OBJECT_STATE *DuplicateInfo,
        _EPROCESS *TargetProcess,
        INT64 PreviousMode,
        VOID **TargetHandle,
        UINT *GrantedAccess){
  unsigned __int8 v7; 
  unsigned __int64 v9; 
  __int64 v10; 
  void *Object; 
  bool v12; 
  int v13; 
  char *v14; 
  __int64 v15; 
  _OBJECT_TYPE *v16; 
  void *v17; 
  unsigned __int64 Handle; 
  UINT *v19; 
  UINT v20; 
  _EPROCESS *SourceProcess; 
  int v23; 
  PVOID TargetProcessa; 
  UINT64 DesiredAccess; 
  _OBJECT_TYPE *ObjectType; 
  LIST_ENTRY ThreadCallbackListHead; 
  UINT64 v28; 
  *TargetHandle = 0i64;
  v7 = PreviousMode;
  v9 = ObReferenceProcessHandleTable((struct _EX_RUNDOWN_REF *)TargetProcess);
  v10 = v9;
  if( v9 )
  {
    Object = DuplicateInfo->Object;
    v12 = v9 == ObpKernelHandleTable;
    LODWORD(v28) = DuplicateInfo->TargetAccess;
    v13 = ObpIncrementHandleCountEx(
            2,
            (__int64)&v28,
            (ULONG_PTR)TargetProcess,
            (__int64)Object,
            v7,
            DuplicateInfo->HandleAttributes,
            0i64);
    if( v13 >= 0 )
    {
      v14 = (char *)DuplicateInfo->Object;
      v15 = (__int64)(v14 - 48);
      v16 = (_OBJECT_TYPE *)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ (unsigned __int8)*(v14 - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)v14 - 48) >> 8)];
      ThreadCallbackListHead.Blink = &ThreadCallbackListHead;
      ThreadCallbackListHead.Flink = &ThreadCallbackListHead;
      ObjectType = v16;
      if( !ObpFilterOperation((__int64)v16) )
      {
LABEL_4:
        ObfReferenceObjectWithTag(DuplicateInfo->Object, 0x6E48624Fu);
        Handle = (unsigned __int64)ExCreateHandleEx(
                                     v10,
                                     v15,
                                     v28,
                                     DuplicateInfo->HandleAttributes,
                                     (__int64)&DuplicateInfo->ObjectInfo);
        if( Handle )
        {
          if( (DuplicateInfo->HandleAttributes & 4) != 0
            && (unsigned __int8)SeAuditingWithTokenForSubcategory(0x7Bui64, 0i64) )
          {
            SeAuditHandleDuplication(
              DuplicateInfo->SourceHandle,
              (PVOID)Handle,
              DuplicateInfo->SourceProcess,
              TargetProcess);
          }
        }
        else
        {
          ObfDereferenceObjectWithTag(DuplicateInfo->Object, 0x7544624Fui64);
          ObpDecrementHandleCount((ULONG_PTR)TargetProcess, v15);
          v13 = -1073741670;
        }
        if( v12 )
          Handle |= 0xFFFFFFFF80000000ui64;
        ExReleaseRundownProtection((PEX_RUNDOWN_REF)TargetProcess + 139);
        if( ThreadCallbackListHead.Flink != &ThreadCallbackListHead )
          ObpPostInterceptHandleDuplicate(
            DuplicateInfo->Object,
            v12,
            (unsigned int)v13,
            (unsigned int)v28,
            &ThreadCallbackListHead);
        if( v13 >= 0 )
        {
          v19 = GrantedAccess;
          v20 = v28;
          *TargetHandle = (VOID *)Handle;
          *v19 = v20;
        }
        if( (*(_BYTE *)(&PerfGlobalGroupMask + 2) & 0x40) != 0 && v13 >= 0 )
        {
          LODWORD(TargetProcessa) = *((_DWORD *)TargetProcess + 272);
          EtwTraceDuplicateHandle(
            DuplicateInfo->SourceHandle,
            (VOID *)Handle,
            DuplicateInfo->Object,
            *((unsigned int *)DuplicateInfo->SourceProcess + 272),
            (UINT64)TargetProcessa,
            ObjectType);
        }
        return(unsigned int)v13;
      }
      SourceProcess = DuplicateInfo->SourceProcess;
      LODWORD(DesiredAccess) = v28;
      v13 = ObpPreInterceptHandleDuplicate(
              v17,
              v12,
              &DesiredAccess,
              SourceProcess,
              TargetProcess,
              &ThreadCallbackListHead);
      if( v13 >= 0 )
      {
        v23 = v28;
        if( !v12 )
          v23 = DesiredAccess;
        LODWORD(v28) = v23;
        goto LABEL_4;
      }
      ObpDecrementHandleCount((ULONG_PTR)TargetProcess, v15);
    }
    ExReleaseRundownProtection((PEX_RUNDOWN_REF)TargetProcess + 139);
    return(unsigned int)v13;
  }
  return 3221225738i64;
}

Referenced by: