DbgkpOpenHandles

VOID __stdcall DbgkpOpenHandles(_DBGUI_WAIT_STATE_CHANGE *WaitStateChange, VOID *Process, VOID *Thread){
  VOID *v5; 
  _EPROCESS *v6; 
  _DBGUI_WAIT_STATE_CHANGE *v7; 
  _EPROCESS *v8; 
  _DBGUI_WAIT_STATE_CHANGE *v9; 
  _OBJECT_TYPE *ObjectType; 
  _OBJECT_TYPE *ObjectTypea; 
  INT64 AccessMode; 
  _KPROCESSOR_MODE AccessModea; 
  INT64 AccessModeb; 
  VOID **Handle; 
  VOID **Handlea; 

  switch( *WaitStateChange )
  {
    case 2:
      v9 = WaitStateChange + 6;
      LOBYTE(AccessMode) = 0;
      if( ObOpenObjectByPointer(
             Thread,
             0i64,
             0i64,
             1179771,
             (POBJECT_TYPE)PsThreadType,
             AccessMode,
             (VOID **)WaitStateChange + 3) < 0 )
        *(_QWORD *)v9 = 0i64;
      break;
    case 3:
      v7 = WaitStateChange + 8;
      LOBYTE(AccessMode) = 0;
      if( ObOpenObjectByPointer(
             Thread,
             0i64,
             0i64,
             1179771,
             (POBJECT_TYPE)PsThreadType,
             AccessMode,
             (VOID **)WaitStateChange + 4) < 0 )
        *(_QWORD *)v7 = 0i64;
      LOBYTE(AccessModea) = 0;
      if( ObOpenObjectByPointer(
             Process,
             0i64,
             0i64,
             1181307,
             (POBJECT_TYPE)PsProcessType,
             AccessModea,
             (VOID **)WaitStateChange + 3) < 0 )
        *((_QWORD *)WaitStateChange + 3) = 0i64;
      v5 = (VOID *)*((_QWORD *)WaitStateChange + 6);
      if( v5 )
      {
        LODWORD(Handlea) = 2;
        LODWORD(AccessModeb) = 0;
        LODWORD(ObjectTypea) = 0;
        v8 = KeGetCurrentThread()->ApcState.Process;
        if( ObDuplicateObject(
               (INT64)v8,
               (UINT64)v5,
               (INT64)v8,
               (UINT64 *)WaitStateChange + 6,
               (INT64)ObjectTypea,
               AccessModeb,
               (INT64)Handlea,
               0) < 0 )
          *((_QWORD *)WaitStateChange + 6) = 0i64;
        goto LABEL_14;
      }
      break;
    case 9:
      v5 = (VOID *)*((_QWORD *)WaitStateChange + 3);
      if( v5 )
      {
        LODWORD(Handle) = 2;
        LODWORD(AccessMode) = 0;
        LODWORD(ObjectType) = 0;
        v6 = KeGetCurrentThread()->ApcState.Process;
        if( ObDuplicateObject(
               (INT64)v6,
               (UINT64)v5,
               (INT64)v6,
               (UINT64 *)WaitStateChange + 3,
               (INT64)ObjectType,
               AccessMode,
               (INT64)Handle,
               0) < 0 )
          *((_QWORD *)WaitStateChange + 3) = 0i64;
LABEL_14:
        ObCloseHandle(v5, 0);
      }
      break;
  }
}

Referenced by: