NtDebugActiveProcess

NTSTATUS __stdcall NtDebugActiveProcess(VOID *ProcessHandle, VOID *DebugObjectHandle){
  char PreviousMode; 
  NTSTATUS result; 
  _ETHREAD *CurrentThread; 
  _EPROCESS *v6; 
  _EPROCESS *Process; 
  int v8; 
  _EWOW64PROCESS *WoW64Process; 
  unsigned __int16 Machine; 
  _EWOW64PROCESS *v11; 
  unsigned __int16 v12; 
  UINT8 v13; 
  _KEVENT *v14; 
  unsigned int v15; 
  UINT64 Tag; 
  _EX_RUNDOWN_REF *pLastThread; 
  _EPROCESS *TargetProcess; 
  PVOID Object; 

  TargetProcess = 0i64;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  pLastThread = 0i64;
  LODWORD(Tag) = 1332175428;
  result = ObReferenceObjectByHandleWithTag(
             ProcessHandle,
             0x800ui64,
             (_OBJECT_TYPE *)PsProcessType,
             PreviousMode,
             Tag,
             (VOID **)&TargetProcess,
             0i64);
  if( result >= 0 )
  {
    CurrentThread = (_ETHREAD *)KeGetCurrentThread();
    v6 = TargetProcess;
    Process = CurrentThread->Tcb.ApcState.Process;
    if( TargetProcess == Process || TargetProcess == PsInitialSystemProcess )
    {
      v8 = -1073741790;
    }
    else if( PsTestProtectedProcessIncompatibility(PreviousMode, CurrentThread->Tcb.ApcState.Process, TargetProcess) )
    {
      v8 = -1073740014;
    }
    else if( (*(_BYTE *)&v6->Pcb.SecureState & 1) == 0 || (v8 = PsRequestDebugSecureProcess((__int64)v6, 1u), v8 >= 0) )
    {
      WoW64Process = Process->WoW64Process;
      if( !WoW64Process
        || (Machine = WoW64Process->Machine, Machine != 332) && Machine != 452
        || (v11 = v6->WoW64Process) != 0i64 && ((v12 = v11->Machine, v12 == 332) || v12 == 452) )
      {
        Object = 0i64;
        v8 = ObReferenceObjectByHandle(DebugObjectHandle, 2ui64, DbgkDebugObjectType, PreviousMode, &Object, 0i64);
        if( v8 >= 0 )
        {
          v13 = ExAcquireRundownProtection(&v6->RundownProtect);
          v14 = (_KEVENT *)Object;
          if( v13 )
          {
            v15 = DbgkpPostFakeProcessCreateMessages(v6, (_KEVENT *)Object, &pLastThread);
            v8 = DbgkpSetProcessDebugObject((ULONG_PTR)v6, v14, v15, (_ETHREAD *)pLastThread);
            ExReleaseRundownProtection(&v6->RundownProtect);
          }
          else
          {
            v8 = -1073741558;
          }
          HalPutDmaAdapter((PADAPTER_OBJECT)v14);
        }
      }
      else
      {
        v8 = -1073741637;
      }
    }
    ObfDereferenceObjectWithTag(v6, 0x4F676244ui64);
    return v8;
  }
  return result;
}

Referenced by: