NtCreateDebugObject

NTSTATUS __stdcall NtCreateDebugObject(
        VOID **DebugObjectHandle,
        _ACCESS_MASK DesiredAccess,
        POBJECT_ATTRIBUTES ObjectAttributes,
        UINT64 Flags,
        VOID *a5){
  char v5; 
  VOID **v7; 
  char PreviousMode; 
  NTSTATUS result; 
  PRKEVENT v10; 
  _EWOW64PROCESS *WoW64Process; 
  unsigned __int16 Machine; 
  VOID *v13; 
  VOID *v14; 
  UINT64 ObjectBodySize; 
  PVOID *Handle; 
  UINT64 v17; 
  PRKEVENT Event; 
  PVOID v19; 

  v5 = Flags;
  v7 = DebugObjectHandle;
  v19 = 0i64;
  Event = 0i64;
  PreviousMode = KeGetCurrentThread()->PreviousMode;
  if( PreviousMode )
  {
    DebugObjectHandle = (VOID **)0x7FFFFFFF0000i64;
    if( (unsigned __int64)v7 < 0x7FFFFFFF0000i64 )
      DebugObjectHandle = v7;
    *DebugObjectHandle = *DebugObjectHandle;
  }
  *v7 = 0i64;
  if( (Flags & 0xFFFFFFFE) != 0 )
    return -1073741811;
  LODWORD(v17) = 0;
  LODWORD(Handle) = 0;
  LODWORD(ObjectBodySize) = 104;
  LOBYTE(Flags) = PreviousMode;
  LOBYTE(DebugObjectHandle) = PreviousMode;
  result = ObCreateObjectEx(
             (UINT64)DebugObjectHandle,
             DbgkDebugObjectType,
             ObjectAttributes,
             Flags,
             v13,
             ObjectBodySize,
             (UINT64)Handle,
             v17,
             (VOID **)&Event,
             0i64);
  if( result >= 0 )
  {
    v10 = Event;
    *((_DWORD *)Event + 6) = 1;
    *((_QWORD *)v10 + 4) = 0i64;
    *((_DWORD *)v10 + 10) = 0;
    KeInitializeEvent((INT64)v10 + 48, 1, 0);
    *((_QWORD *)v10 + 11) = (char *)v10 + 80;
    *((_QWORD *)v10 + 10) = (char *)v10 + 80;
    KeInitializeEvent((INT64)v10, 0, 0);
    if( (v5 & 1) != 0 )
      *((_DWORD *)v10 + 24) = 2;
    else
      *((_DWORD *)v10 + 24) = 0;
    WoW64Process = KeGetCurrentThread()->ApcState.Process->WoW64Process;
    if( WoW64Process )
    {
      Machine = WoW64Process->Machine;
      if( Machine == 332 || Machine == 452 )
        *((_DWORD *)v10 + 24) |= 4u;
    }
    LODWORD(v14) = 0;
    result = ObInsertObjectEx(Event, 0i64, (unsigned int)DesiredAccess, 0i64, (UINT64)v14, 0i64, &v19);
    if( result >= 0 )
      *v7 = v19;
  }
  return result;
}

Referenced by: