ZwDuplicateObject

NTSTATUS __stdcall ZwDuplicateObject(
        VOID *SourceProcessHandle,
        VOID *SourceHandle,
        VOID *TargetProcessHandle,
        VOID **TargetHandle,
        _ACCESS_MASK DesiredAccess,
        UINT64 HandleAttributes,
        UINT64 Options){
  NTSTATUS result; 

  _disable();
  __readeflags();
  KiServiceInternal();
  return result;
}

Referenced by:

ObpCreateHandle
SeAuditHandleCreation
SepReferenceCachedTokenHandles
SmKmFileInfoDuplicate
SysCtxOpenMachine