ObCompleteObjectDuplication

NTSTATUS __stdcall ObCompleteObjectDuplication(
        _OB_DUPLICATE_OBJECT_STATE *DuplicateInfo,
        _EPROCESS *TargetProcess,
        INT8 PreviousMode,
        VOID **TargetHandle,
        UINT64 *GrantedAccess){
  _HANDLE_TABLE *v9; 
  _HANDLE_TABLE *v10; 
  void *Object; 
  bool v12; 
  NTSTATUS v13; 
  char *v14; 
  _OBJECT_HEADER *v15; 
  _OBJECT_TYPE *v16; 
  _KNOWN_CONTROLLER_TYPE v17; 
  _KNOWN_CONTROLLER_TYPE v18; 
  unsigned __int64 Handle; 
  UINT64 *v20; 
  int v21; 
  int v23; 
  UINT64 AccessMode; 
  _KNOWN_CONTROLLER_TYPE v25; 
  _OBJECT_TYPE *ObjectType; 
  _LIST_ENTRY ThreadCallbackListHead; 
  UINT64 v28; 

  *TargetHandle = 0i64;
  v9 = ObReferenceProcessHandleTable(TargetProcess);
  v10 = v9;
  if( v9 )
  {
    Object = DuplicateInfo->Object;
    v12 = v9 == HandleTable;
    LODWORD(v28) = DuplicateInfo->TargetAccess;
    v13 = ObpIncrementHandleCountEx(
            ObDuplicateHandle,
            &v28,
            TargetProcess,
            Object,
            PreviousMode,
            DuplicateInfo->HandleAttributes,
            0i64);
    if( v13 >= 0 )
    {
      v14 = (char *)DuplicateInfo->Object;
      v15 = (_OBJECT_HEADER *)(v14 - 48);
      v16 = (_OBJECT_TYPE *)ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ (unsigned __int8)*(v14 - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)v14 - 48) >> 8)];
      ThreadCallbackListHead.Blink = &ThreadCallbackListHead;
      ThreadCallbackListHead.Flink = &ThreadCallbackListHead;
      ObjectType = v16;
      if( !ObpFilterOperation(v16) )
      {
LABEL_4:
        ObfReferenceObjectWithTag(DuplicateInfo->Object, 0x6E48624Fui64);
        Handle = (unsigned __int64)ExCreateHandleEx(
                                     v10,
                                     v15,
                                     (unsigned int)v28,
                                     DuplicateInfo->HandleAttributes,
                                     &DuplicateInfo->ObjectInfo);
        if( Handle )
        {
          if( (DuplicateInfo->HandleAttributes & 4) != 0 && SeAuditingWithTokenForSubcategory(123i64, 0i64) )
            SeAuditHandleDuplication(
              DuplicateInfo->SourceHandle,
              (VOID *)Handle,
              DuplicateInfo->SourceProcess,
              TargetProcess);
        }
        else
        {
          ObfDereferenceObjectWithTag(DuplicateInfo->Object, 0x7544624Fui64);
          ObpDecrementHandleCount(TargetProcess, v15);
          v13 = -1073741670;
        }
        if( v12 )
          Handle |= 0xFFFFFFFF80000000ui64;
        ExReleaseRundownProtection(&TargetProcess->RundownProtect);
        if( ThreadCallbackListHead.Flink != &ThreadCallbackListHead )
          ObpPostInterceptHandleDuplicate(
            DuplicateInfo->Object,
            v12,
            (unsigned int)v13,
            (unsigned int)v28,
            &ThreadCallbackListHead);
        if( v13 >= 0 )
        {
          v20 = GrantedAccess;
          v21 = v28;
          *TargetHandle = (VOID *)Handle;
          *(_DWORD *)v20 = v21;
        }
        if( (xmmword_140CFB490 & 0x40) != 0 && v13 >= 0 )
        {
          LODWORD(AccessMode) = TargetProcess->UniqueProcessId;
          EtwTraceDuplicateHandle(
            DuplicateInfo->SourceHandle,
            (VOID *)Handle,
            DuplicateInfo->Object,
            LODWORD(DuplicateInfo->SourceProcess->UniqueProcessId),
            AccessMode,
            ObjectType);
        }
        return v13;
      }
      LOBYTE(v17) = v12;
      v25 = (int)v28;
      v13 = ObpPreInterceptHandleDuplicate(v18, v17, (_KNOWN_CONTROLLER_TYPE)&v25);
      if( v13 >= 0 )
      {
        v23 = v28;
        if( !v12 )
          v23 = v25;
        LODWORD(v28) = v23;
        goto LABEL_4;
      }
      ObpDecrementHandleCount(TargetProcess, v15);
    }
    ExReleaseRundownProtection(&TargetProcess->RundownProtect);
    return v13;
  }
  return -1073741558;
}

Referenced by: