ZwDuplicateObject

NTSTATUS __stdcall ZwDuplicateObject(
        PVOID SourceProcessHandle,
        PVOID SourceHandle,
        PVOID TargetProcessHandle,
        PVOID *TargetHandle,
        UINT64 DesiredAccess,
        UINT64 HandleAttributes,
        UINT64 Options){
  NTSTATUS result; 
  _disable();
  __readeflags();
  KiServiceInternal();
  return result;
}

Referenced by:

ObpCreateHandle
SeAuditHandleCreation
SepReferenceCachedTokenHandles
SmKmFileInfoDuplicate
SysCtxOpenMachine