ObCaptureObjectStateForDuplication

NTSTATUS __stdcall ObCaptureObjectStateForDuplication(
        PVOID SourceProcess,
        VOID *SourceHandle,
        UINT64 DesiredAccess,
        UINT64 Options,
        INT8 PreviousMode,
        _OB_DUPLICATE_OBJECT_STATE *DuplicateInfo){
  char v6; 
  int v7; 
  int v10; 
  _HANDLE_TABLE *v11; 
  int v12; 
  char *v13; 
  bool v14; 
  unsigned int v15; 
  _OB_DUPLICATE_OBJECT_STATE *v16; 
  int v17; 
  __int64 v18; 
  int v19; 
  UINT64 Tag; 
  _OBJECT_HANDLE_INFORMATION SecurityDescriptor; 
  _HANDLE_TABLE_ENTRY_INFO ObjectInfo; 
  PVOID Object; 
  UINT64 AccessMask; 
  UINT64 GrantedAccess; 

  SecurityDescriptor = 0i64;
  v6 = Options;
  ObjectInfo = 0i64;
  v7 = DesiredAccess;
  Object = 0i64;
  v10 = Options & 2;
  if( (Options & 2) == 0 && (DesiredAccess & 0xCE00000) != 0 )
    return -1073741790;
  v11 = ObReferenceProcessHandleTable((_EPROCESS *)SourceProcess);
  if( !v11 )
    return -1073741558;
  LODWORD(Tag) = 1967415887;
  v12 = ObpReferenceProcessObjectByHandle(
          SourceHandle,
          (_EPROCESS *)SourceProcess,
          v11,
          PreviousMode,
          Tag,
          &Object,
          &SecurityDescriptor,
          &ObjectInfo);
  if( v12 < 0 )
  {
    ExReleaseRundownProtection((_EX_RUNDOWN_REF *)SourceProcess + 139);
    return v12;
  }
  if( (SecurityDescriptor.HandleAttributes & 4) != 0 )
    ObjectInfo.AuditMask = 0;
  v13 = (char *)Object;
  v14 = v10 == 0;
  v15 = SecurityDescriptor.GrantedAccess;
  v16 = DuplicateInfo;
  if( !v14 )
    v7 = SecurityDescriptor.GrantedAccess;
  LODWORD(AccessMask) = v7;
  v17 = SecurityDescriptor.HandleAttributes & 4 | 8;
  if( (v6 & 8) == 0 )
    v17 = SecurityDescriptor.HandleAttributes & 0xC;
  DuplicateInfo->ObjectInfo = ObjectInfo;
  v18 = ObTypeIndexTable[(unsigned __int8)ObHeaderCookie ^ (unsigned __int8)*(v13 - 24) ^ (unsigned __int64)(unsigned __int8)((unsigned __int16)((_WORD)v13 - 48) >> 8)];
  if( (v7 & 0xF0000000) != 0 )
  {
    RtlMapGenericMask(&AccessMask, (_GENERIC_MAPPING *)(v18 + 76));
    v7 = AccessMask;
  }
  LODWORD(GrantedAccess) = v7 & (*(_DWORD *)(v18 + 92) | 0x1000000);
  if( (~v15 & (unsigned int)GrantedAccess) != 0 )
  {
    ExReleaseRundownProtection((_EX_RUNDOWN_REF *)SourceProcess + 139);
    ObfDereferenceObjectWithTag(v13, 0x7544624Fui64);
    return -1073741790;
  }
  v19 = ObpIncrementHandleCountEx(ObDuplicateHandle, &GrantedAccess, SourceProcess, v13, PreviousMode, v17, 0i64);
  ExReleaseRundownProtection((_EX_RUNDOWN_REF *)SourceProcess + 139);
  if( v19 < 0 )
  {
    ObfDereferenceObjectWithTag(v13, 0x7544624Fui64);
  }
  else
  {
    v16->TargetAccess = GrantedAccess;
    v16->SourceHandle = SourceHandle;
    v16->HandleAttributes = v17;
    ObfReferenceObjectWithTag(SourceProcess, 0x7544624Fui64);
    v16->SourceProcess = (_EPROCESS *)SourceProcess;
    v16->Object = v13;
  }
  return v19;
}

Referenced by: