Not yet solve the problem:
1. [fs + 0F24h] stored in something.
This function simply construct a OBJECT_ATTRIBUTES, and then call the kernel CreateDebugObject () to create an object to be debugged.
When the function starts simple judgment of the debugger [fs: F24h] whether there is value (associated with debugging), if zero is trying to build a kernel object.
The last call to the kernel function NtCreateDbgObject, when the value of its argument come calling:
