StarCraft Multi-Loader

StarCraft.exe has a handle like this:

Event, \Sessions\1\BaseNamedObjects\Starcraft Check For Other Instances, 0x00

Duplicate execution is possible by terminating this.

※ This requires administrator privileges.

1. Get system all handle list from ZwQueryInformationProcess
2. Copy handle from DuplicateHandle
3. Get handle name from NtQueryObject
4. check if name is Starcraft Check For Other Instances
5. Close handle DuplicateHandle flag DUPLICATE_CLOSE_SOURCE