PsIsProcessAppContainer

char __fastcall PsIsProcessAppContainer(_EPROCESS *a1){
  char v1; 
  struct _DMA_ADAPTER *v2; 
  int v3; 
  PVOID TokenInformation; 
  v1 = 0;
  LODWORD(TokenInformation) = 0;
  v2 = (struct _DMA_ADAPTER *)PsReferencePrimaryToken((PEPROCESS)a1);
  v3 = SeQueryInformationToken(v2, TokenIsAppContainer, &TokenInformation);
  HalPutDmaAdapter(v2);
  if( v3 >= 0 && (_DWORD)TokenInformation )
    return 1;
  return v1;
}

Referenced by: