PfSnIsHostingApplication

UINT8 __stdcall PfSnIsHostingApplication(PWCHAR ExecutableName){
  __int64 v1; 
  __int64 v3; 
  _ETHREAD *CurrentThread; 
  UINT8 v5; 
  const WCHAR *v6; 
  wchar_t *v7; 
  wchar_t *v8; 
  wchar_t *v10; 
  v1 = -1i64;
  v3 = -1i64;
  do
    ++v3;
  while( ExecutableName[v3] );
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v5 = 0;
  --*((_WORD *)CurrentThread + 242);
  ExAcquirePushLockSharedEx((UINT64)&qword_140C4FFF8, 0i64);
  do
    ++v1;
  while( *(&Str + v1) );
  v6 = &Str;
  v7 = (wchar_t *)&PfGlobals + v1 + 120;
  while( 1 )
  {
    v8 = wcsstr(v6, ExecutableName);
    if( !v8 || v8 < &Str || v8 >= v7 )
      break;
    if( v8 == &Str || *(v8 - 1) == 44 )
    {
      v10 = &v8[(unsigned int)v3];
      if( v10 == v7 || *v10 == 44 )
      {
        v5 = 1;
        break;
      }
    }
    v6 = v8 + 1;
  }
  if( _InterlockedCompareExchange64((volatile signed __int64 *)&qword_140C4FFF8, 0i64, 17i64) != 17 )
    ExfReleasePushLockShared((INT64 *)&qword_140C4FFF8);
  KeAbPostRelease(&qword_140C4FFF8);
  KeLeaveCriticalRegion();
  return v5;
}

Referenced by: