EtwpQueryTokenPackageInfo

__int64 __fastcall EtwpQueryTokenPackageInfo(__int64 a1, __int64 a2, _DWORD *a3){
  UINT64 *AppIdSize; 
  __int64 result; 
  UINT8 v8; 
  UINT8 v9; 
  AppIdSize = (UINT64 *)(a2 + 8);
  *(_QWORD *)a2 = 0i64;
  v8 = 0;
  v9 = 0;
  *(_QWORD *)(a2 + 8) = 0i64;
  PsQueryProcessAttributesByToken((PVOID)a1, &v8, &v9);
  if( v8 )
  {
    *a3 |= 1u;
    *(_QWORD *)a2 = 256i64;
    *AppIdSize = 130i64;
    if( RtlQueryPackageIdentity((PVOID)a1, (PWCHAR)(a2 + 16), (UINT64 *)a2, (PWCHAR)(a2 + 272), AppIdSize, 0i64) < 0 )
    {
      *(_QWORD *)a2 = 0i64;
      *AppIdSize = 0i64;
    }
    if( v9 )
      *a3 |= 8u;
  }
  result = 2i64;
  if( !*(_QWORD *)a2 )
  {
    *(_QWORD *)a2 = 2i64;
    *(_WORD *)(a2 + 16) = 0;
  }
  if( !*AppIdSize )
  {
    *AppIdSize = 2i64;
    *(_WORD *)(a2 + 272) = 0;
  }
  return result;
}

Referenced by: