RtlGetAppContainerParent

INT64 __stdcall RtlGetAppContainerParent(PVOID ChildAppContainerSid, PVOID *ParentAppContainerSid){
  UINT *PoolWithQuotaTag; 
  UINT64 v5; 
  UINT *v6; 
  int v8; 
  unsigned __int8 v9; 
  UINT *v10; 
  UINT *v11; 
  int v12; 
  *ParentAppContainerSid = 0i64;
  v12 = 0;
  if( (int)RtlGetAppContainerSidType(ChildAppContainerSid, &v12) < 0 || v12 != 1 )
    return 3221225485i64;
  PoolWithQuotaTag = (UINT *)ExAllocatePoolWithQuotaTag((POOL_TYPE)520, 0x28ui64, 0x62507452ui64);
  v6 = PoolWithQuotaTag;
  if( !PoolWithQuotaTag )
    return 3221225626i64;
  LOBYTE(v5) = 8;
  v8 = RtlInitializeSid(PoolWithQuotaTag, (SID_IDENTIFIER_AUTHORITY *)&RtlpAppPackageAuthority, v5);
  if( v8 < 0 )
  {
    ExFreePoolWithTag(v6, 0);
  }
  else
  {
    v9 = 0;
    v10 = v6 + 2;
    do
    {
      v11 = RtlSubAuthoritySid(ChildAppContainerSid, v9++);
      *v10++ = *v11;
    }
    while( v9 < 8u );
    *ParentAppContainerSid = v6;
    return 0;
  }
  return(unsigned int)v8;
}

Referenced by: