PspIdentityBasedJobBreakaway

NTSTATUS __stdcall PspIdentityBasedJobBreakaway(PVOID ParentToken, PVOID ChildToken, INT32 *JobBreakaway){
  NTSTATUS v4; 
  NTSTATUS v5; 
  UINT64 *v7; 
  UINT64 v8; 
  UINT64 PackageSize[2]; 
  UINT64 AppIdSize; 
  UNICODE_STRING String2; 
  struct _UNICODE_STRING DestinationString; 
  UNICODE_STRING v13; 
  UNICODE_STRING String1; 
  WCHAR AppId[72]; 
  WCHAR SourceString[128]; 
  PackageSize[0] = 256i64;
  *JobBreakaway = 0;
  v8 = 256i64;
  AppIdSize = 132i64;
  PackageSize[1] = 132i64;
  DestinationString = 0i64;
  String1 = 0i64;
  String2 = 0i64;
  v13 = 0i64;
  v4 = RtlQueryPackageIdentityEx(ParentToken, SourceString, PackageSize, AppId, &AppIdSize, v7);
  v5 = v4;
  if( v4 == -1073741275 || v4 == -2147483643 )
    v5 = 0;
  if( v5 >= 0 )
    *JobBreakaway = 1;
  return v5;
}

Referenced by:

PspInitializeProcessSecurity