PsGetEffectiveContainerId

NTSTATUS __stdcall PsGetEffectiveContainerId(
        _CONTAINER_TYPE ContainerType,
        VOID **Thread,
        _CONTAINER_ID_INFO *ContainerIdInfo){
  _ETHREAD *WorkOnBehalfThread; 
  _ETHREAD *v8; 
  _EJOB *volatile Job; 
  __int32 v10; 
  __int64 v11; 
  __int32 v12; 
  _GUID v13; 
  UINT64 DerefThread; 

  LODWORD(DerefThread) = 0;
  if( ContainerType >= ContainerTypeMaximumList )
    return -1073741585;
  if( Thread )
  {
    ContainerIdInfo->ContainerId = 0i64;
    ContainerIdInfo->Flags = 0;
    if( (KeGetPcr()->Prcb._bf_0 & 0x10001) != 0 && Thread == (VOID **)KeGetCurrentThread() )
      return 0;
    WorkOnBehalfThread = PsGetWorkOnBehalfThread(Thread, &DerefThread);
    v8 = WorkOnBehalfThread;
    if( WorkOnBehalfThread )
    {
      Job = WorkOnBehalfThread->Tcb.Process->Job;
      ContainerIdInfo->Flags |= 1u;
    }
    else
    {
      Job = (_EJOB *volatile)*((_QWORD *)Thread[68] + 162);
    }
    if( !Job )
    {
LABEL_13:
      if( (_DWORD)DerefThread )
        ObfDereferenceObjectWithTag(v8, 0x746C6644ui64);
      return 0;
    }
    if( ContainerType )
    {
      v10 = ContainerType - 2;
      if( !v10 )
      {
        v11 = *((_QWORD *)Job + 104);
LABEL_12:
        if( !v11 )
          goto LABEL_13;
        v13 = *(_GUID *)(v11 + 1240);
        goto LABEL_21;
      }
      v12 = v10 - 1;
      if( !v12 )
      {
        v11 = *((_QWORD *)Job + 105);
        goto LABEL_12;
      }
      if( v12 != 1 )
        goto LABEL_13;
    }
    v13 = *(_GUID *)((char *)Job + 1240);
LABEL_21:
    ContainerIdInfo->ContainerId = v13;
    goto LABEL_13;
  }
  return -1073741584;
}

Referenced by: