RtlpIsAppContainer

NTSTATUS __stdcall RtlpIsAppContainer(VOID *a1, BOOL *a2){
  int v3; 
  INT64 TokenType; 
  VOID *TokenInformation; 
  VOID *AccessToken; 
  void *TokenHandle; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int64 v10; 
  int v11; 

  LODWORD(TokenInformation) = 0;
  TokenHandle = 0i64;
  AccessToken = 0i64;
  v10 = 0i64;
  v11 = 0;
  *a2 = 0;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  if( a1 )
  {
LABEL_7:
    v3 = SeQueryInformationToken(a1, TokenIsAppContainer, &TokenInformation);
    if( v3 >= 0 )
      *a2 = (_DWORD)TokenInformation != 0;
    goto LABEL_9;
  }
  v3 = ZwOpenThreadTokenEx(0xFFFFFFFFFFFFFFFEui64, 8ui64, 1, 512i64, (UINT64)&AccessToken);
  if( v3 == -1073741700 )
  {
    v3 = ZwOpenProcessTokenEx(0xFFFFFFFFFFFFFFFFui64, 10i64, 512i64, (UINT64)&TokenHandle);
    if( v3 < 0 )
      goto LABEL_9;
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.ObjectName = 0i64;
    ObjectAttributes.SecurityDescriptor = 0i64;
    ObjectAttributes.SecurityQualityOfService = &v10;
    LODWORD(TokenType) = 2;
    ObjectAttributes.Length = 48;
    ObjectAttributes.Attributes = 512;
    v10 = 0x20000000Ci64;
    LOWORD(v11) = 1;
    v3 = ZwDuplicateToken((UINT64)TokenHandle, 8i64, (INT64)&ObjectAttributes, 0, TokenType, (UINT64)&AccessToken);
    ZwClose((_HANDLE)TokenHandle);
  }
  if( v3 >= 0 )
  {
    a1 = AccessToken;
    goto LABEL_7;
  }
LABEL_9:
  if( AccessToken )
    ZwClose((_HANDLE)AccessToken);
  return v3;
}

Referenced by: