PopEtAppIdIntern
NTSTATUS __stdcall PopEtAppIdIntern(INT64 a1, INT64 *a2){
NTSTATUS v4;
__int64 v5;
__int64 v6;
__int64 v7;
INT64 v8;
INT64 v10[4];
__int64 v11[20];
v10[0] = 80i64;
v4 = 0;
v10[1] = (INT64)v11;
v10[3] = 0i64;
memset(v11, 0i64, sizeof(v11));
v11[0] = *(_QWORD *)(a1 + 32);
v11[6] = *(unsigned __int16 *)(a1 + 78);
v11[4] = *(_QWORD *)(a1 + 64);
v5 = 2i64 * *(unsigned __int16 *)(a1 + 72);
v11[3] = 4i64;
v11[10] = v5;
v11[8] = *(_QWORD *)(a1 + 40);
v6 = 2i64 * *(unsigned __int16 *)(a1 + 74);
v11[7] = 4i64;
v11[14] = v6;
v11[12] = *(_QWORD *)(a1 + 48);
v7 = 2i64 * *(unsigned __int16 *)(a1 + 76);
v11[11] = 2i64;
v11[15] = 2i64;
v11[19] = 2i64;
v11[18] = v7;
v11[16] = *(_QWORD *)(a1 + 56);
v11[2] = 8i64;
v10[2] = 5i64;
LODWORD(v8) = RtlInternTableIntern(PopEtGlobals + 56, (INT64)v10);
if( !v8 )
return -1073741670;
*a2 = v8;
return v4;
}Referenced by:
PopEtGetProcessAppId