PopEtAppIdIntern

NTSTATUS __stdcall PopEtAppIdIntern(INT64 a1, INT64 *a2){
  NTSTATUS v4; 
  __int64 v5; 
  __int64 v6; 
  __int64 v7; 
  INT64 v8; 
  INT64 v10[4]; 
  __int64 v11[20]; 

  v10[0] = 80i64;
  v4 = 0;
  v10[1] = (INT64)v11;
  v10[3] = 0i64;
  memset(v11, 0i64, sizeof(v11));
  v11[0] = *(_QWORD *)(a1 + 32);
  v11[6] = *(unsigned __int16 *)(a1 + 78);
  v11[4] = *(_QWORD *)(a1 + 64);
  v5 = 2i64 * *(unsigned __int16 *)(a1 + 72);
  v11[3] = 4i64;
  v11[10] = v5;
  v11[8] = *(_QWORD *)(a1 + 40);
  v6 = 2i64 * *(unsigned __int16 *)(a1 + 74);
  v11[7] = 4i64;
  v11[14] = v6;
  v11[12] = *(_QWORD *)(a1 + 48);
  v7 = 2i64 * *(unsigned __int16 *)(a1 + 76);
  v11[11] = 2i64;
  v11[15] = 2i64;
  v11[19] = 2i64;
  v11[18] = v7;
  v11[16] = *(_QWORD *)(a1 + 56);
  v11[2] = 8i64;
  v10[2] = 5i64;
  LODWORD(v8) = RtlInternTableIntern(PopEtGlobals + 56, (INT64)v10);
  if( !v8 )
    return -1073741670;
  *a2 = v8;
  return v4;
}

Referenced by:

PopEtGetProcessAppId