SepIsParentOfChildAppContainer

UINT8 __stdcall SepIsParentOfChildAppContainer(UINT64 SessionId, UINT64 LowboxNumber1, UINT64 LowboxNumber2){
  unsigned int v3; 
  unsigned int v4; 
  unsigned int v5; 
  UINT8 IsParentOfChildAppContainer; 
  char v7; 
  _ETHREAD *CurrentThread; 
  _ETHREAD *v9; 
  _SEP_LOWBOX_NUMBER_MAPPING *v10; 
  _SEP_LOWBOX_NUMBER_ENTRY *MatchingEntry2; 
  _SEP_LOWBOX_NUMBER_ENTRY *MatchingEntry1; 
  _SEP_LOWBOX_NUMBER_MAPPING *LowboxMap; 

  v3 = SessionId;
  LowboxMap = 0i64;
  v4 = LowboxNumber2;
  MatchingEntry1 = 0i64;
  v5 = LowboxNumber1;
  MatchingEntry2 = 0i64;
  IsParentOfChildAppContainer = 0;
  v7 = 0;
  if( (_DWORD)LowboxNumber1 && (_DWORD)LowboxNumber2 )
  {
    if( (unsigned int)SessionId >= 5 )
    {
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      --CurrentThread->Tcb.KernelApcDisable;
      ExAcquirePushLockSharedEx(&stru_140C25D50, 0i64);
      v7 = 1;
      if( SepGetTokenSessionMapEntry(v3, 0, &LowboxMap) < 0 )
      {
LABEL_11:
        if( _InterlockedCompareExchange64(&stru_140C25D50._bf_0, 0i64, 17i64) != 17 )
          ExfReleasePushLockShared(&stru_140C25D50);
        KeAbPostRelease(&stru_140C25D50);
        KeLeaveCriticalRegionThread(KeGetCurrentThread());
        return IsParentOfChildAppContainer;
      }
    }
    else
    {
      LowboxMap = (_SEP_LOWBOX_NUMBER_MAPPING *)((char *)&unk_140C25C80 + 40 * (unsigned int)SessionId);
    }
    v9 = (_ETHREAD *)KeGetCurrentThread();
    --v9->Tcb.KernelApcDisable;
    v10 = LowboxMap;
    ExAcquirePushLockExclusiveEx(&LowboxMap->Lock, 0i64);
    if( SepFindMatchingLowBoxNumberEntries(v10->HashTable, v5, v4, &MatchingEntry1, &MatchingEntry2) >= 0 )
      IsParentOfChildAppContainer = RtlIsParentOfChildAppContainer(
                                      MatchingEntry1->PackageSid,
                                      MatchingEntry2->PackageSid);
    if( (_InterlockedExchangeAdd64(&v10->Lock._bf_0, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock(&LowboxMap->Lock);
    KeAbPostRelease(LowboxMap);
    KeLeaveCriticalRegionThread(KeGetCurrentThread());
    if( !v7 )
      return IsParentOfChildAppContainer;
    goto LABEL_11;
  }
  return 0;
}

Referenced by: