MiIsStoreProcess

NTSTATUS __stdcall MiIsStoreProcess(_EPROCESS *Process){
  __int64 v1; 
  NTSTATUS result; 

  v1 = *(_QWORD *)(*(&stru_140C4DB30 + 267) + 8i64 * Process->Vm.Instance.PartitionId);
  result = 0;
  if( *(_DWORD *)(v1 + 1160) )
  {
    if( *(_EPROCESS **)(v1 + 1280) == Process )
      return 1;
  }
  return result;
}

Referenced by: