RtlpQueryPackageIdentityAttributes

NTSTATUS __stdcall RtlpQueryPackageIdentityAttributes(
        VOID *TokenObject,
        VOID *AttributeBuffer,
        VOID *PkgClaim,
        PS_PKG_CLAIM *AttributesPresent,
        UINT64 *AttributesPresenta){
  UINT64 *v5; 
  unsigned __int8 v9; 
  unsigned int v10; 
  NTSTATUS result; 
  __int64 v12; 
  UINT64 BufferLength; 
  UINT64 BufferLengtha; 
  UINT64 BufferLengthb; 
  UINT64 pReturnLength; 

  v5 = AttributesPresenta;
  if( AttributesPresenta )
    *AttributesPresenta = 0i64;
  v9 = 1;
  v10 = 1;
  if( AttributesPresent || v5 )
    v10 = 2;
  LODWORD(BufferLength) = 816;
  result = SeQuerySecurityAttributesToken(TokenObject, &pAttributes, v10, PkgClaim, BufferLength, &pReturnLength);
  if( result < 0 )
  {
    if( result != -1073741275 )
      return result;
    if( v10 == 1 )
      return result;
    LODWORD(BufferLengtha) = 816;
    result = SeQuerySecurityAttributesToken(TokenObject, &pAttributes, 1ui64, PkgClaim, BufferLengtha, &pReturnLength);
    if( result < 0 )
      return result;
    v9 = 0;
  }
  if( !*((_DWORD *)PkgClaim + 1) )
    return -1073741275;
  if( AttributesPresent )
  {
    if( v9 )
      v12 = **(_QWORD **)(*((_QWORD *)PkgClaim + 1) + 72i64);
    else
      v12 = 0i64;
    *(_QWORD *)AttributesPresent = v12;
  }
  if( v5 )
  {
    *v5 |= (2i64 * v9) | 1;
    LODWORD(BufferLengtha) = 0;
    if( SeQuerySecurityAttributesToken(TokenObject, &stru_140001158 + 1, 1ui64, 0i64, BufferLengtha, &pReturnLength) == -1073741789 )
      *v5 |= 4ui64;
    LODWORD(BufferLengthb) = 0;
    if( SeQuerySecurityAttributesToken(TokenObject, &stru_140001158, 1ui64, 0i64, BufferLengthb, &pReturnLength) == -1073741789 )
      *v5 |= 8ui64;
  }
  return 0;
}

Referenced by: