PopEtGetProcessAppId

NTSTATUS __stdcall PopEtGetProcessAppId(INT64 rcx0, INT64 *rdx0){
  _UNICODE_STRING *p_DestinationString; 
  int v5; 
  INT64 v6; 
  unsigned __int64 i; 
  WCHAR v9; 
  INT64 v10; 
  INT64 v11; 
  _UNICODE_STRING DestinationString; 
  INT64 v13[2]; 
  __int128 v14; 
  INT64 *v15; 
  wchar_t *Buffer; 
  __int16 *v17; 
  __int16 *v18; 
  _DWORD *v19; 
  __int16 v20; 
  __int16 v21; 
  __int16 v22; 
  __int16 v23; 
  _DWORD v24[20]; 
  __int16 v25[200]; 
  WCHAR SourceString[16]; 

  v11 = 0i64;
  v10 = 0i64;
  DestinationString = 0i64;
  memset(v25, 0i64, 0x188u);
  memset(v24, 0i64, 0x44u);
  p_DestinationString = *(_UNICODE_STRING **)(rcx0 + 1472);
  if( !p_DestinationString || !p_DestinationString->Length )
  {
    for( i = 0i64; i < 0xF; ++i )
    {
      v9 = *(unsigned __int8 *)(rcx0 + i + 1448);
      SourceString[i] = v9;
      if( !(_BYTE)v9 )
        break;
    }
    SourceString[14] = 0;
    RtlInitUnicodeString(&DestinationString, SourceString);
    p_DestinationString = &DestinationString;
  }
  PopEtGetProcessImageInfo(rcx0, (INT64)&v11);
  PopEtGetProcessSidAndPackageIdentity((_EPROCESS *)rcx0, v24, (__int64)v25);
  v13[0] = 0i64;
  v15 = &v11;
  v13[1] = 0i64;
  v19 = v24;
  v14 = 0i64;
  v23 = 4 * (BYTE1(v24[0]) + 2);
  Buffer = p_DestinationString->Buffer;
  v20 = p_DestinationString->Length >> 1;
  v17 = &v25[2];
  v21 = v25[0];
  v18 = &v25[130];
  v22 = v25[1];
  v5 = PopEtAppIdIntern((INT64)v13, &v10);
  if( v5 < 0 )
  {
    v6 = v10;
  }
  else
  {
    v6 = 0i64;
    *rdx0 = v10;
    v5 = 0;
  }
  if( v6 )
    PopEtAppIdDereference(v6);
  return v5;
}

Referenced by: