IoIs32bitProcess

BOOL __stdcall IoIs32bitProcess(PIRP Irp){
  _ETHREAD *Thread; 
  unsigned __int64 Process; 
  __int64 v3; 
  _EWOW64PROCESS *WoW64Process; 
  unsigned __int16 Machine; 
  char ApcEnvironment; 
  __int16 v8; 

  if( !Irp )
  {
    if( KeGetCurrentThread()->PreviousMode == 1 )
    {
      WoW64Process = KeGetCurrentThread()->ApcState.Process->WoW64Process;
      if( WoW64Process )
      {
        Machine = WoW64Process->Machine;
        if( Machine == 332 || Machine == 452 )
          return 1;
      }
    }
    return 0;
  }
  if( Irp->RequestorMode != 1 )
    return 0;
  Thread = Irp->Tail.Thread;
  if( (Irp->Flags & 0x2000) == 0 )
  {
    if( Thread )
    {
      ApcEnvironment = Irp->ApcEnvironment;
      if( !ApcEnvironment )
      {
        Process = (unsigned __int64)Thread->Tcb.Process;
        goto LABEL_5;
      }
      if( ApcEnvironment == 1 )
      {
        Process = (unsigned __int64)Thread->Tcb.ApcState.Process;
        goto LABEL_5;
      }
    }
    return 0;
  }
  Process = (unsigned __int64)Irp->Overlay.UserApcRoutine & 0xFFFFFFFFFFFFFFF9ui64;
LABEL_5:
  if( !Process )
    return 0;
  v3 = *(_QWORD *)(Process + 1408);
  if( !v3 )
    return 0;
  v8 = *(_WORD *)(v3 + 8);
  return v8 == 332 || v8 == 452;
}

Referenced by: