PopEtGetProcessSidAndPackageIdentity

void __fastcall PopEtGetProcessSidAndPackageIdentity(_EPROCESS *a1, _DWORD *a2, __int64 a3){
  VOID *v6; 
  UINT64 SystemAppIdentifier; 
  UINT64 PackagedApplication; 

  *(_DWORD *)a3 = 0;
  *(_QWORD *)a2 = 0i64;
  a2[2] = 0;
  LOBYTE(SystemAppIdentifier) = 0;
  v6 = PsReferencePrimaryToken(a1);
  PsQueryProcessAttributesByToken(v6, (UINT8 *)&SystemAppIdentifier, (UINT8 *)&PackagedApplication);
  if( (_BYTE)SystemAppIdentifier )
  {
    SystemAppIdentifier = 256i64;
    PackagedApplication = 132i64;
    if( RtlQueryPackageIdentity(
           v6,
           (WCHAR *)(a3 + 4),
           &SystemAppIdentifier,
           (WCHAR *)(a3 + 260),
           &PackagedApplication,
           0i64) >= 0 )
    {
      *(_WORD *)a3 = (SystemAppIdentifier >> 1) - 1;
      *(_WORD *)(a3 + 2) = (PackagedApplication >> 1) - 1;
    }
  }
  if( SeQueryUserSidToken(v6, a2, 0x44ui64, &SystemAppIdentifier) < 0 )
  {
    *(_QWORD *)a2 = 0i64;
    a2[2] = 0;
  }
  ObFastDereferenceObject(&a1->Token, v6);
}

Referenced by: