PsGetEffectiveContainerId

__int64 __fastcall PsGetEffectiveContainerId(int a1, __int64 a2, __int64 a3){
  __int64 WorkOnBehalfThread; 
  void *v8; 
  __int64 v9; 
  int v10; 
  __int64 v11; 
  int v12; 
  __int128 v13; 
  int v14; 
  v14 = 0;
  if( a1 >= 5 )
    return 3221225711i64;
  if( a2 )
  {
    *(_OWORD *)a3 = 0i64;
    *(_DWORD *)(a3 + 16) = 0;
    if( (*((_DWORD *)KeGetPcr() + 3243) & 0x10001) != 0 && (struct _KTHREAD *)a2 == KeGetCurrentThread() )
      return 0i64;
    WorkOnBehalfThread = PsGetWorkOnBehalfThread(a2, &v14);
    v8 = (void *)WorkOnBehalfThread;
    if( WorkOnBehalfThread )
    {
      v9 = *(_QWORD *)(*(_QWORD *)(WorkOnBehalfThread + 544) + 1296i64);
      *(_DWORD *)(a3 + 16) |= 1u;
    }
    else
    {
      v9 = *(_QWORD *)(*(_QWORD *)(a2 + 544) + 1296i64);
    }
    if( !v9 )
    {
LABEL_13:
      if( v14 )
        ObfDereferenceObjectWithTag(v8, 0x746C6644ui64);
      return 0i64;
    }
    if( a1 )
    {
      v10 = a1 - 2;
      if( !v10 )
      {
        v11 = *(_QWORD *)(v9 + 832);
LABEL_12:
        if( !v11 )
          goto LABEL_13;
        v13 = *(_OWORD *)(v11 + 1240);
        goto LABEL_21;
      }
      v12 = v10 - 1;
      if( !v12 )
      {
        v11 = *(_QWORD *)(v9 + 840);
        goto LABEL_12;
      }
      if( v12 != 1 )
        goto LABEL_13;
    }
    v13 = *(_OWORD *)(v9 + 1240);
LABEL_21:
    *(_OWORD *)a3 = v13;
    goto LABEL_13;
  }
  return 3221225712i64;
}

Referenced by: