SepIsParentOfChildAppContainer

UINT8 __stdcall SepIsParentOfChildAppContainer(UINT64 SessionId, UINT64 LowboxNumber1, UINT64 LowboxNumber2){
  unsigned int v3; 
  unsigned int v4; 
  unsigned int v5; 
  UINT8 IsParentOfChildAppContainer; 
  char v7; 
  _ETHREAD *CurrentThread; 
  _ETHREAD *v9; 
  ULONG_PTR v10; 
  _SEP_LOWBOX_NUMBER_ENTRY *MatchingEntry2; 
  _SEP_LOWBOX_NUMBER_ENTRY *MatchingEntry1; 
  ULONG_PTR BugCheckParameter2; 
  v3 = SessionId;
  BugCheckParameter2 = 0i64;
  v4 = LowboxNumber2;
  MatchingEntry1 = 0i64;
  v5 = LowboxNumber1;
  MatchingEntry2 = 0i64;
  IsParentOfChildAppContainer = 0;
  v7 = 0;
  if( (_DWORD)LowboxNumber1 && (_DWORD)LowboxNumber2 )
  {
    if( (unsigned int)SessionId >= 5 )
    {
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      --*((_WORD *)CurrentThread + 242);
      ExAcquirePushLockSharedEx((UINT64)&LowboxSessionMapLock, 0i64);
      v7 = 1;
      if( (int)SepGetTokenSessionMapEntry(v3, 0, (CHAR **)&BugCheckParameter2) < 0 )
      {
LABEL_11:
        if( _InterlockedCompareExchange64((volatile signed __int64 *)&LowboxSessionMapLock, 0i64, 17i64) != 17 )
          ExfReleasePushLockShared((INT64 *)&LowboxSessionMapLock);
        KeAbPostRelease(&LowboxSessionMapLock);
        KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
        return IsParentOfChildAppContainer;
      }
    }
    else
    {
      BugCheckParameter2 = (ULONG_PTR)&g_SessionLowboxArray[5 * (unsigned int)SessionId];
    }
    v9 = (_ETHREAD *)KeGetCurrentThread();
    --*((_WORD *)v9 + 242);
    v10 = BugCheckParameter2;
    ExAcquirePushLockExclusiveEx(BugCheckParameter2, 0i64);
    if( (int)SepFindMatchingLowBoxNumberEntries(
                *(_RTL_DYNAMIC_HASH_TABLE **)(v10 + 24),
                v5,
                v4,
                &MatchingEntry1,
                &MatchingEntry2) >= 0 )
      IsParentOfChildAppContainer = RtlIsParentOfChildAppContainer(
                                      MatchingEntry1->PackageSid,
                                      MatchingEntry2->PackageSid);
    if( (_InterlockedExchangeAdd64((volatile signed __int64 *)v10, 0xFFFFFFFFFFFFFFFFui64) & 6) == 2 )
      ExfTryToWakePushLock((volatile INT64 *)BugCheckParameter2);
    KeAbPostRelease((PVOID)BugCheckParameter2);
    KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
    if( !v7 )
      return IsParentOfChildAppContainer;
    goto LABEL_11;
  }
  return 0;
}

Referenced by: