PfSnCheckModernApp

NTSTATUS __stdcall PfSnCheckModernApp(UINT64 *IsModernAppOut, UINT64 *HashIdOut, UINT64 a3){
  UINT64 *v3; 
  UINT64 *v5; 
  int v8; 
  _EPROCESS *Process; 
  VOID *v10; 
  NTSTATUS PackageIdentity; 
  NTSTATUS v12; 
  int v13; 
  __int64 v15; 
  __int64 v16; 
  __int64 v17; 
  unsigned __int64 v18; 
  __int64 v19; 
  __int64 v20; 
  unsigned __int8 *v21; 
  __int64 v22; 
  unsigned __int64 v23; 
  __int64 v24; 
  __int64 v25; 
  int v26; 
  int v27; 
  int v28; 
  int v29; 
  int v30; 
  int v31; 
  int v32; 
  int v33; 
  int v34; 
  int v35; 
  int v36; 
  int v37; 
  __int64 AppIdSize[2]; 
  wchar_t AppId[72]; 

  v5 = v3;
  v8 = 0;
  Process = KeGetCurrentThread()->ApcState.Process;
  v10 = PsReferencePrimaryToken(Process);
  AppIdSize[0] = 130i64;
  PackageIdentity = RtlQueryPackageIdentity(v10, (WCHAR *)a3, v5, AppId, (UINT64 *)AppIdSize, 0i64);
  v12 = PackageIdentity;
  if( PackageIdentity >= 0 )
  {
    v15 = 314159i64;
    v16 = *v5 - 2;
    v17 = 314159i64;
    v13 = 1;
    if( v16 >= 8 )
    {
      v18 = (unsigned __int64)v16 >> 3;
      v16 -= 8 * ((unsigned __int64)v16 >> 3);
      do
      {
        v19 = *(unsigned __int8 *)(a3 + 6)
            + 37
            * (*(unsigned __int8 *)(a3 + 5)
             + 37
             * (*(unsigned __int8 *)(a3 + 4)
              + 37
              * (*(unsigned __int8 *)(a3 + 3)
               + 37
               * (*(unsigned __int8 *)(a3 + 2)
                + 37 * (*(unsigned __int8 *)(a3 + 1) + 37 * (*(unsigned __int8 *)a3 + 37 * v17))))));
        v20 = *(unsigned __int8 *)(a3 + 7);
        a3 += 8i64;
        v17 = v20 + 37 * v19;
        --v18;
      }
      while( v18 );
    }
    if( v16 < 1 || v16 > 7 )
    {
LABEL_13:
      v21 = (unsigned __int8 *)AppId;
      v22 = AppIdSize[0] - 2;
      if( AppIdSize[0] - 2 >= 8 )
      {
        v23 = (unsigned __int64)v22 >> 3;
        v22 -= 8 * ((unsigned __int64)v22 >> 3);
        do
        {
          v24 = v21[6]
              + 37 * (v21[5] + 37 * (v21[4] + 37 * (v21[3] + 37 * (v21[2] + 37 * (v21[1] + 37 * (*v21 + 37 * v15))))));
          v25 = v21[7];
          v21 += 8;
          v15 = v25 + 37 * v24;
          --v23;
        }
        while( v23 );
      }
      if( v22 < 1 || v22 > 7 )
        goto LABEL_17;
      v32 = v22 - 1;
      if( v32 )
      {
        v33 = v32 - 1;
        if( v33 )
        {
          v34 = v33 - 1;
          if( v34 )
          {
            v35 = v34 - 1;
            if( v35 )
            {
              v36 = v35 - 1;
              if( v36 )
              {
                v37 = v36 - 1;
                if( v37 )
                {
                  if( v37 != 1 )
                  {
LABEL_17:
                    v8 = v15 + v17;
                    goto LABEL_3;
                  }
                  LODWORD(v15) = *v21++ + 37 * v15;
                }
                LODWORD(v15) = *v21++ + 37 * v15;
              }
              LODWORD(v15) = *v21++ + 37 * v15;
            }
            LODWORD(v15) = *v21++ + 37 * v15;
          }
          LODWORD(v15) = *v21++ + 37 * v15;
        }
        LODWORD(v15) = *v21++ + 37 * v15;
      }
      LODWORD(v15) = *v21 + 37 * v15;
      goto LABEL_17;
    }
    v26 = v16 - 1;
    if( v26 )
    {
      v27 = v26 - 1;
      if( v27 )
      {
        v28 = v27 - 1;
        if( v28 )
        {
          v29 = v28 - 1;
          if( v29 )
          {
            v30 = v29 - 1;
            if( v30 )
            {
              v31 = v30 - 1;
              if( v31 )
              {
                if( v31 != 1 )
                  goto LABEL_13;
                LODWORD(v17) = *(unsigned __int8 *)a3++ + 37 * v17;
              }
              LODWORD(v17) = *(unsigned __int8 *)a3++ + 37 * v17;
            }
            LODWORD(v17) = *(unsigned __int8 *)a3++ + 37 * v17;
          }
          LODWORD(v17) = *(unsigned __int8 *)a3++ + 37 * v17;
        }
        LODWORD(v17) = *(unsigned __int8 *)a3++ + 37 * v17;
      }
      LODWORD(v17) = *(unsigned __int8 *)a3++ + 37 * v17;
    }
    LODWORD(v17) = *(unsigned __int8 *)a3 + 37 * v17;
    goto LABEL_13;
  }
  v13 = 0;
  if( PackageIdentity == -1073741275 )
  {
LABEL_3:
    *(_DWORD *)HashIdOut = v8;
    v12 = 0;
    *(_DWORD *)IsModernAppOut = v13;
  }
  ObFastDereferenceObject(&Process->Token, v10);
  return v12;
}

Referenced by: