EtwpQueryTokenPackageInfo

VOID __stdcall EtwpQueryTokenPackageInfo(VOID *Token, _ETW_PACKAGE_IDENTITY *PackageInfo, UINT64 *ProcessInfoFlags){
  UINT64 *AppIdSize; 
  UINT8 v7; 
  UINT8 v8; 

  AppIdSize = (UINT64 *)PackageInfo->PackageName;
  *(_QWORD *)&PackageInfo->PackageNameSize = 0i64;
  v7 = 0;
  v8 = 0;
  *(_QWORD *)PackageInfo->PackageName = 0i64;
  PsQueryProcessAttributesByToken(Token, &v7, &v8);
  if( v7 )
  {
    *(_DWORD *)ProcessInfoFlags |= 1u;
    *(_QWORD *)&PackageInfo->PackageNameSize = 256i64;
    *AppIdSize = 130i64;
    if( RtlQueryPackageIdentity(
           Token,
           &PackageInfo->PackageName[4],
           (UINT64 *)&PackageInfo->PackageNameSize,
           &PackageInfo->ApplicationName[4],
           AppIdSize,
           0i64) < 0 )
    {
      *(_QWORD *)&PackageInfo->PackageNameSize = 0i64;
      *AppIdSize = 0i64;
    }
    if( v8 )
      *(_DWORD *)ProcessInfoFlags |= 8u;
  }
  if( !*(_QWORD *)&PackageInfo->PackageNameSize )
  {
    *(_QWORD *)&PackageInfo->PackageNameSize = 2i64;
    PackageInfo->PackageName[4] = 0;
  }
  if( !*AppIdSize )
  {
    *AppIdSize = 2i64;
    PackageInfo->ApplicationName[4] = 0;
  }
}

Referenced by: