PspIdentityBasedJobBreakaway

NTSTATUS __fastcall PspIdentityBasedJobBreakaway(VOID *ParentToken, VOID *ChildToken, UINT64 *JobBreakaway){
  NTSTATUS v4; 
  NTSTATUS v5; 
  UINT64 *v7; 
  INT64 v8; 
  INT64 a3[2]; 
  UINT64 v10; 
  _UNICODE_STRING String2; 
  _UNICODE_STRING DestinationString; 
  _UNICODE_STRING v13; 
  _UNICODE_STRING String1; 
  __int16 a4[72]; 
  __int16 PackageFullName[128]; 

  a3[0] = 256i64;
  *(_DWORD *)JobBreakaway = 0;
  v8 = 256i64;
  v10 = 132i64;
  a3[1] = 132i64;
  DestinationString = 0i64;
  String1 = 0i64;
  String2 = 0i64;
  v13 = 0i64;
  v4 = RtlQueryPackageIdentityEx(ParentToken, (WCHAR *)PackageFullName, (UINT64 *)a3, (WCHAR *)a4, &v10, v7);
  v5 = v4;
  if( v4 == -1073741275 || v4 == -2147483643 )
    v5 = 0;
  if( v5 >= 0 )
    *(_DWORD *)JobBreakaway = 1;
  return v5;
}

Referenced by: