RtlpIsAppContainer

INT64 __fastcall RtlpIsAppContainer(VOID *a1, BOOL *a2){
  int v3; 
  PVOID TokenInformation; 
  PACCESS_TOKEN Token; 
  void *TokenHandle; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  __int64 v9; 
  int v10; 
  LODWORD(TokenInformation) = 0;
  TokenHandle = 0i64;
  Token = 0i64;
  v9 = 0i64;
  v10 = 0;
  *(_BYTE *)a2 = 0;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  if( a1 )
  {
LABEL_7:
    v3 = SeQueryInformationToken(a1, TokenIsAppContainer, &TokenInformation);
    if( v3 >= 0 )
      *(_BYTE *)a2 = (_DWORD)TokenInformation != 0;
    goto LABEL_9;
  }
  v3 = ZwOpenThreadTokenEx((PVOID)0xFFFFFFFFFFFFFFFEi64, 8ui64, 1u, 0x200ui64, &Token);
  if( v3 == -1073741700 )
  {
    v3 = ZwOpenProcessTokenEx((PVOID)0xFFFFFFFFFFFFFFFFi64, 0xAui64, 0x200ui64, &TokenHandle);
    if( v3 < 0 )
      goto LABEL_9;
    ObjectAttributes.RootDirectory = 0i64;
    ObjectAttributes.ObjectName = 0i64;
    ObjectAttributes.SecurityDescriptor = 0i64;
    ObjectAttributes.SecurityQualityOfService = &v9;
    ObjectAttributes.Length = 48;
    ObjectAttributes.Attributes = 512;
    v9 = 0x20000000Ci64;
    LOWORD(v10) = 1;
    v3 = ZwDuplicateToken(TokenHandle, 8ui64, &ObjectAttributes, 0, TokenImpersonation, &Token);
    ZwClose(TokenHandle);
  }
  if( v3 >= 0 )
  {
    a1 = Token;
    goto LABEL_7;
  }
LABEL_9:
  if( Token )
    ZwClose(Token);
  return(unsigned int)v3;
}

Referenced by: