PopEtGetProcessAppId

INT64 __stdcall PopEtGetProcessAppId(INT64 rcx0, INT64 *rdx0){
  WCHAR v4; 
  struct _UNICODE_STRING *p_DestinationString; 
  int v6; 
  INT64 v7; 
  unsigned __int64 i; 
  WCHAR v10; 
  INT64 v11; 
  INT64 v12; 
  struct _UNICODE_STRING DestinationString; 
  INT64 v14[2]; 
  __int128 v15; 
  INT64 *v16; 
  wchar_t *Buffer; 
  INT64 *p_result_4; 
  char *v19; 
  INT64 *v20; 
  __int16 v21; 
  int v22; 
  __int16 v23; 
  INT64 v24[10]; 
  int result; 
  INT64 result_4; 
  char v27; 
  WCHAR SourceString[16]; 
  v12 = 0i64;
  v11 = 0i64;
  DestinationString = 0i64;
  memset((INT64)&result, 0i64);
  memset((INT64)v24, 0i64);
  p_DestinationString = *(struct _UNICODE_STRING **)(rcx0 + 1472);
  if( !p_DestinationString || !p_DestinationString->Length )
  {
    for( i = 0i64; i < 0xF; ++i )
    {
      v10 = *(unsigned __int8 *)(rcx0 + i + 1448);
      SourceString[i] = v10;
      if( !(_BYTE)v10 )
        break;
    }
    SourceString[14] = 0;
    RtlInitUnicodeString(&DestinationString, SourceString, v4);
    p_DestinationString = &DestinationString;
  }
  PopEtGetProcessImageInfo(rcx0, (INT64)&v12);
  PopEtGetProcessSidAndPackageIdentity((INT64 *)rcx0, v24, (INT64)&result);
  v14[0] = 0i64;
  v16 = &v12;
  v14[1] = 0i64;
  v20 = v24;
  v15 = 0i64;
  v23 = 4 * (BYTE1(v24[0]) + 2);
  Buffer = p_DestinationString->Buffer;
  v21 = p_DestinationString->Length >> 1;
  p_result_4 = &result_4;
  v22 = result;
  v19 = &v27;
  v6 = PopEtAppIdIntern((INT64)v14, &v11);
  if( v6 < 0 )
  {
    v7 = v11;
  }
  else
  {
    v7 = 0i64;
    *rdx0 = v11;
    v6 = 0;
  }
  if( v7 )
    PopEtAppIdDereference(v7);
  return(unsigned int)v6;
}

Referenced by: