MiSessionLookupImage

_RTL_BALANCED_NODE *__stdcall MiSessionLookupImage(UINT64 a1){
  _RTL_BALANCED_NODE *v1; 

  v1 = (_RTL_BALANCED_NODE *)*((_QWORD *)KeGetCurrentThread()->ApcState.Process->Session + 11);
  while( v1 )
  {
    if( (_RTL_BALANCED_NODE *)a1 > v1[2].Children[0] )
    {
      v1 = v1->Children[1];
    }
    else
    {
      if( a1 >= (v1[1].ParentValue & 0xFFFFFFFFFFFFFFFCui64) )
        return v1;
      v1 = v1->Children[0];
    }
  }
  return 0i64;
}

Referenced by: