MmGetSessionById

VOID *__stdcall MmGetSessionById(UINT64 SessionId){
  unsigned int v1; 
  _EPROCESS *v2; 
  int v3; 
  __int64 v4; 
  __int64 v5; 
  _RTL_BALANCED_NODE *Root; 
  unsigned int Right; 
  _KLOCK_QUEUE_HANDLE LockHandle; 

  memset(&LockHandle, 0, sizeof(LockHandle));
  v1 = SessionId;
  v2 = 0i64;
  LOBYTE(v3) = KeIsExecutingInArbitraryThreadContext();
  if( v3 )
  {
    v4 = 0i64;
  }
  else
  {
    LODWORD(v5) = PsGetThreadServerSilo((INT64)KeGetCurrentThread());
    v4 = v5;
  }
  KeAcquireInStackQueuedSpinLock((PKSPIN_LOCK)&stru_140C4DB30 + 522, &LockHandle);
  Root = Tree.Root;
  if( !Tree.Root )
    goto LABEL_16;
  while( 1 )
  {
    Right = (unsigned int)Root[-6].Right;
    if( v1 > Right )
    {
      Root = Root->Children[1];
      goto LABEL_9;
    }
    if( v1 >= Right )
      break;
    Root = Root->Children[0];
LABEL_9:
    if( !Root )
      goto LABEL_16;
  }
  if( Root && (!v4 || Root[37].ParentValue == v4) && Right == v1 )
    v2 = MiSelectSessionAttachProcess((_MM_SESSION_SPACE *)&Root[-6]);
LABEL_16:
  KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
  __writecr8(LockHandle.OldIrql);
  return v2;
}

Referenced by: