NTSTATUS __fastcall PsGetProcessSessionId(INT64 a1){ NTSTATUS SessionId; NTSTATUS result; SessionId = MmGetSessionIdEx((_EPROCESS *)a1); result = 0; if( SessionId != -1 ) return SessionId; return result; }