MiReferenceOwningSession

_EPROCESS *__fastcall MiReferenceOwningSession(ULONG_PTR a1){
  UINT64 TopLevelPfn; 
  _MM_SESSION_SPACE *v3; 
  _EPROCESS *v4; 
  struct _KLOCK_QUEUE_HANDLE LockHandle; 
  memset(&LockHandle, 0, sizeof(LockHandle));
  TopLevelPfn = MiGetTopLevelPfn(a1);
  if( (*(_QWORD *)(TopLevelPfn + 24) & 0x4000000000000000i64) != 0 )
  {
    if( TopLevelPfn != a1 )
      _InterlockedAnd64((volatile signed __int64 *)(TopLevelPfn + 24), 0x7FFFFFFFFFFFFFFFui64);
  }
  else
  {
    v3 = (_MM_SESSION_SPACE *)((*(_QWORD *)TopLevelPfn >> 13) & 0x7FFFFFFFFFF0i64 | 0xFFFF800000000000ui64);
    if( TopLevelPfn != a1 )
      _InterlockedAnd64((volatile signed __int64 *)(TopLevelPfn + 24), 0x7FFFFFFFFFFFFFFFui64);
    if( (unsigned int)MiTryToAcquireExpansionLockAtDpc(&LockHandle) )
    {
      v4 = MiSelectSessionAttachProcess(v3);
      KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
      return v4;
    }
  }
  return 0i64;
}

Referenced by: