MmGetSessionId

__int64 __fastcall MmGetSessionId(__int64 a1){
  __int64 v1; 
  unsigned int v2; 
  unsigned int v3; 
  v1 = *(_QWORD *)(a1 + 1368);
  if( !v1 || (*(_DWORD *)(a1 + 2172) & 0x1000) != 0 )
    v2 = -1;
  else
    v2 = *(_DWORD *)(v1 + 8);
  v3 = 0;
  if( v2 != -1 )
    return v2;
  return v3;
}

Referenced by:

EtwpPoolRunDown
EtwpPsProvTraceProcess
EtwpStartLogger
ExCallSessionCallBack
ExGetSessionBigPoolInformation
ExpGetProcessInformation
MmCreatePeb
MmGetSessionMappedViewInformation
NtQueryInformationProcess
NtSetInformationProcess
PopDirectedDripsSendSuspendResumeNotification
PopInputDisabled
PopInvokeWin32Callout
PsGetThreadSessionId
PsInvokeWin32Callout
PspBindProcessSessionToJob
PspInitializeProcessSecurity
SeExchangePrimaryToken