MmGetSessionId
__int64 __fastcall MmGetSessionId(__int64 a1){
__int64 v1;
unsigned int v2;
unsigned int v3;
v1 = *(_QWORD *)(a1 + 1368);
if( !v1 || (*(_DWORD *)(a1 + 2172) & 0x1000) != 0 )
v2 = -1;
else
v2 = *(_DWORD *)(v1 + 8);
v3 = 0;
if( v2 != -1 )
return v2;
return v3;
}Referenced by:
EtwpPoolRunDown
EtwpPsProvTraceProcess
EtwpStartLogger
ExCallSessionCallBack
ExGetSessionBigPoolInformation
ExpGetProcessInformation
MmCreatePeb
MmGetSessionMappedViewInformation
NtQueryInformationProcess
NtSetInformationProcess
PopDirectedDripsSendSuspendResumeNotification
PopInputDisabled
PopInvokeWin32Callout
PsGetThreadSessionId
PsInvokeWin32Callout
PspBindProcessSessionToJob
PspInitializeProcessSecurity
SeExchangePrimaryToken