MmIsSessionExecutionValid

INT64 __fastcall MmIsSessionExecutionValid(VOID *a1, INT64 a2, INT64 a3, INT64 a4, INT64 a5){
  INT64 v7; 
  int SessionId; 
  INT64 v9; 
  __int64 v10; 
  RTL_BALANCED_NODE *v11; 
  UINT64 v12; 
  RTL_BALANCED_NODE *v13; 
  UINT8 OldIrql; 
  OldIrql = 0;
  SessionId = MmGetSessionIdEx(a2);
  if( SessionId == -1 )
    return 0i64;
  LODWORD(v10) = 1;
  if( *((_BYTE *)a1 + 586) == 1 && SessionId != (unsigned int)MmGetSessionIdEx(*((_QWORD *)a1 + 68)) )
    return 0i64;
  if( (*((_DWORD *)a1 + 29) & 0x800) != 0 || *((_QWORD *)a1 + 5) != *((_QWORD *)KeGetPcr() + 53) )
    return 0i64;
  if( a3 )
  {
    MmLockLoadedModuleListShared(&OldIrql, v7, v9);
    v11 = MiSessionLookupImage(a3);
    LOBYTE(v12) = OldIrql;
    v13 = v11;
    MmUnlockLoadedModuleListShared(v12);
    return v13 != 0i64;
  }
  return(unsigned int)v10;
}

Referenced by: