SeQuerySessionIdToken

INT64 __fastcall SeQuerySessionIdToken(VOID *Token, UINT64 *SessionId){
  _ETHREAD *CurrentThread; 
  UINT64 *v3; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v3 = SessionId;
  --*((_WORD *)CurrentThread + 242);
  LOBYTE(SessionId) = 1;
  ExAcquireResourceSharedLite(*((PERESOURCE *)Token + 6), (BOOL)SessionId);
  *(_DWORD *)v3 = *((_DWORD *)Token + 30);
  ExReleaseResourceLite(*((PERESOURCE *)Token + 6));
  KeLeaveCriticalRegion();
  return 0i64;
}

Referenced by:

NtQueryInformationToken
PnpGetCallerSessionId
PspAllocateProcess
SeQueryInformationToken