MmAttachSession

NTSTATUS __stdcall MmAttachSession(PVOID OpaqueSession, KAPC_STATE *ApcState){
  __int64 v2; 
  _KPROCESS *v4; 
  __int64 v5; 
  __int64 v6; 
  struct _KLOCK_QUEUE_HANDLE LockHandle; 
  v2 = *((_QWORD *)OpaqueSession + 171);
  memset(&LockHandle, 0, sizeof(LockHandle));
  v4 = (_EPROCESS *)OpaqueSession;
  v5 = *((_QWORD *)KeGetCurrentThread() + 23);
  v6 = *(_QWORD *)(v5 + 1368);
  KeAcquireInStackQueuedSpinLock(&WorkerRoutine, &LockHandle);
  if( (*(_DWORD *)(v2 + 4) & 2) != 0 )
  {
    KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
    __writecr8(LockHandle.OldIrql);
    return -1073741558;
  }
  else
  {
    ++*(_DWORD *)(v2 + 100);
    KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
    __writecr8(LockHandle.OldIrql);
    if( v6 && (*(_DWORD *)(v5 + 2172) & 0x1000) == 0 && v6 == v2 )
      v4 = (_EPROCESS *)v5;
    KiStackAttachProcess((_KPROCESS *)v4, 0i64, ApcState);
    return 0;
  }
}

Referenced by: