INT64 __stdcall PopGetSessionId(){ return PsGetProcessSessionIdEx(*((_QWORD *)KeGetCurrentThread() + 23)); }