MiUnlinkProcessFromSession

VOID __stdcall MiUnlinkProcessFromSession(_EPROCESS *Process){
  _MM_SESSION_SPACE *Session; 
  _LIST_ENTRY *p_SessionProcessLinks; 
  _LIST_ENTRY *Flink; 
  _LIST_ENTRY *Blink; 
  _LIST_ENTRY *v6; 
  _LIST_ENTRY *v7; 
  _KLOCK_QUEUE_HANDLE LockHandle; 

  memset(&LockHandle, 0, sizeof(LockHandle));
  KeAcquireInStackQueuedSpinLock((PKSPIN_LOCK)&stru_140C4DB30 + 522, &LockHandle);
  Session = Process->Session;
  if( Session )
  {
    p_SessionProcessLinks = &Process->SessionProcessLinks;
    if( Process->SessionProcessLinks.Flink )
    {
      if( (Process->Vm.Instance.Flags._bf_1 & 1) != 0 && !*((_QWORD *)Session + 85) )
        *((_QWORD *)Session + 85) = 1i64;
      Flink = p_SessionProcessLinks->Flink;
      Blink = Process->SessionProcessLinks.Blink;
      if( p_SessionProcessLinks->Flink->Blink != p_SessionProcessLinks || Blink->Flink != p_SessionProcessLinks )
LABEL_12:
        __fastfail(3u);
      Blink->Flink = Flink;
      Flink->Blink = Blink;
    }
  }
  v6 = Process->MmProcessLinks.Flink;
  v7 = Process->MmProcessLinks.Blink;
  if( v6->Blink != &Process->MmProcessLinks || v7->Flink != &Process->MmProcessLinks )
    goto LABEL_12;
  v7->Flink = v6;
  v6->Blink = v7;
  KeReleaseInStackQueuedSpinLockFromDpcLevel(&LockHandle);
  __writecr8(LockHandle.OldIrql);
}

Referenced by: