MmIsSessionExecutionValid

NTSTATUS __stdcall MmIsSessionExecutionValid(VOID *a1, INT64 a2, INT64 a3, INT64 a4, INT64 a5){
  NTSTATUS SessionId; 
  __int64 v8; 
  _RTL_BALANCED_NODE *v9; 
  UINT64 v10; 
  _RTL_BALANCED_NODE *v11; 
  UINT64 OldIrql; 

  LOBYTE(OldIrql) = 0;
  SessionId = MmGetSessionIdEx((_EPROCESS *)a2);
  if( SessionId == -1 )
    return 0;
  LODWORD(v8) = 1;
  if( *((_BYTE *)a1 + 586) == 1 && SessionId != MmGetSessionIdEx(*((_EPROCESS **)a1 + 68)) )
    return 0;
  if( (*((_DWORD *)a1 + 29) & 0x800) != 0 || *((_QWORD *)a1 + 5) != KeGetPcr()->Prcb.RspBase )
    return 0;
  if( a3 )
  {
    MmLockLoadedModuleListShared((unsigned __int8 *)&OldIrql);
    v9 = MiSessionLookupImage(a3);
    LOBYTE(v10) = OldIrql;
    v11 = v9;
    MmUnlockLoadedModuleListShared(v10);
    return v11 != 0i64;
  }
  return v8;
}

Referenced by: