MiSelectSessionAttachProcess

_EPROCESS *__stdcall MiSelectSessionAttachProcess(_MM_SESSION_SPACE *SessionGlobal){
  char *v1; 
  char *i; 
  char *v3; 

  if( *((_QWORD *)SessionGlobal + 85) && (*((_DWORD *)SessionGlobal + 1) & 2) == 0 )
  {
    v1 = (char *)SessionGlobal + 16;
    for( i = (char *)*((_QWORD *)SessionGlobal + 2); i != v1; i = *(char **)i )
    {
      v3 = i - 1184;
      if( (i[665] & 1) == 0
        && (*((_DWORD *)v3 + 281) & 0xC00u) >= 0xC00
        && (v3[1851] & 0x60) != 64
        && ObReferenceObjectSafeWithTag((INT64)(i - 1184), 1953261124i64) )
      {
        return(_EPROCESS *)(i - 1184);
      }
    }
  }
  return 0i64;
}

Referenced by: