PsGetCurrentSilo

_EJOB *__stdcall PsGetCurrentSilo(){
  _ETHREAD *CurrentThread; 
  _EJOB *result; 
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  result = (_EJOB *)*((_QWORD *)CurrentThread + 193);
  if( result == (_EJOB *)-3i64 )
  {
    for( result = *(_EJOB **)(*((_QWORD *)CurrentThread + 68) + 1296i64); result; result = result->ParentJob )
    {
      if( (result->JobFlags & 0x40000000) != 0 )
        break;
    }
  }
  return result;
}

Referenced by:

CmLockKeyForWrite
CmpParseKey
IoQueryInformationByName
IoRevokeHandlesForProcess
IopCreateFile
IopFastQueryNetworkAttributes
NtDeleteFile
NtOpenSymbolicLinkObject
NtQueryAttributesFile
NtQueryFullAttributesFile
ObGetSiloRootDirectoryPath
ObOpenObjectByName
ObQueryNameStringMode
ObReferenceObjectByName
ObReferenceObjectByNameEx
ObpCreateSymbolicLinkName
ObpInsertOrLocateNamedObject
PsRegisterSiloMonitor
PsRootSiloInformation
VRegEnabledInJob