PsGetCurrentServerSilo

_EJOB *__stdcall PsGetCurrentServerSilo(){
  volatile INT32 *v0; 
  _ETHREAD *CurrentThread; 
  INT64 v3; 
  volatile INT32 *v4; 
  __int64 v5; 
  char v6; 
  char v7; 
  if( KeIsExecutingInArbitraryThreadContext() )
    return 0i64;
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  v3 = *((_QWORD *)CurrentThread + 193);
  if( v3 == -3 )
    return *(_EJOB **)(*((_QWORD *)CurrentThread + 68) + 2160i64);
  if( !v3 )
    return 0i64;
  PsIsServerSilo(v3, v0);
  if( v6 )
    return(_EJOB *)v5;
  do
    PsIsServerSilo(*(_QWORD *)(v5 + 1072), v4);
  while( !v7 );
  return(_EJOB *)v5;
}

Referenced by:

EtwpStartLogger
ExInitLicenseData
ExpGetProcessInformation
ExpRefreshTimeZoneInformation
ExpSystemErrorHandler2
ExpWnfGenerateStateName
IoRegisterPlugPlayNotification
IopParseDevice
MiSessionCreateInternal
NtGetNextProcess
NtImpersonateAnonymousToken
ObpLookupObjectName
ObpReferenceDeviceMap
PnpNotifyDeviceClassChange
PnpNotifyTargetDeviceChange
PnpNotifyTargetDeviceChangeNotifyEntry
PopTransitionSystemPowerStateEx
PsLookupProcessByProcessId
PsLookupThreadByThreadId
PspThreadFromTicket
SLUpdateLicenseDataInternal
SeCreateClientSecurityEx
SepBlockAccessForLogonSession
SepCreateClientSecurityEx
SepCreateLogonSessionTrack
SepDeleteLogonSessionTrack
SepIsMinTCB
SepIsNgenImage
SepMakeLogonSessionsSiblings
SepReferenceLogonSession