PsGetCurrentServerSilo
_EJOB *__stdcall PsGetCurrentServerSilo(){
volatile INT32 *v0;
_ETHREAD *CurrentThread;
INT64 v3;
volatile INT32 *v4;
__int64 v5;
char v6;
char v7;
if( KeIsExecutingInArbitraryThreadContext() )
return 0i64;
CurrentThread = (_ETHREAD *)KeGetCurrentThread();
v3 = *((_QWORD *)CurrentThread + 193);
if( v3 == -3 )
return *(_EJOB **)(*((_QWORD *)CurrentThread + 68) + 2160i64);
if( !v3 )
return 0i64;
PsIsServerSilo(v3, v0);
if( v6 )
return(_EJOB *)v5;
do
PsIsServerSilo(*(_QWORD *)(v5 + 1072), v4);
while( !v7 );
return(_EJOB *)v5;
}Referenced by:
EtwpStartLogger
ExInitLicenseData
ExpGetProcessInformation
ExpRefreshTimeZoneInformation
ExpSystemErrorHandler2
ExpWnfGenerateStateName
IoRegisterPlugPlayNotification
IopParseDevice
MiSessionCreateInternal
NtGetNextProcess
NtImpersonateAnonymousToken
ObpLookupObjectName
ObpReferenceDeviceMap
PnpNotifyDeviceClassChange
PnpNotifyTargetDeviceChange
PnpNotifyTargetDeviceChangeNotifyEntry
PopTransitionSystemPowerStateEx
PsLookupProcessByProcessId
PsLookupThreadByThreadId
PspThreadFromTicket
SLUpdateLicenseDataInternal
SeCreateClientSecurityEx
SepBlockAccessForLogonSession
SepCreateClientSecurityEx
SepCreateLogonSessionTrack
SepDeleteLogonSessionTrack
SepIsMinTCB
SepIsNgenImage
SepMakeLogonSessionsSiblings
SepReferenceLogonSession