INT64 __fastcall PsGetThreadSessionId(_ETHREAD *Thread){ return MmGetSessionId(*((_QWORD *)Thread + 68)); }