UINT8 __stdcall PopIsRunningAsLocalSystem(){ INT64 a7; LOBYTE(a7) = 0; RtlCheckTokenMembership(0i64, SeLocalSystemSid, (UINT8 *)&a7); return a7; }