INT64 __fastcall NtTestAlert(){ return KeTestAlertThread(*((_BYTE *)KeGetCurrentThread() + 562)) != 0 ? 0x101 : 0; }