UINT8 __stdcall PsIsWin32KFilterEnabled(){ return(KeGetCurrentThread()->ApcState.Process->MitigationFlags & 0x4000) != 0; }