BOOL __stdcall SkipVirtualAccessCheck(INT64 a1){ if( (*(_DWORD *)(a1 + 184) & 0x2000000) == 0 ) return 0; LOBYTE(a1) = KeGetCurrentThread()->PreviousMode; return CmpIsSystemEntity((UINT64 *)a1) == 0; }