bool __fastcall CmDoVirtualTest(_SECURITY_SUBJECT_CONTEXT *a1, int *a2){ if( !CmpVEEnabled ) return 0; LOBYTE(a1) = KeGetCurrentThread()->PreviousMode; return CmpIsSystemEntity((UINT64 *)a1) == 0; }