BOOL __stdcall KCBNeedsVirtualImage(INT64 a1){ UINT64 *v1; if( !KCBIsVirtualizable(a1) ) return 0; LOBYTE(v1) = KeGetCurrentThread()->PreviousMode; return CmpIsSystemEntity(v1) == 0; }