bool __fastcall PsGetProcessExitProcessCalled(__int64 a1){ return(*(_DWORD *)(a1 + 1124) & 4) != 0; }