PnpIsSafeToExamineUserModeTeb

VOID __fastcall PnpIsSafeToExamineUserModeTeb(INT64 a1){
  if( *((_BYTE *)KeGetCurrentThread() + 586) != 1 && *((_BYTE *)KeGetCurrentThread() + 562) == 1 )
    KeAreAllApcsDisabled();
}

Referenced by: