CmDoVirtualTest

BOOL __fastcall CmDoVirtualTest(UINT64 *a1){
  BOOL result; 
  if( CmpVEEnabled )
  {
    LOBYTE(a1) = *((_BYTE *)KeGetCurrentThread() + 562);
    LOBYTE(result) = CmpIsSystemEntity(a1) == 0;
  }
  else
  {
    LOBYTE(result) = 0;
  }
  return result;
}

Referenced by:

NtDeleteKey
NtDeleteValueKey
NtRenameKey
NtSetInformationKey
NtSetValueKey