CmKeyBodyNeedsVirtualImage

char __fastcall CmKeyBodyNeedsVirtualImage(__int64 a1){
  char v1; 
  char v3; 
  __int64 v4; 
  __int64 v5; 
  UINT64 v6; 
  char v7; 
  v1 = 0;
  v3 = 0;
  v4 = *(_QWORD *)(*(_QWORD *)(a1 + 8) + 32i64);
  CmpLockRegistry();
  v5 = *(_QWORD *)(a1 + 8);
  ExAcquirePushLockSharedEx(v5 + 48, 0i64);
  _InterlockedAdd((volatile signed __int32 *)(v5 + 56), 1u);
  if( !CmpIsKeyDeletedForKeyBody(a1, 0i64) && (*(_BYTE *)(v4 + 4152) & 0x10) != 0 )
    v3 = 1;
  v6 = *(_QWORD *)(a1 + 8);
  v7 = 0;
  if( !*(_WORD *)(v6 + 66) )
    v7 = v3;
  if( (*(_DWORD *)(a1 + 48) & 0x10) == 0 )
    v1 = v7;
  CmpUnlockKcb(v6);
  CmpUnlockRegistry();
  return v1;
}

Referenced by:

NtDeleteKey
NtDeleteValueKey
NtRenameKey
NtSetInformationKey
NtSetValueKey