CmKeyBodyNeedsVirtualImage
char __fastcall CmKeyBodyNeedsVirtualImage(__int64 a1){
char v1;
char v3;
__int64 v4;
__int64 v5;
UINT64 v6;
char v7;
v1 = 0;
v3 = 0;
v4 = *(_QWORD *)(*(_QWORD *)(a1 + 8) + 32i64);
CmpLockRegistry();
v5 = *(_QWORD *)(a1 + 8);
ExAcquirePushLockSharedEx(v5 + 48, 0i64);
_InterlockedAdd((volatile signed __int32 *)(v5 + 56), 1u);
if( !CmpIsKeyDeletedForKeyBody(a1, 0i64) && (*(_BYTE *)(v4 + 4152) & 0x10) != 0 )
v3 = 1;
v6 = *(_QWORD *)(a1 + 8);
v7 = 0;
if( !*(_WORD *)(v6 + 66) )
v7 = v3;
if( (*(_DWORD *)(a1 + 48) & 0x10) == 0 )
v1 = v7;
CmpUnlockKcb(v6);
CmpUnlockRegistry();
return v1;
}Referenced by:
NtDeleteKey
NtDeleteValueKey
NtRenameKey
NtSetInformationKey
NtSetValueKey