CmKeyBodyNeedsVirtualImage

char __fastcall CmKeyBodyNeedsVirtualImage(__int64 a1){
  char v1; 
  char v3; 
  __int64 v4; 
  __int64 v5; 
  _CM_KEY_CONTROL_BLOCK *v6; 
  char v7; 

  v1 = 0;
  v3 = 0;
  v4 = *(_QWORD *)(*(_QWORD *)(a1 + 8) + 32i64);
  CmpLockRegistry();
  v5 = *(_QWORD *)(a1 + 8);
  ExAcquirePushLockSharedEx((_EX_PUSH_LOCK *)(v5 + 48), 0i64);
  _InterlockedAdd((volatile signed __int32 *)(v5 + 56), 1u);
  if( !CmpIsKeyDeletedForKeyBody((CM_KEY_BODY *)a1, 0i64) && (*(_BYTE *)(v4 + 4152) & 0x10) != 0 )
    v3 = 1;
  v6 = *(_CM_KEY_CONTROL_BLOCK **)(a1 + 8);
  v7 = 0;
  if( !v6->LayerHeight )
    v7 = v3;
  if( (*(_DWORD *)(a1 + 48) & 0x10) == 0 )
    v1 = v7;
  CmpUnlockKcb(v6);
  CmpUnlockRegistry();
  return v1;
}

Referenced by:

NtDeleteKey
NtDeleteValueKey
NtRenameKey
NtSetInformationKey
NtSetValueKey