CmKeyBodyNeedsVirtualImage
char __fastcall CmKeyBodyNeedsVirtualImage(__int64 a1){
char v1;
char v3;
__int64 v4;
__int64 v5;
_CM_KEY_CONTROL_BLOCK *v6;
char v7;
v1 = 0;
v3 = 0;
v4 = *(_QWORD *)(*(_QWORD *)(a1 + 8) + 32i64);
CmpLockRegistry();
v5 = *(_QWORD *)(a1 + 8);
ExAcquirePushLockSharedEx((_EX_PUSH_LOCK *)(v5 + 48), 0i64);
_InterlockedAdd((volatile signed __int32 *)(v5 + 56), 1u);
if( !CmpIsKeyDeletedForKeyBody((CM_KEY_BODY *)a1, 0i64) && (*(_BYTE *)(v4 + 4152) & 0x10) != 0 )
v3 = 1;
v6 = *(_CM_KEY_CONTROL_BLOCK **)(a1 + 8);
v7 = 0;
if( !v6->LayerHeight )
v7 = v3;
if( (*(_DWORD *)(a1 + 48) & 0x10) == 0 )
v1 = v7;
CmpUnlockKcb(v6);
CmpUnlockRegistry();
return v1;
}Referenced by:
NtDeleteKey
NtDeleteValueKey
NtRenameKey
NtSetInformationKey
NtSetValueKey