ExpCovReadRequestBuffer

NTSTATUS __stdcall ExpCovReadRequestBuffer(
        _COVERAGE_MODULE_REQUEST *ModuleRequestInfo,
        _UNICODE_STRING *ModuleName,
        UINT8 *MD5Hash,
        _COVERAGE_REQUEST_CODES *RequestType){
  NTSTATUS v5; 
  _COVERAGE_REQUEST_CODES v6; 
  __int32 v7; 
  unsigned __int16 v8; 
  wchar_t *Buffer; 
  UINT64 v10; 
  wchar_t *v11; 
  VOID **PoolWithTag; 
  VOID **v13; 
  _UNICODE_STRING StringIn; 

  v5 = 0;
  v6 = ModuleRequestInfo->RequestType;
  *RequestType = ModuleRequestInfo->RequestType;
  if( v6 )
  {
    v7 = v6 - 1;
    if( v7 )
    {
      if( v7 == 1
        && (StringIn = *(_UNICODE_STRING *)((char *)&ModuleRequestInfo->SearchInfo + 4),
            (v8 = _mm_cvtsi128_si32((__m128i)StringIn)) != 0)
        && (v8 & 1) == 0 )
      {
        Buffer = StringIn.Buffer;
        if( ((__int64)StringIn.Buffer & 1) != 0 )
          ExRaiseDatatypeMisalignment();
        v10 = v8;
        v11 = (wchar_t *)((char *)StringIn.Buffer + v8);
        if( (unsigned __int64)v11 > 0x7FFFFFFF0000i64 || v11 < StringIn.Buffer )
          MEMORY[0x7FFFFFFF0000] = 0;
        PoolWithTag = ExAllocatePoolWithTag(1ui64, v10, 1920364355i64);
        v13 = PoolWithTag;
        StringIn.Buffer = (wchar_t *)PoolWithTag;
        if( PoolWithTag )
        {
          memset(PoolWithTag, 0i64, v10);
          memmove(v13, Buffer, v10);
          v5 = RtlDuplicateUnicodeString(1ui64, &StringIn, ModuleName);
          ExFreePoolWithTag(v13, 0);
        }
        else
        {
          return -1073741670;
        }
      }
      else
      {
        return -1073741811;
      }
    }
    else
    {
      *($44235BE70204DD86C27F5084799471BF *)MD5Hash = *($44235BE70204DD86C27F5084799471BF *)((char *)&ModuleRequestInfo->SearchInfo
                                                                                           + 4);
    }
  }
  return v5;
}

Referenced by: