EtwpCovSampModuleGetName

INT64 __fastcall EtwpCovSampModuleGetName(INT64 a1, INT64 a2, const UNICODE_STRING *a3){
  __int64 v4; 
  NTSTATUS v6; 
  __int64 v7; 
  wchar_t *Buffer; 
  struct _UNICODE_STRING StringOut; 
  __int128 v11; 
  __int64 v12; 
  v4 = *(_QWORD *)(a2 + 48);
  v12 = 0i64;
  v11 = 0i64;
  StringOut = 0i64;
  if( v4
    && FltMgrCallbacks
    && (*(int(__fastcall **)(__int64, __int64, __int128 *, __int64 *))(FltMgrCallbacks + 24))(v4, 512i64, &v11, &v12) >= 0 )
  {
    v6 = 0;
    *(_QWORD *)(a1 + 112) = *((_QWORD *)&v11 + 1);
    *(_WORD *)(a1 + 120) = (unsigned __int16)v11 >> 1;
    v7 = v12 | 1;
    v12 = 0i64;
    *(_QWORD *)(a1 + 104) = v7;
  }
  else
  {
    if( a3 && a3->Length )
    {
      v6 = RtlDuplicateUnicodeString(0i64, (UNICODE_STRING *)a3, &StringOut);
      if( v6 >= 0 )
      {
        Buffer = StringOut.Buffer;
        v6 = 0;
        *(_WORD *)(a1 + 120) = StringOut.Length >> 1;
        *(_QWORD *)(a1 + 112) = Buffer;
        *(_QWORD *)(a1 + 104) = Buffer;
        StringOut = 0i64;
      }
    }
    else
    {
      v6 = -1073741275;
    }
    if( v12 )
      (*(void(**)(void))(FltMgrCallbacks + 32))();
  }
  RtlFreeAnsiString(&StringOut);
  return(unsigned int)v6;
}

Referenced by: