ExpCovResetInformation

INT64 __fastcall ExpCovResetInformation(UINT64 rcx0, UINT64 a2){
  unsigned int v2; 
  int v5; 
  _ETHREAD *CurrentThread; 
  UNICODE_STRING *i; 
  UNICODE_STRING *v8; 
  unsigned int a4; 
  UNICODE_STRING StringIn; 
  INT64 a1[2]; 
  __int64 v12; 
  char v13[16]; 
  struct _UNICODE_STRING StringOut; 
  __int128 v15; 
  unsigned int v16; 
  __int128 a3; 
  v2 = a2;
  memset((INT64)v13, 0i64);
  StringIn = 0i64;
  a4 = 0;
  if( !ExCovMaxPagedPoolToUse )
    return 3221225506i64;
  if( v2 < 0x18 )
    return 3221225476i64;
  if( rcx0 >= 0x7FFFFFFF0000i64 )
    rcx0 = 0x7FFFFFFF0000i64;
  *(_OWORD *)a1 = *(_OWORD *)rcx0;
  v12 = *(_QWORD *)(rcx0 + 16);
  v5 = ExpCovReadRequestBuffer(a1, &StringIn, &a3, &a4);
  if( v5 >= 0 )
  {
    v16 = a4;
    v15 = a3;
    if( !StringIn.Buffer || (v5 = RtlDuplicateUnicodeString(1ui64, &StringIn, &StringOut), v5 >= 0) )
    {
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      --*((_WORD *)CurrentThread + 242);
      v5 = MmEnumerateSystemImages((__int64(__fastcall *)(PVOID *, __int64))ExpCovResetInfoCallBack, (__int64)v13);
      if( v5 >= 0 )
      {
        ExfAcquirePushLockExclusive(&ExpCovPushLock);
        for( i = ExpCovUnloadedModuleList;
              i != (UNICODE_STRING *)&ExpCovUnloadedModuleList;
              i = *(UNICODE_STRING **)&i->Length )
        {
          v8 = i;
          if( i[3].Buffer && ExpCovIsUnLoadedModulePresent(i, a4, &StringIn, &a3) == 1 )
          {
            i = (UNICODE_STRING *)i->Buffer;
            ExpCovDeleteUnloadedModuleEntry(v8);
          }
        }
        ExfReleasePushLock((_EX_PUSH_LOCK *__ptr32)&ExpCovPushLock);
      }
      KeLeaveCriticalRegionThread((__int64)KeGetCurrentThread());
    }
  }
  if( StringIn.Buffer )
    RtlFreeAnsiString(&StringIn);
  if( StringOut.Buffer )
    RtlFreeAnsiString(&StringOut);
  return(unsigned int)v5;
}

Referenced by: