ExpCovReadFriendlyName
int __fastcall ExpCovReadFriendlyName(__int64 a1, _UNICODE_STRING *a2, _UNICODE_STRING *a3){
__int64 v3;
int result;
_STRING PhysicalAddress;
v3 = *(unsigned int *)(a1 + 36);
*(_QWORD *)&PhysicalAddress.Length = 0i64;
PhysicalAddress.Buffer = 0i64;
if( *(_DWORD *)(v3 + a1) == 327680 )
{
result = RtlInitAnsiStringEx(&PhysicalAddress, (INT8 *)(a1 + *(unsigned int *)(v3 + a1 + 12)));
if( result >= 0 )
return RtlAnsiStringToUnicodeString(a3, &PhysicalAddress, 1u);
}
else
{
DbgPrintEx(0x7Eu, 2u, (PCSTR)&stru_1407D9AB0._Xmm8);
return RtlDuplicateUnicodeString(1ui64, a2, a3);
}
return result;
}Referenced by:
ExCovReadjustUnloadedModuleEntry
ExpCovCreateUnloadedModuleEntry
ExpCovIsModulePresent
ExpCovQueryLoadedModule