ExpCovQueryInformation

__int64 __fastcall ExpCovQueryInformation(unsigned __int64 a1, unsigned int a2, unsigned int *a3){
  unsigned int *v3; 
  UINT64 v4; 
  VOID **PoolWithTag; 
  unsigned __int64 v8; 
  int v9; 
  _ETHREAD *CurrentThread; 
  unsigned int Buffer; 
  VOID **v12; 
  int v13; 
  __int64 v14; 
  VOID *v15; 
  __int64 v16; 
  __int64 *v17; 
  size_t v18; 
  unsigned int v19; 
  unsigned int v20; 
  VOID *v21; 
  _COVERAGE_REQUEST_CODES RequestType; 
  int v23; 
  unsigned __int64 v24; 
  VOID **v25; 
  unsigned int *v26; 
  unsigned int v27; 
  VOID *v28; 
  _UNICODE_STRING ModuleName; 
  _UNICODE_STRING *v30; 
  unsigned __int64 v31; 
  _UNICODE_STRING v32[4]; 
  _OWORD ModuleRequestInfo[4]; 
  UINT8 MD5Hash[16]; 

  v3 = a3;
  v26 = a3;
  v4 = a2;
  v27 = a2;
  v31 = a1;
  memset(v32, 0i64, sizeof(v32));
  ModuleName = 0i64;
  RequestType = CoverageAllModules;
  v24 = 0i64;
  PoolWithTag = 0i64;
  v25 = 0i64;
  LODWORD(v32[3].Buffer) = 64;
  LODWORD(v32[0].Buffer) = v4;
  if( !ExCovMaxPagedPoolToUse )
    return 3221225506i64;
  if( v3 )
    *v3 = 64;
  if( (unsigned int)v4 < 0x40 )
    return 3221225476i64;
  v24 = a1 + 32;
  v8 = a1;
  if( a1 >= 0x7FFFFFFF0000i64 )
    v8 = 0x7FFFFFFF0000i64;
  ModuleRequestInfo[0] = *(_OWORD *)v8;
  ModuleRequestInfo[1] = *(_OWORD *)(v8 + 16);
  ModuleRequestInfo[2] = *(_OWORD *)(v8 + 32);
  ModuleRequestInfo[3] = *(_OWORD *)(v8 + 48);
  BYTE4(v32[0].Buffer) = LODWORD(ModuleRequestInfo[0]) == 1;
  v9 = ExpCovReadRequestBuffer(
         (_COVERAGE_MODULE_REQUEST *)((char *)ModuleRequestInfo + 8),
         &ModuleName,
         MD5Hash,
         &RequestType);
  if( v9 >= 0 )
  {
    *(_DWORD *)&v32[3].Length = RequestType;
    v32[2] = *(_UNICODE_STRING *)MD5Hash;
    if( !ModuleName.Buffer || (v9 = RtlDuplicateUnicodeString(1ui64, &ModuleName, &v32[1]), v9 >= 0) )
    {
      PoolWithTag = ExAllocatePoolWithTag(0x200ui64, v4, 1920364355i64);
      v25 = PoolWithTag;
      *(_QWORD *)&v32[0].Length = PoolWithTag;
      if( !PoolWithTag )
      {
        v9 = -1073741670;
        goto LABEL_52;
      }
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      --CurrentThread->Tcb.KernelApcDisable;
      v9 = MmEnumerateSystemImages((__int64(__fastcall *)(INT64 *, __int64))ExpCovQueryInfoCallBack, (__int64)v32);
      if( v9 < 0 )
      {
        KeLeaveCriticalRegionThread(KeGetCurrentThread());
        goto LABEL_52;
      }
      ExpCovQueryHypervisorInformation((INT64 *)v32);
      Buffer = (unsigned int)v32[3].Buffer;
      v23 = *(_DWORD *)(&v32[3].MaximumLength + 1);
      if( (unsigned int)v4 >= LODWORD(v32[3].Buffer)
        && (unsigned int)((__int64)(*(_QWORD *)&v32[0].Length - (_QWORD)PoolWithTag) >> 5) )
      {
        v12 = PoolWithTag;
        v13 = *(_DWORD *)(&v32[3].MaximumLength + 1);
        v14 = v24;
        while( v13 )
        {
          v15 = (VOID *)(*((unsigned int *)v12 + 6) + v14 + 32);
          *(_DWORD *)v14 = *(_DWORD *)v12;
          *(_DWORD *)(v14 + 4) = *((_DWORD *)v12 + 1);
          *(_DWORD *)(v14 + 24) = *((_DWORD *)v12 + 6);
          memmove((VOID *)(v14 + 28), (char *)v12 + 28, *((_DWORD *)v12 + 6));
          *(_WORD *)(v14 + 8) = *((_WORD *)v12 + 4);
          *(_WORD *)(v14 + 10) = *((_WORD *)v12 + 5);
          *(_QWORD *)(v14 + 16) = v15;
          memmove(v15, v12[2], *((unsigned __int16 *)v12 + 4));
          v16 = *(unsigned int *)v12;
          v14 += v16;
          v24 = v14;
          v12 = (VOID **)((char *)v12 + v16);
          v13 = --*(_DWORD *)(&v32[3].MaximumLength + 1);
        }
      }
      else
      {
        if( (unsigned int)v4 < LODWORD(v32[3].Buffer) )
          v9 = -1073741820;
        v14 = v24;
      }
      if( LODWORD(ModuleRequestInfo[0]) == 1 )
        ExfAcquirePushLockExclusive((UINT64 *)&WheapDeferredInternalLogsEventLock + 86);
      else
        ExfAcquirePushLockShared((_EX_PUSH_LOCK *)&WheapDeferredInternalLogsEventLock + 86);
      v17 = (__int64 *)*(&WheapDeferredInternalLogsEventLock + 84);
      while( 1 )
      {
        while( 1 )
        {
          if( v17 == (__int64 *)((char *)&WheapDeferredInternalLogsEventLock + 672) )
          {
            ExfReleasePushLock((_EX_PUSH_LOCK *)&WheapDeferredInternalLogsEventLock + 86);
            KeLeaveCriticalRegionThread(KeGetCurrentThread());
            if( v3 )
              *v3 = Buffer;
            *(_DWORD *)(v31 + 4) = v23;
            goto LABEL_52;
          }
          v30 = (_UNICODE_STRING *)v17;
          v28 = (VOID *)v17[7];
          if( v28 )
          {
            if( ExpCovIsUnLoadedModulePresent(
                   (_COVERAGE_UNLOADED_MODULE_ENTRY *)v17,
                   RequestType,
                   &ModuleName,
                   MD5Hash) )
            {
              break;
            }
          }
LABEL_31:
          v17 = (__int64 *)*v17;
        }
        v18 = *((_DWORD *)v17 + 12);
        if( LODWORD(ModuleRequestInfo[0]) != 1 )
          v18 -= *((_DWORD *)v28 + 7);
        if( v18 < 0xFFFFFFE0 )
        {
          v19 = *((unsigned __int16 *)v17 + 16) + v18 + 32;
          if( v19 < 0x20 )
            v19 = -1;
        }
        else
        {
          v19 = -1;
        }
        v20 = v19 + Buffer;
        if( v19 + Buffer >= Buffer )
        {
          Buffer += v19;
          if( v27 >= v20 )
          {
            v28 = (VOID *)(v18 + v14 + 32);
            *(_DWORD *)v14 = v19;
            *(_DWORD *)(v14 + 4) = 0;
            *(_DWORD *)(v14 + 24) = v18;
            memmove((VOID *)(v14 + 28), (const VOID *)v17[7], v18);
            *(_WORD *)(v14 + 8) = *((_WORD *)v17 + 16);
            *(_WORD *)(v14 + 10) = *((_WORD *)v17 + 16);
            v21 = v28;
            *(_QWORD *)(v14 + 16) = v28;
            memmove(v21, (const VOID *)v17[5], *((unsigned __int16 *)v17 + 16));
            v14 += v19;
            v24 = v14;
            if( LODWORD(ModuleRequestInfo[0]) == 1 )
            {
              v17 = (__int64 *)v17[1];
              ExpCovDeleteUnloadedModuleEntry(v30);
            }
            v3 = v26;
          }
          else
          {
            v3 = v26;
            if( v26 )
              *v26 = v20;
            v9 = -1073741820;
          }
          ++v23;
          goto LABEL_31;
        }
        DbgPrintEx(0x7Eu, 2u, "COV: Overflow when calculating total required length for %wZ\n", v17 + 4);
        v17 = (__int64 *)*v17;
        v3 = v26;
      }
    }
  }
LABEL_52:
  if( ModuleName.Buffer )
    RtlFreeAnsiString(&ModuleName);
  if( v32[1].Buffer )
    RtlFreeAnsiString(&v32[1]);
  if( PoolWithTag )
    ExFreePoolWithTag(PoolWithTag, 0x72766F43u);
  return(unsigned int)v9;
}

Referenced by: