ExpCovCreateUnloadedModuleEntry

VOID __stdcall ExpCovCreateUnloadedModuleEntry(_KLDR_DATA_TABLE_ENTRY *DataTableEntry){
  _UNICODE_STRING *p_FullDllName; 
  void *CoverageSection; 
  _ETHREAD *CurrentThread; 
  unsigned int v5; 
  unsigned int v6; 
  unsigned int v7; 
  VOID **PoolWithTag; 
  VOID **v9; 
  VOID **v10; 
  VOID ***v11; 
  _UNICODE_STRING BaseDllName; 
  _UNICODE_STRING *p_BaseDllName; 
  _UNICODE_STRING StringIn; 
  _UNICODE_STRING v15; 

  p_FullDllName = &DataTableEntry->FullDllName;
  CoverageSection = DataTableEntry->CoverageSection;
  *(_QWORD *)&StringIn.Length = 0i64;
  StringIn.Buffer = 0i64;
  if( ExpCovReadFriendlyName((__int64)CoverageSection, p_FullDllName, &StringIn) < 0 )
  {
    DbgPrintEx(0x7Eu, 0, (PCSTR)&stru_1407D9AB0.OutputLength, &DataTableEntry->BaseDllName);
    return;
  }
  CurrentThread = (_ETHREAD *)KeGetCurrentThread();
  --CurrentThread->Tcb.KernelApcDisable;
  ExfAcquirePushLockExclusive((UINT64 *)&WheapDeferredInternalLogsEventLock + 86);
  if( ExpCovCurrentPagedPoolInUse + 64 < (unsigned int)ExpCovCurrentPagedPoolInUse
    || (v5 = StringIn.Length + ExpCovCurrentPagedPoolInUse + 64, v5 < ExpCovCurrentPagedPoolInUse)
    || v5 == -1 )
  {
    p_BaseDllName = &DataTableEntry->BaseDllName;
  }
  else
  {
    v6 = StringIn.Length + v5;
    if( v6 >= v5 )
    {
      v7 = DataTableEntry->CoverageSectionSize + v6;
      if( v7 >= v5 && v7 != -1 )
      {
        if( v7 <= ExCovMaxPagedPoolToUse )
        {
          PoolWithTag = ExAllocatePoolWithTag(1ui64, 0x40ui64, 1920364355i64);
          v9 = PoolWithTag;
          if( !PoolWithTag )
            goto LABEL_21;
          memset(PoolWithTag, 0i64, 0x40u);
          if( RtlDuplicateUnicodeString(1ui64, &StringIn, (_UNICODE_STRING *)v9 + 2) < 0 )
            goto LABEL_21;
          if( StringIn.Buffer )
            RtlFreeAnsiString(&StringIn);
          if( ExpCovReadFriendlyName((__int64)DataTableEntry->CoverageSection, &DataTableEntry->BaseDllName, &StringIn) >= 0
            && RtlDuplicateUnicodeString(1ui64, &StringIn, (_UNICODE_STRING *)v9 + 1) >= 0
            && (*((_DWORD *)v9 + 12) = DataTableEntry->CoverageSectionSize,
                v10 = ExAllocatePoolWithTag(1ui64, DataTableEntry->CoverageSectionSize, 1920364355i64),
                (v9[7] = v10) != 0i64) )
          {
            memset(v10, 0i64, DataTableEntry->CoverageSectionSize);
            memmove(v9[7], DataTableEntry->CoverageSection, DataTableEntry->CoverageSectionSize);
            v11 = (VOID ***)*(&WheapDeferredInternalLogsEventLock + 85);
            if( (_UNKNOWN *)**(&WheapDeferredInternalLogsEventLock + 85) != (_UNKNOWN *)((char *)&WheapDeferredInternalLogsEventLock
                                                                                        + 672) )
              __fastfail(3u);
            *v9 = (char *)&WheapDeferredInternalLogsEventLock + 672;
            v9[1] = v11;
            *v11 = v9;
            *(&WheapDeferredInternalLogsEventLock + 85) = v9;
            BaseDllName = DataTableEntry->BaseDllName;
            ExpCovCurrentPagedPoolInUse = v7;
            v15 = BaseDllName;
            DbgPrintEx(0x7Eu, 2u, "COV: Entry created for %wZ in ExpCovUnloadedModuleList\n", &v15);
          }
          else
          {
LABEL_21:
            DbgPrintEx(0x7Eu, 0, (PCSTR)&stru_1407D9AB0.OutputLength, &DataTableEntry->BaseDllName);
            ExpCovFreeUnloadedModuleEntry((_COVERAGE_UNLOADED_MODULE_ENTRY *)v9);
          }
        }
        else
        {
          DbgPrintEx(0x7Eu, 2u, "COV: Max paged pool size(%u) reached, coverage lost for %wZ\n");
        }
        goto LABEL_25;
      }
    }
    p_BaseDllName = p_FullDllName;
  }
  DbgPrintEx(0x7Eu, 2u, "COV: Overflow when calculating paged pool size for %wZ\n", p_BaseDllName);
LABEL_25:
  ExfReleasePushLock((_EX_PUSH_LOCK *)&WheapDeferredInternalLogsEventLock + 86);
  KeLeaveCriticalRegion();
  if( StringIn.Buffer )
    RtlFreeAnsiString(&StringIn);
}

Referenced by: