ExpCovDeleteUnloadedModuleEntry
NTSTATUS __stdcall ExpCovDeleteUnloadedModuleEntry(_UNICODE_STRING *a1){
__int64 v2;
wchar_t *Buffer;
unsigned int v4;
unsigned int v5;
if( !a1 )
return -1073741811;
v2 = *(_QWORD *)&a1->Length;
if( *(_UNICODE_STRING **)(*(_QWORD *)&a1->Length + 8i64) != a1
|| (Buffer = a1->Buffer, *(_UNICODE_STRING **)Buffer != a1) )
{
__fastfail(3u);
}
*(_QWORD *)Buffer = v2;
*(_QWORD *)(v2 + 8) = Buffer;
v4 = a1[2].Length + a1[1].Length + 64;
if( v4 < 0x40 )
v4 = -1;
v5 = v4 + *(_DWORD *)&a1[3].Length;
if( v5 < v4 )
v5 = -1;
ExpCovFreeUnloadedModuleEntry((_COVERAGE_UNLOADED_MODULE_ENTRY *)a1);
ExpCovCurrentPagedPoolInUse -= v5;
return 0;
}Referenced by:
ExCovReadjustUnloadedModuleEntry
ExpCovQueryInformation
ExpCovResetInformation