EtwpCovSampModuleGetName

NTSTATUS __stdcall EtwpCovSampModuleGetName(INT64 a1, INT64 a2, const _UNICODE_STRING *a3){
  __int64 v4; 
  int v6; 
  __int64 v7; 
  wchar_t *Buffer; 
  _UNICODE_STRING StringOut; 
  __int128 v11; 
  __int64 v12; 

  v4 = *(_QWORD *)(a2 + 48);
  v12 = 0i64;
  v11 = 0i64;
  StringOut = 0i64;
  if( v4
    && *(&stru_140CF2E80 + 599)
    && (*(int(__fastcall **)(__int64, __int64, __int128 *, __int64 *))(*(&stru_140CF2E80 + 599) + 24i64))(
         v4,
         512i64,
         &v11,
         &v12) >= 0 )
  {
    v6 = 0;
    *(_QWORD *)(a1 + 112) = *((_QWORD *)&v11 + 1);
    *(_WORD *)(a1 + 120) = (unsigned __int16)v11 >> 1;
    v7 = v12 | 1;
    v12 = 0i64;
    *(_QWORD *)(a1 + 104) = v7;
  }
  else
  {
    if( a3 && a3->Length )
    {
      v6 = RtlDuplicateUnicodeString(0i64, (_UNICODE_STRING *)a3, &StringOut);
      if( v6 >= 0 )
      {
        Buffer = StringOut.Buffer;
        v6 = 0;
        *(_WORD *)(a1 + 120) = StringOut.Length >> 1;
        *(_QWORD *)(a1 + 112) = Buffer;
        *(_QWORD *)(a1 + 104) = Buffer;
        StringOut = 0i64;
      }
    }
    else
    {
      v6 = -1073741275;
    }
    if( v12 )
      (*(void(**)(void))(*(&stru_140CF2E80 + 599) + 32i64))();
  }
  RtlFreeAnsiString(&StringOut);
  return v6;
}

Referenced by: