ExpCovResetInformation

UINT8 __fastcall ExpCovResetInformation(
        _COVERAGE_MODULE_REQUEST *UserModuleInformation,
        UINT64 ModuleInformationLength,
        PS_PROTECTION TargetProtection){
  unsigned int v3; 
  int v6; 
  _ETHREAD *CurrentThread; 
  _UNICODE_STRING *i; 
  _UNICODE_STRING *v9; 
  _COVERAGE_REQUEST_CODES RequestType; 
  _UNICODE_STRING ModuleName; 
  char ModuleRequestInfo[24]; 
  _UNICODE_STRING v13[4]; 
  UINT8 MD5Hash[16]; 

  v3 = ModuleInformationLength;
  memset(v13, 0i64, sizeof(v13));
  ModuleName = 0i64;
  RequestType = CoverageAllModules;
  if( !ExCovMaxPagedPoolToUse )
    return 34;
  if( v3 < 0x18 )
    return 4;
  if( (unsigned __int64)UserModuleInformation >= 0x7FFFFFFF0000i64 )
    UserModuleInformation = (_COVERAGE_MODULE_REQUEST *)0x7FFFFFFF0000i64;
  *(_OWORD *)ModuleRequestInfo = *(_OWORD *)&UserModuleInformation->RequestType;
  *(_QWORD *)&ModuleRequestInfo[16] = *(_QWORD *)&UserModuleInformation->SearchInfo.ModuleName[12];
  v6 = ExpCovReadRequestBuffer((_COVERAGE_MODULE_REQUEST *)ModuleRequestInfo, &ModuleName, MD5Hash, &RequestType);
  if( v6 >= 0 )
  {
    *(_DWORD *)&v13[3].Length = RequestType;
    v13[2] = *(_UNICODE_STRING *)MD5Hash;
    if( !ModuleName.Buffer || (v6 = RtlDuplicateUnicodeString(1ui64, &ModuleName, &v13[1]), v6 >= 0) )
    {
      CurrentThread = (_ETHREAD *)KeGetCurrentThread();
      --CurrentThread->Tcb.KernelApcDisable;
      v6 = MmEnumerateSystemImages((__int64(__fastcall *)(INT64 *, __int64))ExpCovResetInfoCallBack, (__int64)v13);
      if( v6 >= 0 )
      {
        ExfAcquirePushLockExclusive((UINT64 *)&WheapDeferredInternalLogsEventLock + 86);
        for( i = (_UNICODE_STRING *)*(&WheapDeferredInternalLogsEventLock + 84);
              i != (_UNICODE_STRING *)((char *)&WheapDeferredInternalLogsEventLock + 672);
              i = *(_UNICODE_STRING **)&i->Length )
        {
          v9 = i;
          if( i[3].Buffer
            && ExpCovIsUnLoadedModulePresent((_COVERAGE_UNLOADED_MODULE_ENTRY *)i, RequestType, &ModuleName, MD5Hash) == 1 )
          {
            i = (_UNICODE_STRING *)i->Buffer;
            ExpCovDeleteUnloadedModuleEntry(v9);
          }
        }
        ExfReleasePushLock((_EX_PUSH_LOCK *)&WheapDeferredInternalLogsEventLock + 86);
      }
      KeLeaveCriticalRegionThread(KeGetCurrentThread());
    }
  }
  if( ModuleName.Buffer )
    RtlFreeAnsiString(&ModuleName);
  if( v13[1].Buffer )
    RtlFreeAnsiString(&v13[1]);
  return v6;
}

Referenced by: