ExpCovQueryHypervisorInformation

VOID __fastcall ExpCovQueryHypervisorInformation(INT64 *a1){
  UINT8 *v2; 
  WCHAR *PoolWithTag; 
  WCHAR *v4; 
  INT64 v5; 
  WCHAR v6; 
  CHAR v7; 
  unsigned int v8; 
  int v9; 
  INT64 v10; 
  UINT64 v11; 
  unsigned int v12; 
  unsigned int v13; 
  unsigned int v14; 
  unsigned int v15; 
  unsigned int v16; 
  UINT8 *v17; 
  unsigned int Length; 
  unsigned __int16 MaximumLength; 
  UINT8 *v20; 
  UINT64 v21; 
  wchar_t *Buffer; 
  struct _UNICODE_STRING DestinationString; 
  SIZE_T NumberOfBytes; 
  unsigned int a4; 
  unsigned int v26; 
  a4 = 0;
  v2 = 0i64;
  DestinationString = 0i64;
  LODWORD(NumberOfBytes) = 0;
  if( (_BYTE)HvlHypervisorConnected )
  {
    PoolWithTag = (WCHAR *)ExAllocatePoolWithTag(PagedPool, 0x40ui64, 0x72766F43ui64);
    v4 = PoolWithTag;
    if( PoolWithTag )
    {
      memset((INT64)PoolWithTag, 0i64);
      if( HvlGetCoverageInfo(v4, v5, &NumberOfBytes, &a4) )
      {
        RtlInitUnicodeString(&DestinationString, v4, v6);
        v7 = *((_BYTE *)a1 + 12);
        v8 = *((_DWORD *)a1 + 2);
        v9 = *((_DWORD *)a1 + 12);
        v10 = *a1;
        v26 = v8;
        if( v7 )
        {
          if( v7 == 1 && v9 == 2 )
          {
            v11 = a4;
            if( !(unsigned int)RtlCompareUnicodeString((const UNICODE_STRING *)a1 + 1, &DestinationString, 1u) )
            {
              v8 = v26;
              goto LABEL_11;
            }
          }
        }
        else if( !v9 )
        {
          v11 = (unsigned int)NumberOfBytes;
LABEL_11:
          v12 = -1;
          if( (unsigned int)v11 < 0xFFFFFFE0 )
          {
            v13 = DestinationString.Length + v11 + 32;
            if( v13 < 0x20 )
              v13 = -1;
            v12 = v13;
          }
          v14 = *((_DWORD *)a1 + 14);
          v15 = v14 + v12;
          if( v14 + v12 >= v14 )
          {
            *((_DWORD *)a1 + 14) = v15;
            if( v8 >= v15 )
            {
              v16 = 4096;
              if( (unsigned int)v11 > 0x1000 )
                v16 = v11;
              v17 = (UINT8 *)ExAllocatePoolWithTag(NonPagedPoolNx, v16, 0x72766F43ui64);
              v2 = v17;
              if( v17 )
              {
                if( HvlGetCoverageData(v7, (unsigned int)v11, v17) )
                {
                  *(_DWORD *)(v10 + 4) = 1;
                  *(_DWORD *)v10 = v12;
                  *(_DWORD *)(v10 + 24) = v11;
                  memmove((UINT8 *)(v10 + 28), v2, v11);
                  Length = DestinationString.Length;
                  MaximumLength = DestinationString.MaximumLength;
                  v20 = (UINT8 *)(v11 + v10 + 32);
                  *(_WORD *)(v10 + 8) = DestinationString.Length;
                  v21 = Length;
                  Buffer = DestinationString.Buffer;
                  *(_QWORD *)(v10 + 16) = v20;
                  *(_WORD *)(v10 + 10) = MaximumLength;
                  memmove(v20, (UINT8 *)Buffer, v21);
                  ++*((_DWORD *)a1 + 13);
                  *a1 += v12;
                  if( v7 )
                    HvlResetCoverageVector();
                }
              }
            }
            else
            {
              ++*((_DWORD *)a1 + 13);
            }
          }
        }
      }
      ExFreePoolWithTag(v4, 0);
      if( v2 )
        ExFreePoolWithTag(v2, 0);
    }
  }
}

Referenced by: