LdrpMapResourceFile

NTSTATUS __stdcall LdrpMapResourceFile(
        PVOID Module,
        UNICODE_STRING *pResourceFileName,
        PVOID *pFileHandle,
        PVOID *pResourceFileView,
        UINT64 *pViewSize){
  PVOID v8; 
  IMAGE_NT_HEADERS *v9; 
  unsigned __int16 MajorSubsystemVersion; 
  int v11; 
  PVOID v12; 
  NTSTATUS v13; 
  IMAGE_NT_HEADERS *v14; 
  int v15; 
  UINT64 *v16; 
  PLARGE_INTEGER AllocationSize; 
  UINT64 FileAttributes; 
  UINT64 FileAttributesa; 
  UINT64 ShareAccess; 
  UINT64 CreateDisposition; 
  UINT64 CreateOptions; 
  UINT64 EaLength; 
  void *SectionHandle; 
  PVOID MappedBase; 
  PVOID Object; 
  ULONG_PTR ViewSize; 
  struct _OBJECT_ATTRIBUTES ObjectAttributes; 
  union _LARGE_INTEGER MaximumSize; 
  struct _IO_STATUS_BLOCK IoStatusBlock; 
  void *FileHandle; 
  FileHandle = 0i64;
  SectionHandle = 0i64;
  MappedBase = 0i64;
  MaximumSize.QuadPart = 0i64;
  v8 = 0i64;
  ViewSize = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  IoStatusBlock = 0i64;
  if( Module && pResourceFileName && pResourceFileView )
  {
    v9 = RtlImageNtHeader((PVOID)((unsigned __int64)Module & 0xFFFFFFFFFFFFFFFCui64));
    if( v9 )
    {
      MajorSubsystemVersion = v9->OptionalHeader.MajorSubsystemVersion;
      LODWORD(EaLength) = 0;
      LODWORD(CreateOptions) = 0;
      LODWORD(CreateDisposition) = 1;
      LODWORD(ShareAccess) = 5;
      LODWORD(FileAttributes) = 0;
      ObjectAttributes.Length = 48;
      ObjectAttributes.RootDirectory = 0i64;
      ObjectAttributes.Attributes = 576;
      ObjectAttributes.ObjectName = pResourceFileName;
      *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
      v11 = ZwCreateFile(
              &FileHandle,
              0x80000000ui64,
              &ObjectAttributes,
              &IoStatusBlock,
              0i64,
              FileAttributes,
              ShareAccess,
              CreateDisposition,
              CreateOptions,
              0i64,
              EaLength);
      if( v11 >= 0 )
      {
        *(_QWORD *)&ObjectAttributes.Length = 48i64;
        *(_QWORD *)&ObjectAttributes.Attributes = 576i64;
        ObjectAttributes.RootDirectory = 0i64;
        ObjectAttributes.ObjectName = 0i64;
        LODWORD(FileAttributesa) = 0x8000000;
        LODWORD(AllocationSize) = MajorSubsystemVersion < 6u ? 8 : 2;
        *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
        v11 = ZwCreateSection(
                &SectionHandle,
                0xF0005ui64,
                &ObjectAttributes,
                &MaximumSize,
                (UINT64)AllocationSize,
                FileAttributesa,
                FileHandle);
        if( v11 >= 0 )
        {
          Object = 0i64;
          v11 = ObReferenceObjectByHandle(SectionHandle, 0, 0i64, 0, &Object, 0i64);
          ZwClose(SectionHandle);
          v12 = Object;
          if( v11 >= 0 )
          {
            v13 = MmMapViewInSystemSpace(Object, &MappedBase, &ViewSize);
            v8 = MappedBase;
            v11 = v13;
            if( v13 >= 0 )
            {
              v14 = RtlImageNtHeader(MappedBase);
              v15 = v11;
              if( !v14 )
                v15 = -1073741701;
              v11 = v15;
            }
          }
          if( v12 )
            ObfDereferenceObjectWithTag(v12, 0x746C6644ui64);
          if( v11 < 0 )
          {
            if( v8 )
              MmUnmapViewInSystemSpace(v8);
          }
          else
          {
            v16 = pViewSize;
            *pResourceFileView = v8;
            if( v16 )
              *v16 = ViewSize;
            if( pFileHandle )
            {
              *pFileHandle = FileHandle;
              return v11;
            }
          }
        }
      }
    }
    else
    {
      v11 = -1073741701;
    }
    if( FileHandle )
      ZwClose(FileHandle);
    return v11;
  }
  return -1073741811;
}

Referenced by: