LdrpAccessResourceDataNoMultipleLanguage
NTSTATUS __stdcall LdrpAccessResourceDataNoMultipleLanguage(
PVOID DllHandle,
_IMAGE_RESOURCE_DATA_ENTRY *ResourceDataEntry,
PVOID *Address,
UINT64 *Size){
UINT64 *v4;
UINT64 v6;
__int64 v7;
int v8;
unsigned __int64 v9;
UINT64 v10;
int v11;
IMAGE_NT_HEADERS *v12;
IMAGE_NT_HEADERS *v13;
unsigned __int16 Magic;
unsigned int VirtualAddress;
UINT64 v16;
__int64 v17;
void *v18;
__int64 v19;
__int64 v20;
UINT64 ImageSize;
int v23;
__int64 v24;
__int64 v25;
v4 = Size;
v6 = (UINT64)DllHandle;
LODWORD(v7) = RtlImageDirectoryEntryToData(DllHandle, 1u, 2u, &ImageSize);
v24 = v7;
if( !v7 )
return -1073741687;
ImageSize = 0i64;
v8 = LdrpGetImageSize((PVOID)v6, &ImageSize);
v23 = v8;
if( v8 == -1073741701 )
return -1073741701;
v9 = v6 & 0xFFFFFFFFFFFFFFFCui64;
if( (unsigned __int64)ResourceDataEntry <= (v6 & 0xFFFFFFFFFFFFFFFCui64) )
return -1073741701;
v10 = ImageSize;
if( ImageSize )
{
if( (unsigned __int64)ResourceDataEntry >= v9 + ImageSize )
return -1073741701;
}
v11 = 0;
if( (v6 & 3) != 0 )
{
if( (v6 & 1) != 0 )
v11 = 1;
v6 &= 0xFFFFFFFFFFFFFFFCui64;
}
if( v11 == 1 )
{
v12 = RtlImageNtHeader((PVOID)v6);
v13 = v12;
if( !v12 )
return -1073741687;
Magic = v12->OptionalHeader.Magic;
if( Magic == 267 )
{
VirtualAddress = v13->OptionalHeader.DataDirectory[0].VirtualAddress;
}
else if( Magic == 523 )
{
VirtualAddress = v13->OptionalHeader.DataDirectory[2].VirtualAddress;
}
else
{
VirtualAddress = 0;
}
if( !VirtualAddress )
return -1073741687;
v16 = v6 + VirtualAddress - v24;
RtlSectionTableFromVirtualAddress(v13, v6);
if( !v17 )
return -1073741687;
if( ResourceDataEntry->OffsetToData > *(_DWORD *)(v17 + 8) )
{
LODWORD(ImageSize) = *(_DWORD *)(v17 + 12);
RtlSectionTableFromVirtualAddress(v13, v6);
v25 = v19;
if( !v19 )
return -1073741687;
LODWORD(v20) = RtlAddressInSectionTable(v13, (PVOID)v6, *(unsigned int *)(v19 + 12));
v16 += v24 + *(unsigned int *)(v25 + 12) - (unsigned __int64)(unsigned int)ImageSize - v20;
}
v4 = Size;
}
else
{
v16 = 0i64;
}
if( Address
&& ((v18 = (void *)(v6 + ResourceDataEntry->OffsetToData - v16), *Address = v18, (unsigned __int64)v18 <= v9)
|| v10 && (unsigned __int64)v18 >= v9 + v10) )
{
*Address = 0i64;
return -1073741701;
}
else
{
if( v4 )
*(_DWORD *)v4 = ResourceDataEntry->Size;
return v8;
}
}Referenced by:
LdrpAccessResourceData
LdrpFindMessageInAlternateModule
LdrpGetRcConfig