LdrpFindMessageInAlternateModule
NTSTATUS __stdcall LdrpFindMessageInAlternateModule(
PVOID AlternateModule,
PVOID Resource,
UINT64 ResourceSize,
UINT64 MessageId,
UINT8 Hardening){
unsigned int v5;
unsigned int *v7;
NTSTATUS result;
unsigned int *v9;
__int64 v10;
PVOID Address;
Address = 0i64;
v5 = MessageId;
v7 = (unsigned int *)Resource;
if( !AlternateModule || !Resource )
return -1073741811;
if( !Hardening )
{
result = LdrpAccessResourceDataNoMultipleLanguage(
AlternateModule,
(_IMAGE_RESOURCE_DATA_ENTRY *)Resource,
&Address,
0i64);
if( result < 0 )
return result;
v7 = (unsigned int *)Address;
}
v9 = v7 + 1;
v10 = *v7;
if( Hardening && 12 * v10 + 4 > ResourceSize )
return -1073741701;
while( 1 )
{
if( !(_DWORD)v10 )
return -1073741559;
LODWORD(v10) = v10 - 1;
if( v5 >= *v9 && v5 <= v9[1] )
break;
v9 += 3;
}
return 0;
}Referenced by:
LdrpLoadResourceFromAlternativeModule
LdrpResSearchResourceMappedFile