LdrpMapResourceFile

NTSTATUS __stdcall LdrpMapResourceFile(
        PVOID Module,
        _UNICODE_STRING *pResourceFileName,
        PVOID *pFileHandle,
        PVOID *pResourceFileView,
        UINT64 *pViewSize){
  VOID *v8; 
  __int64 v9; 
  unsigned __int16 v10; 
  int Section; 
  VOID *v12; 
  NTSTATUS v13; 
  __int64 v14; 
  int v15; 
  UINT64 *v16; 
  _LARGE_INTEGER *AllocationSize; 
  UINT64 FileAttributes; 
  INT64 FileAttributesa; 
  UINT64 ShareAccess; 
  UINT64 CreateDisposition; 
  UINT64 CreateOptions; 
  UINT64 EaLength; 
  VOID *SectionHandle; 
  VOID *MappedBase; 
  PVOID Object; 
  UINT64 ViewSize; 
  _OBJECT_ATTRIBUTES ObjectAttributes; 
  _LARGE_INTEGER MaximumSize; 
  _IO_STATUS_BLOCK IoStatusBlock; 
  VOID *FileHandle; 

  FileHandle = 0i64;
  SectionHandle = 0i64;
  MappedBase = 0i64;
  MaximumSize.QuadPart = 0i64;
  v8 = 0i64;
  ViewSize = 0i64;
  memset(&ObjectAttributes, 0, sizeof(ObjectAttributes));
  IoStatusBlock = 0i64;
  if( Module && pResourceFileName && pResourceFileView )
  {
    LODWORD(v9) = RtlImageNtHeader((unsigned __int64)Module & 0xFFFFFFFFFFFFFFFCui64);
    if( v9 )
    {
      v10 = *(_WORD *)(v9 + 72);
      LODWORD(EaLength) = 0;
      LODWORD(CreateOptions) = 0;
      LODWORD(CreateDisposition) = 1;
      LODWORD(ShareAccess) = 5;
      LODWORD(FileAttributes) = 0;
      ObjectAttributes.Length = 48;
      ObjectAttributes.RootDirectory = 0i64;
      ObjectAttributes.Attributes = 576;
      ObjectAttributes.ObjectName = pResourceFileName;
      *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
      Section = ZwCreateFile(
                  &FileHandle,
                  0x80000000ui64,
                  &ObjectAttributes,
                  &IoStatusBlock,
                  0i64,
                  FileAttributes,
                  ShareAccess,
                  CreateDisposition,
                  CreateOptions,
                  0i64,
                  EaLength);
      if( Section >= 0 )
      {
        *(_QWORD *)&ObjectAttributes.Length = 48i64;
        *(_QWORD *)&ObjectAttributes.Attributes = 576i64;
        ObjectAttributes.RootDirectory = 0i64;
        ObjectAttributes.ObjectName = 0i64;
        LODWORD(FileAttributesa) = 0x8000000;
        LODWORD(AllocationSize) = v10 < 6u ? 8 : 2;
        *(_OWORD *)&ObjectAttributes.SecurityDescriptor = 0i64;
        Section = ZwCreateSection(
                    (UINT64)&SectionHandle,
                    0xF0005ui64,
                    (INT64)&ObjectAttributes,
                    (INT64 *)&MaximumSize,
                    (INT64)AllocationSize,
                    FileAttributesa,
                    (UINT64)FileHandle);
        if( Section >= 0 )
        {
          Object = 0i64;
          Section = ObReferenceObjectByHandle(SectionHandle, 0i64, 0i64, 0, &Object, 0i64);
          ZwClose((_HANDLE)SectionHandle);
          v12 = Object;
          if( Section >= 0 )
          {
            v13 = MmMapViewInSystemSpace(Object, &MappedBase, &ViewSize);
            v8 = MappedBase;
            Section = v13;
            if( v13 >= 0 )
            {
              LODWORD(v14) = RtlImageNtHeader((UINT64)MappedBase);
              v15 = Section;
              if( !v14 )
                v15 = -1073741701;
              Section = v15;
            }
          }
          if( v12 )
            ObfDereferenceObjectWithTag(v12, 0x746C6644ui64);
          if( Section < 0 )
          {
            if( v8 )
              MmUnmapViewInSystemSpace(v8);
          }
          else
          {
            v16 = pViewSize;
            *pResourceFileView = v8;
            if( v16 )
              *v16 = ViewSize;
            if( pFileHandle )
            {
              *pFileHandle = FileHandle;
              return Section;
            }
          }
        }
      }
    }
    else
    {
      Section = -1073741701;
    }
    if( FileHandle )
      ZwClose((_HANDLE)FileHandle);
    return Section;
  }
  return -1073741811;
}

Referenced by: