LdrpResGetMappingSize

NTSTATUS __stdcall LdrpResGetMappingSize(PVOID ModuleBase, UINT64 *MappingSize, UINT64 Flags, UINT8 fIsMUI){
  UINT64 v6; 
  UINT64 Flink_low; 
  bool v8; 
  NTSTATUS result; 
  __int16 v10; 
  UINT64 v11; 
  _LIST_ENTRY *DataTableEntry; 
  __int128 MemoryInformation; 
  __int128 v14; 
  __int128 v15; 
  __int64 v16; 

  v16 = 0i64;
  MemoryInformation = 0i64;
  v14 = 0i64;
  v15 = 0i64;
  if( !ModuleBase || !MappingSize )
    return -1073741811;
  v6 = 0i64;
  if( (Flags & 0x20000) != 0 )
    v6 = *MappingSize;
  *MappingSize = 0i64;
  Flink_low = 0i64;
  v8 = (Flags & 0x100) != 0 && ((unsigned __int8)ModuleBase & 1) == 0;
  result = RtlImageNtHeaderEx(1, (unsigned __int64)ModuleBase & 0xFFFFFFFFFFFFFFFCui64, 0i64, &v16);
  if( result >= 0 )
  {
    v10 = *(_WORD *)(v16 + 24);
    if( v10 == 267 || v10 == 523 )
    {
      v11 = *(unsigned int *)(v16 + 80);
    }
    else
    {
      v11 = 0i64;
      result = -1073741701;
    }
    if( result >= 0 )
    {
      if( !v8 || !v11 )
      {
        DataTableEntry = LdrpKrnGetDataTableEntry(ModuleBase);
        if( DataTableEntry )
          Flink_low = LODWORD(DataTableEntry[4].Flink);
        if( Flink_low )
        {
          result = 0;
        }
        else
        {
          result = ZwQueryVirtualMemory(
                     -1,
                     (PVOID)((unsigned __int64)ModuleBase & 0xFFFFFFFFFFFFFFFCui64),
                     MemoryRegionInformation,
                     &MemoryInformation,
                     48,
                     0i64);
          if( result >= 0 )
            Flink_low = v14;
        }
        if( Flink_low || !v11 )
          goto LABEL_14;
        result = 0;
      }
      Flink_low = v11;
LABEL_14:
      if( result >= 0 )
      {
        if( v6 && v6 < Flink_low )
          return -1073741793;
        else
          *MappingSize = Flink_low;
      }
    }
  }
  return result;
}

Referenced by: