LdrpGetMappingFromCacheEntry

UINT8 __stdcall LdrpGetMappingFromCacheEntry(
        UINT64 ModuleIndex,
        _IMAGE_RESOURCE_DATA_ENTRY *ResourceDataEntry,
        PVOID *pAlternateModule,
        UINT64 *pImageSize){
  unsigned __int64 v7; 
  unsigned __int64 v8; 
  UINT64 v9; 
  UINT8 result; 
  __int64 v11; 
  __int16 v12; 

  if( !ResourceDataEntry )
    return 0;
  if( !pAlternateModule )
    return 0;
  if( (unsigned int)ModuleIndex >= (unsigned int)AlternateResourceModuleCount )
    return 0;
  _mm_lfence();
  v7 = (unsigned __int64)(unsigned int)ModuleIndex << 6;
  v8 = *(_QWORD *)((char *)AlternateResourceModules + v7 + 32);
  v9 = *(_QWORD *)((char *)AlternateResourceModules + v7 + 48);
  if( v8 - 1 > 0xFFFFFFFFFFFFFFFDui64 )
    return 0;
  if( !v9 )
  {
    LODWORD(v11) = RtlImageNtHeader(v8 & 0xFFFFFFFFFFFFFFFCui64);
    if( !v11 )
      return 0;
    v12 = *(_WORD *)(v11 + 24);
    if( v12 == 267 || v12 == 523 )
      v9 = *(unsigned int *)(v11 + 80);
    else
      v9 = 0i64;
    if( !v9 )
      return 0;
  }
  if( (unsigned __int64)ResourceDataEntry < (v8 & 0xFFFFFFFFFFFFFFFCui64)
    || (unsigned __int64)ResourceDataEntry >= v9 + (v8 & 0xFFFFFFFFFFFFFFFCui64) )
  {
    return 0;
  }
  *pAlternateModule = (PVOID)v8;
  result = 1;
  *pImageSize = v9;
  return result;
}

Referenced by: