LdrpResSearchResourceMappedFile
NTSTATUS __stdcall LdrpResSearchResourceMappedFile(
PVOID ModuleBase,
UINT64 MappingSize,
UINT64 Flags,
UINT64 *ResIds,
INT64 ResIdCount,
PVOID *Resource,
UINT64 *Size,
PWCHAR FoundLanguage,
UINT64 *FoundLanguageLength){
unsigned int v10;
bool v11;
UINT16 v12;
int v13;
int v14;
int v15;
__int64 v16;
int ResourceDirectory;
unsigned int v18;
int v19;
unsigned int i;
char v21;
UINT16 *v22;
int v23;
__int64 p_ResourceSize;
VOID *v25;
const _IMAGE_RESOURCE_DIRECTORY *v26;
unsigned __int64 v27;
VOID *v28;
NTSTATUS v29;
UINT64 *v30;
NTSTATUS result;
__int64 v32;
int v33;
__int16 v34;
NTSTATUS RCConfig;
NTSTATUS v36;
UINT8 v37;
UINT64 v38;
UINT64 v39;
__int64 v40;
_WORD *v41;
VOID **NtHeaders;
UINT64 v43;
char v44;
UINT16 v45;
int v46;
bool v47;
UINT64 AlternateViewSize;
PVOID ReturnAlternateModule;
VOID *ModuleBasea;
unsigned int v51;
int v52;
ULONGLONG MappingSizea;
UINT64 ResourceSize;
__int64 v55;
VOID *v56;
VOID *v57;
VOID *TopResourceDirectory;
VOID *v59;
__int64 v60;
UINT64 *v61;
VOID *v62;
__int64 v63[66];
__int16 Name[88];
v10 = Flags;
MappingSizea = MappingSize;
ModuleBasea = ModuleBase;
v55 = (__int64)Resource;
v60 = (__int64)Size;
v62 = FoundLanguage;
v61 = FoundLanguageLength;
TopResourceDirectory = 0i64;
v59 = 0i64;
v56 = 0i64;
v57 = 0i64;
memset(v63, 0i64, 0x208u);
v11 = 0;
v51 = v10 & 0x40;
ResourceSize = 0i64;
v12 = 0;
v13 = v10 & 0x80;
v14 = ResIdCount;
if( (_DWORD)ResIdCount == 3 )
{
v12 = *((_WORD *)ResIds + 8);
v11 = (*ResIds & 0xFFFFFFFFFFFF0000ui64) != 0 && !wcsicmp((const wchar_t *)*ResIds, L"MUI");
v47 = v11;
}
v15 = v10 & 0x80;
if( (v10 & 0x10) == 0 )
{
v15 = v10 & 0x80;
if( (int)ResIdCount >= 1 && (int)ResIdCount <= 3 )
{
if( (_DWORD)ResIdCount == 3 )
v34 = *((_WORD *)ResIds + 8);
else
v34 = 0;
if( (v10 & 0x1000000) == 0
&& (((*ResIds - 16) & 0xFFFFFFFFFFFFFFF7ui64) != 0 && !v11
|| (~(_BYTE)v10 & 8) == 0
|| (v34 & 0xF3FF) != 0
|| v34 == 3072) )
{
RCConfig = LdrResGetRCConfig(ModuleBasea, MappingSizea, 0i64, v10, 1u);
ResourceDirectory = RCConfig;
if( RCConfig < 0 )
{
if( RCConfig != -1073741686 )
return ResourceDirectory;
v15 = v13 | 0x80000;
v14 = ResIdCount;
}
else
{
v15 = v13 | LdrIsResItemExist(ModuleBasea, ResIds);
v14 = ResIdCount;
}
}
else
{
v10 |= 0x10u;
v15 = v13;
}
}
}
if( (v15 & 0x60000) == 393216 )
return -1073741686;
v16 = (unsigned int)~v15;
LOWORD(v63[0]) = 1;
WORD2(v63[0]) = 0;
if( ((v16 & 0x80000) != 0 && (~(_BYTE)v10 & 0x10) != 0 && (v16 & 0x20000) != 0 || v14 == 3)
&& ((v10 & 0x10) == 0 || (v10 & 0x20) == 0) )
{
v32 = v10;
v33 = v15 | 4;
if( (v10 & 4) == 0 )
v33 = v15;
v15 = v33;
LOBYTE(v32) = v10 & 4;
result = LdrResFallbackLangList(v32, v16, v12, v33, (unsigned __int16 *)v63);
if( result < 0 && (v10 & 0x1000) != 0 )
return result;
}
if( (v10 & 0x10) != 0 || (~v15 & 0x40000) != 0 || (v15 & 0x80000) != 0 )
{
result = LdrpResGetResourceDirectory(ModuleBasea, MappingSizea, v10, &TopResourceDirectory, &v56);
if( result < 0 )
return result;
}
ResourceDirectory = 0;
v18 = 0;
LABEL_15:
if( v18 >= LOWORD(v63[0]) )
return ResourceDirectory;
ReturnAlternateModule = 0i64;
AlternateViewSize = 0i64;
v45 = WORD2(v63[v18]);
v19 = v63[v18 + 1];
v46 = v19;
for( i = 0; ; ++i )
{
if( i >= 2 )
{
LABEL_48:
++v18;
goto LABEL_15;
}
if( i )
break;
if( v19 != 9 )
{
if( (v15 & 0xA0000) == 0 && (v10 & 0x10) == 0 && v45 && *(&PnpReplaceEvent + 6682) )
{
v44 = 1;
LODWORD(NtHeaders) = v15 | 0x1000;
v36 = LdrLoadAlternateResourceModuleEx(
ModuleBasea,
v45,
&ReturnAlternateModule,
&AlternateViewSize,
(UINT64)NtHeaders);
ResourceDirectory = v36;
if( v36 < 0 )
{
if( v36 == -1073741772 || v36 == -1073741766 )
ResourceDirectory = -1073020927;
}
else
{
v38 = AlternateViewSize;
if( !AlternateViewSize )
{
ResourceDirectory = LdrpResGetMappingSize(ReturnAlternateModule, &AlternateViewSize, 0x200ui64, v37);
v38 = AlternateViewSize;
}
if( (v10 & 0x1000) != 0 && ResourceDirectory < 0 )
goto LABEL_48;
ResourceDirectory = LdrpResGetResourceDirectory(ReturnAlternateModule, v38, v10, &v59, &v57);
if( ResourceDirectory >= 0 )
{
v21 = 1;
goto LABEL_20;
}
}
}
LABEL_46:
v19 = v46;
continue;
}
v10 |= 0x20u;
}
v21 = 0;
v44 = 0;
LABEL_20:
if( (~(_BYTE)v10 & 2) != 0 && (int)ResIdCount > 2 )
ResIds[2] = v45;
ResourceSize = 0i64;
v22 = &v45;
if( v21 )
v22 = 0i64;
v23 = v10;
if( v21 )
{
v23 = v10 | 0x20;
}
else if( (v10 & 0x20) == 0 )
{
v23 = v10 | 4;
}
p_ResourceSize = (__int64)&ResourceSize;
if( v60 )
p_ResourceSize = v60;
v25 = v56;
if( v21 )
v25 = v57;
v26 = (const _IMAGE_RESOURCE_DIRECTORY *)TopResourceDirectory;
if( v21 )
v26 = (const _IMAGE_RESOURCE_DIRECTORY *)v59;
v27 = MappingSizea;
if( v21 )
v27 = AlternateViewSize;
v28 = ModuleBasea;
if( v21 )
v28 = ReturnAlternateModule;
LODWORD(v43) = v23;
v29 = LdrpResSearchResourceInsideDirectory(
v28,
0i64,
v27,
v26,
(__int64)v25,
0i64,
(__int64)ResIds,
ResIdCount,
(__int64)v63,
v55,
p_ResourceSize,
v43,
(__int64)v22);
ResourceDirectory = v29;
if( v51 && v29 >= 0 && v55 && v44 )
{
v39 = v60 ? *(_QWORD *)v60 : ResourceSize;
ResourceDirectory = LdrpFindMessageInAlternateModule(
ReturnAlternateModule,
*(PVOID *)v55,
v39,
*((unsigned int *)ResIds + 6),
1u);
if( ResourceDirectory < 0 )
{
*(_QWORD *)v55 = 0i64;
if( ResourceDirectory == -1073741701 )
return ResourceDirectory;
}
}
if( ResourceDirectory < 0 )
goto LABEL_46;
v30 = v61;
if( !v61 )
return ResourceDirectory;
if( v45 )
{
if( DownLevelLangIDToLanguageName(v45, (PWCHAR)Name, 86i64, 2ui64) )
{
v40 = -1i64;
do
++v40;
while( Name[v40] );
goto LABEL_103;
}
return -1073741823;
}
else
{
Name[0] = 0;
LODWORD(v40) = 0;
LABEL_103:
if( (unsigned int)v40 < *(_DWORD *)v30 && (v41 = v62) != 0i64 )
{
memmove(v62, Name, 2 * v40);
*(_DWORD *)v30 = v40 + 1;
v41[(unsigned int)v40] = 0;
}
else
{
*(_DWORD *)v30 = v40 + 1;
ResourceDirectory = -1073741789;
v52 = -1073741789;
}
}
return ResourceDirectory;
}Referenced by:
LdrResGetRCConfig
LdrResSearchResource