LdrpAccessResourceDataNoMultipleLanguage
NTSTATUS __stdcall LdrpAccessResourceDataNoMultipleLanguage(
PVOID DllHandle,
_IMAGE_RESOURCE_DATA_ENTRY *ResourceDataEntry,
PVOID *Address,
UINT64 *Size){
UINT64 *v4;
UINT64 v6;
int v7;
unsigned __int64 v8;
UINT64 v9;
int v10;
unsigned __int64 v11;
unsigned __int64 v12;
__int16 v13;
unsigned int v14;
UINT64 v15;
unsigned __int64 v16;
unsigned int OffsetToData;
void *v18;
unsigned __int64 v19;
unsigned __int64 v20;
UINT64 ImageSize;
int v23;
char *v24;
unsigned __int64 v25;
v4 = Size;
v6 = (UINT64)DllHandle;
v24 = (char *)RtlImageDirectoryEntryToData(DllHandle, 1u, 2u, &ImageSize);
if( !v24 )
return -1073741687;
ImageSize = 0i64;
v7 = LdrpGetImageSize((PVOID)v6, &ImageSize);
v23 = v7;
if( v7 == -1073741701 )
return -1073741701;
v8 = v6 & 0xFFFFFFFFFFFFFFFCui64;
if( (unsigned __int64)ResourceDataEntry <= (v6 & 0xFFFFFFFFFFFFFFFCui64) )
return -1073741701;
v9 = ImageSize;
if( ImageSize )
{
if( (unsigned __int64)ResourceDataEntry >= v8 + ImageSize )
return -1073741701;
}
v10 = 0;
if( (v6 & 3) != 0 )
{
if( (v6 & 1) != 0 )
v10 = 1;
v6 &= 0xFFFFFFFFFFFFFFFCui64;
}
if( v10 == 1 )
{
LODWORD(v11) = RtlImageNtHeader(v6);
v12 = v11;
if( !v11 )
return -1073741687;
v13 = *(_WORD *)(v11 + 24);
if( v13 == 267 )
{
v14 = *(_DWORD *)(v12 + 136);
}
else if( v13 == 523 )
{
v14 = *(_DWORD *)(v12 + 152);
}
else
{
v14 = 0;
}
if( !v14 )
return -1073741687;
v15 = v6 + v14 - (_QWORD)v24;
v16 = RtlSectionTableFromVirtualAddress(v12, v6, v14);
if( !v16 )
return -1073741687;
OffsetToData = ResourceDataEntry->OffsetToData;
if( ResourceDataEntry->OffsetToData > *(_DWORD *)(v16 + 8) )
{
LODWORD(ImageSize) = *(_DWORD *)(v16 + 12);
v19 = RtlSectionTableFromVirtualAddress(v12, v6, OffsetToData);
v25 = v19;
if( !v19 )
return -1073741687;
v20 = RtlAddressInSectionTable(v12, v6, *(_DWORD *)(v19 + 12));
v15 += (UINT64)&v24[*(unsigned int *)(v25 + 12) - (unsigned __int64)(unsigned int)ImageSize - v20];
}
v4 = Size;
}
else
{
v15 = 0i64;
}
if( Address
&& ((v18 = (void *)(v6 + ResourceDataEntry->OffsetToData - v15), *Address = v18, (unsigned __int64)v18 <= v8)
|| v9 && (unsigned __int64)v18 >= v8 + v9) )
{
*Address = 0i64;
return -1073741701;
}
else
{
if( v4 )
*(_DWORD *)v4 = ResourceDataEntry->Size;
return v7;
}
}Referenced by:
LdrpAccessResourceData
LdrpFindMessageInAlternateModule
LdrpGetRcConfig