LdrpResGetResourceDirectory

NTSTATUS __stdcall LdrpResGetResourceDirectory(
        VOID *ModuleBase,
        ULONGLONG MappingSize,
        UINT64 Flags,
        VOID **TopResourceDirectory,
        VOID **NtHeaders){
  unsigned __int64 v5; 
  NTSTATUS v6; 
  char v7; 
  bool v8; 
  int v9; 
  NTSTATUS result; 
  __int64 v11; 
  VOID *v12; 
  __int128 *v13; 
  __int16 v14; 
  unsigned int v15; 
  unsigned int v16; 
  UINT64 v17; 
  __int64 v18; 
  unsigned int *v19; 
  unsigned __int64 v20; 
  int v21; 
  int v22; 
  UINT64 pullResult; 
  UINT64 v24; 
  __int128 v25; 
  __int128 v26; 
  __int128 v27; 
  __int128 v28; 
  __int128 v29; 
  __int128 v30; 
  __int128 v31; 
  __int128 ullAddend; 
  __int128 v33; 
  __int128 v34; 
  __int128 v35; 
  __int128 v36; 
  __int128 v37; 
  __int128 v38; 
  __int128 v39; 
  __int64 v40; 
  __int64 v41; 
  VOID **v42; 

  v42 = TopResourceDirectory;
  v41 = MappingSize;
  v5 = (unsigned __int64)ModuleBase;
  v6 = 0;
  v24 = 0i64;
  v40 = 0i64;
  v7 = 1;
  v8 = 1;
  pullResult = 0i64;
  if( !ModuleBase || !TopResourceDirectory || !NtHeaders )
    return -1073741811;
  if( ((unsigned __int8)ModuleBase & 3) != 0 )
  {
    v5 = (unsigned __int64)ModuleBase & 0xFFFFFFFFFFFFFFFCui64;
    v8 = !((unsigned __int8)ModuleBase & 1);
  }
  v9 = Flags & 0x1000;
  result = RtlImageNtHeaderEx(v9 == 0, v5, MappingSize, &v40);
  if( result >= 0 )
  {
    v12 = (VOID *)v40;
    v13 = (__int128 *)(v40 + 24);
    v14 = *(_WORD *)(v40 + 24);
    if( v14 == 267 )
    {
      v25 = *v13;
      v26 = *(_OWORD *)(v40 + 40);
      v27 = *(_OWORD *)(v40 + 56);
      v28 = *(_OWORD *)(v40 + 72);
      v29 = *(_OWORD *)(v40 + 88);
      v30 = *(_OWORD *)(v40 + 104);
      v31 = *(_OWORD *)(v40 + 120);
      ullAddend = *(_OWORD *)(v40 + 136);
      v33 = *(_OWORD *)(v40 + 152);
      v34 = *(_OWORD *)(v40 + 168);
      v35 = *(_OWORD *)(v40 + 184);
      v36 = *(_OWORD *)(v40 + 200);
      v37 = *(_OWORD *)(v40 + 216);
      v38 = *(_OWORD *)(v40 + 232);
    }
    else
    {
      if( v14 != 523 )
        return -1073741701;
      v25 = *v13;
      v26 = *(_OWORD *)(v40 + 40);
      v27 = *(_OWORD *)(v40 + 56);
      v28 = *(_OWORD *)(v40 + 72);
      v29 = *(_OWORD *)(v40 + 88);
      v30 = *(_OWORD *)(v40 + 104);
      v31 = *(_OWORD *)(v40 + 120);
      ullAddend = *(_OWORD *)(v40 + 136);
      v33 = *(_OWORD *)(v40 + 152);
      v34 = *(_OWORD *)(v40 + 168);
      v35 = *(_OWORD *)(v40 + 184);
      v36 = *(_OWORD *)(v40 + 200);
      v37 = *(_OWORD *)(v40 + 216);
      v38 = *(_OWORD *)(v40 + 232);
      v39 = *(_OWORD *)(v40 + 248);
      v7 = 0;
    }
    v15 = HIDWORD(v31);
    if( v7 )
      v15 = HIDWORD(v30);
    if( v15 <= 2 )
      return -1073741687;
    v16 = v33;
    if( v7 )
      v16 = ullAddend;
    if( !v16 )
      return -1073741687;
    if( v5 < 0x7FFFFFFEFFFFi64 && v5 + v16 >= 0x7FFFFFFEFFFFi64 )
      return -1073741701;
    if( v8 || v16 < HIDWORD(v28) )
    {
      if( RtlULongLongAdd(v5, v16, &pullResult) < 0 )
        return -1073741701;
      v17 = pullResult;
      v24 = pullResult;
      v18 = v41;
    }
    else
    {
      v18 = v41;
      v19 = (unsigned int *)LdrpSectionTableFromVirtualAddress(v5, v41, v40, v11, v16, v9 != 0);
      if( !v19 )
        return -1073741701;
      if( !v19[4] )
        return -1073741687;
      v17 = v5 + v19[5] - (unsigned __int64)v19[3] + v16;
      v24 = v17;
    }
    if( !v17 )
      return -1073741687;
    if( v9 )
    {
      if( v17 <= v5 )
        return -1073741701;
      v20 = (v5 & 0xFFFFFFFFFFFFFFFCui64) + v18;
      if( v17 + 16 > v20 )
        return -1073741701;
      v21 = *(unsigned __int16 *)(v17 + 12);
      v22 = *(unsigned __int16 *)(v17 + 14);
      if( !__PAIR32__(v22, v21) )
        return -1073741686;
      if( v17 + 8i64 * (unsigned int)(v21 + v22) > v20 )
        return -1073741701;
    }
    *v42 = (VOID *)v17;
    *NtHeaders = v12;
    return v6;
  }
  return result;
}

Referenced by: