LdrResSearchResource
INT64 __fastcall LdrResSearchResource(
VOID *File,
UINT64 *InitResIds,
UINT64 InitResIdCount,
UINT64 Flags,
VOID **Resource,
UINT64 *Size,
WCHAR *FoundLanguage,
UINT64 *FoundLanguageLength){
unsigned int v8;
void *v10;
unsigned int v11;
unsigned int v12;
bool v13;
unsigned int v14;
INT64 result;
UINT8 v16;
UINT64 *v17;
int v18;
UINT16 v19;
NTSTATUS v20;
UINT8 v21;
INT64 ResIdCount;
INT64 ResIdCounta;
INT64 ResIdCountb;
UINT64 MappingSize;
PVOID ModuleBase;
int v27;
PVOID *v28;
UINT64 *v29;
UINT64 dst[2];
PWCHAR lpName;
v8 = InitResIdCount;
v28 = Resource;
v29 = FoundLanguageLength;
v10 = 0i64;
if( !File || !InitResIds || FoundLanguage && !FoundLanguageLength )
return(unsigned int)-1073741811;
if( (Flags & 0xC00) != 0 )
return(unsigned int)-1073741582;
v11 = Flags | 0x100;
if( (Flags & 0xF00) != 0 )
v11 = Flags;
v12 = v11 | 0x1000;
if( (v11 & 0x2000) != 0 )
v12 = v11;
if( (v12 & 0xFFF80000) != 0 )
return(unsigned int)-1073741582;
if( (unsigned int)InitResIdCount < 3 && (v12 & 2) == 0 || (unsigned int)InitResIdCount > 4 )
return(unsigned int)-1073741583;
if( (v12 & 0x41) != 0 )
{
if( (_DWORD)InitResIdCount != 4 )
return 3221225713i64;
}
else if( (_DWORD)InitResIdCount != 4 )
{
goto LABEL_14;
}
if( (v12 & 0x41) == 0 )
return 3221225714i64;
LABEL_14:
if( (v12 & 0x100) != 0 )
{
v13 = (v12 & 0xE00) == 0;
goto LABEL_16;
}
v18 = v12 & 0xC00;
if( (v12 & 0x200) != 0 )
{
v13 = v18 == 0;
LABEL_16:
if( v13 )
goto LABEL_17;
return(unsigned int)-1073741582;
}
if( v18 == 3072 )
return(unsigned int)-1073741582;
LABEL_17:
if( (v12 & 0x8000) != 0 && (~(_WORD)v12 & 0x810) != 0 || (v12 & 0x3000) == 12288 || (v12 & 0x18) == 24 )
return(unsigned int)-1073741582;
MappingSize = 0i64;
if( (v12 & 0x20000) != 0 )
{
if( (v12 & 0x400) == 0 || !Size || !*Size )
{
v14 = -1073741811;
v27 = -1073741811;
return v14;
}
MappingSize = *Size;
}
memmove((UINT8 *)dst, (UINT8 *)InitResIds, 8i64 * (unsigned int)InitResIdCount);
if( v8 > 3 )
{
v8 = 3;
}
else if( v8 != 3 )
{
goto LABEL_28;
}
if( (unsigned __int64)lpName >= 0x10000 )
{
if( *lpName )
{
v19 = DownLevelLanguageNameToLangID(lpName, 2ui64);
LODWORD(ModuleBase) = v19;
}
else
{
v19 = 0;
LODWORD(ModuleBase) = 0;
}
lpName = (PWCHAR)v19;
}
else if( lpName
&& (((unsigned __int16)lpName & 0x3FF) == 0
|| lpName == (PWCHAR)127
|| !DownLevelLangIDToLanguageName((UINT16)lpName, 0i64, 0i64, 2ui64)) )
{
return(unsigned int)-1073741811;
}
LABEL_28:
if( (v12 & 0x300) == 0 )
goto LABEL_31;
v10 = File;
if( (v12 & 0x200) != 0 )
{
v10 = (void *)((unsigned __int64)File | 1);
if( ((unsigned __int8)File & 1) != 0 )
v10 = File;
}
LODWORD(result) = LdrpResGetMappingSize(v10, &MappingSize, v12, v16);
if( (int)result >= 0 || (v12 & 0x1000) == 0 )
{
LABEL_31:
v17 = v29;
LODWORD(ResIdCount) = v8;
v14 = LdrpResSearchResourceMappedFile(v10, MappingSize, v12, dst, ResIdCount, v28, Size, FoundLanguage, v29);
if( v14 == -1073741686 && ((dst[0] - 16) & 0xFFFFFFFFFFFFFFF7ui64) != 0 )
{
ModuleBase = 0i64;
LODWORD(ResIdCounta) = 0x1000000;
v20 = LdrLoadAlternateResourceModuleEx(v10, 0xF2EEu, &ModuleBase, 0i64, ResIdCounta);
if( v20 >= 0 )
{
MappingSize = 0i64;
if( LdrpResGetMappingSize(ModuleBase, &MappingSize, v12, v21) >= 0 )
{
LODWORD(ResIdCountb) = v8;
return(unsigned int)LdrpResSearchResourceMappedFile(
ModuleBase,
MappingSize,
v12 | 0x1000000,
dst,
ResIdCountb,
v28,
Size,
FoundLanguage,
v17);
}
}
}
return v14;
}
return result;
}Referenced by:
AslpFileGetVersionBlock
KeHwPolicyLocateResource
LdrResFindResource
LdrResFindResourceDirectory
PspLocateInPEManifest
RtlLoadString
SeRegisterElamCertResources