LdrpResGetResourceDirectory

INT64 __fastcall LdrpResGetResourceDirectory(
        VOID *ModuleBase,
        UINT64 MappingSize,
        UINT64 Flags,
        VOID **TopResourceDirectory,
        VOID **NtHeaders){
  UINT64 v5; 
  unsigned int v6; 
  char v7; 
  bool v8; 
  int v9; 
  INT64 result; 
  _IMAGE_SECTION_HEADER *v11; 
  PIMAGE_NT_HEADERS v12; 
  _IMAGE_OPTIONAL_HEADER64 *p_OptionalHeader; 
  unsigned __int16 Magic; 
  unsigned int v15; 
  unsigned int v16; 
  ULONGLONG v17; 
  UINT64 v18; 
  _IMAGE_SECTION_HEADER *v19; 
  unsigned __int64 v20; 
  int v21; 
  int v22; 
  ULONGLONG pullResult; 
  ULONGLONG v24; 
  __int128 v25; 
  __int128 v26; 
  __int128 v27; 
  __int128 v28; 
  __int128 v29; 
  __int128 v30; 
  __int128 v31; 
  __int128 ullAddend; 
  __int128 v33; 
  __int128 v34; 
  __int128 v35; 
  __int128 v36; 
  __int128 v37; 
  __int128 v38; 
  __int128 v39; 
  PIMAGE_NT_HEADERS NtHeader; 
  UINT64 MappingSizea; 
  VOID **v42; 
  v42 = TopResourceDirectory;
  MappingSizea = MappingSize;
  v5 = (UINT64)ModuleBase;
  v6 = 0;
  v24 = 0i64;
  NtHeader = 0i64;
  v7 = 1;
  v8 = 1;
  pullResult = 0i64;
  if( !ModuleBase || !TopResourceDirectory || !NtHeaders )
    return 3221225485i64;
  if( ((unsigned __int8)ModuleBase & 3) != 0 )
  {
    v5 = (unsigned __int64)ModuleBase & 0xFFFFFFFFFFFFFFFCui64;
    v8 = !((unsigned __int8)ModuleBase & 1);
  }
  v9 = Flags & 0x1000;
  LODWORD(result) = RtlImageNtHeaderEx(v9 == 0, (PVOID)v5, MappingSize, &NtHeader);
  if( (int)result >= 0 )
  {
    v12 = NtHeader;
    p_OptionalHeader = &NtHeader->OptionalHeader;
    Magic = NtHeader->OptionalHeader.Magic;
    if( Magic == 267 )
    {
      v25 = *(_OWORD *)&p_OptionalHeader->Magic;
      v26 = *(_OWORD *)&NtHeader->OptionalHeader.AddressOfEntryPoint;
      v27 = *(_OWORD *)&NtHeader->OptionalHeader.SectionAlignment;
      v28 = *(_OWORD *)&NtHeader->OptionalHeader.MajorSubsystemVersion;
      v29 = *(_OWORD *)&NtHeader->OptionalHeader.CheckSum;
      v30 = *(_OWORD *)&NtHeader->OptionalHeader.SizeOfStackCommit;
      v31 = *(_OWORD *)&NtHeader->OptionalHeader.SizeOfHeapCommit;
      ullAddend = *(_OWORD *)&NtHeader->OptionalHeader.DataDirectory[0].VirtualAddress;
      v33 = *(_OWORD *)&NtHeader->OptionalHeader.DataDirectory[2].VirtualAddress;
      v34 = *(_OWORD *)&NtHeader->OptionalHeader.DataDirectory[4].VirtualAddress;
      v35 = *(_OWORD *)&NtHeader->OptionalHeader.DataDirectory[6].VirtualAddress;
      v36 = *(_OWORD *)&NtHeader->OptionalHeader.DataDirectory[8].VirtualAddress;
      v37 = *(_OWORD *)&NtHeader->OptionalHeader.DataDirectory[10].VirtualAddress;
      v38 = *(_OWORD *)&NtHeader->OptionalHeader.DataDirectory[12].VirtualAddress;
    }
    else
    {
      if( Magic != 523 )
        return(unsigned int)-1073741701;
      v25 = *(_OWORD *)&p_OptionalHeader->Magic;
      v26 = *(_OWORD *)&NtHeader->OptionalHeader.AddressOfEntryPoint;
      v27 = *(_OWORD *)&NtHeader->OptionalHeader.SectionAlignment;
      v28 = *(_OWORD *)&NtHeader->OptionalHeader.MajorSubsystemVersion;
      v29 = *(_OWORD *)&NtHeader->OptionalHeader.CheckSum;
      v30 = *(_OWORD *)&NtHeader->OptionalHeader.SizeOfStackCommit;
      v31 = *(_OWORD *)&NtHeader->OptionalHeader.SizeOfHeapCommit;
      ullAddend = *(_OWORD *)&NtHeader->OptionalHeader.DataDirectory[0].VirtualAddress;
      v33 = *(_OWORD *)&NtHeader->OptionalHeader.DataDirectory[2].VirtualAddress;
      v34 = *(_OWORD *)&NtHeader->OptionalHeader.DataDirectory[4].VirtualAddress;
      v35 = *(_OWORD *)&NtHeader->OptionalHeader.DataDirectory[6].VirtualAddress;
      v36 = *(_OWORD *)&NtHeader->OptionalHeader.DataDirectory[8].VirtualAddress;
      v37 = *(_OWORD *)&NtHeader->OptionalHeader.DataDirectory[10].VirtualAddress;
      v38 = *(_OWORD *)&NtHeader->OptionalHeader.DataDirectory[12].VirtualAddress;
      v39 = *(_OWORD *)&NtHeader->OptionalHeader.DataDirectory[14].VirtualAddress;
      v7 = 0;
    }
    v15 = HIDWORD(v31);
    if( v7 )
      v15 = HIDWORD(v30);
    if( v15 <= 2 )
    {
      return(unsigned int)-1073741687;
    }
    else
    {
      v16 = v33;
      if( v7 )
        v16 = ullAddend;
      if( v16 )
      {
        if( v5 < 0x7FFFFFFEFFFFi64 && v5 + v16 >= 0x7FFFFFFEFFFFi64 )
        {
          return(unsigned int)-1073741701;
        }
        else
        {
          if( v8 || v16 < HIDWORD(v28) )
          {
            if( RtlULongLongAdd(v5, v16, &pullResult) < 0 )
              return(unsigned int)-1073741701;
            v17 = pullResult;
            v24 = pullResult;
            v18 = MappingSizea;
          }
          else
          {
            v18 = MappingSizea;
            v19 = LdrpSectionTableFromVirtualAddress((PVOID)v5, MappingSizea, NtHeader, v11);
            if( !v19 )
              return(unsigned int)-1073741701;
            if( !*((_DWORD *)v19 + 4) )
              return(unsigned int)-1073741687;
            v17 = v5 + *((unsigned int *)v19 + 5) - (unsigned __int64)*((unsigned int *)v19 + 3) + v16;
            v24 = v17;
          }
          if( !v17 )
            return(unsigned int)-1073741687;
          if( v9 )
          {
            if( v17 <= v5 )
              return(unsigned int)-1073741701;
            v20 = (v5 & 0xFFFFFFFFFFFFFFFCui64) + v18;
            if( v17 + 16 > v20 )
              return(unsigned int)-1073741701;
            v21 = *(unsigned __int16 *)(v17 + 12);
            v22 = *(unsigned __int16 *)(v17 + 14);
            if( !__PAIR32__(v22, v21) )
              return(unsigned int)-1073741686;
            if( v17 + 8i64 * (unsigned int)(v21 + v22) > v20 )
              return(unsigned int)-1073741701;
          }
          *v42 = (VOID *)v17;
          *NtHeaders = v12;
        }
      }
      else
      {
        return(unsigned int)-1073741687;
      }
    }
    return v6;
  }
  return result;
}

Referenced by: