LdrpResGetMappingSize

NTSTATUS __stdcall LdrpResGetMappingSize(PVOID ModuleBase, UINT64 *MappingSize, UINT64 Flags, UINT8 fIsMUI){
  UINT64 v6; 
  UINT64 v7; 
  bool v8; 
  NTSTATUS result; 
  unsigned __int16 Magic; 
  UINT64 SizeOfImage; 
  __int64 v12; 
  __int128 MemoryInformation; 
  __int128 v14; 
  __int128 v15; 
  PIMAGE_NT_HEADERS NtHeader; 
  NtHeader = 0i64;
  MemoryInformation = 0i64;
  v14 = 0i64;
  v15 = 0i64;
  if( !ModuleBase || !MappingSize )
    return -1073741811;
  v6 = 0i64;
  if( (Flags & 0x20000) != 0 )
    v6 = *MappingSize;
  *MappingSize = 0i64;
  v7 = 0i64;
  v8 = (Flags & 0x100) != 0 && ((unsigned __int8)ModuleBase & 1) == 0;
  result = RtlImageNtHeaderEx(1ui64, (PVOID)((unsigned __int64)ModuleBase & 0xFFFFFFFFFFFFFFFCui64), 0i64, &NtHeader);
  if( result >= 0 )
  {
    Magic = NtHeader->OptionalHeader.Magic;
    if( Magic == 267 || Magic == 523 )
    {
      SizeOfImage = NtHeader->OptionalHeader.SizeOfImage;
    }
    else
    {
      SizeOfImage = 0i64;
      result = -1073741701;
    }
    if( result >= 0 )
    {
      if( !v8 || !SizeOfImage )
      {
        LODWORD(v12) = LdrpKrnGetDataTableEntry(ModuleBase);
        if( v12 )
          v7 = *(unsigned int *)(v12 + 64);
        if( v7 )
        {
          result = 0;
        }
        else
        {
          result = ZwQueryVirtualMemory(
                     (PVOID)0xFFFFFFFFFFFFFFFFi64,
                     (PVOID)((unsigned __int64)ModuleBase & 0xFFFFFFFFFFFFFFFCui64),
                     MemoryBasicVlmInformation,
                     &MemoryInformation,
                     0x30ui64,
                     0i64);
          if( result >= 0 )
            v7 = v14;
        }
        if( v7 || !SizeOfImage )
          goto LABEL_14;
        result = 0;
      }
      v7 = SizeOfImage;
LABEL_14:
      if( result >= 0 )
      {
        if( v6 && v6 < v7 )
          return -1073741793;
        else
          *MappingSize = v7;
      }
    }
  }
  return result;
}

Referenced by: