LdrpResSearchResourceInsideDirectory
NTSTATUS __fastcall LdrpResSearchResourceInsideDirectory(
PVOID ModuleBase,
INT64 a2,
UINT64 a3,
IMAGE_RESOURCE_DIRECTORY_ENTRY *a4,
IMAGE_NT_HEADERS *NtHeaders,
UINT64 ullSubtrahend,
INT64 a7,
INT64 a8,
INT64 a9,
INT64 a10,
INT64 a11,
INT64 *a12,
INT64 a13){
UINT64 v14;
NTSTATUS v16;
DWORD Name;
UINT64 *v18;
int v19;
int v20;
const _IMAGE_RESOURCE_DIRECTORY_ENTRY *v21;
unsigned int *v22;
int v23;
int v24;
UINT64 OffsetToData_low;
const _IMAGE_RESOURCE_DIRECTORY_ENTRY *v26;
unsigned int v27;
__int64 v28;
const _IMAGE_RESOURCE_DIRECTORY_ENTRY *ResourceDirectoryEntry;
const _IMAGE_RESOURCE_DIRECTORY_ENTRY *v30;
char v31;
int v32;
NTSTATUS result;
UINT64 v34;
bool v35;
char v36;
__int64 v37;
__int64 OffsetToData;
int v39;
_IMAGE_SECTION_HEADER *v40;
unsigned __int64 v41;
UINT64 v42;
UINT64 v43;
UINT64 v44;
UINT64 v45;
UINT64 v46;
UINT64 *v47;
__int64 v48;
UINT64 v49;
_QWORD *v50;
__int64 v51;
__int64 v52;
_IMAGE_NT_HEADERS64 *v53;
unsigned __int16 Magic;
unsigned int VirtualAddress;
__int64 v56;
_IMAGE_SECTION_HEADER *v57;
_IMAGE_NT_HEADERS64 *v58;
_IMAGE_SECTION_HEADER *v59;
_IMAGE_SECTION_HEADER *v60;
_IMAGE_NT_HEADERS64 *v61;
_IMAGE_SECTION_HEADER *v62;
_IMAGE_SECTION_HEADER *v63;
_IMAGE_SECTION_HEADER *v64;
__int64 v65;
unsigned int v66;
unsigned __int64 v67;
__int64 v68;
int v69;
unsigned __int64 v70;
UINT64 Flags;
ULONGLONG pullResult;
unsigned int v73;
int v74;
INT64 Return;
ULONGLONG v76;
const _IMAGE_RESOURCE_DIRECTORY_ENTRY *v77;
__int16 v78;
int v79;
int v80;
const _IMAGE_RESOURCE_DIRECTORY_ENTRY *v81;
UINT64 ResourceName;
char *v83;
UINT64 v84;
const _IMAGE_RESOURCE_DIRECTORY_ENTRY *v85;
const _IMAGE_RESOURCE_DIRECTORY_ENTRY *v86;
__int16 v87;
__int64 v88;
const _IMAGE_RESOURCE_DIRECTORY_ENTRY *v89;
int v90;
const _IMAGE_RESOURCE_DIRECTORY_ENTRY *v91;
UINT64 *v92;
char v94;
unsigned int v95;
__int16 ullSubtrahenda;
unsigned int ullSubtrahendb;
v14 = a3;
v16 = 0;
LODWORD(Return) = 0;
ullSubtrahenda = 0;
LOWORD(Name) = 0;
v79 = 0;
pullResult = 0i64;
if( !a4 )
return -1073741811;
if( !NtHeaders )
return -1073741811;
v18 = (UINT64 *)a7;
if( !a7 )
return -1073741811;
if( (unsigned int)(a8 - 1) > 3 )
return -1073741811;
v19 = (int)a12;
v74 = (int)a12;
if( ((unsigned __int16)a12 & 0x8000) != 0 || ((unsigned __int16)a12 & 0x1000) != 0 && !v14 )
return -1073741811;
if( ((unsigned __int16)a12 & 0x8800) == 34816 || !ModuleBase )
return -1073741811;
v20 = a8;
v80 = a8;
v21 = a4;
v22 = 0i64;
v81 = 0i64;
if( a13 )
*(_WORD *)a13 = 0;
LABEL_12:
if( !v21 )
goto LABEL_58;
v23 = v20;
v24 = v20 - 1;
v80 = v24;
v90 = v24;
if( !v23 )
goto LABEL_58;
ResourceName = *v18;
v84 = ResourceName;
if( !v24 && (_DWORD)a8 == 3 )
{
v81 = v21;
v91 = v21;
if( !a9 )
return -1073741811;
ullSubtrahenda = *(_WORD *)a9;
v87 = *(_WORD *)a9;
v79 = 0;
v78 = 0;
if( (~(_BYTE)v19 & 4) != 0 )
{
ResourceName = *(unsigned __int16 *)(a9 + 4);
v84 = ResourceName;
}
}
if( ((unsigned __int16)a12 & 0x1000) != 0
&& (RtlULongLongAdd((UINT64)v21, 0x18ui64, &pullResult) < 0
|| (unsigned __int64)&v21[3] > v14 + ((unsigned __int64)ModuleBase & 0xFFFFFFFFFFFFFFFCui64)) )
{
return -1073741701;
}
OffsetToData_low = LOWORD(v21[1].OffsetToData);
v73 = OffsetToData_low;
if( (_DWORD)OffsetToData_low && ((unsigned __int16)a12 & 0x1000) != 0 )
{
v83 = (char *)(8 * OffsetToData_low);
if( RtlULongLongAdd((UINT64)v21, (unsigned int)(8 * OffsetToData_low) + 16i64, &pullResult) < 0
|| (unsigned __int64)&v21[2] + v52 > v14 + ((unsigned __int64)ModuleBase & 0xFFFFFFFFFFFFFFFCui64) )
{
return -1073741701;
}
OffsetToData_low = v73;
}
v26 = v21 + 2;
v83 = (char *)&v21[2];
v86 = v21 + 2;
v27 = OffsetToData_low;
if( (ResourceName & 0xFFFFFFFFFFFF0000ui64) == 0 )
{
if( (_DWORD)OffsetToData_low )
{
if( ((unsigned __int16)a12 & 0x1000) != 0 )
{
if( RtlULongLongAdd((UINT64)v26, OffsetToData_low, &pullResult) < 0 )
return -1073741701;
LODWORD(OffsetToData_low) = v73;
}
v26 += (unsigned int)OffsetToData_low;
v83 = (char *)v26;
v86 = v26;
}
OffsetToData_low = *((unsigned __int16 *)&v21[1].1 + 1);
v73 = OffsetToData_low;
v27 = OffsetToData_low;
if( ((unsigned __int16)a12 & 0x1000) != 0 )
{
v88 = 8i64 * (unsigned int)OffsetToData_low;
if( RtlULongLongAdd((UINT64)v26, (unsigned int)(8 * OffsetToData_low), &pullResult) < 0 )
return -1073741701;
OffsetToData_low = v27;
v73 = v27;
if( (unsigned __int64)&v83[v28] > v14 + ((unsigned __int64)ModuleBase & 0xFFFFFFFFFFFFFFFCui64) )
return -1073741701;
v19 = v74;
v26 = (const _IMAGE_RESOURCE_DIRECTORY_ENTRY *)v83;
}
}
if( !v27 )
{
v77 = 0i64;
LABEL_106:
switch( (_DWORD)a8 - v80 )
{
case 1:
return -1073741686;
case 2:
return -1073741685;
case 3:
return -1073741308;
}
return -1073741811;
}
LABEL_26:
if( v81 && (v19 & 0x20) != 0 )
{
v21 = 0i64;
v77 = 0i64;
OffsetToData = v26->OffsetToData;
if( ((unsigned __int16)a12 & 0x1000) != 0 )
{
if( RtlULongLongAdd((UINT64)a4, (unsigned int)OffsetToData, &pullResult) < 0 )
return -1073741701;
v22 = (unsigned int *)pullResult;
v76 = pullResult;
v26 = (const _IMAGE_RESOURCE_DIRECTORY_ENTRY *)v83;
}
else
{
v22 = (unsigned int *)((char *)a4 + OffsetToData);
v76 = (ULONGLONG)a4 + OffsetToData;
}
Name = v26->Name;
v84 = v26->Name;
LABEL_58:
v39 = v19 & 2;
if( v22 && !v39 )
{
if( ((unsigned __int16)a12 & 0x1000) != 0
&& (v22 <= (unsigned int *)a4
|| (unsigned __int64)(v22 + 4) > v14 + ((unsigned __int64)ModuleBase & 0xFFFFFFFFFFFFFFFCui64)) )
{
goto LABEL_151;
}
v40 = (_IMAGE_SECTION_HEADER *)a13;
if( a13 )
*(_WORD *)a13 = Name;
v41 = (unsigned __int64)ModuleBase & 0xFFFFFFFFFFFFFFFCui64;
if( ((unsigned __int8)ModuleBase & 1) != 0 )
{
v53 = NtHeaders;
Magic = NtHeaders->OptionalHeader.Magic;
if( Magic == 267 )
{
VirtualAddress = NtHeaders->OptionalHeader.DataDirectory[0].VirtualAddress;
}
else if( Magic == 523 )
{
VirtualAddress = NtHeaders->OptionalHeader.DataDirectory[2].VirtualAddress;
}
else
{
VirtualAddress = 0;
}
if( !VirtualAddress )
{
v76 = 0i64;
return -1073741687;
}
v56 = VirtualAddress;
if( ((unsigned __int16)a12 & 0x1000) != 0 )
{
if( RtlULongLongAdd((unsigned __int64)ModuleBase & 0xFFFFFFFFFFFFFFFCui64, VirtualAddress, &pullResult) < 0
|| RtlULongLongSub(pullResult, (UINT64)a4, &pullResult) < 0 )
{
return -1073741701;
}
v53 = NtHeaders;
}
v42 = v41 + v56 - (_QWORD)a4;
v57 = LdrpSectionTableFromVirtualAddress(
(PVOID)((unsigned __int64)ModuleBase & 0xFFFFFFFFFFFFFFFCui64),
v14,
v53,
v40);
if( !v57 )
goto LABEL_151;
if( *v22 > *((_DWORD *)v57 + 2) )
{
ullSubtrahendb = *((_DWORD *)v57 + 3);
v60 = LdrpSectionTableFromVirtualAddress(
(PVOID)((unsigned __int64)ModuleBase & 0xFFFFFFFFFFFFFFFCui64),
a3,
v58,
v59);
if( !v60 )
goto LABEL_151;
v95 = *((_DWORD *)v60 + 3);
v63 = LdrpSectionTableFromVirtualAddress(
(PVOID)((unsigned __int64)ModuleBase & 0xFFFFFFFFFFFFFFFCui64),
a3,
v61,
v62);
v64 = v63;
if( v63 )
{
if( ((unsigned __int16)a12 & 0x1000) != 0 )
{
if( RtlULongLongAdd(
(unsigned __int64)ModuleBase & 0xFFFFFFFFFFFFFFFCui64,
v95 - (unsigned __int64)*((unsigned int *)v63 + 3),
&pullResult) < 0
|| RtlULongLongAdd(pullResult, *(unsigned int *)(v65 + 20), &pullResult) < 0 )
{
return -1073741701;
}
}
else
{
v66 = v95;
}
v67 = v41 + *((unsigned int *)v64 + 5) - (unsigned __int64)*((unsigned int *)v64 + 3) + v66;
}
else
{
v67 = 0i64;
}
if( ((unsigned __int16)a12 & 0x1000) != 0
&& (RtlULongLongSub(*((unsigned int *)v64 + 3), ullSubtrahendb, &pullResult) < 0
|| RtlULongLongSub(pullResult, v68 - (_QWORD)a4, &pullResult) < 0) )
{
return -1073741701;
}
v42 += (UINT64)a4 + *((unsigned int *)v64 + 3) - (unsigned __int64)ullSubtrahendb - v67;
}
}
else
{
v42 = 0i64;
}
if( ((unsigned __int16)a12 & 0x1000) == 0 )
{
v44 = 0i64;
v46 = v22[1];
v45 = a3;
LABEL_74:
v47 = (UINT64 *)a10;
if( a10 )
{
if( ((unsigned __int16)a12 & 0x1000) != 0 )
{
if( RtlULongLongAdd(v41, v44, &pullResult) < 0
|| pullResult < v41
|| pullResult > v45 + (v41 & 0xFFFFFFFFFFFFFFFCui64) )
{
return -1073741701;
}
v49 = v48 + v41;
}
else
{
v49 = v41 + *v22 - v42;
}
*v47 = v49;
}
v50 = (_QWORD *)a11;
if( a11 )
{
if( ((unsigned __int16)a12 & 0x1000) != 0
&& v47
&& (RtlULongLongAdd(*v47, v46, &pullResult) < 0 || v51 + v46 > v41 + v45) )
{
return -1073741701;
}
*v50 = v46;
}
return v16;
}
if( RtlULongLongSub(*v22, v42, &pullResult) < 0 )
return -1073741701;
v44 = pullResult;
if( pullResult >= (char *)a4 - (_BYTE *)ModuleBase )
{
v45 = a3;
if( pullResult <= a3 )
{
if( (_DWORD)v43 )
{
v46 = (unsigned int)v43;
if( v43 <= a3 && pullResult + v43 <= a3 )
goto LABEL_74;
}
}
}
LABEL_151:
v76 = 0i64;
return -1073741701;
}
if( v21 && v39 )
{
if( ((unsigned __int16)a12 & 0x1000) != 0 )
{
if( RtlULongLongAdd((UINT64)v21, 0x18ui64, &pullResult) < 0
|| (v70 = (unsigned __int64)ModuleBase & 0xFFFFFFFFFFFFFFFCui64, (unsigned __int64)&v21[3] > v70 + v14) )
{
v77 = 0i64;
return -1073741701;
}
}
else
{
v70 = (unsigned __int64)ModuleBase & 0xFFFFFFFFFFFFFFFCui64;
}
if( a10 )
{
if( ((unsigned __int16)a12 & 0x1000) != 0 && ((unsigned __int64)v21 < v70 || (unsigned __int64)v21 > v70 + v14) )
return -1073741701;
*(_QWORD *)a10 = v21;
}
return v16;
}
goto LABEL_106;
}
LABEL_27:
v21 = 0i64;
v77 = 0i64;
ResourceDirectoryEntry = v26;
v86 = v26;
v30 = &v26[(unsigned int)OffsetToData_low - 1];
v89 = v30;
v31 = OffsetToData_low;
while( 1 )
{
if( ResourceDirectoryEntry > v30 )
goto LABEL_40;
v32 = (int)OffsetToData_low >> 1;
LODWORD(v88) = (int)OffsetToData_low >> 1;
if( !((int)OffsetToData_low >> 1) )
{
if( !(_DWORD)OffsetToData_low )
goto LABEL_40;
LODWORD(Flags) = v19;
result = LdrpResCompareResourceNames(
ModuleBase,
(VOID *)OffsetToData_low,
v14,
ResourceName,
(const _IMAGE_RESOURCE_DIRECTORY *)a4,
ResourceDirectoryEntry,
Flags,
&Return);
if( result < 0 )
return result;
if( !(_DWORD)Return )
{
v34 = v86->OffsetToData;
if( (v34 & 0x80000000) == 0i64 )
goto LABEL_100;
LABEL_34:
if( ((unsigned __int16)a12 & 0x1000) != 0 )
{
if( v81 || RtlULongLongAdd((UINT64)a4, v34 & 0x7FFFFFFF, &pullResult) < 0 )
return -1073741701;
v21 = (const _IMAGE_RESOURCE_DIRECTORY_ENTRY *)pullResult;
}
else
{
v21 = (IMAGE_RESOURCE_DIRECTORY_ENTRY *)((char *)a4 + (v34 & 0xFFFFFFFF7FFFFFFFui64));
}
v77 = v21;
}
LABEL_39:
v14 = a3;
LABEL_40:
v19 = v74;
if( !v81 || v22 )
goto LABEL_41;
if( (v74 & 4) != 0 )
{
LOWORD(Name) = ResourceName;
goto LABEL_58;
}
HIWORD(v69) = HIWORD(v79);
LOWORD(v69) = v79 + 1;
v79 = v69;
v78 = v69;
if( (unsigned __int16)v69 >= ullSubtrahenda )
{
if( *(_BYTE *)(a9 + 516) )
{
LABEL_41:
v18 = (UINT64 *)(a7 + 8);
a7 = (INT64)v18;
v92 = v18;
LOWORD(Name) = ResourceName;
v20 = v80;
goto LABEL_12;
}
v19 = v74 | 0x20;
v74 |= 0x20u;
OffsetToData_low = v73;
v26 = (const _IMAGE_RESOURCE_DIRECTORY_ENTRY *)v83;
goto LABEL_26;
}
ResourceName = *(unsigned __int16 *)(a9 + 8i64 * (unsigned __int16)v69 + 4);
v84 = ResourceName;
OffsetToData_low = v73;
v26 = (const _IMAGE_RESOURCE_DIRECTORY_ENTRY *)v83;
goto LABEL_27;
}
v85 = ResourceDirectoryEntry;
v36 = v31 & 1;
v35 = v36 == 0;
v94 = v36;
LODWORD(v37) = v32 - 1;
LODWORD(v84) = v32 - 1;
if( v35 )
v37 = (int)v37;
else
v37 = v32;
v85 = &ResourceDirectoryEntry[v37];
LODWORD(Flags) = v19;
result = LdrpResCompareResourceNames(
ModuleBase,
(VOID *)OffsetToData_low,
v14,
ResourceName,
(const _IMAGE_RESOURCE_DIRECTORY *)a4,
v85,
Flags,
&Return);
if( result < 0 )
return result;
if( !(_DWORD)Return )
break;
if( (int)Return < 0 )
{
v30 = v85 - 1;
v89 = v85 - 1;
if( v94 )
{
v31 = v88;
OffsetToData_low = (unsigned int)v88;
}
else
{
v31 = v84;
OffsetToData_low = (unsigned int)v84;
}
ResourceDirectoryEntry = v86;
}
else
{
ResourceDirectoryEntry = v85 + 1;
v86 = v85 + 1;
v31 = v88;
OffsetToData_low = (unsigned int)v88;
v30 = v89;
}
v14 = a3;
v19 = v74;
}
v34 = v85->OffsetToData;
if( (v34 & 0x80000000) != 0i64 )
goto LABEL_34;
v21 = 0i64;
v77 = 0i64;
LABEL_100:
if( ((unsigned __int16)a12 & 0x1000) == 0 )
{
v22 = (unsigned int *)((char *)a4 + v34);
LABEL_104:
v76 = (ULONGLONG)v22;
goto LABEL_39;
}
if( v81 && RtlULongLongAdd((UINT64)a4, v34, &pullResult) >= 0 )
{
v22 = (unsigned int *)pullResult;
goto LABEL_104;
}
return -1073741701;
}Referenced by:
LdrpResSearchResourceMappedFile