LdrpGetMappingFromCacheEntry

UINT8 __stdcall LdrpGetMappingFromCacheEntry(
        UINT64 ModuleIndex,
        IMAGE_RESOURCE_DATA_ENTRY *ResourceDataEntry,
        PVOID *pAlternateModule,
        UINT64 *pImageSize){
  unsigned __int64 v7; 
  unsigned __int64 v8; 
  UINT64 SizeOfImage; 
  UINT8 result; 
  IMAGE_NT_HEADERS *v11; 
  unsigned __int16 Magic; 
  if( !ResourceDataEntry )
    return 0;
  if( !pAlternateModule )
    return 0;
  if( (unsigned int)ModuleIndex >= (unsigned int)AlternateResourceModuleCount )
    return 0;
  _mm_lfence();
  v7 = (unsigned __int64)(unsigned int)ModuleIndex << 6;
  v8 = *(_QWORD *)((char *)AlternateResourceModules + v7 + 32);
  SizeOfImage = *(_QWORD *)((char *)AlternateResourceModules + v7 + 48);
  if( v8 - 1 > 0xFFFFFFFFFFFFFFFDui64 )
    return 0;
  if( !SizeOfImage )
  {
    v11 = RtlImageNtHeader((PVOID)(v8 & 0xFFFFFFFFFFFFFFFCui64));
    if( !v11 )
      return 0;
    Magic = v11->OptionalHeader.Magic;
    if( Magic == 267 || Magic == 523 )
      SizeOfImage = v11->OptionalHeader.SizeOfImage;
    else
      SizeOfImage = 0i64;
    if( !SizeOfImage )
      return 0;
  }
  if( (unsigned __int64)ResourceDataEntry < (v8 & 0xFFFFFFFFFFFFFFFCui64)
    || (unsigned __int64)ResourceDataEntry >= SizeOfImage + (v8 & 0xFFFFFFFFFFFFFFFCui64) )
  {
    return 0;
  }
  *pAlternateModule = (PVOID)v8;
  result = 1;
  *pImageSize = SizeOfImage;
  return result;
}

Referenced by: