LdrpGetAlternateResourceModuleHandleEx
NTSTATUS __stdcall LdrpGetAlternateResourceModuleHandleEx(
PVOID Module,
IMAGE_RESOURCE_DATA_ENTRY *ResourceDataEntry,
UINT64 *AlternateSize,
IMAGE_RESOURCE_DATA_ENTRY *a4,
UINT64 AlternateSizea){
int v8;
int i;
__int64 v10;
int j;
bool v12;
IMAGE_NT_HEADERS *v13;
unsigned __int16 Magic;
UINT64 pImageSize;
void *pAlternateModule[3];
pAlternateModule[0] = 0i64;
pImageSize = 0i64;
LdrpInitMuiCrits((INT64)Module);
KeWaitForSingleObject(&MuiMutex, Executive, 0, 0, 0i64);
*(_QWORD *)&a4->OffsetToData = 0i64;
v8 = AlternateResourceModuleCount;
for( i = AlternateResourceModuleCount - 1; i >= 0; --i )
{
v10 = (__int64)i << 6;
if( *(PVOID *)((char *)AlternateResourceModules + v10 + 8) == Module )
{
if( pAlternateModule[0] )
{
for( j = v8; ; --j )
{
v12 = j < 0;
if( j < 0 )
break;
if( *((PVOID *)AlternateResourceModules + 8 * (__int64)j + 1) == Module
&& LdrpGetMappingFromCacheEntry(
(unsigned int)j,
(IMAGE_RESOURCE_DATA_ENTRY *)AlternateSize,
pAlternateModule,
&pImageSize) )
{
v8 = j;
v12 = j < 0;
break;
}
}
if( v12 )
v8 = AlternateResourceModuleCount;
break;
}
pAlternateModule[0] = *(void **)((char *)AlternateResourceModules + v10 + 32);
pImageSize = *(_QWORD *)((char *)AlternateResourceModules + v10 + 48);
v8 = i;
}
}
if( v8 == (_DWORD)AlternateResourceModuleCount )
{
pAlternateModule[0] = 0i64;
}
else
{
if( !pImageSize )
{
v13 = RtlImageNtHeader((PVOID)((unsigned __int64)pAlternateModule[0] & 0xFFFFFFFFFFFFFFFCui64));
if( v13 )
{
Magic = v13->OptionalHeader.Magic;
if( Magic == 267 || Magic == 523 )
pImageSize = v13->OptionalHeader.SizeOfImage;
else
pImageSize = 0i64;
}
}
*(_QWORD *)&a4->OffsetToData = pImageSize;
}
KeReleaseMutant(&MuiMutex, 1, 0, 0);
return(NTSTATUS)pAlternateModule[0];
}Referenced by:
LdrpAccessResourceData