./15593 meme en pseudocode c'est pas beaucoup plus evident :/

    if ( _ImageBase.e_magic == 'ZM' )
    {
      originNtHeader = (&_ImageBase + _ImageBase.e_lfanew);
      if ( (&_ImageBase + _ImageBase.e_lfanew) )
      {
        if ( originNtHeader->Signature == 'EP' )
        {
          v11 = (NtCurrentTeb()->NtTib.StackBase - originNtHeader->OptionalHeader.SizeOfStackReserve + 0x3000);
          if ( &retaddr > v11 )
          {
            do
            {
              if ( v9 >= 0x40000 )
                break;
              v12 = *v8;
              v9 += 0x1000;
              v8 += -0x400u;
            }
            while ( v8 > v11 );
          }
        }
      }
    }