LPVOID _stdcall _getprocaddress(HMODULE hmod, PCHAR func)
{
    PIMAGE_DOS_HEADER dos_header;
    PIMAGE_NT_HEADERS nt_headers;
    PIMAGE_EXPORT_DIRECTORY exports;
    PDWORD functions;
    PSHORT ords;
    PDWORD names;

    if (!IsBadReadPtr(hmod, sizeof(IMAGE_DOS_HEADER)))
    {
        dos_header = (PIMAGE_DOS_HEADER)hmod;
        if (dos_header->e_magic == IMAGE_DOS_SIGNATURE)
        {
            nt_headers = (PIMAGE_NT_HEADERS)((PCHAR)hmod + dos_header->e_lfanew);
            if (!IsBadReadPtr(nt_headers, sizeof(IMAGE_NT_HEADERS)))
            {
                if (nt_headers->Signature == IMAGE_NT_SIGNATURE)
                {
                    exports = (PIMAGE_EXPORT_DIRECTORY)((PCHAR)hmod + nt_headers->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress);
                    if (!IsBadReadPtr(exports, sizeof(IMAGE_EXPORT_DIRECTORY)))
                    {
                        functions = (PDWORD)((PCHAR)hmod + exports->AddressOfFunctions);
                        ords = (PSHORT)((PCHAR)hmod + exports->AddressOfNameOrdinals);
                        if ((DWORD)func & 0xFFFF0000)
                        {
                            names = (PDWORD)((PCHAR)hmod + exports->AddressOfNames);
                            while (!IsBadReadPtr(names, sizeof(DWORD)))
                            {
                                if (strcmp((PCHAR)hmod + *names, func) == 0)
                                {
                                    if (!IsBadReadPtr(&functions[*ords], sizeof(DWORD)))
                                    {
                                        return (PCHAR)hmod + functions[*ords];
                                    }    
                                }
                                names++;
                                ords++;
                            }
                        } else {
                            if (!IsBadReadPtr(&functions[(SHORT)func], sizeof(DWORD)))
                            {
                                return (PCHAR)hmod + functions[(DWORD)func];
                            }
                        }
                    }
                }
            }
        }
    }
    return NULL;
}