RtlImageNtHeaderEx
__int64 __fastcall RtlImageNtHeaderEx(int a1, unsigned __int64 a2, unsigned __int64 a3, _QWORD *a4){
unsigned int v4;
char v5;
unsigned __int64 v6;
_DWORD *v7;
if( !a4 )
return(unsigned int)-1073741811;
v4 = 0;
*a4 = 0i64;
if( (a1 & 0xFFFFFFFE) != 0 || a2 - 1 > 0xFFFFFFFFFFFFFFFDui64 )
return(unsigned int)-1073741811;
if( (a1 & 1) != 0 )
{
v5 = 0;
}
else
{
v5 = 1;
if( a3 < 0x40 )
return 3221225595i64;
}
if( *(_WORD *)a2 == 23117 )
{
v6 = *(unsigned int *)(a2 + 60);
if( !v5 || v6 < a3 && (unsigned int)v6 < 0xFFFFFFE7 && v6 + 24 < a3 )
{
v7 = (_DWORD *)(a2 + v6);
if( a2 + v6 >= a2
&& (a2 >= 0x7FFFFFFEFFFFi64
|| (unsigned __int64)v7 < 0x7FFFFFFEFFFFi64 && (unsigned __int64)(v7 + 66) < 0x7FFFFFFEFFFFi64)
&& *v7 == 17744 )
{
*a4 = v7;
return v4;
}
}
}
return 3221225595i64;
}Referenced by:
EtwpLocateDbgIdForRegEntry
LdrImageDirectoryEntryToLoadConfig
LdrRelocateImageWithBias
LdrpFetchAddressOfSecurityCookie
LdrpResGetMappingSize
LdrpResGetResourceDirectory
MiCaptureBootDriverRetpolineInfo
MiCaptureDynamicRelocationTableRva
MiOpenHotPatchFile
MiProcessKernelCfgImage
RtlImageNtHeader
RtlpCaptureDynamicRelocationTableRva
RtlpImageDirectoryEntryToDataEx
VfDriverEnableVerifierForAll