RtlImageNtHeaderEx

__int64 __fastcall RtlImageNtHeaderEx(int a1, unsigned __int64 a2, unsigned __int64 a3, _QWORD *a4){
  unsigned int v4; 
  char v5; 
  unsigned __int64 v6; 
  _DWORD *v7; 

  if( !a4 )
    return(unsigned int)-1073741811;
  v4 = 0;
  *a4 = 0i64;
  if( (a1 & 0xFFFFFFFE) != 0 || a2 - 1 > 0xFFFFFFFFFFFFFFFDui64 )
    return(unsigned int)-1073741811;
  if( (a1 & 1) != 0 )
  {
    v5 = 0;
  }
  else
  {
    v5 = 1;
    if( a3 < 0x40 )
      return 3221225595i64;
  }
  if( *(_WORD *)a2 == 23117 )
  {
    v6 = *(unsigned int *)(a2 + 60);
    if( !v5 || v6 < a3 && (unsigned int)v6 < 0xFFFFFFE7 && v6 + 24 < a3 )
    {
      v7 = (_DWORD *)(a2 + v6);
      if( a2 + v6 >= a2
        && (a2 >= 0x7FFFFFFEFFFFi64
         || (unsigned __int64)v7 < 0x7FFFFFFEFFFFi64 && (unsigned __int64)(v7 + 66) < 0x7FFFFFFEFFFFi64)
        && *v7 == 17744 )
      {
        *a4 = v7;
        return v4;
      }
    }
  }
  return 3221225595i64;
}

Referenced by:

EtwpLocateDbgIdForRegEntry
LdrImageDirectoryEntryToLoadConfig
LdrRelocateImageWithBias
LdrpFetchAddressOfSecurityCookie
LdrpResGetMappingSize
LdrpResGetResourceDirectory
MiCaptureBootDriverRetpolineInfo
MiCaptureDynamicRelocationTableRva
MiOpenHotPatchFile
MiProcessKernelCfgImage
RtlImageNtHeader
RtlpCaptureDynamicRelocationTableRva
RtlpImageDirectoryEntryToDataEx
VfDriverEnableVerifierForAll