LdrImageDirectoryEntryToLoadConfig
NTSTATUS __stdcall LdrImageDirectoryEntryToLoadConfig(PVOID Base){
_DWORD *v2;
NTSTATUS v3;
UINT64 Size;
PIMAGE_NT_HEADERS NtHeader;
LODWORD(Size) = 0;
NtHeader = 0i64;
RtlImageNtHeaderEx(1ui64, Base, 0i64, &NtHeader);
if( !Base )
return 0;
LODWORD(v2) = RtlImageDirectoryEntryToData(Base, 1u, 0xAu, &Size);
if( (unsigned __int64)Base < 0x7FFFFFFEFFFFi64 && ((unsigned __int64)(v2 + 1) > 0x7FFFFFFF0000i64 || v2 + 1 < v2) )
MEMORY[0x7FFFFFFF0000] = 0;
if( v2
&& (_DWORD)Size
&& (_DWORD)Size == *v2
&& RtlWow64GetEquivalentMachineCHPE(NtHeader->FileHeader.Machine) == -31132 )
{
return v3;
}
else
{
return 0;
}
}Referenced by:
LdrpFetchAddressOfSecurityCookie
MiCaptureBootDriverRetpolineInfo
RtlGetImageBaseAndLoadConfig
RtlGuardCheckExceptionHandler
RtlGuardCheckLongJumpTarget
RtlIsImageFullyRetpolined
RtlpCaptureDynamicRelocationTableRva
RtlpCaptureRetpolineBinaryInfoForImage