PsWow64GetProcessNtdllType
INT64 __fastcall PsWow64GetProcessNtdllType(INT64 a1){
INT64 result;
result = *(_QWORD *)(a1 + 1408);
if( result )
return *(unsigned int *)(result + 12);
return result;
}Referenced by:
DbgkCreateThread
DbgkSendSystemDllMessages
PsMapSystemDlls
PsThawProcess
PspAllocateProcess
PspPrepareSystemDllInitBlock
PspSetupUserProcessAddressSpace
PspWow64InitThread