RtlpImageDirectoryEntryToData32
NTSTATUS __stdcall RtlpImageDirectoryEntryToData32(
PVOID Base,
UINT8 MappedAsImage,
UINT16 DirectoryEntry,
UINT64 *Size,
IMAGE_NT_HEADERS *NtHeaders,
PVOID *RawDirectory){
__int64 v6;
UINT64 v7;
void *v8;
if( (unsigned int)DirectoryEntry >= HIDWORD(NtHeaders->OptionalHeader.SizeOfHeapReserve) )
return -1073741811;
v6 = DirectoryEntry;
v7 = *((unsigned int *)&NtHeaders->OptionalHeader.SizeOfHeapCommit + 2 * DirectoryEntry);
if( (_DWORD)v7 )
{
if( (unsigned __int64)Base < 0x7FFFFFFEFFFFi64 && (unsigned __int64)Base + v7 >= 0x7FFFFFFEFFFFi64 )
return -1073741811;
*(_DWORD *)Size = *((_DWORD *)&NtHeaders->OptionalHeader.SizeOfHeapCommit + 2 * v6 + 1);
if( MappedAsImage || (unsigned int)v7 < NtHeaders->OptionalHeader.SizeOfHeaders )
{
*RawDirectory = (char *)Base + v7;
}
else
{
LODWORD(v8) = RtlAddressInSectionTable(NtHeaders, Base, v7);
*RawDirectory = v8;
if( !v8 )
return -1073741811;
}
return 0;
}
return -1073741822;
}Referenced by:
RtlpImageDirectoryEntryToDataEx