RtlpImageDirectoryEntryToDataEx
NTSTATUS __stdcall RtlpImageDirectoryEntryToDataEx(
PVOID Base,
UINT8 MappedAsImage,
UINT16 DirectoryEntry,
UINT64 *Size,
PVOID *RawDirectory){
PVOID *v5;
UINT8 v8;
void *v9;
NTSTATUS result;
unsigned __int16 Magic;
INT64 v12;
PIMAGE_NT_HEADERS NtHeader;
v5 = RawDirectory;
NtHeader = 0i64;
v8 = MappedAsImage;
v9 = Base;
*RawDirectory = 0i64;
if( ((unsigned __int8)Base & 3) != 0 )
{
v8 = 0;
v9 = (void *)((unsigned __int64)Base & 0xFFFFFFFFFFFFFFFCui64);
if( ((unsigned __int8)Base & 1) == 0 )
v8 = MappedAsImage;
}
result = RtlImageNtHeaderEx(1ui64, v9, 0i64, &NtHeader);
if( NtHeader )
{
Magic = NtHeader->OptionalHeader.Magic;
if( Magic == 267 )
{
return RtlpImageDirectoryEntryToData32(v9, v8, DirectoryEntry, Size, NtHeader, v5);
}
else
{
v12 = 523i64;
if( Magic == 523 )
{
LOBYTE(v12) = v8;
return RtlpImageDirectoryEntryToData64(v9, v12, DirectoryEntry, Size, NtHeader, v5);
}
else
{
return -1073741811;
}
}
}
return result;
}Referenced by:
RtlImageDirectoryEntryToData