LdrImageDirectoryEntryToLoadConfig
NTSTATUS __stdcall LdrImageDirectoryEntryToLoadConfig(PVOID Base){
_DWORD *v2;
NTSTATUS v3;
UINT64 Size;
__int64 v6;
LODWORD(Size) = 0;
v6 = 0i64;
RtlImageNtHeaderEx(1, (unsigned __int64)Base, 0i64, &v6);
if( !Base )
return 0;
v2 = RtlImageDirectoryEntryToData(Base, 1u, 0xAu, &Size);
if( (unsigned __int64)Base < 0x7FFFFFFEFFFFi64 && ((unsigned __int64)(v2 + 1) > 0x7FFFFFFF0000i64 || v2 + 1 < v2) )
MEMORY[0x7FFFFFFF0000] = 0;
if( v2 && (_DWORD)Size && (_DWORD)Size == *v2 && RtlWow64GetEquivalentMachineCHPE(*(_WORD *)(v6 + 4)) == -31132 )
return v3;
else
return 0;
}Referenced by:
LdrpFetchAddressOfSecurityCookie
MiCaptureBootDriverRetpolineInfo
RtlGetImageBaseAndLoadConfig
RtlGuardCheckExceptionHandler
RtlGuardCheckLongJumpTarget
RtlIsImageFullyRetpolined
RtlpCaptureDynamicRelocationTableRva
RtlpCaptureRetpolineBinaryInfoForImage