RtlpImageDirectoryEntryToDataEx
VOID __fastcall RtlpImageDirectoryEntryToDataEx(
VOID *Base,
_BYTE *MappedAsImage,
INT64 a3,
INT64 a4,
UINT16 DirectoryEntry,
UINT64 *Size,
VOID **RawDirectory){
unsigned __int64 *v7;
unsigned __int16 v9;
char v10;
unsigned __int64 v11;
__int16 v12;
unsigned __int64 v13;
v7 = (unsigned __int64 *)DirectoryEntry;
v13 = 0i64;
v9 = a3;
v10 = (char)MappedAsImage;
v11 = (unsigned __int64)Base;
*(_QWORD *)DirectoryEntry = 0i64;
if( ((unsigned __int8)Base & 3) != 0 )
{
v10 = 0;
v11 = (unsigned __int64)Base & 0xFFFFFFFFFFFFFFFCui64;
if( ((unsigned __int8)Base & 1) == 0 )
v10 = (char)MappedAsImage;
}
RtlImageNtHeaderEx(1, v11, 0i64, &v13);
if( v13 )
{
v12 = *(_WORD *)(v13 + 24);
if( v12 == 267 )
{
RtlpImageDirectoryEntryToData32(v11, v10, v9, (_DWORD *)a4, v13, v7);
}
else if( v12 == 523 )
{
RtlpImageDirectoryEntryToData64(v11, v10, v9, (_DWORD *)a4, v13, v7);
}
}
}Referenced by:
RtlImageDirectoryEntryToData