RtlImageNtHeaderEx

NTSTATUS __stdcall RtlImageNtHeaderEx(UINT64 Flags, PVOID Base, UINT64 Size, IMAGE_NT_HEADERS **OutHeaders){
  NTSTATUS v4; 
  char v5; 
  UINT64 v6; 
  IMAGE_NT_HEADERS *v7; 
  if( !OutHeaders )
    return -1073741811;
  v4 = 0;
  *OutHeaders = 0i64;
  if( (Flags & 0xFFFFFFFE) != 0 || (char *)Base - 1 > (char *)0xFFFFFFFFFFFFFFFDi64 )
    return -1073741811;
  if( (Flags & 1) != 0 )
  {
    v5 = 0;
  }
  else
  {
    v5 = 1;
    if( Size < 0x40 )
      return -1073741701;
  }
  if( *(_WORD *)Base == 23117 )
  {
    v6 = *((unsigned int *)Base + 15);
    if( !v5 || v6 < Size && (unsigned int)v6 < 0xFFFFFFE7 && v6 + 24 < Size )
    {
      v7 = (IMAGE_NT_HEADERS *)((char *)Base + v6);
      if( (char *)Base + v6 >= Base
        && ((unsigned __int64)Base >= 0x7FFFFFFEFFFFi64
         || (unsigned __int64)v7 < 0x7FFFFFFEFFFFi64 && (unsigned __int64)&v7[1] < 0x7FFFFFFEFFFFi64)
        && v7->Signature == 17744 )
      {
        *OutHeaders = v7;
        return v4;
      }
    }
  }
  return -1073741701;
}

Referenced by: