#pragma once

typedef struct _RTL_INVERTED_FUNCTION_TABLE_ENTRY_64 {
	PIMAGE_RUNTIME_FUNCTION_ENTRY ExceptionDirectory;
	PVOID ImageBase;
	ULONG ImageSize;
	ULONG ExceptionDirectorySize;
} RTL_INVERTED_FUNCTION_TABLE_ENTRY_64, * PRTL_INVERTED_FUNCTION_TABLE_ENTRY_64;
typedef struct _RTL_INVERTED_FUNCTION_TABLE_64 {
	ULONG Count;
	ULONG MaxCount;
	ULONG Epoch;
	ULONG Overflow;
	RTL_INVERTED_FUNCTION_TABLE_ENTRY_64 Entries[0x200];
} RTL_INVERTED_FUNCTION_TABLE_64, * PRTL_INVERTED_FUNCTION_TABLE_64;

//	The correct data structure should be this.
//
//typedef struct _RTL_INVERTED_FUNCTION_TABLE_ENTRY_WIN7_32 {
//  PVOID EntrySEHandlerTableEncoded;
//	PVOID ImageBase;
//	ULONG ImageSize;
//	ULONG SEHandlerCount;
//} RTL_INVERTED_FUNCTION_TABLE_ENTRY_WIN7_32, * PRTL_INVERTED_FUNCTION_TABLE_ENTRY_WIN7_32;
//typedef struct _RTL_INVERTED_FUNCTION_TABLE_WIN7_32 {
//	ULONG Count;
//	ULONG MaxCount;
//	ULONG Overflow;
//	RTL_INVERTED_FUNCTION_TABLE_ENTRY_WIN7_32 Entries[0x200];
//} RTL_INVERTED_FUNCTION_TABLE_WIN7_32, * PRTL_INVERTED_FUNCTION_TABLE_WIN7_32;
//
//
typedef struct _RTL_INVERTED_FUNCTION_TABLE_ENTRY_WIN7_32 {
	PVOID ImageBase;
	ULONG ImageSize;
	ULONG SEHandlerCount;
	PVOID NextEntrySEHandlerTableEncoded;
} RTL_INVERTED_FUNCTION_TABLE_ENTRY_WIN7_32, * PRTL_INVERTED_FUNCTION_TABLE_ENTRY_WIN7_32;
typedef struct _RTL_INVERTED_FUNCTION_TABLE_WIN7_32 {
	ULONG Count;
	ULONG MaxCount;
	ULONG Overflow;
	ULONG NextEntrySEHandlerTableEncoded;
	RTL_INVERTED_FUNCTION_TABLE_ENTRY_WIN7_32 Entries[0x200];
} RTL_INVERTED_FUNCTION_TABLE_WIN7_32, * PRTL_INVERTED_FUNCTION_TABLE_WIN7_32;

#ifdef _WIN64
typedef _RTL_INVERTED_FUNCTION_TABLE_ENTRY_64 _RTL_INVERTED_FUNCTION_TABLE_ENTRY, RTL_INVERTED_FUNCTION_TABLE_ENTRY, * PRTL_INVERTED_FUNCTION_TABLE_ENTRY;
typedef RTL_INVERTED_FUNCTION_TABLE_64 _RTL_INVERTED_FUNCTION_TABLE, RTL_INVERTED_FUNCTION_TABLE, * PRTL_INVERTED_FUNCTION_TABLE;
#else
typedef RTL_INVERTED_FUNCTION_TABLE_WIN7_32 _RTL_INVERTED_FUNCTION_TABLE, RTL_INVERTED_FUNCTION_TABLE, * PRTL_INVERTED_FUNCTION_TABLE;
typedef _RTL_INVERTED_FUNCTION_TABLE_ENTRY_WIN7_32 _RTL_INVERTED_FUNCTION_TABLE_ENTRY, RTL_INVERTED_FUNCTION_TABLE_ENTRY, * PRTL_INVERTED_FUNCTION_TABLE_ENTRY;
#endif

PVOID NTAPI RtlFindLdrpInvertedFunctionTable();

NTSTATUS NTAPI RtlInsertInvertedFunctionTable(IN PVOID BaseAddress, IN size_t ImageSize);
NTSTATUS NTAPI RtlRemoveInvertedFunctionTable(IN PVOID ImageBase);


#ifdef _WIN64
#define FindLdrpInvertedFunctionTable FindLdrpInvertedFunctionTable64
#else
#define FindLdrpInvertedFunctionTable FindLdrpInvertedFunctionTable32
#endif