#ifndef _NTLDR_H
#if (PHNT_MODE != PHNT_MODE_KERNEL)
// begin_msdn:"DLL Load Notification"

/**
 * Registers for notification when a DLL is first loaded. This notification occurs before dynamic linking takes place.
 *
 * \param Flags This parameter must be zero.
 * \param NotificationFunction A pointer to an LdrDllNotification notification callback function to call when the DLL is loaded.
 * \param Context A pointer to context data for the callback function.
 * \param Cookie A pointer to a variable to receive an identifier for the callback function. This identifier is used to unregister the notification callback function.
 * \return NTSTATUS Successful or errant status.
 * \remarks https://learn.microsoft.com/en-us/windows/win32/devnotes/ldrregisterdllnotification
 */
NTSYSAPI
NTSTATUS
NTAPI
LdrRegisterDllNotification(
    _In_ ULONG Flags,
    _In_ PLDR_DLL_NOTIFICATION_FUNCTION NotificationFunction,
    _In_opt_ PVOID Context,
    _Out_ PVOID *Cookie
    );

// end_msdn
#endif
#endif
View code on GitHub

NTSTATUS NTAPI LdrRegisterDllNotification(
  _In_     ULONG                          Flags,
  _In_     PLDR_DLL_NOTIFICATION_FUNCTION NotificationFunction,
  _In_opt_ PVOID                          Context,
  _Out_    PVOID                          *Cookie
);
View the official Win32 development documentation

NtDoc

This function is documented in Windows SDK.

Edit description on GitHub

Win32 development documentation (ldrregisterdllnotification)

LdrRegisterDllNotification function

[This function may be changed or removed from Windows without further notice.]

Registers for notification when a DLL is first loaded. This notification occurs before dynamic linking takes place.

Parameters

Flags [in]

This parameter must be zero.

NotificationFunction [in]

A pointer to an LdrDllNotification notification callback function to call when the DLL is loaded.

Context [in, optional]

A pointer to context data for the callback function.

Cookie [out]

A pointer to a variable to receive an identifier for the callback function. This identifier is used to unregister the notification callback function.

Return value

If the function succeeds, it returns STATUS_SUCCESS.

The forms and significance of NTSTATUS error codes are listed in the Ntstatus.h header file available in the WDK, and are described in the WDK documentation.

Remarks

This function has no associated header file. The associated import library, Ntdll.lib, is available in the WDK. You can also use the LoadLibrary and GetProcAddress functions to dynamically link to Ntdll.dll.

Requirements

Requirement	Value
Minimum supported client	Windows Vista [desktop apps only]
Minimum supported server	Windows Server 2008 [desktop apps only]
DLL	Ntdll.dll

LdrRegisterDllNotification - NtDoc