#ifndef _NTRTL_H

/**
 * The RtlDecodePointer routine decodes a pointer that was previously encoded with RtlEncodePointer.
 *
 * \param Ptr The system pointer to be decoded.
 * \return The function returns the decoded pointer.
 * \sa https://learn.microsoft.com/en-us/previous-versions/bb432242(v=vs.85)
 * \remarks Transforms a pointer-sized value using the applicable process or shared-system cookie. Encode/decode must be paired in the same cookie domain. This neither validates nor owns the pointer and is not encryption for secrets.
 */
_Ret_maybenull_
NTSYSAPI
PVOID
NTAPI
RtlDecodePointer(
    _In_opt_ PVOID Ptr
    );

#endif
View code on GitHub