#ifndef _NTRTL_H

/**
 * The RtlDeNormalizeProcessParams routine converts the embedded pointers in a process parameters block from absolute addresses back to relative offsets.
 *
 * \param ProcessParameters A pointer to the process parameters block to de-normalize.
 * \return A pointer to the de-normalized process parameters block.
 */
NTSYSAPI
PRTL_USER_PROCESS_PARAMETERS
NTAPI
RtlDeNormalizeProcessParams(
    _Inout_ PRTL_USER_PROCESS_PARAMETERS ProcessParameters
    );

#endif
View code on GitHub