RtlPcToFileHeader - NtDoc

#ifndef _NTRTL_H
// begin_msdn:"Winternl"

/**
 * Retrieves the base address of the image that contains the specified PC value.
 *
 * @param PcValue The PC value. The function searches all modules mapped into the address space of the calling process for a module that contains this value.
 * @param BaseOfImage The base address of the image containing the PC value. This value must be added to any relative addresses in the headers to locate the image.
 * @return If the PC value is found, returns the base address of the image that contains the PC value. If no image contains the PC value, the function returns NULL.
 * @sa https://learn.microsoft.com/en-us/windows/win32/api/winnt/nf-winnt-rtlpctofileheader
 */
NTSYSAPI
PVOID
NTAPI
RtlPcToFileHeader(
    _In_ PVOID PcValue,
    _Out_ PVOID* BaseOfImage
    );

// end_msdn
#endif
View code on GitHub