Loader Initialisation

As well as being the kernel’s public face in user mode, NTDLL does much that might on its own be regarded as system work. In particular, it does much of the work of preparing user-mode executables for execution and eventually of tearing them down. Much of this is internal, even deeply so, but a handful of functions that are involved in the loader’s initialisation and ending of executable images are exported.

• LdrInitShimEngineDynamic
• LdrQueryImageFileExecutionOptions
• LdrShutdownProcess
• LdrShutdownThread
• RtlGetNtVersionNumbers
• RtlSetUnhandledExceptionFilter