d35cb48d-2aca-4d7d-a194-f4566183bcd9

TmComm.sys :inline

Description

TmComm.sys is a vulnerable driver and more information will be added as found.

  • UUID: d35cb48d-2aca-4d7d-a194-f4566183bcd9
  • Created: 2023-05-06
  • Author: Nasreddine Bencherchali
  • Acknowledgement: |

Download

This download link contains the vulnerable driver!

Commands

sc.exe create TmComm.sys binPath=C:\windows\temp\TmComm.sys type=kernel && sc.exe start TmComm.sys
Use CasePrivilegesOperating System
Elevate privilegeskernelWindows 10

Detections

YARA 🏹

Expand

Exact Match

with header and size limitation

Threat Hunting

without header and size limitation

Renamed

for renamed driver files

Sigma 🛡️

Expand

Names

detects loading using name only

Hashes

detects loading using hashes only

Sysmon 🔎

Expand

Block

on hashes

Alert

on hashes

Resources


  • Internal Research

  • Known Vulnerable Samples

    PropertyValue
    FilenameTmComm.sys
    Creation Timestamp2017-10-16 04:19:20
    MD534686a4b10f239d781772e9e94486c1a
    SHA18a922499f7a1b978555b46c30f90de1339760c74
    SHA2560909005d625866ef8ccd8ae8af5745a469f4f70561b644d6e38b80bccb53eb06
    Authentihash MD5ebd5f8589975be817ecd3c281055d4a7
    Authentihash SHA1ebd74b4fecfb48c28cdf11f123e0364c9e9852ea
    Authentihash SHA25666539655171ddff02d8134241c58a53de3faa6467db7be14131e04b99ef33cee
    RichPEHeaderHash MD55b33b237bab6e0b50320054616983177
    RichPEHeaderHash SHA1754c63349a54279bb01f24974f9faf6da8294d27
    RichPEHeaderHash SHA256001d9e469d2c4160f8fbff1c0aee013e72881cffb568910a2c1473a17bf858b2
    CompanyTrend Micro Inc.
    DescriptionTrendMicro Common Module
    ProductTrend Micro Eyes
    OriginalFilenameTmComm.sys

    Download

    Certificates

    Expand
    Certificate 7e93ebfb7cc64e59ea4b9a77d406fc3b
    FieldValue
    ToBeSigned (TBS) MD5d0785ad36e427c92b19f6826ab1e8020
    ToBeSigned (TBS) SHA1365b7a9c21bd9373e49052c3e7b3e4646ddd4d43
    ToBeSigned (TBS) SHA256c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff
    SubjectC=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2
    ValidFrom2012-12-21 00:00:00
    ValidTo2020-12-30 23:59:59
    Signature03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber7e93ebfb7cc64e59ea4b9a77d406fc3b
    Version3
    Certificate 0ecff438c8febf356e04d86a981b1a50
    FieldValue
    ToBeSigned (TBS) MD5e9d38360b914c8863f6cba3ee58764d3
    ToBeSigned (TBS) SHA14cba8eae47b6bf76f20b3504b98b8f062694a89b
    ToBeSigned (TBS) SHA25688901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976
    SubjectC=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4
    ValidFrom2012-10-18 00:00:00
    ValidTo2020-12-29 23:59:59
    Signature783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber0ecff438c8febf356e04d86a981b1a50
    Version3
    Certificate 497c4fad471540e6e453d0cafb155740
    FieldValue
    ToBeSigned (TBS) MD578eaa337666217b1c16a9a0ebd0b8434
    ToBeSigned (TBS) SHA1ff9cb835e78f6185eed4372096c3bae53b17d18d
    ToBeSigned (TBS) SHA2561c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250
    SubjectC=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.
    ValidFrom2017-04-27 00:00:00
    ValidTo2018-07-16 23:59:59
    Signaturef3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber497c4fad471540e6e453d0cafb155740
    Version3
    Certificate 611993e400000000001c
    FieldValue
    ToBeSigned (TBS) MD578a717e082dcc1cda3458d917e677d14
    ToBeSigned (TBS) SHA14a872e0e51f9b304469cd1dedb496ee9b8b983a4
    ToBeSigned (TBS) SHA256317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
    ValidFrom2011-02-22 19:25:17
    ValidTo2021-02-22 19:35:17
    Signature812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber611993e400000000001c
    Version3
    Certificate 5200e5aa2556fc1a86ed96c9d44b33c7
    FieldValue
    ToBeSigned (TBS) MD5b30c31a572b0409383ed3fbe17e56e81
    ToBeSigned (TBS) SHA14843a82ed3b1f2bfbee9671960e1940c942f688d
    ToBeSigned (TBS) SHA25603cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
    ValidFrom2010-02-08 00:00:00
    ValidTo2020-02-07 23:59:59
    Signature5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber5200e5aa2556fc1a86ed96c9d44b33c7
    Version3

    Imports

    Expand
    • ntoskrnl.exe
    • HAL.dll
    • CLASSPNP.SYS

    Imported Functions

    Expand
    • wcsrchr
    • KeSetEvent
    • KePulseEvent
    • KeClearEvent
    • KeStackAttachProcess
    • KeUnstackDetachProcess
    • ObfDereferenceObject
    • ZwSetEvent
    • ZwClose
    • ZwConnectPort
    • RtlInitUnicodeString
    • RtlUnicodeStringToInteger
    • ZwCreateSection
    • ZwWaitForSingleObject
    • ZwOpenEvent
    • IoGetCurrentProcess
    • ObfReferenceObject
    • DbgBreakPoint
    • ZwRequestWaitReplyPort
    • ExFreePoolWithTag
    • ProbeForWrite
    • ZwFreeVirtualMemory
    • ZwAllocateVirtualMemory
    • ObOpenObjectByPointer
    • PsProcessType
    • memmove
    • PsGetProcessExitTime
    • MmSectionObjectType
    • PsThreadType
    • ObReleaseObjectSecurity
    • SeReleaseSubjectContext
    • SeAccessCheck
    • SeCaptureSubjectContext
    • ObGetObjectSecurity
    • DbgPrint
    • memset
    • MmIsAddressValid
    • ExInitializeResourceLite
    • ExDeleteResourceLite
    • ZwWriteFile
    • ZwReadFile
    • ZwQueryInformationFile
    • ZwSetInformationFile
    • ZwCreateFile
    • swprintf
    • towupper
    • _wcsnicmp
    • ExAllocatePoolWithTag
    • KeInitializeEvent
    • _snprintf
    • PsGetCurrentProcessId
    • RtlTimeToTimeFields
    • ExSystemTimeToLocalTime
    • KeQuerySystemTime
    • PsGetCurrentThreadId
    • RtlInitAnsiString
    • ZwDeviceIoControlFile
    • ZwCreateKey
    • ZwCreateEvent
    • KeWaitForMultipleObjects
    • ObReferenceObjectByHandle
    • ZwNotifyChangeKey
    • _vsnprintf
    • RtlFreeUnicodeString
    • RtlAnsiStringToUnicodeString
    • RtlEqualUnicodeString
    • RtlAppendUnicodeStringToString
    • RtlCopyUnicodeString
    • RtlUpcaseUnicodeChar
    • ExGetPreviousMode
    • KeWaitForSingleObject
    • KeSetPriorityThread
    • PsTerminateSystemThread
    • PsCreateSystemThread
    • KeDelayExecutionThread
    • KeNumberProcessors
    • ZwQueryInformationProcess
    • PsLookupProcessByProcessId
    • ZwOpenDirectoryObject
    • PsSetCreateProcessNotifyRoutine
    • ZwQuerySystemInformation
    • ZwQueryDirectoryFile
    • ZwQueryDirectoryObject
    • ZwOpenKey
    • ZwEnumerateKey
    • ZwEnumerateValueKey
    • ZwQueryValueKey
    • ZwDeleteValueKey
    • ZwDeleteKey
    • ZwTerminateProcess
    • ZwOpenProcess
    • ZwQueryKey
    • ZwSetValueKey
    • IoFileObjectType
    • _allrem
    • ZwQuerySecurityObject
    • memcpy
    • RtlLengthSecurityDescriptor
    • MmHighestUserAddress
    • IoFreeIrp
    • IoFreeMdl
    • _purecall
    • IoBuildAsynchronousFsdRequest
    • _strnicmp
    • RtlQueryRegistryValues
    • RtlAppendUnicodeToString
    • mbstowcs
    • ZwQuerySymbolicLinkObject
    • ZwOpenSymbolicLinkObject
    • NtClose
    • ObQueryNameString
    • MmGetSystemRoutineAddress
    • ZwSetInformationObject
    • _stricmp
    • ZwUnmapViewOfSection
    • ZwMapViewOfSection
    • ZwOpenFile
    • IoCreateFile
    • IofCallDriver
    • IoAllocateIrp
    • MmBuildMdlForNonPagedPool
    • IoAllocateMdl
    • ProbeForRead
    • PsGetVersion
    • RtlImageNtHeader
    • RtlCompareMemory
    • RtlUpcaseUnicodeString
    • _snwprintf
    • MmSystemRangeStart
    • wcsncmp
    • strrchr
    • ZwQueryVolumeInformationFile
    • ObReferenceObjectByPointer
    • IoBuildDeviceIoControlRequest
    • ZwOpenSection
    • _allmul
    • KeReleaseSemaphore
    • RtlLengthRequiredSid
    • RtlInitializeSid
    • RtlSubAuthoritySid
    • RtlSetDaclSecurityDescriptor
    • RtlCreateSecurityDescriptor
    • RtlAddAccessAllowedAce
    • RtlCreateAcl
    • KeInitializeSemaphore
    • IofCompleteRequest
    • ExEventObjectType
    • IoDeleteDevice
    • IoDeleteSymbolicLink
    • IoCreateSymbolicLink
    • IoGetDeviceObjectPointer
    • RtlUpperChar
    • ObReferenceObjectByName
    • IoDriverObjectType
    • RtlCompareUnicodeString
    • strncpy
    • KeServiceDescriptorTable
    • NtOpenProcess
    • ObOpenObjectByName
    • NtQueryInformationProcess
    • PsIsThreadTerminating
    • KeAddSystemServiceTable
    • ZwFsControlFile
    • ObInsertObject
    • IoReleaseVpbSpinLock
    • IoAcquireVpbSpinLock
    • SeCreateAccessState
    • IoGetFileObjectGenericMapping
    • ObCreateObject
    • _allshr
    • ExInterlockedPopEntrySList
    • IoGetStackLimits
    • IoBuildSynchronousFsdRequest
    • wcsstr
    • IoUnregisterPlugPlayNotification
    • FsRtlIsNameInExpression
    • IoGetConfigurationInformation
    • MmProbeAndLockPages
    • IoGetDeviceInterfaces
    • IoRegisterPlugPlayNotification
    • ExAllocatePool
    • RtlFreeAnsiString
    • RtlUnicodeStringToAnsiString
    • strncat
    • wcschr
    • wcsncat
    • wcstombs
    • KeTickCount
    • KeBugCheckEx
    • RtlUnwind
    • wcsncpy
    • ExReleaseResourceLite
    • ExAcquireResourceExclusiveLite
    • ExAcquireResourceSharedLite
    • ExReleaseFastMutexUnsafe
    • KeLeaveCriticalRegion
    • KeEnterCriticalRegion
    • ZwSetSecurityObject
    • ExAcquireFastMutexUnsafe
    • IoDeviceObjectType
    • IoCreateDevice
    • RtlGetDaclSecurityDescriptor
    • RtlGetSaclSecurityDescriptor
    • RtlGetGroupSecurityDescriptor
    • RtlGetOwnerSecurityDescriptor
    • SeCaptureSecurityDescriptor
    • SeExports
    • IoIsWdmVersionAvailable
    • RtlLengthSid
    • RtlAbsoluteToSelfRelativeSD
    • MmUnlockPages
    • KeGetCurrentThread
    • KfAcquireSpinLock
    • KfReleaseSpinLock
    • KeRaiseIrqlToDpcLevel
    • KfLowerIrql
    • ExAcquireFastMutex
    • ExReleaseFastMutex
    • KeGetCurrentIrql
    • KfRaiseIrql
    • ClassInitialize

    Exported Functions

    Expand
    • ??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
    • ??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
    • ??0CBlobConfig@@QAE@ABV0@@Z
    • ??0CBlobConfig@@QAE@K@Z
    • ??0CContext@@QAE@ABV0@@Z
    • ??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
    • ??0CContextList@@QAE@ABV0@@Z
    • ??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CDebugLog@@QAE@ABV0@@Z
    • ??0CDebugLog@@QAE@PBG@Z
    • ??0CDebugLogEx@@QAE@ABV0@@Z
    • ??0CDebugLogEx@@QAE@K@Z
    • ??0CDelayLoadThread@@QAE@ABV0@@Z
    • ??0CDelayLoadThread@@QAE@XZ
    • ??0CExclusionExtConfig@@QAE@ABV0@@Z
    • ??0CExclusionExtConfig@@QAE@KKE@Z
    • ??0CExclusionFileNameConfig@@QAE@ABV0@@Z
    • ??0CExclusionFileNameConfig@@QAE@KK@Z
    • ??0CExclusionFilePathConfig@@QAE@ABV0@@Z
    • ??0CExclusionFilePathConfig@@QAE@KK@Z
    • ??0CExclusionFolderConfig@@QAE@ABV0@@Z
    • ??0CExclusionFolderConfig@@QAE@KK@Z
    • ??0CExclusionRegistryConfig@@QAE@ABV0@@Z
    • ??0CExclusionRegistryConfig@@QAE@KK@Z
    • ??0CFile@@QAE@ABV0@@Z
    • ??0CFile@@QAE@E@Z
    • ??0CFileExtension@@QAE@ABV0@@Z
    • ??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
    • ??0CInclusionExtConfig@@QAE@ABV0@@Z
    • ??0CInclusionExtConfig@@QAE@KKE@Z
    • ??0CInclusionFileNameConfig@@QAE@ABV0@@Z
    • ??0CInclusionFileNameConfig@@QAE@KK@Z
    • ??0CInclusionFilePathConfig@@QAE@ABV0@@Z
    • ??0CInclusionFilePathConfig@@QAE@KK@Z
    • ??0CInclusionFolderConfig@@QAE@ABV0@@Z
    • ??0CInclusionFolderConfig@@QAE@KK@Z
    • ??0CKEvent@@QAE@ABV0@@Z
    • ??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
    • ??0CList@@QAE@ABV0@@Z
    • ??0CList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CLockEvent@@QAE@ABV0@@Z
    • ??0CLockEvent@@QAE@XZ
    • ??0CLockList@@QAE@ABV0@@Z
    • ??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
    • ??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
    • ??0CMemoryAllocator@@QAE@ABV0@@Z
    • ??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
    • ??0CMemoryPoolAllocator@@QAE@ABV0@@Z
    • ??0CModuleConfig@@QAE@ABV0@@Z
    • ??0CModuleConfig@@QAE@XZ
    • ??0CModuleConfigList@@QAE@ABV0@@Z
    • ??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CModuleFileExtConfig@@QAE@ABV0@@Z
    • ??0CModuleFileExtConfig@@QAE@KKE@Z
    • ??0CModuleFlagConfig@@QAE@ABV0@@Z
    • ??0CModuleFlagConfig@@QAE@K@Z
    • ??0CModuleMultiStringConfig@@QAE@ABV0@@Z
    • ??0CModuleMultiStringConfig@@QAE@KK@Z
    • ??0CModuleStringConfig@@QAE@ABV0@@Z
    • ??0CModuleStringConfig@@QAE@K@Z
    • ??0CNoLockList@@QAE@ABV0@@Z
    • ??0CNoLockList@@QAE@KKPAVIMemoryAllocator@@@Z
    • ??0CSmartLock@@QAE@AAVCLockEvent@@@Z
    • ??0CSmartLock@@QAE@XZ
    • ??0CSmartReference@@QAE@AAJ@Z
    • ??0CSmartReference@@QAE@AAK@Z
    • ??0CSmartResource@@QAE@AAVCResource@@E@Z
    • ??0CStrList@@QAE@ABV0@@Z
    • ??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CSystemThread@@QAE@ABV0@@Z
    • ??0CSystemThread@@QAE@K@Z
    • ??0CUserFuncAdapterJob@@QAE@ABV0@@Z
    • ??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z01@Z
    • ??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
    • ??0CWorkerThread@@QAE@ABV0@@Z
    • ??0CWorkerThreadJob@@QAE@ABV0@@Z
    • ??0CWorkerThreadJob@@QAE@E@Z
    • ??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
    • ??0CWorkerThreadJobQueue@@QAE@K@Z
    • ??0CWorkerThreadPool@@QAE@ABV0@@Z
    • ??0CWorkerThreadPool@@QAE@K@Z
    • ??0CWorkerThreadPoolEx@@QAE@ABV0@@Z
    • ??0CWorkerThreadPoolEx@@QAE@KK@Z
    • ??0IMemoryAllocator@@QAE@ABV0@@Z
    • ??0IMemoryAllocator@@QAE@XZ
    • ??1CAutoUpdateConfigThread@@UAE@XZ
    • ??1CBlobConfig@@UAE@XZ
    • ??1CContext@@UAE@XZ
    • ??1CContextList@@UAE@XZ
    • ??1CDebugLog@@UAE@XZ
    • ??1CDebugLogEx@@UAE@XZ
    • ??1CDelayLoadThread@@UAE@XZ
    • ??1CExclusionExtConfig@@UAE@XZ
    • ??1CExclusionFileNameConfig@@UAE@XZ
    • ??1CExclusionFilePathConfig@@UAE@XZ
    • ??1CExclusionFolderConfig@@UAE@XZ
    • ??1CExclusionRegistryConfig@@UAE@XZ
    • ??1CFile@@UAE@XZ
    • ??1CFileExtension@@UAE@XZ
    • ??1CInclusionExtConfig@@UAE@XZ
    • ??1CInclusionFileNameConfig@@UAE@XZ
    • ??1CInclusionFilePathConfig@@UAE@XZ
    • ??1CInclusionFolderConfig@@UAE@XZ
    • ??1CKEvent@@UAE@XZ
    • ??1CList@@UAE@XZ
    • ??1CLockEvent@@UAE@XZ
    • ??1CLockList@@UAE@XZ
    • ??1CMemoryAllocator@@UAE@XZ
    • ??1CMemoryPoolAllocator@@UAE@XZ
    • ??1CModuleConfig@@UAE@XZ
    • ??1CModuleConfigList@@UAE@XZ
    • ??1CModuleFileExtConfig@@UAE@XZ
    • ??1CModuleFlagConfig@@UAE@XZ
    • ??1CModuleMultiStringConfig@@UAE@XZ
    • ??1CModuleStringConfig@@UAE@XZ
    • ??1CNoLockList@@UAE@XZ
    • ??1CSmartLock@@QAE@XZ
    • ??1CSmartReference@@QAE@XZ
    • ??1CSmartResource@@QAE@XZ
    • ??1CStrList@@UAE@XZ
    • ??1CSystemThread@@UAE@XZ
    • ??1CUserFuncAdapterJob@@UAE@XZ
    • ??1CWorkerThread@@UAE@XZ
    • ??1CWorkerThreadJob@@UAE@XZ
    • ??1CWorkerThreadJobQueue@@UAE@XZ
    • ??1CWorkerThreadPool@@UAE@XZ
    • ??1CWorkerThreadPoolEx@@UAE@XZ
    • ??1IMemoryAllocator@@UAE@XZ
    • ??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
    • ??2CMemoryAllocator@@SGPAXI@Z
    • ??2CMemoryPoolAllocator@@SGPAXI@Z
    • ??3@YAXPAX@Z
    • ??3IMemoryAllocator@@SGXPAX@Z
    • ??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
    • ??4CBlobConfig@@QAEAAV0@ABV0@@Z
    • ??4CContext@@QAEAAV0@ABV0@@Z
    • ??4CDebugLog@@QAEAAV0@ABV0@@Z
    • ??4CDebugLogEx@@QAEAAV0@ABV0@@Z
    • ??4CDelayLoadThread@@QAEAAV0@ABV0@@Z
    • ??4CFile@@QAEAAV0@ABV0@@Z
    • ??4CKEvent@@QAEAAV0@ABV0@@Z
    • ??4CLockEvent@@QAEAAV0@ABV0@@Z
    • ??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
    • ??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
    • ??4CModuleConfig@@QAEAAV0@ABV0@@Z
    • ??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
    • ??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
    • ??4CSmartLock@@QAEAAV0@ABV0@@Z
    • ??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
    • ??4CSmartResource@@QAEAAV0@ABV0@@Z
    • ??4CSystemThread@@QAEAAV0@ABV0@@Z
    • ??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
    • ??4CWorkerThread@@QAEAAV0@ABV0@@Z
    • ??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
    • ??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
    • ??_7CAutoUpdateConfigThread@@6B@
    • ??_7CBlobConfig@@6B@
    • ??_7CContext@@6B@
    • ??_7CContextList@@6B@
    • ??_7CDebugLog@@6B@
    • ??_7CDebugLogEx@@6B@
    • ??_7CDelayLoadThread@@6B@
    • ??_7CExclusionExtConfig@@6B@
    • ??_7CExclusionFileNameConfig@@6B@
    • ??_7CExclusionFilePathConfig@@6B@
    • ??_7CExclusionFolderConfig@@6B@
    • ??_7CExclusionRegistryConfig@@6B@
    • ??_7CFile@@6B@
    • ??_7CFileExtension@@6B@
    • ??_7CInclusionExtConfig@@6B@
    • ??_7CInclusionFileNameConfig@@6B@
    • ??_7CInclusionFilePathConfig@@6B@
    • ??_7CInclusionFolderConfig@@6B@
    • ??_7CKEvent@@6B@
    • ??_7CList@@6B@
    • ??_7CLockEvent@@6B@
    • ??_7CLockList@@6B@
    • ??_7CMemoryAllocator@@6B@
    • ??_7CMemoryPoolAllocator@@6B@
    • ??_7CModuleConfig@@6B@
    • ??_7CModuleConfigList@@6B@
    • ??_7CModuleFileExtConfig@@6B@
    • ??_7CModuleFlagConfig@@6B@
    • ??_7CModuleMultiStringConfig@@6B@
    • ??_7CModuleStringConfig@@6B@
    • ??_7CNoLockList@@6B@
    • ??_7CStrList@@6B@
    • ??_7CSystemThread@@6B@
    • ??_7CUserFuncAdapterJob@@6B@
    • ??_7CWorkerThread@@6B@
    • ??_7CWorkerThreadJob@@6B@
    • ??_7CWorkerThreadJobQueue@@6B@
    • ??_7CWorkerThreadPool@@6B@
    • ??_7CWorkerThreadPoolEx@@6B@
    • ??_7IMemoryAllocator@@6B@
    • ??_FCContextList@@QAEXXZ
    • ??_FCFile@@QAEXXZ
    • ??_FCFileExtension@@QAEXXZ
    • ??_FCModuleConfigList@@QAEXXZ
    • ??_FCStrList@@QAEXXZ
    • ??_FCSystemThread@@QAEXXZ
    • ??_FCWorkerThread@@QAEXXZ
    • ??_FCWorkerThreadJob@@QAEXXZ
    • ??_FCWorkerThreadJobQueue@@QAEXXZ
    • ??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
    • ??_V@YAXPAX@Z
    • ?Acquire@CLockEvent@@QAEXXZ
    • ?Add@CContextList@@QAEEPAVCContext@@@Z
    • ?Add@CFileExtension@@QAEEPBGK@Z
    • ?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
    • ?Add@CStrList@@QAEEPBG@Z
    • ?AddNode@CLockList@@UAEEQAXE@Z
    • ?AddNode@CNoLockList@@UAEEQAXE@Z
    • ?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
    • ?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
    • ?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
    • ?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
    • ?Cancel@CWorkerThreadJob@@QAEXXZ
    • ?CheckNode@CLockList@@UAEHQAX@Z
    • ?CheckNode@CNoLockList@@UAEHQAX@Z
    • ?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
    • ?Cleanup@CBlobConfig@@AAEXXZ
    • ?Cleanup@CModuleFileExtConfig@@IAEXXZ
    • ?Cleanup@CModuleMultiStringConfig@@IAEXXZ
    • ?Cleanup@CModuleStringConfig@@AAEXXZ
    • ?Close@CFile@@QAEJXZ
    • ?Count@CLockList@@QAEKXZ
    • ?Count@CNoLockList@@QAEKXZ
    • ?Create@CFile@@QAEJPBGKKKK@Z
    • ?Create@CSystemThread@@QAEEXZ
    • ?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
    • ?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
    • ?CreatePool@CWorkerThreadPool@@QAEEXZ
    • ?CreatePool@CWorkerThreadPoolEx@@QAEEXZ
    • ?CreateThreads@CWorkerThreadPool@@QAEEK@Z
    • ?CreateThreads@CWorkerThreadPoolEx@@QAEEK@Z
    • ?CreateWIRP@CFile@@QAEJPBGKKKK@Z
    • ?Delete@CFile@@QAEJXZ
    • ?Delete@CFileExtension@@QAEEPBGK@Z
    • ?Delete@CStrList@@QAEEPBG@Z
    • ?DeleteAll@CList@@UAEXXZ
    • ?DeleteAll@CLockList@@UAEXXZ
    • ?DeleteAll@CNoLockList@@UAEXXZ
    • ?DeleteNode@CContextList@@MAEXPAX@Z
    • ?DeleteNode@CList@@UAEXPAX@Z
    • ?DeleteNode@CModuleConfigList@@MAEXPAX@Z
    • ?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
    • ?DisableWriteProtectFromCR0@@YGXPAPAX@Z
    • ?DoIt@CWorkerThreadJob@@QAEJXZ
    • ?EntryPoint@CSystemThread@@KGXPAX@Z
    • ?Find@CContextList@@QAEPAVCContext@@K@Z
    • ?Find@CContextList@@QAEPAVCContext@@PAX@Z
    • ?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
    • ?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
    • ?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
    • ?FindNode@CContextList@@IAEPAXPAX@Z
    • ?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
    • ?FinishFunction@CUserFuncAdapterJob@@MAEXXZ
    • ?FinishIt@CWorkerThreadJob@@QAEJXZ
    • ?First@CList@@UAEPAXXZ
    • ?First@CLockList@@UAEPAXXZ
    • ?First@CNoLockList@@UAEPAXXZ
    • ?Free@CMemoryAllocator@@UAEXPAX@Z
    • ?Free@CMemoryPoolAllocator@@UAEXPAX@Z
    • ?GetAttributes@CFile@@QAEKXZ
    • ?GetBasicInfomration@CFile@@IAEJXZ
    • ?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
    • ?GetCategory@CContext@@QAEKXZ
    • ?GetData@CBlobConfig@@QAEHPAXPAK@Z
    • ?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
    • ?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
    • ?GetData@CModuleFlagConfig@@QAEKXZ
    • ?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
    • ?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
    • ?GetData@CModuleStringConfig@@QAEPAGXZ
    • ?GetData@CStrList@@QAEEPAGPAK@Z
    • ?GetDataType@CModuleConfig@@QAEKXZ
    • ?GetEngineContext@CContext@@QAEPAXXZ
    • ?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
    • ?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
    • ?GetFileSizeWIRP@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
    • ?GetFlagConfig@CContext@@UAEJKPAK@Z
    • ?GetID@CModuleConfig@@QAEKXZ
    • ?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
    • ?GetLength@CModuleStringConfig@@QAEKXZ
    • ?GetLinkContext@CContext@@QAEPAXXZ
    • ?GetLogFlag@CDebugLog@@QAEKXZ
    • ?GetLogFlag@CDebugLogEx@@QAEKXZ
    • ?GetModuleId@CModuleConfig@@QAEKXZ
    • ?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
    • ?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_KTHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_ETHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_KTHREAD@@XZ
    • ?GetReportCallBackRoutine@CContext@@QAEKXZ
    • ?GetSize@CBlobConfig@@QAEKXZ
    • ?GetStringConfig@CContext@@QAEPAGK@Z
    • ?GetStringConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetThreadCount@CWorkerThreadPool@@QAEKXZ
    • ?GetThreadCount@CWorkerThreadPoolEx@@QAEKXZ
    • ?GetThreadID@CSystemThread@@QAEKXZ
    • ?GetType@CContext@@QAEKXZ
    • ?GetUserParameter@CContext@@QAEKXZ
    • ?InitProcMon@CDebugLogEx@@IAEXXZ
    • ?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
    • ?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
    • ?InitializeFlagConfig@CContext@@QAEHKK@Z
    • ?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
    • ?InitializeStringConfig@CContext@@QAEHKPBG@Z
    • ?Insert@CList@@UAEXQAXE@Z
    • ?Insert@CLockList@@UAEXQAXE@Z
    • ?Insert@CNoLockList@@UAEXQAXE@Z
    • ?InsertAfter@CList@@UAEXPAX0@Z
    • ?InsertBefore@CList@@UAEXPAX0@Z
    • ?Instance@CWorkerThreadPool@@SGPAV1@XZ
    • ?IsEmpty@CList@@UAEEXZ
    • ?IsEmpty@CLockList@@UAEEXZ
    • ?IsEmpty@CNoLockList@@UAEEXZ
    • ?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
    • ?IsFull@CLockList@@QBEEXZ
    • ?IsFull@CNoLockList@@QBEEXZ
    • ?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionExtConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFileNameConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFilePathConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFolderConfig@@QAEEPBG@Z
    • ?IsOpened@CFile@@QAEEXZ
    • ?IsTerminated@CWorkerThreadPool@@QAEEXZ
    • ?IsTerminated@CWorkerThreadPoolEx@@QAEEXZ
    • ?IsValid@CMemoryAllocator@@UAEEXZ
    • ?IsValid@CMemoryPoolAllocator@@UAEEXZ
    • ?IsValid@IMemoryAllocator@@UAEEXZ
    • ?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
    • ?IsWorkerThread@CWorkerThreadPoolEx@@QAEEK@Z
    • ?JobFunction@CUserFuncAdapterJob@@MAEXXZ
    • ?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
    • ?JobQueue@CWorkerThreadPoolEx@@QAEAAVCWorkerThreadJobQueue@@XZ
    • ?Limit@CLockList@@QAEKXZ
    • ?Limit@CNoLockList@@QAEKXZ
    • ?MatchAllExtensions@CFileExtension@@QAEEXZ
    • ?MatchNoExtensions@CFileExtension@@QAEEXZ
    • ?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
    • ?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
    • ?NeedDelete@CWorkerThreadJob@@QAEEXZ
    • ?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
    • ?NewNode@CList@@UAEPAXXZ
    • ?NewNode@CStrList@@EAEPAXXZ
    • ?NewNodeVariant@CList@@IAEPAXK@Z
    • ?Next@CList@@UBEPAXQAX@Z
    • ?Next@CLockList@@UBEPAXQAX@Z
    • ?Next@CNoLockList@@UBEPAXQAX@Z
    • ?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
    • ?NotityTerminate@CWorkerThread@@QAEXXZ
    • ?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
    • ?PostJobToWorkerThread@CWorkerThreadPoolEx@@QAEJP6GXPAX@Z0E1@Z
    • ?Pulse@CKEvent@@QAEJJE@Z
    • ?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
    • ?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
    • ?QueueJobItem@CWorkerThreadPoolEx@@QAEJPAVCWorkerThreadJob@@@Z
    • ?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
    • ?Read@CFile@@QAEJPADKPAK@Z
    • ?ReadWIRP@CFile@@QAEJPADKPAK@Z
    • ?ReferenceCount@CContext@@QAEAAKXZ
    • ?Release@CLockEvent@@QAEXXZ
    • ?Remove@CContextList@@UAEEQAX@Z
    • ?Remove@CList@@UAEEQAX@Z
    • ?Remove@CLockList@@UAEEQAX@Z
    • ?Remove@CNoLockList@@UAEEQAX@Z
    • ?RemoveHead@CList@@UAEPAXXZ
    • ?RemoveHead@CLockList@@UAEPAXXZ
    • ?RemoveHead@CNoLockList@@UAEPAXXZ
    • ?RemoveTail@CList@@UAEPAXXZ
    • ?RemoveTail@CLockList@@UAEPAXXZ
    • ?RemoveTail@CNoLockList@@UAEPAXXZ
    • ?Reset@CKEvent@@QAEXXZ
    • ?ResetData@CInclusionExtConfig@@QAEXXZ
    • ?ResetData@CInclusionFileNameConfig@@QAEXXZ
    • ?ResetData@CInclusionFilePathConfig@@QAEXXZ
    • ?ResetData@CInclusionFolderConfig@@QAEXXZ
    • ?RestoreCR0@@YGXPAX@Z
    • ?Run@CAutoUpdateConfigThread@@UAEXXZ
    • ?Run@CDelayLoadThread@@UAEXXZ
    • ?Run@CWorkerThread@@UAEXXZ
    • ?SeekToEnd@CFile@@QAEJXZ
    • ?Set@CKEvent@@QAEJJE@Z
    • ?SetAttributes@CFile@@QAEJK@Z
    • ?SetBlobCofig@CContext@@UAEJKPAXK@Z
    • ?SetData@CBlobConfig@@QAEHPAXK@Z
    • ?SetData@CModuleFileExtConfig@@QAEHPBG@Z
    • ?SetData@CModuleFlagConfig@@QAEHK@Z
    • ?SetData@CModuleMultiStringConfig@@QAEHPBGK@Z
    • ?SetData@CModuleStringConfig@@QAEHPBG@Z
    • ?SetEngineContext@CContext@@QAEXPAX@Z
    • ?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
    • ?SetFlagConfig@CContext@@UAEJKK@Z
    • ?SetLinkContext@CContext@@QAEXPAX@Z
    • ?SetLogFlag@CDebugLog@@QAEEK@Z
    • ?SetLogFlag@CDebugLogEx@@QAEEK@Z
    • ?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
    • ?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
    • ?SetMultiStringConfig@CContext@@UAEJKPBG@Z
    • ?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
    • ?SetPriority@CSystemThread@@QAEXK@Z
    • ?SetStopUse@CContext@@QAEXXZ
    • ?SetStringConfig@CContext@@UAEJKPBG@Z
    • ?Setup@CSystemThread@@MAEXXZ
    • ?StopUse@CContext@@QAEHXZ
    • ?TearDown@CSystemThread@@MAEXXZ
    • ?Terminate@CSystemThread@@QAEXE@Z
    • ?Terminate@CWorkerThreadPool@@QAEEXZ
    • ?Terminate@CWorkerThreadPoolEx@@QAEEXZ
    • ?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
    • ?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
    • ?WaitFinish@CWorkerThreadJob@@QAEXXZ
    • ?WaitForInit@CDelayLoadThread@@QAEEXZ
    • ?WaitForLoad@CDelayLoadThread@@QAEEXZ
    • ?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
    • ?WaitQueueEmpty@CWorkerThreadJobQueue@@QAEXXZ
    • ?Write@CDebugLog@@QAAXPBDZZ
    • ?Write@CDebugLogEx@@QAAXPBDZZ
    • ?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
    • ?WriteDataToFile@CDebugLogEx@@IAEXPADK@Z
    • ?WriteDataToProcMonW@CDebugLogEx@@IAEXPAD@Z
    • ?WriteSystemInformation@CDebugLog@@QAEXXZ
    • ?WriteSystemInformation@CDebugLogEx@@QAEXXZ
    • ?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
    • ?WriteSystemStringInformation@CDebugLogEx@@IAEXPBG@Z
    • ?WriteToFile@CDebugLog@@IAEXPADK@Z
    • ?WriteToProcMonW@CDebugLogEx@@IAEXPAU_UNICODE_STRING@@@Z
    • ?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
    • ?_pPagedAllocator@@3PAVCMemoryAllocator@@A
    • ?m_lpInstance@CWorkerThreadPool@@1PAV1@A
    • ?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
    • _DeInitKm2UmCommunication@0
    • _DeInitKmLPC@0
    • _DuplicateFullFileName@4
    • _FreeFullFileName@4
    • _GetKm2UmMode@0
    • _GetModuleInfoByAddress@8
    • _GetModuleInfoByModuleName@8
    • _InitKm2UmCommunication@8
    • _InitKmLPC@0
    • _IsVerifierCodeCheckFlagOn@0
    • _IsWindows8_1_update@4
    • _KmCallUm@8
    • _KmCallUmByLPC@8
    • _KmCallUmEx@12
    • _KmCleanupCommPortAPIs@0
    • _KmGetUmInitProcess@0
    • _KmSetCommPortAPIs@4
    • _ModGetExportProcAddress@8
    • _ModLoadDLLToBuffer@4
    • _ModLoadDLLToBufferWithImageSize@8
    • _ModLoadModule@8
    • _ModUnLoadModule@4
    • _NormalizeFileName@4
    • _NormalizeFullNtPathToDosName@4
    • _TmCommConfigRoutine@4
    • _UtilAddDeviceInDriveTable@4
    • _UtilAddReparsePointMapping@8
    • _UtilCleanFileReadOnly@4
    • _UtilCloseExclusiveHandle@12
    • _UtilCreateDosFileName@8
    • _UtilDeleteFileForce@4
    • _UtilGetDeviceObjectName@8
    • _UtilGetFileNameFromFileObject@4
    • _UtilGetFileObjectForProcessByEPROC@8
    • _UtilGetFileObjectFromFileName@12
    • _UtilGetProcessName@12
    • _UtilGetSystemDirectory@4
    • _UtilGetSystemDirectoryEx@0
    • _UtilGetSystemDirectoryLength@0
    • _UtilGetSystemTime@4
    • _UtilIoSetFileInfo@24
    • _UtilIopCreateFileIRP@40
    • _UtilKeGetLowFileDevice@16
    • _UtilModuleIATHook@24
    • _UtilModuleIATUnHook@8
    • _UtilPostJobToWorkerThread@12
    • _UtilQueryExclusiveHandle@12
    • _UtilQueryKeyValue@24
    • _UtilRemoveDeviceFromDriveTable@4
    • _UtilVolumeDeviceToDosName@8
    • _UtilWaitValueChangeToZero@8
    • _UtilWriteVersionToRegistry@8
    • _UtilbuildDynamicDiskMappingTable@0
    • _UtlWriteBinValueKeyToRegistry@16
    • _ValidateAddressWithSize@20
    • __ResetProtectFromClose@4
    • __UtilDosPathNameToNtPathName@12

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • PAGE
    • .edata
    • INIT
    • .rsrc
    • .reloc

    Signature

    Expand
    {
      "Certificates": [
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
          "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
          "TBS": {
            "MD5": "d0785ad36e427c92b19f6826ab1e8020",
            "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
            "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
            "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
          },
          "ValidFrom": "2012-12-21 00:00:00",
          "ValidTo": "2020-12-30 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
          "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
          "TBS": {
            "MD5": "e9d38360b914c8863f6cba3ee58764d3",
            "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
            "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
            "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
          },
          "ValidFrom": "2012-10-18 00:00:00",
          "ValidTo": "2020-12-29 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
          "TBS": {
            "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
            "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
            "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
            "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
          },
          "ValidFrom": "2017-04-27 00:00:00",
          "ValidTo": "2018-07-16 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "611993e400000000001c",
          "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
          "TBS": {
            "MD5": "78a717e082dcc1cda3458d917e677d14",
            "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
            "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
            "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
          },
          "ValidFrom": "2011-02-22 19:25:17",
          "ValidTo": "2021-02-22 19:35:17",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
          "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "TBS": {
            "MD5": "b30c31a572b0409383ed3fbe17e56e81",
            "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
            "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
            "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
          },
          "ValidFrom": "2010-02-08 00:00:00",
          "ValidTo": "2020-02-07 23:59:59",
          "Version": 3
        }
      ],
      "CertificatesInfo": "",
      "Signer": [
        {
          "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Version": 1
        }
      ],
      "SignerInfo": ""
    }
    

    PropertyValue
    FilenameTmComm.sys
    Creation Timestamp2019-11-24 20:59:46
    MD528d6b138adc174a86c0f6248d8a88275
    SHA18ac5703e67c3e6e0585cb8dbb86d196c5362f9bb
    SHA25612eda8b65ed8c1d80464a0c535ea099dffdb4981c134294cb0fa424efc85ee56
    Authentihash MD553dc04de7603508de1788cc4cfcbf35f
    Authentihash SHA1b9b4d64e4c97b88e7258994f542c0ac84e934554
    Authentihash SHA256cf0855a8517be550b08a981bfacf90f245791cd70620868a241f1b1e2d8dfd89
    RichPEHeaderHash MD510609f326d2f94c82a36fc64676533d8
    RichPEHeaderHash SHA12a6eaf986eff3455a32fb6a20ceb7c3ffe70bf41
    RichPEHeaderHash SHA256b61ea91d46738a0387b4bbfb7c154f3a1881c8cab9360fd8eb85e1dd8c5d386c
    CompanyTrend Micro Inc.
    DescriptionTrendMicro Common Module
    ProductTrend Micro Eyes
    OriginalFilenameTmComm.sys

    Download

    Certificates

    Expand
    Certificate 0ea0fe4dfb74cc64bc32143103c27c8b
    FieldValue
    ToBeSigned (TBS) MD5e93e004baa6013b41135ac0648e29d5b
    ToBeSigned (TBS) SHA1dc91e26674d4b627319c700d3ebb1a6cf83d358e
    ToBeSigned (TBS) SHA2560d20335edb166a303411548471bee6f301c8b4f7f7e453d09c15303de2c888d7
    SubjectC=TW, L=Taipei, O=Trend Micro, Inc., OU=Taipei, TW, CN=Trend Micro, Inc.
    ValidFrom2019-07-12 00:00:00
    ValidTo2020-07-10 12:00:00
    Signature5c08ae5d586a4751195382d6889dc2fc500e7c39c641e1a58def8d923e12b754e2cc35720cc8d3d29382980debf7d98fcc17d764187126dd07c134fdbb96dd44fe8a40195df6f6acd1881fa5ba2921dadceb3f64422344672834813916bbdf317533cf6aaf3317d78197d7d6c560ad681de135f39e2d4ad345b7fe491162660a5462c6075fd725382df1e6e6bc3a4c443be778f79b07f181082e38150ca28ab932f99e4bc4185dc5b3b6edf22c187fdfd84e23a21e7da1989837f43b89aa172e6b34dbcb297bffd511a1d1c100b25e0e921f622a0845e23317f9fec83659ca21c241800683e0dd66ce4d042a8aefc4142b5923a6fa93ee72c48e8dc04c13b4b0
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber0ea0fe4dfb74cc64bc32143103c27c8b
    Version3
    Certificate 61204db4000000000027
    FieldValue
    ToBeSigned (TBS) MD58e3ffc222fbcebdbb8b23115ab259be7
    ToBeSigned (TBS) SHA1ee20bff28ffe13be731c294c90d6ded5aae0ec0e
    ToBeSigned (TBS) SHA25659826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821
    SubjectC=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
    ValidFrom2011-04-15 19:45:33
    ValidTo2021-04-15 19:55:33
    Signature208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber61204db4000000000027
    Version3
    Certificate 03019a023aff58b16bd6d5eae617f066
    FieldValue
    ToBeSigned (TBS) MD5a752afee44f017e8d74e3f3eb7914ae3
    ToBeSigned (TBS) SHA18eca80a6b80e9c69dcef7745748524afb8019e2d
    ToBeSigned (TBS) SHA25682560fa7efec30b5ff82af643e6f3bf3d46868bbd5e7d76f93db185e9e3553a1
    SubjectC=US, O=DigiCert, CN=DigiCert Timestamp Responder
    ValidFrom2014-10-22 00:00:00
    ValidTo2024-10-22 00:00:00
    Signature9d257e1b334db226815c9b86ce23200f8087e588ffffb1d46a2c31ed3a17197117cda91bbc5a1639009de36c84e45a40fbde06018c37fa9bb19d247efe20a457ad5bb79ab06026ea6957215d342f1f71b0839419056b359010a07b97c7f63fe7e21141a6bd62d9f0273d381d286f3a5209f0ec7062d3624bb0e073a692c0d38e31d82fe36d171306eee403b614abf38f43a7719d21dd14ca155d9241daf90f81d199740d26c40e7f1bb5f5a0f1c677062815e9d893e55516f0bb0aab1cdb5c482766c8a38b0a1ce595daaec42e59a061dddaf36da261e98a0b6dec1218bdf755544003922b6bc251c20a48afb0d46ee0f4140a3a1be38f3dcaaf6a8d7bdcd844
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber03019a023aff58b16bd6d5eae617f066
    Version3
    Certificate 02c4d1e58a4a680c568da3047e7e4d5f
    FieldValue
    ToBeSigned (TBS) MD5829995f702421dea833a24fb2c7f4442
    ToBeSigned (TBS) SHA11d7e838accd498c2e5ba9373af819ec097bb955c
    ToBeSigned (TBS) SHA25692914d016cc46e125e50c4bd0bd7f72db87eed4ba68f3c589b4e86aa563108db
    SubjectC=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1
    ValidFrom2011-02-11 12:00:00
    ValidTo2026-02-10 12:00:00
    Signature49eb7c60beaeefc97cb3c5ba4b64df1669e286fa29d9de98857d406626332f4455aaaa90e935700a34bed3ae542e8e6500d67a32203e6c26b898a939b1bc95c7aae9f5ee4666c6b3e812f8b3979dff74588234997550ac448fe892ce7d8b0f3196c7dcd31130987416c6e56b4576a39401cd33007a48f66f8631c9562b3322d5f801b644ce8cb4ca88d2e416e3e7f6e23ee109c09d7943437f555c05ad9310c62c0d6bc09eea78e5d277d6b8da9a987fba4c922b9dbda488b1ddafc34cd2979b03c6ae5f1b440f333715e3cbff2f56d316a45b55679da2cadb346c0c734ab57ba4b6b3e935027870ec007acbfc4b4f2236bb1484c98f91dd0f3c758cca0b88e7
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber02c4d1e58a4a680c568da3047e7e4d5f
    Version3
    Certificate 06fdf9039603adea000aeb3f27bbba1b
    FieldValue
    ToBeSigned (TBS) MD54e5ad189638cf52ba9cd881d4d44668c
    ToBeSigned (TBS) SHA1cdc115e98d798b33904c820d63cc1e1afc19251d
    ToBeSigned (TBS) SHA25637560fb9d548ab62cc3ed4669a4ab74828b5a108e67e829937ffb2d10a5f78dd
    SubjectC=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID CA,1
    ValidFrom2006-11-10 00:00:00
    ValidTo2021-11-10 00:00:00
    Signature46503ec9b72824a7381db65b29af52cf52e93147ab565c7bd50d0b41b3efec751f7438f2b25c61a29c95c350e482b923d1ba3a8672ad3878ac755d1717347247859456d1ebbb368477cc24a5f3041955a9e7e3e7ab62cdfb8b2d90c2c0d2b594bd5e4fb105d20e3d1aa9145ba6863162a8a833e49b39a7c4f5ce1d7876942573e42aabcf9c764bed5fc24b16e44b704c00891efcc579bc4c1257fe5fe11ebc025da8fefb07384f0dc65d91b90f6745cdd683ede7920d8db1698c4ffb59e0230fd2aaae007cee9c420ecf91d727b716ee0fc3bd7c0aa0ee2c08558522b8eb181a4dfc2a21ad49318347957771dcb11b4b4b1c109c7714c19d4f2f5a9508291026
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber06fdf9039603adea000aeb3f27bbba1b
    Version3

    Imports

    Expand
    • ntoskrnl.exe

    Imported Functions

    Expand
    • KeLeaveCriticalRegion
    • wcsncpy
    • KeEnterCriticalRegion
    • ExAcquireFastMutexUnsafe
    • wcsrchr
    • ExAcquireResourceSharedLite
    • ExReleaseResourceLite
    • _purecall
    • ZwOpenEvent
    • ZwConnectPort
    • KeClearEvent
    • PsProcessType
    • ExFreePoolWithTag
    • RtlInitUnicodeString
    • KeSetEvent
    • ProbeForWrite
    • KeUnstackDetachProcess
    • ZwRequestWaitReplyPort
    • ZwWaitForSingleObject
    • DbgBreakPoint
    • ZwSetEvent
    • IoGetCurrentProcess
    • ZwFreeVirtualMemory
    • ZwClose
    • ObfReferenceObject
    • ObfDereferenceObject
    • RtlUnicodeStringToInteger
    • ZwCreateSection
    • ObOpenObjectByPointer
    • KeStackAttachProcess
    • KePulseEvent
    • ZwAllocateVirtualMemory
    • ObGetObjectSecurity
    • SeAccessCheck
    • SeReleaseSubjectContext
    • SeCaptureSubjectContext
    • PsThreadType
    • ObReleaseObjectSecurity
    • PsGetProcessExitTime
    • MmSectionObjectType
    • DbgPrint
    • ExDeleteResourceLite
    • ExInitializeResourceLite
    • ZwReadFile
    • swprintf
    • ZwSetInformationFile
    • ZwCreateFile
    • ZwQueryInformationFile
    • ZwWriteFile
    • _wcsnicmp
    • towupper
    • ExAllocatePoolWithTag
    • KeInitializeEvent
    • ZwCreateEvent
    • ZwCreateKey
    • RtlAnsiStringToUnicodeString
    • ZwNotifyChangeKey
    • RtlInitAnsiString
    • _snprintf
    • RtlFreeUnicodeString
    • ExSystemTimeToLocalTime
    • _vsnprintf
    • ObReferenceObjectByHandle
    • RtlTimeToTimeFields
    • ZwDeviceIoControlFile
    • PsGetCurrentThreadId
    • PsGetCurrentProcessId
    • KeWaitForMultipleObjects
    • ExGetPreviousMode
    • RtlEqualUnicodeString
    • RtlPrefixUnicodeString
    • RtlAppendUnicodeStringToString
    • RtlCopyUnicodeString
    • RtlUpcaseUnicodeChar
    • KeWaitForSingleObject
    • KeSetPriorityThread
    • PsCreateSystemThread
    • PsTerminateSystemThread
    • MmIsAddressValid
    • KeDelayExecutionThread
    • KeNumberProcessors
    • PsLookupProcessByProcessId
    • PsSetCreateProcessNotifyRoutine
    • ZwOpenDirectoryObject
    • ZwQueryInformationProcess
    • ZwQuerySecurityObject
    • NtSetInformationFile
    • ZwDeleteValueKey
    • ZwSetValueKey
    • ZwQuerySystemInformation
    • NtQueryInformationFile
    • IoFileObjectType
    • ZwQueryValueKey
    • ZwQueryDirectoryFile
    • NtCreateFile
    • ZwEnumerateValueKey
    • RtlLengthSecurityDescriptor
    • ZwQueryDirectoryObject
    • ZwSetSecurityObject
    • ZwDuplicateObject
    • ZwOpenProcess
    • ZwTerminateProcess
    • ExReleaseFastMutexUnsafe
    • ZwEnumerateKey
    • ZwQueryKey
    • ZwOpenKey
    • MmSystemRangeStart
    • _stricmp
    • _strnicmp
    • mbstowcs
    • ProbeForRead
    • RtlUpcaseUnicodeString
    • _snwprintf
    • ZwQuerySymbolicLinkObject
    • ZwMapViewOfSection
    • MmGetSystemRoutineAddress
    • RtlAppendUnicodeToString
    • IoCreateFile
    • RtlQueryRegistryValues
    • MmBuildMdlForNonPagedPool
    • ZwOpenSymbolicLinkObject
    • IoFreeMdl
    • ObQueryNameString
    • ZwUnmapViewOfSection
    • NtClose
    • IoFreeIrp
    • PsGetVersion
    • IoAllocateIrp
    • RtlCompareMemory
    • MmUnlockPages
    • ZwSetInformationObject
    • ZwOpenFile
    • wcsncmp
    • RtlImageNtHeader
    • IoAllocateMdl
    • IofCallDriver
    • ZwQueryVolumeInformationFile
    • ObReferenceObjectByPointer
    • IoBuildDeviceIoControlRequest
    • ZwOpenSection
    • RtlSubAuthoritySid
    • RtlLengthRequiredSid
    • ExReleaseFastMutex
    • ExAcquireFastMutex
    • RtlCreateAcl
    • RtlSetDaclSecurityDescriptor
    • RtlAddAccessAllowedAce
    • KeInitializeSemaphore
    • KeReleaseSemaphore
    • RtlInitializeSid
    • RtlCreateSecurityDescriptor
    • IoDeleteSymbolicLink
    • IoDeleteDevice
    • IoGetDeviceObjectPointer
    • ExEventObjectType
    • IofCompleteRequest
    • IoCreateSymbolicLink
    • ObOpenObjectByName
    • NtQueryInformationProcess
    • strncpy
    • NtOpenProcess
    • ObInsertObject
    • IoAcquireVpbSpinLock
    • SeCreateAccessState
    • IoGetFileObjectGenericMapping
    • ObCreateObject
    • KeAcquireQueuedSpinLock
    • KeReleaseQueuedSpinLock
    • IoReleaseVpbSpinLock
    • wcschr
    • strncat
    • RtlUnicodeStringToAnsiString
    • wcsncat
    • RtlFreeAnsiString
    • wcstombs
    • IoGetConfigurationInformation
    • IoRegisterPlugPlayNotification
    • IoGetStackLimits
    • IoBuildSynchronousFsdRequest
    • KeReleaseSpinLock
    • ExpInterlockedPopEntrySList
    • FsRtlIsNameInExpression
    • wcsstr
    • ExAllocatePool
    • IoUnregisterPlugPlayNotification
    • MmProbeAndLockPages
    • RtlCompareUnicodeString
    • IoGetDeviceInterfaces
    • KeAcquireSpinLockRaiseToDpc
    • KeBugCheckEx
    • IoCreateDevice
    • IoDeviceObjectType
    • SeCaptureSecurityDescriptor
    • RtlAbsoluteToSelfRelativeSD
    • IoIsWdmVersionAvailable
    • SeExports
    • RtlLengthSid
    • RtlGetSaclSecurityDescriptor
    • RtlGetDaclSecurityDescriptor
    • RtlGetGroupSecurityDescriptor
    • RtlGetOwnerSecurityDescriptor
    • ZwDeleteKey
    • ExAcquireResourceExclusiveLite
    • __C_specific_handler

    Exported Functions

    Expand
    • ??0CAutoUpdateConfigThread@@QEAA@AEBV0@@Z
    • ??0CAutoUpdateConfigThread@@QEAA@PEAU_UNICODE_STRING@@P6AX0PEAX@Z1@Z
    • ??0CBlobConfig@@QEAA@AEBV0@@Z
    • ??0CBlobConfig@@QEAA@K@Z
    • ??0CContext@@QEAA@AEBV0@@Z
    • ??0CContext@@QEAA@KP6AJPEAU_EVENT_REPORT@@PEAXPEAU_TMCE_REPORT@@PEAU_TMCE_FEEDBACK@@@Z1K@Z
    • ??0CContextList@@QEAA@AEBV0@@Z
    • ??0CContextList@@QEAA@KPEAVIMemoryAllocator@@@Z
    • ??0CDebugLog@@QEAA@AEBV0@@Z
    • ??0CDebugLog@@QEAA@PEBG@Z
    • ??0CDebugLogEx@@QEAA@AEBV0@@Z
    • ??0CDebugLogEx@@QEAA@K@Z
    • ??0CDelayLoadThread@@QEAA@AEBV0@@Z
    • ??0CDelayLoadThread@@QEAA@XZ
    • ??0CExclusionExtConfig@@QEAA@AEBV0@@Z
    • ??0CExclusionExtConfig@@QEAA@KKE@Z
    • ??0CExclusionFileNameConfig@@QEAA@AEBV0@@Z
    • ??0CExclusionFileNameConfig@@QEAA@KK@Z
    • ??0CExclusionFilePathConfig@@QEAA@AEBV0@@Z
    • ??0CExclusionFilePathConfig@@QEAA@KK@Z
    • ??0CExclusionFolderConfig@@QEAA@AEBV0@@Z
    • ??0CExclusionFolderConfig@@QEAA@KK@Z
    • ??0CExclusionRegistryConfig@@QEAA@AEBV0@@Z
    • ??0CExclusionRegistryConfig@@QEAA@KK@Z
    • ??0CFile@@QEAA@AEBV0@@Z
    • ??0CFile@@QEAA@E@Z
    • ??0CFileExtension@@QEAA@AEBV0@@Z
    • ??0CFileExtension@@QEAA@KEEPEAVIMemoryAllocator@@@Z
    • ??0CInclusionExtConfig@@QEAA@AEBV0@@Z
    • ??0CInclusionExtConfig@@QEAA@KKE@Z
    • ??0CInclusionFileNameConfig@@QEAA@AEBV0@@Z
    • ??0CInclusionFileNameConfig@@QEAA@KK@Z
    • ??0CInclusionFilePathConfig@@QEAA@AEBV0@@Z
    • ??0CInclusionFilePathConfig@@QEAA@KK@Z
    • ??0CInclusionFolderConfig@@QEAA@AEBV0@@Z
    • ??0CInclusionFolderConfig@@QEAA@KK@Z
    • ??0CKEvent@@QEAA@AEBV0@@Z
    • ??0CKEvent@@QEAA@W4_EVENT_TYPE@@E@Z
    • ??0CList@@QEAA@AEBV0@@Z
    • ??0CList@@QEAA@KPEAVIMemoryAllocator@@@Z
    • ??0CLockEvent@@QEAA@AEBV0@@Z
    • ??0CLockEvent@@QEAA@XZ
    • ??0CLockList@@QEAA@AEBV0@@Z
    • ??0CLockList@@QEAA@KKPEAVIMemoryAllocator@@@Z
    • ??0CMemoryAllocator@@IEAA@W4_POOL_TYPE@@K@Z
    • ??0CMemoryAllocator@@QEAA@AEBV0@@Z
    • ??0CMemoryPoolAllocator@@IEAA@W4_POOL_TYPE@@_K1K@Z
    • ??0CMemoryPoolAllocator@@QEAA@AEBV0@@Z
    • ??0CModuleConfig@@QEAA@AEBV0@@Z
    • ??0CModuleConfig@@QEAA@XZ
    • ??0CModuleConfigList@@QEAA@AEBV0@@Z
    • ??0CModuleConfigList@@QEAA@KPEAVIMemoryAllocator@@@Z
    • ??0CModuleFileExtConfig@@QEAA@AEBV0@@Z
    • ??0CModuleFileExtConfig@@QEAA@KKE@Z
    • ??0CModuleFlagConfig@@QEAA@AEBV0@@Z
    • ??0CModuleFlagConfig@@QEAA@K@Z
    • ??0CModuleMultiStringConfig@@QEAA@AEBV0@@Z
    • ??0CModuleMultiStringConfig@@QEAA@KK@Z
    • ??0CModuleStringConfig@@QEAA@AEBV0@@Z
    • ??0CModuleStringConfig@@QEAA@K@Z
    • ??0CNoLockList@@QEAA@AEBV0@@Z
    • ??0CNoLockList@@QEAA@KKPEAVIMemoryAllocator@@@Z
    • ??0CSmartLock@@QEAA@AEAVCLockEvent@@@Z
    • ??0CSmartLock@@QEAA@XZ
    • ??0CSmartReference@@QEAA@AEAJ@Z
    • ??0CSmartReference@@QEAA@AEAK@Z
    • ??0CSmartResource@@QEAA@AEAVCResource@@E@Z
    • ??0CStrList@@QEAA@AEBV0@@Z
    • ??0CStrList@@QEAA@KPEAVIMemoryAllocator@@@Z
    • ??0CSystemThread@@QEAA@AEBV0@@Z
    • ??0CSystemThread@@QEAA@K@Z
    • ??0CUserFuncAdapterJob@@QEAA@AEBV0@@Z
    • ??0CUserFuncAdapterJob@@QEAA@P6AXPEAX@Z01@Z
    • ??0CWorkerThread@@IEAA@PEAVCWorkerThreadJobQueue@@@Z
    • ??0CWorkerThread@@QEAA@AEBV0@@Z
    • ??0CWorkerThreadJob@@QEAA@AEBV0@@Z
    • ??0CWorkerThreadJob@@QEAA@E@Z
    • ??0CWorkerThreadJobQueue@@QEAA@AEBV0@@Z
    • ??0CWorkerThreadJobQueue@@QEAA@K@Z
    • ??0CWorkerThreadPool@@QEAA@AEBV0@@Z
    • ??0CWorkerThreadPool@@QEAA@K@Z
    • ??0CWorkerThreadPoolEx@@QEAA@AEBV0@@Z
    • ??0CWorkerThreadPoolEx@@QEAA@KK@Z
    • ??0IMemoryAllocator@@QEAA@AEBV0@@Z
    • ??0IMemoryAllocator@@QEAA@XZ
    • ??1CAutoUpdateConfigThread@@UEAA@XZ
    • ??1CBlobConfig@@UEAA@XZ
    • ??1CContext@@UEAA@XZ
    • ??1CContextList@@UEAA@XZ
    • ??1CDebugLog@@UEAA@XZ
    • ??1CDebugLogEx@@UEAA@XZ
    • ??1CDelayLoadThread@@UEAA@XZ
    • ??1CExclusionExtConfig@@UEAA@XZ
    • ??1CExclusionFileNameConfig@@UEAA@XZ
    • ??1CExclusionFilePathConfig@@UEAA@XZ
    • ??1CExclusionFolderConfig@@UEAA@XZ
    • ??1CExclusionRegistryConfig@@UEAA@XZ
    • ??1CFile@@UEAA@XZ
    • ??1CFileExtension@@UEAA@XZ
    • ??1CInclusionExtConfig@@UEAA@XZ
    • ??1CInclusionFileNameConfig@@UEAA@XZ
    • ??1CInclusionFilePathConfig@@UEAA@XZ
    • ??1CInclusionFolderConfig@@UEAA@XZ
    • ??1CKEvent@@UEAA@XZ
    • ??1CList@@UEAA@XZ
    • ??1CLockEvent@@UEAA@XZ
    • ??1CLockList@@UEAA@XZ
    • ??1CMemoryAllocator@@UEAA@XZ
    • ??1CMemoryPoolAllocator@@UEAA@XZ
    • ??1CModuleConfig@@UEAA@XZ
    • ??1CModuleConfigList@@UEAA@XZ
    • ??1CModuleFileExtConfig@@UEAA@XZ
    • ??1CModuleFlagConfig@@UEAA@XZ
    • ??1CModuleMultiStringConfig@@UEAA@XZ
    • ??1CModuleStringConfig@@UEAA@XZ
    • ??1CNoLockList@@UEAA@XZ
    • ??1CSmartLock@@QEAA@XZ
    • ??1CSmartReference@@QEAA@XZ
    • ??1CSmartResource@@QEAA@XZ
    • ??1CStrList@@UEAA@XZ
    • ??1CSystemThread@@UEAA@XZ
    • ??1CUserFuncAdapterJob@@UEAA@XZ
    • ??1CWorkerThread@@UEAA@XZ
    • ??1CWorkerThreadJob@@UEAA@XZ
    • ??1CWorkerThreadJobQueue@@UEAA@XZ
    • ??1CWorkerThreadPool@@UEAA@XZ
    • ??1CWorkerThreadPoolEx@@UEAA@XZ
    • ??1IMemoryAllocator@@UEAA@XZ
    • ??2@YAPEAX_KPEAVIMemoryAllocator@@PEBDK@Z
    • ??2CMemoryAllocator@@SAPEAX_K@Z
    • ??2CMemoryPoolAllocator@@SAPEAX_K@Z
    • ??3@YAXPEAX@Z
    • ??3IMemoryAllocator@@SAXPEAX@Z
    • ??4CAutoUpdateConfigThread@@QEAAAEAV0@AEBV0@@Z
    • ??4CBlobConfig@@QEAAAEAV0@AEBV0@@Z
    • ??4CContext@@QEAAAEAV0@AEBV0@@Z
    • ??4CDebugLog@@QEAAAEAV0@AEBV0@@Z
    • ??4CDebugLogEx@@QEAAAEAV0@AEBV0@@Z
    • ??4CDelayLoadThread@@QEAAAEAV0@AEBV0@@Z
    • ??4CFile@@QEAAAEAV0@AEBV0@@Z
    • ??4CKEvent@@QEAAAEAV0@AEBV0@@Z
    • ??4CLockEvent@@QEAAAEAV0@AEBV0@@Z
    • ??4CMemoryAllocator@@QEAAAEAV0@AEBV0@@Z
    • ??4CMemoryPoolAllocator@@QEAAAEAV0@AEBV0@@Z
    • ??4CModuleConfig@@QEAAAEAV0@AEBV0@@Z
    • ??4CModuleFlagConfig@@QEAAAEAV0@AEBV0@@Z
    • ??4CModuleStringConfig@@QEAAAEAV0@AEBV0@@Z
    • ??4CSmartLock@@QEAAAEAV0@AEBV0@@Z
    • ??4CSmartLock@@QEAAAEBV0@AEAVCLockEvent@@@Z
    • ??4CSmartResource@@QEAAAEAV0@AEBV0@@Z
    • ??4CSystemThread@@QEAAAEAV0@AEBV0@@Z
    • ??4CUserFuncAdapterJob@@QEAAAEAV0@AEBV0@@Z
    • ??4CWorkerThread@@QEAAAEAV0@AEBV0@@Z
    • ??4CWorkerThreadJob@@QEAAAEAV0@AEBV0@@Z
    • ??4IMemoryAllocator@@QEAAAEAV0@AEBV0@@Z
    • ??_7CAutoUpdateConfigThread@@6B@
    • ??_7CBlobConfig@@6B@
    • ??_7CContext@@6B@
    • ??_7CContextList@@6B@
    • ??_7CDebugLog@@6B@
    • ??_7CDebugLogEx@@6B@
    • ??_7CDelayLoadThread@@6B@
    • ??_7CExclusionExtConfig@@6B@
    • ??_7CExclusionFileNameConfig@@6B@
    • ??_7CExclusionFilePathConfig@@6B@
    • ??_7CExclusionFolderConfig@@6B@
    • ??_7CExclusionRegistryConfig@@6B@
    • ??_7CFile@@6B@
    • ??_7CFileExtension@@6B@
    • ??_7CInclusionExtConfig@@6B@
    • ??_7CInclusionFileNameConfig@@6B@
    • ??_7CInclusionFilePathConfig@@6B@
    • ??_7CInclusionFolderConfig@@6B@
    • ??_7CKEvent@@6B@
    • ??_7CList@@6B@
    • ??_7CLockEvent@@6B@
    • ??_7CLockList@@6B@
    • ??_7CMemoryAllocator@@6B@
    • ??_7CMemoryPoolAllocator@@6B@
    • ??_7CModuleConfig@@6B@
    • ??_7CModuleConfigList@@6B@
    • ??_7CModuleFileExtConfig@@6B@
    • ??_7CModuleFlagConfig@@6B@
    • ??_7CModuleMultiStringConfig@@6B@
    • ??_7CModuleStringConfig@@6B@
    • ??_7CNoLockList@@6B@
    • ??_7CStrList@@6B@
    • ??_7CSystemThread@@6B@
    • ??_7CUserFuncAdapterJob@@6B@
    • ??_7CWorkerThread@@6B@
    • ??_7CWorkerThreadJob@@6B@
    • ??_7CWorkerThreadJobQueue@@6B@
    • ??_7CWorkerThreadPool@@6B@
    • ??_7CWorkerThreadPoolEx@@6B@
    • ??_7IMemoryAllocator@@6B@
    • ??_FCContextList@@QEAAXXZ
    • ??_FCFile@@QEAAXXZ
    • ??_FCFileExtension@@QEAAXXZ
    • ??_FCModuleConfigList@@QEAAXXZ
    • ??_FCStrList@@QEAAXXZ
    • ??_FCSystemThread@@QEAAXXZ
    • ??_FCWorkerThread@@QEAAXXZ
    • ??_FCWorkerThreadJob@@QEAAXXZ
    • ??_FCWorkerThreadJobQueue@@QEAAXXZ
    • ??_U@YAPEAX_KPEAVIMemoryAllocator@@PEBDK@Z
    • ??_V@YAXPEAX@Z
    • ?Acquire@CLockEvent@@QEAAXXZ
    • ?Add@CContextList@@QEAAEPEAVCContext@@@Z
    • ?Add@CFileExtension@@QEAAEPEBGK@Z
    • ?Add@CModuleConfigList@@QEAAEPEAVCModuleConfig@@@Z
    • ?Add@CStrList@@QEAAEPEBG@Z
    • ?AddNode@CLockList@@UEAAEQEAXE@Z
    • ?AddNode@CNoLockList@@UEAAEQEAXE@Z
    • ?Alloc@CMemoryAllocator@@UEAAPEAX_KPEBDK@Z
    • ?Alloc@CMemoryPoolAllocator@@UEAAPEAX_KPEBDK@Z
    • ?AllocBlock@CMemoryPoolAllocator@@IEAAPEAX_K@Z
    • ?AttachJobQueue@CWorkerThread@@QEAAXPEAVCWorkerThreadJobQueue@@@Z
    • ?Cancel@CWorkerThreadJob@@QEAAXXZ
    • ?CheckNode@CLockList@@UEAAHQEAX@Z
    • ?CheckNode@CNoLockList@@UEAAHQEAX@Z
    • ?CleanQueue@CWorkerThreadJobQueue@@QEAAXXZ
    • ?Cleanup@CBlobConfig@@AEAAXXZ
    • ?Cleanup@CModuleFileExtConfig@@IEAAXXZ
    • ?Cleanup@CModuleMultiStringConfig@@IEAAXXZ
    • ?Cleanup@CModuleStringConfig@@AEAAXXZ
    • ?Close@CFile@@QEAAJXZ
    • ?Count@CLockList@@QEAAKXZ
    • ?Count@CNoLockList@@QEAAKXZ
    • ?Create@CFile@@QEAAJPEBGKKKK@Z
    • ?Create@CSystemThread@@QEAAEXZ
    • ?CreateInstance@CMemoryAllocator@@SAPEAV1@W4_POOL_TYPE@@K@Z
    • ?CreateInstance@CMemoryPoolAllocator@@SAPEAV1@W4_POOL_TYPE@@_K1K@Z
    • ?CreatePool@CWorkerThreadPool@@QEAAEXZ
    • ?CreatePool@CWorkerThreadPoolEx@@QEAAEXZ
    • ?CreateThreads@CWorkerThreadPool@@QEAAEK@Z
    • ?CreateThreads@CWorkerThreadPoolEx@@QEAAEK@Z
    • ?CreateWIRP@CFile@@QEAAJPEBGKKKK@Z
    • ?Delete@CFile@@QEAAJXZ
    • ?Delete@CFileExtension@@QEAAEPEBGK@Z
    • ?Delete@CStrList@@QEAAEPEBG@Z
    • ?DeleteAll@CList@@UEAAXXZ
    • ?DeleteAll@CLockList@@UEAAXXZ
    • ?DeleteAll@CNoLockList@@UEAAXXZ
    • ?DeleteNode@CContextList@@MEAAXPEAX@Z
    • ?DeleteNode@CList@@UEAAXPEAX@Z
    • ?DeleteNode@CModuleConfigList@@MEAAXPEAX@Z
    • ?DeleteNode@CStrList@@EEAAXPEAU_STR_LIST_NODE@1@@Z
    • ?DisableWriteProtectFromCR0@@YAXPEAPEAX@Z
    • ?DoIt@CWorkerThreadJob@@QEAAJXZ
    • ?EntryPoint@CSystemThread@@KAXPEAX@Z
    • ?Find@CContextList@@QEAAPEAVCContext@@K@Z
    • ?Find@CContextList@@QEAAPEAVCContext@@PEAX@Z
    • ?Find@CFileExtension@@QEAAPEAU_STR_LIST_NODE@CStrList@@PEBGK@Z
    • ?Find@CModuleConfigList@@QEAAPEAVCModuleConfig@@K@Z
    • ?Find@CStrList@@QEAAPEAU_STR_LIST_NODE@1@PEBG@Z
    • ?FindNode@CContextList@@IEAAPEAXPEAX@Z
    • ?FindPartiallyAndAllMatch@CStrList@@QEAAPEAU_STR_LIST_NODE@1@PEBG@Z
    • ?FinishFunction@CUserFuncAdapterJob@@MEAAXXZ
    • ?FinishIt@CWorkerThreadJob@@QEAAJXZ
    • ?First@CList@@UEAAPEAXXZ
    • ?First@CLockList@@UEAAPEAXXZ
    • ?First@CNoLockList@@UEAAPEAXXZ
    • ?Free@CMemoryAllocator@@UEAAXPEAX@Z
    • ?Free@CMemoryPoolAllocator@@UEAAXPEAX@Z
    • ?GetAttributes@CFile@@QEAAKXZ
    • ?GetBasicInfomration@CFile@@IEAAJXZ
    • ?GetBlobCofig@CContext@@UEAAJKPEAXPEAK@Z
    • ?GetCategory@CContext@@QEAAKXZ
    • ?GetData@CBlobConfig@@QEAAHPEAXPEAK@Z
    • ?GetData@CModuleFileExtConfig@@QEAAHPEAGPEAK@Z
    • ?GetData@CModuleFileExtConfig@@QEAAPEAVCFileExtension@@XZ
    • ?GetData@CModuleFlagConfig@@QEAAKXZ
    • ?GetData@CModuleMultiStringConfig@@QEAAHPEAGPEAK@Z
    • ?GetData@CModuleMultiStringConfig@@QEAAPEAVCStrList@@XZ
    • ?GetData@CModuleStringConfig@@QEAAPEAGXZ
    • ?GetData@CStrList@@QEAAEPEAGPEAK@Z
    • ?GetDataType@CModuleConfig@@QEAAKXZ
    • ?GetEngineContext@CContext@@QEAAPEAXXZ
    • ?GetFileExtensionConfig@CContext@@QEAAPEAVCFileExtension@@K@Z
    • ?GetFileExtensionConfig@CContext@@UEAAJKPEAGPEAK@Z
    • ?GetFileSize@CFile@@QEAAJPEAT_LARGE_INTEGER@@@Z
    • ?GetFileSizeWIRP@CFile@@QEAAJPEAT_LARGE_INTEGER@@@Z
    • ?GetFlagConfig@CContext@@UEAAJKPEAK@Z
    • ?GetID@CModuleConfig@@QEAAKXZ
    • ?GetJob@CWorkerThreadJobQueue@@QEAAPEAVCWorkerThreadJob@@XZ
    • ?GetLength@CModuleStringConfig@@QEAAKXZ
    • ?GetLinkContext@CContext@@QEAAPEAXXZ
    • ?GetLogFlag@CDebugLog@@QEAAKXZ
    • ?GetLogFlag@CDebugLogEx@@QEAAKXZ
    • ?GetModuleId@CModuleConfig@@QEAAKXZ
    • ?GetMultiStringConfig@CContext@@QEAAPEAVCStrList@@K@Z
    • ?GetMultiStringConfig@CContext@@UEAAJKPEAGPEAK@Z
    • ?GetOneThreadTEB@CWorkerThreadPool@@QEAAPEAU_ETHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPool@@QEAAPEAU_KTHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPoolEx@@QEAAPEAU_ETHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPoolEx@@QEAAPEAU_KTHREAD@@XZ
    • ?GetReportCallBackRoutine@CContext@@QEAA_KXZ
    • ?GetSize@CBlobConfig@@QEAAKXZ
    • ?GetStringConfig@CContext@@QEAAPEAGK@Z
    • ?GetStringConfig@CContext@@UEAAJKPEAGPEAK@Z
    • ?GetThreadCount@CWorkerThreadPool@@QEAAKXZ
    • ?GetThreadCount@CWorkerThreadPoolEx@@QEAAKXZ
    • ?GetThreadID@CSystemThread@@QEAA_KXZ
    • ?GetType@CContext@@QEAAKXZ
    • ?GetUserParameter@CContext@@QEAA_KXZ
    • ?InitProcMon@CDebugLogEx@@IEAAXXZ
    • ?InitializeBlobConfig@CContext@@QEAAHKPEAXK@Z
    • ?InitializeFileExtensionConfig@CContext@@QEAAHKPEBG@Z
    • ?InitializeFlagConfig@CContext@@QEAAHKK@Z
    • ?InitializeMultiStringConfig@CContext@@QEAAHKPEBG@Z
    • ?InitializeStringConfig@CContext@@QEAAHKPEBG@Z
    • ?Insert@CList@@UEAAXQEAXE@Z
    • ?Insert@CLockList@@UEAAXQEAXE@Z
    • ?Insert@CNoLockList@@UEAAXQEAXE@Z
    • ?InsertAfter@CList@@UEAAXPEAX0@Z
    • ?InsertBefore@CList@@UEAAXPEAX0@Z
    • ?Instance@CWorkerThreadPool@@SAPEAV1@XZ
    • ?IsEmpty@CList@@UEAAEXZ
    • ?IsEmpty@CLockList@@UEAAEXZ
    • ?IsEmpty@CNoLockList@@UEAAEXZ
    • ?IsExceedLimitation@CMemoryPoolAllocator@@IEAAEK@Z
    • ?IsFull@CLockList@@QEBAEXZ
    • ?IsFull@CNoLockList@@QEBAEXZ
    • ?IsInExclusionList@CExclusionExtConfig@@QEAAEPEBG@Z
    • ?IsInExclusionList@CExclusionFileNameConfig@@QEAAEPEBG@Z
    • ?IsInExclusionList@CExclusionFilePathConfig@@QEAAEPEBG@Z
    • ?IsInExclusionList@CExclusionFolderConfig@@QEAAEPEBG@Z
    • ?IsInExclusionList@CExclusionRegistryConfig@@QEAAEPEBG@Z
    • ?IsInInclusionList@CInclusionExtConfig@@QEAAEPEBG@Z
    • ?IsInInclusionList@CInclusionFileNameConfig@@QEAAEPEBG@Z
    • ?IsInInclusionList@CInclusionFilePathConfig@@QEAAEPEBG@Z
    • ?IsInInclusionList@CInclusionFolderConfig@@QEAAEPEBG@Z
    • ?IsOpened@CFile@@QEAAEXZ
    • ?IsTerminated@CWorkerThreadPool@@QEAAEXZ
    • ?IsTerminated@CWorkerThreadPoolEx@@QEAAEXZ
    • ?IsValid@CMemoryAllocator@@UEAAEXZ
    • ?IsValid@CMemoryPoolAllocator@@UEAAEXZ
    • ?IsValid@IMemoryAllocator@@UEAAEXZ
    • ?IsWorkerThread@CWorkerThreadPool@@QEAAE_K@Z
    • ?IsWorkerThread@CWorkerThreadPoolEx@@QEAAE_K@Z
    • ?JobFunction@CUserFuncAdapterJob@@MEAAXXZ
    • ?JobQueue@CWorkerThreadPool@@QEAAAEAVCWorkerThreadJobQueue@@XZ
    • ?JobQueue@CWorkerThreadPoolEx@@QEAAAEAVCWorkerThreadJobQueue@@XZ
    • ?Limit@CLockList@@QEAAKXZ
    • ?Limit@CNoLockList@@QEAAKXZ
    • ?MatchAllExtensions@CFileExtension@@QEAAEXZ
    • ?MatchNoExtensions@CFileExtension@@QEAAEXZ
    • ?MergeLeft@CMemoryPoolAllocator@@IEAAPEAXPEAX@Z
    • ?MergeRight@CMemoryPoolAllocator@@IEAAPEAXPEAX@Z
    • ?NeedDelete@CWorkerThreadJob@@QEAAEXZ
    • ?NeedDeleteWhenFinish@CWorkerThreadJob@@QEAAXE@Z
    • ?NewNode@CList@@UEAAPEAXXZ
    • ?NewNode@CStrList@@EEAAPEAXXZ
    • ?NewNodeVariant@CList@@IEAAPEAXK@Z
    • ?Next@CList@@UEBAPEAXQEAX@Z
    • ?Next@CLockList@@UEBAPEAXQEAX@Z
    • ?Next@CNoLockList@@UEBAPEAXQEAX@Z
    • ?NextPool@CMemoryPoolAllocator@@QEAAPEAV1@XZ
    • ?NotityTerminate@CWorkerThread@@QEAAXXZ
    • ?PostJobToWorkerThread@CWorkerThreadPool@@QEAAJP6AXPEAX@Z0E@Z
    • ?PostJobToWorkerThread@CWorkerThreadPoolEx@@QEAAJP6AXPEAX@Z0E1@Z
    • ?Pulse@CKEvent@@QEAAJJE@Z
    • ?QueueJob@CWorkerThreadJobQueue@@QEAAEPEAVCWorkerThreadJob@@@Z
    • ?QueueJobItem@CWorkerThreadPool@@QEAAJPEAVCWorkerThreadJob@@@Z
    • ?QueueJobItem@CWorkerThreadPoolEx@@QEAAJPEAVCWorkerThreadJob@@@Z
    • ?RCMInstance@CWorkerThreadPool@@SAPEAV1@XZ
    • ?Read@CFile@@QEAAJPEADKPEAK@Z
    • ?ReadWIRP@CFile@@QEAAJPEADKPEAK@Z
    • ?ReferenceCount@CContext@@QEAAAEAKXZ
    • ?Release@CLockEvent@@QEAAXXZ
    • ?Remove@CContextList@@UEAAEQEAX@Z
    • ?Remove@CList@@UEAAEQEAX@Z
    • ?Remove@CLockList@@UEAAEQEAX@Z
    • ?Remove@CNoLockList@@UEAAEQEAX@Z
    • ?RemoveHead@CList@@UEAAPEAXXZ
    • ?RemoveHead@CLockList@@UEAAPEAXXZ
    • ?RemoveHead@CNoLockList@@UEAAPEAXXZ
    • ?RemoveTail@CList@@UEAAPEAXXZ
    • ?RemoveTail@CLockList@@UEAAPEAXXZ
    • ?RemoveTail@CNoLockList@@UEAAPEAXXZ
    • ?Reset@CKEvent@@QEAAXXZ
    • ?ResetData@CInclusionExtConfig@@QEAAXXZ
    • ?ResetData@CInclusionFileNameConfig@@QEAAXXZ
    • ?ResetData@CInclusionFilePathConfig@@QEAAXXZ
    • ?ResetData@CInclusionFolderConfig@@QEAAXXZ
    • ?RestoreCR0@@YAXPEAX@Z
    • ?Run@CAutoUpdateConfigThread@@UEAAXXZ
    • ?Run@CDelayLoadThread@@UEAAXXZ
    • ?Run@CWorkerThread@@UEAAXXZ
    • ?SeekToEnd@CFile@@QEAAJXZ
    • ?Set@CKEvent@@QEAAJJE@Z
    • ?SetAttributes@CFile@@QEAAJK@Z
    • ?SetBlobCofig@CContext@@UEAAJKPEAXK@Z
    • ?SetData@CBlobConfig@@QEAAHPEAXK@Z
    • ?SetData@CModuleFileExtConfig@@QEAAHPEBG@Z
    • ?SetData@CModuleFlagConfig@@QEAAHK@Z
    • ?SetData@CModuleMultiStringConfig@@QEAAHPEBGK@Z
    • ?SetData@CModuleStringConfig@@QEAAHPEBG@Z
    • ?SetEngineContext@CContext@@QEAAXPEAX@Z
    • ?SetFileExtensionConfig@CContext@@UEAAJKPEBG@Z
    • ?SetFlagConfig@CContext@@UEAAJKK@Z
    • ?SetLinkContext@CContext@@QEAAXPEAX@Z
    • ?SetLogFlag@CDebugLog@@QEAAEK@Z
    • ?SetLogFlag@CDebugLogEx@@QEAAEK@Z
    • ?SetMatchAllExtensions@CFileExtension@@QEAAXE@Z
    • ?SetMatchNoExtensions@CFileExtension@@QEAAXE@Z
    • ?SetMultiStringConfig@CContext@@UEAAJKPEBG@Z
    • ?SetNewJobItemEvent@CWorkerThreadJobQueue@@QEAAXXZ
    • ?SetPriority@CSystemThread@@QEAAXK@Z
    • ?SetStopUse@CContext@@QEAAXXZ
    • ?SetStringConfig@CContext@@UEAAJKPEBG@Z
    • ?Setup@CSystemThread@@MEAAXXZ
    • ?StopUse@CContext@@QEAAHXZ
    • ?TearDown@CSystemThread@@MEAAXXZ
    • ?Terminate@CSystemThread@@QEAAXE@Z
    • ?Terminate@CWorkerThreadPool@@QEAAEXZ
    • ?Terminate@CWorkerThreadPoolEx@@QEAAEXZ
    • ?TmExceptionFilter@@YAJPEAU_EXCEPTION_POINTERS@@@Z
    • ?Wait@CKEvent@@QEAAJPEAT_LARGE_INTEGER@@E@Z
    • ?WaitFinish@CWorkerThreadJob@@QEAAXXZ
    • ?WaitForInit@CDelayLoadThread@@QEAAEXZ
    • ?WaitForLoad@CDelayLoadThread@@QEAAEXZ
    • ?WaitNewJobAvailable@CWorkerThreadJobQueue@@QEAAEXZ
    • ?WaitQueueEmpty@CWorkerThreadJobQueue@@QEAAXXZ
    • ?Write@CDebugLog@@QEAAXPEBDZZ
    • ?Write@CDebugLogEx@@QEAAXPEBDZZ
    • ?Write@CFile@@QEAAJPEADKPEAT_LARGE_INTEGER@@PEAK@Z
    • ?WriteDataToFile@CDebugLogEx@@IEAAXPEADK@Z
    • ?WriteDataToProcMonW@CDebugLogEx@@IEAAXPEAD@Z
    • ?WriteSystemInformation@CDebugLog@@QEAAXXZ
    • ?WriteSystemInformation@CDebugLogEx@@QEAAXXZ
    • ?WriteSystemStringInformation@CDebugLog@@IEAAXPEBG@Z
    • ?WriteSystemStringInformation@CDebugLogEx@@IEAAXPEBG@Z
    • ?WriteToFile@CDebugLog@@IEAAXPEADK@Z
    • ?WriteToProcMonW@CDebugLogEx@@IEAAXPEAU_UNICODE_STRING@@@Z
    • ?_pNonPagedAllocator@@3PEAVCMemoryAllocator@@EA
    • ?_pPagedAllocator@@3PEAVCMemoryAllocator@@EA
    • ?m_lpInstance@CWorkerThreadPool@@1PEAV1@EA
    • ?m_lpRCMInstance@CWorkerThreadPool@@1PEAV1@EA
    • DeInitKm2UmCommunication
    • DeInitKmLPC
    • DuplicateFullFileName
    • FreeFullFileName
    • GetKm2UmMode
    • GetModuleInfoByAddress
    • GetModuleInfoByModuleName
    • InitKm2UmCommunication
    • InitKmLPC
    • IsVerifierCodeCheckFlagOn
    • IsWindows8_1_update
    • KmCallUm
    • KmCallUmByLPC
    • KmCallUmEx
    • KmCleanupCommPortAPIs
    • KmGetUmInitProcess
    • KmSetCommPortAPIs
    • ModGetExportProcAddress
    • ModLoadDLLToBuffer
    • ModLoadDLLToBufferWithImageSize
    • ModLoadModule
    • ModUnLoadModule
    • NormalizeFileName
    • NormalizeFullNtPathToDosName
    • TmCommConfigRoutine
    • UtilAddDeviceInDriveTable
    • UtilAddReparsePointMapping
    • UtilCleanFileReadOnly
    • UtilCloseExclusiveHandle
    • UtilCreateDosFileName
    • UtilDeleteFileForce
    • UtilGetDeviceObjectName
    • UtilGetFileNameFromFileObject
    • UtilGetFileObjectForProcessByEPROC
    • UtilGetFileObjectFromFileName
    • UtilGetProcessName
    • UtilGetSystemDirectory
    • UtilGetSystemDirectoryEx
    • UtilGetSystemDirectoryLength
    • UtilGetSystemTime
    • UtilIoSetFileInfo
    • UtilIopCreateFileIRP
    • UtilKeGetLowFileDevice
    • UtilModuleIATHook
    • UtilModuleIATUnHook
    • UtilPostJobToWorkerThread
    • UtilQueryExclusiveHandle
    • UtilQueryKeyValue
    • UtilRemoveDeviceFromDriveTable
    • UtilVolumeDeviceToDosName
    • UtilWaitValueChangeToZero
    • UtilWriteVersionToRegistry
    • UtilbuildDynamicDiskMappingTable
    • UtlWriteBinValueKeyToRegistry
    • ValidateAddressWithSize
    • _ResetProtectFromClose
    • _UtilDosPathNameToNtPathName

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • .pdata
    • PAGE
    • .edata
    • INIT
    • .rsrc
    • .reloc

    Signature

    Expand
    {
      "Certificates": [
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
          "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
          "TBS": {
            "MD5": "d0785ad36e427c92b19f6826ab1e8020",
            "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
            "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
            "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
          },
          "ValidFrom": "2012-12-21 00:00:00",
          "ValidTo": "2020-12-30 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
          "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
          "TBS": {
            "MD5": "e9d38360b914c8863f6cba3ee58764d3",
            "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
            "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
            "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
          },
          "ValidFrom": "2012-10-18 00:00:00",
          "ValidTo": "2020-12-29 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
          "TBS": {
            "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
            "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
            "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
            "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
          },
          "ValidFrom": "2017-04-27 00:00:00",
          "ValidTo": "2018-07-16 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "611993e400000000001c",
          "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
          "TBS": {
            "MD5": "78a717e082dcc1cda3458d917e677d14",
            "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
            "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
            "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
          },
          "ValidFrom": "2011-02-22 19:25:17",
          "ValidTo": "2021-02-22 19:35:17",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
          "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "TBS": {
            "MD5": "b30c31a572b0409383ed3fbe17e56e81",
            "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
            "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
            "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
          },
          "ValidFrom": "2010-02-08 00:00:00",
          "ValidTo": "2020-02-07 23:59:59",
          "Version": 3
        }
      ],
      "CertificatesInfo": "",
      "Signer": [
        {
          "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Version": 1
        }
      ],
      "SignerInfo": ""
    }
    

    PropertyValue
    FilenameTmComm.sys
    Creation Timestamp2015-12-03 06:29:37
    MD5e3aaa0c1c3a5e99eb9970ebe4b5a3183
    SHA18fafd70bae94bbc22786c9328ee9126fed54dbae
    SHA2561c1251784e6f61525d0082882a969cb8a0c5d5359be22f5a73e3b0cd38b51687
    Authentihash MD5257904eecb49998ecad8b3d2acee8344
    Authentihash SHA17f7110dcca30c2110d31f5a875305d52dac0db49
    Authentihash SHA2563847a1ed764ba25361a1748761fd9a1cbb65e42db00094f8ad6def9ac5da4116
    RichPEHeaderHash MD5baada9343cbaf3c9fea4ef77c7273bfb
    RichPEHeaderHash SHA14c6b0ced9400f041538de6302dd3259a0e3e067c
    RichPEHeaderHash SHA2564eb67ab524a9d7f44e010b8a29c08d68801262325b6d99adabb130d91438ebd3
    CompanyTrend Micro Inc.
    DescriptionTrendMicro Common Module
    ProductTrend Micro Eyes
    OriginalFilenameTmComm.sys

    Download

    Certificates

    Expand
    Certificate 009feac811b0f16247a5fc20d80523ace6
    FieldValue
    ToBeSigned (TBS) MD5b6aa9cf28bcfc9f07ec1069fb425ab61
    ToBeSigned (TBS) SHA1ca7a166fcd53878ba5a38d4cac37c63513cfc1fa
    ToBeSigned (TBS) SHA256711394fc49f8948a831f687d42ced6b18514f57786ecc6cdbc3c3eb72e568a40
    SubjectC=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO Time Stamping Signer
    ValidFrom2015-05-05 00:00:00
    ValidTo2015-12-31 23:59:59
    Signature0dbbad60111bb5f00dcce6483a7a3e0e33dc1cb9ead620fea34dd0cc764ee818d879dfd34f9a4264238a29728a3a6c66a63c3a17a8704565c673c3d0ce8954fbac690f58b019cb869f7eb97eeb5192bf9bddebd165f0257b887cdebda5c8b51451bcc081308a85387be679fe67559387fe4fe88d0eedf37292b5c289806dd159e31d0deab138ee039d0019a5ab219b79c3ccc23e687ebdc94d694db46451fbb22874e25389ce9dfaade2dbceab7b7e064474fd0aa3c9b7a730cd49d29264f122a6b828457479e9a7ce3b33f98350947d68c01d49c760787a3c6426d5befa0a6de41ee109538fa9c523acc79d614221f02c1671493b10af2c6f1ae631f114fd6c
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber009feac811b0f16247a5fc20d80523ace6
    Version3
    Certificate 250ce8e030612e9f2b89f7054d7cf8fd
    FieldValue
    ToBeSigned (TBS) MD5918d9eb6a6cd36c531eceb926170a7e1
    ToBeSigned (TBS) SHA10ae95700d65e6f59715aa47048993ca7858e676a
    ToBeSigned (TBS) SHA25647c46e6eaa3780eace3d0d891346cd373359d246b21a957219dbab4c8f37c166
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
    ValidFrom2006-11-08 00:00:00
    ValidTo2021-11-07 23:59:59
    Signature1302ddf8e88600f25af8f8200c59886207cecef74ef9bb59a198e5e138dd4ebc6618d3adeb18f20dc96d3e4a9420c33cbabd6554c6af44b310ad2c6b3eabd707b6b88163c5f95e2ee52a67cecd330c2ad7895603231fb3bee83a0859b4ec4535f78a5bff66cf50afc66d578d1978b7b9a2d157ea1f9a4bafbac98e127ec6bdff
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber250ce8e030612e9f2b89f7054d7cf8fd
    Version3
    Certificate 610c120600000000001b
    FieldValue
    ToBeSigned (TBS) MD553c41bc1164e09e0cd1617a5bf913efd
    ToBeSigned (TBS) SHA193c03aac8951d494ecd5696b1c08658541b18727
    ToBeSigned (TBS) SHA25640bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b
    SubjectC=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
    ValidFrom2006-05-23 17:01:29
    ValidTo2016-05-23 17:11:29
    Signature01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber610c120600000000001b
    Version3
    Certificate 1519396ee230f02cad1fcfdb077a35f0
    FieldValue
    ToBeSigned (TBS) MD57e2a6f93403382b4ec42463426d0a4b5
    ToBeSigned (TBS) SHA162acc697c0e2dc37f3d37ab79751637346e051e2
    ToBeSigned (TBS) SHA2563e9a51973a839e5bc6e81c886e085b777d08ce2b24f816b7552cf2c44e322d59
    SubjectC=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.
    ValidFrom2015-02-20 00:00:00
    ValidTo2016-05-21 23:59:59
    Signaturee480eb7f78216a855e34dbcb712d3879d6b1744c823c8e78c3661e55182a5c1f3a03686169393ef8778c893a49604a79769f5ba7156426c5431ae729a8dc5f8e22b14d124e46eff3f4f660552a57250a15e15d07ad548a02cddf8a204b5010be387a05b1019f618cf15078d80a809a7272b1822a63862c7db194f12697a786001ef630ac9d8bf9f5475191f327b8ed4839dff1ef65e5eb8f91379a66366451f99cb633848c57d4392096e6080fa327b23fc3834ad4f6043904d6c5aeb35454a265b3fda38167cffa8394f092a74bad1ea386f63b7baeb95271a97fc3bff0a2bc96a834f280a254d7170e5cc2830f3bd0649178f8b04514ecd1103753b1762902
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber1519396ee230f02cad1fcfdb077a35f0
    Version3
    Certificate 5200e5aa2556fc1a86ed96c9d44b33c7
    FieldValue
    ToBeSigned (TBS) MD5b30c31a572b0409383ed3fbe17e56e81
    ToBeSigned (TBS) SHA14843a82ed3b1f2bfbee9671960e1940c942f688d
    ToBeSigned (TBS) SHA25603cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
    ValidFrom2010-02-08 00:00:00
    ValidTo2020-02-07 23:59:59
    Signature5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber5200e5aa2556fc1a86ed96c9d44b33c7
    Version3

    Imports

    Expand
    • ntoskrnl.exe
    • HAL.dll
    • CLASSPNP.SYS

    Imported Functions

    Expand
    • wcsrchr
    • KeSetEvent
    • KePulseEvent
    • KeClearEvent
    • KeInitializeSemaphore
    • KeWaitForSingleObject
    • KeReleaseSemaphore
    • KeStackAttachProcess
    • KeUnstackDetachProcess
    • RtlSubAuthoritySid
    • RtlInitializeSid
    • ExAllocatePoolWithTag
    • RtlLengthRequiredSid
    • ExFreePoolWithTag
    • RtlSetDaclSecurityDescriptor
    • RtlCreateSecurityDescriptor
    • RtlAddAccessAllowedAce
    • RtlCreateAcl
    • ObfDereferenceObject
    • ZwSetEvent
    • ZwClose
    • ZwRequestWaitReplyPort
    • ProbeForWrite
    • ZwFreeVirtualMemory
    • ZwAllocateVirtualMemory
    • ObOpenObjectByPointer
    • PsProcessType
    • memmove
    • ZwConnectPort
    • RtlInitUnicodeString
    • RtlUnicodeStringToInteger
    • ZwCreateSection
    • ZwWaitForSingleObject
    • ZwOpenEvent
    • ObfReferenceObject
    • IoGetCurrentProcess
    • DbgBreakPoint
    • PsGetProcessExitTime
    • MmSectionObjectType
    • PsThreadType
    • MmGetSystemRoutineAddress
    • DbgPrint
    • memset
    • MmIsAddressValid
    • ExInitializeResourceLite
    • ExDeleteResourceLite
    • ZwWriteFile
    • ZwReadFile
    • ZwQueryInformationFile
    • ZwSetInformationFile
    • ZwCreateFile
    • swprintf
    • towupper
    • _wcsnicmp
    • KeInitializeEvent
    • _snprintf
    • PsGetCurrentProcessId
    • RtlTimeToTimeFields
    • ExSystemTimeToLocalTime
    • KeQuerySystemTime
    • ZwCreateKey
    • ZwCreateEvent
    • KeWaitForMultipleObjects
    • ObReferenceObjectByHandle
    • ZwNotifyChangeKey
    • PsGetCurrentThreadId
    • _vsnprintf
    • KeSetPriorityThread
    • PsTerminateSystemThread
    • PsCreateSystemThread
    • KeNumberProcessors
    • ZwQueryInformationProcess
    • PsLookupProcessByProcessId
    • KeDelayExecutionThread
    • ZwOpenDirectoryObject
    • PsSetCreateProcessNotifyRoutine
    • ZwQuerySystemInformation
    • ZwQueryDirectoryFile
    • ZwQueryDirectoryObject
    • ZwDuplicateObject
    • ZwOpenKey
    • ZwEnumerateKey
    • ZwEnumerateValueKey
    • ZwQueryValueKey
    • ZwDeleteValueKey
    • ZwDeleteKey
    • ExGetPreviousMode
    • ZwTerminateProcess
    • ZwOpenProcess
    • ZwQueryKey
    • ZwSetValueKey
    • IoFileObjectType
    • memcpy
    • ZwQuerySecurityObject
    • ZwSetSecurityObject
    • RtlLengthSecurityDescriptor
    • MmHighestUserAddress
    • IoFreeIrp
    • _purecall
    • MmUnlockPages
    • IoBuildAsynchronousFsdRequest
    • _strnicmp
    • RtlQueryRegistryValues
    • RtlAppendUnicodeToString
    • mbstowcs
    • ZwQuerySymbolicLinkObject
    • ZwOpenSymbolicLinkObject
    • NtClose
    • ZwSetInformationObject
    • _stricmp
    • ZwUnmapViewOfSection
    • ZwMapViewOfSection
    • ZwOpenFile
    • RtlEqualUnicodeString
    • IoCreateFile
    • IofCallDriver
    • IoAllocateIrp
    • MmBuildMdlForNonPagedPool
    • IoAllocateMdl
    • ProbeForRead
    • PsGetVersion
    • RtlCopyUnicodeString
    • RtlFreeUnicodeString
    • RtlCompareMemory
    • RtlUpcaseUnicodeString
    • _snwprintf
    • RtlImageNtHeader
    • RtlAnsiStringToUnicodeString
    • RtlInitAnsiString
    • strrchr
    • ZwQueryVolumeInformationFile
    • ObReferenceObjectByPointer
    • ObQueryNameString
    • IoBuildDeviceIoControlRequest
    • IofCompleteRequest
    • ExEventObjectType
    • _allmul
    • IoDeleteDevice
    • IoDeleteSymbolicLink
    • IoCreateSymbolicLink
    • IoGetDeviceObjectPointer
    • RtlUpperChar
    • RtlCompareUnicodeString
    • strncpy
    • KeServiceDescriptorTable
    • NtOpenProcess
    • ObOpenObjectByName
    • IoDriverObjectType
    • RtlAppendUnicodeStringToString
    • NtQueryInformationProcess
    • IoThreadToProcess
    • PsIsThreadTerminating
    • KeAddSystemServiceTable
    • ZwQueryObject
    • ObInsertObject
    • IoReleaseVpbSpinLock
    • IoAcquireVpbSpinLock
    • SeCreateAccessState
    • IoGetFileObjectGenericMapping
    • ObCreateObject
    • _allshr
    • ExInterlockedPopEntrySList
    • IoGetStackLimits
    • IoBuildSynchronousFsdRequest
    • MmSystemRangeStart
    • wcsstr
    • IoUnregisterPlugPlayNotification
    • FsRtlIsNameInExpression
    • IoGetConfigurationInformation
    • MmProbeAndLockPages
    • IoGetDeviceInterfaces
    • IoRegisterPlugPlayNotification
    • ExAllocatePool
    • RtlFreeAnsiString
    • RtlUnicodeStringToAnsiString
    • strncat
    • wcschr
    • wcsncat
    • wcstombs
    • KeTickCount
    • KeBugCheckEx
    • RtlUnwind
    • wcsncpy
    • ExReleaseResourceLite
    • ExAcquireResourceExclusiveLite
    • ExAcquireResourceSharedLite
    • ExReleaseFastMutexUnsafe
    • KeLeaveCriticalRegion
    • KeEnterCriticalRegion
    • _allrem
    • ExAcquireFastMutexUnsafe
    • IoDeviceObjectType
    • IoCreateDevice
    • RtlGetDaclSecurityDescriptor
    • RtlGetSaclSecurityDescriptor
    • RtlGetGroupSecurityDescriptor
    • RtlGetOwnerSecurityDescriptor
    • SeCaptureSecurityDescriptor
    • SeExports
    • IoIsWdmVersionAvailable
    • RtlLengthSid
    • RtlAbsoluteToSelfRelativeSD
    • IoFreeMdl
    • KeGetCurrentThread
    • KfAcquireSpinLock
    • KfReleaseSpinLock
    • KeRaiseIrqlToDpcLevel
    • KfLowerIrql
    • KeGetCurrentIrql
    • ExAcquireFastMutex
    • ExReleaseFastMutex
    • KfRaiseIrql
    • ClassInitialize

    Exported Functions

    Expand
    • ??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
    • ??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
    • ??0CBlobConfig@@QAE@ABV0@@Z
    • ??0CBlobConfig@@QAE@K@Z
    • ??0CContext@@QAE@ABV0@@Z
    • ??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
    • ??0CContextList@@QAE@ABV0@@Z
    • ??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CDebugLog@@QAE@ABV0@@Z
    • ??0CDebugLog@@QAE@PBG@Z
    • ??0CDelayLoadThread@@QAE@ABV0@@Z
    • ??0CDelayLoadThread@@QAE@XZ
    • ??0CExclusionExtConfig@@QAE@ABV0@@Z
    • ??0CExclusionExtConfig@@QAE@KKE@Z
    • ??0CExclusionFileNameConfig@@QAE@ABV0@@Z
    • ??0CExclusionFileNameConfig@@QAE@KK@Z
    • ??0CExclusionFilePathConfig@@QAE@ABV0@@Z
    • ??0CExclusionFilePathConfig@@QAE@KK@Z
    • ??0CExclusionFolderConfig@@QAE@ABV0@@Z
    • ??0CExclusionFolderConfig@@QAE@KK@Z
    • ??0CExclusionRegistryConfig@@QAE@ABV0@@Z
    • ??0CExclusionRegistryConfig@@QAE@KK@Z
    • ??0CFile@@QAE@ABV0@@Z
    • ??0CFile@@QAE@E@Z
    • ??0CFileExtension@@QAE@ABV0@@Z
    • ??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
    • ??0CInclusionExtConfig@@QAE@ABV0@@Z
    • ??0CInclusionExtConfig@@QAE@KKE@Z
    • ??0CInclusionFileNameConfig@@QAE@ABV0@@Z
    • ??0CInclusionFileNameConfig@@QAE@KK@Z
    • ??0CInclusionFilePathConfig@@QAE@ABV0@@Z
    • ??0CInclusionFilePathConfig@@QAE@KK@Z
    • ??0CInclusionFolderConfig@@QAE@ABV0@@Z
    • ??0CInclusionFolderConfig@@QAE@KK@Z
    • ??0CKEvent@@QAE@ABV0@@Z
    • ??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
    • ??0CList@@QAE@ABV0@@Z
    • ??0CList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CLockEvent@@QAE@ABV0@@Z
    • ??0CLockEvent@@QAE@XZ
    • ??0CLockList@@QAE@ABV0@@Z
    • ??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
    • ??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
    • ??0CMemoryAllocator@@QAE@ABV0@@Z
    • ??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
    • ??0CMemoryPoolAllocator@@QAE@ABV0@@Z
    • ??0CModuleConfig@@QAE@ABV0@@Z
    • ??0CModuleConfig@@QAE@XZ
    • ??0CModuleConfigList@@QAE@ABV0@@Z
    • ??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CModuleFileExtConfig@@QAE@ABV0@@Z
    • ??0CModuleFileExtConfig@@QAE@KKE@Z
    • ??0CModuleFlagConfig@@QAE@ABV0@@Z
    • ??0CModuleFlagConfig@@QAE@K@Z
    • ??0CModuleMultiStringConfig@@QAE@ABV0@@Z
    • ??0CModuleMultiStringConfig@@QAE@KK@Z
    • ??0CModuleStringConfig@@QAE@ABV0@@Z
    • ??0CModuleStringConfig@@QAE@K@Z
    • ??0CNoLockList@@QAE@ABV0@@Z
    • ??0CNoLockList@@QAE@KKPAVIMemoryAllocator@@@Z
    • ??0CSmartLock@@QAE@AAVCLockEvent@@@Z
    • ??0CSmartLock@@QAE@XZ
    • ??0CSmartReference@@QAE@AAJ@Z
    • ??0CSmartReference@@QAE@AAK@Z
    • ??0CSmartResource@@QAE@AAVCResource@@E@Z
    • ??0CStrList@@QAE@ABV0@@Z
    • ??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CSystemThread@@QAE@ABV0@@Z
    • ??0CSystemThread@@QAE@K@Z
    • ??0CUserFuncAdapterJob@@QAE@ABV0@@Z
    • ??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z0@Z
    • ??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
    • ??0CWorkerThread@@QAE@ABV0@@Z
    • ??0CWorkerThreadJob@@QAE@ABV0@@Z
    • ??0CWorkerThreadJob@@QAE@E@Z
    • ??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
    • ??0CWorkerThreadJobQueue@@QAE@K@Z
    • ??0CWorkerThreadPool@@QAE@ABV0@@Z
    • ??0CWorkerThreadPool@@QAE@K@Z
    • ??0IMemoryAllocator@@QAE@ABV0@@Z
    • ??0IMemoryAllocator@@QAE@XZ
    • ??1CAutoUpdateConfigThread@@UAE@XZ
    • ??1CBlobConfig@@UAE@XZ
    • ??1CContext@@UAE@XZ
    • ??1CContextList@@UAE@XZ
    • ??1CDebugLog@@UAE@XZ
    • ??1CDelayLoadThread@@UAE@XZ
    • ??1CExclusionExtConfig@@UAE@XZ
    • ??1CExclusionFileNameConfig@@UAE@XZ
    • ??1CExclusionFilePathConfig@@UAE@XZ
    • ??1CExclusionFolderConfig@@UAE@XZ
    • ??1CExclusionRegistryConfig@@UAE@XZ
    • ??1CFile@@UAE@XZ
    • ??1CFileExtension@@UAE@XZ
    • ??1CInclusionExtConfig@@UAE@XZ
    • ??1CInclusionFileNameConfig@@UAE@XZ
    • ??1CInclusionFilePathConfig@@UAE@XZ
    • ??1CInclusionFolderConfig@@UAE@XZ
    • ??1CKEvent@@UAE@XZ
    • ??1CList@@UAE@XZ
    • ??1CLockEvent@@UAE@XZ
    • ??1CLockList@@UAE@XZ
    • ??1CMemoryAllocator@@UAE@XZ
    • ??1CMemoryPoolAllocator@@UAE@XZ
    • ??1CModuleConfig@@UAE@XZ
    • ??1CModuleConfigList@@UAE@XZ
    • ??1CModuleFileExtConfig@@UAE@XZ
    • ??1CModuleFlagConfig@@UAE@XZ
    • ??1CModuleMultiStringConfig@@UAE@XZ
    • ??1CModuleStringConfig@@UAE@XZ
    • ??1CNoLockList@@UAE@XZ
    • ??1CSmartLock@@QAE@XZ
    • ??1CSmartReference@@QAE@XZ
    • ??1CSmartResource@@QAE@XZ
    • ??1CStrList@@UAE@XZ
    • ??1CSystemThread@@UAE@XZ
    • ??1CUserFuncAdapterJob@@UAE@XZ
    • ??1CWorkerThread@@UAE@XZ
    • ??1CWorkerThreadJob@@UAE@XZ
    • ??1CWorkerThreadJobQueue@@UAE@XZ
    • ??1CWorkerThreadPool@@UAE@XZ
    • ??1IMemoryAllocator@@UAE@XZ
    • ??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
    • ??2CMemoryAllocator@@SGPAXI@Z
    • ??2CMemoryPoolAllocator@@SGPAXI@Z
    • ??3@YAXPAX@Z
    • ??3IMemoryAllocator@@SGXPAX@Z
    • ??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
    • ??4CBlobConfig@@QAEAAV0@ABV0@@Z
    • ??4CContext@@QAEAAV0@ABV0@@Z
    • ??4CDebugLog@@QAEAAV0@ABV0@@Z
    • ??4CDelayLoadThread@@QAEAAV0@ABV0@@Z
    • ??4CFile@@QAEAAV0@ABV0@@Z
    • ??4CKEvent@@QAEAAV0@ABV0@@Z
    • ??4CLockEvent@@QAEAAV0@ABV0@@Z
    • ??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
    • ??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
    • ??4CModuleConfig@@QAEAAV0@ABV0@@Z
    • ??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
    • ??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
    • ??4CSmartLock@@QAEAAV0@ABV0@@Z
    • ??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
    • ??4CSmartResource@@QAEAAV0@ABV0@@Z
    • ??4CSystemThread@@QAEAAV0@ABV0@@Z
    • ??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
    • ??4CWorkerThread@@QAEAAV0@ABV0@@Z
    • ??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
    • ??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
    • ??_7CAutoUpdateConfigThread@@6B@
    • ??_7CBlobConfig@@6B@
    • ??_7CContext@@6B@
    • ??_7CContextList@@6B@
    • ??_7CDebugLog@@6B@
    • ??_7CDelayLoadThread@@6B@
    • ??_7CExclusionExtConfig@@6B@
    • ??_7CExclusionFileNameConfig@@6B@
    • ??_7CExclusionFilePathConfig@@6B@
    • ??_7CExclusionFolderConfig@@6B@
    • ??_7CExclusionRegistryConfig@@6B@
    • ??_7CFile@@6B@
    • ??_7CFileExtension@@6B@
    • ??_7CInclusionExtConfig@@6B@
    • ??_7CInclusionFileNameConfig@@6B@
    • ??_7CInclusionFilePathConfig@@6B@
    • ??_7CInclusionFolderConfig@@6B@
    • ??_7CKEvent@@6B@
    • ??_7CList@@6B@
    • ??_7CLockEvent@@6B@
    • ??_7CLockList@@6B@
    • ??_7CMemoryAllocator@@6B@
    • ??_7CMemoryPoolAllocator@@6B@
    • ??_7CModuleConfig@@6B@
    • ??_7CModuleConfigList@@6B@
    • ??_7CModuleFileExtConfig@@6B@
    • ??_7CModuleFlagConfig@@6B@
    • ??_7CModuleMultiStringConfig@@6B@
    • ??_7CModuleStringConfig@@6B@
    • ??_7CNoLockList@@6B@
    • ??_7CStrList@@6B@
    • ??_7CSystemThread@@6B@
    • ??_7CUserFuncAdapterJob@@6B@
    • ??_7CWorkerThread@@6B@
    • ??_7CWorkerThreadJob@@6B@
    • ??_7CWorkerThreadJobQueue@@6B@
    • ??_7CWorkerThreadPool@@6B@
    • ??_7IMemoryAllocator@@6B@
    • ??_FCContextList@@QAEXXZ
    • ??_FCFile@@QAEXXZ
    • ??_FCFileExtension@@QAEXXZ
    • ??_FCModuleConfigList@@QAEXXZ
    • ??_FCStrList@@QAEXXZ
    • ??_FCSystemThread@@QAEXXZ
    • ??_FCWorkerThread@@QAEXXZ
    • ??_FCWorkerThreadJob@@QAEXXZ
    • ??_FCWorkerThreadJobQueue@@QAEXXZ
    • ??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
    • ??_V@YAXPAX@Z
    • ?Acquire@CLockEvent@@QAEXXZ
    • ?Add@CContextList@@QAEEPAVCContext@@@Z
    • ?Add@CFileExtension@@QAEEPBGK@Z
    • ?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
    • ?Add@CStrList@@QAEEPBG@Z
    • ?AddNode@CLockList@@UAEEQAXE@Z
    • ?AddNode@CNoLockList@@UAEEQAXE@Z
    • ?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
    • ?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
    • ?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
    • ?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
    • ?Cancel@CWorkerThreadJob@@QAEXXZ
    • ?CheckNode@CLockList@@UAEHQAX@Z
    • ?CheckNode@CNoLockList@@UAEHQAX@Z
    • ?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
    • ?Cleanup@CBlobConfig@@AAEXXZ
    • ?Cleanup@CModuleFileExtConfig@@IAEXXZ
    • ?Cleanup@CModuleMultiStringConfig@@IAEXXZ
    • ?Cleanup@CModuleStringConfig@@AAEXXZ
    • ?Close@CFile@@QAEJXZ
    • ?Count@CLockList@@QAEKXZ
    • ?Count@CNoLockList@@QAEKXZ
    • ?Create@CFile@@QAEJPBGKKKK@Z
    • ?Create@CSystemThread@@QAEEXZ
    • ?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
    • ?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
    • ?CreatePool@CWorkerThreadPool@@QAEEXZ
    • ?CreateThreads@CWorkerThreadPool@@QAEEK@Z
    • ?CreateWIRP@CFile@@QAEJPBGKKKK@Z
    • ?Delete@CFile@@QAEJXZ
    • ?Delete@CFileExtension@@QAEEPBGK@Z
    • ?Delete@CStrList@@QAEEPBG@Z
    • ?DeleteAll@CList@@UAEXXZ
    • ?DeleteAll@CLockList@@UAEXXZ
    • ?DeleteAll@CNoLockList@@UAEXXZ
    • ?DeleteNode@CContextList@@MAEXPAX@Z
    • ?DeleteNode@CList@@UAEXPAX@Z
    • ?DeleteNode@CModuleConfigList@@MAEXPAX@Z
    • ?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
    • ?DisableWriteProtectFromCR0@@YGXPAPAX@Z
    • ?DoIt@CWorkerThreadJob@@QAEJXZ
    • ?EntryPoint@CSystemThread@@KGXPAX@Z
    • ?Find@CContextList@@QAEPAVCContext@@K@Z
    • ?Find@CContextList@@QAEPAVCContext@@PAX@Z
    • ?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
    • ?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
    • ?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
    • ?FindNode@CContextList@@IAEPAXPAX@Z
    • ?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
    • ?First@CList@@UAEPAXXZ
    • ?First@CLockList@@UAEPAXXZ
    • ?First@CNoLockList@@UAEPAXXZ
    • ?Free@CMemoryAllocator@@UAEXPAX@Z
    • ?Free@CMemoryPoolAllocator@@UAEXPAX@Z
    • ?GetAttributes@CFile@@QAEKXZ
    • ?GetBasicInfomration@CFile@@IAEJXZ
    • ?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
    • ?GetCategory@CContext@@QAEKXZ
    • ?GetData@CBlobConfig@@QAEHPAXPAK@Z
    • ?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
    • ?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
    • ?GetData@CModuleFlagConfig@@QAEKXZ
    • ?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
    • ?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
    • ?GetData@CModuleStringConfig@@QAEPAGXZ
    • ?GetData@CStrList@@QAEEPAGPAK@Z
    • ?GetDataType@CModuleConfig@@QAEKXZ
    • ?GetEngineContext@CContext@@QAEPAXXZ
    • ?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
    • ?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
    • ?GetFileSizeWIRP@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
    • ?GetFlagConfig@CContext@@UAEJKPAK@Z
    • ?GetID@CModuleConfig@@QAEKXZ
    • ?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
    • ?GetLength@CModuleStringConfig@@QAEKXZ
    • ?GetLinkContext@CContext@@QAEPAXXZ
    • ?GetLogFlag@CDebugLog@@QAEKXZ
    • ?GetModuleId@CModuleConfig@@QAEKXZ
    • ?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
    • ?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
    • ?GetReportCallBackRoutine@CContext@@QAEKXZ
    • ?GetSize@CBlobConfig@@QAEKXZ
    • ?GetStringConfig@CContext@@QAEPAGK@Z
    • ?GetStringConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetThreadCount@CWorkerThreadPool@@QAEKXZ
    • ?GetThreadID@CSystemThread@@QAEKXZ
    • ?GetType@CContext@@QAEKXZ
    • ?GetUserParameter@CContext@@QAEKXZ
    • ?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
    • ?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
    • ?InitializeFlagConfig@CContext@@QAEHKK@Z
    • ?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
    • ?InitializeStringConfig@CContext@@QAEHKPBG@Z
    • ?Insert@CList@@UAEXQAXE@Z
    • ?Insert@CLockList@@UAEXQAXE@Z
    • ?Insert@CNoLockList@@UAEXQAXE@Z
    • ?InsertAfter@CList@@UAEXPAX0@Z
    • ?InsertBefore@CList@@UAEXPAX0@Z
    • ?Instance@CWorkerThreadPool@@SGPAV1@XZ
    • ?IsEmpty@CList@@UAEEXZ
    • ?IsEmpty@CLockList@@UAEEXZ
    • ?IsEmpty@CNoLockList@@UAEEXZ
    • ?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
    • ?IsFull@CLockList@@QBEEXZ
    • ?IsFull@CNoLockList@@QBEEXZ
    • ?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionExtConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFileNameConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFilePathConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFolderConfig@@QAEEPBG@Z
    • ?IsOpened@CFile@@QAEEXZ
    • ?IsTerminated@CWorkerThreadPool@@QAEEXZ
    • ?IsValid@CMemoryAllocator@@UAEEXZ
    • ?IsValid@CMemoryPoolAllocator@@UAEEXZ
    • ?IsValid@IMemoryAllocator@@UAEEXZ
    • ?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
    • ?JobFunction@CUserFuncAdapterJob@@MAEXXZ
    • ?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
    • ?Limit@CLockList@@QAEKXZ
    • ?Limit@CNoLockList@@QAEKXZ
    • ?MatchAllExtensions@CFileExtension@@QAEEXZ
    • ?MatchNoExtensions@CFileExtension@@QAEEXZ
    • ?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
    • ?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
    • ?NeedDelete@CWorkerThreadJob@@QAEEXZ
    • ?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
    • ?NewNode@CList@@UAEPAXXZ
    • ?NewNode@CStrList@@EAEPAXXZ
    • ?NewNodeVariant@CList@@IAEPAXK@Z
    • ?Next@CList@@UBEPAXQAX@Z
    • ?Next@CLockList@@UBEPAXQAX@Z
    • ?Next@CNoLockList@@UBEPAXQAX@Z
    • ?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
    • ?NotityTerminate@CWorkerThread@@QAEXXZ
    • ?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
    • ?Pulse@CKEvent@@QAEJJE@Z
    • ?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
    • ?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
    • ?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
    • ?Read@CFile@@QAEJPADKPAK@Z
    • ?ReadWIRP@CFile@@QAEJPADKPAK@Z
    • ?ReferenceCount@CContext@@QAEAAKXZ
    • ?Release@CLockEvent@@QAEXXZ
    • ?Remove@CContextList@@UAEEQAX@Z
    • ?Remove@CList@@UAEEQAX@Z
    • ?Remove@CLockList@@UAEEQAX@Z
    • ?Remove@CNoLockList@@UAEEQAX@Z
    • ?RemoveHead@CList@@UAEPAXXZ
    • ?RemoveHead@CLockList@@UAEPAXXZ
    • ?RemoveHead@CNoLockList@@UAEPAXXZ
    • ?RemoveTail@CList@@UAEPAXXZ
    • ?RemoveTail@CLockList@@UAEPAXXZ
    • ?RemoveTail@CNoLockList@@UAEPAXXZ
    • ?Reset@CKEvent@@QAEXXZ
    • ?ResetData@CInclusionExtConfig@@QAEXXZ
    • ?ResetData@CInclusionFileNameConfig@@QAEXXZ
    • ?ResetData@CInclusionFilePathConfig@@QAEXXZ
    • ?ResetData@CInclusionFolderConfig@@QAEXXZ
    • ?RestoreCR0@@YGXPAX@Z
    • ?Run@CAutoUpdateConfigThread@@UAEXXZ
    • ?Run@CDelayLoadThread@@UAEXXZ
    • ?Run@CWorkerThread@@UAEXXZ
    • ?SeekToEnd@CFile@@QAEJXZ
    • ?Set@CKEvent@@QAEJJE@Z
    • ?SetAttributes@CFile@@QAEJK@Z
    • ?SetBlobCofig@CContext@@UAEJKPAXK@Z
    • ?SetData@CBlobConfig@@QAEHPAXK@Z
    • ?SetData@CModuleFileExtConfig@@QAEHPBG@Z
    • ?SetData@CModuleFlagConfig@@QAEHK@Z
    • ?SetData@CModuleMultiStringConfig@@QAEHPBGK@Z
    • ?SetData@CModuleStringConfig@@QAEHPBG@Z
    • ?SetEngineContext@CContext@@QAEXPAX@Z
    • ?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
    • ?SetFlagConfig@CContext@@UAEJKK@Z
    • ?SetLinkContext@CContext@@QAEXPAX@Z
    • ?SetLogFlag@CDebugLog@@QAEEK@Z
    • ?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
    • ?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
    • ?SetMultiStringConfig@CContext@@UAEJKPBG@Z
    • ?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
    • ?SetPriority@CSystemThread@@QAEXK@Z
    • ?SetStopUse@CContext@@QAEXXZ
    • ?SetStringConfig@CContext@@UAEJKPBG@Z
    • ?Setup@CSystemThread@@MAEXXZ
    • ?StopUse@CContext@@QAEHXZ
    • ?TearDown@CSystemThread@@MAEXXZ
    • ?Terminate@CSystemThread@@QAEXE@Z
    • ?Terminate@CWorkerThreadPool@@QAEEXZ
    • ?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
    • ?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
    • ?WaitFinish@CWorkerThreadJob@@QAEXXZ
    • ?WaitForInit@CDelayLoadThread@@QAEEXZ
    • ?WaitForLoad@CDelayLoadThread@@QAEEXZ
    • ?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
    • ?Write@CDebugLog@@QAAXPBDZZ
    • ?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
    • ?WriteSystemInformation@CDebugLog@@QAEXXZ
    • ?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
    • ?WriteToFile@CDebugLog@@IAEXPADK@Z
    • ?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
    • ?_pPagedAllocator@@3PAVCMemoryAllocator@@A
    • ?m_lpInstance@CWorkerThreadPool@@1PAV1@A
    • ?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
    • _DeInitKmLPC@0
    • _GetModuleInfoByAddress@8
    • _GetModuleInfoByModuleName@8
    • _InitKmLPC@0
    • _IsVerifierCodeCheckFlagOn@0
    • _IsWindows8_1_update@4
    • _KmCallUm@8
    • _KmCallUmEx@12
    • _ModGetExportProcAddress@8
    • _ModLoadDLLToBuffer@4
    • _ModLoadDLLToBufferWithImageSize@8
    • _ModLoadModule@8
    • _ModUnLoadModule@4
    • _NormalizeFileName@4
    • _NormalizeFullNtPathToDosName@4
    • _TmCommConfigRoutine@4
    • _UtilAddDeviceInDriveTable@4
    • _UtilCleanFileReadOnly@4
    • _UtilDeleteFileForce@4
    • _UtilGetFileObjectForProcessByEPROC@8
    • _UtilGetFileObjectFromFileName@12
    • _UtilGetProcessName@12
    • _UtilGetSystemDirectory@4
    • _UtilGetSystemDirectoryEx@0
    • _UtilGetSystemDirectoryLength@0
    • _UtilGetSystemTime@4
    • _UtilIoSetFileInfo@24
    • _UtilIopCreateFileIRP@40
    • _UtilKeGetLowFileDevice@16
    • _UtilModuleIATHook@24
    • _UtilModuleIATUnHook@8
    • _UtilQueryKeyValue@24
    • _UtilRemoveDeviceFromDriveTable@4
    • _UtilVolumeDeviceToDosName@8
    • _UtilWaitValueChangeToZero@8
    • _UtilWriteVersionToRegistry@8
    • _UtilbuildDynamicDiskMappingTable@0
    • _UtlWriteBinValueKeyToRegistry@16
    • __UtilDosPathNameToNtPathName@12

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • PAGE
    • .edata
    • INIT
    • .rsrc
    • .reloc

    Signature

    Expand
    {
      "Certificates": [
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
          "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
          "TBS": {
            "MD5": "d0785ad36e427c92b19f6826ab1e8020",
            "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
            "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
            "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
          },
          "ValidFrom": "2012-12-21 00:00:00",
          "ValidTo": "2020-12-30 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
          "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
          "TBS": {
            "MD5": "e9d38360b914c8863f6cba3ee58764d3",
            "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
            "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
            "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
          },
          "ValidFrom": "2012-10-18 00:00:00",
          "ValidTo": "2020-12-29 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
          "TBS": {
            "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
            "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
            "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
            "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
          },
          "ValidFrom": "2017-04-27 00:00:00",
          "ValidTo": "2018-07-16 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "611993e400000000001c",
          "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
          "TBS": {
            "MD5": "78a717e082dcc1cda3458d917e677d14",
            "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
            "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
            "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
          },
          "ValidFrom": "2011-02-22 19:25:17",
          "ValidTo": "2021-02-22 19:35:17",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
          "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "TBS": {
            "MD5": "b30c31a572b0409383ed3fbe17e56e81",
            "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
            "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
            "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
          },
          "ValidFrom": "2010-02-08 00:00:00",
          "ValidTo": "2020-02-07 23:59:59",
          "Version": 3
        }
      ],
      "CertificatesInfo": "",
      "Signer": [
        {
          "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Version": 1
        }
      ],
      "SignerInfo": ""
    }
    

    PropertyValue
    FilenameTmComm.sys
    Creation Timestamp2016-08-04 03:27:03
    MD55a615f4641287e5e88968f5455627d45
    SHA1dcfeca5e883a084e89ecd734c4528b922a1099b9
    SHA2562afdb3278a7b57466a103024aef9ff7f41c73a19bab843a8ebf3d3c4d4e82b30
    Authentihash MD5f9170d67a08b1a8f4e283615b4400773
    Authentihash SHA1e1e0a986b99795fa8c40328c5a01b5b8cbb9ca34
    Authentihash SHA256dd54115ef08b107691425e4c0bf94dc0ae7c522fba60a0ce3f574ebf4f5dbc5a
    RichPEHeaderHash MD55b33b237bab6e0b50320054616983177
    RichPEHeaderHash SHA1754c63349a54279bb01f24974f9faf6da8294d27
    RichPEHeaderHash SHA256001d9e469d2c4160f8fbff1c0aee013e72881cffb568910a2c1473a17bf858b2
    CompanyTrend Micro Inc.
    DescriptionTrendMicro Common Module
    ProductTrend Micro Eyes
    OriginalFilenameTmComm.sys

    Download

    Certificates

    Expand
    Certificate 1688f039255e638e69143907e6330b
    FieldValue
    ToBeSigned (TBS) MD50179e8ddeebaf8998fec419d65cdf13d
    ToBeSigned (TBS) SHA134c724c3369f2da8c25b591808962f66f10bde28
    ToBeSigned (TBS) SHA25635b0bac11602847aaab65fb35199d3c8976cde3ccf7e061b130177c712cbd92f
    SubjectC=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO SHA,1 Time Stamping Signer
    ValidFrom2015-12-31 00:00:00
    ValidTo2019-07-09 18:40:36
    Signatureba332440408c7cdb589fb36098b2f5c031feeb1f6e50f60ae0e4e681ad2687a2dffdb3daf473f300fb291b891b153edb6b52932bc4ac3981d73c67579a3936e028089ae3394f9b89097f7bc5617f598932250a6aae1a3ef0a227a8b6c3b887f7160448413d5cd8ec9f4d203104d965a1edcd690753163ddd36020a88eb40e506300bb8164bdcefbc5509ffc63e122e76b3dcce42eff97657e1b70a054098589a5d711693718c6581ea6ff389f7fb73adb4e7bfd98e6faa0b4f25f3b8e1d5dd75986881f8aac0d180c2c4c43989c1f6c99e6cd774f9d997f84fc29a0acd5e8ff819e9e0a59fc4f09221e62d7925c922f9c3f03a8457ad3a16f46394101d5dd0c6
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber1688f039255e638e69143907e6330b
    Version3
    Certificate 774d49c5649436de6bf3190a67eedcdf
    FieldValue
    ToBeSigned (TBS) MD5b3ca7d6b821d8e3432b29874980af55e
    ToBeSigned (TBS) SHA1618d7e55a24c1d8b65a0bcce79120c5e3b13fa4d
    ToBeSigned (TBS) SHA256c645c6a7dc7243a4a3f78a6569c029401a7bda8bc4732ce7198d9f21f19b12fa
    SubjectC=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.
    ValidFrom2016-03-29 00:00:00
    ValidTo2017-06-28 23:59:59
    Signature27351697f046d1d43fe306dff30b83e7a404e3e6431c1e06829c558d99eb3f21776021e3e1bd4e485aba08b89bb0972f23daa471d7b432a44a591270f9a838f13dbda32ee936c0df792cff8c493e1f27b2282b3d896ae7b4155ca1a50bf7111f3f4bbbe11f17cfe5d49c0589c210966ef7e567153e802d2e783ff498c59585598d9d3e93273d1e81c07ce85c0cfb24834d448c3930120f1686bd472d916ac8f9475acfdb27be8528311f668d71dfc132a0ff62df7baa575a0cc732b3de003beca214954d4d97cf9511b9329eccbb7b716675b31e543a43570080dffce3fc8ca8fbb17d954b9678e2d0c1e1710a5cf03952a687fede59dcba3bf98900f9934f12
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber774d49c5649436de6bf3190a67eedcdf
    Version3
    Certificate 611993e400000000001c
    FieldValue
    ToBeSigned (TBS) MD578a717e082dcc1cda3458d917e677d14
    ToBeSigned (TBS) SHA14a872e0e51f9b304469cd1dedb496ee9b8b983a4
    ToBeSigned (TBS) SHA256317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
    ValidFrom2011-02-22 19:25:17
    ValidTo2021-02-22 19:35:17
    Signature812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber611993e400000000001c
    Version3
    Certificate 5200e5aa2556fc1a86ed96c9d44b33c7
    FieldValue
    ToBeSigned (TBS) MD5b30c31a572b0409383ed3fbe17e56e81
    ToBeSigned (TBS) SHA14843a82ed3b1f2bfbee9671960e1940c942f688d
    ToBeSigned (TBS) SHA25603cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
    ValidFrom2010-02-08 00:00:00
    ValidTo2020-02-07 23:59:59
    Signature5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber5200e5aa2556fc1a86ed96c9d44b33c7
    Version3

    Imports

    Expand
    • ntoskrnl.exe
    • HAL.dll
    • CLASSPNP.SYS

    Imported Functions

    Expand
    • wcsrchr
    • KeSetEvent
    • KePulseEvent
    • KeClearEvent
    • KeStackAttachProcess
    • KeUnstackDetachProcess
    • ObfDereferenceObject
    • ZwSetEvent
    • ZwClose
    • ZwConnectPort
    • RtlInitUnicodeString
    • RtlUnicodeStringToInteger
    • ZwCreateSection
    • ZwWaitForSingleObject
    • ZwOpenEvent
    • IoGetCurrentProcess
    • ObfReferenceObject
    • DbgBreakPoint
    • ZwRequestWaitReplyPort
    • ExFreePoolWithTag
    • ProbeForWrite
    • ZwFreeVirtualMemory
    • ZwAllocateVirtualMemory
    • ObOpenObjectByPointer
    • PsProcessType
    • memmove
    • PsGetProcessExitTime
    • MmSectionObjectType
    • PsThreadType
    • ObReleaseObjectSecurity
    • SeReleaseSubjectContext
    • SeAccessCheck
    • SeCaptureSubjectContext
    • ObGetObjectSecurity
    • DbgPrint
    • memset
    • MmIsAddressValid
    • ExInitializeResourceLite
    • ExDeleteResourceLite
    • ZwWriteFile
    • ZwReadFile
    • ZwQueryInformationFile
    • ZwSetInformationFile
    • ZwCreateFile
    • swprintf
    • towupper
    • _wcsnicmp
    • ExAllocatePoolWithTag
    • KeInitializeEvent
    • _snprintf
    • PsGetCurrentProcessId
    • RtlTimeToTimeFields
    • ExSystemTimeToLocalTime
    • KeQuerySystemTime
    • PsGetCurrentThreadId
    • RtlInitAnsiString
    • ZwDeviceIoControlFile
    • ZwCreateKey
    • ZwCreateEvent
    • KeWaitForMultipleObjects
    • ObReferenceObjectByHandle
    • ZwNotifyChangeKey
    • _vsnprintf
    • RtlFreeUnicodeString
    • RtlAnsiStringToUnicodeString
    • RtlEqualUnicodeString
    • RtlAppendUnicodeStringToString
    • RtlCopyUnicodeString
    • RtlUpcaseUnicodeChar
    • ExGetPreviousMode
    • KeWaitForSingleObject
    • KeSetPriorityThread
    • PsTerminateSystemThread
    • PsCreateSystemThread
    • KeDelayExecutionThread
    • KeNumberProcessors
    • ZwQueryInformationProcess
    • PsLookupProcessByProcessId
    • ZwOpenDirectoryObject
    • PsSetCreateProcessNotifyRoutine
    • ZwQuerySystemInformation
    • ZwQueryDirectoryFile
    • ZwQueryDirectoryObject
    • ZwOpenKey
    • ZwEnumerateKey
    • ZwEnumerateValueKey
    • ZwQueryValueKey
    • ZwDeleteValueKey
    • ZwDeleteKey
    • ZwTerminateProcess
    • ZwOpenProcess
    • ZwQueryKey
    • ZwSetValueKey
    • IoFileObjectType
    • _allrem
    • ZwQuerySecurityObject
    • memcpy
    • RtlLengthSecurityDescriptor
    • MmHighestUserAddress
    • IoFreeIrp
    • IoFreeMdl
    • _purecall
    • IoBuildAsynchronousFsdRequest
    • _strnicmp
    • RtlQueryRegistryValues
    • RtlAppendUnicodeToString
    • mbstowcs
    • ZwQuerySymbolicLinkObject
    • ZwOpenSymbolicLinkObject
    • NtClose
    • ObQueryNameString
    • MmGetSystemRoutineAddress
    • ZwSetInformationObject
    • _stricmp
    • ZwUnmapViewOfSection
    • ZwMapViewOfSection
    • ZwOpenFile
    • IoCreateFile
    • IofCallDriver
    • IoAllocateIrp
    • MmBuildMdlForNonPagedPool
    • IoAllocateMdl
    • ProbeForRead
    • PsGetVersion
    • RtlImageNtHeader
    • RtlCompareMemory
    • RtlUpcaseUnicodeString
    • _snwprintf
    • MmSystemRangeStart
    • wcsncmp
    • strrchr
    • ZwQueryVolumeInformationFile
    • ObReferenceObjectByPointer
    • IoBuildDeviceIoControlRequest
    • ZwOpenSection
    • _allmul
    • KeReleaseSemaphore
    • RtlLengthRequiredSid
    • RtlInitializeSid
    • RtlSubAuthoritySid
    • RtlSetDaclSecurityDescriptor
    • RtlCreateSecurityDescriptor
    • RtlAddAccessAllowedAce
    • RtlCreateAcl
    • KeInitializeSemaphore
    • IofCompleteRequest
    • ExEventObjectType
    • IoDeleteDevice
    • IoDeleteSymbolicLink
    • IoCreateSymbolicLink
    • IoGetDeviceObjectPointer
    • RtlUpperChar
    • ObReferenceObjectByName
    • IoDriverObjectType
    • RtlCompareUnicodeString
    • strncpy
    • KeServiceDescriptorTable
    • NtOpenProcess
    • ObOpenObjectByName
    • NtQueryInformationProcess
    • PsIsThreadTerminating
    • KeAddSystemServiceTable
    • ZwFsControlFile
    • ObInsertObject
    • IoReleaseVpbSpinLock
    • IoAcquireVpbSpinLock
    • SeCreateAccessState
    • IoGetFileObjectGenericMapping
    • ObCreateObject
    • _allshr
    • ExInterlockedPopEntrySList
    • IoGetStackLimits
    • IoBuildSynchronousFsdRequest
    • wcsstr
    • IoUnregisterPlugPlayNotification
    • FsRtlIsNameInExpression
    • IoGetConfigurationInformation
    • MmProbeAndLockPages
    • IoGetDeviceInterfaces
    • IoRegisterPlugPlayNotification
    • ExAllocatePool
    • RtlFreeAnsiString
    • RtlUnicodeStringToAnsiString
    • strncat
    • wcschr
    • wcsncat
    • wcstombs
    • KeTickCount
    • KeBugCheckEx
    • RtlUnwind
    • wcsncpy
    • ExReleaseResourceLite
    • ExAcquireResourceExclusiveLite
    • ExAcquireResourceSharedLite
    • ExReleaseFastMutexUnsafe
    • KeLeaveCriticalRegion
    • KeEnterCriticalRegion
    • ZwSetSecurityObject
    • ExAcquireFastMutexUnsafe
    • IoDeviceObjectType
    • IoCreateDevice
    • RtlGetDaclSecurityDescriptor
    • RtlGetSaclSecurityDescriptor
    • RtlGetGroupSecurityDescriptor
    • RtlGetOwnerSecurityDescriptor
    • SeCaptureSecurityDescriptor
    • SeExports
    • IoIsWdmVersionAvailable
    • RtlLengthSid
    • RtlAbsoluteToSelfRelativeSD
    • MmUnlockPages
    • KeGetCurrentThread
    • KfAcquireSpinLock
    • KfReleaseSpinLock
    • KeRaiseIrqlToDpcLevel
    • KfLowerIrql
    • ExAcquireFastMutex
    • ExReleaseFastMutex
    • KeGetCurrentIrql
    • KfRaiseIrql
    • ClassInitialize

    Exported Functions

    Expand
    • ??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
    • ??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
    • ??0CBlobConfig@@QAE@ABV0@@Z
    • ??0CBlobConfig@@QAE@K@Z
    • ??0CContext@@QAE@ABV0@@Z
    • ??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
    • ??0CContextList@@QAE@ABV0@@Z
    • ??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CDebugLog@@QAE@ABV0@@Z
    • ??0CDebugLog@@QAE@PBG@Z
    • ??0CDebugLogEx@@QAE@ABV0@@Z
    • ??0CDebugLogEx@@QAE@K@Z
    • ??0CDelayLoadThread@@QAE@ABV0@@Z
    • ??0CDelayLoadThread@@QAE@XZ
    • ??0CExclusionExtConfig@@QAE@ABV0@@Z
    • ??0CExclusionExtConfig@@QAE@KKE@Z
    • ??0CExclusionFileNameConfig@@QAE@ABV0@@Z
    • ??0CExclusionFileNameConfig@@QAE@KK@Z
    • ??0CExclusionFilePathConfig@@QAE@ABV0@@Z
    • ??0CExclusionFilePathConfig@@QAE@KK@Z
    • ??0CExclusionFolderConfig@@QAE@ABV0@@Z
    • ??0CExclusionFolderConfig@@QAE@KK@Z
    • ??0CExclusionRegistryConfig@@QAE@ABV0@@Z
    • ??0CExclusionRegistryConfig@@QAE@KK@Z
    • ??0CFile@@QAE@ABV0@@Z
    • ??0CFile@@QAE@E@Z
    • ??0CFileExtension@@QAE@ABV0@@Z
    • ??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
    • ??0CInclusionExtConfig@@QAE@ABV0@@Z
    • ??0CInclusionExtConfig@@QAE@KKE@Z
    • ??0CInclusionFileNameConfig@@QAE@ABV0@@Z
    • ??0CInclusionFileNameConfig@@QAE@KK@Z
    • ??0CInclusionFilePathConfig@@QAE@ABV0@@Z
    • ??0CInclusionFilePathConfig@@QAE@KK@Z
    • ??0CInclusionFolderConfig@@QAE@ABV0@@Z
    • ??0CInclusionFolderConfig@@QAE@KK@Z
    • ??0CKEvent@@QAE@ABV0@@Z
    • ??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
    • ??0CList@@QAE@ABV0@@Z
    • ??0CList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CLockEvent@@QAE@ABV0@@Z
    • ??0CLockEvent@@QAE@XZ
    • ??0CLockList@@QAE@ABV0@@Z
    • ??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
    • ??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
    • ??0CMemoryAllocator@@QAE@ABV0@@Z
    • ??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
    • ??0CMemoryPoolAllocator@@QAE@ABV0@@Z
    • ??0CModuleConfig@@QAE@ABV0@@Z
    • ??0CModuleConfig@@QAE@XZ
    • ??0CModuleConfigList@@QAE@ABV0@@Z
    • ??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CModuleFileExtConfig@@QAE@ABV0@@Z
    • ??0CModuleFileExtConfig@@QAE@KKE@Z
    • ??0CModuleFlagConfig@@QAE@ABV0@@Z
    • ??0CModuleFlagConfig@@QAE@K@Z
    • ??0CModuleMultiStringConfig@@QAE@ABV0@@Z
    • ??0CModuleMultiStringConfig@@QAE@KK@Z
    • ??0CModuleStringConfig@@QAE@ABV0@@Z
    • ??0CModuleStringConfig@@QAE@K@Z
    • ??0CNoLockList@@QAE@ABV0@@Z
    • ??0CNoLockList@@QAE@KKPAVIMemoryAllocator@@@Z
    • ??0CSmartLock@@QAE@AAVCLockEvent@@@Z
    • ??0CSmartLock@@QAE@XZ
    • ??0CSmartReference@@QAE@AAJ@Z
    • ??0CSmartReference@@QAE@AAK@Z
    • ??0CSmartResource@@QAE@AAVCResource@@E@Z
    • ??0CStrList@@QAE@ABV0@@Z
    • ??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CSystemThread@@QAE@ABV0@@Z
    • ??0CSystemThread@@QAE@K@Z
    • ??0CUserFuncAdapterJob@@QAE@ABV0@@Z
    • ??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z01@Z
    • ??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
    • ??0CWorkerThread@@QAE@ABV0@@Z
    • ??0CWorkerThreadJob@@QAE@ABV0@@Z
    • ??0CWorkerThreadJob@@QAE@E@Z
    • ??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
    • ??0CWorkerThreadJobQueue@@QAE@K@Z
    • ??0CWorkerThreadPool@@QAE@ABV0@@Z
    • ??0CWorkerThreadPool@@QAE@K@Z
    • ??0CWorkerThreadPoolEx@@QAE@ABV0@@Z
    • ??0CWorkerThreadPoolEx@@QAE@KK@Z
    • ??0IMemoryAllocator@@QAE@ABV0@@Z
    • ??0IMemoryAllocator@@QAE@XZ
    • ??1CAutoUpdateConfigThread@@UAE@XZ
    • ??1CBlobConfig@@UAE@XZ
    • ??1CContext@@UAE@XZ
    • ??1CContextList@@UAE@XZ
    • ??1CDebugLog@@UAE@XZ
    • ??1CDebugLogEx@@UAE@XZ
    • ??1CDelayLoadThread@@UAE@XZ
    • ??1CExclusionExtConfig@@UAE@XZ
    • ??1CExclusionFileNameConfig@@UAE@XZ
    • ??1CExclusionFilePathConfig@@UAE@XZ
    • ??1CExclusionFolderConfig@@UAE@XZ
    • ??1CExclusionRegistryConfig@@UAE@XZ
    • ??1CFile@@UAE@XZ
    • ??1CFileExtension@@UAE@XZ
    • ??1CInclusionExtConfig@@UAE@XZ
    • ??1CInclusionFileNameConfig@@UAE@XZ
    • ??1CInclusionFilePathConfig@@UAE@XZ
    • ??1CInclusionFolderConfig@@UAE@XZ
    • ??1CKEvent@@UAE@XZ
    • ??1CList@@UAE@XZ
    • ??1CLockEvent@@UAE@XZ
    • ??1CLockList@@UAE@XZ
    • ??1CMemoryAllocator@@UAE@XZ
    • ??1CMemoryPoolAllocator@@UAE@XZ
    • ??1CModuleConfig@@UAE@XZ
    • ??1CModuleConfigList@@UAE@XZ
    • ??1CModuleFileExtConfig@@UAE@XZ
    • ??1CModuleFlagConfig@@UAE@XZ
    • ??1CModuleMultiStringConfig@@UAE@XZ
    • ??1CModuleStringConfig@@UAE@XZ
    • ??1CNoLockList@@UAE@XZ
    • ??1CSmartLock@@QAE@XZ
    • ??1CSmartReference@@QAE@XZ
    • ??1CSmartResource@@QAE@XZ
    • ??1CStrList@@UAE@XZ
    • ??1CSystemThread@@UAE@XZ
    • ??1CUserFuncAdapterJob@@UAE@XZ
    • ??1CWorkerThread@@UAE@XZ
    • ??1CWorkerThreadJob@@UAE@XZ
    • ??1CWorkerThreadJobQueue@@UAE@XZ
    • ??1CWorkerThreadPool@@UAE@XZ
    • ??1CWorkerThreadPoolEx@@UAE@XZ
    • ??1IMemoryAllocator@@UAE@XZ
    • ??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
    • ??2CMemoryAllocator@@SGPAXI@Z
    • ??2CMemoryPoolAllocator@@SGPAXI@Z
    • ??3@YAXPAX@Z
    • ??3IMemoryAllocator@@SGXPAX@Z
    • ??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
    • ??4CBlobConfig@@QAEAAV0@ABV0@@Z
    • ??4CContext@@QAEAAV0@ABV0@@Z
    • ??4CDebugLog@@QAEAAV0@ABV0@@Z
    • ??4CDebugLogEx@@QAEAAV0@ABV0@@Z
    • ??4CDelayLoadThread@@QAEAAV0@ABV0@@Z
    • ??4CFile@@QAEAAV0@ABV0@@Z
    • ??4CKEvent@@QAEAAV0@ABV0@@Z
    • ??4CLockEvent@@QAEAAV0@ABV0@@Z
    • ??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
    • ??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
    • ??4CModuleConfig@@QAEAAV0@ABV0@@Z
    • ??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
    • ??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
    • ??4CSmartLock@@QAEAAV0@ABV0@@Z
    • ??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
    • ??4CSmartResource@@QAEAAV0@ABV0@@Z
    • ??4CSystemThread@@QAEAAV0@ABV0@@Z
    • ??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
    • ??4CWorkerThread@@QAEAAV0@ABV0@@Z
    • ??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
    • ??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
    • ??_7CAutoUpdateConfigThread@@6B@
    • ??_7CBlobConfig@@6B@
    • ??_7CContext@@6B@
    • ??_7CContextList@@6B@
    • ??_7CDebugLog@@6B@
    • ??_7CDebugLogEx@@6B@
    • ??_7CDelayLoadThread@@6B@
    • ??_7CExclusionExtConfig@@6B@
    • ??_7CExclusionFileNameConfig@@6B@
    • ??_7CExclusionFilePathConfig@@6B@
    • ??_7CExclusionFolderConfig@@6B@
    • ??_7CExclusionRegistryConfig@@6B@
    • ??_7CFile@@6B@
    • ??_7CFileExtension@@6B@
    • ??_7CInclusionExtConfig@@6B@
    • ??_7CInclusionFileNameConfig@@6B@
    • ??_7CInclusionFilePathConfig@@6B@
    • ??_7CInclusionFolderConfig@@6B@
    • ??_7CKEvent@@6B@
    • ??_7CList@@6B@
    • ??_7CLockEvent@@6B@
    • ??_7CLockList@@6B@
    • ??_7CMemoryAllocator@@6B@
    • ??_7CMemoryPoolAllocator@@6B@
    • ??_7CModuleConfig@@6B@
    • ??_7CModuleConfigList@@6B@
    • ??_7CModuleFileExtConfig@@6B@
    • ??_7CModuleFlagConfig@@6B@
    • ??_7CModuleMultiStringConfig@@6B@
    • ??_7CModuleStringConfig@@6B@
    • ??_7CNoLockList@@6B@
    • ??_7CStrList@@6B@
    • ??_7CSystemThread@@6B@
    • ??_7CUserFuncAdapterJob@@6B@
    • ??_7CWorkerThread@@6B@
    • ??_7CWorkerThreadJob@@6B@
    • ??_7CWorkerThreadJobQueue@@6B@
    • ??_7CWorkerThreadPool@@6B@
    • ??_7CWorkerThreadPoolEx@@6B@
    • ??_7IMemoryAllocator@@6B@
    • ??_FCContextList@@QAEXXZ
    • ??_FCFile@@QAEXXZ
    • ??_FCFileExtension@@QAEXXZ
    • ??_FCModuleConfigList@@QAEXXZ
    • ??_FCStrList@@QAEXXZ
    • ??_FCSystemThread@@QAEXXZ
    • ??_FCWorkerThread@@QAEXXZ
    • ??_FCWorkerThreadJob@@QAEXXZ
    • ??_FCWorkerThreadJobQueue@@QAEXXZ
    • ??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
    • ??_V@YAXPAX@Z
    • ?Acquire@CLockEvent@@QAEXXZ
    • ?Add@CContextList@@QAEEPAVCContext@@@Z
    • ?Add@CFileExtension@@QAEEPBGK@Z
    • ?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
    • ?Add@CStrList@@QAEEPBG@Z
    • ?AddNode@CLockList@@UAEEQAXE@Z
    • ?AddNode@CNoLockList@@UAEEQAXE@Z
    • ?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
    • ?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
    • ?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
    • ?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
    • ?Cancel@CWorkerThreadJob@@QAEXXZ
    • ?CheckNode@CLockList@@UAEHQAX@Z
    • ?CheckNode@CNoLockList@@UAEHQAX@Z
    • ?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
    • ?Cleanup@CBlobConfig@@AAEXXZ
    • ?Cleanup@CModuleFileExtConfig@@IAEXXZ
    • ?Cleanup@CModuleMultiStringConfig@@IAEXXZ
    • ?Cleanup@CModuleStringConfig@@AAEXXZ
    • ?Close@CFile@@QAEJXZ
    • ?Count@CLockList@@QAEKXZ
    • ?Count@CNoLockList@@QAEKXZ
    • ?Create@CFile@@QAEJPBGKKKK@Z
    • ?Create@CSystemThread@@QAEEXZ
    • ?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
    • ?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
    • ?CreatePool@CWorkerThreadPool@@QAEEXZ
    • ?CreatePool@CWorkerThreadPoolEx@@QAEEXZ
    • ?CreateThreads@CWorkerThreadPool@@QAEEK@Z
    • ?CreateThreads@CWorkerThreadPoolEx@@QAEEK@Z
    • ?CreateWIRP@CFile@@QAEJPBGKKKK@Z
    • ?Delete@CFile@@QAEJXZ
    • ?Delete@CFileExtension@@QAEEPBGK@Z
    • ?Delete@CStrList@@QAEEPBG@Z
    • ?DeleteAll@CList@@UAEXXZ
    • ?DeleteAll@CLockList@@UAEXXZ
    • ?DeleteAll@CNoLockList@@UAEXXZ
    • ?DeleteNode@CContextList@@MAEXPAX@Z
    • ?DeleteNode@CList@@UAEXPAX@Z
    • ?DeleteNode@CModuleConfigList@@MAEXPAX@Z
    • ?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
    • ?DisableWriteProtectFromCR0@@YGXPAPAX@Z
    • ?DoIt@CWorkerThreadJob@@QAEJXZ
    • ?EntryPoint@CSystemThread@@KGXPAX@Z
    • ?Find@CContextList@@QAEPAVCContext@@K@Z
    • ?Find@CContextList@@QAEPAVCContext@@PAX@Z
    • ?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
    • ?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
    • ?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
    • ?FindNode@CContextList@@IAEPAXPAX@Z
    • ?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
    • ?FinishFunction@CUserFuncAdapterJob@@MAEXXZ
    • ?FinishIt@CWorkerThreadJob@@QAEJXZ
    • ?First@CList@@UAEPAXXZ
    • ?First@CLockList@@UAEPAXXZ
    • ?First@CNoLockList@@UAEPAXXZ
    • ?Free@CMemoryAllocator@@UAEXPAX@Z
    • ?Free@CMemoryPoolAllocator@@UAEXPAX@Z
    • ?GetAttributes@CFile@@QAEKXZ
    • ?GetBasicInfomration@CFile@@IAEJXZ
    • ?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
    • ?GetCategory@CContext@@QAEKXZ
    • ?GetData@CBlobConfig@@QAEHPAXPAK@Z
    • ?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
    • ?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
    • ?GetData@CModuleFlagConfig@@QAEKXZ
    • ?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
    • ?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
    • ?GetData@CModuleStringConfig@@QAEPAGXZ
    • ?GetData@CStrList@@QAEEPAGPAK@Z
    • ?GetDataType@CModuleConfig@@QAEKXZ
    • ?GetEngineContext@CContext@@QAEPAXXZ
    • ?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
    • ?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
    • ?GetFileSizeWIRP@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
    • ?GetFlagConfig@CContext@@UAEJKPAK@Z
    • ?GetID@CModuleConfig@@QAEKXZ
    • ?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
    • ?GetLength@CModuleStringConfig@@QAEKXZ
    • ?GetLinkContext@CContext@@QAEPAXXZ
    • ?GetLogFlag@CDebugLog@@QAEKXZ
    • ?GetLogFlag@CDebugLogEx@@QAEKXZ
    • ?GetModuleId@CModuleConfig@@QAEKXZ
    • ?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
    • ?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_KTHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_ETHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_KTHREAD@@XZ
    • ?GetReportCallBackRoutine@CContext@@QAEKXZ
    • ?GetSize@CBlobConfig@@QAEKXZ
    • ?GetStringConfig@CContext@@QAEPAGK@Z
    • ?GetStringConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetThreadCount@CWorkerThreadPool@@QAEKXZ
    • ?GetThreadCount@CWorkerThreadPoolEx@@QAEKXZ
    • ?GetThreadID@CSystemThread@@QAEKXZ
    • ?GetType@CContext@@QAEKXZ
    • ?GetUserParameter@CContext@@QAEKXZ
    • ?InitProcMon@CDebugLogEx@@IAEXXZ
    • ?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
    • ?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
    • ?InitializeFlagConfig@CContext@@QAEHKK@Z
    • ?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
    • ?InitializeStringConfig@CContext@@QAEHKPBG@Z
    • ?Insert@CList@@UAEXQAXE@Z
    • ?Insert@CLockList@@UAEXQAXE@Z
    • ?Insert@CNoLockList@@UAEXQAXE@Z
    • ?InsertAfter@CList@@UAEXPAX0@Z
    • ?InsertBefore@CList@@UAEXPAX0@Z
    • ?Instance@CWorkerThreadPool@@SGPAV1@XZ
    • ?IsEmpty@CList@@UAEEXZ
    • ?IsEmpty@CLockList@@UAEEXZ
    • ?IsEmpty@CNoLockList@@UAEEXZ
    • ?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
    • ?IsFull@CLockList@@QBEEXZ
    • ?IsFull@CNoLockList@@QBEEXZ
    • ?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionExtConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFileNameConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFilePathConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFolderConfig@@QAEEPBG@Z
    • ?IsOpened@CFile@@QAEEXZ
    • ?IsTerminated@CWorkerThreadPool@@QAEEXZ
    • ?IsTerminated@CWorkerThreadPoolEx@@QAEEXZ
    • ?IsValid@CMemoryAllocator@@UAEEXZ
    • ?IsValid@CMemoryPoolAllocator@@UAEEXZ
    • ?IsValid@IMemoryAllocator@@UAEEXZ
    • ?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
    • ?IsWorkerThread@CWorkerThreadPoolEx@@QAEEK@Z
    • ?JobFunction@CUserFuncAdapterJob@@MAEXXZ
    • ?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
    • ?JobQueue@CWorkerThreadPoolEx@@QAEAAVCWorkerThreadJobQueue@@XZ
    • ?Limit@CLockList@@QAEKXZ
    • ?Limit@CNoLockList@@QAEKXZ
    • ?MatchAllExtensions@CFileExtension@@QAEEXZ
    • ?MatchNoExtensions@CFileExtension@@QAEEXZ
    • ?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
    • ?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
    • ?NeedDelete@CWorkerThreadJob@@QAEEXZ
    • ?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
    • ?NewNode@CList@@UAEPAXXZ
    • ?NewNode@CStrList@@EAEPAXXZ
    • ?NewNodeVariant@CList@@IAEPAXK@Z
    • ?Next@CList@@UBEPAXQAX@Z
    • ?Next@CLockList@@UBEPAXQAX@Z
    • ?Next@CNoLockList@@UBEPAXQAX@Z
    • ?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
    • ?NotityTerminate@CWorkerThread@@QAEXXZ
    • ?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
    • ?PostJobToWorkerThread@CWorkerThreadPoolEx@@QAEJP6GXPAX@Z0E1@Z
    • ?Pulse@CKEvent@@QAEJJE@Z
    • ?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
    • ?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
    • ?QueueJobItem@CWorkerThreadPoolEx@@QAEJPAVCWorkerThreadJob@@@Z
    • ?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
    • ?Read@CFile@@QAEJPADKPAK@Z
    • ?ReadWIRP@CFile@@QAEJPADKPAK@Z
    • ?ReferenceCount@CContext@@QAEAAKXZ
    • ?Release@CLockEvent@@QAEXXZ
    • ?Remove@CContextList@@UAEEQAX@Z
    • ?Remove@CList@@UAEEQAX@Z
    • ?Remove@CLockList@@UAEEQAX@Z
    • ?Remove@CNoLockList@@UAEEQAX@Z
    • ?RemoveHead@CList@@UAEPAXXZ
    • ?RemoveHead@CLockList@@UAEPAXXZ
    • ?RemoveHead@CNoLockList@@UAEPAXXZ
    • ?RemoveTail@CList@@UAEPAXXZ
    • ?RemoveTail@CLockList@@UAEPAXXZ
    • ?RemoveTail@CNoLockList@@UAEPAXXZ
    • ?Reset@CKEvent@@QAEXXZ
    • ?ResetData@CInclusionExtConfig@@QAEXXZ
    • ?ResetData@CInclusionFileNameConfig@@QAEXXZ
    • ?ResetData@CInclusionFilePathConfig@@QAEXXZ
    • ?ResetData@CInclusionFolderConfig@@QAEXXZ
    • ?RestoreCR0@@YGXPAX@Z
    • ?Run@CAutoUpdateConfigThread@@UAEXXZ
    • ?Run@CDelayLoadThread@@UAEXXZ
    • ?Run@CWorkerThread@@UAEXXZ
    • ?SeekToEnd@CFile@@QAEJXZ
    • ?Set@CKEvent@@QAEJJE@Z
    • ?SetAttributes@CFile@@QAEJK@Z
    • ?SetBlobCofig@CContext@@UAEJKPAXK@Z
    • ?SetData@CBlobConfig@@QAEHPAXK@Z
    • ?SetData@CModuleFileExtConfig@@QAEHPBG@Z
    • ?SetData@CModuleFlagConfig@@QAEHK@Z
    • ?SetData@CModuleMultiStringConfig@@QAEHPBGK@Z
    • ?SetData@CModuleStringConfig@@QAEHPBG@Z
    • ?SetEngineContext@CContext@@QAEXPAX@Z
    • ?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
    • ?SetFlagConfig@CContext@@UAEJKK@Z
    • ?SetLinkContext@CContext@@QAEXPAX@Z
    • ?SetLogFlag@CDebugLog@@QAEEK@Z
    • ?SetLogFlag@CDebugLogEx@@QAEEK@Z
    • ?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
    • ?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
    • ?SetMultiStringConfig@CContext@@UAEJKPBG@Z
    • ?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
    • ?SetPriority@CSystemThread@@QAEXK@Z
    • ?SetStopUse@CContext@@QAEXXZ
    • ?SetStringConfig@CContext@@UAEJKPBG@Z
    • ?Setup@CSystemThread@@MAEXXZ
    • ?StopUse@CContext@@QAEHXZ
    • ?TearDown@CSystemThread@@MAEXXZ
    • ?Terminate@CSystemThread@@QAEXE@Z
    • ?Terminate@CWorkerThreadPool@@QAEEXZ
    • ?Terminate@CWorkerThreadPoolEx@@QAEEXZ
    • ?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
    • ?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
    • ?WaitFinish@CWorkerThreadJob@@QAEXXZ
    • ?WaitForInit@CDelayLoadThread@@QAEEXZ
    • ?WaitForLoad@CDelayLoadThread@@QAEEXZ
    • ?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
    • ?WaitQueueEmpty@CWorkerThreadJobQueue@@QAEXXZ
    • ?Write@CDebugLog@@QAAXPBDZZ
    • ?Write@CDebugLogEx@@QAAXPBDZZ
    • ?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
    • ?WriteDataToFile@CDebugLogEx@@IAEXPADK@Z
    • ?WriteDataToProcMonW@CDebugLogEx@@IAEXPAD@Z
    • ?WriteSystemInformation@CDebugLog@@QAEXXZ
    • ?WriteSystemInformation@CDebugLogEx@@QAEXXZ
    • ?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
    • ?WriteSystemStringInformation@CDebugLogEx@@IAEXPBG@Z
    • ?WriteToFile@CDebugLog@@IAEXPADK@Z
    • ?WriteToProcMonW@CDebugLogEx@@IAEXPAU_UNICODE_STRING@@@Z
    • ?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
    • ?_pPagedAllocator@@3PAVCMemoryAllocator@@A
    • ?m_lpInstance@CWorkerThreadPool@@1PAV1@A
    • ?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
    • _DeInitKm2UmCommunication@0
    • _DeInitKmLPC@0
    • _DuplicateFullFileName@4
    • _FreeFullFileName@4
    • _GetKm2UmMode@0
    • _GetModuleInfoByAddress@8
    • _GetModuleInfoByModuleName@8
    • _InitKm2UmCommunication@8
    • _InitKmLPC@0
    • _IsVerifierCodeCheckFlagOn@0
    • _IsWindows8_1_update@4
    • _KmCallUm@8
    • _KmCallUmByLPC@8
    • _KmCallUmEx@12
    • _KmCleanupCommPortAPIs@0
    • _KmGetUmInitProcess@0
    • _KmSetCommPortAPIs@4
    • _ModGetExportProcAddress@8
    • _ModLoadDLLToBuffer@4
    • _ModLoadDLLToBufferWithImageSize@8
    • _ModLoadModule@8
    • _ModUnLoadModule@4
    • _NormalizeFileName@4
    • _NormalizeFullNtPathToDosName@4
    • _TmCommConfigRoutine@4
    • _UtilAddDeviceInDriveTable@4
    • _UtilAddReparsePointMapping@8
    • _UtilCleanFileReadOnly@4
    • _UtilCloseExclusiveHandle@12
    • _UtilCreateDosFileName@8
    • _UtilDeleteFileForce@4
    • _UtilGetDeviceObjectName@8
    • _UtilGetFileNameFromFileObject@4
    • _UtilGetFileObjectForProcessByEPROC@8
    • _UtilGetFileObjectFromFileName@12
    • _UtilGetProcessName@12
    • _UtilGetSystemDirectory@4
    • _UtilGetSystemDirectoryEx@0
    • _UtilGetSystemDirectoryLength@0
    • _UtilGetSystemTime@4
    • _UtilIoSetFileInfo@24
    • _UtilIopCreateFileIRP@40
    • _UtilKeGetLowFileDevice@16
    • _UtilModuleIATHook@24
    • _UtilModuleIATUnHook@8
    • _UtilPostJobToWorkerThread@12
    • _UtilQueryExclusiveHandle@12
    • _UtilQueryKeyValue@24
    • _UtilRemoveDeviceFromDriveTable@4
    • _UtilVolumeDeviceToDosName@8
    • _UtilWaitValueChangeToZero@8
    • _UtilWriteVersionToRegistry@8
    • _UtilbuildDynamicDiskMappingTable@0
    • _UtlWriteBinValueKeyToRegistry@16
    • _ValidateAddressWithSize@20
    • __ResetProtectFromClose@4
    • __UtilDosPathNameToNtPathName@12

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • PAGE
    • .edata
    • INIT
    • .rsrc
    • .reloc

    Signature

    Expand
    {
      "Certificates": [
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
          "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
          "TBS": {
            "MD5": "d0785ad36e427c92b19f6826ab1e8020",
            "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
            "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
            "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
          },
          "ValidFrom": "2012-12-21 00:00:00",
          "ValidTo": "2020-12-30 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
          "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
          "TBS": {
            "MD5": "e9d38360b914c8863f6cba3ee58764d3",
            "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
            "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
            "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
          },
          "ValidFrom": "2012-10-18 00:00:00",
          "ValidTo": "2020-12-29 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
          "TBS": {
            "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
            "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
            "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
            "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
          },
          "ValidFrom": "2017-04-27 00:00:00",
          "ValidTo": "2018-07-16 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "611993e400000000001c",
          "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
          "TBS": {
            "MD5": "78a717e082dcc1cda3458d917e677d14",
            "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
            "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
            "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
          },
          "ValidFrom": "2011-02-22 19:25:17",
          "ValidTo": "2021-02-22 19:35:17",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
          "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "TBS": {
            "MD5": "b30c31a572b0409383ed3fbe17e56e81",
            "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
            "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
            "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
          },
          "ValidFrom": "2010-02-08 00:00:00",
          "ValidTo": "2020-02-07 23:59:59",
          "Version": 3
        }
      ],
      "CertificatesInfo": "",
      "Signer": [
        {
          "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Version": 1
        }
      ],
      "SignerInfo": ""
    }
    

    PropertyValue
    FilenameTmComm.sys
    Creation Timestamp2017-07-12 21:23:02
    MD585e606523ce390f7fcd8370d5f4b812a
    SHA155c64235d223baeb8577a2445fdaa6bedcde23db
    SHA256385485e643aa611e97ceae6590c6a8c47155886123dbb9de1e704d0d1624d039
    Authentihash MD5438eb42132c6fb062033d6effb62813c
    Authentihash SHA1e6c39b401e841e2351a9daa07b85abf679636f89
    Authentihash SHA2563ed3d54fb8222d861785f0d7e71d6223278fbf4d0baa335a54813087d7c3674e
    RichPEHeaderHash MD59700ee6a34ba2b25ddc817d1a0743be8
    RichPEHeaderHash SHA180283ee3a81f182a56da60791555c7a5ac734e1c
    RichPEHeaderHash SHA2567f352214a0d86b5a789492b8c5d18b8bb5fe7ec7145b883dbf27d6f1bc31a950
    CompanyTrend Micro Inc.
    DescriptionTrendMicro Common Module
    ProductTrend Micro Eyes
    OriginalFilenameTmComm.sys

    Download

    Certificates

    Expand
    Certificate 7e93ebfb7cc64e59ea4b9a77d406fc3b
    FieldValue
    ToBeSigned (TBS) MD5d0785ad36e427c92b19f6826ab1e8020
    ToBeSigned (TBS) SHA1365b7a9c21bd9373e49052c3e7b3e4646ddd4d43
    ToBeSigned (TBS) SHA256c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff
    SubjectC=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2
    ValidFrom2012-12-21 00:00:00
    ValidTo2020-12-30 23:59:59
    Signature03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber7e93ebfb7cc64e59ea4b9a77d406fc3b
    Version3
    Certificate 0ecff438c8febf356e04d86a981b1a50
    FieldValue
    ToBeSigned (TBS) MD5e9d38360b914c8863f6cba3ee58764d3
    ToBeSigned (TBS) SHA14cba8eae47b6bf76f20b3504b98b8f062694a89b
    ToBeSigned (TBS) SHA25688901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976
    SubjectC=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4
    ValidFrom2012-10-18 00:00:00
    ValidTo2020-12-29 23:59:59
    Signature783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber0ecff438c8febf356e04d86a981b1a50
    Version3
    Certificate 497c4fad471540e6e453d0cafb155740
    FieldValue
    ToBeSigned (TBS) MD578eaa337666217b1c16a9a0ebd0b8434
    ToBeSigned (TBS) SHA1ff9cb835e78f6185eed4372096c3bae53b17d18d
    ToBeSigned (TBS) SHA2561c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250
    SubjectC=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.
    ValidFrom2017-04-27 00:00:00
    ValidTo2018-07-16 23:59:59
    Signaturef3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber497c4fad471540e6e453d0cafb155740
    Version3
    Certificate 611993e400000000001c
    FieldValue
    ToBeSigned (TBS) MD578a717e082dcc1cda3458d917e677d14
    ToBeSigned (TBS) SHA14a872e0e51f9b304469cd1dedb496ee9b8b983a4
    ToBeSigned (TBS) SHA256317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
    ValidFrom2011-02-22 19:25:17
    ValidTo2021-02-22 19:35:17
    Signature812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber611993e400000000001c
    Version3
    Certificate 5200e5aa2556fc1a86ed96c9d44b33c7
    FieldValue
    ToBeSigned (TBS) MD5b30c31a572b0409383ed3fbe17e56e81
    ToBeSigned (TBS) SHA14843a82ed3b1f2bfbee9671960e1940c942f688d
    ToBeSigned (TBS) SHA25603cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
    ValidFrom2010-02-08 00:00:00
    ValidTo2020-02-07 23:59:59
    Signature5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber5200e5aa2556fc1a86ed96c9d44b33c7
    Version3

    Imports

    Expand
    • ntoskrnl.exe

    Imported Functions

    Expand
    • RtlInitUnicodeString
    • KeInitializeEvent
    • KeClearEvent
    • KeSetEvent
    • KeEnterCriticalRegion
    • KeLeaveCriticalRegion
    • KeWaitForSingleObject
    • ExFreePoolWithTag
    • ExAcquireFastMutexUnsafe
    • ExReleaseFastMutexUnsafe
    • ProbeForRead
    • ProbeForWrite
    • ExAcquireResourceSharedLite
    • ExAcquireResourceExclusiveLite
    • ExReleaseResourceLite
    • MmProbeAndLockPages
    • MmUnlockPages
    • MmMapLockedPagesSpecifyCache
    • IoAllocateMdl
    • IoFreeMdl
    • IoGetCurrentProcess
    • ObfReferenceObject
    • ObfDereferenceObject
    • ZwClose
    • ZwCreateSection
    • ZwOpenSection
    • ZwMapViewOfSection
    • ZwUnmapViewOfSection
    • ZwOpenEvent
    • KePulseEvent
    • KeStackAttachProcess
    • KeUnstackDetachProcess
    • ObOpenObjectByPointer
    • ZwAllocateVirtualMemory
    • ZwFreeVirtualMemory
    • ZwSetEvent
    • __C_specific_handler
    • PsProcessType
    • wcslen
    • wcsncpy
    • wcsrchr
    • RtlUnicodeStringToInteger
    • ZwWaitForSingleObject
    • ZwRequestWaitReplyPort
    • ZwConnectPort
    • _stricmp
    • ExAllocatePoolWithTag
    • MmIsAddressValid
    • RtlImageNtHeader
    • ZwQuerySystemInformation
    • SeCaptureSubjectContext
    • SeReleaseSubjectContext
    • SeAccessCheck
    • ObGetObjectSecurity
    • ObReleaseObjectSecurity
    • PsGetProcessExitTime
    • PsThreadType
    • MmSectionObjectType
    • RtlCreateSecurityDescriptor
    • RtlSetDaclSecurityDescriptor
    • KeInitializeSemaphore
    • KeReleaseSemaphore
    • ExAcquireFastMutex
    • ExReleaseFastMutex
    • RtlCreateAcl
    • RtlAddAccessAllowedAce
    • RtlLengthRequiredSid
    • RtlInitializeSid
    • RtlSubAuthoritySid
    • KeDelayExecutionThread
    • ExGetPreviousMode
    • DbgPrint
    • swprintf
    • RtlCopyUnicodeString
    • IofCompleteRequest
    • IoCreateSymbolicLink
    • IoDeleteDevice
    • IoDeleteSymbolicLink
    • ObReferenceObjectByHandle
    • PsGetCurrentProcessId
    • ZwCreateEvent
    • ExEventObjectType
    • _wcsnicmp
    • PsSetCreateProcessNotifyRoutine
    • ZwQueryInformationProcess
    • PsLookupProcessByProcessId
    • ZwOpenDirectoryObject
    • ExInitializeResourceLite
    • ExDeleteResourceLite
    • ZwCreateFile
    • ZwQueryInformationFile
    • ZwSetInformationFile
    • ZwReadFile
    • ZwWriteFile
    • towupper
    • MmGetSystemRoutineAddress
    • ObReferenceObjectByPointer
    • PsGetCurrentThreadId
    • ObQueryNameString
    • PsGetVersion
    • _snprintf
    • _vsnprintf
    • RtlInitAnsiString
    • wcscat
    • RtlFreeUnicodeString
    • RtlTimeToTimeFields
    • KeWaitForMultipleObjects
    • ExSystemTimeToLocalTime
    • ZwCreateKey
    • ZwDeviceIoControlFile
    • ZwNotifyChangeKey
    • ZwOpenFile
    • ZwQueryVolumeInformationFile
    • mbstowcs
    • IoGetDeviceObjectPointer
    • IoBuildDeviceIoControlRequest
    • IofCallDriver
    • IoCreateFile
    • RtlEqualUnicodeString
    • RtlAppendUnicodeStringToString
    • RtlUpcaseUnicodeChar
    • _snwprintf
    • strlen
    • _strnicmp
    • strncpy
    • NtOpenProcess
    • NtQueryInformationProcess
    • ObOpenObjectByName
    • KeSetPriorityThread
    • PsCreateSystemThread
    • PsTerminateSystemThread
    • KeNumberProcessors
    • RtlLengthSecurityDescriptor
    • ZwOpenKey
    • ZwDeleteKey
    • ZwDeleteValueKey
    • ZwEnumerateKey
    • ZwEnumerateValueKey
    • ZwQueryKey
    • ZwQueryValueKey
    • ZwSetValueKey
    • ZwTerminateProcess
    • ZwOpenProcess
    • ZwDuplicateObject
    • ZwQuerySecurityObject
    • ZwSetSecurityObject
    • ZwQueryDirectoryObject
    • ZwQueryDirectoryFile
    • NtCreateFile
    • NtQueryInformationFile
    • NtSetInformationFile
    • IoFileObjectType
    • ObInsertObject
    • wcschr
    • wcsncmp
    • RtlQueryRegistryValues
    • RtlAppendUnicodeToString
    • RtlCompareMemory
    • MmBuildMdlForNonPagedPool
    • IoAllocateIrp
    • IoFreeIrp
    • ZwOpenSymbolicLinkObject
    • ZwQuerySymbolicLinkObject
    • RtlUpcaseUnicodeString
    • NtClose
    • ZwSetInformationObject
    • SeQueryAuthenticationIdToken
    • MmSystemRangeStart
    • IoGetFileObjectGenericMapping
    • ObCreateObject
    • SeCreateAccessState
    • IoAcquireVpbSpinLock
    • IoReleaseVpbSpinLock
    • wcstombs
    • strncat
    • wcsncat
    • RtlUnicodeStringToAnsiString
    • RtlFreeAnsiString
    • strcpy
    • wcsstr
    • RtlCompareUnicodeString
    • DbgPrintEx
    • KeAcquireSpinLockRaiseToDpc
    • KeReleaseSpinLock
    • ExAllocatePool
    • ExpInterlockedPopEntrySList
    • IoBuildSynchronousFsdRequest
    • IoGetStackLimits
    • IoGetDeviceInterfaces
    • IoRegisterPlugPlayNotification
    • IoUnregisterPlugPlayNotification
    • IoGetConfigurationInformation
    • FsRtlIsNameInExpression
    • IoDeviceObjectType
    • IoCreateDevice
    • RtlGetOwnerSecurityDescriptor
    • RtlGetDaclSecurityDescriptor
    • RtlGetGroupSecurityDescriptor
    • RtlGetSaclSecurityDescriptor
    • SeCaptureSecurityDescriptor
    • RtlLengthSid
    • SeExports
    • IoIsWdmVersionAvailable
    • RtlAbsoluteToSelfRelativeSD
    • RtlAnsiStringToUnicodeString
    • _purecall
    • KeBugCheckEx

    Exported Functions

    Expand
    • ??0CAutoUpdateConfigThread@@QEAA@AEBV0@@Z
    • ??0CAutoUpdateConfigThread@@QEAA@PEAU_UNICODE_STRING@@P6AX0PEAX@Z1@Z
    • ??0CBlobConfig@@QEAA@AEBV0@@Z
    • ??0CBlobConfig@@QEAA@K@Z
    • ??0CContext@@QEAA@AEBV0@@Z
    • ??0CContext@@QEAA@KP6AJPEAU_EVENT_REPORT@@PEAXPEAU_TMCE_REPORT@@PEAU_TMCE_FEEDBACK@@@Z1K@Z
    • ??0CContextList@@QEAA@AEBV0@@Z
    • ??0CContextList@@QEAA@KPEAVIMemoryAllocator@@@Z
    • ??0CDebugLog@@QEAA@AEBV0@@Z
    • ??0CDebugLog@@QEAA@PEBG@Z
    • ??0CDebugLogEx@@QEAA@AEBV0@@Z
    • ??0CDebugLogEx@@QEAA@K@Z
    • ??0CDelayLoadThread@@QEAA@AEBV0@@Z
    • ??0CDelayLoadThread@@QEAA@XZ
    • ??0CExclusionExtConfig@@QEAA@AEBV0@@Z
    • ??0CExclusionExtConfig@@QEAA@KKE@Z
    • ??0CExclusionFileNameConfig@@QEAA@AEBV0@@Z
    • ??0CExclusionFileNameConfig@@QEAA@KK@Z
    • ??0CExclusionFilePathConfig@@QEAA@AEBV0@@Z
    • ??0CExclusionFilePathConfig@@QEAA@KK@Z
    • ??0CExclusionFolderConfig@@QEAA@AEBV0@@Z
    • ??0CExclusionFolderConfig@@QEAA@KK@Z
    • ??0CExclusionRegistryConfig@@QEAA@AEBV0@@Z
    • ??0CExclusionRegistryConfig@@QEAA@KK@Z
    • ??0CFile@@QEAA@AEBV0@@Z
    • ??0CFile@@QEAA@E@Z
    • ??0CFileExtension@@QEAA@AEBV0@@Z
    • ??0CFileExtension@@QEAA@KEEPEAVIMemoryAllocator@@@Z
    • ??0CInclusionExtConfig@@QEAA@AEBV0@@Z
    • ??0CInclusionExtConfig@@QEAA@KKE@Z
    • ??0CInclusionFileNameConfig@@QEAA@AEBV0@@Z
    • ??0CInclusionFileNameConfig@@QEAA@KK@Z
    • ??0CInclusionFilePathConfig@@QEAA@AEBV0@@Z
    • ??0CInclusionFilePathConfig@@QEAA@KK@Z
    • ??0CInclusionFolderConfig@@QEAA@AEBV0@@Z
    • ??0CInclusionFolderConfig@@QEAA@KK@Z
    • ??0CKEvent@@QEAA@AEBV0@@Z
    • ??0CKEvent@@QEAA@W4_EVENT_TYPE@@E@Z
    • ??0CList@@QEAA@AEBV0@@Z
    • ??0CList@@QEAA@KPEAVIMemoryAllocator@@@Z
    • ??0CLockEvent@@QEAA@AEBV0@@Z
    • ??0CLockEvent@@QEAA@XZ
    • ??0CLockList@@QEAA@AEBV0@@Z
    • ??0CLockList@@QEAA@KKPEAVIMemoryAllocator@@@Z
    • ??0CMemoryAllocator@@IEAA@W4_POOL_TYPE@@K@Z
    • ??0CMemoryAllocator@@QEAA@AEBV0@@Z
    • ??0CMemoryPoolAllocator@@IEAA@W4_POOL_TYPE@@_K1K@Z
    • ??0CMemoryPoolAllocator@@QEAA@AEBV0@@Z
    • ??0CModuleConfig@@QEAA@AEBV0@@Z
    • ??0CModuleConfig@@QEAA@XZ
    • ??0CModuleConfigList@@QEAA@AEBV0@@Z
    • ??0CModuleConfigList@@QEAA@KPEAVIMemoryAllocator@@@Z
    • ??0CModuleFileExtConfig@@QEAA@AEBV0@@Z
    • ??0CModuleFileExtConfig@@QEAA@KKE@Z
    • ??0CModuleFlagConfig@@QEAA@AEBV0@@Z
    • ??0CModuleFlagConfig@@QEAA@K@Z
    • ??0CModuleMultiStringConfig@@QEAA@AEBV0@@Z
    • ??0CModuleMultiStringConfig@@QEAA@KK@Z
    • ??0CModuleStringConfig@@QEAA@AEBV0@@Z
    • ??0CModuleStringConfig@@QEAA@K@Z
    • ??0CNoLockList@@QEAA@AEBV0@@Z
    • ??0CNoLockList@@QEAA@KKPEAVIMemoryAllocator@@@Z
    • ??0CSmartLock@@QEAA@AEAVCLockEvent@@@Z
    • ??0CSmartLock@@QEAA@XZ
    • ??0CSmartReference@@QEAA@AEAJ@Z
    • ??0CSmartReference@@QEAA@AEAK@Z
    • ??0CSmartResource@@QEAA@AEAVCResource@@E@Z
    • ??0CStrList@@QEAA@AEBV0@@Z
    • ??0CStrList@@QEAA@KPEAVIMemoryAllocator@@@Z
    • ??0CSystemThread@@QEAA@AEBV0@@Z
    • ??0CSystemThread@@QEAA@K@Z
    • ??0CUserFuncAdapterJob@@QEAA@AEBV0@@Z
    • ??0CUserFuncAdapterJob@@QEAA@P6AXPEAX@Z01@Z
    • ??0CWorkerThread@@IEAA@PEAVCWorkerThreadJobQueue@@@Z
    • ??0CWorkerThread@@QEAA@AEBV0@@Z
    • ??0CWorkerThreadJob@@QEAA@AEBV0@@Z
    • ??0CWorkerThreadJob@@QEAA@E@Z
    • ??0CWorkerThreadJobQueue@@QEAA@AEBV0@@Z
    • ??0CWorkerThreadJobQueue@@QEAA@K@Z
    • ??0CWorkerThreadPool@@QEAA@AEBV0@@Z
    • ??0CWorkerThreadPool@@QEAA@K@Z
    • ??0CWorkerThreadPoolEx@@QEAA@AEBV0@@Z
    • ??0CWorkerThreadPoolEx@@QEAA@KK@Z
    • ??0IMemoryAllocator@@QEAA@AEBV0@@Z
    • ??0IMemoryAllocator@@QEAA@XZ
    • ??1CAutoUpdateConfigThread@@UEAA@XZ
    • ??1CBlobConfig@@UEAA@XZ
    • ??1CContext@@UEAA@XZ
    • ??1CContextList@@UEAA@XZ
    • ??1CDebugLog@@UEAA@XZ
    • ??1CDebugLogEx@@UEAA@XZ
    • ??1CDelayLoadThread@@UEAA@XZ
    • ??1CExclusionExtConfig@@UEAA@XZ
    • ??1CExclusionFileNameConfig@@UEAA@XZ
    • ??1CExclusionFilePathConfig@@UEAA@XZ
    • ??1CExclusionFolderConfig@@UEAA@XZ
    • ??1CExclusionRegistryConfig@@UEAA@XZ
    • ??1CFile@@UEAA@XZ
    • ??1CFileExtension@@UEAA@XZ
    • ??1CInclusionExtConfig@@UEAA@XZ
    • ??1CInclusionFileNameConfig@@UEAA@XZ
    • ??1CInclusionFilePathConfig@@UEAA@XZ
    • ??1CInclusionFolderConfig@@UEAA@XZ
    • ??1CKEvent@@UEAA@XZ
    • ??1CList@@UEAA@XZ
    • ??1CLockEvent@@UEAA@XZ
    • ??1CLockList@@UEAA@XZ
    • ??1CMemoryAllocator@@UEAA@XZ
    • ??1CMemoryPoolAllocator@@UEAA@XZ
    • ??1CModuleConfig@@UEAA@XZ
    • ??1CModuleConfigList@@UEAA@XZ
    • ??1CModuleFileExtConfig@@UEAA@XZ
    • ??1CModuleFlagConfig@@UEAA@XZ
    • ??1CModuleMultiStringConfig@@UEAA@XZ
    • ??1CModuleStringConfig@@UEAA@XZ
    • ??1CNoLockList@@UEAA@XZ
    • ??1CSmartLock@@QEAA@XZ
    • ??1CSmartReference@@QEAA@XZ
    • ??1CSmartResource@@QEAA@XZ
    • ??1CStrList@@UEAA@XZ
    • ??1CSystemThread@@UEAA@XZ
    • ??1CUserFuncAdapterJob@@UEAA@XZ
    • ??1CWorkerThread@@UEAA@XZ
    • ??1CWorkerThreadJob@@UEAA@XZ
    • ??1CWorkerThreadJobQueue@@UEAA@XZ
    • ??1CWorkerThreadPool@@UEAA@XZ
    • ??1CWorkerThreadPoolEx@@UEAA@XZ
    • ??1IMemoryAllocator@@UEAA@XZ
    • ??2@YAPEAX_KPEAVIMemoryAllocator@@PEBDK@Z
    • ??2CMemoryAllocator@@SAPEAX_K@Z
    • ??2CMemoryPoolAllocator@@SAPEAX_K@Z
    • ??3@YAXPEAX@Z
    • ??3@YAXPEAX_K@Z
    • ??3IMemoryAllocator@@SAXPEAX@Z
    • ??4CAutoUpdateConfigThread@@QEAAAEAV0@AEBV0@@Z
    • ??4CBlobConfig@@QEAAAEAV0@AEBV0@@Z
    • ??4CContext@@QEAAAEAV0@AEBV0@@Z
    • ??4CDebugLog@@QEAAAEAV0@AEBV0@@Z
    • ??4CDebugLogEx@@QEAAAEAV0@AEBV0@@Z
    • ??4CDelayLoadThread@@QEAAAEAV0@AEBV0@@Z
    • ??4CFile@@QEAAAEAV0@AEBV0@@Z
    • ??4CKEvent@@QEAAAEAV0@AEBV0@@Z
    • ??4CLockEvent@@QEAAAEAV0@AEBV0@@Z
    • ??4CMemoryAllocator@@QEAAAEAV0@AEBV0@@Z
    • ??4CMemoryPoolAllocator@@QEAAAEAV0@AEBV0@@Z
    • ??4CModuleConfig@@QEAAAEAV0@AEBV0@@Z
    • ??4CModuleFlagConfig@@QEAAAEAV0@AEBV0@@Z
    • ??4CModuleStringConfig@@QEAAAEAV0@AEBV0@@Z
    • ??4CSmartLock@@QEAAAEAV0@AEBV0@@Z
    • ??4CSmartLock@@QEAAAEBV0@AEAVCLockEvent@@@Z
    • ??4CSmartResource@@QEAAAEAV0@AEBV0@@Z
    • ??4CSystemThread@@QEAAAEAV0@AEBV0@@Z
    • ??4CUserFuncAdapterJob@@QEAAAEAV0@AEBV0@@Z
    • ??4CWorkerThread@@QEAAAEAV0@AEBV0@@Z
    • ??4CWorkerThreadJob@@QEAAAEAV0@AEBV0@@Z
    • ??4IMemoryAllocator@@QEAAAEAV0@AEBV0@@Z
    • ??_7CAutoUpdateConfigThread@@6B@
    • ??_7CBlobConfig@@6B@
    • ??_7CContext@@6B@
    • ??_7CContextList@@6B@
    • ??_7CDebugLog@@6B@
    • ??_7CDebugLogEx@@6B@
    • ??_7CDelayLoadThread@@6B@
    • ??_7CExclusionExtConfig@@6B@
    • ??_7CExclusionFileNameConfig@@6B@
    • ??_7CExclusionFilePathConfig@@6B@
    • ??_7CExclusionFolderConfig@@6B@
    • ??_7CExclusionRegistryConfig@@6B@
    • ??_7CFile@@6B@
    • ??_7CFileExtension@@6B@
    • ??_7CInclusionExtConfig@@6B@
    • ??_7CInclusionFileNameConfig@@6B@
    • ??_7CInclusionFilePathConfig@@6B@
    • ??_7CInclusionFolderConfig@@6B@
    • ??_7CKEvent@@6B@
    • ??_7CList@@6B@
    • ??_7CLockEvent@@6B@
    • ??_7CLockList@@6B@
    • ??_7CMemoryAllocator@@6B@
    • ??_7CMemoryPoolAllocator@@6B@
    • ??_7CModuleConfig@@6B@
    • ??_7CModuleConfigList@@6B@
    • ??_7CModuleFileExtConfig@@6B@
    • ??_7CModuleFlagConfig@@6B@
    • ??_7CModuleMultiStringConfig@@6B@
    • ??_7CModuleStringConfig@@6B@
    • ??_7CNoLockList@@6B@
    • ??_7CStrList@@6B@
    • ??_7CSystemThread@@6B@
    • ??_7CUserFuncAdapterJob@@6B@
    • ??_7CWorkerThread@@6B@
    • ??_7CWorkerThreadJob@@6B@
    • ??_7CWorkerThreadJobQueue@@6B@
    • ??_7CWorkerThreadPool@@6B@
    • ??_7CWorkerThreadPoolEx@@6B@
    • ??_7IMemoryAllocator@@6B@
    • ??_FCContextList@@QEAAXXZ
    • ??_FCFile@@QEAAXXZ
    • ??_FCFileExtension@@QEAAXXZ
    • ??_FCModuleConfigList@@QEAAXXZ
    • ??_FCStrList@@QEAAXXZ
    • ??_FCSystemThread@@QEAAXXZ
    • ??_FCWorkerThread@@QEAAXXZ
    • ??_FCWorkerThreadJob@@QEAAXXZ
    • ??_FCWorkerThreadJobQueue@@QEAAXXZ
    • ??_U@YAPEAX_KPEAVIMemoryAllocator@@PEBDK@Z
    • ??_V@YAXPEAX@Z
    • ??_V@YAXPEAX_K@Z
    • ?Acquire@CLockEvent@@QEAAXXZ
    • ?Add@CContextList@@QEAAEPEAVCContext@@@Z
    • ?Add@CFileExtension@@QEAAEPEBGK@Z
    • ?Add@CModuleConfigList@@QEAAEPEAVCModuleConfig@@@Z
    • ?Add@CStrList@@QEAAEPEBG@Z
    • ?AddNode@CLockList@@UEAAEQEAXE@Z
    • ?AddNode@CNoLockList@@UEAAEQEAXE@Z
    • ?Alloc@CMemoryAllocator@@UEAAPEAX_KPEBDK@Z
    • ?Alloc@CMemoryPoolAllocator@@UEAAPEAX_KPEBDK@Z
    • ?AllocBlock@CMemoryPoolAllocator@@IEAAPEAX_K@Z
    • ?AttachJobQueue@CWorkerThread@@QEAAXPEAVCWorkerThreadJobQueue@@@Z
    • ?Cancel@CWorkerThreadJob@@QEAAXXZ
    • ?CheckNode@CLockList@@UEAAHQEAX@Z
    • ?CheckNode@CNoLockList@@UEAAHQEAX@Z
    • ?CleanQueue@CWorkerThreadJobQueue@@QEAAXXZ
    • ?Cleanup@CBlobConfig@@AEAAXXZ
    • ?Cleanup@CModuleFileExtConfig@@IEAAXXZ
    • ?Cleanup@CModuleMultiStringConfig@@IEAAXXZ
    • ?Cleanup@CModuleStringConfig@@AEAAXXZ
    • ?Close@CFile@@QEAAJXZ
    • ?Count@CLockList@@QEAAKXZ
    • ?Count@CNoLockList@@QEAAKXZ
    • ?Create@CFile@@QEAAJPEBGKKKK@Z
    • ?Create@CSystemThread@@QEAAEXZ
    • ?CreateInstance@CMemoryAllocator@@SAPEAV1@W4_POOL_TYPE@@K@Z
    • ?CreateInstance@CMemoryPoolAllocator@@SAPEAV1@W4_POOL_TYPE@@_K1K@Z
    • ?CreatePool@CWorkerThreadPool@@QEAAEXZ
    • ?CreatePool@CWorkerThreadPoolEx@@QEAAEXZ
    • ?CreateThreads@CWorkerThreadPool@@QEAAEK@Z
    • ?CreateThreads@CWorkerThreadPoolEx@@QEAAEK@Z
    • ?CreateWIRP@CFile@@QEAAJPEBGKKKK@Z
    • ?Delete@CFile@@QEAAJXZ
    • ?Delete@CFileExtension@@QEAAEPEBGK@Z
    • ?Delete@CStrList@@QEAAEPEBG@Z
    • ?DeleteAll@CList@@UEAAXXZ
    • ?DeleteAll@CLockList@@UEAAXXZ
    • ?DeleteAll@CNoLockList@@UEAAXXZ
    • ?DeleteNode@CContextList@@MEAAXPEAX@Z
    • ?DeleteNode@CList@@UEAAXPEAX@Z
    • ?DeleteNode@CModuleConfigList@@MEAAXPEAX@Z
    • ?DeleteNode@CStrList@@EEAAXPEAU_STR_LIST_NODE@1@@Z
    • ?DisableWriteProtectFromCR0@@YAXPEAPEAX@Z
    • ?DoIt@CWorkerThreadJob@@QEAAJXZ
    • ?EntryPoint@CSystemThread@@KAXPEAX@Z
    • ?Find@CContextList@@QEAAPEAVCContext@@K@Z
    • ?Find@CContextList@@QEAAPEAVCContext@@PEAX@Z
    • ?Find@CFileExtension@@QEAAPEAU_STR_LIST_NODE@CStrList@@PEBGK@Z
    • ?Find@CModuleConfigList@@QEAAPEAVCModuleConfig@@K@Z
    • ?Find@CStrList@@QEAAPEAU_STR_LIST_NODE@1@PEBG@Z
    • ?FindNode@CContextList@@IEAAPEAXPEAX@Z
    • ?FindPartiallyAndAllMatch@CStrList@@QEAAPEAU_STR_LIST_NODE@1@PEBG@Z
    • ?FinishFunction@CUserFuncAdapterJob@@MEAAXXZ
    • ?FinishIt@CWorkerThreadJob@@QEAAJXZ
    • ?First@CList@@UEAAPEAXXZ
    • ?First@CLockList@@UEAAPEAXXZ
    • ?First@CNoLockList@@UEAAPEAXXZ
    • ?Free@CMemoryAllocator@@UEAAXPEAX@Z
    • ?Free@CMemoryPoolAllocator@@UEAAXPEAX@Z
    • ?GetAttributes@CFile@@QEAAKXZ
    • ?GetBasicInfomration@CFile@@IEAAJXZ
    • ?GetBlobCofig@CContext@@UEAAJKPEAXPEAK@Z
    • ?GetCategory@CContext@@QEAAKXZ
    • ?GetData@CBlobConfig@@QEAAHPEAXPEAK@Z
    • ?GetData@CModuleFileExtConfig@@QEAAHPEAGPEAK@Z
    • ?GetData@CModuleFileExtConfig@@QEAAPEAVCFileExtension@@XZ
    • ?GetData@CModuleFlagConfig@@QEAAKXZ
    • ?GetData@CModuleMultiStringConfig@@QEAAHPEAGPEAK@Z
    • ?GetData@CModuleMultiStringConfig@@QEAAPEAVCStrList@@XZ
    • ?GetData@CModuleStringConfig@@QEAAPEAGXZ
    • ?GetData@CStrList@@QEAAEPEAGPEAK@Z
    • ?GetDataType@CModuleConfig@@QEAAKXZ
    • ?GetEngineContext@CContext@@QEAAPEAXXZ
    • ?GetFileExtensionConfig@CContext@@QEAAPEAVCFileExtension@@K@Z
    • ?GetFileExtensionConfig@CContext@@UEAAJKPEAGPEAK@Z
    • ?GetFileSize@CFile@@QEAAJPEAT_LARGE_INTEGER@@@Z
    • ?GetFileSizeWIRP@CFile@@QEAAJPEAT_LARGE_INTEGER@@@Z
    • ?GetFlagConfig@CContext@@UEAAJKPEAK@Z
    • ?GetID@CModuleConfig@@QEAAKXZ
    • ?GetJob@CWorkerThreadJobQueue@@QEAAPEAVCWorkerThreadJob@@XZ
    • ?GetLength@CModuleStringConfig@@QEAAKXZ
    • ?GetLinkContext@CContext@@QEAAPEAXXZ
    • ?GetLogFlag@CDebugLog@@QEAAKXZ
    • ?GetLogFlag@CDebugLogEx@@QEAAKXZ
    • ?GetModuleId@CModuleConfig@@QEAAKXZ
    • ?GetMultiStringConfig@CContext@@QEAAPEAVCStrList@@K@Z
    • ?GetMultiStringConfig@CContext@@UEAAJKPEAGPEAK@Z
    • ?GetOneThreadTEB@CWorkerThreadPool@@QEAAPEAU_ETHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPool@@QEAAPEAU_KTHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPoolEx@@QEAAPEAU_ETHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPoolEx@@QEAAPEAU_KTHREAD@@XZ
    • ?GetReportCallBackRoutine@CContext@@QEAA_KXZ
    • ?GetSize@CBlobConfig@@QEAAKXZ
    • ?GetStringConfig@CContext@@QEAAPEAGK@Z
    • ?GetStringConfig@CContext@@UEAAJKPEAGPEAK@Z
    • ?GetThreadCount@CWorkerThreadPool@@QEAAKXZ
    • ?GetThreadCount@CWorkerThreadPoolEx@@QEAAKXZ
    • ?GetThreadID@CSystemThread@@QEAA_KXZ
    • ?GetType@CContext@@QEAAKXZ
    • ?GetUserParameter@CContext@@QEAA_KXZ
    • ?InitProcMon@CDebugLogEx@@IEAAXXZ
    • ?InitializeBlobConfig@CContext@@QEAAHKPEAXK@Z
    • ?InitializeFileExtensionConfig@CContext@@QEAAHKPEBG@Z
    • ?InitializeFlagConfig@CContext@@QEAAHKK@Z
    • ?InitializeMultiStringConfig@CContext@@QEAAHKPEBG@Z
    • ?InitializeStringConfig@CContext@@QEAAHKPEBG@Z
    • ?Insert@CList@@UEAAXQEAXE@Z
    • ?Insert@CLockList@@UEAAXQEAXE@Z
    • ?Insert@CNoLockList@@UEAAXQEAXE@Z
    • ?InsertAfter@CList@@UEAAXPEAX0@Z
    • ?InsertBefore@CList@@UEAAXPEAX0@Z
    • ?Instance@CWorkerThreadPool@@SAPEAV1@XZ
    • ?IsEmpty@CList@@UEAAEXZ
    • ?IsEmpty@CLockList@@UEAAEXZ
    • ?IsEmpty@CNoLockList@@UEAAEXZ
    • ?IsExceedLimitation@CMemoryPoolAllocator@@IEAAEK@Z
    • ?IsFull@CLockList@@QEBAEXZ
    • ?IsFull@CNoLockList@@QEBAEXZ
    • ?IsInExclusionList@CExclusionExtConfig@@QEAAEPEBG@Z
    • ?IsInExclusionList@CExclusionFileNameConfig@@QEAAEPEBG@Z
    • ?IsInExclusionList@CExclusionFilePathConfig@@QEAAEPEBG@Z
    • ?IsInExclusionList@CExclusionFolderConfig@@QEAAEPEBG@Z
    • ?IsInExclusionList@CExclusionRegistryConfig@@QEAAEPEBG@Z
    • ?IsInInclusionList@CInclusionExtConfig@@QEAAEPEBG@Z
    • ?IsInInclusionList@CInclusionFileNameConfig@@QEAAEPEBG@Z
    • ?IsInInclusionList@CInclusionFilePathConfig@@QEAAEPEBG@Z
    • ?IsInInclusionList@CInclusionFolderConfig@@QEAAEPEBG@Z
    • ?IsOpened@CFile@@QEAAEXZ
    • ?IsTerminated@CWorkerThreadPool@@QEAAEXZ
    • ?IsTerminated@CWorkerThreadPoolEx@@QEAAEXZ
    • ?IsValid@CMemoryAllocator@@UEAAEXZ
    • ?IsValid@CMemoryPoolAllocator@@UEAAEXZ
    • ?IsValid@IMemoryAllocator@@UEAAEXZ
    • ?IsWorkerThread@CWorkerThreadPool@@QEAAE_K@Z
    • ?IsWorkerThread@CWorkerThreadPoolEx@@QEAAE_K@Z
    • ?JobFunction@CUserFuncAdapterJob@@MEAAXXZ
    • ?JobQueue@CWorkerThreadPool@@QEAAAEAVCWorkerThreadJobQueue@@XZ
    • ?JobQueue@CWorkerThreadPoolEx@@QEAAAEAVCWorkerThreadJobQueue@@XZ
    • ?Limit@CLockList@@QEAAKXZ
    • ?Limit@CNoLockList@@QEAAKXZ
    • ?MatchAllExtensions@CFileExtension@@QEAAEXZ
    • ?MatchNoExtensions@CFileExtension@@QEAAEXZ
    • ?MergeLeft@CMemoryPoolAllocator@@IEAAPEAXPEAX@Z
    • ?MergeRight@CMemoryPoolAllocator@@IEAAPEAXPEAX@Z
    • ?NeedDelete@CWorkerThreadJob@@QEAAEXZ
    • ?NeedDeleteWhenFinish@CWorkerThreadJob@@QEAAXE@Z
    • ?NewNode@CList@@UEAAPEAXXZ
    • ?NewNode@CStrList@@EEAAPEAXXZ
    • ?NewNodeVariant@CList@@IEAAPEAXK@Z
    • ?Next@CList@@UEBAPEAXQEAX@Z
    • ?Next@CLockList@@UEBAPEAXQEAX@Z
    • ?Next@CNoLockList@@UEBAPEAXQEAX@Z
    • ?NextPool@CMemoryPoolAllocator@@QEAAPEAV1@XZ
    • ?NotityTerminate@CWorkerThread@@QEAAXXZ
    • ?PostJobToWorkerThread@CWorkerThreadPool@@QEAAJP6AXPEAX@Z0E@Z
    • ?PostJobToWorkerThread@CWorkerThreadPoolEx@@QEAAJP6AXPEAX@Z0E1@Z
    • ?Pulse@CKEvent@@QEAAJJE@Z
    • ?QueueJob@CWorkerThreadJobQueue@@QEAAEPEAVCWorkerThreadJob@@@Z
    • ?QueueJobItem@CWorkerThreadPool@@QEAAJPEAVCWorkerThreadJob@@@Z
    • ?QueueJobItem@CWorkerThreadPoolEx@@QEAAJPEAVCWorkerThreadJob@@@Z
    • ?RCMInstance@CWorkerThreadPool@@SAPEAV1@XZ
    • ?Read@CFile@@QEAAJPEADKPEAK@Z
    • ?ReadWIRP@CFile@@QEAAJPEADKPEAK@Z
    • ?ReferenceCount@CContext@@QEAAAEAKXZ
    • ?Release@CLockEvent@@QEAAXXZ
    • ?Remove@CContextList@@UEAAEQEAX@Z
    • ?Remove@CList@@UEAAEQEAX@Z
    • ?Remove@CLockList@@UEAAEQEAX@Z
    • ?Remove@CNoLockList@@UEAAEQEAX@Z
    • ?RemoveHead@CList@@UEAAPEAXXZ
    • ?RemoveHead@CLockList@@UEAAPEAXXZ
    • ?RemoveHead@CNoLockList@@UEAAPEAXXZ
    • ?RemoveTail@CList@@UEAAPEAXXZ
    • ?RemoveTail@CLockList@@UEAAPEAXXZ
    • ?RemoveTail@CNoLockList@@UEAAPEAXXZ
    • ?Reset@CKEvent@@QEAAXXZ
    • ?ResetData@CInclusionExtConfig@@QEAAXXZ
    • ?ResetData@CInclusionFileNameConfig@@QEAAXXZ
    • ?ResetData@CInclusionFilePathConfig@@QEAAXXZ
    • ?ResetData@CInclusionFolderConfig@@QEAAXXZ
    • ?RestoreCR0@@YAXPEAX@Z
    • ?Run@CAutoUpdateConfigThread@@UEAAXXZ
    • ?Run@CDelayLoadThread@@UEAAXXZ
    • ?Run@CWorkerThread@@UEAAXXZ
    • ?SeekToEnd@CFile@@QEAAJXZ
    • ?Set@CKEvent@@QEAAJJE@Z
    • ?SetAttributes@CFile@@QEAAJK@Z
    • ?SetBlobCofig@CContext@@UEAAJKPEAXK@Z
    • ?SetData@CBlobConfig@@QEAAHPEAXK@Z
    • ?SetData@CModuleFileExtConfig@@QEAAHPEBG@Z
    • ?SetData@CModuleFlagConfig@@QEAAHK@Z
    • ?SetData@CModuleMultiStringConfig@@QEAAHPEBGK@Z
    • ?SetData@CModuleStringConfig@@QEAAHPEBG@Z
    • ?SetEngineContext@CContext@@QEAAXPEAX@Z
    • ?SetFileExtensionConfig@CContext@@UEAAJKPEBG@Z
    • ?SetFlagConfig@CContext@@UEAAJKK@Z
    • ?SetLinkContext@CContext@@QEAAXPEAX@Z
    • ?SetLogFlag@CDebugLog@@QEAAEK@Z
    • ?SetLogFlag@CDebugLogEx@@QEAAEK@Z
    • ?SetMatchAllExtensions@CFileExtension@@QEAAXE@Z
    • ?SetMatchNoExtensions@CFileExtension@@QEAAXE@Z
    • ?SetMultiStringConfig@CContext@@UEAAJKPEBG@Z
    • ?SetNewJobItemEvent@CWorkerThreadJobQueue@@QEAAXXZ
    • ?SetPriority@CSystemThread@@QEAAXK@Z
    • ?SetStopUse@CContext@@QEAAXXZ
    • ?SetStringConfig@CContext@@UEAAJKPEBG@Z
    • ?Setup@CSystemThread@@MEAAXXZ
    • ?StopUse@CContext@@QEAAHXZ
    • ?TearDown@CSystemThread@@MEAAXXZ
    • ?Terminate@CSystemThread@@QEAAXE@Z
    • ?Terminate@CWorkerThreadPool@@QEAAEXZ
    • ?Terminate@CWorkerThreadPoolEx@@QEAAEXZ
    • ?TmExceptionFilter@@YAJPEAU_EXCEPTION_POINTERS@@@Z
    • ?Wait@CKEvent@@QEAAJPEAT_LARGE_INTEGER@@E@Z
    • ?WaitFinish@CWorkerThreadJob@@QEAAXXZ
    • ?WaitForInit@CDelayLoadThread@@QEAAEXZ
    • ?WaitForLoad@CDelayLoadThread@@QEAAEXZ
    • ?WaitNewJobAvailable@CWorkerThreadJobQueue@@QEAAEXZ
    • ?WaitQueueEmpty@CWorkerThreadJobQueue@@QEAAXXZ
    • ?Write@CDebugLog@@QEAAXPEBDZZ
    • ?Write@CDebugLogEx@@QEAAXPEBDZZ
    • ?Write@CFile@@QEAAJPEADKPEAT_LARGE_INTEGER@@PEAK@Z
    • ?WriteDataToFile@CDebugLogEx@@IEAAXPEADK@Z
    • ?WriteDataToProcMonW@CDebugLogEx@@IEAAXPEAD@Z
    • ?WriteSystemInformation@CDebugLog@@QEAAXXZ
    • ?WriteSystemInformation@CDebugLogEx@@QEAAXXZ
    • ?WriteSystemStringInformation@CDebugLog@@IEAAXPEBG@Z
    • ?WriteSystemStringInformation@CDebugLogEx@@IEAAXPEBG@Z
    • ?WriteToFile@CDebugLog@@IEAAXPEADK@Z
    • ?WriteToProcMonW@CDebugLogEx@@IEAAXPEAU_UNICODE_STRING@@@Z
    • ?_pNonPagedAllocator@@3PEAVCMemoryAllocator@@EA
    • ?_pPagedAllocator@@3PEAVCMemoryAllocator@@EA
    • ?m_lpInstance@CWorkerThreadPool@@1PEAV1@EA
    • ?m_lpRCMInstance@CWorkerThreadPool@@1PEAV1@EA
    • AllocFullFileName
    • DeInitKm2UmCommunication
    • DeInitKmLPC
    • DuplicateFullFileName
    • FreeFullFileName
    • GetKm2UmMode
    • GetModuleInfoByAddress
    • GetModuleInfoByModuleName
    • InitKm2UmCommunication
    • InitKmLPC
    • IsVerifierCodeCheckFlagOn
    • IsWindows8_1_update
    • KmCallUm
    • KmCallUmByLPC
    • KmCallUmEx
    • KmCleanupCommPortAPIs
    • KmGetUmInitProcess
    • KmSetBackupCommPortAPIs
    • KmSetCommPortAPIs
    • ModGetExportProcAddress
    • ModLoadDLLToBuffer
    • ModLoadDLLToBufferWithImageSize
    • ModLoadModule
    • ModUnLoadModule
    • NormalizeFileName
    • NormalizeFullNtPathToDosName
    • TmCommConfigRoutine
    • UtilAddDeviceInDriveTable
    • UtilAddReparsePointMapping
    • UtilCleanFileReadOnly
    • UtilCloseExclusiveHandle
    • UtilCreateDosFileName
    • UtilDeleteFileForce
    • UtilGetDeviceObjectName
    • UtilGetFileNameFromFileObject
    • UtilGetFileObjectForProcessByEPROC
    • UtilGetFileObjectFromFileName
    • UtilGetProcessName
    • UtilGetSystemDirectory
    • UtilGetSystemDirectoryEx
    • UtilGetSystemDirectoryLength
    • UtilGetSystemTime
    • UtilIoSetFileInfo
    • UtilIopCreateFileIRP
    • UtilKeGetLowFileDevice
    • UtilModuleIATHook
    • UtilModuleIATUnHook
    • UtilPostJobToWorkerThread
    • UtilQueryExclusiveHandle
    • UtilQueryKeyValue
    • UtilRemoveDeviceFromDriveTable
    • UtilVolumeDeviceToDosName
    • UtilWaitValueChangeToZero
    • UtilWriteVersionToRegistry
    • UtilbuildDynamicDiskMappingTable
    • UtlWriteBinValueKeyToRegistry
    • ValidateAddressWithSize
    • _ResetProtectFromClose
    • _UtilDosPathNameToNtPathName

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • .pdata
    • .gfids
    • PAGE
    • .edata
    • INIT
    • .rsrc
    • .reloc

    Signature

    Expand
    {
      "Certificates": [
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
          "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
          "TBS": {
            "MD5": "d0785ad36e427c92b19f6826ab1e8020",
            "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
            "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
            "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
          },
          "ValidFrom": "2012-12-21 00:00:00",
          "ValidTo": "2020-12-30 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
          "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
          "TBS": {
            "MD5": "e9d38360b914c8863f6cba3ee58764d3",
            "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
            "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
            "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
          },
          "ValidFrom": "2012-10-18 00:00:00",
          "ValidTo": "2020-12-29 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
          "TBS": {
            "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
            "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
            "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
            "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
          },
          "ValidFrom": "2017-04-27 00:00:00",
          "ValidTo": "2018-07-16 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "611993e400000000001c",
          "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
          "TBS": {
            "MD5": "78a717e082dcc1cda3458d917e677d14",
            "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
            "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
            "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
          },
          "ValidFrom": "2011-02-22 19:25:17",
          "ValidTo": "2021-02-22 19:35:17",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
          "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "TBS": {
            "MD5": "b30c31a572b0409383ed3fbe17e56e81",
            "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
            "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
            "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
          },
          "ValidFrom": "2010-02-08 00:00:00",
          "ValidTo": "2020-02-07 23:59:59",
          "Version": 3
        }
      ],
      "CertificatesInfo": "",
      "Signer": [
        {
          "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Version": 1
        }
      ],
      "SignerInfo": ""
    }
    

    PropertyValue
    FilenameTmComm.sys
    Creation Timestamp2020-06-22 02:26:17
    MD56e25148bb384469f3d5386dc5217548a
    SHA1dbf6e72c08824fe49c29b7660c9965c37d983e93
    SHA2563c4207c90c97733fae2a08679d63fbbe94dfcf96fdfdf88406aa7ab3f80ea78f
    Authentihash MD52778b2480e305bca99547b921a96ede5
    Authentihash SHA169044e94c725b1536c4f721b5a0cd9816581c745
    Authentihash SHA256eb14c5db8307488809897be13c66ef02941f6020f9c34a9664db92a00d551f4a
    RichPEHeaderHash MD58ae6b3a63d3444e617eba17c3a93979e
    RichPEHeaderHash SHA13cc95db9109125c87a3cb737bbe371034d9c3ade
    RichPEHeaderHash SHA256118d8d8e4d2d1ce80640e7b28300dd41389daf9bdbdc6ad2e9fefcde4aab7ad2
    CompanyTrend Micro Inc.
    DescriptionTrendMicro Common Module
    ProductTrend Micro Eyes
    OriginalFilenameTmComm.sys

    Download

    Certificates

    Expand
    Certificate 0ea0fe4dfb74cc64bc32143103c27c8b
    FieldValue
    ToBeSigned (TBS) MD5e93e004baa6013b41135ac0648e29d5b
    ToBeSigned (TBS) SHA1dc91e26674d4b627319c700d3ebb1a6cf83d358e
    ToBeSigned (TBS) SHA2560d20335edb166a303411548471bee6f301c8b4f7f7e453d09c15303de2c888d7
    SubjectC=TW, L=Taipei, O=Trend Micro, Inc., OU=Taipei, TW, CN=Trend Micro, Inc.
    ValidFrom2019-07-12 00:00:00
    ValidTo2020-07-10 12:00:00
    Signature5c08ae5d586a4751195382d6889dc2fc500e7c39c641e1a58def8d923e12b754e2cc35720cc8d3d29382980debf7d98fcc17d764187126dd07c134fdbb96dd44fe8a40195df6f6acd1881fa5ba2921dadceb3f64422344672834813916bbdf317533cf6aaf3317d78197d7d6c560ad681de135f39e2d4ad345b7fe491162660a5462c6075fd725382df1e6e6bc3a4c443be778f79b07f181082e38150ca28ab932f99e4bc4185dc5b3b6edf22c187fdfd84e23a21e7da1989837f43b89aa172e6b34dbcb297bffd511a1d1c100b25e0e921f622a0845e23317f9fec83659ca21c241800683e0dd66ce4d042a8aefc4142b5923a6fa93ee72c48e8dc04c13b4b0
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber0ea0fe4dfb74cc64bc32143103c27c8b
    Version3
    Certificate 61204db4000000000027
    FieldValue
    ToBeSigned (TBS) MD58e3ffc222fbcebdbb8b23115ab259be7
    ToBeSigned (TBS) SHA1ee20bff28ffe13be731c294c90d6ded5aae0ec0e
    ToBeSigned (TBS) SHA25659826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821
    SubjectC=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
    ValidFrom2011-04-15 19:45:33
    ValidTo2021-04-15 19:55:33
    Signature208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber61204db4000000000027
    Version3
    Certificate 03019a023aff58b16bd6d5eae617f066
    FieldValue
    ToBeSigned (TBS) MD5a752afee44f017e8d74e3f3eb7914ae3
    ToBeSigned (TBS) SHA18eca80a6b80e9c69dcef7745748524afb8019e2d
    ToBeSigned (TBS) SHA25682560fa7efec30b5ff82af643e6f3bf3d46868bbd5e7d76f93db185e9e3553a1
    SubjectC=US, O=DigiCert, CN=DigiCert Timestamp Responder
    ValidFrom2014-10-22 00:00:00
    ValidTo2024-10-22 00:00:00
    Signature9d257e1b334db226815c9b86ce23200f8087e588ffffb1d46a2c31ed3a17197117cda91bbc5a1639009de36c84e45a40fbde06018c37fa9bb19d247efe20a457ad5bb79ab06026ea6957215d342f1f71b0839419056b359010a07b97c7f63fe7e21141a6bd62d9f0273d381d286f3a5209f0ec7062d3624bb0e073a692c0d38e31d82fe36d171306eee403b614abf38f43a7719d21dd14ca155d9241daf90f81d199740d26c40e7f1bb5f5a0f1c677062815e9d893e55516f0bb0aab1cdb5c482766c8a38b0a1ce595daaec42e59a061dddaf36da261e98a0b6dec1218bdf755544003922b6bc251c20a48afb0d46ee0f4140a3a1be38f3dcaaf6a8d7bdcd844
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber03019a023aff58b16bd6d5eae617f066
    Version3
    Certificate 02c4d1e58a4a680c568da3047e7e4d5f
    FieldValue
    ToBeSigned (TBS) MD5829995f702421dea833a24fb2c7f4442
    ToBeSigned (TBS) SHA11d7e838accd498c2e5ba9373af819ec097bb955c
    ToBeSigned (TBS) SHA25692914d016cc46e125e50c4bd0bd7f72db87eed4ba68f3c589b4e86aa563108db
    SubjectC=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1
    ValidFrom2011-02-11 12:00:00
    ValidTo2026-02-10 12:00:00
    Signature49eb7c60beaeefc97cb3c5ba4b64df1669e286fa29d9de98857d406626332f4455aaaa90e935700a34bed3ae542e8e6500d67a32203e6c26b898a939b1bc95c7aae9f5ee4666c6b3e812f8b3979dff74588234997550ac448fe892ce7d8b0f3196c7dcd31130987416c6e56b4576a39401cd33007a48f66f8631c9562b3322d5f801b644ce8cb4ca88d2e416e3e7f6e23ee109c09d7943437f555c05ad9310c62c0d6bc09eea78e5d277d6b8da9a987fba4c922b9dbda488b1ddafc34cd2979b03c6ae5f1b440f333715e3cbff2f56d316a45b55679da2cadb346c0c734ab57ba4b6b3e935027870ec007acbfc4b4f2236bb1484c98f91dd0f3c758cca0b88e7
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber02c4d1e58a4a680c568da3047e7e4d5f
    Version3
    Certificate 06fdf9039603adea000aeb3f27bbba1b
    FieldValue
    ToBeSigned (TBS) MD54e5ad189638cf52ba9cd881d4d44668c
    ToBeSigned (TBS) SHA1cdc115e98d798b33904c820d63cc1e1afc19251d
    ToBeSigned (TBS) SHA25637560fb9d548ab62cc3ed4669a4ab74828b5a108e67e829937ffb2d10a5f78dd
    SubjectC=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID CA,1
    ValidFrom2006-11-10 00:00:00
    ValidTo2021-11-10 00:00:00
    Signature46503ec9b72824a7381db65b29af52cf52e93147ab565c7bd50d0b41b3efec751f7438f2b25c61a29c95c350e482b923d1ba3a8672ad3878ac755d1717347247859456d1ebbb368477cc24a5f3041955a9e7e3e7ab62cdfb8b2d90c2c0d2b594bd5e4fb105d20e3d1aa9145ba6863162a8a833e49b39a7c4f5ce1d7876942573e42aabcf9c764bed5fc24b16e44b704c00891efcc579bc4c1257fe5fe11ebc025da8fefb07384f0dc65d91b90f6745cdd683ede7920d8db1698c4ffb59e0230fd2aaae007cee9c420ecf91d727b716ee0fc3bd7c0aa0ee2c08558522b8eb181a4dfc2a21ad49318347957771dcb11b4b4b1c109c7714c19d4f2f5a9508291026
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber06fdf9039603adea000aeb3f27bbba1b
    Version3

    Imports

    Expand
    • ntoskrnl.exe
    • HAL.dll
    • CLASSPNP.SYS

    Imported Functions

    Expand
    • KePulseEvent
    • KeClearEvent
    • KeStackAttachProcess
    • KeUnstackDetachProcess
    • ObfDereferenceObject
    • ZwSetEvent
    • ZwClose
    • ZwConnectPort
    • RtlInitUnicodeString
    • RtlUnicodeStringToInteger
    • ZwCreateSection
    • ZwWaitForSingleObject
    • ZwOpenEvent
    • IoGetCurrentProcess
    • ObfReferenceObject
    • DbgBreakPoint
    • ZwRequestWaitReplyPort
    • ExFreePoolWithTag
    • ProbeForWrite
    • ZwFreeVirtualMemory
    • ZwAllocateVirtualMemory
    • ObOpenObjectByPointer
    • PsProcessType
    • memmove
    • PsGetProcessExitTime
    • MmSectionObjectType
    • PsThreadType
    • ObReleaseObjectSecurity
    • SeReleaseSubjectContext
    • SeAccessCheck
    • SeCaptureSubjectContext
    • ObGetObjectSecurity
    • DbgPrint
    • memset
    • MmIsAddressValid
    • ExInitializeResourceLite
    • ExDeleteResourceLite
    • ZwWriteFile
    • ZwReadFile
    • ZwQueryInformationFile
    • ZwSetInformationFile
    • ZwCreateFile
    • swprintf
    • towupper
    • _wcsnicmp
    • ExAllocatePoolWithTag
    • KeInitializeEvent
    • _snprintf
    • PsGetCurrentProcessId
    • RtlTimeToTimeFields
    • ExSystemTimeToLocalTime
    • KeQuerySystemTime
    • PsGetCurrentThreadId
    • RtlInitAnsiString
    • ZwDeviceIoControlFile
    • ZwCreateKey
    • ZwCreateEvent
    • KeWaitForMultipleObjects
    • ObReferenceObjectByHandle
    • ZwNotifyChangeKey
    • _vsnprintf
    • RtlFreeUnicodeString
    • RtlAnsiStringToUnicodeString
    • RtlEqualUnicodeString
    • RtlAppendUnicodeStringToString
    • RtlCopyUnicodeString
    • RtlUpcaseUnicodeChar
    • RtlPrefixUnicodeString
    • ExGetPreviousMode
    • KeWaitForSingleObject
    • KeSetPriorityThread
    • PsTerminateSystemThread
    • PsCreateSystemThread
    • KeDelayExecutionThread
    • KeNumberProcessors
    • ZwQueryInformationProcess
    • PsLookupProcessByProcessId
    • ZwOpenDirectoryObject
    • PsSetCreateProcessNotifyRoutine
    • ZwQuerySystemInformation
    • ZwQueryDirectoryFile
    • ZwQueryDirectoryObject
    • ZwOpenKey
    • ZwEnumerateKey
    • ZwEnumerateValueKey
    • ZwQueryValueKey
    • ZwDeleteValueKey
    • ZwDeleteKey
    • ZwTerminateProcess
    • ZwOpenProcess
    • ZwQueryKey
    • ZwSetValueKey
    • IoFileObjectType
    • KeSetEvent
    • ZwQuerySecurityObject
    • ZwSetSecurityObject
    • RtlLengthSecurityDescriptor
    • MmHighestUserAddress
    • IoFreeIrp
    • _purecall
    • MmUnlockPages
    • IoBuildAsynchronousFsdRequest
    • _strnicmp
    • RtlQueryRegistryValues
    • RtlAppendUnicodeToString
    • mbstowcs
    • ZwQuerySymbolicLinkObject
    • ZwOpenSymbolicLinkObject
    • NtClose
    • ObQueryNameString
    • MmGetSystemRoutineAddress
    • ZwSetInformationObject
    • _stricmp
    • ZwUnmapViewOfSection
    • ZwMapViewOfSection
    • ZwOpenFile
    • IoCreateFile
    • IofCallDriver
    • IoAllocateIrp
    • MmBuildMdlForNonPagedPool
    • IoAllocateMdl
    • ProbeForRead
    • PsGetVersion
    • RtlImageNtHeader
    • RtlCompareMemory
    • RtlUpcaseUnicodeString
    • _snwprintf
    • MmSystemRangeStart
    • wcsncmp
    • strrchr
    • ZwQueryVolumeInformationFile
    • ObReferenceObjectByPointer
    • IoBuildDeviceIoControlRequest
    • ZwOpenSection
    • _allmul
    • KeReleaseSemaphore
    • RtlLengthRequiredSid
    • RtlInitializeSid
    • RtlSubAuthoritySid
    • RtlSetDaclSecurityDescriptor
    • RtlCreateSecurityDescriptor
    • RtlAddAccessAllowedAce
    • RtlCreateAcl
    • KeInitializeSemaphore
    • IoGetDeviceObjectPointer
    • IofCompleteRequest
    • ExEventObjectType
    • IoDeleteDevice
    • IoDeleteSymbolicLink
    • IoCreateSymbolicLink
    • RtlUpperChar
    • ObReferenceObjectByName
    • IoDriverObjectType
    • RtlCompareUnicodeString
    • strncpy
    • KeServiceDescriptorTable
    • NtOpenProcess
    • ObOpenObjectByName
    • NtQueryInformationProcess
    • PsIsThreadTerminating
    • KeAddSystemServiceTable
    • ZwFsControlFile
    • ObInsertObject
    • IoReleaseVpbSpinLock
    • IoAcquireVpbSpinLock
    • SeCreateAccessState
    • IoGetFileObjectGenericMapping
    • ObCreateObject
    • _allshr
    • ExInterlockedPopEntrySList
    • IoGetStackLimits
    • IoBuildSynchronousFsdRequest
    • wcsstr
    • IoUnregisterPlugPlayNotification
    • FsRtlIsNameInExpression
    • IoGetConfigurationInformation
    • MmProbeAndLockPages
    • IoGetDeviceInterfaces
    • IoRegisterPlugPlayNotification
    • ExAllocatePool
    • wcschr
    • KeTickCount
    • KeBugCheckEx
    • RtlUnwind
    • wcsrchr
    • memcpy
    • wcsncpy
    • ExReleaseResourceLite
    • ExAcquireResourceExclusiveLite
    • ExAcquireResourceSharedLite
    • ExReleaseFastMutexUnsafe
    • KeLeaveCriticalRegion
    • KeEnterCriticalRegion
    • _allrem
    • ExAcquireFastMutexUnsafe
    • IoDeviceObjectType
    • IoCreateDevice
    • RtlGetDaclSecurityDescriptor
    • RtlGetSaclSecurityDescriptor
    • RtlGetGroupSecurityDescriptor
    • RtlGetOwnerSecurityDescriptor
    • SeCaptureSecurityDescriptor
    • SeExports
    • IoIsWdmVersionAvailable
    • RtlLengthSid
    • RtlAbsoluteToSelfRelativeSD
    • IoFreeMdl
    • KeGetCurrentThread
    • KfAcquireSpinLock
    • KfReleaseSpinLock
    • KeRaiseIrqlToDpcLevel
    • KfLowerIrql
    • KeAcquireQueuedSpinLock
    • KeReleaseQueuedSpinLock
    • ExAcquireFastMutex
    • ExReleaseFastMutex
    • KeGetCurrentIrql
    • KfRaiseIrql
    • ClassInitialize

    Exported Functions

    Expand
    • ??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
    • ??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
    • ??0CBlobConfig@@QAE@ABV0@@Z
    • ??0CBlobConfig@@QAE@K@Z
    • ??0CContext@@QAE@ABV0@@Z
    • ??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
    • ??0CContextList@@QAE@ABV0@@Z
    • ??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CDebugLog@@QAE@ABV0@@Z
    • ??0CDebugLog@@QAE@PBG@Z
    • ??0CDebugLogEx@@QAE@ABV0@@Z
    • ??0CDebugLogEx@@QAE@K@Z
    • ??0CDelayLoadThread@@QAE@ABV0@@Z
    • ??0CDelayLoadThread@@QAE@XZ
    • ??0CExclusionExtConfig@@QAE@ABV0@@Z
    • ??0CExclusionExtConfig@@QAE@KKE@Z
    • ??0CExclusionFileNameConfig@@QAE@ABV0@@Z
    • ??0CExclusionFileNameConfig@@QAE@KK@Z
    • ??0CExclusionFilePathConfig@@QAE@ABV0@@Z
    • ??0CExclusionFilePathConfig@@QAE@KK@Z
    • ??0CExclusionFolderConfig@@QAE@ABV0@@Z
    • ??0CExclusionFolderConfig@@QAE@KK@Z
    • ??0CExclusionRegistryConfig@@QAE@ABV0@@Z
    • ??0CExclusionRegistryConfig@@QAE@KK@Z
    • ??0CFile@@QAE@ABV0@@Z
    • ??0CFile@@QAE@E@Z
    • ??0CFileExtension@@QAE@ABV0@@Z
    • ??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
    • ??0CInclusionExtConfig@@QAE@ABV0@@Z
    • ??0CInclusionExtConfig@@QAE@KKE@Z
    • ??0CInclusionFileNameConfig@@QAE@ABV0@@Z
    • ??0CInclusionFileNameConfig@@QAE@KK@Z
    • ??0CInclusionFilePathConfig@@QAE@ABV0@@Z
    • ??0CInclusionFilePathConfig@@QAE@KK@Z
    • ??0CInclusionFolderConfig@@QAE@ABV0@@Z
    • ??0CInclusionFolderConfig@@QAE@KK@Z
    • ??0CKEvent@@QAE@ABV0@@Z
    • ??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
    • ??0CList@@QAE@ABV0@@Z
    • ??0CList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CLockEvent@@QAE@ABV0@@Z
    • ??0CLockEvent@@QAE@XZ
    • ??0CLockList@@QAE@ABV0@@Z
    • ??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
    • ??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
    • ??0CMemoryAllocator@@QAE@ABV0@@Z
    • ??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
    • ??0CMemoryPoolAllocator@@QAE@ABV0@@Z
    • ??0CModuleConfig@@QAE@ABV0@@Z
    • ??0CModuleConfig@@QAE@XZ
    • ??0CModuleConfigList@@QAE@ABV0@@Z
    • ??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CModuleFileExtConfig@@QAE@ABV0@@Z
    • ??0CModuleFileExtConfig@@QAE@KKE@Z
    • ??0CModuleFlagConfig@@QAE@ABV0@@Z
    • ??0CModuleFlagConfig@@QAE@K@Z
    • ??0CModuleMultiStringConfig@@QAE@ABV0@@Z
    • ??0CModuleMultiStringConfig@@QAE@KK@Z
    • ??0CModuleStringConfig@@QAE@ABV0@@Z
    • ??0CModuleStringConfig@@QAE@K@Z
    • ??0CNoLockList@@QAE@ABV0@@Z
    • ??0CNoLockList@@QAE@KKPAVIMemoryAllocator@@@Z
    • ??0CSmartLock@@QAE@AAVCLockEvent@@@Z
    • ??0CSmartLock@@QAE@XZ
    • ??0CSmartReference@@QAE@AAJ@Z
    • ??0CSmartReference@@QAE@AAK@Z
    • ??0CSmartResource@@QAE@AAVCResource@@E@Z
    • ??0CStrList@@QAE@ABV0@@Z
    • ??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CSystemThread@@QAE@ABV0@@Z
    • ??0CSystemThread@@QAE@K@Z
    • ??0CUserFuncAdapterJob@@QAE@ABV0@@Z
    • ??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z01@Z
    • ??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
    • ??0CWorkerThread@@QAE@ABV0@@Z
    • ??0CWorkerThreadJob@@QAE@ABV0@@Z
    • ??0CWorkerThreadJob@@QAE@E@Z
    • ??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
    • ??0CWorkerThreadJobQueue@@QAE@K@Z
    • ??0CWorkerThreadPool@@QAE@ABV0@@Z
    • ??0CWorkerThreadPool@@QAE@K@Z
    • ??0CWorkerThreadPoolEx@@QAE@ABV0@@Z
    • ??0CWorkerThreadPoolEx@@QAE@KK@Z
    • ??0IMemoryAllocator@@QAE@ABV0@@Z
    • ??0IMemoryAllocator@@QAE@XZ
    • ??1CAutoUpdateConfigThread@@UAE@XZ
    • ??1CBlobConfig@@UAE@XZ
    • ??1CContext@@UAE@XZ
    • ??1CContextList@@UAE@XZ
    • ??1CDebugLog@@UAE@XZ
    • ??1CDebugLogEx@@UAE@XZ
    • ??1CDelayLoadThread@@UAE@XZ
    • ??1CExclusionExtConfig@@UAE@XZ
    • ??1CExclusionFileNameConfig@@UAE@XZ
    • ??1CExclusionFilePathConfig@@UAE@XZ
    • ??1CExclusionFolderConfig@@UAE@XZ
    • ??1CExclusionRegistryConfig@@UAE@XZ
    • ??1CFile@@UAE@XZ
    • ??1CFileExtension@@UAE@XZ
    • ??1CInclusionExtConfig@@UAE@XZ
    • ??1CInclusionFileNameConfig@@UAE@XZ
    • ??1CInclusionFilePathConfig@@UAE@XZ
    • ??1CInclusionFolderConfig@@UAE@XZ
    • ??1CKEvent@@UAE@XZ
    • ??1CList@@UAE@XZ
    • ??1CLockEvent@@UAE@XZ
    • ??1CLockList@@UAE@XZ
    • ??1CMemoryAllocator@@UAE@XZ
    • ??1CMemoryPoolAllocator@@UAE@XZ
    • ??1CModuleConfig@@UAE@XZ
    • ??1CModuleConfigList@@UAE@XZ
    • ??1CModuleFileExtConfig@@UAE@XZ
    • ??1CModuleFlagConfig@@UAE@XZ
    • ??1CModuleMultiStringConfig@@UAE@XZ
    • ??1CModuleStringConfig@@UAE@XZ
    • ??1CNoLockList@@UAE@XZ
    • ??1CSmartLock@@QAE@XZ
    • ??1CSmartReference@@QAE@XZ
    • ??1CSmartResource@@QAE@XZ
    • ??1CStrList@@UAE@XZ
    • ??1CSystemThread@@UAE@XZ
    • ??1CUserFuncAdapterJob@@UAE@XZ
    • ??1CWorkerThread@@UAE@XZ
    • ??1CWorkerThreadJob@@UAE@XZ
    • ??1CWorkerThreadJobQueue@@UAE@XZ
    • ??1CWorkerThreadPool@@UAE@XZ
    • ??1CWorkerThreadPoolEx@@UAE@XZ
    • ??1IMemoryAllocator@@UAE@XZ
    • ??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
    • ??2CMemoryAllocator@@SGPAXI@Z
    • ??2CMemoryPoolAllocator@@SGPAXI@Z
    • ??3@YAXPAX@Z
    • ??3IMemoryAllocator@@SGXPAX@Z
    • ??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
    • ??4CBlobConfig@@QAEAAV0@ABV0@@Z
    • ??4CContext@@QAEAAV0@ABV0@@Z
    • ??4CDebugLog@@QAEAAV0@ABV0@@Z
    • ??4CDebugLogEx@@QAEAAV0@ABV0@@Z
    • ??4CDelayLoadThread@@QAEAAV0@ABV0@@Z
    • ??4CFile@@QAEAAV0@ABV0@@Z
    • ??4CKEvent@@QAEAAV0@ABV0@@Z
    • ??4CLockEvent@@QAEAAV0@ABV0@@Z
    • ??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
    • ??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
    • ??4CModuleConfig@@QAEAAV0@ABV0@@Z
    • ??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
    • ??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
    • ??4CSmartLock@@QAEAAV0@ABV0@@Z
    • ??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
    • ??4CSmartResource@@QAEAAV0@ABV0@@Z
    • ??4CSystemThread@@QAEAAV0@ABV0@@Z
    • ??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
    • ??4CWorkerThread@@QAEAAV0@ABV0@@Z
    • ??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
    • ??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
    • ??_7CAutoUpdateConfigThread@@6B@
    • ??_7CBlobConfig@@6B@
    • ??_7CContext@@6B@
    • ??_7CContextList@@6B@
    • ??_7CDebugLog@@6B@
    • ??_7CDebugLogEx@@6B@
    • ??_7CDelayLoadThread@@6B@
    • ??_7CExclusionExtConfig@@6B@
    • ??_7CExclusionFileNameConfig@@6B@
    • ??_7CExclusionFilePathConfig@@6B@
    • ??_7CExclusionFolderConfig@@6B@
    • ??_7CExclusionRegistryConfig@@6B@
    • ??_7CFile@@6B@
    • ??_7CFileExtension@@6B@
    • ??_7CInclusionExtConfig@@6B@
    • ??_7CInclusionFileNameConfig@@6B@
    • ??_7CInclusionFilePathConfig@@6B@
    • ??_7CInclusionFolderConfig@@6B@
    • ??_7CKEvent@@6B@
    • ??_7CList@@6B@
    • ??_7CLockEvent@@6B@
    • ??_7CLockList@@6B@
    • ??_7CMemoryAllocator@@6B@
    • ??_7CMemoryPoolAllocator@@6B@
    • ??_7CModuleConfig@@6B@
    • ??_7CModuleConfigList@@6B@
    • ??_7CModuleFileExtConfig@@6B@
    • ??_7CModuleFlagConfig@@6B@
    • ??_7CModuleMultiStringConfig@@6B@
    • ??_7CModuleStringConfig@@6B@
    • ??_7CNoLockList@@6B@
    • ??_7CStrList@@6B@
    • ??_7CSystemThread@@6B@
    • ??_7CUserFuncAdapterJob@@6B@
    • ??_7CWorkerThread@@6B@
    • ??_7CWorkerThreadJob@@6B@
    • ??_7CWorkerThreadJobQueue@@6B@
    • ??_7CWorkerThreadPool@@6B@
    • ??_7CWorkerThreadPoolEx@@6B@
    • ??_7IMemoryAllocator@@6B@
    • ??_FCContextList@@QAEXXZ
    • ??_FCFile@@QAEXXZ
    • ??_FCFileExtension@@QAEXXZ
    • ??_FCModuleConfigList@@QAEXXZ
    • ??_FCStrList@@QAEXXZ
    • ??_FCSystemThread@@QAEXXZ
    • ??_FCWorkerThread@@QAEXXZ
    • ??_FCWorkerThreadJob@@QAEXXZ
    • ??_FCWorkerThreadJobQueue@@QAEXXZ
    • ??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
    • ??_V@YAXPAX@Z
    • ?Acquire@CLockEvent@@QAEXXZ
    • ?Add@CContextList@@QAEEPAVCContext@@@Z
    • ?Add@CFileExtension@@QAEEPBGK@Z
    • ?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
    • ?Add@CStrList@@QAEEPBG@Z
    • ?AddNode@CLockList@@UAEEQAXE@Z
    • ?AddNode@CNoLockList@@UAEEQAXE@Z
    • ?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
    • ?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
    • ?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
    • ?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
    • ?Cancel@CWorkerThreadJob@@QAEXXZ
    • ?CheckNode@CLockList@@UAEHQAX@Z
    • ?CheckNode@CNoLockList@@UAEHQAX@Z
    • ?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
    • ?Cleanup@CBlobConfig@@AAEXXZ
    • ?Cleanup@CModuleFileExtConfig@@IAEXXZ
    • ?Cleanup@CModuleMultiStringConfig@@IAEXXZ
    • ?Cleanup@CModuleStringConfig@@AAEXXZ
    • ?Close@CFile@@QAEJXZ
    • ?Count@CLockList@@QAEKXZ
    • ?Count@CNoLockList@@QAEKXZ
    • ?Create@CFile@@QAEJPBGKKKK@Z
    • ?Create@CSystemThread@@QAEEXZ
    • ?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
    • ?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
    • ?CreatePool@CWorkerThreadPool@@QAEEXZ
    • ?CreatePool@CWorkerThreadPoolEx@@QAEEXZ
    • ?CreateThreads@CWorkerThreadPool@@QAEEK@Z
    • ?CreateThreads@CWorkerThreadPoolEx@@QAEEK@Z
    • ?CreateWIRP@CFile@@QAEJPBGKKKK@Z
    • ?Delete@CFile@@QAEJXZ
    • ?Delete@CFileExtension@@QAEEPBGK@Z
    • ?Delete@CStrList@@QAEEPBG@Z
    • ?DeleteAll@CList@@UAEXXZ
    • ?DeleteAll@CLockList@@UAEXXZ
    • ?DeleteAll@CNoLockList@@UAEXXZ
    • ?DeleteNode@CContextList@@MAEXPAX@Z
    • ?DeleteNode@CList@@UAEXPAX@Z
    • ?DeleteNode@CModuleConfigList@@MAEXPAX@Z
    • ?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
    • ?DisableWriteProtectFromCR0@@YGXPAPAX@Z
    • ?DoIt@CWorkerThreadJob@@QAEJXZ
    • ?EntryPoint@CSystemThread@@KGXPAX@Z
    • ?Find@CContextList@@QAEPAVCContext@@K@Z
    • ?Find@CContextList@@QAEPAVCContext@@PAX@Z
    • ?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
    • ?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
    • ?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
    • ?FindNode@CContextList@@IAEPAXPAX@Z
    • ?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
    • ?FinishFunction@CUserFuncAdapterJob@@MAEXXZ
    • ?FinishIt@CWorkerThreadJob@@QAEJXZ
    • ?First@CList@@UAEPAXXZ
    • ?First@CLockList@@UAEPAXXZ
    • ?First@CNoLockList@@UAEPAXXZ
    • ?Free@CMemoryAllocator@@UAEXPAX@Z
    • ?Free@CMemoryPoolAllocator@@UAEXPAX@Z
    • ?GetAttributes@CFile@@QAEKXZ
    • ?GetBasicInfomration@CFile@@IAEJXZ
    • ?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
    • ?GetCategory@CContext@@QAEKXZ
    • ?GetData@CBlobConfig@@QAEHPAXPAK@Z
    • ?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
    • ?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
    • ?GetData@CModuleFlagConfig@@QAEKXZ
    • ?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
    • ?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
    • ?GetData@CModuleStringConfig@@QAEPAGXZ
    • ?GetData@CStrList@@QAEEPAGPAK@Z
    • ?GetDataType@CModuleConfig@@QAEKXZ
    • ?GetEngineContext@CContext@@QAEPAXXZ
    • ?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
    • ?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
    • ?GetFileSizeWIRP@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
    • ?GetFlagConfig@CContext@@UAEJKPAK@Z
    • ?GetID@CModuleConfig@@QAEKXZ
    • ?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
    • ?GetLength@CModuleStringConfig@@QAEKXZ
    • ?GetLinkContext@CContext@@QAEPAXXZ
    • ?GetLogFlag@CDebugLog@@QAEKXZ
    • ?GetLogFlag@CDebugLogEx@@QAEKXZ
    • ?GetModuleId@CModuleConfig@@QAEKXZ
    • ?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
    • ?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_KTHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_ETHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_KTHREAD@@XZ
    • ?GetReportCallBackRoutine@CContext@@QAEKXZ
    • ?GetSize@CBlobConfig@@QAEKXZ
    • ?GetStringConfig@CContext@@QAEPAGK@Z
    • ?GetStringConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetThreadCount@CWorkerThreadPool@@QAEKXZ
    • ?GetThreadCount@CWorkerThreadPoolEx@@QAEKXZ
    • ?GetThreadID@CSystemThread@@QAEKXZ
    • ?GetType@CContext@@QAEKXZ
    • ?GetUserParameter@CContext@@QAEKXZ
    • ?InitProcMon@CDebugLogEx@@IAEXXZ
    • ?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
    • ?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
    • ?InitializeFlagConfig@CContext@@QAEHKK@Z
    • ?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
    • ?InitializeStringConfig@CContext@@QAEHKPBG@Z
    • ?Insert@CList@@UAEXQAXE@Z
    • ?Insert@CLockList@@UAEXQAXE@Z
    • ?Insert@CNoLockList@@UAEXQAXE@Z
    • ?InsertAfter@CList@@UAEXPAX0@Z
    • ?InsertBefore@CList@@UAEXPAX0@Z
    • ?Instance@CWorkerThreadPool@@SGPAV1@XZ
    • ?IsEmpty@CList@@UAEEXZ
    • ?IsEmpty@CLockList@@UAEEXZ
    • ?IsEmpty@CNoLockList@@UAEEXZ
    • ?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
    • ?IsFull@CLockList@@QBEEXZ
    • ?IsFull@CNoLockList@@QBEEXZ
    • ?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionExtConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFileNameConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFilePathConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFolderConfig@@QAEEPBG@Z
    • ?IsOpened@CFile@@QAEEXZ
    • ?IsTerminated@CWorkerThreadPool@@QAEEXZ
    • ?IsTerminated@CWorkerThreadPoolEx@@QAEEXZ
    • ?IsValid@CMemoryAllocator@@UAEEXZ
    • ?IsValid@CMemoryPoolAllocator@@UAEEXZ
    • ?IsValid@IMemoryAllocator@@UAEEXZ
    • ?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
    • ?IsWorkerThread@CWorkerThreadPoolEx@@QAEEK@Z
    • ?JobFunction@CUserFuncAdapterJob@@MAEXXZ
    • ?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
    • ?JobQueue@CWorkerThreadPoolEx@@QAEAAVCWorkerThreadJobQueue@@XZ
    • ?Limit@CLockList@@QAEKXZ
    • ?Limit@CNoLockList@@QAEKXZ
    • ?MatchAllExtensions@CFileExtension@@QAEEXZ
    • ?MatchNoExtensions@CFileExtension@@QAEEXZ
    • ?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
    • ?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
    • ?NeedDelete@CWorkerThreadJob@@QAEEXZ
    • ?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
    • ?NewNode@CList@@UAEPAXXZ
    • ?NewNode@CStrList@@EAEPAXXZ
    • ?NewNodeVariant@CList@@IAEPAXK@Z
    • ?Next@CList@@UBEPAXQAX@Z
    • ?Next@CLockList@@UBEPAXQAX@Z
    • ?Next@CNoLockList@@UBEPAXQAX@Z
    • ?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
    • ?NotityTerminate@CWorkerThread@@QAEXXZ
    • ?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
    • ?PostJobToWorkerThread@CWorkerThreadPoolEx@@QAEJP6GXPAX@Z0E1@Z
    • ?Pulse@CKEvent@@QAEJJE@Z
    • ?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
    • ?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
    • ?QueueJobItem@CWorkerThreadPoolEx@@QAEJPAVCWorkerThreadJob@@@Z
    • ?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
    • ?Read@CFile@@QAEJPADKPAK@Z
    • ?ReadWIRP@CFile@@QAEJPADKPAK@Z
    • ?ReferenceCount@CContext@@QAEAAKXZ
    • ?Release@CLockEvent@@QAEXXZ
    • ?Remove@CContextList@@UAEEQAX@Z
    • ?Remove@CList@@UAEEQAX@Z
    • ?Remove@CLockList@@UAEEQAX@Z
    • ?Remove@CNoLockList@@UAEEQAX@Z
    • ?RemoveHead@CList@@UAEPAXXZ
    • ?RemoveHead@CLockList@@UAEPAXXZ
    • ?RemoveHead@CNoLockList@@UAEPAXXZ
    • ?RemoveTail@CList@@UAEPAXXZ
    • ?RemoveTail@CLockList@@UAEPAXXZ
    • ?RemoveTail@CNoLockList@@UAEPAXXZ
    • ?Reset@CKEvent@@QAEXXZ
    • ?ResetData@CInclusionExtConfig@@QAEXXZ
    • ?ResetData@CInclusionFileNameConfig@@QAEXXZ
    • ?ResetData@CInclusionFilePathConfig@@QAEXXZ
    • ?ResetData@CInclusionFolderConfig@@QAEXXZ
    • ?RestoreCR0@@YGXPAX@Z
    • ?Run@CAutoUpdateConfigThread@@UAEXXZ
    • ?Run@CDelayLoadThread@@UAEXXZ
    • ?Run@CWorkerThread@@UAEXXZ
    • ?SeekToEnd@CFile@@QAEJXZ
    • ?Set@CKEvent@@QAEJJE@Z
    • ?SetAttributes@CFile@@QAEJK@Z
    • ?SetBlobCofig@CContext@@UAEJKPAXK@Z
    • ?SetData@CBlobConfig@@QAEHPAXK@Z
    • ?SetData@CModuleFileExtConfig@@QAEHPBG@Z
    • ?SetData@CModuleFlagConfig@@QAEHK@Z
    • ?SetData@CModuleMultiStringConfig@@QAEHPBGK@Z
    • ?SetData@CModuleStringConfig@@QAEHPBG@Z
    • ?SetEngineContext@CContext@@QAEXPAX@Z
    • ?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
    • ?SetFlagConfig@CContext@@UAEJKK@Z
    • ?SetLinkContext@CContext@@QAEXPAX@Z
    • ?SetLogFlag@CDebugLog@@QAEEK@Z
    • ?SetLogFlag@CDebugLogEx@@QAEEK@Z
    • ?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
    • ?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
    • ?SetMultiStringConfig@CContext@@UAEJKPBG@Z
    • ?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
    • ?SetPriority@CSystemThread@@QAEXK@Z
    • ?SetStopUse@CContext@@QAEXXZ
    • ?SetStringConfig@CContext@@UAEJKPBG@Z
    • ?Setup@CSystemThread@@MAEXXZ
    • ?StopUse@CContext@@QAEHXZ
    • ?TearDown@CSystemThread@@MAEXXZ
    • ?Terminate@CSystemThread@@QAEXE@Z
    • ?Terminate@CWorkerThreadPool@@QAEEXZ
    • ?Terminate@CWorkerThreadPoolEx@@QAEEXZ
    • ?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
    • ?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
    • ?WaitFinish@CWorkerThreadJob@@QAEXXZ
    • ?WaitForInit@CDelayLoadThread@@QAEEXZ
    • ?WaitForLoad@CDelayLoadThread@@QAEEXZ
    • ?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
    • ?WaitQueueEmpty@CWorkerThreadJobQueue@@QAEXXZ
    • ?Write@CDebugLog@@QAAXPBDZZ
    • ?Write@CDebugLogEx@@QAAXPBDZZ
    • ?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
    • ?WriteDataToFile@CDebugLogEx@@IAEXPADK@Z
    • ?WriteDataToProcMonW@CDebugLogEx@@IAEXPAD@Z
    • ?WriteSystemInformation@CDebugLog@@QAEXXZ
    • ?WriteSystemInformation@CDebugLogEx@@QAEXXZ
    • ?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
    • ?WriteSystemStringInformation@CDebugLogEx@@IAEXPBG@Z
    • ?WriteToFile@CDebugLog@@IAEXPADK@Z
    • ?WriteToProcMonW@CDebugLogEx@@IAEXPAU_UNICODE_STRING@@@Z
    • ?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
    • ?_pPagedAllocator@@3PAVCMemoryAllocator@@A
    • ?m_lpInstance@CWorkerThreadPool@@1PAV1@A
    • ?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
    • _DeInitKm2UmCommunication@0
    • _DeInitKmLPC@0
    • _DuplicateFullFileName@4
    • _FreeFullFileName@4
    • _GetFileVersionOfNtoskrnl@16
    • _GetKm2UmMode@0
    • _GetModuleInfoByAddress@8
    • _GetModuleInfoByModuleName@8
    • _InitKm2UmCommunication@8
    • _InitKmLPC@0
    • _IsWindows8_1_update@4
    • _KmCallUm@8
    • _KmCallUmByLPC@8
    • _KmCallUmEx@12
    • _KmCleanupCommPortAPIs@0
    • _KmGetUmInitProcess@0
    • _KmSetCommPortAPIs@4
    • _ModGetExportProcAddress@8
    • _ModLoadDLLToBuffer@4
    • _ModLoadDLLToBufferWithImageSize@8
    • _ModLoadModule@8
    • _ModUnLoadModule@4
    • _NormalizeFileName@4
    • _NormalizeFullNtPathToDosName@4
    • _TmCommConfigRoutine@4
    • _UtilAddDeviceInDriveTable@4
    • _UtilAddReparsePointMapping@8
    • _UtilCleanFileReadOnly@4
    • _UtilCloseExclusiveHandle@12
    • _UtilCreateDosFileName@8
    • _UtilDeleteFileForce@4
    • _UtilGetDeviceObjectName@8
    • _UtilGetFileNameFromFileObject@4
    • _UtilGetFileObjectForProcessByEPROC@8
    • _UtilGetFileObjectFromFileName@12
    • _UtilGetProcessName@12
    • _UtilGetSystemDirectory@4
    • _UtilGetSystemDirectoryEx@0
    • _UtilGetSystemDirectoryLength@0
    • _UtilGetSystemTime@4
    • _UtilIoSetFileInfo@24
    • _UtilIopCreateFileIRP@40
    • _UtilKeGetLowFileDevice@16
    • _UtilModuleIATHook@24
    • _UtilModuleIATUnHook@8
    • _UtilPostJobToWorkerThread@12
    • _UtilQueryExclusiveHandle@12
    • _UtilQueryKeyValue@24
    • _UtilRemoveDeviceFromDriveTable@4
    • _UtilVolumeDeviceToDosName@8
    • _UtilWaitValueChangeToZero@8
    • _UtilWriteVersionToRegistry@8
    • _UtilbuildDynamicDiskMappingTable@0
    • _UtlWriteBinValueKeyToRegistry@16
    • _ValidateAddressWithSize@20
    • __ResetProtectFromClose@4
    • __UtilDosPathNameToNtPathName@12

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • PAGE
    • .edata
    • INIT
    • .rsrc
    • .reloc

    Signature

    Expand
    {
      "Certificates": [
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
          "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
          "TBS": {
            "MD5": "d0785ad36e427c92b19f6826ab1e8020",
            "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
            "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
            "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
          },
          "ValidFrom": "2012-12-21 00:00:00",
          "ValidTo": "2020-12-30 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
          "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
          "TBS": {
            "MD5": "e9d38360b914c8863f6cba3ee58764d3",
            "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
            "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
            "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
          },
          "ValidFrom": "2012-10-18 00:00:00",
          "ValidTo": "2020-12-29 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
          "TBS": {
            "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
            "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
            "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
            "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
          },
          "ValidFrom": "2017-04-27 00:00:00",
          "ValidTo": "2018-07-16 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "611993e400000000001c",
          "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
          "TBS": {
            "MD5": "78a717e082dcc1cda3458d917e677d14",
            "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
            "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
            "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
          },
          "ValidFrom": "2011-02-22 19:25:17",
          "ValidTo": "2021-02-22 19:35:17",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
          "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "TBS": {
            "MD5": "b30c31a572b0409383ed3fbe17e56e81",
            "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
            "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
            "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
          },
          "ValidFrom": "2010-02-08 00:00:00",
          "ValidTo": "2020-02-07 23:59:59",
          "Version": 3
        }
      ],
      "CertificatesInfo": "",
      "Signer": [
        {
          "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Version": 1
        }
      ],
      "SignerInfo": ""
    }
    

    PropertyValue
    FilenameTmComm.sys
    Creation Timestamp2011-07-27 20:25:40
    MD5ad866d83b4f0391aecceb4e507011831
    SHA12cc70b772b42e0208f345c7c70d78f7536812f99
    SHA2563e1d47a497babbfd1c83905777b517ec87c65742bee7eb57a2273eca825d2272
    Authentihash MD59242d88e9b533ca214638aadacfb515a
    Authentihash SHA19892893a2a7d2a458ee795eeee065f64d4f6e3c4
    Authentihash SHA2566ad7bdf11a7ce7296a06eb4f14091df84fafdb04413e714f09f9ea6c686a1323
    RichPEHeaderHash MD514f57f14bfadf8c2853ed049e6fe2971
    RichPEHeaderHash SHA1318505d62e83e79bc68d918520aa260b537e69c8
    RichPEHeaderHash SHA256426a0d423024b210c562a0b5b34161f67c5dbac0e8fd1ff5c7b273951f8efa37
    CompanyTrend Micro Inc.
    DescriptionTrendMicro Common Module
    ProductTrend Micro Eyes
    OriginalFilenameTmComm.sys

    Download

    Certificates

    Expand
    Certificate 3825d7faf861af9ef490e726b5d65ad5
    FieldValue
    ToBeSigned (TBS) MD5d6c7684e9aaa508cf268335f83afe040
    ToBeSigned (TBS) SHA118066d20ad92409c567cdfde745279ff71c75226
    ToBeSigned (TBS) SHA256a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff
    SubjectC=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2
    ValidFrom2007-06-15 00:00:00
    ValidTo2012-06-14 23:59:59
    Signature50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber3825d7faf861af9ef490e726b5d65ad5
    Version3
    Certificate 47bf1995df8d524643f7db6d480d31a4
    FieldValue
    ToBeSigned (TBS) MD5518d2ea8a21e879c942d504824ac211c
    ToBeSigned (TBS) SHA121ce87d827077e61abddf2beba69fde5432ea031
    ToBeSigned (TBS) SHA2561ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7
    SubjectC=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
    ValidFrom2003-12-04 00:00:00
    ValidTo2013-12-03 23:59:59
    Signature4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber47bf1995df8d524643f7db6d480d31a4
    Version3
    Certificate 4d6290e58c54f0f1eb17341a1310e6a4
    FieldValue
    ToBeSigned (TBS) MD5b7d8444a70054990435f35a5630df5e1
    ToBeSigned (TBS) SHA14678c6e4a8787a8e6ed2bce8792b122f6c08afd8
    ToBeSigned (TBS) SHA2560a8b4b359ea7890b358e56e436e9cfc6f32b037b2599b597ca7f7a80d475ec98
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
    ValidFrom2010-09-30 00:00:00
    ValidTo2014-01-01 23:59:59
    Signatureaedd211d5f8f807ad25209eadb6ed25d8be8c21b6904be51a5010e59fa37d174a3eedced89742b62d5a6bf4fad361754f013e0a345d24c26cbe26da21fd01e7a070fb6b37b6f5068a2e931b3b7997d8070a0a7de0b1ea4fff34d811bdd20c91cc4afcff18ffad9da95f0ecdc5cbfe88c5a3e7ab0a3eb59437411e09b1a6af36f
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber4d6290e58c54f0f1eb17341a1310e6a4
    Version3
    Certificate 610c120600000000001b
    FieldValue
    ToBeSigned (TBS) MD553c41bc1164e09e0cd1617a5bf913efd
    ToBeSigned (TBS) SHA193c03aac8951d494ecd5696b1c08658541b18727
    ToBeSigned (TBS) SHA25640bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b
    SubjectC=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
    ValidFrom2006-05-23 17:01:29
    ValidTo2016-05-23 17:11:29
    Signature01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber610c120600000000001b
    Version3
    Certificate 24e3d70b86ed54d0b22c3450b960984e
    FieldValue
    ToBeSigned (TBS) MD58ddf6d6623a3f10024af513804bb606d
    ToBeSigned (TBS) SHA14daedaec405b6dfefce005517e230b2419ad08bc
    ToBeSigned (TBS) SHA25654894db2dab64a4991b4deab1a3415d4ea0d9905711af3b67242a0568d799b95
    SubjectC=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, OU=RD, CN=Trend Micro, Inc.
    ValidFrom2011-01-31 00:00:00
    ValidTo2012-02-16 23:59:59
    Signature5ae5a2abcc8bbf832dd651a0cb396ee5af87305e67d20288d6d830699286ce0b1b3ec77c732d80564e6a482461bda52329dc301ec6286011fe60413c97f4207bf675a71460365e9d917b19d7b5e7c49ff035a5488f8fc703a61512b1588cb6fc8ceef0f6353d47c66a5edbef40e53197431ada77acef71cca7db0dbaa88d02355af0a62a7901e91bc8c59ad48b4ecfd67f137023601c308691ad14d6859c9d6b28c6a3e15314e55832cea94793436a5610bbe5f0901cedc6796c9ca53b5d55f79974cd6be7093bba119675614c1654139096e506c3fb92460d45879bdbc196bd833ae4dc31da6e14130df14a20c05615db7ea7e25aa0fe59801ec30a56501e56
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber24e3d70b86ed54d0b22c3450b960984e
    Version3

    Imports

    Expand
    • ntoskrnl.exe
    • HAL.dll
    • CLASSPNP.SYS
    • SCSIPORT.SYS

    Imported Functions

    Expand
    • KeWaitForSingleObject
    • KeReleaseSemaphore
    • KeStackAttachProcess
    • KeUnstackDetachProcess
    • RtlSubAuthoritySid
    • RtlInitializeSid
    • ExAllocatePoolWithTag
    • RtlLengthRequiredSid
    • ExFreePoolWithTag
    • RtlSetDaclSecurityDescriptor
    • RtlCreateSecurityDescriptor
    • RtlAddAccessAllowedAce
    • RtlCreateAcl
    • ObfDereferenceObject
    • ZwSetEvent
    • ZwClose
    • ZwRequestWaitReplyPort
    • ProbeForWrite
    • ZwFreeVirtualMemory
    • ZwAllocateVirtualMemory
    • ObOpenObjectByPointer
    • PsProcessType
    • memmove
    • ZwConnectPort
    • RtlInitUnicodeString
    • RtlUnicodeStringToInteger
    • ZwCreateSection
    • ZwWaitForSingleObject
    • ZwOpenEvent
    • ObfReferenceObject
    • IoGetCurrentProcess
    • DbgBreakPoint
    • PsGetProcessExitTime
    • MmSectionObjectType
    • DbgPrint
    • memset
    • MmIsAddressValid
    • ExInitializeResourceLite
    • ExDeleteResourceLite
    • ZwWriteFile
    • ZwReadFile
    • ZwQueryInformationFile
    • ZwSetInformationFile
    • ZwCreateFile
    • swprintf
    • towupper
    • _wcsnicmp
    • KeInitializeEvent
    • _snprintf
    • PsGetCurrentProcessId
    • RtlTimeToTimeFields
    • ExSystemTimeToLocalTime
    • KeQuerySystemTime
    • ZwCreateKey
    • ZwCreateEvent
    • KeWaitForMultipleObjects
    • ObReferenceObjectByHandle
    • ZwNotifyChangeKey
    • PsGetCurrentThreadId
    • _vsnprintf
    • KeSetPriorityThread
    • PsTerminateSystemThread
    • PsCreateSystemThread
    • KeNumberProcessors
    • ZwQueryInformationProcess
    • PsLookupProcessByProcessId
    • KeDelayExecutionThread
    • ZwOpenDirectoryObject
    • PsSetCreateProcessNotifyRoutine
    • ZwQuerySystemInformation
    • ZwQueryDirectoryFile
    • ZwQueryDirectoryObject
    • ZwDuplicateObject
    • ZwOpenKey
    • ZwEnumerateKey
    • ZwEnumerateValueKey
    • ZwQueryValueKey
    • ZwDeleteValueKey
    • ZwDeleteKey
    • ExGetPreviousMode
    • ZwTerminateProcess
    • ZwOpenProcess
    • ZwQueryKey
    • ZwSetValueKey
    • MmHighestUserAddress
    • IoFreeIrp
    • IoFreeMdl
    • MmUnlockPages
    • KeInitializeSemaphore
    • _strnicmp
    • RtlQueryRegistryValues
    • RtlAppendUnicodeToString
    • mbstowcs
    • ZwQuerySymbolicLinkObject
    • ZwOpenSymbolicLinkObject
    • NtClose
    • ZwSetInformationObject
    • _stricmp
    • ZwUnmapViewOfSection
    • ZwMapViewOfSection
    • ZwOpenFile
    • RtlEqualUnicodeString
    • IoFileObjectType
    • IoCreateFile
    • IofCallDriver
    • IoAllocateIrp
    • MmBuildMdlForNonPagedPool
    • IoAllocateMdl
    • ProbeForRead
    • PsGetVersion
    • MmGetSystemRoutineAddress
    • RtlCopyUnicodeString
    • RtlCompareMemory
    • _snwprintf
    • RtlImageNtHeader
    • RtlFreeUnicodeString
    • RtlAnsiStringToUnicodeString
    • RtlInitAnsiString
    • strrchr
    • ZwQueryVolumeInformationFile
    • ObReferenceObjectByPointer
    • ObQueryNameString
    • IoBuildDeviceIoControlRequest
    • IofCompleteRequest
    • ExEventObjectType
    • _allmul
    • IoDeleteDevice
    • IoDeleteSymbolicLink
    • IoCreateSymbolicLink
    • IoGetDeviceObjectPointer
    • RtlUpperChar
    • RtlCompareUnicodeString
    • strncpy
    • KeServiceDescriptorTable
    • NtOpenProcess
    • ObOpenObjectByName
    • IoDriverObjectType
    • RtlAppendUnicodeStringToString
    • NtQueryInformationProcess
    • PsIsThreadTerminating
    • PsThreadType
    • KeAddSystemServiceTable
    • ZwQueryObject
    • ZwQuerySecurityObject
    • ObInsertObject
    • _allrem
    • IoReleaseVpbSpinLock
    • IoAcquireVpbSpinLock
    • SeCreateAccessState
    • IoGetFileObjectGenericMapping
    • RtlUpcaseUnicodeString
    • ObCreateObject
    • _allshr
    • MmUnmapIoSpace
    • MmGetPhysicalAddress
    • MmFreeContiguousMemory
    • MmAllocateContiguousMemory
    • MmMapIoSpace
    • KeTickCount
    • KeBugCheckEx
    • RtlUnwind
    • KeClearEvent
    • KePulseEvent
    • KeSetEvent
    • wcsrchr
    • memcpy
    • ZwSetSecurityObject
    • IoDeviceObjectType
    • IoCreateDevice
    • RtlGetDaclSecurityDescriptor
    • RtlGetSaclSecurityDescriptor
    • RtlGetGroupSecurityDescriptor
    • RtlGetOwnerSecurityDescriptor
    • RtlLengthSecurityDescriptor
    • SeCaptureSecurityDescriptor
    • SeExports
    • IoIsWdmVersionAvailable
    • RtlLengthSid
    • wcschr
    • RtlAbsoluteToSelfRelativeSD
    • wcsncpy
    • ExReleaseResourceLite
    • ExAcquireResourceExclusiveLite
    • ExAcquireResourceSharedLite
    • ExReleaseFastMutexUnsafe
    • KeLeaveCriticalRegion
    • KeEnterCriticalRegion
    • ExAcquireFastMutexUnsafe
    • _purecall
    • IoBuildAsynchronousFsdRequest
    • KeGetCurrentThread
    • KeRaiseIrqlToDpcLevel
    • KfLowerIrql
    • ExReleaseFastMutex
    • ExAcquireFastMutex
    • ClassInitialize
    • ScsiPortReadPortBufferUshort
    • ScsiPortReadPortUchar
    • ScsiPortWritePortUchar
    • ScsiPortStallExecution
    • ScsiPortWritePortBufferUshort

    Exported Functions

    Expand
    • ??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
    • ??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
    • ??0CBlobConfig@@QAE@ABV0@@Z
    • ??0CBlobConfig@@QAE@K@Z
    • ??0CContext@@QAE@ABV0@@Z
    • ??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
    • ??0CContextList@@QAE@ABV0@@Z
    • ??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CDebugLog@@QAE@ABV0@@Z
    • ??0CDebugLog@@QAE@PBG@Z
    • ??0CDelayLoadThread@@QAE@ABV0@@Z
    • ??0CDelayLoadThread@@QAE@XZ
    • ??0CExclusionExtConfig@@QAE@ABV0@@Z
    • ??0CExclusionExtConfig@@QAE@KKE@Z
    • ??0CExclusionFileNameConfig@@QAE@ABV0@@Z
    • ??0CExclusionFileNameConfig@@QAE@KK@Z
    • ??0CExclusionFilePathConfig@@QAE@ABV0@@Z
    • ??0CExclusionFilePathConfig@@QAE@KK@Z
    • ??0CExclusionFolderConfig@@QAE@ABV0@@Z
    • ??0CExclusionFolderConfig@@QAE@KK@Z
    • ??0CExclusionRegistryConfig@@QAE@ABV0@@Z
    • ??0CExclusionRegistryConfig@@QAE@KK@Z
    • ??0CFile@@QAE@ABV0@@Z
    • ??0CFile@@QAE@E@Z
    • ??0CFileExtension@@QAE@ABV0@@Z
    • ??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
    • ??0CKEvent@@QAE@ABV0@@Z
    • ??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
    • ??0CList@@QAE@ABV0@@Z
    • ??0CList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CLockEvent@@QAE@ABV0@@Z
    • ??0CLockEvent@@QAE@XZ
    • ??0CLockList@@QAE@ABV0@@Z
    • ??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
    • ??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
    • ??0CMemoryAllocator@@QAE@ABV0@@Z
    • ??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
    • ??0CMemoryPoolAllocator@@QAE@ABV0@@Z
    • ??0CModuleConfig@@QAE@ABV0@@Z
    • ??0CModuleConfig@@QAE@XZ
    • ??0CModuleConfigList@@QAE@ABV0@@Z
    • ??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CModuleFileExtConfig@@QAE@ABV0@@Z
    • ??0CModuleFileExtConfig@@QAE@KKE@Z
    • ??0CModuleFlagConfig@@QAE@ABV0@@Z
    • ??0CModuleFlagConfig@@QAE@K@Z
    • ??0CModuleMultiStringConfig@@QAE@ABV0@@Z
    • ??0CModuleMultiStringConfig@@QAE@KK@Z
    • ??0CModuleStringConfig@@QAE@ABV0@@Z
    • ??0CModuleStringConfig@@QAE@K@Z
    • ??0CNoLockList@@QAE@ABV0@@Z
    • ??0CNoLockList@@QAE@KKPAVIMemoryAllocator@@@Z
    • ??0CSmartLock@@QAE@AAVCLockEvent@@@Z
    • ??0CSmartLock@@QAE@XZ
    • ??0CSmartReference@@QAE@AAJ@Z
    • ??0CSmartReference@@QAE@AAK@Z
    • ??0CSmartResource@@QAE@AAVCResource@@E@Z
    • ??0CStrList@@QAE@ABV0@@Z
    • ??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CSystemThread@@QAE@ABV0@@Z
    • ??0CSystemThread@@QAE@K@Z
    • ??0CUserFuncAdapterJob@@QAE@ABV0@@Z
    • ??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z0@Z
    • ??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
    • ??0CWorkerThread@@QAE@ABV0@@Z
    • ??0CWorkerThreadJob@@QAE@ABV0@@Z
    • ??0CWorkerThreadJob@@QAE@E@Z
    • ??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
    • ??0CWorkerThreadJobQueue@@QAE@K@Z
    • ??0CWorkerThreadPool@@QAE@ABV0@@Z
    • ??0CWorkerThreadPool@@QAE@K@Z
    • ??0IMemoryAllocator@@QAE@ABV0@@Z
    • ??0IMemoryAllocator@@QAE@XZ
    • ??1CAutoUpdateConfigThread@@UAE@XZ
    • ??1CBlobConfig@@UAE@XZ
    • ??1CContext@@UAE@XZ
    • ??1CContextList@@UAE@XZ
    • ??1CDebugLog@@UAE@XZ
    • ??1CDelayLoadThread@@UAE@XZ
    • ??1CExclusionExtConfig@@UAE@XZ
    • ??1CExclusionFileNameConfig@@UAE@XZ
    • ??1CExclusionFilePathConfig@@UAE@XZ
    • ??1CExclusionFolderConfig@@UAE@XZ
    • ??1CExclusionRegistryConfig@@UAE@XZ
    • ??1CFile@@UAE@XZ
    • ??1CFileExtension@@UAE@XZ
    • ??1CKEvent@@UAE@XZ
    • ??1CList@@UAE@XZ
    • ??1CLockEvent@@UAE@XZ
    • ??1CLockList@@UAE@XZ
    • ??1CMemoryAllocator@@UAE@XZ
    • ??1CMemoryPoolAllocator@@UAE@XZ
    • ??1CModuleConfig@@UAE@XZ
    • ??1CModuleConfigList@@UAE@XZ
    • ??1CModuleFileExtConfig@@UAE@XZ
    • ??1CModuleFlagConfig@@UAE@XZ
    • ??1CModuleMultiStringConfig@@UAE@XZ
    • ??1CModuleStringConfig@@UAE@XZ
    • ??1CNoLockList@@UAE@XZ
    • ??1CSmartLock@@QAE@XZ
    • ??1CSmartReference@@QAE@XZ
    • ??1CSmartResource@@QAE@XZ
    • ??1CStrList@@UAE@XZ
    • ??1CSystemThread@@UAE@XZ
    • ??1CUserFuncAdapterJob@@UAE@XZ
    • ??1CWorkerThread@@UAE@XZ
    • ??1CWorkerThreadJob@@UAE@XZ
    • ??1CWorkerThreadJobQueue@@UAE@XZ
    • ??1CWorkerThreadPool@@UAE@XZ
    • ??1IMemoryAllocator@@UAE@XZ
    • ??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
    • ??2CMemoryAllocator@@SGPAXI@Z
    • ??2CMemoryPoolAllocator@@SGPAXI@Z
    • ??3@YAXPAX@Z
    • ??3IMemoryAllocator@@SGXPAX@Z
    • ??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
    • ??4CBlobConfig@@QAEAAV0@ABV0@@Z
    • ??4CContext@@QAEAAV0@ABV0@@Z
    • ??4CDebugLog@@QAEAAV0@ABV0@@Z
    • ??4CDelayLoadThread@@QAEAAV0@ABV0@@Z
    • ??4CFile@@QAEAAV0@ABV0@@Z
    • ??4CKEvent@@QAEAAV0@ABV0@@Z
    • ??4CLockEvent@@QAEAAV0@ABV0@@Z
    • ??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
    • ??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
    • ??4CModuleConfig@@QAEAAV0@ABV0@@Z
    • ??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
    • ??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
    • ??4CSmartLock@@QAEAAV0@ABV0@@Z
    • ??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
    • ??4CSmartResource@@QAEAAV0@ABV0@@Z
    • ??4CSystemThread@@QAEAAV0@ABV0@@Z
    • ??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
    • ??4CWorkerThread@@QAEAAV0@ABV0@@Z
    • ??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
    • ??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
    • ??_7CAutoUpdateConfigThread@@6B@
    • ??_7CBlobConfig@@6B@
    • ??_7CContext@@6B@
    • ??_7CContextList@@6B@
    • ??_7CDebugLog@@6B@
    • ??_7CDelayLoadThread@@6B@
    • ??_7CExclusionExtConfig@@6B@
    • ??_7CExclusionFileNameConfig@@6B@
    • ??_7CExclusionFilePathConfig@@6B@
    • ??_7CExclusionFolderConfig@@6B@
    • ??_7CExclusionRegistryConfig@@6B@
    • ??_7CFile@@6B@
    • ??_7CFileExtension@@6B@
    • ??_7CKEvent@@6B@
    • ??_7CList@@6B@
    • ??_7CLockEvent@@6B@
    • ??_7CLockList@@6B@
    • ??_7CMemoryAllocator@@6B@
    • ??_7CMemoryPoolAllocator@@6B@
    • ??_7CModuleConfig@@6B@
    • ??_7CModuleConfigList@@6B@
    • ??_7CModuleFileExtConfig@@6B@
    • ??_7CModuleFlagConfig@@6B@
    • ??_7CModuleMultiStringConfig@@6B@
    • ??_7CModuleStringConfig@@6B@
    • ??_7CNoLockList@@6B@
    • ??_7CStrList@@6B@
    • ??_7CSystemThread@@6B@
    • ??_7CUserFuncAdapterJob@@6B@
    • ??_7CWorkerThread@@6B@
    • ??_7CWorkerThreadJob@@6B@
    • ??_7CWorkerThreadJobQueue@@6B@
    • ??_7CWorkerThreadPool@@6B@
    • ??_7IMemoryAllocator@@6B@
    • ??_FCContextList@@QAEXXZ
    • ??_FCFile@@QAEXXZ
    • ??_FCFileExtension@@QAEXXZ
    • ??_FCModuleConfigList@@QAEXXZ
    • ??_FCStrList@@QAEXXZ
    • ??_FCSystemThread@@QAEXXZ
    • ??_FCWorkerThread@@QAEXXZ
    • ??_FCWorkerThreadJob@@QAEXXZ
    • ??_FCWorkerThreadJobQueue@@QAEXXZ
    • ??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
    • ??_V@YAXPAX@Z
    • ?Acquire@CLockEvent@@QAEXXZ
    • ?Add@CContextList@@QAEEPAVCContext@@@Z
    • ?Add@CFileExtension@@QAEEPBGK@Z
    • ?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
    • ?Add@CStrList@@QAEEPBG@Z
    • ?AddNode@CLockList@@UAEEQAXE@Z
    • ?AddNode@CNoLockList@@UAEEQAXE@Z
    • ?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
    • ?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
    • ?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
    • ?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
    • ?Cancel@CWorkerThreadJob@@QAEXXZ
    • ?CheckNode@CLockList@@UAEHQAX@Z
    • ?CheckNode@CNoLockList@@UAEHQAX@Z
    • ?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
    • ?Cleanup@CBlobConfig@@AAEXXZ
    • ?Cleanup@CModuleFileExtConfig@@IAEXXZ
    • ?Cleanup@CModuleMultiStringConfig@@IAEXXZ
    • ?Cleanup@CModuleStringConfig@@AAEXXZ
    • ?Close@CFile@@QAEJXZ
    • ?Count@CLockList@@QAEKXZ
    • ?Count@CNoLockList@@QAEKXZ
    • ?Create@CFile@@QAEJPBGKKKK@Z
    • ?Create@CSystemThread@@QAEEXZ
    • ?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
    • ?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
    • ?CreatePool@CWorkerThreadPool@@QAEEXZ
    • ?CreateThreads@CWorkerThreadPool@@QAEEK@Z
    • ?CreateWIRP@CFile@@QAEJPBGKKKK@Z
    • ?Delete@CFile@@QAEJXZ
    • ?Delete@CFileExtension@@QAEEPBGK@Z
    • ?Delete@CStrList@@QAEEPBG@Z
    • ?DeleteAll@CList@@UAEXXZ
    • ?DeleteAll@CLockList@@UAEXXZ
    • ?DeleteAll@CNoLockList@@UAEXXZ
    • ?DeleteNode@CContextList@@MAEXPAX@Z
    • ?DeleteNode@CList@@UAEXPAX@Z
    • ?DeleteNode@CModuleConfigList@@MAEXPAX@Z
    • ?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
    • ?DisableWriteProtectFromCR0@@YGXPAPAX@Z
    • ?DoIt@CWorkerThreadJob@@QAEJXZ
    • ?EntryPoint@CSystemThread@@KGXPAX@Z
    • ?Find@CContextList@@QAEPAVCContext@@K@Z
    • ?Find@CContextList@@QAEPAVCContext@@PAX@Z
    • ?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
    • ?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
    • ?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
    • ?FindNode@CContextList@@IAEPAXPAX@Z
    • ?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
    • ?First@CList@@UAEPAXXZ
    • ?First@CLockList@@UAEPAXXZ
    • ?First@CNoLockList@@UAEPAXXZ
    • ?Free@CMemoryAllocator@@UAEXPAX@Z
    • ?Free@CMemoryPoolAllocator@@UAEXPAX@Z
    • ?GetAttributes@CFile@@QAEKXZ
    • ?GetBasicInfomration@CFile@@IAEJXZ
    • ?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
    • ?GetCategory@CContext@@QAEKXZ
    • ?GetData@CBlobConfig@@QAEHPAXPAK@Z
    • ?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
    • ?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
    • ?GetData@CModuleFlagConfig@@QAEKXZ
    • ?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
    • ?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
    • ?GetData@CModuleStringConfig@@QAEPAGXZ
    • ?GetData@CStrList@@QAEEPAGPAK@Z
    • ?GetDataType@CModuleConfig@@QAEKXZ
    • ?GetEngineContext@CContext@@QAEPAXXZ
    • ?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
    • ?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
    • ?GetFlagConfig@CContext@@UAEJKPAK@Z
    • ?GetID@CModuleConfig@@QAEKXZ
    • ?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
    • ?GetLength@CModuleStringConfig@@QAEKXZ
    • ?GetLinkContext@CContext@@QAEPAXXZ
    • ?GetLogFlag@CDebugLog@@QAEKXZ
    • ?GetModuleId@CModuleConfig@@QAEKXZ
    • ?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
    • ?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
    • ?GetReportCallBackRoutine@CContext@@QAEKXZ
    • ?GetSize@CBlobConfig@@QAEKXZ
    • ?GetStringConfig@CContext@@QAEPAGK@Z
    • ?GetStringConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetThreadCount@CWorkerThreadPool@@QAEKXZ
    • ?GetThreadID@CSystemThread@@QAEKXZ
    • ?GetType@CContext@@QAEKXZ
    • ?GetUserParameter@CContext@@QAEKXZ
    • ?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
    • ?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
    • ?InitializeFlagConfig@CContext@@QAEHKK@Z
    • ?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
    • ?InitializeStringConfig@CContext@@QAEHKPBG@Z
    • ?Insert@CList@@UAEXQAXE@Z
    • ?Insert@CLockList@@UAEXQAXE@Z
    • ?Insert@CNoLockList@@UAEXQAXE@Z
    • ?InsertAfter@CList@@UAEXPAX0@Z
    • ?InsertBefore@CList@@UAEXPAX0@Z
    • ?Instance@CWorkerThreadPool@@SGPAV1@XZ
    • ?IsEmpty@CList@@UAEEXZ
    • ?IsEmpty@CLockList@@UAEEXZ
    • ?IsEmpty@CNoLockList@@UAEEXZ
    • ?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
    • ?IsFull@CLockList@@QBEEXZ
    • ?IsFull@CNoLockList@@QBEEXZ
    • ?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
    • ?IsOpened@CFile@@QAEEXZ
    • ?IsTerminated@CWorkerThreadPool@@QAEEXZ
    • ?IsValid@CMemoryAllocator@@UAEEXZ
    • ?IsValid@CMemoryPoolAllocator@@UAEEXZ
    • ?IsValid@IMemoryAllocator@@UAEEXZ
    • ?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
    • ?JobFunction@CUserFuncAdapterJob@@MAEXXZ
    • ?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
    • ?Limit@CLockList@@QAEKXZ
    • ?Limit@CNoLockList@@QAEKXZ
    • ?MatchAllExtensions@CFileExtension@@QAEEXZ
    • ?MatchNoExtensions@CFileExtension@@QAEEXZ
    • ?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
    • ?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
    • ?NeedDelete@CWorkerThreadJob@@QAEEXZ
    • ?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
    • ?NewNode@CList@@UAEPAXXZ
    • ?NewNode@CStrList@@EAEPAXXZ
    • ?NewNodeVariant@CList@@IAEPAXK@Z
    • ?Next@CList@@UBEPAXQAX@Z
    • ?Next@CLockList@@UBEPAXQAX@Z
    • ?Next@CNoLockList@@UBEPAXQAX@Z
    • ?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
    • ?NotityTerminate@CWorkerThread@@QAEXXZ
    • ?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
    • ?Pulse@CKEvent@@QAEJJE@Z
    • ?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
    • ?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
    • ?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
    • ?Read@CFile@@QAEJPADKPAK@Z
    • ?ReferenceCount@CContext@@QAEAAKXZ
    • ?Release@CLockEvent@@QAEXXZ
    • ?Remove@CContextList@@UAEEQAX@Z
    • ?Remove@CList@@UAEEQAX@Z
    • ?Remove@CLockList@@UAEEQAX@Z
    • ?Remove@CNoLockList@@UAEEQAX@Z
    • ?RemoveHead@CList@@UAEPAXXZ
    • ?RemoveHead@CLockList@@UAEPAXXZ
    • ?RemoveHead@CNoLockList@@UAEPAXXZ
    • ?RemoveTail@CList@@UAEPAXXZ
    • ?RemoveTail@CLockList@@UAEPAXXZ
    • ?RemoveTail@CNoLockList@@UAEPAXXZ
    • ?Reset@CKEvent@@QAEXXZ
    • ?RestoreCR0@@YGXPAX@Z
    • ?Run@CAutoUpdateConfigThread@@UAEXXZ
    • ?Run@CDelayLoadThread@@UAEXXZ
    • ?Run@CWorkerThread@@UAEXXZ
    • ?SeekToEnd@CFile@@QAEJXZ
    • ?Set@CKEvent@@QAEJJE@Z
    • ?SetAttributes@CFile@@QAEJK@Z
    • ?SetBlobCofig@CContext@@UAEJKPAXK@Z
    • ?SetData@CBlobConfig@@QAEHPAXK@Z
    • ?SetData@CModuleFileExtConfig@@QAEHPBG@Z
    • ?SetData@CModuleFlagConfig@@QAEHK@Z
    • ?SetData@CModuleMultiStringConfig@@QAEHPBG@Z
    • ?SetData@CModuleStringConfig@@QAEHPBG@Z
    • ?SetEngineContext@CContext@@QAEXPAX@Z
    • ?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
    • ?SetFlagConfig@CContext@@UAEJKK@Z
    • ?SetLinkContext@CContext@@QAEXPAX@Z
    • ?SetLogFlag@CDebugLog@@QAEEK@Z
    • ?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
    • ?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
    • ?SetMultiStringConfig@CContext@@UAEJKPBG@Z
    • ?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
    • ?SetPriority@CSystemThread@@QAEXK@Z
    • ?SetStopUse@CContext@@QAEXXZ
    • ?SetStringConfig@CContext@@UAEJKPBG@Z
    • ?Setup@CSystemThread@@MAEXXZ
    • ?StopUse@CContext@@QAEHXZ
    • ?TearDown@CSystemThread@@MAEXXZ
    • ?Terminate@CSystemThread@@QAEXE@Z
    • ?Terminate@CWorkerThreadPool@@QAEEXZ
    • ?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
    • ?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
    • ?WaitFinish@CWorkerThreadJob@@QAEXXZ
    • ?WaitForReady@CDelayLoadThread@@QAEEXZ
    • ?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
    • ?Write@CDebugLog@@QAAXPBDZZ
    • ?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
    • ?WriteSystemInformation@CDebugLog@@QAEXXZ
    • ?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
    • ?WriteToFile@CDebugLog@@IAEXPADK@Z
    • ?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
    • ?_pPagedAllocator@@3PAVCMemoryAllocator@@A
    • ?m_lpInstance@CWorkerThreadPool@@1PAV1@A
    • ?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
    • _DeInitKmLPC@0
    • _GetModuleInfoByAddress@8
    • _GetModuleInfoByModuleName@8
    • _InitKmLPC@0
    • _KmCallUm@8
    • _KmCallUmEx@12
    • _ModGetExportProcAddress@8
    • _ModLoadDLLToBuffer@4
    • _ModLoadDLLToBufferWithImageSize@8
    • _ModLoadModule@8
    • _ModUnLoadModule@4
    • _NormalizeFileName@4
    • _NormalizeFullNtPathToDosName@4
    • _TmCommConfigRoutine@4
    • _UtilAddDeviceInDriveTable@4
    • _UtilCleanFileReadOnly@4
    • _UtilDeleteFileForce@4
    • _UtilGetFileObjectForProcessByEPROC@8
    • _UtilGetFileObjectFromFileName@12
    • _UtilGetProcessName@12
    • _UtilGetSystemDirectory@4
    • _UtilGetSystemTime@4
    • _UtilIoSetFileInfo@24
    • _UtilIopCreateFileIRP@40
    • _UtilKeGetLowFileDevice@16
    • _UtilModuleIATHook@24
    • _UtilModuleIATUnHook@8
    • _UtilQueryKeyValue@24
    • _UtilRemoveDeviceFromDriveTable@4
    • _UtilVolumeDeviceToDosName@8
    • _UtilWaitValueChangeToZero@8
    • _UtilWriteVersionToRegistry@8
    • _UtilbuildDynamicDiskMappingTable@0
    • __UtilDosPathNameToNtPathName@12

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • PAGE
    • .edata
    • INIT
    • .rsrc
    • .reloc

    Signature

    Expand
    {
      "Certificates": [
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
          "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
          "TBS": {
            "MD5": "d0785ad36e427c92b19f6826ab1e8020",
            "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
            "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
            "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
          },
          "ValidFrom": "2012-12-21 00:00:00",
          "ValidTo": "2020-12-30 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
          "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
          "TBS": {
            "MD5": "e9d38360b914c8863f6cba3ee58764d3",
            "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
            "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
            "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
          },
          "ValidFrom": "2012-10-18 00:00:00",
          "ValidTo": "2020-12-29 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
          "TBS": {
            "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
            "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
            "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
            "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
          },
          "ValidFrom": "2017-04-27 00:00:00",
          "ValidTo": "2018-07-16 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "611993e400000000001c",
          "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
          "TBS": {
            "MD5": "78a717e082dcc1cda3458d917e677d14",
            "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
            "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
            "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
          },
          "ValidFrom": "2011-02-22 19:25:17",
          "ValidTo": "2021-02-22 19:35:17",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
          "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "TBS": {
            "MD5": "b30c31a572b0409383ed3fbe17e56e81",
            "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
            "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
            "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
          },
          "ValidFrom": "2010-02-08 00:00:00",
          "ValidTo": "2020-02-07 23:59:59",
          "Version": 3
        }
      ],
      "CertificatesInfo": "",
      "Signer": [
        {
          "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Version": 1
        }
      ],
      "SignerInfo": ""
    }
    

    PropertyValue
    FilenameTmComm.sys
    Creation Timestamp2009-11-01 22:13:22
    MD5dd9596c18818288845423c68f3f39800
    SHA1fb1570b4865083dfce1fcff2bd72e9e1b03cead5
    SHA2563fa6379951f08ed3cb87eeba9cf0c5f5e1d0317dcfcf003b810df9d795eeb73e
    Authentihash MD5ad490c2e1c6e3f31f1cd1073b03bb866
    Authentihash SHA1a2c557dd6ee13783291800be7a6d28af2bc051a4
    Authentihash SHA2565b08743c8e1de8343ab0a0d453ca76487c6a438608c68c2b2921ea2c2a92821c
    RichPEHeaderHash MD576921aba04baecd2d45f9dfe4dcc990b
    RichPEHeaderHash SHA167b5d031a35a5f2585df570a51ec645d2afa7d42
    RichPEHeaderHash SHA2566bea33a3d3886f3e61db7639abe45fc5e80ab3d1ee18b40248b0816c17f32433
    CompanyTrend Micro Inc.
    DescriptionTrendMicro Common Module
    ProductTrend Micro AEGIS
    OriginalFilenameTmComm.sys

    Download

    Certificates

    Expand
    Certificate 3825d7faf861af9ef490e726b5d65ad5
    FieldValue
    ToBeSigned (TBS) MD5d6c7684e9aaa508cf268335f83afe040
    ToBeSigned (TBS) SHA118066d20ad92409c567cdfde745279ff71c75226
    ToBeSigned (TBS) SHA256a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff
    SubjectC=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2
    ValidFrom2007-06-15 00:00:00
    ValidTo2012-06-14 23:59:59
    Signature50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber3825d7faf861af9ef490e726b5d65ad5
    Version3
    Certificate 47bf1995df8d524643f7db6d480d31a4
    FieldValue
    ToBeSigned (TBS) MD5518d2ea8a21e879c942d504824ac211c
    ToBeSigned (TBS) SHA121ce87d827077e61abddf2beba69fde5432ea031
    ToBeSigned (TBS) SHA2561ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7
    SubjectC=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
    ValidFrom2003-12-04 00:00:00
    ValidTo2013-12-03 23:59:59
    Signature4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber47bf1995df8d524643f7db6d480d31a4
    Version3
    Certificate 4191a15a3978dfcf496566381d4c75c2
    FieldValue
    ToBeSigned (TBS) MD541011f8d0e7c7a6408334ca387914c61
    ToBeSigned (TBS) SHA1c7fc1727f5b75a6421a1f95c73bbdb23580c48e5
    ToBeSigned (TBS) SHA25688dd3952638ee82738c03168e6fd863fe4eab1059ee5e2926ad8cb587c255dc0
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA
    ValidFrom2004-07-16 00:00:00
    ValidTo2014-07-15 23:59:59
    Signatureae3a17b84a7b55fa6455ec40a4ed494190999c89bcaf2e1dca7823f91c190f7feb68bc32d98838dedc3fd389b43fb18296f1a45abaed2e26d3de7c016e000a00a4069211480940f91c1879672324e0bbd5e150ae1bf50edde02e81cd80a36c524f9175558aba22f2d2ea4175882f63557d1e545a9559cad93481c05f5ef67ab5
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber4191a15a3978dfcf496566381d4c75c2
    Version3
    Certificate 645212f783f4d7aba3555729e99ce065
    FieldValue
    ToBeSigned (TBS) MD5e00f0a38c65f7c0b9f19b97448d6a0e3
    ToBeSigned (TBS) SHA191c033a2f289418c4101654dceacef1b25bb55d0
    ToBeSigned (TBS) SHA25638b3fcbdb734b0e3439f3c9a3c4c1712091f577d2b616d41224137faf7ba7c86
    SubjectC=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, OU=RD, CN=Trend Micro, Inc.
    ValidFrom2008-01-16 00:00:00
    ValidTo2011-02-16 23:59:59
    Signature5a693868cea6ba49064b801a0d9e12887a37cbb92cca2950cc5e99c2df9aec5697422e67cd042836daf09a09e739f625255841fed1ec9657cb8b3edc08c55c302574cbdb3f7de2798ed769d766402619b48041f9d90f8c904488788412b1c632055e1afc4a5bbac642cb626bd20fece0feaa6cf9b287887788cf64586309a14a644b5f0595c0ddcb7d789831faedb48451e40e342da4ccbc38a5e992e57e7ce5328d531a8c68e61f9dc9be65605c1bedf3358579000b91a19b3be388bac36b58ca76b72358bd8e74e0a7b08b0587bb7a29758c01af40b80e8e72c76abd3a2babfe7c1ed6e7b1cd9b0221a605062b6d9d0ceb57e0eb305fdc5eb5bf6ea442f4c9
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber645212f783f4d7aba3555729e99ce065
    Version3
    Certificate 610c120600000000001b
    FieldValue
    ToBeSigned (TBS) MD553c41bc1164e09e0cd1617a5bf913efd
    ToBeSigned (TBS) SHA193c03aac8951d494ecd5696b1c08658541b18727
    ToBeSigned (TBS) SHA25640bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b
    SubjectC=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
    ValidFrom2006-05-23 17:01:29
    ValidTo2016-05-23 17:11:29
    Signature01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber610c120600000000001b
    Version3

    Imports

    Expand
    • ntoskrnl.exe
    • HAL.dll
    • CLASSPNP.SYS

    Imported Functions

    Expand
    • ExReleaseFastMutexUnsafe
    • wcsncpy
    • memcpy
    • wcsrchr
    • KeSetEvent
    • KePulseEvent
    • KeClearEvent
    • KeInitializeSemaphore
    • KeWaitForSingleObject
    • DbgPrint
    • KeReleaseSemaphore
    • RtlSubAuthoritySid
    • RtlInitializeSid
    • ExAllocatePoolWithTag
    • RtlLengthRequiredSid
    • ExFreePoolWithTag
    • RtlSetDaclSecurityDescriptor
    • RtlCreateSecurityDescriptor
    • RtlAddAccessAllowedAce
    • RtlCreateAcl
    • ObfDereferenceObject
    • ZwSetEvent
    • ZwClose
    • KeUnstackDetachProcess
    • ZwRequestWaitReplyPort
    • memmove
    • KeStackAttachProcess
    • ZwConnectPort
    • RtlInitUnicodeString
    • ZwCreateSection
    • ZwWaitForSingleObject
    • ZwOpenEvent
    • ObfReferenceObject
    • IoGetCurrentProcess
    • memset
    • MmIsAddressValid
    • ZwWriteFile
    • ZwReadFile
    • ZwQueryInformationFile
    • ZwSetInformationFile
    • ZwCreateFile
    • swprintf
    • towupper
    • _wcsnicmp
    • KeInitializeEvent
    • _snprintf
    • PsGetCurrentProcessId
    • RtlTimeToTimeFields
    • ExSystemTimeToLocalTime
    • KeQuerySystemTime
    • ZwCreateKey
    • ZwCreateEvent
    • KeWaitForMultipleObjects
    • ObReferenceObjectByHandle
    • ZwNotifyChangeKey
    • PsGetCurrentThreadId
    • _vsnprintf
    • KeSetPriorityThread
    • PsTerminateSystemThread
    • PsCreateSystemThread
    • KeNumberProcessors
    • ZwQuerySystemInformation
    • ZwQueryDirectoryFile
    • ZwOpenDirectoryObject
    • ZwQueryDirectoryObject
    • ZwDuplicateObject
    • ZwOpenKey
    • ZwEnumerateKey
    • ZwEnumerateValueKey
    • ZwQueryValueKey
    • ZwDeleteValueKey
    • ZwDeleteKey
    • ExGetPreviousMode
    • ZwTerminateProcess
    • ObOpenObjectByPointer
    • PsProcessType
    • KeLeaveCriticalRegion
    • ZwQueryKey
    • ZwSetValueKey
    • MmHighestUserAddress
    • IoFreeIrp
    • IoFreeMdl
    • MmUnlockPages
    • _purecall
    • ProbeForWrite
    • _strnicmp
    • RtlQueryRegistryValues
    • RtlAppendUnicodeToString
    • KeDelayExecutionThread
    • mbstowcs
    • ZwQuerySymbolicLinkObject
    • ZwOpenSymbolicLinkObject
    • NtClose
    • ZwSetInformationObject
    • _stricmp
    • ZwUnmapViewOfSection
    • ZwMapViewOfSection
    • ZwOpenFile
    • RtlEqualUnicodeString
    • IoFileObjectType
    • IoCreateFile
    • IofCallDriver
    • IoAllocateIrp
    • PsGetVersion
    • MmGetSystemRoutineAddress
    • RtlCompareMemory
    • RtlCopyUnicodeString
    • RtlImageNtHeader
    • PsLookupProcessByProcessId
    • RtlFreeUnicodeString
    • RtlAnsiStringToUnicodeString
    • RtlInitAnsiString
    • strrchr
    • KeBugCheckEx
    • RtlAppendUnicodeStringToString
    • IofCompleteRequest
    • ExEventObjectType
    • _allmul
    • IoDeleteDevice
    • IoDeleteSymbolicLink
    • IoCreateSymbolicLink
    • ProbeForRead
    • IoGetDeviceObjectPointer
    • MmBuildMdlForNonPagedPool
    • IoAllocateMdl
    • RtlUpperChar
    • RtlCompareUnicodeString
    • strncpy
    • KeServiceDescriptorTable
    • NtOpenProcess
    • ObReferenceObjectByPointer
    • MmSectionObjectType
    • ObQueryNameString
    • ObOpenObjectByName
    • IoDriverObjectType
    • NtQueryInformationProcess
    • _snwprintf
    • ZwAllocateVirtualMemory
    • ZwFreeVirtualMemory
    • KeAddSystemServiceTable
    • ZwQueryObject
    • ZwQuerySecurityObject
    • ObInsertObject
    • _allrem
    • IoBuildDeviceIoControlRequest
    • IoReleaseVpbSpinLock
    • IoAcquireVpbSpinLock
    • SeCreateAccessState
    • IoGetFileObjectGenericMapping
    • ObCreateObject
    • _allshr
    • KeTickCount
    • RtlUnwind
    • KeEnterCriticalRegion
    • ZwOpenProcess
    • ExAcquireFastMutexUnsafe
    • ZwSetSecurityObject
    • IoDeviceObjectType
    • IoCreateDevice
    • RtlGetDaclSecurityDescriptor
    • RtlGetSaclSecurityDescriptor
    • RtlGetGroupSecurityDescriptor
    • RtlGetOwnerSecurityDescriptor
    • RtlLengthSecurityDescriptor
    • SeCaptureSecurityDescriptor
    • SeExports
    • IoIsWdmVersionAvailable
    • RtlLengthSid
    • wcschr
    • RtlAbsoluteToSelfRelativeSD
    • IoBuildAsynchronousFsdRequest
    • KeGetCurrentThread
    • KfLowerIrql
    • KeRaiseIrqlToDpcLevel
    • ClassInitialize

    Exported Functions

    Expand
    • ??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
    • ??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
    • ??0CBlobConfig@@QAE@ABV0@@Z
    • ??0CBlobConfig@@QAE@K@Z
    • ??0CContext@@QAE@ABV0@@Z
    • ??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
    • ??0CContextList@@QAE@ABV0@@Z
    • ??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CDebugLog@@QAE@ABV0@@Z
    • ??0CDebugLog@@QAE@PBG@Z
    • ??0CExclusionExtConfig@@QAE@ABV0@@Z
    • ??0CExclusionExtConfig@@QAE@KKE@Z
    • ??0CExclusionFileNameConfig@@QAE@ABV0@@Z
    • ??0CExclusionFileNameConfig@@QAE@KK@Z
    • ??0CExclusionFilePathConfig@@QAE@ABV0@@Z
    • ??0CExclusionFilePathConfig@@QAE@KK@Z
    • ??0CExclusionFolderConfig@@QAE@ABV0@@Z
    • ??0CExclusionFolderConfig@@QAE@KK@Z
    • ??0CExclusionRegistryConfig@@QAE@ABV0@@Z
    • ??0CExclusionRegistryConfig@@QAE@KK@Z
    • ??0CFile@@QAE@ABV0@@Z
    • ??0CFile@@QAE@E@Z
    • ??0CFileExtension@@QAE@ABV0@@Z
    • ??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
    • ??0CKEvent@@QAE@ABV0@@Z
    • ??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
    • ??0CList@@QAE@ABV0@@Z
    • ??0CList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CLockEvent@@QAE@ABV0@@Z
    • ??0CLockEvent@@QAE@XZ
    • ??0CLockList@@QAE@ABV0@@Z
    • ??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
    • ??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
    • ??0CMemoryAllocator@@QAE@ABV0@@Z
    • ??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
    • ??0CMemoryPoolAllocator@@QAE@ABV0@@Z
    • ??0CModuleConfig@@QAE@ABV0@@Z
    • ??0CModuleConfig@@QAE@XZ
    • ??0CModuleConfigList@@QAE@ABV0@@Z
    • ??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CModuleFileExtConfig@@QAE@ABV0@@Z
    • ??0CModuleFileExtConfig@@QAE@KKE@Z
    • ??0CModuleFlagConfig@@QAE@ABV0@@Z
    • ??0CModuleFlagConfig@@QAE@K@Z
    • ??0CModuleMultiStringConfig@@QAE@ABV0@@Z
    • ??0CModuleMultiStringConfig@@QAE@KK@Z
    • ??0CModuleStringConfig@@QAE@ABV0@@Z
    • ??0CModuleStringConfig@@QAE@K@Z
    • ??0CSmartLock@@QAE@AAVCLockEvent@@@Z
    • ??0CSmartLock@@QAE@XZ
    • ??0CSmartReference@@QAE@AAJ@Z
    • ??0CSmartReference@@QAE@AAK@Z
    • ??0CStrList@@QAE@ABV0@@Z
    • ??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CSystemThread@@QAE@ABV0@@Z
    • ??0CSystemThread@@QAE@K@Z
    • ??0CUserFuncAdapterJob@@QAE@ABV0@@Z
    • ??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z0@Z
    • ??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
    • ??0CWorkerThread@@QAE@ABV0@@Z
    • ??0CWorkerThreadJob@@QAE@ABV0@@Z
    • ??0CWorkerThreadJob@@QAE@E@Z
    • ??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
    • ??0CWorkerThreadJobQueue@@QAE@K@Z
    • ??0CWorkerThreadPool@@QAE@ABV0@@Z
    • ??0CWorkerThreadPool@@QAE@K@Z
    • ??0IMemoryAllocator@@QAE@ABV0@@Z
    • ??0IMemoryAllocator@@QAE@XZ
    • ??1CAutoUpdateConfigThread@@UAE@XZ
    • ??1CBlobConfig@@UAE@XZ
    • ??1CContext@@UAE@XZ
    • ??1CContextList@@UAE@XZ
    • ??1CDebugLog@@UAE@XZ
    • ??1CExclusionExtConfig@@UAE@XZ
    • ??1CExclusionFileNameConfig@@UAE@XZ
    • ??1CExclusionFilePathConfig@@UAE@XZ
    • ??1CExclusionFolderConfig@@UAE@XZ
    • ??1CExclusionRegistryConfig@@UAE@XZ
    • ??1CFile@@UAE@XZ
    • ??1CFileExtension@@UAE@XZ
    • ??1CKEvent@@UAE@XZ
    • ??1CList@@UAE@XZ
    • ??1CLockEvent@@UAE@XZ
    • ??1CLockList@@UAE@XZ
    • ??1CMemoryAllocator@@UAE@XZ
    • ??1CMemoryPoolAllocator@@UAE@XZ
    • ??1CModuleConfig@@UAE@XZ
    • ??1CModuleConfigList@@UAE@XZ
    • ??1CModuleFileExtConfig@@UAE@XZ
    • ??1CModuleFlagConfig@@UAE@XZ
    • ??1CModuleMultiStringConfig@@UAE@XZ
    • ??1CModuleStringConfig@@UAE@XZ
    • ??1CSmartLock@@QAE@XZ
    • ??1CSmartReference@@QAE@XZ
    • ??1CStrList@@UAE@XZ
    • ??1CSystemThread@@UAE@XZ
    • ??1CUserFuncAdapterJob@@UAE@XZ
    • ??1CWorkerThread@@UAE@XZ
    • ??1CWorkerThreadJob@@UAE@XZ
    • ??1CWorkerThreadJobQueue@@UAE@XZ
    • ??1CWorkerThreadPool@@UAE@XZ
    • ??1IMemoryAllocator@@UAE@XZ
    • ??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
    • ??2CMemoryAllocator@@SGPAXI@Z
    • ??2CMemoryPoolAllocator@@SGPAXI@Z
    • ??3@YAXPAX@Z
    • ??3IMemoryAllocator@@SGXPAX@Z
    • ??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
    • ??4CBlobConfig@@QAEAAV0@ABV0@@Z
    • ??4CContext@@QAEAAV0@ABV0@@Z
    • ??4CDebugLog@@QAEAAV0@ABV0@@Z
    • ??4CFile@@QAEAAV0@ABV0@@Z
    • ??4CKEvent@@QAEAAV0@ABV0@@Z
    • ??4CLockEvent@@QAEAAV0@ABV0@@Z
    • ??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
    • ??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
    • ??4CModuleConfig@@QAEAAV0@ABV0@@Z
    • ??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
    • ??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
    • ??4CSmartLock@@QAEAAV0@ABV0@@Z
    • ??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
    • ??4CSystemThread@@QAEAAV0@ABV0@@Z
    • ??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
    • ??4CWorkerThread@@QAEAAV0@ABV0@@Z
    • ??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
    • ??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
    • ??_7CAutoUpdateConfigThread@@6B@
    • ??_7CBlobConfig@@6B@
    • ??_7CContext@@6B@
    • ??_7CContextList@@6B@
    • ??_7CDebugLog@@6B@
    • ??_7CExclusionExtConfig@@6B@
    • ??_7CExclusionFileNameConfig@@6B@
    • ??_7CExclusionFilePathConfig@@6B@
    • ??_7CExclusionFolderConfig@@6B@
    • ??_7CExclusionRegistryConfig@@6B@
    • ??_7CFile@@6B@
    • ??_7CFileExtension@@6B@
    • ??_7CKEvent@@6B@
    • ??_7CList@@6B@
    • ??_7CLockEvent@@6B@
    • ??_7CLockList@@6B@
    • ??_7CMemoryAllocator@@6B@
    • ??_7CMemoryPoolAllocator@@6B@
    • ??_7CModuleConfig@@6B@
    • ??_7CModuleConfigList@@6B@
    • ??_7CModuleFileExtConfig@@6B@
    • ??_7CModuleFlagConfig@@6B@
    • ??_7CModuleMultiStringConfig@@6B@
    • ??_7CModuleStringConfig@@6B@
    • ??_7CStrList@@6B@
    • ??_7CSystemThread@@6B@
    • ??_7CUserFuncAdapterJob@@6B@
    • ??_7CWorkerThread@@6B@
    • ??_7CWorkerThreadJob@@6B@
    • ??_7CWorkerThreadJobQueue@@6B@
    • ??_7CWorkerThreadPool@@6B@
    • ??_7IMemoryAllocator@@6B@
    • ??_FCContextList@@QAEXXZ
    • ??_FCFile@@QAEXXZ
    • ??_FCFileExtension@@QAEXXZ
    • ??_FCModuleConfigList@@QAEXXZ
    • ??_FCStrList@@QAEXXZ
    • ??_FCSystemThread@@QAEXXZ
    • ??_FCWorkerThread@@QAEXXZ
    • ??_FCWorkerThreadJob@@QAEXXZ
    • ??_FCWorkerThreadJobQueue@@QAEXXZ
    • ??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
    • ??_V@YAXPAX@Z
    • ?Acquire@CLockEvent@@QAEXXZ
    • ?Add@CContextList@@QAEEPAVCContext@@@Z
    • ?Add@CFileExtension@@QAEEPBGK@Z
    • ?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
    • ?Add@CStrList@@QAEEPBG@Z
    • ?AddNode@CLockList@@UAEEQAXE@Z
    • ?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
    • ?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
    • ?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
    • ?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
    • ?Cancel@CWorkerThreadJob@@QAEXXZ
    • ?CheckNode@CLockList@@UAEHQAX@Z
    • ?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
    • ?Cleanup@CBlobConfig@@AAEXXZ
    • ?Cleanup@CModuleFileExtConfig@@IAEXXZ
    • ?Cleanup@CModuleMultiStringConfig@@IAEXXZ
    • ?Cleanup@CModuleStringConfig@@AAEXXZ
    • ?Close@CFile@@QAEJXZ
    • ?Count@CLockList@@QAEKXZ
    • ?Create@CFile@@QAEJPBGKKKK@Z
    • ?Create@CSystemThread@@QAEEXZ
    • ?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
    • ?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
    • ?CreatePool@CWorkerThreadPool@@QAEEXZ
    • ?CreateThreads@CWorkerThreadPool@@QAEEK@Z
    • ?CreateWIRP@CFile@@QAEJPBGKKKK@Z
    • ?Delete@CFile@@QAEJXZ
    • ?Delete@CFileExtension@@QAEEPBGK@Z
    • ?Delete@CStrList@@QAEEPBG@Z
    • ?DeleteAll@CList@@UAEXXZ
    • ?DeleteAll@CLockList@@UAEXXZ
    • ?DeleteNode@CContextList@@MAEXPAX@Z
    • ?DeleteNode@CList@@UAEXPAX@Z
    • ?DeleteNode@CModuleConfigList@@MAEXPAX@Z
    • ?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
    • ?DisableWriteProtectFromCR0@@YGXPAPAX@Z
    • ?DoIt@CWorkerThreadJob@@QAEJXZ
    • ?EntryPoint@CSystemThread@@KGXPAX@Z
    • ?Find@CContextList@@QAEPAVCContext@@K@Z
    • ?Find@CContextList@@QAEPAVCContext@@PAX@Z
    • ?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
    • ?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
    • ?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
    • ?FindNode@CContextList@@IAEPAXPAX@Z
    • ?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
    • ?First@CList@@UAEPAXXZ
    • ?First@CLockList@@UAEPAXXZ
    • ?Free@CMemoryAllocator@@UAEXPAX@Z
    • ?Free@CMemoryPoolAllocator@@UAEXPAX@Z
    • ?GetAttributes@CFile@@QAEKXZ
    • ?GetBasicInfomration@CFile@@IAEJXZ
    • ?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
    • ?GetCategory@CContext@@QAEKXZ
    • ?GetData@CBlobConfig@@QAEHPAXPAK@Z
    • ?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
    • ?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
    • ?GetData@CModuleFlagConfig@@QAEKXZ
    • ?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
    • ?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
    • ?GetData@CModuleStringConfig@@QAEPAGXZ
    • ?GetData@CStrList@@QAEEPAGPAK@Z
    • ?GetDataType@CModuleConfig@@QAEKXZ
    • ?GetEngineContext@CContext@@QAEPAXXZ
    • ?GetFBCallBackRoutine@CContext@@QAEKXZ
    • ?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
    • ?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
    • ?GetFlagConfig@CContext@@UAEJKPAK@Z
    • ?GetID@CModuleConfig@@QAEKXZ
    • ?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
    • ?GetLength@CModuleStringConfig@@QAEKXZ
    • ?GetLinkContext@CContext@@QAEPAXXZ
    • ?GetLogFlag@CDebugLog@@QAEKXZ
    • ?GetModuleId@CModuleConfig@@QAEKXZ
    • ?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
    • ?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
    • ?GetReportCallBackRoutine@CContext@@QAEKXZ
    • ?GetSize@CBlobConfig@@QAEKXZ
    • ?GetStringConfig@CContext@@QAEPAGK@Z
    • ?GetStringConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetThreadCount@CWorkerThreadPool@@QAEKXZ
    • ?GetThreadID@CSystemThread@@QAEKXZ
    • ?GetType@CContext@@QAEKXZ
    • ?GetUserParameter@CContext@@QAEKXZ
    • ?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
    • ?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
    • ?InitializeFlagConfig@CContext@@QAEHKK@Z
    • ?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
    • ?InitializeStringConfig@CContext@@QAEHKPBG@Z
    • ?Insert@CList@@UAEXQAXE@Z
    • ?Insert@CLockList@@UAEXQAXE@Z
    • ?InsertAfter@CList@@UAEXPAX0@Z
    • ?InsertBefore@CList@@UAEXPAX0@Z
    • ?Instance@CWorkerThreadPool@@SGPAV1@XZ
    • ?IsEmpty@CList@@UAEEXZ
    • ?IsEmpty@CLockList@@UAEEXZ
    • ?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
    • ?IsFull@CLockList@@QBEEXZ
    • ?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
    • ?IsOpened@CFile@@QAEEXZ
    • ?IsTerminated@CWorkerThreadPool@@QAEEXZ
    • ?IsValid@CMemoryAllocator@@UAEEXZ
    • ?IsValid@CMemoryPoolAllocator@@UAEEXZ
    • ?IsValid@IMemoryAllocator@@UAEEXZ
    • ?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
    • ?JobFunction@CUserFuncAdapterJob@@MAEXXZ
    • ?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
    • ?Limit@CLockList@@QAEKXZ
    • ?MatchAllExtensions@CFileExtension@@QAEEXZ
    • ?MatchNoExtensions@CFileExtension@@QAEEXZ
    • ?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
    • ?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
    • ?NeedDelete@CWorkerThreadJob@@QAEEXZ
    • ?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
    • ?NewNode@CList@@UAEPAXXZ
    • ?NewNode@CStrList@@EAEPAXXZ
    • ?NewNodeVariant@CList@@IAEPAXK@Z
    • ?Next@CList@@UBEPAXQAX@Z
    • ?Next@CLockList@@UBEPAXQAX@Z
    • ?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
    • ?NotityTerminate@CWorkerThread@@QAEXXZ
    • ?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
    • ?Pulse@CKEvent@@QAEJJE@Z
    • ?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
    • ?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
    • ?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
    • ?Read@CFile@@QAEJPADKPAK@Z
    • ?ReferenceCount@CContext@@QAEAAKXZ
    • ?Release@CLockEvent@@QAEXXZ
    • ?Remove@CContextList@@UAEEQAX@Z
    • ?Remove@CList@@UAEEQAX@Z
    • ?Remove@CLockList@@UAEEQAX@Z
    • ?RemoveHead@CList@@UAEPAXXZ
    • ?RemoveHead@CLockList@@UAEPAXXZ
    • ?RemoveTail@CList@@UAEPAXXZ
    • ?RemoveTail@CLockList@@UAEPAXXZ
    • ?Reset@CKEvent@@QAEXXZ
    • ?RestoreCR0@@YGXPAX@Z
    • ?Run@CAutoUpdateConfigThread@@UAEXXZ
    • ?Run@CWorkerThread@@UAEXXZ
    • ?SeekToEnd@CFile@@QAEJXZ
    • ?Set@CKEvent@@QAEJJE@Z
    • ?SetAttributes@CFile@@QAEJK@Z
    • ?SetBlobCofig@CContext@@UAEJKPAXK@Z
    • ?SetData@CBlobConfig@@QAEHPAXK@Z
    • ?SetData@CModuleFileExtConfig@@QAEHPBG@Z
    • ?SetData@CModuleFlagConfig@@QAEHK@Z
    • ?SetData@CModuleMultiStringConfig@@QAEHPBG@Z
    • ?SetData@CModuleStringConfig@@QAEHPBG@Z
    • ?SetEngineContext@CContext@@QAEXPAX@Z
    • ?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
    • ?SetFlagConfig@CContext@@UAEJKK@Z
    • ?SetLinkContext@CContext@@QAEXPAX@Z
    • ?SetLogFlag@CDebugLog@@QAEEK@Z
    • ?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
    • ?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
    • ?SetMultiStringConfig@CContext@@UAEJKPBG@Z
    • ?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
    • ?SetPriority@CSystemThread@@QAEXK@Z
    • ?SetStopUse@CContext@@QAEXXZ
    • ?SetStringConfig@CContext@@UAEJKPBG@Z
    • ?Setup@CSystemThread@@MAEXXZ
    • ?StopUse@CContext@@QAEHXZ
    • ?TearDown@CSystemThread@@MAEXXZ
    • ?Terminate@CSystemThread@@QAEXE@Z
    • ?Terminate@CWorkerThreadPool@@QAEEXZ
    • ?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
    • ?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
    • ?WaitFinish@CWorkerThreadJob@@QAEXXZ
    • ?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
    • ?Write@CDebugLog@@QAAXPBDZZ
    • ?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
    • ?WriteSystemInformation@CDebugLog@@QAEXXZ
    • ?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
    • ?WriteToFile@CDebugLog@@IAEXPADK@Z
    • ?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
    • ?_pPagedAllocator@@3PAVCMemoryAllocator@@A
    • ?m_lpInstance@CWorkerThreadPool@@1PAV1@A
    • ?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
    • _DeInitKmLPC@0
    • _GetModuleInfoByAddress@8
    • _GetModuleInfoByModuleName@8
    • _InitKmLPC@0
    • _KmCallUm@8
    • _ModGetExportProcAddress@8
    • _ModLoadDLLToBuffer@4
    • _ModLoadModule@8
    • _ModUnLoadModule@4
    • _NormalizeFileName@4
    • _NormalizeFullNtPathToDosName@4
    • _TmCommConfigRoutine@4
    • _UtilCleanFileReadOnly@4
    • _UtilDeleteFileForce@4
    • _UtilGetFileObjectForProcessByEPROC@8
    • _UtilGetFileObjectFromFileName@12
    • _UtilGetProcessName@12
    • _UtilGetSystemTime@4
    • _UtilIoSetFileInfo@24
    • _UtilIopCreateFileIRP@40
    • _UtilKeGetLowFileDevice@16
    • _UtilModuleIATHook@24
    • _UtilModuleIATUnHook@8
    • _UtilQueryKeyValue@24
    • _UtilVolumeDeviceToDosName@8
    • _UtilWaitValueChangeToZero@8
    • _UtilWriteVersionToRegistry@8
    • _UtilbuildDynamicDiskMappingTable@0
    • __UtilDosPathNameToNtPathName@12

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • PAGE
    • .edata
    • INIT
    • .rsrc
    • .reloc

    Signature

    Expand
    {
      "Certificates": [
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
          "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
          "TBS": {
            "MD5": "d0785ad36e427c92b19f6826ab1e8020",
            "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
            "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
            "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
          },
          "ValidFrom": "2012-12-21 00:00:00",
          "ValidTo": "2020-12-30 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
          "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
          "TBS": {
            "MD5": "e9d38360b914c8863f6cba3ee58764d3",
            "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
            "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
            "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
          },
          "ValidFrom": "2012-10-18 00:00:00",
          "ValidTo": "2020-12-29 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
          "TBS": {
            "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
            "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
            "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
            "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
          },
          "ValidFrom": "2017-04-27 00:00:00",
          "ValidTo": "2018-07-16 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "611993e400000000001c",
          "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
          "TBS": {
            "MD5": "78a717e082dcc1cda3458d917e677d14",
            "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
            "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
            "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
          },
          "ValidFrom": "2011-02-22 19:25:17",
          "ValidTo": "2021-02-22 19:35:17",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
          "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "TBS": {
            "MD5": "b30c31a572b0409383ed3fbe17e56e81",
            "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
            "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
            "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
          },
          "ValidFrom": "2010-02-08 00:00:00",
          "ValidTo": "2020-02-07 23:59:59",
          "Version": 3
        }
      ],
      "CertificatesInfo": "",
      "Signer": [
        {
          "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Version": 1
        }
      ],
      "SignerInfo": ""
    }
    

    PropertyValue
    FilenameTmComm.sys
    Creation Timestamp2019-11-18 03:29:47
    MD53e796eb95aca7e620d6a0c2118d6871b
    SHA1dc6e62dbde5869a6adc92253fff6326b6af5c8d4
    SHA256478d855b648ef4501d3b08b3b10e94076ac67546b0ce86b454324f1bf9a78aa0
    Authentihash MD53d01509bec77747dea890e23147245ca
    Authentihash SHA13dab396397670007e1d04f9497a7d4d6244d0cb7
    Authentihash SHA256c032e2abdf4f07ba42ce4559e6413387becbebb0a43c287b6d367dbb33bde751
    RichPEHeaderHash MD55b33b237bab6e0b50320054616983177
    RichPEHeaderHash SHA1754c63349a54279bb01f24974f9faf6da8294d27
    RichPEHeaderHash SHA256001d9e469d2c4160f8fbff1c0aee013e72881cffb568910a2c1473a17bf858b2
    CompanyTrend Micro Inc.
    DescriptionTrendMicro Common Module
    ProductTrend Micro Eyes
    OriginalFilenameTmComm.sys

    Download

    Certificates

    Expand
    Certificate 0ea0fe4dfb74cc64bc32143103c27c8b
    FieldValue
    ToBeSigned (TBS) MD5e93e004baa6013b41135ac0648e29d5b
    ToBeSigned (TBS) SHA1dc91e26674d4b627319c700d3ebb1a6cf83d358e
    ToBeSigned (TBS) SHA2560d20335edb166a303411548471bee6f301c8b4f7f7e453d09c15303de2c888d7
    SubjectC=TW, L=Taipei, O=Trend Micro, Inc., OU=Taipei, TW, CN=Trend Micro, Inc.
    ValidFrom2019-07-12 00:00:00
    ValidTo2020-07-10 12:00:00
    Signature5c08ae5d586a4751195382d6889dc2fc500e7c39c641e1a58def8d923e12b754e2cc35720cc8d3d29382980debf7d98fcc17d764187126dd07c134fdbb96dd44fe8a40195df6f6acd1881fa5ba2921dadceb3f64422344672834813916bbdf317533cf6aaf3317d78197d7d6c560ad681de135f39e2d4ad345b7fe491162660a5462c6075fd725382df1e6e6bc3a4c443be778f79b07f181082e38150ca28ab932f99e4bc4185dc5b3b6edf22c187fdfd84e23a21e7da1989837f43b89aa172e6b34dbcb297bffd511a1d1c100b25e0e921f622a0845e23317f9fec83659ca21c241800683e0dd66ce4d042a8aefc4142b5923a6fa93ee72c48e8dc04c13b4b0
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber0ea0fe4dfb74cc64bc32143103c27c8b
    Version3
    Certificate 61204db4000000000027
    FieldValue
    ToBeSigned (TBS) MD58e3ffc222fbcebdbb8b23115ab259be7
    ToBeSigned (TBS) SHA1ee20bff28ffe13be731c294c90d6ded5aae0ec0e
    ToBeSigned (TBS) SHA25659826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821
    SubjectC=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
    ValidFrom2011-04-15 19:45:33
    ValidTo2021-04-15 19:55:33
    Signature208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber61204db4000000000027
    Version3
    Certificate 03019a023aff58b16bd6d5eae617f066
    FieldValue
    ToBeSigned (TBS) MD5a752afee44f017e8d74e3f3eb7914ae3
    ToBeSigned (TBS) SHA18eca80a6b80e9c69dcef7745748524afb8019e2d
    ToBeSigned (TBS) SHA25682560fa7efec30b5ff82af643e6f3bf3d46868bbd5e7d76f93db185e9e3553a1
    SubjectC=US, O=DigiCert, CN=DigiCert Timestamp Responder
    ValidFrom2014-10-22 00:00:00
    ValidTo2024-10-22 00:00:00
    Signature9d257e1b334db226815c9b86ce23200f8087e588ffffb1d46a2c31ed3a17197117cda91bbc5a1639009de36c84e45a40fbde06018c37fa9bb19d247efe20a457ad5bb79ab06026ea6957215d342f1f71b0839419056b359010a07b97c7f63fe7e21141a6bd62d9f0273d381d286f3a5209f0ec7062d3624bb0e073a692c0d38e31d82fe36d171306eee403b614abf38f43a7719d21dd14ca155d9241daf90f81d199740d26c40e7f1bb5f5a0f1c677062815e9d893e55516f0bb0aab1cdb5c482766c8a38b0a1ce595daaec42e59a061dddaf36da261e98a0b6dec1218bdf755544003922b6bc251c20a48afb0d46ee0f4140a3a1be38f3dcaaf6a8d7bdcd844
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber03019a023aff58b16bd6d5eae617f066
    Version3
    Certificate 02c4d1e58a4a680c568da3047e7e4d5f
    FieldValue
    ToBeSigned (TBS) MD5829995f702421dea833a24fb2c7f4442
    ToBeSigned (TBS) SHA11d7e838accd498c2e5ba9373af819ec097bb955c
    ToBeSigned (TBS) SHA25692914d016cc46e125e50c4bd0bd7f72db87eed4ba68f3c589b4e86aa563108db
    SubjectC=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1
    ValidFrom2011-02-11 12:00:00
    ValidTo2026-02-10 12:00:00
    Signature49eb7c60beaeefc97cb3c5ba4b64df1669e286fa29d9de98857d406626332f4455aaaa90e935700a34bed3ae542e8e6500d67a32203e6c26b898a939b1bc95c7aae9f5ee4666c6b3e812f8b3979dff74588234997550ac448fe892ce7d8b0f3196c7dcd31130987416c6e56b4576a39401cd33007a48f66f8631c9562b3322d5f801b644ce8cb4ca88d2e416e3e7f6e23ee109c09d7943437f555c05ad9310c62c0d6bc09eea78e5d277d6b8da9a987fba4c922b9dbda488b1ddafc34cd2979b03c6ae5f1b440f333715e3cbff2f56d316a45b55679da2cadb346c0c734ab57ba4b6b3e935027870ec007acbfc4b4f2236bb1484c98f91dd0f3c758cca0b88e7
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber02c4d1e58a4a680c568da3047e7e4d5f
    Version3
    Certificate 06fdf9039603adea000aeb3f27bbba1b
    FieldValue
    ToBeSigned (TBS) MD54e5ad189638cf52ba9cd881d4d44668c
    ToBeSigned (TBS) SHA1cdc115e98d798b33904c820d63cc1e1afc19251d
    ToBeSigned (TBS) SHA25637560fb9d548ab62cc3ed4669a4ab74828b5a108e67e829937ffb2d10a5f78dd
    SubjectC=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID CA,1
    ValidFrom2006-11-10 00:00:00
    ValidTo2021-11-10 00:00:00
    Signature46503ec9b72824a7381db65b29af52cf52e93147ab565c7bd50d0b41b3efec751f7438f2b25c61a29c95c350e482b923d1ba3a8672ad3878ac755d1717347247859456d1ebbb368477cc24a5f3041955a9e7e3e7ab62cdfb8b2d90c2c0d2b594bd5e4fb105d20e3d1aa9145ba6863162a8a833e49b39a7c4f5ce1d7876942573e42aabcf9c764bed5fc24b16e44b704c00891efcc579bc4c1257fe5fe11ebc025da8fefb07384f0dc65d91b90f6745cdd683ede7920d8db1698c4ffb59e0230fd2aaae007cee9c420ecf91d727b716ee0fc3bd7c0aa0ee2c08558522b8eb181a4dfc2a21ad49318347957771dcb11b4b4b1c109c7714c19d4f2f5a9508291026
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber06fdf9039603adea000aeb3f27bbba1b
    Version3

    Imports

    Expand
    • ntoskrnl.exe
    • HAL.dll
    • CLASSPNP.SYS

    Imported Functions

    Expand
    • KePulseEvent
    • KeClearEvent
    • KeStackAttachProcess
    • KeUnstackDetachProcess
    • ObfDereferenceObject
    • ZwSetEvent
    • ZwClose
    • ZwConnectPort
    • RtlInitUnicodeString
    • RtlUnicodeStringToInteger
    • ZwCreateSection
    • ZwWaitForSingleObject
    • ZwOpenEvent
    • IoGetCurrentProcess
    • ObfReferenceObject
    • DbgBreakPoint
    • ZwRequestWaitReplyPort
    • ExFreePoolWithTag
    • ProbeForWrite
    • ZwFreeVirtualMemory
    • ZwAllocateVirtualMemory
    • ObOpenObjectByPointer
    • PsProcessType
    • memmove
    • PsGetProcessExitTime
    • MmSectionObjectType
    • PsThreadType
    • MmGetSystemRoutineAddress
    • ObReleaseObjectSecurity
    • SeReleaseSubjectContext
    • SeAccessCheck
    • SeCaptureSubjectContext
    • ObGetObjectSecurity
    • DbgPrint
    • memset
    • MmIsAddressValid
    • ExInitializeResourceLite
    • ExDeleteResourceLite
    • ZwWriteFile
    • ZwReadFile
    • ZwQueryInformationFile
    • ZwSetInformationFile
    • ZwCreateFile
    • swprintf
    • towupper
    • _wcsnicmp
    • ExAllocatePoolWithTag
    • KeInitializeEvent
    • _snprintf
    • PsGetCurrentProcessId
    • RtlTimeToTimeFields
    • ExSystemTimeToLocalTime
    • KeQuerySystemTime
    • PsGetCurrentThreadId
    • RtlInitAnsiString
    • ZwDeviceIoControlFile
    • ZwCreateKey
    • ZwCreateEvent
    • KeWaitForMultipleObjects
    • ObReferenceObjectByHandle
    • ZwNotifyChangeKey
    • _vsnprintf
    • RtlFreeUnicodeString
    • RtlAnsiStringToUnicodeString
    • RtlEqualUnicodeString
    • RtlAppendUnicodeStringToString
    • RtlCopyUnicodeString
    • RtlUpcaseUnicodeChar
    • ExGetPreviousMode
    • KeWaitForSingleObject
    • KeSetPriorityThread
    • PsTerminateSystemThread
    • PsCreateSystemThread
    • KeDelayExecutionThread
    • KeNumberProcessors
    • ZwQueryInformationProcess
    • PsLookupProcessByProcessId
    • ZwOpenDirectoryObject
    • PsSetCreateProcessNotifyRoutine
    • ZwQuerySystemInformation
    • ZwQueryDirectoryFile
    • ZwQueryDirectoryObject
    • ZwDuplicateObject
    • ZwOpenKey
    • ZwEnumerateKey
    • ZwEnumerateValueKey
    • ZwQueryValueKey
    • ZwDeleteValueKey
    • ZwDeleteKey
    • ZwTerminateProcess
    • ZwOpenProcess
    • ZwQueryKey
    • ZwSetValueKey
    • IoFileObjectType
    • _allrem
    • KeSetEvent
    • ZwSetSecurityObject
    • RtlLengthSecurityDescriptor
    • MmHighestUserAddress
    • IoFreeIrp
    • _purecall
    • MmUnlockPages
    • IoBuildAsynchronousFsdRequest
    • _strnicmp
    • RtlQueryRegistryValues
    • RtlAppendUnicodeToString
    • mbstowcs
    • ZwQuerySymbolicLinkObject
    • ZwOpenSymbolicLinkObject
    • NtClose
    • ObQueryNameString
    • ZwSetInformationObject
    • _stricmp
    • ZwUnmapViewOfSection
    • ZwMapViewOfSection
    • ZwOpenFile
    • IoCreateFile
    • IofCallDriver
    • IoAllocateIrp
    • MmBuildMdlForNonPagedPool
    • IoAllocateMdl
    • ProbeForRead
    • PsGetVersion
    • RtlImageNtHeader
    • RtlCompareMemory
    • RtlUpcaseUnicodeString
    • _snwprintf
    • MmSystemRangeStart
    • wcsncmp
    • RtlCompareUnicodeString
    • strrchr
    • ZwQueryVolumeInformationFile
    • ObReferenceObjectByPointer
    • IoBuildDeviceIoControlRequest
    • ZwOpenSection
    • _allmul
    • KeReleaseSemaphore
    • RtlLengthRequiredSid
    • RtlInitializeSid
    • RtlSubAuthoritySid
    • RtlSetDaclSecurityDescriptor
    • RtlCreateSecurityDescriptor
    • RtlAddAccessAllowedAce
    • RtlCreateAcl
    • KeInitializeSemaphore
    • IoGetDeviceObjectPointer
    • IofCompleteRequest
    • ExEventObjectType
    • IoDeleteDevice
    • IoDeleteSymbolicLink
    • IoCreateSymbolicLink
    • RtlUpperChar
    • ObReferenceObjectByName
    • IoDriverObjectType
    • strncpy
    • KeServiceDescriptorTable
    • NtOpenProcess
    • ObOpenObjectByName
    • NtQueryInformationProcess
    • PsIsThreadTerminating
    • KeAddSystemServiceTable
    • ZwQueryObject
    • ZwFsControlFile
    • ObInsertObject
    • IoReleaseVpbSpinLock
    • IoAcquireVpbSpinLock
    • SeCreateAccessState
    • IoGetFileObjectGenericMapping
    • ObCreateObject
    • _allshr
    • ExInterlockedPopEntrySList
    • IoGetStackLimits
    • IoBuildSynchronousFsdRequest
    • wcsstr
    • IoUnregisterPlugPlayNotification
    • FsRtlIsNameInExpression
    • IoGetConfigurationInformation
    • MmProbeAndLockPages
    • IoGetDeviceInterfaces
    • IoRegisterPlugPlayNotification
    • ExAllocatePool
    • RtlFreeAnsiString
    • RtlUnicodeStringToAnsiString
    • strncat
    • wcschr
    • wcsncat
    • wcstombs
    • KeTickCount
    • KeBugCheckEx
    • RtlUnwind
    • wcsrchr
    • memcpy
    • wcsncpy
    • ExReleaseResourceLite
    • ExAcquireResourceExclusiveLite
    • ExAcquireResourceSharedLite
    • ExReleaseFastMutexUnsafe
    • KeLeaveCriticalRegion
    • KeEnterCriticalRegion
    • ZwQuerySecurityObject
    • ExAcquireFastMutexUnsafe
    • IoDeviceObjectType
    • IoCreateDevice
    • RtlGetDaclSecurityDescriptor
    • RtlGetSaclSecurityDescriptor
    • RtlGetGroupSecurityDescriptor
    • RtlGetOwnerSecurityDescriptor
    • SeCaptureSecurityDescriptor
    • SeExports
    • IoIsWdmVersionAvailable
    • RtlLengthSid
    • RtlAbsoluteToSelfRelativeSD
    • IoFreeMdl
    • KeGetCurrentThread
    • KfAcquireSpinLock
    • KfReleaseSpinLock
    • KeRaiseIrqlToDpcLevel
    • KfLowerIrql
    • KeAcquireQueuedSpinLock
    • KeReleaseQueuedSpinLock
    • ExAcquireFastMutex
    • ExReleaseFastMutex
    • KeGetCurrentIrql
    • KfRaiseIrql
    • ClassInitialize

    Exported Functions

    Expand
    • ??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
    • ??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
    • ??0CBlobConfig@@QAE@ABV0@@Z
    • ??0CBlobConfig@@QAE@K@Z
    • ??0CContext@@QAE@ABV0@@Z
    • ??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
    • ??0CContextList@@QAE@ABV0@@Z
    • ??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CDebugLog@@QAE@ABV0@@Z
    • ??0CDebugLog@@QAE@PBG@Z
    • ??0CDebugLogEx@@QAE@ABV0@@Z
    • ??0CDebugLogEx@@QAE@K@Z
    • ??0CDelayLoadThread@@QAE@ABV0@@Z
    • ??0CDelayLoadThread@@QAE@XZ
    • ??0CExclusionExtConfig@@QAE@ABV0@@Z
    • ??0CExclusionExtConfig@@QAE@KKE@Z
    • ??0CExclusionFileNameConfig@@QAE@ABV0@@Z
    • ??0CExclusionFileNameConfig@@QAE@KK@Z
    • ??0CExclusionFilePathConfig@@QAE@ABV0@@Z
    • ??0CExclusionFilePathConfig@@QAE@KK@Z
    • ??0CExclusionFolderConfig@@QAE@ABV0@@Z
    • ??0CExclusionFolderConfig@@QAE@KK@Z
    • ??0CExclusionRegistryConfig@@QAE@ABV0@@Z
    • ??0CExclusionRegistryConfig@@QAE@KK@Z
    • ??0CFile@@QAE@ABV0@@Z
    • ??0CFile@@QAE@E@Z
    • ??0CFileExtension@@QAE@ABV0@@Z
    • ??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
    • ??0CInclusionExtConfig@@QAE@ABV0@@Z
    • ??0CInclusionExtConfig@@QAE@KKE@Z
    • ??0CInclusionFileNameConfig@@QAE@ABV0@@Z
    • ??0CInclusionFileNameConfig@@QAE@KK@Z
    • ??0CInclusionFilePathConfig@@QAE@ABV0@@Z
    • ??0CInclusionFilePathConfig@@QAE@KK@Z
    • ??0CInclusionFolderConfig@@QAE@ABV0@@Z
    • ??0CInclusionFolderConfig@@QAE@KK@Z
    • ??0CKEvent@@QAE@ABV0@@Z
    • ??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
    • ??0CList@@QAE@ABV0@@Z
    • ??0CList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CLockEvent@@QAE@ABV0@@Z
    • ??0CLockEvent@@QAE@XZ
    • ??0CLockList@@QAE@ABV0@@Z
    • ??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
    • ??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
    • ??0CMemoryAllocator@@QAE@ABV0@@Z
    • ??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
    • ??0CMemoryPoolAllocator@@QAE@ABV0@@Z
    • ??0CModuleConfig@@QAE@ABV0@@Z
    • ??0CModuleConfig@@QAE@XZ
    • ??0CModuleConfigList@@QAE@ABV0@@Z
    • ??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CModuleFileExtConfig@@QAE@ABV0@@Z
    • ??0CModuleFileExtConfig@@QAE@KKE@Z
    • ??0CModuleFlagConfig@@QAE@ABV0@@Z
    • ??0CModuleFlagConfig@@QAE@K@Z
    • ??0CModuleMultiStringConfig@@QAE@ABV0@@Z
    • ??0CModuleMultiStringConfig@@QAE@KK@Z
    • ??0CModuleStringConfig@@QAE@ABV0@@Z
    • ??0CModuleStringConfig@@QAE@K@Z
    • ??0CNoLockList@@QAE@ABV0@@Z
    • ??0CNoLockList@@QAE@KKPAVIMemoryAllocator@@@Z
    • ??0CSmartLock@@QAE@AAVCLockEvent@@@Z
    • ??0CSmartLock@@QAE@XZ
    • ??0CSmartReference@@QAE@AAJ@Z
    • ??0CSmartReference@@QAE@AAK@Z
    • ??0CSmartResource@@QAE@AAVCResource@@E@Z
    • ??0CStrList@@QAE@ABV0@@Z
    • ??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CSystemThread@@QAE@ABV0@@Z
    • ??0CSystemThread@@QAE@K@Z
    • ??0CUserFuncAdapterJob@@QAE@ABV0@@Z
    • ??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z01@Z
    • ??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
    • ??0CWorkerThread@@QAE@ABV0@@Z
    • ??0CWorkerThreadJob@@QAE@ABV0@@Z
    • ??0CWorkerThreadJob@@QAE@E@Z
    • ??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
    • ??0CWorkerThreadJobQueue@@QAE@K@Z
    • ??0CWorkerThreadPool@@QAE@ABV0@@Z
    • ??0CWorkerThreadPool@@QAE@K@Z
    • ??0CWorkerThreadPoolEx@@QAE@ABV0@@Z
    • ??0CWorkerThreadPoolEx@@QAE@KK@Z
    • ??0IMemoryAllocator@@QAE@ABV0@@Z
    • ??0IMemoryAllocator@@QAE@XZ
    • ??1CAutoUpdateConfigThread@@UAE@XZ
    • ??1CBlobConfig@@UAE@XZ
    • ??1CContext@@UAE@XZ
    • ??1CContextList@@UAE@XZ
    • ??1CDebugLog@@UAE@XZ
    • ??1CDebugLogEx@@UAE@XZ
    • ??1CDelayLoadThread@@UAE@XZ
    • ??1CExclusionExtConfig@@UAE@XZ
    • ??1CExclusionFileNameConfig@@UAE@XZ
    • ??1CExclusionFilePathConfig@@UAE@XZ
    • ??1CExclusionFolderConfig@@UAE@XZ
    • ??1CExclusionRegistryConfig@@UAE@XZ
    • ??1CFile@@UAE@XZ
    • ??1CFileExtension@@UAE@XZ
    • ??1CInclusionExtConfig@@UAE@XZ
    • ??1CInclusionFileNameConfig@@UAE@XZ
    • ??1CInclusionFilePathConfig@@UAE@XZ
    • ??1CInclusionFolderConfig@@UAE@XZ
    • ??1CKEvent@@UAE@XZ
    • ??1CList@@UAE@XZ
    • ??1CLockEvent@@UAE@XZ
    • ??1CLockList@@UAE@XZ
    • ??1CMemoryAllocator@@UAE@XZ
    • ??1CMemoryPoolAllocator@@UAE@XZ
    • ??1CModuleConfig@@UAE@XZ
    • ??1CModuleConfigList@@UAE@XZ
    • ??1CModuleFileExtConfig@@UAE@XZ
    • ??1CModuleFlagConfig@@UAE@XZ
    • ??1CModuleMultiStringConfig@@UAE@XZ
    • ??1CModuleStringConfig@@UAE@XZ
    • ??1CNoLockList@@UAE@XZ
    • ??1CSmartLock@@QAE@XZ
    • ??1CSmartReference@@QAE@XZ
    • ??1CSmartResource@@QAE@XZ
    • ??1CStrList@@UAE@XZ
    • ??1CSystemThread@@UAE@XZ
    • ??1CUserFuncAdapterJob@@UAE@XZ
    • ??1CWorkerThread@@UAE@XZ
    • ??1CWorkerThreadJob@@UAE@XZ
    • ??1CWorkerThreadJobQueue@@UAE@XZ
    • ??1CWorkerThreadPool@@UAE@XZ
    • ??1CWorkerThreadPoolEx@@UAE@XZ
    • ??1IMemoryAllocator@@UAE@XZ
    • ??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
    • ??2CMemoryAllocator@@SGPAXI@Z
    • ??2CMemoryPoolAllocator@@SGPAXI@Z
    • ??3@YAXPAX@Z
    • ??3IMemoryAllocator@@SGXPAX@Z
    • ??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
    • ??4CBlobConfig@@QAEAAV0@ABV0@@Z
    • ??4CContext@@QAEAAV0@ABV0@@Z
    • ??4CDebugLog@@QAEAAV0@ABV0@@Z
    • ??4CDebugLogEx@@QAEAAV0@ABV0@@Z
    • ??4CDelayLoadThread@@QAEAAV0@ABV0@@Z
    • ??4CFile@@QAEAAV0@ABV0@@Z
    • ??4CKEvent@@QAEAAV0@ABV0@@Z
    • ??4CLockEvent@@QAEAAV0@ABV0@@Z
    • ??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
    • ??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
    • ??4CModuleConfig@@QAEAAV0@ABV0@@Z
    • ??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
    • ??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
    • ??4CSmartLock@@QAEAAV0@ABV0@@Z
    • ??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
    • ??4CSmartResource@@QAEAAV0@ABV0@@Z
    • ??4CSystemThread@@QAEAAV0@ABV0@@Z
    • ??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
    • ??4CWorkerThread@@QAEAAV0@ABV0@@Z
    • ??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
    • ??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
    • ??_7CAutoUpdateConfigThread@@6B@
    • ??_7CBlobConfig@@6B@
    • ??_7CContext@@6B@
    • ??_7CContextList@@6B@
    • ??_7CDebugLog@@6B@
    • ??_7CDebugLogEx@@6B@
    • ??_7CDelayLoadThread@@6B@
    • ??_7CExclusionExtConfig@@6B@
    • ??_7CExclusionFileNameConfig@@6B@
    • ??_7CExclusionFilePathConfig@@6B@
    • ??_7CExclusionFolderConfig@@6B@
    • ??_7CExclusionRegistryConfig@@6B@
    • ??_7CFile@@6B@
    • ??_7CFileExtension@@6B@
    • ??_7CInclusionExtConfig@@6B@
    • ??_7CInclusionFileNameConfig@@6B@
    • ??_7CInclusionFilePathConfig@@6B@
    • ??_7CInclusionFolderConfig@@6B@
    • ??_7CKEvent@@6B@
    • ??_7CList@@6B@
    • ??_7CLockEvent@@6B@
    • ??_7CLockList@@6B@
    • ??_7CMemoryAllocator@@6B@
    • ??_7CMemoryPoolAllocator@@6B@
    • ??_7CModuleConfig@@6B@
    • ??_7CModuleConfigList@@6B@
    • ??_7CModuleFileExtConfig@@6B@
    • ??_7CModuleFlagConfig@@6B@
    • ??_7CModuleMultiStringConfig@@6B@
    • ??_7CModuleStringConfig@@6B@
    • ??_7CNoLockList@@6B@
    • ??_7CStrList@@6B@
    • ??_7CSystemThread@@6B@
    • ??_7CUserFuncAdapterJob@@6B@
    • ??_7CWorkerThread@@6B@
    • ??_7CWorkerThreadJob@@6B@
    • ??_7CWorkerThreadJobQueue@@6B@
    • ??_7CWorkerThreadPool@@6B@
    • ??_7CWorkerThreadPoolEx@@6B@
    • ??_7IMemoryAllocator@@6B@
    • ??_FCContextList@@QAEXXZ
    • ??_FCFile@@QAEXXZ
    • ??_FCFileExtension@@QAEXXZ
    • ??_FCModuleConfigList@@QAEXXZ
    • ??_FCStrList@@QAEXXZ
    • ??_FCSystemThread@@QAEXXZ
    • ??_FCWorkerThread@@QAEXXZ
    • ??_FCWorkerThreadJob@@QAEXXZ
    • ??_FCWorkerThreadJobQueue@@QAEXXZ
    • ??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
    • ??_V@YAXPAX@Z
    • ?Acquire@CLockEvent@@QAEXXZ
    • ?Add@CContextList@@QAEEPAVCContext@@@Z
    • ?Add@CFileExtension@@QAEEPBGK@Z
    • ?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
    • ?Add@CStrList@@QAEEPBG@Z
    • ?AddNode@CLockList@@UAEEQAXE@Z
    • ?AddNode@CNoLockList@@UAEEQAXE@Z
    • ?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
    • ?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
    • ?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
    • ?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
    • ?Cancel@CWorkerThreadJob@@QAEXXZ
    • ?CheckNode@CLockList@@UAEHQAX@Z
    • ?CheckNode@CNoLockList@@UAEHQAX@Z
    • ?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
    • ?Cleanup@CBlobConfig@@AAEXXZ
    • ?Cleanup@CModuleFileExtConfig@@IAEXXZ
    • ?Cleanup@CModuleMultiStringConfig@@IAEXXZ
    • ?Cleanup@CModuleStringConfig@@AAEXXZ
    • ?Close@CFile@@QAEJXZ
    • ?Count@CLockList@@QAEKXZ
    • ?Count@CNoLockList@@QAEKXZ
    • ?Create@CFile@@QAEJPBGKKKK@Z
    • ?Create@CSystemThread@@QAEEXZ
    • ?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
    • ?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
    • ?CreatePool@CWorkerThreadPool@@QAEEXZ
    • ?CreatePool@CWorkerThreadPoolEx@@QAEEXZ
    • ?CreateThreads@CWorkerThreadPool@@QAEEK@Z
    • ?CreateThreads@CWorkerThreadPoolEx@@QAEEK@Z
    • ?CreateWIRP@CFile@@QAEJPBGKKKK@Z
    • ?Delete@CFile@@QAEJXZ
    • ?Delete@CFileExtension@@QAEEPBGK@Z
    • ?Delete@CStrList@@QAEEPBG@Z
    • ?DeleteAll@CList@@UAEXXZ
    • ?DeleteAll@CLockList@@UAEXXZ
    • ?DeleteAll@CNoLockList@@UAEXXZ
    • ?DeleteNode@CContextList@@MAEXPAX@Z
    • ?DeleteNode@CList@@UAEXPAX@Z
    • ?DeleteNode@CModuleConfigList@@MAEXPAX@Z
    • ?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
    • ?DisableWriteProtectFromCR0@@YGXPAPAX@Z
    • ?DoIt@CWorkerThreadJob@@QAEJXZ
    • ?EntryPoint@CSystemThread@@KGXPAX@Z
    • ?Find@CContextList@@QAEPAVCContext@@K@Z
    • ?Find@CContextList@@QAEPAVCContext@@PAX@Z
    • ?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
    • ?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
    • ?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
    • ?FindNode@CContextList@@IAEPAXPAX@Z
    • ?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
    • ?FinishFunction@CUserFuncAdapterJob@@MAEXXZ
    • ?FinishIt@CWorkerThreadJob@@QAEJXZ
    • ?First@CList@@UAEPAXXZ
    • ?First@CLockList@@UAEPAXXZ
    • ?First@CNoLockList@@UAEPAXXZ
    • ?Free@CMemoryAllocator@@UAEXPAX@Z
    • ?Free@CMemoryPoolAllocator@@UAEXPAX@Z
    • ?GetAttributes@CFile@@QAEKXZ
    • ?GetBasicInfomration@CFile@@IAEJXZ
    • ?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
    • ?GetCategory@CContext@@QAEKXZ
    • ?GetData@CBlobConfig@@QAEHPAXPAK@Z
    • ?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
    • ?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
    • ?GetData@CModuleFlagConfig@@QAEKXZ
    • ?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
    • ?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
    • ?GetData@CModuleStringConfig@@QAEPAGXZ
    • ?GetData@CStrList@@QAEEPAGPAK@Z
    • ?GetDataType@CModuleConfig@@QAEKXZ
    • ?GetEngineContext@CContext@@QAEPAXXZ
    • ?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
    • ?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
    • ?GetFileSizeWIRP@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
    • ?GetFlagConfig@CContext@@UAEJKPAK@Z
    • ?GetID@CModuleConfig@@QAEKXZ
    • ?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
    • ?GetLength@CModuleStringConfig@@QAEKXZ
    • ?GetLinkContext@CContext@@QAEPAXXZ
    • ?GetLogFlag@CDebugLog@@QAEKXZ
    • ?GetLogFlag@CDebugLogEx@@QAEKXZ
    • ?GetModuleId@CModuleConfig@@QAEKXZ
    • ?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
    • ?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_KTHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_ETHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_KTHREAD@@XZ
    • ?GetReportCallBackRoutine@CContext@@QAEKXZ
    • ?GetSize@CBlobConfig@@QAEKXZ
    • ?GetStringConfig@CContext@@QAEPAGK@Z
    • ?GetStringConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetThreadCount@CWorkerThreadPool@@QAEKXZ
    • ?GetThreadCount@CWorkerThreadPoolEx@@QAEKXZ
    • ?GetThreadID@CSystemThread@@QAEKXZ
    • ?GetType@CContext@@QAEKXZ
    • ?GetUserParameter@CContext@@QAEKXZ
    • ?InitProcMon@CDebugLogEx@@IAEXXZ
    • ?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
    • ?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
    • ?InitializeFlagConfig@CContext@@QAEHKK@Z
    • ?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
    • ?InitializeStringConfig@CContext@@QAEHKPBG@Z
    • ?Insert@CList@@UAEXQAXE@Z
    • ?Insert@CLockList@@UAEXQAXE@Z
    • ?Insert@CNoLockList@@UAEXQAXE@Z
    • ?InsertAfter@CList@@UAEXPAX0@Z
    • ?InsertBefore@CList@@UAEXPAX0@Z
    • ?Instance@CWorkerThreadPool@@SGPAV1@XZ
    • ?IsEmpty@CList@@UAEEXZ
    • ?IsEmpty@CLockList@@UAEEXZ
    • ?IsEmpty@CNoLockList@@UAEEXZ
    • ?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
    • ?IsFull@CLockList@@QBEEXZ
    • ?IsFull@CNoLockList@@QBEEXZ
    • ?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionExtConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFileNameConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFilePathConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFolderConfig@@QAEEPBG@Z
    • ?IsOpened@CFile@@QAEEXZ
    • ?IsTerminated@CWorkerThreadPool@@QAEEXZ
    • ?IsTerminated@CWorkerThreadPoolEx@@QAEEXZ
    • ?IsValid@CMemoryAllocator@@UAEEXZ
    • ?IsValid@CMemoryPoolAllocator@@UAEEXZ
    • ?IsValid@IMemoryAllocator@@UAEEXZ
    • ?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
    • ?IsWorkerThread@CWorkerThreadPoolEx@@QAEEK@Z
    • ?JobFunction@CUserFuncAdapterJob@@MAEXXZ
    • ?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
    • ?JobQueue@CWorkerThreadPoolEx@@QAEAAVCWorkerThreadJobQueue@@XZ
    • ?Limit@CLockList@@QAEKXZ
    • ?Limit@CNoLockList@@QAEKXZ
    • ?MatchAllExtensions@CFileExtension@@QAEEXZ
    • ?MatchNoExtensions@CFileExtension@@QAEEXZ
    • ?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
    • ?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
    • ?NeedDelete@CWorkerThreadJob@@QAEEXZ
    • ?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
    • ?NewNode@CList@@UAEPAXXZ
    • ?NewNode@CStrList@@EAEPAXXZ
    • ?NewNodeVariant@CList@@IAEPAXK@Z
    • ?Next@CList@@UBEPAXQAX@Z
    • ?Next@CLockList@@UBEPAXQAX@Z
    • ?Next@CNoLockList@@UBEPAXQAX@Z
    • ?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
    • ?NotityTerminate@CWorkerThread@@QAEXXZ
    • ?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
    • ?PostJobToWorkerThread@CWorkerThreadPoolEx@@QAEJP6GXPAX@Z0E1@Z
    • ?Pulse@CKEvent@@QAEJJE@Z
    • ?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
    • ?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
    • ?QueueJobItem@CWorkerThreadPoolEx@@QAEJPAVCWorkerThreadJob@@@Z
    • ?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
    • ?Read@CFile@@QAEJPADKPAK@Z
    • ?ReadWIRP@CFile@@QAEJPADKPAK@Z
    • ?ReferenceCount@CContext@@QAEAAKXZ
    • ?Release@CLockEvent@@QAEXXZ
    • ?Remove@CContextList@@UAEEQAX@Z
    • ?Remove@CList@@UAEEQAX@Z
    • ?Remove@CLockList@@UAEEQAX@Z
    • ?Remove@CNoLockList@@UAEEQAX@Z
    • ?RemoveHead@CList@@UAEPAXXZ
    • ?RemoveHead@CLockList@@UAEPAXXZ
    • ?RemoveHead@CNoLockList@@UAEPAXXZ
    • ?RemoveTail@CList@@UAEPAXXZ
    • ?RemoveTail@CLockList@@UAEPAXXZ
    • ?RemoveTail@CNoLockList@@UAEPAXXZ
    • ?Reset@CKEvent@@QAEXXZ
    • ?ResetData@CInclusionExtConfig@@QAEXXZ
    • ?ResetData@CInclusionFileNameConfig@@QAEXXZ
    • ?ResetData@CInclusionFilePathConfig@@QAEXXZ
    • ?ResetData@CInclusionFolderConfig@@QAEXXZ
    • ?RestoreCR0@@YGXPAX@Z
    • ?Run@CAutoUpdateConfigThread@@UAEXXZ
    • ?Run@CDelayLoadThread@@UAEXXZ
    • ?Run@CWorkerThread@@UAEXXZ
    • ?SeekToEnd@CFile@@QAEJXZ
    • ?Set@CKEvent@@QAEJJE@Z
    • ?SetAttributes@CFile@@QAEJK@Z
    • ?SetBlobCofig@CContext@@UAEJKPAXK@Z
    • ?SetData@CBlobConfig@@QAEHPAXK@Z
    • ?SetData@CModuleFileExtConfig@@QAEHPBG@Z
    • ?SetData@CModuleFlagConfig@@QAEHK@Z
    • ?SetData@CModuleMultiStringConfig@@QAEHPBGK@Z
    • ?SetData@CModuleStringConfig@@QAEHPBG@Z
    • ?SetEngineContext@CContext@@QAEXPAX@Z
    • ?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
    • ?SetFlagConfig@CContext@@UAEJKK@Z
    • ?SetLinkContext@CContext@@QAEXPAX@Z
    • ?SetLogFlag@CDebugLog@@QAEEK@Z
    • ?SetLogFlag@CDebugLogEx@@QAEEK@Z
    • ?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
    • ?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
    • ?SetMultiStringConfig@CContext@@UAEJKPBG@Z
    • ?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
    • ?SetPriority@CSystemThread@@QAEXK@Z
    • ?SetStopUse@CContext@@QAEXXZ
    • ?SetStringConfig@CContext@@UAEJKPBG@Z
    • ?Setup@CSystemThread@@MAEXXZ
    • ?StopUse@CContext@@QAEHXZ
    • ?TearDown@CSystemThread@@MAEXXZ
    • ?Terminate@CSystemThread@@QAEXE@Z
    • ?Terminate@CWorkerThreadPool@@QAEEXZ
    • ?Terminate@CWorkerThreadPoolEx@@QAEEXZ
    • ?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
    • ?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
    • ?WaitFinish@CWorkerThreadJob@@QAEXXZ
    • ?WaitForInit@CDelayLoadThread@@QAEEXZ
    • ?WaitForLoad@CDelayLoadThread@@QAEEXZ
    • ?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
    • ?WaitQueueEmpty@CWorkerThreadJobQueue@@QAEXXZ
    • ?Write@CDebugLog@@QAAXPBDZZ
    • ?Write@CDebugLogEx@@QAAXPBDZZ
    • ?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
    • ?WriteDataToFile@CDebugLogEx@@IAEXPADK@Z
    • ?WriteDataToProcMonW@CDebugLogEx@@IAEXPAD@Z
    • ?WriteSystemInformation@CDebugLog@@QAEXXZ
    • ?WriteSystemInformation@CDebugLogEx@@QAEXXZ
    • ?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
    • ?WriteSystemStringInformation@CDebugLogEx@@IAEXPBG@Z
    • ?WriteToFile@CDebugLog@@IAEXPADK@Z
    • ?WriteToProcMonW@CDebugLogEx@@IAEXPAU_UNICODE_STRING@@@Z
    • ?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
    • ?_pPagedAllocator@@3PAVCMemoryAllocator@@A
    • ?m_lpInstance@CWorkerThreadPool@@1PAV1@A
    • ?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
    • _DeInitKm2UmCommunication@0
    • _DeInitKmLPC@0
    • _DuplicateFullFileName@4
    • _FreeFullFileName@4
    • _GetFileVersionOfNtoskrnl@16
    • _GetKm2UmMode@0
    • _GetModuleInfoByAddress@8
    • _GetModuleInfoByModuleName@8
    • _InitKm2UmCommunication@8
    • _InitKmLPC@0
    • _IsVerifierCodeCheckFlagOn@0
    • _IsWindows8_1_update@4
    • _KmCallUm@8
    • _KmCallUmByLPC@8
    • _KmCallUmEx@12
    • _KmCleanupCommPortAPIs@0
    • _KmGetUmInitProcess@0
    • _KmSetCommPortAPIs@4
    • _ModGetExportProcAddress@8
    • _ModLoadDLLToBuffer@4
    • _ModLoadDLLToBufferWithImageSize@8
    • _ModLoadModule@8
    • _ModUnLoadModule@4
    • _NormalizeFileName@4
    • _NormalizeFullNtPathToDosName@4
    • _TmCommConfigRoutine@4
    • _UtilAddDeviceInDriveTable@4
    • _UtilAddReparsePointMapping@8
    • _UtilCleanFileReadOnly@4
    • _UtilCloseExclusiveHandle@12
    • _UtilCreateDosFileName@8
    • _UtilDeleteFileForce@4
    • _UtilGetDeviceObjectName@8
    • _UtilGetFileNameFromFileObject@4
    • _UtilGetFileObjectForProcessByEPROC@8
    • _UtilGetFileObjectFromFileName@12
    • _UtilGetProcessName@12
    • _UtilGetSystemDirectory@4
    • _UtilGetSystemDirectoryEx@0
    • _UtilGetSystemDirectoryLength@0
    • _UtilGetSystemTime@4
    • _UtilIoSetFileInfo@24
    • _UtilIopCreateFileIRP@40
    • _UtilKeGetLowFileDevice@16
    • _UtilModuleIATHook@24
    • _UtilModuleIATUnHook@8
    • _UtilPostJobToWorkerThread@12
    • _UtilQueryExclusiveHandle@12
    • _UtilQueryKeyValue@24
    • _UtilRemoveDeviceFromDriveTable@4
    • _UtilVolumeDeviceToDosName@8
    • _UtilWaitValueChangeToZero@8
    • _UtilWriteVersionToRegistry@8
    • _UtilbuildDynamicDiskMappingTable@0
    • _UtlWriteBinValueKeyToRegistry@16
    • _ValidateAddressWithSize@20
    • __ResetProtectFromClose@4
    • __UtilDosPathNameToNtPathName@12

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • PAGE
    • .edata
    • INIT
    • .rsrc
    • .reloc

    Signature

    Expand
    {
      "Certificates": [
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
          "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
          "TBS": {
            "MD5": "d0785ad36e427c92b19f6826ab1e8020",
            "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
            "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
            "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
          },
          "ValidFrom": "2012-12-21 00:00:00",
          "ValidTo": "2020-12-30 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
          "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
          "TBS": {
            "MD5": "e9d38360b914c8863f6cba3ee58764d3",
            "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
            "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
            "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
          },
          "ValidFrom": "2012-10-18 00:00:00",
          "ValidTo": "2020-12-29 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
          "TBS": {
            "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
            "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
            "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
            "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
          },
          "ValidFrom": "2017-04-27 00:00:00",
          "ValidTo": "2018-07-16 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "611993e400000000001c",
          "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
          "TBS": {
            "MD5": "78a717e082dcc1cda3458d917e677d14",
            "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
            "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
            "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
          },
          "ValidFrom": "2011-02-22 19:25:17",
          "ValidTo": "2021-02-22 19:35:17",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
          "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "TBS": {
            "MD5": "b30c31a572b0409383ed3fbe17e56e81",
            "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
            "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
            "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
          },
          "ValidFrom": "2010-02-08 00:00:00",
          "ValidTo": "2020-02-07 23:59:59",
          "Version": 3
        }
      ],
      "CertificatesInfo": "",
      "Signer": [
        {
          "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Version": 1
        }
      ],
      "SignerInfo": ""
    }
    

    PropertyValue
    FilenameTmComm.sys
    Creation Timestamp2010-02-08 02:56:46
    MD5f4b7b84a6828d2f9205b55cf8cfc7742
    SHA1e835776e0dc68c994dd18e8628454520156c93e3
    SHA2564bc0921ffd4acc865525d3faf98961e8decc5aec4974552cbbf2ae8d5a569de4
    Authentihash MD50fe42b5332d879959e93066779cac8e5
    Authentihash SHA106c69146793ba18827da747ce0f0a5a13cc4399f
    Authentihash SHA2561f642b5e76572b80684d15bf48bb6e2b6d2743171280ab50502284808a515904
    RichPEHeaderHash MD5df8a25ecde66c4d7d7b6be099c7b9b67
    RichPEHeaderHash SHA1c723f9aa149d1ded440fe119ee6dccabdb9f5c1c
    RichPEHeaderHash SHA256353de968d66434d82e17dad93d2565f57228bd75935707cf356b3a1cc6e55df2
    CompanyTrend Micro Inc.
    DescriptionTrendMicro Common Module
    ProductTrend Micro AEGIS
    OriginalFilenameTmComm.sys

    Download

    Certificates

    Expand
    Certificate 3825d7faf861af9ef490e726b5d65ad5
    FieldValue
    ToBeSigned (TBS) MD5d6c7684e9aaa508cf268335f83afe040
    ToBeSigned (TBS) SHA118066d20ad92409c567cdfde745279ff71c75226
    ToBeSigned (TBS) SHA256a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff
    SubjectC=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2
    ValidFrom2007-06-15 00:00:00
    ValidTo2012-06-14 23:59:59
    Signature50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber3825d7faf861af9ef490e726b5d65ad5
    Version3
    Certificate 47bf1995df8d524643f7db6d480d31a4
    FieldValue
    ToBeSigned (TBS) MD5518d2ea8a21e879c942d504824ac211c
    ToBeSigned (TBS) SHA121ce87d827077e61abddf2beba69fde5432ea031
    ToBeSigned (TBS) SHA2561ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7
    SubjectC=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
    ValidFrom2003-12-04 00:00:00
    ValidTo2013-12-03 23:59:59
    Signature4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber47bf1995df8d524643f7db6d480d31a4
    Version3
    Certificate 4191a15a3978dfcf496566381d4c75c2
    FieldValue
    ToBeSigned (TBS) MD541011f8d0e7c7a6408334ca387914c61
    ToBeSigned (TBS) SHA1c7fc1727f5b75a6421a1f95c73bbdb23580c48e5
    ToBeSigned (TBS) SHA25688dd3952638ee82738c03168e6fd863fe4eab1059ee5e2926ad8cb587c255dc0
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA
    ValidFrom2004-07-16 00:00:00
    ValidTo2014-07-15 23:59:59
    Signatureae3a17b84a7b55fa6455ec40a4ed494190999c89bcaf2e1dca7823f91c190f7feb68bc32d98838dedc3fd389b43fb18296f1a45abaed2e26d3de7c016e000a00a4069211480940f91c1879672324e0bbd5e150ae1bf50edde02e81cd80a36c524f9175558aba22f2d2ea4175882f63557d1e545a9559cad93481c05f5ef67ab5
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber4191a15a3978dfcf496566381d4c75c2
    Version3
    Certificate 645212f783f4d7aba3555729e99ce065
    FieldValue
    ToBeSigned (TBS) MD5e00f0a38c65f7c0b9f19b97448d6a0e3
    ToBeSigned (TBS) SHA191c033a2f289418c4101654dceacef1b25bb55d0
    ToBeSigned (TBS) SHA25638b3fcbdb734b0e3439f3c9a3c4c1712091f577d2b616d41224137faf7ba7c86
    SubjectC=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, OU=RD, CN=Trend Micro, Inc.
    ValidFrom2008-01-16 00:00:00
    ValidTo2011-02-16 23:59:59
    Signature5a693868cea6ba49064b801a0d9e12887a37cbb92cca2950cc5e99c2df9aec5697422e67cd042836daf09a09e739f625255841fed1ec9657cb8b3edc08c55c302574cbdb3f7de2798ed769d766402619b48041f9d90f8c904488788412b1c632055e1afc4a5bbac642cb626bd20fece0feaa6cf9b287887788cf64586309a14a644b5f0595c0ddcb7d789831faedb48451e40e342da4ccbc38a5e992e57e7ce5328d531a8c68e61f9dc9be65605c1bedf3358579000b91a19b3be388bac36b58ca76b72358bd8e74e0a7b08b0587bb7a29758c01af40b80e8e72c76abd3a2babfe7c1ed6e7b1cd9b0221a605062b6d9d0ceb57e0eb305fdc5eb5bf6ea442f4c9
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber645212f783f4d7aba3555729e99ce065
    Version3
    Certificate 610c120600000000001b
    FieldValue
    ToBeSigned (TBS) MD553c41bc1164e09e0cd1617a5bf913efd
    ToBeSigned (TBS) SHA193c03aac8951d494ecd5696b1c08658541b18727
    ToBeSigned (TBS) SHA25640bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b
    SubjectC=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
    ValidFrom2006-05-23 17:01:29
    ValidTo2016-05-23 17:11:29
    Signature01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber610c120600000000001b
    Version3

    Imports

    Expand
    • ntoskrnl.exe
    • HAL.dll
    • CLASSPNP.SYS

    Imported Functions

    Expand
    • ExReleaseFastMutexUnsafe
    • wcsncpy
    • memcpy
    • wcsrchr
    • KeSetEvent
    • KePulseEvent
    • KeClearEvent
    • KeInitializeSemaphore
    • KeWaitForSingleObject
    • KeReleaseSemaphore
    • KeStackAttachProcess
    • KeUnstackDetachProcess
    • RtlSubAuthoritySid
    • RtlInitializeSid
    • ExAllocatePoolWithTag
    • RtlLengthRequiredSid
    • ExFreePoolWithTag
    • RtlSetDaclSecurityDescriptor
    • RtlCreateSecurityDescriptor
    • RtlAddAccessAllowedAce
    • RtlCreateAcl
    • ObfDereferenceObject
    • ZwSetEvent
    • ZwClose
    • ZwRequestWaitReplyPort
    • ProbeForWrite
    • ZwFreeVirtualMemory
    • ZwAllocateVirtualMemory
    • ObOpenObjectByPointer
    • PsProcessType
    • memmove
    • ZwConnectPort
    • RtlInitUnicodeString
    • RtlUnicodeStringToInteger
    • ZwCreateSection
    • ZwWaitForSingleObject
    • ZwOpenEvent
    • ObfReferenceObject
    • IoGetCurrentProcess
    • PsGetProcessExitTime
    • DbgPrint
    • memset
    • MmIsAddressValid
    • ZwWriteFile
    • ZwReadFile
    • ZwQueryInformationFile
    • ZwSetInformationFile
    • ZwCreateFile
    • swprintf
    • towupper
    • _wcsnicmp
    • KeInitializeEvent
    • _snprintf
    • PsGetCurrentProcessId
    • RtlTimeToTimeFields
    • ExSystemTimeToLocalTime
    • KeQuerySystemTime
    • ZwCreateKey
    • ZwCreateEvent
    • KeWaitForMultipleObjects
    • ObReferenceObjectByHandle
    • ZwNotifyChangeKey
    • PsGetCurrentThreadId
    • _vsnprintf
    • MmMapLockedPagesSpecifyCache
    • MmBuildMdlForNonPagedPool
    • MmCreateMdl
    • MmUnmapLockedPages
    • KeSetPriorityThread
    • PsTerminateSystemThread
    • PsCreateSystemThread
    • KeNumberProcessors
    • ZwQuerySystemInformation
    • ZwQueryDirectoryFile
    • ZwOpenDirectoryObject
    • ZwQueryDirectoryObject
    • ZwDuplicateObject
    • ZwOpenKey
    • KeLeaveCriticalRegion
    • ZwEnumerateValueKey
    • ZwQueryValueKey
    • ZwDeleteValueKey
    • ZwDeleteKey
    • ExGetPreviousMode
    • ZwTerminateProcess
    • _purecall
    • ZwQueryKey
    • ZwSetValueKey
    • IoFreeIrp
    • IoFreeMdl
    • MmUnlockPages
    • IoBuildAsynchronousFsdRequest
    • _strnicmp
    • RtlQueryRegistryValues
    • RtlAppendUnicodeToString
    • KeDelayExecutionThread
    • mbstowcs
    • ZwQuerySymbolicLinkObject
    • ZwOpenSymbolicLinkObject
    • NtClose
    • PsLookupProcessByProcessId
    • ZwSetInformationObject
    • _stricmp
    • ZwUnmapViewOfSection
    • ZwMapViewOfSection
    • ZwOpenFile
    • RtlEqualUnicodeString
    • IoFileObjectType
    • IoCreateFile
    • IofCallDriver
    • IoAllocateIrp
    • IoAllocateMdl
    • ProbeForRead
    • PsGetVersion
    • MmGetSystemRoutineAddress
    • RtlCopyUnicodeString
    • RtlCompareMemory
    • _snwprintf
    • RtlImageNtHeader
    • RtlFreeUnicodeString
    • RtlAnsiStringToUnicodeString
    • RtlInitAnsiString
    • strrchr
    • KeBugCheckEx
    • RtlAppendUnicodeStringToString
    • ZwQueryVolumeInformationFile
    • ObReferenceObjectByPointer
    • ObQueryNameString
    • IofCompleteRequest
    • ExEventObjectType
    • IoDeleteDevice
    • IoDeleteSymbolicLink
    • IoCreateSymbolicLink
    • IoGetDeviceObjectPointer
    • RtlUpperChar
    • RtlCompareUnicodeString
    • strncpy
    • KeServiceDescriptorTable
    • NtOpenProcess
    • MmSectionObjectType
    • ObOpenObjectByName
    • IoDriverObjectType
    • NtQueryInformationProcess
    • KeAddSystemServiceTable
    • ZwQueryObject
    • ZwQuerySecurityObject
    • ObInsertObject
    • _allrem
    • IoReleaseVpbSpinLock
    • IoAcquireVpbSpinLock
    • SeCreateAccessState
    • IoGetFileObjectGenericMapping
    • ObCreateObject
    • KeTickCount
    • RtlUnwind
    • KeEnterCriticalRegion
    • ZwEnumerateKey
    • ExAcquireFastMutexUnsafe
    • ZwSetSecurityObject
    • IoDeviceObjectType
    • IoCreateDevice
    • RtlGetDaclSecurityDescriptor
    • RtlGetSaclSecurityDescriptor
    • RtlGetGroupSecurityDescriptor
    • RtlGetOwnerSecurityDescriptor
    • RtlLengthSecurityDescriptor
    • SeCaptureSecurityDescriptor
    • SeExports
    • IoIsWdmVersionAvailable
    • RtlLengthSid
    • wcschr
    • RtlAbsoluteToSelfRelativeSD
    • ZwOpenProcess
    • KeGetCurrentThread
    • KfLowerIrql
    • KeRaiseIrqlToDpcLevel
    • ClassInitialize

    Exported Functions

    Expand
    • ??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
    • ??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
    • ??0CBlobConfig@@QAE@ABV0@@Z
    • ??0CBlobConfig@@QAE@K@Z
    • ??0CContext@@QAE@ABV0@@Z
    • ??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
    • ??0CContextList@@QAE@ABV0@@Z
    • ??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CDebugLog@@QAE@ABV0@@Z
    • ??0CDebugLog@@QAE@PBG@Z
    • ??0CExclusionExtConfig@@QAE@ABV0@@Z
    • ??0CExclusionExtConfig@@QAE@KKE@Z
    • ??0CExclusionFileNameConfig@@QAE@ABV0@@Z
    • ??0CExclusionFileNameConfig@@QAE@KK@Z
    • ??0CExclusionFilePathConfig@@QAE@ABV0@@Z
    • ??0CExclusionFilePathConfig@@QAE@KK@Z
    • ??0CExclusionFolderConfig@@QAE@ABV0@@Z
    • ??0CExclusionFolderConfig@@QAE@KK@Z
    • ??0CExclusionRegistryConfig@@QAE@ABV0@@Z
    • ??0CExclusionRegistryConfig@@QAE@KK@Z
    • ??0CFile@@QAE@ABV0@@Z
    • ??0CFile@@QAE@E@Z
    • ??0CFileExtension@@QAE@ABV0@@Z
    • ??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
    • ??0CKEvent@@QAE@ABV0@@Z
    • ??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
    • ??0CList@@QAE@ABV0@@Z
    • ??0CList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CLockEvent@@QAE@ABV0@@Z
    • ??0CLockEvent@@QAE@XZ
    • ??0CLockList@@QAE@ABV0@@Z
    • ??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
    • ??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
    • ??0CMemoryAllocator@@QAE@ABV0@@Z
    • ??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
    • ??0CMemoryPoolAllocator@@QAE@ABV0@@Z
    • ??0CModuleConfig@@QAE@ABV0@@Z
    • ??0CModuleConfig@@QAE@XZ
    • ??0CModuleConfigList@@QAE@ABV0@@Z
    • ??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CModuleFileExtConfig@@QAE@ABV0@@Z
    • ??0CModuleFileExtConfig@@QAE@KKE@Z
    • ??0CModuleFlagConfig@@QAE@ABV0@@Z
    • ??0CModuleFlagConfig@@QAE@K@Z
    • ??0CModuleMultiStringConfig@@QAE@ABV0@@Z
    • ??0CModuleMultiStringConfig@@QAE@KK@Z
    • ??0CModuleStringConfig@@QAE@ABV0@@Z
    • ??0CModuleStringConfig@@QAE@K@Z
    • ??0CSmartLock@@QAE@AAVCLockEvent@@@Z
    • ??0CSmartLock@@QAE@XZ
    • ??0CSmartReference@@QAE@AAJ@Z
    • ??0CSmartReference@@QAE@AAK@Z
    • ??0CStrList@@QAE@ABV0@@Z
    • ??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CSystemThread@@QAE@ABV0@@Z
    • ??0CSystemThread@@QAE@K@Z
    • ??0CUserFuncAdapterJob@@QAE@ABV0@@Z
    • ??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z0@Z
    • ??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
    • ??0CWorkerThread@@QAE@ABV0@@Z
    • ??0CWorkerThreadJob@@QAE@ABV0@@Z
    • ??0CWorkerThreadJob@@QAE@E@Z
    • ??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
    • ??0CWorkerThreadJobQueue@@QAE@K@Z
    • ??0CWorkerThreadPool@@QAE@ABV0@@Z
    • ??0CWorkerThreadPool@@QAE@K@Z
    • ??0IMemoryAllocator@@QAE@ABV0@@Z
    • ??0IMemoryAllocator@@QAE@XZ
    • ??1CAutoUpdateConfigThread@@UAE@XZ
    • ??1CBlobConfig@@UAE@XZ
    • ??1CContext@@UAE@XZ
    • ??1CContextList@@UAE@XZ
    • ??1CDebugLog@@UAE@XZ
    • ??1CExclusionExtConfig@@UAE@XZ
    • ??1CExclusionFileNameConfig@@UAE@XZ
    • ??1CExclusionFilePathConfig@@UAE@XZ
    • ??1CExclusionFolderConfig@@UAE@XZ
    • ??1CExclusionRegistryConfig@@UAE@XZ
    • ??1CFile@@UAE@XZ
    • ??1CFileExtension@@UAE@XZ
    • ??1CKEvent@@UAE@XZ
    • ??1CList@@UAE@XZ
    • ??1CLockEvent@@UAE@XZ
    • ??1CLockList@@UAE@XZ
    • ??1CMemoryAllocator@@UAE@XZ
    • ??1CMemoryPoolAllocator@@UAE@XZ
    • ??1CModuleConfig@@UAE@XZ
    • ??1CModuleConfigList@@UAE@XZ
    • ??1CModuleFileExtConfig@@UAE@XZ
    • ??1CModuleFlagConfig@@UAE@XZ
    • ??1CModuleMultiStringConfig@@UAE@XZ
    • ??1CModuleStringConfig@@UAE@XZ
    • ??1CSmartLock@@QAE@XZ
    • ??1CSmartReference@@QAE@XZ
    • ??1CStrList@@UAE@XZ
    • ??1CSystemThread@@UAE@XZ
    • ??1CUserFuncAdapterJob@@UAE@XZ
    • ??1CWorkerThread@@UAE@XZ
    • ??1CWorkerThreadJob@@UAE@XZ
    • ??1CWorkerThreadJobQueue@@UAE@XZ
    • ??1CWorkerThreadPool@@UAE@XZ
    • ??1IMemoryAllocator@@UAE@XZ
    • ??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
    • ??2CMemoryAllocator@@SGPAXI@Z
    • ??2CMemoryPoolAllocator@@SGPAXI@Z
    • ??3@YAXPAX@Z
    • ??3IMemoryAllocator@@SGXPAX@Z
    • ??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
    • ??4CBlobConfig@@QAEAAV0@ABV0@@Z
    • ??4CContext@@QAEAAV0@ABV0@@Z
    • ??4CDebugLog@@QAEAAV0@ABV0@@Z
    • ??4CFile@@QAEAAV0@ABV0@@Z
    • ??4CKEvent@@QAEAAV0@ABV0@@Z
    • ??4CLockEvent@@QAEAAV0@ABV0@@Z
    • ??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
    • ??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
    • ??4CModuleConfig@@QAEAAV0@ABV0@@Z
    • ??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
    • ??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
    • ??4CSmartLock@@QAEAAV0@ABV0@@Z
    • ??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
    • ??4CSystemThread@@QAEAAV0@ABV0@@Z
    • ??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
    • ??4CWorkerThread@@QAEAAV0@ABV0@@Z
    • ??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
    • ??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
    • ??_7CAutoUpdateConfigThread@@6B@
    • ??_7CBlobConfig@@6B@
    • ??_7CContext@@6B@
    • ??_7CContextList@@6B@
    • ??_7CDebugLog@@6B@
    • ??_7CExclusionExtConfig@@6B@
    • ??_7CExclusionFileNameConfig@@6B@
    • ??_7CExclusionFilePathConfig@@6B@
    • ??_7CExclusionFolderConfig@@6B@
    • ??_7CExclusionRegistryConfig@@6B@
    • ??_7CFile@@6B@
    • ??_7CFileExtension@@6B@
    • ??_7CKEvent@@6B@
    • ??_7CList@@6B@
    • ??_7CLockEvent@@6B@
    • ??_7CLockList@@6B@
    • ??_7CMemoryAllocator@@6B@
    • ??_7CMemoryPoolAllocator@@6B@
    • ??_7CModuleConfig@@6B@
    • ??_7CModuleConfigList@@6B@
    • ??_7CModuleFileExtConfig@@6B@
    • ??_7CModuleFlagConfig@@6B@
    • ??_7CModuleMultiStringConfig@@6B@
    • ??_7CModuleStringConfig@@6B@
    • ??_7CStrList@@6B@
    • ??_7CSystemThread@@6B@
    • ??_7CUserFuncAdapterJob@@6B@
    • ??_7CWorkerThread@@6B@
    • ??_7CWorkerThreadJob@@6B@
    • ??_7CWorkerThreadJobQueue@@6B@
    • ??_7CWorkerThreadPool@@6B@
    • ??_7IMemoryAllocator@@6B@
    • ??_FCContextList@@QAEXXZ
    • ??_FCFile@@QAEXXZ
    • ??_FCFileExtension@@QAEXXZ
    • ??_FCModuleConfigList@@QAEXXZ
    • ??_FCStrList@@QAEXXZ
    • ??_FCSystemThread@@QAEXXZ
    • ??_FCWorkerThread@@QAEXXZ
    • ??_FCWorkerThreadJob@@QAEXXZ
    • ??_FCWorkerThreadJobQueue@@QAEXXZ
    • ??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
    • ??_V@YAXPAX@Z
    • ?Acquire@CLockEvent@@QAEXXZ
    • ?Add@CContextList@@QAEEPAVCContext@@@Z
    • ?Add@CFileExtension@@QAEEPBGK@Z
    • ?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
    • ?Add@CStrList@@QAEEPBG@Z
    • ?AddNode@CLockList@@UAEEQAXE@Z
    • ?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
    • ?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
    • ?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
    • ?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
    • ?Cancel@CWorkerThreadJob@@QAEXXZ
    • ?CheckNode@CLockList@@UAEHQAX@Z
    • ?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
    • ?Cleanup@CBlobConfig@@AAEXXZ
    • ?Cleanup@CModuleFileExtConfig@@IAEXXZ
    • ?Cleanup@CModuleMultiStringConfig@@IAEXXZ
    • ?Cleanup@CModuleStringConfig@@AAEXXZ
    • ?Close@CFile@@QAEJXZ
    • ?Count@CLockList@@QAEKXZ
    • ?Create@CFile@@QAEJPBGKKKK@Z
    • ?Create@CSystemThread@@QAEEXZ
    • ?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
    • ?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
    • ?CreatePool@CWorkerThreadPool@@QAEEXZ
    • ?CreateThreads@CWorkerThreadPool@@QAEEK@Z
    • ?CreateWIRP@CFile@@QAEJPBGKKKK@Z
    • ?Delete@CFile@@QAEJXZ
    • ?Delete@CFileExtension@@QAEEPBGK@Z
    • ?Delete@CStrList@@QAEEPBG@Z
    • ?DeleteAll@CList@@UAEXXZ
    • ?DeleteAll@CLockList@@UAEXXZ
    • ?DeleteNode@CContextList@@MAEXPAX@Z
    • ?DeleteNode@CList@@UAEXPAX@Z
    • ?DeleteNode@CModuleConfigList@@MAEXPAX@Z
    • ?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
    • ?DisableWriteProtectFromCR0@@YGXPAPAX@Z
    • ?DoIt@CWorkerThreadJob@@QAEJXZ
    • ?EntryPoint@CSystemThread@@KGXPAX@Z
    • ?Find@CContextList@@QAEPAVCContext@@K@Z
    • ?Find@CContextList@@QAEPAVCContext@@PAX@Z
    • ?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
    • ?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
    • ?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
    • ?FindNode@CContextList@@IAEPAXPAX@Z
    • ?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
    • ?First@CList@@UAEPAXXZ
    • ?First@CLockList@@UAEPAXXZ
    • ?Free@CMemoryAllocator@@UAEXPAX@Z
    • ?Free@CMemoryPoolAllocator@@UAEXPAX@Z
    • ?GetAttributes@CFile@@QAEKXZ
    • ?GetBasicInfomration@CFile@@IAEJXZ
    • ?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
    • ?GetCategory@CContext@@QAEKXZ
    • ?GetData@CBlobConfig@@QAEHPAXPAK@Z
    • ?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
    • ?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
    • ?GetData@CModuleFlagConfig@@QAEKXZ
    • ?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
    • ?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
    • ?GetData@CModuleStringConfig@@QAEPAGXZ
    • ?GetData@CStrList@@QAEEPAGPAK@Z
    • ?GetDataType@CModuleConfig@@QAEKXZ
    • ?GetEngineContext@CContext@@QAEPAXXZ
    • ?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
    • ?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
    • ?GetFlagConfig@CContext@@UAEJKPAK@Z
    • ?GetID@CModuleConfig@@QAEKXZ
    • ?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
    • ?GetLength@CModuleStringConfig@@QAEKXZ
    • ?GetLinkContext@CContext@@QAEPAXXZ
    • ?GetLogFlag@CDebugLog@@QAEKXZ
    • ?GetModuleId@CModuleConfig@@QAEKXZ
    • ?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
    • ?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
    • ?GetReportCallBackRoutine@CContext@@QAEKXZ
    • ?GetSize@CBlobConfig@@QAEKXZ
    • ?GetStringConfig@CContext@@QAEPAGK@Z
    • ?GetStringConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetThreadCount@CWorkerThreadPool@@QAEKXZ
    • ?GetThreadID@CSystemThread@@QAEKXZ
    • ?GetType@CContext@@QAEKXZ
    • ?GetUserParameter@CContext@@QAEKXZ
    • ?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
    • ?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
    • ?InitializeFlagConfig@CContext@@QAEHKK@Z
    • ?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
    • ?InitializeStringConfig@CContext@@QAEHKPBG@Z
    • ?Insert@CList@@UAEXQAXE@Z
    • ?Insert@CLockList@@UAEXQAXE@Z
    • ?InsertAfter@CList@@UAEXPAX0@Z
    • ?InsertBefore@CList@@UAEXPAX0@Z
    • ?Instance@CWorkerThreadPool@@SGPAV1@XZ
    • ?IsEmpty@CList@@UAEEXZ
    • ?IsEmpty@CLockList@@UAEEXZ
    • ?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
    • ?IsFull@CLockList@@QBEEXZ
    • ?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
    • ?IsOpened@CFile@@QAEEXZ
    • ?IsTerminated@CWorkerThreadPool@@QAEEXZ
    • ?IsValid@CMemoryAllocator@@UAEEXZ
    • ?IsValid@CMemoryPoolAllocator@@UAEEXZ
    • ?IsValid@IMemoryAllocator@@UAEEXZ
    • ?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
    • ?JobFunction@CUserFuncAdapterJob@@MAEXXZ
    • ?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
    • ?Limit@CLockList@@QAEKXZ
    • ?MatchAllExtensions@CFileExtension@@QAEEXZ
    • ?MatchNoExtensions@CFileExtension@@QAEEXZ
    • ?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
    • ?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
    • ?NeedDelete@CWorkerThreadJob@@QAEEXZ
    • ?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
    • ?NewNode@CList@@UAEPAXXZ
    • ?NewNode@CStrList@@EAEPAXXZ
    • ?NewNodeVariant@CList@@IAEPAXK@Z
    • ?Next@CList@@UBEPAXQAX@Z
    • ?Next@CLockList@@UBEPAXQAX@Z
    • ?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
    • ?NotityTerminate@CWorkerThread@@QAEXXZ
    • ?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
    • ?Pulse@CKEvent@@QAEJJE@Z
    • ?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
    • ?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
    • ?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
    • ?Read@CFile@@QAEJPADKPAK@Z
    • ?ReferenceCount@CContext@@QAEAAKXZ
    • ?Release@CLockEvent@@QAEXXZ
    • ?Remove@CContextList@@UAEEQAX@Z
    • ?Remove@CList@@UAEEQAX@Z
    • ?Remove@CLockList@@UAEEQAX@Z
    • ?RemoveHead@CList@@UAEPAXXZ
    • ?RemoveHead@CLockList@@UAEPAXXZ
    • ?RemoveTail@CList@@UAEPAXXZ
    • ?RemoveTail@CLockList@@UAEPAXXZ
    • ?Reset@CKEvent@@QAEXXZ
    • ?RestoreCR0@@YGXPAX@Z
    • ?Run@CAutoUpdateConfigThread@@UAEXXZ
    • ?Run@CWorkerThread@@UAEXXZ
    • ?SeekToEnd@CFile@@QAEJXZ
    • ?Set@CKEvent@@QAEJJE@Z
    • ?SetAttributes@CFile@@QAEJK@Z
    • ?SetBlobCofig@CContext@@UAEJKPAXK@Z
    • ?SetData@CBlobConfig@@QAEHPAXK@Z
    • ?SetData@CModuleFileExtConfig@@QAEHPBG@Z
    • ?SetData@CModuleFlagConfig@@QAEHK@Z
    • ?SetData@CModuleMultiStringConfig@@QAEHPBG@Z
    • ?SetData@CModuleStringConfig@@QAEHPBG@Z
    • ?SetEngineContext@CContext@@QAEXPAX@Z
    • ?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
    • ?SetFlagConfig@CContext@@UAEJKK@Z
    • ?SetLinkContext@CContext@@QAEXPAX@Z
    • ?SetLogFlag@CDebugLog@@QAEEK@Z
    • ?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
    • ?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
    • ?SetMultiStringConfig@CContext@@UAEJKPBG@Z
    • ?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
    • ?SetPriority@CSystemThread@@QAEXK@Z
    • ?SetStopUse@CContext@@QAEXXZ
    • ?SetStringConfig@CContext@@UAEJKPBG@Z
    • ?Setup@CSystemThread@@MAEXXZ
    • ?StopUse@CContext@@QAEHXZ
    • ?TearDown@CSystemThread@@MAEXXZ
    • ?Terminate@CSystemThread@@QAEXE@Z
    • ?Terminate@CWorkerThreadPool@@QAEEXZ
    • ?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
    • ?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
    • ?WaitFinish@CWorkerThreadJob@@QAEXXZ
    • ?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
    • ?Write@CDebugLog@@QAAXPBDZZ
    • ?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
    • ?WriteSystemInformation@CDebugLog@@QAEXXZ
    • ?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
    • ?WriteToFile@CDebugLog@@IAEXPADK@Z
    • ?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
    • ?_pPagedAllocator@@3PAVCMemoryAllocator@@A
    • ?m_lpInstance@CWorkerThreadPool@@1PAV1@A
    • ?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
    • _DeInitKmLPC@0
    • _GetModuleInfoByAddress@8
    • _GetModuleInfoByModuleName@8
    • _InitKmLPC@0
    • _KmCallUm@8
    • _MapMem@12
    • _ModGetExportProcAddress@8
    • _ModLoadDLLToBuffer@4
    • _ModLoadDLLToBufferWithImageSize@8
    • _ModLoadModule@8
    • _ModUnLoadModule@4
    • _NormalizeFileName@4
    • _NormalizeFullNtPathToDosName@4
    • _TmCommConfigRoutine@4
    • _UnMapMem@8
    • _UtilCleanFileReadOnly@4
    • _UtilDeleteFileForce@4
    • _UtilGetFileObjectForProcessByEPROC@8
    • _UtilGetFileObjectFromFileName@12
    • _UtilGetProcessName@12
    • _UtilGetSystemTime@4
    • _UtilIoSetFileInfo@24
    • _UtilIopCreateFileIRP@40
    • _UtilKeGetLowFileDevice@16
    • _UtilModuleIATHook@24
    • _UtilModuleIATUnHook@8
    • _UtilQueryKeyValue@24
    • _UtilVolumeDeviceToDosName@8
    • _UtilWaitValueChangeToZero@8
    • _UtilWriteVersionToRegistry@8
    • _UtilbuildDynamicDiskMappingTable@0
    • __UtilDosPathNameToNtPathName@12

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • PAGE
    • .edata
    • INIT
    • .rsrc
    • .reloc

    Signature

    Expand
    {
      "Certificates": [
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
          "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
          "TBS": {
            "MD5": "d0785ad36e427c92b19f6826ab1e8020",
            "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
            "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
            "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
          },
          "ValidFrom": "2012-12-21 00:00:00",
          "ValidTo": "2020-12-30 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
          "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
          "TBS": {
            "MD5": "e9d38360b914c8863f6cba3ee58764d3",
            "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
            "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
            "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
          },
          "ValidFrom": "2012-10-18 00:00:00",
          "ValidTo": "2020-12-29 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
          "TBS": {
            "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
            "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
            "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
            "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
          },
          "ValidFrom": "2017-04-27 00:00:00",
          "ValidTo": "2018-07-16 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "611993e400000000001c",
          "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
          "TBS": {
            "MD5": "78a717e082dcc1cda3458d917e677d14",
            "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
            "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
            "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
          },
          "ValidFrom": "2011-02-22 19:25:17",
          "ValidTo": "2021-02-22 19:35:17",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
          "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "TBS": {
            "MD5": "b30c31a572b0409383ed3fbe17e56e81",
            "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
            "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
            "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
          },
          "ValidFrom": "2010-02-08 00:00:00",
          "ValidTo": "2020-02-07 23:59:59",
          "Version": 3
        }
      ],
      "CertificatesInfo": "",
      "Signer": [
        {
          "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Version": 1
        }
      ],
      "SignerInfo": ""
    }
    

    PropertyValue
    FilenameTmComm.sys
    Creation Timestamp2021-06-17 20:32:14
    MD529122f970a9e766ef01a73e0616d68b3
    SHA1432fa24e0ce4b3673113c90b34d6e52dc7bac471
    SHA2564e37592a2a415f520438330c32cfbdbd6af594deef5290b2fa4b9722b898ff69
    Authentihash MD584cb997d2380df8ee2ac77eacdb2d9f7
    Authentihash SHA1c8c6a98f592d7255d12b7a6c3d7f5bf5c4a34b50
    Authentihash SHA25662d1ca62fb251b1eeda5d2577719414e6e26d4afdc5f3df3faf3b35de5cb9506
    RichPEHeaderHash MD5f4be961fdf2f7511374b1df8df43f982
    RichPEHeaderHash SHA1548170450c7a94ed3369b8ea52224efc6207e53e
    RichPEHeaderHash SHA256afb90f23e79bf9a8d2b7c8cfe6668b65edca751317215ad400d3240b652eea37
    CompanyTrend Micro Inc.
    DescriptionTrendMicro Common Module
    ProductTrend Micro Eyes
    OriginalFilenameTmComm.sys

    Download

    Certificates

    Expand
    Certificate 33000000b5213fca1e4aa03de40000000000b5
    FieldValue
    ToBeSigned (TBS) MD5a0dd89c33c4973bf6758331e200fb6de
    ToBeSigned (TBS) SHA165ff7fa429c0f08f8a8bf30509e8ca2919d9edb5
    ToBeSigned (TBS) SHA25629a7b646af062aee3bf37d1ba190211365116db7d7aa4cb87ba268843262ae47
    SubjectC=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher
    ValidFrom2020-12-15 22:15:33
    ValidTo2021-12-02 22:15:33
    Signature0d2d53cd15a8feddcb17e2df1bf7dc1aef21e98c6cd220f58b593824849c134a0f1add59ce42ef80ddf47860273013604d9568ec5894a797bd4e571432a9aaf10ab04dd1c038b26ab7c5ca3a9c88d009267fab56254525546a0a055fb37b9cd8029c7d501809fc8b11482c7a4347b3ad29f35427c9570e87117db52cc94864259274b9e2e758f918a3af1fdb9f9d40ffa3ae2e2ae012fb97a436258642a2a4223dc6690db88103a6e5220646bd8afb3d12eb894ac28b527396a1965408487f6ab878b3c474b8c960842861ae8e799a3d2a8d6f918f50f8e26bb1ed6ced47be36e447574e8568582964ff31cd288b9c7f8d7e6a46d6c3d92f5c101fe1522a720c
    SignatureAlgorithmOID1.2.840.113549.1.1.11
    IsCertificateAuthorityFalse
    SerialNumber33000000b5213fca1e4aa03de40000000000b5
    Version3
    Certificate 610baac1000000000009
    FieldValue
    ToBeSigned (TBS) MD5a569061297e8e824767dbc3184a69bea
    ToBeSigned (TBS) SHA1adbb26a587a8f44b4fccaecb306f980d1c55a150
    ToBeSigned (TBS) SHA256cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46
    SubjectC=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012
    ValidFrom2012-04-18 23:48:38
    ValidTo2027-04-18 23:58:38
    Signature5a8a67daccd5fd0d264177bf0a4678b4b3de12692b7723c2652f015fd203f461ba509d2e8c3972f36c3e6ab11e766decb7f382dcccbbc56970287366173f54ebee011648c446d91b80ae813a8d0f796d68b09eea2d3f39d3ca387ebd5e7c086e19dcc6c2f438336861e2524783e1000156d2bacb878205310a418b4ee77f5f5fed5fd3392d45eba213bffd1ec298417161165fc80a70257c59693124e471e70abb0417f79f721ec9d2bb1abe3d02fe090cb243b4591a99539396215fe0d6b72601429536ac27fdbef48577683d18bdf4be98882211865216f345ec0397107087a37043713cdbc98603170cf5735bc67de15c64edd7c548d7ed32e2d1aad3cfa7f6574e61f977eb67f288b3de00da038fd08a34373e1dd862b8d2b1f3e12f8b723b81967c6ffcec667672601b24f2a0896d5b6d002eef28dd868705c2b4b9e5be64c22af24a155c98e2c42785ff52e3627e0fb2020bd766c70ab2d33d200414503259830a7d9bed5a38120152ba2f5e20728e4af1fde771028c3be107bec973f4dd47d8b4efb4a4b330b9893e76cab90098567eabea8ab8a5d038ab6977130b142fe9aa411ff7babd3a2b348aee0aab63e663f788248e200d2b3b9de3c24952ac9f1f0e393b5dd46e506ae67d523aaa7c3315290d265e0158a74ea93d7a846f743f609fe4324f3600af6d71d33ea646655f8174f1fec171da4ca0415a82ddf11f
    SignatureAlgorithmOID1.2.840.113549.1.1.11
    IsCertificateAuthorityTrue
    SerialNumber610baac1000000000009
    Version3

    Imports

    Expand
    • ntoskrnl.exe

    Imported Functions

    Expand
    • KeLeaveCriticalRegion
    • wcsncpy
    • KeEnterCriticalRegion
    • ExAcquireFastMutexUnsafe
    • wcsrchr
    • ExAcquireResourceSharedLite
    • ExReleaseResourceLite
    • _purecall
    • ZwOpenEvent
    • ZwConnectPort
    • KeClearEvent
    • PsProcessType
    • ExFreePoolWithTag
    • RtlInitUnicodeString
    • KeSetEvent
    • ProbeForWrite
    • KeUnstackDetachProcess
    • ZwRequestWaitReplyPort
    • ZwWaitForSingleObject
    • DbgBreakPoint
    • ZwSetEvent
    • IoGetCurrentProcess
    • ZwFreeVirtualMemory
    • ZwClose
    • ObfReferenceObject
    • ObfDereferenceObject
    • RtlUnicodeStringToInteger
    • ZwCreateSection
    • ObOpenObjectByPointer
    • KeStackAttachProcess
    • KePulseEvent
    • ZwAllocateVirtualMemory
    • ObGetObjectSecurity
    • SeAccessCheck
    • SeReleaseSubjectContext
    • SeCaptureSubjectContext
    • PsThreadType
    • ObReleaseObjectSecurity
    • PsGetProcessExitTime
    • MmSectionObjectType
    • DbgPrint
    • ExDeleteResourceLite
    • ExInitializeResourceLite
    • ZwReadFile
    • swprintf
    • ZwSetInformationFile
    • ZwCreateFile
    • ZwQueryInformationFile
    • ZwWriteFile
    • _wcsnicmp
    • towupper
    • ExAllocatePoolWithTag
    • KeInitializeEvent
    • ZwCreateEvent
    • ZwCreateKey
    • RtlAnsiStringToUnicodeString
    • ZwNotifyChangeKey
    • RtlInitAnsiString
    • _snprintf
    • RtlFreeUnicodeString
    • ExSystemTimeToLocalTime
    • _vsnprintf
    • ObReferenceObjectByHandle
    • RtlTimeToTimeFields
    • ZwDeviceIoControlFile
    • PsGetCurrentThreadId
    • PsGetCurrentProcessId
    • KeWaitForMultipleObjects
    • ExGetPreviousMode
    • RtlEqualUnicodeString
    • RtlPrefixUnicodeString
    • RtlAppendUnicodeStringToString
    • RtlCopyUnicodeString
    • RtlUpcaseUnicodeChar
    • KeWaitForSingleObject
    • KeSetPriorityThread
    • PsCreateSystemThread
    • PsTerminateSystemThread
    • MmIsAddressValid
    • KeDelayExecutionThread
    • KeNumberProcessors
    • PsLookupProcessByProcessId
    • PsSetCreateProcessNotifyRoutine
    • ZwOpenDirectoryObject
    • ZwQueryInformationProcess
    • ZwQuerySecurityObject
    • NtSetInformationFile
    • ZwDeleteValueKey
    • ZwSetValueKey
    • ZwQuerySystemInformation
    • NtQueryInformationFile
    • IoFileObjectType
    • ZwQueryValueKey
    • ZwQueryDirectoryFile
    • NtCreateFile
    • ZwEnumerateValueKey
    • RtlLengthSecurityDescriptor
    • ZwQueryDirectoryObject
    • ZwSetSecurityObject
    • ZwDuplicateObject
    • ZwOpenProcess
    • ExReleaseFastMutexUnsafe
    • ZwDeleteKey
    • ZwEnumerateKey
    • ZwQueryKey
    • ZwOpenKey
    • MmSystemRangeStart
    • _stricmp
    • _strnicmp
    • mbstowcs
    • ProbeForRead
    • RtlUpcaseUnicodeString
    • _snwprintf
    • ZwQuerySymbolicLinkObject
    • ZwMapViewOfSection
    • MmGetSystemRoutineAddress
    • RtlAppendUnicodeToString
    • IoCreateFile
    • RtlQueryRegistryValues
    • MmBuildMdlForNonPagedPool
    • ZwOpenSymbolicLinkObject
    • IoFreeMdl
    • ObQueryNameString
    • ZwUnmapViewOfSection
    • NtClose
    • IoFreeIrp
    • PsGetVersion
    • IoAllocateIrp
    • RtlCompareMemory
    • MmUnlockPages
    • ZwSetInformationObject
    • ZwOpenFile
    • wcsncmp
    • RtlImageNtHeader
    • IoAllocateMdl
    • IofCallDriver
    • ZwQueryVolumeInformationFile
    • ObReferenceObjectByPointer
    • IoBuildDeviceIoControlRequest
    • ZwOpenSection
    • RtlSubAuthoritySid
    • RtlLengthRequiredSid
    • ExReleaseFastMutex
    • ExAcquireFastMutex
    • RtlCreateAcl
    • RtlSetDaclSecurityDescriptor
    • RtlAddAccessAllowedAce
    • KeInitializeSemaphore
    • KeReleaseSemaphore
    • RtlInitializeSid
    • RtlCreateSecurityDescriptor
    • IoDeleteSymbolicLink
    • IoDeleteDevice
    • IoGetDeviceObjectPointer
    • ExEventObjectType
    • IofCompleteRequest
    • IoCreateSymbolicLink
    • ObOpenObjectByName
    • NtQueryInformationProcess
    • strncpy
    • NtOpenProcess
    • ObInsertObject
    • IoAcquireVpbSpinLock
    • SeCreateAccessState
    • IoGetFileObjectGenericMapping
    • ObCreateObject
    • KeAcquireQueuedSpinLock
    • KeReleaseQueuedSpinLock
    • IoReleaseVpbSpinLock
    • wcschr
    • IoGetConfigurationInformation
    • IoRegisterPlugPlayNotification
    • IoGetStackLimits
    • IoBuildSynchronousFsdRequest
    • KeReleaseSpinLock
    • ExpInterlockedPopEntrySList
    • FsRtlIsNameInExpression
    • wcsstr
    • ExAllocatePool
    • IoUnregisterPlugPlayNotification
    • MmProbeAndLockPages
    • RtlCompareUnicodeString
    • IoGetDeviceInterfaces
    • KeAcquireSpinLockRaiseToDpc
    • KeBugCheckEx
    • IoCreateDevice
    • IoDeviceObjectType
    • SeCaptureSecurityDescriptor
    • RtlAbsoluteToSelfRelativeSD
    • IoIsWdmVersionAvailable
    • SeExports
    • RtlLengthSid
    • RtlGetSaclSecurityDescriptor
    • RtlGetDaclSecurityDescriptor
    • RtlGetGroupSecurityDescriptor
    • RtlGetOwnerSecurityDescriptor
    • ZwTerminateProcess
    • ExAcquireResourceExclusiveLite
    • __C_specific_handler

    Exported Functions

    Expand
    • ??0CAutoUpdateConfigThread@@QEAA@AEBV0@@Z
    • ??0CAutoUpdateConfigThread@@QEAA@PEAU_UNICODE_STRING@@P6AX0PEAX@Z1@Z
    • ??0CBlobConfig@@QEAA@AEBV0@@Z
    • ??0CBlobConfig@@QEAA@K@Z
    • ??0CContext@@QEAA@AEBV0@@Z
    • ??0CContext@@QEAA@KP6AJPEAU_EVENT_REPORT@@PEAXPEAU_TMCE_REPORT@@PEAU_TMCE_FEEDBACK@@@Z1K@Z
    • ??0CContextList@@QEAA@AEBV0@@Z
    • ??0CContextList@@QEAA@KPEAVIMemoryAllocator@@@Z
    • ??0CDebugLog@@QEAA@AEBV0@@Z
    • ??0CDebugLog@@QEAA@PEBG@Z
    • ??0CDebugLogEx@@QEAA@AEBV0@@Z
    • ??0CDebugLogEx@@QEAA@K@Z
    • ??0CDelayLoadThread@@QEAA@AEBV0@@Z
    • ??0CDelayLoadThread@@QEAA@XZ
    • ??0CExclusionExtConfig@@QEAA@AEBV0@@Z
    • ??0CExclusionExtConfig@@QEAA@KKE@Z
    • ??0CExclusionFileNameConfig@@QEAA@AEBV0@@Z
    • ??0CExclusionFileNameConfig@@QEAA@KK@Z
    • ??0CExclusionFilePathConfig@@QEAA@AEBV0@@Z
    • ??0CExclusionFilePathConfig@@QEAA@KK@Z
    • ??0CExclusionFolderConfig@@QEAA@AEBV0@@Z
    • ??0CExclusionFolderConfig@@QEAA@KK@Z
    • ??0CExclusionRegistryConfig@@QEAA@AEBV0@@Z
    • ??0CExclusionRegistryConfig@@QEAA@KK@Z
    • ??0CFile@@QEAA@AEBV0@@Z
    • ??0CFile@@QEAA@E@Z
    • ??0CFileExtension@@QEAA@AEBV0@@Z
    • ??0CFileExtension@@QEAA@KEEPEAVIMemoryAllocator@@@Z
    • ??0CInclusionExtConfig@@QEAA@AEBV0@@Z
    • ??0CInclusionExtConfig@@QEAA@KKE@Z
    • ??0CInclusionFileNameConfig@@QEAA@AEBV0@@Z
    • ??0CInclusionFileNameConfig@@QEAA@KK@Z
    • ??0CInclusionFilePathConfig@@QEAA@AEBV0@@Z
    • ??0CInclusionFilePathConfig@@QEAA@KK@Z
    • ??0CInclusionFolderConfig@@QEAA@AEBV0@@Z
    • ??0CInclusionFolderConfig@@QEAA@KK@Z
    • ??0CKEvent@@QEAA@AEBV0@@Z
    • ??0CKEvent@@QEAA@W4_EVENT_TYPE@@E@Z
    • ??0CList@@QEAA@AEBV0@@Z
    • ??0CList@@QEAA@KPEAVIMemoryAllocator@@@Z
    • ??0CLockEvent@@QEAA@AEBV0@@Z
    • ??0CLockEvent@@QEAA@XZ
    • ??0CLockList@@QEAA@AEBV0@@Z
    • ??0CLockList@@QEAA@KKPEAVIMemoryAllocator@@@Z
    • ??0CMemoryAllocator@@IEAA@W4_POOL_TYPE@@K@Z
    • ??0CMemoryAllocator@@QEAA@AEBV0@@Z
    • ??0CMemoryPoolAllocator@@IEAA@W4_POOL_TYPE@@_K1K@Z
    • ??0CMemoryPoolAllocator@@QEAA@AEBV0@@Z
    • ??0CModuleConfig@@QEAA@AEBV0@@Z
    • ??0CModuleConfig@@QEAA@XZ
    • ??0CModuleConfigList@@QEAA@AEBV0@@Z
    • ??0CModuleConfigList@@QEAA@KPEAVIMemoryAllocator@@@Z
    • ??0CModuleFileExtConfig@@QEAA@AEBV0@@Z
    • ??0CModuleFileExtConfig@@QEAA@KKE@Z
    • ??0CModuleFlagConfig@@QEAA@AEBV0@@Z
    • ??0CModuleFlagConfig@@QEAA@K@Z
    • ??0CModuleMultiStringConfig@@QEAA@AEBV0@@Z
    • ??0CModuleMultiStringConfig@@QEAA@KK@Z
    • ??0CModuleStringConfig@@QEAA@AEBV0@@Z
    • ??0CModuleStringConfig@@QEAA@K@Z
    • ??0CNoLockList@@QEAA@AEBV0@@Z
    • ??0CNoLockList@@QEAA@KKPEAVIMemoryAllocator@@@Z
    • ??0CSmartLock@@QEAA@AEAVCLockEvent@@@Z
    • ??0CSmartLock@@QEAA@XZ
    • ??0CSmartReference@@QEAA@AEAJ@Z
    • ??0CSmartReference@@QEAA@AEAK@Z
    • ??0CSmartResource@@QEAA@AEAVCResource@@E@Z
    • ??0CStrList@@QEAA@AEBV0@@Z
    • ??0CStrList@@QEAA@KPEAVIMemoryAllocator@@@Z
    • ??0CSystemThread@@QEAA@AEBV0@@Z
    • ??0CSystemThread@@QEAA@K@Z
    • ??0CUserFuncAdapterJob@@QEAA@AEBV0@@Z
    • ??0CUserFuncAdapterJob@@QEAA@P6AXPEAX@Z01@Z
    • ??0CWorkerThread@@IEAA@PEAVCWorkerThreadJobQueue@@@Z
    • ??0CWorkerThread@@QEAA@AEBV0@@Z
    • ??0CWorkerThreadJob@@QEAA@AEBV0@@Z
    • ??0CWorkerThreadJob@@QEAA@E@Z
    • ??0CWorkerThreadJobQueue@@QEAA@AEBV0@@Z
    • ??0CWorkerThreadJobQueue@@QEAA@K@Z
    • ??0CWorkerThreadPool@@QEAA@AEBV0@@Z
    • ??0CWorkerThreadPool@@QEAA@K@Z
    • ??0CWorkerThreadPoolEx@@QEAA@AEBV0@@Z
    • ??0CWorkerThreadPoolEx@@QEAA@KK@Z
    • ??0IMemoryAllocator@@QEAA@AEBV0@@Z
    • ??0IMemoryAllocator@@QEAA@XZ
    • ??1CAutoUpdateConfigThread@@UEAA@XZ
    • ??1CBlobConfig@@UEAA@XZ
    • ??1CContext@@UEAA@XZ
    • ??1CContextList@@UEAA@XZ
    • ??1CDebugLog@@UEAA@XZ
    • ??1CDebugLogEx@@UEAA@XZ
    • ??1CDelayLoadThread@@UEAA@XZ
    • ??1CExclusionExtConfig@@UEAA@XZ
    • ??1CExclusionFileNameConfig@@UEAA@XZ
    • ??1CExclusionFilePathConfig@@UEAA@XZ
    • ??1CExclusionFolderConfig@@UEAA@XZ
    • ??1CExclusionRegistryConfig@@UEAA@XZ
    • ??1CFile@@UEAA@XZ
    • ??1CFileExtension@@UEAA@XZ
    • ??1CInclusionExtConfig@@UEAA@XZ
    • ??1CInclusionFileNameConfig@@UEAA@XZ
    • ??1CInclusionFilePathConfig@@UEAA@XZ
    • ??1CInclusionFolderConfig@@UEAA@XZ
    • ??1CKEvent@@UEAA@XZ
    • ??1CList@@UEAA@XZ
    • ??1CLockEvent@@UEAA@XZ
    • ??1CLockList@@UEAA@XZ
    • ??1CMemoryAllocator@@UEAA@XZ
    • ??1CMemoryPoolAllocator@@UEAA@XZ
    • ??1CModuleConfig@@UEAA@XZ
    • ??1CModuleConfigList@@UEAA@XZ
    • ??1CModuleFileExtConfig@@UEAA@XZ
    • ??1CModuleFlagConfig@@UEAA@XZ
    • ??1CModuleMultiStringConfig@@UEAA@XZ
    • ??1CModuleStringConfig@@UEAA@XZ
    • ??1CNoLockList@@UEAA@XZ
    • ??1CSmartLock@@QEAA@XZ
    • ??1CSmartReference@@QEAA@XZ
    • ??1CSmartResource@@QEAA@XZ
    • ??1CStrList@@UEAA@XZ
    • ??1CSystemThread@@UEAA@XZ
    • ??1CUserFuncAdapterJob@@UEAA@XZ
    • ??1CWorkerThread@@UEAA@XZ
    • ??1CWorkerThreadJob@@UEAA@XZ
    • ??1CWorkerThreadJobQueue@@UEAA@XZ
    • ??1CWorkerThreadPool@@UEAA@XZ
    • ??1CWorkerThreadPoolEx@@UEAA@XZ
    • ??1IMemoryAllocator@@UEAA@XZ
    • ??2@YAPEAX_KPEAVIMemoryAllocator@@PEBDK@Z
    • ??2CMemoryAllocator@@SAPEAX_K@Z
    • ??2CMemoryPoolAllocator@@SAPEAX_K@Z
    • ??3@YAXPEAX@Z
    • ??3IMemoryAllocator@@SAXPEAX@Z
    • ??4CAutoUpdateConfigThread@@QEAAAEAV0@AEBV0@@Z
    • ??4CBlobConfig@@QEAAAEAV0@AEBV0@@Z
    • ??4CContext@@QEAAAEAV0@AEBV0@@Z
    • ??4CDebugLog@@QEAAAEAV0@AEBV0@@Z
    • ??4CDebugLogEx@@QEAAAEAV0@AEBV0@@Z
    • ??4CDelayLoadThread@@QEAAAEAV0@AEBV0@@Z
    • ??4CFile@@QEAAAEAV0@AEBV0@@Z
    • ??4CKEvent@@QEAAAEAV0@AEBV0@@Z
    • ??4CLockEvent@@QEAAAEAV0@AEBV0@@Z
    • ??4CMemoryAllocator@@QEAAAEAV0@AEBV0@@Z
    • ??4CMemoryPoolAllocator@@QEAAAEAV0@AEBV0@@Z
    • ??4CModuleConfig@@QEAAAEAV0@AEBV0@@Z
    • ??4CModuleFlagConfig@@QEAAAEAV0@AEBV0@@Z
    • ??4CModuleStringConfig@@QEAAAEAV0@AEBV0@@Z
    • ??4CSmartLock@@QEAAAEAV0@AEBV0@@Z
    • ??4CSmartLock@@QEAAAEBV0@AEAVCLockEvent@@@Z
    • ??4CSmartResource@@QEAAAEAV0@AEBV0@@Z
    • ??4CSystemThread@@QEAAAEAV0@AEBV0@@Z
    • ??4CUserFuncAdapterJob@@QEAAAEAV0@AEBV0@@Z
    • ??4CWorkerThread@@QEAAAEAV0@AEBV0@@Z
    • ??4CWorkerThreadJob@@QEAAAEAV0@AEBV0@@Z
    • ??4IMemoryAllocator@@QEAAAEAV0@AEBV0@@Z
    • ??_7CAutoUpdateConfigThread@@6B@
    • ??_7CBlobConfig@@6B@
    • ??_7CContext@@6B@
    • ??_7CContextList@@6B@
    • ??_7CDebugLog@@6B@
    • ??_7CDebugLogEx@@6B@
    • ??_7CDelayLoadThread@@6B@
    • ??_7CExclusionExtConfig@@6B@
    • ??_7CExclusionFileNameConfig@@6B@
    • ??_7CExclusionFilePathConfig@@6B@
    • ??_7CExclusionFolderConfig@@6B@
    • ??_7CExclusionRegistryConfig@@6B@
    • ??_7CFile@@6B@
    • ??_7CFileExtension@@6B@
    • ??_7CInclusionExtConfig@@6B@
    • ??_7CInclusionFileNameConfig@@6B@
    • ??_7CInclusionFilePathConfig@@6B@
    • ??_7CInclusionFolderConfig@@6B@
    • ??_7CKEvent@@6B@
    • ??_7CList@@6B@
    • ??_7CLockEvent@@6B@
    • ??_7CLockList@@6B@
    • ??_7CMemoryAllocator@@6B@
    • ??_7CMemoryPoolAllocator@@6B@
    • ??_7CModuleConfig@@6B@
    • ??_7CModuleConfigList@@6B@
    • ??_7CModuleFileExtConfig@@6B@
    • ??_7CModuleFlagConfig@@6B@
    • ??_7CModuleMultiStringConfig@@6B@
    • ??_7CModuleStringConfig@@6B@
    • ??_7CNoLockList@@6B@
    • ??_7CStrList@@6B@
    • ??_7CSystemThread@@6B@
    • ??_7CUserFuncAdapterJob@@6B@
    • ??_7CWorkerThread@@6B@
    • ??_7CWorkerThreadJob@@6B@
    • ??_7CWorkerThreadJobQueue@@6B@
    • ??_7CWorkerThreadPool@@6B@
    • ??_7CWorkerThreadPoolEx@@6B@
    • ??_7IMemoryAllocator@@6B@
    • ??_FCContextList@@QEAAXXZ
    • ??_FCFile@@QEAAXXZ
    • ??_FCFileExtension@@QEAAXXZ
    • ??_FCModuleConfigList@@QEAAXXZ
    • ??_FCStrList@@QEAAXXZ
    • ??_FCSystemThread@@QEAAXXZ
    • ??_FCWorkerThread@@QEAAXXZ
    • ??_FCWorkerThreadJob@@QEAAXXZ
    • ??_FCWorkerThreadJobQueue@@QEAAXXZ
    • ??_U@YAPEAX_KPEAVIMemoryAllocator@@PEBDK@Z
    • ??_V@YAXPEAX@Z
    • ?Acquire@CLockEvent@@QEAAXXZ
    • ?Add@CContextList@@QEAAEPEAVCContext@@@Z
    • ?Add@CFileExtension@@QEAAEPEBGK@Z
    • ?Add@CModuleConfigList@@QEAAEPEAVCModuleConfig@@@Z
    • ?Add@CStrList@@QEAAEPEBG@Z
    • ?AddNode@CLockList@@UEAAEQEAXE@Z
    • ?AddNode@CNoLockList@@UEAAEQEAXE@Z
    • ?Alloc@CMemoryAllocator@@UEAAPEAX_KPEBDK@Z
    • ?Alloc@CMemoryPoolAllocator@@UEAAPEAX_KPEBDK@Z
    • ?AllocBlock@CMemoryPoolAllocator@@IEAAPEAX_K@Z
    • ?AttachJobQueue@CWorkerThread@@QEAAXPEAVCWorkerThreadJobQueue@@@Z
    • ?Cancel@CWorkerThreadJob@@QEAAXXZ
    • ?CheckNode@CLockList@@UEAAHQEAX@Z
    • ?CheckNode@CNoLockList@@UEAAHQEAX@Z
    • ?CleanQueue@CWorkerThreadJobQueue@@QEAAXXZ
    • ?Cleanup@CBlobConfig@@AEAAXXZ
    • ?Cleanup@CModuleFileExtConfig@@IEAAXXZ
    • ?Cleanup@CModuleMultiStringConfig@@IEAAXXZ
    • ?Cleanup@CModuleStringConfig@@AEAAXXZ
    • ?Close@CFile@@QEAAJXZ
    • ?Count@CLockList@@QEAAKXZ
    • ?Count@CNoLockList@@QEAAKXZ
    • ?Create@CFile@@QEAAJPEBGKKKK@Z
    • ?Create@CSystemThread@@QEAAEXZ
    • ?CreateInstance@CMemoryAllocator@@SAPEAV1@W4_POOL_TYPE@@K@Z
    • ?CreateInstance@CMemoryPoolAllocator@@SAPEAV1@W4_POOL_TYPE@@_K1K@Z
    • ?CreatePool@CWorkerThreadPool@@QEAAEXZ
    • ?CreatePool@CWorkerThreadPoolEx@@QEAAEXZ
    • ?CreateThreads@CWorkerThreadPool@@QEAAEK@Z
    • ?CreateThreads@CWorkerThreadPoolEx@@QEAAEK@Z
    • ?CreateWIRP@CFile@@QEAAJPEBGKKKK@Z
    • ?Delete@CFile@@QEAAJXZ
    • ?Delete@CFileExtension@@QEAAEPEBGK@Z
    • ?Delete@CStrList@@QEAAEPEBG@Z
    • ?DeleteAll@CList@@UEAAXXZ
    • ?DeleteAll@CLockList@@UEAAXXZ
    • ?DeleteAll@CNoLockList@@UEAAXXZ
    • ?DeleteNode@CContextList@@MEAAXPEAX@Z
    • ?DeleteNode@CList@@UEAAXPEAX@Z
    • ?DeleteNode@CModuleConfigList@@MEAAXPEAX@Z
    • ?DeleteNode@CStrList@@EEAAXPEAU_STR_LIST_NODE@1@@Z
    • ?DisableWriteProtectFromCR0@@YAXPEAPEAX@Z
    • ?DoIt@CWorkerThreadJob@@QEAAJXZ
    • ?EntryPoint@CSystemThread@@KAXPEAX@Z
    • ?Find@CContextList@@QEAAPEAVCContext@@K@Z
    • ?Find@CContextList@@QEAAPEAVCContext@@PEAX@Z
    • ?Find@CFileExtension@@QEAAPEAU_STR_LIST_NODE@CStrList@@PEBGK@Z
    • ?Find@CModuleConfigList@@QEAAPEAVCModuleConfig@@K@Z
    • ?Find@CStrList@@QEAAPEAU_STR_LIST_NODE@1@PEBG@Z
    • ?FindNode@CContextList@@IEAAPEAXPEAX@Z
    • ?FindPartiallyAndAllMatch@CStrList@@QEAAPEAU_STR_LIST_NODE@1@PEBG@Z
    • ?FinishFunction@CUserFuncAdapterJob@@MEAAXXZ
    • ?FinishIt@CWorkerThreadJob@@QEAAJXZ
    • ?First@CList@@UEAAPEAXXZ
    • ?First@CLockList@@UEAAPEAXXZ
    • ?First@CNoLockList@@UEAAPEAXXZ
    • ?Free@CMemoryAllocator@@UEAAXPEAX@Z
    • ?Free@CMemoryPoolAllocator@@UEAAXPEAX@Z
    • ?GetAttributes@CFile@@QEAAKXZ
    • ?GetBasicInfomration@CFile@@IEAAJXZ
    • ?GetBlobCofig@CContext@@UEAAJKPEAXPEAK@Z
    • ?GetCategory@CContext@@QEAAKXZ
    • ?GetData@CBlobConfig@@QEAAHPEAXPEAK@Z
    • ?GetData@CModuleFileExtConfig@@QEAAHPEAGPEAK@Z
    • ?GetData@CModuleFileExtConfig@@QEAAPEAVCFileExtension@@XZ
    • ?GetData@CModuleFlagConfig@@QEAAKXZ
    • ?GetData@CModuleMultiStringConfig@@QEAAHPEAGPEAK@Z
    • ?GetData@CModuleMultiStringConfig@@QEAAPEAVCStrList@@XZ
    • ?GetData@CModuleStringConfig@@QEAAPEAGXZ
    • ?GetData@CStrList@@QEAAEPEAGPEAK@Z
    • ?GetDataType@CModuleConfig@@QEAAKXZ
    • ?GetEngineContext@CContext@@QEAAPEAXXZ
    • ?GetFileExtensionConfig@CContext@@QEAAPEAVCFileExtension@@K@Z
    • ?GetFileExtensionConfig@CContext@@UEAAJKPEAGPEAK@Z
    • ?GetFileSize@CFile@@QEAAJPEAT_LARGE_INTEGER@@@Z
    • ?GetFileSizeWIRP@CFile@@QEAAJPEAT_LARGE_INTEGER@@@Z
    • ?GetFlagConfig@CContext@@UEAAJKPEAK@Z
    • ?GetID@CModuleConfig@@QEAAKXZ
    • ?GetJob@CWorkerThreadJobQueue@@QEAAPEAVCWorkerThreadJob@@XZ
    • ?GetLength@CModuleStringConfig@@QEAAKXZ
    • ?GetLinkContext@CContext@@QEAAPEAXXZ
    • ?GetLogFlag@CDebugLog@@QEAAKXZ
    • ?GetLogFlag@CDebugLogEx@@QEAAKXZ
    • ?GetModuleId@CModuleConfig@@QEAAKXZ
    • ?GetMultiStringConfig@CContext@@QEAAPEAVCStrList@@K@Z
    • ?GetMultiStringConfig@CContext@@UEAAJKPEAGPEAK@Z
    • ?GetOneThreadTEB@CWorkerThreadPool@@QEAAPEAU_ETHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPool@@QEAAPEAU_KTHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPoolEx@@QEAAPEAU_ETHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPoolEx@@QEAAPEAU_KTHREAD@@XZ
    • ?GetReportCallBackRoutine@CContext@@QEAA_KXZ
    • ?GetSize@CBlobConfig@@QEAAKXZ
    • ?GetStringConfig@CContext@@QEAAPEAGK@Z
    • ?GetStringConfig@CContext@@UEAAJKPEAGPEAK@Z
    • ?GetThreadCount@CWorkerThreadPool@@QEAAKXZ
    • ?GetThreadCount@CWorkerThreadPoolEx@@QEAAKXZ
    • ?GetThreadID@CSystemThread@@QEAA_KXZ
    • ?GetType@CContext@@QEAAKXZ
    • ?GetUserParameter@CContext@@QEAA_KXZ
    • ?InitProcMon@CDebugLogEx@@IEAAXXZ
    • ?InitializeBlobConfig@CContext@@QEAAHKPEAXK@Z
    • ?InitializeFileExtensionConfig@CContext@@QEAAHKPEBG@Z
    • ?InitializeFlagConfig@CContext@@QEAAHKK@Z
    • ?InitializeMultiStringConfig@CContext@@QEAAHKPEBG@Z
    • ?InitializeStringConfig@CContext@@QEAAHKPEBG@Z
    • ?Insert@CList@@UEAAXQEAXE@Z
    • ?Insert@CLockList@@UEAAXQEAXE@Z
    • ?Insert@CNoLockList@@UEAAXQEAXE@Z
    • ?InsertAfter@CList@@UEAAXPEAX0@Z
    • ?InsertBefore@CList@@UEAAXPEAX0@Z
    • ?Instance@CWorkerThreadPool@@SAPEAV1@XZ
    • ?IsEmpty@CList@@UEAAEXZ
    • ?IsEmpty@CLockList@@UEAAEXZ
    • ?IsEmpty@CNoLockList@@UEAAEXZ
    • ?IsExceedLimitation@CMemoryPoolAllocator@@IEAAEK@Z
    • ?IsFull@CLockList@@QEBAEXZ
    • ?IsFull@CNoLockList@@QEBAEXZ
    • ?IsInExclusionList@CExclusionExtConfig@@QEAAEPEBG@Z
    • ?IsInExclusionList@CExclusionFileNameConfig@@QEAAEPEBG@Z
    • ?IsInExclusionList@CExclusionFilePathConfig@@QEAAEPEBG@Z
    • ?IsInExclusionList@CExclusionFolderConfig@@QEAAEPEBG@Z
    • ?IsInExclusionList@CExclusionRegistryConfig@@QEAAEPEBG@Z
    • ?IsInInclusionList@CInclusionExtConfig@@QEAAEPEBG@Z
    • ?IsInInclusionList@CInclusionFileNameConfig@@QEAAEPEBG@Z
    • ?IsInInclusionList@CInclusionFilePathConfig@@QEAAEPEBG@Z
    • ?IsInInclusionList@CInclusionFolderConfig@@QEAAEPEBG@Z
    • ?IsOpened@CFile@@QEAAEXZ
    • ?IsTerminated@CWorkerThreadPool@@QEAAEXZ
    • ?IsTerminated@CWorkerThreadPoolEx@@QEAAEXZ
    • ?IsValid@CMemoryAllocator@@UEAAEXZ
    • ?IsValid@CMemoryPoolAllocator@@UEAAEXZ
    • ?IsValid@IMemoryAllocator@@UEAAEXZ
    • ?IsWorkerThread@CWorkerThreadPool@@QEAAE_K@Z
    • ?IsWorkerThread@CWorkerThreadPoolEx@@QEAAE_K@Z
    • ?JobFunction@CUserFuncAdapterJob@@MEAAXXZ
    • ?JobQueue@CWorkerThreadPool@@QEAAAEAVCWorkerThreadJobQueue@@XZ
    • ?JobQueue@CWorkerThreadPoolEx@@QEAAAEAVCWorkerThreadJobQueue@@XZ
    • ?Limit@CLockList@@QEAAKXZ
    • ?Limit@CNoLockList@@QEAAKXZ
    • ?MatchAllExtensions@CFileExtension@@QEAAEXZ
    • ?MatchNoExtensions@CFileExtension@@QEAAEXZ
    • ?MergeLeft@CMemoryPoolAllocator@@IEAAPEAXPEAX@Z
    • ?MergeRight@CMemoryPoolAllocator@@IEAAPEAXPEAX@Z
    • ?NeedDelete@CWorkerThreadJob@@QEAAEXZ
    • ?NeedDeleteWhenFinish@CWorkerThreadJob@@QEAAXE@Z
    • ?NewNode@CList@@UEAAPEAXXZ
    • ?NewNode@CStrList@@EEAAPEAXXZ
    • ?NewNodeVariant@CList@@IEAAPEAXK@Z
    • ?Next@CList@@UEBAPEAXQEAX@Z
    • ?Next@CLockList@@UEBAPEAXQEAX@Z
    • ?Next@CNoLockList@@UEBAPEAXQEAX@Z
    • ?NextPool@CMemoryPoolAllocator@@QEAAPEAV1@XZ
    • ?NotityTerminate@CWorkerThread@@QEAAXXZ
    • ?PostJobToWorkerThread@CWorkerThreadPool@@QEAAJP6AXPEAX@Z0E@Z
    • ?PostJobToWorkerThread@CWorkerThreadPoolEx@@QEAAJP6AXPEAX@Z0E1@Z
    • ?Pulse@CKEvent@@QEAAJJE@Z
    • ?QueueJob@CWorkerThreadJobQueue@@QEAAEPEAVCWorkerThreadJob@@@Z
    • ?QueueJobItem@CWorkerThreadPool@@QEAAJPEAVCWorkerThreadJob@@@Z
    • ?QueueJobItem@CWorkerThreadPoolEx@@QEAAJPEAVCWorkerThreadJob@@@Z
    • ?RCMInstance@CWorkerThreadPool@@SAPEAV1@XZ
    • ?Read@CFile@@QEAAJPEADKPEAK@Z
    • ?ReadWIRP@CFile@@QEAAJPEADKPEAK@Z
    • ?ReferenceCount@CContext@@QEAAAEAKXZ
    • ?Release@CLockEvent@@QEAAXXZ
    • ?Remove@CContextList@@UEAAEQEAX@Z
    • ?Remove@CList@@UEAAEQEAX@Z
    • ?Remove@CLockList@@UEAAEQEAX@Z
    • ?Remove@CNoLockList@@UEAAEQEAX@Z
    • ?RemoveHead@CList@@UEAAPEAXXZ
    • ?RemoveHead@CLockList@@UEAAPEAXXZ
    • ?RemoveHead@CNoLockList@@UEAAPEAXXZ
    • ?RemoveTail@CList@@UEAAPEAXXZ
    • ?RemoveTail@CLockList@@UEAAPEAXXZ
    • ?RemoveTail@CNoLockList@@UEAAPEAXXZ
    • ?Reset@CKEvent@@QEAAXXZ
    • ?ResetData@CInclusionExtConfig@@QEAAXXZ
    • ?ResetData@CInclusionFileNameConfig@@QEAAXXZ
    • ?ResetData@CInclusionFilePathConfig@@QEAAXXZ
    • ?ResetData@CInclusionFolderConfig@@QEAAXXZ
    • ?RestoreCR0@@YAXPEAX@Z
    • ?Run@CAutoUpdateConfigThread@@UEAAXXZ
    • ?Run@CDelayLoadThread@@UEAAXXZ
    • ?Run@CWorkerThread@@UEAAXXZ
    • ?SeekToEnd@CFile@@QEAAJXZ
    • ?Set@CKEvent@@QEAAJJE@Z
    • ?SetAttributes@CFile@@QEAAJK@Z
    • ?SetBlobCofig@CContext@@UEAAJKPEAXK@Z
    • ?SetData@CBlobConfig@@QEAAHPEAXK@Z
    • ?SetData@CModuleFileExtConfig@@QEAAHPEBG@Z
    • ?SetData@CModuleFlagConfig@@QEAAHK@Z
    • ?SetData@CModuleMultiStringConfig@@QEAAHPEBGK@Z
    • ?SetData@CModuleStringConfig@@QEAAHPEBG@Z
    • ?SetEngineContext@CContext@@QEAAXPEAX@Z
    • ?SetFileExtensionConfig@CContext@@UEAAJKPEBG@Z
    • ?SetFlagConfig@CContext@@UEAAJKK@Z
    • ?SetLinkContext@CContext@@QEAAXPEAX@Z
    • ?SetLogFlag@CDebugLog@@QEAAEK@Z
    • ?SetLogFlag@CDebugLogEx@@QEAAEK@Z
    • ?SetMatchAllExtensions@CFileExtension@@QEAAXE@Z
    • ?SetMatchNoExtensions@CFileExtension@@QEAAXE@Z
    • ?SetMultiStringConfig@CContext@@UEAAJKPEBG@Z
    • ?SetNewJobItemEvent@CWorkerThreadJobQueue@@QEAAXXZ
    • ?SetPriority@CSystemThread@@QEAAXK@Z
    • ?SetStopUse@CContext@@QEAAXXZ
    • ?SetStringConfig@CContext@@UEAAJKPEBG@Z
    • ?Setup@CSystemThread@@MEAAXXZ
    • ?StopUse@CContext@@QEAAHXZ
    • ?TearDown@CSystemThread@@MEAAXXZ
    • ?Terminate@CSystemThread@@QEAAXE@Z
    • ?Terminate@CWorkerThreadPool@@QEAAEXZ
    • ?Terminate@CWorkerThreadPoolEx@@QEAAEXZ
    • ?TmExceptionFilter@@YAJPEAU_EXCEPTION_POINTERS@@@Z
    • ?Wait@CKEvent@@QEAAJPEAT_LARGE_INTEGER@@E@Z
    • ?WaitFinish@CWorkerThreadJob@@QEAAXXZ
    • ?WaitForInit@CDelayLoadThread@@QEAAEXZ
    • ?WaitForLoad@CDelayLoadThread@@QEAAEXZ
    • ?WaitNewJobAvailable@CWorkerThreadJobQueue@@QEAAEXZ
    • ?WaitQueueEmpty@CWorkerThreadJobQueue@@QEAAXXZ
    • ?Write@CDebugLog@@QEAAXPEBDZZ
    • ?Write@CDebugLogEx@@QEAAXPEBDZZ
    • ?Write@CFile@@QEAAJPEADKPEAT_LARGE_INTEGER@@PEAK@Z
    • ?WriteDataToFile@CDebugLogEx@@IEAAXPEADK@Z
    • ?WriteDataToProcMonW@CDebugLogEx@@IEAAXPEAD@Z
    • ?WriteSystemInformation@CDebugLog@@QEAAXXZ
    • ?WriteSystemInformation@CDebugLogEx@@QEAAXXZ
    • ?WriteSystemStringInformation@CDebugLog@@IEAAXPEBG@Z
    • ?WriteSystemStringInformation@CDebugLogEx@@IEAAXPEBG@Z
    • ?WriteToFile@CDebugLog@@IEAAXPEADK@Z
    • ?WriteToProcMonW@CDebugLogEx@@IEAAXPEAU_UNICODE_STRING@@@Z
    • ?_pNonPagedAllocator@@3PEAVCMemoryAllocator@@EA
    • ?_pPagedAllocator@@3PEAVCMemoryAllocator@@EA
    • ?m_lpInstance@CWorkerThreadPool@@1PEAV1@EA
    • ?m_lpRCMInstance@CWorkerThreadPool@@1PEAV1@EA
    • DeInitKm2UmCommunication
    • DeInitKmLPC
    • DuplicateFullFileName
    • FreeFullFileName
    • GetFileVersionOfNtoskrnl
    • GetKm2UmMode
    • GetModuleInfoByAddress
    • GetModuleInfoByModuleName
    • InitKm2UmCommunication
    • InitKmLPC
    • IsWindows8_1_update
    • KmCallUm
    • KmCallUmByLPC
    • KmCallUmEx
    • KmCleanupCommPortAPIs
    • KmGetUmInitProcess
    • KmSetCommPortAPIs
    • ModGetExportProcAddress
    • ModLoadDLLToBuffer
    • ModLoadDLLToBufferWithImageSize
    • ModLoadModule
    • ModUnLoadModule
    • NormalizeFileName
    • NormalizeFileName1
    • NormalizeFullNtPathToDosName
    • NormalizeFullNtPathToDosName1
    • TmCommConfigRoutine
    • UtilAddDeviceInDriveTable
    • UtilAddReparsePointMapping
    • UtilCleanFileReadOnly
    • UtilCloseExclusiveHandle
    • UtilCreateDosFileName
    • UtilDeleteFileForce
    • UtilGetDeviceObjectName
    • UtilGetFileNameFromFileObject
    • UtilGetFileObjectForProcessByEPROC
    • UtilGetFileObjectFromFileName
    • UtilGetProcessName
    • UtilGetSystemDirectory
    • UtilGetSystemDirectoryEx
    • UtilGetSystemDirectoryLength
    • UtilGetSystemTime
    • UtilIoSetFileInfo
    • UtilIopCreateFileIRP
    • UtilKeGetLowFileDevice
    • UtilModuleIATHook
    • UtilModuleIATUnHook
    • UtilPostJobToWorkerThread
    • UtilQueryExclusiveHandle
    • UtilQueryKeyValue
    • UtilRemoveDeviceFromDriveTable
    • UtilVolumeDeviceToDosName
    • UtilWaitValueChangeToZero
    • UtilWriteVersionToRegistry
    • UtilbuildDynamicDiskMappingTable
    • UtlWriteBinValueKeyToRegistry
    • ValidateAddressWithSize
    • _ResetProtectFromClose
    • _UtilDosPathNameToNtPathName

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • .pdata
    • PAGE
    • .edata
    • INIT
    • .rsrc
    • .reloc

    Signature

    Expand
    {
      "Certificates": [
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
          "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
          "TBS": {
            "MD5": "d0785ad36e427c92b19f6826ab1e8020",
            "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
            "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
            "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
          },
          "ValidFrom": "2012-12-21 00:00:00",
          "ValidTo": "2020-12-30 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
          "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
          "TBS": {
            "MD5": "e9d38360b914c8863f6cba3ee58764d3",
            "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
            "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
            "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
          },
          "ValidFrom": "2012-10-18 00:00:00",
          "ValidTo": "2020-12-29 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
          "TBS": {
            "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
            "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
            "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
            "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
          },
          "ValidFrom": "2017-04-27 00:00:00",
          "ValidTo": "2018-07-16 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "611993e400000000001c",
          "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
          "TBS": {
            "MD5": "78a717e082dcc1cda3458d917e677d14",
            "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
            "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
            "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
          },
          "ValidFrom": "2011-02-22 19:25:17",
          "ValidTo": "2021-02-22 19:35:17",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
          "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "TBS": {
            "MD5": "b30c31a572b0409383ed3fbe17e56e81",
            "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
            "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
            "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
          },
          "ValidFrom": "2010-02-08 00:00:00",
          "ValidTo": "2020-02-07 23:59:59",
          "Version": 3
        }
      ],
      "CertificatesInfo": "",
      "Signer": [
        {
          "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Version": 1
        }
      ],
      "SignerInfo": ""
    }
    

    PropertyValue
    FilenameTmComm.sys
    Creation Timestamp2012-08-02 03:35:11
    MD58580165a2803591e007380db9097bbcc
    SHA15a55c227ca13e9373b87f1ef6534533c7ce1f4fb
    SHA2565027fce41ed60906a0e76b97c95c2a5a83d57a2d1cd42de232a21f26c0d58e48
    Authentihash MD501266e09667dd8822e9895786c7802b5
    Authentihash SHA17e52c3e0861290dd0d7e8807a6f6cfd52b7ab5c2
    Authentihash SHA2565e71106ee81d050e30afd84cade4ef4a581d70130477aa1e34549e6de50cde87
    RichPEHeaderHash MD503cc0cf6cc93ab1faa8dd44481e28703
    RichPEHeaderHash SHA17c749d49c0677c330200d6fcd0e2da5232be0970
    RichPEHeaderHash SHA2568ff0549239941077a9cfd73a1d1e0ca0a20d4df41e2b9d249e6115f9bc1857b4
    CompanyTrend Micro Inc.
    DescriptionTrendMicro Common Module
    ProductTrend Micro Eyes
    OriginalFilenameTmComm.sys

    Download

    Certificates

    Expand
    Certificate 79a2a585f9d1154213d9b83ef6b68ded
    FieldValue
    ToBeSigned (TBS) MD5e6d820afb23af20a65cf0b03247ea05e
    ToBeSigned (TBS) SHA17a8f7c37453f99390ee1e94bb5d3d1cba3a0eea7
    ToBeSigned (TBS) SHA2567e722dc40e6b9abf8c20aa4d887e34b6d2c6b8cbe53a055d49bf9f5e946e0d27
    SubjectC=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G3
    ValidFrom2012-05-01 00:00:00
    ValidTo2012-12-31 23:59:59
    Signature1e98aa27b778b508b5c9726db7dfc00e98a635c488c9d2f66df14b1afbd5f92d99009ed1e79b8be13fbd39800c66cd07bc5c9854a694ba10d14e8babf56f65cc6709a2807c52e80e03d66b7ac60518ecc8ac427c072ca73d0866dc00edfd941d73f2729893b111d68fef8eeaacf496510cd08ddf31524f5eaf7da74a75e64ece2b9f292be7cf5d9f037e6e277b23ad622966af92e82ccebd9c7fdccd173c43c2093f7545c79ee4d7607f97c6e4aac769f5fccd74ac2cb048c1504e70561eb535d38ebeb1edacbdfe0cec857dd5bb856644195d9f93eb82ba639ed37c61ffc81bd923587f30a366a139265e92c33ccb3732faf5a38ddcd5b0a3e9253655d781fa
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber79a2a585f9d1154213d9b83ef6b68ded
    Version3
    Certificate 47bf1995df8d524643f7db6d480d31a4
    FieldValue
    ToBeSigned (TBS) MD5518d2ea8a21e879c942d504824ac211c
    ToBeSigned (TBS) SHA121ce87d827077e61abddf2beba69fde5432ea031
    ToBeSigned (TBS) SHA2561ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7
    SubjectC=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
    ValidFrom2003-12-04 00:00:00
    ValidTo2013-12-03 23:59:59
    Signature4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber47bf1995df8d524643f7db6d480d31a4
    Version3
    Certificate 4d6290e58c54f0f1eb17341a1310e6a4
    FieldValue
    ToBeSigned (TBS) MD5b7d8444a70054990435f35a5630df5e1
    ToBeSigned (TBS) SHA14678c6e4a8787a8e6ed2bce8792b122f6c08afd8
    ToBeSigned (TBS) SHA2560a8b4b359ea7890b358e56e436e9cfc6f32b037b2599b597ca7f7a80d475ec98
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
    ValidFrom2010-09-30 00:00:00
    ValidTo2014-01-01 23:59:59
    Signatureaedd211d5f8f807ad25209eadb6ed25d8be8c21b6904be51a5010e59fa37d174a3eedced89742b62d5a6bf4fad361754f013e0a345d24c26cbe26da21fd01e7a070fb6b37b6f5068a2e931b3b7997d8070a0a7de0b1ea4fff34d811bdd20c91cc4afcff18ffad9da95f0ecdc5cbfe88c5a3e7ab0a3eb59437411e09b1a6af36f
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber4d6290e58c54f0f1eb17341a1310e6a4
    Version3
    Certificate 610c120600000000001b
    FieldValue
    ToBeSigned (TBS) MD553c41bc1164e09e0cd1617a5bf913efd
    ToBeSigned (TBS) SHA193c03aac8951d494ecd5696b1c08658541b18727
    ToBeSigned (TBS) SHA25640bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b
    SubjectC=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
    ValidFrom2006-05-23 17:01:29
    ValidTo2016-05-23 17:11:29
    Signature01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber610c120600000000001b
    Version3
    Certificate 6326c00ead256b6837eeb29b5ee84720
    FieldValue
    ToBeSigned (TBS) MD511b208a45459069f827186fe81c6badd
    ToBeSigned (TBS) SHA1456356986e8ecbb7b05e4617d37cb8cd69ce4969
    ToBeSigned (TBS) SHA2564a0336d7ffa5db42ece4b342e1244f5c2bd0681827f68f847d99195c83740145
    SubjectC=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, OU=RD, CN=Trend Micro, Inc.
    ValidFrom2011-12-27 00:00:00
    ValidTo2013-02-15 23:59:59
    Signature840ba0fc35187fe2edc7b17c101fd2bf035bbad8f3de048e250741e96a3f4ecee86f1f065ea76f2f8f430a13a75ff3eab29a8b11a13006d27bf3173fa49aabf9cef98fc4554f1732317c4b821c740eb58a91977d85e86574dd712718b15d24f7eb88b6d4520aef788478e1ef8cebd7fff06fadbc87ca6ca2b77da85be3c30b4d590bcb8945a0acfa013f89073933494d9c465c0036280a5af39f6802e60bd175a2603366dd935cb3458b1791411a06b6e5f38e3171de4238051c79b33117cb94674d0625c402bdfb0f99b80625dc0f827911c6c11263884a4e41d1abf60070ad46b7296e19e1cfcda7304a650d7a814319cc11e5a947e82b2d00a169e798b871
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber6326c00ead256b6837eeb29b5ee84720
    Version3

    Imports

    Expand
    • ntoskrnl.exe
    • HAL.dll
    • CLASSPNP.SYS

    Imported Functions

    Expand
    • wcsrchr
    • KeSetEvent
    • KePulseEvent
    • KeClearEvent
    • KeInitializeSemaphore
    • KeWaitForSingleObject
    • KeReleaseSemaphore
    • KeStackAttachProcess
    • KeUnstackDetachProcess
    • RtlSubAuthoritySid
    • RtlInitializeSid
    • ExAllocatePoolWithTag
    • RtlLengthRequiredSid
    • ExFreePoolWithTag
    • RtlSetDaclSecurityDescriptor
    • RtlCreateSecurityDescriptor
    • RtlAddAccessAllowedAce
    • RtlCreateAcl
    • ObfDereferenceObject
    • ZwSetEvent
    • ZwClose
    • ZwRequestWaitReplyPort
    • ProbeForWrite
    • ZwFreeVirtualMemory
    • ZwAllocateVirtualMemory
    • ObOpenObjectByPointer
    • PsProcessType
    • memmove
    • ZwConnectPort
    • RtlInitUnicodeString
    • RtlUnicodeStringToInteger
    • ZwCreateSection
    • ZwWaitForSingleObject
    • ZwOpenEvent
    • ObfReferenceObject
    • IoGetCurrentProcess
    • DbgBreakPoint
    • PsGetProcessExitTime
    • MmSectionObjectType
    • DbgPrint
    • memset
    • MmIsAddressValid
    • ExInitializeResourceLite
    • ExDeleteResourceLite
    • ZwWriteFile
    • ZwReadFile
    • ZwQueryInformationFile
    • ZwSetInformationFile
    • ZwCreateFile
    • swprintf
    • towupper
    • _wcsnicmp
    • KeInitializeEvent
    • _snprintf
    • PsGetCurrentProcessId
    • RtlTimeToTimeFields
    • ExSystemTimeToLocalTime
    • KeQuerySystemTime
    • ZwCreateKey
    • ZwCreateEvent
    • KeWaitForMultipleObjects
    • ObReferenceObjectByHandle
    • ZwNotifyChangeKey
    • PsGetCurrentThreadId
    • _vsnprintf
    • KeSetPriorityThread
    • PsTerminateSystemThread
    • PsCreateSystemThread
    • KeNumberProcessors
    • ZwQueryInformationProcess
    • PsLookupProcessByProcessId
    • KeDelayExecutionThread
    • ZwOpenDirectoryObject
    • PsSetCreateProcessNotifyRoutine
    • ZwQuerySystemInformation
    • ZwQueryDirectoryFile
    • ZwQueryDirectoryObject
    • ZwDuplicateObject
    • ZwOpenKey
    • ZwEnumerateKey
    • ZwEnumerateValueKey
    • ZwQueryValueKey
    • ZwDeleteValueKey
    • ZwDeleteKey
    • ExGetPreviousMode
    • ZwTerminateProcess
    • ZwOpenProcess
    • ZwQueryKey
    • ZwSetValueKey
    • MmHighestUserAddress
    • IoFreeIrp
    • memcpy
    • MmUnlockPages
    • IoBuildAsynchronousFsdRequest
    • _strnicmp
    • RtlQueryRegistryValues
    • RtlAppendUnicodeToString
    • mbstowcs
    • _purecall
    • ZwOpenSymbolicLinkObject
    • NtClose
    • ZwSetInformationObject
    • _stricmp
    • ZwUnmapViewOfSection
    • ZwMapViewOfSection
    • ZwOpenFile
    • RtlEqualUnicodeString
    • IoFileObjectType
    • IoCreateFile
    • IofCallDriver
    • IoAllocateIrp
    • MmBuildMdlForNonPagedPool
    • IoAllocateMdl
    • ProbeForRead
    • PsGetVersion
    • MmGetSystemRoutineAddress
    • RtlCopyUnicodeString
    • RtlCompareMemory
    • _snwprintf
    • RtlImageNtHeader
    • RtlFreeUnicodeString
    • RtlAnsiStringToUnicodeString
    • RtlInitAnsiString
    • strrchr
    • ZwQueryVolumeInformationFile
    • ObReferenceObjectByPointer
    • ObQueryNameString
    • IoBuildDeviceIoControlRequest
    • IofCompleteRequest
    • ExEventObjectType
    • _allmul
    • IoDeleteDevice
    • IoDeleteSymbolicLink
    • IoCreateSymbolicLink
    • IoGetDeviceObjectPointer
    • RtlUpperChar
    • RtlCompareUnicodeString
    • strncpy
    • KeServiceDescriptorTable
    • NtOpenProcess
    • ObOpenObjectByName
    • IoDriverObjectType
    • RtlAppendUnicodeStringToString
    • strncmp
    • NtQueryInformationProcess
    • PsIsThreadTerminating
    • PsThreadType
    • KeAddSystemServiceTable
    • ZwQueryObject
    • ZwQuerySecurityObject
    • ObInsertObject
    • _allrem
    • IoReleaseVpbSpinLock
    • IoAcquireVpbSpinLock
    • SeCreateAccessState
    • IoGetFileObjectGenericMapping
    • RtlUpcaseUnicodeString
    • ObCreateObject
    • _allshr
    • ExInterlockedPopEntrySList
    • IoGetStackLimits
    • IoBuildSynchronousFsdRequest
    • MmSystemRangeStart
    • IoUnregisterPlugPlayNotification
    • FsRtlIsNameInExpression
    • wcsstr
    • IoGetConfigurationInformation
    • MmProbeAndLockPages
    • IoGetDeviceInterfaces
    • IoRegisterPlugPlayNotification
    • ExAllocatePool
    • RtlFreeAnsiString
    • RtlUnicodeStringToAnsiString
    • strncat
    • wcschr
    • wcsncat
    • wcstombs
    • KeTickCount
    • KeBugCheckEx
    • RtlUnwind
    • wcsncpy
    • ExReleaseResourceLite
    • ExAcquireResourceExclusiveLite
    • ExAcquireResourceSharedLite
    • ExReleaseFastMutexUnsafe
    • KeLeaveCriticalRegion
    • KeEnterCriticalRegion
    • IoFreeMdl
    • ExAcquireFastMutexUnsafe
    • ZwSetSecurityObject
    • IoDeviceObjectType
    • IoCreateDevice
    • RtlGetDaclSecurityDescriptor
    • RtlGetSaclSecurityDescriptor
    • RtlGetGroupSecurityDescriptor
    • RtlGetOwnerSecurityDescriptor
    • RtlLengthSecurityDescriptor
    • SeCaptureSecurityDescriptor
    • SeExports
    • IoIsWdmVersionAvailable
    • RtlLengthSid
    • RtlAbsoluteToSelfRelativeSD
    • ZwQuerySymbolicLinkObject
    • KeGetCurrentThread
    • KfAcquireSpinLock
    • KfReleaseSpinLock
    • KeRaiseIrqlToDpcLevel
    • KfLowerIrql
    • KeGetCurrentIrql
    • ExAcquireFastMutex
    • ExReleaseFastMutex
    • KfRaiseIrql
    • ClassInitialize

    Exported Functions

    Expand
    • ??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
    • ??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
    • ??0CBlobConfig@@QAE@ABV0@@Z
    • ??0CBlobConfig@@QAE@K@Z
    • ??0CContext@@QAE@ABV0@@Z
    • ??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
    • ??0CContextList@@QAE@ABV0@@Z
    • ??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CDebugLog@@QAE@ABV0@@Z
    • ??0CDebugLog@@QAE@PBG@Z
    • ??0CDelayLoadThread@@QAE@ABV0@@Z
    • ??0CDelayLoadThread@@QAE@XZ
    • ??0CExclusionExtConfig@@QAE@ABV0@@Z
    • ??0CExclusionExtConfig@@QAE@KKE@Z
    • ??0CExclusionFileNameConfig@@QAE@ABV0@@Z
    • ??0CExclusionFileNameConfig@@QAE@KK@Z
    • ??0CExclusionFilePathConfig@@QAE@ABV0@@Z
    • ??0CExclusionFilePathConfig@@QAE@KK@Z
    • ??0CExclusionFolderConfig@@QAE@ABV0@@Z
    • ??0CExclusionFolderConfig@@QAE@KK@Z
    • ??0CExclusionRegistryConfig@@QAE@ABV0@@Z
    • ??0CExclusionRegistryConfig@@QAE@KK@Z
    • ??0CFile@@QAE@ABV0@@Z
    • ??0CFile@@QAE@E@Z
    • ??0CFileExtension@@QAE@ABV0@@Z
    • ??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
    • ??0CInclusionExtConfig@@QAE@ABV0@@Z
    • ??0CInclusionExtConfig@@QAE@KKE@Z
    • ??0CInclusionFileNameConfig@@QAE@ABV0@@Z
    • ??0CInclusionFileNameConfig@@QAE@KK@Z
    • ??0CInclusionFilePathConfig@@QAE@ABV0@@Z
    • ??0CInclusionFilePathConfig@@QAE@KK@Z
    • ??0CInclusionFolderConfig@@QAE@ABV0@@Z
    • ??0CInclusionFolderConfig@@QAE@KK@Z
    • ??0CKEvent@@QAE@ABV0@@Z
    • ??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
    • ??0CList@@QAE@ABV0@@Z
    • ??0CList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CLockEvent@@QAE@ABV0@@Z
    • ??0CLockEvent@@QAE@XZ
    • ??0CLockList@@QAE@ABV0@@Z
    • ??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
    • ??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
    • ??0CMemoryAllocator@@QAE@ABV0@@Z
    • ??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
    • ??0CMemoryPoolAllocator@@QAE@ABV0@@Z
    • ??0CModuleConfig@@QAE@ABV0@@Z
    • ??0CModuleConfig@@QAE@XZ
    • ??0CModuleConfigList@@QAE@ABV0@@Z
    • ??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CModuleFileExtConfig@@QAE@ABV0@@Z
    • ??0CModuleFileExtConfig@@QAE@KKE@Z
    • ??0CModuleFlagConfig@@QAE@ABV0@@Z
    • ??0CModuleFlagConfig@@QAE@K@Z
    • ??0CModuleMultiStringConfig@@QAE@ABV0@@Z
    • ??0CModuleMultiStringConfig@@QAE@KK@Z
    • ??0CModuleStringConfig@@QAE@ABV0@@Z
    • ??0CModuleStringConfig@@QAE@K@Z
    • ??0CNoLockList@@QAE@ABV0@@Z
    • ??0CNoLockList@@QAE@KKPAVIMemoryAllocator@@@Z
    • ??0CSmartLock@@QAE@AAVCLockEvent@@@Z
    • ??0CSmartLock@@QAE@XZ
    • ??0CSmartReference@@QAE@AAJ@Z
    • ??0CSmartReference@@QAE@AAK@Z
    • ??0CSmartResource@@QAE@AAVCResource@@E@Z
    • ??0CStrList@@QAE@ABV0@@Z
    • ??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CSystemThread@@QAE@ABV0@@Z
    • ??0CSystemThread@@QAE@K@Z
    • ??0CUserFuncAdapterJob@@QAE@ABV0@@Z
    • ??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z0@Z
    • ??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
    • ??0CWorkerThread@@QAE@ABV0@@Z
    • ??0CWorkerThreadJob@@QAE@ABV0@@Z
    • ??0CWorkerThreadJob@@QAE@E@Z
    • ??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
    • ??0CWorkerThreadJobQueue@@QAE@K@Z
    • ??0CWorkerThreadPool@@QAE@ABV0@@Z
    • ??0CWorkerThreadPool@@QAE@K@Z
    • ??0IMemoryAllocator@@QAE@ABV0@@Z
    • ??0IMemoryAllocator@@QAE@XZ
    • ??1CAutoUpdateConfigThread@@UAE@XZ
    • ??1CBlobConfig@@UAE@XZ
    • ??1CContext@@UAE@XZ
    • ??1CContextList@@UAE@XZ
    • ??1CDebugLog@@UAE@XZ
    • ??1CDelayLoadThread@@UAE@XZ
    • ??1CExclusionExtConfig@@UAE@XZ
    • ??1CExclusionFileNameConfig@@UAE@XZ
    • ??1CExclusionFilePathConfig@@UAE@XZ
    • ??1CExclusionFolderConfig@@UAE@XZ
    • ??1CExclusionRegistryConfig@@UAE@XZ
    • ??1CFile@@UAE@XZ
    • ??1CFileExtension@@UAE@XZ
    • ??1CInclusionExtConfig@@UAE@XZ
    • ??1CInclusionFileNameConfig@@UAE@XZ
    • ??1CInclusionFilePathConfig@@UAE@XZ
    • ??1CInclusionFolderConfig@@UAE@XZ
    • ??1CKEvent@@UAE@XZ
    • ??1CList@@UAE@XZ
    • ??1CLockEvent@@UAE@XZ
    • ??1CLockList@@UAE@XZ
    • ??1CMemoryAllocator@@UAE@XZ
    • ??1CMemoryPoolAllocator@@UAE@XZ
    • ??1CModuleConfig@@UAE@XZ
    • ??1CModuleConfigList@@UAE@XZ
    • ??1CModuleFileExtConfig@@UAE@XZ
    • ??1CModuleFlagConfig@@UAE@XZ
    • ??1CModuleMultiStringConfig@@UAE@XZ
    • ??1CModuleStringConfig@@UAE@XZ
    • ??1CNoLockList@@UAE@XZ
    • ??1CSmartLock@@QAE@XZ
    • ??1CSmartReference@@QAE@XZ
    • ??1CSmartResource@@QAE@XZ
    • ??1CStrList@@UAE@XZ
    • ??1CSystemThread@@UAE@XZ
    • ??1CUserFuncAdapterJob@@UAE@XZ
    • ??1CWorkerThread@@UAE@XZ
    • ??1CWorkerThreadJob@@UAE@XZ
    • ??1CWorkerThreadJobQueue@@UAE@XZ
    • ??1CWorkerThreadPool@@UAE@XZ
    • ??1IMemoryAllocator@@UAE@XZ
    • ??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
    • ??2CMemoryAllocator@@SGPAXI@Z
    • ??2CMemoryPoolAllocator@@SGPAXI@Z
    • ??3@YAXPAX@Z
    • ??3IMemoryAllocator@@SGXPAX@Z
    • ??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
    • ??4CBlobConfig@@QAEAAV0@ABV0@@Z
    • ??4CContext@@QAEAAV0@ABV0@@Z
    • ??4CDebugLog@@QAEAAV0@ABV0@@Z
    • ??4CDelayLoadThread@@QAEAAV0@ABV0@@Z
    • ??4CFile@@QAEAAV0@ABV0@@Z
    • ??4CKEvent@@QAEAAV0@ABV0@@Z
    • ??4CLockEvent@@QAEAAV0@ABV0@@Z
    • ??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
    • ??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
    • ??4CModuleConfig@@QAEAAV0@ABV0@@Z
    • ??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
    • ??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
    • ??4CSmartLock@@QAEAAV0@ABV0@@Z
    • ??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
    • ??4CSmartResource@@QAEAAV0@ABV0@@Z
    • ??4CSystemThread@@QAEAAV0@ABV0@@Z
    • ??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
    • ??4CWorkerThread@@QAEAAV0@ABV0@@Z
    • ??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
    • ??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
    • ??_7CAutoUpdateConfigThread@@6B@
    • ??_7CBlobConfig@@6B@
    • ??_7CContext@@6B@
    • ??_7CContextList@@6B@
    • ??_7CDebugLog@@6B@
    • ??_7CDelayLoadThread@@6B@
    • ??_7CExclusionExtConfig@@6B@
    • ??_7CExclusionFileNameConfig@@6B@
    • ??_7CExclusionFilePathConfig@@6B@
    • ??_7CExclusionFolderConfig@@6B@
    • ??_7CExclusionRegistryConfig@@6B@
    • ??_7CFile@@6B@
    • ??_7CFileExtension@@6B@
    • ??_7CInclusionExtConfig@@6B@
    • ??_7CInclusionFileNameConfig@@6B@
    • ??_7CInclusionFilePathConfig@@6B@
    • ??_7CInclusionFolderConfig@@6B@
    • ??_7CKEvent@@6B@
    • ??_7CList@@6B@
    • ??_7CLockEvent@@6B@
    • ??_7CLockList@@6B@
    • ??_7CMemoryAllocator@@6B@
    • ??_7CMemoryPoolAllocator@@6B@
    • ??_7CModuleConfig@@6B@
    • ??_7CModuleConfigList@@6B@
    • ??_7CModuleFileExtConfig@@6B@
    • ??_7CModuleFlagConfig@@6B@
    • ??_7CModuleMultiStringConfig@@6B@
    • ??_7CModuleStringConfig@@6B@
    • ??_7CNoLockList@@6B@
    • ??_7CStrList@@6B@
    • ??_7CSystemThread@@6B@
    • ??_7CUserFuncAdapterJob@@6B@
    • ??_7CWorkerThread@@6B@
    • ??_7CWorkerThreadJob@@6B@
    • ??_7CWorkerThreadJobQueue@@6B@
    • ??_7CWorkerThreadPool@@6B@
    • ??_7IMemoryAllocator@@6B@
    • ??_FCContextList@@QAEXXZ
    • ??_FCFile@@QAEXXZ
    • ??_FCFileExtension@@QAEXXZ
    • ??_FCModuleConfigList@@QAEXXZ
    • ??_FCStrList@@QAEXXZ
    • ??_FCSystemThread@@QAEXXZ
    • ??_FCWorkerThread@@QAEXXZ
    • ??_FCWorkerThreadJob@@QAEXXZ
    • ??_FCWorkerThreadJobQueue@@QAEXXZ
    • ??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
    • ??_V@YAXPAX@Z
    • ?Acquire@CLockEvent@@QAEXXZ
    • ?Add@CContextList@@QAEEPAVCContext@@@Z
    • ?Add@CFileExtension@@QAEEPBGK@Z
    • ?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
    • ?Add@CStrList@@QAEEPBG@Z
    • ?AddNode@CLockList@@UAEEQAXE@Z
    • ?AddNode@CNoLockList@@UAEEQAXE@Z
    • ?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
    • ?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
    • ?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
    • ?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
    • ?Cancel@CWorkerThreadJob@@QAEXXZ
    • ?CheckNode@CLockList@@UAEHQAX@Z
    • ?CheckNode@CNoLockList@@UAEHQAX@Z
    • ?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
    • ?Cleanup@CBlobConfig@@AAEXXZ
    • ?Cleanup@CModuleFileExtConfig@@IAEXXZ
    • ?Cleanup@CModuleMultiStringConfig@@IAEXXZ
    • ?Cleanup@CModuleStringConfig@@AAEXXZ
    • ?Close@CFile@@QAEJXZ
    • ?Count@CLockList@@QAEKXZ
    • ?Count@CNoLockList@@QAEKXZ
    • ?Create@CFile@@QAEJPBGKKKK@Z
    • ?Create@CSystemThread@@QAEEXZ
    • ?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
    • ?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
    • ?CreatePool@CWorkerThreadPool@@QAEEXZ
    • ?CreateThreads@CWorkerThreadPool@@QAEEK@Z
    • ?CreateWIRP@CFile@@QAEJPBGKKKK@Z
    • ?Delete@CFile@@QAEJXZ
    • ?Delete@CFileExtension@@QAEEPBGK@Z
    • ?Delete@CStrList@@QAEEPBG@Z
    • ?DeleteAll@CList@@UAEXXZ
    • ?DeleteAll@CLockList@@UAEXXZ
    • ?DeleteAll@CNoLockList@@UAEXXZ
    • ?DeleteNode@CContextList@@MAEXPAX@Z
    • ?DeleteNode@CList@@UAEXPAX@Z
    • ?DeleteNode@CModuleConfigList@@MAEXPAX@Z
    • ?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
    • ?DisableWriteProtectFromCR0@@YGXPAPAX@Z
    • ?DoIt@CWorkerThreadJob@@QAEJXZ
    • ?EntryPoint@CSystemThread@@KGXPAX@Z
    • ?Find@CContextList@@QAEPAVCContext@@K@Z
    • ?Find@CContextList@@QAEPAVCContext@@PAX@Z
    • ?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
    • ?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
    • ?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
    • ?FindNode@CContextList@@IAEPAXPAX@Z
    • ?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
    • ?First@CList@@UAEPAXXZ
    • ?First@CLockList@@UAEPAXXZ
    • ?First@CNoLockList@@UAEPAXXZ
    • ?Free@CMemoryAllocator@@UAEXPAX@Z
    • ?Free@CMemoryPoolAllocator@@UAEXPAX@Z
    • ?GetAttributes@CFile@@QAEKXZ
    • ?GetBasicInfomration@CFile@@IAEJXZ
    • ?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
    • ?GetCategory@CContext@@QAEKXZ
    • ?GetData@CBlobConfig@@QAEHPAXPAK@Z
    • ?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
    • ?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
    • ?GetData@CModuleFlagConfig@@QAEKXZ
    • ?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
    • ?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
    • ?GetData@CModuleStringConfig@@QAEPAGXZ
    • ?GetData@CStrList@@QAEEPAGPAK@Z
    • ?GetDataType@CModuleConfig@@QAEKXZ
    • ?GetEngineContext@CContext@@QAEPAXXZ
    • ?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
    • ?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
    • ?GetFlagConfig@CContext@@UAEJKPAK@Z
    • ?GetID@CModuleConfig@@QAEKXZ
    • ?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
    • ?GetLength@CModuleStringConfig@@QAEKXZ
    • ?GetLinkContext@CContext@@QAEPAXXZ
    • ?GetLogFlag@CDebugLog@@QAEKXZ
    • ?GetModuleId@CModuleConfig@@QAEKXZ
    • ?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
    • ?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
    • ?GetReportCallBackRoutine@CContext@@QAEKXZ
    • ?GetSize@CBlobConfig@@QAEKXZ
    • ?GetStringConfig@CContext@@QAEPAGK@Z
    • ?GetStringConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetThreadCount@CWorkerThreadPool@@QAEKXZ
    • ?GetThreadID@CSystemThread@@QAEKXZ
    • ?GetType@CContext@@QAEKXZ
    • ?GetUserParameter@CContext@@QAEKXZ
    • ?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
    • ?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
    • ?InitializeFlagConfig@CContext@@QAEHKK@Z
    • ?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
    • ?InitializeStringConfig@CContext@@QAEHKPBG@Z
    • ?Insert@CList@@UAEXQAXE@Z
    • ?Insert@CLockList@@UAEXQAXE@Z
    • ?Insert@CNoLockList@@UAEXQAXE@Z
    • ?InsertAfter@CList@@UAEXPAX0@Z
    • ?InsertBefore@CList@@UAEXPAX0@Z
    • ?Instance@CWorkerThreadPool@@SGPAV1@XZ
    • ?IsEmpty@CList@@UAEEXZ
    • ?IsEmpty@CLockList@@UAEEXZ
    • ?IsEmpty@CNoLockList@@UAEEXZ
    • ?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
    • ?IsFull@CLockList@@QBEEXZ
    • ?IsFull@CNoLockList@@QBEEXZ
    • ?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionExtConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFileNameConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFilePathConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFolderConfig@@QAEEPBG@Z
    • ?IsOpened@CFile@@QAEEXZ
    • ?IsTerminated@CWorkerThreadPool@@QAEEXZ
    • ?IsValid@CMemoryAllocator@@UAEEXZ
    • ?IsValid@CMemoryPoolAllocator@@UAEEXZ
    • ?IsValid@IMemoryAllocator@@UAEEXZ
    • ?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
    • ?JobFunction@CUserFuncAdapterJob@@MAEXXZ
    • ?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
    • ?Limit@CLockList@@QAEKXZ
    • ?Limit@CNoLockList@@QAEKXZ
    • ?MatchAllExtensions@CFileExtension@@QAEEXZ
    • ?MatchNoExtensions@CFileExtension@@QAEEXZ
    • ?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
    • ?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
    • ?NeedDelete@CWorkerThreadJob@@QAEEXZ
    • ?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
    • ?NewNode@CList@@UAEPAXXZ
    • ?NewNode@CStrList@@EAEPAXXZ
    • ?NewNodeVariant@CList@@IAEPAXK@Z
    • ?Next@CList@@UBEPAXQAX@Z
    • ?Next@CLockList@@UBEPAXQAX@Z
    • ?Next@CNoLockList@@UBEPAXQAX@Z
    • ?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
    • ?NotityTerminate@CWorkerThread@@QAEXXZ
    • ?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
    • ?Pulse@CKEvent@@QAEJJE@Z
    • ?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
    • ?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
    • ?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
    • ?Read@CFile@@QAEJPADKPAK@Z
    • ?ReferenceCount@CContext@@QAEAAKXZ
    • ?Release@CLockEvent@@QAEXXZ
    • ?Remove@CContextList@@UAEEQAX@Z
    • ?Remove@CList@@UAEEQAX@Z
    • ?Remove@CLockList@@UAEEQAX@Z
    • ?Remove@CNoLockList@@UAEEQAX@Z
    • ?RemoveHead@CList@@UAEPAXXZ
    • ?RemoveHead@CLockList@@UAEPAXXZ
    • ?RemoveHead@CNoLockList@@UAEPAXXZ
    • ?RemoveTail@CList@@UAEPAXXZ
    • ?RemoveTail@CLockList@@UAEPAXXZ
    • ?RemoveTail@CNoLockList@@UAEPAXXZ
    • ?Reset@CKEvent@@QAEXXZ
    • ?ResetData@CInclusionExtConfig@@QAEXXZ
    • ?ResetData@CInclusionFileNameConfig@@QAEXXZ
    • ?ResetData@CInclusionFilePathConfig@@QAEXXZ
    • ?ResetData@CInclusionFolderConfig@@QAEXXZ
    • ?RestoreCR0@@YGXPAX@Z
    • ?Run@CAutoUpdateConfigThread@@UAEXXZ
    • ?Run@CDelayLoadThread@@UAEXXZ
    • ?Run@CWorkerThread@@UAEXXZ
    • ?SeekToEnd@CFile@@QAEJXZ
    • ?Set@CKEvent@@QAEJJE@Z
    • ?SetAttributes@CFile@@QAEJK@Z
    • ?SetBlobCofig@CContext@@UAEJKPAXK@Z
    • ?SetData@CBlobConfig@@QAEHPAXK@Z
    • ?SetData@CModuleFileExtConfig@@QAEHPBG@Z
    • ?SetData@CModuleFlagConfig@@QAEHK@Z
    • ?SetData@CModuleMultiStringConfig@@QAEHPBGK@Z
    • ?SetData@CModuleStringConfig@@QAEHPBG@Z
    • ?SetEngineContext@CContext@@QAEXPAX@Z
    • ?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
    • ?SetFlagConfig@CContext@@UAEJKK@Z
    • ?SetLinkContext@CContext@@QAEXPAX@Z
    • ?SetLogFlag@CDebugLog@@QAEEK@Z
    • ?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
    • ?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
    • ?SetMultiStringConfig@CContext@@UAEJKPBG@Z
    • ?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
    • ?SetPriority@CSystemThread@@QAEXK@Z
    • ?SetStopUse@CContext@@QAEXXZ
    • ?SetStringConfig@CContext@@UAEJKPBG@Z
    • ?Setup@CSystemThread@@MAEXXZ
    • ?StopUse@CContext@@QAEHXZ
    • ?TearDown@CSystemThread@@MAEXXZ
    • ?Terminate@CSystemThread@@QAEXE@Z
    • ?Terminate@CWorkerThreadPool@@QAEEXZ
    • ?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
    • ?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
    • ?WaitFinish@CWorkerThreadJob@@QAEXXZ
    • ?WaitForInit@CDelayLoadThread@@QAEEXZ
    • ?WaitForLoad@CDelayLoadThread@@QAEEXZ
    • ?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
    • ?Write@CDebugLog@@QAAXPBDZZ
    • ?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
    • ?WriteSystemInformation@CDebugLog@@QAEXXZ
    • ?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
    • ?WriteToFile@CDebugLog@@IAEXPADK@Z
    • ?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
    • ?_pPagedAllocator@@3PAVCMemoryAllocator@@A
    • ?m_lpInstance@CWorkerThreadPool@@1PAV1@A
    • ?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
    • _DeInitKmLPC@0
    • _GetModuleInfoByAddress@8
    • _GetModuleInfoByModuleName@8
    • _InitKmLPC@0
    • _KmCallUm@8
    • _KmCallUmEx@12
    • _ModGetExportProcAddress@8
    • _ModLoadDLLToBuffer@4
    • _ModLoadDLLToBufferWithImageSize@8
    • _ModLoadModule@8
    • _ModUnLoadModule@4
    • _NormalizeFileName@4
    • _NormalizeFullNtPathToDosName@4
    • _TmCommConfigRoutine@4
    • _UtilAddDeviceInDriveTable@4
    • _UtilCleanFileReadOnly@4
    • _UtilDeleteFileForce@4
    • _UtilGetFileObjectForProcessByEPROC@8
    • _UtilGetFileObjectFromFileName@12
    • _UtilGetProcessName@12
    • _UtilGetSystemDirectory@4
    • _UtilGetSystemDirectoryEx@0
    • _UtilGetSystemDirectoryLength@0
    • _UtilGetSystemTime@4
    • _UtilIoSetFileInfo@24
    • _UtilIopCreateFileIRP@40
    • _UtilKeGetLowFileDevice@16
    • _UtilModuleIATHook@24
    • _UtilModuleIATUnHook@8
    • _UtilQueryKeyValue@24
    • _UtilRemoveDeviceFromDriveTable@4
    • _UtilVolumeDeviceToDosName@8
    • _UtilWaitValueChangeToZero@8
    • _UtilWriteVersionToRegistry@8
    • _UtilbuildDynamicDiskMappingTable@0
    • _UtlWriteBinValueKeyToRegistry@16
    • __UtilDosPathNameToNtPathName@12

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • PAGE
    • .edata
    • INIT
    • .rsrc
    • .reloc

    Signature

    Expand
    {
      "Certificates": [
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
          "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
          "TBS": {
            "MD5": "d0785ad36e427c92b19f6826ab1e8020",
            "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
            "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
            "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
          },
          "ValidFrom": "2012-12-21 00:00:00",
          "ValidTo": "2020-12-30 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
          "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
          "TBS": {
            "MD5": "e9d38360b914c8863f6cba3ee58764d3",
            "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
            "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
            "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
          },
          "ValidFrom": "2012-10-18 00:00:00",
          "ValidTo": "2020-12-29 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
          "TBS": {
            "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
            "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
            "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
            "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
          },
          "ValidFrom": "2017-04-27 00:00:00",
          "ValidTo": "2018-07-16 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "611993e400000000001c",
          "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
          "TBS": {
            "MD5": "78a717e082dcc1cda3458d917e677d14",
            "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
            "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
            "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
          },
          "ValidFrom": "2011-02-22 19:25:17",
          "ValidTo": "2021-02-22 19:35:17",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
          "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "TBS": {
            "MD5": "b30c31a572b0409383ed3fbe17e56e81",
            "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
            "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
            "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
          },
          "ValidFrom": "2010-02-08 00:00:00",
          "ValidTo": "2020-02-07 23:59:59",
          "Version": 3
        }
      ],
      "CertificatesInfo": "",
      "Signer": [
        {
          "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Version": 1
        }
      ],
      "SignerInfo": ""
    }
    

    PropertyValue
    FilenameTmComm.sys
    Creation Timestamp2015-07-16 05:25:16
    MD5085d3423f3c12a17119920f1a293ab4d
    SHA1d3daa971580b9f94002f7257de44fcef13bb1673
    SHA2565192ec4501d0fe0b1c8f7bf9b778f7524a7a70a26bbbb66e5dab8480f6fdbb8b
    Authentihash MD5037efb773500b55fa774ab62ef60838c
    Authentihash SHA19b1bc87c26d4a75e929ba54b88d32909d3cc6e5a
    Authentihash SHA2562e37c0e580bf6f0514af985b1581fef3d66b845aeefa790c625964512a911659
    RichPEHeaderHash MD55b33b237bab6e0b50320054616983177
    RichPEHeaderHash SHA1754c63349a54279bb01f24974f9faf6da8294d27
    RichPEHeaderHash SHA256001d9e469d2c4160f8fbff1c0aee013e72881cffb568910a2c1473a17bf858b2
    CompanyTrend Micro Inc.
    DescriptionTrendMicro Common Module
    ProductTrend Micro Eyes
    OriginalFilenameTmComm.sys

    Download

    Certificates

    Expand
    Certificate 009feac811b0f16247a5fc20d80523ace6
    FieldValue
    ToBeSigned (TBS) MD5b6aa9cf28bcfc9f07ec1069fb425ab61
    ToBeSigned (TBS) SHA1ca7a166fcd53878ba5a38d4cac37c63513cfc1fa
    ToBeSigned (TBS) SHA256711394fc49f8948a831f687d42ced6b18514f57786ecc6cdbc3c3eb72e568a40
    SubjectC=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO Time Stamping Signer
    ValidFrom2015-05-05 00:00:00
    ValidTo2015-12-31 23:59:59
    Signature0dbbad60111bb5f00dcce6483a7a3e0e33dc1cb9ead620fea34dd0cc764ee818d879dfd34f9a4264238a29728a3a6c66a63c3a17a8704565c673c3d0ce8954fbac690f58b019cb869f7eb97eeb5192bf9bddebd165f0257b887cdebda5c8b51451bcc081308a85387be679fe67559387fe4fe88d0eedf37292b5c289806dd159e31d0deab138ee039d0019a5ab219b79c3ccc23e687ebdc94d694db46451fbb22874e25389ce9dfaade2dbceab7b7e064474fd0aa3c9b7a730cd49d29264f122a6b828457479e9a7ce3b33f98350947d68c01d49c760787a3c6426d5befa0a6de41ee109538fa9c523acc79d614221f02c1671493b10af2c6f1ae631f114fd6c
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber009feac811b0f16247a5fc20d80523ace6
    Version3
    Certificate 250ce8e030612e9f2b89f7054d7cf8fd
    FieldValue
    ToBeSigned (TBS) MD5918d9eb6a6cd36c531eceb926170a7e1
    ToBeSigned (TBS) SHA10ae95700d65e6f59715aa47048993ca7858e676a
    ToBeSigned (TBS) SHA25647c46e6eaa3780eace3d0d891346cd373359d246b21a957219dbab4c8f37c166
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
    ValidFrom2006-11-08 00:00:00
    ValidTo2021-11-07 23:59:59
    Signature1302ddf8e88600f25af8f8200c59886207cecef74ef9bb59a198e5e138dd4ebc6618d3adeb18f20dc96d3e4a9420c33cbabd6554c6af44b310ad2c6b3eabd707b6b88163c5f95e2ee52a67cecd330c2ad7895603231fb3bee83a0859b4ec4535f78a5bff66cf50afc66d578d1978b7b9a2d157ea1f9a4bafbac98e127ec6bdff
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber250ce8e030612e9f2b89f7054d7cf8fd
    Version3
    Certificate 610c120600000000001b
    FieldValue
    ToBeSigned (TBS) MD553c41bc1164e09e0cd1617a5bf913efd
    ToBeSigned (TBS) SHA193c03aac8951d494ecd5696b1c08658541b18727
    ToBeSigned (TBS) SHA25640bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b
    SubjectC=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
    ValidFrom2006-05-23 17:01:29
    ValidTo2016-05-23 17:11:29
    Signature01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber610c120600000000001b
    Version3
    Certificate 1519396ee230f02cad1fcfdb077a35f0
    FieldValue
    ToBeSigned (TBS) MD57e2a6f93403382b4ec42463426d0a4b5
    ToBeSigned (TBS) SHA162acc697c0e2dc37f3d37ab79751637346e051e2
    ToBeSigned (TBS) SHA2563e9a51973a839e5bc6e81c886e085b777d08ce2b24f816b7552cf2c44e322d59
    SubjectC=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.
    ValidFrom2015-02-20 00:00:00
    ValidTo2016-05-21 23:59:59
    Signaturee480eb7f78216a855e34dbcb712d3879d6b1744c823c8e78c3661e55182a5c1f3a03686169393ef8778c893a49604a79769f5ba7156426c5431ae729a8dc5f8e22b14d124e46eff3f4f660552a57250a15e15d07ad548a02cddf8a204b5010be387a05b1019f618cf15078d80a809a7272b1822a63862c7db194f12697a786001ef630ac9d8bf9f5475191f327b8ed4839dff1ef65e5eb8f91379a66366451f99cb633848c57d4392096e6080fa327b23fc3834ad4f6043904d6c5aeb35454a265b3fda38167cffa8394f092a74bad1ea386f63b7baeb95271a97fc3bff0a2bc96a834f280a254d7170e5cc2830f3bd0649178f8b04514ecd1103753b1762902
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber1519396ee230f02cad1fcfdb077a35f0
    Version3
    Certificate 5200e5aa2556fc1a86ed96c9d44b33c7
    FieldValue
    ToBeSigned (TBS) MD5b30c31a572b0409383ed3fbe17e56e81
    ToBeSigned (TBS) SHA14843a82ed3b1f2bfbee9671960e1940c942f688d
    ToBeSigned (TBS) SHA25603cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
    ValidFrom2010-02-08 00:00:00
    ValidTo2020-02-07 23:59:59
    Signature5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber5200e5aa2556fc1a86ed96c9d44b33c7
    Version3

    Imports

    Expand
    • ntoskrnl.exe
    • HAL.dll
    • CLASSPNP.SYS

    Imported Functions

    Expand
    • wcsrchr
    • KeSetEvent
    • KePulseEvent
    • KeClearEvent
    • KeStackAttachProcess
    • KeUnstackDetachProcess
    • ObfDereferenceObject
    • ZwSetEvent
    • ZwClose
    • ZwConnectPort
    • RtlInitUnicodeString
    • RtlUnicodeStringToInteger
    • ZwCreateSection
    • ZwWaitForSingleObject
    • ZwOpenEvent
    • IoGetCurrentProcess
    • ObfReferenceObject
    • DbgBreakPoint
    • ZwRequestWaitReplyPort
    • ExFreePoolWithTag
    • ProbeForWrite
    • ZwFreeVirtualMemory
    • ZwAllocateVirtualMemory
    • ObOpenObjectByPointer
    • PsProcessType
    • memmove
    • PsGetProcessExitTime
    • MmSectionObjectType
    • PsThreadType
    • ObReleaseObjectSecurity
    • SeReleaseSubjectContext
    • SeAccessCheck
    • SeCaptureSubjectContext
    • ObGetObjectSecurity
    • DbgPrint
    • memset
    • MmIsAddressValid
    • ExInitializeResourceLite
    • ExDeleteResourceLite
    • ZwWriteFile
    • ZwReadFile
    • ZwQueryInformationFile
    • ZwSetInformationFile
    • ZwCreateFile
    • swprintf
    • towupper
    • _wcsnicmp
    • ExAllocatePoolWithTag
    • KeInitializeEvent
    • _snprintf
    • PsGetCurrentProcessId
    • RtlTimeToTimeFields
    • ExSystemTimeToLocalTime
    • KeQuerySystemTime
    • PsGetCurrentThreadId
    • RtlInitAnsiString
    • ZwDeviceIoControlFile
    • ZwCreateKey
    • ZwCreateEvent
    • KeWaitForMultipleObjects
    • ObReferenceObjectByHandle
    • ZwNotifyChangeKey
    • _vsnprintf
    • RtlFreeUnicodeString
    • RtlAnsiStringToUnicodeString
    • RtlEqualUnicodeString
    • RtlAppendUnicodeStringToString
    • RtlCopyUnicodeString
    • RtlUpcaseUnicodeChar
    • ExGetPreviousMode
    • KeWaitForSingleObject
    • KeSetPriorityThread
    • PsTerminateSystemThread
    • PsCreateSystemThread
    • KeDelayExecutionThread
    • KeNumberProcessors
    • ZwQueryInformationProcess
    • PsLookupProcessByProcessId
    • ZwOpenDirectoryObject
    • PsSetCreateProcessNotifyRoutine
    • ZwQuerySystemInformation
    • ZwQueryDirectoryFile
    • ZwQueryDirectoryObject
    • ZwOpenKey
    • ZwEnumerateKey
    • ZwEnumerateValueKey
    • ZwQueryValueKey
    • ZwDeleteValueKey
    • ZwDeleteKey
    • ZwTerminateProcess
    • ZwOpenProcess
    • ZwQueryKey
    • ZwSetValueKey
    • IoFileObjectType
    • _allrem
    • ZwQuerySecurityObject
    • memcpy
    • RtlLengthSecurityDescriptor
    • MmHighestUserAddress
    • IoFreeIrp
    • IoFreeMdl
    • _purecall
    • IoBuildAsynchronousFsdRequest
    • _strnicmp
    • RtlQueryRegistryValues
    • RtlAppendUnicodeToString
    • mbstowcs
    • ZwQuerySymbolicLinkObject
    • ZwOpenSymbolicLinkObject
    • NtClose
    • ObQueryNameString
    • MmGetSystemRoutineAddress
    • ZwSetInformationObject
    • _stricmp
    • ZwUnmapViewOfSection
    • ZwMapViewOfSection
    • ZwOpenFile
    • IoCreateFile
    • IofCallDriver
    • IoAllocateIrp
    • MmBuildMdlForNonPagedPool
    • IoAllocateMdl
    • ProbeForRead
    • PsGetVersion
    • RtlImageNtHeader
    • RtlCompareMemory
    • RtlUpcaseUnicodeString
    • _snwprintf
    • MmSystemRangeStart
    • wcsncmp
    • strrchr
    • ZwQueryVolumeInformationFile
    • ObReferenceObjectByPointer
    • IoBuildDeviceIoControlRequest
    • ZwOpenSection
    • _allmul
    • KeReleaseSemaphore
    • RtlLengthRequiredSid
    • RtlInitializeSid
    • RtlSubAuthoritySid
    • RtlSetDaclSecurityDescriptor
    • RtlCreateSecurityDescriptor
    • RtlAddAccessAllowedAce
    • RtlCreateAcl
    • KeInitializeSemaphore
    • IofCompleteRequest
    • ExEventObjectType
    • IoDeleteDevice
    • IoDeleteSymbolicLink
    • IoCreateSymbolicLink
    • IoGetDeviceObjectPointer
    • RtlUpperChar
    • ObReferenceObjectByName
    • IoDriverObjectType
    • RtlCompareUnicodeString
    • strncpy
    • KeServiceDescriptorTable
    • NtOpenProcess
    • ObOpenObjectByName
    • NtQueryInformationProcess
    • PsIsThreadTerminating
    • KeAddSystemServiceTable
    • ZwFsControlFile
    • ObInsertObject
    • IoReleaseVpbSpinLock
    • IoAcquireVpbSpinLock
    • SeCreateAccessState
    • IoGetFileObjectGenericMapping
    • ObCreateObject
    • _allshr
    • ExInterlockedPopEntrySList
    • IoGetStackLimits
    • IoBuildSynchronousFsdRequest
    • wcsstr
    • IoUnregisterPlugPlayNotification
    • FsRtlIsNameInExpression
    • IoGetConfigurationInformation
    • MmProbeAndLockPages
    • IoGetDeviceInterfaces
    • IoRegisterPlugPlayNotification
    • ExAllocatePool
    • RtlFreeAnsiString
    • RtlUnicodeStringToAnsiString
    • strncat
    • wcschr
    • wcsncat
    • wcstombs
    • KeTickCount
    • KeBugCheckEx
    • RtlUnwind
    • wcsncpy
    • ExReleaseResourceLite
    • ExAcquireResourceExclusiveLite
    • ExAcquireResourceSharedLite
    • ExReleaseFastMutexUnsafe
    • KeLeaveCriticalRegion
    • KeEnterCriticalRegion
    • ZwSetSecurityObject
    • ExAcquireFastMutexUnsafe
    • IoDeviceObjectType
    • IoCreateDevice
    • RtlGetDaclSecurityDescriptor
    • RtlGetSaclSecurityDescriptor
    • RtlGetGroupSecurityDescriptor
    • RtlGetOwnerSecurityDescriptor
    • SeCaptureSecurityDescriptor
    • SeExports
    • IoIsWdmVersionAvailable
    • RtlLengthSid
    • RtlAbsoluteToSelfRelativeSD
    • MmUnlockPages
    • KeGetCurrentThread
    • KfAcquireSpinLock
    • KfReleaseSpinLock
    • KeRaiseIrqlToDpcLevel
    • KfLowerIrql
    • ExAcquireFastMutex
    • ExReleaseFastMutex
    • KeGetCurrentIrql
    • KfRaiseIrql
    • ClassInitialize

    Exported Functions

    Expand
    • ??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
    • ??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
    • ??0CBlobConfig@@QAE@ABV0@@Z
    • ??0CBlobConfig@@QAE@K@Z
    • ??0CContext@@QAE@ABV0@@Z
    • ??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
    • ??0CContextList@@QAE@ABV0@@Z
    • ??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CDebugLog@@QAE@ABV0@@Z
    • ??0CDebugLog@@QAE@PBG@Z
    • ??0CDebugLogEx@@QAE@ABV0@@Z
    • ??0CDebugLogEx@@QAE@K@Z
    • ??0CDelayLoadThread@@QAE@ABV0@@Z
    • ??0CDelayLoadThread@@QAE@XZ
    • ??0CExclusionExtConfig@@QAE@ABV0@@Z
    • ??0CExclusionExtConfig@@QAE@KKE@Z
    • ??0CExclusionFileNameConfig@@QAE@ABV0@@Z
    • ??0CExclusionFileNameConfig@@QAE@KK@Z
    • ??0CExclusionFilePathConfig@@QAE@ABV0@@Z
    • ??0CExclusionFilePathConfig@@QAE@KK@Z
    • ??0CExclusionFolderConfig@@QAE@ABV0@@Z
    • ??0CExclusionFolderConfig@@QAE@KK@Z
    • ??0CExclusionRegistryConfig@@QAE@ABV0@@Z
    • ??0CExclusionRegistryConfig@@QAE@KK@Z
    • ??0CFile@@QAE@ABV0@@Z
    • ??0CFile@@QAE@E@Z
    • ??0CFileExtension@@QAE@ABV0@@Z
    • ??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
    • ??0CInclusionExtConfig@@QAE@ABV0@@Z
    • ??0CInclusionExtConfig@@QAE@KKE@Z
    • ??0CInclusionFileNameConfig@@QAE@ABV0@@Z
    • ??0CInclusionFileNameConfig@@QAE@KK@Z
    • ??0CInclusionFilePathConfig@@QAE@ABV0@@Z
    • ??0CInclusionFilePathConfig@@QAE@KK@Z
    • ??0CInclusionFolderConfig@@QAE@ABV0@@Z
    • ??0CInclusionFolderConfig@@QAE@KK@Z
    • ??0CKEvent@@QAE@ABV0@@Z
    • ??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
    • ??0CList@@QAE@ABV0@@Z
    • ??0CList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CLockEvent@@QAE@ABV0@@Z
    • ??0CLockEvent@@QAE@XZ
    • ??0CLockList@@QAE@ABV0@@Z
    • ??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
    • ??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
    • ??0CMemoryAllocator@@QAE@ABV0@@Z
    • ??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
    • ??0CMemoryPoolAllocator@@QAE@ABV0@@Z
    • ??0CModuleConfig@@QAE@ABV0@@Z
    • ??0CModuleConfig@@QAE@XZ
    • ??0CModuleConfigList@@QAE@ABV0@@Z
    • ??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CModuleFileExtConfig@@QAE@ABV0@@Z
    • ??0CModuleFileExtConfig@@QAE@KKE@Z
    • ??0CModuleFlagConfig@@QAE@ABV0@@Z
    • ??0CModuleFlagConfig@@QAE@K@Z
    • ??0CModuleMultiStringConfig@@QAE@ABV0@@Z
    • ??0CModuleMultiStringConfig@@QAE@KK@Z
    • ??0CModuleStringConfig@@QAE@ABV0@@Z
    • ??0CModuleStringConfig@@QAE@K@Z
    • ??0CNoLockList@@QAE@ABV0@@Z
    • ??0CNoLockList@@QAE@KKPAVIMemoryAllocator@@@Z
    • ??0CSmartLock@@QAE@AAVCLockEvent@@@Z
    • ??0CSmartLock@@QAE@XZ
    • ??0CSmartReference@@QAE@AAJ@Z
    • ??0CSmartReference@@QAE@AAK@Z
    • ??0CSmartResource@@QAE@AAVCResource@@E@Z
    • ??0CStrList@@QAE@ABV0@@Z
    • ??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CSystemThread@@QAE@ABV0@@Z
    • ??0CSystemThread@@QAE@K@Z
    • ??0CUserFuncAdapterJob@@QAE@ABV0@@Z
    • ??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z01@Z
    • ??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
    • ??0CWorkerThread@@QAE@ABV0@@Z
    • ??0CWorkerThreadJob@@QAE@ABV0@@Z
    • ??0CWorkerThreadJob@@QAE@E@Z
    • ??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
    • ??0CWorkerThreadJobQueue@@QAE@K@Z
    • ??0CWorkerThreadPool@@QAE@ABV0@@Z
    • ??0CWorkerThreadPool@@QAE@K@Z
    • ??0CWorkerThreadPoolEx@@QAE@ABV0@@Z
    • ??0CWorkerThreadPoolEx@@QAE@KK@Z
    • ??0IMemoryAllocator@@QAE@ABV0@@Z
    • ??0IMemoryAllocator@@QAE@XZ
    • ??1CAutoUpdateConfigThread@@UAE@XZ
    • ??1CBlobConfig@@UAE@XZ
    • ??1CContext@@UAE@XZ
    • ??1CContextList@@UAE@XZ
    • ??1CDebugLog@@UAE@XZ
    • ??1CDebugLogEx@@UAE@XZ
    • ??1CDelayLoadThread@@UAE@XZ
    • ??1CExclusionExtConfig@@UAE@XZ
    • ??1CExclusionFileNameConfig@@UAE@XZ
    • ??1CExclusionFilePathConfig@@UAE@XZ
    • ??1CExclusionFolderConfig@@UAE@XZ
    • ??1CExclusionRegistryConfig@@UAE@XZ
    • ??1CFile@@UAE@XZ
    • ??1CFileExtension@@UAE@XZ
    • ??1CInclusionExtConfig@@UAE@XZ
    • ??1CInclusionFileNameConfig@@UAE@XZ
    • ??1CInclusionFilePathConfig@@UAE@XZ
    • ??1CInclusionFolderConfig@@UAE@XZ
    • ??1CKEvent@@UAE@XZ
    • ??1CList@@UAE@XZ
    • ??1CLockEvent@@UAE@XZ
    • ??1CLockList@@UAE@XZ
    • ??1CMemoryAllocator@@UAE@XZ
    • ??1CMemoryPoolAllocator@@UAE@XZ
    • ??1CModuleConfig@@UAE@XZ
    • ??1CModuleConfigList@@UAE@XZ
    • ??1CModuleFileExtConfig@@UAE@XZ
    • ??1CModuleFlagConfig@@UAE@XZ
    • ??1CModuleMultiStringConfig@@UAE@XZ
    • ??1CModuleStringConfig@@UAE@XZ
    • ??1CNoLockList@@UAE@XZ
    • ??1CSmartLock@@QAE@XZ
    • ??1CSmartReference@@QAE@XZ
    • ??1CSmartResource@@QAE@XZ
    • ??1CStrList@@UAE@XZ
    • ??1CSystemThread@@UAE@XZ
    • ??1CUserFuncAdapterJob@@UAE@XZ
    • ??1CWorkerThread@@UAE@XZ
    • ??1CWorkerThreadJob@@UAE@XZ
    • ??1CWorkerThreadJobQueue@@UAE@XZ
    • ??1CWorkerThreadPool@@UAE@XZ
    • ??1CWorkerThreadPoolEx@@UAE@XZ
    • ??1IMemoryAllocator@@UAE@XZ
    • ??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
    • ??2CMemoryAllocator@@SGPAXI@Z
    • ??2CMemoryPoolAllocator@@SGPAXI@Z
    • ??3@YAXPAX@Z
    • ??3IMemoryAllocator@@SGXPAX@Z
    • ??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
    • ??4CBlobConfig@@QAEAAV0@ABV0@@Z
    • ??4CContext@@QAEAAV0@ABV0@@Z
    • ??4CDebugLog@@QAEAAV0@ABV0@@Z
    • ??4CDebugLogEx@@QAEAAV0@ABV0@@Z
    • ??4CDelayLoadThread@@QAEAAV0@ABV0@@Z
    • ??4CFile@@QAEAAV0@ABV0@@Z
    • ??4CKEvent@@QAEAAV0@ABV0@@Z
    • ??4CLockEvent@@QAEAAV0@ABV0@@Z
    • ??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
    • ??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
    • ??4CModuleConfig@@QAEAAV0@ABV0@@Z
    • ??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
    • ??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
    • ??4CSmartLock@@QAEAAV0@ABV0@@Z
    • ??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
    • ??4CSmartResource@@QAEAAV0@ABV0@@Z
    • ??4CSystemThread@@QAEAAV0@ABV0@@Z
    • ??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
    • ??4CWorkerThread@@QAEAAV0@ABV0@@Z
    • ??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
    • ??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
    • ??_7CAutoUpdateConfigThread@@6B@
    • ??_7CBlobConfig@@6B@
    • ??_7CContext@@6B@
    • ??_7CContextList@@6B@
    • ??_7CDebugLog@@6B@
    • ??_7CDebugLogEx@@6B@
    • ??_7CDelayLoadThread@@6B@
    • ??_7CExclusionExtConfig@@6B@
    • ??_7CExclusionFileNameConfig@@6B@
    • ??_7CExclusionFilePathConfig@@6B@
    • ??_7CExclusionFolderConfig@@6B@
    • ??_7CExclusionRegistryConfig@@6B@
    • ??_7CFile@@6B@
    • ??_7CFileExtension@@6B@
    • ??_7CInclusionExtConfig@@6B@
    • ??_7CInclusionFileNameConfig@@6B@
    • ??_7CInclusionFilePathConfig@@6B@
    • ??_7CInclusionFolderConfig@@6B@
    • ??_7CKEvent@@6B@
    • ??_7CList@@6B@
    • ??_7CLockEvent@@6B@
    • ??_7CLockList@@6B@
    • ??_7CMemoryAllocator@@6B@
    • ??_7CMemoryPoolAllocator@@6B@
    • ??_7CModuleConfig@@6B@
    • ??_7CModuleConfigList@@6B@
    • ??_7CModuleFileExtConfig@@6B@
    • ??_7CModuleFlagConfig@@6B@
    • ??_7CModuleMultiStringConfig@@6B@
    • ??_7CModuleStringConfig@@6B@
    • ??_7CNoLockList@@6B@
    • ??_7CStrList@@6B@
    • ??_7CSystemThread@@6B@
    • ??_7CUserFuncAdapterJob@@6B@
    • ??_7CWorkerThread@@6B@
    • ??_7CWorkerThreadJob@@6B@
    • ??_7CWorkerThreadJobQueue@@6B@
    • ??_7CWorkerThreadPool@@6B@
    • ??_7CWorkerThreadPoolEx@@6B@
    • ??_7IMemoryAllocator@@6B@
    • ??_FCContextList@@QAEXXZ
    • ??_FCFile@@QAEXXZ
    • ??_FCFileExtension@@QAEXXZ
    • ??_FCModuleConfigList@@QAEXXZ
    • ??_FCStrList@@QAEXXZ
    • ??_FCSystemThread@@QAEXXZ
    • ??_FCWorkerThread@@QAEXXZ
    • ??_FCWorkerThreadJob@@QAEXXZ
    • ??_FCWorkerThreadJobQueue@@QAEXXZ
    • ??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
    • ??_V@YAXPAX@Z
    • ?Acquire@CLockEvent@@QAEXXZ
    • ?Add@CContextList@@QAEEPAVCContext@@@Z
    • ?Add@CFileExtension@@QAEEPBGK@Z
    • ?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
    • ?Add@CStrList@@QAEEPBG@Z
    • ?AddNode@CLockList@@UAEEQAXE@Z
    • ?AddNode@CNoLockList@@UAEEQAXE@Z
    • ?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
    • ?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
    • ?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
    • ?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
    • ?Cancel@CWorkerThreadJob@@QAEXXZ
    • ?CheckNode@CLockList@@UAEHQAX@Z
    • ?CheckNode@CNoLockList@@UAEHQAX@Z
    • ?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
    • ?Cleanup@CBlobConfig@@AAEXXZ
    • ?Cleanup@CModuleFileExtConfig@@IAEXXZ
    • ?Cleanup@CModuleMultiStringConfig@@IAEXXZ
    • ?Cleanup@CModuleStringConfig@@AAEXXZ
    • ?Close@CFile@@QAEJXZ
    • ?Count@CLockList@@QAEKXZ
    • ?Count@CNoLockList@@QAEKXZ
    • ?Create@CFile@@QAEJPBGKKKK@Z
    • ?Create@CSystemThread@@QAEEXZ
    • ?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
    • ?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
    • ?CreatePool@CWorkerThreadPool@@QAEEXZ
    • ?CreatePool@CWorkerThreadPoolEx@@QAEEXZ
    • ?CreateThreads@CWorkerThreadPool@@QAEEK@Z
    • ?CreateThreads@CWorkerThreadPoolEx@@QAEEK@Z
    • ?CreateWIRP@CFile@@QAEJPBGKKKK@Z
    • ?Delete@CFile@@QAEJXZ
    • ?Delete@CFileExtension@@QAEEPBGK@Z
    • ?Delete@CStrList@@QAEEPBG@Z
    • ?DeleteAll@CList@@UAEXXZ
    • ?DeleteAll@CLockList@@UAEXXZ
    • ?DeleteAll@CNoLockList@@UAEXXZ
    • ?DeleteNode@CContextList@@MAEXPAX@Z
    • ?DeleteNode@CList@@UAEXPAX@Z
    • ?DeleteNode@CModuleConfigList@@MAEXPAX@Z
    • ?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
    • ?DisableWriteProtectFromCR0@@YGXPAPAX@Z
    • ?DoIt@CWorkerThreadJob@@QAEJXZ
    • ?EntryPoint@CSystemThread@@KGXPAX@Z
    • ?Find@CContextList@@QAEPAVCContext@@K@Z
    • ?Find@CContextList@@QAEPAVCContext@@PAX@Z
    • ?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
    • ?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
    • ?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
    • ?FindNode@CContextList@@IAEPAXPAX@Z
    • ?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
    • ?FinishFunction@CUserFuncAdapterJob@@MAEXXZ
    • ?FinishIt@CWorkerThreadJob@@QAEJXZ
    • ?First@CList@@UAEPAXXZ
    • ?First@CLockList@@UAEPAXXZ
    • ?First@CNoLockList@@UAEPAXXZ
    • ?Free@CMemoryAllocator@@UAEXPAX@Z
    • ?Free@CMemoryPoolAllocator@@UAEXPAX@Z
    • ?GetAttributes@CFile@@QAEKXZ
    • ?GetBasicInfomration@CFile@@IAEJXZ
    • ?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
    • ?GetCategory@CContext@@QAEKXZ
    • ?GetData@CBlobConfig@@QAEHPAXPAK@Z
    • ?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
    • ?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
    • ?GetData@CModuleFlagConfig@@QAEKXZ
    • ?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
    • ?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
    • ?GetData@CModuleStringConfig@@QAEPAGXZ
    • ?GetData@CStrList@@QAEEPAGPAK@Z
    • ?GetDataType@CModuleConfig@@QAEKXZ
    • ?GetEngineContext@CContext@@QAEPAXXZ
    • ?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
    • ?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
    • ?GetFileSizeWIRP@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
    • ?GetFlagConfig@CContext@@UAEJKPAK@Z
    • ?GetID@CModuleConfig@@QAEKXZ
    • ?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
    • ?GetLength@CModuleStringConfig@@QAEKXZ
    • ?GetLinkContext@CContext@@QAEPAXXZ
    • ?GetLogFlag@CDebugLog@@QAEKXZ
    • ?GetLogFlag@CDebugLogEx@@QAEKXZ
    • ?GetModuleId@CModuleConfig@@QAEKXZ
    • ?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
    • ?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_KTHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_ETHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_KTHREAD@@XZ
    • ?GetReportCallBackRoutine@CContext@@QAEKXZ
    • ?GetSize@CBlobConfig@@QAEKXZ
    • ?GetStringConfig@CContext@@QAEPAGK@Z
    • ?GetStringConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetThreadCount@CWorkerThreadPool@@QAEKXZ
    • ?GetThreadCount@CWorkerThreadPoolEx@@QAEKXZ
    • ?GetThreadID@CSystemThread@@QAEKXZ
    • ?GetType@CContext@@QAEKXZ
    • ?GetUserParameter@CContext@@QAEKXZ
    • ?InitProcMon@CDebugLogEx@@IAEXXZ
    • ?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
    • ?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
    • ?InitializeFlagConfig@CContext@@QAEHKK@Z
    • ?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
    • ?InitializeStringConfig@CContext@@QAEHKPBG@Z
    • ?Insert@CList@@UAEXQAXE@Z
    • ?Insert@CLockList@@UAEXQAXE@Z
    • ?Insert@CNoLockList@@UAEXQAXE@Z
    • ?InsertAfter@CList@@UAEXPAX0@Z
    • ?InsertBefore@CList@@UAEXPAX0@Z
    • ?Instance@CWorkerThreadPool@@SGPAV1@XZ
    • ?IsEmpty@CList@@UAEEXZ
    • ?IsEmpty@CLockList@@UAEEXZ
    • ?IsEmpty@CNoLockList@@UAEEXZ
    • ?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
    • ?IsFull@CLockList@@QBEEXZ
    • ?IsFull@CNoLockList@@QBEEXZ
    • ?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionExtConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFileNameConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFilePathConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFolderConfig@@QAEEPBG@Z
    • ?IsOpened@CFile@@QAEEXZ
    • ?IsTerminated@CWorkerThreadPool@@QAEEXZ
    • ?IsTerminated@CWorkerThreadPoolEx@@QAEEXZ
    • ?IsValid@CMemoryAllocator@@UAEEXZ
    • ?IsValid@CMemoryPoolAllocator@@UAEEXZ
    • ?IsValid@IMemoryAllocator@@UAEEXZ
    • ?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
    • ?IsWorkerThread@CWorkerThreadPoolEx@@QAEEK@Z
    • ?JobFunction@CUserFuncAdapterJob@@MAEXXZ
    • ?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
    • ?JobQueue@CWorkerThreadPoolEx@@QAEAAVCWorkerThreadJobQueue@@XZ
    • ?Limit@CLockList@@QAEKXZ
    • ?Limit@CNoLockList@@QAEKXZ
    • ?MatchAllExtensions@CFileExtension@@QAEEXZ
    • ?MatchNoExtensions@CFileExtension@@QAEEXZ
    • ?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
    • ?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
    • ?NeedDelete@CWorkerThreadJob@@QAEEXZ
    • ?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
    • ?NewNode@CList@@UAEPAXXZ
    • ?NewNode@CStrList@@EAEPAXXZ
    • ?NewNodeVariant@CList@@IAEPAXK@Z
    • ?Next@CList@@UBEPAXQAX@Z
    • ?Next@CLockList@@UBEPAXQAX@Z
    • ?Next@CNoLockList@@UBEPAXQAX@Z
    • ?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
    • ?NotityTerminate@CWorkerThread@@QAEXXZ
    • ?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
    • ?PostJobToWorkerThread@CWorkerThreadPoolEx@@QAEJP6GXPAX@Z0E1@Z
    • ?Pulse@CKEvent@@QAEJJE@Z
    • ?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
    • ?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
    • ?QueueJobItem@CWorkerThreadPoolEx@@QAEJPAVCWorkerThreadJob@@@Z
    • ?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
    • ?Read@CFile@@QAEJPADKPAK@Z
    • ?ReadWIRP@CFile@@QAEJPADKPAK@Z
    • ?ReferenceCount@CContext@@QAEAAKXZ
    • ?Release@CLockEvent@@QAEXXZ
    • ?Remove@CContextList@@UAEEQAX@Z
    • ?Remove@CList@@UAEEQAX@Z
    • ?Remove@CLockList@@UAEEQAX@Z
    • ?Remove@CNoLockList@@UAEEQAX@Z
    • ?RemoveHead@CList@@UAEPAXXZ
    • ?RemoveHead@CLockList@@UAEPAXXZ
    • ?RemoveHead@CNoLockList@@UAEPAXXZ
    • ?RemoveTail@CList@@UAEPAXXZ
    • ?RemoveTail@CLockList@@UAEPAXXZ
    • ?RemoveTail@CNoLockList@@UAEPAXXZ
    • ?Reset@CKEvent@@QAEXXZ
    • ?ResetData@CInclusionExtConfig@@QAEXXZ
    • ?ResetData@CInclusionFileNameConfig@@QAEXXZ
    • ?ResetData@CInclusionFilePathConfig@@QAEXXZ
    • ?ResetData@CInclusionFolderConfig@@QAEXXZ
    • ?RestoreCR0@@YGXPAX@Z
    • ?Run@CAutoUpdateConfigThread@@UAEXXZ
    • ?Run@CDelayLoadThread@@UAEXXZ
    • ?Run@CWorkerThread@@UAEXXZ
    • ?SeekToEnd@CFile@@QAEJXZ
    • ?Set@CKEvent@@QAEJJE@Z
    • ?SetAttributes@CFile@@QAEJK@Z
    • ?SetBlobCofig@CContext@@UAEJKPAXK@Z
    • ?SetData@CBlobConfig@@QAEHPAXK@Z
    • ?SetData@CModuleFileExtConfig@@QAEHPBG@Z
    • ?SetData@CModuleFlagConfig@@QAEHK@Z
    • ?SetData@CModuleMultiStringConfig@@QAEHPBGK@Z
    • ?SetData@CModuleStringConfig@@QAEHPBG@Z
    • ?SetEngineContext@CContext@@QAEXPAX@Z
    • ?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
    • ?SetFlagConfig@CContext@@UAEJKK@Z
    • ?SetLinkContext@CContext@@QAEXPAX@Z
    • ?SetLogFlag@CDebugLog@@QAEEK@Z
    • ?SetLogFlag@CDebugLogEx@@QAEEK@Z
    • ?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
    • ?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
    • ?SetMultiStringConfig@CContext@@UAEJKPBG@Z
    • ?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
    • ?SetPriority@CSystemThread@@QAEXK@Z
    • ?SetStopUse@CContext@@QAEXXZ
    • ?SetStringConfig@CContext@@UAEJKPBG@Z
    • ?Setup@CSystemThread@@MAEXXZ
    • ?StopUse@CContext@@QAEHXZ
    • ?TearDown@CSystemThread@@MAEXXZ
    • ?Terminate@CSystemThread@@QAEXE@Z
    • ?Terminate@CWorkerThreadPool@@QAEEXZ
    • ?Terminate@CWorkerThreadPoolEx@@QAEEXZ
    • ?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
    • ?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
    • ?WaitFinish@CWorkerThreadJob@@QAEXXZ
    • ?WaitForInit@CDelayLoadThread@@QAEEXZ
    • ?WaitForLoad@CDelayLoadThread@@QAEEXZ
    • ?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
    • ?WaitQueueEmpty@CWorkerThreadJobQueue@@QAEXXZ
    • ?Write@CDebugLog@@QAAXPBDZZ
    • ?Write@CDebugLogEx@@QAAXPBDZZ
    • ?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
    • ?WriteDataToFile@CDebugLogEx@@IAEXPADK@Z
    • ?WriteDataToProcMonW@CDebugLogEx@@IAEXPAD@Z
    • ?WriteSystemInformation@CDebugLog@@QAEXXZ
    • ?WriteSystemInformation@CDebugLogEx@@QAEXXZ
    • ?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
    • ?WriteSystemStringInformation@CDebugLogEx@@IAEXPBG@Z
    • ?WriteToFile@CDebugLog@@IAEXPADK@Z
    • ?WriteToProcMonW@CDebugLogEx@@IAEXPAU_UNICODE_STRING@@@Z
    • ?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
    • ?_pPagedAllocator@@3PAVCMemoryAllocator@@A
    • ?m_lpInstance@CWorkerThreadPool@@1PAV1@A
    • ?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
    • _DeInitKm2UmCommunication@0
    • _DeInitKmLPC@0
    • _DuplicateFullFileName@4
    • _FreeFullFileName@4
    • _GetKm2UmMode@0
    • _GetModuleInfoByAddress@8
    • _GetModuleInfoByModuleName@8
    • _InitKm2UmCommunication@8
    • _InitKmLPC@0
    • _IsVerifierCodeCheckFlagOn@0
    • _IsWindows8_1_update@4
    • _KmCallUm@8
    • _KmCallUmByLPC@8
    • _KmCallUmEx@12
    • _KmCleanupCommPortAPIs@0
    • _KmGetUmInitProcess@0
    • _KmSetCommPortAPIs@4
    • _ModGetExportProcAddress@8
    • _ModLoadDLLToBuffer@4
    • _ModLoadDLLToBufferWithImageSize@8
    • _ModLoadModule@8
    • _ModUnLoadModule@4
    • _NormalizeFileName@4
    • _NormalizeFullNtPathToDosName@4
    • _TmCommConfigRoutine@4
    • _UtilAddDeviceInDriveTable@4
    • _UtilAddReparsePointMapping@8
    • _UtilCleanFileReadOnly@4
    • _UtilCloseExclusiveHandle@12
    • _UtilCreateDosFileName@8
    • _UtilDeleteFileForce@4
    • _UtilGetDeviceObjectName@8
    • _UtilGetFileNameFromFileObject@4
    • _UtilGetFileObjectForProcessByEPROC@8
    • _UtilGetFileObjectFromFileName@12
    • _UtilGetProcessName@12
    • _UtilGetSystemDirectory@4
    • _UtilGetSystemDirectoryEx@0
    • _UtilGetSystemDirectoryLength@0
    • _UtilGetSystemTime@4
    • _UtilIoSetFileInfo@24
    • _UtilIopCreateFileIRP@40
    • _UtilKeGetLowFileDevice@16
    • _UtilModuleIATHook@24
    • _UtilModuleIATUnHook@8
    • _UtilPostJobToWorkerThread@12
    • _UtilQueryExclusiveHandle@12
    • _UtilQueryKeyValue@24
    • _UtilRemoveDeviceFromDriveTable@4
    • _UtilVolumeDeviceToDosName@8
    • _UtilWaitValueChangeToZero@8
    • _UtilWriteVersionToRegistry@8
    • _UtilbuildDynamicDiskMappingTable@0
    • _UtlWriteBinValueKeyToRegistry@16
    • _ValidateAddressWithSize@20
    • __ResetProtectFromClose@4
    • __UtilDosPathNameToNtPathName@12

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • PAGE
    • .edata
    • INIT
    • .rsrc
    • .reloc

    Signature

    Expand
    {
      "Certificates": [
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
          "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
          "TBS": {
            "MD5": "d0785ad36e427c92b19f6826ab1e8020",
            "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
            "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
            "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
          },
          "ValidFrom": "2012-12-21 00:00:00",
          "ValidTo": "2020-12-30 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
          "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
          "TBS": {
            "MD5": "e9d38360b914c8863f6cba3ee58764d3",
            "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
            "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
            "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
          },
          "ValidFrom": "2012-10-18 00:00:00",
          "ValidTo": "2020-12-29 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
          "TBS": {
            "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
            "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
            "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
            "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
          },
          "ValidFrom": "2017-04-27 00:00:00",
          "ValidTo": "2018-07-16 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "611993e400000000001c",
          "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
          "TBS": {
            "MD5": "78a717e082dcc1cda3458d917e677d14",
            "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
            "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
            "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
          },
          "ValidFrom": "2011-02-22 19:25:17",
          "ValidTo": "2021-02-22 19:35:17",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
          "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "TBS": {
            "MD5": "b30c31a572b0409383ed3fbe17e56e81",
            "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
            "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
            "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
          },
          "ValidFrom": "2010-02-08 00:00:00",
          "ValidTo": "2020-02-07 23:59:59",
          "Version": 3
        }
      ],
      "CertificatesInfo": "",
      "Signer": [
        {
          "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Version": 1
        }
      ],
      "SignerInfo": ""
    }
    

    PropertyValue
    FilenameTmComm.sys
    Creation Timestamp2008-07-22 06:53:20
    MD508bac71557df8a9b1381c8c165f64520
    SHA1891c8d482e23222498022845a6b349fe1a186bcc
    SHA25661befeef14783eb0fed679fca179d2f5c33eb2dcbd40980669ca2ebeb3bf11cf
    Authentihash MD5cfb84fad4e23da054656c41b09c8c467
    Authentihash SHA14dad9e501ec85acd2b405eca3fc1e5787d64ab34
    Authentihash SHA25614cfe7b4f7572aa3434ac5dd458a35f286538b34734cf7a310fb7bcba209921c
    RichPEHeaderHash MD5fd5680b44e33c644adb2a11aaf9c107b
    RichPEHeaderHash SHA1797adadf7d576be425cefa156494b0e490b2fc81
    RichPEHeaderHash SHA256bf0ee0f8675bb1fbe955bd5eedb7f49b38a8af2e99a9f101d826baf830fe6c55
    CompanyTrend Micro Inc.
    DescriptionTrendMicro Common Module
    ProductAEGIS
    OriginalFilenameTmComm.sys

    Download

    Certificates

    Expand
    Certificate 3825d7faf861af9ef490e726b5d65ad5
    FieldValue
    ToBeSigned (TBS) MD5d6c7684e9aaa508cf268335f83afe040
    ToBeSigned (TBS) SHA118066d20ad92409c567cdfde745279ff71c75226
    ToBeSigned (TBS) SHA256a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff
    SubjectC=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2
    ValidFrom2007-06-15 00:00:00
    ValidTo2012-06-14 23:59:59
    Signature50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber3825d7faf861af9ef490e726b5d65ad5
    Version3
    Certificate 47bf1995df8d524643f7db6d480d31a4
    FieldValue
    ToBeSigned (TBS) MD5518d2ea8a21e879c942d504824ac211c
    ToBeSigned (TBS) SHA121ce87d827077e61abddf2beba69fde5432ea031
    ToBeSigned (TBS) SHA2561ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7
    SubjectC=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
    ValidFrom2003-12-04 00:00:00
    ValidTo2013-12-03 23:59:59
    Signature4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber47bf1995df8d524643f7db6d480d31a4
    Version3
    Certificate 4191a15a3978dfcf496566381d4c75c2
    FieldValue
    ToBeSigned (TBS) MD541011f8d0e7c7a6408334ca387914c61
    ToBeSigned (TBS) SHA1c7fc1727f5b75a6421a1f95c73bbdb23580c48e5
    ToBeSigned (TBS) SHA25688dd3952638ee82738c03168e6fd863fe4eab1059ee5e2926ad8cb587c255dc0
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA
    ValidFrom2004-07-16 00:00:00
    ValidTo2014-07-15 23:59:59
    Signatureae3a17b84a7b55fa6455ec40a4ed494190999c89bcaf2e1dca7823f91c190f7feb68bc32d98838dedc3fd389b43fb18296f1a45abaed2e26d3de7c016e000a00a4069211480940f91c1879672324e0bbd5e150ae1bf50edde02e81cd80a36c524f9175558aba22f2d2ea4175882f63557d1e545a9559cad93481c05f5ef67ab5
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber4191a15a3978dfcf496566381d4c75c2
    Version3
    Certificate 645212f783f4d7aba3555729e99ce065
    FieldValue
    ToBeSigned (TBS) MD5e00f0a38c65f7c0b9f19b97448d6a0e3
    ToBeSigned (TBS) SHA191c033a2f289418c4101654dceacef1b25bb55d0
    ToBeSigned (TBS) SHA25638b3fcbdb734b0e3439f3c9a3c4c1712091f577d2b616d41224137faf7ba7c86
    SubjectC=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, OU=RD, CN=Trend Micro, Inc.
    ValidFrom2008-01-16 00:00:00
    ValidTo2011-02-16 23:59:59
    Signature5a693868cea6ba49064b801a0d9e12887a37cbb92cca2950cc5e99c2df9aec5697422e67cd042836daf09a09e739f625255841fed1ec9657cb8b3edc08c55c302574cbdb3f7de2798ed769d766402619b48041f9d90f8c904488788412b1c632055e1afc4a5bbac642cb626bd20fece0feaa6cf9b287887788cf64586309a14a644b5f0595c0ddcb7d789831faedb48451e40e342da4ccbc38a5e992e57e7ce5328d531a8c68e61f9dc9be65605c1bedf3358579000b91a19b3be388bac36b58ca76b72358bd8e74e0a7b08b0587bb7a29758c01af40b80e8e72c76abd3a2babfe7c1ed6e7b1cd9b0221a605062b6d9d0ceb57e0eb305fdc5eb5bf6ea442f4c9
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber645212f783f4d7aba3555729e99ce065
    Version3
    Certificate 610c120600000000001b
    FieldValue
    ToBeSigned (TBS) MD553c41bc1164e09e0cd1617a5bf913efd
    ToBeSigned (TBS) SHA193c03aac8951d494ecd5696b1c08658541b18727
    ToBeSigned (TBS) SHA25640bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b
    SubjectC=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
    ValidFrom2006-05-23 17:01:29
    ValidTo2016-05-23 17:11:29
    Signature01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber610c120600000000001b
    Version3

    Imports

    Expand
    • ntoskrnl.exe
    • CLASSPNP.SYS

    Imported Functions

    Expand
    • KeEnterCriticalRegion
    • KeGetCurrentThread
    • KeLeaveCriticalRegion
    • ExReleaseFastMutexUnsafe
    • wcsncpy
    • memcpy
    • wcsrchr
    • KeSetEvent
    • KePulseEvent
    • KeClearEvent
    • KeInitializeSemaphore
    • KeWaitForSingleObject
    • DbgPrint
    • KeReleaseSemaphore
    • RtlSubAuthoritySid
    • RtlInitializeSid
    • ExAllocatePoolWithTag
    • RtlLengthRequiredSid
    • ExFreePoolWithTag
    • RtlSetDaclSecurityDescriptor
    • RtlCreateSecurityDescriptor
    • RtlAddAccessAllowedAce
    • RtlCreateAcl
    • ObfDereferenceObject
    • ZwSetEvent
    • ZwClose
    • KeUnstackDetachProcess
    • ZwRequestWaitReplyPort
    • memmove
    • KeStackAttachProcess
    • ZwConnectPort
    • RtlInitUnicodeString
    • ZwCreateSection
    • ZwWaitForSingleObject
    • ZwOpenEvent
    • ObfReferenceObject
    • IoGetCurrentProcess
    • memset
    • MmIsAddressValid
    • ZwWriteFile
    • ZwReadFile
    • ZwQueryInformationFile
    • ZwSetInformationFile
    • ZwCreateFile
    • swprintf
    • towupper
    • _wcsnicmp
    • KeInitializeEvent
    • _snprintf
    • PsGetCurrentProcessId
    • RtlTimeToTimeFields
    • ExSystemTimeToLocalTime
    • KeQuerySystemTime
    • ZwCreateKey
    • ZwCreateEvent
    • KeWaitForMultipleObjects
    • ObReferenceObjectByHandle
    • ZwNotifyChangeKey
    • PsGetCurrentThreadId
    • _vsnprintf
    • MmMapLockedPagesSpecifyCache
    • MmBuildMdlForNonPagedPool
    • MmCreateMdl
    • MmUnmapLockedPages
    • KeSetPriorityThread
    • PsTerminateSystemThread
    • PsCreateSystemThread
    • KeNumberProcessors
    • ZwQuerySystemInformation
    • ZwQueryDirectoryFile
    • ZwOpenDirectoryObject
    • ZwQueryDirectoryObject
    • ZwDuplicateObject
    • ZwOpenKey
    • ZwEnumerateKey
    • ZwEnumerateValueKey
    • ZwQueryValueKey
    • ZwDeleteValueKey
    • ZwDeleteKey
    • ExGetPreviousMode
    • ExAcquireFastMutexUnsafe
    • ObOpenObjectByPointer
    • PsProcessType
    • ZwOpenProcess
    • ZwQueryKey
    • ZwSetValueKey
    • IoFreeIrp
    • IoBuildAsynchronousFsdRequest
    • ProbeForWrite
    • KeBugCheckEx
    • RtlImageNtHeader
    • _stricmp
    • _strnicmp
    • RtlQueryRegistryValues
    • RtlAppendUnicodeToString
    • KeDelayExecutionThread
    • mbstowcs
    • ZwQuerySymbolicLinkObject
    • ZwOpenSymbolicLinkObject
    • RtlEqualUnicodeString
    • IoFileObjectType
    • IoCreateFile
    • IofCallDriver
    • IoAllocateIrp
    • IoFreeMdl
    • IoAllocateMdl
    • PsGetVersion
    • MmGetSystemRoutineAddress
    • RtlCompareMemory
    • RtlCopyUnicodeString
    • RtlAppendUnicodeStringToString
    • IofCompleteRequest
    • ExEventObjectType
    • IoDeleteDevice
    • IoDeleteSymbolicLink
    • IoCreateSymbolicLink
    • ProbeForRead
    • IoGetDeviceObjectPointer
    • ExAllocatePool
    • RtlUpperChar
    • RtlCompareUnicodeString
    • PsLookupProcessByProcessId
    • strncpy
    • KeServiceDescriptorTable
    • NtOpenProcess
    • ObReferenceObjectByPointer
    • MmSectionObjectType
    • ObQueryNameString
    • ObOpenObjectByName
    • NtQueryInformationProcess
    • _snwprintf
    • RtlAnsiStringToUnicodeString
    • KeAddSystemServiceTable
    • ZwQueryObject
    • ZwQuerySecurityObject
    • ObInsertObject
    • _allrem
    • IoReleaseVpbSpinLock
    • IoAcquireVpbSpinLock
    • SeCreateAccessState
    • IoGetFileObjectGenericMapping
    • ObCreateObject
    • KeTickCount
    • RtlUnwind
    • ZwSetSecurityObject
    • IoDeviceObjectType
    • IoCreateDevice
    • RtlGetDaclSecurityDescriptor
    • RtlGetSaclSecurityDescriptor
    • RtlGetGroupSecurityDescriptor
    • RtlGetOwnerSecurityDescriptor
    • RtlLengthSecurityDescriptor
    • SeCaptureSecurityDescriptor
    • SeExports
    • IoIsWdmVersionAvailable
    • RtlLengthSid
    • wcschr
    • RtlAbsoluteToSelfRelativeSD
    • RtlFreeUnicodeString
    • ZwTerminateProcess
    • _purecall
    • ClassInitialize

    Exported Functions

    Expand
    • ??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
    • ??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
    • ??0CBlobConfig@@QAE@ABV0@@Z
    • ??0CBlobConfig@@QAE@K@Z
    • ??0CContext@@QAE@ABV0@@Z
    • ??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
    • ??0CContextList@@QAE@ABV0@@Z
    • ??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CDebugLog@@QAE@ABV0@@Z
    • ??0CDebugLog@@QAE@PBG@Z
    • ??0CExclusionExtConfig@@QAE@ABV0@@Z
    • ??0CExclusionExtConfig@@QAE@KKE@Z
    • ??0CExclusionFileNameConfig@@QAE@ABV0@@Z
    • ??0CExclusionFileNameConfig@@QAE@KK@Z
    • ??0CExclusionFilePathConfig@@QAE@ABV0@@Z
    • ??0CExclusionFilePathConfig@@QAE@KK@Z
    • ??0CExclusionFolderConfig@@QAE@ABV0@@Z
    • ??0CExclusionFolderConfig@@QAE@KK@Z
    • ??0CExclusionRegistryConfig@@QAE@ABV0@@Z
    • ??0CExclusionRegistryConfig@@QAE@KK@Z
    • ??0CFile@@QAE@ABV0@@Z
    • ??0CFile@@QAE@E@Z
    • ??0CFileExtension@@QAE@ABV0@@Z
    • ??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
    • ??0CKEvent@@QAE@ABV0@@Z
    • ??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
    • ??0CList@@QAE@ABV0@@Z
    • ??0CList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CLockEvent@@QAE@ABV0@@Z
    • ??0CLockEvent@@QAE@XZ
    • ??0CLockList@@QAE@ABV0@@Z
    • ??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
    • ??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
    • ??0CMemoryAllocator@@QAE@ABV0@@Z
    • ??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
    • ??0CMemoryPoolAllocator@@QAE@ABV0@@Z
    • ??0CModuleConfig@@QAE@ABV0@@Z
    • ??0CModuleConfig@@QAE@XZ
    • ??0CModuleConfigList@@QAE@ABV0@@Z
    • ??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CModuleFileExtConfig@@QAE@ABV0@@Z
    • ??0CModuleFileExtConfig@@QAE@KKE@Z
    • ??0CModuleFlagConfig@@QAE@ABV0@@Z
    • ??0CModuleFlagConfig@@QAE@K@Z
    • ??0CModuleMultiStringConfig@@QAE@ABV0@@Z
    • ??0CModuleMultiStringConfig@@QAE@KK@Z
    • ??0CModuleStringConfig@@QAE@ABV0@@Z
    • ??0CModuleStringConfig@@QAE@K@Z
    • ??0CSmartLock@@QAE@AAVCLockEvent@@@Z
    • ??0CSmartLock@@QAE@XZ
    • ??0CSmartReference@@QAE@AAJ@Z
    • ??0CSmartReference@@QAE@AAK@Z
    • ??0CStrList@@QAE@ABV0@@Z
    • ??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CSystemThread@@QAE@ABV0@@Z
    • ??0CSystemThread@@QAE@K@Z
    • ??0CUserFuncAdapterJob@@QAE@ABV0@@Z
    • ??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z0@Z
    • ??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
    • ??0CWorkerThread@@QAE@ABV0@@Z
    • ??0CWorkerThreadJob@@QAE@ABV0@@Z
    • ??0CWorkerThreadJob@@QAE@E@Z
    • ??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
    • ??0CWorkerThreadJobQueue@@QAE@K@Z
    • ??0CWorkerThreadPool@@QAE@ABV0@@Z
    • ??0CWorkerThreadPool@@QAE@K@Z
    • ??0IMemoryAllocator@@QAE@ABV0@@Z
    • ??0IMemoryAllocator@@QAE@XZ
    • ??1CAutoUpdateConfigThread@@UAE@XZ
    • ??1CBlobConfig@@UAE@XZ
    • ??1CContext@@UAE@XZ
    • ??1CContextList@@UAE@XZ
    • ??1CDebugLog@@UAE@XZ
    • ??1CExclusionExtConfig@@UAE@XZ
    • ??1CExclusionFileNameConfig@@UAE@XZ
    • ??1CExclusionFilePathConfig@@UAE@XZ
    • ??1CExclusionFolderConfig@@UAE@XZ
    • ??1CExclusionRegistryConfig@@UAE@XZ
    • ??1CFile@@UAE@XZ
    • ??1CFileExtension@@UAE@XZ
    • ??1CKEvent@@UAE@XZ
    • ??1CList@@UAE@XZ
    • ??1CLockEvent@@UAE@XZ
    • ??1CLockList@@UAE@XZ
    • ??1CMemoryAllocator@@UAE@XZ
    • ??1CMemoryPoolAllocator@@UAE@XZ
    • ??1CModuleConfig@@UAE@XZ
    • ??1CModuleConfigList@@UAE@XZ
    • ??1CModuleFileExtConfig@@UAE@XZ
    • ??1CModuleFlagConfig@@UAE@XZ
    • ??1CModuleMultiStringConfig@@UAE@XZ
    • ??1CModuleStringConfig@@UAE@XZ
    • ??1CSmartLock@@QAE@XZ
    • ??1CSmartReference@@QAE@XZ
    • ??1CStrList@@UAE@XZ
    • ??1CSystemThread@@UAE@XZ
    • ??1CUserFuncAdapterJob@@UAE@XZ
    • ??1CWorkerThread@@UAE@XZ
    • ??1CWorkerThreadJob@@UAE@XZ
    • ??1CWorkerThreadJobQueue@@UAE@XZ
    • ??1CWorkerThreadPool@@UAE@XZ
    • ??1IMemoryAllocator@@UAE@XZ
    • ??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
    • ??2CMemoryAllocator@@SGPAXI@Z
    • ??2CMemoryPoolAllocator@@SGPAXI@Z
    • ??3@YAXPAX@Z
    • ??3IMemoryAllocator@@SGXPAX@Z
    • ??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
    • ??4CBlobConfig@@QAEAAV0@ABV0@@Z
    • ??4CContext@@QAEAAV0@ABV0@@Z
    • ??4CDebugLog@@QAEAAV0@ABV0@@Z
    • ??4CFile@@QAEAAV0@ABV0@@Z
    • ??4CKEvent@@QAEAAV0@ABV0@@Z
    • ??4CLockEvent@@QAEAAV0@ABV0@@Z
    • ??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
    • ??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
    • ??4CModuleConfig@@QAEAAV0@ABV0@@Z
    • ??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
    • ??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
    • ??4CSmartLock@@QAEAAV0@ABV0@@Z
    • ??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
    • ??4CSystemThread@@QAEAAV0@ABV0@@Z
    • ??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
    • ??4CWorkerThread@@QAEAAV0@ABV0@@Z
    • ??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
    • ??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
    • ??_7CAutoUpdateConfigThread@@6B@
    • ??_7CBlobConfig@@6B@
    • ??_7CContext@@6B@
    • ??_7CContextList@@6B@
    • ??_7CDebugLog@@6B@
    • ??_7CExclusionExtConfig@@6B@
    • ??_7CExclusionFileNameConfig@@6B@
    • ??_7CExclusionFilePathConfig@@6B@
    • ??_7CExclusionFolderConfig@@6B@
    • ??_7CExclusionRegistryConfig@@6B@
    • ??_7CFile@@6B@
    • ??_7CFileExtension@@6B@
    • ??_7CKEvent@@6B@
    • ??_7CList@@6B@
    • ??_7CLockEvent@@6B@
    • ??_7CLockList@@6B@
    • ??_7CMemoryAllocator@@6B@
    • ??_7CMemoryPoolAllocator@@6B@
    • ??_7CModuleConfig@@6B@
    • ??_7CModuleConfigList@@6B@
    • ??_7CModuleFileExtConfig@@6B@
    • ??_7CModuleFlagConfig@@6B@
    • ??_7CModuleMultiStringConfig@@6B@
    • ??_7CModuleStringConfig@@6B@
    • ??_7CStrList@@6B@
    • ??_7CSystemThread@@6B@
    • ??_7CUserFuncAdapterJob@@6B@
    • ??_7CWorkerThread@@6B@
    • ??_7CWorkerThreadJob@@6B@
    • ??_7CWorkerThreadJobQueue@@6B@
    • ??_7CWorkerThreadPool@@6B@
    • ??_7IMemoryAllocator@@6B@
    • ??_FCContextList@@QAEXXZ
    • ??_FCFile@@QAEXXZ
    • ??_FCFileExtension@@QAEXXZ
    • ??_FCModuleConfigList@@QAEXXZ
    • ??_FCStrList@@QAEXXZ
    • ??_FCSystemThread@@QAEXXZ
    • ??_FCWorkerThread@@QAEXXZ
    • ??_FCWorkerThreadJob@@QAEXXZ
    • ??_FCWorkerThreadJobQueue@@QAEXXZ
    • ??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
    • ??_V@YAXPAX@Z
    • ?Acquire@CLockEvent@@QAEXXZ
    • ?Add@CContextList@@QAEEPAVCContext@@@Z
    • ?Add@CFileExtension@@QAEEPBGK@Z
    • ?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
    • ?Add@CStrList@@QAEEPBG@Z
    • ?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
    • ?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
    • ?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
    • ?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
    • ?Cancel@CWorkerThreadJob@@QAEXXZ
    • ?CheckNode@CLockList@@UAEHQAX@Z
    • ?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
    • ?Cleanup@CBlobConfig@@AAEXXZ
    • ?Cleanup@CModuleFileExtConfig@@IAEXXZ
    • ?Cleanup@CModuleMultiStringConfig@@IAEXXZ
    • ?Cleanup@CModuleStringConfig@@AAEXXZ
    • ?Close@CFile@@QAEJXZ
    • ?Count@CLockList@@QAEKXZ
    • ?Create@CFile@@QAEJPBGKKKK@Z
    • ?Create@CSystemThread@@QAEEXZ
    • ?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
    • ?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
    • ?CreatePool@CWorkerThreadPool@@QAEEXZ
    • ?CreateThreads@CWorkerThreadPool@@QAEEK@Z
    • ?CreateWIRP@CFile@@QAEJPBGKKKK@Z
    • ?Delete@CFile@@QAEJXZ
    • ?Delete@CFileExtension@@QAEEPBGK@Z
    • ?Delete@CStrList@@QAEEPBG@Z
    • ?DeleteAll@CList@@UAEXXZ
    • ?DeleteAll@CLockList@@UAEXXZ
    • ?DeleteNode@CContextList@@MAEXPAX@Z
    • ?DeleteNode@CList@@UAEXPAX@Z
    • ?DeleteNode@CModuleConfigList@@MAEXPAX@Z
    • ?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
    • ?DisableWriteProtectFromCR0@@YGXPAPAX@Z
    • ?DoIt@CWorkerThreadJob@@QAEJXZ
    • ?EntryPoint@CSystemThread@@KGXPAX@Z
    • ?Find@CContextList@@QAEPAVCContext@@K@Z
    • ?Find@CContextList@@QAEPAVCContext@@PAX@Z
    • ?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
    • ?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
    • ?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
    • ?FindNode@CContextList@@IAEPAXPAX@Z
    • ?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
    • ?First@CList@@UAEPAXXZ
    • ?First@CLockList@@UAEPAXXZ
    • ?Free@CMemoryAllocator@@UAEXPAX@Z
    • ?Free@CMemoryPoolAllocator@@UAEXPAX@Z
    • ?GetAttributes@CFile@@QAEKXZ
    • ?GetBasicInfomration@CFile@@IAEJXZ
    • ?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
    • ?GetCategory@CContext@@QAEKXZ
    • ?GetData@CBlobConfig@@QAEHPAXPAK@Z
    • ?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
    • ?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
    • ?GetData@CModuleFlagConfig@@QAEKXZ
    • ?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
    • ?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
    • ?GetData@CModuleStringConfig@@QAEPAGXZ
    • ?GetData@CStrList@@QAEEPAGPAK@Z
    • ?GetDataType@CModuleConfig@@QAEKXZ
    • ?GetEngineContext@CContext@@QAEPAXXZ
    • ?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
    • ?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
    • ?GetFlagConfig@CContext@@UAEJKPAK@Z
    • ?GetID@CModuleConfig@@QAEKXZ
    • ?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
    • ?GetLength@CModuleStringConfig@@QAEKXZ
    • ?GetLinkContext@CContext@@QAEPAXXZ
    • ?GetLogFlag@CDebugLog@@QAEKXZ
    • ?GetModuleId@CModuleConfig@@QAEKXZ
    • ?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
    • ?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
    • ?GetReportCallBackRoutine@CContext@@QAEKXZ
    • ?GetSize@CBlobConfig@@QAEKXZ
    • ?GetStringConfig@CContext@@QAEPAGK@Z
    • ?GetStringConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetThreadCount@CWorkerThreadPool@@QAEKXZ
    • ?GetThreadID@CSystemThread@@QAEKXZ
    • ?GetType@CContext@@QAEKXZ
    • ?GetUserParameter@CContext@@QAEKXZ
    • ?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
    • ?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
    • ?InitializeFlagConfig@CContext@@QAEHKK@Z
    • ?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
    • ?InitializeStringConfig@CContext@@QAEHKPBG@Z
    • ?Insert@CList@@UAEXQAXE@Z
    • ?Insert@CLockList@@UAEXQAXE@Z
    • ?InsertAfter@CList@@UAEXPAX0@Z
    • ?InsertBefore@CList@@UAEXPAX0@Z
    • ?Instance@CWorkerThreadPool@@SGPAV1@XZ
    • ?IsEmpty@CList@@UAEEXZ
    • ?IsEmpty@CLockList@@UAEEXZ
    • ?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
    • ?IsFull@CLockList@@QBEEXZ
    • ?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
    • ?IsOpened@CFile@@QAEEXZ
    • ?IsTerminated@CWorkerThreadPool@@QAEEXZ
    • ?IsValid@CMemoryAllocator@@UAEEXZ
    • ?IsValid@CMemoryPoolAllocator@@UAEEXZ
    • ?IsValid@IMemoryAllocator@@UAEEXZ
    • ?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
    • ?JobFunction@CUserFuncAdapterJob@@MAEXXZ
    • ?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
    • ?Limit@CLockList@@QAEKXZ
    • ?MatchAllExtensions@CFileExtension@@QAEEXZ
    • ?MatchNoExtensions@CFileExtension@@QAEEXZ
    • ?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
    • ?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
    • ?NeedDelete@CWorkerThreadJob@@QAEEXZ
    • ?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
    • ?NewNode@CList@@UAEPAXXZ
    • ?NewNode@CStrList@@EAEPAXXZ
    • ?NewNodeVariant@CList@@IAEPAXK@Z
    • ?Next@CList@@UBEPAXQAX@Z
    • ?Next@CLockList@@UBEPAXQAX@Z
    • ?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
    • ?NotityTerminate@CWorkerThread@@QAEXXZ
    • ?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
    • ?Pulse@CKEvent@@QAEJJE@Z
    • ?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
    • ?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
    • ?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
    • ?Read@CFile@@QAEJPADKPAK@Z
    • ?ReferenceCount@CContext@@QAEAAKXZ
    • ?Release@CLockEvent@@QAEXXZ
    • ?Remove@CContextList@@UAEEQAX@Z
    • ?Remove@CList@@UAEEQAX@Z
    • ?Remove@CLockList@@UAEEQAX@Z
    • ?RemoveHead@CList@@UAEPAXXZ
    • ?RemoveHead@CLockList@@UAEPAXXZ
    • ?RemoveTail@CList@@UAEPAXXZ
    • ?RemoveTail@CLockList@@UAEPAXXZ
    • ?Reset@CKEvent@@QAEXXZ
    • ?RestoreCR0@@YGXPAX@Z
    • ?Run@CAutoUpdateConfigThread@@UAEXXZ
    • ?Run@CWorkerThread@@UAEXXZ
    • ?SeekToEnd@CFile@@QAEJXZ
    • ?Set@CKEvent@@QAEJJE@Z
    • ?SetAttributes@CFile@@QAEJK@Z
    • ?SetBlobCofig@CContext@@UAEJKPAXK@Z
    • ?SetData@CBlobConfig@@QAEHPAXK@Z
    • ?SetData@CModuleFileExtConfig@@QAEHPBG@Z
    • ?SetData@CModuleFlagConfig@@QAEHK@Z
    • ?SetData@CModuleMultiStringConfig@@QAEHPBG@Z
    • ?SetData@CModuleStringConfig@@QAEHPBG@Z
    • ?SetEngineContext@CContext@@QAEXPAX@Z
    • ?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
    • ?SetFlagConfig@CContext@@UAEJKK@Z
    • ?SetLinkContext@CContext@@QAEXPAX@Z
    • ?SetLogFlag@CDebugLog@@QAEEK@Z
    • ?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
    • ?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
    • ?SetMultiStringConfig@CContext@@UAEJKPBG@Z
    • ?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
    • ?SetPriority@CSystemThread@@QAEXK@Z
    • ?SetStopUse@CContext@@QAEXXZ
    • ?SetStringConfig@CContext@@UAEJKPBG@Z
    • ?Setup@CSystemThread@@MAEXXZ
    • ?StopUse@CContext@@QAEHXZ
    • ?TearDown@CSystemThread@@MAEXXZ
    • ?Terminate@CSystemThread@@QAEXE@Z
    • ?Terminate@CWorkerThreadPool@@QAEEXZ
    • ?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
    • ?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
    • ?WaitFinish@CWorkerThreadJob@@QAEXXZ
    • ?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
    • ?Write@CDebugLog@@QAAXPBDZZ
    • ?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
    • ?WriteSystemInformation@CDebugLog@@QAEXXZ
    • ?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
    • ?WriteToFile@CDebugLog@@IAEXPADK@Z
    • ?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
    • ?_pPagedAllocator@@3PAVCMemoryAllocator@@A
    • ?m_lpInstance@CWorkerThreadPool@@1PAV1@A
    • ?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
    • _DeInitKmLPC@0
    • _GetModuleInfoByAddress@8
    • _GetModuleInfoByModuleName@8
    • _InitKmLPC@0
    • _KmCallUm@8
    • _MapMem@12
    • _ModGetExportProcAddress@8
    • _ModLoadDLLToBuffer@4
    • _ModLoadModule@8
    • _ModUnLoadModule@4
    • _NormalizeFileName@4
    • _NormalizeFullNtPathToDosName@4
    • _TmCommConfigRoutine@4
    • _UnMapMem@8
    • _UtilGetFileObjectForProcessByEPROC@8
    • _UtilGetProcessName@12
    • _UtilGetSystemTime@4
    • _UtilIoSetFileInfo@24
    • _UtilIopCreateFileIRP@40
    • _UtilKeGetLowFileDevice@16
    • _UtilQueryKeyValue@24
    • _UtilVolumeDeviceToDosName@8
    • _UtilWaitValueChangeToZero@8
    • _UtilWriteVersionToRegistry@8
    • _UtilbuildDynamicDiskMappingTable@0
    • __UtilDosPathNameToNtPathName@12

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • PAGE
    • .edata
    • INIT
    • .rsrc
    • .reloc

    Signature

    Expand
    {
      "Certificates": [
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
          "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
          "TBS": {
            "MD5": "d0785ad36e427c92b19f6826ab1e8020",
            "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
            "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
            "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
          },
          "ValidFrom": "2012-12-21 00:00:00",
          "ValidTo": "2020-12-30 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
          "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
          "TBS": {
            "MD5": "e9d38360b914c8863f6cba3ee58764d3",
            "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
            "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
            "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
          },
          "ValidFrom": "2012-10-18 00:00:00",
          "ValidTo": "2020-12-29 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
          "TBS": {
            "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
            "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
            "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
            "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
          },
          "ValidFrom": "2017-04-27 00:00:00",
          "ValidTo": "2018-07-16 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "611993e400000000001c",
          "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
          "TBS": {
            "MD5": "78a717e082dcc1cda3458d917e677d14",
            "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
            "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
            "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
          },
          "ValidFrom": "2011-02-22 19:25:17",
          "ValidTo": "2021-02-22 19:35:17",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
          "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "TBS": {
            "MD5": "b30c31a572b0409383ed3fbe17e56e81",
            "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
            "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
            "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
          },
          "ValidFrom": "2010-02-08 00:00:00",
          "ValidTo": "2020-02-07 23:59:59",
          "Version": 3
        }
      ],
      "CertificatesInfo": "",
      "Signer": [
        {
          "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Version": 1
        }
      ],
      "SignerInfo": ""
    }
    

    PropertyValue
    FilenameTmComm.sys
    Creation Timestamp2016-08-01 21:01:01
    MD542132c7a755064f94314b01afb80e73c
    SHA13e790c4e893513566916c76a677b0f98bd7334dd
    SHA25662f5e13b2edc00128716cb93e6a9eddffea67ce83d2bb426f18f5be08ead89e0
    Authentihash MD537dd516b2406b4e5d95e260886230437
    Authentihash SHA195e72a3ba11c83d127302e8327b2fe9580a61e3f
    Authentihash SHA256a553ba125adf00a769718d5cd26ed1a59b5e397956ebc6163973b10fe8c58214
    RichPEHeaderHash MD515c4587da185e00df2f0c96851dcc38c
    RichPEHeaderHash SHA1d11202ca48859e8c148a964c6e4871cf1affc82d
    RichPEHeaderHash SHA256625832d0b9c8d6aef127c177634d2f29f994e6ed52ae7b78e592bc13316aa347
    CompanyTrend Micro Inc.
    DescriptionTrendMicro Common Module
    ProductTrend Micro Eyes
    OriginalFilenameTmComm.sys

    Download

    Certificates

    Expand
    Certificate 1688f039255e638e69143907e6330b
    FieldValue
    ToBeSigned (TBS) MD50179e8ddeebaf8998fec419d65cdf13d
    ToBeSigned (TBS) SHA134c724c3369f2da8c25b591808962f66f10bde28
    ToBeSigned (TBS) SHA25635b0bac11602847aaab65fb35199d3c8976cde3ccf7e061b130177c712cbd92f
    SubjectC=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO SHA,1 Time Stamping Signer
    ValidFrom2015-12-31 00:00:00
    ValidTo2019-07-09 18:40:36
    Signatureba332440408c7cdb589fb36098b2f5c031feeb1f6e50f60ae0e4e681ad2687a2dffdb3daf473f300fb291b891b153edb6b52932bc4ac3981d73c67579a3936e028089ae3394f9b89097f7bc5617f598932250a6aae1a3ef0a227a8b6c3b887f7160448413d5cd8ec9f4d203104d965a1edcd690753163ddd36020a88eb40e506300bb8164bdcefbc5509ffc63e122e76b3dcce42eff97657e1b70a054098589a5d711693718c6581ea6ff389f7fb73adb4e7bfd98e6faa0b4f25f3b8e1d5dd75986881f8aac0d180c2c4c43989c1f6c99e6cd774f9d997f84fc29a0acd5e8ff819e9e0a59fc4f09221e62d7925c922f9c3f03a8457ad3a16f46394101d5dd0c6
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber1688f039255e638e69143907e6330b
    Version3
    Certificate 774d49c5649436de6bf3190a67eedcdf
    FieldValue
    ToBeSigned (TBS) MD5b3ca7d6b821d8e3432b29874980af55e
    ToBeSigned (TBS) SHA1618d7e55a24c1d8b65a0bcce79120c5e3b13fa4d
    ToBeSigned (TBS) SHA256c645c6a7dc7243a4a3f78a6569c029401a7bda8bc4732ce7198d9f21f19b12fa
    SubjectC=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.
    ValidFrom2016-03-29 00:00:00
    ValidTo2017-06-28 23:59:59
    Signature27351697f046d1d43fe306dff30b83e7a404e3e6431c1e06829c558d99eb3f21776021e3e1bd4e485aba08b89bb0972f23daa471d7b432a44a591270f9a838f13dbda32ee936c0df792cff8c493e1f27b2282b3d896ae7b4155ca1a50bf7111f3f4bbbe11f17cfe5d49c0589c210966ef7e567153e802d2e783ff498c59585598d9d3e93273d1e81c07ce85c0cfb24834d448c3930120f1686bd472d916ac8f9475acfdb27be8528311f668d71dfc132a0ff62df7baa575a0cc732b3de003beca214954d4d97cf9511b9329eccbb7b716675b31e543a43570080dffce3fc8ca8fbb17d954b9678e2d0c1e1710a5cf03952a687fede59dcba3bf98900f9934f12
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber774d49c5649436de6bf3190a67eedcdf
    Version3
    Certificate 611993e400000000001c
    FieldValue
    ToBeSigned (TBS) MD578a717e082dcc1cda3458d917e677d14
    ToBeSigned (TBS) SHA14a872e0e51f9b304469cd1dedb496ee9b8b983a4
    ToBeSigned (TBS) SHA256317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
    ValidFrom2011-02-22 19:25:17
    ValidTo2021-02-22 19:35:17
    Signature812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber611993e400000000001c
    Version3
    Certificate 5200e5aa2556fc1a86ed96c9d44b33c7
    FieldValue
    ToBeSigned (TBS) MD5b30c31a572b0409383ed3fbe17e56e81
    ToBeSigned (TBS) SHA14843a82ed3b1f2bfbee9671960e1940c942f688d
    ToBeSigned (TBS) SHA25603cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
    ValidFrom2010-02-08 00:00:00
    ValidTo2020-02-07 23:59:59
    Signature5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber5200e5aa2556fc1a86ed96c9d44b33c7
    Version3

    Imports

    Expand
    • ntoskrnl.exe
    • CLASSPNP.SYS
    • HAL.dll

    Imported Functions

    Expand
    • ExAcquireFastMutexUnsafe
    • ExReleaseFastMutexUnsafe
    • ProbeForRead
    • ProbeForWrite
    • ExAcquireResourceSharedLite
    • ExAcquireResourceExclusiveLite
    • ExReleaseResourceLite
    • MmProbeAndLockPages
    • MmUnlockPages
    • MmMapLockedPagesSpecifyCache
    • IoAllocateMdl
    • IoFreeMdl
    • IoGetCurrentProcess
    • ObfReferenceObject
    • ObfDereferenceObject
    • ZwClose
    • ZwCreateSection
    • ZwOpenSection
    • ZwMapViewOfSection
    • ZwUnmapViewOfSection
    • ZwOpenEvent
    • KePulseEvent
    • KeStackAttachProcess
    • KeUnstackDetachProcess
    • ObOpenObjectByPointer
    • ZwAllocateVirtualMemory
    • ZwFreeVirtualMemory
    • ZwSetEvent
    • _allmul
    • memcpy
    • memset
    • PsProcessType
    • wcsncpy
    • wcsrchr
    • RtlUnicodeStringToInteger
    • ZwWaitForSingleObject
    • ZwRequestWaitReplyPort
    • ZwConnectPort
    • swprintf
    • RtlCopyUnicodeString
    • DbgPrint
    • KeDelayExecutionThread
    • KeQuerySystemTime
    • ExAllocatePoolWithTag
    • PsGetVersion
    • IofCompleteRequest
    • IoCreateSymbolicLink
    • IoDeleteDevice
    • IoDeleteSymbolicLink
    • ObReferenceObjectByHandle
    • PsGetCurrentProcessId
    • ZwCreateEvent
    • ExEventObjectType
    • SeCaptureSubjectContext
    • SeReleaseSubjectContext
    • SeAccessCheck
    • ObGetObjectSecurity
    • ObReleaseObjectSecurity
    • PsGetProcessExitTime
    • PsThreadType
    • MmSectionObjectType
    • RtlCreateSecurityDescriptor
    • RtlSetDaclSecurityDescriptor
    • KeInitializeSemaphore
    • KeReleaseSemaphore
    • RtlCreateAcl
    • RtlAddAccessAllowedAce
    • RtlLengthRequiredSid
    • RtlInitializeSid
    • RtlSubAuthoritySid
    • ExGetPreviousMode
    • _wcsnicmp
    • PsSetCreateProcessNotifyRoutine
    • ZwQueryInformationProcess
    • PsLookupProcessByProcessId
    • ZwOpenDirectoryObject
    • MmIsAddressValid
    • ExInitializeResourceLite
    • ExDeleteResourceLite
    • ZwCreateFile
    • ZwQueryInformationFile
    • ZwSetInformationFile
    • ZwReadFile
    • ZwWriteFile
    • towupper
    • MmGetSystemRoutineAddress
    • ObReferenceObjectByPointer
    • ObQueryNameString
    • MmHighestUserAddress
    • _snprintf
    • _vsnprintf
    • RtlInitAnsiString
    • RtlAnsiStringToUnicodeString
    • RtlFreeUnicodeString
    • RtlTimeToTimeFields
    • KeWaitForMultipleObjects
    • ExSystemTimeToLocalTime
    • ZwCreateKey
    • PsGetCurrentThreadId
    • ZwDeviceIoControlFile
    • ZwNotifyChangeKey
    • ZwOpenFile
    • ExFreePoolWithTag
    • mbstowcs
    • _stricmp
    • IoGetDeviceObjectPointer
    • RtlImageNtHeader
    • ZwQuerySystemInformation
    • _strnicmp
    • RtlCompareUnicodeString
    • RtlCompareMemory
    • MmBuildMdlForNonPagedPool
    • IoAllocateIrp
    • IofCallDriver
    • IoFreeIrp
    • RtlUpperChar
    • ObReferenceObjectByName
    • IoFileObjectType
    • IoDriverObjectType
    • IoBuildDeviceIoControlRequest
    • IoCreateFile
    • RtlEqualUnicodeString
    • RtlAppendUnicodeStringToString
    • RtlUpcaseUnicodeChar
    • _snwprintf
    • strncpy
    • NtOpenProcess
    • NtQueryInformationProcess
    • PsIsThreadTerminating
    • ObOpenObjectByName
    • KeServiceDescriptorTable
    • KeAddSystemServiceTable
    • KeSetPriorityThread
    • PsCreateSystemThread
    • PsTerminateSystemThread
    • KeNumberProcessors
    • RtlLengthSecurityDescriptor
    • ZwOpenKey
    • ZwDeleteKey
    • ZwDeleteValueKey
    • ZwEnumerateKey
    • ZwEnumerateValueKey
    • ZwQueryKey
    • ZwQueryValueKey
    • ZwSetValueKey
    • ZwTerminateProcess
    • ZwOpenProcess
    • ZwQuerySecurityObject
    • ZwSetSecurityObject
    • ZwQueryDirectoryObject
    • ZwQueryDirectoryFile
    • _allrem
    • RtlAppendUnicodeToString
    • ZwFsControlFile
    • ObInsertObject
    • strrchr
    • wcschr
    • wcsncmp
    • RtlQueryRegistryValues
    • IoBuildAsynchronousFsdRequest
    • ZwOpenSymbolicLinkObject
    • ZwQuerySymbolicLinkObject
    • RtlUpcaseUnicodeString
    • NtClose
    • ZwSetInformationObject
    • SeQueryAuthenticationIdToken
    • MmSystemRangeStart
    • IoGetFileObjectGenericMapping
    • ObCreateObject
    • SeCreateAccessState
    • IoAcquireVpbSpinLock
    • IoReleaseVpbSpinLock
    • wcstombs
    • strncat
    • wcsncat
    • RtlUnicodeStringToAnsiString
    • RtlFreeAnsiString
    • wcsstr
    • ExAllocatePool
    • ExInterlockedPopEntrySList
    • IoBuildSynchronousFsdRequest
    • IoGetStackLimits
    • IoGetDeviceInterfaces
    • IoRegisterPlugPlayNotification
    • IoUnregisterPlugPlayNotification
    • IoGetConfigurationInformation
    • FsRtlIsNameInExpression
    • RtlUnwind
    • IoDeviceObjectType
    • IoCreateDevice
    • RtlGetOwnerSecurityDescriptor
    • RtlGetDaclSecurityDescriptor
    • RtlGetGroupSecurityDescriptor
    • RtlGetSaclSecurityDescriptor
    • SeCaptureSecurityDescriptor
    • RtlLengthSid
    • SeExports
    • IoIsWdmVersionAvailable
    • RtlAbsoluteToSelfRelativeSD
    • KeWaitForSingleObject
    • KeLeaveCriticalRegion
    • KeBugCheckEx
    • KeEnterCriticalRegion
    • KeSetEvent
    • KeClearEvent
    • KeInitializeEvent
    • RtlInitUnicodeString
    • KeGetCurrentThread
    • memmove
    • ZwQueryVolumeInformationFile
    • _purecall
    • ClassInitialize
    • KeRaiseIrqlToDpcLevel
    • KfAcquireSpinLock
    • KeGetCurrentIrql
    • ExReleaseFastMutex
    • ExAcquireFastMutex
    • KfLowerIrql
    • KfRaiseIrql
    • KfReleaseSpinLock

    Exported Functions

    Expand
    • ??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
    • ??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
    • ??0CBlobConfig@@QAE@ABV0@@Z
    • ??0CBlobConfig@@QAE@K@Z
    • ??0CContext@@QAE@ABV0@@Z
    • ??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
    • ??0CContextList@@QAE@ABV0@@Z
    • ??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CDebugLog@@QAE@ABV0@@Z
    • ??0CDebugLog@@QAE@PBG@Z
    • ??0CDebugLogEx@@QAE@ABV0@@Z
    • ??0CDebugLogEx@@QAE@K@Z
    • ??0CDelayLoadThread@@QAE@ABV0@@Z
    • ??0CDelayLoadThread@@QAE@XZ
    • ??0CExclusionExtConfig@@QAE@ABV0@@Z
    • ??0CExclusionExtConfig@@QAE@KKE@Z
    • ??0CExclusionFileNameConfig@@QAE@ABV0@@Z
    • ??0CExclusionFileNameConfig@@QAE@KK@Z
    • ??0CExclusionFilePathConfig@@QAE@ABV0@@Z
    • ??0CExclusionFilePathConfig@@QAE@KK@Z
    • ??0CExclusionFolderConfig@@QAE@ABV0@@Z
    • ??0CExclusionFolderConfig@@QAE@KK@Z
    • ??0CExclusionRegistryConfig@@QAE@ABV0@@Z
    • ??0CExclusionRegistryConfig@@QAE@KK@Z
    • ??0CFile@@QAE@ABV0@@Z
    • ??0CFile@@QAE@E@Z
    • ??0CFileExtension@@QAE@ABV0@@Z
    • ??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
    • ??0CInclusionExtConfig@@QAE@ABV0@@Z
    • ??0CInclusionExtConfig@@QAE@KKE@Z
    • ??0CInclusionFileNameConfig@@QAE@ABV0@@Z
    • ??0CInclusionFileNameConfig@@QAE@KK@Z
    • ??0CInclusionFilePathConfig@@QAE@ABV0@@Z
    • ??0CInclusionFilePathConfig@@QAE@KK@Z
    • ??0CInclusionFolderConfig@@QAE@ABV0@@Z
    • ??0CInclusionFolderConfig@@QAE@KK@Z
    • ??0CKEvent@@QAE@ABV0@@Z
    • ??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
    • ??0CList@@QAE@ABV0@@Z
    • ??0CList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CLockEvent@@QAE@ABV0@@Z
    • ??0CLockEvent@@QAE@XZ
    • ??0CLockList@@QAE@ABV0@@Z
    • ??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
    • ??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
    • ??0CMemoryAllocator@@QAE@ABV0@@Z
    • ??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
    • ??0CMemoryPoolAllocator@@QAE@ABV0@@Z
    • ??0CModuleConfig@@QAE@ABV0@@Z
    • ??0CModuleConfig@@QAE@XZ
    • ??0CModuleConfigList@@QAE@ABV0@@Z
    • ??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CModuleFileExtConfig@@QAE@ABV0@@Z
    • ??0CModuleFileExtConfig@@QAE@KKE@Z
    • ??0CModuleFlagConfig@@QAE@ABV0@@Z
    • ??0CModuleFlagConfig@@QAE@K@Z
    • ??0CModuleMultiStringConfig@@QAE@ABV0@@Z
    • ??0CModuleMultiStringConfig@@QAE@KK@Z
    • ??0CModuleStringConfig@@QAE@ABV0@@Z
    • ??0CModuleStringConfig@@QAE@K@Z
    • ??0CNoLockList@@QAE@ABV0@@Z
    • ??0CNoLockList@@QAE@KKPAVIMemoryAllocator@@@Z
    • ??0CSmartLock@@QAE@AAVCLockEvent@@@Z
    • ??0CSmartLock@@QAE@XZ
    • ??0CSmartReference@@QAE@AAJ@Z
    • ??0CSmartReference@@QAE@AAK@Z
    • ??0CSmartResource@@QAE@AAVCResource@@E@Z
    • ??0CStrList@@QAE@ABV0@@Z
    • ??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CSystemThread@@QAE@ABV0@@Z
    • ??0CSystemThread@@QAE@K@Z
    • ??0CUserFuncAdapterJob@@QAE@ABV0@@Z
    • ??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z01@Z
    • ??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
    • ??0CWorkerThread@@QAE@ABV0@@Z
    • ??0CWorkerThreadJob@@QAE@ABV0@@Z
    • ??0CWorkerThreadJob@@QAE@E@Z
    • ??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
    • ??0CWorkerThreadJobQueue@@QAE@K@Z
    • ??0CWorkerThreadPool@@QAE@ABV0@@Z
    • ??0CWorkerThreadPool@@QAE@K@Z
    • ??0CWorkerThreadPoolEx@@QAE@ABV0@@Z
    • ??0CWorkerThreadPoolEx@@QAE@KK@Z
    • ??0IMemoryAllocator@@QAE@ABV0@@Z
    • ??0IMemoryAllocator@@QAE@XZ
    • ??1CAutoUpdateConfigThread@@UAE@XZ
    • ??1CBlobConfig@@UAE@XZ
    • ??1CContext@@UAE@XZ
    • ??1CContextList@@UAE@XZ
    • ??1CDebugLog@@UAE@XZ
    • ??1CDebugLogEx@@UAE@XZ
    • ??1CDelayLoadThread@@UAE@XZ
    • ??1CExclusionExtConfig@@UAE@XZ
    • ??1CExclusionFileNameConfig@@UAE@XZ
    • ??1CExclusionFilePathConfig@@UAE@XZ
    • ??1CExclusionFolderConfig@@UAE@XZ
    • ??1CExclusionRegistryConfig@@UAE@XZ
    • ??1CFile@@UAE@XZ
    • ??1CFileExtension@@UAE@XZ
    • ??1CInclusionExtConfig@@UAE@XZ
    • ??1CInclusionFileNameConfig@@UAE@XZ
    • ??1CInclusionFilePathConfig@@UAE@XZ
    • ??1CInclusionFolderConfig@@UAE@XZ
    • ??1CKEvent@@UAE@XZ
    • ??1CList@@UAE@XZ
    • ??1CLockEvent@@UAE@XZ
    • ??1CLockList@@UAE@XZ
    • ??1CMemoryAllocator@@UAE@XZ
    • ??1CMemoryPoolAllocator@@UAE@XZ
    • ??1CModuleConfig@@UAE@XZ
    • ??1CModuleConfigList@@UAE@XZ
    • ??1CModuleFileExtConfig@@UAE@XZ
    • ??1CModuleFlagConfig@@UAE@XZ
    • ??1CModuleMultiStringConfig@@UAE@XZ
    • ??1CModuleStringConfig@@UAE@XZ
    • ??1CNoLockList@@UAE@XZ
    • ??1CSmartLock@@QAE@XZ
    • ??1CSmartReference@@QAE@XZ
    • ??1CSmartResource@@QAE@XZ
    • ??1CStrList@@UAE@XZ
    • ??1CSystemThread@@UAE@XZ
    • ??1CUserFuncAdapterJob@@UAE@XZ
    • ??1CWorkerThread@@UAE@XZ
    • ??1CWorkerThreadJob@@UAE@XZ
    • ??1CWorkerThreadJobQueue@@UAE@XZ
    • ??1CWorkerThreadPool@@UAE@XZ
    • ??1CWorkerThreadPoolEx@@UAE@XZ
    • ??1IMemoryAllocator@@UAE@XZ
    • ??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
    • ??2CMemoryAllocator@@SGPAXI@Z
    • ??2CMemoryPoolAllocator@@SGPAXI@Z
    • ??3@YAXPAX@Z
    • ??3@YAXPAXI@Z
    • ??3IMemoryAllocator@@SGXPAX@Z
    • ??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
    • ??4CBlobConfig@@QAEAAV0@ABV0@@Z
    • ??4CContext@@QAEAAV0@ABV0@@Z
    • ??4CDebugLog@@QAEAAV0@ABV0@@Z
    • ??4CDebugLogEx@@QAEAAV0@ABV0@@Z
    • ??4CDelayLoadThread@@QAEAAV0@ABV0@@Z
    • ??4CFile@@QAEAAV0@ABV0@@Z
    • ??4CKEvent@@QAEAAV0@ABV0@@Z
    • ??4CLockEvent@@QAEAAV0@ABV0@@Z
    • ??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
    • ??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
    • ??4CModuleConfig@@QAEAAV0@ABV0@@Z
    • ??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
    • ??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
    • ??4CSmartLock@@QAEAAV0@ABV0@@Z
    • ??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
    • ??4CSmartResource@@QAEAAV0@ABV0@@Z
    • ??4CSystemThread@@QAEAAV0@ABV0@@Z
    • ??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
    • ??4CWorkerThread@@QAEAAV0@ABV0@@Z
    • ??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
    • ??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
    • ??_7CAutoUpdateConfigThread@@6B@
    • ??_7CBlobConfig@@6B@
    • ??_7CContext@@6B@
    • ??_7CContextList@@6B@
    • ??_7CDebugLog@@6B@
    • ??_7CDebugLogEx@@6B@
    • ??_7CDelayLoadThread@@6B@
    • ??_7CExclusionExtConfig@@6B@
    • ??_7CExclusionFileNameConfig@@6B@
    • ??_7CExclusionFilePathConfig@@6B@
    • ??_7CExclusionFolderConfig@@6B@
    • ??_7CExclusionRegistryConfig@@6B@
    • ??_7CFile@@6B@
    • ??_7CFileExtension@@6B@
    • ??_7CInclusionExtConfig@@6B@
    • ??_7CInclusionFileNameConfig@@6B@
    • ??_7CInclusionFilePathConfig@@6B@
    • ??_7CInclusionFolderConfig@@6B@
    • ??_7CKEvent@@6B@
    • ??_7CList@@6B@
    • ??_7CLockEvent@@6B@
    • ??_7CLockList@@6B@
    • ??_7CMemoryAllocator@@6B@
    • ??_7CMemoryPoolAllocator@@6B@
    • ??_7CModuleConfig@@6B@
    • ??_7CModuleConfigList@@6B@
    • ??_7CModuleFileExtConfig@@6B@
    • ??_7CModuleFlagConfig@@6B@
    • ??_7CModuleMultiStringConfig@@6B@
    • ??_7CModuleStringConfig@@6B@
    • ??_7CNoLockList@@6B@
    • ??_7CStrList@@6B@
    • ??_7CSystemThread@@6B@
    • ??_7CUserFuncAdapterJob@@6B@
    • ??_7CWorkerThread@@6B@
    • ??_7CWorkerThreadJob@@6B@
    • ??_7CWorkerThreadJobQueue@@6B@
    • ??_7CWorkerThreadPool@@6B@
    • ??_7CWorkerThreadPoolEx@@6B@
    • ??_7IMemoryAllocator@@6B@
    • ??_FCContextList@@QAEXXZ
    • ??_FCFile@@QAEXXZ
    • ??_FCFileExtension@@QAEXXZ
    • ??_FCModuleConfigList@@QAEXXZ
    • ??_FCStrList@@QAEXXZ
    • ??_FCSystemThread@@QAEXXZ
    • ??_FCWorkerThread@@QAEXXZ
    • ??_FCWorkerThreadJob@@QAEXXZ
    • ??_FCWorkerThreadJobQueue@@QAEXXZ
    • ??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
    • ??_V@YAXPAX@Z
    • ?Acquire@CLockEvent@@QAEXXZ
    • ?Add@CContextList@@QAEEPAVCContext@@@Z
    • ?Add@CFileExtension@@QAEEPBGK@Z
    • ?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
    • ?Add@CStrList@@QAEEPBG@Z
    • ?AddNode@CLockList@@UAEEQAXE@Z
    • ?AddNode@CNoLockList@@UAEEQAXE@Z
    • ?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
    • ?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
    • ?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
    • ?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
    • ?Cancel@CWorkerThreadJob@@QAEXXZ
    • ?CheckNode@CLockList@@UAEHQAX@Z
    • ?CheckNode@CNoLockList@@UAEHQAX@Z
    • ?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
    • ?Cleanup@CBlobConfig@@AAEXXZ
    • ?Cleanup@CModuleFileExtConfig@@IAEXXZ
    • ?Cleanup@CModuleMultiStringConfig@@IAEXXZ
    • ?Cleanup@CModuleStringConfig@@AAEXXZ
    • ?Close@CFile@@QAEJXZ
    • ?Count@CLockList@@QAEKXZ
    • ?Count@CNoLockList@@QAEKXZ
    • ?Create@CFile@@QAEJPBGKKKK@Z
    • ?Create@CSystemThread@@QAEEXZ
    • ?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
    • ?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
    • ?CreatePool@CWorkerThreadPool@@QAEEXZ
    • ?CreatePool@CWorkerThreadPoolEx@@QAEEXZ
    • ?CreateThreads@CWorkerThreadPool@@QAEEK@Z
    • ?CreateThreads@CWorkerThreadPoolEx@@QAEEK@Z
    • ?CreateWIRP@CFile@@QAEJPBGKKKK@Z
    • ?Delete@CFile@@QAEJXZ
    • ?Delete@CFileExtension@@QAEEPBGK@Z
    • ?Delete@CStrList@@QAEEPBG@Z
    • ?DeleteAll@CList@@UAEXXZ
    • ?DeleteAll@CLockList@@UAEXXZ
    • ?DeleteAll@CNoLockList@@UAEXXZ
    • ?DeleteNode@CContextList@@MAEXPAX@Z
    • ?DeleteNode@CList@@UAEXPAX@Z
    • ?DeleteNode@CModuleConfigList@@MAEXPAX@Z
    • ?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
    • ?DisableWriteProtectFromCR0@@YGXPAPAX@Z
    • ?DoIt@CWorkerThreadJob@@QAEJXZ
    • ?EntryPoint@CSystemThread@@KGXPAX@Z
    • ?Find@CContextList@@QAEPAVCContext@@K@Z
    • ?Find@CContextList@@QAEPAVCContext@@PAX@Z
    • ?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
    • ?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
    • ?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
    • ?FindNode@CContextList@@IAEPAXPAX@Z
    • ?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
    • ?FinishFunction@CUserFuncAdapterJob@@MAEXXZ
    • ?FinishIt@CWorkerThreadJob@@QAEJXZ
    • ?First@CList@@UAEPAXXZ
    • ?First@CLockList@@UAEPAXXZ
    • ?First@CNoLockList@@UAEPAXXZ
    • ?Free@CMemoryAllocator@@UAEXPAX@Z
    • ?Free@CMemoryPoolAllocator@@UAEXPAX@Z
    • ?GetAttributes@CFile@@QAEKXZ
    • ?GetBasicInfomration@CFile@@IAEJXZ
    • ?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
    • ?GetCategory@CContext@@QAEKXZ
    • ?GetData@CBlobConfig@@QAEHPAXPAK@Z
    • ?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
    • ?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
    • ?GetData@CModuleFlagConfig@@QAEKXZ
    • ?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
    • ?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
    • ?GetData@CModuleStringConfig@@QAEPAGXZ
    • ?GetData@CStrList@@QAEEPAGPAK@Z
    • ?GetDataType@CModuleConfig@@QAEKXZ
    • ?GetEngineContext@CContext@@QAEPAXXZ
    • ?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
    • ?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
    • ?GetFileSizeWIRP@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
    • ?GetFlagConfig@CContext@@UAEJKPAK@Z
    • ?GetID@CModuleConfig@@QAEKXZ
    • ?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
    • ?GetLength@CModuleStringConfig@@QAEKXZ
    • ?GetLinkContext@CContext@@QAEPAXXZ
    • ?GetLogFlag@CDebugLog@@QAEKXZ
    • ?GetLogFlag@CDebugLogEx@@QAEKXZ
    • ?GetModuleId@CModuleConfig@@QAEKXZ
    • ?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
    • ?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_KTHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_ETHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_KTHREAD@@XZ
    • ?GetReportCallBackRoutine@CContext@@QAEKXZ
    • ?GetSize@CBlobConfig@@QAEKXZ
    • ?GetStringConfig@CContext@@QAEPAGK@Z
    • ?GetStringConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetThreadCount@CWorkerThreadPool@@QAEKXZ
    • ?GetThreadCount@CWorkerThreadPoolEx@@QAEKXZ
    • ?GetThreadID@CSystemThread@@QAEKXZ
    • ?GetType@CContext@@QAEKXZ
    • ?GetUserParameter@CContext@@QAEKXZ
    • ?InitProcMon@CDebugLogEx@@IAEXXZ
    • ?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
    • ?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
    • ?InitializeFlagConfig@CContext@@QAEHKK@Z
    • ?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
    • ?InitializeStringConfig@CContext@@QAEHKPBG@Z
    • ?Insert@CList@@UAEXQAXE@Z
    • ?Insert@CLockList@@UAEXQAXE@Z
    • ?Insert@CNoLockList@@UAEXQAXE@Z
    • ?InsertAfter@CList@@UAEXPAX0@Z
    • ?InsertBefore@CList@@UAEXPAX0@Z
    • ?Instance@CWorkerThreadPool@@SGPAV1@XZ
    • ?IsEmpty@CList@@UAEEXZ
    • ?IsEmpty@CLockList@@UAEEXZ
    • ?IsEmpty@CNoLockList@@UAEEXZ
    • ?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
    • ?IsFull@CLockList@@QBEEXZ
    • ?IsFull@CNoLockList@@QBEEXZ
    • ?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionExtConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFileNameConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFilePathConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFolderConfig@@QAEEPBG@Z
    • ?IsOpened@CFile@@QAEEXZ
    • ?IsTerminated@CWorkerThreadPool@@QAEEXZ
    • ?IsTerminated@CWorkerThreadPoolEx@@QAEEXZ
    • ?IsValid@CMemoryAllocator@@UAEEXZ
    • ?IsValid@CMemoryPoolAllocator@@UAEEXZ
    • ?IsValid@IMemoryAllocator@@UAEEXZ
    • ?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
    • ?IsWorkerThread@CWorkerThreadPoolEx@@QAEEK@Z
    • ?JobFunction@CUserFuncAdapterJob@@MAEXXZ
    • ?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
    • ?JobQueue@CWorkerThreadPoolEx@@QAEAAVCWorkerThreadJobQueue@@XZ
    • ?Limit@CLockList@@QAEKXZ
    • ?Limit@CNoLockList@@QAEKXZ
    • ?MatchAllExtensions@CFileExtension@@QAEEXZ
    • ?MatchNoExtensions@CFileExtension@@QAEEXZ
    • ?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
    • ?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
    • ?NeedDelete@CWorkerThreadJob@@QAEEXZ
    • ?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
    • ?NewNode@CList@@UAEPAXXZ
    • ?NewNode@CStrList@@EAEPAXXZ
    • ?NewNodeVariant@CList@@IAEPAXK@Z
    • ?Next@CList@@UBEPAXQAX@Z
    • ?Next@CLockList@@UBEPAXQAX@Z
    • ?Next@CNoLockList@@UBEPAXQAX@Z
    • ?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
    • ?NotityTerminate@CWorkerThread@@QAEXXZ
    • ?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
    • ?PostJobToWorkerThread@CWorkerThreadPoolEx@@QAEJP6GXPAX@Z0E1@Z
    • ?Pulse@CKEvent@@QAEJJE@Z
    • ?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
    • ?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
    • ?QueueJobItem@CWorkerThreadPoolEx@@QAEJPAVCWorkerThreadJob@@@Z
    • ?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
    • ?Read@CFile@@QAEJPADKPAK@Z
    • ?ReadWIRP@CFile@@QAEJPADKPAK@Z
    • ?ReferenceCount@CContext@@QAEAAKXZ
    • ?Release@CLockEvent@@QAEXXZ
    • ?Remove@CContextList@@UAEEQAX@Z
    • ?Remove@CList@@UAEEQAX@Z
    • ?Remove@CLockList@@UAEEQAX@Z
    • ?Remove@CNoLockList@@UAEEQAX@Z
    • ?RemoveHead@CList@@UAEPAXXZ
    • ?RemoveHead@CLockList@@UAEPAXXZ
    • ?RemoveHead@CNoLockList@@UAEPAXXZ
    • ?RemoveTail@CList@@UAEPAXXZ
    • ?RemoveTail@CLockList@@UAEPAXXZ
    • ?RemoveTail@CNoLockList@@UAEPAXXZ
    • ?Reset@CKEvent@@QAEXXZ
    • ?ResetData@CInclusionExtConfig@@QAEXXZ
    • ?ResetData@CInclusionFileNameConfig@@QAEXXZ
    • ?ResetData@CInclusionFilePathConfig@@QAEXXZ
    • ?ResetData@CInclusionFolderConfig@@QAEXXZ
    • ?RestoreCR0@@YGXPAX@Z
    • ?Run@CAutoUpdateConfigThread@@UAEXXZ
    • ?Run@CDelayLoadThread@@UAEXXZ
    • ?Run@CWorkerThread@@UAEXXZ
    • ?SeekToEnd@CFile@@QAEJXZ
    • ?Set@CKEvent@@QAEJJE@Z
    • ?SetAttributes@CFile@@QAEJK@Z
    • ?SetBlobCofig@CContext@@UAEJKPAXK@Z
    • ?SetData@CBlobConfig@@QAEHPAXK@Z
    • ?SetData@CModuleFileExtConfig@@QAEHPBG@Z
    • ?SetData@CModuleFlagConfig@@QAEHK@Z
    • ?SetData@CModuleMultiStringConfig@@QAEHPBGK@Z
    • ?SetData@CModuleStringConfig@@QAEHPBG@Z
    • ?SetEngineContext@CContext@@QAEXPAX@Z
    • ?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
    • ?SetFlagConfig@CContext@@UAEJKK@Z
    • ?SetLinkContext@CContext@@QAEXPAX@Z
    • ?SetLogFlag@CDebugLog@@QAEEK@Z
    • ?SetLogFlag@CDebugLogEx@@QAEEK@Z
    • ?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
    • ?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
    • ?SetMultiStringConfig@CContext@@UAEJKPBG@Z
    • ?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
    • ?SetPriority@CSystemThread@@QAEXK@Z
    • ?SetStopUse@CContext@@QAEXXZ
    • ?SetStringConfig@CContext@@UAEJKPBG@Z
    • ?Setup@CSystemThread@@MAEXXZ
    • ?StopUse@CContext@@QAEHXZ
    • ?TearDown@CSystemThread@@MAEXXZ
    • ?Terminate@CSystemThread@@QAEXE@Z
    • ?Terminate@CWorkerThreadPool@@QAEEXZ
    • ?Terminate@CWorkerThreadPoolEx@@QAEEXZ
    • ?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
    • ?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
    • ?WaitFinish@CWorkerThreadJob@@QAEXXZ
    • ?WaitForInit@CDelayLoadThread@@QAEEXZ
    • ?WaitForLoad@CDelayLoadThread@@QAEEXZ
    • ?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
    • ?WaitQueueEmpty@CWorkerThreadJobQueue@@QAEXXZ
    • ?Write@CDebugLog@@QAAXPBDZZ
    • ?Write@CDebugLogEx@@QAAXPBDZZ
    • ?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
    • ?WriteDataToFile@CDebugLogEx@@IAEXPADK@Z
    • ?WriteDataToProcMonW@CDebugLogEx@@IAEXPAD@Z
    • ?WriteSystemInformation@CDebugLog@@QAEXXZ
    • ?WriteSystemInformation@CDebugLogEx@@QAEXXZ
    • ?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
    • ?WriteSystemStringInformation@CDebugLogEx@@IAEXPBG@Z
    • ?WriteToFile@CDebugLog@@IAEXPADK@Z
    • ?WriteToProcMonW@CDebugLogEx@@IAEXPAU_UNICODE_STRING@@@Z
    • ?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
    • ?_pPagedAllocator@@3PAVCMemoryAllocator@@A
    • ?m_lpInstance@CWorkerThreadPool@@1PAV1@A
    • ?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
    • _AllocFullFileName@8
    • _DeInitKm2UmCommunication@0
    • _DeInitKmLPC@0
    • _DuplicateFullFileName@4
    • _FreeFullFileName@4
    • _GetKm2UmMode@0
    • _GetModuleInfoByAddress@8
    • _GetModuleInfoByModuleName@8
    • _InitKm2UmCommunication@8
    • _InitKmLPC@0
    • _IsVerifierCodeCheckFlagOn@0
    • _IsWindows8_1_update@4
    • _KmCallUm@8
    • _KmCallUmByLPC@8
    • _KmCallUmEx@12
    • _KmCleanupCommPortAPIs@0
    • _KmGetUmInitProcess@0
    • _KmSetBackupCommPortAPIs@4
    • _KmSetCommPortAPIs@4
    • _ModGetExportProcAddress@8
    • _ModLoadDLLToBuffer@4
    • _ModLoadDLLToBufferWithImageSize@8
    • _ModLoadModule@8
    • _ModUnLoadModule@4
    • _NormalizeFileName@4
    • _NormalizeFullNtPathToDosName@4
    • _TmCommConfigRoutine@4
    • _UtilAddDeviceInDriveTable@4
    • _UtilAddReparsePointMapping@8
    • _UtilCleanFileReadOnly@4
    • _UtilCloseExclusiveHandle@12
    • _UtilCreateDosFileName@8
    • _UtilDeleteFileForce@4
    • _UtilGetDeviceObjectName@8
    • _UtilGetFileNameFromFileObject@4
    • _UtilGetFileObjectForProcessByEPROC@8
    • _UtilGetFileObjectFromFileName@12
    • _UtilGetProcessName@12
    • _UtilGetSystemDirectory@4
    • _UtilGetSystemDirectoryEx@0
    • _UtilGetSystemDirectoryLength@0
    • _UtilGetSystemTime@4
    • _UtilIoSetFileInfo@24
    • _UtilIopCreateFileIRP@40
    • _UtilKeGetLowFileDevice@16
    • _UtilModuleIATHook@24
    • _UtilModuleIATUnHook@8
    • _UtilPostJobToWorkerThread@12
    • _UtilQueryExclusiveHandle@12
    • _UtilQueryKeyValue@24
    • _UtilRemoveDeviceFromDriveTable@4
    • _UtilVolumeDeviceToDosName@8
    • _UtilWaitValueChangeToZero@8
    • _UtilWriteVersionToRegistry@8
    • _UtilbuildDynamicDiskMappingTable@0
    • _UtlWriteBinValueKeyToRegistry@16
    • _ValidateAddressWithSize@20
    • __ResetProtectFromClose@4
    • __UtilDosPathNameToNtPathName@12

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • PAGE
    • .edata
    • INIT
    • .rsrc
    • .reloc

    Signature

    Expand
    {
      "Certificates": [
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
          "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
          "TBS": {
            "MD5": "d0785ad36e427c92b19f6826ab1e8020",
            "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
            "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
            "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
          },
          "ValidFrom": "2012-12-21 00:00:00",
          "ValidTo": "2020-12-30 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
          "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
          "TBS": {
            "MD5": "e9d38360b914c8863f6cba3ee58764d3",
            "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
            "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
            "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
          },
          "ValidFrom": "2012-10-18 00:00:00",
          "ValidTo": "2020-12-29 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
          "TBS": {
            "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
            "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
            "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
            "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
          },
          "ValidFrom": "2017-04-27 00:00:00",
          "ValidTo": "2018-07-16 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "611993e400000000001c",
          "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
          "TBS": {
            "MD5": "78a717e082dcc1cda3458d917e677d14",
            "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
            "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
            "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
          },
          "ValidFrom": "2011-02-22 19:25:17",
          "ValidTo": "2021-02-22 19:35:17",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
          "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "TBS": {
            "MD5": "b30c31a572b0409383ed3fbe17e56e81",
            "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
            "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
            "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
          },
          "ValidFrom": "2010-02-08 00:00:00",
          "ValidTo": "2020-02-07 23:59:59",
          "Version": 3
        }
      ],
      "CertificatesInfo": "",
      "Signer": [
        {
          "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Version": 1
        }
      ],
      "SignerInfo": ""
    }
    

    PropertyValue
    FilenameTmComm.sys
    Creation Timestamp2013-09-27 20:56:05
    MD5f51065667fb127cf6de984daea2f6b24
    SHA11768fb2b4796f624fa52b95dfdfbfb922ac21019
    SHA256654c5ba47f74008c8f49cbb97988017eec8c898adc3bb851bc6e1fdf9dcf54ad
    Authentihash MD5671205c31cc873b793bd9922b8c2594e
    Authentihash SHA1d8dea3a091ef24abd0cee37b74a6e6bf8dccea23
    Authentihash SHA2569bea1a92c747c203cd3e370f422ed6023787817a5495385e5ca473ef59396a2e
    RichPEHeaderHash MD5bbb76ea1d539dce2f6450c28c119dfc4
    RichPEHeaderHash SHA193937617f04f056cdde3a44129645289bbf68c00
    RichPEHeaderHash SHA256559177f9f73571b4f376e356741cfbedbb9806f57e0a1a70cb6b8dd57b8d83fa
    CompanyTrend Micro Inc.
    DescriptionTrendMicro Common Module
    ProductTrend Micro Eyes
    OriginalFilenameTmComm.sys

    Download

    Certificates

    Expand
    Certificate 478a8efb59e1d83f0ce142d2a28707be
    FieldValue
    ToBeSigned (TBS) MD5f13ede9179075999ef7f856ec31e364b
    ToBeSigned (TBS) SHA12f09867166e6107e17808317f5c8d4ee157f45bc
    ToBeSigned (TBS) SHA256089a2c4c6ac7432020acdb65c33bf39130da6f37c002ba79128bd4c94e4fa101
    SubjectC=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO Time Stamping Signer
    ValidFrom2010-05-10 00:00:00
    ValidTo2015-05-10 23:59:59
    Signaturec8fb63f80b75752c3af1f213a72db6a31a9cad0107d3348e77e0c26eae025d484fa4d221b636fd2a35437c6bdf80870b15f0763200b4ceb567a42f2f201b9c549e833f1f5f149562820f2241221f70b3f3f742de6c51cd4bf821ac9b3b8cb1e5e6288fce2a8af9aa524d8c5b77ba4d5a58dbbb6a04cc521e9de228370ebbe70e91c7f8dbf18198ebcd37b30eab65d362ec3aa576eb13a83593c92e0a01ecc0e8cc3d7eb6ebe2c1ecd3149282668750dcfd5097acb34a767306c486113ab35f4304526feab3d074364ccaf11b7984377063ad74b9aa0ef398b08608ebdbe01f8c10f239649bae4f0a2c928a4f18b591e58d1a935f1faef1a6f02e97d0d2f62b3c
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber478a8efb59e1d83f0ce142d2a28707be
    Version3
    Certificate 4d6290e58c54f0f1eb17341a1310e6a4
    FieldValue
    ToBeSigned (TBS) MD5b7d8444a70054990435f35a5630df5e1
    ToBeSigned (TBS) SHA14678c6e4a8787a8e6ed2bce8792b122f6c08afd8
    ToBeSigned (TBS) SHA2560a8b4b359ea7890b358e56e436e9cfc6f32b037b2599b597ca7f7a80d475ec98
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
    ValidFrom2010-09-30 00:00:00
    ValidTo2014-01-01 23:59:59
    Signatureaedd211d5f8f807ad25209eadb6ed25d8be8c21b6904be51a5010e59fa37d174a3eedced89742b62d5a6bf4fad361754f013e0a345d24c26cbe26da21fd01e7a070fb6b37b6f5068a2e931b3b7997d8070a0a7de0b1ea4fff34d811bdd20c91cc4afcff18ffad9da95f0ecdc5cbfe88c5a3e7ab0a3eb59437411e09b1a6af36f
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber4d6290e58c54f0f1eb17341a1310e6a4
    Version3
    Certificate 610c120600000000001b
    FieldValue
    ToBeSigned (TBS) MD553c41bc1164e09e0cd1617a5bf913efd
    ToBeSigned (TBS) SHA193c03aac8951d494ecd5696b1c08658541b18727
    ToBeSigned (TBS) SHA25640bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b
    SubjectC=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
    ValidFrom2006-05-23 17:01:29
    ValidTo2016-05-23 17:11:29
    Signature01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber610c120600000000001b
    Version3
    Certificate 1a9d178ad334acdf47c8a0d15bb50e6e
    FieldValue
    ToBeSigned (TBS) MD5685d99029d38a9d263ea82cd02a49f6c
    ToBeSigned (TBS) SHA193464d8f54b4ee7caf22ca1db15a4211e0d3c79e
    ToBeSigned (TBS) SHA256894991f1477dff88c7c0707531073bb59483750bcad672fc388179affca07aa9
    SubjectC=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=Trend Micro, Inc.
    ValidFrom2013-01-17 00:00:00
    ValidTo2014-03-18 23:59:59
    Signature65c7e1e0f4051179852b819153b528c88db47ef50e897cd8ce0d03a7cc2dc896c89790410182186fecaf9da5c317bf57b5038311c10c2ec5ddb5c18165a7e92f92a6f39c042262126c714337a7c528041a04679217c1475a30231c967ca63b4430ccea52fe4f16fabb5c454d2aa8cdde347b8beaa973d76b3f9ba99d2597939a33d67ec4abc3974ef3792b8bc90d092cce62309d205129bbcbd3554382f24b2911b4904b09e7f52f24f2cc5a52fa49f3a163c32fde076e917301f22dd45d643b95319bae922bc861e5a8f90d4dd72603c7b1ea0229eca869ab8d086ae5286baeba9b99a12856dc1d3cd9f6d9da4b8d5a85896ba4587d8eba506a4fbba4a7bb49
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber1a9d178ad334acdf47c8a0d15bb50e6e
    Version3

    Imports

    Expand
    • ntoskrnl.exe

    Imported Functions

    Expand
    • KeLeaveCriticalRegion
    • wcsncpy
    • KeEnterCriticalRegion
    • ExAcquireFastMutexUnsafe
    • wcsrchr
    • ExAcquireResourceSharedLite
    • ExReleaseResourceLite
    • _purecall
    • ZwOpenEvent
    • ZwConnectPort
    • KeClearEvent
    • PsProcessType
    • ExFreePoolWithTag
    • RtlInitUnicodeString
    • KeSetEvent
    • ProbeForWrite
    • KeUnstackDetachProcess
    • ZwRequestWaitReplyPort
    • ZwWaitForSingleObject
    • DbgBreakPoint
    • ZwSetEvent
    • IoGetCurrentProcess
    • ZwFreeVirtualMemory
    • ZwClose
    • ObfReferenceObject
    • ObfDereferenceObject
    • RtlUnicodeStringToInteger
    • ZwCreateSection
    • ObOpenObjectByPointer
    • KeStackAttachProcess
    • KePulseEvent
    • ZwAllocateVirtualMemory
    • ObGetObjectSecurity
    • SeAccessCheck
    • SeReleaseSubjectContext
    • SeCaptureSubjectContext
    • PsThreadType
    • ObReleaseObjectSecurity
    • PsGetProcessExitTime
    • MmSectionObjectType
    • DbgPrint
    • ExDeleteResourceLite
    • ExInitializeResourceLite
    • ZwReadFile
    • swprintf
    • ZwSetInformationFile
    • ZwCreateFile
    • ZwQueryInformationFile
    • ZwWriteFile
    • _wcsnicmp
    • towupper
    • ExAllocatePoolWithTag
    • KeInitializeEvent
    • ZwCreateEvent
    • ZwCreateKey
    • RtlAnsiStringToUnicodeString
    • ZwNotifyChangeKey
    • RtlInitAnsiString
    • _snprintf
    • RtlFreeUnicodeString
    • ExSystemTimeToLocalTime
    • _vsnprintf
    • ObReferenceObjectByHandle
    • RtlTimeToTimeFields
    • ZwDeviceIoControlFile
    • PsGetCurrentThreadId
    • PsGetCurrentProcessId
    • KeWaitForMultipleObjects
    • RtlEqualUnicodeString
    • RtlAppendUnicodeStringToString
    • RtlCopyUnicodeString
    • RtlUpcaseUnicodeChar
    • KeWaitForSingleObject
    • KeSetPriorityThread
    • PsCreateSystemThread
    • PsTerminateSystemThread
    • MmIsAddressValid
    • KeDelayExecutionThread
    • KeNumberProcessors
    • PsLookupProcessByProcessId
    • PsSetCreateProcessNotifyRoutine
    • ZwOpenDirectoryObject
    • ZwQueryInformationProcess
    • ExGetPreviousMode
    • NtSetInformationFile
    • ZwDeleteValueKey
    • ZwSetValueKey
    • ZwQuerySystemInformation
    • NtQueryInformationFile
    • IoFileObjectType
    • ZwQueryValueKey
    • ZwQueryDirectoryFile
    • NtCreateFile
    • ZwEnumerateValueKey
    • ZwQueryDirectoryObject
    • ZwDuplicateObject
    • ZwOpenProcess
    • ZwTerminateProcess
    • ZwDeleteKey
    • ZwEnumerateKey
    • ZwQueryKey
    • ZwOpenKey
    • ExReleaseFastMutexUnsafe
    • _stricmp
    • _strnicmp
    • mbstowcs
    • ProbeForRead
    • _snwprintf
    • ZwQuerySymbolicLinkObject
    • ZwMapViewOfSection
    • MmGetSystemRoutineAddress
    • RtlAppendUnicodeToString
    • IoCreateFile
    • RtlQueryRegistryValues
    • MmBuildMdlForNonPagedPool
    • ZwOpenSymbolicLinkObject
    • IoFreeMdl
    • ObQueryNameString
    • ZwUnmapViewOfSection
    • NtClose
    • IoFreeIrp
    • PsGetVersion
    • IoAllocateIrp
    • RtlCompareMemory
    • MmUnlockPages
    • ZwOpenFile
    • wcsncmp
    • RtlImageNtHeader
    • IoAllocateMdl
    • IofCallDriver
    • ZwQueryVolumeInformationFile
    • ObReferenceObjectByPointer
    • IoBuildDeviceIoControlRequest
    • ZwOpenSection
    • RtlSubAuthoritySid
    • RtlLengthRequiredSid
    • ExReleaseFastMutex
    • ExAcquireFastMutex
    • RtlCreateAcl
    • RtlSetDaclSecurityDescriptor
    • RtlAddAccessAllowedAce
    • KeInitializeSemaphore
    • KeReleaseSemaphore
    • RtlInitializeSid
    • RtlCreateSecurityDescriptor
    • IoDeleteSymbolicLink
    • IoDeleteDevice
    • ExEventObjectType
    • IofCompleteRequest
    • IoCreateSymbolicLink
    • IoGetDeviceObjectPointer
    • strncpy
    • NtOpenProcess
    • ObInsertObject
    • IoAcquireVpbSpinLock
    • SeCreateAccessState
    • IoGetFileObjectGenericMapping
    • ObCreateObject
    • IoReleaseVpbSpinLock
    • wcschr
    • strncat
    • RtlUnicodeStringToAnsiString
    • wcsncat
    • RtlFreeAnsiString
    • wcstombs
    • IoGetConfigurationInformation
    • IoRegisterPlugPlayNotification
    • RtlUpcaseUnicodeString
    • IoGetStackLimits
    • IoBuildSynchronousFsdRequest
    • KeReleaseSpinLock
    • ExpInterlockedPopEntrySList
    • FsRtlIsNameInExpression
    • wcsstr
    • ExAllocatePool
    • IoUnregisterPlugPlayNotification
    • MmProbeAndLockPages
    • RtlCompareUnicodeString
    • IoGetDeviceInterfaces
    • DbgPrintEx
    • KeAcquireSpinLockRaiseToDpc
    • KeBugCheckEx
    • IoCreateDevice
    • ZwSetSecurityObject
    • IoDeviceObjectType
    • RtlLengthSecurityDescriptor
    • SeCaptureSecurityDescriptor
    • RtlAbsoluteToSelfRelativeSD
    • IoIsWdmVersionAvailable
    • SeExports
    • RtlLengthSid
    • RtlGetSaclSecurityDescriptor
    • RtlGetDaclSecurityDescriptor
    • RtlGetGroupSecurityDescriptor
    • RtlGetOwnerSecurityDescriptor
    • MmSystemRangeStart
    • ExAcquireResourceExclusiveLite
    • __C_specific_handler

    Exported Functions

    Expand
    • ??0CAutoUpdateConfigThread@@QEAA@AEBV0@@Z
    • ??0CAutoUpdateConfigThread@@QEAA@PEAU_UNICODE_STRING@@P6AX0PEAX@Z1@Z
    • ??0CBlobConfig@@QEAA@AEBV0@@Z
    • ??0CBlobConfig@@QEAA@K@Z
    • ??0CContext@@QEAA@AEBV0@@Z
    • ??0CContext@@QEAA@KP6AJPEAU_EVENT_REPORT@@PEAXPEAU_TMCE_REPORT@@PEAU_TMCE_FEEDBACK@@@Z1K@Z
    • ??0CContextList@@QEAA@AEBV0@@Z
    • ??0CContextList@@QEAA@KPEAVIMemoryAllocator@@@Z
    • ??0CDebugLog@@QEAA@AEBV0@@Z
    • ??0CDebugLog@@QEAA@PEBG@Z
    • ??0CDebugLogEx@@QEAA@AEBV0@@Z
    • ??0CDebugLogEx@@QEAA@K@Z
    • ??0CDelayLoadThread@@QEAA@AEBV0@@Z
    • ??0CDelayLoadThread@@QEAA@XZ
    • ??0CExclusionExtConfig@@QEAA@AEBV0@@Z
    • ??0CExclusionExtConfig@@QEAA@KKE@Z
    • ??0CExclusionFileNameConfig@@QEAA@AEBV0@@Z
    • ??0CExclusionFileNameConfig@@QEAA@KK@Z
    • ??0CExclusionFilePathConfig@@QEAA@AEBV0@@Z
    • ??0CExclusionFilePathConfig@@QEAA@KK@Z
    • ??0CExclusionFolderConfig@@QEAA@AEBV0@@Z
    • ??0CExclusionFolderConfig@@QEAA@KK@Z
    • ??0CExclusionRegistryConfig@@QEAA@AEBV0@@Z
    • ??0CExclusionRegistryConfig@@QEAA@KK@Z
    • ??0CFile@@QEAA@AEBV0@@Z
    • ??0CFile@@QEAA@E@Z
    • ??0CFileExtension@@QEAA@AEBV0@@Z
    • ??0CFileExtension@@QEAA@KEEPEAVIMemoryAllocator@@@Z
    • ??0CInclusionExtConfig@@QEAA@AEBV0@@Z
    • ??0CInclusionExtConfig@@QEAA@KKE@Z
    • ??0CInclusionFileNameConfig@@QEAA@AEBV0@@Z
    • ??0CInclusionFileNameConfig@@QEAA@KK@Z
    • ??0CInclusionFilePathConfig@@QEAA@AEBV0@@Z
    • ??0CInclusionFilePathConfig@@QEAA@KK@Z
    • ??0CInclusionFolderConfig@@QEAA@AEBV0@@Z
    • ??0CInclusionFolderConfig@@QEAA@KK@Z
    • ??0CKEvent@@QEAA@AEBV0@@Z
    • ??0CKEvent@@QEAA@W4_EVENT_TYPE@@E@Z
    • ??0CList@@QEAA@AEBV0@@Z
    • ??0CList@@QEAA@KPEAVIMemoryAllocator@@@Z
    • ??0CLockEvent@@QEAA@AEBV0@@Z
    • ??0CLockEvent@@QEAA@XZ
    • ??0CLockList@@QEAA@AEBV0@@Z
    • ??0CLockList@@QEAA@KKPEAVIMemoryAllocator@@@Z
    • ??0CMemoryAllocator@@IEAA@W4_POOL_TYPE@@K@Z
    • ??0CMemoryAllocator@@QEAA@AEBV0@@Z
    • ??0CMemoryPoolAllocator@@IEAA@W4_POOL_TYPE@@_K1K@Z
    • ??0CMemoryPoolAllocator@@QEAA@AEBV0@@Z
    • ??0CModuleConfig@@QEAA@AEBV0@@Z
    • ??0CModuleConfig@@QEAA@XZ
    • ??0CModuleConfigList@@QEAA@AEBV0@@Z
    • ??0CModuleConfigList@@QEAA@KPEAVIMemoryAllocator@@@Z
    • ??0CModuleFileExtConfig@@QEAA@AEBV0@@Z
    • ??0CModuleFileExtConfig@@QEAA@KKE@Z
    • ??0CModuleFlagConfig@@QEAA@AEBV0@@Z
    • ??0CModuleFlagConfig@@QEAA@K@Z
    • ??0CModuleMultiStringConfig@@QEAA@AEBV0@@Z
    • ??0CModuleMultiStringConfig@@QEAA@KK@Z
    • ??0CModuleStringConfig@@QEAA@AEBV0@@Z
    • ??0CModuleStringConfig@@QEAA@K@Z
    • ??0CNoLockList@@QEAA@AEBV0@@Z
    • ??0CNoLockList@@QEAA@KKPEAVIMemoryAllocator@@@Z
    • ??0CSmartLock@@QEAA@AEAVCLockEvent@@@Z
    • ??0CSmartLock@@QEAA@XZ
    • ??0CSmartReference@@QEAA@AEAJ@Z
    • ??0CSmartReference@@QEAA@AEAK@Z
    • ??0CSmartResource@@QEAA@AEAVCResource@@E@Z
    • ??0CStrList@@QEAA@AEBV0@@Z
    • ??0CStrList@@QEAA@KPEAVIMemoryAllocator@@@Z
    • ??0CSystemThread@@QEAA@AEBV0@@Z
    • ??0CSystemThread@@QEAA@K@Z
    • ??0CUserFuncAdapterJob@@QEAA@AEBV0@@Z
    • ??0CUserFuncAdapterJob@@QEAA@P6AXPEAX@Z01@Z
    • ??0CWorkerThread@@IEAA@PEAVCWorkerThreadJobQueue@@@Z
    • ??0CWorkerThread@@QEAA@AEBV0@@Z
    • ??0CWorkerThreadJob@@QEAA@AEBV0@@Z
    • ??0CWorkerThreadJob@@QEAA@E@Z
    • ??0CWorkerThreadJobQueue@@QEAA@AEBV0@@Z
    • ??0CWorkerThreadJobQueue@@QEAA@K@Z
    • ??0CWorkerThreadPool@@QEAA@AEBV0@@Z
    • ??0CWorkerThreadPool@@QEAA@K@Z
    • ??0CWorkerThreadPoolEx@@QEAA@AEBV0@@Z
    • ??0CWorkerThreadPoolEx@@QEAA@KK@Z
    • ??0IMemoryAllocator@@QEAA@AEBV0@@Z
    • ??0IMemoryAllocator@@QEAA@XZ
    • ??1CAutoUpdateConfigThread@@UEAA@XZ
    • ??1CBlobConfig@@UEAA@XZ
    • ??1CContext@@UEAA@XZ
    • ??1CContextList@@UEAA@XZ
    • ??1CDebugLog@@UEAA@XZ
    • ??1CDebugLogEx@@UEAA@XZ
    • ??1CDelayLoadThread@@UEAA@XZ
    • ??1CExclusionExtConfig@@UEAA@XZ
    • ??1CExclusionFileNameConfig@@UEAA@XZ
    • ??1CExclusionFilePathConfig@@UEAA@XZ
    • ??1CExclusionFolderConfig@@UEAA@XZ
    • ??1CExclusionRegistryConfig@@UEAA@XZ
    • ??1CFile@@UEAA@XZ
    • ??1CFileExtension@@UEAA@XZ
    • ??1CInclusionExtConfig@@UEAA@XZ
    • ??1CInclusionFileNameConfig@@UEAA@XZ
    • ??1CInclusionFilePathConfig@@UEAA@XZ
    • ??1CInclusionFolderConfig@@UEAA@XZ
    • ??1CKEvent@@UEAA@XZ
    • ??1CList@@UEAA@XZ
    • ??1CLockEvent@@UEAA@XZ
    • ??1CLockList@@UEAA@XZ
    • ??1CMemoryAllocator@@UEAA@XZ
    • ??1CMemoryPoolAllocator@@UEAA@XZ
    • ??1CModuleConfig@@UEAA@XZ
    • ??1CModuleConfigList@@UEAA@XZ
    • ??1CModuleFileExtConfig@@UEAA@XZ
    • ??1CModuleFlagConfig@@UEAA@XZ
    • ??1CModuleMultiStringConfig@@UEAA@XZ
    • ??1CModuleStringConfig@@UEAA@XZ
    • ??1CNoLockList@@UEAA@XZ
    • ??1CSmartLock@@QEAA@XZ
    • ??1CSmartReference@@QEAA@XZ
    • ??1CSmartResource@@QEAA@XZ
    • ??1CStrList@@UEAA@XZ
    • ??1CSystemThread@@UEAA@XZ
    • ??1CUserFuncAdapterJob@@UEAA@XZ
    • ??1CWorkerThread@@UEAA@XZ
    • ??1CWorkerThreadJob@@UEAA@XZ
    • ??1CWorkerThreadJobQueue@@UEAA@XZ
    • ??1CWorkerThreadPool@@UEAA@XZ
    • ??1CWorkerThreadPoolEx@@UEAA@XZ
    • ??1IMemoryAllocator@@UEAA@XZ
    • ??2@YAPEAX_KPEAVIMemoryAllocator@@PEBDK@Z
    • ??2CMemoryAllocator@@SAPEAX_K@Z
    • ??2CMemoryPoolAllocator@@SAPEAX_K@Z
    • ??3@YAXPEAX@Z
    • ??3IMemoryAllocator@@SAXPEAX@Z
    • ??4CAutoUpdateConfigThread@@QEAAAEAV0@AEBV0@@Z
    • ??4CBlobConfig@@QEAAAEAV0@AEBV0@@Z
    • ??4CContext@@QEAAAEAV0@AEBV0@@Z
    • ??4CDebugLog@@QEAAAEAV0@AEBV0@@Z
    • ??4CDebugLogEx@@QEAAAEAV0@AEBV0@@Z
    • ??4CDelayLoadThread@@QEAAAEAV0@AEBV0@@Z
    • ??4CFile@@QEAAAEAV0@AEBV0@@Z
    • ??4CKEvent@@QEAAAEAV0@AEBV0@@Z
    • ??4CLockEvent@@QEAAAEAV0@AEBV0@@Z
    • ??4CMemoryAllocator@@QEAAAEAV0@AEBV0@@Z
    • ??4CMemoryPoolAllocator@@QEAAAEAV0@AEBV0@@Z
    • ??4CModuleConfig@@QEAAAEAV0@AEBV0@@Z
    • ??4CModuleFlagConfig@@QEAAAEAV0@AEBV0@@Z
    • ??4CModuleStringConfig@@QEAAAEAV0@AEBV0@@Z
    • ??4CSmartLock@@QEAAAEAV0@AEBV0@@Z
    • ??4CSmartLock@@QEAAAEBV0@AEAVCLockEvent@@@Z
    • ??4CSmartResource@@QEAAAEAV0@AEBV0@@Z
    • ??4CSystemThread@@QEAAAEAV0@AEBV0@@Z
    • ??4CUserFuncAdapterJob@@QEAAAEAV0@AEBV0@@Z
    • ??4CWorkerThread@@QEAAAEAV0@AEBV0@@Z
    • ??4CWorkerThreadJob@@QEAAAEAV0@AEBV0@@Z
    • ??4IMemoryAllocator@@QEAAAEAV0@AEBV0@@Z
    • ??_7CAutoUpdateConfigThread@@6B@
    • ??_7CBlobConfig@@6B@
    • ??_7CContext@@6B@
    • ??_7CContextList@@6B@
    • ??_7CDebugLog@@6B@
    • ??_7CDebugLogEx@@6B@
    • ??_7CDelayLoadThread@@6B@
    • ??_7CExclusionExtConfig@@6B@
    • ??_7CExclusionFileNameConfig@@6B@
    • ??_7CExclusionFilePathConfig@@6B@
    • ??_7CExclusionFolderConfig@@6B@
    • ??_7CExclusionRegistryConfig@@6B@
    • ??_7CFile@@6B@
    • ??_7CFileExtension@@6B@
    • ??_7CInclusionExtConfig@@6B@
    • ??_7CInclusionFileNameConfig@@6B@
    • ??_7CInclusionFilePathConfig@@6B@
    • ??_7CInclusionFolderConfig@@6B@
    • ??_7CKEvent@@6B@
    • ??_7CList@@6B@
    • ??_7CLockEvent@@6B@
    • ??_7CLockList@@6B@
    • ??_7CMemoryAllocator@@6B@
    • ??_7CMemoryPoolAllocator@@6B@
    • ??_7CModuleConfig@@6B@
    • ??_7CModuleConfigList@@6B@
    • ??_7CModuleFileExtConfig@@6B@
    • ??_7CModuleFlagConfig@@6B@
    • ??_7CModuleMultiStringConfig@@6B@
    • ??_7CModuleStringConfig@@6B@
    • ??_7CNoLockList@@6B@
    • ??_7CStrList@@6B@
    • ??_7CSystemThread@@6B@
    • ??_7CUserFuncAdapterJob@@6B@
    • ??_7CWorkerThread@@6B@
    • ??_7CWorkerThreadJob@@6B@
    • ??_7CWorkerThreadJobQueue@@6B@
    • ??_7CWorkerThreadPool@@6B@
    • ??_7CWorkerThreadPoolEx@@6B@
    • ??_7IMemoryAllocator@@6B@
    • ??_FCContextList@@QEAAXXZ
    • ??_FCFile@@QEAAXXZ
    • ??_FCFileExtension@@QEAAXXZ
    • ??_FCModuleConfigList@@QEAAXXZ
    • ??_FCStrList@@QEAAXXZ
    • ??_FCSystemThread@@QEAAXXZ
    • ??_FCWorkerThread@@QEAAXXZ
    • ??_FCWorkerThreadJob@@QEAAXXZ
    • ??_FCWorkerThreadJobQueue@@QEAAXXZ
    • ??_U@YAPEAX_KPEAVIMemoryAllocator@@PEBDK@Z
    • ??_V@YAXPEAX@Z
    • ?Acquire@CLockEvent@@QEAAXXZ
    • ?Add@CContextList@@QEAAEPEAVCContext@@@Z
    • ?Add@CFileExtension@@QEAAEPEBGK@Z
    • ?Add@CModuleConfigList@@QEAAEPEAVCModuleConfig@@@Z
    • ?Add@CStrList@@QEAAEPEBG@Z
    • ?AddNode@CLockList@@UEAAEQEAXE@Z
    • ?AddNode@CNoLockList@@UEAAEQEAXE@Z
    • ?Alloc@CMemoryAllocator@@UEAAPEAX_KPEBDK@Z
    • ?Alloc@CMemoryPoolAllocator@@UEAAPEAX_KPEBDK@Z
    • ?AllocBlock@CMemoryPoolAllocator@@IEAAPEAX_K@Z
    • ?AttachJobQueue@CWorkerThread@@QEAAXPEAVCWorkerThreadJobQueue@@@Z
    • ?Cancel@CWorkerThreadJob@@QEAAXXZ
    • ?CheckNode@CLockList@@UEAAHQEAX@Z
    • ?CheckNode@CNoLockList@@UEAAHQEAX@Z
    • ?CleanQueue@CWorkerThreadJobQueue@@QEAAXXZ
    • ?Cleanup@CBlobConfig@@AEAAXXZ
    • ?Cleanup@CModuleFileExtConfig@@IEAAXXZ
    • ?Cleanup@CModuleMultiStringConfig@@IEAAXXZ
    • ?Cleanup@CModuleStringConfig@@AEAAXXZ
    • ?Close@CFile@@QEAAJXZ
    • ?Count@CLockList@@QEAAKXZ
    • ?Count@CNoLockList@@QEAAKXZ
    • ?Create@CFile@@QEAAJPEBGKKKK@Z
    • ?Create@CSystemThread@@QEAAEXZ
    • ?CreateInstance@CMemoryAllocator@@SAPEAV1@W4_POOL_TYPE@@K@Z
    • ?CreateInstance@CMemoryPoolAllocator@@SAPEAV1@W4_POOL_TYPE@@_K1K@Z
    • ?CreatePool@CWorkerThreadPool@@QEAAEXZ
    • ?CreatePool@CWorkerThreadPoolEx@@QEAAEXZ
    • ?CreateThreads@CWorkerThreadPool@@QEAAEK@Z
    • ?CreateThreads@CWorkerThreadPoolEx@@QEAAEK@Z
    • ?CreateWIRP@CFile@@QEAAJPEBGKKKK@Z
    • ?Delete@CFile@@QEAAJXZ
    • ?Delete@CFileExtension@@QEAAEPEBGK@Z
    • ?Delete@CStrList@@QEAAEPEBG@Z
    • ?DeleteAll@CList@@UEAAXXZ
    • ?DeleteAll@CLockList@@UEAAXXZ
    • ?DeleteAll@CNoLockList@@UEAAXXZ
    • ?DeleteNode@CContextList@@MEAAXPEAX@Z
    • ?DeleteNode@CList@@UEAAXPEAX@Z
    • ?DeleteNode@CModuleConfigList@@MEAAXPEAX@Z
    • ?DeleteNode@CStrList@@EEAAXPEAU_STR_LIST_NODE@1@@Z
    • ?DisableWriteProtectFromCR0@@YAXPEAPEAX@Z
    • ?DoIt@CWorkerThreadJob@@QEAAJXZ
    • ?EntryPoint@CSystemThread@@KAXPEAX@Z
    • ?Find@CContextList@@QEAAPEAVCContext@@K@Z
    • ?Find@CContextList@@QEAAPEAVCContext@@PEAX@Z
    • ?Find@CFileExtension@@QEAAPEAU_STR_LIST_NODE@CStrList@@PEBGK@Z
    • ?Find@CModuleConfigList@@QEAAPEAVCModuleConfig@@K@Z
    • ?Find@CStrList@@QEAAPEAU_STR_LIST_NODE@1@PEBG@Z
    • ?FindNode@CContextList@@IEAAPEAXPEAX@Z
    • ?FindPartiallyAndAllMatch@CStrList@@QEAAPEAU_STR_LIST_NODE@1@PEBG@Z
    • ?FinishFunction@CUserFuncAdapterJob@@MEAAXXZ
    • ?FinishIt@CWorkerThreadJob@@QEAAJXZ
    • ?First@CList@@UEAAPEAXXZ
    • ?First@CLockList@@UEAAPEAXXZ
    • ?First@CNoLockList@@UEAAPEAXXZ
    • ?Free@CMemoryAllocator@@UEAAXPEAX@Z
    • ?Free@CMemoryPoolAllocator@@UEAAXPEAX@Z
    • ?GetAttributes@CFile@@QEAAKXZ
    • ?GetBasicInfomration@CFile@@IEAAJXZ
    • ?GetBlobCofig@CContext@@UEAAJKPEAXPEAK@Z
    • ?GetCategory@CContext@@QEAAKXZ
    • ?GetData@CBlobConfig@@QEAAHPEAXPEAK@Z
    • ?GetData@CModuleFileExtConfig@@QEAAHPEAGPEAK@Z
    • ?GetData@CModuleFileExtConfig@@QEAAPEAVCFileExtension@@XZ
    • ?GetData@CModuleFlagConfig@@QEAAKXZ
    • ?GetData@CModuleMultiStringConfig@@QEAAHPEAGPEAK@Z
    • ?GetData@CModuleMultiStringConfig@@QEAAPEAVCStrList@@XZ
    • ?GetData@CModuleStringConfig@@QEAAPEAGXZ
    • ?GetData@CStrList@@QEAAEPEAGPEAK@Z
    • ?GetDataType@CModuleConfig@@QEAAKXZ
    • ?GetEngineContext@CContext@@QEAAPEAXXZ
    • ?GetFileExtensionConfig@CContext@@QEAAPEAVCFileExtension@@K@Z
    • ?GetFileExtensionConfig@CContext@@UEAAJKPEAGPEAK@Z
    • ?GetFileSize@CFile@@QEAAJPEAT_LARGE_INTEGER@@@Z
    • ?GetFlagConfig@CContext@@UEAAJKPEAK@Z
    • ?GetID@CModuleConfig@@QEAAKXZ
    • ?GetJob@CWorkerThreadJobQueue@@QEAAPEAVCWorkerThreadJob@@XZ
    • ?GetLength@CModuleStringConfig@@QEAAKXZ
    • ?GetLinkContext@CContext@@QEAAPEAXXZ
    • ?GetLogFlag@CDebugLog@@QEAAKXZ
    • ?GetLogFlag@CDebugLogEx@@QEAAKXZ
    • ?GetModuleId@CModuleConfig@@QEAAKXZ
    • ?GetMultiStringConfig@CContext@@QEAAPEAVCStrList@@K@Z
    • ?GetMultiStringConfig@CContext@@UEAAJKPEAGPEAK@Z
    • ?GetOneThreadTEB@CWorkerThreadPool@@QEAAPEAU_ETHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPool@@QEAAPEAU_KTHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPoolEx@@QEAAPEAU_ETHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPoolEx@@QEAAPEAU_KTHREAD@@XZ
    • ?GetReportCallBackRoutine@CContext@@QEAA_KXZ
    • ?GetSize@CBlobConfig@@QEAAKXZ
    • ?GetStringConfig@CContext@@QEAAPEAGK@Z
    • ?GetStringConfig@CContext@@UEAAJKPEAGPEAK@Z
    • ?GetThreadCount@CWorkerThreadPool@@QEAAKXZ
    • ?GetThreadCount@CWorkerThreadPoolEx@@QEAAKXZ
    • ?GetThreadID@CSystemThread@@QEAA_KXZ
    • ?GetType@CContext@@QEAAKXZ
    • ?GetUserParameter@CContext@@QEAA_KXZ
    • ?InitProcMon@CDebugLogEx@@IEAAXXZ
    • ?InitializeBlobConfig@CContext@@QEAAHKPEAXK@Z
    • ?InitializeFileExtensionConfig@CContext@@QEAAHKPEBG@Z
    • ?InitializeFlagConfig@CContext@@QEAAHKK@Z
    • ?InitializeMultiStringConfig@CContext@@QEAAHKPEBG@Z
    • ?InitializeStringConfig@CContext@@QEAAHKPEBG@Z
    • ?Insert@CList@@UEAAXQEAXE@Z
    • ?Insert@CLockList@@UEAAXQEAXE@Z
    • ?Insert@CNoLockList@@UEAAXQEAXE@Z
    • ?InsertAfter@CList@@UEAAXPEAX0@Z
    • ?InsertBefore@CList@@UEAAXPEAX0@Z
    • ?Instance@CWorkerThreadPool@@SAPEAV1@XZ
    • ?IsEmpty@CList@@UEAAEXZ
    • ?IsEmpty@CLockList@@UEAAEXZ
    • ?IsEmpty@CNoLockList@@UEAAEXZ
    • ?IsExceedLimitation@CMemoryPoolAllocator@@IEAAEK@Z
    • ?IsFull@CLockList@@QEBAEXZ
    • ?IsFull@CNoLockList@@QEBAEXZ
    • ?IsInExclusionList@CExclusionExtConfig@@QEAAEPEBG@Z
    • ?IsInExclusionList@CExclusionFileNameConfig@@QEAAEPEBG@Z
    • ?IsInExclusionList@CExclusionFilePathConfig@@QEAAEPEBG@Z
    • ?IsInExclusionList@CExclusionFolderConfig@@QEAAEPEBG@Z
    • ?IsInExclusionList@CExclusionRegistryConfig@@QEAAEPEBG@Z
    • ?IsInInclusionList@CInclusionExtConfig@@QEAAEPEBG@Z
    • ?IsInInclusionList@CInclusionFileNameConfig@@QEAAEPEBG@Z
    • ?IsInInclusionList@CInclusionFilePathConfig@@QEAAEPEBG@Z
    • ?IsInInclusionList@CInclusionFolderConfig@@QEAAEPEBG@Z
    • ?IsOpened@CFile@@QEAAEXZ
    • ?IsTerminated@CWorkerThreadPool@@QEAAEXZ
    • ?IsTerminated@CWorkerThreadPoolEx@@QEAAEXZ
    • ?IsValid@CMemoryAllocator@@UEAAEXZ
    • ?IsValid@CMemoryPoolAllocator@@UEAAEXZ
    • ?IsValid@IMemoryAllocator@@UEAAEXZ
    • ?IsWorkerThread@CWorkerThreadPool@@QEAAE_K@Z
    • ?IsWorkerThread@CWorkerThreadPoolEx@@QEAAE_K@Z
    • ?JobFunction@CUserFuncAdapterJob@@MEAAXXZ
    • ?JobQueue@CWorkerThreadPool@@QEAAAEAVCWorkerThreadJobQueue@@XZ
    • ?JobQueue@CWorkerThreadPoolEx@@QEAAAEAVCWorkerThreadJobQueue@@XZ
    • ?Limit@CLockList@@QEAAKXZ
    • ?Limit@CNoLockList@@QEAAKXZ
    • ?MatchAllExtensions@CFileExtension@@QEAAEXZ
    • ?MatchNoExtensions@CFileExtension@@QEAAEXZ
    • ?MergeLeft@CMemoryPoolAllocator@@IEAAPEAXPEAX@Z
    • ?MergeRight@CMemoryPoolAllocator@@IEAAPEAXPEAX@Z
    • ?NeedDelete@CWorkerThreadJob@@QEAAEXZ
    • ?NeedDeleteWhenFinish@CWorkerThreadJob@@QEAAXE@Z
    • ?NewNode@CList@@UEAAPEAXXZ
    • ?NewNode@CStrList@@EEAAPEAXXZ
    • ?NewNodeVariant@CList@@IEAAPEAXK@Z
    • ?Next@CList@@UEBAPEAXQEAX@Z
    • ?Next@CLockList@@UEBAPEAXQEAX@Z
    • ?Next@CNoLockList@@UEBAPEAXQEAX@Z
    • ?NextPool@CMemoryPoolAllocator@@QEAAPEAV1@XZ
    • ?NotityTerminate@CWorkerThread@@QEAAXXZ
    • ?PostJobToWorkerThread@CWorkerThreadPool@@QEAAJP6AXPEAX@Z0E@Z
    • ?PostJobToWorkerThread@CWorkerThreadPoolEx@@QEAAJP6AXPEAX@Z0E1@Z
    • ?Pulse@CKEvent@@QEAAJJE@Z
    • ?QueueJob@CWorkerThreadJobQueue@@QEAAEPEAVCWorkerThreadJob@@@Z
    • ?QueueJobItem@CWorkerThreadPool@@QEAAJPEAVCWorkerThreadJob@@@Z
    • ?QueueJobItem@CWorkerThreadPoolEx@@QEAAJPEAVCWorkerThreadJob@@@Z
    • ?RCMInstance@CWorkerThreadPool@@SAPEAV1@XZ
    • ?Read@CFile@@QEAAJPEADKPEAK@Z
    • ?ReadWIRP@CFile@@QEAAJPEADKPEAK@Z
    • ?ReferenceCount@CContext@@QEAAAEAKXZ
    • ?Release@CLockEvent@@QEAAXXZ
    • ?Remove@CContextList@@UEAAEQEAX@Z
    • ?Remove@CList@@UEAAEQEAX@Z
    • ?Remove@CLockList@@UEAAEQEAX@Z
    • ?Remove@CNoLockList@@UEAAEQEAX@Z
    • ?RemoveHead@CList@@UEAAPEAXXZ
    • ?RemoveHead@CLockList@@UEAAPEAXXZ
    • ?RemoveHead@CNoLockList@@UEAAPEAXXZ
    • ?RemoveTail@CList@@UEAAPEAXXZ
    • ?RemoveTail@CLockList@@UEAAPEAXXZ
    • ?RemoveTail@CNoLockList@@UEAAPEAXXZ
    • ?Reset@CKEvent@@QEAAXXZ
    • ?ResetData@CInclusionExtConfig@@QEAAXXZ
    • ?ResetData@CInclusionFileNameConfig@@QEAAXXZ
    • ?ResetData@CInclusionFilePathConfig@@QEAAXXZ
    • ?ResetData@CInclusionFolderConfig@@QEAAXXZ
    • ?RestoreCR0@@YAXPEAX@Z
    • ?Run@CAutoUpdateConfigThread@@UEAAXXZ
    • ?Run@CDelayLoadThread@@UEAAXXZ
    • ?Run@CWorkerThread@@UEAAXXZ
    • ?SeekToEnd@CFile@@QEAAJXZ
    • ?Set@CKEvent@@QEAAJJE@Z
    • ?SetAttributes@CFile@@QEAAJK@Z
    • ?SetBlobCofig@CContext@@UEAAJKPEAXK@Z
    • ?SetData@CBlobConfig@@QEAAHPEAXK@Z
    • ?SetData@CModuleFileExtConfig@@QEAAHPEBG@Z
    • ?SetData@CModuleFlagConfig@@QEAAHK@Z
    • ?SetData@CModuleMultiStringConfig@@QEAAHPEBGK@Z
    • ?SetData@CModuleStringConfig@@QEAAHPEBG@Z
    • ?SetEngineContext@CContext@@QEAAXPEAX@Z
    • ?SetFileExtensionConfig@CContext@@UEAAJKPEBG@Z
    • ?SetFlagConfig@CContext@@UEAAJKK@Z
    • ?SetLinkContext@CContext@@QEAAXPEAX@Z
    • ?SetLogFlag@CDebugLog@@QEAAEK@Z
    • ?SetLogFlag@CDebugLogEx@@QEAAEK@Z
    • ?SetMatchAllExtensions@CFileExtension@@QEAAXE@Z
    • ?SetMatchNoExtensions@CFileExtension@@QEAAXE@Z
    • ?SetMultiStringConfig@CContext@@UEAAJKPEBG@Z
    • ?SetNewJobItemEvent@CWorkerThreadJobQueue@@QEAAXXZ
    • ?SetPriority@CSystemThread@@QEAAXK@Z
    • ?SetStopUse@CContext@@QEAAXXZ
    • ?SetStringConfig@CContext@@UEAAJKPEBG@Z
    • ?Setup@CSystemThread@@MEAAXXZ
    • ?StopUse@CContext@@QEAAHXZ
    • ?TearDown@CSystemThread@@MEAAXXZ
    • ?Terminate@CSystemThread@@QEAAXE@Z
    • ?Terminate@CWorkerThreadPool@@QEAAEXZ
    • ?Terminate@CWorkerThreadPoolEx@@QEAAEXZ
    • ?TmExceptionFilter@@YAJPEAU_EXCEPTION_POINTERS@@@Z
    • ?Wait@CKEvent@@QEAAJPEAT_LARGE_INTEGER@@E@Z
    • ?WaitFinish@CWorkerThreadJob@@QEAAXXZ
    • ?WaitForInit@CDelayLoadThread@@QEAAEXZ
    • ?WaitForLoad@CDelayLoadThread@@QEAAEXZ
    • ?WaitNewJobAvailable@CWorkerThreadJobQueue@@QEAAEXZ
    • ?WaitQueueEmpty@CWorkerThreadJobQueue@@QEAAXXZ
    • ?Write@CDebugLog@@QEAAXPEBDZZ
    • ?Write@CDebugLogEx@@QEAAXPEBDZZ
    • ?Write@CFile@@QEAAJPEADKPEAT_LARGE_INTEGER@@PEAK@Z
    • ?WriteDataToFile@CDebugLogEx@@IEAAXPEADK@Z
    • ?WriteDataToProcMonW@CDebugLogEx@@IEAAXPEAD@Z
    • ?WriteSystemInformation@CDebugLog@@QEAAXXZ
    • ?WriteSystemInformation@CDebugLogEx@@QEAAXXZ
    • ?WriteSystemStringInformation@CDebugLog@@IEAAXPEBG@Z
    • ?WriteSystemStringInformation@CDebugLogEx@@IEAAXPEBG@Z
    • ?WriteToFile@CDebugLog@@IEAAXPEADK@Z
    • ?WriteToProcMonW@CDebugLogEx@@IEAAXPEAU_UNICODE_STRING@@@Z
    • ?_pNonPagedAllocator@@3PEAVCMemoryAllocator@@EA
    • ?_pPagedAllocator@@3PEAVCMemoryAllocator@@EA
    • ?m_lpInstance@CWorkerThreadPool@@1PEAV1@EA
    • ?m_lpRCMInstance@CWorkerThreadPool@@1PEAV1@EA
    • DeInitKm2UmCommunication
    • DeInitKmLPC
    • DuplicateFullFileName
    • FreeFullFileName
    • GetKm2UmMode
    • GetModuleInfoByAddress
    • GetModuleInfoByModuleName
    • InitKm2UmCommunication
    • InitKmLPC
    • KmCallUm
    • KmCallUmByLPC
    • KmCallUmEx
    • KmCleanupCommPortAPIs
    • KmGetUmInitProcess
    • KmSetCommPortAPIs
    • ModGetExportProcAddress
    • ModLoadDLLToBuffer
    • ModLoadDLLToBufferWithImageSize
    • ModLoadModule
    • ModUnLoadModule
    • NormalizeFileName
    • NormalizeFullNtPathToDosName
    • TmCommConfigRoutine
    • UtilAddDeviceInDriveTable
    • UtilAddReparsePointMapping
    • UtilCleanFileReadOnly
    • UtilCreateDosFileName
    • UtilDeleteFileForce
    • UtilGetDeviceObjectName
    • UtilGetFileNameFromFileObject
    • UtilGetFileObjectForProcessByEPROC
    • UtilGetFileObjectFromFileName
    • UtilGetProcessName
    • UtilGetSystemDirectory
    • UtilGetSystemDirectoryEx
    • UtilGetSystemDirectoryLength
    • UtilGetSystemTime
    • UtilIoSetFileInfo
    • UtilIopCreateFileIRP
    • UtilKeGetLowFileDevice
    • UtilModuleIATHook
    • UtilModuleIATUnHook
    • UtilPostJobToWorkerThread
    • UtilQueryKeyValue
    • UtilRemoveDeviceFromDriveTable
    • UtilVolumeDeviceToDosName
    • UtilWaitValueChangeToZero
    • UtilWriteVersionToRegistry
    • UtilbuildDynamicDiskMappingTable
    • UtlWriteBinValueKeyToRegistry
    • ValidateAddressWithSize
    • _UtilDosPathNameToNtPathName

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • .pdata
    • PAGE
    • .edata
    • INIT
    • .rsrc
    • .reloc

    Signature

    Expand
    {
      "Certificates": [
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
          "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
          "TBS": {
            "MD5": "d0785ad36e427c92b19f6826ab1e8020",
            "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
            "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
            "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
          },
          "ValidFrom": "2012-12-21 00:00:00",
          "ValidTo": "2020-12-30 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
          "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
          "TBS": {
            "MD5": "e9d38360b914c8863f6cba3ee58764d3",
            "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
            "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
            "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
          },
          "ValidFrom": "2012-10-18 00:00:00",
          "ValidTo": "2020-12-29 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
          "TBS": {
            "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
            "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
            "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
            "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
          },
          "ValidFrom": "2017-04-27 00:00:00",
          "ValidTo": "2018-07-16 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "611993e400000000001c",
          "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
          "TBS": {
            "MD5": "78a717e082dcc1cda3458d917e677d14",
            "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
            "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
            "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
          },
          "ValidFrom": "2011-02-22 19:25:17",
          "ValidTo": "2021-02-22 19:35:17",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
          "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "TBS": {
            "MD5": "b30c31a572b0409383ed3fbe17e56e81",
            "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
            "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
            "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
          },
          "ValidFrom": "2010-02-08 00:00:00",
          "ValidTo": "2020-02-07 23:59:59",
          "Version": 3
        }
      ],
      "CertificatesInfo": "",
      "Signer": [
        {
          "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Version": 1
        }
      ],
      "SignerInfo": ""
    }
    

    PropertyValue
    FilenameTmComm.sys
    Creation Timestamp2011-06-20 22:08:35
    MD5a31246180e61140ad7ff9dd7edf1f6a1
    SHA1fe0afc6dd03a9bd7f6e673cc6b4af2266737e3d1
    SHA2566ffdde6bc6784c13c601442e47157062941c47015891e7139c2aaba676ab59cc
    Authentihash MD59da7d62145d6f4c104da27b797fabc4c
    Authentihash SHA1597144e2c01496c32aeed3277f8619c229de17b4
    Authentihash SHA256d3227dc2e8f83258810cf43719f02a8d52648eb17939fddd79fd70155a47305d
    RichPEHeaderHash MD5b096b1994ceb1d288d734b2bd59137d7
    RichPEHeaderHash SHA1a9cb9331ae0ecb82e617ff09fe40796ab093035e
    RichPEHeaderHash SHA2560a5393cf21980cb34b6c35c2fe034fa52f56cd502b9bb49398d04d555bc5cc8f
    CompanyTrend Micro Inc.
    DescriptionTrendMicro Common Module NoTrap Build
    ProductTrend Micro Eyes
    OriginalFilenameTmComm.sys

    Download

    Certificates

    Expand
    Certificate 3825d7faf861af9ef490e726b5d65ad5
    FieldValue
    ToBeSigned (TBS) MD5d6c7684e9aaa508cf268335f83afe040
    ToBeSigned (TBS) SHA118066d20ad92409c567cdfde745279ff71c75226
    ToBeSigned (TBS) SHA256a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff
    SubjectC=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2
    ValidFrom2007-06-15 00:00:00
    ValidTo2012-06-14 23:59:59
    Signature50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber3825d7faf861af9ef490e726b5d65ad5
    Version3
    Certificate 47bf1995df8d524643f7db6d480d31a4
    FieldValue
    ToBeSigned (TBS) MD5518d2ea8a21e879c942d504824ac211c
    ToBeSigned (TBS) SHA121ce87d827077e61abddf2beba69fde5432ea031
    ToBeSigned (TBS) SHA2561ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7
    SubjectC=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
    ValidFrom2003-12-04 00:00:00
    ValidTo2013-12-03 23:59:59
    Signature4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber47bf1995df8d524643f7db6d480d31a4
    Version3
    Certificate 4d6290e58c54f0f1eb17341a1310e6a4
    FieldValue
    ToBeSigned (TBS) MD5b7d8444a70054990435f35a5630df5e1
    ToBeSigned (TBS) SHA14678c6e4a8787a8e6ed2bce8792b122f6c08afd8
    ToBeSigned (TBS) SHA2560a8b4b359ea7890b358e56e436e9cfc6f32b037b2599b597ca7f7a80d475ec98
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
    ValidFrom2010-09-30 00:00:00
    ValidTo2014-01-01 23:59:59
    Signatureaedd211d5f8f807ad25209eadb6ed25d8be8c21b6904be51a5010e59fa37d174a3eedced89742b62d5a6bf4fad361754f013e0a345d24c26cbe26da21fd01e7a070fb6b37b6f5068a2e931b3b7997d8070a0a7de0b1ea4fff34d811bdd20c91cc4afcff18ffad9da95f0ecdc5cbfe88c5a3e7ab0a3eb59437411e09b1a6af36f
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber4d6290e58c54f0f1eb17341a1310e6a4
    Version3
    Certificate 610c120600000000001b
    FieldValue
    ToBeSigned (TBS) MD553c41bc1164e09e0cd1617a5bf913efd
    ToBeSigned (TBS) SHA193c03aac8951d494ecd5696b1c08658541b18727
    ToBeSigned (TBS) SHA25640bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b
    SubjectC=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
    ValidFrom2006-05-23 17:01:29
    ValidTo2016-05-23 17:11:29
    Signature01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber610c120600000000001b
    Version3
    Certificate 24e3d70b86ed54d0b22c3450b960984e
    FieldValue
    ToBeSigned (TBS) MD58ddf6d6623a3f10024af513804bb606d
    ToBeSigned (TBS) SHA14daedaec405b6dfefce005517e230b2419ad08bc
    ToBeSigned (TBS) SHA25654894db2dab64a4991b4deab1a3415d4ea0d9905711af3b67242a0568d799b95
    SubjectC=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, OU=RD, CN=Trend Micro, Inc.
    ValidFrom2011-01-31 00:00:00
    ValidTo2012-02-16 23:59:59
    Signature5ae5a2abcc8bbf832dd651a0cb396ee5af87305e67d20288d6d830699286ce0b1b3ec77c732d80564e6a482461bda52329dc301ec6286011fe60413c97f4207bf675a71460365e9d917b19d7b5e7c49ff035a5488f8fc703a61512b1588cb6fc8ceef0f6353d47c66a5edbef40e53197431ada77acef71cca7db0dbaa88d02355af0a62a7901e91bc8c59ad48b4ecfd67f137023601c308691ad14d6859c9d6b28c6a3e15314e55832cea94793436a5610bbe5f0901cedc6796c9ca53b5d55f79974cd6be7093bba119675614c1654139096e506c3fb92460d45879bdbc196bd833ae4dc31da6e14130df14a20c05615db7ea7e25aa0fe59801ec30a56501e56
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber24e3d70b86ed54d0b22c3450b960984e
    Version3

    Imports

    Expand
    • ntoskrnl.exe
    • HAL.dll
    • CLASSPNP.SYS
    • SCSIPORT.SYS

    Imported Functions

    Expand
    • KeWaitForSingleObject
    • KeReleaseSemaphore
    • KeStackAttachProcess
    • KeUnstackDetachProcess
    • RtlSubAuthoritySid
    • RtlInitializeSid
    • ExAllocatePoolWithTag
    • RtlLengthRequiredSid
    • ExFreePoolWithTag
    • RtlSetDaclSecurityDescriptor
    • RtlCreateSecurityDescriptor
    • RtlAddAccessAllowedAce
    • RtlCreateAcl
    • ObfDereferenceObject
    • ZwSetEvent
    • ZwClose
    • ZwRequestWaitReplyPort
    • ProbeForWrite
    • ZwFreeVirtualMemory
    • ZwAllocateVirtualMemory
    • ObOpenObjectByPointer
    • PsProcessType
    • memmove
    • ZwConnectPort
    • RtlInitUnicodeString
    • RtlUnicodeStringToInteger
    • ZwCreateSection
    • ZwWaitForSingleObject
    • ZwOpenEvent
    • ObfReferenceObject
    • IoGetCurrentProcess
    • PsGetProcessExitTime
    • MmSectionObjectType
    • DbgPrint
    • memset
    • MmIsAddressValid
    • ExInitializeResourceLite
    • ExDeleteResourceLite
    • ZwWriteFile
    • ZwReadFile
    • ZwQueryInformationFile
    • ZwSetInformationFile
    • ZwCreateFile
    • swprintf
    • towupper
    • _wcsnicmp
    • KeInitializeEvent
    • _snprintf
    • PsGetCurrentProcessId
    • RtlTimeToTimeFields
    • ExSystemTimeToLocalTime
    • KeQuerySystemTime
    • ZwCreateKey
    • ZwCreateEvent
    • KeWaitForMultipleObjects
    • ObReferenceObjectByHandle
    • ZwNotifyChangeKey
    • PsGetCurrentThreadId
    • _vsnprintf
    • KeSetPriorityThread
    • PsTerminateSystemThread
    • PsCreateSystemThread
    • KeNumberProcessors
    • ZwQueryInformationProcess
    • PsLookupProcessByProcessId
    • KeDelayExecutionThread
    • ZwOpenDirectoryObject
    • PsSetCreateProcessNotifyRoutine
    • ZwQuerySystemInformation
    • ZwQueryDirectoryFile
    • ZwQueryDirectoryObject
    • ZwDuplicateObject
    • ZwOpenKey
    • ZwEnumerateKey
    • ZwEnumerateValueKey
    • ZwQueryValueKey
    • ZwDeleteValueKey
    • ZwDeleteKey
    • ExGetPreviousMode
    • ZwTerminateProcess
    • ZwOpenProcess
    • ZwQueryKey
    • ZwSetValueKey
    • MmHighestUserAddress
    • IoFreeIrp
    • IoFreeMdl
    • MmUnlockPages
    • KeInitializeSemaphore
    • _strnicmp
    • RtlQueryRegistryValues
    • RtlAppendUnicodeToString
    • mbstowcs
    • ZwQuerySymbolicLinkObject
    • ZwOpenSymbolicLinkObject
    • NtClose
    • ZwSetInformationObject
    • _stricmp
    • ZwUnmapViewOfSection
    • ZwMapViewOfSection
    • ZwOpenFile
    • RtlEqualUnicodeString
    • IoFileObjectType
    • IoCreateFile
    • IofCallDriver
    • IoAllocateIrp
    • MmBuildMdlForNonPagedPool
    • IoAllocateMdl
    • ProbeForRead
    • PsGetVersion
    • MmGetSystemRoutineAddress
    • RtlCopyUnicodeString
    • RtlCompareMemory
    • _snwprintf
    • RtlImageNtHeader
    • RtlFreeUnicodeString
    • RtlAnsiStringToUnicodeString
    • RtlInitAnsiString
    • strrchr
    • ZwQueryVolumeInformationFile
    • ObReferenceObjectByPointer
    • ObQueryNameString
    • IoBuildDeviceIoControlRequest
    • IofCompleteRequest
    • ExEventObjectType
    • _allmul
    • IoDeleteDevice
    • IoDeleteSymbolicLink
    • IoCreateSymbolicLink
    • IoGetDeviceObjectPointer
    • RtlUpperChar
    • RtlCompareUnicodeString
    • strncpy
    • KeServiceDescriptorTable
    • NtOpenProcess
    • ObOpenObjectByName
    • IoDriverObjectType
    • RtlAppendUnicodeStringToString
    • NtQueryInformationProcess
    • PsIsThreadTerminating
    • PsThreadType
    • KeAddSystemServiceTable
    • ZwQueryObject
    • ZwQuerySecurityObject
    • ObInsertObject
    • _allrem
    • IoReleaseVpbSpinLock
    • IoAcquireVpbSpinLock
    • SeCreateAccessState
    • IoGetFileObjectGenericMapping
    • RtlUpcaseUnicodeString
    • ObCreateObject
    • _allshr
    • MmUnmapIoSpace
    • MmGetPhysicalAddress
    • MmFreeContiguousMemory
    • MmAllocateContiguousMemory
    • MmMapIoSpace
    • KeTickCount
    • KeBugCheckEx
    • RtlUnwind
    • KeClearEvent
    • KePulseEvent
    • KeSetEvent
    • wcsrchr
    • memcpy
    • ZwSetSecurityObject
    • IoDeviceObjectType
    • IoCreateDevice
    • RtlGetDaclSecurityDescriptor
    • RtlGetSaclSecurityDescriptor
    • RtlGetGroupSecurityDescriptor
    • RtlGetOwnerSecurityDescriptor
    • RtlLengthSecurityDescriptor
    • SeCaptureSecurityDescriptor
    • SeExports
    • IoIsWdmVersionAvailable
    • RtlLengthSid
    • wcschr
    • RtlAbsoluteToSelfRelativeSD
    • wcsncpy
    • ExReleaseResourceLite
    • ExAcquireResourceExclusiveLite
    • ExAcquireResourceSharedLite
    • ExReleaseFastMutexUnsafe
    • KeLeaveCriticalRegion
    • KeEnterCriticalRegion
    • ExAcquireFastMutexUnsafe
    • _purecall
    • IoBuildAsynchronousFsdRequest
    • KeGetCurrentThread
    • KeRaiseIrqlToDpcLevel
    • KfLowerIrql
    • ExReleaseFastMutex
    • ExAcquireFastMutex
    • ClassInitialize
    • ScsiPortReadPortBufferUshort
    • ScsiPortReadPortUchar
    • ScsiPortWritePortUchar
    • ScsiPortStallExecution
    • ScsiPortWritePortBufferUshort

    Exported Functions

    Expand
    • ??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
    • ??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
    • ??0CBlobConfig@@QAE@ABV0@@Z
    • ??0CBlobConfig@@QAE@K@Z
    • ??0CContext@@QAE@ABV0@@Z
    • ??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
    • ??0CContextList@@QAE@ABV0@@Z
    • ??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CDebugLog@@QAE@ABV0@@Z
    • ??0CDebugLog@@QAE@PBG@Z
    • ??0CDelayLoadThread@@QAE@ABV0@@Z
    • ??0CDelayLoadThread@@QAE@XZ
    • ??0CExclusionExtConfig@@QAE@ABV0@@Z
    • ??0CExclusionExtConfig@@QAE@KKE@Z
    • ??0CExclusionFileNameConfig@@QAE@ABV0@@Z
    • ??0CExclusionFileNameConfig@@QAE@KK@Z
    • ??0CExclusionFilePathConfig@@QAE@ABV0@@Z
    • ??0CExclusionFilePathConfig@@QAE@KK@Z
    • ??0CExclusionFolderConfig@@QAE@ABV0@@Z
    • ??0CExclusionFolderConfig@@QAE@KK@Z
    • ??0CExclusionRegistryConfig@@QAE@ABV0@@Z
    • ??0CExclusionRegistryConfig@@QAE@KK@Z
    • ??0CFile@@QAE@ABV0@@Z
    • ??0CFile@@QAE@E@Z
    • ??0CFileExtension@@QAE@ABV0@@Z
    • ??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
    • ??0CKEvent@@QAE@ABV0@@Z
    • ??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
    • ??0CList@@QAE@ABV0@@Z
    • ??0CList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CLockEvent@@QAE@ABV0@@Z
    • ??0CLockEvent@@QAE@XZ
    • ??0CLockList@@QAE@ABV0@@Z
    • ??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
    • ??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
    • ??0CMemoryAllocator@@QAE@ABV0@@Z
    • ??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
    • ??0CMemoryPoolAllocator@@QAE@ABV0@@Z
    • ??0CModuleConfig@@QAE@ABV0@@Z
    • ??0CModuleConfig@@QAE@XZ
    • ??0CModuleConfigList@@QAE@ABV0@@Z
    • ??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CModuleFileExtConfig@@QAE@ABV0@@Z
    • ??0CModuleFileExtConfig@@QAE@KKE@Z
    • ??0CModuleFlagConfig@@QAE@ABV0@@Z
    • ??0CModuleFlagConfig@@QAE@K@Z
    • ??0CModuleMultiStringConfig@@QAE@ABV0@@Z
    • ??0CModuleMultiStringConfig@@QAE@KK@Z
    • ??0CModuleStringConfig@@QAE@ABV0@@Z
    • ??0CModuleStringConfig@@QAE@K@Z
    • ??0CNoLockList@@QAE@ABV0@@Z
    • ??0CNoLockList@@QAE@KKPAVIMemoryAllocator@@@Z
    • ??0CSmartLock@@QAE@AAVCLockEvent@@@Z
    • ??0CSmartLock@@QAE@XZ
    • ??0CSmartReference@@QAE@AAJ@Z
    • ??0CSmartReference@@QAE@AAK@Z
    • ??0CSmartResource@@QAE@AAVCResource@@E@Z
    • ??0CStrList@@QAE@ABV0@@Z
    • ??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CSystemThread@@QAE@ABV0@@Z
    • ??0CSystemThread@@QAE@K@Z
    • ??0CUserFuncAdapterJob@@QAE@ABV0@@Z
    • ??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z0@Z
    • ??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
    • ??0CWorkerThread@@QAE@ABV0@@Z
    • ??0CWorkerThreadJob@@QAE@ABV0@@Z
    • ??0CWorkerThreadJob@@QAE@E@Z
    • ??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
    • ??0CWorkerThreadJobQueue@@QAE@K@Z
    • ??0CWorkerThreadPool@@QAE@ABV0@@Z
    • ??0CWorkerThreadPool@@QAE@K@Z
    • ??0IMemoryAllocator@@QAE@ABV0@@Z
    • ??0IMemoryAllocator@@QAE@XZ
    • ??1CAutoUpdateConfigThread@@UAE@XZ
    • ??1CBlobConfig@@UAE@XZ
    • ??1CContext@@UAE@XZ
    • ??1CContextList@@UAE@XZ
    • ??1CDebugLog@@UAE@XZ
    • ??1CDelayLoadThread@@UAE@XZ
    • ??1CExclusionExtConfig@@UAE@XZ
    • ??1CExclusionFileNameConfig@@UAE@XZ
    • ??1CExclusionFilePathConfig@@UAE@XZ
    • ??1CExclusionFolderConfig@@UAE@XZ
    • ??1CExclusionRegistryConfig@@UAE@XZ
    • ??1CFile@@UAE@XZ
    • ??1CFileExtension@@UAE@XZ
    • ??1CKEvent@@UAE@XZ
    • ??1CList@@UAE@XZ
    • ??1CLockEvent@@UAE@XZ
    • ??1CLockList@@UAE@XZ
    • ??1CMemoryAllocator@@UAE@XZ
    • ??1CMemoryPoolAllocator@@UAE@XZ
    • ??1CModuleConfig@@UAE@XZ
    • ??1CModuleConfigList@@UAE@XZ
    • ??1CModuleFileExtConfig@@UAE@XZ
    • ??1CModuleFlagConfig@@UAE@XZ
    • ??1CModuleMultiStringConfig@@UAE@XZ
    • ??1CModuleStringConfig@@UAE@XZ
    • ??1CNoLockList@@UAE@XZ
    • ??1CSmartLock@@QAE@XZ
    • ??1CSmartReference@@QAE@XZ
    • ??1CSmartResource@@QAE@XZ
    • ??1CStrList@@UAE@XZ
    • ??1CSystemThread@@UAE@XZ
    • ??1CUserFuncAdapterJob@@UAE@XZ
    • ??1CWorkerThread@@UAE@XZ
    • ??1CWorkerThreadJob@@UAE@XZ
    • ??1CWorkerThreadJobQueue@@UAE@XZ
    • ??1CWorkerThreadPool@@UAE@XZ
    • ??1IMemoryAllocator@@UAE@XZ
    • ??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
    • ??2CMemoryAllocator@@SGPAXI@Z
    • ??2CMemoryPoolAllocator@@SGPAXI@Z
    • ??3@YAXPAX@Z
    • ??3IMemoryAllocator@@SGXPAX@Z
    • ??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
    • ??4CBlobConfig@@QAEAAV0@ABV0@@Z
    • ??4CContext@@QAEAAV0@ABV0@@Z
    • ??4CDebugLog@@QAEAAV0@ABV0@@Z
    • ??4CDelayLoadThread@@QAEAAV0@ABV0@@Z
    • ??4CFile@@QAEAAV0@ABV0@@Z
    • ??4CKEvent@@QAEAAV0@ABV0@@Z
    • ??4CLockEvent@@QAEAAV0@ABV0@@Z
    • ??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
    • ??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
    • ??4CModuleConfig@@QAEAAV0@ABV0@@Z
    • ??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
    • ??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
    • ??4CSmartLock@@QAEAAV0@ABV0@@Z
    • ??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
    • ??4CSmartResource@@QAEAAV0@ABV0@@Z
    • ??4CSystemThread@@QAEAAV0@ABV0@@Z
    • ??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
    • ??4CWorkerThread@@QAEAAV0@ABV0@@Z
    • ??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
    • ??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
    • ??_7CAutoUpdateConfigThread@@6B@
    • ??_7CBlobConfig@@6B@
    • ??_7CContext@@6B@
    • ??_7CContextList@@6B@
    • ??_7CDebugLog@@6B@
    • ??_7CDelayLoadThread@@6B@
    • ??_7CExclusionExtConfig@@6B@
    • ??_7CExclusionFileNameConfig@@6B@
    • ??_7CExclusionFilePathConfig@@6B@
    • ??_7CExclusionFolderConfig@@6B@
    • ??_7CExclusionRegistryConfig@@6B@
    • ??_7CFile@@6B@
    • ??_7CFileExtension@@6B@
    • ??_7CKEvent@@6B@
    • ??_7CList@@6B@
    • ??_7CLockEvent@@6B@
    • ??_7CLockList@@6B@
    • ??_7CMemoryAllocator@@6B@
    • ??_7CMemoryPoolAllocator@@6B@
    • ??_7CModuleConfig@@6B@
    • ??_7CModuleConfigList@@6B@
    • ??_7CModuleFileExtConfig@@6B@
    • ??_7CModuleFlagConfig@@6B@
    • ??_7CModuleMultiStringConfig@@6B@
    • ??_7CModuleStringConfig@@6B@
    • ??_7CNoLockList@@6B@
    • ??_7CStrList@@6B@
    • ??_7CSystemThread@@6B@
    • ??_7CUserFuncAdapterJob@@6B@
    • ??_7CWorkerThread@@6B@
    • ??_7CWorkerThreadJob@@6B@
    • ??_7CWorkerThreadJobQueue@@6B@
    • ??_7CWorkerThreadPool@@6B@
    • ??_7IMemoryAllocator@@6B@
    • ??_FCContextList@@QAEXXZ
    • ??_FCFile@@QAEXXZ
    • ??_FCFileExtension@@QAEXXZ
    • ??_FCModuleConfigList@@QAEXXZ
    • ??_FCStrList@@QAEXXZ
    • ??_FCSystemThread@@QAEXXZ
    • ??_FCWorkerThread@@QAEXXZ
    • ??_FCWorkerThreadJob@@QAEXXZ
    • ??_FCWorkerThreadJobQueue@@QAEXXZ
    • ??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
    • ??_V@YAXPAX@Z
    • ?Acquire@CLockEvent@@QAEXXZ
    • ?Add@CContextList@@QAEEPAVCContext@@@Z
    • ?Add@CFileExtension@@QAEEPBGK@Z
    • ?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
    • ?Add@CStrList@@QAEEPBG@Z
    • ?AddNode@CLockList@@UAEEQAXE@Z
    • ?AddNode@CNoLockList@@UAEEQAXE@Z
    • ?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
    • ?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
    • ?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
    • ?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
    • ?Cancel@CWorkerThreadJob@@QAEXXZ
    • ?CheckNode@CLockList@@UAEHQAX@Z
    • ?CheckNode@CNoLockList@@UAEHQAX@Z
    • ?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
    • ?Cleanup@CBlobConfig@@AAEXXZ
    • ?Cleanup@CModuleFileExtConfig@@IAEXXZ
    • ?Cleanup@CModuleMultiStringConfig@@IAEXXZ
    • ?Cleanup@CModuleStringConfig@@AAEXXZ
    • ?Close@CFile@@QAEJXZ
    • ?Count@CLockList@@QAEKXZ
    • ?Count@CNoLockList@@QAEKXZ
    • ?Create@CFile@@QAEJPBGKKKK@Z
    • ?Create@CSystemThread@@QAEEXZ
    • ?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
    • ?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
    • ?CreatePool@CWorkerThreadPool@@QAEEXZ
    • ?CreateThreads@CWorkerThreadPool@@QAEEK@Z
    • ?CreateWIRP@CFile@@QAEJPBGKKKK@Z
    • ?Delete@CFile@@QAEJXZ
    • ?Delete@CFileExtension@@QAEEPBGK@Z
    • ?Delete@CStrList@@QAEEPBG@Z
    • ?DeleteAll@CList@@UAEXXZ
    • ?DeleteAll@CLockList@@UAEXXZ
    • ?DeleteAll@CNoLockList@@UAEXXZ
    • ?DeleteNode@CContextList@@MAEXPAX@Z
    • ?DeleteNode@CList@@UAEXPAX@Z
    • ?DeleteNode@CModuleConfigList@@MAEXPAX@Z
    • ?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
    • ?DisableWriteProtectFromCR0@@YGXPAPAX@Z
    • ?DoIt@CWorkerThreadJob@@QAEJXZ
    • ?EntryPoint@CSystemThread@@KGXPAX@Z
    • ?Find@CContextList@@QAEPAVCContext@@K@Z
    • ?Find@CContextList@@QAEPAVCContext@@PAX@Z
    • ?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
    • ?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
    • ?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
    • ?FindNode@CContextList@@IAEPAXPAX@Z
    • ?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
    • ?First@CList@@UAEPAXXZ
    • ?First@CLockList@@UAEPAXXZ
    • ?First@CNoLockList@@UAEPAXXZ
    • ?Free@CMemoryAllocator@@UAEXPAX@Z
    • ?Free@CMemoryPoolAllocator@@UAEXPAX@Z
    • ?GetAttributes@CFile@@QAEKXZ
    • ?GetBasicInfomration@CFile@@IAEJXZ
    • ?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
    • ?GetCategory@CContext@@QAEKXZ
    • ?GetData@CBlobConfig@@QAEHPAXPAK@Z
    • ?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
    • ?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
    • ?GetData@CModuleFlagConfig@@QAEKXZ
    • ?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
    • ?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
    • ?GetData@CModuleStringConfig@@QAEPAGXZ
    • ?GetData@CStrList@@QAEEPAGPAK@Z
    • ?GetDataType@CModuleConfig@@QAEKXZ
    • ?GetEngineContext@CContext@@QAEPAXXZ
    • ?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
    • ?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
    • ?GetFlagConfig@CContext@@UAEJKPAK@Z
    • ?GetID@CModuleConfig@@QAEKXZ
    • ?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
    • ?GetLength@CModuleStringConfig@@QAEKXZ
    • ?GetLinkContext@CContext@@QAEPAXXZ
    • ?GetLogFlag@CDebugLog@@QAEKXZ
    • ?GetModuleId@CModuleConfig@@QAEKXZ
    • ?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
    • ?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
    • ?GetReportCallBackRoutine@CContext@@QAEKXZ
    • ?GetSize@CBlobConfig@@QAEKXZ
    • ?GetStringConfig@CContext@@QAEPAGK@Z
    • ?GetStringConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetThreadCount@CWorkerThreadPool@@QAEKXZ
    • ?GetThreadID@CSystemThread@@QAEKXZ
    • ?GetType@CContext@@QAEKXZ
    • ?GetUserParameter@CContext@@QAEKXZ
    • ?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
    • ?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
    • ?InitializeFlagConfig@CContext@@QAEHKK@Z
    • ?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
    • ?InitializeStringConfig@CContext@@QAEHKPBG@Z
    • ?Insert@CList@@UAEXQAXE@Z
    • ?Insert@CLockList@@UAEXQAXE@Z
    • ?Insert@CNoLockList@@UAEXQAXE@Z
    • ?InsertAfter@CList@@UAEXPAX0@Z
    • ?InsertBefore@CList@@UAEXPAX0@Z
    • ?Instance@CWorkerThreadPool@@SGPAV1@XZ
    • ?IsEmpty@CList@@UAEEXZ
    • ?IsEmpty@CLockList@@UAEEXZ
    • ?IsEmpty@CNoLockList@@UAEEXZ
    • ?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
    • ?IsFull@CLockList@@QBEEXZ
    • ?IsFull@CNoLockList@@QBEEXZ
    • ?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
    • ?IsOpened@CFile@@QAEEXZ
    • ?IsTerminated@CWorkerThreadPool@@QAEEXZ
    • ?IsValid@CMemoryAllocator@@UAEEXZ
    • ?IsValid@CMemoryPoolAllocator@@UAEEXZ
    • ?IsValid@IMemoryAllocator@@UAEEXZ
    • ?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
    • ?JobFunction@CUserFuncAdapterJob@@MAEXXZ
    • ?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
    • ?Limit@CLockList@@QAEKXZ
    • ?Limit@CNoLockList@@QAEKXZ
    • ?MatchAllExtensions@CFileExtension@@QAEEXZ
    • ?MatchNoExtensions@CFileExtension@@QAEEXZ
    • ?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
    • ?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
    • ?NeedDelete@CWorkerThreadJob@@QAEEXZ
    • ?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
    • ?NewNode@CList@@UAEPAXXZ
    • ?NewNode@CStrList@@EAEPAXXZ
    • ?NewNodeVariant@CList@@IAEPAXK@Z
    • ?Next@CList@@UBEPAXQAX@Z
    • ?Next@CLockList@@UBEPAXQAX@Z
    • ?Next@CNoLockList@@UBEPAXQAX@Z
    • ?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
    • ?NotityTerminate@CWorkerThread@@QAEXXZ
    • ?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
    • ?Pulse@CKEvent@@QAEJJE@Z
    • ?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
    • ?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
    • ?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
    • ?Read@CFile@@QAEJPADKPAK@Z
    • ?ReferenceCount@CContext@@QAEAAKXZ
    • ?Release@CLockEvent@@QAEXXZ
    • ?Remove@CContextList@@UAEEQAX@Z
    • ?Remove@CList@@UAEEQAX@Z
    • ?Remove@CLockList@@UAEEQAX@Z
    • ?Remove@CNoLockList@@UAEEQAX@Z
    • ?RemoveHead@CList@@UAEPAXXZ
    • ?RemoveHead@CLockList@@UAEPAXXZ
    • ?RemoveHead@CNoLockList@@UAEPAXXZ
    • ?RemoveTail@CList@@UAEPAXXZ
    • ?RemoveTail@CLockList@@UAEPAXXZ
    • ?RemoveTail@CNoLockList@@UAEPAXXZ
    • ?Reset@CKEvent@@QAEXXZ
    • ?RestoreCR0@@YGXPAX@Z
    • ?Run@CAutoUpdateConfigThread@@UAEXXZ
    • ?Run@CDelayLoadThread@@UAEXXZ
    • ?Run@CWorkerThread@@UAEXXZ
    • ?SeekToEnd@CFile@@QAEJXZ
    • ?Set@CKEvent@@QAEJJE@Z
    • ?SetAttributes@CFile@@QAEJK@Z
    • ?SetBlobCofig@CContext@@UAEJKPAXK@Z
    • ?SetData@CBlobConfig@@QAEHPAXK@Z
    • ?SetData@CModuleFileExtConfig@@QAEHPBG@Z
    • ?SetData@CModuleFlagConfig@@QAEHK@Z
    • ?SetData@CModuleMultiStringConfig@@QAEHPBG@Z
    • ?SetData@CModuleStringConfig@@QAEHPBG@Z
    • ?SetEngineContext@CContext@@QAEXPAX@Z
    • ?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
    • ?SetFlagConfig@CContext@@UAEJKK@Z
    • ?SetLinkContext@CContext@@QAEXPAX@Z
    • ?SetLogFlag@CDebugLog@@QAEEK@Z
    • ?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
    • ?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
    • ?SetMultiStringConfig@CContext@@UAEJKPBG@Z
    • ?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
    • ?SetPriority@CSystemThread@@QAEXK@Z
    • ?SetStopUse@CContext@@QAEXXZ
    • ?SetStringConfig@CContext@@UAEJKPBG@Z
    • ?Setup@CSystemThread@@MAEXXZ
    • ?StopUse@CContext@@QAEHXZ
    • ?TearDown@CSystemThread@@MAEXXZ
    • ?Terminate@CSystemThread@@QAEXE@Z
    • ?Terminate@CWorkerThreadPool@@QAEEXZ
    • ?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
    • ?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
    • ?WaitFinish@CWorkerThreadJob@@QAEXXZ
    • ?WaitForReady@CDelayLoadThread@@QAEEXZ
    • ?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
    • ?Write@CDebugLog@@QAAXPBDZZ
    • ?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
    • ?WriteSystemInformation@CDebugLog@@QAEXXZ
    • ?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
    • ?WriteToFile@CDebugLog@@IAEXPADK@Z
    • ?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
    • ?_pPagedAllocator@@3PAVCMemoryAllocator@@A
    • ?m_lpInstance@CWorkerThreadPool@@1PAV1@A
    • ?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
    • _DeInitKmLPC@0
    • _GetModuleInfoByAddress@8
    • _GetModuleInfoByModuleName@8
    • _InitKmLPC@0
    • _KmCallUm@8
    • _KmCallUmEx@12
    • _ModGetExportProcAddress@8
    • _ModLoadDLLToBuffer@4
    • _ModLoadDLLToBufferWithImageSize@8
    • _ModLoadModule@8
    • _ModUnLoadModule@4
    • _NormalizeFileName@4
    • _NormalizeFullNtPathToDosName@4
    • _TmCommConfigRoutine@4
    • _UtilAddDeviceInDriveTable@4
    • _UtilCleanFileReadOnly@4
    • _UtilDeleteFileForce@4
    • _UtilGetFileObjectForProcessByEPROC@8
    • _UtilGetFileObjectFromFileName@12
    • _UtilGetProcessName@12
    • _UtilGetSystemDirectory@4
    • _UtilGetSystemTime@4
    • _UtilIoSetFileInfo@24
    • _UtilIopCreateFileIRP@40
    • _UtilKeGetLowFileDevice@16
    • _UtilModuleIATHook@24
    • _UtilModuleIATUnHook@8
    • _UtilQueryKeyValue@24
    • _UtilRemoveDeviceFromDriveTable@4
    • _UtilVolumeDeviceToDosName@8
    • _UtilWaitValueChangeToZero@8
    • _UtilWriteVersionToRegistry@8
    • _UtilbuildDynamicDiskMappingTable@0
    • __UtilDosPathNameToNtPathName@12

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • PAGE
    • .edata
    • INIT
    • .rsrc
    • .reloc

    Signature

    Expand
    {
      "Certificates": [
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
          "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
          "TBS": {
            "MD5": "d0785ad36e427c92b19f6826ab1e8020",
            "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
            "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
            "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
          },
          "ValidFrom": "2012-12-21 00:00:00",
          "ValidTo": "2020-12-30 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
          "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
          "TBS": {
            "MD5": "e9d38360b914c8863f6cba3ee58764d3",
            "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
            "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
            "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
          },
          "ValidFrom": "2012-10-18 00:00:00",
          "ValidTo": "2020-12-29 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
          "TBS": {
            "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
            "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
            "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
            "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
          },
          "ValidFrom": "2017-04-27 00:00:00",
          "ValidTo": "2018-07-16 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "611993e400000000001c",
          "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
          "TBS": {
            "MD5": "78a717e082dcc1cda3458d917e677d14",
            "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
            "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
            "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
          },
          "ValidFrom": "2011-02-22 19:25:17",
          "ValidTo": "2021-02-22 19:35:17",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
          "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "TBS": {
            "MD5": "b30c31a572b0409383ed3fbe17e56e81",
            "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
            "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
            "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
          },
          "ValidFrom": "2010-02-08 00:00:00",
          "ValidTo": "2020-02-07 23:59:59",
          "Version": 3
        }
      ],
      "CertificatesInfo": "",
      "Signer": [
        {
          "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Version": 1
        }
      ],
      "SignerInfo": ""
    }
    

    PropertyValue
    FilenameTmComm.sys
    Creation Timestamp2013-12-09 05:00:06
    MD5569676d3d45b0964ac6dd0815be8ff8c
    SHA158b31fb2b623bd2c5d5c8c49b657a14a674664a4
    SHA25676e807b6c0214e66455f09a8de8faad40b738982ca84470f0043de0290449524
    Authentihash MD56d3193458659666e4c86ec1b9fb06bf9
    Authentihash SHA1ef123d041e10d8a0b22786f6e471d0c18bc13167
    Authentihash SHA25683a67b544982a2fd1484af752cc4ab2f6c0b50cb3c9dba60b888c2c2e37d1036
    RichPEHeaderHash MD5db8673928b63031dda3b7e6b364d7157
    RichPEHeaderHash SHA1c7c04144287b50a964c97c1c0c43c141d3b53037
    RichPEHeaderHash SHA25670cca01aa262b7adf0baef899d17c4cbd896bf51543e6b22d4175db6bd26a838
    CompanyTrend Micro Inc.
    DescriptionTrendMicro Common Module
    ProductTrend Micro Eyes
    OriginalFilenameTmComm.sys

    Download

    Certificates

    Expand
    Certificate 478a8efb59e1d83f0ce142d2a28707be
    FieldValue
    ToBeSigned (TBS) MD5f13ede9179075999ef7f856ec31e364b
    ToBeSigned (TBS) SHA12f09867166e6107e17808317f5c8d4ee157f45bc
    ToBeSigned (TBS) SHA256089a2c4c6ac7432020acdb65c33bf39130da6f37c002ba79128bd4c94e4fa101
    SubjectC=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO Time Stamping Signer
    ValidFrom2010-05-10 00:00:00
    ValidTo2015-05-10 23:59:59
    Signaturec8fb63f80b75752c3af1f213a72db6a31a9cad0107d3348e77e0c26eae025d484fa4d221b636fd2a35437c6bdf80870b15f0763200b4ceb567a42f2f201b9c549e833f1f5f149562820f2241221f70b3f3f742de6c51cd4bf821ac9b3b8cb1e5e6288fce2a8af9aa524d8c5b77ba4d5a58dbbb6a04cc521e9de228370ebbe70e91c7f8dbf18198ebcd37b30eab65d362ec3aa576eb13a83593c92e0a01ecc0e8cc3d7eb6ebe2c1ecd3149282668750dcfd5097acb34a767306c486113ab35f4304526feab3d074364ccaf11b7984377063ad74b9aa0ef398b08608ebdbe01f8c10f239649bae4f0a2c928a4f18b591e58d1a935f1faef1a6f02e97d0d2f62b3c
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber478a8efb59e1d83f0ce142d2a28707be
    Version3
    Certificate 4d6290e58c54f0f1eb17341a1310e6a4
    FieldValue
    ToBeSigned (TBS) MD5b7d8444a70054990435f35a5630df5e1
    ToBeSigned (TBS) SHA14678c6e4a8787a8e6ed2bce8792b122f6c08afd8
    ToBeSigned (TBS) SHA2560a8b4b359ea7890b358e56e436e9cfc6f32b037b2599b597ca7f7a80d475ec98
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
    ValidFrom2010-09-30 00:00:00
    ValidTo2014-01-01 23:59:59
    Signatureaedd211d5f8f807ad25209eadb6ed25d8be8c21b6904be51a5010e59fa37d174a3eedced89742b62d5a6bf4fad361754f013e0a345d24c26cbe26da21fd01e7a070fb6b37b6f5068a2e931b3b7997d8070a0a7de0b1ea4fff34d811bdd20c91cc4afcff18ffad9da95f0ecdc5cbfe88c5a3e7ab0a3eb59437411e09b1a6af36f
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber4d6290e58c54f0f1eb17341a1310e6a4
    Version3
    Certificate 610c120600000000001b
    FieldValue
    ToBeSigned (TBS) MD553c41bc1164e09e0cd1617a5bf913efd
    ToBeSigned (TBS) SHA193c03aac8951d494ecd5696b1c08658541b18727
    ToBeSigned (TBS) SHA25640bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b
    SubjectC=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
    ValidFrom2006-05-23 17:01:29
    ValidTo2016-05-23 17:11:29
    Signature01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber610c120600000000001b
    Version3
    Certificate 1a9d178ad334acdf47c8a0d15bb50e6e
    FieldValue
    ToBeSigned (TBS) MD5685d99029d38a9d263ea82cd02a49f6c
    ToBeSigned (TBS) SHA193464d8f54b4ee7caf22ca1db15a4211e0d3c79e
    ToBeSigned (TBS) SHA256894991f1477dff88c7c0707531073bb59483750bcad672fc388179affca07aa9
    SubjectC=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=Trend Micro, Inc.
    ValidFrom2013-01-17 00:00:00
    ValidTo2014-03-18 23:59:59
    Signature65c7e1e0f4051179852b819153b528c88db47ef50e897cd8ce0d03a7cc2dc896c89790410182186fecaf9da5c317bf57b5038311c10c2ec5ddb5c18165a7e92f92a6f39c042262126c714337a7c528041a04679217c1475a30231c967ca63b4430ccea52fe4f16fabb5c454d2aa8cdde347b8beaa973d76b3f9ba99d2597939a33d67ec4abc3974ef3792b8bc90d092cce62309d205129bbcbd3554382f24b2911b4904b09e7f52f24f2cc5a52fa49f3a163c32fde076e917301f22dd45d643b95319bae922bc861e5a8f90d4dd72603c7b1ea0229eca869ab8d086ae5286baeba9b99a12856dc1d3cd9f6d9da4b8d5a85896ba4587d8eba506a4fbba4a7bb49
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber1a9d178ad334acdf47c8a0d15bb50e6e
    Version3

    Imports

    Expand
    • ntoskrnl.exe
    • HAL.dll
    • CLASSPNP.SYS

    Imported Functions

    Expand
    • wcsrchr
    • KeSetEvent
    • KePulseEvent
    • KeClearEvent
    • KeStackAttachProcess
    • KeUnstackDetachProcess
    • ObfDereferenceObject
    • ZwSetEvent
    • ZwClose
    • ZwConnectPort
    • RtlInitUnicodeString
    • RtlUnicodeStringToInteger
    • ZwCreateSection
    • ZwWaitForSingleObject
    • ZwOpenEvent
    • IoGetCurrentProcess
    • ObfReferenceObject
    • DbgBreakPoint
    • ZwRequestWaitReplyPort
    • ExFreePoolWithTag
    • ProbeForWrite
    • ZwFreeVirtualMemory
    • ZwAllocateVirtualMemory
    • ObOpenObjectByPointer
    • PsProcessType
    • memmove
    • PsGetProcessExitTime
    • MmSectionObjectType
    • PsThreadType
    • ObReleaseObjectSecurity
    • SeReleaseSubjectContext
    • SeAccessCheck
    • SeCaptureSubjectContext
    • ObGetObjectSecurity
    • DbgPrint
    • memset
    • MmIsAddressValid
    • ExInitializeResourceLite
    • ExDeleteResourceLite
    • ZwWriteFile
    • ZwReadFile
    • ZwQueryInformationFile
    • ZwSetInformationFile
    • ZwCreateFile
    • swprintf
    • towupper
    • _wcsnicmp
    • ExAllocatePoolWithTag
    • KeInitializeEvent
    • _snprintf
    • PsGetCurrentProcessId
    • RtlTimeToTimeFields
    • ExSystemTimeToLocalTime
    • KeQuerySystemTime
    • PsGetCurrentThreadId
    • RtlInitAnsiString
    • ZwDeviceIoControlFile
    • ZwCreateKey
    • ZwCreateEvent
    • KeWaitForMultipleObjects
    • ObReferenceObjectByHandle
    • ZwNotifyChangeKey
    • _vsnprintf
    • RtlFreeUnicodeString
    • RtlAnsiStringToUnicodeString
    • RtlEqualUnicodeString
    • RtlAppendUnicodeStringToString
    • RtlCopyUnicodeString
    • RtlUpcaseUnicodeChar
    • KeWaitForSingleObject
    • KeSetPriorityThread
    • PsTerminateSystemThread
    • PsCreateSystemThread
    • KeDelayExecutionThread
    • KeNumberProcessors
    • ZwQueryInformationProcess
    • PsLookupProcessByProcessId
    • ZwOpenDirectoryObject
    • PsSetCreateProcessNotifyRoutine
    • ZwQuerySystemInformation
    • ZwQueryDirectoryFile
    • ZwQueryDirectoryObject
    • ZwDuplicateObject
    • ZwOpenKey
    • ZwEnumerateKey
    • ZwEnumerateValueKey
    • ZwQueryValueKey
    • ZwDeleteValueKey
    • ZwDeleteKey
    • ExGetPreviousMode
    • ZwTerminateProcess
    • ZwOpenProcess
    • ZwQueryKey
    • ZwSetValueKey
    • IoFileObjectType
    • _allrem
    • memcpy
    • IoFreeIrp
    • IoFreeMdl
    • MmUnlockPages
    • IoBuildAsynchronousFsdRequest
    • _strnicmp
    • _purecall
    • RtlAppendUnicodeToString
    • mbstowcs
    • ZwQuerySymbolicLinkObject
    • ZwOpenSymbolicLinkObject
    • NtClose
    • ObQueryNameString
    • MmGetSystemRoutineAddress
    • ZwSetInformationObject
    • _stricmp
    • ZwUnmapViewOfSection
    • ZwMapViewOfSection
    • ZwOpenFile
    • IoCreateFile
    • IofCallDriver
    • IoAllocateIrp
    • MmBuildMdlForNonPagedPool
    • IoAllocateMdl
    • ProbeForRead
    • PsGetVersion
    • RtlCompareMemory
    • _snwprintf
    • MmSystemRangeStart
    • RtlImageNtHeader
    • wcsncmp
    • strrchr
    • ZwQueryVolumeInformationFile
    • ObReferenceObjectByPointer
    • IoBuildDeviceIoControlRequest
    • ZwOpenSection
    • _allmul
    • KeReleaseSemaphore
    • RtlLengthRequiredSid
    • RtlInitializeSid
    • RtlSubAuthoritySid
    • RtlSetDaclSecurityDescriptor
    • RtlCreateSecurityDescriptor
    • RtlAddAccessAllowedAce
    • RtlCreateAcl
    • KeInitializeSemaphore
    • IofCompleteRequest
    • ExEventObjectType
    • IoDeleteDevice
    • IoDeleteSymbolicLink
    • IoCreateSymbolicLink
    • IoGetDeviceObjectPointer
    • RtlUpperChar
    • ObReferenceObjectByName
    • IoDriverObjectType
    • RtlCompareUnicodeString
    • strncpy
    • KeServiceDescriptorTable
    • NtOpenProcess
    • ObOpenObjectByName
    • NtQueryInformationProcess
    • PsIsThreadTerminating
    • KeAddSystemServiceTable
    • ZwQueryObject
    • ZwQuerySecurityObject
    • ObInsertObject
    • IoReleaseVpbSpinLock
    • IoAcquireVpbSpinLock
    • SeCreateAccessState
    • IoGetFileObjectGenericMapping
    • ObCreateObject
    • _allshr
    • ExInterlockedPopEntrySList
    • IoGetStackLimits
    • IoBuildSynchronousFsdRequest
    • wcsstr
    • RtlUpcaseUnicodeString
    • IoUnregisterPlugPlayNotification
    • FsRtlIsNameInExpression
    • IoGetConfigurationInformation
    • MmProbeAndLockPages
    • IoGetDeviceInterfaces
    • IoRegisterPlugPlayNotification
    • ExAllocatePool
    • RtlFreeAnsiString
    • RtlUnicodeStringToAnsiString
    • strncat
    • wcschr
    • wcsncat
    • wcstombs
    • KeTickCount
    • KeBugCheckEx
    • RtlUnwind
    • wcsncpy
    • ExReleaseResourceLite
    • ExAcquireResourceExclusiveLite
    • ExAcquireResourceSharedLite
    • ExReleaseFastMutexUnsafe
    • KeLeaveCriticalRegion
    • KeEnterCriticalRegion
    • MmHighestUserAddress
    • ExAcquireFastMutexUnsafe
    • ZwSetSecurityObject
    • IoDeviceObjectType
    • IoCreateDevice
    • RtlGetDaclSecurityDescriptor
    • RtlGetSaclSecurityDescriptor
    • RtlGetGroupSecurityDescriptor
    • RtlGetOwnerSecurityDescriptor
    • RtlLengthSecurityDescriptor
    • SeCaptureSecurityDescriptor
    • SeExports
    • IoIsWdmVersionAvailable
    • RtlLengthSid
    • RtlAbsoluteToSelfRelativeSD
    • RtlQueryRegistryValues
    • KeGetCurrentThread
    • KfAcquireSpinLock
    • KfReleaseSpinLock
    • KeRaiseIrqlToDpcLevel
    • KfLowerIrql
    • ExAcquireFastMutex
    • ExReleaseFastMutex
    • KeGetCurrentIrql
    • KfRaiseIrql
    • ClassInitialize

    Exported Functions

    Expand
    • ??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
    • ??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
    • ??0CBlobConfig@@QAE@ABV0@@Z
    • ??0CBlobConfig@@QAE@K@Z
    • ??0CContext@@QAE@ABV0@@Z
    • ??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
    • ??0CContextList@@QAE@ABV0@@Z
    • ??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CDebugLog@@QAE@ABV0@@Z
    • ??0CDebugLog@@QAE@PBG@Z
    • ??0CDebugLogEx@@QAE@ABV0@@Z
    • ??0CDebugLogEx@@QAE@K@Z
    • ??0CDelayLoadThread@@QAE@ABV0@@Z
    • ??0CDelayLoadThread@@QAE@XZ
    • ??0CExclusionExtConfig@@QAE@ABV0@@Z
    • ??0CExclusionExtConfig@@QAE@KKE@Z
    • ??0CExclusionFileNameConfig@@QAE@ABV0@@Z
    • ??0CExclusionFileNameConfig@@QAE@KK@Z
    • ??0CExclusionFilePathConfig@@QAE@ABV0@@Z
    • ??0CExclusionFilePathConfig@@QAE@KK@Z
    • ??0CExclusionFolderConfig@@QAE@ABV0@@Z
    • ??0CExclusionFolderConfig@@QAE@KK@Z
    • ??0CExclusionRegistryConfig@@QAE@ABV0@@Z
    • ??0CExclusionRegistryConfig@@QAE@KK@Z
    • ??0CFile@@QAE@ABV0@@Z
    • ??0CFile@@QAE@E@Z
    • ??0CFileExtension@@QAE@ABV0@@Z
    • ??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
    • ??0CInclusionExtConfig@@QAE@ABV0@@Z
    • ??0CInclusionExtConfig@@QAE@KKE@Z
    • ??0CInclusionFileNameConfig@@QAE@ABV0@@Z
    • ??0CInclusionFileNameConfig@@QAE@KK@Z
    • ??0CInclusionFilePathConfig@@QAE@ABV0@@Z
    • ??0CInclusionFilePathConfig@@QAE@KK@Z
    • ??0CInclusionFolderConfig@@QAE@ABV0@@Z
    • ??0CInclusionFolderConfig@@QAE@KK@Z
    • ??0CKEvent@@QAE@ABV0@@Z
    • ??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
    • ??0CList@@QAE@ABV0@@Z
    • ??0CList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CLockEvent@@QAE@ABV0@@Z
    • ??0CLockEvent@@QAE@XZ
    • ??0CLockList@@QAE@ABV0@@Z
    • ??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
    • ??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
    • ??0CMemoryAllocator@@QAE@ABV0@@Z
    • ??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
    • ??0CMemoryPoolAllocator@@QAE@ABV0@@Z
    • ??0CModuleConfig@@QAE@ABV0@@Z
    • ??0CModuleConfig@@QAE@XZ
    • ??0CModuleConfigList@@QAE@ABV0@@Z
    • ??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CModuleFileExtConfig@@QAE@ABV0@@Z
    • ??0CModuleFileExtConfig@@QAE@KKE@Z
    • ??0CModuleFlagConfig@@QAE@ABV0@@Z
    • ??0CModuleFlagConfig@@QAE@K@Z
    • ??0CModuleMultiStringConfig@@QAE@ABV0@@Z
    • ??0CModuleMultiStringConfig@@QAE@KK@Z
    • ??0CModuleStringConfig@@QAE@ABV0@@Z
    • ??0CModuleStringConfig@@QAE@K@Z
    • ??0CNoLockList@@QAE@ABV0@@Z
    • ??0CNoLockList@@QAE@KKPAVIMemoryAllocator@@@Z
    • ??0CSmartLock@@QAE@AAVCLockEvent@@@Z
    • ??0CSmartLock@@QAE@XZ
    • ??0CSmartReference@@QAE@AAJ@Z
    • ??0CSmartReference@@QAE@AAK@Z
    • ??0CSmartResource@@QAE@AAVCResource@@E@Z
    • ??0CStrList@@QAE@ABV0@@Z
    • ??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CSystemThread@@QAE@ABV0@@Z
    • ??0CSystemThread@@QAE@K@Z
    • ??0CUserFuncAdapterJob@@QAE@ABV0@@Z
    • ??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z01@Z
    • ??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
    • ??0CWorkerThread@@QAE@ABV0@@Z
    • ??0CWorkerThreadJob@@QAE@ABV0@@Z
    • ??0CWorkerThreadJob@@QAE@E@Z
    • ??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
    • ??0CWorkerThreadJobQueue@@QAE@K@Z
    • ??0CWorkerThreadPool@@QAE@ABV0@@Z
    • ??0CWorkerThreadPool@@QAE@K@Z
    • ??0CWorkerThreadPoolEx@@QAE@ABV0@@Z
    • ??0CWorkerThreadPoolEx@@QAE@KK@Z
    • ??0IMemoryAllocator@@QAE@ABV0@@Z
    • ??0IMemoryAllocator@@QAE@XZ
    • ??1CAutoUpdateConfigThread@@UAE@XZ
    • ??1CBlobConfig@@UAE@XZ
    • ??1CContext@@UAE@XZ
    • ??1CContextList@@UAE@XZ
    • ??1CDebugLog@@UAE@XZ
    • ??1CDebugLogEx@@UAE@XZ
    • ??1CDelayLoadThread@@UAE@XZ
    • ??1CExclusionExtConfig@@UAE@XZ
    • ??1CExclusionFileNameConfig@@UAE@XZ
    • ??1CExclusionFilePathConfig@@UAE@XZ
    • ??1CExclusionFolderConfig@@UAE@XZ
    • ??1CExclusionRegistryConfig@@UAE@XZ
    • ??1CFile@@UAE@XZ
    • ??1CFileExtension@@UAE@XZ
    • ??1CInclusionExtConfig@@UAE@XZ
    • ??1CInclusionFileNameConfig@@UAE@XZ
    • ??1CInclusionFilePathConfig@@UAE@XZ
    • ??1CInclusionFolderConfig@@UAE@XZ
    • ??1CKEvent@@UAE@XZ
    • ??1CList@@UAE@XZ
    • ??1CLockEvent@@UAE@XZ
    • ??1CLockList@@UAE@XZ
    • ??1CMemoryAllocator@@UAE@XZ
    • ??1CMemoryPoolAllocator@@UAE@XZ
    • ??1CModuleConfig@@UAE@XZ
    • ??1CModuleConfigList@@UAE@XZ
    • ??1CModuleFileExtConfig@@UAE@XZ
    • ??1CModuleFlagConfig@@UAE@XZ
    • ??1CModuleMultiStringConfig@@UAE@XZ
    • ??1CModuleStringConfig@@UAE@XZ
    • ??1CNoLockList@@UAE@XZ
    • ??1CSmartLock@@QAE@XZ
    • ??1CSmartReference@@QAE@XZ
    • ??1CSmartResource@@QAE@XZ
    • ??1CStrList@@UAE@XZ
    • ??1CSystemThread@@UAE@XZ
    • ??1CUserFuncAdapterJob@@UAE@XZ
    • ??1CWorkerThread@@UAE@XZ
    • ??1CWorkerThreadJob@@UAE@XZ
    • ??1CWorkerThreadJobQueue@@UAE@XZ
    • ??1CWorkerThreadPool@@UAE@XZ
    • ??1CWorkerThreadPoolEx@@UAE@XZ
    • ??1IMemoryAllocator@@UAE@XZ
    • ??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
    • ??2CMemoryAllocator@@SGPAXI@Z
    • ??2CMemoryPoolAllocator@@SGPAXI@Z
    • ??3@YAXPAX@Z
    • ??3IMemoryAllocator@@SGXPAX@Z
    • ??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
    • ??4CBlobConfig@@QAEAAV0@ABV0@@Z
    • ??4CContext@@QAEAAV0@ABV0@@Z
    • ??4CDebugLog@@QAEAAV0@ABV0@@Z
    • ??4CDebugLogEx@@QAEAAV0@ABV0@@Z
    • ??4CDelayLoadThread@@QAEAAV0@ABV0@@Z
    • ??4CFile@@QAEAAV0@ABV0@@Z
    • ??4CKEvent@@QAEAAV0@ABV0@@Z
    • ??4CLockEvent@@QAEAAV0@ABV0@@Z
    • ??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
    • ??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
    • ??4CModuleConfig@@QAEAAV0@ABV0@@Z
    • ??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
    • ??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
    • ??4CSmartLock@@QAEAAV0@ABV0@@Z
    • ??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
    • ??4CSmartResource@@QAEAAV0@ABV0@@Z
    • ??4CSystemThread@@QAEAAV0@ABV0@@Z
    • ??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
    • ??4CWorkerThread@@QAEAAV0@ABV0@@Z
    • ??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
    • ??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
    • ??_7CAutoUpdateConfigThread@@6B@
    • ??_7CBlobConfig@@6B@
    • ??_7CContext@@6B@
    • ??_7CContextList@@6B@
    • ??_7CDebugLog@@6B@
    • ??_7CDebugLogEx@@6B@
    • ??_7CDelayLoadThread@@6B@
    • ??_7CExclusionExtConfig@@6B@
    • ??_7CExclusionFileNameConfig@@6B@
    • ??_7CExclusionFilePathConfig@@6B@
    • ??_7CExclusionFolderConfig@@6B@
    • ??_7CExclusionRegistryConfig@@6B@
    • ??_7CFile@@6B@
    • ??_7CFileExtension@@6B@
    • ??_7CInclusionExtConfig@@6B@
    • ??_7CInclusionFileNameConfig@@6B@
    • ??_7CInclusionFilePathConfig@@6B@
    • ??_7CInclusionFolderConfig@@6B@
    • ??_7CKEvent@@6B@
    • ??_7CList@@6B@
    • ??_7CLockEvent@@6B@
    • ??_7CLockList@@6B@
    • ??_7CMemoryAllocator@@6B@
    • ??_7CMemoryPoolAllocator@@6B@
    • ??_7CModuleConfig@@6B@
    • ??_7CModuleConfigList@@6B@
    • ??_7CModuleFileExtConfig@@6B@
    • ??_7CModuleFlagConfig@@6B@
    • ??_7CModuleMultiStringConfig@@6B@
    • ??_7CModuleStringConfig@@6B@
    • ??_7CNoLockList@@6B@
    • ??_7CStrList@@6B@
    • ??_7CSystemThread@@6B@
    • ??_7CUserFuncAdapterJob@@6B@
    • ??_7CWorkerThread@@6B@
    • ??_7CWorkerThreadJob@@6B@
    • ??_7CWorkerThreadJobQueue@@6B@
    • ??_7CWorkerThreadPool@@6B@
    • ??_7CWorkerThreadPoolEx@@6B@
    • ??_7IMemoryAllocator@@6B@
    • ??_FCContextList@@QAEXXZ
    • ??_FCFile@@QAEXXZ
    • ??_FCFileExtension@@QAEXXZ
    • ??_FCModuleConfigList@@QAEXXZ
    • ??_FCStrList@@QAEXXZ
    • ??_FCSystemThread@@QAEXXZ
    • ??_FCWorkerThread@@QAEXXZ
    • ??_FCWorkerThreadJob@@QAEXXZ
    • ??_FCWorkerThreadJobQueue@@QAEXXZ
    • ??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
    • ??_V@YAXPAX@Z
    • ?Acquire@CLockEvent@@QAEXXZ
    • ?Add@CContextList@@QAEEPAVCContext@@@Z
    • ?Add@CFileExtension@@QAEEPBGK@Z
    • ?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
    • ?Add@CStrList@@QAEEPBG@Z
    • ?AddNode@CLockList@@UAEEQAXE@Z
    • ?AddNode@CNoLockList@@UAEEQAXE@Z
    • ?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
    • ?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
    • ?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
    • ?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
    • ?Cancel@CWorkerThreadJob@@QAEXXZ
    • ?CheckNode@CLockList@@UAEHQAX@Z
    • ?CheckNode@CNoLockList@@UAEHQAX@Z
    • ?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
    • ?Cleanup@CBlobConfig@@AAEXXZ
    • ?Cleanup@CModuleFileExtConfig@@IAEXXZ
    • ?Cleanup@CModuleMultiStringConfig@@IAEXXZ
    • ?Cleanup@CModuleStringConfig@@AAEXXZ
    • ?Close@CFile@@QAEJXZ
    • ?Count@CLockList@@QAEKXZ
    • ?Count@CNoLockList@@QAEKXZ
    • ?Create@CFile@@QAEJPBGKKKK@Z
    • ?Create@CSystemThread@@QAEEXZ
    • ?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
    • ?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
    • ?CreatePool@CWorkerThreadPool@@QAEEXZ
    • ?CreatePool@CWorkerThreadPoolEx@@QAEEXZ
    • ?CreateThreads@CWorkerThreadPool@@QAEEK@Z
    • ?CreateThreads@CWorkerThreadPoolEx@@QAEEK@Z
    • ?CreateWIRP@CFile@@QAEJPBGKKKK@Z
    • ?Delete@CFile@@QAEJXZ
    • ?Delete@CFileExtension@@QAEEPBGK@Z
    • ?Delete@CStrList@@QAEEPBG@Z
    • ?DeleteAll@CList@@UAEXXZ
    • ?DeleteAll@CLockList@@UAEXXZ
    • ?DeleteAll@CNoLockList@@UAEXXZ
    • ?DeleteNode@CContextList@@MAEXPAX@Z
    • ?DeleteNode@CList@@UAEXPAX@Z
    • ?DeleteNode@CModuleConfigList@@MAEXPAX@Z
    • ?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
    • ?DisableWriteProtectFromCR0@@YGXPAPAX@Z
    • ?DoIt@CWorkerThreadJob@@QAEJXZ
    • ?EntryPoint@CSystemThread@@KGXPAX@Z
    • ?Find@CContextList@@QAEPAVCContext@@K@Z
    • ?Find@CContextList@@QAEPAVCContext@@PAX@Z
    • ?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
    • ?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
    • ?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
    • ?FindNode@CContextList@@IAEPAXPAX@Z
    • ?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
    • ?FinishFunction@CUserFuncAdapterJob@@MAEXXZ
    • ?FinishIt@CWorkerThreadJob@@QAEJXZ
    • ?First@CList@@UAEPAXXZ
    • ?First@CLockList@@UAEPAXXZ
    • ?First@CNoLockList@@UAEPAXXZ
    • ?Free@CMemoryAllocator@@UAEXPAX@Z
    • ?Free@CMemoryPoolAllocator@@UAEXPAX@Z
    • ?GetAttributes@CFile@@QAEKXZ
    • ?GetBasicInfomration@CFile@@IAEJXZ
    • ?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
    • ?GetCategory@CContext@@QAEKXZ
    • ?GetData@CBlobConfig@@QAEHPAXPAK@Z
    • ?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
    • ?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
    • ?GetData@CModuleFlagConfig@@QAEKXZ
    • ?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
    • ?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
    • ?GetData@CModuleStringConfig@@QAEPAGXZ
    • ?GetData@CStrList@@QAEEPAGPAK@Z
    • ?GetDataType@CModuleConfig@@QAEKXZ
    • ?GetEngineContext@CContext@@QAEPAXXZ
    • ?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
    • ?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
    • ?GetFileSizeWIRP@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
    • ?GetFlagConfig@CContext@@UAEJKPAK@Z
    • ?GetID@CModuleConfig@@QAEKXZ
    • ?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
    • ?GetLength@CModuleStringConfig@@QAEKXZ
    • ?GetLinkContext@CContext@@QAEPAXXZ
    • ?GetLogFlag@CDebugLog@@QAEKXZ
    • ?GetLogFlag@CDebugLogEx@@QAEKXZ
    • ?GetModuleId@CModuleConfig@@QAEKXZ
    • ?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
    • ?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_KTHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_ETHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_KTHREAD@@XZ
    • ?GetReportCallBackRoutine@CContext@@QAEKXZ
    • ?GetSize@CBlobConfig@@QAEKXZ
    • ?GetStringConfig@CContext@@QAEPAGK@Z
    • ?GetStringConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetThreadCount@CWorkerThreadPool@@QAEKXZ
    • ?GetThreadCount@CWorkerThreadPoolEx@@QAEKXZ
    • ?GetThreadID@CSystemThread@@QAEKXZ
    • ?GetType@CContext@@QAEKXZ
    • ?GetUserParameter@CContext@@QAEKXZ
    • ?InitProcMon@CDebugLogEx@@IAEXXZ
    • ?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
    • ?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
    • ?InitializeFlagConfig@CContext@@QAEHKK@Z
    • ?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
    • ?InitializeStringConfig@CContext@@QAEHKPBG@Z
    • ?Insert@CList@@UAEXQAXE@Z
    • ?Insert@CLockList@@UAEXQAXE@Z
    • ?Insert@CNoLockList@@UAEXQAXE@Z
    • ?InsertAfter@CList@@UAEXPAX0@Z
    • ?InsertBefore@CList@@UAEXPAX0@Z
    • ?Instance@CWorkerThreadPool@@SGPAV1@XZ
    • ?IsEmpty@CList@@UAEEXZ
    • ?IsEmpty@CLockList@@UAEEXZ
    • ?IsEmpty@CNoLockList@@UAEEXZ
    • ?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
    • ?IsFull@CLockList@@QBEEXZ
    • ?IsFull@CNoLockList@@QBEEXZ
    • ?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionExtConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFileNameConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFilePathConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFolderConfig@@QAEEPBG@Z
    • ?IsOpened@CFile@@QAEEXZ
    • ?IsTerminated@CWorkerThreadPool@@QAEEXZ
    • ?IsTerminated@CWorkerThreadPoolEx@@QAEEXZ
    • ?IsValid@CMemoryAllocator@@UAEEXZ
    • ?IsValid@CMemoryPoolAllocator@@UAEEXZ
    • ?IsValid@IMemoryAllocator@@UAEEXZ
    • ?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
    • ?IsWorkerThread@CWorkerThreadPoolEx@@QAEEK@Z
    • ?JobFunction@CUserFuncAdapterJob@@MAEXXZ
    • ?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
    • ?JobQueue@CWorkerThreadPoolEx@@QAEAAVCWorkerThreadJobQueue@@XZ
    • ?Limit@CLockList@@QAEKXZ
    • ?Limit@CNoLockList@@QAEKXZ
    • ?MatchAllExtensions@CFileExtension@@QAEEXZ
    • ?MatchNoExtensions@CFileExtension@@QAEEXZ
    • ?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
    • ?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
    • ?NeedDelete@CWorkerThreadJob@@QAEEXZ
    • ?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
    • ?NewNode@CList@@UAEPAXXZ
    • ?NewNode@CStrList@@EAEPAXXZ
    • ?NewNodeVariant@CList@@IAEPAXK@Z
    • ?Next@CList@@UBEPAXQAX@Z
    • ?Next@CLockList@@UBEPAXQAX@Z
    • ?Next@CNoLockList@@UBEPAXQAX@Z
    • ?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
    • ?NotityTerminate@CWorkerThread@@QAEXXZ
    • ?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
    • ?PostJobToWorkerThread@CWorkerThreadPoolEx@@QAEJP6GXPAX@Z0E1@Z
    • ?Pulse@CKEvent@@QAEJJE@Z
    • ?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
    • ?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
    • ?QueueJobItem@CWorkerThreadPoolEx@@QAEJPAVCWorkerThreadJob@@@Z
    • ?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
    • ?Read@CFile@@QAEJPADKPAK@Z
    • ?ReadWIRP@CFile@@QAEJPADKPAK@Z
    • ?ReferenceCount@CContext@@QAEAAKXZ
    • ?Release@CLockEvent@@QAEXXZ
    • ?Remove@CContextList@@UAEEQAX@Z
    • ?Remove@CList@@UAEEQAX@Z
    • ?Remove@CLockList@@UAEEQAX@Z
    • ?Remove@CNoLockList@@UAEEQAX@Z
    • ?RemoveHead@CList@@UAEPAXXZ
    • ?RemoveHead@CLockList@@UAEPAXXZ
    • ?RemoveHead@CNoLockList@@UAEPAXXZ
    • ?RemoveTail@CList@@UAEPAXXZ
    • ?RemoveTail@CLockList@@UAEPAXXZ
    • ?RemoveTail@CNoLockList@@UAEPAXXZ
    • ?Reset@CKEvent@@QAEXXZ
    • ?ResetData@CInclusionExtConfig@@QAEXXZ
    • ?ResetData@CInclusionFileNameConfig@@QAEXXZ
    • ?ResetData@CInclusionFilePathConfig@@QAEXXZ
    • ?ResetData@CInclusionFolderConfig@@QAEXXZ
    • ?RestoreCR0@@YGXPAX@Z
    • ?Run@CAutoUpdateConfigThread@@UAEXXZ
    • ?Run@CDelayLoadThread@@UAEXXZ
    • ?Run@CWorkerThread@@UAEXXZ
    • ?SeekToEnd@CFile@@QAEJXZ
    • ?Set@CKEvent@@QAEJJE@Z
    • ?SetAttributes@CFile@@QAEJK@Z
    • ?SetBlobCofig@CContext@@UAEJKPAXK@Z
    • ?SetData@CBlobConfig@@QAEHPAXK@Z
    • ?SetData@CModuleFileExtConfig@@QAEHPBG@Z
    • ?SetData@CModuleFlagConfig@@QAEHK@Z
    • ?SetData@CModuleMultiStringConfig@@QAEHPBGK@Z
    • ?SetData@CModuleStringConfig@@QAEHPBG@Z
    • ?SetEngineContext@CContext@@QAEXPAX@Z
    • ?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
    • ?SetFlagConfig@CContext@@UAEJKK@Z
    • ?SetLinkContext@CContext@@QAEXPAX@Z
    • ?SetLogFlag@CDebugLog@@QAEEK@Z
    • ?SetLogFlag@CDebugLogEx@@QAEEK@Z
    • ?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
    • ?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
    • ?SetMultiStringConfig@CContext@@UAEJKPBG@Z
    • ?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
    • ?SetPriority@CSystemThread@@QAEXK@Z
    • ?SetStopUse@CContext@@QAEXXZ
    • ?SetStringConfig@CContext@@UAEJKPBG@Z
    • ?Setup@CSystemThread@@MAEXXZ
    • ?StopUse@CContext@@QAEHXZ
    • ?TearDown@CSystemThread@@MAEXXZ
    • ?Terminate@CSystemThread@@QAEXE@Z
    • ?Terminate@CWorkerThreadPool@@QAEEXZ
    • ?Terminate@CWorkerThreadPoolEx@@QAEEXZ
    • ?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
    • ?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
    • ?WaitFinish@CWorkerThreadJob@@QAEXXZ
    • ?WaitForInit@CDelayLoadThread@@QAEEXZ
    • ?WaitForLoad@CDelayLoadThread@@QAEEXZ
    • ?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
    • ?WaitQueueEmpty@CWorkerThreadJobQueue@@QAEXXZ
    • ?Write@CDebugLog@@QAAXPBDZZ
    • ?Write@CDebugLogEx@@QAAXPBDZZ
    • ?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
    • ?WriteDataToFile@CDebugLogEx@@IAEXPADK@Z
    • ?WriteDataToProcMonW@CDebugLogEx@@IAEXPAD@Z
    • ?WriteSystemInformation@CDebugLog@@QAEXXZ
    • ?WriteSystemInformation@CDebugLogEx@@QAEXXZ
    • ?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
    • ?WriteSystemStringInformation@CDebugLogEx@@IAEXPBG@Z
    • ?WriteToFile@CDebugLog@@IAEXPADK@Z
    • ?WriteToProcMonW@CDebugLogEx@@IAEXPAU_UNICODE_STRING@@@Z
    • ?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
    • ?_pPagedAllocator@@3PAVCMemoryAllocator@@A
    • ?m_lpInstance@CWorkerThreadPool@@1PAV1@A
    • ?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
    • _DeInitKm2UmCommunication@0
    • _DeInitKmLPC@0
    • _DuplicateFullFileName@4
    • _FreeFullFileName@4
    • _GetKm2UmMode@0
    • _GetModuleInfoByAddress@8
    • _GetModuleInfoByModuleName@8
    • _InitKm2UmCommunication@8
    • _InitKmLPC@0
    • _KmCallUm@8
    • _KmCallUmByLPC@8
    • _KmCallUmEx@12
    • _KmCleanupCommPortAPIs@0
    • _KmGetUmInitProcess@0
    • _KmSetCommPortAPIs@4
    • _ModGetExportProcAddress@8
    • _ModLoadDLLToBuffer@4
    • _ModLoadDLLToBufferWithImageSize@8
    • _ModLoadModule@8
    • _ModUnLoadModule@4
    • _NormalizeFileName@4
    • _NormalizeFullNtPathToDosName@4
    • _TmCommConfigRoutine@4
    • _UtilAddDeviceInDriveTable@4
    • _UtilAddReparsePointMapping@8
    • _UtilCleanFileReadOnly@4
    • _UtilCreateDosFileName@8
    • _UtilDeleteFileForce@4
    • _UtilGetDeviceObjectName@8
    • _UtilGetFileNameFromFileObject@4
    • _UtilGetFileObjectForProcessByEPROC@8
    • _UtilGetFileObjectFromFileName@12
    • _UtilGetProcessName@12
    • _UtilGetSystemDirectory@4
    • _UtilGetSystemDirectoryEx@0
    • _UtilGetSystemDirectoryLength@0
    • _UtilGetSystemTime@4
    • _UtilIoSetFileInfo@24
    • _UtilIopCreateFileIRP@40
    • _UtilKeGetLowFileDevice@16
    • _UtilModuleIATHook@24
    • _UtilModuleIATUnHook@8
    • _UtilPostJobToWorkerThread@12
    • _UtilQueryKeyValue@24
    • _UtilRemoveDeviceFromDriveTable@4
    • _UtilVolumeDeviceToDosName@8
    • _UtilWaitValueChangeToZero@8
    • _UtilWriteVersionToRegistry@8
    • _UtilbuildDynamicDiskMappingTable@0
    • _UtlWriteBinValueKeyToRegistry@16
    • _ValidateAddressWithSize@20
    • __UtilDosPathNameToNtPathName@12

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • PAGE
    • .edata
    • INIT
    • .rsrc
    • .reloc

    Signature

    Expand
    {
      "Certificates": [
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
          "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
          "TBS": {
            "MD5": "d0785ad36e427c92b19f6826ab1e8020",
            "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
            "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
            "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
          },
          "ValidFrom": "2012-12-21 00:00:00",
          "ValidTo": "2020-12-30 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
          "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
          "TBS": {
            "MD5": "e9d38360b914c8863f6cba3ee58764d3",
            "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
            "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
            "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
          },
          "ValidFrom": "2012-10-18 00:00:00",
          "ValidTo": "2020-12-29 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
          "TBS": {
            "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
            "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
            "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
            "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
          },
          "ValidFrom": "2017-04-27 00:00:00",
          "ValidTo": "2018-07-16 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "611993e400000000001c",
          "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
          "TBS": {
            "MD5": "78a717e082dcc1cda3458d917e677d14",
            "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
            "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
            "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
          },
          "ValidFrom": "2011-02-22 19:25:17",
          "ValidTo": "2021-02-22 19:35:17",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
          "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "TBS": {
            "MD5": "b30c31a572b0409383ed3fbe17e56e81",
            "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
            "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
            "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
          },
          "ValidFrom": "2010-02-08 00:00:00",
          "ValidTo": "2020-02-07 23:59:59",
          "Version": 3
        }
      ],
      "CertificatesInfo": "",
      "Signer": [
        {
          "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Version": 1
        }
      ],
      "SignerInfo": ""
    }
    

    PropertyValue
    FilenameTmComm.sys
    Creation Timestamp2016-08-12 00:50:21
    MD5df9953fa93e1793456a8d428ba7e5700
    SHA18db4376a86bd2164513c178a578a0bf8d90e7292
    SHA2567837cb350338c4958968d06b105466da6518f5bb522a6e70e87c0cad85128408
    Authentihash MD533de043781d74ef12f02411b9944186e
    Authentihash SHA1a405bb5d0ca4862f40a0f9eadce8ef068f421004
    Authentihash SHA256d74599ab8960f16e8026dcd564c5407956444c46c3dea6b38b1c243fbbbdc517
    RichPEHeaderHash MD5c060a624a43f3a4972ee081f9209e4d3
    RichPEHeaderHash SHA1e630bbef7195d2e1c16d683b8f18c182aef98dc7
    RichPEHeaderHash SHA256b574f3894ffb1b628c20191e085a4ada2a5f0eb04ea86a3a1ddc1d9fffd22f99
    CompanyTrend Micro Inc.
    DescriptionTrendMicro Common Module
    ProductTrend Micro Eyes
    OriginalFilenameTmComm.sys

    Download

    Certificates

    Expand
    Certificate 1688f039255e638e69143907e6330b
    FieldValue
    ToBeSigned (TBS) MD50179e8ddeebaf8998fec419d65cdf13d
    ToBeSigned (TBS) SHA134c724c3369f2da8c25b591808962f66f10bde28
    ToBeSigned (TBS) SHA25635b0bac11602847aaab65fb35199d3c8976cde3ccf7e061b130177c712cbd92f
    SubjectC=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO SHA,1 Time Stamping Signer
    ValidFrom2015-12-31 00:00:00
    ValidTo2019-07-09 18:40:36
    Signatureba332440408c7cdb589fb36098b2f5c031feeb1f6e50f60ae0e4e681ad2687a2dffdb3daf473f300fb291b891b153edb6b52932bc4ac3981d73c67579a3936e028089ae3394f9b89097f7bc5617f598932250a6aae1a3ef0a227a8b6c3b887f7160448413d5cd8ec9f4d203104d965a1edcd690753163ddd36020a88eb40e506300bb8164bdcefbc5509ffc63e122e76b3dcce42eff97657e1b70a054098589a5d711693718c6581ea6ff389f7fb73adb4e7bfd98e6faa0b4f25f3b8e1d5dd75986881f8aac0d180c2c4c43989c1f6c99e6cd774f9d997f84fc29a0acd5e8ff819e9e0a59fc4f09221e62d7925c922f9c3f03a8457ad3a16f46394101d5dd0c6
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber1688f039255e638e69143907e6330b
    Version3
    Certificate 774d49c5649436de6bf3190a67eedcdf
    FieldValue
    ToBeSigned (TBS) MD5b3ca7d6b821d8e3432b29874980af55e
    ToBeSigned (TBS) SHA1618d7e55a24c1d8b65a0bcce79120c5e3b13fa4d
    ToBeSigned (TBS) SHA256c645c6a7dc7243a4a3f78a6569c029401a7bda8bc4732ce7198d9f21f19b12fa
    SubjectC=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.
    ValidFrom2016-03-29 00:00:00
    ValidTo2017-06-28 23:59:59
    Signature27351697f046d1d43fe306dff30b83e7a404e3e6431c1e06829c558d99eb3f21776021e3e1bd4e485aba08b89bb0972f23daa471d7b432a44a591270f9a838f13dbda32ee936c0df792cff8c493e1f27b2282b3d896ae7b4155ca1a50bf7111f3f4bbbe11f17cfe5d49c0589c210966ef7e567153e802d2e783ff498c59585598d9d3e93273d1e81c07ce85c0cfb24834d448c3930120f1686bd472d916ac8f9475acfdb27be8528311f668d71dfc132a0ff62df7baa575a0cc732b3de003beca214954d4d97cf9511b9329eccbb7b716675b31e543a43570080dffce3fc8ca8fbb17d954b9678e2d0c1e1710a5cf03952a687fede59dcba3bf98900f9934f12
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber774d49c5649436de6bf3190a67eedcdf
    Version3
    Certificate 611993e400000000001c
    FieldValue
    ToBeSigned (TBS) MD578a717e082dcc1cda3458d917e677d14
    ToBeSigned (TBS) SHA14a872e0e51f9b304469cd1dedb496ee9b8b983a4
    ToBeSigned (TBS) SHA256317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
    ValidFrom2011-02-22 19:25:17
    ValidTo2021-02-22 19:35:17
    Signature812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber611993e400000000001c
    Version3
    Certificate 5200e5aa2556fc1a86ed96c9d44b33c7
    FieldValue
    ToBeSigned (TBS) MD5b30c31a572b0409383ed3fbe17e56e81
    ToBeSigned (TBS) SHA14843a82ed3b1f2bfbee9671960e1940c942f688d
    ToBeSigned (TBS) SHA25603cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
    ValidFrom2010-02-08 00:00:00
    ValidTo2020-02-07 23:59:59
    Signature5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber5200e5aa2556fc1a86ed96c9d44b33c7
    Version3

    Imports

    Expand
    • ntoskrnl.exe
    • HAL.dll
    • CLASSPNP.SYS

    Imported Functions

    Expand
    • wcsrchr
    • KeSetEvent
    • KePulseEvent
    • KeClearEvent
    • KeStackAttachProcess
    • KeUnstackDetachProcess
    • ObfDereferenceObject
    • ZwSetEvent
    • ZwClose
    • ZwConnectPort
    • RtlInitUnicodeString
    • RtlUnicodeStringToInteger
    • ZwCreateSection
    • ZwWaitForSingleObject
    • ZwOpenEvent
    • IoGetCurrentProcess
    • ObfReferenceObject
    • DbgBreakPoint
    • ZwRequestWaitReplyPort
    • ExFreePoolWithTag
    • ProbeForWrite
    • ZwFreeVirtualMemory
    • ZwAllocateVirtualMemory
    • ObOpenObjectByPointer
    • PsProcessType
    • memmove
    • PsGetProcessExitTime
    • MmSectionObjectType
    • PsThreadType
    • MmGetSystemRoutineAddress
    • ObReleaseObjectSecurity
    • SeReleaseSubjectContext
    • SeAccessCheck
    • SeCaptureSubjectContext
    • ObGetObjectSecurity
    • DbgPrint
    • memset
    • MmIsAddressValid
    • ExInitializeResourceLite
    • ExDeleteResourceLite
    • ZwWriteFile
    • ZwReadFile
    • ZwQueryInformationFile
    • ZwSetInformationFile
    • ZwCreateFile
    • swprintf
    • towupper
    • _wcsnicmp
    • ExAllocatePoolWithTag
    • KeInitializeEvent
    • _snprintf
    • PsGetCurrentProcessId
    • RtlTimeToTimeFields
    • ExSystemTimeToLocalTime
    • KeQuerySystemTime
    • PsGetCurrentThreadId
    • RtlInitAnsiString
    • ZwDeviceIoControlFile
    • ZwCreateKey
    • ZwCreateEvent
    • KeWaitForMultipleObjects
    • ObReferenceObjectByHandle
    • ZwNotifyChangeKey
    • _vsnprintf
    • RtlFreeUnicodeString
    • RtlAnsiStringToUnicodeString
    • RtlEqualUnicodeString
    • RtlAppendUnicodeStringToString
    • RtlCopyUnicodeString
    • RtlUpcaseUnicodeChar
    • ExGetPreviousMode
    • KeWaitForSingleObject
    • KeSetPriorityThread
    • PsTerminateSystemThread
    • PsCreateSystemThread
    • KeDelayExecutionThread
    • KeNumberProcessors
    • ZwQueryInformationProcess
    • PsLookupProcessByProcessId
    • ZwOpenDirectoryObject
    • PsSetCreateProcessNotifyRoutine
    • ZwQuerySystemInformation
    • ZwQueryDirectoryFile
    • ZwQueryDirectoryObject
    • ZwDuplicateObject
    • ZwOpenKey
    • ZwEnumerateKey
    • ZwEnumerateValueKey
    • ZwQueryValueKey
    • ZwDeleteValueKey
    • ZwDeleteKey
    • ZwTerminateProcess
    • ZwOpenProcess
    • ZwQueryKey
    • ZwSetValueKey
    • IoFileObjectType
    • _allrem
    • memcpy
    • ZwSetSecurityObject
    • RtlLengthSecurityDescriptor
    • MmHighestUserAddress
    • IoFreeIrp
    • IoFreeMdl
    • _purecall
    • IoBuildAsynchronousFsdRequest
    • _strnicmp
    • RtlQueryRegistryValues
    • RtlAppendUnicodeToString
    • mbstowcs
    • ZwQuerySymbolicLinkObject
    • ZwOpenSymbolicLinkObject
    • NtClose
    • ObQueryNameString
    • ZwSetInformationObject
    • _stricmp
    • ZwUnmapViewOfSection
    • ZwMapViewOfSection
    • ZwOpenFile
    • IoCreateFile
    • IofCallDriver
    • IoAllocateIrp
    • MmBuildMdlForNonPagedPool
    • IoAllocateMdl
    • ProbeForRead
    • PsGetVersion
    • RtlImageNtHeader
    • RtlCompareMemory
    • RtlUpcaseUnicodeString
    • _snwprintf
    • MmSystemRangeStart
    • wcsncmp
    • RtlCompareUnicodeString
    • strrchr
    • ZwQueryVolumeInformationFile
    • ObReferenceObjectByPointer
    • IoBuildDeviceIoControlRequest
    • ZwOpenSection
    • _allmul
    • KeReleaseSemaphore
    • RtlLengthRequiredSid
    • RtlInitializeSid
    • RtlSubAuthoritySid
    • RtlSetDaclSecurityDescriptor
    • RtlCreateSecurityDescriptor
    • RtlAddAccessAllowedAce
    • RtlCreateAcl
    • KeInitializeSemaphore
    • IofCompleteRequest
    • ExEventObjectType
    • IoDeleteDevice
    • IoDeleteSymbolicLink
    • IoCreateSymbolicLink
    • IoGetDeviceObjectPointer
    • RtlUpperChar
    • ObReferenceObjectByName
    • IoDriverObjectType
    • strncpy
    • KeServiceDescriptorTable
    • NtOpenProcess
    • ObOpenObjectByName
    • NtQueryInformationProcess
    • PsIsThreadTerminating
    • KeAddSystemServiceTable
    • ZwQueryObject
    • ZwFsControlFile
    • ObInsertObject
    • IoReleaseVpbSpinLock
    • IoAcquireVpbSpinLock
    • SeCreateAccessState
    • IoGetFileObjectGenericMapping
    • ObCreateObject
    • _allshr
    • ExInterlockedPopEntrySList
    • IoGetStackLimits
    • IoBuildSynchronousFsdRequest
    • wcsstr
    • IoUnregisterPlugPlayNotification
    • FsRtlIsNameInExpression
    • IoGetConfigurationInformation
    • MmProbeAndLockPages
    • IoGetDeviceInterfaces
    • IoRegisterPlugPlayNotification
    • ExAllocatePool
    • RtlFreeAnsiString
    • RtlUnicodeStringToAnsiString
    • strncat
    • wcschr
    • wcsncat
    • wcstombs
    • KeTickCount
    • KeBugCheckEx
    • RtlUnwind
    • wcsncpy
    • ExReleaseResourceLite
    • ExAcquireResourceExclusiveLite
    • ExAcquireResourceSharedLite
    • ExReleaseFastMutexUnsafe
    • KeLeaveCriticalRegion
    • KeEnterCriticalRegion
    • ZwQuerySecurityObject
    • ExAcquireFastMutexUnsafe
    • IoDeviceObjectType
    • IoCreateDevice
    • RtlGetDaclSecurityDescriptor
    • RtlGetSaclSecurityDescriptor
    • RtlGetGroupSecurityDescriptor
    • RtlGetOwnerSecurityDescriptor
    • SeCaptureSecurityDescriptor
    • SeExports
    • IoIsWdmVersionAvailable
    • RtlLengthSid
    • RtlAbsoluteToSelfRelativeSD
    • MmUnlockPages
    • KeGetCurrentThread
    • KfAcquireSpinLock
    • KfReleaseSpinLock
    • KeRaiseIrqlToDpcLevel
    • KfLowerIrql
    • ExAcquireFastMutex
    • ExReleaseFastMutex
    • KeGetCurrentIrql
    • KfRaiseIrql
    • ClassInitialize

    Exported Functions

    Expand
    • ??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
    • ??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
    • ??0CBlobConfig@@QAE@ABV0@@Z
    • ??0CBlobConfig@@QAE@K@Z
    • ??0CContext@@QAE@ABV0@@Z
    • ??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
    • ??0CContextList@@QAE@ABV0@@Z
    • ??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CDebugLog@@QAE@ABV0@@Z
    • ??0CDebugLog@@QAE@PBG@Z
    • ??0CDebugLogEx@@QAE@ABV0@@Z
    • ??0CDebugLogEx@@QAE@K@Z
    • ??0CDelayLoadThread@@QAE@ABV0@@Z
    • ??0CDelayLoadThread@@QAE@XZ
    • ??0CExclusionExtConfig@@QAE@ABV0@@Z
    • ??0CExclusionExtConfig@@QAE@KKE@Z
    • ??0CExclusionFileNameConfig@@QAE@ABV0@@Z
    • ??0CExclusionFileNameConfig@@QAE@KK@Z
    • ??0CExclusionFilePathConfig@@QAE@ABV0@@Z
    • ??0CExclusionFilePathConfig@@QAE@KK@Z
    • ??0CExclusionFolderConfig@@QAE@ABV0@@Z
    • ??0CExclusionFolderConfig@@QAE@KK@Z
    • ??0CExclusionRegistryConfig@@QAE@ABV0@@Z
    • ??0CExclusionRegistryConfig@@QAE@KK@Z
    • ??0CFile@@QAE@ABV0@@Z
    • ??0CFile@@QAE@E@Z
    • ??0CFileExtension@@QAE@ABV0@@Z
    • ??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
    • ??0CInclusionExtConfig@@QAE@ABV0@@Z
    • ??0CInclusionExtConfig@@QAE@KKE@Z
    • ??0CInclusionFileNameConfig@@QAE@ABV0@@Z
    • ??0CInclusionFileNameConfig@@QAE@KK@Z
    • ??0CInclusionFilePathConfig@@QAE@ABV0@@Z
    • ??0CInclusionFilePathConfig@@QAE@KK@Z
    • ??0CInclusionFolderConfig@@QAE@ABV0@@Z
    • ??0CInclusionFolderConfig@@QAE@KK@Z
    • ??0CKEvent@@QAE@ABV0@@Z
    • ??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
    • ??0CList@@QAE@ABV0@@Z
    • ??0CList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CLockEvent@@QAE@ABV0@@Z
    • ??0CLockEvent@@QAE@XZ
    • ??0CLockList@@QAE@ABV0@@Z
    • ??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
    • ??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
    • ??0CMemoryAllocator@@QAE@ABV0@@Z
    • ??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
    • ??0CMemoryPoolAllocator@@QAE@ABV0@@Z
    • ??0CModuleConfig@@QAE@ABV0@@Z
    • ??0CModuleConfig@@QAE@XZ
    • ??0CModuleConfigList@@QAE@ABV0@@Z
    • ??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CModuleFileExtConfig@@QAE@ABV0@@Z
    • ??0CModuleFileExtConfig@@QAE@KKE@Z
    • ??0CModuleFlagConfig@@QAE@ABV0@@Z
    • ??0CModuleFlagConfig@@QAE@K@Z
    • ??0CModuleMultiStringConfig@@QAE@ABV0@@Z
    • ??0CModuleMultiStringConfig@@QAE@KK@Z
    • ??0CModuleStringConfig@@QAE@ABV0@@Z
    • ??0CModuleStringConfig@@QAE@K@Z
    • ??0CNoLockList@@QAE@ABV0@@Z
    • ??0CNoLockList@@QAE@KKPAVIMemoryAllocator@@@Z
    • ??0CSmartLock@@QAE@AAVCLockEvent@@@Z
    • ??0CSmartLock@@QAE@XZ
    • ??0CSmartReference@@QAE@AAJ@Z
    • ??0CSmartReference@@QAE@AAK@Z
    • ??0CSmartResource@@QAE@AAVCResource@@E@Z
    • ??0CStrList@@QAE@ABV0@@Z
    • ??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CSystemThread@@QAE@ABV0@@Z
    • ??0CSystemThread@@QAE@K@Z
    • ??0CUserFuncAdapterJob@@QAE@ABV0@@Z
    • ??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z01@Z
    • ??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
    • ??0CWorkerThread@@QAE@ABV0@@Z
    • ??0CWorkerThreadJob@@QAE@ABV0@@Z
    • ??0CWorkerThreadJob@@QAE@E@Z
    • ??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
    • ??0CWorkerThreadJobQueue@@QAE@K@Z
    • ??0CWorkerThreadPool@@QAE@ABV0@@Z
    • ??0CWorkerThreadPool@@QAE@K@Z
    • ??0CWorkerThreadPoolEx@@QAE@ABV0@@Z
    • ??0CWorkerThreadPoolEx@@QAE@KK@Z
    • ??0IMemoryAllocator@@QAE@ABV0@@Z
    • ??0IMemoryAllocator@@QAE@XZ
    • ??1CAutoUpdateConfigThread@@UAE@XZ
    • ??1CBlobConfig@@UAE@XZ
    • ??1CContext@@UAE@XZ
    • ??1CContextList@@UAE@XZ
    • ??1CDebugLog@@UAE@XZ
    • ??1CDebugLogEx@@UAE@XZ
    • ??1CDelayLoadThread@@UAE@XZ
    • ??1CExclusionExtConfig@@UAE@XZ
    • ??1CExclusionFileNameConfig@@UAE@XZ
    • ??1CExclusionFilePathConfig@@UAE@XZ
    • ??1CExclusionFolderConfig@@UAE@XZ
    • ??1CExclusionRegistryConfig@@UAE@XZ
    • ??1CFile@@UAE@XZ
    • ??1CFileExtension@@UAE@XZ
    • ??1CInclusionExtConfig@@UAE@XZ
    • ??1CInclusionFileNameConfig@@UAE@XZ
    • ??1CInclusionFilePathConfig@@UAE@XZ
    • ??1CInclusionFolderConfig@@UAE@XZ
    • ??1CKEvent@@UAE@XZ
    • ??1CList@@UAE@XZ
    • ??1CLockEvent@@UAE@XZ
    • ??1CLockList@@UAE@XZ
    • ??1CMemoryAllocator@@UAE@XZ
    • ??1CMemoryPoolAllocator@@UAE@XZ
    • ??1CModuleConfig@@UAE@XZ
    • ??1CModuleConfigList@@UAE@XZ
    • ??1CModuleFileExtConfig@@UAE@XZ
    • ??1CModuleFlagConfig@@UAE@XZ
    • ??1CModuleMultiStringConfig@@UAE@XZ
    • ??1CModuleStringConfig@@UAE@XZ
    • ??1CNoLockList@@UAE@XZ
    • ??1CSmartLock@@QAE@XZ
    • ??1CSmartReference@@QAE@XZ
    • ??1CSmartResource@@QAE@XZ
    • ??1CStrList@@UAE@XZ
    • ??1CSystemThread@@UAE@XZ
    • ??1CUserFuncAdapterJob@@UAE@XZ
    • ??1CWorkerThread@@UAE@XZ
    • ??1CWorkerThreadJob@@UAE@XZ
    • ??1CWorkerThreadJobQueue@@UAE@XZ
    • ??1CWorkerThreadPool@@UAE@XZ
    • ??1CWorkerThreadPoolEx@@UAE@XZ
    • ??1IMemoryAllocator@@UAE@XZ
    • ??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
    • ??2CMemoryAllocator@@SGPAXI@Z
    • ??2CMemoryPoolAllocator@@SGPAXI@Z
    • ??3@YAXPAX@Z
    • ??3IMemoryAllocator@@SGXPAX@Z
    • ??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
    • ??4CBlobConfig@@QAEAAV0@ABV0@@Z
    • ??4CContext@@QAEAAV0@ABV0@@Z
    • ??4CDebugLog@@QAEAAV0@ABV0@@Z
    • ??4CDebugLogEx@@QAEAAV0@ABV0@@Z
    • ??4CDelayLoadThread@@QAEAAV0@ABV0@@Z
    • ??4CFile@@QAEAAV0@ABV0@@Z
    • ??4CKEvent@@QAEAAV0@ABV0@@Z
    • ??4CLockEvent@@QAEAAV0@ABV0@@Z
    • ??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
    • ??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
    • ??4CModuleConfig@@QAEAAV0@ABV0@@Z
    • ??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
    • ??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
    • ??4CSmartLock@@QAEAAV0@ABV0@@Z
    • ??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
    • ??4CSmartResource@@QAEAAV0@ABV0@@Z
    • ??4CSystemThread@@QAEAAV0@ABV0@@Z
    • ??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
    • ??4CWorkerThread@@QAEAAV0@ABV0@@Z
    • ??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
    • ??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
    • ??_7CAutoUpdateConfigThread@@6B@
    • ??_7CBlobConfig@@6B@
    • ??_7CContext@@6B@
    • ??_7CContextList@@6B@
    • ??_7CDebugLog@@6B@
    • ??_7CDebugLogEx@@6B@
    • ??_7CDelayLoadThread@@6B@
    • ??_7CExclusionExtConfig@@6B@
    • ??_7CExclusionFileNameConfig@@6B@
    • ??_7CExclusionFilePathConfig@@6B@
    • ??_7CExclusionFolderConfig@@6B@
    • ??_7CExclusionRegistryConfig@@6B@
    • ??_7CFile@@6B@
    • ??_7CFileExtension@@6B@
    • ??_7CInclusionExtConfig@@6B@
    • ??_7CInclusionFileNameConfig@@6B@
    • ??_7CInclusionFilePathConfig@@6B@
    • ??_7CInclusionFolderConfig@@6B@
    • ??_7CKEvent@@6B@
    • ??_7CList@@6B@
    • ??_7CLockEvent@@6B@
    • ??_7CLockList@@6B@
    • ??_7CMemoryAllocator@@6B@
    • ??_7CMemoryPoolAllocator@@6B@
    • ??_7CModuleConfig@@6B@
    • ??_7CModuleConfigList@@6B@
    • ??_7CModuleFileExtConfig@@6B@
    • ??_7CModuleFlagConfig@@6B@
    • ??_7CModuleMultiStringConfig@@6B@
    • ??_7CModuleStringConfig@@6B@
    • ??_7CNoLockList@@6B@
    • ??_7CStrList@@6B@
    • ??_7CSystemThread@@6B@
    • ??_7CUserFuncAdapterJob@@6B@
    • ??_7CWorkerThread@@6B@
    • ??_7CWorkerThreadJob@@6B@
    • ??_7CWorkerThreadJobQueue@@6B@
    • ??_7CWorkerThreadPool@@6B@
    • ??_7CWorkerThreadPoolEx@@6B@
    • ??_7IMemoryAllocator@@6B@
    • ??_FCContextList@@QAEXXZ
    • ??_FCFile@@QAEXXZ
    • ??_FCFileExtension@@QAEXXZ
    • ??_FCModuleConfigList@@QAEXXZ
    • ??_FCStrList@@QAEXXZ
    • ??_FCSystemThread@@QAEXXZ
    • ??_FCWorkerThread@@QAEXXZ
    • ??_FCWorkerThreadJob@@QAEXXZ
    • ??_FCWorkerThreadJobQueue@@QAEXXZ
    • ??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
    • ??_V@YAXPAX@Z
    • ?Acquire@CLockEvent@@QAEXXZ
    • ?Add@CContextList@@QAEEPAVCContext@@@Z
    • ?Add@CFileExtension@@QAEEPBGK@Z
    • ?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
    • ?Add@CStrList@@QAEEPBG@Z
    • ?AddNode@CLockList@@UAEEQAXE@Z
    • ?AddNode@CNoLockList@@UAEEQAXE@Z
    • ?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
    • ?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
    • ?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
    • ?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
    • ?Cancel@CWorkerThreadJob@@QAEXXZ
    • ?CheckNode@CLockList@@UAEHQAX@Z
    • ?CheckNode@CNoLockList@@UAEHQAX@Z
    • ?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
    • ?Cleanup@CBlobConfig@@AAEXXZ
    • ?Cleanup@CModuleFileExtConfig@@IAEXXZ
    • ?Cleanup@CModuleMultiStringConfig@@IAEXXZ
    • ?Cleanup@CModuleStringConfig@@AAEXXZ
    • ?Close@CFile@@QAEJXZ
    • ?Count@CLockList@@QAEKXZ
    • ?Count@CNoLockList@@QAEKXZ
    • ?Create@CFile@@QAEJPBGKKKK@Z
    • ?Create@CSystemThread@@QAEEXZ
    • ?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
    • ?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
    • ?CreatePool@CWorkerThreadPool@@QAEEXZ
    • ?CreatePool@CWorkerThreadPoolEx@@QAEEXZ
    • ?CreateThreads@CWorkerThreadPool@@QAEEK@Z
    • ?CreateThreads@CWorkerThreadPoolEx@@QAEEK@Z
    • ?CreateWIRP@CFile@@QAEJPBGKKKK@Z
    • ?Delete@CFile@@QAEJXZ
    • ?Delete@CFileExtension@@QAEEPBGK@Z
    • ?Delete@CStrList@@QAEEPBG@Z
    • ?DeleteAll@CList@@UAEXXZ
    • ?DeleteAll@CLockList@@UAEXXZ
    • ?DeleteAll@CNoLockList@@UAEXXZ
    • ?DeleteNode@CContextList@@MAEXPAX@Z
    • ?DeleteNode@CList@@UAEXPAX@Z
    • ?DeleteNode@CModuleConfigList@@MAEXPAX@Z
    • ?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
    • ?DisableWriteProtectFromCR0@@YGXPAPAX@Z
    • ?DoIt@CWorkerThreadJob@@QAEJXZ
    • ?EntryPoint@CSystemThread@@KGXPAX@Z
    • ?Find@CContextList@@QAEPAVCContext@@K@Z
    • ?Find@CContextList@@QAEPAVCContext@@PAX@Z
    • ?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
    • ?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
    • ?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
    • ?FindNode@CContextList@@IAEPAXPAX@Z
    • ?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
    • ?FinishFunction@CUserFuncAdapterJob@@MAEXXZ
    • ?FinishIt@CWorkerThreadJob@@QAEJXZ
    • ?First@CList@@UAEPAXXZ
    • ?First@CLockList@@UAEPAXXZ
    • ?First@CNoLockList@@UAEPAXXZ
    • ?Free@CMemoryAllocator@@UAEXPAX@Z
    • ?Free@CMemoryPoolAllocator@@UAEXPAX@Z
    • ?GetAttributes@CFile@@QAEKXZ
    • ?GetBasicInfomration@CFile@@IAEJXZ
    • ?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
    • ?GetCategory@CContext@@QAEKXZ
    • ?GetData@CBlobConfig@@QAEHPAXPAK@Z
    • ?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
    • ?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
    • ?GetData@CModuleFlagConfig@@QAEKXZ
    • ?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
    • ?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
    • ?GetData@CModuleStringConfig@@QAEPAGXZ
    • ?GetData@CStrList@@QAEEPAGPAK@Z
    • ?GetDataType@CModuleConfig@@QAEKXZ
    • ?GetEngineContext@CContext@@QAEPAXXZ
    • ?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
    • ?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
    • ?GetFileSizeWIRP@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
    • ?GetFlagConfig@CContext@@UAEJKPAK@Z
    • ?GetID@CModuleConfig@@QAEKXZ
    • ?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
    • ?GetLength@CModuleStringConfig@@QAEKXZ
    • ?GetLinkContext@CContext@@QAEPAXXZ
    • ?GetLogFlag@CDebugLog@@QAEKXZ
    • ?GetLogFlag@CDebugLogEx@@QAEKXZ
    • ?GetModuleId@CModuleConfig@@QAEKXZ
    • ?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
    • ?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_KTHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_ETHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_KTHREAD@@XZ
    • ?GetReportCallBackRoutine@CContext@@QAEKXZ
    • ?GetSize@CBlobConfig@@QAEKXZ
    • ?GetStringConfig@CContext@@QAEPAGK@Z
    • ?GetStringConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetThreadCount@CWorkerThreadPool@@QAEKXZ
    • ?GetThreadCount@CWorkerThreadPoolEx@@QAEKXZ
    • ?GetThreadID@CSystemThread@@QAEKXZ
    • ?GetType@CContext@@QAEKXZ
    • ?GetUserParameter@CContext@@QAEKXZ
    • ?InitProcMon@CDebugLogEx@@IAEXXZ
    • ?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
    • ?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
    • ?InitializeFlagConfig@CContext@@QAEHKK@Z
    • ?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
    • ?InitializeStringConfig@CContext@@QAEHKPBG@Z
    • ?Insert@CList@@UAEXQAXE@Z
    • ?Insert@CLockList@@UAEXQAXE@Z
    • ?Insert@CNoLockList@@UAEXQAXE@Z
    • ?InsertAfter@CList@@UAEXPAX0@Z
    • ?InsertBefore@CList@@UAEXPAX0@Z
    • ?Instance@CWorkerThreadPool@@SGPAV1@XZ
    • ?IsEmpty@CList@@UAEEXZ
    • ?IsEmpty@CLockList@@UAEEXZ
    • ?IsEmpty@CNoLockList@@UAEEXZ
    • ?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
    • ?IsFull@CLockList@@QBEEXZ
    • ?IsFull@CNoLockList@@QBEEXZ
    • ?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionExtConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFileNameConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFilePathConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFolderConfig@@QAEEPBG@Z
    • ?IsOpened@CFile@@QAEEXZ
    • ?IsTerminated@CWorkerThreadPool@@QAEEXZ
    • ?IsTerminated@CWorkerThreadPoolEx@@QAEEXZ
    • ?IsValid@CMemoryAllocator@@UAEEXZ
    • ?IsValid@CMemoryPoolAllocator@@UAEEXZ
    • ?IsValid@IMemoryAllocator@@UAEEXZ
    • ?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
    • ?IsWorkerThread@CWorkerThreadPoolEx@@QAEEK@Z
    • ?JobFunction@CUserFuncAdapterJob@@MAEXXZ
    • ?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
    • ?JobQueue@CWorkerThreadPoolEx@@QAEAAVCWorkerThreadJobQueue@@XZ
    • ?Limit@CLockList@@QAEKXZ
    • ?Limit@CNoLockList@@QAEKXZ
    • ?MatchAllExtensions@CFileExtension@@QAEEXZ
    • ?MatchNoExtensions@CFileExtension@@QAEEXZ
    • ?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
    • ?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
    • ?NeedDelete@CWorkerThreadJob@@QAEEXZ
    • ?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
    • ?NewNode@CList@@UAEPAXXZ
    • ?NewNode@CStrList@@EAEPAXXZ
    • ?NewNodeVariant@CList@@IAEPAXK@Z
    • ?Next@CList@@UBEPAXQAX@Z
    • ?Next@CLockList@@UBEPAXQAX@Z
    • ?Next@CNoLockList@@UBEPAXQAX@Z
    • ?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
    • ?NotityTerminate@CWorkerThread@@QAEXXZ
    • ?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
    • ?PostJobToWorkerThread@CWorkerThreadPoolEx@@QAEJP6GXPAX@Z0E1@Z
    • ?Pulse@CKEvent@@QAEJJE@Z
    • ?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
    • ?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
    • ?QueueJobItem@CWorkerThreadPoolEx@@QAEJPAVCWorkerThreadJob@@@Z
    • ?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
    • ?Read@CFile@@QAEJPADKPAK@Z
    • ?ReadWIRP@CFile@@QAEJPADKPAK@Z
    • ?ReferenceCount@CContext@@QAEAAKXZ
    • ?Release@CLockEvent@@QAEXXZ
    • ?Remove@CContextList@@UAEEQAX@Z
    • ?Remove@CList@@UAEEQAX@Z
    • ?Remove@CLockList@@UAEEQAX@Z
    • ?Remove@CNoLockList@@UAEEQAX@Z
    • ?RemoveHead@CList@@UAEPAXXZ
    • ?RemoveHead@CLockList@@UAEPAXXZ
    • ?RemoveHead@CNoLockList@@UAEPAXXZ
    • ?RemoveTail@CList@@UAEPAXXZ
    • ?RemoveTail@CLockList@@UAEPAXXZ
    • ?RemoveTail@CNoLockList@@UAEPAXXZ
    • ?Reset@CKEvent@@QAEXXZ
    • ?ResetData@CInclusionExtConfig@@QAEXXZ
    • ?ResetData@CInclusionFileNameConfig@@QAEXXZ
    • ?ResetData@CInclusionFilePathConfig@@QAEXXZ
    • ?ResetData@CInclusionFolderConfig@@QAEXXZ
    • ?RestoreCR0@@YGXPAX@Z
    • ?Run@CAutoUpdateConfigThread@@UAEXXZ
    • ?Run@CDelayLoadThread@@UAEXXZ
    • ?Run@CWorkerThread@@UAEXXZ
    • ?SeekToEnd@CFile@@QAEJXZ
    • ?Set@CKEvent@@QAEJJE@Z
    • ?SetAttributes@CFile@@QAEJK@Z
    • ?SetBlobCofig@CContext@@UAEJKPAXK@Z
    • ?SetData@CBlobConfig@@QAEHPAXK@Z
    • ?SetData@CModuleFileExtConfig@@QAEHPBG@Z
    • ?SetData@CModuleFlagConfig@@QAEHK@Z
    • ?SetData@CModuleMultiStringConfig@@QAEHPBGK@Z
    • ?SetData@CModuleStringConfig@@QAEHPBG@Z
    • ?SetEngineContext@CContext@@QAEXPAX@Z
    • ?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
    • ?SetFlagConfig@CContext@@UAEJKK@Z
    • ?SetLinkContext@CContext@@QAEXPAX@Z
    • ?SetLogFlag@CDebugLog@@QAEEK@Z
    • ?SetLogFlag@CDebugLogEx@@QAEEK@Z
    • ?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
    • ?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
    • ?SetMultiStringConfig@CContext@@UAEJKPBG@Z
    • ?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
    • ?SetPriority@CSystemThread@@QAEXK@Z
    • ?SetStopUse@CContext@@QAEXXZ
    • ?SetStringConfig@CContext@@UAEJKPBG@Z
    • ?Setup@CSystemThread@@MAEXXZ
    • ?StopUse@CContext@@QAEHXZ
    • ?TearDown@CSystemThread@@MAEXXZ
    • ?Terminate@CSystemThread@@QAEXE@Z
    • ?Terminate@CWorkerThreadPool@@QAEEXZ
    • ?Terminate@CWorkerThreadPoolEx@@QAEEXZ
    • ?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
    • ?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
    • ?WaitFinish@CWorkerThreadJob@@QAEXXZ
    • ?WaitForInit@CDelayLoadThread@@QAEEXZ
    • ?WaitForLoad@CDelayLoadThread@@QAEEXZ
    • ?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
    • ?WaitQueueEmpty@CWorkerThreadJobQueue@@QAEXXZ
    • ?Write@CDebugLog@@QAAXPBDZZ
    • ?Write@CDebugLogEx@@QAAXPBDZZ
    • ?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
    • ?WriteDataToFile@CDebugLogEx@@IAEXPADK@Z
    • ?WriteDataToProcMonW@CDebugLogEx@@IAEXPAD@Z
    • ?WriteSystemInformation@CDebugLog@@QAEXXZ
    • ?WriteSystemInformation@CDebugLogEx@@QAEXXZ
    • ?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
    • ?WriteSystemStringInformation@CDebugLogEx@@IAEXPBG@Z
    • ?WriteToFile@CDebugLog@@IAEXPADK@Z
    • ?WriteToProcMonW@CDebugLogEx@@IAEXPAU_UNICODE_STRING@@@Z
    • ?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
    • ?_pPagedAllocator@@3PAVCMemoryAllocator@@A
    • ?m_lpInstance@CWorkerThreadPool@@1PAV1@A
    • ?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
    • _DeInitKm2UmCommunication@0
    • _DeInitKmLPC@0
    • _DuplicateFullFileName@4
    • _FreeFullFileName@4
    • _GetKm2UmMode@0
    • _GetModuleInfoByAddress@8
    • _GetModuleInfoByModuleName@8
    • _InitKm2UmCommunication@8
    • _InitKmLPC@0
    • _IsVerifierCodeCheckFlagOn@0
    • _IsWindows8_1_update@4
    • _KmCallUm@8
    • _KmCallUmByLPC@8
    • _KmCallUmEx@12
    • _KmCleanupCommPortAPIs@0
    • _KmGetUmInitProcess@0
    • _KmSetCommPortAPIs@4
    • _ModGetExportProcAddress@8
    • _ModLoadDLLToBuffer@4
    • _ModLoadDLLToBufferWithImageSize@8
    • _ModLoadModule@8
    • _ModUnLoadModule@4
    • _NormalizeFileName@4
    • _NormalizeFullNtPathToDosName@4
    • _TmCommConfigRoutine@4
    • _UtilAddDeviceInDriveTable@4
    • _UtilAddReparsePointMapping@8
    • _UtilCleanFileReadOnly@4
    • _UtilCloseExclusiveHandle@12
    • _UtilCreateDosFileName@8
    • _UtilDeleteFileForce@4
    • _UtilGetDeviceObjectName@8
    • _UtilGetFileNameFromFileObject@4
    • _UtilGetFileObjectForProcessByEPROC@8
    • _UtilGetFileObjectFromFileName@12
    • _UtilGetProcessName@12
    • _UtilGetSystemDirectory@4
    • _UtilGetSystemDirectoryEx@0
    • _UtilGetSystemDirectoryLength@0
    • _UtilGetSystemTime@4
    • _UtilIoSetFileInfo@24
    • _UtilIopCreateFileIRP@40
    • _UtilKeGetLowFileDevice@16
    • _UtilModuleIATHook@24
    • _UtilModuleIATUnHook@8
    • _UtilPostJobToWorkerThread@12
    • _UtilQueryExclusiveHandle@12
    • _UtilQueryKeyValue@24
    • _UtilRemoveDeviceFromDriveTable@4
    • _UtilVolumeDeviceToDosName@8
    • _UtilWaitValueChangeToZero@8
    • _UtilWriteVersionToRegistry@8
    • _UtilbuildDynamicDiskMappingTable@0
    • _UtlWriteBinValueKeyToRegistry@16
    • _ValidateAddressWithSize@20
    • __ResetProtectFromClose@4
    • __UtilDosPathNameToNtPathName@12

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • PAGE
    • .edata
    • INIT
    • .rsrc
    • .reloc

    Signature

    Expand
    {
      "Certificates": [
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
          "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
          "TBS": {
            "MD5": "d0785ad36e427c92b19f6826ab1e8020",
            "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
            "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
            "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
          },
          "ValidFrom": "2012-12-21 00:00:00",
          "ValidTo": "2020-12-30 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
          "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
          "TBS": {
            "MD5": "e9d38360b914c8863f6cba3ee58764d3",
            "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
            "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
            "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
          },
          "ValidFrom": "2012-10-18 00:00:00",
          "ValidTo": "2020-12-29 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
          "TBS": {
            "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
            "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
            "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
            "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
          },
          "ValidFrom": "2017-04-27 00:00:00",
          "ValidTo": "2018-07-16 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "611993e400000000001c",
          "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
          "TBS": {
            "MD5": "78a717e082dcc1cda3458d917e677d14",
            "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
            "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
            "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
          },
          "ValidFrom": "2011-02-22 19:25:17",
          "ValidTo": "2021-02-22 19:35:17",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
          "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "TBS": {
            "MD5": "b30c31a572b0409383ed3fbe17e56e81",
            "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
            "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
            "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
          },
          "ValidFrom": "2010-02-08 00:00:00",
          "ValidTo": "2020-02-07 23:59:59",
          "Version": 3
        }
      ],
      "CertificatesInfo": "",
      "Signer": [
        {
          "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Version": 1
        }
      ],
      "SignerInfo": ""
    }
    

    PropertyValue
    FilenameTmComm.sys
    Creation Timestamp2020-08-25 02:07:39
    MD558a92520dda53166e322118ee0503364
    SHA1d2be76e79741454b4611675b58446e10fc3d0c6c
    SHA2567c731c0ea7f28671ab7787800db69739ea5cd6be16ea21045b4580cf95cbf73b
    Authentihash MD57311c7bcd55dd7a769f43b480c1978d8
    Authentihash SHA1390bd5d395784a675a3b62929407a4f83e0bcc87
    Authentihash SHA2562175f4289f3bae19b058e5a4f590c200bede255cd2716dfb054d5e0840f70359
    RichPEHeaderHash MD58ae6b3a63d3444e617eba17c3a93979e
    RichPEHeaderHash SHA13cc95db9109125c87a3cb737bbe371034d9c3ade
    RichPEHeaderHash SHA256118d8d8e4d2d1ce80640e7b28300dd41389daf9bdbdc6ad2e9fefcde4aab7ad2
    CompanyTrend Micro Inc.
    DescriptionTrendMicro Common Module
    ProductTrend Micro Eyes
    OriginalFilenameTmComm.sys

    Download

    Certificates

    Expand
    Certificate 61204db4000000000027
    FieldValue
    ToBeSigned (TBS) MD58e3ffc222fbcebdbb8b23115ab259be7
    ToBeSigned (TBS) SHA1ee20bff28ffe13be731c294c90d6ded5aae0ec0e
    ToBeSigned (TBS) SHA25659826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821
    SubjectC=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
    ValidFrom2011-04-15 19:45:33
    ValidTo2021-04-15 19:55:33
    Signature208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber61204db4000000000027
    Version3
    Certificate 0f6146af9397c7fa04b13c2d0279a1ba
    FieldValue
    ToBeSigned (TBS) MD5df4ab4b67a0e9b1f9ec4a1ad9ea6052a
    ToBeSigned (TBS) SHA1dc1d0c4be3072afed8b0739a21b87b14292815e0
    ToBeSigned (TBS) SHA2569c8450b3fa641a421a545e7e4fa7e1bcb657db4796bef147312c44b7a1b5ffe0
    Subject??=TW, ??=Private Organization, serialNumber=23310837, C=TW, ST=Taipei City, L=Daan District, O=Trend Micro, Inc., CN=Trend Micro, Inc.
    ValidFrom2020-08-07 00:00:00
    ValidTo2021-04-15 12:00:00
    Signature578aa329d98f23e576b6937a3146ca65f1ec8da04b5ec5f4c499436cfe710be5660f7c864950d9276a6dfdd2341048e6fe4f51044e7fce164f3b9203035bc3d311991685fbce0d90a4c7b2b511d0d3ba37b3558eae76db3ab30f4a2ef102faad1820e26b5fcbc216b368980655de80fe7177f9f1a80c75e4a0a21451a59c86986e5348318da4d295e8d02520fa674ce89756903b25521b5ad358f8328c5591a9702494cc24e340418dbcf08ef06214a8e90c4836dc6f8465fd59385bd56407d83bfc8a633e8125c523ff23dd8c669169848668d5aefe059ee5091e1776ec4686efd0d6ccee0e0bea5922ee41fb36e63d5704633f85115f9584926bdb708a9edb
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber0f6146af9397c7fa04b13c2d0279a1ba
    Version3
    Certificate 03019a023aff58b16bd6d5eae617f066
    FieldValue
    ToBeSigned (TBS) MD5a752afee44f017e8d74e3f3eb7914ae3
    ToBeSigned (TBS) SHA18eca80a6b80e9c69dcef7745748524afb8019e2d
    ToBeSigned (TBS) SHA25682560fa7efec30b5ff82af643e6f3bf3d46868bbd5e7d76f93db185e9e3553a1
    SubjectC=US, O=DigiCert, CN=DigiCert Timestamp Responder
    ValidFrom2014-10-22 00:00:00
    ValidTo2024-10-22 00:00:00
    Signature9d257e1b334db226815c9b86ce23200f8087e588ffffb1d46a2c31ed3a17197117cda91bbc5a1639009de36c84e45a40fbde06018c37fa9bb19d247efe20a457ad5bb79ab06026ea6957215d342f1f71b0839419056b359010a07b97c7f63fe7e21141a6bd62d9f0273d381d286f3a5209f0ec7062d3624bb0e073a692c0d38e31d82fe36d171306eee403b614abf38f43a7719d21dd14ca155d9241daf90f81d199740d26c40e7f1bb5f5a0f1c677062815e9d893e55516f0bb0aab1cdb5c482766c8a38b0a1ce595daaec42e59a061dddaf36da261e98a0b6dec1218bdf755544003922b6bc251c20a48afb0d46ee0f4140a3a1be38f3dcaaf6a8d7bdcd844
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber03019a023aff58b16bd6d5eae617f066
    Version3
    Certificate 0dd0e3374ac95bdbfa6b434b2a48ec06
    FieldValue
    ToBeSigned (TBS) MD5f92649915476229b093c211c2b18e6c4
    ToBeSigned (TBS) SHA12d54c16a8f8b69ccdea48d0603c132f547a5cf75
    ToBeSigned (TBS) SHA2562cd702a7dec30aa441345672e8992ef9770ce4946f276d767b45b0ed627658fb
    SubjectC=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA
    ValidFrom2012-04-18 12:00:00
    ValidTo2027-04-18 12:00:00
    Signature9e5b963a2e1288acab016da49f75e40187a3a532d7bcbaa97ea3d61417f7c2136b7c738f2b6ae50f265968b08e259b6ceffa6c939208c14dcf459e9c46d61e74a19b14a3fa012f4ab101e1724048111368b9369d914bd7c2391210c1c4dcbb6214142a615d4f387c661fc61bffadbe4f7f945b7343000f4d73b751cf0ef677c05bcd348cd96313aa0e6111d6f28e27fcb47bb8b91120918678ea0ed428ff2ad52438e837b2ec96bb9fbc4a1650e15ebf517d23a032c7c1949e7ac9c026a2cc2587a0127e749f2d8db1c8e784beb9d1e9debb6a4e887371e12238cb2487e9737e51b2ff98eb4e7e2fe0ca0efab35ed1ba0542a8489f83f63fc4caa8df68a05061
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber0dd0e3374ac95bdbfa6b434b2a48ec06
    Version3
    Certificate 06fdf9039603adea000aeb3f27bbba1b
    FieldValue
    ToBeSigned (TBS) MD54e5ad189638cf52ba9cd881d4d44668c
    ToBeSigned (TBS) SHA1cdc115e98d798b33904c820d63cc1e1afc19251d
    ToBeSigned (TBS) SHA25637560fb9d548ab62cc3ed4669a4ab74828b5a108e67e829937ffb2d10a5f78dd
    SubjectC=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID CA,1
    ValidFrom2006-11-10 00:00:00
    ValidTo2021-11-10 00:00:00
    Signature46503ec9b72824a7381db65b29af52cf52e93147ab565c7bd50d0b41b3efec751f7438f2b25c61a29c95c350e482b923d1ba3a8672ad3878ac755d1717347247859456d1ebbb368477cc24a5f3041955a9e7e3e7ab62cdfb8b2d90c2c0d2b594bd5e4fb105d20e3d1aa9145ba6863162a8a833e49b39a7c4f5ce1d7876942573e42aabcf9c764bed5fc24b16e44b704c00891efcc579bc4c1257fe5fe11ebc025da8fefb07384f0dc65d91b90f6745cdd683ede7920d8db1698c4ffb59e0230fd2aaae007cee9c420ecf91d727b716ee0fc3bd7c0aa0ee2c08558522b8eb181a4dfc2a21ad49318347957771dcb11b4b4b1c109c7714c19d4f2f5a9508291026
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber06fdf9039603adea000aeb3f27bbba1b
    Version3

    Imports

    Expand
    • ntoskrnl.exe
    • HAL.dll
    • CLASSPNP.SYS

    Imported Functions

    Expand
    • KePulseEvent
    • KeClearEvent
    • KeStackAttachProcess
    • KeUnstackDetachProcess
    • ObfDereferenceObject
    • ZwSetEvent
    • ZwClose
    • ZwConnectPort
    • RtlInitUnicodeString
    • RtlUnicodeStringToInteger
    • ZwCreateSection
    • ZwWaitForSingleObject
    • ZwOpenEvent
    • IoGetCurrentProcess
    • ObfReferenceObject
    • DbgBreakPoint
    • ZwRequestWaitReplyPort
    • ExFreePoolWithTag
    • ProbeForWrite
    • ZwFreeVirtualMemory
    • ZwAllocateVirtualMemory
    • ObOpenObjectByPointer
    • PsProcessType
    • memmove
    • PsGetProcessExitTime
    • MmSectionObjectType
    • PsThreadType
    • ObReleaseObjectSecurity
    • SeReleaseSubjectContext
    • SeAccessCheck
    • SeCaptureSubjectContext
    • ObGetObjectSecurity
    • DbgPrint
    • memset
    • MmIsAddressValid
    • ExInitializeResourceLite
    • ExDeleteResourceLite
    • ZwWriteFile
    • ZwReadFile
    • ZwQueryInformationFile
    • ZwSetInformationFile
    • ZwCreateFile
    • swprintf
    • towupper
    • _wcsnicmp
    • ExAllocatePoolWithTag
    • KeInitializeEvent
    • _snprintf
    • PsGetCurrentProcessId
    • RtlTimeToTimeFields
    • ExSystemTimeToLocalTime
    • KeQuerySystemTime
    • PsGetCurrentThreadId
    • RtlInitAnsiString
    • ZwDeviceIoControlFile
    • ZwCreateKey
    • ZwCreateEvent
    • KeWaitForMultipleObjects
    • ObReferenceObjectByHandle
    • ZwNotifyChangeKey
    • _vsnprintf
    • RtlFreeUnicodeString
    • RtlAnsiStringToUnicodeString
    • RtlEqualUnicodeString
    • RtlAppendUnicodeStringToString
    • RtlCopyUnicodeString
    • RtlUpcaseUnicodeChar
    • RtlPrefixUnicodeString
    • ExGetPreviousMode
    • KeWaitForSingleObject
    • KeSetPriorityThread
    • PsTerminateSystemThread
    • PsCreateSystemThread
    • KeDelayExecutionThread
    • KeNumberProcessors
    • ZwQueryInformationProcess
    • PsLookupProcessByProcessId
    • ZwOpenDirectoryObject
    • PsSetCreateProcessNotifyRoutine
    • ZwQuerySystemInformation
    • ZwQueryDirectoryFile
    • ZwQueryDirectoryObject
    • ZwOpenKey
    • ZwEnumerateKey
    • ZwEnumerateValueKey
    • ZwQueryValueKey
    • ZwDeleteValueKey
    • ZwDeleteKey
    • ZwTerminateProcess
    • ZwOpenProcess
    • ZwQueryKey
    • ZwSetValueKey
    • IoFileObjectType
    • KeSetEvent
    • ZwQuerySecurityObject
    • ZwSetSecurityObject
    • RtlLengthSecurityDescriptor
    • MmHighestUserAddress
    • IoFreeIrp
    • _purecall
    • MmUnlockPages
    • IoBuildAsynchronousFsdRequest
    • _strnicmp
    • RtlQueryRegistryValues
    • RtlAppendUnicodeToString
    • mbstowcs
    • ZwQuerySymbolicLinkObject
    • ZwOpenSymbolicLinkObject
    • NtClose
    • ObQueryNameString
    • MmGetSystemRoutineAddress
    • ZwSetInformationObject
    • _stricmp
    • ZwUnmapViewOfSection
    • ZwMapViewOfSection
    • ZwOpenFile
    • IoCreateFile
    • IofCallDriver
    • IoAllocateIrp
    • MmBuildMdlForNonPagedPool
    • IoAllocateMdl
    • ProbeForRead
    • PsGetVersion
    • RtlImageNtHeader
    • RtlCompareMemory
    • RtlUpcaseUnicodeString
    • _snwprintf
    • MmSystemRangeStart
    • wcsncmp
    • strrchr
    • ZwQueryVolumeInformationFile
    • ObReferenceObjectByPointer
    • IoBuildDeviceIoControlRequest
    • ZwOpenSection
    • _allmul
    • KeReleaseSemaphore
    • RtlLengthRequiredSid
    • RtlInitializeSid
    • RtlSubAuthoritySid
    • RtlSetDaclSecurityDescriptor
    • RtlCreateSecurityDescriptor
    • RtlAddAccessAllowedAce
    • RtlCreateAcl
    • KeInitializeSemaphore
    • IoGetDeviceObjectPointer
    • IofCompleteRequest
    • ExEventObjectType
    • IoDeleteDevice
    • IoDeleteSymbolicLink
    • IoCreateSymbolicLink
    • RtlUpperChar
    • ObReferenceObjectByName
    • IoDriverObjectType
    • RtlCompareUnicodeString
    • strncpy
    • KeServiceDescriptorTable
    • NtOpenProcess
    • ObOpenObjectByName
    • NtQueryInformationProcess
    • PsIsThreadTerminating
    • KeAddSystemServiceTable
    • ZwFsControlFile
    • ObInsertObject
    • IoReleaseVpbSpinLock
    • IoAcquireVpbSpinLock
    • SeCreateAccessState
    • IoGetFileObjectGenericMapping
    • ObCreateObject
    • _allshr
    • ExInterlockedPopEntrySList
    • IoGetStackLimits
    • IoBuildSynchronousFsdRequest
    • wcsstr
    • IoUnregisterPlugPlayNotification
    • FsRtlIsNameInExpression
    • IoGetConfigurationInformation
    • MmProbeAndLockPages
    • IoGetDeviceInterfaces
    • IoRegisterPlugPlayNotification
    • ExAllocatePool
    • wcschr
    • KeTickCount
    • KeBugCheckEx
    • RtlUnwind
    • wcsrchr
    • memcpy
    • wcsncpy
    • ExReleaseResourceLite
    • ExAcquireResourceExclusiveLite
    • ExAcquireResourceSharedLite
    • ExReleaseFastMutexUnsafe
    • KeLeaveCriticalRegion
    • KeEnterCriticalRegion
    • _allrem
    • ExAcquireFastMutexUnsafe
    • IoDeviceObjectType
    • IoCreateDevice
    • RtlGetDaclSecurityDescriptor
    • RtlGetSaclSecurityDescriptor
    • RtlGetGroupSecurityDescriptor
    • RtlGetOwnerSecurityDescriptor
    • SeCaptureSecurityDescriptor
    • SeExports
    • IoIsWdmVersionAvailable
    • RtlLengthSid
    • RtlAbsoluteToSelfRelativeSD
    • IoFreeMdl
    • KeGetCurrentThread
    • KfAcquireSpinLock
    • KfReleaseSpinLock
    • KeRaiseIrqlToDpcLevel
    • KfLowerIrql
    • KeAcquireQueuedSpinLock
    • KeReleaseQueuedSpinLock
    • ExAcquireFastMutex
    • ExReleaseFastMutex
    • KeGetCurrentIrql
    • KfRaiseIrql
    • ClassInitialize

    Exported Functions

    Expand
    • ??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
    • ??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
    • ??0CBlobConfig@@QAE@ABV0@@Z
    • ??0CBlobConfig@@QAE@K@Z
    • ??0CContext@@QAE@ABV0@@Z
    • ??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
    • ??0CContextList@@QAE@ABV0@@Z
    • ??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CDebugLog@@QAE@ABV0@@Z
    • ??0CDebugLog@@QAE@PBG@Z
    • ??0CDebugLogEx@@QAE@ABV0@@Z
    • ??0CDebugLogEx@@QAE@K@Z
    • ??0CDelayLoadThread@@QAE@ABV0@@Z
    • ??0CDelayLoadThread@@QAE@XZ
    • ??0CExclusionExtConfig@@QAE@ABV0@@Z
    • ??0CExclusionExtConfig@@QAE@KKE@Z
    • ??0CExclusionFileNameConfig@@QAE@ABV0@@Z
    • ??0CExclusionFileNameConfig@@QAE@KK@Z
    • ??0CExclusionFilePathConfig@@QAE@ABV0@@Z
    • ??0CExclusionFilePathConfig@@QAE@KK@Z
    • ??0CExclusionFolderConfig@@QAE@ABV0@@Z
    • ??0CExclusionFolderConfig@@QAE@KK@Z
    • ??0CExclusionRegistryConfig@@QAE@ABV0@@Z
    • ??0CExclusionRegistryConfig@@QAE@KK@Z
    • ??0CFile@@QAE@ABV0@@Z
    • ??0CFile@@QAE@E@Z
    • ??0CFileExtension@@QAE@ABV0@@Z
    • ??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
    • ??0CInclusionExtConfig@@QAE@ABV0@@Z
    • ??0CInclusionExtConfig@@QAE@KKE@Z
    • ??0CInclusionFileNameConfig@@QAE@ABV0@@Z
    • ??0CInclusionFileNameConfig@@QAE@KK@Z
    • ??0CInclusionFilePathConfig@@QAE@ABV0@@Z
    • ??0CInclusionFilePathConfig@@QAE@KK@Z
    • ??0CInclusionFolderConfig@@QAE@ABV0@@Z
    • ??0CInclusionFolderConfig@@QAE@KK@Z
    • ??0CKEvent@@QAE@ABV0@@Z
    • ??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
    • ??0CList@@QAE@ABV0@@Z
    • ??0CList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CLockEvent@@QAE@ABV0@@Z
    • ??0CLockEvent@@QAE@XZ
    • ??0CLockList@@QAE@ABV0@@Z
    • ??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
    • ??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
    • ??0CMemoryAllocator@@QAE@ABV0@@Z
    • ??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
    • ??0CMemoryPoolAllocator@@QAE@ABV0@@Z
    • ??0CModuleConfig@@QAE@ABV0@@Z
    • ??0CModuleConfig@@QAE@XZ
    • ??0CModuleConfigList@@QAE@ABV0@@Z
    • ??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CModuleFileExtConfig@@QAE@ABV0@@Z
    • ??0CModuleFileExtConfig@@QAE@KKE@Z
    • ??0CModuleFlagConfig@@QAE@ABV0@@Z
    • ??0CModuleFlagConfig@@QAE@K@Z
    • ??0CModuleMultiStringConfig@@QAE@ABV0@@Z
    • ??0CModuleMultiStringConfig@@QAE@KK@Z
    • ??0CModuleStringConfig@@QAE@ABV0@@Z
    • ??0CModuleStringConfig@@QAE@K@Z
    • ??0CNoLockList@@QAE@ABV0@@Z
    • ??0CNoLockList@@QAE@KKPAVIMemoryAllocator@@@Z
    • ??0CSmartLock@@QAE@AAVCLockEvent@@@Z
    • ??0CSmartLock@@QAE@XZ
    • ??0CSmartReference@@QAE@AAJ@Z
    • ??0CSmartReference@@QAE@AAK@Z
    • ??0CSmartResource@@QAE@AAVCResource@@E@Z
    • ??0CStrList@@QAE@ABV0@@Z
    • ??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CSystemThread@@QAE@ABV0@@Z
    • ??0CSystemThread@@QAE@K@Z
    • ??0CUserFuncAdapterJob@@QAE@ABV0@@Z
    • ??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z01@Z
    • ??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
    • ??0CWorkerThread@@QAE@ABV0@@Z
    • ??0CWorkerThreadJob@@QAE@ABV0@@Z
    • ??0CWorkerThreadJob@@QAE@E@Z
    • ??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
    • ??0CWorkerThreadJobQueue@@QAE@K@Z
    • ??0CWorkerThreadPool@@QAE@ABV0@@Z
    • ??0CWorkerThreadPool@@QAE@K@Z
    • ??0CWorkerThreadPoolEx@@QAE@ABV0@@Z
    • ??0CWorkerThreadPoolEx@@QAE@KK@Z
    • ??0IMemoryAllocator@@QAE@ABV0@@Z
    • ??0IMemoryAllocator@@QAE@XZ
    • ??1CAutoUpdateConfigThread@@UAE@XZ
    • ??1CBlobConfig@@UAE@XZ
    • ??1CContext@@UAE@XZ
    • ??1CContextList@@UAE@XZ
    • ??1CDebugLog@@UAE@XZ
    • ??1CDebugLogEx@@UAE@XZ
    • ??1CDelayLoadThread@@UAE@XZ
    • ??1CExclusionExtConfig@@UAE@XZ
    • ??1CExclusionFileNameConfig@@UAE@XZ
    • ??1CExclusionFilePathConfig@@UAE@XZ
    • ??1CExclusionFolderConfig@@UAE@XZ
    • ??1CExclusionRegistryConfig@@UAE@XZ
    • ??1CFile@@UAE@XZ
    • ??1CFileExtension@@UAE@XZ
    • ??1CInclusionExtConfig@@UAE@XZ
    • ??1CInclusionFileNameConfig@@UAE@XZ
    • ??1CInclusionFilePathConfig@@UAE@XZ
    • ??1CInclusionFolderConfig@@UAE@XZ
    • ??1CKEvent@@UAE@XZ
    • ??1CList@@UAE@XZ
    • ??1CLockEvent@@UAE@XZ
    • ??1CLockList@@UAE@XZ
    • ??1CMemoryAllocator@@UAE@XZ
    • ??1CMemoryPoolAllocator@@UAE@XZ
    • ??1CModuleConfig@@UAE@XZ
    • ??1CModuleConfigList@@UAE@XZ
    • ??1CModuleFileExtConfig@@UAE@XZ
    • ??1CModuleFlagConfig@@UAE@XZ
    • ??1CModuleMultiStringConfig@@UAE@XZ
    • ??1CModuleStringConfig@@UAE@XZ
    • ??1CNoLockList@@UAE@XZ
    • ??1CSmartLock@@QAE@XZ
    • ??1CSmartReference@@QAE@XZ
    • ??1CSmartResource@@QAE@XZ
    • ??1CStrList@@UAE@XZ
    • ??1CSystemThread@@UAE@XZ
    • ??1CUserFuncAdapterJob@@UAE@XZ
    • ??1CWorkerThread@@UAE@XZ
    • ??1CWorkerThreadJob@@UAE@XZ
    • ??1CWorkerThreadJobQueue@@UAE@XZ
    • ??1CWorkerThreadPool@@UAE@XZ
    • ??1CWorkerThreadPoolEx@@UAE@XZ
    • ??1IMemoryAllocator@@UAE@XZ
    • ??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
    • ??2CMemoryAllocator@@SGPAXI@Z
    • ??2CMemoryPoolAllocator@@SGPAXI@Z
    • ??3@YAXPAX@Z
    • ??3IMemoryAllocator@@SGXPAX@Z
    • ??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
    • ??4CBlobConfig@@QAEAAV0@ABV0@@Z
    • ??4CContext@@QAEAAV0@ABV0@@Z
    • ??4CDebugLog@@QAEAAV0@ABV0@@Z
    • ??4CDebugLogEx@@QAEAAV0@ABV0@@Z
    • ??4CDelayLoadThread@@QAEAAV0@ABV0@@Z
    • ??4CFile@@QAEAAV0@ABV0@@Z
    • ??4CKEvent@@QAEAAV0@ABV0@@Z
    • ??4CLockEvent@@QAEAAV0@ABV0@@Z
    • ??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
    • ??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
    • ??4CModuleConfig@@QAEAAV0@ABV0@@Z
    • ??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
    • ??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
    • ??4CSmartLock@@QAEAAV0@ABV0@@Z
    • ??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
    • ??4CSmartResource@@QAEAAV0@ABV0@@Z
    • ??4CSystemThread@@QAEAAV0@ABV0@@Z
    • ??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
    • ??4CWorkerThread@@QAEAAV0@ABV0@@Z
    • ??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
    • ??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
    • ??_7CAutoUpdateConfigThread@@6B@
    • ??_7CBlobConfig@@6B@
    • ??_7CContext@@6B@
    • ??_7CContextList@@6B@
    • ??_7CDebugLog@@6B@
    • ??_7CDebugLogEx@@6B@
    • ??_7CDelayLoadThread@@6B@
    • ??_7CExclusionExtConfig@@6B@
    • ??_7CExclusionFileNameConfig@@6B@
    • ??_7CExclusionFilePathConfig@@6B@
    • ??_7CExclusionFolderConfig@@6B@
    • ??_7CExclusionRegistryConfig@@6B@
    • ??_7CFile@@6B@
    • ??_7CFileExtension@@6B@
    • ??_7CInclusionExtConfig@@6B@
    • ??_7CInclusionFileNameConfig@@6B@
    • ??_7CInclusionFilePathConfig@@6B@
    • ??_7CInclusionFolderConfig@@6B@
    • ??_7CKEvent@@6B@
    • ??_7CList@@6B@
    • ??_7CLockEvent@@6B@
    • ??_7CLockList@@6B@
    • ??_7CMemoryAllocator@@6B@
    • ??_7CMemoryPoolAllocator@@6B@
    • ??_7CModuleConfig@@6B@
    • ??_7CModuleConfigList@@6B@
    • ??_7CModuleFileExtConfig@@6B@
    • ??_7CModuleFlagConfig@@6B@
    • ??_7CModuleMultiStringConfig@@6B@
    • ??_7CModuleStringConfig@@6B@
    • ??_7CNoLockList@@6B@
    • ??_7CStrList@@6B@
    • ??_7CSystemThread@@6B@
    • ??_7CUserFuncAdapterJob@@6B@
    • ??_7CWorkerThread@@6B@
    • ??_7CWorkerThreadJob@@6B@
    • ??_7CWorkerThreadJobQueue@@6B@
    • ??_7CWorkerThreadPool@@6B@
    • ??_7CWorkerThreadPoolEx@@6B@
    • ??_7IMemoryAllocator@@6B@
    • ??_FCContextList@@QAEXXZ
    • ??_FCFile@@QAEXXZ
    • ??_FCFileExtension@@QAEXXZ
    • ??_FCModuleConfigList@@QAEXXZ
    • ??_FCStrList@@QAEXXZ
    • ??_FCSystemThread@@QAEXXZ
    • ??_FCWorkerThread@@QAEXXZ
    • ??_FCWorkerThreadJob@@QAEXXZ
    • ??_FCWorkerThreadJobQueue@@QAEXXZ
    • ??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
    • ??_V@YAXPAX@Z
    • ?Acquire@CLockEvent@@QAEXXZ
    • ?Add@CContextList@@QAEEPAVCContext@@@Z
    • ?Add@CFileExtension@@QAEEPBGK@Z
    • ?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
    • ?Add@CStrList@@QAEEPBG@Z
    • ?AddNode@CLockList@@UAEEQAXE@Z
    • ?AddNode@CNoLockList@@UAEEQAXE@Z
    • ?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
    • ?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
    • ?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
    • ?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
    • ?Cancel@CWorkerThreadJob@@QAEXXZ
    • ?CheckNode@CLockList@@UAEHQAX@Z
    • ?CheckNode@CNoLockList@@UAEHQAX@Z
    • ?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
    • ?Cleanup@CBlobConfig@@AAEXXZ
    • ?Cleanup@CModuleFileExtConfig@@IAEXXZ
    • ?Cleanup@CModuleMultiStringConfig@@IAEXXZ
    • ?Cleanup@CModuleStringConfig@@AAEXXZ
    • ?Close@CFile@@QAEJXZ
    • ?Count@CLockList@@QAEKXZ
    • ?Count@CNoLockList@@QAEKXZ
    • ?Create@CFile@@QAEJPBGKKKK@Z
    • ?Create@CSystemThread@@QAEEXZ
    • ?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
    • ?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
    • ?CreatePool@CWorkerThreadPool@@QAEEXZ
    • ?CreatePool@CWorkerThreadPoolEx@@QAEEXZ
    • ?CreateThreads@CWorkerThreadPool@@QAEEK@Z
    • ?CreateThreads@CWorkerThreadPoolEx@@QAEEK@Z
    • ?CreateWIRP@CFile@@QAEJPBGKKKK@Z
    • ?Delete@CFile@@QAEJXZ
    • ?Delete@CFileExtension@@QAEEPBGK@Z
    • ?Delete@CStrList@@QAEEPBG@Z
    • ?DeleteAll@CList@@UAEXXZ
    • ?DeleteAll@CLockList@@UAEXXZ
    • ?DeleteAll@CNoLockList@@UAEXXZ
    • ?DeleteNode@CContextList@@MAEXPAX@Z
    • ?DeleteNode@CList@@UAEXPAX@Z
    • ?DeleteNode@CModuleConfigList@@MAEXPAX@Z
    • ?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
    • ?DisableWriteProtectFromCR0@@YGXPAPAX@Z
    • ?DoIt@CWorkerThreadJob@@QAEJXZ
    • ?EntryPoint@CSystemThread@@KGXPAX@Z
    • ?Find@CContextList@@QAEPAVCContext@@K@Z
    • ?Find@CContextList@@QAEPAVCContext@@PAX@Z
    • ?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
    • ?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
    • ?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
    • ?FindNode@CContextList@@IAEPAXPAX@Z
    • ?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
    • ?FinishFunction@CUserFuncAdapterJob@@MAEXXZ
    • ?FinishIt@CWorkerThreadJob@@QAEJXZ
    • ?First@CList@@UAEPAXXZ
    • ?First@CLockList@@UAEPAXXZ
    • ?First@CNoLockList@@UAEPAXXZ
    • ?Free@CMemoryAllocator@@UAEXPAX@Z
    • ?Free@CMemoryPoolAllocator@@UAEXPAX@Z
    • ?GetAttributes@CFile@@QAEKXZ
    • ?GetBasicInfomration@CFile@@IAEJXZ
    • ?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
    • ?GetCategory@CContext@@QAEKXZ
    • ?GetData@CBlobConfig@@QAEHPAXPAK@Z
    • ?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
    • ?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
    • ?GetData@CModuleFlagConfig@@QAEKXZ
    • ?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
    • ?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
    • ?GetData@CModuleStringConfig@@QAEPAGXZ
    • ?GetData@CStrList@@QAEEPAGPAK@Z
    • ?GetDataType@CModuleConfig@@QAEKXZ
    • ?GetEngineContext@CContext@@QAEPAXXZ
    • ?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
    • ?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
    • ?GetFileSizeWIRP@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
    • ?GetFlagConfig@CContext@@UAEJKPAK@Z
    • ?GetID@CModuleConfig@@QAEKXZ
    • ?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
    • ?GetLength@CModuleStringConfig@@QAEKXZ
    • ?GetLinkContext@CContext@@QAEPAXXZ
    • ?GetLogFlag@CDebugLog@@QAEKXZ
    • ?GetLogFlag@CDebugLogEx@@QAEKXZ
    • ?GetModuleId@CModuleConfig@@QAEKXZ
    • ?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
    • ?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_KTHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_ETHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_KTHREAD@@XZ
    • ?GetReportCallBackRoutine@CContext@@QAEKXZ
    • ?GetSize@CBlobConfig@@QAEKXZ
    • ?GetStringConfig@CContext@@QAEPAGK@Z
    • ?GetStringConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetThreadCount@CWorkerThreadPool@@QAEKXZ
    • ?GetThreadCount@CWorkerThreadPoolEx@@QAEKXZ
    • ?GetThreadID@CSystemThread@@QAEKXZ
    • ?GetType@CContext@@QAEKXZ
    • ?GetUserParameter@CContext@@QAEKXZ
    • ?InitProcMon@CDebugLogEx@@IAEXXZ
    • ?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
    • ?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
    • ?InitializeFlagConfig@CContext@@QAEHKK@Z
    • ?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
    • ?InitializeStringConfig@CContext@@QAEHKPBG@Z
    • ?Insert@CList@@UAEXQAXE@Z
    • ?Insert@CLockList@@UAEXQAXE@Z
    • ?Insert@CNoLockList@@UAEXQAXE@Z
    • ?InsertAfter@CList@@UAEXPAX0@Z
    • ?InsertBefore@CList@@UAEXPAX0@Z
    • ?Instance@CWorkerThreadPool@@SGPAV1@XZ
    • ?IsEmpty@CList@@UAEEXZ
    • ?IsEmpty@CLockList@@UAEEXZ
    • ?IsEmpty@CNoLockList@@UAEEXZ
    • ?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
    • ?IsFull@CLockList@@QBEEXZ
    • ?IsFull@CNoLockList@@QBEEXZ
    • ?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionExtConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFileNameConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFilePathConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFolderConfig@@QAEEPBG@Z
    • ?IsOpened@CFile@@QAEEXZ
    • ?IsTerminated@CWorkerThreadPool@@QAEEXZ
    • ?IsTerminated@CWorkerThreadPoolEx@@QAEEXZ
    • ?IsValid@CMemoryAllocator@@UAEEXZ
    • ?IsValid@CMemoryPoolAllocator@@UAEEXZ
    • ?IsValid@IMemoryAllocator@@UAEEXZ
    • ?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
    • ?IsWorkerThread@CWorkerThreadPoolEx@@QAEEK@Z
    • ?JobFunction@CUserFuncAdapterJob@@MAEXXZ
    • ?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
    • ?JobQueue@CWorkerThreadPoolEx@@QAEAAVCWorkerThreadJobQueue@@XZ
    • ?Limit@CLockList@@QAEKXZ
    • ?Limit@CNoLockList@@QAEKXZ
    • ?MatchAllExtensions@CFileExtension@@QAEEXZ
    • ?MatchNoExtensions@CFileExtension@@QAEEXZ
    • ?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
    • ?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
    • ?NeedDelete@CWorkerThreadJob@@QAEEXZ
    • ?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
    • ?NewNode@CList@@UAEPAXXZ
    • ?NewNode@CStrList@@EAEPAXXZ
    • ?NewNodeVariant@CList@@IAEPAXK@Z
    • ?Next@CList@@UBEPAXQAX@Z
    • ?Next@CLockList@@UBEPAXQAX@Z
    • ?Next@CNoLockList@@UBEPAXQAX@Z
    • ?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
    • ?NotityTerminate@CWorkerThread@@QAEXXZ
    • ?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
    • ?PostJobToWorkerThread@CWorkerThreadPoolEx@@QAEJP6GXPAX@Z0E1@Z
    • ?Pulse@CKEvent@@QAEJJE@Z
    • ?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
    • ?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
    • ?QueueJobItem@CWorkerThreadPoolEx@@QAEJPAVCWorkerThreadJob@@@Z
    • ?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
    • ?Read@CFile@@QAEJPADKPAK@Z
    • ?ReadWIRP@CFile@@QAEJPADKPAK@Z
    • ?ReferenceCount@CContext@@QAEAAKXZ
    • ?Release@CLockEvent@@QAEXXZ
    • ?Remove@CContextList@@UAEEQAX@Z
    • ?Remove@CList@@UAEEQAX@Z
    • ?Remove@CLockList@@UAEEQAX@Z
    • ?Remove@CNoLockList@@UAEEQAX@Z
    • ?RemoveHead@CList@@UAEPAXXZ
    • ?RemoveHead@CLockList@@UAEPAXXZ
    • ?RemoveHead@CNoLockList@@UAEPAXXZ
    • ?RemoveTail@CList@@UAEPAXXZ
    • ?RemoveTail@CLockList@@UAEPAXXZ
    • ?RemoveTail@CNoLockList@@UAEPAXXZ
    • ?Reset@CKEvent@@QAEXXZ
    • ?ResetData@CInclusionExtConfig@@QAEXXZ
    • ?ResetData@CInclusionFileNameConfig@@QAEXXZ
    • ?ResetData@CInclusionFilePathConfig@@QAEXXZ
    • ?ResetData@CInclusionFolderConfig@@QAEXXZ
    • ?RestoreCR0@@YGXPAX@Z
    • ?Run@CAutoUpdateConfigThread@@UAEXXZ
    • ?Run@CDelayLoadThread@@UAEXXZ
    • ?Run@CWorkerThread@@UAEXXZ
    • ?SeekToEnd@CFile@@QAEJXZ
    • ?Set@CKEvent@@QAEJJE@Z
    • ?SetAttributes@CFile@@QAEJK@Z
    • ?SetBlobCofig@CContext@@UAEJKPAXK@Z
    • ?SetData@CBlobConfig@@QAEHPAXK@Z
    • ?SetData@CModuleFileExtConfig@@QAEHPBG@Z
    • ?SetData@CModuleFlagConfig@@QAEHK@Z
    • ?SetData@CModuleMultiStringConfig@@QAEHPBGK@Z
    • ?SetData@CModuleStringConfig@@QAEHPBG@Z
    • ?SetEngineContext@CContext@@QAEXPAX@Z
    • ?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
    • ?SetFlagConfig@CContext@@UAEJKK@Z
    • ?SetLinkContext@CContext@@QAEXPAX@Z
    • ?SetLogFlag@CDebugLog@@QAEEK@Z
    • ?SetLogFlag@CDebugLogEx@@QAEEK@Z
    • ?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
    • ?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
    • ?SetMultiStringConfig@CContext@@UAEJKPBG@Z
    • ?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
    • ?SetPriority@CSystemThread@@QAEXK@Z
    • ?SetStopUse@CContext@@QAEXXZ
    • ?SetStringConfig@CContext@@UAEJKPBG@Z
    • ?Setup@CSystemThread@@MAEXXZ
    • ?StopUse@CContext@@QAEHXZ
    • ?TearDown@CSystemThread@@MAEXXZ
    • ?Terminate@CSystemThread@@QAEXE@Z
    • ?Terminate@CWorkerThreadPool@@QAEEXZ
    • ?Terminate@CWorkerThreadPoolEx@@QAEEXZ
    • ?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
    • ?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
    • ?WaitFinish@CWorkerThreadJob@@QAEXXZ
    • ?WaitForInit@CDelayLoadThread@@QAEEXZ
    • ?WaitForLoad@CDelayLoadThread@@QAEEXZ
    • ?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
    • ?WaitQueueEmpty@CWorkerThreadJobQueue@@QAEXXZ
    • ?Write@CDebugLog@@QAAXPBDZZ
    • ?Write@CDebugLogEx@@QAAXPBDZZ
    • ?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
    • ?WriteDataToFile@CDebugLogEx@@IAEXPADK@Z
    • ?WriteDataToProcMonW@CDebugLogEx@@IAEXPAD@Z
    • ?WriteSystemInformation@CDebugLog@@QAEXXZ
    • ?WriteSystemInformation@CDebugLogEx@@QAEXXZ
    • ?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
    • ?WriteSystemStringInformation@CDebugLogEx@@IAEXPBG@Z
    • ?WriteToFile@CDebugLog@@IAEXPADK@Z
    • ?WriteToProcMonW@CDebugLogEx@@IAEXPAU_UNICODE_STRING@@@Z
    • ?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
    • ?_pPagedAllocator@@3PAVCMemoryAllocator@@A
    • ?m_lpInstance@CWorkerThreadPool@@1PAV1@A
    • ?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
    • _DeInitKm2UmCommunication@0
    • _DeInitKmLPC@0
    • _DuplicateFullFileName@4
    • _FreeFullFileName@4
    • _GetFileVersionOfNtoskrnl@16
    • _GetKm2UmMode@0
    • _GetModuleInfoByAddress@8
    • _GetModuleInfoByModuleName@8
    • _InitKm2UmCommunication@8
    • _InitKmLPC@0
    • _IsWindows8_1_update@4
    • _KmCallUm@8
    • _KmCallUmByLPC@8
    • _KmCallUmEx@12
    • _KmCleanupCommPortAPIs@0
    • _KmGetUmInitProcess@0
    • _KmSetCommPortAPIs@4
    • _ModGetExportProcAddress@8
    • _ModLoadDLLToBuffer@4
    • _ModLoadDLLToBufferWithImageSize@8
    • _ModLoadModule@8
    • _ModUnLoadModule@4
    • _NormalizeFileName1@8
    • _NormalizeFileName@4
    • _NormalizeFullNtPathToDosName1@8
    • _NormalizeFullNtPathToDosName@4
    • _TmCommConfigRoutine@4
    • _UtilAddDeviceInDriveTable@4
    • _UtilAddReparsePointMapping@8
    • _UtilCleanFileReadOnly@4
    • _UtilCloseExclusiveHandle@12
    • _UtilCreateDosFileName@8
    • _UtilDeleteFileForce@4
    • _UtilGetDeviceObjectName@8
    • _UtilGetFileNameFromFileObject@4
    • _UtilGetFileObjectForProcessByEPROC@8
    • _UtilGetFileObjectFromFileName@12
    • _UtilGetProcessName@12
    • _UtilGetSystemDirectory@4
    • _UtilGetSystemDirectoryEx@0
    • _UtilGetSystemDirectoryLength@0
    • _UtilGetSystemTime@4
    • _UtilIoSetFileInfo@24
    • _UtilIopCreateFileIRP@40
    • _UtilKeGetLowFileDevice@16
    • _UtilModuleIATHook@24
    • _UtilModuleIATUnHook@8
    • _UtilPostJobToWorkerThread@12
    • _UtilQueryExclusiveHandle@12
    • _UtilQueryKeyValue@24
    • _UtilRemoveDeviceFromDriveTable@4
    • _UtilVolumeDeviceToDosName@8
    • _UtilWaitValueChangeToZero@8
    • _UtilWriteVersionToRegistry@8
    • _UtilbuildDynamicDiskMappingTable@0
    • _UtlWriteBinValueKeyToRegistry@16
    • _ValidateAddressWithSize@20
    • __ResetProtectFromClose@4
    • __UtilDosPathNameToNtPathName@12

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • PAGE
    • .edata
    • INIT
    • .rsrc
    • .reloc

    Signature

    Expand
    {
      "Certificates": [
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
          "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
          "TBS": {
            "MD5": "d0785ad36e427c92b19f6826ab1e8020",
            "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
            "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
            "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
          },
          "ValidFrom": "2012-12-21 00:00:00",
          "ValidTo": "2020-12-30 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
          "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
          "TBS": {
            "MD5": "e9d38360b914c8863f6cba3ee58764d3",
            "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
            "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
            "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
          },
          "ValidFrom": "2012-10-18 00:00:00",
          "ValidTo": "2020-12-29 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
          "TBS": {
            "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
            "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
            "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
            "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
          },
          "ValidFrom": "2017-04-27 00:00:00",
          "ValidTo": "2018-07-16 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "611993e400000000001c",
          "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
          "TBS": {
            "MD5": "78a717e082dcc1cda3458d917e677d14",
            "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
            "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
            "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
          },
          "ValidFrom": "2011-02-22 19:25:17",
          "ValidTo": "2021-02-22 19:35:17",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
          "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "TBS": {
            "MD5": "b30c31a572b0409383ed3fbe17e56e81",
            "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
            "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
            "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
          },
          "ValidFrom": "2010-02-08 00:00:00",
          "ValidTo": "2020-02-07 23:59:59",
          "Version": 3
        }
      ],
      "CertificatesInfo": "",
      "Signer": [
        {
          "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Version": 1
        }
      ],
      "SignerInfo": ""
    }
    

    PropertyValue
    FilenameTmComm.sys
    Creation Timestamp2013-09-02 01:57:59
    MD54c6d311e0b13c4f469f717db4ab4d0e7
    SHA16da2dd8a0b4c0e09a04613bbabfc07c0b848ec77
    SHA25680a59ca71fc20961ccafc0686051e86ae4afbbd4578cb26ad4570b9207651085
    Authentihash MD58dfae750a79d89ab846e49f1f587a361
    Authentihash SHA11d11a90b1d32a812a7dd36a886254d446cdd823a
    Authentihash SHA256af45d91fefd4dfffda0ce70957a542b68775368432e52d20dfdf0fc159495c7f
    RichPEHeaderHash MD501697b3eff62a3013d7497c38b3d0912
    RichPEHeaderHash SHA192ba287f9a361cd285dec165334bbe382f84fbdf
    RichPEHeaderHash SHA256f63b567f5dd45b44a7a0d5177f8f6afad21bc8fb958ff75651ad3c55956f9008
    CompanyTrend Micro Inc.
    DescriptionTrendMicro Common Module
    ProductTrend Micro Eyes
    OriginalFilenameTmComm.sys

    Download

    Certificates

    Expand
    Certificate 478a8efb59e1d83f0ce142d2a28707be
    FieldValue
    ToBeSigned (TBS) MD5f13ede9179075999ef7f856ec31e364b
    ToBeSigned (TBS) SHA12f09867166e6107e17808317f5c8d4ee157f45bc
    ToBeSigned (TBS) SHA256089a2c4c6ac7432020acdb65c33bf39130da6f37c002ba79128bd4c94e4fa101
    SubjectC=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO Time Stamping Signer
    ValidFrom2010-05-10 00:00:00
    ValidTo2015-05-10 23:59:59
    Signaturec8fb63f80b75752c3af1f213a72db6a31a9cad0107d3348e77e0c26eae025d484fa4d221b636fd2a35437c6bdf80870b15f0763200b4ceb567a42f2f201b9c549e833f1f5f149562820f2241221f70b3f3f742de6c51cd4bf821ac9b3b8cb1e5e6288fce2a8af9aa524d8c5b77ba4d5a58dbbb6a04cc521e9de228370ebbe70e91c7f8dbf18198ebcd37b30eab65d362ec3aa576eb13a83593c92e0a01ecc0e8cc3d7eb6ebe2c1ecd3149282668750dcfd5097acb34a767306c486113ab35f4304526feab3d074364ccaf11b7984377063ad74b9aa0ef398b08608ebdbe01f8c10f239649bae4f0a2c928a4f18b591e58d1a935f1faef1a6f02e97d0d2f62b3c
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber478a8efb59e1d83f0ce142d2a28707be
    Version3
    Certificate 4d6290e58c54f0f1eb17341a1310e6a4
    FieldValue
    ToBeSigned (TBS) MD5b7d8444a70054990435f35a5630df5e1
    ToBeSigned (TBS) SHA14678c6e4a8787a8e6ed2bce8792b122f6c08afd8
    ToBeSigned (TBS) SHA2560a8b4b359ea7890b358e56e436e9cfc6f32b037b2599b597ca7f7a80d475ec98
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
    ValidFrom2010-09-30 00:00:00
    ValidTo2014-01-01 23:59:59
    Signatureaedd211d5f8f807ad25209eadb6ed25d8be8c21b6904be51a5010e59fa37d174a3eedced89742b62d5a6bf4fad361754f013e0a345d24c26cbe26da21fd01e7a070fb6b37b6f5068a2e931b3b7997d8070a0a7de0b1ea4fff34d811bdd20c91cc4afcff18ffad9da95f0ecdc5cbfe88c5a3e7ab0a3eb59437411e09b1a6af36f
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber4d6290e58c54f0f1eb17341a1310e6a4
    Version3
    Certificate 610c120600000000001b
    FieldValue
    ToBeSigned (TBS) MD553c41bc1164e09e0cd1617a5bf913efd
    ToBeSigned (TBS) SHA193c03aac8951d494ecd5696b1c08658541b18727
    ToBeSigned (TBS) SHA25640bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b
    SubjectC=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
    ValidFrom2006-05-23 17:01:29
    ValidTo2016-05-23 17:11:29
    Signature01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber610c120600000000001b
    Version3
    Certificate 1a9d178ad334acdf47c8a0d15bb50e6e
    FieldValue
    ToBeSigned (TBS) MD5685d99029d38a9d263ea82cd02a49f6c
    ToBeSigned (TBS) SHA193464d8f54b4ee7caf22ca1db15a4211e0d3c79e
    ToBeSigned (TBS) SHA256894991f1477dff88c7c0707531073bb59483750bcad672fc388179affca07aa9
    SubjectC=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=Trend Micro, Inc.
    ValidFrom2013-01-17 00:00:00
    ValidTo2014-03-18 23:59:59
    Signature65c7e1e0f4051179852b819153b528c88db47ef50e897cd8ce0d03a7cc2dc896c89790410182186fecaf9da5c317bf57b5038311c10c2ec5ddb5c18165a7e92f92a6f39c042262126c714337a7c528041a04679217c1475a30231c967ca63b4430ccea52fe4f16fabb5c454d2aa8cdde347b8beaa973d76b3f9ba99d2597939a33d67ec4abc3974ef3792b8bc90d092cce62309d205129bbcbd3554382f24b2911b4904b09e7f52f24f2cc5a52fa49f3a163c32fde076e917301f22dd45d643b95319bae922bc861e5a8f90d4dd72603c7b1ea0229eca869ab8d086ae5286baeba9b99a12856dc1d3cd9f6d9da4b8d5a85896ba4587d8eba506a4fbba4a7bb49
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber1a9d178ad334acdf47c8a0d15bb50e6e
    Version3

    Imports

    Expand
    • ntoskrnl.exe
    • HAL.dll
    • CLASSPNP.SYS

    Imported Functions

    Expand
    • wcsrchr
    • KeSetEvent
    • KePulseEvent
    • KeClearEvent
    • KeInitializeSemaphore
    • KeWaitForSingleObject
    • KeReleaseSemaphore
    • KeStackAttachProcess
    • KeUnstackDetachProcess
    • RtlSubAuthoritySid
    • RtlInitializeSid
    • ExAllocatePoolWithTag
    • RtlLengthRequiredSid
    • ExFreePoolWithTag
    • RtlSetDaclSecurityDescriptor
    • RtlCreateSecurityDescriptor
    • RtlAddAccessAllowedAce
    • RtlCreateAcl
    • ObfDereferenceObject
    • ZwSetEvent
    • ZwClose
    • ZwRequestWaitReplyPort
    • ProbeForWrite
    • ZwFreeVirtualMemory
    • ZwAllocateVirtualMemory
    • ObOpenObjectByPointer
    • PsProcessType
    • memmove
    • ZwConnectPort
    • RtlInitUnicodeString
    • RtlUnicodeStringToInteger
    • ZwCreateSection
    • ZwWaitForSingleObject
    • ZwOpenEvent
    • ObfReferenceObject
    • IoGetCurrentProcess
    • DbgBreakPoint
    • PsGetProcessExitTime
    • MmSectionObjectType
    • PsThreadType
    • DbgPrint
    • memset
    • MmIsAddressValid
    • ExInitializeResourceLite
    • ExDeleteResourceLite
    • ZwWriteFile
    • ZwReadFile
    • ZwQueryInformationFile
    • ZwSetInformationFile
    • ZwCreateFile
    • swprintf
    • towupper
    • _wcsnicmp
    • KeInitializeEvent
    • _snprintf
    • PsGetCurrentProcessId
    • RtlTimeToTimeFields
    • ExSystemTimeToLocalTime
    • KeQuerySystemTime
    • ZwCreateKey
    • ZwCreateEvent
    • KeWaitForMultipleObjects
    • ObReferenceObjectByHandle
    • ZwNotifyChangeKey
    • PsGetCurrentThreadId
    • _vsnprintf
    • KeSetPriorityThread
    • PsTerminateSystemThread
    • PsCreateSystemThread
    • KeNumberProcessors
    • ZwQueryInformationProcess
    • PsLookupProcessByProcessId
    • KeDelayExecutionThread
    • ZwOpenDirectoryObject
    • PsSetCreateProcessNotifyRoutine
    • ZwQuerySystemInformation
    • ZwQueryDirectoryFile
    • ZwQueryDirectoryObject
    • ZwDuplicateObject
    • ZwOpenKey
    • ZwEnumerateKey
    • ZwEnumerateValueKey
    • ZwQueryValueKey
    • ZwDeleteValueKey
    • ZwDeleteKey
    • ExGetPreviousMode
    • ZwTerminateProcess
    • ZwOpenProcess
    • ZwQueryKey
    • ZwSetValueKey
    • MmHighestUserAddress
    • IoFreeIrp
    • memcpy
    • MmUnlockPages
    • IoBuildAsynchronousFsdRequest
    • _strnicmp
    • RtlQueryRegistryValues
    • RtlAppendUnicodeToString
    • _purecall
    • ZwQuerySymbolicLinkObject
    • ZwOpenSymbolicLinkObject
    • NtClose
    • ZwSetInformationObject
    • _stricmp
    • ZwUnmapViewOfSection
    • ZwMapViewOfSection
    • ZwOpenFile
    • RtlEqualUnicodeString
    • IoFileObjectType
    • IoCreateFile
    • IofCallDriver
    • IoAllocateIrp
    • MmBuildMdlForNonPagedPool
    • IoAllocateMdl
    • ProbeForRead
    • PsGetVersion
    • MmGetSystemRoutineAddress
    • RtlCopyUnicodeString
    • RtlCompareMemory
    • _snwprintf
    • RtlImageNtHeader
    • RtlFreeUnicodeString
    • RtlAnsiStringToUnicodeString
    • RtlInitAnsiString
    • strrchr
    • ZwQueryVolumeInformationFile
    • ObReferenceObjectByPointer
    • ObQueryNameString
    • IoBuildDeviceIoControlRequest
    • IofCompleteRequest
    • ExEventObjectType
    • _allmul
    • IoDeleteDevice
    • IoDeleteSymbolicLink
    • IoCreateSymbolicLink
    • IoGetDeviceObjectPointer
    • RtlUpperChar
    • RtlCompareUnicodeString
    • strncpy
    • KeServiceDescriptorTable
    • NtOpenProcess
    • ObOpenObjectByName
    • IoDriverObjectType
    • RtlAppendUnicodeStringToString
    • strncmp
    • NtQueryInformationProcess
    • IoThreadToProcess
    • PsIsThreadTerminating
    • KeAddSystemServiceTable
    • ZwQueryObject
    • ZwQuerySecurityObject
    • ObInsertObject
    • _allrem
    • IoReleaseVpbSpinLock
    • IoAcquireVpbSpinLock
    • SeCreateAccessState
    • IoGetFileObjectGenericMapping
    • RtlUpcaseUnicodeString
    • ObCreateObject
    • _allshr
    • ExInterlockedPopEntrySList
    • IoGetStackLimits
    • IoBuildSynchronousFsdRequest
    • MmSystemRangeStart
    • wcsstr
    • IoUnregisterPlugPlayNotification
    • FsRtlIsNameInExpression
    • IoGetConfigurationInformation
    • MmProbeAndLockPages
    • IoGetDeviceInterfaces
    • IoRegisterPlugPlayNotification
    • ExAllocatePool
    • RtlFreeAnsiString
    • RtlUnicodeStringToAnsiString
    • strncat
    • wcschr
    • wcsncat
    • wcstombs
    • KeTickCount
    • KeBugCheckEx
    • RtlUnwind
    • wcsncpy
    • ExReleaseResourceLite
    • ExAcquireResourceExclusiveLite
    • ExAcquireResourceSharedLite
    • ExReleaseFastMutexUnsafe
    • KeLeaveCriticalRegion
    • KeEnterCriticalRegion
    • IoFreeMdl
    • ExAcquireFastMutexUnsafe
    • ZwSetSecurityObject
    • IoDeviceObjectType
    • IoCreateDevice
    • RtlGetDaclSecurityDescriptor
    • RtlGetSaclSecurityDescriptor
    • RtlGetGroupSecurityDescriptor
    • RtlGetOwnerSecurityDescriptor
    • RtlLengthSecurityDescriptor
    • SeCaptureSecurityDescriptor
    • SeExports
    • IoIsWdmVersionAvailable
    • RtlLengthSid
    • RtlAbsoluteToSelfRelativeSD
    • mbstowcs
    • KeGetCurrentThread
    • KfAcquireSpinLock
    • KfReleaseSpinLock
    • KeRaiseIrqlToDpcLevel
    • KfLowerIrql
    • KeGetCurrentIrql
    • ExAcquireFastMutex
    • ExReleaseFastMutex
    • KfRaiseIrql
    • ClassInitialize

    Exported Functions

    Expand
    • ??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
    • ??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
    • ??0CBlobConfig@@QAE@ABV0@@Z
    • ??0CBlobConfig@@QAE@K@Z
    • ??0CContext@@QAE@ABV0@@Z
    • ??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
    • ??0CContextList@@QAE@ABV0@@Z
    • ??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CDebugLog@@QAE@ABV0@@Z
    • ??0CDebugLog@@QAE@PBG@Z
    • ??0CDelayLoadThread@@QAE@ABV0@@Z
    • ??0CDelayLoadThread@@QAE@XZ
    • ??0CExclusionExtConfig@@QAE@ABV0@@Z
    • ??0CExclusionExtConfig@@QAE@KKE@Z
    • ??0CExclusionFileNameConfig@@QAE@ABV0@@Z
    • ??0CExclusionFileNameConfig@@QAE@KK@Z
    • ??0CExclusionFilePathConfig@@QAE@ABV0@@Z
    • ??0CExclusionFilePathConfig@@QAE@KK@Z
    • ??0CExclusionFolderConfig@@QAE@ABV0@@Z
    • ??0CExclusionFolderConfig@@QAE@KK@Z
    • ??0CExclusionRegistryConfig@@QAE@ABV0@@Z
    • ??0CExclusionRegistryConfig@@QAE@KK@Z
    • ??0CFile@@QAE@ABV0@@Z
    • ??0CFile@@QAE@E@Z
    • ??0CFileExtension@@QAE@ABV0@@Z
    • ??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
    • ??0CInclusionExtConfig@@QAE@ABV0@@Z
    • ??0CInclusionExtConfig@@QAE@KKE@Z
    • ??0CInclusionFileNameConfig@@QAE@ABV0@@Z
    • ??0CInclusionFileNameConfig@@QAE@KK@Z
    • ??0CInclusionFilePathConfig@@QAE@ABV0@@Z
    • ??0CInclusionFilePathConfig@@QAE@KK@Z
    • ??0CInclusionFolderConfig@@QAE@ABV0@@Z
    • ??0CInclusionFolderConfig@@QAE@KK@Z
    • ??0CKEvent@@QAE@ABV0@@Z
    • ??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
    • ??0CList@@QAE@ABV0@@Z
    • ??0CList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CLockEvent@@QAE@ABV0@@Z
    • ??0CLockEvent@@QAE@XZ
    • ??0CLockList@@QAE@ABV0@@Z
    • ??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
    • ??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
    • ??0CMemoryAllocator@@QAE@ABV0@@Z
    • ??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
    • ??0CMemoryPoolAllocator@@QAE@ABV0@@Z
    • ??0CModuleConfig@@QAE@ABV0@@Z
    • ??0CModuleConfig@@QAE@XZ
    • ??0CModuleConfigList@@QAE@ABV0@@Z
    • ??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CModuleFileExtConfig@@QAE@ABV0@@Z
    • ??0CModuleFileExtConfig@@QAE@KKE@Z
    • ??0CModuleFlagConfig@@QAE@ABV0@@Z
    • ??0CModuleFlagConfig@@QAE@K@Z
    • ??0CModuleMultiStringConfig@@QAE@ABV0@@Z
    • ??0CModuleMultiStringConfig@@QAE@KK@Z
    • ??0CModuleStringConfig@@QAE@ABV0@@Z
    • ??0CModuleStringConfig@@QAE@K@Z
    • ??0CNoLockList@@QAE@ABV0@@Z
    • ??0CNoLockList@@QAE@KKPAVIMemoryAllocator@@@Z
    • ??0CSmartLock@@QAE@AAVCLockEvent@@@Z
    • ??0CSmartLock@@QAE@XZ
    • ??0CSmartReference@@QAE@AAJ@Z
    • ??0CSmartReference@@QAE@AAK@Z
    • ??0CSmartResource@@QAE@AAVCResource@@E@Z
    • ??0CStrList@@QAE@ABV0@@Z
    • ??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CSystemThread@@QAE@ABV0@@Z
    • ??0CSystemThread@@QAE@K@Z
    • ??0CUserFuncAdapterJob@@QAE@ABV0@@Z
    • ??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z0@Z
    • ??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
    • ??0CWorkerThread@@QAE@ABV0@@Z
    • ??0CWorkerThreadJob@@QAE@ABV0@@Z
    • ??0CWorkerThreadJob@@QAE@E@Z
    • ??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
    • ??0CWorkerThreadJobQueue@@QAE@K@Z
    • ??0CWorkerThreadPool@@QAE@ABV0@@Z
    • ??0CWorkerThreadPool@@QAE@K@Z
    • ??0IMemoryAllocator@@QAE@ABV0@@Z
    • ??0IMemoryAllocator@@QAE@XZ
    • ??1CAutoUpdateConfigThread@@UAE@XZ
    • ??1CBlobConfig@@UAE@XZ
    • ??1CContext@@UAE@XZ
    • ??1CContextList@@UAE@XZ
    • ??1CDebugLog@@UAE@XZ
    • ??1CDelayLoadThread@@UAE@XZ
    • ??1CExclusionExtConfig@@UAE@XZ
    • ??1CExclusionFileNameConfig@@UAE@XZ
    • ??1CExclusionFilePathConfig@@UAE@XZ
    • ??1CExclusionFolderConfig@@UAE@XZ
    • ??1CExclusionRegistryConfig@@UAE@XZ
    • ??1CFile@@UAE@XZ
    • ??1CFileExtension@@UAE@XZ
    • ??1CInclusionExtConfig@@UAE@XZ
    • ??1CInclusionFileNameConfig@@UAE@XZ
    • ??1CInclusionFilePathConfig@@UAE@XZ
    • ??1CInclusionFolderConfig@@UAE@XZ
    • ??1CKEvent@@UAE@XZ
    • ??1CList@@UAE@XZ
    • ??1CLockEvent@@UAE@XZ
    • ??1CLockList@@UAE@XZ
    • ??1CMemoryAllocator@@UAE@XZ
    • ??1CMemoryPoolAllocator@@UAE@XZ
    • ??1CModuleConfig@@UAE@XZ
    • ??1CModuleConfigList@@UAE@XZ
    • ??1CModuleFileExtConfig@@UAE@XZ
    • ??1CModuleFlagConfig@@UAE@XZ
    • ??1CModuleMultiStringConfig@@UAE@XZ
    • ??1CModuleStringConfig@@UAE@XZ
    • ??1CNoLockList@@UAE@XZ
    • ??1CSmartLock@@QAE@XZ
    • ??1CSmartReference@@QAE@XZ
    • ??1CSmartResource@@QAE@XZ
    • ??1CStrList@@UAE@XZ
    • ??1CSystemThread@@UAE@XZ
    • ??1CUserFuncAdapterJob@@UAE@XZ
    • ??1CWorkerThread@@UAE@XZ
    • ??1CWorkerThreadJob@@UAE@XZ
    • ??1CWorkerThreadJobQueue@@UAE@XZ
    • ??1CWorkerThreadPool@@UAE@XZ
    • ??1IMemoryAllocator@@UAE@XZ
    • ??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
    • ??2CMemoryAllocator@@SGPAXI@Z
    • ??2CMemoryPoolAllocator@@SGPAXI@Z
    • ??3@YAXPAX@Z
    • ??3IMemoryAllocator@@SGXPAX@Z
    • ??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
    • ??4CBlobConfig@@QAEAAV0@ABV0@@Z
    • ??4CContext@@QAEAAV0@ABV0@@Z
    • ??4CDebugLog@@QAEAAV0@ABV0@@Z
    • ??4CDelayLoadThread@@QAEAAV0@ABV0@@Z
    • ??4CFile@@QAEAAV0@ABV0@@Z
    • ??4CKEvent@@QAEAAV0@ABV0@@Z
    • ??4CLockEvent@@QAEAAV0@ABV0@@Z
    • ??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
    • ??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
    • ??4CModuleConfig@@QAEAAV0@ABV0@@Z
    • ??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
    • ??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
    • ??4CSmartLock@@QAEAAV0@ABV0@@Z
    • ??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
    • ??4CSmartResource@@QAEAAV0@ABV0@@Z
    • ??4CSystemThread@@QAEAAV0@ABV0@@Z
    • ??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
    • ??4CWorkerThread@@QAEAAV0@ABV0@@Z
    • ??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
    • ??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
    • ??_7CAutoUpdateConfigThread@@6B@
    • ??_7CBlobConfig@@6B@
    • ??_7CContext@@6B@
    • ??_7CContextList@@6B@
    • ??_7CDebugLog@@6B@
    • ??_7CDelayLoadThread@@6B@
    • ??_7CExclusionExtConfig@@6B@
    • ??_7CExclusionFileNameConfig@@6B@
    • ??_7CExclusionFilePathConfig@@6B@
    • ??_7CExclusionFolderConfig@@6B@
    • ??_7CExclusionRegistryConfig@@6B@
    • ??_7CFile@@6B@
    • ??_7CFileExtension@@6B@
    • ??_7CInclusionExtConfig@@6B@
    • ??_7CInclusionFileNameConfig@@6B@
    • ??_7CInclusionFilePathConfig@@6B@
    • ??_7CInclusionFolderConfig@@6B@
    • ??_7CKEvent@@6B@
    • ??_7CList@@6B@
    • ??_7CLockEvent@@6B@
    • ??_7CLockList@@6B@
    • ??_7CMemoryAllocator@@6B@
    • ??_7CMemoryPoolAllocator@@6B@
    • ??_7CModuleConfig@@6B@
    • ??_7CModuleConfigList@@6B@
    • ??_7CModuleFileExtConfig@@6B@
    • ??_7CModuleFlagConfig@@6B@
    • ??_7CModuleMultiStringConfig@@6B@
    • ??_7CModuleStringConfig@@6B@
    • ??_7CNoLockList@@6B@
    • ??_7CStrList@@6B@
    • ??_7CSystemThread@@6B@
    • ??_7CUserFuncAdapterJob@@6B@
    • ??_7CWorkerThread@@6B@
    • ??_7CWorkerThreadJob@@6B@
    • ??_7CWorkerThreadJobQueue@@6B@
    • ??_7CWorkerThreadPool@@6B@
    • ??_7IMemoryAllocator@@6B@
    • ??_FCContextList@@QAEXXZ
    • ??_FCFile@@QAEXXZ
    • ??_FCFileExtension@@QAEXXZ
    • ??_FCModuleConfigList@@QAEXXZ
    • ??_FCStrList@@QAEXXZ
    • ??_FCSystemThread@@QAEXXZ
    • ??_FCWorkerThread@@QAEXXZ
    • ??_FCWorkerThreadJob@@QAEXXZ
    • ??_FCWorkerThreadJobQueue@@QAEXXZ
    • ??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
    • ??_V@YAXPAX@Z
    • ?Acquire@CLockEvent@@QAEXXZ
    • ?Add@CContextList@@QAEEPAVCContext@@@Z
    • ?Add@CFileExtension@@QAEEPBGK@Z
    • ?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
    • ?Add@CStrList@@QAEEPBG@Z
    • ?AddNode@CLockList@@UAEEQAXE@Z
    • ?AddNode@CNoLockList@@UAEEQAXE@Z
    • ?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
    • ?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
    • ?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
    • ?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
    • ?Cancel@CWorkerThreadJob@@QAEXXZ
    • ?CheckNode@CLockList@@UAEHQAX@Z
    • ?CheckNode@CNoLockList@@UAEHQAX@Z
    • ?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
    • ?Cleanup@CBlobConfig@@AAEXXZ
    • ?Cleanup@CModuleFileExtConfig@@IAEXXZ
    • ?Cleanup@CModuleMultiStringConfig@@IAEXXZ
    • ?Cleanup@CModuleStringConfig@@AAEXXZ
    • ?Close@CFile@@QAEJXZ
    • ?Count@CLockList@@QAEKXZ
    • ?Count@CNoLockList@@QAEKXZ
    • ?Create@CFile@@QAEJPBGKKKK@Z
    • ?Create@CSystemThread@@QAEEXZ
    • ?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
    • ?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
    • ?CreatePool@CWorkerThreadPool@@QAEEXZ
    • ?CreateThreads@CWorkerThreadPool@@QAEEK@Z
    • ?CreateWIRP@CFile@@QAEJPBGKKKK@Z
    • ?Delete@CFile@@QAEJXZ
    • ?Delete@CFileExtension@@QAEEPBGK@Z
    • ?Delete@CStrList@@QAEEPBG@Z
    • ?DeleteAll@CList@@UAEXXZ
    • ?DeleteAll@CLockList@@UAEXXZ
    • ?DeleteAll@CNoLockList@@UAEXXZ
    • ?DeleteNode@CContextList@@MAEXPAX@Z
    • ?DeleteNode@CList@@UAEXPAX@Z
    • ?DeleteNode@CModuleConfigList@@MAEXPAX@Z
    • ?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
    • ?DisableWriteProtectFromCR0@@YGXPAPAX@Z
    • ?DoIt@CWorkerThreadJob@@QAEJXZ
    • ?EntryPoint@CSystemThread@@KGXPAX@Z
    • ?Find@CContextList@@QAEPAVCContext@@K@Z
    • ?Find@CContextList@@QAEPAVCContext@@PAX@Z
    • ?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
    • ?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
    • ?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
    • ?FindNode@CContextList@@IAEPAXPAX@Z
    • ?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
    • ?First@CList@@UAEPAXXZ
    • ?First@CLockList@@UAEPAXXZ
    • ?First@CNoLockList@@UAEPAXXZ
    • ?Free@CMemoryAllocator@@UAEXPAX@Z
    • ?Free@CMemoryPoolAllocator@@UAEXPAX@Z
    • ?GetAttributes@CFile@@QAEKXZ
    • ?GetBasicInfomration@CFile@@IAEJXZ
    • ?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
    • ?GetCategory@CContext@@QAEKXZ
    • ?GetData@CBlobConfig@@QAEHPAXPAK@Z
    • ?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
    • ?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
    • ?GetData@CModuleFlagConfig@@QAEKXZ
    • ?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
    • ?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
    • ?GetData@CModuleStringConfig@@QAEPAGXZ
    • ?GetData@CStrList@@QAEEPAGPAK@Z
    • ?GetDataType@CModuleConfig@@QAEKXZ
    • ?GetEngineContext@CContext@@QAEPAXXZ
    • ?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
    • ?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
    • ?GetFlagConfig@CContext@@UAEJKPAK@Z
    • ?GetID@CModuleConfig@@QAEKXZ
    • ?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
    • ?GetLength@CModuleStringConfig@@QAEKXZ
    • ?GetLinkContext@CContext@@QAEPAXXZ
    • ?GetLogFlag@CDebugLog@@QAEKXZ
    • ?GetModuleId@CModuleConfig@@QAEKXZ
    • ?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
    • ?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
    • ?GetReportCallBackRoutine@CContext@@QAEKXZ
    • ?GetSize@CBlobConfig@@QAEKXZ
    • ?GetStringConfig@CContext@@QAEPAGK@Z
    • ?GetStringConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetThreadCount@CWorkerThreadPool@@QAEKXZ
    • ?GetThreadID@CSystemThread@@QAEKXZ
    • ?GetType@CContext@@QAEKXZ
    • ?GetUserParameter@CContext@@QAEKXZ
    • ?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
    • ?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
    • ?InitializeFlagConfig@CContext@@QAEHKK@Z
    • ?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
    • ?InitializeStringConfig@CContext@@QAEHKPBG@Z
    • ?Insert@CList@@UAEXQAXE@Z
    • ?Insert@CLockList@@UAEXQAXE@Z
    • ?Insert@CNoLockList@@UAEXQAXE@Z
    • ?InsertAfter@CList@@UAEXPAX0@Z
    • ?InsertBefore@CList@@UAEXPAX0@Z
    • ?Instance@CWorkerThreadPool@@SGPAV1@XZ
    • ?IsEmpty@CList@@UAEEXZ
    • ?IsEmpty@CLockList@@UAEEXZ
    • ?IsEmpty@CNoLockList@@UAEEXZ
    • ?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
    • ?IsFull@CLockList@@QBEEXZ
    • ?IsFull@CNoLockList@@QBEEXZ
    • ?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionExtConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFileNameConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFilePathConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFolderConfig@@QAEEPBG@Z
    • ?IsOpened@CFile@@QAEEXZ
    • ?IsTerminated@CWorkerThreadPool@@QAEEXZ
    • ?IsValid@CMemoryAllocator@@UAEEXZ
    • ?IsValid@CMemoryPoolAllocator@@UAEEXZ
    • ?IsValid@IMemoryAllocator@@UAEEXZ
    • ?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
    • ?JobFunction@CUserFuncAdapterJob@@MAEXXZ
    • ?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
    • ?Limit@CLockList@@QAEKXZ
    • ?Limit@CNoLockList@@QAEKXZ
    • ?MatchAllExtensions@CFileExtension@@QAEEXZ
    • ?MatchNoExtensions@CFileExtension@@QAEEXZ
    • ?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
    • ?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
    • ?NeedDelete@CWorkerThreadJob@@QAEEXZ
    • ?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
    • ?NewNode@CList@@UAEPAXXZ
    • ?NewNode@CStrList@@EAEPAXXZ
    • ?NewNodeVariant@CList@@IAEPAXK@Z
    • ?Next@CList@@UBEPAXQAX@Z
    • ?Next@CLockList@@UBEPAXQAX@Z
    • ?Next@CNoLockList@@UBEPAXQAX@Z
    • ?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
    • ?NotityTerminate@CWorkerThread@@QAEXXZ
    • ?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
    • ?Pulse@CKEvent@@QAEJJE@Z
    • ?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
    • ?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
    • ?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
    • ?Read@CFile@@QAEJPADKPAK@Z
    • ?ReferenceCount@CContext@@QAEAAKXZ
    • ?Release@CLockEvent@@QAEXXZ
    • ?Remove@CContextList@@UAEEQAX@Z
    • ?Remove@CList@@UAEEQAX@Z
    • ?Remove@CLockList@@UAEEQAX@Z
    • ?Remove@CNoLockList@@UAEEQAX@Z
    • ?RemoveHead@CList@@UAEPAXXZ
    • ?RemoveHead@CLockList@@UAEPAXXZ
    • ?RemoveHead@CNoLockList@@UAEPAXXZ
    • ?RemoveTail@CList@@UAEPAXXZ
    • ?RemoveTail@CLockList@@UAEPAXXZ
    • ?RemoveTail@CNoLockList@@UAEPAXXZ
    • ?Reset@CKEvent@@QAEXXZ
    • ?ResetData@CInclusionExtConfig@@QAEXXZ
    • ?ResetData@CInclusionFileNameConfig@@QAEXXZ
    • ?ResetData@CInclusionFilePathConfig@@QAEXXZ
    • ?ResetData@CInclusionFolderConfig@@QAEXXZ
    • ?RestoreCR0@@YGXPAX@Z
    • ?Run@CAutoUpdateConfigThread@@UAEXXZ
    • ?Run@CDelayLoadThread@@UAEXXZ
    • ?Run@CWorkerThread@@UAEXXZ
    • ?SeekToEnd@CFile@@QAEJXZ
    • ?Set@CKEvent@@QAEJJE@Z
    • ?SetAttributes@CFile@@QAEJK@Z
    • ?SetBlobCofig@CContext@@UAEJKPAXK@Z
    • ?SetData@CBlobConfig@@QAEHPAXK@Z
    • ?SetData@CModuleFileExtConfig@@QAEHPBG@Z
    • ?SetData@CModuleFlagConfig@@QAEHK@Z
    • ?SetData@CModuleMultiStringConfig@@QAEHPBGK@Z
    • ?SetData@CModuleStringConfig@@QAEHPBG@Z
    • ?SetEngineContext@CContext@@QAEXPAX@Z
    • ?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
    • ?SetFlagConfig@CContext@@UAEJKK@Z
    • ?SetLinkContext@CContext@@QAEXPAX@Z
    • ?SetLogFlag@CDebugLog@@QAEEK@Z
    • ?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
    • ?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
    • ?SetMultiStringConfig@CContext@@UAEJKPBG@Z
    • ?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
    • ?SetPriority@CSystemThread@@QAEXK@Z
    • ?SetStopUse@CContext@@QAEXXZ
    • ?SetStringConfig@CContext@@UAEJKPBG@Z
    • ?Setup@CSystemThread@@MAEXXZ
    • ?StopUse@CContext@@QAEHXZ
    • ?TearDown@CSystemThread@@MAEXXZ
    • ?Terminate@CSystemThread@@QAEXE@Z
    • ?Terminate@CWorkerThreadPool@@QAEEXZ
    • ?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
    • ?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
    • ?WaitFinish@CWorkerThreadJob@@QAEXXZ
    • ?WaitForInit@CDelayLoadThread@@QAEEXZ
    • ?WaitForLoad@CDelayLoadThread@@QAEEXZ
    • ?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
    • ?Write@CDebugLog@@QAAXPBDZZ
    • ?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
    • ?WriteSystemInformation@CDebugLog@@QAEXXZ
    • ?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
    • ?WriteToFile@CDebugLog@@IAEXPADK@Z
    • ?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
    • ?_pPagedAllocator@@3PAVCMemoryAllocator@@A
    • ?m_lpInstance@CWorkerThreadPool@@1PAV1@A
    • ?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
    • _DeInitKmLPC@0
    • _GetModuleInfoByAddress@8
    • _GetModuleInfoByModuleName@8
    • _InitKmLPC@0
    • _KmCallUm@8
    • _KmCallUmEx@12
    • _ModGetExportProcAddress@8
    • _ModLoadDLLToBuffer@4
    • _ModLoadDLLToBufferWithImageSize@8
    • _ModLoadModule@8
    • _ModUnLoadModule@4
    • _NormalizeFileName@4
    • _NormalizeFullNtPathToDosName@4
    • _TmCommConfigRoutine@4
    • _UtilAddDeviceInDriveTable@4
    • _UtilCleanFileReadOnly@4
    • _UtilDeleteFileForce@4
    • _UtilGetFileObjectForProcessByEPROC@8
    • _UtilGetFileObjectFromFileName@12
    • _UtilGetProcessName@12
    • _UtilGetSystemDirectory@4
    • _UtilGetSystemDirectoryEx@0
    • _UtilGetSystemDirectoryLength@0
    • _UtilGetSystemTime@4
    • _UtilIoSetFileInfo@24
    • _UtilIopCreateFileIRP@40
    • _UtilKeGetLowFileDevice@16
    • _UtilModuleIATHook@24
    • _UtilModuleIATUnHook@8
    • _UtilQueryKeyValue@24
    • _UtilRemoveDeviceFromDriveTable@4
    • _UtilVolumeDeviceToDosName@8
    • _UtilWaitValueChangeToZero@8
    • _UtilWriteVersionToRegistry@8
    • _UtilbuildDynamicDiskMappingTable@0
    • _UtlWriteBinValueKeyToRegistry@16
    • __UtilDosPathNameToNtPathName@12

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • PAGE
    • .edata
    • INIT
    • .rsrc
    • .reloc

    Signature

    Expand
    {
      "Certificates": [
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
          "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
          "TBS": {
            "MD5": "d0785ad36e427c92b19f6826ab1e8020",
            "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
            "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
            "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
          },
          "ValidFrom": "2012-12-21 00:00:00",
          "ValidTo": "2020-12-30 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
          "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
          "TBS": {
            "MD5": "e9d38360b914c8863f6cba3ee58764d3",
            "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
            "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
            "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
          },
          "ValidFrom": "2012-10-18 00:00:00",
          "ValidTo": "2020-12-29 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
          "TBS": {
            "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
            "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
            "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
            "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
          },
          "ValidFrom": "2017-04-27 00:00:00",
          "ValidTo": "2018-07-16 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "611993e400000000001c",
          "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
          "TBS": {
            "MD5": "78a717e082dcc1cda3458d917e677d14",
            "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
            "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
            "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
          },
          "ValidFrom": "2011-02-22 19:25:17",
          "ValidTo": "2021-02-22 19:35:17",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
          "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "TBS": {
            "MD5": "b30c31a572b0409383ed3fbe17e56e81",
            "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
            "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
            "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
          },
          "ValidFrom": "2010-02-08 00:00:00",
          "ValidTo": "2020-02-07 23:59:59",
          "Version": 3
        }
      ],
      "CertificatesInfo": "",
      "Signer": [
        {
          "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Version": 1
        }
      ],
      "SignerInfo": ""
    }
    

    PropertyValue
    FilenameTmComm.sys
    Creation Timestamp2017-10-02 04:43:25
    MD51db988eb9ac5f99756c33b91830a9cf6
    SHA14471935df0e68fe149425703b66f1efca3d82168
    SHA256818e396595d08d724666803cd29dac566dc7db23bf50e9919d04b33afa988c01
    Authentihash MD5a134546e7fd28a27327fd6e4c7ddad9e
    Authentihash SHA13f0972132e791e4b24c6a390633aff670afd7ccc
    Authentihash SHA2563912c38f4c09b107ee9bbb60f43a8193d6bacf00bfb3b59b7b146d76594797cf
    RichPEHeaderHash MD59700ee6a34ba2b25ddc817d1a0743be8
    RichPEHeaderHash SHA180283ee3a81f182a56da60791555c7a5ac734e1c
    RichPEHeaderHash SHA2567f352214a0d86b5a789492b8c5d18b8bb5fe7ec7145b883dbf27d6f1bc31a950
    CompanyTrend Micro Inc.
    DescriptionTrendMicro Common Module
    ProductTrend Micro Eyes
    OriginalFilenameTmComm.sys

    Download

    Certificates

    Expand
    Certificate 7e93ebfb7cc64e59ea4b9a77d406fc3b
    FieldValue
    ToBeSigned (TBS) MD5d0785ad36e427c92b19f6826ab1e8020
    ToBeSigned (TBS) SHA1365b7a9c21bd9373e49052c3e7b3e4646ddd4d43
    ToBeSigned (TBS) SHA256c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff
    SubjectC=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2
    ValidFrom2012-12-21 00:00:00
    ValidTo2020-12-30 23:59:59
    Signature03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber7e93ebfb7cc64e59ea4b9a77d406fc3b
    Version3
    Certificate 0ecff438c8febf356e04d86a981b1a50
    FieldValue
    ToBeSigned (TBS) MD5e9d38360b914c8863f6cba3ee58764d3
    ToBeSigned (TBS) SHA14cba8eae47b6bf76f20b3504b98b8f062694a89b
    ToBeSigned (TBS) SHA25688901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976
    SubjectC=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4
    ValidFrom2012-10-18 00:00:00
    ValidTo2020-12-29 23:59:59
    Signature783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber0ecff438c8febf356e04d86a981b1a50
    Version3
    Certificate 497c4fad471540e6e453d0cafb155740
    FieldValue
    ToBeSigned (TBS) MD578eaa337666217b1c16a9a0ebd0b8434
    ToBeSigned (TBS) SHA1ff9cb835e78f6185eed4372096c3bae53b17d18d
    ToBeSigned (TBS) SHA2561c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250
    SubjectC=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.
    ValidFrom2017-04-27 00:00:00
    ValidTo2018-07-16 23:59:59
    Signaturef3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber497c4fad471540e6e453d0cafb155740
    Version3
    Certificate 611993e400000000001c
    FieldValue
    ToBeSigned (TBS) MD578a717e082dcc1cda3458d917e677d14
    ToBeSigned (TBS) SHA14a872e0e51f9b304469cd1dedb496ee9b8b983a4
    ToBeSigned (TBS) SHA256317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
    ValidFrom2011-02-22 19:25:17
    ValidTo2021-02-22 19:35:17
    Signature812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber611993e400000000001c
    Version3
    Certificate 5200e5aa2556fc1a86ed96c9d44b33c7
    FieldValue
    ToBeSigned (TBS) MD5b30c31a572b0409383ed3fbe17e56e81
    ToBeSigned (TBS) SHA14843a82ed3b1f2bfbee9671960e1940c942f688d
    ToBeSigned (TBS) SHA25603cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
    ValidFrom2010-02-08 00:00:00
    ValidTo2020-02-07 23:59:59
    Signature5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber5200e5aa2556fc1a86ed96c9d44b33c7
    Version3

    Imports

    Expand
    • ntoskrnl.exe

    Imported Functions

    Expand
    • RtlInitUnicodeString
    • KeInitializeEvent
    • KeClearEvent
    • KeSetEvent
    • KeEnterCriticalRegion
    • KeLeaveCriticalRegion
    • KeWaitForSingleObject
    • ExFreePoolWithTag
    • ExAcquireFastMutexUnsafe
    • ExReleaseFastMutexUnsafe
    • ProbeForRead
    • ProbeForWrite
    • ExAcquireResourceSharedLite
    • ExAcquireResourceExclusiveLite
    • ExReleaseResourceLite
    • MmProbeAndLockPages
    • MmUnlockPages
    • MmMapLockedPagesSpecifyCache
    • IoAllocateMdl
    • IoFreeMdl
    • IoGetCurrentProcess
    • ObfReferenceObject
    • ObfDereferenceObject
    • ZwClose
    • ZwCreateSection
    • ZwOpenSection
    • ZwMapViewOfSection
    • ZwUnmapViewOfSection
    • ZwOpenEvent
    • KePulseEvent
    • KeStackAttachProcess
    • KeUnstackDetachProcess
    • ObOpenObjectByPointer
    • ZwAllocateVirtualMemory
    • ZwFreeVirtualMemory
    • ZwSetEvent
    • __C_specific_handler
    • PsProcessType
    • wcslen
    • wcsncpy
    • wcsrchr
    • RtlUnicodeStringToInteger
    • ZwWaitForSingleObject
    • ZwRequestWaitReplyPort
    • ZwConnectPort
    • _stricmp
    • ExAllocatePoolWithTag
    • MmIsAddressValid
    • RtlImageNtHeader
    • ZwQuerySystemInformation
    • SeCaptureSubjectContext
    • SeReleaseSubjectContext
    • SeAccessCheck
    • ObGetObjectSecurity
    • ObReleaseObjectSecurity
    • PsGetProcessExitTime
    • PsThreadType
    • MmSectionObjectType
    • RtlCreateSecurityDescriptor
    • RtlSetDaclSecurityDescriptor
    • KeInitializeSemaphore
    • KeReleaseSemaphore
    • ExAcquireFastMutex
    • ExReleaseFastMutex
    • RtlCreateAcl
    • RtlAddAccessAllowedAce
    • RtlLengthRequiredSid
    • RtlInitializeSid
    • RtlSubAuthoritySid
    • KeDelayExecutionThread
    • ExGetPreviousMode
    • DbgPrint
    • swprintf
    • RtlCopyUnicodeString
    • IofCompleteRequest
    • IoCreateSymbolicLink
    • IoDeleteDevice
    • IoDeleteSymbolicLink
    • ObReferenceObjectByHandle
    • PsGetCurrentProcessId
    • ZwCreateEvent
    • ExEventObjectType
    • _wcsnicmp
    • PsSetCreateProcessNotifyRoutine
    • ZwQueryInformationProcess
    • PsLookupProcessByProcessId
    • ZwOpenDirectoryObject
    • ExInitializeResourceLite
    • ExDeleteResourceLite
    • ZwCreateFile
    • ZwQueryInformationFile
    • ZwSetInformationFile
    • ZwReadFile
    • ZwWriteFile
    • towupper
    • MmGetSystemRoutineAddress
    • ObReferenceObjectByPointer
    • PsGetCurrentThreadId
    • ObQueryNameString
    • PsGetVersion
    • _snprintf
    • _vsnprintf
    • RtlInitAnsiString
    • wcscat
    • RtlFreeUnicodeString
    • RtlTimeToTimeFields
    • KeWaitForMultipleObjects
    • ExSystemTimeToLocalTime
    • ZwCreateKey
    • ZwDeviceIoControlFile
    • ZwNotifyChangeKey
    • ZwOpenFile
    • ZwQueryVolumeInformationFile
    • mbstowcs
    • IoGetDeviceObjectPointer
    • IoBuildDeviceIoControlRequest
    • IofCallDriver
    • IoCreateFile
    • RtlEqualUnicodeString
    • RtlAppendUnicodeStringToString
    • RtlUpcaseUnicodeChar
    • _snwprintf
    • strlen
    • _strnicmp
    • strncpy
    • NtOpenProcess
    • NtQueryInformationProcess
    • ObOpenObjectByName
    • KeSetPriorityThread
    • PsCreateSystemThread
    • PsTerminateSystemThread
    • KeNumberProcessors
    • RtlLengthSecurityDescriptor
    • ZwOpenKey
    • ZwDeleteKey
    • ZwDeleteValueKey
    • ZwEnumerateKey
    • ZwEnumerateValueKey
    • ZwQueryKey
    • ZwQueryValueKey
    • ZwSetValueKey
    • ZwTerminateProcess
    • ZwOpenProcess
    • ZwDuplicateObject
    • ZwQuerySecurityObject
    • ZwSetSecurityObject
    • ZwQueryDirectoryObject
    • ZwQueryDirectoryFile
    • NtCreateFile
    • NtQueryInformationFile
    • NtSetInformationFile
    • IoFileObjectType
    • ObInsertObject
    • wcschr
    • wcsncmp
    • RtlQueryRegistryValues
    • RtlAppendUnicodeToString
    • RtlCompareMemory
    • MmBuildMdlForNonPagedPool
    • IoAllocateIrp
    • IoFreeIrp
    • ZwOpenSymbolicLinkObject
    • ZwQuerySymbolicLinkObject
    • RtlUpcaseUnicodeString
    • NtClose
    • ZwSetInformationObject
    • SeQueryAuthenticationIdToken
    • MmSystemRangeStart
    • IoGetFileObjectGenericMapping
    • ObCreateObject
    • SeCreateAccessState
    • IoAcquireVpbSpinLock
    • IoReleaseVpbSpinLock
    • wcstombs
    • strncat
    • wcsncat
    • RtlUnicodeStringToAnsiString
    • RtlFreeAnsiString
    • strcpy
    • wcsstr
    • RtlCompareUnicodeString
    • DbgPrintEx
    • KeAcquireSpinLockRaiseToDpc
    • KeReleaseSpinLock
    • ExAllocatePool
    • ExpInterlockedPopEntrySList
    • IoBuildSynchronousFsdRequest
    • IoGetStackLimits
    • IoGetDeviceInterfaces
    • IoRegisterPlugPlayNotification
    • IoUnregisterPlugPlayNotification
    • IoGetConfigurationInformation
    • FsRtlIsNameInExpression
    • IoDeviceObjectType
    • IoCreateDevice
    • RtlGetOwnerSecurityDescriptor
    • RtlGetDaclSecurityDescriptor
    • RtlGetGroupSecurityDescriptor
    • RtlGetSaclSecurityDescriptor
    • SeCaptureSecurityDescriptor
    • RtlLengthSid
    • SeExports
    • IoIsWdmVersionAvailable
    • RtlAbsoluteToSelfRelativeSD
    • RtlAnsiStringToUnicodeString
    • _purecall
    • KeBugCheckEx

    Exported Functions

    Expand
    • ??0CAutoUpdateConfigThread@@QEAA@AEBV0@@Z
    • ??0CAutoUpdateConfigThread@@QEAA@PEAU_UNICODE_STRING@@P6AX0PEAX@Z1@Z
    • ??0CBlobConfig@@QEAA@AEBV0@@Z
    • ??0CBlobConfig@@QEAA@K@Z
    • ??0CContext@@QEAA@AEBV0@@Z
    • ??0CContext@@QEAA@KP6AJPEAU_EVENT_REPORT@@PEAXPEAU_TMCE_REPORT@@PEAU_TMCE_FEEDBACK@@@Z1K@Z
    • ??0CContextList@@QEAA@AEBV0@@Z
    • ??0CContextList@@QEAA@KPEAVIMemoryAllocator@@@Z
    • ??0CDebugLog@@QEAA@AEBV0@@Z
    • ??0CDebugLog@@QEAA@PEBG@Z
    • ??0CDebugLogEx@@QEAA@AEBV0@@Z
    • ??0CDebugLogEx@@QEAA@K@Z
    • ??0CDelayLoadThread@@QEAA@AEBV0@@Z
    • ??0CDelayLoadThread@@QEAA@XZ
    • ??0CExclusionExtConfig@@QEAA@AEBV0@@Z
    • ??0CExclusionExtConfig@@QEAA@KKE@Z
    • ??0CExclusionFileNameConfig@@QEAA@AEBV0@@Z
    • ??0CExclusionFileNameConfig@@QEAA@KK@Z
    • ??0CExclusionFilePathConfig@@QEAA@AEBV0@@Z
    • ??0CExclusionFilePathConfig@@QEAA@KK@Z
    • ??0CExclusionFolderConfig@@QEAA@AEBV0@@Z
    • ??0CExclusionFolderConfig@@QEAA@KK@Z
    • ??0CExclusionRegistryConfig@@QEAA@AEBV0@@Z
    • ??0CExclusionRegistryConfig@@QEAA@KK@Z
    • ??0CFile@@QEAA@AEBV0@@Z
    • ??0CFile@@QEAA@E@Z
    • ??0CFileExtension@@QEAA@AEBV0@@Z
    • ??0CFileExtension@@QEAA@KEEPEAVIMemoryAllocator@@@Z
    • ??0CInclusionExtConfig@@QEAA@AEBV0@@Z
    • ??0CInclusionExtConfig@@QEAA@KKE@Z
    • ??0CInclusionFileNameConfig@@QEAA@AEBV0@@Z
    • ??0CInclusionFileNameConfig@@QEAA@KK@Z
    • ??0CInclusionFilePathConfig@@QEAA@AEBV0@@Z
    • ??0CInclusionFilePathConfig@@QEAA@KK@Z
    • ??0CInclusionFolderConfig@@QEAA@AEBV0@@Z
    • ??0CInclusionFolderConfig@@QEAA@KK@Z
    • ??0CKEvent@@QEAA@AEBV0@@Z
    • ??0CKEvent@@QEAA@W4_EVENT_TYPE@@E@Z
    • ??0CList@@QEAA@AEBV0@@Z
    • ??0CList@@QEAA@KPEAVIMemoryAllocator@@@Z
    • ??0CLockEvent@@QEAA@AEBV0@@Z
    • ??0CLockEvent@@QEAA@XZ
    • ??0CLockList@@QEAA@AEBV0@@Z
    • ??0CLockList@@QEAA@KKPEAVIMemoryAllocator@@@Z
    • ??0CMemoryAllocator@@IEAA@W4_POOL_TYPE@@K@Z
    • ??0CMemoryAllocator@@QEAA@AEBV0@@Z
    • ??0CMemoryPoolAllocator@@IEAA@W4_POOL_TYPE@@_K1K@Z
    • ??0CMemoryPoolAllocator@@QEAA@AEBV0@@Z
    • ??0CModuleConfig@@QEAA@AEBV0@@Z
    • ??0CModuleConfig@@QEAA@XZ
    • ??0CModuleConfigList@@QEAA@AEBV0@@Z
    • ??0CModuleConfigList@@QEAA@KPEAVIMemoryAllocator@@@Z
    • ??0CModuleFileExtConfig@@QEAA@AEBV0@@Z
    • ??0CModuleFileExtConfig@@QEAA@KKE@Z
    • ??0CModuleFlagConfig@@QEAA@AEBV0@@Z
    • ??0CModuleFlagConfig@@QEAA@K@Z
    • ??0CModuleMultiStringConfig@@QEAA@AEBV0@@Z
    • ??0CModuleMultiStringConfig@@QEAA@KK@Z
    • ??0CModuleStringConfig@@QEAA@AEBV0@@Z
    • ??0CModuleStringConfig@@QEAA@K@Z
    • ??0CNoLockList@@QEAA@AEBV0@@Z
    • ??0CNoLockList@@QEAA@KKPEAVIMemoryAllocator@@@Z
    • ??0CSmartLock@@QEAA@AEAVCLockEvent@@@Z
    • ??0CSmartLock@@QEAA@XZ
    • ??0CSmartReference@@QEAA@AEAJ@Z
    • ??0CSmartReference@@QEAA@AEAK@Z
    • ??0CSmartResource@@QEAA@AEAVCResource@@E@Z
    • ??0CStrList@@QEAA@AEBV0@@Z
    • ??0CStrList@@QEAA@KPEAVIMemoryAllocator@@@Z
    • ??0CSystemThread@@QEAA@AEBV0@@Z
    • ??0CSystemThread@@QEAA@K@Z
    • ??0CUserFuncAdapterJob@@QEAA@AEBV0@@Z
    • ??0CUserFuncAdapterJob@@QEAA@P6AXPEAX@Z01@Z
    • ??0CWorkerThread@@IEAA@PEAVCWorkerThreadJobQueue@@@Z
    • ??0CWorkerThread@@QEAA@AEBV0@@Z
    • ??0CWorkerThreadJob@@QEAA@AEBV0@@Z
    • ??0CWorkerThreadJob@@QEAA@E@Z
    • ??0CWorkerThreadJobQueue@@QEAA@AEBV0@@Z
    • ??0CWorkerThreadJobQueue@@QEAA@K@Z
    • ??0CWorkerThreadPool@@QEAA@AEBV0@@Z
    • ??0CWorkerThreadPool@@QEAA@K@Z
    • ??0CWorkerThreadPoolEx@@QEAA@AEBV0@@Z
    • ??0CWorkerThreadPoolEx@@QEAA@KK@Z
    • ??0IMemoryAllocator@@QEAA@AEBV0@@Z
    • ??0IMemoryAllocator@@QEAA@XZ
    • ??1CAutoUpdateConfigThread@@UEAA@XZ
    • ??1CBlobConfig@@UEAA@XZ
    • ??1CContext@@UEAA@XZ
    • ??1CContextList@@UEAA@XZ
    • ??1CDebugLog@@UEAA@XZ
    • ??1CDebugLogEx@@UEAA@XZ
    • ??1CDelayLoadThread@@UEAA@XZ
    • ??1CExclusionExtConfig@@UEAA@XZ
    • ??1CExclusionFileNameConfig@@UEAA@XZ
    • ??1CExclusionFilePathConfig@@UEAA@XZ
    • ??1CExclusionFolderConfig@@UEAA@XZ
    • ??1CExclusionRegistryConfig@@UEAA@XZ
    • ??1CFile@@UEAA@XZ
    • ??1CFileExtension@@UEAA@XZ
    • ??1CInclusionExtConfig@@UEAA@XZ
    • ??1CInclusionFileNameConfig@@UEAA@XZ
    • ??1CInclusionFilePathConfig@@UEAA@XZ
    • ??1CInclusionFolderConfig@@UEAA@XZ
    • ??1CKEvent@@UEAA@XZ
    • ??1CList@@UEAA@XZ
    • ??1CLockEvent@@UEAA@XZ
    • ??1CLockList@@UEAA@XZ
    • ??1CMemoryAllocator@@UEAA@XZ
    • ??1CMemoryPoolAllocator@@UEAA@XZ
    • ??1CModuleConfig@@UEAA@XZ
    • ??1CModuleConfigList@@UEAA@XZ
    • ??1CModuleFileExtConfig@@UEAA@XZ
    • ??1CModuleFlagConfig@@UEAA@XZ
    • ??1CModuleMultiStringConfig@@UEAA@XZ
    • ??1CModuleStringConfig@@UEAA@XZ
    • ??1CNoLockList@@UEAA@XZ
    • ??1CSmartLock@@QEAA@XZ
    • ??1CSmartReference@@QEAA@XZ
    • ??1CSmartResource@@QEAA@XZ
    • ??1CStrList@@UEAA@XZ
    • ??1CSystemThread@@UEAA@XZ
    • ??1CUserFuncAdapterJob@@UEAA@XZ
    • ??1CWorkerThread@@UEAA@XZ
    • ??1CWorkerThreadJob@@UEAA@XZ
    • ??1CWorkerThreadJobQueue@@UEAA@XZ
    • ??1CWorkerThreadPool@@UEAA@XZ
    • ??1CWorkerThreadPoolEx@@UEAA@XZ
    • ??1IMemoryAllocator@@UEAA@XZ
    • ??2@YAPEAX_KPEAVIMemoryAllocator@@PEBDK@Z
    • ??2CMemoryAllocator@@SAPEAX_K@Z
    • ??2CMemoryPoolAllocator@@SAPEAX_K@Z
    • ??3@YAXPEAX@Z
    • ??3@YAXPEAX_K@Z
    • ??3IMemoryAllocator@@SAXPEAX@Z
    • ??4CAutoUpdateConfigThread@@QEAAAEAV0@AEBV0@@Z
    • ??4CBlobConfig@@QEAAAEAV0@AEBV0@@Z
    • ??4CContext@@QEAAAEAV0@AEBV0@@Z
    • ??4CDebugLog@@QEAAAEAV0@AEBV0@@Z
    • ??4CDebugLogEx@@QEAAAEAV0@AEBV0@@Z
    • ??4CDelayLoadThread@@QEAAAEAV0@AEBV0@@Z
    • ??4CFile@@QEAAAEAV0@AEBV0@@Z
    • ??4CKEvent@@QEAAAEAV0@AEBV0@@Z
    • ??4CLockEvent@@QEAAAEAV0@AEBV0@@Z
    • ??4CMemoryAllocator@@QEAAAEAV0@AEBV0@@Z
    • ??4CMemoryPoolAllocator@@QEAAAEAV0@AEBV0@@Z
    • ??4CModuleConfig@@QEAAAEAV0@AEBV0@@Z
    • ??4CModuleFlagConfig@@QEAAAEAV0@AEBV0@@Z
    • ??4CModuleStringConfig@@QEAAAEAV0@AEBV0@@Z
    • ??4CSmartLock@@QEAAAEAV0@AEBV0@@Z
    • ??4CSmartLock@@QEAAAEBV0@AEAVCLockEvent@@@Z
    • ??4CSmartResource@@QEAAAEAV0@AEBV0@@Z
    • ??4CSystemThread@@QEAAAEAV0@AEBV0@@Z
    • ??4CUserFuncAdapterJob@@QEAAAEAV0@AEBV0@@Z
    • ??4CWorkerThread@@QEAAAEAV0@AEBV0@@Z
    • ??4CWorkerThreadJob@@QEAAAEAV0@AEBV0@@Z
    • ??4IMemoryAllocator@@QEAAAEAV0@AEBV0@@Z
    • ??_7CAutoUpdateConfigThread@@6B@
    • ??_7CBlobConfig@@6B@
    • ??_7CContext@@6B@
    • ??_7CContextList@@6B@
    • ??_7CDebugLog@@6B@
    • ??_7CDebugLogEx@@6B@
    • ??_7CDelayLoadThread@@6B@
    • ??_7CExclusionExtConfig@@6B@
    • ??_7CExclusionFileNameConfig@@6B@
    • ??_7CExclusionFilePathConfig@@6B@
    • ??_7CExclusionFolderConfig@@6B@
    • ??_7CExclusionRegistryConfig@@6B@
    • ??_7CFile@@6B@
    • ??_7CFileExtension@@6B@
    • ??_7CInclusionExtConfig@@6B@
    • ??_7CInclusionFileNameConfig@@6B@
    • ??_7CInclusionFilePathConfig@@6B@
    • ??_7CInclusionFolderConfig@@6B@
    • ??_7CKEvent@@6B@
    • ??_7CList@@6B@
    • ??_7CLockEvent@@6B@
    • ??_7CLockList@@6B@
    • ??_7CMemoryAllocator@@6B@
    • ??_7CMemoryPoolAllocator@@6B@
    • ??_7CModuleConfig@@6B@
    • ??_7CModuleConfigList@@6B@
    • ??_7CModuleFileExtConfig@@6B@
    • ??_7CModuleFlagConfig@@6B@
    • ??_7CModuleMultiStringConfig@@6B@
    • ??_7CModuleStringConfig@@6B@
    • ??_7CNoLockList@@6B@
    • ??_7CStrList@@6B@
    • ??_7CSystemThread@@6B@
    • ??_7CUserFuncAdapterJob@@6B@
    • ??_7CWorkerThread@@6B@
    • ??_7CWorkerThreadJob@@6B@
    • ??_7CWorkerThreadJobQueue@@6B@
    • ??_7CWorkerThreadPool@@6B@
    • ??_7CWorkerThreadPoolEx@@6B@
    • ??_7IMemoryAllocator@@6B@
    • ??_FCContextList@@QEAAXXZ
    • ??_FCFile@@QEAAXXZ
    • ??_FCFileExtension@@QEAAXXZ
    • ??_FCModuleConfigList@@QEAAXXZ
    • ??_FCStrList@@QEAAXXZ
    • ??_FCSystemThread@@QEAAXXZ
    • ??_FCWorkerThread@@QEAAXXZ
    • ??_FCWorkerThreadJob@@QEAAXXZ
    • ??_FCWorkerThreadJobQueue@@QEAAXXZ
    • ??_U@YAPEAX_KPEAVIMemoryAllocator@@PEBDK@Z
    • ??_V@YAXPEAX@Z
    • ??_V@YAXPEAX_K@Z
    • ?Acquire@CLockEvent@@QEAAXXZ
    • ?Add@CContextList@@QEAAEPEAVCContext@@@Z
    • ?Add@CFileExtension@@QEAAEPEBGK@Z
    • ?Add@CModuleConfigList@@QEAAEPEAVCModuleConfig@@@Z
    • ?Add@CStrList@@QEAAEPEBG@Z
    • ?AddNode@CLockList@@UEAAEQEAXE@Z
    • ?AddNode@CNoLockList@@UEAAEQEAXE@Z
    • ?Alloc@CMemoryAllocator@@UEAAPEAX_KPEBDK@Z
    • ?Alloc@CMemoryPoolAllocator@@UEAAPEAX_KPEBDK@Z
    • ?AllocBlock@CMemoryPoolAllocator@@IEAAPEAX_K@Z
    • ?AttachJobQueue@CWorkerThread@@QEAAXPEAVCWorkerThreadJobQueue@@@Z
    • ?Cancel@CWorkerThreadJob@@QEAAXXZ
    • ?CheckNode@CLockList@@UEAAHQEAX@Z
    • ?CheckNode@CNoLockList@@UEAAHQEAX@Z
    • ?CleanQueue@CWorkerThreadJobQueue@@QEAAXXZ
    • ?Cleanup@CBlobConfig@@AEAAXXZ
    • ?Cleanup@CModuleFileExtConfig@@IEAAXXZ
    • ?Cleanup@CModuleMultiStringConfig@@IEAAXXZ
    • ?Cleanup@CModuleStringConfig@@AEAAXXZ
    • ?Close@CFile@@QEAAJXZ
    • ?Count@CLockList@@QEAAKXZ
    • ?Count@CNoLockList@@QEAAKXZ
    • ?Create@CFile@@QEAAJPEBGKKKK@Z
    • ?Create@CSystemThread@@QEAAEXZ
    • ?CreateInstance@CMemoryAllocator@@SAPEAV1@W4_POOL_TYPE@@K@Z
    • ?CreateInstance@CMemoryPoolAllocator@@SAPEAV1@W4_POOL_TYPE@@_K1K@Z
    • ?CreatePool@CWorkerThreadPool@@QEAAEXZ
    • ?CreatePool@CWorkerThreadPoolEx@@QEAAEXZ
    • ?CreateThreads@CWorkerThreadPool@@QEAAEK@Z
    • ?CreateThreads@CWorkerThreadPoolEx@@QEAAEK@Z
    • ?CreateWIRP@CFile@@QEAAJPEBGKKKK@Z
    • ?Delete@CFile@@QEAAJXZ
    • ?Delete@CFileExtension@@QEAAEPEBGK@Z
    • ?Delete@CStrList@@QEAAEPEBG@Z
    • ?DeleteAll@CList@@UEAAXXZ
    • ?DeleteAll@CLockList@@UEAAXXZ
    • ?DeleteAll@CNoLockList@@UEAAXXZ
    • ?DeleteNode@CContextList@@MEAAXPEAX@Z
    • ?DeleteNode@CList@@UEAAXPEAX@Z
    • ?DeleteNode@CModuleConfigList@@MEAAXPEAX@Z
    • ?DeleteNode@CStrList@@EEAAXPEAU_STR_LIST_NODE@1@@Z
    • ?DisableWriteProtectFromCR0@@YAXPEAPEAX@Z
    • ?DoIt@CWorkerThreadJob@@QEAAJXZ
    • ?EntryPoint@CSystemThread@@KAXPEAX@Z
    • ?Find@CContextList@@QEAAPEAVCContext@@K@Z
    • ?Find@CContextList@@QEAAPEAVCContext@@PEAX@Z
    • ?Find@CFileExtension@@QEAAPEAU_STR_LIST_NODE@CStrList@@PEBGK@Z
    • ?Find@CModuleConfigList@@QEAAPEAVCModuleConfig@@K@Z
    • ?Find@CStrList@@QEAAPEAU_STR_LIST_NODE@1@PEBG@Z
    • ?FindNode@CContextList@@IEAAPEAXPEAX@Z
    • ?FindPartiallyAndAllMatch@CStrList@@QEAAPEAU_STR_LIST_NODE@1@PEBG@Z
    • ?FinishFunction@CUserFuncAdapterJob@@MEAAXXZ
    • ?FinishIt@CWorkerThreadJob@@QEAAJXZ
    • ?First@CList@@UEAAPEAXXZ
    • ?First@CLockList@@UEAAPEAXXZ
    • ?First@CNoLockList@@UEAAPEAXXZ
    • ?Free@CMemoryAllocator@@UEAAXPEAX@Z
    • ?Free@CMemoryPoolAllocator@@UEAAXPEAX@Z
    • ?GetAttributes@CFile@@QEAAKXZ
    • ?GetBasicInfomration@CFile@@IEAAJXZ
    • ?GetBlobCofig@CContext@@UEAAJKPEAXPEAK@Z
    • ?GetCategory@CContext@@QEAAKXZ
    • ?GetData@CBlobConfig@@QEAAHPEAXPEAK@Z
    • ?GetData@CModuleFileExtConfig@@QEAAHPEAGPEAK@Z
    • ?GetData@CModuleFileExtConfig@@QEAAPEAVCFileExtension@@XZ
    • ?GetData@CModuleFlagConfig@@QEAAKXZ
    • ?GetData@CModuleMultiStringConfig@@QEAAHPEAGPEAK@Z
    • ?GetData@CModuleMultiStringConfig@@QEAAPEAVCStrList@@XZ
    • ?GetData@CModuleStringConfig@@QEAAPEAGXZ
    • ?GetData@CStrList@@QEAAEPEAGPEAK@Z
    • ?GetDataType@CModuleConfig@@QEAAKXZ
    • ?GetEngineContext@CContext@@QEAAPEAXXZ
    • ?GetFileExtensionConfig@CContext@@QEAAPEAVCFileExtension@@K@Z
    • ?GetFileExtensionConfig@CContext@@UEAAJKPEAGPEAK@Z
    • ?GetFileSize@CFile@@QEAAJPEAT_LARGE_INTEGER@@@Z
    • ?GetFileSizeWIRP@CFile@@QEAAJPEAT_LARGE_INTEGER@@@Z
    • ?GetFlagConfig@CContext@@UEAAJKPEAK@Z
    • ?GetID@CModuleConfig@@QEAAKXZ
    • ?GetJob@CWorkerThreadJobQueue@@QEAAPEAVCWorkerThreadJob@@XZ
    • ?GetLength@CModuleStringConfig@@QEAAKXZ
    • ?GetLinkContext@CContext@@QEAAPEAXXZ
    • ?GetLogFlag@CDebugLog@@QEAAKXZ
    • ?GetLogFlag@CDebugLogEx@@QEAAKXZ
    • ?GetModuleId@CModuleConfig@@QEAAKXZ
    • ?GetMultiStringConfig@CContext@@QEAAPEAVCStrList@@K@Z
    • ?GetMultiStringConfig@CContext@@UEAAJKPEAGPEAK@Z
    • ?GetOneThreadTEB@CWorkerThreadPool@@QEAAPEAU_ETHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPool@@QEAAPEAU_KTHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPoolEx@@QEAAPEAU_ETHREAD@@XZ
    • ?GetOneThreadTEB@CWorkerThreadPoolEx@@QEAAPEAU_KTHREAD@@XZ
    • ?GetReportCallBackRoutine@CContext@@QEAA_KXZ
    • ?GetSize@CBlobConfig@@QEAAKXZ
    • ?GetStringConfig@CContext@@QEAAPEAGK@Z
    • ?GetStringConfig@CContext@@UEAAJKPEAGPEAK@Z
    • ?GetThreadCount@CWorkerThreadPool@@QEAAKXZ
    • ?GetThreadCount@CWorkerThreadPoolEx@@QEAAKXZ
    • ?GetThreadID@CSystemThread@@QEAA_KXZ
    • ?GetType@CContext@@QEAAKXZ
    • ?GetUserParameter@CContext@@QEAA_KXZ
    • ?InitProcMon@CDebugLogEx@@IEAAXXZ
    • ?InitializeBlobConfig@CContext@@QEAAHKPEAXK@Z
    • ?InitializeFileExtensionConfig@CContext@@QEAAHKPEBG@Z
    • ?InitializeFlagConfig@CContext@@QEAAHKK@Z
    • ?InitializeMultiStringConfig@CContext@@QEAAHKPEBG@Z
    • ?InitializeStringConfig@CContext@@QEAAHKPEBG@Z
    • ?Insert@CList@@UEAAXQEAXE@Z
    • ?Insert@CLockList@@UEAAXQEAXE@Z
    • ?Insert@CNoLockList@@UEAAXQEAXE@Z
    • ?InsertAfter@CList@@UEAAXPEAX0@Z
    • ?InsertBefore@CList@@UEAAXPEAX0@Z
    • ?Instance@CWorkerThreadPool@@SAPEAV1@XZ
    • ?IsEmpty@CList@@UEAAEXZ
    • ?IsEmpty@CLockList@@UEAAEXZ
    • ?IsEmpty@CNoLockList@@UEAAEXZ
    • ?IsExceedLimitation@CMemoryPoolAllocator@@IEAAEK@Z
    • ?IsFull@CLockList@@QEBAEXZ
    • ?IsFull@CNoLockList@@QEBAEXZ
    • ?IsInExclusionList@CExclusionExtConfig@@QEAAEPEBG@Z
    • ?IsInExclusionList@CExclusionFileNameConfig@@QEAAEPEBG@Z
    • ?IsInExclusionList@CExclusionFilePathConfig@@QEAAEPEBG@Z
    • ?IsInExclusionList@CExclusionFolderConfig@@QEAAEPEBG@Z
    • ?IsInExclusionList@CExclusionRegistryConfig@@QEAAEPEBG@Z
    • ?IsInInclusionList@CInclusionExtConfig@@QEAAEPEBG@Z
    • ?IsInInclusionList@CInclusionFileNameConfig@@QEAAEPEBG@Z
    • ?IsInInclusionList@CInclusionFilePathConfig@@QEAAEPEBG@Z
    • ?IsInInclusionList@CInclusionFolderConfig@@QEAAEPEBG@Z
    • ?IsOpened@CFile@@QEAAEXZ
    • ?IsTerminated@CWorkerThreadPool@@QEAAEXZ
    • ?IsTerminated@CWorkerThreadPoolEx@@QEAAEXZ
    • ?IsValid@CMemoryAllocator@@UEAAEXZ
    • ?IsValid@CMemoryPoolAllocator@@UEAAEXZ
    • ?IsValid@IMemoryAllocator@@UEAAEXZ
    • ?IsWorkerThread@CWorkerThreadPool@@QEAAE_K@Z
    • ?IsWorkerThread@CWorkerThreadPoolEx@@QEAAE_K@Z
    • ?JobFunction@CUserFuncAdapterJob@@MEAAXXZ
    • ?JobQueue@CWorkerThreadPool@@QEAAAEAVCWorkerThreadJobQueue@@XZ
    • ?JobQueue@CWorkerThreadPoolEx@@QEAAAEAVCWorkerThreadJobQueue@@XZ
    • ?Limit@CLockList@@QEAAKXZ
    • ?Limit@CNoLockList@@QEAAKXZ
    • ?MatchAllExtensions@CFileExtension@@QEAAEXZ
    • ?MatchNoExtensions@CFileExtension@@QEAAEXZ
    • ?MergeLeft@CMemoryPoolAllocator@@IEAAPEAXPEAX@Z
    • ?MergeRight@CMemoryPoolAllocator@@IEAAPEAXPEAX@Z
    • ?NeedDelete@CWorkerThreadJob@@QEAAEXZ
    • ?NeedDeleteWhenFinish@CWorkerThreadJob@@QEAAXE@Z
    • ?NewNode@CList@@UEAAPEAXXZ
    • ?NewNode@CStrList@@EEAAPEAXXZ
    • ?NewNodeVariant@CList@@IEAAPEAXK@Z
    • ?Next@CList@@UEBAPEAXQEAX@Z
    • ?Next@CLockList@@UEBAPEAXQEAX@Z
    • ?Next@CNoLockList@@UEBAPEAXQEAX@Z
    • ?NextPool@CMemoryPoolAllocator@@QEAAPEAV1@XZ
    • ?NotityTerminate@CWorkerThread@@QEAAXXZ
    • ?PostJobToWorkerThread@CWorkerThreadPool@@QEAAJP6AXPEAX@Z0E@Z
    • ?PostJobToWorkerThread@CWorkerThreadPoolEx@@QEAAJP6AXPEAX@Z0E1@Z
    • ?Pulse@CKEvent@@QEAAJJE@Z
    • ?QueueJob@CWorkerThreadJobQueue@@QEAAEPEAVCWorkerThreadJob@@@Z
    • ?QueueJobItem@CWorkerThreadPool@@QEAAJPEAVCWorkerThreadJob@@@Z
    • ?QueueJobItem@CWorkerThreadPoolEx@@QEAAJPEAVCWorkerThreadJob@@@Z
    • ?RCMInstance@CWorkerThreadPool@@SAPEAV1@XZ
    • ?Read@CFile@@QEAAJPEADKPEAK@Z
    • ?ReadWIRP@CFile@@QEAAJPEADKPEAK@Z
    • ?ReferenceCount@CContext@@QEAAAEAKXZ
    • ?Release@CLockEvent@@QEAAXXZ
    • ?Remove@CContextList@@UEAAEQEAX@Z
    • ?Remove@CList@@UEAAEQEAX@Z
    • ?Remove@CLockList@@UEAAEQEAX@Z
    • ?Remove@CNoLockList@@UEAAEQEAX@Z
    • ?RemoveHead@CList@@UEAAPEAXXZ
    • ?RemoveHead@CLockList@@UEAAPEAXXZ
    • ?RemoveHead@CNoLockList@@UEAAPEAXXZ
    • ?RemoveTail@CList@@UEAAPEAXXZ
    • ?RemoveTail@CLockList@@UEAAPEAXXZ
    • ?RemoveTail@CNoLockList@@UEAAPEAXXZ
    • ?Reset@CKEvent@@QEAAXXZ
    • ?ResetData@CInclusionExtConfig@@QEAAXXZ
    • ?ResetData@CInclusionFileNameConfig@@QEAAXXZ
    • ?ResetData@CInclusionFilePathConfig@@QEAAXXZ
    • ?ResetData@CInclusionFolderConfig@@QEAAXXZ
    • ?RestoreCR0@@YAXPEAX@Z
    • ?Run@CAutoUpdateConfigThread@@UEAAXXZ
    • ?Run@CDelayLoadThread@@UEAAXXZ
    • ?Run@CWorkerThread@@UEAAXXZ
    • ?SeekToEnd@CFile@@QEAAJXZ
    • ?Set@CKEvent@@QEAAJJE@Z
    • ?SetAttributes@CFile@@QEAAJK@Z
    • ?SetBlobCofig@CContext@@UEAAJKPEAXK@Z
    • ?SetData@CBlobConfig@@QEAAHPEAXK@Z
    • ?SetData@CModuleFileExtConfig@@QEAAHPEBG@Z
    • ?SetData@CModuleFlagConfig@@QEAAHK@Z
    • ?SetData@CModuleMultiStringConfig@@QEAAHPEBGK@Z
    • ?SetData@CModuleStringConfig@@QEAAHPEBG@Z
    • ?SetEngineContext@CContext@@QEAAXPEAX@Z
    • ?SetFileExtensionConfig@CContext@@UEAAJKPEBG@Z
    • ?SetFlagConfig@CContext@@UEAAJKK@Z
    • ?SetLinkContext@CContext@@QEAAXPEAX@Z
    • ?SetLogFlag@CDebugLog@@QEAAEK@Z
    • ?SetLogFlag@CDebugLogEx@@QEAAEK@Z
    • ?SetMatchAllExtensions@CFileExtension@@QEAAXE@Z
    • ?SetMatchNoExtensions@CFileExtension@@QEAAXE@Z
    • ?SetMultiStringConfig@CContext@@UEAAJKPEBG@Z
    • ?SetNewJobItemEvent@CWorkerThreadJobQueue@@QEAAXXZ
    • ?SetPriority@CSystemThread@@QEAAXK@Z
    • ?SetStopUse@CContext@@QEAAXXZ
    • ?SetStringConfig@CContext@@UEAAJKPEBG@Z
    • ?Setup@CSystemThread@@MEAAXXZ
    • ?StopUse@CContext@@QEAAHXZ
    • ?TearDown@CSystemThread@@MEAAXXZ
    • ?Terminate@CSystemThread@@QEAAXE@Z
    • ?Terminate@CWorkerThreadPool@@QEAAEXZ
    • ?Terminate@CWorkerThreadPoolEx@@QEAAEXZ
    • ?TmExceptionFilter@@YAJPEAU_EXCEPTION_POINTERS@@@Z
    • ?Wait@CKEvent@@QEAAJPEAT_LARGE_INTEGER@@E@Z
    • ?WaitFinish@CWorkerThreadJob@@QEAAXXZ
    • ?WaitForInit@CDelayLoadThread@@QEAAEXZ
    • ?WaitForLoad@CDelayLoadThread@@QEAAEXZ
    • ?WaitNewJobAvailable@CWorkerThreadJobQueue@@QEAAEXZ
    • ?WaitQueueEmpty@CWorkerThreadJobQueue@@QEAAXXZ
    • ?Write@CDebugLog@@QEAAXPEBDZZ
    • ?Write@CDebugLogEx@@QEAAXPEBDZZ
    • ?Write@CFile@@QEAAJPEADKPEAT_LARGE_INTEGER@@PEAK@Z
    • ?WriteDataToFile@CDebugLogEx@@IEAAXPEADK@Z
    • ?WriteDataToProcMonW@CDebugLogEx@@IEAAXPEAD@Z
    • ?WriteSystemInformation@CDebugLog@@QEAAXXZ
    • ?WriteSystemInformation@CDebugLogEx@@QEAAXXZ
    • ?WriteSystemStringInformation@CDebugLog@@IEAAXPEBG@Z
    • ?WriteSystemStringInformation@CDebugLogEx@@IEAAXPEBG@Z
    • ?WriteToFile@CDebugLog@@IEAAXPEADK@Z
    • ?WriteToProcMonW@CDebugLogEx@@IEAAXPEAU_UNICODE_STRING@@@Z
    • ?_pNonPagedAllocator@@3PEAVCMemoryAllocator@@EA
    • ?_pPagedAllocator@@3PEAVCMemoryAllocator@@EA
    • ?m_lpInstance@CWorkerThreadPool@@1PEAV1@EA
    • ?m_lpRCMInstance@CWorkerThreadPool@@1PEAV1@EA
    • AllocFullFileName
    • DeInitKm2UmCommunication
    • DeInitKmLPC
    • DuplicateFullFileName
    • FreeFullFileName
    • GetKm2UmMode
    • GetModuleInfoByAddress
    • GetModuleInfoByModuleName
    • InitKm2UmCommunication
    • InitKmLPC
    • IsVerifierCodeCheckFlagOn
    • IsWindows8_1_update
    • KmCallUm
    • KmCallUmByLPC
    • KmCallUmEx
    • KmCleanupCommPortAPIs
    • KmGetUmInitProcess
    • KmSetBackupCommPortAPIs
    • KmSetCommPortAPIs
    • ModGetExportProcAddress
    • ModLoadDLLToBuffer
    • ModLoadDLLToBufferWithImageSize
    • ModLoadModule
    • ModUnLoadModule
    • NormalizeFileName
    • NormalizeFullNtPathToDosName
    • TmCommConfigRoutine
    • UtilAddDeviceInDriveTable
    • UtilAddReparsePointMapping
    • UtilCleanFileReadOnly
    • UtilCloseExclusiveHandle
    • UtilCreateDosFileName
    • UtilDeleteFileForce
    • UtilGetDeviceObjectName
    • UtilGetFileNameFromFileObject
    • UtilGetFileObjectForProcessByEPROC
    • UtilGetFileObjectFromFileName
    • UtilGetProcessName
    • UtilGetSystemDirectory
    • UtilGetSystemDirectoryEx
    • UtilGetSystemDirectoryLength
    • UtilGetSystemTime
    • UtilIoSetFileInfo
    • UtilIopCreateFileIRP
    • UtilKeGetLowFileDevice
    • UtilModuleIATHook
    • UtilModuleIATUnHook
    • UtilPostJobToWorkerThread
    • UtilQueryExclusiveHandle
    • UtilQueryKeyValue
    • UtilRemoveDeviceFromDriveTable
    • UtilVolumeDeviceToDosName
    • UtilWaitValueChangeToZero
    • UtilWriteVersionToRegistry
    • UtilbuildDynamicDiskMappingTable
    • UtlWriteBinValueKeyToRegistry
    • ValidateAddressWithSize
    • _ResetProtectFromClose
    • _UtilDosPathNameToNtPathName

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • .pdata
    • .gfids
    • PAGE
    • .edata
    • INIT
    • .rsrc
    • .reloc

    Signature

    Expand
    {
      "Certificates": [
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
          "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
          "TBS": {
            "MD5": "d0785ad36e427c92b19f6826ab1e8020",
            "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
            "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
            "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
          },
          "ValidFrom": "2012-12-21 00:00:00",
          "ValidTo": "2020-12-30 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
          "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
          "TBS": {
            "MD5": "e9d38360b914c8863f6cba3ee58764d3",
            "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
            "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
            "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
          },
          "ValidFrom": "2012-10-18 00:00:00",
          "ValidTo": "2020-12-29 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
          "TBS": {
            "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
            "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
            "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
            "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
          },
          "ValidFrom": "2017-04-27 00:00:00",
          "ValidTo": "2018-07-16 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "611993e400000000001c",
          "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
          "TBS": {
            "MD5": "78a717e082dcc1cda3458d917e677d14",
            "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
            "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
            "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
          },
          "ValidFrom": "2011-02-22 19:25:17",
          "ValidTo": "2021-02-22 19:35:17",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
          "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "TBS": {
            "MD5": "b30c31a572b0409383ed3fbe17e56e81",
            "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
            "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
            "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
          },
          "ValidFrom": "2010-02-08 00:00:00",
          "ValidTo": "2020-02-07 23:59:59",
          "Version": 3
        }
      ],
      "CertificatesInfo": "",
      "Signer": [
        {
          "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Version": 1
        }
      ],
      "SignerInfo": ""
    }
    

    PropertyValue
    FilenameTmComm.sys
    Creation Timestamp2012-11-13 04:31:52
    MD5f33c3f08536f988aac84d72d83b139a6
    SHA107f60b2b0e56cb15aad3ca8a96d9fe3a91491329
    SHA25689108a15f009b285db4ef94250b889d5b11b96b4aa7b190784a6d1396e893e10
    Authentihash MD59c5ecf2cf0ba2a3297f9677d514c2a39
    Authentihash SHA101df70bdb08dda678118d4449b6171fe387b5d0c
    Authentihash SHA25635a7be9b0cde8c3d409a472a320541df070d7af6008e6458a05947f2591da9b5
    RichPEHeaderHash MD503cc0cf6cc93ab1faa8dd44481e28703
    RichPEHeaderHash SHA17c749d49c0677c330200d6fcd0e2da5232be0970
    RichPEHeaderHash SHA2568ff0549239941077a9cfd73a1d1e0ca0a20d4df41e2b9d249e6115f9bc1857b4
    CompanyTrend Micro Inc.
    DescriptionTrendMicro Common Module
    ProductTrend Micro Eyes
    OriginalFilenameTmComm.sys

    Download

    Certificates

    Expand
    Certificate 79a2a585f9d1154213d9b83ef6b68ded
    FieldValue
    ToBeSigned (TBS) MD5e6d820afb23af20a65cf0b03247ea05e
    ToBeSigned (TBS) SHA17a8f7c37453f99390ee1e94bb5d3d1cba3a0eea7
    ToBeSigned (TBS) SHA2567e722dc40e6b9abf8c20aa4d887e34b6d2c6b8cbe53a055d49bf9f5e946e0d27
    SubjectC=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G3
    ValidFrom2012-05-01 00:00:00
    ValidTo2012-12-31 23:59:59
    Signature1e98aa27b778b508b5c9726db7dfc00e98a635c488c9d2f66df14b1afbd5f92d99009ed1e79b8be13fbd39800c66cd07bc5c9854a694ba10d14e8babf56f65cc6709a2807c52e80e03d66b7ac60518ecc8ac427c072ca73d0866dc00edfd941d73f2729893b111d68fef8eeaacf496510cd08ddf31524f5eaf7da74a75e64ece2b9f292be7cf5d9f037e6e277b23ad622966af92e82ccebd9c7fdccd173c43c2093f7545c79ee4d7607f97c6e4aac769f5fccd74ac2cb048c1504e70561eb535d38ebeb1edacbdfe0cec857dd5bb856644195d9f93eb82ba639ed37c61ffc81bd923587f30a366a139265e92c33ccb3732faf5a38ddcd5b0a3e9253655d781fa
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber79a2a585f9d1154213d9b83ef6b68ded
    Version3
    Certificate 47bf1995df8d524643f7db6d480d31a4
    FieldValue
    ToBeSigned (TBS) MD5518d2ea8a21e879c942d504824ac211c
    ToBeSigned (TBS) SHA121ce87d827077e61abddf2beba69fde5432ea031
    ToBeSigned (TBS) SHA2561ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7
    SubjectC=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
    ValidFrom2003-12-04 00:00:00
    ValidTo2013-12-03 23:59:59
    Signature4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber47bf1995df8d524643f7db6d480d31a4
    Version3
    Certificate 4d6290e58c54f0f1eb17341a1310e6a4
    FieldValue
    ToBeSigned (TBS) MD5b7d8444a70054990435f35a5630df5e1
    ToBeSigned (TBS) SHA14678c6e4a8787a8e6ed2bce8792b122f6c08afd8
    ToBeSigned (TBS) SHA2560a8b4b359ea7890b358e56e436e9cfc6f32b037b2599b597ca7f7a80d475ec98
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
    ValidFrom2010-09-30 00:00:00
    ValidTo2014-01-01 23:59:59
    Signatureaedd211d5f8f807ad25209eadb6ed25d8be8c21b6904be51a5010e59fa37d174a3eedced89742b62d5a6bf4fad361754f013e0a345d24c26cbe26da21fd01e7a070fb6b37b6f5068a2e931b3b7997d8070a0a7de0b1ea4fff34d811bdd20c91cc4afcff18ffad9da95f0ecdc5cbfe88c5a3e7ab0a3eb59437411e09b1a6af36f
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber4d6290e58c54f0f1eb17341a1310e6a4
    Version3
    Certificate 610c120600000000001b
    FieldValue
    ToBeSigned (TBS) MD553c41bc1164e09e0cd1617a5bf913efd
    ToBeSigned (TBS) SHA193c03aac8951d494ecd5696b1c08658541b18727
    ToBeSigned (TBS) SHA25640bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b
    SubjectC=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
    ValidFrom2006-05-23 17:01:29
    ValidTo2016-05-23 17:11:29
    Signature01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber610c120600000000001b
    Version3
    Certificate 6326c00ead256b6837eeb29b5ee84720
    FieldValue
    ToBeSigned (TBS) MD511b208a45459069f827186fe81c6badd
    ToBeSigned (TBS) SHA1456356986e8ecbb7b05e4617d37cb8cd69ce4969
    ToBeSigned (TBS) SHA2564a0336d7ffa5db42ece4b342e1244f5c2bd0681827f68f847d99195c83740145
    SubjectC=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, OU=RD, CN=Trend Micro, Inc.
    ValidFrom2011-12-27 00:00:00
    ValidTo2013-02-15 23:59:59
    Signature840ba0fc35187fe2edc7b17c101fd2bf035bbad8f3de048e250741e96a3f4ecee86f1f065ea76f2f8f430a13a75ff3eab29a8b11a13006d27bf3173fa49aabf9cef98fc4554f1732317c4b821c740eb58a91977d85e86574dd712718b15d24f7eb88b6d4520aef788478e1ef8cebd7fff06fadbc87ca6ca2b77da85be3c30b4d590bcb8945a0acfa013f89073933494d9c465c0036280a5af39f6802e60bd175a2603366dd935cb3458b1791411a06b6e5f38e3171de4238051c79b33117cb94674d0625c402bdfb0f99b80625dc0f827911c6c11263884a4e41d1abf60070ad46b7296e19e1cfcda7304a650d7a814319cc11e5a947e82b2d00a169e798b871
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber6326c00ead256b6837eeb29b5ee84720
    Version3

    Imports

    Expand
    • ntoskrnl.exe
    • HAL.dll
    • CLASSPNP.SYS

    Imported Functions

    Expand
    • wcsrchr
    • KeSetEvent
    • KePulseEvent
    • KeClearEvent
    • KeInitializeSemaphore
    • KeWaitForSingleObject
    • KeReleaseSemaphore
    • KeStackAttachProcess
    • KeUnstackDetachProcess
    • RtlSubAuthoritySid
    • RtlInitializeSid
    • ExAllocatePoolWithTag
    • RtlLengthRequiredSid
    • ExFreePoolWithTag
    • RtlSetDaclSecurityDescriptor
    • RtlCreateSecurityDescriptor
    • RtlAddAccessAllowedAce
    • RtlCreateAcl
    • ObfDereferenceObject
    • ZwSetEvent
    • ZwClose
    • ZwRequestWaitReplyPort
    • ProbeForWrite
    • ZwFreeVirtualMemory
    • ZwAllocateVirtualMemory
    • ObOpenObjectByPointer
    • PsProcessType
    • memmove
    • ZwConnectPort
    • RtlInitUnicodeString
    • RtlUnicodeStringToInteger
    • ZwCreateSection
    • ZwWaitForSingleObject
    • ZwOpenEvent
    • ObfReferenceObject
    • IoGetCurrentProcess
    • DbgBreakPoint
    • PsGetProcessExitTime
    • MmSectionObjectType
    • PsThreadType
    • DbgPrint
    • memset
    • MmIsAddressValid
    • ExInitializeResourceLite
    • ExDeleteResourceLite
    • ZwWriteFile
    • ZwReadFile
    • ZwQueryInformationFile
    • ZwSetInformationFile
    • ZwCreateFile
    • swprintf
    • towupper
    • _wcsnicmp
    • KeInitializeEvent
    • _snprintf
    • PsGetCurrentProcessId
    • RtlTimeToTimeFields
    • ExSystemTimeToLocalTime
    • KeQuerySystemTime
    • ZwCreateKey
    • ZwCreateEvent
    • KeWaitForMultipleObjects
    • ObReferenceObjectByHandle
    • ZwNotifyChangeKey
    • PsGetCurrentThreadId
    • _vsnprintf
    • KeSetPriorityThread
    • PsTerminateSystemThread
    • PsCreateSystemThread
    • KeNumberProcessors
    • ZwQueryInformationProcess
    • PsLookupProcessByProcessId
    • KeDelayExecutionThread
    • ZwOpenDirectoryObject
    • PsSetCreateProcessNotifyRoutine
    • ZwQuerySystemInformation
    • ZwQueryDirectoryFile
    • ZwQueryDirectoryObject
    • ZwDuplicateObject
    • ZwOpenKey
    • ZwEnumerateKey
    • ZwEnumerateValueKey
    • ZwQueryValueKey
    • ZwDeleteValueKey
    • ZwDeleteKey
    • ExGetPreviousMode
    • ZwTerminateProcess
    • ZwOpenProcess
    • ZwQueryKey
    • ZwSetValueKey
    • MmHighestUserAddress
    • memcpy
    • IoFreeMdl
    • MmUnlockPages
    • IoBuildAsynchronousFsdRequest
    • _strnicmp
    • RtlQueryRegistryValues
    • RtlAppendUnicodeToString
    • _purecall
    • ZwQuerySymbolicLinkObject
    • ZwOpenSymbolicLinkObject
    • NtClose
    • ZwSetInformationObject
    • _stricmp
    • ZwUnmapViewOfSection
    • ZwMapViewOfSection
    • ZwOpenFile
    • RtlEqualUnicodeString
    • IoFileObjectType
    • IoCreateFile
    • IofCallDriver
    • IoAllocateIrp
    • MmBuildMdlForNonPagedPool
    • IoAllocateMdl
    • ProbeForRead
    • PsGetVersion
    • MmGetSystemRoutineAddress
    • RtlCopyUnicodeString
    • RtlCompareMemory
    • _snwprintf
    • RtlImageNtHeader
    • RtlFreeUnicodeString
    • RtlAnsiStringToUnicodeString
    • RtlInitAnsiString
    • strrchr
    • ZwQueryVolumeInformationFile
    • ObReferenceObjectByPointer
    • ObQueryNameString
    • IoBuildDeviceIoControlRequest
    • IofCompleteRequest
    • ExEventObjectType
    • _allmul
    • IoDeleteDevice
    • IoDeleteSymbolicLink
    • IoCreateSymbolicLink
    • IoGetDeviceObjectPointer
    • RtlUpperChar
    • RtlCompareUnicodeString
    • strncpy
    • KeServiceDescriptorTable
    • NtOpenProcess
    • ObOpenObjectByName
    • IoDriverObjectType
    • RtlAppendUnicodeStringToString
    • strncmp
    • NtQueryInformationProcess
    • PsIsThreadTerminating
    • KeAddSystemServiceTable
    • ZwQueryObject
    • ZwQuerySecurityObject
    • ObInsertObject
    • _allrem
    • IoReleaseVpbSpinLock
    • IoAcquireVpbSpinLock
    • SeCreateAccessState
    • IoGetFileObjectGenericMapping
    • RtlUpcaseUnicodeString
    • ObCreateObject
    • _allshr
    • ExInterlockedPopEntrySList
    • IoGetStackLimits
    • IoBuildSynchronousFsdRequest
    • MmSystemRangeStart
    • IoUnregisterPlugPlayNotification
    • FsRtlIsNameInExpression
    • wcsstr
    • IoGetConfigurationInformation
    • MmProbeAndLockPages
    • IoGetDeviceInterfaces
    • IoRegisterPlugPlayNotification
    • ExAllocatePool
    • RtlFreeAnsiString
    • RtlUnicodeStringToAnsiString
    • strncat
    • wcschr
    • wcsncat
    • wcstombs
    • KeTickCount
    • KeBugCheckEx
    • RtlUnwind
    • wcsncpy
    • ExReleaseResourceLite
    • ExAcquireResourceExclusiveLite
    • ExAcquireResourceSharedLite
    • ExReleaseFastMutexUnsafe
    • KeLeaveCriticalRegion
    • KeEnterCriticalRegion
    • IoFreeIrp
    • ExAcquireFastMutexUnsafe
    • ZwSetSecurityObject
    • IoDeviceObjectType
    • IoCreateDevice
    • RtlGetDaclSecurityDescriptor
    • RtlGetSaclSecurityDescriptor
    • RtlGetGroupSecurityDescriptor
    • RtlGetOwnerSecurityDescriptor
    • RtlLengthSecurityDescriptor
    • SeCaptureSecurityDescriptor
    • SeExports
    • IoIsWdmVersionAvailable
    • RtlLengthSid
    • RtlAbsoluteToSelfRelativeSD
    • mbstowcs
    • KeGetCurrentThread
    • KfAcquireSpinLock
    • KfReleaseSpinLock
    • KeRaiseIrqlToDpcLevel
    • KfLowerIrql
    • KeGetCurrentIrql
    • ExAcquireFastMutex
    • ExReleaseFastMutex
    • KfRaiseIrql
    • ClassInitialize

    Exported Functions

    Expand
    • ??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
    • ??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
    • ??0CBlobConfig@@QAE@ABV0@@Z
    • ??0CBlobConfig@@QAE@K@Z
    • ??0CContext@@QAE@ABV0@@Z
    • ??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
    • ??0CContextList@@QAE@ABV0@@Z
    • ??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CDebugLog@@QAE@ABV0@@Z
    • ??0CDebugLog@@QAE@PBG@Z
    • ??0CDelayLoadThread@@QAE@ABV0@@Z
    • ??0CDelayLoadThread@@QAE@XZ
    • ??0CExclusionExtConfig@@QAE@ABV0@@Z
    • ??0CExclusionExtConfig@@QAE@KKE@Z
    • ??0CExclusionFileNameConfig@@QAE@ABV0@@Z
    • ??0CExclusionFileNameConfig@@QAE@KK@Z
    • ??0CExclusionFilePathConfig@@QAE@ABV0@@Z
    • ??0CExclusionFilePathConfig@@QAE@KK@Z
    • ??0CExclusionFolderConfig@@QAE@ABV0@@Z
    • ??0CExclusionFolderConfig@@QAE@KK@Z
    • ??0CExclusionRegistryConfig@@QAE@ABV0@@Z
    • ??0CExclusionRegistryConfig@@QAE@KK@Z
    • ??0CFile@@QAE@ABV0@@Z
    • ??0CFile@@QAE@E@Z
    • ??0CFileExtension@@QAE@ABV0@@Z
    • ??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
    • ??0CInclusionExtConfig@@QAE@ABV0@@Z
    • ??0CInclusionExtConfig@@QAE@KKE@Z
    • ??0CInclusionFileNameConfig@@QAE@ABV0@@Z
    • ??0CInclusionFileNameConfig@@QAE@KK@Z
    • ??0CInclusionFilePathConfig@@QAE@ABV0@@Z
    • ??0CInclusionFilePathConfig@@QAE@KK@Z
    • ??0CInclusionFolderConfig@@QAE@ABV0@@Z
    • ??0CInclusionFolderConfig@@QAE@KK@Z
    • ??0CKEvent@@QAE@ABV0@@Z
    • ??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
    • ??0CList@@QAE@ABV0@@Z
    • ??0CList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CLockEvent@@QAE@ABV0@@Z
    • ??0CLockEvent@@QAE@XZ
    • ??0CLockList@@QAE@ABV0@@Z
    • ??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
    • ??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
    • ??0CMemoryAllocator@@QAE@ABV0@@Z
    • ??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
    • ??0CMemoryPoolAllocator@@QAE@ABV0@@Z
    • ??0CModuleConfig@@QAE@ABV0@@Z
    • ??0CModuleConfig@@QAE@XZ
    • ??0CModuleConfigList@@QAE@ABV0@@Z
    • ??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CModuleFileExtConfig@@QAE@ABV0@@Z
    • ??0CModuleFileExtConfig@@QAE@KKE@Z
    • ??0CModuleFlagConfig@@QAE@ABV0@@Z
    • ??0CModuleFlagConfig@@QAE@K@Z
    • ??0CModuleMultiStringConfig@@QAE@ABV0@@Z
    • ??0CModuleMultiStringConfig@@QAE@KK@Z
    • ??0CModuleStringConfig@@QAE@ABV0@@Z
    • ??0CModuleStringConfig@@QAE@K@Z
    • ??0CNoLockList@@QAE@ABV0@@Z
    • ??0CNoLockList@@QAE@KKPAVIMemoryAllocator@@@Z
    • ??0CSmartLock@@QAE@AAVCLockEvent@@@Z
    • ??0CSmartLock@@QAE@XZ
    • ??0CSmartReference@@QAE@AAJ@Z
    • ??0CSmartReference@@QAE@AAK@Z
    • ??0CSmartResource@@QAE@AAVCResource@@E@Z
    • ??0CStrList@@QAE@ABV0@@Z
    • ??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
    • ??0CSystemThread@@QAE@ABV0@@Z
    • ??0CSystemThread@@QAE@K@Z
    • ??0CUserFuncAdapterJob@@QAE@ABV0@@Z
    • ??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z0@Z
    • ??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
    • ??0CWorkerThread@@QAE@ABV0@@Z
    • ??0CWorkerThreadJob@@QAE@ABV0@@Z
    • ??0CWorkerThreadJob@@QAE@E@Z
    • ??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
    • ??0CWorkerThreadJobQueue@@QAE@K@Z
    • ??0CWorkerThreadPool@@QAE@ABV0@@Z
    • ??0CWorkerThreadPool@@QAE@K@Z
    • ??0IMemoryAllocator@@QAE@ABV0@@Z
    • ??0IMemoryAllocator@@QAE@XZ
    • ??1CAutoUpdateConfigThread@@UAE@XZ
    • ??1CBlobConfig@@UAE@XZ
    • ??1CContext@@UAE@XZ
    • ??1CContextList@@UAE@XZ
    • ??1CDebugLog@@UAE@XZ
    • ??1CDelayLoadThread@@UAE@XZ
    • ??1CExclusionExtConfig@@UAE@XZ
    • ??1CExclusionFileNameConfig@@UAE@XZ
    • ??1CExclusionFilePathConfig@@UAE@XZ
    • ??1CExclusionFolderConfig@@UAE@XZ
    • ??1CExclusionRegistryConfig@@UAE@XZ
    • ??1CFile@@UAE@XZ
    • ??1CFileExtension@@UAE@XZ
    • ??1CInclusionExtConfig@@UAE@XZ
    • ??1CInclusionFileNameConfig@@UAE@XZ
    • ??1CInclusionFilePathConfig@@UAE@XZ
    • ??1CInclusionFolderConfig@@UAE@XZ
    • ??1CKEvent@@UAE@XZ
    • ??1CList@@UAE@XZ
    • ??1CLockEvent@@UAE@XZ
    • ??1CLockList@@UAE@XZ
    • ??1CMemoryAllocator@@UAE@XZ
    • ??1CMemoryPoolAllocator@@UAE@XZ
    • ??1CModuleConfig@@UAE@XZ
    • ??1CModuleConfigList@@UAE@XZ
    • ??1CModuleFileExtConfig@@UAE@XZ
    • ??1CModuleFlagConfig@@UAE@XZ
    • ??1CModuleMultiStringConfig@@UAE@XZ
    • ??1CModuleStringConfig@@UAE@XZ
    • ??1CNoLockList@@UAE@XZ
    • ??1CSmartLock@@QAE@XZ
    • ??1CSmartReference@@QAE@XZ
    • ??1CSmartResource@@QAE@XZ
    • ??1CStrList@@UAE@XZ
    • ??1CSystemThread@@UAE@XZ
    • ??1CUserFuncAdapterJob@@UAE@XZ
    • ??1CWorkerThread@@UAE@XZ
    • ??1CWorkerThreadJob@@UAE@XZ
    • ??1CWorkerThreadJobQueue@@UAE@XZ
    • ??1CWorkerThreadPool@@UAE@XZ
    • ??1IMemoryAllocator@@UAE@XZ
    • ??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
    • ??2CMemoryAllocator@@SGPAXI@Z
    • ??2CMemoryPoolAllocator@@SGPAXI@Z
    • ??3@YAXPAX@Z
    • ??3IMemoryAllocator@@SGXPAX@Z
    • ??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
    • ??4CBlobConfig@@QAEAAV0@ABV0@@Z
    • ??4CContext@@QAEAAV0@ABV0@@Z
    • ??4CDebugLog@@QAEAAV0@ABV0@@Z
    • ??4CDelayLoadThread@@QAEAAV0@ABV0@@Z
    • ??4CFile@@QAEAAV0@ABV0@@Z
    • ??4CKEvent@@QAEAAV0@ABV0@@Z
    • ??4CLockEvent@@QAEAAV0@ABV0@@Z
    • ??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
    • ??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
    • ??4CModuleConfig@@QAEAAV0@ABV0@@Z
    • ??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
    • ??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
    • ??4CSmartLock@@QAEAAV0@ABV0@@Z
    • ??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
    • ??4CSmartResource@@QAEAAV0@ABV0@@Z
    • ??4CSystemThread@@QAEAAV0@ABV0@@Z
    • ??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
    • ??4CWorkerThread@@QAEAAV0@ABV0@@Z
    • ??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
    • ??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
    • ??_7CAutoUpdateConfigThread@@6B@
    • ??_7CBlobConfig@@6B@
    • ??_7CContext@@6B@
    • ??_7CContextList@@6B@
    • ??_7CDebugLog@@6B@
    • ??_7CDelayLoadThread@@6B@
    • ??_7CExclusionExtConfig@@6B@
    • ??_7CExclusionFileNameConfig@@6B@
    • ??_7CExclusionFilePathConfig@@6B@
    • ??_7CExclusionFolderConfig@@6B@
    • ??_7CExclusionRegistryConfig@@6B@
    • ??_7CFile@@6B@
    • ??_7CFileExtension@@6B@
    • ??_7CInclusionExtConfig@@6B@
    • ??_7CInclusionFileNameConfig@@6B@
    • ??_7CInclusionFilePathConfig@@6B@
    • ??_7CInclusionFolderConfig@@6B@
    • ??_7CKEvent@@6B@
    • ??_7CList@@6B@
    • ??_7CLockEvent@@6B@
    • ??_7CLockList@@6B@
    • ??_7CMemoryAllocator@@6B@
    • ??_7CMemoryPoolAllocator@@6B@
    • ??_7CModuleConfig@@6B@
    • ??_7CModuleConfigList@@6B@
    • ??_7CModuleFileExtConfig@@6B@
    • ??_7CModuleFlagConfig@@6B@
    • ??_7CModuleMultiStringConfig@@6B@
    • ??_7CModuleStringConfig@@6B@
    • ??_7CNoLockList@@6B@
    • ??_7CStrList@@6B@
    • ??_7CSystemThread@@6B@
    • ??_7CUserFuncAdapterJob@@6B@
    • ??_7CWorkerThread@@6B@
    • ??_7CWorkerThreadJob@@6B@
    • ??_7CWorkerThreadJobQueue@@6B@
    • ??_7CWorkerThreadPool@@6B@
    • ??_7IMemoryAllocator@@6B@
    • ??_FCContextList@@QAEXXZ
    • ??_FCFile@@QAEXXZ
    • ??_FCFileExtension@@QAEXXZ
    • ??_FCModuleConfigList@@QAEXXZ
    • ??_FCStrList@@QAEXXZ
    • ??_FCSystemThread@@QAEXXZ
    • ??_FCWorkerThread@@QAEXXZ
    • ??_FCWorkerThreadJob@@QAEXXZ
    • ??_FCWorkerThreadJobQueue@@QAEXXZ
    • ??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
    • ??_V@YAXPAX@Z
    • ?Acquire@CLockEvent@@QAEXXZ
    • ?Add@CContextList@@QAEEPAVCContext@@@Z
    • ?Add@CFileExtension@@QAEEPBGK@Z
    • ?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
    • ?Add@CStrList@@QAEEPBG@Z
    • ?AddNode@CLockList@@UAEEQAXE@Z
    • ?AddNode@CNoLockList@@UAEEQAXE@Z
    • ?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
    • ?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
    • ?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
    • ?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
    • ?Cancel@CWorkerThreadJob@@QAEXXZ
    • ?CheckNode@CLockList@@UAEHQAX@Z
    • ?CheckNode@CNoLockList@@UAEHQAX@Z
    • ?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
    • ?Cleanup@CBlobConfig@@AAEXXZ
    • ?Cleanup@CModuleFileExtConfig@@IAEXXZ
    • ?Cleanup@CModuleMultiStringConfig@@IAEXXZ
    • ?Cleanup@CModuleStringConfig@@AAEXXZ
    • ?Close@CFile@@QAEJXZ
    • ?Count@CLockList@@QAEKXZ
    • ?Count@CNoLockList@@QAEKXZ
    • ?Create@CFile@@QAEJPBGKKKK@Z
    • ?Create@CSystemThread@@QAEEXZ
    • ?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
    • ?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
    • ?CreatePool@CWorkerThreadPool@@QAEEXZ
    • ?CreateThreads@CWorkerThreadPool@@QAEEK@Z
    • ?CreateWIRP@CFile@@QAEJPBGKKKK@Z
    • ?Delete@CFile@@QAEJXZ
    • ?Delete@CFileExtension@@QAEEPBGK@Z
    • ?Delete@CStrList@@QAEEPBG@Z
    • ?DeleteAll@CList@@UAEXXZ
    • ?DeleteAll@CLockList@@UAEXXZ
    • ?DeleteAll@CNoLockList@@UAEXXZ
    • ?DeleteNode@CContextList@@MAEXPAX@Z
    • ?DeleteNode@CList@@UAEXPAX@Z
    • ?DeleteNode@CModuleConfigList@@MAEXPAX@Z
    • ?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
    • ?DisableWriteProtectFromCR0@@YGXPAPAX@Z
    • ?DoIt@CWorkerThreadJob@@QAEJXZ
    • ?EntryPoint@CSystemThread@@KGXPAX@Z
    • ?Find@CContextList@@QAEPAVCContext@@K@Z
    • ?Find@CContextList@@QAEPAVCContext@@PAX@Z
    • ?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
    • ?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
    • ?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
    • ?FindNode@CContextList@@IAEPAXPAX@Z
    • ?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
    • ?First@CList@@UAEPAXXZ
    • ?First@CLockList@@UAEPAXXZ
    • ?First@CNoLockList@@UAEPAXXZ
    • ?Free@CMemoryAllocator@@UAEXPAX@Z
    • ?Free@CMemoryPoolAllocator@@UAEXPAX@Z
    • ?GetAttributes@CFile@@QAEKXZ
    • ?GetBasicInfomration@CFile@@IAEJXZ
    • ?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
    • ?GetCategory@CContext@@QAEKXZ
    • ?GetData@CBlobConfig@@QAEHPAXPAK@Z
    • ?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
    • ?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
    • ?GetData@CModuleFlagConfig@@QAEKXZ
    • ?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
    • ?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
    • ?GetData@CModuleStringConfig@@QAEPAGXZ
    • ?GetData@CStrList@@QAEEPAGPAK@Z
    • ?GetDataType@CModuleConfig@@QAEKXZ
    • ?GetEngineContext@CContext@@QAEPAXXZ
    • ?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
    • ?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
    • ?GetFlagConfig@CContext@@UAEJKPAK@Z
    • ?GetID@CModuleConfig@@QAEKXZ
    • ?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
    • ?GetLength@CModuleStringConfig@@QAEKXZ
    • ?GetLinkContext@CContext@@QAEPAXXZ
    • ?GetLogFlag@CDebugLog@@QAEKXZ
    • ?GetModuleId@CModuleConfig@@QAEKXZ
    • ?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
    • ?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
    • ?GetReportCallBackRoutine@CContext@@QAEKXZ
    • ?GetSize@CBlobConfig@@QAEKXZ
    • ?GetStringConfig@CContext@@QAEPAGK@Z
    • ?GetStringConfig@CContext@@UAEJKPAGPAK@Z
    • ?GetThreadCount@CWorkerThreadPool@@QAEKXZ
    • ?GetThreadID@CSystemThread@@QAEKXZ
    • ?GetType@CContext@@QAEKXZ
    • ?GetUserParameter@CContext@@QAEKXZ
    • ?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
    • ?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
    • ?InitializeFlagConfig@CContext@@QAEHKK@Z
    • ?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
    • ?InitializeStringConfig@CContext@@QAEHKPBG@Z
    • ?Insert@CList@@UAEXQAXE@Z
    • ?Insert@CLockList@@UAEXQAXE@Z
    • ?Insert@CNoLockList@@UAEXQAXE@Z
    • ?InsertAfter@CList@@UAEXPAX0@Z
    • ?InsertBefore@CList@@UAEXPAX0@Z
    • ?Instance@CWorkerThreadPool@@SGPAV1@XZ
    • ?IsEmpty@CList@@UAEEXZ
    • ?IsEmpty@CLockList@@UAEEXZ
    • ?IsEmpty@CNoLockList@@UAEEXZ
    • ?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
    • ?IsFull@CLockList@@QBEEXZ
    • ?IsFull@CNoLockList@@QBEEXZ
    • ?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
    • ?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionExtConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFileNameConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFilePathConfig@@QAEEPBG@Z
    • ?IsInInclusionList@CInclusionFolderConfig@@QAEEPBG@Z
    • ?IsOpened@CFile@@QAEEXZ
    • ?IsTerminated@CWorkerThreadPool@@QAEEXZ
    • ?IsValid@CMemoryAllocator@@UAEEXZ
    • ?IsValid@CMemoryPoolAllocator@@UAEEXZ
    • ?IsValid@IMemoryAllocator@@UAEEXZ
    • ?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
    • ?JobFunction@CUserFuncAdapterJob@@MAEXXZ
    • ?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
    • ?Limit@CLockList@@QAEKXZ
    • ?Limit@CNoLockList@@QAEKXZ
    • ?MatchAllExtensions@CFileExtension@@QAEEXZ
    • ?MatchNoExtensions@CFileExtension@@QAEEXZ
    • ?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
    • ?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
    • ?NeedDelete@CWorkerThreadJob@@QAEEXZ
    • ?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
    • ?NewNode@CList@@UAEPAXXZ
    • ?NewNode@CStrList@@EAEPAXXZ
    • ?NewNodeVariant@CList@@IAEPAXK@Z
    • ?Next@CList@@UBEPAXQAX@Z
    • ?Next@CLockList@@UBEPAXQAX@Z
    • ?Next@CNoLockList@@UBEPAXQAX@Z
    • ?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
    • ?NotityTerminate@CWorkerThread@@QAEXXZ
    • ?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
    • ?Pulse@CKEvent@@QAEJJE@Z
    • ?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
    • ?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
    • ?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
    • ?Read@CFile@@QAEJPADKPAK@Z
    • ?ReferenceCount@CContext@@QAEAAKXZ
    • ?Release@CLockEvent@@QAEXXZ
    • ?Remove@CContextList@@UAEEQAX@Z
    • ?Remove@CList@@UAEEQAX@Z
    • ?Remove@CLockList@@UAEEQAX@Z
    • ?Remove@CNoLockList@@UAEEQAX@Z
    • ?RemoveHead@CList@@UAEPAXXZ
    • ?RemoveHead@CLockList@@UAEPAXXZ
    • ?RemoveHead@CNoLockList@@UAEPAXXZ
    • ?RemoveTail@CList@@UAEPAXXZ
    • ?RemoveTail@CLockList@@UAEPAXXZ
    • ?RemoveTail@CNoLockList@@UAEPAXXZ
    • ?Reset@CKEvent@@QAEXXZ
    • ?ResetData@CInclusionExtConfig@@QAEXXZ
    • ?ResetData@CInclusionFileNameConfig@@QAEXXZ
    • ?ResetData@CInclusionFilePathConfig@@QAEXXZ
    • ?ResetData@CInclusionFolderConfig@@QAEXXZ
    • ?RestoreCR0@@YGXPAX@Z
    • ?Run@CAutoUpdateConfigThread@@UAEXXZ
    • ?Run@CDelayLoadThread@@UAEXXZ
    • ?Run@CWorkerThread@@UAEXXZ
    • ?SeekToEnd@CFile@@QAEJXZ
    • ?Set@CKEvent@@QAEJJE@Z
    • ?SetAttributes@CFile@@QAEJK@Z
    • ?SetBlobCofig@CContext@@UAEJKPAXK@Z
    • ?SetData@CBlobConfig@@QAEHPAXK@Z
    • ?SetData@CModuleFileExtConfig@@QAEHPBG@Z
    • ?SetData@CModuleFlagConfig@@QAEHK@Z
    • ?SetData@CModuleMultiStringConfig@@QAEHPBGK@Z
    • ?SetData@CModuleStringConfig@@QAEHPBG@Z
    • ?SetEngineContext@CContext@@QAEXPAX@Z
    • ?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
    • ?SetFlagConfig@CContext@@UAEJKK@Z
    • ?SetLinkContext@CContext@@QAEXPAX@Z
    • ?SetLogFlag@CDebugLog@@QAEEK@Z
    • ?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
    • ?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
    • ?SetMultiStringConfig@CContext@@UAEJKPBG@Z
    • ?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
    • ?SetPriority@CSystemThread@@QAEXK@Z
    • ?SetStopUse@CContext@@QAEXXZ
    • ?SetStringConfig@CContext@@UAEJKPBG@Z
    • ?Setup@CSystemThread@@MAEXXZ
    • ?StopUse@CContext@@QAEHXZ
    • ?TearDown@CSystemThread@@MAEXXZ
    • ?Terminate@CSystemThread@@QAEXE@Z
    • ?Terminate@CWorkerThreadPool@@QAEEXZ
    • ?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
    • ?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
    • ?WaitFinish@CWorkerThreadJob@@QAEXXZ
    • ?WaitForInit@CDelayLoadThread@@QAEEXZ
    • ?WaitForLoad@CDelayLoadThread@@QAEEXZ
    • ?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
    • ?Write@CDebugLog@@QAAXPBDZZ
    • ?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
    • ?WriteSystemInformation@CDebugLog@@QAEXXZ
    • ?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
    • ?WriteToFile@CDebugLog@@IAEXPADK@Z
    • ?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
    • ?_pPagedAllocator@@3PAVCMemoryAllocator@@A
    • ?m_lpInstance@CWorkerThreadPool@@1PAV1@A
    • ?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
    • _DeInitKmLPC@0
    • _GetModuleInfoByAddress@8
    • _GetModuleInfoByModuleName@8
    • _InitKmLPC@0
    • _KmCallUm@8
    • _KmCallUmEx@12
    • _ModGetExportProcAddress@8
    • _ModLoadDLLToBuffer@4
    • _ModLoadDLLToBufferWithImageSize@8
    • _ModLoadModule@8
    • _ModUnLoadModule@4
    • _NormalizeFileName@4
    • _NormalizeFullNtPathToDosName@4
    • _TmCommConfigRoutine@4
    • _UtilAddDeviceInDriveTable@4
    • _UtilCleanFileReadOnly@4
    • _UtilDeleteFileForce@4
    • _UtilGetFileObjectForProcessByEPROC@8
    • _UtilGetFileObjectFromFileName@12
    • _UtilGetProcessName@12
    • _UtilGetSystemDirectory@4
    • _UtilGetSystemDirectoryEx@0
    • _UtilGetSystemDirectoryLength@0
    • _UtilGetSystemTime@4
    • _UtilIoSetFileInfo@24
    • _UtilIopCreateFileIRP@40
    • _UtilKeGetLowFileDevice@16
    • _UtilModuleIATHook@24
    • _UtilModuleIATUnHook@8
    • _UtilQueryKeyValue@24
    • _UtilRemoveDeviceFromDriveTable@4
    • _UtilVolumeDeviceToDosName@8
    • _UtilWaitValueChangeToZero@8
    • _UtilWriteVersionToRegistry@8
    • _UtilbuildDynamicDiskMappingTable@0
    • _UtlWriteBinValueKeyToRegistry@16
    • __UtilDosPathNameToNtPathName@12

    Sections

    Expand
    • .text
    • .rdata
    • .data
    • PAGE
    • .edata
    • INIT
    • .rsrc
    • .reloc

    Signature

    Expand
    {
      "Certificates": [
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
          "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
          "TBS": {
            "MD5": "d0785ad36e427c92b19f6826ab1e8020",
            "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
            "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
            "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
          },
          "ValidFrom": "2012-12-21 00:00:00",
          "ValidTo": "2020-12-30 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
          "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
          "TBS": {
            "MD5": "e9d38360b914c8863f6cba3ee58764d3",
            "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
            "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
            "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
          },
          "ValidFrom": "2012-10-18 00:00:00",
          "ValidTo": "2020-12-29 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": false,
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
          "TBS": {
            "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
            "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
            "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
            "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
          },
          "ValidFrom": "2017-04-27 00:00:00",
          "ValidTo": "2018-07-16 23:59:59",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "611993e400000000001c",
          "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
          "TBS": {
            "MD5": "78a717e082dcc1cda3458d917e677d14",
            "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
            "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
            "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
          },
          "ValidFrom": "2011-02-22 19:25:17",
          "ValidTo": "2021-02-22 19:35:17",
          "Version": 3
        },
        {
          "IsCertificateAuthority": true,
          "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
          "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
          "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
          "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "TBS": {
            "MD5": "b30c31a572b0409383ed3fbe17e56e81",
            "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
            "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
            "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
          },
          "ValidFrom": "2010-02-08 00:00:00",
          "ValidTo": "2020-02-07 23:59:59",
          "Version": 3
        }
      ],
      "CertificatesInfo": "",
      "Signer": [
        {
          "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
          "SerialNumber": "497c4fad471540e6e453d0cafb155740",
          "Version": 1
        }
      ],
      "SignerInfo": ""
    }
    

    PropertyValue
    FilenameTmComm.sys
    Creation Timestamp2012-11-13 04:31:43
    MD546edb648c1b5c3abd76bd5e912dac026
    SHA13f43412c563889a5f5350f415f7040a71cc25221
    SHA25697b32ddf83f75637e3ba934df117081dd6a1c57d47a4c9700d35e736da11d5bd
    Authentihash MD524d18871ef8362a3fc2296f859f34793
    Authentihash SHA1fcd9d88abae49a60c462fdfb0cca8f1d105eb3b1
    Authentihash SHA25692bb92314ad69e9d118df55924ddab76b983029f1eae7739bbb098c6bea86ca1
    RichPEHeaderHash MD5758d7e589c3ed9801189755eeacb7853
    RichPEHeaderHash SHA13489d3411a9549281a52875dd5b15c14d16fe035
    RichPEHeaderHash SHA25641392221145207e9cc769dfaeda0bfa63ee6babeb2d86771a48cc97bd0ab89c0
    CompanyTrend Micro Inc.
    DescriptionTrendMicro Common Module
    ProductTrend Micro Eyes
    OriginalFilenameTmComm.sys

    Download

    Certificates

    Expand
    Certificate 79a2a585f9d1154213d9b83ef6b68ded
    FieldValue
    ToBeSigned (TBS) MD5e6d820afb23af20a65cf0b03247ea05e
    ToBeSigned (TBS) SHA17a8f7c37453f99390ee1e94bb5d3d1cba3a0eea7
    ToBeSigned (TBS) SHA2567e722dc40e6b9abf8c20aa4d887e34b6d2c6b8cbe53a055d49bf9f5e946e0d27
    SubjectC=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G3
    ValidFrom2012-05-01 00:00:00
    ValidTo2012-12-31 23:59:59
    Signature1e98aa27b778b508b5c9726db7dfc00e98a635c488c9d2f66df14b1afbd5f92d99009ed1e79b8be13fbd39800c66cd07bc5c9854a694ba10d14e8babf56f65cc6709a2807c52e80e03d66b7ac60518ecc8ac427c072ca73d0866dc00edfd941d73f2729893b111d68fef8eeaacf496510cd08ddf31524f5eaf7da74a75e64ece2b9f292be7cf5d9f037e6e277b23ad622966af92e82ccebd9c7fdccd173c43c2093f7545c79ee4d7607f97c6e4aac769f5fccd74ac2cb048c1504e70561eb535d38ebeb1edacbdfe0cec857dd5bb856644195d9f93eb82ba639ed37c61ffc81bd923587f30a366a139265e92c33ccb3732faf5a38ddcd5b0a3e9253655d781fa
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber79a2a585f9d1154213d9b83ef6b68ded
    Version3
    Certificate 47bf1995df8d524643f7db6d480d31a4
    FieldValue
    ToBeSigned (TBS) MD5518d2ea8a21e879c942d504824ac211c
    ToBeSigned (TBS) SHA121ce87d827077e61abddf2beba69fde5432ea031
    ToBeSigned (TBS) SHA2561ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7
    SubjectC=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
    ValidFrom2003-12-04 00:00:00
    ValidTo2013-12-03 23:59:59
    Signature4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber47bf1995df8d524643f7db6d480d31a4
    Version3
    Certificate 4d6290e58c54f0f1eb17341a1310e6a4
    FieldValue
    ToBeSigned (TBS) MD5b7d8444a70054990435f35a5630df5e1
    ToBeSigned (TBS) SHA14678c6e4a8787a8e6ed2bce8792b122f6c08afd8
    ToBeSigned (TBS) SHA2560a8b4b359ea7890b358e56e436e9cfc6f32b037b2599b597ca7f7a80d475ec98
    SubjectC=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
    ValidFrom2010-09-30 00:00:00
    ValidTo2014-01-01 23:59:59
    Signatureaedd211d5f8f807ad25209eadb6ed25d8be8c21b6904be51a5010e59fa37d174a3eedced89742b62d5a6bf4fad361754f013e0a345d24c26cbe26da21fd01e7a070fb6b37b6f5068a2e931b3b7997d8070a0a7de0b1ea4fff34d811bdd20c91cc4afcff18ffad9da95f0ecdc5cbfe88c5a3e7ab0a3eb59437411e09b1a6af36f
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber4d6290e58c54f0f1eb17341a1310e6a4
    Version3
    Certificate 610c120600000000001b
    FieldValue
    ToBeSigned (TBS) MD553c41bc1164e09e0cd1617a5bf913efd
    ToBeSigned (TBS) SHA193c03aac8951d494ecd5696b1c08658541b18727
    ToBeSigned (TBS) SHA25640bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b
    SubjectC=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
    ValidFrom2006-05-23 17:01:29
    ValidTo2016-05-23 17:11:29
    Signature01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityTrue
    SerialNumber610c120600000000001b
    Version3
    Certificate 6326c00ead256b6837eeb29b5ee84720
    FieldValue
    ToBeSigned (TBS) MD511b208a45459069f827186fe81c6badd
    ToBeSigned (TBS) SHA1456356986e8ecbb7b05e4617d37cb8cd69ce4969
    ToBeSigned (TBS) SHA2564a0336d7ffa5db42ece4b342e1244f5c2bd0681827f68f847d99195c83740145
    SubjectC=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, OU=RD, CN=Trend Micro, Inc.
    ValidFrom2011-12-27 00:00:00
    ValidTo2013-02-15 23:59:59
    Signature840ba0fc35187fe2edc7b17c101fd2bf035bbad8f3de048e250741e96a3f4ecee86f1f065ea76f2f8f430a13a75ff3eab29a8b11a13006d27bf3173fa49aabf9cef98fc4554f1732317c4b821c740eb58a91977d85e86574dd712718b15d24f7eb88b6d4520aef788478e1ef8cebd7fff06fadbc87ca6ca2b77da85be3c30b4d590bcb8945a0acfa013f89073933494d9c465c0036280a5af39f6802e60bd175a2603366dd935cb3458b1791411a06b6e5f38e3171de4238051c79b33117cb94674d0625c402bdfb0f99b80625dc0f827911c6c11263884a4e41d1abf60070ad46b7296e19e1cfcda7304a650d7a814319cc11e5a947e82b2d00a169e798b871
    SignatureAlgorithmOID1.2.840.113549.1.1.5
    IsCertificateAuthorityFalse
    SerialNumber6326c00ead256b6837eeb29b5ee84720
    Version3

    Imports

    Expand
    • ntoskrnl.exe

    Imported Functions

    Expand
    • KeLeaveCriticalRegion
    • wcsncpy
    • KeEnterCriticalRegion
    • ExAcquireFastMutexUnsafe
    • wcsrchr
    • ExAcquireResourceSharedLite
    • ExReleaseResourceLite
    • _purecall
    • ZwOpenEvent
    • RtlSubAuthoritySid
    • RtlLengthRequiredSid
    • ZwConnectPort
    • ExAllocatePoolWithTag
    • KeClearEvent
    • PsProcessType
    • ExFreePoolWithTag
    • ExReleaseFastMutex
    • ExAcquireFastMutex
    • RtlCreateAcl
    • RtlSetDaclSecurityDescriptor
    • RtlInitUnicodeString
    • KeSetEvent
    • ProbeForWrite
    • KeUnstackDetachProcess
    • RtlAddAccessAllowedAce
    • ZwRequestWaitReplyPort
    • ZwWaitForSingleObject
    • DbgBreakPoint
    • ZwSetEvent
    • IoGetCurrentProcess
    • ZwFreeVirtualMemory
    • ZwClose
    • KeInitializeSemaphore
    • KeWaitForSingleObject
    • KeReleaseSemaphore
    • RtlInitializeSid
    • ObfReferenceObject
    • ObfDereferenceObject
    • RtlUnicodeStringToInteger
    • ZwCreateSection
    • ObOpenObjectByPointer
    • KeStackAttachProcess
    • RtlCreateSecurityDescriptor
    • KePulseEvent
    • ZwAllocateVirtualMemory
    • PsThreadType
    • PsGetProcessExitTime
    • MmSectionObjectType
    • DbgPrint
    • ExDeleteResourceLite
    • ExInitializeResourceLite
    • ZwReadFile
    • swprintf
    • ZwSetInformationFile
    • ZwCreateFile
    • ZwQueryInformationFile
    • ZwWriteFile
    • _wcsnicmp
    • towupper
    • KeInitializeEvent
    • ZwCreateEvent
    • ZwCreateKey
    • ZwNotifyChangeKey
    • _snprintf
    • ExSystemTimeToLocalTime
    • _vsnprintf
    • ObReferenceObjectByHandle
    • RtlTimeToTimeFields
    • PsGetCurrentThreadId
    • PsGetCurrentProcessId
    • MmIsAddressValid
    • KeWaitForMultipleObjects
    • KeSetPriorityThread
    • PsCreateSystemThread
    • PsTerminateSystemThread
    • KeNumberProcessors
    • PsLookupProcessByProcessId
    • PsSetCreateProcessNotifyRoutine
    • ZwOpenDirectoryObject
    • KeDelayExecutionThread
    • ZwQueryInformationProcess
    • ExGetPreviousMode
    • ExReleaseFastMutexUnsafe
    • ZwQuerySystemInformation
    • ZwQueryValueKey
    • ZwOpenKey
    • _stricmp
    • _strnicmp
    • mbstowcs
    • ProbeForRead
    • _snwprintf
    • ZwQuerySymbolicLinkObject
    • ZwMapViewOfSection
    • MmGetSystemRoutineAddress
    • RtlAppendUnicodeToString
    • IoCreateFile
    • RtlQueryRegistryValues
    • RtlEqualUnicodeString
    • MmBuildMdlForNonPagedPool
    • ZwOpenSymbolicLinkObject
    • IoFreeMdl
    • RtlFreeUnicodeString
    • IoFileObjectType
    • ZwUnmapViewOfSection
    • NtClose
    • IoFreeIrp
    • PsGetVersion
    • IoAllocateIrp
    • RtlCopyUnicodeString
    • ZwOpenFile
    • RtlImageNtHeader
    • IoAllocateMdl
    • IofCallDriver
    • ZwQueryVolumeInformationFile
    • ObQueryNameString
    • ObReferenceObjectByPointer
    • IoDeleteSymbolicLink
    • IoDeleteDevice
    • ExEventObjectType
    • IofCompleteRequest
    • IoCreateSymbolicLink
    • IoGetDeviceObjectPointer
    • ObInsertObject
    • IoAcquireVpbSpinLock
    • SeCreateAccessState
    • IoGetFileObjectGenericMapping
    • ObCreateObject
    • IoReleaseVpbSpinLock
    • KeBugCheckEx
    • IoCreateDevice
    • ZwSetSecurityObject
    • IoDeviceObjectType
    • RtlLengthSecurityDescriptor
    • SeCaptureSecurityDescriptor
    • RtlAbsoluteToSelfRelativeSD
    • IoIsWdmVersionAvailable
    • SeExports
    • wcschr
    • RtlLengthSid
    • RtlGetSaclSecurityDescriptor
    • RtlGetDaclSecurityDescriptor
    • RtlGetGroupSecurityDescriptor
    • RtlGetOwnerSecurityDescriptor
    • ZwSetValueKey
    • ExAcquireResourceExclusiveLite
    • __C_specific_handler

    Exported Functions

    Expand
    • ??0CAutoUpdateConfigThread@@QEAA@AEBV0@@Z
    • ??0CAutoUpdateConfigThread@@QEAA@PEAU_UNICODE_STRING@@P6AX0PEAX@Z1@Z
    • ??0CBlobConfig@@QEAA@AEBV0@@Z
    • ??0CBlobConfig@@QEAA@K@Z
    • ??0CContext@@QEAA@AEBV0@@Z
    • ??0CContext@@QEAA@KP6AJPEAU_EVENT_REPORT@@PEAXPEAU_TMCE_REPORT@@PEAU_TMCE_FEEDBACK@@@Z1K@Z
    • ??0CContextList@@QEAA@AEBV0@@Z
    • ??0CContextList@@QEAA@KPEAVIMemoryAllocator@@@Z
    • ??0CDebugLog@@QEAA@AEBV0@@Z
    • ??0CDebugLog@@QEAA@PEBG@Z
    • ??0CDelayLoadThread@@QEAA@AEBV0@@Z
    • ??0CDelayLoadThread@@QEAA@XZ
    • ??0CExclusionExtConfig@@QEAA@AEBV0@@Z
    • ??0CExclusionExtConfig@@QEAA@KKE@Z
    • ??0CExclusionFileNameConfig@@QEAA@AEBV0@@Z
    • ??0CExclusionFileNameConfig@@QEAA@KK@Z
    • ??0CExclusionFilePathConfig@@QEAA@AEBV0@@Z
    • ??0CExclusionFilePathConfig@@QEAA@KK@Z
    • ??0CExclusionFolderConfig@@QEAA@AEBV0@@Z
    • ??0CExclusionFolderConfig@@QEAA@KK@Z
    • ??0CExclusionRegistryConfig@@QEAA@AEBV0@@Z
    • ??0CExclusionRegistryConfig@@QEAA@KK@Z
    • ??0CFile@@QEAA@AEBV0@@Z
    • ??0CFile@@QEAA@E@Z
    • ??0CFileExtension@@QEAA@AEBV0@@Z
    • ??0CFileExtension@@QEAA@KEEPEAVIMemoryAllocator@@@Z
    • ??0CInclusionExtConfig@@QEAA@AEBV0@@Z
    • ??0CInclusionExtConfig@@QEAA@KKE@Z
    • ??0CInclusionFileNameConfig@@QEAA@AEBV0@@Z
    • ??0CInclusionFileNameConfig@@QEAA@KK@Z
    • ??0CInclusionFilePathConfig@@QEAA@AEBV0@@Z
    • ??0CInclusionFilePathConfig@@QEAA@KK@Z
    • ??0CInclusionFolderConfig@@QEAA@AEBV0@@Z
    • ??0CInclusionFolderConfig@@QEAA@KK@Z
    • ??0CKEvent@@QEAA@AEBV0@@Z
    • ??0CKEvent@@QEAA@W4_EVENT_TYPE@@E@Z
    • ??0CList@@QEAA@AEBV0@@Z
    • ??0CList@@QEAA@KPEAVIMemoryAllocator@@@Z
    • ??0CLockEvent@@QEAA@AEBV0@@Z
    • ??0CLockEvent@@QEAA@XZ
    • ??0CLockList@@QEAA@AEBV0@@Z
    • ??0CLockList@@QEAA@KKPEAVIMemoryAllocator@@@Z
    • ??0CMemoryAllocator@@IEAA@W4_POOL_TYPE@@K@Z
    • ??0CMemoryAllocator@@QEAA@AEBV0@@Z
    • ??0CMemoryPoolAllocator@@IEAA@W4_POOL_TYPE@@_K1K@Z
    • ??0CMemoryPoolAllocator@@QEAA@AEBV0@@Z
    • ??0CModuleConfig@@QEAA@AEBV0@@Z
    • ??0CModuleConfig@@QEAA@XZ
    • ??0CModuleConfigList@@QEAA@AEBV0@@Z
    • ??0CModuleConfigList@@QEAA@KPEAVIMemoryAllocator@@@Z
    • ??0CModuleFileExtConfig@@QEAA@AEBV0@@Z
    • ??0CModuleFileExtConfig@@QEAA@KKE@Z
    • ??0CModuleFlagConfig@@QEAA@AEBV0@@Z
    • ??0CModuleFlagConfig@@QEAA@K@Z
    • ??0CModuleMultiStringConfig@@QEAA@AEBV0@@Z
    • ??0CModuleMultiStringConfig@@QEAA@KK@Z
    • ??0CModuleStringConfig@@QEAA@AEBV0@@Z
    • ??0CModuleStringConfig@@QEAA@K@Z
    • ??0CNoLockList@@QEAA@AEBV0@@Z
    • ??0CNoLockList@@QEAA@KKPEAVIMemoryAllocator@@@Z
    • ??0CSmartLock@@QEAA@AEAVCLockEvent@@@Z
    • ??0CSmartLock@@QEAA@XZ
    • ??0CSmartReference@@QEAA@AEAJ@Z
    • ??0CSmartReference@@QEAA@AEAK@Z
    • ??0CSmartResource@@QEAA@AEAVCResource@@E@Z
    • ??0CStrList@@QEAA@AEBV0@@Z
    • ??0CStrList@@QEAA@KPEAVIMemoryAllocator@@@Z
    • ??0CSystemThread@@QEAA@AEBV0@@Z
    • ??0CSystemThread@@QEAA@K@Z
    • ??0CUserFuncAdapterJob@@QEAA@AEBV0@@Z
    • ??0CUserFuncAdapterJob@@QEAA@P6AXPEAX@Z0@Z
    • ??0CWorkerThread@@IEAA@PEAVCWorkerThreadJobQueue@@@Z
    • ??0CWorkerThread@@QEAA@AEBV0@@Z
    • ??0CWorkerThreadJob@@QEAA@AEBV0@@Z
    • ??0CWorkerThreadJob@@QEAA@E@Z
    • ??0CWorkerThreadJobQueue@@QEAA@AEBV0@@Z
    • ??0CWorkerThreadJobQueue@@QEAA@K@Z
    • ??0CWorkerThreadPool@@QEAA@AEBV0@@Z
    • ??0CWorkerThreadPool@@QEAA@K@Z
    • ??0IMemoryAllocator@@QEAA@AEBV0@@Z
    • ??0IMemoryAllocator@@QEAA@XZ
    • ??1CAutoUpdateConfigThread@@UEAA@XZ
    • ??1CBlobConfig@@UEAA@XZ
    • ??1CContext@@UEAA@XZ
    • ??1CContextList@@UEAA@XZ
    • ??1CDebugLog@@UEAA@XZ
    • ??1CDelayLoadThread@@UEAA@XZ
    • ??1CExclusionExtConfig@@UEAA@XZ
    • ??1CExclusionFileNameConfig@@UEAA@XZ
    • ??1CExclusionFilePathConfig@@UEAA@XZ
    • ??1CExclusionFolderConfig@@UEAA@XZ
    • ??1CExclusionRegistryConfig@@UEAA@XZ
    • ??1CFile@@UEAA@XZ
    • ??1CFileExtension@@UEAA@XZ
    • ??1CInclusionExtConfig@@UEAA@XZ
    • ??1CInclusionFileNameConfig@@UEAA@XZ
    • ??1CInclusionFilePathConfig@@UEAA@XZ
    • ??1CInclusionFolderConfig@@UEAA@XZ
    • ??1CKEvent@@UEAA@XZ
    • ??1CList@@UEAA@XZ
    • ??1CLockEvent@@UEAA@XZ
    • ??1CLockList@@UEAA@XZ
    • ??1CMemoryAllocator@@UEAA@XZ
    • ??1CMemoryPoolAllocator@@UEAA@XZ
    • ??1CModuleConfig@@UEAA@XZ
    • ??1CModuleConfigList@@UEAA@XZ
    • ??1CModuleFileExtConfig@@UEAA@XZ
    • ??1CModuleFlagConfig@@UEAA@XZ
    • ??1CModuleMultiStringConfig@@UEAA@XZ
    • ??1CModuleStringConfig@@UEAA@XZ
    • ??1CNoLockList@@UEAA@XZ
    • ??1CSmartLock@@QEAA@XZ
    • ??1CSmartReference@@QEAA@XZ
    • ??1CSmartResource@@QEAA@XZ
    • ??1CStrList@@UEAA@XZ
    • ??1CSystemThread@@UEAA@XZ
    • ??1CUserFuncAdapterJob@@UEAA@XZ
    • ??1CWorkerThread@@UEAA@XZ
    • ??1CWorkerThreadJob@@UEAA@XZ
    • ??1CWorkerThreadJobQueue@@UEAA@XZ
    • ??1CWorkerThreadPool@@UEAA@XZ
    • ??1IMemoryAllocator@@UEAA@XZ
    • ??2@YAPEAX_KPEAVIMemoryAllocator@@PEBDK@Z
    • ??2CMemoryAllocator@@SAPEAX_K@Z
    • ??2CMemoryPoolAllocator@@SAPEAX_K@Z
    • ??3@YAXPEAX@Z
    • ??3IMemoryAllocator@@SAXPEAX@Z
    • ??4CAutoUpdateConfigThread@@QEAAAEAV0@AEBV0@@Z
    • ??4CBlobConfig@@QEAAAEAV0@AEBV0@@Z
    • ??4CContext@@QEAAAEAV0@AEBV0@@Z
    • ??4CDebugLog@@QEAAAEAV0@AEBV0@@Z
    • ??4CDelayLoadThread@@QEAAAEAV0@AEBV0@@Z
    • ??4CFile@@QEAAAEAV0@AEBV0@@Z
    • ??4CKEvent@@QEAAAEAV0@AEBV0@@Z
    • ??4CLockEvent@@QEAAAEAV0@AEBV0@@Z
    • ??4CMemoryAllocator@@QEAAAEAV0@AEBV0@@Z
    • ??4CMemoryPoolAllocator@@QEAAAEAV0@AEBV0@@Z
    • ??4CModuleConfig@@QEAAAEAV0@AEBV0@@Z
    • ??4CModuleFlagConfig@@QEAAAEAV0@AEBV0@@Z
    • ??4CModuleStringConfig@@QEAAAEAV0@AEBV0@@Z
    • ??4CSmartLock@@QEAAAEAV0@AEBV0@@Z
    • ??4CSmartLock@@QEAAAEBV0@AEAVCLockEvent@@@Z
    • ??4CSmartResource@@QEAAAEAV0@AEBV0@@Z
    • ??4CSystemThread@@QEAAAEAV0@AEBV0@@Z
    • ??4CUserFuncAdapterJob@@QEAAAEAV0@AEBV0@@Z
    • ??4CWorkerThread@@QEAAAEAV0@AEBV0@@Z
    • ??4CWorkerThreadJob@@QEAAAEAV0@AEBV0@@Z
    • ??4IMemoryAllocator@@QEAAAEAV0@AEBV0@@Z
    • ??_7CAutoUpdateConfigThread@@6B@
    • ??_7CBlobConfig@@6B@
    • ??_7CContext@@6B@
    • ??_7CContextList@@6B@
    • ??_7CDebugLog@@6B@
    • ??_7CDelayLoadThread@@6B@
    • ??_7CExclusionExtConfig@@6B@
    • ??_7CExclusionFileNameConfig@@6B@
    • ??_7CExclusionFilePathConfig@@6B@
    • ??_7CExclusionFolderConfig@@6B@
    • ??_7CExclusionRegistryConfig@@6B@
    • ??_7CFile@@6B@
    • ??_7CFileExtension@@6B@
    • ??_7CInclusionExtConfig@@6B@
    • ??_7CInclusionFileNameConfig@@6B@
    • ??_7CInclusionFilePathConfig@@6B@
    • ??_7CInclusionFolderConfig@@6B@
    • ??_7CKEvent@@6B@
    • ??_7CList@@6B@
    • ??_7CLockEvent@@6B@
    • ??_7CLockList@@6B@
    • ??_7CMemoryAllocator@@6B@
    • ??_7CMemoryPoolAllocator@@6B@
    • ??_7CModuleConfig@@6B@
    • ??_7CModuleConfigList@@6B@
    • ??_7CModuleFileExtConfig@@6B@
    • ??_7CModuleFlagConfig@@6B@
    • ??_7CModuleMultiStringConfig@@6B@
    • ??_7CModuleStringConfig@@6B@
    • ??_7CNoLockList@@6B@
    • ??_7CStrList@@6B@
    • ??_7CSystemThread@@6B@
    • ??_7CUserFuncAdapterJob@@6B@
    • ??_7CWorkerThread@@6B@
    • ??_7CWorkerThreadJob@@6B@
    • ??_7CWorkerThreadJobQueue@@6B@
    • ??_7CWorkerThreadPool@@6B@
    • ??_7IMemoryAllocator@@6B@
    • ??_FCContextList@@QEAAXXZ
    • ??_FCFile@@QEAAXXZ
    • ??_FCFileExtension@@QEAAXXZ
    • ??_FCModuleConfigList@@QEAAXXZ
    • ??_FCStrList@@QEAAXXZ
    • ??_FCSystemThread@@QEAAXXZ
    • ??_FCWorkerThread@@QEAAXXZ
    • ??_FCWorkerThreadJob@@QEAAXXZ
    • ??_FCWorkerThreadJobQueue@@QEAAXXZ
    • ??_U@YAPEAX_KPEAVIMemoryAllocator@@PEBDK@Z
    • ??_V@YAXPEAX@Z
    • ?Acquire@CLockEvent@@QEAAXXZ
    • ?Add@CContextList@@QEAAEPEAVCContext@@@Z
    • ?Add@CFileExtension@@QEAAEPEBGK@Z
    • ?Add@CModuleConfigList@@QEAAEPEAVCModuleConfig@@@Z
    • ?Add@CStrList@@QEAAEPEBG@Z
    • ?AddNode@CLockList@@UEAAEQEAXE@Z
    • ?AddNode@CNoLockList@@UEAAEQEAXE@Z
    • ?Alloc@CMemoryAllocator@@UEAAPEAX_KPEBDK@Z
    • ?Alloc@CMemoryPoolAllocator@@UEAAPEAX_KPEBDK@Z
    • ?AllocBlock@CMemoryPoolAllocator@@IEAAPEAX_K@Z
    • ?AttachJobQueue@CWorkerThread@@QEAAXPEAVCWorkerThreadJobQueue@@@Z
    • ?Cancel@CWorkerThreadJob@@QEAAXXZ
    • ?CheckNode@CLockList@@UEAAHQEAX@Z
    • ?CheckNode@CNoLockList@@UEAAHQEAX@Z
    • ?CleanQueue@CWorkerThreadJobQueue@@QEAAXXZ
    • ?Cleanup@CBlobConfig@@AEAAXXZ
    • ?Cleanup@CModuleFileExtConfig@@IEAAXXZ
    • ?Cleanup@CModuleMultiStringConfig@@IEAAXXZ
    • ?Cleanup@CModuleStringConfig@@AEAAXXZ
    • ?Close@CFile@@QEAAJXZ
    • ?Count@CLockList@@QEAAKXZ
    • ?Count@CNoLockList@@QEAAKXZ
    • ?Create@CFile@@QEAAJPEBGKKKK@Z
    • ?Create@CSystemThread@@QEAAEXZ
    • ?CreateInstance@CMemoryAllocator@@SAPEAV1@W4_POOL_TYPE@@K@Z
    • ?CreateInstance@CMemoryPoolAllocator@@SAPEAV1@W4_POOL_TYPE@@_K1K@Z
    • ?CreatePool@CWorkerThreadPool@@QEAAEXZ
    • ?CreateThreads@CWorkerThreadPool@@QEAAEK@Z
    • ?CreateWIRP@CFile@@QEAAJPEBGKKKK@Z
    • ?Delete@CFile@@QEAAJXZ
    • ?Delete@CFileExtension@@QEAAEPEBGK@Z
    • ?Delete@CStrList@@QEAAEPEBG@Z
    • ?DeleteAll@CList@@UEAAXXZ
    • ?DeleteAll@CLockList@@UEAAXXZ
    • ?DeleteAll@CNoLockList@@UEAAXXZ
    • ?DeleteNode@CContextList@@MEAAXPEAX@Z
    • ?DeleteNode@CList@@UEAAXPEAX@Z
    • ?DeleteNode@CModuleConfigList@@MEAAXPEAX@Z
    • ?DeleteNode@CStrList@@EEAAXPEAU_STR_LIST_NODE@1@@Z
    • ?DisableWriteProtectFromCR0@@YAXPEAPEAX@Z
    • ?DoIt@CWorkerThreadJob@@QEAAJXZ
    • ?EntryPoint@CSystemThread@@KAXPEAX@Z
    • ?Find@CContextList@@QEAAPEAVCContext@@K@Z
    • ?Find@CContextList@@QEAAPEAVCContext@@PEAX@Z
    • ?Find@CFileExtension@@QEAAPEAU_STR_LIST_NODE@CStrList@@PEBGK@Z
    • ?Find@CModuleConfigList@@QEAAPEAVCModuleConfig@@K@Z
    • ?Find@CStrList@@QEAAPEAU_STR_LIST_NODE@1@PEBG@Z
    • ?FindNode@CContextList@@IEAAPEAXPEAX@Z
    • ?FindPartiallyAndAllMatch@CStrList@@QEAAPEAU_STR_LIST_NODE@1@PEBG@Z
    • ?First@CList@@UEAAPEAXXZ
    • ?First@CLockList@@UEAAPEAXXZ
    • ?First@CNoLockList@@UEAAPEAXXZ
    • ?Free@CMemoryAllocator@@UEAAXPEAX@Z
    • ?Free@CMemoryPoolAllocator@@UEAAXPEAX@Z
    • ?GetAttributes@CFile@@QEAAKXZ
    • ?GetBasicInfomration@CFile@@IEAAJXZ
    • ?GetBlobCofig@CContext@@UEAAJKPEAXPEAK@Z
    • ?GetCategory@CContext@@QEAAKXZ
    • ?GetData@CBlobConfig@@QEAAHPEAXPEAK@Z
    • ?GetData@CModuleFileExtConfig@@QEAAHPEAGPEAK@Z
    • ?GetData@CModuleFileExtConfig@@QEAAPEAVCFileExtension@@XZ
    • ?GetData@CModuleFlagConfig@@QEAAKXZ
    • ?GetData@CModuleMultiStringConfig@@QEAAHPEAGPEAK@Z
    • ?GetData@CModuleMultiStringConfig@@QEAAPEAVCStrList@@XZ
    • ?GetData@CModuleStringConfig@@QEAAPEAGXZ
    • ?GetData@CStrList@@QEAAEPEAGPEAK@Z
    • ?GetDataType@CModuleConfig@@QEAAKXZ
    • ?GetEngineContext@CContext@@QEAAPEAXXZ
    • ?GetFileExtensionConfig@CContext@@QEAAPEAVCFileExtension@@K@Z
    • ?GetFileExtensionConfig@CContext@@UEAAJKPEAGPEAK@Z
    • ?GetFileSize@CFile@@QEAAJPEAT_LARGE_INTEGER@@@Z
    • ?GetFlagConfig@CContext@@UEAAJKPEAK@Z
    • ?GetID@CModuleConfig@@QEAAKXZ
    • ?GetJob@CWorkerThreadJobQueue@@QEAAPEAVCWorkerThreadJob@@XZ
    • ?GetLength@CModuleStringConfig@@QEAAKXZ
    • ?GetLinkContext@CContext@@QEAAPEAXXZ
    • ?GetLogFlag@CDebugLog@@QEAAKXZ
    • ?GetModuleId@CModuleConfig@@QEAAKXZ
    • ?GetMultiStringConfig@CContext@@QEAAPEAVCStrList@@K@Z
    • ?GetMultiStringConfig@CContext@@UEAAJKPEAGPEAK@Z
    • ?GetOneThreadTEB@CWorkerThreadPool@@QEAAPEAU_ETHREAD@@XZ
    • ?GetReportCallBackRoutine@CContext@@QEAA_KXZ
    • ?GetSize@CBlobConfig@@QEAAKXZ
    • ?GetStringConfig@CContext@@QEAAPEAGK@Z
    • ?GetStringConfig@CContext@@UEAAJKPEAGPEAK@Z
    • ?GetThreadCount@CWorkerThreadPool@@QEAAKXZ
    • ?GetThreadID@CSystemThread@@QEAA_KXZ
    • ?GetType@CContext@@QEAAKXZ
    • ?GetUserParameter@CContext@@QEAA_KXZ
    • ?InitializeBlobConfig@CContext@@QEAAHKPEAXK@Z
    • ?InitializeFileExtensionConfig@CContext@@QEAAHKPEBG@Z
    • ?InitializeFlagConfig@CContext@@QEAAHKK@Z
    • ?InitializeMultiStringConfig@CContext@@QEAAHKPEBG@Z
    • ?InitializeStringConfig@CContext@@QEAAHKPEBG@Z
    • ?Insert@CList@@UEAAXQEAXE@Z
    • ?Insert@CLockList@@UEAAXQEAXE@Z
    • ?Insert@CNoLockList@@UEAAXQEAXE@Z
    • ?InsertAfter@CList@@UEAAXPEAX0@Z
    • ?InsertBefore@CList@@UEAAXPEAX0@Z
    • <