d35cb48d-2aca-4d7d-a194-f4566183bcd9

TmComm.sys

Description

TmComm.sys is a vulnerable driver and more information will be added as found.

UUID: d35cb48d-2aca-4d7d-a194-f4566183bcd9
Created: 2023-05-06
Author: Nasreddine Bencherchali
Acknowledgement: |

This download link contains the vulnerable driver!

Commands

sc.exe create TmComm.sys binPath=C:\windows\temp\TmComm.sys type=kernel &amp;&amp; sc.exe start TmComm.sys

Use Case	Privileges	Operating System
Elevate privileges	kernel	Windows 10

Detections

YARA 🏹

Expand

Exact Match

with header and size limitation

Threat Hunting

without header and size limitation

Renamed

for renamed driver files

Sigma 🛡️

Expand

Names

detects loading using name only

Hashes

detects loading using hashes only

Sysmon 🔎

Expand

Block

on hashes

Alert

on hashes

Resources

Internal Research

Known Vulnerable Samples

Property	Value
Filename	TmComm.sys
Creation Timestamp	2017-10-16 04:19:20
MD5	34686a4b10f239d781772e9e94486c1a
SHA1	8a922499f7a1b978555b46c30f90de1339760c74
SHA256	0909005d625866ef8ccd8ae8af5745a469f4f70561b644d6e38b80bccb53eb06
Authentihash MD5	ebd5f8589975be817ecd3c281055d4a7
Authentihash SHA1	ebd74b4fecfb48c28cdf11f123e0364c9e9852ea
Authentihash SHA256	66539655171ddff02d8134241c58a53de3faa6467db7be14131e04b99ef33cee
RichPEHeaderHash MD5	5b33b237bab6e0b50320054616983177
RichPEHeaderHash SHA1	754c63349a54279bb01f24974f9faf6da8294d27
RichPEHeaderHash SHA256	001d9e469d2c4160f8fbff1c0aee013e72881cffb568910a2c1473a17bf858b2
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	Trend Micro Eyes
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 7e93ebfb7cc64e59ea4b9a77d406fc3b

Field	Value
ToBeSigned (TBS) MD5	d0785ad36e427c92b19f6826ab1e8020
ToBeSigned (TBS) SHA1	365b7a9c21bd9373e49052c3e7b3e4646ddd4d43
ToBeSigned (TBS) SHA256	c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2
ValidFrom	2012-12-21 00:00:00
ValidTo	2020-12-30 23:59:59
Signature	03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	7e93ebfb7cc64e59ea4b9a77d406fc3b
Version	3

Certificate 0ecff438c8febf356e04d86a981b1a50

Field	Value
ToBeSigned (TBS) MD5	e9d38360b914c8863f6cba3ee58764d3
ToBeSigned (TBS) SHA1	4cba8eae47b6bf76f20b3504b98b8f062694a89b
ToBeSigned (TBS) SHA256	88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4
ValidFrom	2012-10-18 00:00:00
ValidTo	2020-12-29 23:59:59
Signature	783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	0ecff438c8febf356e04d86a981b1a50
Version	3

Certificate 497c4fad471540e6e453d0cafb155740

Field	Value
ToBeSigned (TBS) MD5	78eaa337666217b1c16a9a0ebd0b8434
ToBeSigned (TBS) SHA1	ff9cb835e78f6185eed4372096c3bae53b17d18d
ToBeSigned (TBS) SHA256	1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250
Subject	C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.
ValidFrom	2017-04-27 00:00:00
ValidTo	2018-07-16 23:59:59
Signature	f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	497c4fad471540e6e453d0cafb155740
Version	3

Certificate 611993e400000000001c

Field	Value
ToBeSigned (TBS) MD5	78a717e082dcc1cda3458d917e677d14
ToBeSigned (TBS) SHA1	4a872e0e51f9b304469cd1dedb496ee9b8b983a4
ToBeSigned (TBS) SHA256	317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
ValidFrom	2011-02-22 19:25:17
ValidTo	2021-02-22 19:35:17
Signature	812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	611993e400000000001c
Version	3

Certificate 5200e5aa2556fc1a86ed96c9d44b33c7

Field	Value
ToBeSigned (TBS) MD5	b30c31a572b0409383ed3fbe17e56e81
ToBeSigned (TBS) SHA1	4843a82ed3b1f2bfbee9671960e1940c942f688d
ToBeSigned (TBS) SHA256	03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-02-08 00:00:00
ValidTo	2020-02-07 23:59:59
Signature	5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	5200e5aa2556fc1a86ed96c9d44b33c7
Version	3

Imports

Expand

ntoskrnl.exe
HAL.dll
CLASSPNP.SYS

Imported Functions

Expand

wcsrchr
KeSetEvent
KePulseEvent
KeClearEvent
KeStackAttachProcess
KeUnstackDetachProcess
ObfDereferenceObject
ZwSetEvent
ZwClose
ZwConnectPort
RtlInitUnicodeString
RtlUnicodeStringToInteger
ZwCreateSection
ZwWaitForSingleObject
ZwOpenEvent
IoGetCurrentProcess
ObfReferenceObject
DbgBreakPoint
ZwRequestWaitReplyPort
ExFreePoolWithTag
ProbeForWrite
ZwFreeVirtualMemory
ZwAllocateVirtualMemory
ObOpenObjectByPointer
PsProcessType
memmove
PsGetProcessExitTime
MmSectionObjectType
PsThreadType
ObReleaseObjectSecurity
SeReleaseSubjectContext
SeAccessCheck
SeCaptureSubjectContext
ObGetObjectSecurity
DbgPrint
memset
MmIsAddressValid
ExInitializeResourceLite
ExDeleteResourceLite
ZwWriteFile
ZwReadFile
ZwQueryInformationFile
ZwSetInformationFile
ZwCreateFile
swprintf
towupper
_wcsnicmp
ExAllocatePoolWithTag
KeInitializeEvent
_snprintf
PsGetCurrentProcessId
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
PsGetCurrentThreadId
RtlInitAnsiString
ZwDeviceIoControlFile
ZwCreateKey
ZwCreateEvent
KeWaitForMultipleObjects
ObReferenceObjectByHandle
ZwNotifyChangeKey
_vsnprintf
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlEqualUnicodeString
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
RtlUpcaseUnicodeChar
ExGetPreviousMode
KeWaitForSingleObject
KeSetPriorityThread
PsTerminateSystemThread
PsCreateSystemThread
KeDelayExecutionThread
KeNumberProcessors
ZwQueryInformationProcess
PsLookupProcessByProcessId
ZwOpenDirectoryObject
PsSetCreateProcessNotifyRoutine
ZwQuerySystemInformation
ZwQueryDirectoryFile
ZwQueryDirectoryObject
ZwOpenKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryValueKey
ZwDeleteValueKey
ZwDeleteKey
ZwTerminateProcess
ZwOpenProcess
ZwQueryKey
ZwSetValueKey
IoFileObjectType
_allrem
ZwQuerySecurityObject
memcpy
RtlLengthSecurityDescriptor
MmHighestUserAddress
IoFreeIrp
IoFreeMdl
_purecall
IoBuildAsynchronousFsdRequest
_strnicmp
RtlQueryRegistryValues
RtlAppendUnicodeToString
mbstowcs
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
NtClose
ObQueryNameString
MmGetSystemRoutineAddress
ZwSetInformationObject
_stricmp
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwOpenFile
IoCreateFile
IofCallDriver
IoAllocateIrp
MmBuildMdlForNonPagedPool
IoAllocateMdl
ProbeForRead
PsGetVersion
RtlImageNtHeader
RtlCompareMemory
RtlUpcaseUnicodeString
_snwprintf
MmSystemRangeStart
wcsncmp
strrchr
ZwQueryVolumeInformationFile
ObReferenceObjectByPointer
IoBuildDeviceIoControlRequest
ZwOpenSection
_allmul
KeReleaseSemaphore
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
KeInitializeSemaphore
IofCompleteRequest
ExEventObjectType
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoGetDeviceObjectPointer
RtlUpperChar
ObReferenceObjectByName
IoDriverObjectType
RtlCompareUnicodeString
strncpy
KeServiceDescriptorTable
NtOpenProcess
ObOpenObjectByName
NtQueryInformationProcess
PsIsThreadTerminating
KeAddSystemServiceTable
ZwFsControlFile
ObInsertObject
IoReleaseVpbSpinLock
IoAcquireVpbSpinLock
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
_allshr
ExInterlockedPopEntrySList
IoGetStackLimits
IoBuildSynchronousFsdRequest
wcsstr
IoUnregisterPlugPlayNotification
FsRtlIsNameInExpression
IoGetConfigurationInformation
MmProbeAndLockPages
IoGetDeviceInterfaces
IoRegisterPlugPlayNotification
ExAllocatePool
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
strncat
wcschr
wcsncat
wcstombs
KeTickCount
KeBugCheckEx
RtlUnwind
wcsncpy
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
ExAcquireResourceSharedLite
ExReleaseFastMutexUnsafe
KeLeaveCriticalRegion
KeEnterCriticalRegion
ZwSetSecurityObject
ExAcquireFastMutexUnsafe
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
RtlLengthSid
RtlAbsoluteToSelfRelativeSD
MmUnlockPages
KeGetCurrentThread
KfAcquireSpinLock
KfReleaseSpinLock
KeRaiseIrqlToDpcLevel
KfLowerIrql
ExAcquireFastMutex
ExReleaseFastMutex
KeGetCurrentIrql
KfRaiseIrql
ClassInitialize

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
??0CBlobConfig@@QAE@ABV0@@Z
??0CBlobConfig@@QAE@K@Z
??0CContext@@QAE@ABV0@@Z
??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QAE@ABV0@@Z
??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
??0CDebugLog@@QAE@ABV0@@Z
??0CDebugLog@@QAE@PBG@Z
??0CDebugLogEx@@QAE@ABV0@@Z
??0CDebugLogEx@@QAE@K@Z
??0CDelayLoadThread@@QAE@ABV0@@Z
??0CDelayLoadThread@@QAE@XZ
??0CExclusionExtConfig@@QAE@ABV0@@Z
??0CExclusionExtConfig@@QAE@KKE@Z
??0CExclusionFileNameConfig@@QAE@ABV0@@Z
??0CExclusionFileNameConfig@@QAE@KK@Z
??0CExclusionFilePathConfig@@QAE@ABV0@@Z
??0CExclusionFilePathConfig@@QAE@KK@Z
??0CExclusionFolderConfig@@QAE@ABV0@@Z
??0CExclusionFolderConfig@@QAE@KK@Z
??0CExclusionRegistryConfig@@QAE@ABV0@@Z
??0CExclusionRegistryConfig@@QAE@KK@Z
??0CFile@@QAE@ABV0@@Z
??0CFile@@QAE@E@Z
??0CFileExtension@@QAE@ABV0@@Z
??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
??0CInclusionExtConfig@@QAE@ABV0@@Z
??0CInclusionExtConfig@@QAE@KKE@Z
??0CInclusionFileNameConfig@@QAE@ABV0@@Z
??0CInclusionFileNameConfig@@QAE@KK@Z
??0CInclusionFilePathConfig@@QAE@ABV0@@Z
??0CInclusionFilePathConfig@@QAE@KK@Z
??0CInclusionFolderConfig@@QAE@ABV0@@Z
??0CInclusionFolderConfig@@QAE@KK@Z
??0CKEvent@@QAE@ABV0@@Z
??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
??0CList@@QAE@ABV0@@Z
??0CList@@QAE@KPAVIMemoryAllocator@@@Z
??0CLockEvent@@QAE@ABV0@@Z
??0CLockEvent@@QAE@XZ
??0CLockList@@QAE@ABV0@@Z
??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QAE@ABV0@@Z
??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
??0CMemoryPoolAllocator@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@XZ
??0CModuleConfigList@@QAE@ABV0@@Z
??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QAE@ABV0@@Z
??0CModuleFileExtConfig@@QAE@KKE@Z
??0CModuleFlagConfig@@QAE@ABV0@@Z
??0CModuleFlagConfig@@QAE@K@Z
??0CModuleMultiStringConfig@@QAE@ABV0@@Z
??0CModuleMultiStringConfig@@QAE@KK@Z
??0CModuleStringConfig@@QAE@ABV0@@Z
??0CModuleStringConfig@@QAE@K@Z
??0CNoLockList@@QAE@ABV0@@Z
??0CNoLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CSmartLock@@QAE@AAVCLockEvent@@@Z
??0CSmartLock@@QAE@XZ
??0CSmartReference@@QAE@AAJ@Z
??0CSmartReference@@QAE@AAK@Z
??0CSmartResource@@QAE@AAVCResource@@E@Z
??0CStrList@@QAE@ABV0@@Z
??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
??0CSystemThread@@QAE@ABV0@@Z
??0CSystemThread@@QAE@K@Z
??0CUserFuncAdapterJob@@QAE@ABV0@@Z
??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z01@Z
??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@E@Z
??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
??0CWorkerThreadJobQueue@@QAE@K@Z
??0CWorkerThreadPool@@QAE@ABV0@@Z
??0CWorkerThreadPool@@QAE@K@Z
??0CWorkerThreadPoolEx@@QAE@ABV0@@Z
??0CWorkerThreadPoolEx@@QAE@KK@Z
??0IMemoryAllocator@@QAE@ABV0@@Z
??0IMemoryAllocator@@QAE@XZ
??1CAutoUpdateConfigThread@@UAE@XZ
??1CBlobConfig@@UAE@XZ
??1CContext@@UAE@XZ
??1CContextList@@UAE@XZ
??1CDebugLog@@UAE@XZ
??1CDebugLogEx@@UAE@XZ
??1CDelayLoadThread@@UAE@XZ
??1CExclusionExtConfig@@UAE@XZ
??1CExclusionFileNameConfig@@UAE@XZ
??1CExclusionFilePathConfig@@UAE@XZ
??1CExclusionFolderConfig@@UAE@XZ
??1CExclusionRegistryConfig@@UAE@XZ
??1CFile@@UAE@XZ
??1CFileExtension@@UAE@XZ
??1CInclusionExtConfig@@UAE@XZ
??1CInclusionFileNameConfig@@UAE@XZ
??1CInclusionFilePathConfig@@UAE@XZ
??1CInclusionFolderConfig@@UAE@XZ
??1CKEvent@@UAE@XZ
??1CList@@UAE@XZ
??1CLockEvent@@UAE@XZ
??1CLockList@@UAE@XZ
??1CMemoryAllocator@@UAE@XZ
??1CMemoryPoolAllocator@@UAE@XZ
??1CModuleConfig@@UAE@XZ
??1CModuleConfigList@@UAE@XZ
??1CModuleFileExtConfig@@UAE@XZ
??1CModuleFlagConfig@@UAE@XZ
??1CModuleMultiStringConfig@@UAE@XZ
??1CModuleStringConfig@@UAE@XZ
??1CNoLockList@@UAE@XZ
??1CSmartLock@@QAE@XZ
??1CSmartReference@@QAE@XZ
??1CSmartResource@@QAE@XZ
??1CStrList@@UAE@XZ
??1CSystemThread@@UAE@XZ
??1CUserFuncAdapterJob@@UAE@XZ
??1CWorkerThread@@UAE@XZ
??1CWorkerThreadJob@@UAE@XZ
??1CWorkerThreadJobQueue@@UAE@XZ
??1CWorkerThreadPool@@UAE@XZ
??1CWorkerThreadPoolEx@@UAE@XZ
??1IMemoryAllocator@@UAE@XZ
??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??2CMemoryAllocator@@SGPAXI@Z
??2CMemoryPoolAllocator@@SGPAXI@Z
??3@YAXPAX@Z
??3IMemoryAllocator@@SGXPAX@Z
??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
??4CBlobConfig@@QAEAAV0@ABV0@@Z
??4CContext@@QAEAAV0@ABV0@@Z
??4CDebugLog@@QAEAAV0@ABV0@@Z
??4CDebugLogEx@@QAEAAV0@ABV0@@Z
??4CDelayLoadThread@@QAEAAV0@ABV0@@Z
??4CFile@@QAEAAV0@ABV0@@Z
??4CKEvent@@QAEAAV0@ABV0@@Z
??4CLockEvent@@QAEAAV0@ABV0@@Z
??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
??4CModuleConfig@@QAEAAV0@ABV0@@Z
??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
??4CSmartResource@@QAEAAV0@ABV0@@Z
??4CSystemThread@@QAEAAV0@ABV0@@Z
??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
??4CWorkerThread@@QAEAAV0@ABV0@@Z
??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CDebugLogEx@@6B@
??_7CDelayLoadThread@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CInclusionExtConfig@@6B@
??_7CInclusionFileNameConfig@@6B@
??_7CInclusionFilePathConfig@@6B@
??_7CInclusionFolderConfig@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CNoLockList@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7CWorkerThreadPoolEx@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QAEXXZ
??_FCFile@@QAEXXZ
??_FCFileExtension@@QAEXXZ
??_FCModuleConfigList@@QAEXXZ
??_FCStrList@@QAEXXZ
??_FCSystemThread@@QAEXXZ
??_FCWorkerThread@@QAEXXZ
??_FCWorkerThreadJob@@QAEXXZ
??_FCWorkerThreadJobQueue@@QAEXXZ
??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??_V@YAXPAX@Z
?Acquire@CLockEvent@@QAEXXZ
?Add@CContextList@@QAEEPAVCContext@@@Z
?Add@CFileExtension@@QAEEPBGK@Z
?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
?Add@CStrList@@QAEEPBG@Z
?AddNode@CLockList@@UAEEQAXE@Z
?AddNode@CNoLockList@@UAEEQAXE@Z
?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QAEXXZ
?CheckNode@CLockList@@UAEHQAX@Z
?CheckNode@CNoLockList@@UAEHQAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
?Cleanup@CBlobConfig@@AAEXXZ
?Cleanup@CModuleFileExtConfig@@IAEXXZ
?Cleanup@CModuleMultiStringConfig@@IAEXXZ
?Cleanup@CModuleStringConfig@@AAEXXZ
?Close@CFile@@QAEJXZ
?Count@CLockList@@QAEKXZ
?Count@CNoLockList@@QAEKXZ
?Create@CFile@@QAEJPBGKKKK@Z
?Create@CSystemThread@@QAEEXZ
?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
?CreatePool@CWorkerThreadPool@@QAEEXZ
?CreatePool@CWorkerThreadPoolEx@@QAEEXZ
?CreateThreads@CWorkerThreadPool@@QAEEK@Z
?CreateThreads@CWorkerThreadPoolEx@@QAEEK@Z
?CreateWIRP@CFile@@QAEJPBGKKKK@Z
?Delete@CFile@@QAEJXZ
?Delete@CFileExtension@@QAEEPBGK@Z
?Delete@CStrList@@QAEEPBG@Z
?DeleteAll@CList@@UAEXXZ
?DeleteAll@CLockList@@UAEXXZ
?DeleteAll@CNoLockList@@UAEXXZ
?DeleteNode@CContextList@@MAEXPAX@Z
?DeleteNode@CList@@UAEXPAX@Z
?DeleteNode@CModuleConfigList@@MAEXPAX@Z
?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YGXPAPAX@Z
?DoIt@CWorkerThreadJob@@QAEJXZ
?EntryPoint@CSystemThread@@KGXPAX@Z
?Find@CContextList@@QAEPAVCContext@@K@Z
?Find@CContextList@@QAEPAVCContext@@PAX@Z
?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FindNode@CContextList@@IAEPAXPAX@Z
?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FinishFunction@CUserFuncAdapterJob@@MAEXXZ
?FinishIt@CWorkerThreadJob@@QAEJXZ
?First@CList@@UAEPAXXZ
?First@CLockList@@UAEPAXXZ
?First@CNoLockList@@UAEPAXXZ
?Free@CMemoryAllocator@@UAEXPAX@Z
?Free@CMemoryPoolAllocator@@UAEXPAX@Z
?GetAttributes@CFile@@QAEKXZ
?GetBasicInfomration@CFile@@IAEJXZ
?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
?GetCategory@CContext@@QAEKXZ
?GetData@CBlobConfig@@QAEHPAXPAK@Z
?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QAEKXZ
?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
?GetData@CModuleStringConfig@@QAEPAGXZ
?GetData@CStrList@@QAEEPAGPAK@Z
?GetDataType@CModuleConfig@@QAEKXZ
?GetEngineContext@CContext@@QAEPAXXZ
?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFileSizeWIRP@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UAEJKPAK@Z
?GetID@CModuleConfig@@QAEKXZ
?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QAEKXZ
?GetLinkContext@CContext@@QAEPAXXZ
?GetLogFlag@CDebugLog@@QAEKXZ
?GetLogFlag@CDebugLogEx@@QAEKXZ
?GetModuleId@CModuleConfig@@QAEKXZ
?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_KTHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_KTHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QAEKXZ
?GetSize@CBlobConfig@@QAEKXZ
?GetStringConfig@CContext@@QAEPAGK@Z
?GetStringConfig@CContext@@UAEJKPAGPAK@Z
?GetThreadCount@CWorkerThreadPool@@QAEKXZ
?GetThreadCount@CWorkerThreadPoolEx@@QAEKXZ
?GetThreadID@CSystemThread@@QAEKXZ
?GetType@CContext@@QAEKXZ
?GetUserParameter@CContext@@QAEKXZ
?InitProcMon@CDebugLogEx@@IAEXXZ
?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
?InitializeFlagConfig@CContext@@QAEHKK@Z
?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
?InitializeStringConfig@CContext@@QAEHKPBG@Z
?Insert@CList@@UAEXQAXE@Z
?Insert@CLockList@@UAEXQAXE@Z
?Insert@CNoLockList@@UAEXQAXE@Z
?InsertAfter@CList@@UAEXPAX0@Z
?InsertBefore@CList@@UAEXPAX0@Z
?Instance@CWorkerThreadPool@@SGPAV1@XZ
?IsEmpty@CList@@UAEEXZ
?IsEmpty@CLockList@@UAEEXZ
?IsEmpty@CNoLockList@@UAEEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
?IsFull@CLockList@@QBEEXZ
?IsFull@CNoLockList@@QBEEXZ
?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionExtConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFileNameConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFilePathConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFolderConfig@@QAEEPBG@Z
?IsOpened@CFile@@QAEEXZ
?IsTerminated@CWorkerThreadPool@@QAEEXZ
?IsTerminated@CWorkerThreadPoolEx@@QAEEXZ
?IsValid@CMemoryAllocator@@UAEEXZ
?IsValid@CMemoryPoolAllocator@@UAEEXZ
?IsValid@IMemoryAllocator@@UAEEXZ
?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
?IsWorkerThread@CWorkerThreadPoolEx@@QAEEK@Z
?JobFunction@CUserFuncAdapterJob@@MAEXXZ
?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
?JobQueue@CWorkerThreadPoolEx@@QAEAAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QAEKXZ
?Limit@CNoLockList@@QAEKXZ
?MatchAllExtensions@CFileExtension@@QAEEXZ
?MatchNoExtensions@CFileExtension@@QAEEXZ
?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
?NeedDelete@CWorkerThreadJob@@QAEEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
?NewNode@CList@@UAEPAXXZ
?NewNode@CStrList@@EAEPAXXZ
?NewNodeVariant@CList@@IAEPAXK@Z
?Next@CList@@UBEPAXQAX@Z
?Next@CLockList@@UBEPAXQAX@Z
?Next@CNoLockList@@UBEPAXQAX@Z
?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
?NotityTerminate@CWorkerThread@@QAEXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
?PostJobToWorkerThread@CWorkerThreadPoolEx@@QAEJP6GXPAX@Z0E1@Z
?Pulse@CKEvent@@QAEJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPoolEx@@QAEJPAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
?Read@CFile@@QAEJPADKPAK@Z
?ReadWIRP@CFile@@QAEJPADKPAK@Z
?ReferenceCount@CContext@@QAEAAKXZ
?Release@CLockEvent@@QAEXXZ
?Remove@CContextList@@UAEEQAX@Z
?Remove@CList@@UAEEQAX@Z
?Remove@CLockList@@UAEEQAX@Z
?Remove@CNoLockList@@UAEEQAX@Z
?RemoveHead@CList@@UAEPAXXZ
?RemoveHead@CLockList@@UAEPAXXZ
?RemoveHead@CNoLockList@@UAEPAXXZ
?RemoveTail@CList@@UAEPAXXZ
?RemoveTail@CLockList@@UAEPAXXZ
?RemoveTail@CNoLockList@@UAEPAXXZ
?Reset@CKEvent@@QAEXXZ
?ResetData@CInclusionExtConfig@@QAEXXZ
?ResetData@CInclusionFileNameConfig@@QAEXXZ
?ResetData@CInclusionFilePathConfig@@QAEXXZ
?ResetData@CInclusionFolderConfig@@QAEXXZ
?RestoreCR0@@YGXPAX@Z
?Run@CAutoUpdateConfigThread@@UAEXXZ
?Run@CDelayLoadThread@@UAEXXZ
?Run@CWorkerThread@@UAEXXZ
?SeekToEnd@CFile@@QAEJXZ
?Set@CKEvent@@QAEJJE@Z
?SetAttributes@CFile@@QAEJK@Z
?SetBlobCofig@CContext@@UAEJKPAXK@Z
?SetData@CBlobConfig@@QAEHPAXK@Z
?SetData@CModuleFileExtConfig@@QAEHPBG@Z
?SetData@CModuleFlagConfig@@QAEHK@Z
?SetData@CModuleMultiStringConfig@@QAEHPBGK@Z
?SetData@CModuleStringConfig@@QAEHPBG@Z
?SetEngineContext@CContext@@QAEXPAX@Z
?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
?SetFlagConfig@CContext@@UAEJKK@Z
?SetLinkContext@CContext@@QAEXPAX@Z
?SetLogFlag@CDebugLog@@QAEEK@Z
?SetLogFlag@CDebugLogEx@@QAEEK@Z
?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
?SetMultiStringConfig@CContext@@UAEJKPBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
?SetPriority@CSystemThread@@QAEXK@Z
?SetStopUse@CContext@@QAEXXZ
?SetStringConfig@CContext@@UAEJKPBG@Z
?Setup@CSystemThread@@MAEXXZ
?StopUse@CContext@@QAEHXZ
?TearDown@CSystemThread@@MAEXXZ
?Terminate@CSystemThread@@QAEXE@Z
?Terminate@CWorkerThreadPool@@QAEEXZ
?Terminate@CWorkerThreadPoolEx@@QAEEXZ
?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QAEXXZ
?WaitForInit@CDelayLoadThread@@QAEEXZ
?WaitForLoad@CDelayLoadThread@@QAEEXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
?WaitQueueEmpty@CWorkerThreadJobQueue@@QAEXXZ
?Write@CDebugLog@@QAAXPBDZZ
?Write@CDebugLogEx@@QAAXPBDZZ
?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
?WriteDataToFile@CDebugLogEx@@IAEXPADK@Z
?WriteDataToProcMonW@CDebugLogEx@@IAEXPAD@Z
?WriteSystemInformation@CDebugLog@@QAEXXZ
?WriteSystemInformation@CDebugLogEx@@QAEXXZ
?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
?WriteSystemStringInformation@CDebugLogEx@@IAEXPBG@Z
?WriteToFile@CDebugLog@@IAEXPADK@Z
?WriteToProcMonW@CDebugLogEx@@IAEXPAU_UNICODE_STRING@@@Z
?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
?_pPagedAllocator@@3PAVCMemoryAllocator@@A
?m_lpInstance@CWorkerThreadPool@@1PAV1@A
?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
_DeInitKm2UmCommunication@0
_DeInitKmLPC@0
_DuplicateFullFileName@4
_FreeFullFileName@4
_GetKm2UmMode@0
_GetModuleInfoByAddress@8
_GetModuleInfoByModuleName@8
_InitKm2UmCommunication@8
_InitKmLPC@0
_IsVerifierCodeCheckFlagOn@0
_IsWindows8_1_update@4
_KmCallUm@8
_KmCallUmByLPC@8
_KmCallUmEx@12
_KmCleanupCommPortAPIs@0
_KmGetUmInitProcess@0
_KmSetCommPortAPIs@4
_ModGetExportProcAddress@8
_ModLoadDLLToBuffer@4
_ModLoadDLLToBufferWithImageSize@8
_ModLoadModule@8
_ModUnLoadModule@4
_NormalizeFileName@4
_NormalizeFullNtPathToDosName@4
_TmCommConfigRoutine@4
_UtilAddDeviceInDriveTable@4
_UtilAddReparsePointMapping@8
_UtilCleanFileReadOnly@4
_UtilCloseExclusiveHandle@12
_UtilCreateDosFileName@8
_UtilDeleteFileForce@4
_UtilGetDeviceObjectName@8
_UtilGetFileNameFromFileObject@4
_UtilGetFileObjectForProcessByEPROC@8
_UtilGetFileObjectFromFileName@12
_UtilGetProcessName@12
_UtilGetSystemDirectory@4
_UtilGetSystemDirectoryEx@0
_UtilGetSystemDirectoryLength@0
_UtilGetSystemTime@4
_UtilIoSetFileInfo@24
_UtilIopCreateFileIRP@40
_UtilKeGetLowFileDevice@16
_UtilModuleIATHook@24
_UtilModuleIATUnHook@8
_UtilPostJobToWorkerThread@12
_UtilQueryExclusiveHandle@12
_UtilQueryKeyValue@24
_UtilRemoveDeviceFromDriveTable@4
_UtilVolumeDeviceToDosName@8
_UtilWaitValueChangeToZero@8
_UtilWriteVersionToRegistry@8
_UtilbuildDynamicDiskMappingTable@0
_UtlWriteBinValueKeyToRegistry@16
_ValidateAddressWithSize@20
__ResetProtectFromClose@4
__UtilDosPathNameToNtPathName@12

Sections

Expand

.text
.rdata
.data
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2019-11-24 20:59:46
MD5	28d6b138adc174a86c0f6248d8a88275
SHA1	8ac5703e67c3e6e0585cb8dbb86d196c5362f9bb
SHA256	12eda8b65ed8c1d80464a0c535ea099dffdb4981c134294cb0fa424efc85ee56
Authentihash MD5	53dc04de7603508de1788cc4cfcbf35f
Authentihash SHA1	b9b4d64e4c97b88e7258994f542c0ac84e934554
Authentihash SHA256	cf0855a8517be550b08a981bfacf90f245791cd70620868a241f1b1e2d8dfd89
RichPEHeaderHash MD5	10609f326d2f94c82a36fc64676533d8
RichPEHeaderHash SHA1	2a6eaf986eff3455a32fb6a20ceb7c3ffe70bf41
RichPEHeaderHash SHA256	b61ea91d46738a0387b4bbfb7c154f3a1881c8cab9360fd8eb85e1dd8c5d386c
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	Trend Micro Eyes
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 0ea0fe4dfb74cc64bc32143103c27c8b

Field	Value
ToBeSigned (TBS) MD5	e93e004baa6013b41135ac0648e29d5b
ToBeSigned (TBS) SHA1	dc91e26674d4b627319c700d3ebb1a6cf83d358e
ToBeSigned (TBS) SHA256	0d20335edb166a303411548471bee6f301c8b4f7f7e453d09c15303de2c888d7
Subject	C=TW, L=Taipei, O=Trend Micro, Inc., OU=Taipei, TW, CN=Trend Micro, Inc.
ValidFrom	2019-07-12 00:00:00
ValidTo	2020-07-10 12:00:00
Signature	5c08ae5d586a4751195382d6889dc2fc500e7c39c641e1a58def8d923e12b754e2cc35720cc8d3d29382980debf7d98fcc17d764187126dd07c134fdbb96dd44fe8a40195df6f6acd1881fa5ba2921dadceb3f64422344672834813916bbdf317533cf6aaf3317d78197d7d6c560ad681de135f39e2d4ad345b7fe491162660a5462c6075fd725382df1e6e6bc3a4c443be778f79b07f181082e38150ca28ab932f99e4bc4185dc5b3b6edf22c187fdfd84e23a21e7da1989837f43b89aa172e6b34dbcb297bffd511a1d1c100b25e0e921f622a0845e23317f9fec83659ca21c241800683e0dd66ce4d042a8aefc4142b5923a6fa93ee72c48e8dc04c13b4b0
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	0ea0fe4dfb74cc64bc32143103c27c8b
Version	3

Certificate 61204db4000000000027

Field	Value
ToBeSigned (TBS) MD5	8e3ffc222fbcebdbb8b23115ab259be7
ToBeSigned (TBS) SHA1	ee20bff28ffe13be731c294c90d6ded5aae0ec0e
ToBeSigned (TBS) SHA256	59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821
Subject	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
ValidFrom	2011-04-15 19:45:33
ValidTo	2021-04-15 19:55:33
Signature	208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	61204db4000000000027
Version	3

Certificate 03019a023aff58b16bd6d5eae617f066

Field	Value
ToBeSigned (TBS) MD5	a752afee44f017e8d74e3f3eb7914ae3
ToBeSigned (TBS) SHA1	8eca80a6b80e9c69dcef7745748524afb8019e2d
ToBeSigned (TBS) SHA256	82560fa7efec30b5ff82af643e6f3bf3d46868bbd5e7d76f93db185e9e3553a1
Subject	C=US, O=DigiCert, CN=DigiCert Timestamp Responder
ValidFrom	2014-10-22 00:00:00
ValidTo	2024-10-22 00:00:00
Signature	9d257e1b334db226815c9b86ce23200f8087e588ffffb1d46a2c31ed3a17197117cda91bbc5a1639009de36c84e45a40fbde06018c37fa9bb19d247efe20a457ad5bb79ab06026ea6957215d342f1f71b0839419056b359010a07b97c7f63fe7e21141a6bd62d9f0273d381d286f3a5209f0ec7062d3624bb0e073a692c0d38e31d82fe36d171306eee403b614abf38f43a7719d21dd14ca155d9241daf90f81d199740d26c40e7f1bb5f5a0f1c677062815e9d893e55516f0bb0aab1cdb5c482766c8a38b0a1ce595daaec42e59a061dddaf36da261e98a0b6dec1218bdf755544003922b6bc251c20a48afb0d46ee0f4140a3a1be38f3dcaaf6a8d7bdcd844
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	03019a023aff58b16bd6d5eae617f066
Version	3

Certificate 02c4d1e58a4a680c568da3047e7e4d5f

Field	Value
ToBeSigned (TBS) MD5	829995f702421dea833a24fb2c7f4442
ToBeSigned (TBS) SHA1	1d7e838accd498c2e5ba9373af819ec097bb955c
ToBeSigned (TBS) SHA256	92914d016cc46e125e50c4bd0bd7f72db87eed4ba68f3c589b4e86aa563108db
Subject	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1
ValidFrom	2011-02-11 12:00:00
ValidTo	2026-02-10 12:00:00
Signature	49eb7c60beaeefc97cb3c5ba4b64df1669e286fa29d9de98857d406626332f4455aaaa90e935700a34bed3ae542e8e6500d67a32203e6c26b898a939b1bc95c7aae9f5ee4666c6b3e812f8b3979dff74588234997550ac448fe892ce7d8b0f3196c7dcd31130987416c6e56b4576a39401cd33007a48f66f8631c9562b3322d5f801b644ce8cb4ca88d2e416e3e7f6e23ee109c09d7943437f555c05ad9310c62c0d6bc09eea78e5d277d6b8da9a987fba4c922b9dbda488b1ddafc34cd2979b03c6ae5f1b440f333715e3cbff2f56d316a45b55679da2cadb346c0c734ab57ba4b6b3e935027870ec007acbfc4b4f2236bb1484c98f91dd0f3c758cca0b88e7
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	02c4d1e58a4a680c568da3047e7e4d5f
Version	3

Certificate 06fdf9039603adea000aeb3f27bbba1b

Field	Value
ToBeSigned (TBS) MD5	4e5ad189638cf52ba9cd881d4d44668c
ToBeSigned (TBS) SHA1	cdc115e98d798b33904c820d63cc1e1afc19251d
ToBeSigned (TBS) SHA256	37560fb9d548ab62cc3ed4669a4ab74828b5a108e67e829937ffb2d10a5f78dd
Subject	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID CA,1
ValidFrom	2006-11-10 00:00:00
ValidTo	2021-11-10 00:00:00
Signature	46503ec9b72824a7381db65b29af52cf52e93147ab565c7bd50d0b41b3efec751f7438f2b25c61a29c95c350e482b923d1ba3a8672ad3878ac755d1717347247859456d1ebbb368477cc24a5f3041955a9e7e3e7ab62cdfb8b2d90c2c0d2b594bd5e4fb105d20e3d1aa9145ba6863162a8a833e49b39a7c4f5ce1d7876942573e42aabcf9c764bed5fc24b16e44b704c00891efcc579bc4c1257fe5fe11ebc025da8fefb07384f0dc65d91b90f6745cdd683ede7920d8db1698c4ffb59e0230fd2aaae007cee9c420ecf91d727b716ee0fc3bd7c0aa0ee2c08558522b8eb181a4dfc2a21ad49318347957771dcb11b4b4b1c109c7714c19d4f2f5a9508291026
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	06fdf9039603adea000aeb3f27bbba1b
Version	3

Imports

Expand

ntoskrnl.exe

Imported Functions

Expand

KeLeaveCriticalRegion
wcsncpy
KeEnterCriticalRegion
ExAcquireFastMutexUnsafe
wcsrchr
ExAcquireResourceSharedLite
ExReleaseResourceLite
_purecall
ZwOpenEvent
ZwConnectPort
KeClearEvent
PsProcessType
ExFreePoolWithTag
RtlInitUnicodeString
KeSetEvent
ProbeForWrite
KeUnstackDetachProcess
ZwRequestWaitReplyPort
ZwWaitForSingleObject
DbgBreakPoint
ZwSetEvent
IoGetCurrentProcess
ZwFreeVirtualMemory
ZwClose
ObfReferenceObject
ObfDereferenceObject
RtlUnicodeStringToInteger
ZwCreateSection
ObOpenObjectByPointer
KeStackAttachProcess
KePulseEvent
ZwAllocateVirtualMemory
ObGetObjectSecurity
SeAccessCheck
SeReleaseSubjectContext
SeCaptureSubjectContext
PsThreadType
ObReleaseObjectSecurity
PsGetProcessExitTime
MmSectionObjectType
DbgPrint
ExDeleteResourceLite
ExInitializeResourceLite
ZwReadFile
swprintf
ZwSetInformationFile
ZwCreateFile
ZwQueryInformationFile
ZwWriteFile
_wcsnicmp
towupper
ExAllocatePoolWithTag
KeInitializeEvent
ZwCreateEvent
ZwCreateKey
RtlAnsiStringToUnicodeString
ZwNotifyChangeKey
RtlInitAnsiString
_snprintf
RtlFreeUnicodeString
ExSystemTimeToLocalTime
_vsnprintf
ObReferenceObjectByHandle
RtlTimeToTimeFields
ZwDeviceIoControlFile
PsGetCurrentThreadId
PsGetCurrentProcessId
KeWaitForMultipleObjects
ExGetPreviousMode
RtlEqualUnicodeString
RtlPrefixUnicodeString
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
RtlUpcaseUnicodeChar
KeWaitForSingleObject
KeSetPriorityThread
PsCreateSystemThread
PsTerminateSystemThread
MmIsAddressValid
KeDelayExecutionThread
KeNumberProcessors
PsLookupProcessByProcessId
PsSetCreateProcessNotifyRoutine
ZwOpenDirectoryObject
ZwQueryInformationProcess
ZwQuerySecurityObject
NtSetInformationFile
ZwDeleteValueKey
ZwSetValueKey
ZwQuerySystemInformation
NtQueryInformationFile
IoFileObjectType
ZwQueryValueKey
ZwQueryDirectoryFile
NtCreateFile
ZwEnumerateValueKey
RtlLengthSecurityDescriptor
ZwQueryDirectoryObject
ZwSetSecurityObject
ZwDuplicateObject
ZwOpenProcess
ZwTerminateProcess
ExReleaseFastMutexUnsafe
ZwEnumerateKey
ZwQueryKey
ZwOpenKey
MmSystemRangeStart
_stricmp
_strnicmp
mbstowcs
ProbeForRead
RtlUpcaseUnicodeString
_snwprintf
ZwQuerySymbolicLinkObject
ZwMapViewOfSection
MmGetSystemRoutineAddress
RtlAppendUnicodeToString
IoCreateFile
RtlQueryRegistryValues
MmBuildMdlForNonPagedPool
ZwOpenSymbolicLinkObject
IoFreeMdl
ObQueryNameString
ZwUnmapViewOfSection
NtClose
IoFreeIrp
PsGetVersion
IoAllocateIrp
RtlCompareMemory
MmUnlockPages
ZwSetInformationObject
ZwOpenFile
wcsncmp
RtlImageNtHeader
IoAllocateMdl
IofCallDriver
ZwQueryVolumeInformationFile
ObReferenceObjectByPointer
IoBuildDeviceIoControlRequest
ZwOpenSection
RtlSubAuthoritySid
RtlLengthRequiredSid
ExReleaseFastMutex
ExAcquireFastMutex
RtlCreateAcl
RtlSetDaclSecurityDescriptor
RtlAddAccessAllowedAce
KeInitializeSemaphore
KeReleaseSemaphore
RtlInitializeSid
RtlCreateSecurityDescriptor
IoDeleteSymbolicLink
IoDeleteDevice
IoGetDeviceObjectPointer
ExEventObjectType
IofCompleteRequest
IoCreateSymbolicLink
ObOpenObjectByName
NtQueryInformationProcess
strncpy
NtOpenProcess
ObInsertObject
IoAcquireVpbSpinLock
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
KeAcquireQueuedSpinLock
KeReleaseQueuedSpinLock
IoReleaseVpbSpinLock
wcschr
strncat
RtlUnicodeStringToAnsiString
wcsncat
RtlFreeAnsiString
wcstombs
IoGetConfigurationInformation
IoRegisterPlugPlayNotification
IoGetStackLimits
IoBuildSynchronousFsdRequest
KeReleaseSpinLock
ExpInterlockedPopEntrySList
FsRtlIsNameInExpression
wcsstr
ExAllocatePool
IoUnregisterPlugPlayNotification
MmProbeAndLockPages
RtlCompareUnicodeString
IoGetDeviceInterfaces
KeAcquireSpinLockRaiseToDpc
KeBugCheckEx
IoCreateDevice
IoDeviceObjectType
SeCaptureSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
IoIsWdmVersionAvailable
SeExports
RtlLengthSid
RtlGetSaclSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
ZwDeleteKey
ExAcquireResourceExclusiveLite
__C_specific_handler

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QEAA@AEBV0@@Z
??0CAutoUpdateConfigThread@@QEAA@PEAU_UNICODE_STRING@@P6AX0PEAX@Z1@Z
??0CBlobConfig@@QEAA@AEBV0@@Z
??0CBlobConfig@@QEAA@K@Z
??0CContext@@QEAA@AEBV0@@Z
??0CContext@@QEAA@KP6AJPEAU_EVENT_REPORT@@PEAXPEAU_TMCE_REPORT@@PEAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QEAA@AEBV0@@Z
??0CContextList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CDebugLog@@QEAA@AEBV0@@Z
??0CDebugLog@@QEAA@PEBG@Z
??0CDebugLogEx@@QEAA@AEBV0@@Z
??0CDebugLogEx@@QEAA@K@Z
??0CDelayLoadThread@@QEAA@AEBV0@@Z
??0CDelayLoadThread@@QEAA@XZ
??0CExclusionExtConfig@@QEAA@AEBV0@@Z
??0CExclusionExtConfig@@QEAA@KKE@Z
??0CExclusionFileNameConfig@@QEAA@AEBV0@@Z
??0CExclusionFileNameConfig@@QEAA@KK@Z
??0CExclusionFilePathConfig@@QEAA@AEBV0@@Z
??0CExclusionFilePathConfig@@QEAA@KK@Z
??0CExclusionFolderConfig@@QEAA@AEBV0@@Z
??0CExclusionFolderConfig@@QEAA@KK@Z
??0CExclusionRegistryConfig@@QEAA@AEBV0@@Z
??0CExclusionRegistryConfig@@QEAA@KK@Z
??0CFile@@QEAA@AEBV0@@Z
??0CFile@@QEAA@E@Z
??0CFileExtension@@QEAA@AEBV0@@Z
??0CFileExtension@@QEAA@KEEPEAVIMemoryAllocator@@@Z
??0CInclusionExtConfig@@QEAA@AEBV0@@Z
??0CInclusionExtConfig@@QEAA@KKE@Z
??0CInclusionFileNameConfig@@QEAA@AEBV0@@Z
??0CInclusionFileNameConfig@@QEAA@KK@Z
??0CInclusionFilePathConfig@@QEAA@AEBV0@@Z
??0CInclusionFilePathConfig@@QEAA@KK@Z
??0CInclusionFolderConfig@@QEAA@AEBV0@@Z
??0CInclusionFolderConfig@@QEAA@KK@Z
??0CKEvent@@QEAA@AEBV0@@Z
??0CKEvent@@QEAA@W4_EVENT_TYPE@@E@Z
??0CList@@QEAA@AEBV0@@Z
??0CList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CLockEvent@@QEAA@AEBV0@@Z
??0CLockEvent@@QEAA@XZ
??0CLockList@@QEAA@AEBV0@@Z
??0CLockList@@QEAA@KKPEAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IEAA@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QEAA@AEBV0@@Z
??0CMemoryPoolAllocator@@IEAA@W4_POOL_TYPE@@_K1K@Z
??0CMemoryPoolAllocator@@QEAA@AEBV0@@Z
??0CModuleConfig@@QEAA@AEBV0@@Z
??0CModuleConfig@@QEAA@XZ
??0CModuleConfigList@@QEAA@AEBV0@@Z
??0CModuleConfigList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QEAA@AEBV0@@Z
??0CModuleFileExtConfig@@QEAA@KKE@Z
??0CModuleFlagConfig@@QEAA@AEBV0@@Z
??0CModuleFlagConfig@@QEAA@K@Z
??0CModuleMultiStringConfig@@QEAA@AEBV0@@Z
??0CModuleMultiStringConfig@@QEAA@KK@Z
??0CModuleStringConfig@@QEAA@AEBV0@@Z
??0CModuleStringConfig@@QEAA@K@Z
??0CNoLockList@@QEAA@AEBV0@@Z
??0CNoLockList@@QEAA@KKPEAVIMemoryAllocator@@@Z
??0CSmartLock@@QEAA@AEAVCLockEvent@@@Z
??0CSmartLock@@QEAA@XZ
??0CSmartReference@@QEAA@AEAJ@Z
??0CSmartReference@@QEAA@AEAK@Z
??0CSmartResource@@QEAA@AEAVCResource@@E@Z
??0CStrList@@QEAA@AEBV0@@Z
??0CStrList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CSystemThread@@QEAA@AEBV0@@Z
??0CSystemThread@@QEAA@K@Z
??0CUserFuncAdapterJob@@QEAA@AEBV0@@Z
??0CUserFuncAdapterJob@@QEAA@P6AXPEAX@Z01@Z
??0CWorkerThread@@IEAA@PEAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QEAA@AEBV0@@Z
??0CWorkerThreadJob@@QEAA@AEBV0@@Z
??0CWorkerThreadJob@@QEAA@E@Z
??0CWorkerThreadJobQueue@@QEAA@AEBV0@@Z
??0CWorkerThreadJobQueue@@QEAA@K@Z
??0CWorkerThreadPool@@QEAA@AEBV0@@Z
??0CWorkerThreadPool@@QEAA@K@Z
??0CWorkerThreadPoolEx@@QEAA@AEBV0@@Z
??0CWorkerThreadPoolEx@@QEAA@KK@Z
??0IMemoryAllocator@@QEAA@AEBV0@@Z
??0IMemoryAllocator@@QEAA@XZ
??1CAutoUpdateConfigThread@@UEAA@XZ
??1CBlobConfig@@UEAA@XZ
??1CContext@@UEAA@XZ
??1CContextList@@UEAA@XZ
??1CDebugLog@@UEAA@XZ
??1CDebugLogEx@@UEAA@XZ
??1CDelayLoadThread@@UEAA@XZ
??1CExclusionExtConfig@@UEAA@XZ
??1CExclusionFileNameConfig@@UEAA@XZ
??1CExclusionFilePathConfig@@UEAA@XZ
??1CExclusionFolderConfig@@UEAA@XZ
??1CExclusionRegistryConfig@@UEAA@XZ
??1CFile@@UEAA@XZ
??1CFileExtension@@UEAA@XZ
??1CInclusionExtConfig@@UEAA@XZ
??1CInclusionFileNameConfig@@UEAA@XZ
??1CInclusionFilePathConfig@@UEAA@XZ
??1CInclusionFolderConfig@@UEAA@XZ
??1CKEvent@@UEAA@XZ
??1CList@@UEAA@XZ
??1CLockEvent@@UEAA@XZ
??1CLockList@@UEAA@XZ
??1CMemoryAllocator@@UEAA@XZ
??1CMemoryPoolAllocator@@UEAA@XZ
??1CModuleConfig@@UEAA@XZ
??1CModuleConfigList@@UEAA@XZ
??1CModuleFileExtConfig@@UEAA@XZ
??1CModuleFlagConfig@@UEAA@XZ
??1CModuleMultiStringConfig@@UEAA@XZ
??1CModuleStringConfig@@UEAA@XZ
??1CNoLockList@@UEAA@XZ
??1CSmartLock@@QEAA@XZ
??1CSmartReference@@QEAA@XZ
??1CSmartResource@@QEAA@XZ
??1CStrList@@UEAA@XZ
??1CSystemThread@@UEAA@XZ
??1CUserFuncAdapterJob@@UEAA@XZ
??1CWorkerThread@@UEAA@XZ
??1CWorkerThreadJob@@UEAA@XZ
??1CWorkerThreadJobQueue@@UEAA@XZ
??1CWorkerThreadPool@@UEAA@XZ
??1CWorkerThreadPoolEx@@UEAA@XZ
??1IMemoryAllocator@@UEAA@XZ
??2@YAPEAX_KPEAVIMemoryAllocator@@PEBDK@Z
??2CMemoryAllocator@@SAPEAX_K@Z
??2CMemoryPoolAllocator@@SAPEAX_K@Z
??3@YAXPEAX@Z
??3IMemoryAllocator@@SAXPEAX@Z
??4CAutoUpdateConfigThread@@QEAAAEAV0@AEBV0@@Z
??4CBlobConfig@@QEAAAEAV0@AEBV0@@Z
??4CContext@@QEAAAEAV0@AEBV0@@Z
??4CDebugLog@@QEAAAEAV0@AEBV0@@Z
??4CDebugLogEx@@QEAAAEAV0@AEBV0@@Z
??4CDelayLoadThread@@QEAAAEAV0@AEBV0@@Z
??4CFile@@QEAAAEAV0@AEBV0@@Z
??4CKEvent@@QEAAAEAV0@AEBV0@@Z
??4CLockEvent@@QEAAAEAV0@AEBV0@@Z
??4CMemoryAllocator@@QEAAAEAV0@AEBV0@@Z
??4CMemoryPoolAllocator@@QEAAAEAV0@AEBV0@@Z
??4CModuleConfig@@QEAAAEAV0@AEBV0@@Z
??4CModuleFlagConfig@@QEAAAEAV0@AEBV0@@Z
??4CModuleStringConfig@@QEAAAEAV0@AEBV0@@Z
??4CSmartLock@@QEAAAEAV0@AEBV0@@Z
??4CSmartLock@@QEAAAEBV0@AEAVCLockEvent@@@Z
??4CSmartResource@@QEAAAEAV0@AEBV0@@Z
??4CSystemThread@@QEAAAEAV0@AEBV0@@Z
??4CUserFuncAdapterJob@@QEAAAEAV0@AEBV0@@Z
??4CWorkerThread@@QEAAAEAV0@AEBV0@@Z
??4CWorkerThreadJob@@QEAAAEAV0@AEBV0@@Z
??4IMemoryAllocator@@QEAAAEAV0@AEBV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CDebugLogEx@@6B@
??_7CDelayLoadThread@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CInclusionExtConfig@@6B@
??_7CInclusionFileNameConfig@@6B@
??_7CInclusionFilePathConfig@@6B@
??_7CInclusionFolderConfig@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CNoLockList@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7CWorkerThreadPoolEx@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QEAAXXZ
??_FCFile@@QEAAXXZ
??_FCFileExtension@@QEAAXXZ
??_FCModuleConfigList@@QEAAXXZ
??_FCStrList@@QEAAXXZ
??_FCSystemThread@@QEAAXXZ
??_FCWorkerThread@@QEAAXXZ
??_FCWorkerThreadJob@@QEAAXXZ
??_FCWorkerThreadJobQueue@@QEAAXXZ
??_U@YAPEAX_KPEAVIMemoryAllocator@@PEBDK@Z
??_V@YAXPEAX@Z
?Acquire@CLockEvent@@QEAAXXZ
?Add@CContextList@@QEAAEPEAVCContext@@@Z
?Add@CFileExtension@@QEAAEPEBGK@Z
?Add@CModuleConfigList@@QEAAEPEAVCModuleConfig@@@Z
?Add@CStrList@@QEAAEPEBG@Z
?AddNode@CLockList@@UEAAEQEAXE@Z
?AddNode@CNoLockList@@UEAAEQEAXE@Z
?Alloc@CMemoryAllocator@@UEAAPEAX_KPEBDK@Z
?Alloc@CMemoryPoolAllocator@@UEAAPEAX_KPEBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IEAAPEAX_K@Z
?AttachJobQueue@CWorkerThread@@QEAAXPEAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QEAAXXZ
?CheckNode@CLockList@@UEAAHQEAX@Z
?CheckNode@CNoLockList@@UEAAHQEAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QEAAXXZ
?Cleanup@CBlobConfig@@AEAAXXZ
?Cleanup@CModuleFileExtConfig@@IEAAXXZ
?Cleanup@CModuleMultiStringConfig@@IEAAXXZ
?Cleanup@CModuleStringConfig@@AEAAXXZ
?Close@CFile@@QEAAJXZ
?Count@CLockList@@QEAAKXZ
?Count@CNoLockList@@QEAAKXZ
?Create@CFile@@QEAAJPEBGKKKK@Z
?Create@CSystemThread@@QEAAEXZ
?CreateInstance@CMemoryAllocator@@SAPEAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SAPEAV1@W4_POOL_TYPE@@_K1K@Z
?CreatePool@CWorkerThreadPool@@QEAAEXZ
?CreatePool@CWorkerThreadPoolEx@@QEAAEXZ
?CreateThreads@CWorkerThreadPool@@QEAAEK@Z
?CreateThreads@CWorkerThreadPoolEx@@QEAAEK@Z
?CreateWIRP@CFile@@QEAAJPEBGKKKK@Z
?Delete@CFile@@QEAAJXZ
?Delete@CFileExtension@@QEAAEPEBGK@Z
?Delete@CStrList@@QEAAEPEBG@Z
?DeleteAll@CList@@UEAAXXZ
?DeleteAll@CLockList@@UEAAXXZ
?DeleteAll@CNoLockList@@UEAAXXZ
?DeleteNode@CContextList@@MEAAXPEAX@Z
?DeleteNode@CList@@UEAAXPEAX@Z
?DeleteNode@CModuleConfigList@@MEAAXPEAX@Z
?DeleteNode@CStrList@@EEAAXPEAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YAXPEAPEAX@Z
?DoIt@CWorkerThreadJob@@QEAAJXZ
?EntryPoint@CSystemThread@@KAXPEAX@Z
?Find@CContextList@@QEAAPEAVCContext@@K@Z
?Find@CContextList@@QEAAPEAVCContext@@PEAX@Z
?Find@CFileExtension@@QEAAPEAU_STR_LIST_NODE@CStrList@@PEBGK@Z
?Find@CModuleConfigList@@QEAAPEAVCModuleConfig@@K@Z
?Find@CStrList@@QEAAPEAU_STR_LIST_NODE@1@PEBG@Z
?FindNode@CContextList@@IEAAPEAXPEAX@Z
?FindPartiallyAndAllMatch@CStrList@@QEAAPEAU_STR_LIST_NODE@1@PEBG@Z
?FinishFunction@CUserFuncAdapterJob@@MEAAXXZ
?FinishIt@CWorkerThreadJob@@QEAAJXZ
?First@CList@@UEAAPEAXXZ
?First@CLockList@@UEAAPEAXXZ
?First@CNoLockList@@UEAAPEAXXZ
?Free@CMemoryAllocator@@UEAAXPEAX@Z
?Free@CMemoryPoolAllocator@@UEAAXPEAX@Z
?GetAttributes@CFile@@QEAAKXZ
?GetBasicInfomration@CFile@@IEAAJXZ
?GetBlobCofig@CContext@@UEAAJKPEAXPEAK@Z
?GetCategory@CContext@@QEAAKXZ
?GetData@CBlobConfig@@QEAAHPEAXPEAK@Z
?GetData@CModuleFileExtConfig@@QEAAHPEAGPEAK@Z
?GetData@CModuleFileExtConfig@@QEAAPEAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QEAAKXZ
?GetData@CModuleMultiStringConfig@@QEAAHPEAGPEAK@Z
?GetData@CModuleMultiStringConfig@@QEAAPEAVCStrList@@XZ
?GetData@CModuleStringConfig@@QEAAPEAGXZ
?GetData@CStrList@@QEAAEPEAGPEAK@Z
?GetDataType@CModuleConfig@@QEAAKXZ
?GetEngineContext@CContext@@QEAAPEAXXZ
?GetFileExtensionConfig@CContext@@QEAAPEAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UEAAJKPEAGPEAK@Z
?GetFileSize@CFile@@QEAAJPEAT_LARGE_INTEGER@@@Z
?GetFileSizeWIRP@CFile@@QEAAJPEAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UEAAJKPEAK@Z
?GetID@CModuleConfig@@QEAAKXZ
?GetJob@CWorkerThreadJobQueue@@QEAAPEAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QEAAKXZ
?GetLinkContext@CContext@@QEAAPEAXXZ
?GetLogFlag@CDebugLog@@QEAAKXZ
?GetLogFlag@CDebugLogEx@@QEAAKXZ
?GetModuleId@CModuleConfig@@QEAAKXZ
?GetMultiStringConfig@CContext@@QEAAPEAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UEAAJKPEAGPEAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QEAAPEAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPool@@QEAAPEAU_KTHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QEAAPEAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QEAAPEAU_KTHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QEAA_KXZ
?GetSize@CBlobConfig@@QEAAKXZ
?GetStringConfig@CContext@@QEAAPEAGK@Z
?GetStringConfig@CContext@@UEAAJKPEAGPEAK@Z
?GetThreadCount@CWorkerThreadPool@@QEAAKXZ
?GetThreadCount@CWorkerThreadPoolEx@@QEAAKXZ
?GetThreadID@CSystemThread@@QEAA_KXZ
?GetType@CContext@@QEAAKXZ
?GetUserParameter@CContext@@QEAA_KXZ
?InitProcMon@CDebugLogEx@@IEAAXXZ
?InitializeBlobConfig@CContext@@QEAAHKPEAXK@Z
?InitializeFileExtensionConfig@CContext@@QEAAHKPEBG@Z
?InitializeFlagConfig@CContext@@QEAAHKK@Z
?InitializeMultiStringConfig@CContext@@QEAAHKPEBG@Z
?InitializeStringConfig@CContext@@QEAAHKPEBG@Z
?Insert@CList@@UEAAXQEAXE@Z
?Insert@CLockList@@UEAAXQEAXE@Z
?Insert@CNoLockList@@UEAAXQEAXE@Z
?InsertAfter@CList@@UEAAXPEAX0@Z
?InsertBefore@CList@@UEAAXPEAX0@Z
?Instance@CWorkerThreadPool@@SAPEAV1@XZ
?IsEmpty@CList@@UEAAEXZ
?IsEmpty@CLockList@@UEAAEXZ
?IsEmpty@CNoLockList@@UEAAEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IEAAEK@Z
?IsFull@CLockList@@QEBAEXZ
?IsFull@CNoLockList@@QEBAEXZ
?IsInExclusionList@CExclusionExtConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionExtConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionFileNameConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionFilePathConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionFolderConfig@@QEAAEPEBG@Z
?IsOpened@CFile@@QEAAEXZ
?IsTerminated@CWorkerThreadPool@@QEAAEXZ
?IsTerminated@CWorkerThreadPoolEx@@QEAAEXZ
?IsValid@CMemoryAllocator@@UEAAEXZ
?IsValid@CMemoryPoolAllocator@@UEAAEXZ
?IsValid@IMemoryAllocator@@UEAAEXZ
?IsWorkerThread@CWorkerThreadPool@@QEAAE_K@Z
?IsWorkerThread@CWorkerThreadPoolEx@@QEAAE_K@Z
?JobFunction@CUserFuncAdapterJob@@MEAAXXZ
?JobQueue@CWorkerThreadPool@@QEAAAEAVCWorkerThreadJobQueue@@XZ
?JobQueue@CWorkerThreadPoolEx@@QEAAAEAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QEAAKXZ
?Limit@CNoLockList@@QEAAKXZ
?MatchAllExtensions@CFileExtension@@QEAAEXZ
?MatchNoExtensions@CFileExtension@@QEAAEXZ
?MergeLeft@CMemoryPoolAllocator@@IEAAPEAXPEAX@Z
?MergeRight@CMemoryPoolAllocator@@IEAAPEAXPEAX@Z
?NeedDelete@CWorkerThreadJob@@QEAAEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QEAAXE@Z
?NewNode@CList@@UEAAPEAXXZ
?NewNode@CStrList@@EEAAPEAXXZ
?NewNodeVariant@CList@@IEAAPEAXK@Z
?Next@CList@@UEBAPEAXQEAX@Z
?Next@CLockList@@UEBAPEAXQEAX@Z
?Next@CNoLockList@@UEBAPEAXQEAX@Z
?NextPool@CMemoryPoolAllocator@@QEAAPEAV1@XZ
?NotityTerminate@CWorkerThread@@QEAAXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QEAAJP6AXPEAX@Z0E@Z
?PostJobToWorkerThread@CWorkerThreadPoolEx@@QEAAJP6AXPEAX@Z0E1@Z
?Pulse@CKEvent@@QEAAJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QEAAEPEAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QEAAJPEAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPoolEx@@QEAAJPEAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SAPEAV1@XZ
?Read@CFile@@QEAAJPEADKPEAK@Z
?ReadWIRP@CFile@@QEAAJPEADKPEAK@Z
?ReferenceCount@CContext@@QEAAAEAKXZ
?Release@CLockEvent@@QEAAXXZ
?Remove@CContextList@@UEAAEQEAX@Z
?Remove@CList@@UEAAEQEAX@Z
?Remove@CLockList@@UEAAEQEAX@Z
?Remove@CNoLockList@@UEAAEQEAX@Z
?RemoveHead@CList@@UEAAPEAXXZ
?RemoveHead@CLockList@@UEAAPEAXXZ
?RemoveHead@CNoLockList@@UEAAPEAXXZ
?RemoveTail@CList@@UEAAPEAXXZ
?RemoveTail@CLockList@@UEAAPEAXXZ
?RemoveTail@CNoLockList@@UEAAPEAXXZ
?Reset@CKEvent@@QEAAXXZ
?ResetData@CInclusionExtConfig@@QEAAXXZ
?ResetData@CInclusionFileNameConfig@@QEAAXXZ
?ResetData@CInclusionFilePathConfig@@QEAAXXZ
?ResetData@CInclusionFolderConfig@@QEAAXXZ
?RestoreCR0@@YAXPEAX@Z
?Run@CAutoUpdateConfigThread@@UEAAXXZ
?Run@CDelayLoadThread@@UEAAXXZ
?Run@CWorkerThread@@UEAAXXZ
?SeekToEnd@CFile@@QEAAJXZ
?Set@CKEvent@@QEAAJJE@Z
?SetAttributes@CFile@@QEAAJK@Z
?SetBlobCofig@CContext@@UEAAJKPEAXK@Z
?SetData@CBlobConfig@@QEAAHPEAXK@Z
?SetData@CModuleFileExtConfig@@QEAAHPEBG@Z
?SetData@CModuleFlagConfig@@QEAAHK@Z
?SetData@CModuleMultiStringConfig@@QEAAHPEBGK@Z
?SetData@CModuleStringConfig@@QEAAHPEBG@Z
?SetEngineContext@CContext@@QEAAXPEAX@Z
?SetFileExtensionConfig@CContext@@UEAAJKPEBG@Z
?SetFlagConfig@CContext@@UEAAJKK@Z
?SetLinkContext@CContext@@QEAAXPEAX@Z
?SetLogFlag@CDebugLog@@QEAAEK@Z
?SetLogFlag@CDebugLogEx@@QEAAEK@Z
?SetMatchAllExtensions@CFileExtension@@QEAAXE@Z
?SetMatchNoExtensions@CFileExtension@@QEAAXE@Z
?SetMultiStringConfig@CContext@@UEAAJKPEBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QEAAXXZ
?SetPriority@CSystemThread@@QEAAXK@Z
?SetStopUse@CContext@@QEAAXXZ
?SetStringConfig@CContext@@UEAAJKPEBG@Z
?Setup@CSystemThread@@MEAAXXZ
?StopUse@CContext@@QEAAHXZ
?TearDown@CSystemThread@@MEAAXXZ
?Terminate@CSystemThread@@QEAAXE@Z
?Terminate@CWorkerThreadPool@@QEAAEXZ
?Terminate@CWorkerThreadPoolEx@@QEAAEXZ
?TmExceptionFilter@@YAJPEAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QEAAJPEAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QEAAXXZ
?WaitForInit@CDelayLoadThread@@QEAAEXZ
?WaitForLoad@CDelayLoadThread@@QEAAEXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QEAAEXZ
?WaitQueueEmpty@CWorkerThreadJobQueue@@QEAAXXZ
?Write@CDebugLog@@QEAAXPEBDZZ
?Write@CDebugLogEx@@QEAAXPEBDZZ
?Write@CFile@@QEAAJPEADKPEAT_LARGE_INTEGER@@PEAK@Z
?WriteDataToFile@CDebugLogEx@@IEAAXPEADK@Z
?WriteDataToProcMonW@CDebugLogEx@@IEAAXPEAD@Z
?WriteSystemInformation@CDebugLog@@QEAAXXZ
?WriteSystemInformation@CDebugLogEx@@QEAAXXZ
?WriteSystemStringInformation@CDebugLog@@IEAAXPEBG@Z
?WriteSystemStringInformation@CDebugLogEx@@IEAAXPEBG@Z
?WriteToFile@CDebugLog@@IEAAXPEADK@Z
?WriteToProcMonW@CDebugLogEx@@IEAAXPEAU_UNICODE_STRING@@@Z
?_pNonPagedAllocator@@3PEAVCMemoryAllocator@@EA
?_pPagedAllocator@@3PEAVCMemoryAllocator@@EA
?m_lpInstance@CWorkerThreadPool@@1PEAV1@EA
?m_lpRCMInstance@CWorkerThreadPool@@1PEAV1@EA
DeInitKm2UmCommunication
DeInitKmLPC
DuplicateFullFileName
FreeFullFileName
GetKm2UmMode
GetModuleInfoByAddress
GetModuleInfoByModuleName
InitKm2UmCommunication
InitKmLPC
IsVerifierCodeCheckFlagOn
IsWindows8_1_update
KmCallUm
KmCallUmByLPC
KmCallUmEx
KmCleanupCommPortAPIs
KmGetUmInitProcess
KmSetCommPortAPIs
ModGetExportProcAddress
ModLoadDLLToBuffer
ModLoadDLLToBufferWithImageSize
ModLoadModule
ModUnLoadModule
NormalizeFileName
NormalizeFullNtPathToDosName
TmCommConfigRoutine
UtilAddDeviceInDriveTable
UtilAddReparsePointMapping
UtilCleanFileReadOnly
UtilCloseExclusiveHandle
UtilCreateDosFileName
UtilDeleteFileForce
UtilGetDeviceObjectName
UtilGetFileNameFromFileObject
UtilGetFileObjectForProcessByEPROC
UtilGetFileObjectFromFileName
UtilGetProcessName
UtilGetSystemDirectory
UtilGetSystemDirectoryEx
UtilGetSystemDirectoryLength
UtilGetSystemTime
UtilIoSetFileInfo
UtilIopCreateFileIRP
UtilKeGetLowFileDevice
UtilModuleIATHook
UtilModuleIATUnHook
UtilPostJobToWorkerThread
UtilQueryExclusiveHandle
UtilQueryKeyValue
UtilRemoveDeviceFromDriveTable
UtilVolumeDeviceToDosName
UtilWaitValueChangeToZero
UtilWriteVersionToRegistry
UtilbuildDynamicDiskMappingTable
UtlWriteBinValueKeyToRegistry
ValidateAddressWithSize
_ResetProtectFromClose
_UtilDosPathNameToNtPathName

Sections

Expand

.text
.rdata
.data
.pdata
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2015-12-03 06:29:37
MD5	e3aaa0c1c3a5e99eb9970ebe4b5a3183
SHA1	8fafd70bae94bbc22786c9328ee9126fed54dbae
SHA256	1c1251784e6f61525d0082882a969cb8a0c5d5359be22f5a73e3b0cd38b51687
Authentihash MD5	257904eecb49998ecad8b3d2acee8344
Authentihash SHA1	7f7110dcca30c2110d31f5a875305d52dac0db49
Authentihash SHA256	3847a1ed764ba25361a1748761fd9a1cbb65e42db00094f8ad6def9ac5da4116
RichPEHeaderHash MD5	baada9343cbaf3c9fea4ef77c7273bfb
RichPEHeaderHash SHA1	4c6b0ced9400f041538de6302dd3259a0e3e067c
RichPEHeaderHash SHA256	4eb67ab524a9d7f44e010b8a29c08d68801262325b6d99adabb130d91438ebd3
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	Trend Micro Eyes
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 009feac811b0f16247a5fc20d80523ace6

Field	Value
ToBeSigned (TBS) MD5	b6aa9cf28bcfc9f07ec1069fb425ab61
ToBeSigned (TBS) SHA1	ca7a166fcd53878ba5a38d4cac37c63513cfc1fa
ToBeSigned (TBS) SHA256	711394fc49f8948a831f687d42ced6b18514f57786ecc6cdbc3c3eb72e568a40
Subject	C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO Time Stamping Signer
ValidFrom	2015-05-05 00:00:00
ValidTo	2015-12-31 23:59:59
Signature	0dbbad60111bb5f00dcce6483a7a3e0e33dc1cb9ead620fea34dd0cc764ee818d879dfd34f9a4264238a29728a3a6c66a63c3a17a8704565c673c3d0ce8954fbac690f58b019cb869f7eb97eeb5192bf9bddebd165f0257b887cdebda5c8b51451bcc081308a85387be679fe67559387fe4fe88d0eedf37292b5c289806dd159e31d0deab138ee039d0019a5ab219b79c3ccc23e687ebdc94d694db46451fbb22874e25389ce9dfaade2dbceab7b7e064474fd0aa3c9b7a730cd49d29264f122a6b828457479e9a7ce3b33f98350947d68c01d49c760787a3c6426d5befa0a6de41ee109538fa9c523acc79d614221f02c1671493b10af2c6f1ae631f114fd6c
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	009feac811b0f16247a5fc20d80523ace6
Version	3

Certificate 250ce8e030612e9f2b89f7054d7cf8fd

Field	Value
ToBeSigned (TBS) MD5	918d9eb6a6cd36c531eceb926170a7e1
ToBeSigned (TBS) SHA1	0ae95700d65e6f59715aa47048993ca7858e676a
ToBeSigned (TBS) SHA256	47c46e6eaa3780eace3d0d891346cd373359d246b21a957219dbab4c8f37c166
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
ValidFrom	2006-11-08 00:00:00
ValidTo	2021-11-07 23:59:59
Signature	1302ddf8e88600f25af8f8200c59886207cecef74ef9bb59a198e5e138dd4ebc6618d3adeb18f20dc96d3e4a9420c33cbabd6554c6af44b310ad2c6b3eabd707b6b88163c5f95e2ee52a67cecd330c2ad7895603231fb3bee83a0859b4ec4535f78a5bff66cf50afc66d578d1978b7b9a2d157ea1f9a4bafbac98e127ec6bdff
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	250ce8e030612e9f2b89f7054d7cf8fd
Version	3

Certificate 610c120600000000001b

Field	Value
ToBeSigned (TBS) MD5	53c41bc1164e09e0cd1617a5bf913efd
ToBeSigned (TBS) SHA1	93c03aac8951d494ecd5696b1c08658541b18727
ToBeSigned (TBS) SHA256	40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b
Subject	C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
ValidFrom	2006-05-23 17:01:29
ValidTo	2016-05-23 17:11:29
Signature	01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	610c120600000000001b
Version	3

Certificate 1519396ee230f02cad1fcfdb077a35f0

Field	Value
ToBeSigned (TBS) MD5	7e2a6f93403382b4ec42463426d0a4b5
ToBeSigned (TBS) SHA1	62acc697c0e2dc37f3d37ab79751637346e051e2
ToBeSigned (TBS) SHA256	3e9a51973a839e5bc6e81c886e085b777d08ce2b24f816b7552cf2c44e322d59
Subject	C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.
ValidFrom	2015-02-20 00:00:00
ValidTo	2016-05-21 23:59:59
Signature	e480eb7f78216a855e34dbcb712d3879d6b1744c823c8e78c3661e55182a5c1f3a03686169393ef8778c893a49604a79769f5ba7156426c5431ae729a8dc5f8e22b14d124e46eff3f4f660552a57250a15e15d07ad548a02cddf8a204b5010be387a05b1019f618cf15078d80a809a7272b1822a63862c7db194f12697a786001ef630ac9d8bf9f5475191f327b8ed4839dff1ef65e5eb8f91379a66366451f99cb633848c57d4392096e6080fa327b23fc3834ad4f6043904d6c5aeb35454a265b3fda38167cffa8394f092a74bad1ea386f63b7baeb95271a97fc3bff0a2bc96a834f280a254d7170e5cc2830f3bd0649178f8b04514ecd1103753b1762902
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	1519396ee230f02cad1fcfdb077a35f0
Version	3

Certificate 5200e5aa2556fc1a86ed96c9d44b33c7

Field	Value
ToBeSigned (TBS) MD5	b30c31a572b0409383ed3fbe17e56e81
ToBeSigned (TBS) SHA1	4843a82ed3b1f2bfbee9671960e1940c942f688d
ToBeSigned (TBS) SHA256	03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-02-08 00:00:00
ValidTo	2020-02-07 23:59:59
Signature	5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	5200e5aa2556fc1a86ed96c9d44b33c7
Version	3

Imports

Expand

ntoskrnl.exe
HAL.dll
CLASSPNP.SYS

Imported Functions

Expand

wcsrchr
KeSetEvent
KePulseEvent
KeClearEvent
KeInitializeSemaphore
KeWaitForSingleObject
KeReleaseSemaphore
KeStackAttachProcess
KeUnstackDetachProcess
RtlSubAuthoritySid
RtlInitializeSid
ExAllocatePoolWithTag
RtlLengthRequiredSid
ExFreePoolWithTag
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
ObfDereferenceObject
ZwSetEvent
ZwClose
ZwRequestWaitReplyPort
ProbeForWrite
ZwFreeVirtualMemory
ZwAllocateVirtualMemory
ObOpenObjectByPointer
PsProcessType
memmove
ZwConnectPort
RtlInitUnicodeString
RtlUnicodeStringToInteger
ZwCreateSection
ZwWaitForSingleObject
ZwOpenEvent
ObfReferenceObject
IoGetCurrentProcess
DbgBreakPoint
PsGetProcessExitTime
MmSectionObjectType
PsThreadType
MmGetSystemRoutineAddress
DbgPrint
memset
MmIsAddressValid
ExInitializeResourceLite
ExDeleteResourceLite
ZwWriteFile
ZwReadFile
ZwQueryInformationFile
ZwSetInformationFile
ZwCreateFile
swprintf
towupper
_wcsnicmp
KeInitializeEvent
_snprintf
PsGetCurrentProcessId
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
ZwCreateKey
ZwCreateEvent
KeWaitForMultipleObjects
ObReferenceObjectByHandle
ZwNotifyChangeKey
PsGetCurrentThreadId
_vsnprintf
KeSetPriorityThread
PsTerminateSystemThread
PsCreateSystemThread
KeNumberProcessors
ZwQueryInformationProcess
PsLookupProcessByProcessId
KeDelayExecutionThread
ZwOpenDirectoryObject
PsSetCreateProcessNotifyRoutine
ZwQuerySystemInformation
ZwQueryDirectoryFile
ZwQueryDirectoryObject
ZwDuplicateObject
ZwOpenKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryValueKey
ZwDeleteValueKey
ZwDeleteKey
ExGetPreviousMode
ZwTerminateProcess
ZwOpenProcess
ZwQueryKey
ZwSetValueKey
IoFileObjectType
memcpy
ZwQuerySecurityObject
ZwSetSecurityObject
RtlLengthSecurityDescriptor
MmHighestUserAddress
IoFreeIrp
_purecall
MmUnlockPages
IoBuildAsynchronousFsdRequest
_strnicmp
RtlQueryRegistryValues
RtlAppendUnicodeToString
mbstowcs
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
NtClose
ZwSetInformationObject
_stricmp
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwOpenFile
RtlEqualUnicodeString
IoCreateFile
IofCallDriver
IoAllocateIrp
MmBuildMdlForNonPagedPool
IoAllocateMdl
ProbeForRead
PsGetVersion
RtlCopyUnicodeString
RtlFreeUnicodeString
RtlCompareMemory
RtlUpcaseUnicodeString
_snwprintf
RtlImageNtHeader
RtlAnsiStringToUnicodeString
RtlInitAnsiString
strrchr
ZwQueryVolumeInformationFile
ObReferenceObjectByPointer
ObQueryNameString
IoBuildDeviceIoControlRequest
IofCompleteRequest
ExEventObjectType
_allmul
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoGetDeviceObjectPointer
RtlUpperChar
RtlCompareUnicodeString
strncpy
KeServiceDescriptorTable
NtOpenProcess
ObOpenObjectByName
IoDriverObjectType
RtlAppendUnicodeStringToString
NtQueryInformationProcess
IoThreadToProcess
PsIsThreadTerminating
KeAddSystemServiceTable
ZwQueryObject
ObInsertObject
IoReleaseVpbSpinLock
IoAcquireVpbSpinLock
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
_allshr
ExInterlockedPopEntrySList
IoGetStackLimits
IoBuildSynchronousFsdRequest
MmSystemRangeStart
wcsstr
IoUnregisterPlugPlayNotification
FsRtlIsNameInExpression
IoGetConfigurationInformation
MmProbeAndLockPages
IoGetDeviceInterfaces
IoRegisterPlugPlayNotification
ExAllocatePool
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
strncat
wcschr
wcsncat
wcstombs
KeTickCount
KeBugCheckEx
RtlUnwind
wcsncpy
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
ExAcquireResourceSharedLite
ExReleaseFastMutexUnsafe
KeLeaveCriticalRegion
KeEnterCriticalRegion
_allrem
ExAcquireFastMutexUnsafe
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
RtlLengthSid
RtlAbsoluteToSelfRelativeSD
IoFreeMdl
KeGetCurrentThread
KfAcquireSpinLock
KfReleaseSpinLock
KeRaiseIrqlToDpcLevel
KfLowerIrql
KeGetCurrentIrql
ExAcquireFastMutex
ExReleaseFastMutex
KfRaiseIrql
ClassInitialize

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
??0CBlobConfig@@QAE@ABV0@@Z
??0CBlobConfig@@QAE@K@Z
??0CContext@@QAE@ABV0@@Z
??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QAE@ABV0@@Z
??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
??0CDebugLog@@QAE@ABV0@@Z
??0CDebugLog@@QAE@PBG@Z
??0CDelayLoadThread@@QAE@ABV0@@Z
??0CDelayLoadThread@@QAE@XZ
??0CExclusionExtConfig@@QAE@ABV0@@Z
??0CExclusionExtConfig@@QAE@KKE@Z
??0CExclusionFileNameConfig@@QAE@ABV0@@Z
??0CExclusionFileNameConfig@@QAE@KK@Z
??0CExclusionFilePathConfig@@QAE@ABV0@@Z
??0CExclusionFilePathConfig@@QAE@KK@Z
??0CExclusionFolderConfig@@QAE@ABV0@@Z
??0CExclusionFolderConfig@@QAE@KK@Z
??0CExclusionRegistryConfig@@QAE@ABV0@@Z
??0CExclusionRegistryConfig@@QAE@KK@Z
??0CFile@@QAE@ABV0@@Z
??0CFile@@QAE@E@Z
??0CFileExtension@@QAE@ABV0@@Z
??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
??0CInclusionExtConfig@@QAE@ABV0@@Z
??0CInclusionExtConfig@@QAE@KKE@Z
??0CInclusionFileNameConfig@@QAE@ABV0@@Z
??0CInclusionFileNameConfig@@QAE@KK@Z
??0CInclusionFilePathConfig@@QAE@ABV0@@Z
??0CInclusionFilePathConfig@@QAE@KK@Z
??0CInclusionFolderConfig@@QAE@ABV0@@Z
??0CInclusionFolderConfig@@QAE@KK@Z
??0CKEvent@@QAE@ABV0@@Z
??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
??0CList@@QAE@ABV0@@Z
??0CList@@QAE@KPAVIMemoryAllocator@@@Z
??0CLockEvent@@QAE@ABV0@@Z
??0CLockEvent@@QAE@XZ
??0CLockList@@QAE@ABV0@@Z
??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QAE@ABV0@@Z
??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
??0CMemoryPoolAllocator@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@XZ
??0CModuleConfigList@@QAE@ABV0@@Z
??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QAE@ABV0@@Z
??0CModuleFileExtConfig@@QAE@KKE@Z
??0CModuleFlagConfig@@QAE@ABV0@@Z
??0CModuleFlagConfig@@QAE@K@Z
??0CModuleMultiStringConfig@@QAE@ABV0@@Z
??0CModuleMultiStringConfig@@QAE@KK@Z
??0CModuleStringConfig@@QAE@ABV0@@Z
??0CModuleStringConfig@@QAE@K@Z
??0CNoLockList@@QAE@ABV0@@Z
??0CNoLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CSmartLock@@QAE@AAVCLockEvent@@@Z
??0CSmartLock@@QAE@XZ
??0CSmartReference@@QAE@AAJ@Z
??0CSmartReference@@QAE@AAK@Z
??0CSmartResource@@QAE@AAVCResource@@E@Z
??0CStrList@@QAE@ABV0@@Z
??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
??0CSystemThread@@QAE@ABV0@@Z
??0CSystemThread@@QAE@K@Z
??0CUserFuncAdapterJob@@QAE@ABV0@@Z
??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z0@Z
??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@E@Z
??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
??0CWorkerThreadJobQueue@@QAE@K@Z
??0CWorkerThreadPool@@QAE@ABV0@@Z
??0CWorkerThreadPool@@QAE@K@Z
??0IMemoryAllocator@@QAE@ABV0@@Z
??0IMemoryAllocator@@QAE@XZ
??1CAutoUpdateConfigThread@@UAE@XZ
??1CBlobConfig@@UAE@XZ
??1CContext@@UAE@XZ
??1CContextList@@UAE@XZ
??1CDebugLog@@UAE@XZ
??1CDelayLoadThread@@UAE@XZ
??1CExclusionExtConfig@@UAE@XZ
??1CExclusionFileNameConfig@@UAE@XZ
??1CExclusionFilePathConfig@@UAE@XZ
??1CExclusionFolderConfig@@UAE@XZ
??1CExclusionRegistryConfig@@UAE@XZ
??1CFile@@UAE@XZ
??1CFileExtension@@UAE@XZ
??1CInclusionExtConfig@@UAE@XZ
??1CInclusionFileNameConfig@@UAE@XZ
??1CInclusionFilePathConfig@@UAE@XZ
??1CInclusionFolderConfig@@UAE@XZ
??1CKEvent@@UAE@XZ
??1CList@@UAE@XZ
??1CLockEvent@@UAE@XZ
??1CLockList@@UAE@XZ
??1CMemoryAllocator@@UAE@XZ
??1CMemoryPoolAllocator@@UAE@XZ
??1CModuleConfig@@UAE@XZ
??1CModuleConfigList@@UAE@XZ
??1CModuleFileExtConfig@@UAE@XZ
??1CModuleFlagConfig@@UAE@XZ
??1CModuleMultiStringConfig@@UAE@XZ
??1CModuleStringConfig@@UAE@XZ
??1CNoLockList@@UAE@XZ
??1CSmartLock@@QAE@XZ
??1CSmartReference@@QAE@XZ
??1CSmartResource@@QAE@XZ
??1CStrList@@UAE@XZ
??1CSystemThread@@UAE@XZ
??1CUserFuncAdapterJob@@UAE@XZ
??1CWorkerThread@@UAE@XZ
??1CWorkerThreadJob@@UAE@XZ
??1CWorkerThreadJobQueue@@UAE@XZ
??1CWorkerThreadPool@@UAE@XZ
??1IMemoryAllocator@@UAE@XZ
??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??2CMemoryAllocator@@SGPAXI@Z
??2CMemoryPoolAllocator@@SGPAXI@Z
??3@YAXPAX@Z
??3IMemoryAllocator@@SGXPAX@Z
??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
??4CBlobConfig@@QAEAAV0@ABV0@@Z
??4CContext@@QAEAAV0@ABV0@@Z
??4CDebugLog@@QAEAAV0@ABV0@@Z
??4CDelayLoadThread@@QAEAAV0@ABV0@@Z
??4CFile@@QAEAAV0@ABV0@@Z
??4CKEvent@@QAEAAV0@ABV0@@Z
??4CLockEvent@@QAEAAV0@ABV0@@Z
??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
??4CModuleConfig@@QAEAAV0@ABV0@@Z
??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
??4CSmartResource@@QAEAAV0@ABV0@@Z
??4CSystemThread@@QAEAAV0@ABV0@@Z
??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
??4CWorkerThread@@QAEAAV0@ABV0@@Z
??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CDelayLoadThread@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CInclusionExtConfig@@6B@
??_7CInclusionFileNameConfig@@6B@
??_7CInclusionFilePathConfig@@6B@
??_7CInclusionFolderConfig@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CNoLockList@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QAEXXZ
??_FCFile@@QAEXXZ
??_FCFileExtension@@QAEXXZ
??_FCModuleConfigList@@QAEXXZ
??_FCStrList@@QAEXXZ
??_FCSystemThread@@QAEXXZ
??_FCWorkerThread@@QAEXXZ
??_FCWorkerThreadJob@@QAEXXZ
??_FCWorkerThreadJobQueue@@QAEXXZ
??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??_V@YAXPAX@Z
?Acquire@CLockEvent@@QAEXXZ
?Add@CContextList@@QAEEPAVCContext@@@Z
?Add@CFileExtension@@QAEEPBGK@Z
?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
?Add@CStrList@@QAEEPBG@Z
?AddNode@CLockList@@UAEEQAXE@Z
?AddNode@CNoLockList@@UAEEQAXE@Z
?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QAEXXZ
?CheckNode@CLockList@@UAEHQAX@Z
?CheckNode@CNoLockList@@UAEHQAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
?Cleanup@CBlobConfig@@AAEXXZ
?Cleanup@CModuleFileExtConfig@@IAEXXZ
?Cleanup@CModuleMultiStringConfig@@IAEXXZ
?Cleanup@CModuleStringConfig@@AAEXXZ
?Close@CFile@@QAEJXZ
?Count@CLockList@@QAEKXZ
?Count@CNoLockList@@QAEKXZ
?Create@CFile@@QAEJPBGKKKK@Z
?Create@CSystemThread@@QAEEXZ
?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
?CreatePool@CWorkerThreadPool@@QAEEXZ
?CreateThreads@CWorkerThreadPool@@QAEEK@Z
?CreateWIRP@CFile@@QAEJPBGKKKK@Z
?Delete@CFile@@QAEJXZ
?Delete@CFileExtension@@QAEEPBGK@Z
?Delete@CStrList@@QAEEPBG@Z
?DeleteAll@CList@@UAEXXZ
?DeleteAll@CLockList@@UAEXXZ
?DeleteAll@CNoLockList@@UAEXXZ
?DeleteNode@CContextList@@MAEXPAX@Z
?DeleteNode@CList@@UAEXPAX@Z
?DeleteNode@CModuleConfigList@@MAEXPAX@Z
?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YGXPAPAX@Z
?DoIt@CWorkerThreadJob@@QAEJXZ
?EntryPoint@CSystemThread@@KGXPAX@Z
?Find@CContextList@@QAEPAVCContext@@K@Z
?Find@CContextList@@QAEPAVCContext@@PAX@Z
?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FindNode@CContextList@@IAEPAXPAX@Z
?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?First@CList@@UAEPAXXZ
?First@CLockList@@UAEPAXXZ
?First@CNoLockList@@UAEPAXXZ
?Free@CMemoryAllocator@@UAEXPAX@Z
?Free@CMemoryPoolAllocator@@UAEXPAX@Z
?GetAttributes@CFile@@QAEKXZ
?GetBasicInfomration@CFile@@IAEJXZ
?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
?GetCategory@CContext@@QAEKXZ
?GetData@CBlobConfig@@QAEHPAXPAK@Z
?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QAEKXZ
?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
?GetData@CModuleStringConfig@@QAEPAGXZ
?GetData@CStrList@@QAEEPAGPAK@Z
?GetDataType@CModuleConfig@@QAEKXZ
?GetEngineContext@CContext@@QAEPAXXZ
?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFileSizeWIRP@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UAEJKPAK@Z
?GetID@CModuleConfig@@QAEKXZ
?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QAEKXZ
?GetLinkContext@CContext@@QAEPAXXZ
?GetLogFlag@CDebugLog@@QAEKXZ
?GetModuleId@CModuleConfig@@QAEKXZ
?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QAEKXZ
?GetSize@CBlobConfig@@QAEKXZ
?GetStringConfig@CContext@@QAEPAGK@Z
?GetStringConfig@CContext@@UAEJKPAGPAK@Z
?GetThreadCount@CWorkerThreadPool@@QAEKXZ
?GetThreadID@CSystemThread@@QAEKXZ
?GetType@CContext@@QAEKXZ
?GetUserParameter@CContext@@QAEKXZ
?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
?InitializeFlagConfig@CContext@@QAEHKK@Z
?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
?InitializeStringConfig@CContext@@QAEHKPBG@Z
?Insert@CList@@UAEXQAXE@Z
?Insert@CLockList@@UAEXQAXE@Z
?Insert@CNoLockList@@UAEXQAXE@Z
?InsertAfter@CList@@UAEXPAX0@Z
?InsertBefore@CList@@UAEXPAX0@Z
?Instance@CWorkerThreadPool@@SGPAV1@XZ
?IsEmpty@CList@@UAEEXZ
?IsEmpty@CLockList@@UAEEXZ
?IsEmpty@CNoLockList@@UAEEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
?IsFull@CLockList@@QBEEXZ
?IsFull@CNoLockList@@QBEEXZ
?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionExtConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFileNameConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFilePathConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFolderConfig@@QAEEPBG@Z
?IsOpened@CFile@@QAEEXZ
?IsTerminated@CWorkerThreadPool@@QAEEXZ
?IsValid@CMemoryAllocator@@UAEEXZ
?IsValid@CMemoryPoolAllocator@@UAEEXZ
?IsValid@IMemoryAllocator@@UAEEXZ
?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
?JobFunction@CUserFuncAdapterJob@@MAEXXZ
?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QAEKXZ
?Limit@CNoLockList@@QAEKXZ
?MatchAllExtensions@CFileExtension@@QAEEXZ
?MatchNoExtensions@CFileExtension@@QAEEXZ
?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
?NeedDelete@CWorkerThreadJob@@QAEEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
?NewNode@CList@@UAEPAXXZ
?NewNode@CStrList@@EAEPAXXZ
?NewNodeVariant@CList@@IAEPAXK@Z
?Next@CList@@UBEPAXQAX@Z
?Next@CLockList@@UBEPAXQAX@Z
?Next@CNoLockList@@UBEPAXQAX@Z
?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
?NotityTerminate@CWorkerThread@@QAEXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
?Pulse@CKEvent@@QAEJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
?Read@CFile@@QAEJPADKPAK@Z
?ReadWIRP@CFile@@QAEJPADKPAK@Z
?ReferenceCount@CContext@@QAEAAKXZ
?Release@CLockEvent@@QAEXXZ
?Remove@CContextList@@UAEEQAX@Z
?Remove@CList@@UAEEQAX@Z
?Remove@CLockList@@UAEEQAX@Z
?Remove@CNoLockList@@UAEEQAX@Z
?RemoveHead@CList@@UAEPAXXZ
?RemoveHead@CLockList@@UAEPAXXZ
?RemoveHead@CNoLockList@@UAEPAXXZ
?RemoveTail@CList@@UAEPAXXZ
?RemoveTail@CLockList@@UAEPAXXZ
?RemoveTail@CNoLockList@@UAEPAXXZ
?Reset@CKEvent@@QAEXXZ
?ResetData@CInclusionExtConfig@@QAEXXZ
?ResetData@CInclusionFileNameConfig@@QAEXXZ
?ResetData@CInclusionFilePathConfig@@QAEXXZ
?ResetData@CInclusionFolderConfig@@QAEXXZ
?RestoreCR0@@YGXPAX@Z
?Run@CAutoUpdateConfigThread@@UAEXXZ
?Run@CDelayLoadThread@@UAEXXZ
?Run@CWorkerThread@@UAEXXZ
?SeekToEnd@CFile@@QAEJXZ
?Set@CKEvent@@QAEJJE@Z
?SetAttributes@CFile@@QAEJK@Z
?SetBlobCofig@CContext@@UAEJKPAXK@Z
?SetData@CBlobConfig@@QAEHPAXK@Z
?SetData@CModuleFileExtConfig@@QAEHPBG@Z
?SetData@CModuleFlagConfig@@QAEHK@Z
?SetData@CModuleMultiStringConfig@@QAEHPBGK@Z
?SetData@CModuleStringConfig@@QAEHPBG@Z
?SetEngineContext@CContext@@QAEXPAX@Z
?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
?SetFlagConfig@CContext@@UAEJKK@Z
?SetLinkContext@CContext@@QAEXPAX@Z
?SetLogFlag@CDebugLog@@QAEEK@Z
?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
?SetMultiStringConfig@CContext@@UAEJKPBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
?SetPriority@CSystemThread@@QAEXK@Z
?SetStopUse@CContext@@QAEXXZ
?SetStringConfig@CContext@@UAEJKPBG@Z
?Setup@CSystemThread@@MAEXXZ
?StopUse@CContext@@QAEHXZ
?TearDown@CSystemThread@@MAEXXZ
?Terminate@CSystemThread@@QAEXE@Z
?Terminate@CWorkerThreadPool@@QAEEXZ
?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QAEXXZ
?WaitForInit@CDelayLoadThread@@QAEEXZ
?WaitForLoad@CDelayLoadThread@@QAEEXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
?Write@CDebugLog@@QAAXPBDZZ
?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
?WriteSystemInformation@CDebugLog@@QAEXXZ
?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
?WriteToFile@CDebugLog@@IAEXPADK@Z
?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
?_pPagedAllocator@@3PAVCMemoryAllocator@@A
?m_lpInstance@CWorkerThreadPool@@1PAV1@A
?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
_DeInitKmLPC@0
_GetModuleInfoByAddress@8
_GetModuleInfoByModuleName@8
_InitKmLPC@0
_IsVerifierCodeCheckFlagOn@0
_IsWindows8_1_update@4
_KmCallUm@8
_KmCallUmEx@12
_ModGetExportProcAddress@8
_ModLoadDLLToBuffer@4
_ModLoadDLLToBufferWithImageSize@8
_ModLoadModule@8
_ModUnLoadModule@4
_NormalizeFileName@4
_NormalizeFullNtPathToDosName@4
_TmCommConfigRoutine@4
_UtilAddDeviceInDriveTable@4
_UtilCleanFileReadOnly@4
_UtilDeleteFileForce@4
_UtilGetFileObjectForProcessByEPROC@8
_UtilGetFileObjectFromFileName@12
_UtilGetProcessName@12
_UtilGetSystemDirectory@4
_UtilGetSystemDirectoryEx@0
_UtilGetSystemDirectoryLength@0
_UtilGetSystemTime@4
_UtilIoSetFileInfo@24
_UtilIopCreateFileIRP@40
_UtilKeGetLowFileDevice@16
_UtilModuleIATHook@24
_UtilModuleIATUnHook@8
_UtilQueryKeyValue@24
_UtilRemoveDeviceFromDriveTable@4
_UtilVolumeDeviceToDosName@8
_UtilWaitValueChangeToZero@8
_UtilWriteVersionToRegistry@8
_UtilbuildDynamicDiskMappingTable@0
_UtlWriteBinValueKeyToRegistry@16
__UtilDosPathNameToNtPathName@12

Sections

Expand

.text
.rdata
.data
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2016-08-04 03:27:03
MD5	5a615f4641287e5e88968f5455627d45
SHA1	dcfeca5e883a084e89ecd734c4528b922a1099b9
SHA256	2afdb3278a7b57466a103024aef9ff7f41c73a19bab843a8ebf3d3c4d4e82b30
Authentihash MD5	f9170d67a08b1a8f4e283615b4400773
Authentihash SHA1	e1e0a986b99795fa8c40328c5a01b5b8cbb9ca34
Authentihash SHA256	dd54115ef08b107691425e4c0bf94dc0ae7c522fba60a0ce3f574ebf4f5dbc5a
RichPEHeaderHash MD5	5b33b237bab6e0b50320054616983177
RichPEHeaderHash SHA1	754c63349a54279bb01f24974f9faf6da8294d27
RichPEHeaderHash SHA256	001d9e469d2c4160f8fbff1c0aee013e72881cffb568910a2c1473a17bf858b2
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	Trend Micro Eyes
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 1688f039255e638e69143907e6330b

Field	Value
ToBeSigned (TBS) MD5	0179e8ddeebaf8998fec419d65cdf13d
ToBeSigned (TBS) SHA1	34c724c3369f2da8c25b591808962f66f10bde28
ToBeSigned (TBS) SHA256	35b0bac11602847aaab65fb35199d3c8976cde3ccf7e061b130177c712cbd92f
Subject	C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO SHA,1 Time Stamping Signer
ValidFrom	2015-12-31 00:00:00
ValidTo	2019-07-09 18:40:36
Signature	ba332440408c7cdb589fb36098b2f5c031feeb1f6e50f60ae0e4e681ad2687a2dffdb3daf473f300fb291b891b153edb6b52932bc4ac3981d73c67579a3936e028089ae3394f9b89097f7bc5617f598932250a6aae1a3ef0a227a8b6c3b887f7160448413d5cd8ec9f4d203104d965a1edcd690753163ddd36020a88eb40e506300bb8164bdcefbc5509ffc63e122e76b3dcce42eff97657e1b70a054098589a5d711693718c6581ea6ff389f7fb73adb4e7bfd98e6faa0b4f25f3b8e1d5dd75986881f8aac0d180c2c4c43989c1f6c99e6cd774f9d997f84fc29a0acd5e8ff819e9e0a59fc4f09221e62d7925c922f9c3f03a8457ad3a16f46394101d5dd0c6
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	1688f039255e638e69143907e6330b
Version	3

Certificate 774d49c5649436de6bf3190a67eedcdf

Field	Value
ToBeSigned (TBS) MD5	b3ca7d6b821d8e3432b29874980af55e
ToBeSigned (TBS) SHA1	618d7e55a24c1d8b65a0bcce79120c5e3b13fa4d
ToBeSigned (TBS) SHA256	c645c6a7dc7243a4a3f78a6569c029401a7bda8bc4732ce7198d9f21f19b12fa
Subject	C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.
ValidFrom	2016-03-29 00:00:00
ValidTo	2017-06-28 23:59:59
Signature	27351697f046d1d43fe306dff30b83e7a404e3e6431c1e06829c558d99eb3f21776021e3e1bd4e485aba08b89bb0972f23daa471d7b432a44a591270f9a838f13dbda32ee936c0df792cff8c493e1f27b2282b3d896ae7b4155ca1a50bf7111f3f4bbbe11f17cfe5d49c0589c210966ef7e567153e802d2e783ff498c59585598d9d3e93273d1e81c07ce85c0cfb24834d448c3930120f1686bd472d916ac8f9475acfdb27be8528311f668d71dfc132a0ff62df7baa575a0cc732b3de003beca214954d4d97cf9511b9329eccbb7b716675b31e543a43570080dffce3fc8ca8fbb17d954b9678e2d0c1e1710a5cf03952a687fede59dcba3bf98900f9934f12
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	774d49c5649436de6bf3190a67eedcdf
Version	3

Certificate 611993e400000000001c

Field	Value
ToBeSigned (TBS) MD5	78a717e082dcc1cda3458d917e677d14
ToBeSigned (TBS) SHA1	4a872e0e51f9b304469cd1dedb496ee9b8b983a4
ToBeSigned (TBS) SHA256	317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
ValidFrom	2011-02-22 19:25:17
ValidTo	2021-02-22 19:35:17
Signature	812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	611993e400000000001c
Version	3

Certificate 5200e5aa2556fc1a86ed96c9d44b33c7

Field	Value
ToBeSigned (TBS) MD5	b30c31a572b0409383ed3fbe17e56e81
ToBeSigned (TBS) SHA1	4843a82ed3b1f2bfbee9671960e1940c942f688d
ToBeSigned (TBS) SHA256	03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-02-08 00:00:00
ValidTo	2020-02-07 23:59:59
Signature	5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	5200e5aa2556fc1a86ed96c9d44b33c7
Version	3

Imports

Expand

ntoskrnl.exe
HAL.dll
CLASSPNP.SYS

Imported Functions

Expand

wcsrchr
KeSetEvent
KePulseEvent
KeClearEvent
KeStackAttachProcess
KeUnstackDetachProcess
ObfDereferenceObject
ZwSetEvent
ZwClose
ZwConnectPort
RtlInitUnicodeString
RtlUnicodeStringToInteger
ZwCreateSection
ZwWaitForSingleObject
ZwOpenEvent
IoGetCurrentProcess
ObfReferenceObject
DbgBreakPoint
ZwRequestWaitReplyPort
ExFreePoolWithTag
ProbeForWrite
ZwFreeVirtualMemory
ZwAllocateVirtualMemory
ObOpenObjectByPointer
PsProcessType
memmove
PsGetProcessExitTime
MmSectionObjectType
PsThreadType
ObReleaseObjectSecurity
SeReleaseSubjectContext
SeAccessCheck
SeCaptureSubjectContext
ObGetObjectSecurity
DbgPrint
memset
MmIsAddressValid
ExInitializeResourceLite
ExDeleteResourceLite
ZwWriteFile
ZwReadFile
ZwQueryInformationFile
ZwSetInformationFile
ZwCreateFile
swprintf
towupper
_wcsnicmp
ExAllocatePoolWithTag
KeInitializeEvent
_snprintf
PsGetCurrentProcessId
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
PsGetCurrentThreadId
RtlInitAnsiString
ZwDeviceIoControlFile
ZwCreateKey
ZwCreateEvent
KeWaitForMultipleObjects
ObReferenceObjectByHandle
ZwNotifyChangeKey
_vsnprintf
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlEqualUnicodeString
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
RtlUpcaseUnicodeChar
ExGetPreviousMode
KeWaitForSingleObject
KeSetPriorityThread
PsTerminateSystemThread
PsCreateSystemThread
KeDelayExecutionThread
KeNumberProcessors
ZwQueryInformationProcess
PsLookupProcessByProcessId
ZwOpenDirectoryObject
PsSetCreateProcessNotifyRoutine
ZwQuerySystemInformation
ZwQueryDirectoryFile
ZwQueryDirectoryObject
ZwOpenKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryValueKey
ZwDeleteValueKey
ZwDeleteKey
ZwTerminateProcess
ZwOpenProcess
ZwQueryKey
ZwSetValueKey
IoFileObjectType
_allrem
ZwQuerySecurityObject
memcpy
RtlLengthSecurityDescriptor
MmHighestUserAddress
IoFreeIrp
IoFreeMdl
_purecall
IoBuildAsynchronousFsdRequest
_strnicmp
RtlQueryRegistryValues
RtlAppendUnicodeToString
mbstowcs
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
NtClose
ObQueryNameString
MmGetSystemRoutineAddress
ZwSetInformationObject
_stricmp
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwOpenFile
IoCreateFile
IofCallDriver
IoAllocateIrp
MmBuildMdlForNonPagedPool
IoAllocateMdl
ProbeForRead
PsGetVersion
RtlImageNtHeader
RtlCompareMemory
RtlUpcaseUnicodeString
_snwprintf
MmSystemRangeStart
wcsncmp
strrchr
ZwQueryVolumeInformationFile
ObReferenceObjectByPointer
IoBuildDeviceIoControlRequest
ZwOpenSection
_allmul
KeReleaseSemaphore
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
KeInitializeSemaphore
IofCompleteRequest
ExEventObjectType
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoGetDeviceObjectPointer
RtlUpperChar
ObReferenceObjectByName
IoDriverObjectType
RtlCompareUnicodeString
strncpy
KeServiceDescriptorTable
NtOpenProcess
ObOpenObjectByName
NtQueryInformationProcess
PsIsThreadTerminating
KeAddSystemServiceTable
ZwFsControlFile
ObInsertObject
IoReleaseVpbSpinLock
IoAcquireVpbSpinLock
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
_allshr
ExInterlockedPopEntrySList
IoGetStackLimits
IoBuildSynchronousFsdRequest
wcsstr
IoUnregisterPlugPlayNotification
FsRtlIsNameInExpression
IoGetConfigurationInformation
MmProbeAndLockPages
IoGetDeviceInterfaces
IoRegisterPlugPlayNotification
ExAllocatePool
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
strncat
wcschr
wcsncat
wcstombs
KeTickCount
KeBugCheckEx
RtlUnwind
wcsncpy
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
ExAcquireResourceSharedLite
ExReleaseFastMutexUnsafe
KeLeaveCriticalRegion
KeEnterCriticalRegion
ZwSetSecurityObject
ExAcquireFastMutexUnsafe
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
RtlLengthSid
RtlAbsoluteToSelfRelativeSD
MmUnlockPages
KeGetCurrentThread
KfAcquireSpinLock
KfReleaseSpinLock
KeRaiseIrqlToDpcLevel
KfLowerIrql
ExAcquireFastMutex
ExReleaseFastMutex
KeGetCurrentIrql
KfRaiseIrql
ClassInitialize

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
??0CBlobConfig@@QAE@ABV0@@Z
??0CBlobConfig@@QAE@K@Z
??0CContext@@QAE@ABV0@@Z
??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QAE@ABV0@@Z
??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
??0CDebugLog@@QAE@ABV0@@Z
??0CDebugLog@@QAE@PBG@Z
??0CDebugLogEx@@QAE@ABV0@@Z
??0CDebugLogEx@@QAE@K@Z
??0CDelayLoadThread@@QAE@ABV0@@Z
??0CDelayLoadThread@@QAE@XZ
??0CExclusionExtConfig@@QAE@ABV0@@Z
??0CExclusionExtConfig@@QAE@KKE@Z
??0CExclusionFileNameConfig@@QAE@ABV0@@Z
??0CExclusionFileNameConfig@@QAE@KK@Z
??0CExclusionFilePathConfig@@QAE@ABV0@@Z
??0CExclusionFilePathConfig@@QAE@KK@Z
??0CExclusionFolderConfig@@QAE@ABV0@@Z
??0CExclusionFolderConfig@@QAE@KK@Z
??0CExclusionRegistryConfig@@QAE@ABV0@@Z
??0CExclusionRegistryConfig@@QAE@KK@Z
??0CFile@@QAE@ABV0@@Z
??0CFile@@QAE@E@Z
??0CFileExtension@@QAE@ABV0@@Z
??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
??0CInclusionExtConfig@@QAE@ABV0@@Z
??0CInclusionExtConfig@@QAE@KKE@Z
??0CInclusionFileNameConfig@@QAE@ABV0@@Z
??0CInclusionFileNameConfig@@QAE@KK@Z
??0CInclusionFilePathConfig@@QAE@ABV0@@Z
??0CInclusionFilePathConfig@@QAE@KK@Z
??0CInclusionFolderConfig@@QAE@ABV0@@Z
??0CInclusionFolderConfig@@QAE@KK@Z
??0CKEvent@@QAE@ABV0@@Z
??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
??0CList@@QAE@ABV0@@Z
??0CList@@QAE@KPAVIMemoryAllocator@@@Z
??0CLockEvent@@QAE@ABV0@@Z
??0CLockEvent@@QAE@XZ
??0CLockList@@QAE@ABV0@@Z
??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QAE@ABV0@@Z
??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
??0CMemoryPoolAllocator@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@XZ
??0CModuleConfigList@@QAE@ABV0@@Z
??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QAE@ABV0@@Z
??0CModuleFileExtConfig@@QAE@KKE@Z
??0CModuleFlagConfig@@QAE@ABV0@@Z
??0CModuleFlagConfig@@QAE@K@Z
??0CModuleMultiStringConfig@@QAE@ABV0@@Z
??0CModuleMultiStringConfig@@QAE@KK@Z
??0CModuleStringConfig@@QAE@ABV0@@Z
??0CModuleStringConfig@@QAE@K@Z
??0CNoLockList@@QAE@ABV0@@Z
??0CNoLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CSmartLock@@QAE@AAVCLockEvent@@@Z
??0CSmartLock@@QAE@XZ
??0CSmartReference@@QAE@AAJ@Z
??0CSmartReference@@QAE@AAK@Z
??0CSmartResource@@QAE@AAVCResource@@E@Z
??0CStrList@@QAE@ABV0@@Z
??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
??0CSystemThread@@QAE@ABV0@@Z
??0CSystemThread@@QAE@K@Z
??0CUserFuncAdapterJob@@QAE@ABV0@@Z
??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z01@Z
??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@E@Z
??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
??0CWorkerThreadJobQueue@@QAE@K@Z
??0CWorkerThreadPool@@QAE@ABV0@@Z
??0CWorkerThreadPool@@QAE@K@Z
??0CWorkerThreadPoolEx@@QAE@ABV0@@Z
??0CWorkerThreadPoolEx@@QAE@KK@Z
??0IMemoryAllocator@@QAE@ABV0@@Z
??0IMemoryAllocator@@QAE@XZ
??1CAutoUpdateConfigThread@@UAE@XZ
??1CBlobConfig@@UAE@XZ
??1CContext@@UAE@XZ
??1CContextList@@UAE@XZ
??1CDebugLog@@UAE@XZ
??1CDebugLogEx@@UAE@XZ
??1CDelayLoadThread@@UAE@XZ
??1CExclusionExtConfig@@UAE@XZ
??1CExclusionFileNameConfig@@UAE@XZ
??1CExclusionFilePathConfig@@UAE@XZ
??1CExclusionFolderConfig@@UAE@XZ
??1CExclusionRegistryConfig@@UAE@XZ
??1CFile@@UAE@XZ
??1CFileExtension@@UAE@XZ
??1CInclusionExtConfig@@UAE@XZ
??1CInclusionFileNameConfig@@UAE@XZ
??1CInclusionFilePathConfig@@UAE@XZ
??1CInclusionFolderConfig@@UAE@XZ
??1CKEvent@@UAE@XZ
??1CList@@UAE@XZ
??1CLockEvent@@UAE@XZ
??1CLockList@@UAE@XZ
??1CMemoryAllocator@@UAE@XZ
??1CMemoryPoolAllocator@@UAE@XZ
??1CModuleConfig@@UAE@XZ
??1CModuleConfigList@@UAE@XZ
??1CModuleFileExtConfig@@UAE@XZ
??1CModuleFlagConfig@@UAE@XZ
??1CModuleMultiStringConfig@@UAE@XZ
??1CModuleStringConfig@@UAE@XZ
??1CNoLockList@@UAE@XZ
??1CSmartLock@@QAE@XZ
??1CSmartReference@@QAE@XZ
??1CSmartResource@@QAE@XZ
??1CStrList@@UAE@XZ
??1CSystemThread@@UAE@XZ
??1CUserFuncAdapterJob@@UAE@XZ
??1CWorkerThread@@UAE@XZ
??1CWorkerThreadJob@@UAE@XZ
??1CWorkerThreadJobQueue@@UAE@XZ
??1CWorkerThreadPool@@UAE@XZ
??1CWorkerThreadPoolEx@@UAE@XZ
??1IMemoryAllocator@@UAE@XZ
??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??2CMemoryAllocator@@SGPAXI@Z
??2CMemoryPoolAllocator@@SGPAXI@Z
??3@YAXPAX@Z
??3IMemoryAllocator@@SGXPAX@Z
??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
??4CBlobConfig@@QAEAAV0@ABV0@@Z
??4CContext@@QAEAAV0@ABV0@@Z
??4CDebugLog@@QAEAAV0@ABV0@@Z
??4CDebugLogEx@@QAEAAV0@ABV0@@Z
??4CDelayLoadThread@@QAEAAV0@ABV0@@Z
??4CFile@@QAEAAV0@ABV0@@Z
??4CKEvent@@QAEAAV0@ABV0@@Z
??4CLockEvent@@QAEAAV0@ABV0@@Z
??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
??4CModuleConfig@@QAEAAV0@ABV0@@Z
??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
??4CSmartResource@@QAEAAV0@ABV0@@Z
??4CSystemThread@@QAEAAV0@ABV0@@Z
??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
??4CWorkerThread@@QAEAAV0@ABV0@@Z
??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CDebugLogEx@@6B@
??_7CDelayLoadThread@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CInclusionExtConfig@@6B@
??_7CInclusionFileNameConfig@@6B@
??_7CInclusionFilePathConfig@@6B@
??_7CInclusionFolderConfig@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CNoLockList@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7CWorkerThreadPoolEx@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QAEXXZ
??_FCFile@@QAEXXZ
??_FCFileExtension@@QAEXXZ
??_FCModuleConfigList@@QAEXXZ
??_FCStrList@@QAEXXZ
??_FCSystemThread@@QAEXXZ
??_FCWorkerThread@@QAEXXZ
??_FCWorkerThreadJob@@QAEXXZ
??_FCWorkerThreadJobQueue@@QAEXXZ
??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??_V@YAXPAX@Z
?Acquire@CLockEvent@@QAEXXZ
?Add@CContextList@@QAEEPAVCContext@@@Z
?Add@CFileExtension@@QAEEPBGK@Z
?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
?Add@CStrList@@QAEEPBG@Z
?AddNode@CLockList@@UAEEQAXE@Z
?AddNode@CNoLockList@@UAEEQAXE@Z
?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QAEXXZ
?CheckNode@CLockList@@UAEHQAX@Z
?CheckNode@CNoLockList@@UAEHQAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
?Cleanup@CBlobConfig@@AAEXXZ
?Cleanup@CModuleFileExtConfig@@IAEXXZ
?Cleanup@CModuleMultiStringConfig@@IAEXXZ
?Cleanup@CModuleStringConfig@@AAEXXZ
?Close@CFile@@QAEJXZ
?Count@CLockList@@QAEKXZ
?Count@CNoLockList@@QAEKXZ
?Create@CFile@@QAEJPBGKKKK@Z
?Create@CSystemThread@@QAEEXZ
?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
?CreatePool@CWorkerThreadPool@@QAEEXZ
?CreatePool@CWorkerThreadPoolEx@@QAEEXZ
?CreateThreads@CWorkerThreadPool@@QAEEK@Z
?CreateThreads@CWorkerThreadPoolEx@@QAEEK@Z
?CreateWIRP@CFile@@QAEJPBGKKKK@Z
?Delete@CFile@@QAEJXZ
?Delete@CFileExtension@@QAEEPBGK@Z
?Delete@CStrList@@QAEEPBG@Z
?DeleteAll@CList@@UAEXXZ
?DeleteAll@CLockList@@UAEXXZ
?DeleteAll@CNoLockList@@UAEXXZ
?DeleteNode@CContextList@@MAEXPAX@Z
?DeleteNode@CList@@UAEXPAX@Z
?DeleteNode@CModuleConfigList@@MAEXPAX@Z
?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YGXPAPAX@Z
?DoIt@CWorkerThreadJob@@QAEJXZ
?EntryPoint@CSystemThread@@KGXPAX@Z
?Find@CContextList@@QAEPAVCContext@@K@Z
?Find@CContextList@@QAEPAVCContext@@PAX@Z
?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FindNode@CContextList@@IAEPAXPAX@Z
?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FinishFunction@CUserFuncAdapterJob@@MAEXXZ
?FinishIt@CWorkerThreadJob@@QAEJXZ
?First@CList@@UAEPAXXZ
?First@CLockList@@UAEPAXXZ
?First@CNoLockList@@UAEPAXXZ
?Free@CMemoryAllocator@@UAEXPAX@Z
?Free@CMemoryPoolAllocator@@UAEXPAX@Z
?GetAttributes@CFile@@QAEKXZ
?GetBasicInfomration@CFile@@IAEJXZ
?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
?GetCategory@CContext@@QAEKXZ
?GetData@CBlobConfig@@QAEHPAXPAK@Z
?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QAEKXZ
?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
?GetData@CModuleStringConfig@@QAEPAGXZ
?GetData@CStrList@@QAEEPAGPAK@Z
?GetDataType@CModuleConfig@@QAEKXZ
?GetEngineContext@CContext@@QAEPAXXZ
?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFileSizeWIRP@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UAEJKPAK@Z
?GetID@CModuleConfig@@QAEKXZ
?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QAEKXZ
?GetLinkContext@CContext@@QAEPAXXZ
?GetLogFlag@CDebugLog@@QAEKXZ
?GetLogFlag@CDebugLogEx@@QAEKXZ
?GetModuleId@CModuleConfig@@QAEKXZ
?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_KTHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_KTHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QAEKXZ
?GetSize@CBlobConfig@@QAEKXZ
?GetStringConfig@CContext@@QAEPAGK@Z
?GetStringConfig@CContext@@UAEJKPAGPAK@Z
?GetThreadCount@CWorkerThreadPool@@QAEKXZ
?GetThreadCount@CWorkerThreadPoolEx@@QAEKXZ
?GetThreadID@CSystemThread@@QAEKXZ
?GetType@CContext@@QAEKXZ
?GetUserParameter@CContext@@QAEKXZ
?InitProcMon@CDebugLogEx@@IAEXXZ
?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
?InitializeFlagConfig@CContext@@QAEHKK@Z
?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
?InitializeStringConfig@CContext@@QAEHKPBG@Z
?Insert@CList@@UAEXQAXE@Z
?Insert@CLockList@@UAEXQAXE@Z
?Insert@CNoLockList@@UAEXQAXE@Z
?InsertAfter@CList@@UAEXPAX0@Z
?InsertBefore@CList@@UAEXPAX0@Z
?Instance@CWorkerThreadPool@@SGPAV1@XZ
?IsEmpty@CList@@UAEEXZ
?IsEmpty@CLockList@@UAEEXZ
?IsEmpty@CNoLockList@@UAEEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
?IsFull@CLockList@@QBEEXZ
?IsFull@CNoLockList@@QBEEXZ
?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionExtConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFileNameConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFilePathConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFolderConfig@@QAEEPBG@Z
?IsOpened@CFile@@QAEEXZ
?IsTerminated@CWorkerThreadPool@@QAEEXZ
?IsTerminated@CWorkerThreadPoolEx@@QAEEXZ
?IsValid@CMemoryAllocator@@UAEEXZ
?IsValid@CMemoryPoolAllocator@@UAEEXZ
?IsValid@IMemoryAllocator@@UAEEXZ
?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
?IsWorkerThread@CWorkerThreadPoolEx@@QAEEK@Z
?JobFunction@CUserFuncAdapterJob@@MAEXXZ
?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
?JobQueue@CWorkerThreadPoolEx@@QAEAAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QAEKXZ
?Limit@CNoLockList@@QAEKXZ
?MatchAllExtensions@CFileExtension@@QAEEXZ
?MatchNoExtensions@CFileExtension@@QAEEXZ
?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
?NeedDelete@CWorkerThreadJob@@QAEEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
?NewNode@CList@@UAEPAXXZ
?NewNode@CStrList@@EAEPAXXZ
?NewNodeVariant@CList@@IAEPAXK@Z
?Next@CList@@UBEPAXQAX@Z
?Next@CLockList@@UBEPAXQAX@Z
?Next@CNoLockList@@UBEPAXQAX@Z
?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
?NotityTerminate@CWorkerThread@@QAEXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
?PostJobToWorkerThread@CWorkerThreadPoolEx@@QAEJP6GXPAX@Z0E1@Z
?Pulse@CKEvent@@QAEJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPoolEx@@QAEJPAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
?Read@CFile@@QAEJPADKPAK@Z
?ReadWIRP@CFile@@QAEJPADKPAK@Z
?ReferenceCount@CContext@@QAEAAKXZ
?Release@CLockEvent@@QAEXXZ
?Remove@CContextList@@UAEEQAX@Z
?Remove@CList@@UAEEQAX@Z
?Remove@CLockList@@UAEEQAX@Z
?Remove@CNoLockList@@UAEEQAX@Z
?RemoveHead@CList@@UAEPAXXZ
?RemoveHead@CLockList@@UAEPAXXZ
?RemoveHead@CNoLockList@@UAEPAXXZ
?RemoveTail@CList@@UAEPAXXZ
?RemoveTail@CLockList@@UAEPAXXZ
?RemoveTail@CNoLockList@@UAEPAXXZ
?Reset@CKEvent@@QAEXXZ
?ResetData@CInclusionExtConfig@@QAEXXZ
?ResetData@CInclusionFileNameConfig@@QAEXXZ
?ResetData@CInclusionFilePathConfig@@QAEXXZ
?ResetData@CInclusionFolderConfig@@QAEXXZ
?RestoreCR0@@YGXPAX@Z
?Run@CAutoUpdateConfigThread@@UAEXXZ
?Run@CDelayLoadThread@@UAEXXZ
?Run@CWorkerThread@@UAEXXZ
?SeekToEnd@CFile@@QAEJXZ
?Set@CKEvent@@QAEJJE@Z
?SetAttributes@CFile@@QAEJK@Z
?SetBlobCofig@CContext@@UAEJKPAXK@Z
?SetData@CBlobConfig@@QAEHPAXK@Z
?SetData@CModuleFileExtConfig@@QAEHPBG@Z
?SetData@CModuleFlagConfig@@QAEHK@Z
?SetData@CModuleMultiStringConfig@@QAEHPBGK@Z
?SetData@CModuleStringConfig@@QAEHPBG@Z
?SetEngineContext@CContext@@QAEXPAX@Z
?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
?SetFlagConfig@CContext@@UAEJKK@Z
?SetLinkContext@CContext@@QAEXPAX@Z
?SetLogFlag@CDebugLog@@QAEEK@Z
?SetLogFlag@CDebugLogEx@@QAEEK@Z
?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
?SetMultiStringConfig@CContext@@UAEJKPBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
?SetPriority@CSystemThread@@QAEXK@Z
?SetStopUse@CContext@@QAEXXZ
?SetStringConfig@CContext@@UAEJKPBG@Z
?Setup@CSystemThread@@MAEXXZ
?StopUse@CContext@@QAEHXZ
?TearDown@CSystemThread@@MAEXXZ
?Terminate@CSystemThread@@QAEXE@Z
?Terminate@CWorkerThreadPool@@QAEEXZ
?Terminate@CWorkerThreadPoolEx@@QAEEXZ
?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QAEXXZ
?WaitForInit@CDelayLoadThread@@QAEEXZ
?WaitForLoad@CDelayLoadThread@@QAEEXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
?WaitQueueEmpty@CWorkerThreadJobQueue@@QAEXXZ
?Write@CDebugLog@@QAAXPBDZZ
?Write@CDebugLogEx@@QAAXPBDZZ
?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
?WriteDataToFile@CDebugLogEx@@IAEXPADK@Z
?WriteDataToProcMonW@CDebugLogEx@@IAEXPAD@Z
?WriteSystemInformation@CDebugLog@@QAEXXZ
?WriteSystemInformation@CDebugLogEx@@QAEXXZ
?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
?WriteSystemStringInformation@CDebugLogEx@@IAEXPBG@Z
?WriteToFile@CDebugLog@@IAEXPADK@Z
?WriteToProcMonW@CDebugLogEx@@IAEXPAU_UNICODE_STRING@@@Z
?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
?_pPagedAllocator@@3PAVCMemoryAllocator@@A
?m_lpInstance@CWorkerThreadPool@@1PAV1@A
?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
_DeInitKm2UmCommunication@0
_DeInitKmLPC@0
_DuplicateFullFileName@4
_FreeFullFileName@4
_GetKm2UmMode@0
_GetModuleInfoByAddress@8
_GetModuleInfoByModuleName@8
_InitKm2UmCommunication@8
_InitKmLPC@0
_IsVerifierCodeCheckFlagOn@0
_IsWindows8_1_update@4
_KmCallUm@8
_KmCallUmByLPC@8
_KmCallUmEx@12
_KmCleanupCommPortAPIs@0
_KmGetUmInitProcess@0
_KmSetCommPortAPIs@4
_ModGetExportProcAddress@8
_ModLoadDLLToBuffer@4
_ModLoadDLLToBufferWithImageSize@8
_ModLoadModule@8
_ModUnLoadModule@4
_NormalizeFileName@4
_NormalizeFullNtPathToDosName@4
_TmCommConfigRoutine@4
_UtilAddDeviceInDriveTable@4
_UtilAddReparsePointMapping@8
_UtilCleanFileReadOnly@4
_UtilCloseExclusiveHandle@12
_UtilCreateDosFileName@8
_UtilDeleteFileForce@4
_UtilGetDeviceObjectName@8
_UtilGetFileNameFromFileObject@4
_UtilGetFileObjectForProcessByEPROC@8
_UtilGetFileObjectFromFileName@12
_UtilGetProcessName@12
_UtilGetSystemDirectory@4
_UtilGetSystemDirectoryEx@0
_UtilGetSystemDirectoryLength@0
_UtilGetSystemTime@4
_UtilIoSetFileInfo@24
_UtilIopCreateFileIRP@40
_UtilKeGetLowFileDevice@16
_UtilModuleIATHook@24
_UtilModuleIATUnHook@8
_UtilPostJobToWorkerThread@12
_UtilQueryExclusiveHandle@12
_UtilQueryKeyValue@24
_UtilRemoveDeviceFromDriveTable@4
_UtilVolumeDeviceToDosName@8
_UtilWaitValueChangeToZero@8
_UtilWriteVersionToRegistry@8
_UtilbuildDynamicDiskMappingTable@0
_UtlWriteBinValueKeyToRegistry@16
_ValidateAddressWithSize@20
__ResetProtectFromClose@4
__UtilDosPathNameToNtPathName@12

Sections

Expand

.text
.rdata
.data
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2017-07-12 21:23:02
MD5	85e606523ce390f7fcd8370d5f4b812a
SHA1	55c64235d223baeb8577a2445fdaa6bedcde23db
SHA256	385485e643aa611e97ceae6590c6a8c47155886123dbb9de1e704d0d1624d039
Authentihash MD5	438eb42132c6fb062033d6effb62813c
Authentihash SHA1	e6c39b401e841e2351a9daa07b85abf679636f89
Authentihash SHA256	3ed3d54fb8222d861785f0d7e71d6223278fbf4d0baa335a54813087d7c3674e
RichPEHeaderHash MD5	9700ee6a34ba2b25ddc817d1a0743be8
RichPEHeaderHash SHA1	80283ee3a81f182a56da60791555c7a5ac734e1c
RichPEHeaderHash SHA256	7f352214a0d86b5a789492b8c5d18b8bb5fe7ec7145b883dbf27d6f1bc31a950
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	Trend Micro Eyes
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 7e93ebfb7cc64e59ea4b9a77d406fc3b

Field	Value
ToBeSigned (TBS) MD5	d0785ad36e427c92b19f6826ab1e8020
ToBeSigned (TBS) SHA1	365b7a9c21bd9373e49052c3e7b3e4646ddd4d43
ToBeSigned (TBS) SHA256	c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2
ValidFrom	2012-12-21 00:00:00
ValidTo	2020-12-30 23:59:59
Signature	03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	7e93ebfb7cc64e59ea4b9a77d406fc3b
Version	3

Certificate 0ecff438c8febf356e04d86a981b1a50

Field	Value
ToBeSigned (TBS) MD5	e9d38360b914c8863f6cba3ee58764d3
ToBeSigned (TBS) SHA1	4cba8eae47b6bf76f20b3504b98b8f062694a89b
ToBeSigned (TBS) SHA256	88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4
ValidFrom	2012-10-18 00:00:00
ValidTo	2020-12-29 23:59:59
Signature	783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	0ecff438c8febf356e04d86a981b1a50
Version	3

Certificate 497c4fad471540e6e453d0cafb155740

Field	Value
ToBeSigned (TBS) MD5	78eaa337666217b1c16a9a0ebd0b8434
ToBeSigned (TBS) SHA1	ff9cb835e78f6185eed4372096c3bae53b17d18d
ToBeSigned (TBS) SHA256	1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250
Subject	C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.
ValidFrom	2017-04-27 00:00:00
ValidTo	2018-07-16 23:59:59
Signature	f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	497c4fad471540e6e453d0cafb155740
Version	3

Certificate 611993e400000000001c

Field	Value
ToBeSigned (TBS) MD5	78a717e082dcc1cda3458d917e677d14
ToBeSigned (TBS) SHA1	4a872e0e51f9b304469cd1dedb496ee9b8b983a4
ToBeSigned (TBS) SHA256	317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
ValidFrom	2011-02-22 19:25:17
ValidTo	2021-02-22 19:35:17
Signature	812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	611993e400000000001c
Version	3

Certificate 5200e5aa2556fc1a86ed96c9d44b33c7

Field	Value
ToBeSigned (TBS) MD5	b30c31a572b0409383ed3fbe17e56e81
ToBeSigned (TBS) SHA1	4843a82ed3b1f2bfbee9671960e1940c942f688d
ToBeSigned (TBS) SHA256	03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-02-08 00:00:00
ValidTo	2020-02-07 23:59:59
Signature	5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	5200e5aa2556fc1a86ed96c9d44b33c7
Version	3

Imports

Expand

ntoskrnl.exe

Imported Functions

Expand

RtlInitUnicodeString
KeInitializeEvent
KeClearEvent
KeSetEvent
KeEnterCriticalRegion
KeLeaveCriticalRegion
KeWaitForSingleObject
ExFreePoolWithTag
ExAcquireFastMutexUnsafe
ExReleaseFastMutexUnsafe
ProbeForRead
ProbeForWrite
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
MmProbeAndLockPages
MmUnlockPages
MmMapLockedPagesSpecifyCache
IoAllocateMdl
IoFreeMdl
IoGetCurrentProcess
ObfReferenceObject
ObfDereferenceObject
ZwClose
ZwCreateSection
ZwOpenSection
ZwMapViewOfSection
ZwUnmapViewOfSection
ZwOpenEvent
KePulseEvent
KeStackAttachProcess
KeUnstackDetachProcess
ObOpenObjectByPointer
ZwAllocateVirtualMemory
ZwFreeVirtualMemory
ZwSetEvent
__C_specific_handler
PsProcessType
wcslen
wcsncpy
wcsrchr
RtlUnicodeStringToInteger
ZwWaitForSingleObject
ZwRequestWaitReplyPort
ZwConnectPort
_stricmp
ExAllocatePoolWithTag
MmIsAddressValid
RtlImageNtHeader
ZwQuerySystemInformation
SeCaptureSubjectContext
SeReleaseSubjectContext
SeAccessCheck
ObGetObjectSecurity
ObReleaseObjectSecurity
PsGetProcessExitTime
PsThreadType
MmSectionObjectType
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
KeInitializeSemaphore
KeReleaseSemaphore
ExAcquireFastMutex
ExReleaseFastMutex
RtlCreateAcl
RtlAddAccessAllowedAce
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
KeDelayExecutionThread
ExGetPreviousMode
DbgPrint
swprintf
RtlCopyUnicodeString
IofCompleteRequest
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
ObReferenceObjectByHandle
PsGetCurrentProcessId
ZwCreateEvent
ExEventObjectType
_wcsnicmp
PsSetCreateProcessNotifyRoutine
ZwQueryInformationProcess
PsLookupProcessByProcessId
ZwOpenDirectoryObject
ExInitializeResourceLite
ExDeleteResourceLite
ZwCreateFile
ZwQueryInformationFile
ZwSetInformationFile
ZwReadFile
ZwWriteFile
towupper
MmGetSystemRoutineAddress
ObReferenceObjectByPointer
PsGetCurrentThreadId
ObQueryNameString
PsGetVersion
_snprintf
_vsnprintf
RtlInitAnsiString
wcscat
RtlFreeUnicodeString
RtlTimeToTimeFields
KeWaitForMultipleObjects
ExSystemTimeToLocalTime
ZwCreateKey
ZwDeviceIoControlFile
ZwNotifyChangeKey
ZwOpenFile
ZwQueryVolumeInformationFile
mbstowcs
IoGetDeviceObjectPointer
IoBuildDeviceIoControlRequest
IofCallDriver
IoCreateFile
RtlEqualUnicodeString
RtlAppendUnicodeStringToString
RtlUpcaseUnicodeChar
_snwprintf
strlen
_strnicmp
strncpy
NtOpenProcess
NtQueryInformationProcess
ObOpenObjectByName
KeSetPriorityThread
PsCreateSystemThread
PsTerminateSystemThread
KeNumberProcessors
RtlLengthSecurityDescriptor
ZwOpenKey
ZwDeleteKey
ZwDeleteValueKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryKey
ZwQueryValueKey
ZwSetValueKey
ZwTerminateProcess
ZwOpenProcess
ZwDuplicateObject
ZwQuerySecurityObject
ZwSetSecurityObject
ZwQueryDirectoryObject
ZwQueryDirectoryFile
NtCreateFile
NtQueryInformationFile
NtSetInformationFile
IoFileObjectType
ObInsertObject
wcschr
wcsncmp
RtlQueryRegistryValues
RtlAppendUnicodeToString
RtlCompareMemory
MmBuildMdlForNonPagedPool
IoAllocateIrp
IoFreeIrp
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
RtlUpcaseUnicodeString
NtClose
ZwSetInformationObject
SeQueryAuthenticationIdToken
MmSystemRangeStart
IoGetFileObjectGenericMapping
ObCreateObject
SeCreateAccessState
IoAcquireVpbSpinLock
IoReleaseVpbSpinLock
wcstombs
strncat
wcsncat
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
strcpy
wcsstr
RtlCompareUnicodeString
DbgPrintEx
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
ExAllocatePool
ExpInterlockedPopEntrySList
IoBuildSynchronousFsdRequest
IoGetStackLimits
IoGetDeviceInterfaces
IoRegisterPlugPlayNotification
IoUnregisterPlugPlayNotification
IoGetConfigurationInformation
FsRtlIsNameInExpression
IoDeviceObjectType
IoCreateDevice
RtlGetOwnerSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
RtlLengthSid
SeExports
IoIsWdmVersionAvailable
RtlAbsoluteToSelfRelativeSD
RtlAnsiStringToUnicodeString
_purecall
KeBugCheckEx

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QEAA@AEBV0@@Z
??0CAutoUpdateConfigThread@@QEAA@PEAU_UNICODE_STRING@@P6AX0PEAX@Z1@Z
??0CBlobConfig@@QEAA@AEBV0@@Z
??0CBlobConfig@@QEAA@K@Z
??0CContext@@QEAA@AEBV0@@Z
??0CContext@@QEAA@KP6AJPEAU_EVENT_REPORT@@PEAXPEAU_TMCE_REPORT@@PEAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QEAA@AEBV0@@Z
??0CContextList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CDebugLog@@QEAA@AEBV0@@Z
??0CDebugLog@@QEAA@PEBG@Z
??0CDebugLogEx@@QEAA@AEBV0@@Z
??0CDebugLogEx@@QEAA@K@Z
??0CDelayLoadThread@@QEAA@AEBV0@@Z
??0CDelayLoadThread@@QEAA@XZ
??0CExclusionExtConfig@@QEAA@AEBV0@@Z
??0CExclusionExtConfig@@QEAA@KKE@Z
??0CExclusionFileNameConfig@@QEAA@AEBV0@@Z
??0CExclusionFileNameConfig@@QEAA@KK@Z
??0CExclusionFilePathConfig@@QEAA@AEBV0@@Z
??0CExclusionFilePathConfig@@QEAA@KK@Z
??0CExclusionFolderConfig@@QEAA@AEBV0@@Z
??0CExclusionFolderConfig@@QEAA@KK@Z
??0CExclusionRegistryConfig@@QEAA@AEBV0@@Z
??0CExclusionRegistryConfig@@QEAA@KK@Z
??0CFile@@QEAA@AEBV0@@Z
??0CFile@@QEAA@E@Z
??0CFileExtension@@QEAA@AEBV0@@Z
??0CFileExtension@@QEAA@KEEPEAVIMemoryAllocator@@@Z
??0CInclusionExtConfig@@QEAA@AEBV0@@Z
??0CInclusionExtConfig@@QEAA@KKE@Z
??0CInclusionFileNameConfig@@QEAA@AEBV0@@Z
??0CInclusionFileNameConfig@@QEAA@KK@Z
??0CInclusionFilePathConfig@@QEAA@AEBV0@@Z
??0CInclusionFilePathConfig@@QEAA@KK@Z
??0CInclusionFolderConfig@@QEAA@AEBV0@@Z
??0CInclusionFolderConfig@@QEAA@KK@Z
??0CKEvent@@QEAA@AEBV0@@Z
??0CKEvent@@QEAA@W4_EVENT_TYPE@@E@Z
??0CList@@QEAA@AEBV0@@Z
??0CList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CLockEvent@@QEAA@AEBV0@@Z
??0CLockEvent@@QEAA@XZ
??0CLockList@@QEAA@AEBV0@@Z
??0CLockList@@QEAA@KKPEAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IEAA@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QEAA@AEBV0@@Z
??0CMemoryPoolAllocator@@IEAA@W4_POOL_TYPE@@_K1K@Z
??0CMemoryPoolAllocator@@QEAA@AEBV0@@Z
??0CModuleConfig@@QEAA@AEBV0@@Z
??0CModuleConfig@@QEAA@XZ
??0CModuleConfigList@@QEAA@AEBV0@@Z
??0CModuleConfigList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QEAA@AEBV0@@Z
??0CModuleFileExtConfig@@QEAA@KKE@Z
??0CModuleFlagConfig@@QEAA@AEBV0@@Z
??0CModuleFlagConfig@@QEAA@K@Z
??0CModuleMultiStringConfig@@QEAA@AEBV0@@Z
??0CModuleMultiStringConfig@@QEAA@KK@Z
??0CModuleStringConfig@@QEAA@AEBV0@@Z
??0CModuleStringConfig@@QEAA@K@Z
??0CNoLockList@@QEAA@AEBV0@@Z
??0CNoLockList@@QEAA@KKPEAVIMemoryAllocator@@@Z
??0CSmartLock@@QEAA@AEAVCLockEvent@@@Z
??0CSmartLock@@QEAA@XZ
??0CSmartReference@@QEAA@AEAJ@Z
??0CSmartReference@@QEAA@AEAK@Z
??0CSmartResource@@QEAA@AEAVCResource@@E@Z
??0CStrList@@QEAA@AEBV0@@Z
??0CStrList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CSystemThread@@QEAA@AEBV0@@Z
??0CSystemThread@@QEAA@K@Z
??0CUserFuncAdapterJob@@QEAA@AEBV0@@Z
??0CUserFuncAdapterJob@@QEAA@P6AXPEAX@Z01@Z
??0CWorkerThread@@IEAA@PEAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QEAA@AEBV0@@Z
??0CWorkerThreadJob@@QEAA@AEBV0@@Z
??0CWorkerThreadJob@@QEAA@E@Z
??0CWorkerThreadJobQueue@@QEAA@AEBV0@@Z
??0CWorkerThreadJobQueue@@QEAA@K@Z
??0CWorkerThreadPool@@QEAA@AEBV0@@Z
??0CWorkerThreadPool@@QEAA@K@Z
??0CWorkerThreadPoolEx@@QEAA@AEBV0@@Z
??0CWorkerThreadPoolEx@@QEAA@KK@Z
??0IMemoryAllocator@@QEAA@AEBV0@@Z
??0IMemoryAllocator@@QEAA@XZ
??1CAutoUpdateConfigThread@@UEAA@XZ
??1CBlobConfig@@UEAA@XZ
??1CContext@@UEAA@XZ
??1CContextList@@UEAA@XZ
??1CDebugLog@@UEAA@XZ
??1CDebugLogEx@@UEAA@XZ
??1CDelayLoadThread@@UEAA@XZ
??1CExclusionExtConfig@@UEAA@XZ
??1CExclusionFileNameConfig@@UEAA@XZ
??1CExclusionFilePathConfig@@UEAA@XZ
??1CExclusionFolderConfig@@UEAA@XZ
??1CExclusionRegistryConfig@@UEAA@XZ
??1CFile@@UEAA@XZ
??1CFileExtension@@UEAA@XZ
??1CInclusionExtConfig@@UEAA@XZ
??1CInclusionFileNameConfig@@UEAA@XZ
??1CInclusionFilePathConfig@@UEAA@XZ
??1CInclusionFolderConfig@@UEAA@XZ
??1CKEvent@@UEAA@XZ
??1CList@@UEAA@XZ
??1CLockEvent@@UEAA@XZ
??1CLockList@@UEAA@XZ
??1CMemoryAllocator@@UEAA@XZ
??1CMemoryPoolAllocator@@UEAA@XZ
??1CModuleConfig@@UEAA@XZ
??1CModuleConfigList@@UEAA@XZ
??1CModuleFileExtConfig@@UEAA@XZ
??1CModuleFlagConfig@@UEAA@XZ
??1CModuleMultiStringConfig@@UEAA@XZ
??1CModuleStringConfig@@UEAA@XZ
??1CNoLockList@@UEAA@XZ
??1CSmartLock@@QEAA@XZ
??1CSmartReference@@QEAA@XZ
??1CSmartResource@@QEAA@XZ
??1CStrList@@UEAA@XZ
??1CSystemThread@@UEAA@XZ
??1CUserFuncAdapterJob@@UEAA@XZ
??1CWorkerThread@@UEAA@XZ
??1CWorkerThreadJob@@UEAA@XZ
??1CWorkerThreadJobQueue@@UEAA@XZ
??1CWorkerThreadPool@@UEAA@XZ
??1CWorkerThreadPoolEx@@UEAA@XZ
??1IMemoryAllocator@@UEAA@XZ
??2@YAPEAX_KPEAVIMemoryAllocator@@PEBDK@Z
??2CMemoryAllocator@@SAPEAX_K@Z
??2CMemoryPoolAllocator@@SAPEAX_K@Z
??3@YAXPEAX@Z
??3@YAXPEAX_K@Z
??3IMemoryAllocator@@SAXPEAX@Z
??4CAutoUpdateConfigThread@@QEAAAEAV0@AEBV0@@Z
??4CBlobConfig@@QEAAAEAV0@AEBV0@@Z
??4CContext@@QEAAAEAV0@AEBV0@@Z
??4CDebugLog@@QEAAAEAV0@AEBV0@@Z
??4CDebugLogEx@@QEAAAEAV0@AEBV0@@Z
??4CDelayLoadThread@@QEAAAEAV0@AEBV0@@Z
??4CFile@@QEAAAEAV0@AEBV0@@Z
??4CKEvent@@QEAAAEAV0@AEBV0@@Z
??4CLockEvent@@QEAAAEAV0@AEBV0@@Z
??4CMemoryAllocator@@QEAAAEAV0@AEBV0@@Z
??4CMemoryPoolAllocator@@QEAAAEAV0@AEBV0@@Z
??4CModuleConfig@@QEAAAEAV0@AEBV0@@Z
??4CModuleFlagConfig@@QEAAAEAV0@AEBV0@@Z
??4CModuleStringConfig@@QEAAAEAV0@AEBV0@@Z
??4CSmartLock@@QEAAAEAV0@AEBV0@@Z
??4CSmartLock@@QEAAAEBV0@AEAVCLockEvent@@@Z
??4CSmartResource@@QEAAAEAV0@AEBV0@@Z
??4CSystemThread@@QEAAAEAV0@AEBV0@@Z
??4CUserFuncAdapterJob@@QEAAAEAV0@AEBV0@@Z
??4CWorkerThread@@QEAAAEAV0@AEBV0@@Z
??4CWorkerThreadJob@@QEAAAEAV0@AEBV0@@Z
??4IMemoryAllocator@@QEAAAEAV0@AEBV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CDebugLogEx@@6B@
??_7CDelayLoadThread@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CInclusionExtConfig@@6B@
??_7CInclusionFileNameConfig@@6B@
??_7CInclusionFilePathConfig@@6B@
??_7CInclusionFolderConfig@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CNoLockList@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7CWorkerThreadPoolEx@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QEAAXXZ
??_FCFile@@QEAAXXZ
??_FCFileExtension@@QEAAXXZ
??_FCModuleConfigList@@QEAAXXZ
??_FCStrList@@QEAAXXZ
??_FCSystemThread@@QEAAXXZ
??_FCWorkerThread@@QEAAXXZ
??_FCWorkerThreadJob@@QEAAXXZ
??_FCWorkerThreadJobQueue@@QEAAXXZ
??_U@YAPEAX_KPEAVIMemoryAllocator@@PEBDK@Z
??_V@YAXPEAX@Z
??_V@YAXPEAX_K@Z
?Acquire@CLockEvent@@QEAAXXZ
?Add@CContextList@@QEAAEPEAVCContext@@@Z
?Add@CFileExtension@@QEAAEPEBGK@Z
?Add@CModuleConfigList@@QEAAEPEAVCModuleConfig@@@Z
?Add@CStrList@@QEAAEPEBG@Z
?AddNode@CLockList@@UEAAEQEAXE@Z
?AddNode@CNoLockList@@UEAAEQEAXE@Z
?Alloc@CMemoryAllocator@@UEAAPEAX_KPEBDK@Z
?Alloc@CMemoryPoolAllocator@@UEAAPEAX_KPEBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IEAAPEAX_K@Z
?AttachJobQueue@CWorkerThread@@QEAAXPEAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QEAAXXZ
?CheckNode@CLockList@@UEAAHQEAX@Z
?CheckNode@CNoLockList@@UEAAHQEAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QEAAXXZ
?Cleanup@CBlobConfig@@AEAAXXZ
?Cleanup@CModuleFileExtConfig@@IEAAXXZ
?Cleanup@CModuleMultiStringConfig@@IEAAXXZ
?Cleanup@CModuleStringConfig@@AEAAXXZ
?Close@CFile@@QEAAJXZ
?Count@CLockList@@QEAAKXZ
?Count@CNoLockList@@QEAAKXZ
?Create@CFile@@QEAAJPEBGKKKK@Z
?Create@CSystemThread@@QEAAEXZ
?CreateInstance@CMemoryAllocator@@SAPEAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SAPEAV1@W4_POOL_TYPE@@_K1K@Z
?CreatePool@CWorkerThreadPool@@QEAAEXZ
?CreatePool@CWorkerThreadPoolEx@@QEAAEXZ
?CreateThreads@CWorkerThreadPool@@QEAAEK@Z
?CreateThreads@CWorkerThreadPoolEx@@QEAAEK@Z
?CreateWIRP@CFile@@QEAAJPEBGKKKK@Z
?Delete@CFile@@QEAAJXZ
?Delete@CFileExtension@@QEAAEPEBGK@Z
?Delete@CStrList@@QEAAEPEBG@Z
?DeleteAll@CList@@UEAAXXZ
?DeleteAll@CLockList@@UEAAXXZ
?DeleteAll@CNoLockList@@UEAAXXZ
?DeleteNode@CContextList@@MEAAXPEAX@Z
?DeleteNode@CList@@UEAAXPEAX@Z
?DeleteNode@CModuleConfigList@@MEAAXPEAX@Z
?DeleteNode@CStrList@@EEAAXPEAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YAXPEAPEAX@Z
?DoIt@CWorkerThreadJob@@QEAAJXZ
?EntryPoint@CSystemThread@@KAXPEAX@Z
?Find@CContextList@@QEAAPEAVCContext@@K@Z
?Find@CContextList@@QEAAPEAVCContext@@PEAX@Z
?Find@CFileExtension@@QEAAPEAU_STR_LIST_NODE@CStrList@@PEBGK@Z
?Find@CModuleConfigList@@QEAAPEAVCModuleConfig@@K@Z
?Find@CStrList@@QEAAPEAU_STR_LIST_NODE@1@PEBG@Z
?FindNode@CContextList@@IEAAPEAXPEAX@Z
?FindPartiallyAndAllMatch@CStrList@@QEAAPEAU_STR_LIST_NODE@1@PEBG@Z
?FinishFunction@CUserFuncAdapterJob@@MEAAXXZ
?FinishIt@CWorkerThreadJob@@QEAAJXZ
?First@CList@@UEAAPEAXXZ
?First@CLockList@@UEAAPEAXXZ
?First@CNoLockList@@UEAAPEAXXZ
?Free@CMemoryAllocator@@UEAAXPEAX@Z
?Free@CMemoryPoolAllocator@@UEAAXPEAX@Z
?GetAttributes@CFile@@QEAAKXZ
?GetBasicInfomration@CFile@@IEAAJXZ
?GetBlobCofig@CContext@@UEAAJKPEAXPEAK@Z
?GetCategory@CContext@@QEAAKXZ
?GetData@CBlobConfig@@QEAAHPEAXPEAK@Z
?GetData@CModuleFileExtConfig@@QEAAHPEAGPEAK@Z
?GetData@CModuleFileExtConfig@@QEAAPEAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QEAAKXZ
?GetData@CModuleMultiStringConfig@@QEAAHPEAGPEAK@Z
?GetData@CModuleMultiStringConfig@@QEAAPEAVCStrList@@XZ
?GetData@CModuleStringConfig@@QEAAPEAGXZ
?GetData@CStrList@@QEAAEPEAGPEAK@Z
?GetDataType@CModuleConfig@@QEAAKXZ
?GetEngineContext@CContext@@QEAAPEAXXZ
?GetFileExtensionConfig@CContext@@QEAAPEAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UEAAJKPEAGPEAK@Z
?GetFileSize@CFile@@QEAAJPEAT_LARGE_INTEGER@@@Z
?GetFileSizeWIRP@CFile@@QEAAJPEAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UEAAJKPEAK@Z
?GetID@CModuleConfig@@QEAAKXZ
?GetJob@CWorkerThreadJobQueue@@QEAAPEAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QEAAKXZ
?GetLinkContext@CContext@@QEAAPEAXXZ
?GetLogFlag@CDebugLog@@QEAAKXZ
?GetLogFlag@CDebugLogEx@@QEAAKXZ
?GetModuleId@CModuleConfig@@QEAAKXZ
?GetMultiStringConfig@CContext@@QEAAPEAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UEAAJKPEAGPEAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QEAAPEAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPool@@QEAAPEAU_KTHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QEAAPEAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QEAAPEAU_KTHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QEAA_KXZ
?GetSize@CBlobConfig@@QEAAKXZ
?GetStringConfig@CContext@@QEAAPEAGK@Z
?GetStringConfig@CContext@@UEAAJKPEAGPEAK@Z
?GetThreadCount@CWorkerThreadPool@@QEAAKXZ
?GetThreadCount@CWorkerThreadPoolEx@@QEAAKXZ
?GetThreadID@CSystemThread@@QEAA_KXZ
?GetType@CContext@@QEAAKXZ
?GetUserParameter@CContext@@QEAA_KXZ
?InitProcMon@CDebugLogEx@@IEAAXXZ
?InitializeBlobConfig@CContext@@QEAAHKPEAXK@Z
?InitializeFileExtensionConfig@CContext@@QEAAHKPEBG@Z
?InitializeFlagConfig@CContext@@QEAAHKK@Z
?InitializeMultiStringConfig@CContext@@QEAAHKPEBG@Z
?InitializeStringConfig@CContext@@QEAAHKPEBG@Z
?Insert@CList@@UEAAXQEAXE@Z
?Insert@CLockList@@UEAAXQEAXE@Z
?Insert@CNoLockList@@UEAAXQEAXE@Z
?InsertAfter@CList@@UEAAXPEAX0@Z
?InsertBefore@CList@@UEAAXPEAX0@Z
?Instance@CWorkerThreadPool@@SAPEAV1@XZ
?IsEmpty@CList@@UEAAEXZ
?IsEmpty@CLockList@@UEAAEXZ
?IsEmpty@CNoLockList@@UEAAEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IEAAEK@Z
?IsFull@CLockList@@QEBAEXZ
?IsFull@CNoLockList@@QEBAEXZ
?IsInExclusionList@CExclusionExtConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionExtConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionFileNameConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionFilePathConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionFolderConfig@@QEAAEPEBG@Z
?IsOpened@CFile@@QEAAEXZ
?IsTerminated@CWorkerThreadPool@@QEAAEXZ
?IsTerminated@CWorkerThreadPoolEx@@QEAAEXZ
?IsValid@CMemoryAllocator@@UEAAEXZ
?IsValid@CMemoryPoolAllocator@@UEAAEXZ
?IsValid@IMemoryAllocator@@UEAAEXZ
?IsWorkerThread@CWorkerThreadPool@@QEAAE_K@Z
?IsWorkerThread@CWorkerThreadPoolEx@@QEAAE_K@Z
?JobFunction@CUserFuncAdapterJob@@MEAAXXZ
?JobQueue@CWorkerThreadPool@@QEAAAEAVCWorkerThreadJobQueue@@XZ
?JobQueue@CWorkerThreadPoolEx@@QEAAAEAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QEAAKXZ
?Limit@CNoLockList@@QEAAKXZ
?MatchAllExtensions@CFileExtension@@QEAAEXZ
?MatchNoExtensions@CFileExtension@@QEAAEXZ
?MergeLeft@CMemoryPoolAllocator@@IEAAPEAXPEAX@Z
?MergeRight@CMemoryPoolAllocator@@IEAAPEAXPEAX@Z
?NeedDelete@CWorkerThreadJob@@QEAAEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QEAAXE@Z
?NewNode@CList@@UEAAPEAXXZ
?NewNode@CStrList@@EEAAPEAXXZ
?NewNodeVariant@CList@@IEAAPEAXK@Z
?Next@CList@@UEBAPEAXQEAX@Z
?Next@CLockList@@UEBAPEAXQEAX@Z
?Next@CNoLockList@@UEBAPEAXQEAX@Z
?NextPool@CMemoryPoolAllocator@@QEAAPEAV1@XZ
?NotityTerminate@CWorkerThread@@QEAAXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QEAAJP6AXPEAX@Z0E@Z
?PostJobToWorkerThread@CWorkerThreadPoolEx@@QEAAJP6AXPEAX@Z0E1@Z
?Pulse@CKEvent@@QEAAJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QEAAEPEAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QEAAJPEAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPoolEx@@QEAAJPEAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SAPEAV1@XZ
?Read@CFile@@QEAAJPEADKPEAK@Z
?ReadWIRP@CFile@@QEAAJPEADKPEAK@Z
?ReferenceCount@CContext@@QEAAAEAKXZ
?Release@CLockEvent@@QEAAXXZ
?Remove@CContextList@@UEAAEQEAX@Z
?Remove@CList@@UEAAEQEAX@Z
?Remove@CLockList@@UEAAEQEAX@Z
?Remove@CNoLockList@@UEAAEQEAX@Z
?RemoveHead@CList@@UEAAPEAXXZ
?RemoveHead@CLockList@@UEAAPEAXXZ
?RemoveHead@CNoLockList@@UEAAPEAXXZ
?RemoveTail@CList@@UEAAPEAXXZ
?RemoveTail@CLockList@@UEAAPEAXXZ
?RemoveTail@CNoLockList@@UEAAPEAXXZ
?Reset@CKEvent@@QEAAXXZ
?ResetData@CInclusionExtConfig@@QEAAXXZ
?ResetData@CInclusionFileNameConfig@@QEAAXXZ
?ResetData@CInclusionFilePathConfig@@QEAAXXZ
?ResetData@CInclusionFolderConfig@@QEAAXXZ
?RestoreCR0@@YAXPEAX@Z
?Run@CAutoUpdateConfigThread@@UEAAXXZ
?Run@CDelayLoadThread@@UEAAXXZ
?Run@CWorkerThread@@UEAAXXZ
?SeekToEnd@CFile@@QEAAJXZ
?Set@CKEvent@@QEAAJJE@Z
?SetAttributes@CFile@@QEAAJK@Z
?SetBlobCofig@CContext@@UEAAJKPEAXK@Z
?SetData@CBlobConfig@@QEAAHPEAXK@Z
?SetData@CModuleFileExtConfig@@QEAAHPEBG@Z
?SetData@CModuleFlagConfig@@QEAAHK@Z
?SetData@CModuleMultiStringConfig@@QEAAHPEBGK@Z
?SetData@CModuleStringConfig@@QEAAHPEBG@Z
?SetEngineContext@CContext@@QEAAXPEAX@Z
?SetFileExtensionConfig@CContext@@UEAAJKPEBG@Z
?SetFlagConfig@CContext@@UEAAJKK@Z
?SetLinkContext@CContext@@QEAAXPEAX@Z
?SetLogFlag@CDebugLog@@QEAAEK@Z
?SetLogFlag@CDebugLogEx@@QEAAEK@Z
?SetMatchAllExtensions@CFileExtension@@QEAAXE@Z
?SetMatchNoExtensions@CFileExtension@@QEAAXE@Z
?SetMultiStringConfig@CContext@@UEAAJKPEBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QEAAXXZ
?SetPriority@CSystemThread@@QEAAXK@Z
?SetStopUse@CContext@@QEAAXXZ
?SetStringConfig@CContext@@UEAAJKPEBG@Z
?Setup@CSystemThread@@MEAAXXZ
?StopUse@CContext@@QEAAHXZ
?TearDown@CSystemThread@@MEAAXXZ
?Terminate@CSystemThread@@QEAAXE@Z
?Terminate@CWorkerThreadPool@@QEAAEXZ
?Terminate@CWorkerThreadPoolEx@@QEAAEXZ
?TmExceptionFilter@@YAJPEAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QEAAJPEAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QEAAXXZ
?WaitForInit@CDelayLoadThread@@QEAAEXZ
?WaitForLoad@CDelayLoadThread@@QEAAEXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QEAAEXZ
?WaitQueueEmpty@CWorkerThreadJobQueue@@QEAAXXZ
?Write@CDebugLog@@QEAAXPEBDZZ
?Write@CDebugLogEx@@QEAAXPEBDZZ
?Write@CFile@@QEAAJPEADKPEAT_LARGE_INTEGER@@PEAK@Z
?WriteDataToFile@CDebugLogEx@@IEAAXPEADK@Z
?WriteDataToProcMonW@CDebugLogEx@@IEAAXPEAD@Z
?WriteSystemInformation@CDebugLog@@QEAAXXZ
?WriteSystemInformation@CDebugLogEx@@QEAAXXZ
?WriteSystemStringInformation@CDebugLog@@IEAAXPEBG@Z
?WriteSystemStringInformation@CDebugLogEx@@IEAAXPEBG@Z
?WriteToFile@CDebugLog@@IEAAXPEADK@Z
?WriteToProcMonW@CDebugLogEx@@IEAAXPEAU_UNICODE_STRING@@@Z
?_pNonPagedAllocator@@3PEAVCMemoryAllocator@@EA
?_pPagedAllocator@@3PEAVCMemoryAllocator@@EA
?m_lpInstance@CWorkerThreadPool@@1PEAV1@EA
?m_lpRCMInstance@CWorkerThreadPool@@1PEAV1@EA
AllocFullFileName
DeInitKm2UmCommunication
DeInitKmLPC
DuplicateFullFileName
FreeFullFileName
GetKm2UmMode
GetModuleInfoByAddress
GetModuleInfoByModuleName
InitKm2UmCommunication
InitKmLPC
IsVerifierCodeCheckFlagOn
IsWindows8_1_update
KmCallUm
KmCallUmByLPC
KmCallUmEx
KmCleanupCommPortAPIs
KmGetUmInitProcess
KmSetBackupCommPortAPIs
KmSetCommPortAPIs
ModGetExportProcAddress
ModLoadDLLToBuffer
ModLoadDLLToBufferWithImageSize
ModLoadModule
ModUnLoadModule
NormalizeFileName
NormalizeFullNtPathToDosName
TmCommConfigRoutine
UtilAddDeviceInDriveTable
UtilAddReparsePointMapping
UtilCleanFileReadOnly
UtilCloseExclusiveHandle
UtilCreateDosFileName
UtilDeleteFileForce
UtilGetDeviceObjectName
UtilGetFileNameFromFileObject
UtilGetFileObjectForProcessByEPROC
UtilGetFileObjectFromFileName
UtilGetProcessName
UtilGetSystemDirectory
UtilGetSystemDirectoryEx
UtilGetSystemDirectoryLength
UtilGetSystemTime
UtilIoSetFileInfo
UtilIopCreateFileIRP
UtilKeGetLowFileDevice
UtilModuleIATHook
UtilModuleIATUnHook
UtilPostJobToWorkerThread
UtilQueryExclusiveHandle
UtilQueryKeyValue
UtilRemoveDeviceFromDriveTable
UtilVolumeDeviceToDosName
UtilWaitValueChangeToZero
UtilWriteVersionToRegistry
UtilbuildDynamicDiskMappingTable
UtlWriteBinValueKeyToRegistry
ValidateAddressWithSize
_ResetProtectFromClose
_UtilDosPathNameToNtPathName

Sections

Expand

.text
.rdata
.data
.pdata
.gfids
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2020-06-22 02:26:17
MD5	6e25148bb384469f3d5386dc5217548a
SHA1	dbf6e72c08824fe49c29b7660c9965c37d983e93
SHA256	3c4207c90c97733fae2a08679d63fbbe94dfcf96fdfdf88406aa7ab3f80ea78f
Authentihash MD5	2778b2480e305bca99547b921a96ede5
Authentihash SHA1	69044e94c725b1536c4f721b5a0cd9816581c745
Authentihash SHA256	eb14c5db8307488809897be13c66ef02941f6020f9c34a9664db92a00d551f4a
RichPEHeaderHash MD5	8ae6b3a63d3444e617eba17c3a93979e
RichPEHeaderHash SHA1	3cc95db9109125c87a3cb737bbe371034d9c3ade
RichPEHeaderHash SHA256	118d8d8e4d2d1ce80640e7b28300dd41389daf9bdbdc6ad2e9fefcde4aab7ad2
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	Trend Micro Eyes
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 0ea0fe4dfb74cc64bc32143103c27c8b

Field	Value
ToBeSigned (TBS) MD5	e93e004baa6013b41135ac0648e29d5b
ToBeSigned (TBS) SHA1	dc91e26674d4b627319c700d3ebb1a6cf83d358e
ToBeSigned (TBS) SHA256	0d20335edb166a303411548471bee6f301c8b4f7f7e453d09c15303de2c888d7
Subject	C=TW, L=Taipei, O=Trend Micro, Inc., OU=Taipei, TW, CN=Trend Micro, Inc.
ValidFrom	2019-07-12 00:00:00
ValidTo	2020-07-10 12:00:00
Signature	5c08ae5d586a4751195382d6889dc2fc500e7c39c641e1a58def8d923e12b754e2cc35720cc8d3d29382980debf7d98fcc17d764187126dd07c134fdbb96dd44fe8a40195df6f6acd1881fa5ba2921dadceb3f64422344672834813916bbdf317533cf6aaf3317d78197d7d6c560ad681de135f39e2d4ad345b7fe491162660a5462c6075fd725382df1e6e6bc3a4c443be778f79b07f181082e38150ca28ab932f99e4bc4185dc5b3b6edf22c187fdfd84e23a21e7da1989837f43b89aa172e6b34dbcb297bffd511a1d1c100b25e0e921f622a0845e23317f9fec83659ca21c241800683e0dd66ce4d042a8aefc4142b5923a6fa93ee72c48e8dc04c13b4b0
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	0ea0fe4dfb74cc64bc32143103c27c8b
Version	3

Certificate 61204db4000000000027

Field	Value
ToBeSigned (TBS) MD5	8e3ffc222fbcebdbb8b23115ab259be7
ToBeSigned (TBS) SHA1	ee20bff28ffe13be731c294c90d6ded5aae0ec0e
ToBeSigned (TBS) SHA256	59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821
Subject	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
ValidFrom	2011-04-15 19:45:33
ValidTo	2021-04-15 19:55:33
Signature	208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	61204db4000000000027
Version	3

Certificate 03019a023aff58b16bd6d5eae617f066

Field	Value
ToBeSigned (TBS) MD5	a752afee44f017e8d74e3f3eb7914ae3
ToBeSigned (TBS) SHA1	8eca80a6b80e9c69dcef7745748524afb8019e2d
ToBeSigned (TBS) SHA256	82560fa7efec30b5ff82af643e6f3bf3d46868bbd5e7d76f93db185e9e3553a1
Subject	C=US, O=DigiCert, CN=DigiCert Timestamp Responder
ValidFrom	2014-10-22 00:00:00
ValidTo	2024-10-22 00:00:00
Signature	9d257e1b334db226815c9b86ce23200f8087e588ffffb1d46a2c31ed3a17197117cda91bbc5a1639009de36c84e45a40fbde06018c37fa9bb19d247efe20a457ad5bb79ab06026ea6957215d342f1f71b0839419056b359010a07b97c7f63fe7e21141a6bd62d9f0273d381d286f3a5209f0ec7062d3624bb0e073a692c0d38e31d82fe36d171306eee403b614abf38f43a7719d21dd14ca155d9241daf90f81d199740d26c40e7f1bb5f5a0f1c677062815e9d893e55516f0bb0aab1cdb5c482766c8a38b0a1ce595daaec42e59a061dddaf36da261e98a0b6dec1218bdf755544003922b6bc251c20a48afb0d46ee0f4140a3a1be38f3dcaaf6a8d7bdcd844
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	03019a023aff58b16bd6d5eae617f066
Version	3

Certificate 02c4d1e58a4a680c568da3047e7e4d5f

Field	Value
ToBeSigned (TBS) MD5	829995f702421dea833a24fb2c7f4442
ToBeSigned (TBS) SHA1	1d7e838accd498c2e5ba9373af819ec097bb955c
ToBeSigned (TBS) SHA256	92914d016cc46e125e50c4bd0bd7f72db87eed4ba68f3c589b4e86aa563108db
Subject	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1
ValidFrom	2011-02-11 12:00:00
ValidTo	2026-02-10 12:00:00
Signature	49eb7c60beaeefc97cb3c5ba4b64df1669e286fa29d9de98857d406626332f4455aaaa90e935700a34bed3ae542e8e6500d67a32203e6c26b898a939b1bc95c7aae9f5ee4666c6b3e812f8b3979dff74588234997550ac448fe892ce7d8b0f3196c7dcd31130987416c6e56b4576a39401cd33007a48f66f8631c9562b3322d5f801b644ce8cb4ca88d2e416e3e7f6e23ee109c09d7943437f555c05ad9310c62c0d6bc09eea78e5d277d6b8da9a987fba4c922b9dbda488b1ddafc34cd2979b03c6ae5f1b440f333715e3cbff2f56d316a45b55679da2cadb346c0c734ab57ba4b6b3e935027870ec007acbfc4b4f2236bb1484c98f91dd0f3c758cca0b88e7
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	02c4d1e58a4a680c568da3047e7e4d5f
Version	3

Certificate 06fdf9039603adea000aeb3f27bbba1b

Field	Value
ToBeSigned (TBS) MD5	4e5ad189638cf52ba9cd881d4d44668c
ToBeSigned (TBS) SHA1	cdc115e98d798b33904c820d63cc1e1afc19251d
ToBeSigned (TBS) SHA256	37560fb9d548ab62cc3ed4669a4ab74828b5a108e67e829937ffb2d10a5f78dd
Subject	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID CA,1
ValidFrom	2006-11-10 00:00:00
ValidTo	2021-11-10 00:00:00
Signature	46503ec9b72824a7381db65b29af52cf52e93147ab565c7bd50d0b41b3efec751f7438f2b25c61a29c95c350e482b923d1ba3a8672ad3878ac755d1717347247859456d1ebbb368477cc24a5f3041955a9e7e3e7ab62cdfb8b2d90c2c0d2b594bd5e4fb105d20e3d1aa9145ba6863162a8a833e49b39a7c4f5ce1d7876942573e42aabcf9c764bed5fc24b16e44b704c00891efcc579bc4c1257fe5fe11ebc025da8fefb07384f0dc65d91b90f6745cdd683ede7920d8db1698c4ffb59e0230fd2aaae007cee9c420ecf91d727b716ee0fc3bd7c0aa0ee2c08558522b8eb181a4dfc2a21ad49318347957771dcb11b4b4b1c109c7714c19d4f2f5a9508291026
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	06fdf9039603adea000aeb3f27bbba1b
Version	3

Imports

Expand

ntoskrnl.exe
HAL.dll
CLASSPNP.SYS

Imported Functions

Expand

KePulseEvent
KeClearEvent
KeStackAttachProcess
KeUnstackDetachProcess
ObfDereferenceObject
ZwSetEvent
ZwClose
ZwConnectPort
RtlInitUnicodeString
RtlUnicodeStringToInteger
ZwCreateSection
ZwWaitForSingleObject
ZwOpenEvent
IoGetCurrentProcess
ObfReferenceObject
DbgBreakPoint
ZwRequestWaitReplyPort
ExFreePoolWithTag
ProbeForWrite
ZwFreeVirtualMemory
ZwAllocateVirtualMemory
ObOpenObjectByPointer
PsProcessType
memmove
PsGetProcessExitTime
MmSectionObjectType
PsThreadType
ObReleaseObjectSecurity
SeReleaseSubjectContext
SeAccessCheck
SeCaptureSubjectContext
ObGetObjectSecurity
DbgPrint
memset
MmIsAddressValid
ExInitializeResourceLite
ExDeleteResourceLite
ZwWriteFile
ZwReadFile
ZwQueryInformationFile
ZwSetInformationFile
ZwCreateFile
swprintf
towupper
_wcsnicmp
ExAllocatePoolWithTag
KeInitializeEvent
_snprintf
PsGetCurrentProcessId
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
PsGetCurrentThreadId
RtlInitAnsiString
ZwDeviceIoControlFile
ZwCreateKey
ZwCreateEvent
KeWaitForMultipleObjects
ObReferenceObjectByHandle
ZwNotifyChangeKey
_vsnprintf
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlEqualUnicodeString
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
RtlUpcaseUnicodeChar
RtlPrefixUnicodeString
ExGetPreviousMode
KeWaitForSingleObject
KeSetPriorityThread
PsTerminateSystemThread
PsCreateSystemThread
KeDelayExecutionThread
KeNumberProcessors
ZwQueryInformationProcess
PsLookupProcessByProcessId
ZwOpenDirectoryObject
PsSetCreateProcessNotifyRoutine
ZwQuerySystemInformation
ZwQueryDirectoryFile
ZwQueryDirectoryObject
ZwOpenKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryValueKey
ZwDeleteValueKey
ZwDeleteKey
ZwTerminateProcess
ZwOpenProcess
ZwQueryKey
ZwSetValueKey
IoFileObjectType
KeSetEvent
ZwQuerySecurityObject
ZwSetSecurityObject
RtlLengthSecurityDescriptor
MmHighestUserAddress
IoFreeIrp
_purecall
MmUnlockPages
IoBuildAsynchronousFsdRequest
_strnicmp
RtlQueryRegistryValues
RtlAppendUnicodeToString
mbstowcs
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
NtClose
ObQueryNameString
MmGetSystemRoutineAddress
ZwSetInformationObject
_stricmp
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwOpenFile
IoCreateFile
IofCallDriver
IoAllocateIrp
MmBuildMdlForNonPagedPool
IoAllocateMdl
ProbeForRead
PsGetVersion
RtlImageNtHeader
RtlCompareMemory
RtlUpcaseUnicodeString
_snwprintf
MmSystemRangeStart
wcsncmp
strrchr
ZwQueryVolumeInformationFile
ObReferenceObjectByPointer
IoBuildDeviceIoControlRequest
ZwOpenSection
_allmul
KeReleaseSemaphore
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
KeInitializeSemaphore
IoGetDeviceObjectPointer
IofCompleteRequest
ExEventObjectType
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
RtlUpperChar
ObReferenceObjectByName
IoDriverObjectType
RtlCompareUnicodeString
strncpy
KeServiceDescriptorTable
NtOpenProcess
ObOpenObjectByName
NtQueryInformationProcess
PsIsThreadTerminating
KeAddSystemServiceTable
ZwFsControlFile
ObInsertObject
IoReleaseVpbSpinLock
IoAcquireVpbSpinLock
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
_allshr
ExInterlockedPopEntrySList
IoGetStackLimits
IoBuildSynchronousFsdRequest
wcsstr
IoUnregisterPlugPlayNotification
FsRtlIsNameInExpression
IoGetConfigurationInformation
MmProbeAndLockPages
IoGetDeviceInterfaces
IoRegisterPlugPlayNotification
ExAllocatePool
wcschr
KeTickCount
KeBugCheckEx
RtlUnwind
wcsrchr
memcpy
wcsncpy
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
ExAcquireResourceSharedLite
ExReleaseFastMutexUnsafe
KeLeaveCriticalRegion
KeEnterCriticalRegion
_allrem
ExAcquireFastMutexUnsafe
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
RtlLengthSid
RtlAbsoluteToSelfRelativeSD
IoFreeMdl
KeGetCurrentThread
KfAcquireSpinLock
KfReleaseSpinLock
KeRaiseIrqlToDpcLevel
KfLowerIrql
KeAcquireQueuedSpinLock
KeReleaseQueuedSpinLock
ExAcquireFastMutex
ExReleaseFastMutex
KeGetCurrentIrql
KfRaiseIrql
ClassInitialize

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
??0CBlobConfig@@QAE@ABV0@@Z
??0CBlobConfig@@QAE@K@Z
??0CContext@@QAE@ABV0@@Z
??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QAE@ABV0@@Z
??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
??0CDebugLog@@QAE@ABV0@@Z
??0CDebugLog@@QAE@PBG@Z
??0CDebugLogEx@@QAE@ABV0@@Z
??0CDebugLogEx@@QAE@K@Z
??0CDelayLoadThread@@QAE@ABV0@@Z
??0CDelayLoadThread@@QAE@XZ
??0CExclusionExtConfig@@QAE@ABV0@@Z
??0CExclusionExtConfig@@QAE@KKE@Z
??0CExclusionFileNameConfig@@QAE@ABV0@@Z
??0CExclusionFileNameConfig@@QAE@KK@Z
??0CExclusionFilePathConfig@@QAE@ABV0@@Z
??0CExclusionFilePathConfig@@QAE@KK@Z
??0CExclusionFolderConfig@@QAE@ABV0@@Z
??0CExclusionFolderConfig@@QAE@KK@Z
??0CExclusionRegistryConfig@@QAE@ABV0@@Z
??0CExclusionRegistryConfig@@QAE@KK@Z
??0CFile@@QAE@ABV0@@Z
??0CFile@@QAE@E@Z
??0CFileExtension@@QAE@ABV0@@Z
??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
??0CInclusionExtConfig@@QAE@ABV0@@Z
??0CInclusionExtConfig@@QAE@KKE@Z
??0CInclusionFileNameConfig@@QAE@ABV0@@Z
??0CInclusionFileNameConfig@@QAE@KK@Z
??0CInclusionFilePathConfig@@QAE@ABV0@@Z
??0CInclusionFilePathConfig@@QAE@KK@Z
??0CInclusionFolderConfig@@QAE@ABV0@@Z
??0CInclusionFolderConfig@@QAE@KK@Z
??0CKEvent@@QAE@ABV0@@Z
??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
??0CList@@QAE@ABV0@@Z
??0CList@@QAE@KPAVIMemoryAllocator@@@Z
??0CLockEvent@@QAE@ABV0@@Z
??0CLockEvent@@QAE@XZ
??0CLockList@@QAE@ABV0@@Z
??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QAE@ABV0@@Z
??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
??0CMemoryPoolAllocator@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@XZ
??0CModuleConfigList@@QAE@ABV0@@Z
??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QAE@ABV0@@Z
??0CModuleFileExtConfig@@QAE@KKE@Z
??0CModuleFlagConfig@@QAE@ABV0@@Z
??0CModuleFlagConfig@@QAE@K@Z
??0CModuleMultiStringConfig@@QAE@ABV0@@Z
??0CModuleMultiStringConfig@@QAE@KK@Z
??0CModuleStringConfig@@QAE@ABV0@@Z
??0CModuleStringConfig@@QAE@K@Z
??0CNoLockList@@QAE@ABV0@@Z
??0CNoLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CSmartLock@@QAE@AAVCLockEvent@@@Z
??0CSmartLock@@QAE@XZ
??0CSmartReference@@QAE@AAJ@Z
??0CSmartReference@@QAE@AAK@Z
??0CSmartResource@@QAE@AAVCResource@@E@Z
??0CStrList@@QAE@ABV0@@Z
??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
??0CSystemThread@@QAE@ABV0@@Z
??0CSystemThread@@QAE@K@Z
??0CUserFuncAdapterJob@@QAE@ABV0@@Z
??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z01@Z
??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@E@Z
??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
??0CWorkerThreadJobQueue@@QAE@K@Z
??0CWorkerThreadPool@@QAE@ABV0@@Z
??0CWorkerThreadPool@@QAE@K@Z
??0CWorkerThreadPoolEx@@QAE@ABV0@@Z
??0CWorkerThreadPoolEx@@QAE@KK@Z
??0IMemoryAllocator@@QAE@ABV0@@Z
??0IMemoryAllocator@@QAE@XZ
??1CAutoUpdateConfigThread@@UAE@XZ
??1CBlobConfig@@UAE@XZ
??1CContext@@UAE@XZ
??1CContextList@@UAE@XZ
??1CDebugLog@@UAE@XZ
??1CDebugLogEx@@UAE@XZ
??1CDelayLoadThread@@UAE@XZ
??1CExclusionExtConfig@@UAE@XZ
??1CExclusionFileNameConfig@@UAE@XZ
??1CExclusionFilePathConfig@@UAE@XZ
??1CExclusionFolderConfig@@UAE@XZ
??1CExclusionRegistryConfig@@UAE@XZ
??1CFile@@UAE@XZ
??1CFileExtension@@UAE@XZ
??1CInclusionExtConfig@@UAE@XZ
??1CInclusionFileNameConfig@@UAE@XZ
??1CInclusionFilePathConfig@@UAE@XZ
??1CInclusionFolderConfig@@UAE@XZ
??1CKEvent@@UAE@XZ
??1CList@@UAE@XZ
??1CLockEvent@@UAE@XZ
??1CLockList@@UAE@XZ
??1CMemoryAllocator@@UAE@XZ
??1CMemoryPoolAllocator@@UAE@XZ
??1CModuleConfig@@UAE@XZ
??1CModuleConfigList@@UAE@XZ
??1CModuleFileExtConfig@@UAE@XZ
??1CModuleFlagConfig@@UAE@XZ
??1CModuleMultiStringConfig@@UAE@XZ
??1CModuleStringConfig@@UAE@XZ
??1CNoLockList@@UAE@XZ
??1CSmartLock@@QAE@XZ
??1CSmartReference@@QAE@XZ
??1CSmartResource@@QAE@XZ
??1CStrList@@UAE@XZ
??1CSystemThread@@UAE@XZ
??1CUserFuncAdapterJob@@UAE@XZ
??1CWorkerThread@@UAE@XZ
??1CWorkerThreadJob@@UAE@XZ
??1CWorkerThreadJobQueue@@UAE@XZ
??1CWorkerThreadPool@@UAE@XZ
??1CWorkerThreadPoolEx@@UAE@XZ
??1IMemoryAllocator@@UAE@XZ
??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??2CMemoryAllocator@@SGPAXI@Z
??2CMemoryPoolAllocator@@SGPAXI@Z
??3@YAXPAX@Z
??3IMemoryAllocator@@SGXPAX@Z
??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
??4CBlobConfig@@QAEAAV0@ABV0@@Z
??4CContext@@QAEAAV0@ABV0@@Z
??4CDebugLog@@QAEAAV0@ABV0@@Z
??4CDebugLogEx@@QAEAAV0@ABV0@@Z
??4CDelayLoadThread@@QAEAAV0@ABV0@@Z
??4CFile@@QAEAAV0@ABV0@@Z
??4CKEvent@@QAEAAV0@ABV0@@Z
??4CLockEvent@@QAEAAV0@ABV0@@Z
??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
??4CModuleConfig@@QAEAAV0@ABV0@@Z
??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
??4CSmartResource@@QAEAAV0@ABV0@@Z
??4CSystemThread@@QAEAAV0@ABV0@@Z
??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
??4CWorkerThread@@QAEAAV0@ABV0@@Z
??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CDebugLogEx@@6B@
??_7CDelayLoadThread@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CInclusionExtConfig@@6B@
??_7CInclusionFileNameConfig@@6B@
??_7CInclusionFilePathConfig@@6B@
??_7CInclusionFolderConfig@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CNoLockList@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7CWorkerThreadPoolEx@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QAEXXZ
??_FCFile@@QAEXXZ
??_FCFileExtension@@QAEXXZ
??_FCModuleConfigList@@QAEXXZ
??_FCStrList@@QAEXXZ
??_FCSystemThread@@QAEXXZ
??_FCWorkerThread@@QAEXXZ
??_FCWorkerThreadJob@@QAEXXZ
??_FCWorkerThreadJobQueue@@QAEXXZ
??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??_V@YAXPAX@Z
?Acquire@CLockEvent@@QAEXXZ
?Add@CContextList@@QAEEPAVCContext@@@Z
?Add@CFileExtension@@QAEEPBGK@Z
?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
?Add@CStrList@@QAEEPBG@Z
?AddNode@CLockList@@UAEEQAXE@Z
?AddNode@CNoLockList@@UAEEQAXE@Z
?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QAEXXZ
?CheckNode@CLockList@@UAEHQAX@Z
?CheckNode@CNoLockList@@UAEHQAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
?Cleanup@CBlobConfig@@AAEXXZ
?Cleanup@CModuleFileExtConfig@@IAEXXZ
?Cleanup@CModuleMultiStringConfig@@IAEXXZ
?Cleanup@CModuleStringConfig@@AAEXXZ
?Close@CFile@@QAEJXZ
?Count@CLockList@@QAEKXZ
?Count@CNoLockList@@QAEKXZ
?Create@CFile@@QAEJPBGKKKK@Z
?Create@CSystemThread@@QAEEXZ
?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
?CreatePool@CWorkerThreadPool@@QAEEXZ
?CreatePool@CWorkerThreadPoolEx@@QAEEXZ
?CreateThreads@CWorkerThreadPool@@QAEEK@Z
?CreateThreads@CWorkerThreadPoolEx@@QAEEK@Z
?CreateWIRP@CFile@@QAEJPBGKKKK@Z
?Delete@CFile@@QAEJXZ
?Delete@CFileExtension@@QAEEPBGK@Z
?Delete@CStrList@@QAEEPBG@Z
?DeleteAll@CList@@UAEXXZ
?DeleteAll@CLockList@@UAEXXZ
?DeleteAll@CNoLockList@@UAEXXZ
?DeleteNode@CContextList@@MAEXPAX@Z
?DeleteNode@CList@@UAEXPAX@Z
?DeleteNode@CModuleConfigList@@MAEXPAX@Z
?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YGXPAPAX@Z
?DoIt@CWorkerThreadJob@@QAEJXZ
?EntryPoint@CSystemThread@@KGXPAX@Z
?Find@CContextList@@QAEPAVCContext@@K@Z
?Find@CContextList@@QAEPAVCContext@@PAX@Z
?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FindNode@CContextList@@IAEPAXPAX@Z
?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FinishFunction@CUserFuncAdapterJob@@MAEXXZ
?FinishIt@CWorkerThreadJob@@QAEJXZ
?First@CList@@UAEPAXXZ
?First@CLockList@@UAEPAXXZ
?First@CNoLockList@@UAEPAXXZ
?Free@CMemoryAllocator@@UAEXPAX@Z
?Free@CMemoryPoolAllocator@@UAEXPAX@Z
?GetAttributes@CFile@@QAEKXZ
?GetBasicInfomration@CFile@@IAEJXZ
?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
?GetCategory@CContext@@QAEKXZ
?GetData@CBlobConfig@@QAEHPAXPAK@Z
?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QAEKXZ
?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
?GetData@CModuleStringConfig@@QAEPAGXZ
?GetData@CStrList@@QAEEPAGPAK@Z
?GetDataType@CModuleConfig@@QAEKXZ
?GetEngineContext@CContext@@QAEPAXXZ
?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFileSizeWIRP@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UAEJKPAK@Z
?GetID@CModuleConfig@@QAEKXZ
?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QAEKXZ
?GetLinkContext@CContext@@QAEPAXXZ
?GetLogFlag@CDebugLog@@QAEKXZ
?GetLogFlag@CDebugLogEx@@QAEKXZ
?GetModuleId@CModuleConfig@@QAEKXZ
?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_KTHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_KTHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QAEKXZ
?GetSize@CBlobConfig@@QAEKXZ
?GetStringConfig@CContext@@QAEPAGK@Z
?GetStringConfig@CContext@@UAEJKPAGPAK@Z
?GetThreadCount@CWorkerThreadPool@@QAEKXZ
?GetThreadCount@CWorkerThreadPoolEx@@QAEKXZ
?GetThreadID@CSystemThread@@QAEKXZ
?GetType@CContext@@QAEKXZ
?GetUserParameter@CContext@@QAEKXZ
?InitProcMon@CDebugLogEx@@IAEXXZ
?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
?InitializeFlagConfig@CContext@@QAEHKK@Z
?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
?InitializeStringConfig@CContext@@QAEHKPBG@Z
?Insert@CList@@UAEXQAXE@Z
?Insert@CLockList@@UAEXQAXE@Z
?Insert@CNoLockList@@UAEXQAXE@Z
?InsertAfter@CList@@UAEXPAX0@Z
?InsertBefore@CList@@UAEXPAX0@Z
?Instance@CWorkerThreadPool@@SGPAV1@XZ
?IsEmpty@CList@@UAEEXZ
?IsEmpty@CLockList@@UAEEXZ
?IsEmpty@CNoLockList@@UAEEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
?IsFull@CLockList@@QBEEXZ
?IsFull@CNoLockList@@QBEEXZ
?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionExtConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFileNameConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFilePathConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFolderConfig@@QAEEPBG@Z
?IsOpened@CFile@@QAEEXZ
?IsTerminated@CWorkerThreadPool@@QAEEXZ
?IsTerminated@CWorkerThreadPoolEx@@QAEEXZ
?IsValid@CMemoryAllocator@@UAEEXZ
?IsValid@CMemoryPoolAllocator@@UAEEXZ
?IsValid@IMemoryAllocator@@UAEEXZ
?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
?IsWorkerThread@CWorkerThreadPoolEx@@QAEEK@Z
?JobFunction@CUserFuncAdapterJob@@MAEXXZ
?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
?JobQueue@CWorkerThreadPoolEx@@QAEAAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QAEKXZ
?Limit@CNoLockList@@QAEKXZ
?MatchAllExtensions@CFileExtension@@QAEEXZ
?MatchNoExtensions@CFileExtension@@QAEEXZ
?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
?NeedDelete@CWorkerThreadJob@@QAEEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
?NewNode@CList@@UAEPAXXZ
?NewNode@CStrList@@EAEPAXXZ
?NewNodeVariant@CList@@IAEPAXK@Z
?Next@CList@@UBEPAXQAX@Z
?Next@CLockList@@UBEPAXQAX@Z
?Next@CNoLockList@@UBEPAXQAX@Z
?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
?NotityTerminate@CWorkerThread@@QAEXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
?PostJobToWorkerThread@CWorkerThreadPoolEx@@QAEJP6GXPAX@Z0E1@Z
?Pulse@CKEvent@@QAEJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPoolEx@@QAEJPAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
?Read@CFile@@QAEJPADKPAK@Z
?ReadWIRP@CFile@@QAEJPADKPAK@Z
?ReferenceCount@CContext@@QAEAAKXZ
?Release@CLockEvent@@QAEXXZ
?Remove@CContextList@@UAEEQAX@Z
?Remove@CList@@UAEEQAX@Z
?Remove@CLockList@@UAEEQAX@Z
?Remove@CNoLockList@@UAEEQAX@Z
?RemoveHead@CList@@UAEPAXXZ
?RemoveHead@CLockList@@UAEPAXXZ
?RemoveHead@CNoLockList@@UAEPAXXZ
?RemoveTail@CList@@UAEPAXXZ
?RemoveTail@CLockList@@UAEPAXXZ
?RemoveTail@CNoLockList@@UAEPAXXZ
?Reset@CKEvent@@QAEXXZ
?ResetData@CInclusionExtConfig@@QAEXXZ
?ResetData@CInclusionFileNameConfig@@QAEXXZ
?ResetData@CInclusionFilePathConfig@@QAEXXZ
?ResetData@CInclusionFolderConfig@@QAEXXZ
?RestoreCR0@@YGXPAX@Z
?Run@CAutoUpdateConfigThread@@UAEXXZ
?Run@CDelayLoadThread@@UAEXXZ
?Run@CWorkerThread@@UAEXXZ
?SeekToEnd@CFile@@QAEJXZ
?Set@CKEvent@@QAEJJE@Z
?SetAttributes@CFile@@QAEJK@Z
?SetBlobCofig@CContext@@UAEJKPAXK@Z
?SetData@CBlobConfig@@QAEHPAXK@Z
?SetData@CModuleFileExtConfig@@QAEHPBG@Z
?SetData@CModuleFlagConfig@@QAEHK@Z
?SetData@CModuleMultiStringConfig@@QAEHPBGK@Z
?SetData@CModuleStringConfig@@QAEHPBG@Z
?SetEngineContext@CContext@@QAEXPAX@Z
?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
?SetFlagConfig@CContext@@UAEJKK@Z
?SetLinkContext@CContext@@QAEXPAX@Z
?SetLogFlag@CDebugLog@@QAEEK@Z
?SetLogFlag@CDebugLogEx@@QAEEK@Z
?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
?SetMultiStringConfig@CContext@@UAEJKPBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
?SetPriority@CSystemThread@@QAEXK@Z
?SetStopUse@CContext@@QAEXXZ
?SetStringConfig@CContext@@UAEJKPBG@Z
?Setup@CSystemThread@@MAEXXZ
?StopUse@CContext@@QAEHXZ
?TearDown@CSystemThread@@MAEXXZ
?Terminate@CSystemThread@@QAEXE@Z
?Terminate@CWorkerThreadPool@@QAEEXZ
?Terminate@CWorkerThreadPoolEx@@QAEEXZ
?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QAEXXZ
?WaitForInit@CDelayLoadThread@@QAEEXZ
?WaitForLoad@CDelayLoadThread@@QAEEXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
?WaitQueueEmpty@CWorkerThreadJobQueue@@QAEXXZ
?Write@CDebugLog@@QAAXPBDZZ
?Write@CDebugLogEx@@QAAXPBDZZ
?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
?WriteDataToFile@CDebugLogEx@@IAEXPADK@Z
?WriteDataToProcMonW@CDebugLogEx@@IAEXPAD@Z
?WriteSystemInformation@CDebugLog@@QAEXXZ
?WriteSystemInformation@CDebugLogEx@@QAEXXZ
?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
?WriteSystemStringInformation@CDebugLogEx@@IAEXPBG@Z
?WriteToFile@CDebugLog@@IAEXPADK@Z
?WriteToProcMonW@CDebugLogEx@@IAEXPAU_UNICODE_STRING@@@Z
?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
?_pPagedAllocator@@3PAVCMemoryAllocator@@A
?m_lpInstance@CWorkerThreadPool@@1PAV1@A
?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
_DeInitKm2UmCommunication@0
_DeInitKmLPC@0
_DuplicateFullFileName@4
_FreeFullFileName@4
_GetFileVersionOfNtoskrnl@16
_GetKm2UmMode@0
_GetModuleInfoByAddress@8
_GetModuleInfoByModuleName@8
_InitKm2UmCommunication@8
_InitKmLPC@0
_IsWindows8_1_update@4
_KmCallUm@8
_KmCallUmByLPC@8
_KmCallUmEx@12
_KmCleanupCommPortAPIs@0
_KmGetUmInitProcess@0
_KmSetCommPortAPIs@4
_ModGetExportProcAddress@8
_ModLoadDLLToBuffer@4
_ModLoadDLLToBufferWithImageSize@8
_ModLoadModule@8
_ModUnLoadModule@4
_NormalizeFileName@4
_NormalizeFullNtPathToDosName@4
_TmCommConfigRoutine@4
_UtilAddDeviceInDriveTable@4
_UtilAddReparsePointMapping@8
_UtilCleanFileReadOnly@4
_UtilCloseExclusiveHandle@12
_UtilCreateDosFileName@8
_UtilDeleteFileForce@4
_UtilGetDeviceObjectName@8
_UtilGetFileNameFromFileObject@4
_UtilGetFileObjectForProcessByEPROC@8
_UtilGetFileObjectFromFileName@12
_UtilGetProcessName@12
_UtilGetSystemDirectory@4
_UtilGetSystemDirectoryEx@0
_UtilGetSystemDirectoryLength@0
_UtilGetSystemTime@4
_UtilIoSetFileInfo@24
_UtilIopCreateFileIRP@40
_UtilKeGetLowFileDevice@16
_UtilModuleIATHook@24
_UtilModuleIATUnHook@8
_UtilPostJobToWorkerThread@12
_UtilQueryExclusiveHandle@12
_UtilQueryKeyValue@24
_UtilRemoveDeviceFromDriveTable@4
_UtilVolumeDeviceToDosName@8
_UtilWaitValueChangeToZero@8
_UtilWriteVersionToRegistry@8
_UtilbuildDynamicDiskMappingTable@0
_UtlWriteBinValueKeyToRegistry@16
_ValidateAddressWithSize@20
__ResetProtectFromClose@4
__UtilDosPathNameToNtPathName@12

Sections

Expand

.text
.rdata
.data
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2011-07-27 20:25:40
MD5	ad866d83b4f0391aecceb4e507011831
SHA1	2cc70b772b42e0208f345c7c70d78f7536812f99
SHA256	3e1d47a497babbfd1c83905777b517ec87c65742bee7eb57a2273eca825d2272
Authentihash MD5	9242d88e9b533ca214638aadacfb515a
Authentihash SHA1	9892893a2a7d2a458ee795eeee065f64d4f6e3c4
Authentihash SHA256	6ad7bdf11a7ce7296a06eb4f14091df84fafdb04413e714f09f9ea6c686a1323
RichPEHeaderHash MD5	14f57f14bfadf8c2853ed049e6fe2971
RichPEHeaderHash SHA1	318505d62e83e79bc68d918520aa260b537e69c8
RichPEHeaderHash SHA256	426a0d423024b210c562a0b5b34161f67c5dbac0e8fd1ff5c7b273951f8efa37
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	Trend Micro Eyes
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 3825d7faf861af9ef490e726b5d65ad5

Field	Value
ToBeSigned (TBS) MD5	d6c7684e9aaa508cf268335f83afe040
ToBeSigned (TBS) SHA1	18066d20ad92409c567cdfde745279ff71c75226
ToBeSigned (TBS) SHA256	a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff
Subject	C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2
ValidFrom	2007-06-15 00:00:00
ValidTo	2012-06-14 23:59:59
Signature	50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	3825d7faf861af9ef490e726b5d65ad5
Version	3

Certificate 47bf1995df8d524643f7db6d480d31a4

Field	Value
ToBeSigned (TBS) MD5	518d2ea8a21e879c942d504824ac211c
ToBeSigned (TBS) SHA1	21ce87d827077e61abddf2beba69fde5432ea031
ToBeSigned (TBS) SHA256	1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7
Subject	C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
ValidFrom	2003-12-04 00:00:00
ValidTo	2013-12-03 23:59:59
Signature	4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	47bf1995df8d524643f7db6d480d31a4
Version	3

Certificate 4d6290e58c54f0f1eb17341a1310e6a4

Field	Value
ToBeSigned (TBS) MD5	b7d8444a70054990435f35a5630df5e1
ToBeSigned (TBS) SHA1	4678c6e4a8787a8e6ed2bce8792b122f6c08afd8
ToBeSigned (TBS) SHA256	0a8b4b359ea7890b358e56e436e9cfc6f32b037b2599b597ca7f7a80d475ec98
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-09-30 00:00:00
ValidTo	2014-01-01 23:59:59
Signature	aedd211d5f8f807ad25209eadb6ed25d8be8c21b6904be51a5010e59fa37d174a3eedced89742b62d5a6bf4fad361754f013e0a345d24c26cbe26da21fd01e7a070fb6b37b6f5068a2e931b3b7997d8070a0a7de0b1ea4fff34d811bdd20c91cc4afcff18ffad9da95f0ecdc5cbfe88c5a3e7ab0a3eb59437411e09b1a6af36f
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	4d6290e58c54f0f1eb17341a1310e6a4
Version	3

Certificate 610c120600000000001b

Field	Value
ToBeSigned (TBS) MD5	53c41bc1164e09e0cd1617a5bf913efd
ToBeSigned (TBS) SHA1	93c03aac8951d494ecd5696b1c08658541b18727
ToBeSigned (TBS) SHA256	40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b
Subject	C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
ValidFrom	2006-05-23 17:01:29
ValidTo	2016-05-23 17:11:29
Signature	01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	610c120600000000001b
Version	3

Certificate 24e3d70b86ed54d0b22c3450b960984e

Field	Value
ToBeSigned (TBS) MD5	8ddf6d6623a3f10024af513804bb606d
ToBeSigned (TBS) SHA1	4daedaec405b6dfefce005517e230b2419ad08bc
ToBeSigned (TBS) SHA256	54894db2dab64a4991b4deab1a3415d4ea0d9905711af3b67242a0568d799b95
Subject	C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, OU=RD, CN=Trend Micro, Inc.
ValidFrom	2011-01-31 00:00:00
ValidTo	2012-02-16 23:59:59
Signature	5ae5a2abcc8bbf832dd651a0cb396ee5af87305e67d20288d6d830699286ce0b1b3ec77c732d80564e6a482461bda52329dc301ec6286011fe60413c97f4207bf675a71460365e9d917b19d7b5e7c49ff035a5488f8fc703a61512b1588cb6fc8ceef0f6353d47c66a5edbef40e53197431ada77acef71cca7db0dbaa88d02355af0a62a7901e91bc8c59ad48b4ecfd67f137023601c308691ad14d6859c9d6b28c6a3e15314e55832cea94793436a5610bbe5f0901cedc6796c9ca53b5d55f79974cd6be7093bba119675614c1654139096e506c3fb92460d45879bdbc196bd833ae4dc31da6e14130df14a20c05615db7ea7e25aa0fe59801ec30a56501e56
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	24e3d70b86ed54d0b22c3450b960984e
Version	3

Imports

Expand

ntoskrnl.exe
HAL.dll
CLASSPNP.SYS
SCSIPORT.SYS

Imported Functions

Expand

KeWaitForSingleObject
KeReleaseSemaphore
KeStackAttachProcess
KeUnstackDetachProcess
RtlSubAuthoritySid
RtlInitializeSid
ExAllocatePoolWithTag
RtlLengthRequiredSid
ExFreePoolWithTag
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
ObfDereferenceObject
ZwSetEvent
ZwClose
ZwRequestWaitReplyPort
ProbeForWrite
ZwFreeVirtualMemory
ZwAllocateVirtualMemory
ObOpenObjectByPointer
PsProcessType
memmove
ZwConnectPort
RtlInitUnicodeString
RtlUnicodeStringToInteger
ZwCreateSection
ZwWaitForSingleObject
ZwOpenEvent
ObfReferenceObject
IoGetCurrentProcess
DbgBreakPoint
PsGetProcessExitTime
MmSectionObjectType
DbgPrint
memset
MmIsAddressValid
ExInitializeResourceLite
ExDeleteResourceLite
ZwWriteFile
ZwReadFile
ZwQueryInformationFile
ZwSetInformationFile
ZwCreateFile
swprintf
towupper
_wcsnicmp
KeInitializeEvent
_snprintf
PsGetCurrentProcessId
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
ZwCreateKey
ZwCreateEvent
KeWaitForMultipleObjects
ObReferenceObjectByHandle
ZwNotifyChangeKey
PsGetCurrentThreadId
_vsnprintf
KeSetPriorityThread
PsTerminateSystemThread
PsCreateSystemThread
KeNumberProcessors
ZwQueryInformationProcess
PsLookupProcessByProcessId
KeDelayExecutionThread
ZwOpenDirectoryObject
PsSetCreateProcessNotifyRoutine
ZwQuerySystemInformation
ZwQueryDirectoryFile
ZwQueryDirectoryObject
ZwDuplicateObject
ZwOpenKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryValueKey
ZwDeleteValueKey
ZwDeleteKey
ExGetPreviousMode
ZwTerminateProcess
ZwOpenProcess
ZwQueryKey
ZwSetValueKey
MmHighestUserAddress
IoFreeIrp
IoFreeMdl
MmUnlockPages
KeInitializeSemaphore
_strnicmp
RtlQueryRegistryValues
RtlAppendUnicodeToString
mbstowcs
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
NtClose
ZwSetInformationObject
_stricmp
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwOpenFile
RtlEqualUnicodeString
IoFileObjectType
IoCreateFile
IofCallDriver
IoAllocateIrp
MmBuildMdlForNonPagedPool
IoAllocateMdl
ProbeForRead
PsGetVersion
MmGetSystemRoutineAddress
RtlCopyUnicodeString
RtlCompareMemory
_snwprintf
RtlImageNtHeader
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
strrchr
ZwQueryVolumeInformationFile
ObReferenceObjectByPointer
ObQueryNameString
IoBuildDeviceIoControlRequest
IofCompleteRequest
ExEventObjectType
_allmul
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoGetDeviceObjectPointer
RtlUpperChar
RtlCompareUnicodeString
strncpy
KeServiceDescriptorTable
NtOpenProcess
ObOpenObjectByName
IoDriverObjectType
RtlAppendUnicodeStringToString
NtQueryInformationProcess
PsIsThreadTerminating
PsThreadType
KeAddSystemServiceTable
ZwQueryObject
ZwQuerySecurityObject
ObInsertObject
_allrem
IoReleaseVpbSpinLock
IoAcquireVpbSpinLock
SeCreateAccessState
IoGetFileObjectGenericMapping
RtlUpcaseUnicodeString
ObCreateObject
_allshr
MmUnmapIoSpace
MmGetPhysicalAddress
MmFreeContiguousMemory
MmAllocateContiguousMemory
MmMapIoSpace
KeTickCount
KeBugCheckEx
RtlUnwind
KeClearEvent
KePulseEvent
KeSetEvent
wcsrchr
memcpy
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
RtlLengthSid
wcschr
RtlAbsoluteToSelfRelativeSD
wcsncpy
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
ExAcquireResourceSharedLite
ExReleaseFastMutexUnsafe
KeLeaveCriticalRegion
KeEnterCriticalRegion
ExAcquireFastMutexUnsafe
_purecall
IoBuildAsynchronousFsdRequest
KeGetCurrentThread
KeRaiseIrqlToDpcLevel
KfLowerIrql
ExReleaseFastMutex
ExAcquireFastMutex
ClassInitialize
ScsiPortReadPortBufferUshort
ScsiPortReadPortUchar
ScsiPortWritePortUchar
ScsiPortStallExecution
ScsiPortWritePortBufferUshort

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
??0CBlobConfig@@QAE@ABV0@@Z
??0CBlobConfig@@QAE@K@Z
??0CContext@@QAE@ABV0@@Z
??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QAE@ABV0@@Z
??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
??0CDebugLog@@QAE@ABV0@@Z
??0CDebugLog@@QAE@PBG@Z
??0CDelayLoadThread@@QAE@ABV0@@Z
??0CDelayLoadThread@@QAE@XZ
??0CExclusionExtConfig@@QAE@ABV0@@Z
??0CExclusionExtConfig@@QAE@KKE@Z
??0CExclusionFileNameConfig@@QAE@ABV0@@Z
??0CExclusionFileNameConfig@@QAE@KK@Z
??0CExclusionFilePathConfig@@QAE@ABV0@@Z
??0CExclusionFilePathConfig@@QAE@KK@Z
??0CExclusionFolderConfig@@QAE@ABV0@@Z
??0CExclusionFolderConfig@@QAE@KK@Z
??0CExclusionRegistryConfig@@QAE@ABV0@@Z
??0CExclusionRegistryConfig@@QAE@KK@Z
??0CFile@@QAE@ABV0@@Z
??0CFile@@QAE@E@Z
??0CFileExtension@@QAE@ABV0@@Z
??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
??0CKEvent@@QAE@ABV0@@Z
??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
??0CList@@QAE@ABV0@@Z
??0CList@@QAE@KPAVIMemoryAllocator@@@Z
??0CLockEvent@@QAE@ABV0@@Z
??0CLockEvent@@QAE@XZ
??0CLockList@@QAE@ABV0@@Z
??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QAE@ABV0@@Z
??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
??0CMemoryPoolAllocator@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@XZ
??0CModuleConfigList@@QAE@ABV0@@Z
??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QAE@ABV0@@Z
??0CModuleFileExtConfig@@QAE@KKE@Z
??0CModuleFlagConfig@@QAE@ABV0@@Z
??0CModuleFlagConfig@@QAE@K@Z
??0CModuleMultiStringConfig@@QAE@ABV0@@Z
??0CModuleMultiStringConfig@@QAE@KK@Z
??0CModuleStringConfig@@QAE@ABV0@@Z
??0CModuleStringConfig@@QAE@K@Z
??0CNoLockList@@QAE@ABV0@@Z
??0CNoLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CSmartLock@@QAE@AAVCLockEvent@@@Z
??0CSmartLock@@QAE@XZ
??0CSmartReference@@QAE@AAJ@Z
??0CSmartReference@@QAE@AAK@Z
??0CSmartResource@@QAE@AAVCResource@@E@Z
??0CStrList@@QAE@ABV0@@Z
??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
??0CSystemThread@@QAE@ABV0@@Z
??0CSystemThread@@QAE@K@Z
??0CUserFuncAdapterJob@@QAE@ABV0@@Z
??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z0@Z
??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@E@Z
??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
??0CWorkerThreadJobQueue@@QAE@K@Z
??0CWorkerThreadPool@@QAE@ABV0@@Z
??0CWorkerThreadPool@@QAE@K@Z
??0IMemoryAllocator@@QAE@ABV0@@Z
??0IMemoryAllocator@@QAE@XZ
??1CAutoUpdateConfigThread@@UAE@XZ
??1CBlobConfig@@UAE@XZ
??1CContext@@UAE@XZ
??1CContextList@@UAE@XZ
??1CDebugLog@@UAE@XZ
??1CDelayLoadThread@@UAE@XZ
??1CExclusionExtConfig@@UAE@XZ
??1CExclusionFileNameConfig@@UAE@XZ
??1CExclusionFilePathConfig@@UAE@XZ
??1CExclusionFolderConfig@@UAE@XZ
??1CExclusionRegistryConfig@@UAE@XZ
??1CFile@@UAE@XZ
??1CFileExtension@@UAE@XZ
??1CKEvent@@UAE@XZ
??1CList@@UAE@XZ
??1CLockEvent@@UAE@XZ
??1CLockList@@UAE@XZ
??1CMemoryAllocator@@UAE@XZ
??1CMemoryPoolAllocator@@UAE@XZ
??1CModuleConfig@@UAE@XZ
??1CModuleConfigList@@UAE@XZ
??1CModuleFileExtConfig@@UAE@XZ
??1CModuleFlagConfig@@UAE@XZ
??1CModuleMultiStringConfig@@UAE@XZ
??1CModuleStringConfig@@UAE@XZ
??1CNoLockList@@UAE@XZ
??1CSmartLock@@QAE@XZ
??1CSmartReference@@QAE@XZ
??1CSmartResource@@QAE@XZ
??1CStrList@@UAE@XZ
??1CSystemThread@@UAE@XZ
??1CUserFuncAdapterJob@@UAE@XZ
??1CWorkerThread@@UAE@XZ
??1CWorkerThreadJob@@UAE@XZ
??1CWorkerThreadJobQueue@@UAE@XZ
??1CWorkerThreadPool@@UAE@XZ
??1IMemoryAllocator@@UAE@XZ
??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??2CMemoryAllocator@@SGPAXI@Z
??2CMemoryPoolAllocator@@SGPAXI@Z
??3@YAXPAX@Z
??3IMemoryAllocator@@SGXPAX@Z
??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
??4CBlobConfig@@QAEAAV0@ABV0@@Z
??4CContext@@QAEAAV0@ABV0@@Z
??4CDebugLog@@QAEAAV0@ABV0@@Z
??4CDelayLoadThread@@QAEAAV0@ABV0@@Z
??4CFile@@QAEAAV0@ABV0@@Z
??4CKEvent@@QAEAAV0@ABV0@@Z
??4CLockEvent@@QAEAAV0@ABV0@@Z
??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
??4CModuleConfig@@QAEAAV0@ABV0@@Z
??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
??4CSmartResource@@QAEAAV0@ABV0@@Z
??4CSystemThread@@QAEAAV0@ABV0@@Z
??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
??4CWorkerThread@@QAEAAV0@ABV0@@Z
??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CDelayLoadThread@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CNoLockList@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QAEXXZ
??_FCFile@@QAEXXZ
??_FCFileExtension@@QAEXXZ
??_FCModuleConfigList@@QAEXXZ
??_FCStrList@@QAEXXZ
??_FCSystemThread@@QAEXXZ
??_FCWorkerThread@@QAEXXZ
??_FCWorkerThreadJob@@QAEXXZ
??_FCWorkerThreadJobQueue@@QAEXXZ
??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??_V@YAXPAX@Z
?Acquire@CLockEvent@@QAEXXZ
?Add@CContextList@@QAEEPAVCContext@@@Z
?Add@CFileExtension@@QAEEPBGK@Z
?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
?Add@CStrList@@QAEEPBG@Z
?AddNode@CLockList@@UAEEQAXE@Z
?AddNode@CNoLockList@@UAEEQAXE@Z
?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QAEXXZ
?CheckNode@CLockList@@UAEHQAX@Z
?CheckNode@CNoLockList@@UAEHQAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
?Cleanup@CBlobConfig@@AAEXXZ
?Cleanup@CModuleFileExtConfig@@IAEXXZ
?Cleanup@CModuleMultiStringConfig@@IAEXXZ
?Cleanup@CModuleStringConfig@@AAEXXZ
?Close@CFile@@QAEJXZ
?Count@CLockList@@QAEKXZ
?Count@CNoLockList@@QAEKXZ
?Create@CFile@@QAEJPBGKKKK@Z
?Create@CSystemThread@@QAEEXZ
?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
?CreatePool@CWorkerThreadPool@@QAEEXZ
?CreateThreads@CWorkerThreadPool@@QAEEK@Z
?CreateWIRP@CFile@@QAEJPBGKKKK@Z
?Delete@CFile@@QAEJXZ
?Delete@CFileExtension@@QAEEPBGK@Z
?Delete@CStrList@@QAEEPBG@Z
?DeleteAll@CList@@UAEXXZ
?DeleteAll@CLockList@@UAEXXZ
?DeleteAll@CNoLockList@@UAEXXZ
?DeleteNode@CContextList@@MAEXPAX@Z
?DeleteNode@CList@@UAEXPAX@Z
?DeleteNode@CModuleConfigList@@MAEXPAX@Z
?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YGXPAPAX@Z
?DoIt@CWorkerThreadJob@@QAEJXZ
?EntryPoint@CSystemThread@@KGXPAX@Z
?Find@CContextList@@QAEPAVCContext@@K@Z
?Find@CContextList@@QAEPAVCContext@@PAX@Z
?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FindNode@CContextList@@IAEPAXPAX@Z
?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?First@CList@@UAEPAXXZ
?First@CLockList@@UAEPAXXZ
?First@CNoLockList@@UAEPAXXZ
?Free@CMemoryAllocator@@UAEXPAX@Z
?Free@CMemoryPoolAllocator@@UAEXPAX@Z
?GetAttributes@CFile@@QAEKXZ
?GetBasicInfomration@CFile@@IAEJXZ
?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
?GetCategory@CContext@@QAEKXZ
?GetData@CBlobConfig@@QAEHPAXPAK@Z
?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QAEKXZ
?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
?GetData@CModuleStringConfig@@QAEPAGXZ
?GetData@CStrList@@QAEEPAGPAK@Z
?GetDataType@CModuleConfig@@QAEKXZ
?GetEngineContext@CContext@@QAEPAXXZ
?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UAEJKPAK@Z
?GetID@CModuleConfig@@QAEKXZ
?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QAEKXZ
?GetLinkContext@CContext@@QAEPAXXZ
?GetLogFlag@CDebugLog@@QAEKXZ
?GetModuleId@CModuleConfig@@QAEKXZ
?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QAEKXZ
?GetSize@CBlobConfig@@QAEKXZ
?GetStringConfig@CContext@@QAEPAGK@Z
?GetStringConfig@CContext@@UAEJKPAGPAK@Z
?GetThreadCount@CWorkerThreadPool@@QAEKXZ
?GetThreadID@CSystemThread@@QAEKXZ
?GetType@CContext@@QAEKXZ
?GetUserParameter@CContext@@QAEKXZ
?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
?InitializeFlagConfig@CContext@@QAEHKK@Z
?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
?InitializeStringConfig@CContext@@QAEHKPBG@Z
?Insert@CList@@UAEXQAXE@Z
?Insert@CLockList@@UAEXQAXE@Z
?Insert@CNoLockList@@UAEXQAXE@Z
?InsertAfter@CList@@UAEXPAX0@Z
?InsertBefore@CList@@UAEXPAX0@Z
?Instance@CWorkerThreadPool@@SGPAV1@XZ
?IsEmpty@CList@@UAEEXZ
?IsEmpty@CLockList@@UAEEXZ
?IsEmpty@CNoLockList@@UAEEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
?IsFull@CLockList@@QBEEXZ
?IsFull@CNoLockList@@QBEEXZ
?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
?IsOpened@CFile@@QAEEXZ
?IsTerminated@CWorkerThreadPool@@QAEEXZ
?IsValid@CMemoryAllocator@@UAEEXZ
?IsValid@CMemoryPoolAllocator@@UAEEXZ
?IsValid@IMemoryAllocator@@UAEEXZ
?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
?JobFunction@CUserFuncAdapterJob@@MAEXXZ
?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QAEKXZ
?Limit@CNoLockList@@QAEKXZ
?MatchAllExtensions@CFileExtension@@QAEEXZ
?MatchNoExtensions@CFileExtension@@QAEEXZ
?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
?NeedDelete@CWorkerThreadJob@@QAEEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
?NewNode@CList@@UAEPAXXZ
?NewNode@CStrList@@EAEPAXXZ
?NewNodeVariant@CList@@IAEPAXK@Z
?Next@CList@@UBEPAXQAX@Z
?Next@CLockList@@UBEPAXQAX@Z
?Next@CNoLockList@@UBEPAXQAX@Z
?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
?NotityTerminate@CWorkerThread@@QAEXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
?Pulse@CKEvent@@QAEJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
?Read@CFile@@QAEJPADKPAK@Z
?ReferenceCount@CContext@@QAEAAKXZ
?Release@CLockEvent@@QAEXXZ
?Remove@CContextList@@UAEEQAX@Z
?Remove@CList@@UAEEQAX@Z
?Remove@CLockList@@UAEEQAX@Z
?Remove@CNoLockList@@UAEEQAX@Z
?RemoveHead@CList@@UAEPAXXZ
?RemoveHead@CLockList@@UAEPAXXZ
?RemoveHead@CNoLockList@@UAEPAXXZ
?RemoveTail@CList@@UAEPAXXZ
?RemoveTail@CLockList@@UAEPAXXZ
?RemoveTail@CNoLockList@@UAEPAXXZ
?Reset@CKEvent@@QAEXXZ
?RestoreCR0@@YGXPAX@Z
?Run@CAutoUpdateConfigThread@@UAEXXZ
?Run@CDelayLoadThread@@UAEXXZ
?Run@CWorkerThread@@UAEXXZ
?SeekToEnd@CFile@@QAEJXZ
?Set@CKEvent@@QAEJJE@Z
?SetAttributes@CFile@@QAEJK@Z
?SetBlobCofig@CContext@@UAEJKPAXK@Z
?SetData@CBlobConfig@@QAEHPAXK@Z
?SetData@CModuleFileExtConfig@@QAEHPBG@Z
?SetData@CModuleFlagConfig@@QAEHK@Z
?SetData@CModuleMultiStringConfig@@QAEHPBG@Z
?SetData@CModuleStringConfig@@QAEHPBG@Z
?SetEngineContext@CContext@@QAEXPAX@Z
?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
?SetFlagConfig@CContext@@UAEJKK@Z
?SetLinkContext@CContext@@QAEXPAX@Z
?SetLogFlag@CDebugLog@@QAEEK@Z
?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
?SetMultiStringConfig@CContext@@UAEJKPBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
?SetPriority@CSystemThread@@QAEXK@Z
?SetStopUse@CContext@@QAEXXZ
?SetStringConfig@CContext@@UAEJKPBG@Z
?Setup@CSystemThread@@MAEXXZ
?StopUse@CContext@@QAEHXZ
?TearDown@CSystemThread@@MAEXXZ
?Terminate@CSystemThread@@QAEXE@Z
?Terminate@CWorkerThreadPool@@QAEEXZ
?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QAEXXZ
?WaitForReady@CDelayLoadThread@@QAEEXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
?Write@CDebugLog@@QAAXPBDZZ
?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
?WriteSystemInformation@CDebugLog@@QAEXXZ
?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
?WriteToFile@CDebugLog@@IAEXPADK@Z
?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
?_pPagedAllocator@@3PAVCMemoryAllocator@@A
?m_lpInstance@CWorkerThreadPool@@1PAV1@A
?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
_DeInitKmLPC@0
_GetModuleInfoByAddress@8
_GetModuleInfoByModuleName@8
_InitKmLPC@0
_KmCallUm@8
_KmCallUmEx@12
_ModGetExportProcAddress@8
_ModLoadDLLToBuffer@4
_ModLoadDLLToBufferWithImageSize@8
_ModLoadModule@8
_ModUnLoadModule@4
_NormalizeFileName@4
_NormalizeFullNtPathToDosName@4
_TmCommConfigRoutine@4
_UtilAddDeviceInDriveTable@4
_UtilCleanFileReadOnly@4
_UtilDeleteFileForce@4
_UtilGetFileObjectForProcessByEPROC@8
_UtilGetFileObjectFromFileName@12
_UtilGetProcessName@12
_UtilGetSystemDirectory@4
_UtilGetSystemTime@4
_UtilIoSetFileInfo@24
_UtilIopCreateFileIRP@40
_UtilKeGetLowFileDevice@16
_UtilModuleIATHook@24
_UtilModuleIATUnHook@8
_UtilQueryKeyValue@24
_UtilRemoveDeviceFromDriveTable@4
_UtilVolumeDeviceToDosName@8
_UtilWaitValueChangeToZero@8
_UtilWriteVersionToRegistry@8
_UtilbuildDynamicDiskMappingTable@0
__UtilDosPathNameToNtPathName@12

Sections

Expand

.text
.rdata
.data
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2009-11-01 22:13:22
MD5	dd9596c18818288845423c68f3f39800
SHA1	fb1570b4865083dfce1fcff2bd72e9e1b03cead5
SHA256	3fa6379951f08ed3cb87eeba9cf0c5f5e1d0317dcfcf003b810df9d795eeb73e
Authentihash MD5	ad490c2e1c6e3f31f1cd1073b03bb866
Authentihash SHA1	a2c557dd6ee13783291800be7a6d28af2bc051a4
Authentihash SHA256	5b08743c8e1de8343ab0a0d453ca76487c6a438608c68c2b2921ea2c2a92821c
RichPEHeaderHash MD5	76921aba04baecd2d45f9dfe4dcc990b
RichPEHeaderHash SHA1	67b5d031a35a5f2585df570a51ec645d2afa7d42
RichPEHeaderHash SHA256	6bea33a3d3886f3e61db7639abe45fc5e80ab3d1ee18b40248b0816c17f32433
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	Trend Micro AEGIS
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 3825d7faf861af9ef490e726b5d65ad5

Field	Value
ToBeSigned (TBS) MD5	d6c7684e9aaa508cf268335f83afe040
ToBeSigned (TBS) SHA1	18066d20ad92409c567cdfde745279ff71c75226
ToBeSigned (TBS) SHA256	a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff
Subject	C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2
ValidFrom	2007-06-15 00:00:00
ValidTo	2012-06-14 23:59:59
Signature	50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	3825d7faf861af9ef490e726b5d65ad5
Version	3

Certificate 47bf1995df8d524643f7db6d480d31a4

Field	Value
ToBeSigned (TBS) MD5	518d2ea8a21e879c942d504824ac211c
ToBeSigned (TBS) SHA1	21ce87d827077e61abddf2beba69fde5432ea031
ToBeSigned (TBS) SHA256	1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7
Subject	C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
ValidFrom	2003-12-04 00:00:00
ValidTo	2013-12-03 23:59:59
Signature	4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	47bf1995df8d524643f7db6d480d31a4
Version	3

Certificate 4191a15a3978dfcf496566381d4c75c2

Field	Value
ToBeSigned (TBS) MD5	41011f8d0e7c7a6408334ca387914c61
ToBeSigned (TBS) SHA1	c7fc1727f5b75a6421a1f95c73bbdb23580c48e5
ToBeSigned (TBS) SHA256	88dd3952638ee82738c03168e6fd863fe4eab1059ee5e2926ad8cb587c255dc0
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA
ValidFrom	2004-07-16 00:00:00
ValidTo	2014-07-15 23:59:59
Signature	ae3a17b84a7b55fa6455ec40a4ed494190999c89bcaf2e1dca7823f91c190f7feb68bc32d98838dedc3fd389b43fb18296f1a45abaed2e26d3de7c016e000a00a4069211480940f91c1879672324e0bbd5e150ae1bf50edde02e81cd80a36c524f9175558aba22f2d2ea4175882f63557d1e545a9559cad93481c05f5ef67ab5
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	4191a15a3978dfcf496566381d4c75c2
Version	3

Certificate 645212f783f4d7aba3555729e99ce065

Field	Value
ToBeSigned (TBS) MD5	e00f0a38c65f7c0b9f19b97448d6a0e3
ToBeSigned (TBS) SHA1	91c033a2f289418c4101654dceacef1b25bb55d0
ToBeSigned (TBS) SHA256	38b3fcbdb734b0e3439f3c9a3c4c1712091f577d2b616d41224137faf7ba7c86
Subject	C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, OU=RD, CN=Trend Micro, Inc.
ValidFrom	2008-01-16 00:00:00
ValidTo	2011-02-16 23:59:59
Signature	5a693868cea6ba49064b801a0d9e12887a37cbb92cca2950cc5e99c2df9aec5697422e67cd042836daf09a09e739f625255841fed1ec9657cb8b3edc08c55c302574cbdb3f7de2798ed769d766402619b48041f9d90f8c904488788412b1c632055e1afc4a5bbac642cb626bd20fece0feaa6cf9b287887788cf64586309a14a644b5f0595c0ddcb7d789831faedb48451e40e342da4ccbc38a5e992e57e7ce5328d531a8c68e61f9dc9be65605c1bedf3358579000b91a19b3be388bac36b58ca76b72358bd8e74e0a7b08b0587bb7a29758c01af40b80e8e72c76abd3a2babfe7c1ed6e7b1cd9b0221a605062b6d9d0ceb57e0eb305fdc5eb5bf6ea442f4c9
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	645212f783f4d7aba3555729e99ce065
Version	3

Certificate 610c120600000000001b

Field	Value
ToBeSigned (TBS) MD5	53c41bc1164e09e0cd1617a5bf913efd
ToBeSigned (TBS) SHA1	93c03aac8951d494ecd5696b1c08658541b18727
ToBeSigned (TBS) SHA256	40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b
Subject	C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
ValidFrom	2006-05-23 17:01:29
ValidTo	2016-05-23 17:11:29
Signature	01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	610c120600000000001b
Version	3

Imports

Expand

ntoskrnl.exe
HAL.dll
CLASSPNP.SYS

Imported Functions

Expand

ExReleaseFastMutexUnsafe
wcsncpy
memcpy
wcsrchr
KeSetEvent
KePulseEvent
KeClearEvent
KeInitializeSemaphore
KeWaitForSingleObject
DbgPrint
KeReleaseSemaphore
RtlSubAuthoritySid
RtlInitializeSid
ExAllocatePoolWithTag
RtlLengthRequiredSid
ExFreePoolWithTag
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
ObfDereferenceObject
ZwSetEvent
ZwClose
KeUnstackDetachProcess
ZwRequestWaitReplyPort
memmove
KeStackAttachProcess
ZwConnectPort
RtlInitUnicodeString
ZwCreateSection
ZwWaitForSingleObject
ZwOpenEvent
ObfReferenceObject
IoGetCurrentProcess
memset
MmIsAddressValid
ZwWriteFile
ZwReadFile
ZwQueryInformationFile
ZwSetInformationFile
ZwCreateFile
swprintf
towupper
_wcsnicmp
KeInitializeEvent
_snprintf
PsGetCurrentProcessId
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
ZwCreateKey
ZwCreateEvent
KeWaitForMultipleObjects
ObReferenceObjectByHandle
ZwNotifyChangeKey
PsGetCurrentThreadId
_vsnprintf
KeSetPriorityThread
PsTerminateSystemThread
PsCreateSystemThread
KeNumberProcessors
ZwQuerySystemInformation
ZwQueryDirectoryFile
ZwOpenDirectoryObject
ZwQueryDirectoryObject
ZwDuplicateObject
ZwOpenKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryValueKey
ZwDeleteValueKey
ZwDeleteKey
ExGetPreviousMode
ZwTerminateProcess
ObOpenObjectByPointer
PsProcessType
KeLeaveCriticalRegion
ZwQueryKey
ZwSetValueKey
MmHighestUserAddress
IoFreeIrp
IoFreeMdl
MmUnlockPages
_purecall
ProbeForWrite
_strnicmp
RtlQueryRegistryValues
RtlAppendUnicodeToString
KeDelayExecutionThread
mbstowcs
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
NtClose
ZwSetInformationObject
_stricmp
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwOpenFile
RtlEqualUnicodeString
IoFileObjectType
IoCreateFile
IofCallDriver
IoAllocateIrp
PsGetVersion
MmGetSystemRoutineAddress
RtlCompareMemory
RtlCopyUnicodeString
RtlImageNtHeader
PsLookupProcessByProcessId
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
strrchr
KeBugCheckEx
RtlAppendUnicodeStringToString
IofCompleteRequest
ExEventObjectType
_allmul
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
ProbeForRead
IoGetDeviceObjectPointer
MmBuildMdlForNonPagedPool
IoAllocateMdl
RtlUpperChar
RtlCompareUnicodeString
strncpy
KeServiceDescriptorTable
NtOpenProcess
ObReferenceObjectByPointer
MmSectionObjectType
ObQueryNameString
ObOpenObjectByName
IoDriverObjectType
NtQueryInformationProcess
_snwprintf
ZwAllocateVirtualMemory
ZwFreeVirtualMemory
KeAddSystemServiceTable
ZwQueryObject
ZwQuerySecurityObject
ObInsertObject
_allrem
IoBuildDeviceIoControlRequest
IoReleaseVpbSpinLock
IoAcquireVpbSpinLock
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
_allshr
KeTickCount
RtlUnwind
KeEnterCriticalRegion
ZwOpenProcess
ExAcquireFastMutexUnsafe
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
RtlLengthSid
wcschr
RtlAbsoluteToSelfRelativeSD
IoBuildAsynchronousFsdRequest
KeGetCurrentThread
KfLowerIrql
KeRaiseIrqlToDpcLevel
ClassInitialize

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
??0CBlobConfig@@QAE@ABV0@@Z
??0CBlobConfig@@QAE@K@Z
??0CContext@@QAE@ABV0@@Z
??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QAE@ABV0@@Z
??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
??0CDebugLog@@QAE@ABV0@@Z
??0CDebugLog@@QAE@PBG@Z
??0CExclusionExtConfig@@QAE@ABV0@@Z
??0CExclusionExtConfig@@QAE@KKE@Z
??0CExclusionFileNameConfig@@QAE@ABV0@@Z
??0CExclusionFileNameConfig@@QAE@KK@Z
??0CExclusionFilePathConfig@@QAE@ABV0@@Z
??0CExclusionFilePathConfig@@QAE@KK@Z
??0CExclusionFolderConfig@@QAE@ABV0@@Z
??0CExclusionFolderConfig@@QAE@KK@Z
??0CExclusionRegistryConfig@@QAE@ABV0@@Z
??0CExclusionRegistryConfig@@QAE@KK@Z
??0CFile@@QAE@ABV0@@Z
??0CFile@@QAE@E@Z
??0CFileExtension@@QAE@ABV0@@Z
??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
??0CKEvent@@QAE@ABV0@@Z
??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
??0CList@@QAE@ABV0@@Z
??0CList@@QAE@KPAVIMemoryAllocator@@@Z
??0CLockEvent@@QAE@ABV0@@Z
??0CLockEvent@@QAE@XZ
??0CLockList@@QAE@ABV0@@Z
??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QAE@ABV0@@Z
??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
??0CMemoryPoolAllocator@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@XZ
??0CModuleConfigList@@QAE@ABV0@@Z
??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QAE@ABV0@@Z
??0CModuleFileExtConfig@@QAE@KKE@Z
??0CModuleFlagConfig@@QAE@ABV0@@Z
??0CModuleFlagConfig@@QAE@K@Z
??0CModuleMultiStringConfig@@QAE@ABV0@@Z
??0CModuleMultiStringConfig@@QAE@KK@Z
??0CModuleStringConfig@@QAE@ABV0@@Z
??0CModuleStringConfig@@QAE@K@Z
??0CSmartLock@@QAE@AAVCLockEvent@@@Z
??0CSmartLock@@QAE@XZ
??0CSmartReference@@QAE@AAJ@Z
??0CSmartReference@@QAE@AAK@Z
??0CStrList@@QAE@ABV0@@Z
??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
??0CSystemThread@@QAE@ABV0@@Z
??0CSystemThread@@QAE@K@Z
??0CUserFuncAdapterJob@@QAE@ABV0@@Z
??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z0@Z
??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@E@Z
??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
??0CWorkerThreadJobQueue@@QAE@K@Z
??0CWorkerThreadPool@@QAE@ABV0@@Z
??0CWorkerThreadPool@@QAE@K@Z
??0IMemoryAllocator@@QAE@ABV0@@Z
??0IMemoryAllocator@@QAE@XZ
??1CAutoUpdateConfigThread@@UAE@XZ
??1CBlobConfig@@UAE@XZ
??1CContext@@UAE@XZ
??1CContextList@@UAE@XZ
??1CDebugLog@@UAE@XZ
??1CExclusionExtConfig@@UAE@XZ
??1CExclusionFileNameConfig@@UAE@XZ
??1CExclusionFilePathConfig@@UAE@XZ
??1CExclusionFolderConfig@@UAE@XZ
??1CExclusionRegistryConfig@@UAE@XZ
??1CFile@@UAE@XZ
??1CFileExtension@@UAE@XZ
??1CKEvent@@UAE@XZ
??1CList@@UAE@XZ
??1CLockEvent@@UAE@XZ
??1CLockList@@UAE@XZ
??1CMemoryAllocator@@UAE@XZ
??1CMemoryPoolAllocator@@UAE@XZ
??1CModuleConfig@@UAE@XZ
??1CModuleConfigList@@UAE@XZ
??1CModuleFileExtConfig@@UAE@XZ
??1CModuleFlagConfig@@UAE@XZ
??1CModuleMultiStringConfig@@UAE@XZ
??1CModuleStringConfig@@UAE@XZ
??1CSmartLock@@QAE@XZ
??1CSmartReference@@QAE@XZ
??1CStrList@@UAE@XZ
??1CSystemThread@@UAE@XZ
??1CUserFuncAdapterJob@@UAE@XZ
??1CWorkerThread@@UAE@XZ
??1CWorkerThreadJob@@UAE@XZ
??1CWorkerThreadJobQueue@@UAE@XZ
??1CWorkerThreadPool@@UAE@XZ
??1IMemoryAllocator@@UAE@XZ
??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??2CMemoryAllocator@@SGPAXI@Z
??2CMemoryPoolAllocator@@SGPAXI@Z
??3@YAXPAX@Z
??3IMemoryAllocator@@SGXPAX@Z
??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
??4CBlobConfig@@QAEAAV0@ABV0@@Z
??4CContext@@QAEAAV0@ABV0@@Z
??4CDebugLog@@QAEAAV0@ABV0@@Z
??4CFile@@QAEAAV0@ABV0@@Z
??4CKEvent@@QAEAAV0@ABV0@@Z
??4CLockEvent@@QAEAAV0@ABV0@@Z
??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
??4CModuleConfig@@QAEAAV0@ABV0@@Z
??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
??4CSystemThread@@QAEAAV0@ABV0@@Z
??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
??4CWorkerThread@@QAEAAV0@ABV0@@Z
??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QAEXXZ
??_FCFile@@QAEXXZ
??_FCFileExtension@@QAEXXZ
??_FCModuleConfigList@@QAEXXZ
??_FCStrList@@QAEXXZ
??_FCSystemThread@@QAEXXZ
??_FCWorkerThread@@QAEXXZ
??_FCWorkerThreadJob@@QAEXXZ
??_FCWorkerThreadJobQueue@@QAEXXZ
??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??_V@YAXPAX@Z
?Acquire@CLockEvent@@QAEXXZ
?Add@CContextList@@QAEEPAVCContext@@@Z
?Add@CFileExtension@@QAEEPBGK@Z
?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
?Add@CStrList@@QAEEPBG@Z
?AddNode@CLockList@@UAEEQAXE@Z
?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QAEXXZ
?CheckNode@CLockList@@UAEHQAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
?Cleanup@CBlobConfig@@AAEXXZ
?Cleanup@CModuleFileExtConfig@@IAEXXZ
?Cleanup@CModuleMultiStringConfig@@IAEXXZ
?Cleanup@CModuleStringConfig@@AAEXXZ
?Close@CFile@@QAEJXZ
?Count@CLockList@@QAEKXZ
?Create@CFile@@QAEJPBGKKKK@Z
?Create@CSystemThread@@QAEEXZ
?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
?CreatePool@CWorkerThreadPool@@QAEEXZ
?CreateThreads@CWorkerThreadPool@@QAEEK@Z
?CreateWIRP@CFile@@QAEJPBGKKKK@Z
?Delete@CFile@@QAEJXZ
?Delete@CFileExtension@@QAEEPBGK@Z
?Delete@CStrList@@QAEEPBG@Z
?DeleteAll@CList@@UAEXXZ
?DeleteAll@CLockList@@UAEXXZ
?DeleteNode@CContextList@@MAEXPAX@Z
?DeleteNode@CList@@UAEXPAX@Z
?DeleteNode@CModuleConfigList@@MAEXPAX@Z
?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YGXPAPAX@Z
?DoIt@CWorkerThreadJob@@QAEJXZ
?EntryPoint@CSystemThread@@KGXPAX@Z
?Find@CContextList@@QAEPAVCContext@@K@Z
?Find@CContextList@@QAEPAVCContext@@PAX@Z
?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FindNode@CContextList@@IAEPAXPAX@Z
?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?First@CList@@UAEPAXXZ
?First@CLockList@@UAEPAXXZ
?Free@CMemoryAllocator@@UAEXPAX@Z
?Free@CMemoryPoolAllocator@@UAEXPAX@Z
?GetAttributes@CFile@@QAEKXZ
?GetBasicInfomration@CFile@@IAEJXZ
?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
?GetCategory@CContext@@QAEKXZ
?GetData@CBlobConfig@@QAEHPAXPAK@Z
?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QAEKXZ
?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
?GetData@CModuleStringConfig@@QAEPAGXZ
?GetData@CStrList@@QAEEPAGPAK@Z
?GetDataType@CModuleConfig@@QAEKXZ
?GetEngineContext@CContext@@QAEPAXXZ
?GetFBCallBackRoutine@CContext@@QAEKXZ
?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UAEJKPAK@Z
?GetID@CModuleConfig@@QAEKXZ
?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QAEKXZ
?GetLinkContext@CContext@@QAEPAXXZ
?GetLogFlag@CDebugLog@@QAEKXZ
?GetModuleId@CModuleConfig@@QAEKXZ
?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QAEKXZ
?GetSize@CBlobConfig@@QAEKXZ
?GetStringConfig@CContext@@QAEPAGK@Z
?GetStringConfig@CContext@@UAEJKPAGPAK@Z
?GetThreadCount@CWorkerThreadPool@@QAEKXZ
?GetThreadID@CSystemThread@@QAEKXZ
?GetType@CContext@@QAEKXZ
?GetUserParameter@CContext@@QAEKXZ
?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
?InitializeFlagConfig@CContext@@QAEHKK@Z
?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
?InitializeStringConfig@CContext@@QAEHKPBG@Z
?Insert@CList@@UAEXQAXE@Z
?Insert@CLockList@@UAEXQAXE@Z
?InsertAfter@CList@@UAEXPAX0@Z
?InsertBefore@CList@@UAEXPAX0@Z
?Instance@CWorkerThreadPool@@SGPAV1@XZ
?IsEmpty@CList@@UAEEXZ
?IsEmpty@CLockList@@UAEEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
?IsFull@CLockList@@QBEEXZ
?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
?IsOpened@CFile@@QAEEXZ
?IsTerminated@CWorkerThreadPool@@QAEEXZ
?IsValid@CMemoryAllocator@@UAEEXZ
?IsValid@CMemoryPoolAllocator@@UAEEXZ
?IsValid@IMemoryAllocator@@UAEEXZ
?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
?JobFunction@CUserFuncAdapterJob@@MAEXXZ
?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QAEKXZ
?MatchAllExtensions@CFileExtension@@QAEEXZ
?MatchNoExtensions@CFileExtension@@QAEEXZ
?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
?NeedDelete@CWorkerThreadJob@@QAEEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
?NewNode@CList@@UAEPAXXZ
?NewNode@CStrList@@EAEPAXXZ
?NewNodeVariant@CList@@IAEPAXK@Z
?Next@CList@@UBEPAXQAX@Z
?Next@CLockList@@UBEPAXQAX@Z
?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
?NotityTerminate@CWorkerThread@@QAEXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
?Pulse@CKEvent@@QAEJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
?Read@CFile@@QAEJPADKPAK@Z
?ReferenceCount@CContext@@QAEAAKXZ
?Release@CLockEvent@@QAEXXZ
?Remove@CContextList@@UAEEQAX@Z
?Remove@CList@@UAEEQAX@Z
?Remove@CLockList@@UAEEQAX@Z
?RemoveHead@CList@@UAEPAXXZ
?RemoveHead@CLockList@@UAEPAXXZ
?RemoveTail@CList@@UAEPAXXZ
?RemoveTail@CLockList@@UAEPAXXZ
?Reset@CKEvent@@QAEXXZ
?RestoreCR0@@YGXPAX@Z
?Run@CAutoUpdateConfigThread@@UAEXXZ
?Run@CWorkerThread@@UAEXXZ
?SeekToEnd@CFile@@QAEJXZ
?Set@CKEvent@@QAEJJE@Z
?SetAttributes@CFile@@QAEJK@Z
?SetBlobCofig@CContext@@UAEJKPAXK@Z
?SetData@CBlobConfig@@QAEHPAXK@Z
?SetData@CModuleFileExtConfig@@QAEHPBG@Z
?SetData@CModuleFlagConfig@@QAEHK@Z
?SetData@CModuleMultiStringConfig@@QAEHPBG@Z
?SetData@CModuleStringConfig@@QAEHPBG@Z
?SetEngineContext@CContext@@QAEXPAX@Z
?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
?SetFlagConfig@CContext@@UAEJKK@Z
?SetLinkContext@CContext@@QAEXPAX@Z
?SetLogFlag@CDebugLog@@QAEEK@Z
?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
?SetMultiStringConfig@CContext@@UAEJKPBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
?SetPriority@CSystemThread@@QAEXK@Z
?SetStopUse@CContext@@QAEXXZ
?SetStringConfig@CContext@@UAEJKPBG@Z
?Setup@CSystemThread@@MAEXXZ
?StopUse@CContext@@QAEHXZ
?TearDown@CSystemThread@@MAEXXZ
?Terminate@CSystemThread@@QAEXE@Z
?Terminate@CWorkerThreadPool@@QAEEXZ
?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QAEXXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
?Write@CDebugLog@@QAAXPBDZZ
?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
?WriteSystemInformation@CDebugLog@@QAEXXZ
?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
?WriteToFile@CDebugLog@@IAEXPADK@Z
?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
?_pPagedAllocator@@3PAVCMemoryAllocator@@A
?m_lpInstance@CWorkerThreadPool@@1PAV1@A
?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
_DeInitKmLPC@0
_GetModuleInfoByAddress@8
_GetModuleInfoByModuleName@8
_InitKmLPC@0
_KmCallUm@8
_ModGetExportProcAddress@8
_ModLoadDLLToBuffer@4
_ModLoadModule@8
_ModUnLoadModule@4
_NormalizeFileName@4
_NormalizeFullNtPathToDosName@4
_TmCommConfigRoutine@4
_UtilCleanFileReadOnly@4
_UtilDeleteFileForce@4
_UtilGetFileObjectForProcessByEPROC@8
_UtilGetFileObjectFromFileName@12
_UtilGetProcessName@12
_UtilGetSystemTime@4
_UtilIoSetFileInfo@24
_UtilIopCreateFileIRP@40
_UtilKeGetLowFileDevice@16
_UtilModuleIATHook@24
_UtilModuleIATUnHook@8
_UtilQueryKeyValue@24
_UtilVolumeDeviceToDosName@8
_UtilWaitValueChangeToZero@8
_UtilWriteVersionToRegistry@8
_UtilbuildDynamicDiskMappingTable@0
__UtilDosPathNameToNtPathName@12

Sections

Expand

.text
.rdata
.data
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2019-11-18 03:29:47
MD5	3e796eb95aca7e620d6a0c2118d6871b
SHA1	dc6e62dbde5869a6adc92253fff6326b6af5c8d4
SHA256	478d855b648ef4501d3b08b3b10e94076ac67546b0ce86b454324f1bf9a78aa0
Authentihash MD5	3d01509bec77747dea890e23147245ca
Authentihash SHA1	3dab396397670007e1d04f9497a7d4d6244d0cb7
Authentihash SHA256	c032e2abdf4f07ba42ce4559e6413387becbebb0a43c287b6d367dbb33bde751
RichPEHeaderHash MD5	5b33b237bab6e0b50320054616983177
RichPEHeaderHash SHA1	754c63349a54279bb01f24974f9faf6da8294d27
RichPEHeaderHash SHA256	001d9e469d2c4160f8fbff1c0aee013e72881cffb568910a2c1473a17bf858b2
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	Trend Micro Eyes
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 0ea0fe4dfb74cc64bc32143103c27c8b

Field	Value
ToBeSigned (TBS) MD5	e93e004baa6013b41135ac0648e29d5b
ToBeSigned (TBS) SHA1	dc91e26674d4b627319c700d3ebb1a6cf83d358e
ToBeSigned (TBS) SHA256	0d20335edb166a303411548471bee6f301c8b4f7f7e453d09c15303de2c888d7
Subject	C=TW, L=Taipei, O=Trend Micro, Inc., OU=Taipei, TW, CN=Trend Micro, Inc.
ValidFrom	2019-07-12 00:00:00
ValidTo	2020-07-10 12:00:00
Signature	5c08ae5d586a4751195382d6889dc2fc500e7c39c641e1a58def8d923e12b754e2cc35720cc8d3d29382980debf7d98fcc17d764187126dd07c134fdbb96dd44fe8a40195df6f6acd1881fa5ba2921dadceb3f64422344672834813916bbdf317533cf6aaf3317d78197d7d6c560ad681de135f39e2d4ad345b7fe491162660a5462c6075fd725382df1e6e6bc3a4c443be778f79b07f181082e38150ca28ab932f99e4bc4185dc5b3b6edf22c187fdfd84e23a21e7da1989837f43b89aa172e6b34dbcb297bffd511a1d1c100b25e0e921f622a0845e23317f9fec83659ca21c241800683e0dd66ce4d042a8aefc4142b5923a6fa93ee72c48e8dc04c13b4b0
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	0ea0fe4dfb74cc64bc32143103c27c8b
Version	3

Certificate 61204db4000000000027

Field	Value
ToBeSigned (TBS) MD5	8e3ffc222fbcebdbb8b23115ab259be7
ToBeSigned (TBS) SHA1	ee20bff28ffe13be731c294c90d6ded5aae0ec0e
ToBeSigned (TBS) SHA256	59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821
Subject	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
ValidFrom	2011-04-15 19:45:33
ValidTo	2021-04-15 19:55:33
Signature	208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	61204db4000000000027
Version	3

Certificate 03019a023aff58b16bd6d5eae617f066

Field	Value
ToBeSigned (TBS) MD5	a752afee44f017e8d74e3f3eb7914ae3
ToBeSigned (TBS) SHA1	8eca80a6b80e9c69dcef7745748524afb8019e2d
ToBeSigned (TBS) SHA256	82560fa7efec30b5ff82af643e6f3bf3d46868bbd5e7d76f93db185e9e3553a1
Subject	C=US, O=DigiCert, CN=DigiCert Timestamp Responder
ValidFrom	2014-10-22 00:00:00
ValidTo	2024-10-22 00:00:00
Signature	9d257e1b334db226815c9b86ce23200f8087e588ffffb1d46a2c31ed3a17197117cda91bbc5a1639009de36c84e45a40fbde06018c37fa9bb19d247efe20a457ad5bb79ab06026ea6957215d342f1f71b0839419056b359010a07b97c7f63fe7e21141a6bd62d9f0273d381d286f3a5209f0ec7062d3624bb0e073a692c0d38e31d82fe36d171306eee403b614abf38f43a7719d21dd14ca155d9241daf90f81d199740d26c40e7f1bb5f5a0f1c677062815e9d893e55516f0bb0aab1cdb5c482766c8a38b0a1ce595daaec42e59a061dddaf36da261e98a0b6dec1218bdf755544003922b6bc251c20a48afb0d46ee0f4140a3a1be38f3dcaaf6a8d7bdcd844
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	03019a023aff58b16bd6d5eae617f066
Version	3

Certificate 02c4d1e58a4a680c568da3047e7e4d5f

Field	Value
ToBeSigned (TBS) MD5	829995f702421dea833a24fb2c7f4442
ToBeSigned (TBS) SHA1	1d7e838accd498c2e5ba9373af819ec097bb955c
ToBeSigned (TBS) SHA256	92914d016cc46e125e50c4bd0bd7f72db87eed4ba68f3c589b4e86aa563108db
Subject	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1
ValidFrom	2011-02-11 12:00:00
ValidTo	2026-02-10 12:00:00
Signature	49eb7c60beaeefc97cb3c5ba4b64df1669e286fa29d9de98857d406626332f4455aaaa90e935700a34bed3ae542e8e6500d67a32203e6c26b898a939b1bc95c7aae9f5ee4666c6b3e812f8b3979dff74588234997550ac448fe892ce7d8b0f3196c7dcd31130987416c6e56b4576a39401cd33007a48f66f8631c9562b3322d5f801b644ce8cb4ca88d2e416e3e7f6e23ee109c09d7943437f555c05ad9310c62c0d6bc09eea78e5d277d6b8da9a987fba4c922b9dbda488b1ddafc34cd2979b03c6ae5f1b440f333715e3cbff2f56d316a45b55679da2cadb346c0c734ab57ba4b6b3e935027870ec007acbfc4b4f2236bb1484c98f91dd0f3c758cca0b88e7
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	02c4d1e58a4a680c568da3047e7e4d5f
Version	3

Certificate 06fdf9039603adea000aeb3f27bbba1b

Field	Value
ToBeSigned (TBS) MD5	4e5ad189638cf52ba9cd881d4d44668c
ToBeSigned (TBS) SHA1	cdc115e98d798b33904c820d63cc1e1afc19251d
ToBeSigned (TBS) SHA256	37560fb9d548ab62cc3ed4669a4ab74828b5a108e67e829937ffb2d10a5f78dd
Subject	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID CA,1
ValidFrom	2006-11-10 00:00:00
ValidTo	2021-11-10 00:00:00
Signature	46503ec9b72824a7381db65b29af52cf52e93147ab565c7bd50d0b41b3efec751f7438f2b25c61a29c95c350e482b923d1ba3a8672ad3878ac755d1717347247859456d1ebbb368477cc24a5f3041955a9e7e3e7ab62cdfb8b2d90c2c0d2b594bd5e4fb105d20e3d1aa9145ba6863162a8a833e49b39a7c4f5ce1d7876942573e42aabcf9c764bed5fc24b16e44b704c00891efcc579bc4c1257fe5fe11ebc025da8fefb07384f0dc65d91b90f6745cdd683ede7920d8db1698c4ffb59e0230fd2aaae007cee9c420ecf91d727b716ee0fc3bd7c0aa0ee2c08558522b8eb181a4dfc2a21ad49318347957771dcb11b4b4b1c109c7714c19d4f2f5a9508291026
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	06fdf9039603adea000aeb3f27bbba1b
Version	3

Imports

Expand

ntoskrnl.exe
HAL.dll
CLASSPNP.SYS

Imported Functions

Expand

KePulseEvent
KeClearEvent
KeStackAttachProcess
KeUnstackDetachProcess
ObfDereferenceObject
ZwSetEvent
ZwClose
ZwConnectPort
RtlInitUnicodeString
RtlUnicodeStringToInteger
ZwCreateSection
ZwWaitForSingleObject
ZwOpenEvent
IoGetCurrentProcess
ObfReferenceObject
DbgBreakPoint
ZwRequestWaitReplyPort
ExFreePoolWithTag
ProbeForWrite
ZwFreeVirtualMemory
ZwAllocateVirtualMemory
ObOpenObjectByPointer
PsProcessType
memmove
PsGetProcessExitTime
MmSectionObjectType
PsThreadType
MmGetSystemRoutineAddress
ObReleaseObjectSecurity
SeReleaseSubjectContext
SeAccessCheck
SeCaptureSubjectContext
ObGetObjectSecurity
DbgPrint
memset
MmIsAddressValid
ExInitializeResourceLite
ExDeleteResourceLite
ZwWriteFile
ZwReadFile
ZwQueryInformationFile
ZwSetInformationFile
ZwCreateFile
swprintf
towupper
_wcsnicmp
ExAllocatePoolWithTag
KeInitializeEvent
_snprintf
PsGetCurrentProcessId
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
PsGetCurrentThreadId
RtlInitAnsiString
ZwDeviceIoControlFile
ZwCreateKey
ZwCreateEvent
KeWaitForMultipleObjects
ObReferenceObjectByHandle
ZwNotifyChangeKey
_vsnprintf
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlEqualUnicodeString
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
RtlUpcaseUnicodeChar
ExGetPreviousMode
KeWaitForSingleObject
KeSetPriorityThread
PsTerminateSystemThread
PsCreateSystemThread
KeDelayExecutionThread
KeNumberProcessors
ZwQueryInformationProcess
PsLookupProcessByProcessId
ZwOpenDirectoryObject
PsSetCreateProcessNotifyRoutine
ZwQuerySystemInformation
ZwQueryDirectoryFile
ZwQueryDirectoryObject
ZwDuplicateObject
ZwOpenKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryValueKey
ZwDeleteValueKey
ZwDeleteKey
ZwTerminateProcess
ZwOpenProcess
ZwQueryKey
ZwSetValueKey
IoFileObjectType
_allrem
KeSetEvent
ZwSetSecurityObject
RtlLengthSecurityDescriptor
MmHighestUserAddress
IoFreeIrp
_purecall
MmUnlockPages
IoBuildAsynchronousFsdRequest
_strnicmp
RtlQueryRegistryValues
RtlAppendUnicodeToString
mbstowcs
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
NtClose
ObQueryNameString
ZwSetInformationObject
_stricmp
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwOpenFile
IoCreateFile
IofCallDriver
IoAllocateIrp
MmBuildMdlForNonPagedPool
IoAllocateMdl
ProbeForRead
PsGetVersion
RtlImageNtHeader
RtlCompareMemory
RtlUpcaseUnicodeString
_snwprintf
MmSystemRangeStart
wcsncmp
RtlCompareUnicodeString
strrchr
ZwQueryVolumeInformationFile
ObReferenceObjectByPointer
IoBuildDeviceIoControlRequest
ZwOpenSection
_allmul
KeReleaseSemaphore
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
KeInitializeSemaphore
IoGetDeviceObjectPointer
IofCompleteRequest
ExEventObjectType
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
RtlUpperChar
ObReferenceObjectByName
IoDriverObjectType
strncpy
KeServiceDescriptorTable
NtOpenProcess
ObOpenObjectByName
NtQueryInformationProcess
PsIsThreadTerminating
KeAddSystemServiceTable
ZwQueryObject
ZwFsControlFile
ObInsertObject
IoReleaseVpbSpinLock
IoAcquireVpbSpinLock
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
_allshr
ExInterlockedPopEntrySList
IoGetStackLimits
IoBuildSynchronousFsdRequest
wcsstr
IoUnregisterPlugPlayNotification
FsRtlIsNameInExpression
IoGetConfigurationInformation
MmProbeAndLockPages
IoGetDeviceInterfaces
IoRegisterPlugPlayNotification
ExAllocatePool
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
strncat
wcschr
wcsncat
wcstombs
KeTickCount
KeBugCheckEx
RtlUnwind
wcsrchr
memcpy
wcsncpy
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
ExAcquireResourceSharedLite
ExReleaseFastMutexUnsafe
KeLeaveCriticalRegion
KeEnterCriticalRegion
ZwQuerySecurityObject
ExAcquireFastMutexUnsafe
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
RtlLengthSid
RtlAbsoluteToSelfRelativeSD
IoFreeMdl
KeGetCurrentThread
KfAcquireSpinLock
KfReleaseSpinLock
KeRaiseIrqlToDpcLevel
KfLowerIrql
KeAcquireQueuedSpinLock
KeReleaseQueuedSpinLock
ExAcquireFastMutex
ExReleaseFastMutex
KeGetCurrentIrql
KfRaiseIrql
ClassInitialize

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
??0CBlobConfig@@QAE@ABV0@@Z
??0CBlobConfig@@QAE@K@Z
??0CContext@@QAE@ABV0@@Z
??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QAE@ABV0@@Z
??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
??0CDebugLog@@QAE@ABV0@@Z
??0CDebugLog@@QAE@PBG@Z
??0CDebugLogEx@@QAE@ABV0@@Z
??0CDebugLogEx@@QAE@K@Z
??0CDelayLoadThread@@QAE@ABV0@@Z
??0CDelayLoadThread@@QAE@XZ
??0CExclusionExtConfig@@QAE@ABV0@@Z
??0CExclusionExtConfig@@QAE@KKE@Z
??0CExclusionFileNameConfig@@QAE@ABV0@@Z
??0CExclusionFileNameConfig@@QAE@KK@Z
??0CExclusionFilePathConfig@@QAE@ABV0@@Z
??0CExclusionFilePathConfig@@QAE@KK@Z
??0CExclusionFolderConfig@@QAE@ABV0@@Z
??0CExclusionFolderConfig@@QAE@KK@Z
??0CExclusionRegistryConfig@@QAE@ABV0@@Z
??0CExclusionRegistryConfig@@QAE@KK@Z
??0CFile@@QAE@ABV0@@Z
??0CFile@@QAE@E@Z
??0CFileExtension@@QAE@ABV0@@Z
??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
??0CInclusionExtConfig@@QAE@ABV0@@Z
??0CInclusionExtConfig@@QAE@KKE@Z
??0CInclusionFileNameConfig@@QAE@ABV0@@Z
??0CInclusionFileNameConfig@@QAE@KK@Z
??0CInclusionFilePathConfig@@QAE@ABV0@@Z
??0CInclusionFilePathConfig@@QAE@KK@Z
??0CInclusionFolderConfig@@QAE@ABV0@@Z
??0CInclusionFolderConfig@@QAE@KK@Z
??0CKEvent@@QAE@ABV0@@Z
??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
??0CList@@QAE@ABV0@@Z
??0CList@@QAE@KPAVIMemoryAllocator@@@Z
??0CLockEvent@@QAE@ABV0@@Z
??0CLockEvent@@QAE@XZ
??0CLockList@@QAE@ABV0@@Z
??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QAE@ABV0@@Z
??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
??0CMemoryPoolAllocator@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@XZ
??0CModuleConfigList@@QAE@ABV0@@Z
??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QAE@ABV0@@Z
??0CModuleFileExtConfig@@QAE@KKE@Z
??0CModuleFlagConfig@@QAE@ABV0@@Z
??0CModuleFlagConfig@@QAE@K@Z
??0CModuleMultiStringConfig@@QAE@ABV0@@Z
??0CModuleMultiStringConfig@@QAE@KK@Z
??0CModuleStringConfig@@QAE@ABV0@@Z
??0CModuleStringConfig@@QAE@K@Z
??0CNoLockList@@QAE@ABV0@@Z
??0CNoLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CSmartLock@@QAE@AAVCLockEvent@@@Z
??0CSmartLock@@QAE@XZ
??0CSmartReference@@QAE@AAJ@Z
??0CSmartReference@@QAE@AAK@Z
??0CSmartResource@@QAE@AAVCResource@@E@Z
??0CStrList@@QAE@ABV0@@Z
??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
??0CSystemThread@@QAE@ABV0@@Z
??0CSystemThread@@QAE@K@Z
??0CUserFuncAdapterJob@@QAE@ABV0@@Z
??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z01@Z
??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@E@Z
??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
??0CWorkerThreadJobQueue@@QAE@K@Z
??0CWorkerThreadPool@@QAE@ABV0@@Z
??0CWorkerThreadPool@@QAE@K@Z
??0CWorkerThreadPoolEx@@QAE@ABV0@@Z
??0CWorkerThreadPoolEx@@QAE@KK@Z
??0IMemoryAllocator@@QAE@ABV0@@Z
??0IMemoryAllocator@@QAE@XZ
??1CAutoUpdateConfigThread@@UAE@XZ
??1CBlobConfig@@UAE@XZ
??1CContext@@UAE@XZ
??1CContextList@@UAE@XZ
??1CDebugLog@@UAE@XZ
??1CDebugLogEx@@UAE@XZ
??1CDelayLoadThread@@UAE@XZ
??1CExclusionExtConfig@@UAE@XZ
??1CExclusionFileNameConfig@@UAE@XZ
??1CExclusionFilePathConfig@@UAE@XZ
??1CExclusionFolderConfig@@UAE@XZ
??1CExclusionRegistryConfig@@UAE@XZ
??1CFile@@UAE@XZ
??1CFileExtension@@UAE@XZ
??1CInclusionExtConfig@@UAE@XZ
??1CInclusionFileNameConfig@@UAE@XZ
??1CInclusionFilePathConfig@@UAE@XZ
??1CInclusionFolderConfig@@UAE@XZ
??1CKEvent@@UAE@XZ
??1CList@@UAE@XZ
??1CLockEvent@@UAE@XZ
??1CLockList@@UAE@XZ
??1CMemoryAllocator@@UAE@XZ
??1CMemoryPoolAllocator@@UAE@XZ
??1CModuleConfig@@UAE@XZ
??1CModuleConfigList@@UAE@XZ
??1CModuleFileExtConfig@@UAE@XZ
??1CModuleFlagConfig@@UAE@XZ
??1CModuleMultiStringConfig@@UAE@XZ
??1CModuleStringConfig@@UAE@XZ
??1CNoLockList@@UAE@XZ
??1CSmartLock@@QAE@XZ
??1CSmartReference@@QAE@XZ
??1CSmartResource@@QAE@XZ
??1CStrList@@UAE@XZ
??1CSystemThread@@UAE@XZ
??1CUserFuncAdapterJob@@UAE@XZ
??1CWorkerThread@@UAE@XZ
??1CWorkerThreadJob@@UAE@XZ
??1CWorkerThreadJobQueue@@UAE@XZ
??1CWorkerThreadPool@@UAE@XZ
??1CWorkerThreadPoolEx@@UAE@XZ
??1IMemoryAllocator@@UAE@XZ
??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??2CMemoryAllocator@@SGPAXI@Z
??2CMemoryPoolAllocator@@SGPAXI@Z
??3@YAXPAX@Z
??3IMemoryAllocator@@SGXPAX@Z
??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
??4CBlobConfig@@QAEAAV0@ABV0@@Z
??4CContext@@QAEAAV0@ABV0@@Z
??4CDebugLog@@QAEAAV0@ABV0@@Z
??4CDebugLogEx@@QAEAAV0@ABV0@@Z
??4CDelayLoadThread@@QAEAAV0@ABV0@@Z
??4CFile@@QAEAAV0@ABV0@@Z
??4CKEvent@@QAEAAV0@ABV0@@Z
??4CLockEvent@@QAEAAV0@ABV0@@Z
??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
??4CModuleConfig@@QAEAAV0@ABV0@@Z
??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
??4CSmartResource@@QAEAAV0@ABV0@@Z
??4CSystemThread@@QAEAAV0@ABV0@@Z
??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
??4CWorkerThread@@QAEAAV0@ABV0@@Z
??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CDebugLogEx@@6B@
??_7CDelayLoadThread@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CInclusionExtConfig@@6B@
??_7CInclusionFileNameConfig@@6B@
??_7CInclusionFilePathConfig@@6B@
??_7CInclusionFolderConfig@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CNoLockList@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7CWorkerThreadPoolEx@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QAEXXZ
??_FCFile@@QAEXXZ
??_FCFileExtension@@QAEXXZ
??_FCModuleConfigList@@QAEXXZ
??_FCStrList@@QAEXXZ
??_FCSystemThread@@QAEXXZ
??_FCWorkerThread@@QAEXXZ
??_FCWorkerThreadJob@@QAEXXZ
??_FCWorkerThreadJobQueue@@QAEXXZ
??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??_V@YAXPAX@Z
?Acquire@CLockEvent@@QAEXXZ
?Add@CContextList@@QAEEPAVCContext@@@Z
?Add@CFileExtension@@QAEEPBGK@Z
?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
?Add@CStrList@@QAEEPBG@Z
?AddNode@CLockList@@UAEEQAXE@Z
?AddNode@CNoLockList@@UAEEQAXE@Z
?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QAEXXZ
?CheckNode@CLockList@@UAEHQAX@Z
?CheckNode@CNoLockList@@UAEHQAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
?Cleanup@CBlobConfig@@AAEXXZ
?Cleanup@CModuleFileExtConfig@@IAEXXZ
?Cleanup@CModuleMultiStringConfig@@IAEXXZ
?Cleanup@CModuleStringConfig@@AAEXXZ
?Close@CFile@@QAEJXZ
?Count@CLockList@@QAEKXZ
?Count@CNoLockList@@QAEKXZ
?Create@CFile@@QAEJPBGKKKK@Z
?Create@CSystemThread@@QAEEXZ
?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
?CreatePool@CWorkerThreadPool@@QAEEXZ
?CreatePool@CWorkerThreadPoolEx@@QAEEXZ
?CreateThreads@CWorkerThreadPool@@QAEEK@Z
?CreateThreads@CWorkerThreadPoolEx@@QAEEK@Z
?CreateWIRP@CFile@@QAEJPBGKKKK@Z
?Delete@CFile@@QAEJXZ
?Delete@CFileExtension@@QAEEPBGK@Z
?Delete@CStrList@@QAEEPBG@Z
?DeleteAll@CList@@UAEXXZ
?DeleteAll@CLockList@@UAEXXZ
?DeleteAll@CNoLockList@@UAEXXZ
?DeleteNode@CContextList@@MAEXPAX@Z
?DeleteNode@CList@@UAEXPAX@Z
?DeleteNode@CModuleConfigList@@MAEXPAX@Z
?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YGXPAPAX@Z
?DoIt@CWorkerThreadJob@@QAEJXZ
?EntryPoint@CSystemThread@@KGXPAX@Z
?Find@CContextList@@QAEPAVCContext@@K@Z
?Find@CContextList@@QAEPAVCContext@@PAX@Z
?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FindNode@CContextList@@IAEPAXPAX@Z
?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FinishFunction@CUserFuncAdapterJob@@MAEXXZ
?FinishIt@CWorkerThreadJob@@QAEJXZ
?First@CList@@UAEPAXXZ
?First@CLockList@@UAEPAXXZ
?First@CNoLockList@@UAEPAXXZ
?Free@CMemoryAllocator@@UAEXPAX@Z
?Free@CMemoryPoolAllocator@@UAEXPAX@Z
?GetAttributes@CFile@@QAEKXZ
?GetBasicInfomration@CFile@@IAEJXZ
?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
?GetCategory@CContext@@QAEKXZ
?GetData@CBlobConfig@@QAEHPAXPAK@Z
?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QAEKXZ
?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
?GetData@CModuleStringConfig@@QAEPAGXZ
?GetData@CStrList@@QAEEPAGPAK@Z
?GetDataType@CModuleConfig@@QAEKXZ
?GetEngineContext@CContext@@QAEPAXXZ
?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFileSizeWIRP@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UAEJKPAK@Z
?GetID@CModuleConfig@@QAEKXZ
?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QAEKXZ
?GetLinkContext@CContext@@QAEPAXXZ
?GetLogFlag@CDebugLog@@QAEKXZ
?GetLogFlag@CDebugLogEx@@QAEKXZ
?GetModuleId@CModuleConfig@@QAEKXZ
?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_KTHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_KTHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QAEKXZ
?GetSize@CBlobConfig@@QAEKXZ
?GetStringConfig@CContext@@QAEPAGK@Z
?GetStringConfig@CContext@@UAEJKPAGPAK@Z
?GetThreadCount@CWorkerThreadPool@@QAEKXZ
?GetThreadCount@CWorkerThreadPoolEx@@QAEKXZ
?GetThreadID@CSystemThread@@QAEKXZ
?GetType@CContext@@QAEKXZ
?GetUserParameter@CContext@@QAEKXZ
?InitProcMon@CDebugLogEx@@IAEXXZ
?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
?InitializeFlagConfig@CContext@@QAEHKK@Z
?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
?InitializeStringConfig@CContext@@QAEHKPBG@Z
?Insert@CList@@UAEXQAXE@Z
?Insert@CLockList@@UAEXQAXE@Z
?Insert@CNoLockList@@UAEXQAXE@Z
?InsertAfter@CList@@UAEXPAX0@Z
?InsertBefore@CList@@UAEXPAX0@Z
?Instance@CWorkerThreadPool@@SGPAV1@XZ
?IsEmpty@CList@@UAEEXZ
?IsEmpty@CLockList@@UAEEXZ
?IsEmpty@CNoLockList@@UAEEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
?IsFull@CLockList@@QBEEXZ
?IsFull@CNoLockList@@QBEEXZ
?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionExtConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFileNameConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFilePathConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFolderConfig@@QAEEPBG@Z
?IsOpened@CFile@@QAEEXZ
?IsTerminated@CWorkerThreadPool@@QAEEXZ
?IsTerminated@CWorkerThreadPoolEx@@QAEEXZ
?IsValid@CMemoryAllocator@@UAEEXZ
?IsValid@CMemoryPoolAllocator@@UAEEXZ
?IsValid@IMemoryAllocator@@UAEEXZ
?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
?IsWorkerThread@CWorkerThreadPoolEx@@QAEEK@Z
?JobFunction@CUserFuncAdapterJob@@MAEXXZ
?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
?JobQueue@CWorkerThreadPoolEx@@QAEAAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QAEKXZ
?Limit@CNoLockList@@QAEKXZ
?MatchAllExtensions@CFileExtension@@QAEEXZ
?MatchNoExtensions@CFileExtension@@QAEEXZ
?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
?NeedDelete@CWorkerThreadJob@@QAEEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
?NewNode@CList@@UAEPAXXZ
?NewNode@CStrList@@EAEPAXXZ
?NewNodeVariant@CList@@IAEPAXK@Z
?Next@CList@@UBEPAXQAX@Z
?Next@CLockList@@UBEPAXQAX@Z
?Next@CNoLockList@@UBEPAXQAX@Z
?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
?NotityTerminate@CWorkerThread@@QAEXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
?PostJobToWorkerThread@CWorkerThreadPoolEx@@QAEJP6GXPAX@Z0E1@Z
?Pulse@CKEvent@@QAEJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPoolEx@@QAEJPAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
?Read@CFile@@QAEJPADKPAK@Z
?ReadWIRP@CFile@@QAEJPADKPAK@Z
?ReferenceCount@CContext@@QAEAAKXZ
?Release@CLockEvent@@QAEXXZ
?Remove@CContextList@@UAEEQAX@Z
?Remove@CList@@UAEEQAX@Z
?Remove@CLockList@@UAEEQAX@Z
?Remove@CNoLockList@@UAEEQAX@Z
?RemoveHead@CList@@UAEPAXXZ
?RemoveHead@CLockList@@UAEPAXXZ
?RemoveHead@CNoLockList@@UAEPAXXZ
?RemoveTail@CList@@UAEPAXXZ
?RemoveTail@CLockList@@UAEPAXXZ
?RemoveTail@CNoLockList@@UAEPAXXZ
?Reset@CKEvent@@QAEXXZ
?ResetData@CInclusionExtConfig@@QAEXXZ
?ResetData@CInclusionFileNameConfig@@QAEXXZ
?ResetData@CInclusionFilePathConfig@@QAEXXZ
?ResetData@CInclusionFolderConfig@@QAEXXZ
?RestoreCR0@@YGXPAX@Z
?Run@CAutoUpdateConfigThread@@UAEXXZ
?Run@CDelayLoadThread@@UAEXXZ
?Run@CWorkerThread@@UAEXXZ
?SeekToEnd@CFile@@QAEJXZ
?Set@CKEvent@@QAEJJE@Z
?SetAttributes@CFile@@QAEJK@Z
?SetBlobCofig@CContext@@UAEJKPAXK@Z
?SetData@CBlobConfig@@QAEHPAXK@Z
?SetData@CModuleFileExtConfig@@QAEHPBG@Z
?SetData@CModuleFlagConfig@@QAEHK@Z
?SetData@CModuleMultiStringConfig@@QAEHPBGK@Z
?SetData@CModuleStringConfig@@QAEHPBG@Z
?SetEngineContext@CContext@@QAEXPAX@Z
?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
?SetFlagConfig@CContext@@UAEJKK@Z
?SetLinkContext@CContext@@QAEXPAX@Z
?SetLogFlag@CDebugLog@@QAEEK@Z
?SetLogFlag@CDebugLogEx@@QAEEK@Z
?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
?SetMultiStringConfig@CContext@@UAEJKPBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
?SetPriority@CSystemThread@@QAEXK@Z
?SetStopUse@CContext@@QAEXXZ
?SetStringConfig@CContext@@UAEJKPBG@Z
?Setup@CSystemThread@@MAEXXZ
?StopUse@CContext@@QAEHXZ
?TearDown@CSystemThread@@MAEXXZ
?Terminate@CSystemThread@@QAEXE@Z
?Terminate@CWorkerThreadPool@@QAEEXZ
?Terminate@CWorkerThreadPoolEx@@QAEEXZ
?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QAEXXZ
?WaitForInit@CDelayLoadThread@@QAEEXZ
?WaitForLoad@CDelayLoadThread@@QAEEXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
?WaitQueueEmpty@CWorkerThreadJobQueue@@QAEXXZ
?Write@CDebugLog@@QAAXPBDZZ
?Write@CDebugLogEx@@QAAXPBDZZ
?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
?WriteDataToFile@CDebugLogEx@@IAEXPADK@Z
?WriteDataToProcMonW@CDebugLogEx@@IAEXPAD@Z
?WriteSystemInformation@CDebugLog@@QAEXXZ
?WriteSystemInformation@CDebugLogEx@@QAEXXZ
?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
?WriteSystemStringInformation@CDebugLogEx@@IAEXPBG@Z
?WriteToFile@CDebugLog@@IAEXPADK@Z
?WriteToProcMonW@CDebugLogEx@@IAEXPAU_UNICODE_STRING@@@Z
?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
?_pPagedAllocator@@3PAVCMemoryAllocator@@A
?m_lpInstance@CWorkerThreadPool@@1PAV1@A
?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
_DeInitKm2UmCommunication@0
_DeInitKmLPC@0
_DuplicateFullFileName@4
_FreeFullFileName@4
_GetFileVersionOfNtoskrnl@16
_GetKm2UmMode@0
_GetModuleInfoByAddress@8
_GetModuleInfoByModuleName@8
_InitKm2UmCommunication@8
_InitKmLPC@0
_IsVerifierCodeCheckFlagOn@0
_IsWindows8_1_update@4
_KmCallUm@8
_KmCallUmByLPC@8
_KmCallUmEx@12
_KmCleanupCommPortAPIs@0
_KmGetUmInitProcess@0
_KmSetCommPortAPIs@4
_ModGetExportProcAddress@8
_ModLoadDLLToBuffer@4
_ModLoadDLLToBufferWithImageSize@8
_ModLoadModule@8
_ModUnLoadModule@4
_NormalizeFileName@4
_NormalizeFullNtPathToDosName@4
_TmCommConfigRoutine@4
_UtilAddDeviceInDriveTable@4
_UtilAddReparsePointMapping@8
_UtilCleanFileReadOnly@4
_UtilCloseExclusiveHandle@12
_UtilCreateDosFileName@8
_UtilDeleteFileForce@4
_UtilGetDeviceObjectName@8
_UtilGetFileNameFromFileObject@4
_UtilGetFileObjectForProcessByEPROC@8
_UtilGetFileObjectFromFileName@12
_UtilGetProcessName@12
_UtilGetSystemDirectory@4
_UtilGetSystemDirectoryEx@0
_UtilGetSystemDirectoryLength@0
_UtilGetSystemTime@4
_UtilIoSetFileInfo@24
_UtilIopCreateFileIRP@40
_UtilKeGetLowFileDevice@16
_UtilModuleIATHook@24
_UtilModuleIATUnHook@8
_UtilPostJobToWorkerThread@12
_UtilQueryExclusiveHandle@12
_UtilQueryKeyValue@24
_UtilRemoveDeviceFromDriveTable@4
_UtilVolumeDeviceToDosName@8
_UtilWaitValueChangeToZero@8
_UtilWriteVersionToRegistry@8
_UtilbuildDynamicDiskMappingTable@0
_UtlWriteBinValueKeyToRegistry@16
_ValidateAddressWithSize@20
__ResetProtectFromClose@4
__UtilDosPathNameToNtPathName@12

Sections

Expand

.text
.rdata
.data
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2010-02-08 02:56:46
MD5	f4b7b84a6828d2f9205b55cf8cfc7742
SHA1	e835776e0dc68c994dd18e8628454520156c93e3
SHA256	4bc0921ffd4acc865525d3faf98961e8decc5aec4974552cbbf2ae8d5a569de4
Authentihash MD5	0fe42b5332d879959e93066779cac8e5
Authentihash SHA1	06c69146793ba18827da747ce0f0a5a13cc4399f
Authentihash SHA256	1f642b5e76572b80684d15bf48bb6e2b6d2743171280ab50502284808a515904
RichPEHeaderHash MD5	df8a25ecde66c4d7d7b6be099c7b9b67
RichPEHeaderHash SHA1	c723f9aa149d1ded440fe119ee6dccabdb9f5c1c
RichPEHeaderHash SHA256	353de968d66434d82e17dad93d2565f57228bd75935707cf356b3a1cc6e55df2
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	Trend Micro AEGIS
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 3825d7faf861af9ef490e726b5d65ad5

Field	Value
ToBeSigned (TBS) MD5	d6c7684e9aaa508cf268335f83afe040
ToBeSigned (TBS) SHA1	18066d20ad92409c567cdfde745279ff71c75226
ToBeSigned (TBS) SHA256	a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff
Subject	C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2
ValidFrom	2007-06-15 00:00:00
ValidTo	2012-06-14 23:59:59
Signature	50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	3825d7faf861af9ef490e726b5d65ad5
Version	3

Certificate 47bf1995df8d524643f7db6d480d31a4

Field	Value
ToBeSigned (TBS) MD5	518d2ea8a21e879c942d504824ac211c
ToBeSigned (TBS) SHA1	21ce87d827077e61abddf2beba69fde5432ea031
ToBeSigned (TBS) SHA256	1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7
Subject	C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
ValidFrom	2003-12-04 00:00:00
ValidTo	2013-12-03 23:59:59
Signature	4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	47bf1995df8d524643f7db6d480d31a4
Version	3

Certificate 4191a15a3978dfcf496566381d4c75c2

Field	Value
ToBeSigned (TBS) MD5	41011f8d0e7c7a6408334ca387914c61
ToBeSigned (TBS) SHA1	c7fc1727f5b75a6421a1f95c73bbdb23580c48e5
ToBeSigned (TBS) SHA256	88dd3952638ee82738c03168e6fd863fe4eab1059ee5e2926ad8cb587c255dc0
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA
ValidFrom	2004-07-16 00:00:00
ValidTo	2014-07-15 23:59:59
Signature	ae3a17b84a7b55fa6455ec40a4ed494190999c89bcaf2e1dca7823f91c190f7feb68bc32d98838dedc3fd389b43fb18296f1a45abaed2e26d3de7c016e000a00a4069211480940f91c1879672324e0bbd5e150ae1bf50edde02e81cd80a36c524f9175558aba22f2d2ea4175882f63557d1e545a9559cad93481c05f5ef67ab5
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	4191a15a3978dfcf496566381d4c75c2
Version	3

Certificate 645212f783f4d7aba3555729e99ce065

Field	Value
ToBeSigned (TBS) MD5	e00f0a38c65f7c0b9f19b97448d6a0e3
ToBeSigned (TBS) SHA1	91c033a2f289418c4101654dceacef1b25bb55d0
ToBeSigned (TBS) SHA256	38b3fcbdb734b0e3439f3c9a3c4c1712091f577d2b616d41224137faf7ba7c86
Subject	C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, OU=RD, CN=Trend Micro, Inc.
ValidFrom	2008-01-16 00:00:00
ValidTo	2011-02-16 23:59:59
Signature	5a693868cea6ba49064b801a0d9e12887a37cbb92cca2950cc5e99c2df9aec5697422e67cd042836daf09a09e739f625255841fed1ec9657cb8b3edc08c55c302574cbdb3f7de2798ed769d766402619b48041f9d90f8c904488788412b1c632055e1afc4a5bbac642cb626bd20fece0feaa6cf9b287887788cf64586309a14a644b5f0595c0ddcb7d789831faedb48451e40e342da4ccbc38a5e992e57e7ce5328d531a8c68e61f9dc9be65605c1bedf3358579000b91a19b3be388bac36b58ca76b72358bd8e74e0a7b08b0587bb7a29758c01af40b80e8e72c76abd3a2babfe7c1ed6e7b1cd9b0221a605062b6d9d0ceb57e0eb305fdc5eb5bf6ea442f4c9
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	645212f783f4d7aba3555729e99ce065
Version	3

Certificate 610c120600000000001b

Field	Value
ToBeSigned (TBS) MD5	53c41bc1164e09e0cd1617a5bf913efd
ToBeSigned (TBS) SHA1	93c03aac8951d494ecd5696b1c08658541b18727
ToBeSigned (TBS) SHA256	40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b
Subject	C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
ValidFrom	2006-05-23 17:01:29
ValidTo	2016-05-23 17:11:29
Signature	01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	610c120600000000001b
Version	3

Imports

Expand

ntoskrnl.exe
HAL.dll
CLASSPNP.SYS

Imported Functions

Expand

ExReleaseFastMutexUnsafe
wcsncpy
memcpy
wcsrchr
KeSetEvent
KePulseEvent
KeClearEvent
KeInitializeSemaphore
KeWaitForSingleObject
KeReleaseSemaphore
KeStackAttachProcess
KeUnstackDetachProcess
RtlSubAuthoritySid
RtlInitializeSid
ExAllocatePoolWithTag
RtlLengthRequiredSid
ExFreePoolWithTag
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
ObfDereferenceObject
ZwSetEvent
ZwClose
ZwRequestWaitReplyPort
ProbeForWrite
ZwFreeVirtualMemory
ZwAllocateVirtualMemory
ObOpenObjectByPointer
PsProcessType
memmove
ZwConnectPort
RtlInitUnicodeString
RtlUnicodeStringToInteger
ZwCreateSection
ZwWaitForSingleObject
ZwOpenEvent
ObfReferenceObject
IoGetCurrentProcess
PsGetProcessExitTime
DbgPrint
memset
MmIsAddressValid
ZwWriteFile
ZwReadFile
ZwQueryInformationFile
ZwSetInformationFile
ZwCreateFile
swprintf
towupper
_wcsnicmp
KeInitializeEvent
_snprintf
PsGetCurrentProcessId
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
ZwCreateKey
ZwCreateEvent
KeWaitForMultipleObjects
ObReferenceObjectByHandle
ZwNotifyChangeKey
PsGetCurrentThreadId
_vsnprintf
MmMapLockedPagesSpecifyCache
MmBuildMdlForNonPagedPool
MmCreateMdl
MmUnmapLockedPages
KeSetPriorityThread
PsTerminateSystemThread
PsCreateSystemThread
KeNumberProcessors
ZwQuerySystemInformation
ZwQueryDirectoryFile
ZwOpenDirectoryObject
ZwQueryDirectoryObject
ZwDuplicateObject
ZwOpenKey
KeLeaveCriticalRegion
ZwEnumerateValueKey
ZwQueryValueKey
ZwDeleteValueKey
ZwDeleteKey
ExGetPreviousMode
ZwTerminateProcess
_purecall
ZwQueryKey
ZwSetValueKey
IoFreeIrp
IoFreeMdl
MmUnlockPages
IoBuildAsynchronousFsdRequest
_strnicmp
RtlQueryRegistryValues
RtlAppendUnicodeToString
KeDelayExecutionThread
mbstowcs
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
NtClose
PsLookupProcessByProcessId
ZwSetInformationObject
_stricmp
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwOpenFile
RtlEqualUnicodeString
IoFileObjectType
IoCreateFile
IofCallDriver
IoAllocateIrp
IoAllocateMdl
ProbeForRead
PsGetVersion
MmGetSystemRoutineAddress
RtlCopyUnicodeString
RtlCompareMemory
_snwprintf
RtlImageNtHeader
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
strrchr
KeBugCheckEx
RtlAppendUnicodeStringToString
ZwQueryVolumeInformationFile
ObReferenceObjectByPointer
ObQueryNameString
IofCompleteRequest
ExEventObjectType
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoGetDeviceObjectPointer
RtlUpperChar
RtlCompareUnicodeString
strncpy
KeServiceDescriptorTable
NtOpenProcess
MmSectionObjectType
ObOpenObjectByName
IoDriverObjectType
NtQueryInformationProcess
KeAddSystemServiceTable
ZwQueryObject
ZwQuerySecurityObject
ObInsertObject
_allrem
IoReleaseVpbSpinLock
IoAcquireVpbSpinLock
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
KeTickCount
RtlUnwind
KeEnterCriticalRegion
ZwEnumerateKey
ExAcquireFastMutexUnsafe
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
RtlLengthSid
wcschr
RtlAbsoluteToSelfRelativeSD
ZwOpenProcess
KeGetCurrentThread
KfLowerIrql
KeRaiseIrqlToDpcLevel
ClassInitialize

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
??0CBlobConfig@@QAE@ABV0@@Z
??0CBlobConfig@@QAE@K@Z
??0CContext@@QAE@ABV0@@Z
??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QAE@ABV0@@Z
??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
??0CDebugLog@@QAE@ABV0@@Z
??0CDebugLog@@QAE@PBG@Z
??0CExclusionExtConfig@@QAE@ABV0@@Z
??0CExclusionExtConfig@@QAE@KKE@Z
??0CExclusionFileNameConfig@@QAE@ABV0@@Z
??0CExclusionFileNameConfig@@QAE@KK@Z
??0CExclusionFilePathConfig@@QAE@ABV0@@Z
??0CExclusionFilePathConfig@@QAE@KK@Z
??0CExclusionFolderConfig@@QAE@ABV0@@Z
??0CExclusionFolderConfig@@QAE@KK@Z
??0CExclusionRegistryConfig@@QAE@ABV0@@Z
??0CExclusionRegistryConfig@@QAE@KK@Z
??0CFile@@QAE@ABV0@@Z
??0CFile@@QAE@E@Z
??0CFileExtension@@QAE@ABV0@@Z
??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
??0CKEvent@@QAE@ABV0@@Z
??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
??0CList@@QAE@ABV0@@Z
??0CList@@QAE@KPAVIMemoryAllocator@@@Z
??0CLockEvent@@QAE@ABV0@@Z
??0CLockEvent@@QAE@XZ
??0CLockList@@QAE@ABV0@@Z
??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QAE@ABV0@@Z
??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
??0CMemoryPoolAllocator@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@XZ
??0CModuleConfigList@@QAE@ABV0@@Z
??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QAE@ABV0@@Z
??0CModuleFileExtConfig@@QAE@KKE@Z
??0CModuleFlagConfig@@QAE@ABV0@@Z
??0CModuleFlagConfig@@QAE@K@Z
??0CModuleMultiStringConfig@@QAE@ABV0@@Z
??0CModuleMultiStringConfig@@QAE@KK@Z
??0CModuleStringConfig@@QAE@ABV0@@Z
??0CModuleStringConfig@@QAE@K@Z
??0CSmartLock@@QAE@AAVCLockEvent@@@Z
??0CSmartLock@@QAE@XZ
??0CSmartReference@@QAE@AAJ@Z
??0CSmartReference@@QAE@AAK@Z
??0CStrList@@QAE@ABV0@@Z
??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
??0CSystemThread@@QAE@ABV0@@Z
??0CSystemThread@@QAE@K@Z
??0CUserFuncAdapterJob@@QAE@ABV0@@Z
??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z0@Z
??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@E@Z
??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
??0CWorkerThreadJobQueue@@QAE@K@Z
??0CWorkerThreadPool@@QAE@ABV0@@Z
??0CWorkerThreadPool@@QAE@K@Z
??0IMemoryAllocator@@QAE@ABV0@@Z
??0IMemoryAllocator@@QAE@XZ
??1CAutoUpdateConfigThread@@UAE@XZ
??1CBlobConfig@@UAE@XZ
??1CContext@@UAE@XZ
??1CContextList@@UAE@XZ
??1CDebugLog@@UAE@XZ
??1CExclusionExtConfig@@UAE@XZ
??1CExclusionFileNameConfig@@UAE@XZ
??1CExclusionFilePathConfig@@UAE@XZ
??1CExclusionFolderConfig@@UAE@XZ
??1CExclusionRegistryConfig@@UAE@XZ
??1CFile@@UAE@XZ
??1CFileExtension@@UAE@XZ
??1CKEvent@@UAE@XZ
??1CList@@UAE@XZ
??1CLockEvent@@UAE@XZ
??1CLockList@@UAE@XZ
??1CMemoryAllocator@@UAE@XZ
??1CMemoryPoolAllocator@@UAE@XZ
??1CModuleConfig@@UAE@XZ
??1CModuleConfigList@@UAE@XZ
??1CModuleFileExtConfig@@UAE@XZ
??1CModuleFlagConfig@@UAE@XZ
??1CModuleMultiStringConfig@@UAE@XZ
??1CModuleStringConfig@@UAE@XZ
??1CSmartLock@@QAE@XZ
??1CSmartReference@@QAE@XZ
??1CStrList@@UAE@XZ
??1CSystemThread@@UAE@XZ
??1CUserFuncAdapterJob@@UAE@XZ
??1CWorkerThread@@UAE@XZ
??1CWorkerThreadJob@@UAE@XZ
??1CWorkerThreadJobQueue@@UAE@XZ
??1CWorkerThreadPool@@UAE@XZ
??1IMemoryAllocator@@UAE@XZ
??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??2CMemoryAllocator@@SGPAXI@Z
??2CMemoryPoolAllocator@@SGPAXI@Z
??3@YAXPAX@Z
??3IMemoryAllocator@@SGXPAX@Z
??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
??4CBlobConfig@@QAEAAV0@ABV0@@Z
??4CContext@@QAEAAV0@ABV0@@Z
??4CDebugLog@@QAEAAV0@ABV0@@Z
??4CFile@@QAEAAV0@ABV0@@Z
??4CKEvent@@QAEAAV0@ABV0@@Z
??4CLockEvent@@QAEAAV0@ABV0@@Z
??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
??4CModuleConfig@@QAEAAV0@ABV0@@Z
??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
??4CSystemThread@@QAEAAV0@ABV0@@Z
??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
??4CWorkerThread@@QAEAAV0@ABV0@@Z
??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QAEXXZ
??_FCFile@@QAEXXZ
??_FCFileExtension@@QAEXXZ
??_FCModuleConfigList@@QAEXXZ
??_FCStrList@@QAEXXZ
??_FCSystemThread@@QAEXXZ
??_FCWorkerThread@@QAEXXZ
??_FCWorkerThreadJob@@QAEXXZ
??_FCWorkerThreadJobQueue@@QAEXXZ
??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??_V@YAXPAX@Z
?Acquire@CLockEvent@@QAEXXZ
?Add@CContextList@@QAEEPAVCContext@@@Z
?Add@CFileExtension@@QAEEPBGK@Z
?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
?Add@CStrList@@QAEEPBG@Z
?AddNode@CLockList@@UAEEQAXE@Z
?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QAEXXZ
?CheckNode@CLockList@@UAEHQAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
?Cleanup@CBlobConfig@@AAEXXZ
?Cleanup@CModuleFileExtConfig@@IAEXXZ
?Cleanup@CModuleMultiStringConfig@@IAEXXZ
?Cleanup@CModuleStringConfig@@AAEXXZ
?Close@CFile@@QAEJXZ
?Count@CLockList@@QAEKXZ
?Create@CFile@@QAEJPBGKKKK@Z
?Create@CSystemThread@@QAEEXZ
?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
?CreatePool@CWorkerThreadPool@@QAEEXZ
?CreateThreads@CWorkerThreadPool@@QAEEK@Z
?CreateWIRP@CFile@@QAEJPBGKKKK@Z
?Delete@CFile@@QAEJXZ
?Delete@CFileExtension@@QAEEPBGK@Z
?Delete@CStrList@@QAEEPBG@Z
?DeleteAll@CList@@UAEXXZ
?DeleteAll@CLockList@@UAEXXZ
?DeleteNode@CContextList@@MAEXPAX@Z
?DeleteNode@CList@@UAEXPAX@Z
?DeleteNode@CModuleConfigList@@MAEXPAX@Z
?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YGXPAPAX@Z
?DoIt@CWorkerThreadJob@@QAEJXZ
?EntryPoint@CSystemThread@@KGXPAX@Z
?Find@CContextList@@QAEPAVCContext@@K@Z
?Find@CContextList@@QAEPAVCContext@@PAX@Z
?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FindNode@CContextList@@IAEPAXPAX@Z
?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?First@CList@@UAEPAXXZ
?First@CLockList@@UAEPAXXZ
?Free@CMemoryAllocator@@UAEXPAX@Z
?Free@CMemoryPoolAllocator@@UAEXPAX@Z
?GetAttributes@CFile@@QAEKXZ
?GetBasicInfomration@CFile@@IAEJXZ
?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
?GetCategory@CContext@@QAEKXZ
?GetData@CBlobConfig@@QAEHPAXPAK@Z
?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QAEKXZ
?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
?GetData@CModuleStringConfig@@QAEPAGXZ
?GetData@CStrList@@QAEEPAGPAK@Z
?GetDataType@CModuleConfig@@QAEKXZ
?GetEngineContext@CContext@@QAEPAXXZ
?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UAEJKPAK@Z
?GetID@CModuleConfig@@QAEKXZ
?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QAEKXZ
?GetLinkContext@CContext@@QAEPAXXZ
?GetLogFlag@CDebugLog@@QAEKXZ
?GetModuleId@CModuleConfig@@QAEKXZ
?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QAEKXZ
?GetSize@CBlobConfig@@QAEKXZ
?GetStringConfig@CContext@@QAEPAGK@Z
?GetStringConfig@CContext@@UAEJKPAGPAK@Z
?GetThreadCount@CWorkerThreadPool@@QAEKXZ
?GetThreadID@CSystemThread@@QAEKXZ
?GetType@CContext@@QAEKXZ
?GetUserParameter@CContext@@QAEKXZ
?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
?InitializeFlagConfig@CContext@@QAEHKK@Z
?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
?InitializeStringConfig@CContext@@QAEHKPBG@Z
?Insert@CList@@UAEXQAXE@Z
?Insert@CLockList@@UAEXQAXE@Z
?InsertAfter@CList@@UAEXPAX0@Z
?InsertBefore@CList@@UAEXPAX0@Z
?Instance@CWorkerThreadPool@@SGPAV1@XZ
?IsEmpty@CList@@UAEEXZ
?IsEmpty@CLockList@@UAEEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
?IsFull@CLockList@@QBEEXZ
?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
?IsOpened@CFile@@QAEEXZ
?IsTerminated@CWorkerThreadPool@@QAEEXZ
?IsValid@CMemoryAllocator@@UAEEXZ
?IsValid@CMemoryPoolAllocator@@UAEEXZ
?IsValid@IMemoryAllocator@@UAEEXZ
?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
?JobFunction@CUserFuncAdapterJob@@MAEXXZ
?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QAEKXZ
?MatchAllExtensions@CFileExtension@@QAEEXZ
?MatchNoExtensions@CFileExtension@@QAEEXZ
?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
?NeedDelete@CWorkerThreadJob@@QAEEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
?NewNode@CList@@UAEPAXXZ
?NewNode@CStrList@@EAEPAXXZ
?NewNodeVariant@CList@@IAEPAXK@Z
?Next@CList@@UBEPAXQAX@Z
?Next@CLockList@@UBEPAXQAX@Z
?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
?NotityTerminate@CWorkerThread@@QAEXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
?Pulse@CKEvent@@QAEJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
?Read@CFile@@QAEJPADKPAK@Z
?ReferenceCount@CContext@@QAEAAKXZ
?Release@CLockEvent@@QAEXXZ
?Remove@CContextList@@UAEEQAX@Z
?Remove@CList@@UAEEQAX@Z
?Remove@CLockList@@UAEEQAX@Z
?RemoveHead@CList@@UAEPAXXZ
?RemoveHead@CLockList@@UAEPAXXZ
?RemoveTail@CList@@UAEPAXXZ
?RemoveTail@CLockList@@UAEPAXXZ
?Reset@CKEvent@@QAEXXZ
?RestoreCR0@@YGXPAX@Z
?Run@CAutoUpdateConfigThread@@UAEXXZ
?Run@CWorkerThread@@UAEXXZ
?SeekToEnd@CFile@@QAEJXZ
?Set@CKEvent@@QAEJJE@Z
?SetAttributes@CFile@@QAEJK@Z
?SetBlobCofig@CContext@@UAEJKPAXK@Z
?SetData@CBlobConfig@@QAEHPAXK@Z
?SetData@CModuleFileExtConfig@@QAEHPBG@Z
?SetData@CModuleFlagConfig@@QAEHK@Z
?SetData@CModuleMultiStringConfig@@QAEHPBG@Z
?SetData@CModuleStringConfig@@QAEHPBG@Z
?SetEngineContext@CContext@@QAEXPAX@Z
?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
?SetFlagConfig@CContext@@UAEJKK@Z
?SetLinkContext@CContext@@QAEXPAX@Z
?SetLogFlag@CDebugLog@@QAEEK@Z
?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
?SetMultiStringConfig@CContext@@UAEJKPBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
?SetPriority@CSystemThread@@QAEXK@Z
?SetStopUse@CContext@@QAEXXZ
?SetStringConfig@CContext@@UAEJKPBG@Z
?Setup@CSystemThread@@MAEXXZ
?StopUse@CContext@@QAEHXZ
?TearDown@CSystemThread@@MAEXXZ
?Terminate@CSystemThread@@QAEXE@Z
?Terminate@CWorkerThreadPool@@QAEEXZ
?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QAEXXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
?Write@CDebugLog@@QAAXPBDZZ
?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
?WriteSystemInformation@CDebugLog@@QAEXXZ
?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
?WriteToFile@CDebugLog@@IAEXPADK@Z
?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
?_pPagedAllocator@@3PAVCMemoryAllocator@@A
?m_lpInstance@CWorkerThreadPool@@1PAV1@A
?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
_DeInitKmLPC@0
_GetModuleInfoByAddress@8
_GetModuleInfoByModuleName@8
_InitKmLPC@0
_KmCallUm@8
_MapMem@12
_ModGetExportProcAddress@8
_ModLoadDLLToBuffer@4
_ModLoadDLLToBufferWithImageSize@8
_ModLoadModule@8
_ModUnLoadModule@4
_NormalizeFileName@4
_NormalizeFullNtPathToDosName@4
_TmCommConfigRoutine@4
_UnMapMem@8
_UtilCleanFileReadOnly@4
_UtilDeleteFileForce@4
_UtilGetFileObjectForProcessByEPROC@8
_UtilGetFileObjectFromFileName@12
_UtilGetProcessName@12
_UtilGetSystemTime@4
_UtilIoSetFileInfo@24
_UtilIopCreateFileIRP@40
_UtilKeGetLowFileDevice@16
_UtilModuleIATHook@24
_UtilModuleIATUnHook@8
_UtilQueryKeyValue@24
_UtilVolumeDeviceToDosName@8
_UtilWaitValueChangeToZero@8
_UtilWriteVersionToRegistry@8
_UtilbuildDynamicDiskMappingTable@0
__UtilDosPathNameToNtPathName@12

Sections

Expand

.text
.rdata
.data
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2021-06-17 20:32:14
MD5	29122f970a9e766ef01a73e0616d68b3
SHA1	432fa24e0ce4b3673113c90b34d6e52dc7bac471
SHA256	4e37592a2a415f520438330c32cfbdbd6af594deef5290b2fa4b9722b898ff69
Authentihash MD5	84cb997d2380df8ee2ac77eacdb2d9f7
Authentihash SHA1	c8c6a98f592d7255d12b7a6c3d7f5bf5c4a34b50
Authentihash SHA256	62d1ca62fb251b1eeda5d2577719414e6e26d4afdc5f3df3faf3b35de5cb9506
RichPEHeaderHash MD5	f4be961fdf2f7511374b1df8df43f982
RichPEHeaderHash SHA1	548170450c7a94ed3369b8ea52224efc6207e53e
RichPEHeaderHash SHA256	afb90f23e79bf9a8d2b7c8cfe6668b65edca751317215ad400d3240b652eea37
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	Trend Micro Eyes
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 33000000b5213fca1e4aa03de40000000000b5

Field	Value
ToBeSigned (TBS) MD5	a0dd89c33c4973bf6758331e200fb6de
ToBeSigned (TBS) SHA1	65ff7fa429c0f08f8a8bf30509e8ca2919d9edb5
ToBeSigned (TBS) SHA256	29a7b646af062aee3bf37d1ba190211365116db7d7aa4cb87ba268843262ae47
Subject	C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Hardware Compatibility Publisher
ValidFrom	2020-12-15 22:15:33
ValidTo	2021-12-02 22:15:33
Signature	0d2d53cd15a8feddcb17e2df1bf7dc1aef21e98c6cd220f58b593824849c134a0f1add59ce42ef80ddf47860273013604d9568ec5894a797bd4e571432a9aaf10ab04dd1c038b26ab7c5ca3a9c88d009267fab56254525546a0a055fb37b9cd8029c7d501809fc8b11482c7a4347b3ad29f35427c9570e87117db52cc94864259274b9e2e758f918a3af1fdb9f9d40ffa3ae2e2ae012fb97a436258642a2a4223dc6690db88103a6e5220646bd8afb3d12eb894ac28b527396a1965408487f6ab878b3c474b8c960842861ae8e799a3d2a8d6f918f50f8e26bb1ed6ced47be36e447574e8568582964ff31cd288b9c7f8d7e6a46d6c3d92f5c101fe1522a720c
SignatureAlgorithmOID	1.2.840.113549.1.1.11
IsCertificateAuthority	False
SerialNumber	33000000b5213fca1e4aa03de40000000000b5
Version	3

Certificate 610baac1000000000009

Field	Value
ToBeSigned (TBS) MD5	a569061297e8e824767dbc3184a69bea
ToBeSigned (TBS) SHA1	adbb26a587a8f44b4fccaecb306f980d1c55a150
ToBeSigned (TBS) SHA256	cec1afd0e310c55c1dcc601ab8e172917706aa32fb5eaf826813547fdf02dd46
Subject	C=US, ST=Washington, L=Redmond, O=Microsoft Corporation, CN=Microsoft Windows Third Party Component CA 2012
ValidFrom	2012-04-18 23:48:38
ValidTo	2027-04-18 23:58:38
Signature	5a8a67daccd5fd0d264177bf0a4678b4b3de12692b7723c2652f015fd203f461ba509d2e8c3972f36c3e6ab11e766decb7f382dcccbbc56970287366173f54ebee011648c446d91b80ae813a8d0f796d68b09eea2d3f39d3ca387ebd5e7c086e19dcc6c2f438336861e2524783e1000156d2bacb878205310a418b4ee77f5f5fed5fd3392d45eba213bffd1ec298417161165fc80a70257c59693124e471e70abb0417f79f721ec9d2bb1abe3d02fe090cb243b4591a99539396215fe0d6b72601429536ac27fdbef48577683d18bdf4be98882211865216f345ec0397107087a37043713cdbc98603170cf5735bc67de15c64edd7c548d7ed32e2d1aad3cfa7f6574e61f977eb67f288b3de00da038fd08a34373e1dd862b8d2b1f3e12f8b723b81967c6ffcec667672601b24f2a0896d5b6d002eef28dd868705c2b4b9e5be64c22af24a155c98e2c42785ff52e3627e0fb2020bd766c70ab2d33d200414503259830a7d9bed5a38120152ba2f5e20728e4af1fde771028c3be107bec973f4dd47d8b4efb4a4b330b9893e76cab90098567eabea8ab8a5d038ab6977130b142fe9aa411ff7babd3a2b348aee0aab63e663f788248e200d2b3b9de3c24952ac9f1f0e393b5dd46e506ae67d523aaa7c3315290d265e0158a74ea93d7a846f743f609fe4324f3600af6d71d33ea646655f8174f1fec171da4ca0415a82ddf11f
SignatureAlgorithmOID	1.2.840.113549.1.1.11
IsCertificateAuthority	True
SerialNumber	610baac1000000000009
Version	3

Imports

Expand

ntoskrnl.exe

Imported Functions

Expand

KeLeaveCriticalRegion
wcsncpy
KeEnterCriticalRegion
ExAcquireFastMutexUnsafe
wcsrchr
ExAcquireResourceSharedLite
ExReleaseResourceLite
_purecall
ZwOpenEvent
ZwConnectPort
KeClearEvent
PsProcessType
ExFreePoolWithTag
RtlInitUnicodeString
KeSetEvent
ProbeForWrite
KeUnstackDetachProcess
ZwRequestWaitReplyPort
ZwWaitForSingleObject
DbgBreakPoint
ZwSetEvent
IoGetCurrentProcess
ZwFreeVirtualMemory
ZwClose
ObfReferenceObject
ObfDereferenceObject
RtlUnicodeStringToInteger
ZwCreateSection
ObOpenObjectByPointer
KeStackAttachProcess
KePulseEvent
ZwAllocateVirtualMemory
ObGetObjectSecurity
SeAccessCheck
SeReleaseSubjectContext
SeCaptureSubjectContext
PsThreadType
ObReleaseObjectSecurity
PsGetProcessExitTime
MmSectionObjectType
DbgPrint
ExDeleteResourceLite
ExInitializeResourceLite
ZwReadFile
swprintf
ZwSetInformationFile
ZwCreateFile
ZwQueryInformationFile
ZwWriteFile
_wcsnicmp
towupper
ExAllocatePoolWithTag
KeInitializeEvent
ZwCreateEvent
ZwCreateKey
RtlAnsiStringToUnicodeString
ZwNotifyChangeKey
RtlInitAnsiString
_snprintf
RtlFreeUnicodeString
ExSystemTimeToLocalTime
_vsnprintf
ObReferenceObjectByHandle
RtlTimeToTimeFields
ZwDeviceIoControlFile
PsGetCurrentThreadId
PsGetCurrentProcessId
KeWaitForMultipleObjects
ExGetPreviousMode
RtlEqualUnicodeString
RtlPrefixUnicodeString
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
RtlUpcaseUnicodeChar
KeWaitForSingleObject
KeSetPriorityThread
PsCreateSystemThread
PsTerminateSystemThread
MmIsAddressValid
KeDelayExecutionThread
KeNumberProcessors
PsLookupProcessByProcessId
PsSetCreateProcessNotifyRoutine
ZwOpenDirectoryObject
ZwQueryInformationProcess
ZwQuerySecurityObject
NtSetInformationFile
ZwDeleteValueKey
ZwSetValueKey
ZwQuerySystemInformation
NtQueryInformationFile
IoFileObjectType
ZwQueryValueKey
ZwQueryDirectoryFile
NtCreateFile
ZwEnumerateValueKey
RtlLengthSecurityDescriptor
ZwQueryDirectoryObject
ZwSetSecurityObject
ZwDuplicateObject
ZwOpenProcess
ExReleaseFastMutexUnsafe
ZwDeleteKey
ZwEnumerateKey
ZwQueryKey
ZwOpenKey
MmSystemRangeStart
_stricmp
_strnicmp
mbstowcs
ProbeForRead
RtlUpcaseUnicodeString
_snwprintf
ZwQuerySymbolicLinkObject
ZwMapViewOfSection
MmGetSystemRoutineAddress
RtlAppendUnicodeToString
IoCreateFile
RtlQueryRegistryValues
MmBuildMdlForNonPagedPool
ZwOpenSymbolicLinkObject
IoFreeMdl
ObQueryNameString
ZwUnmapViewOfSection
NtClose
IoFreeIrp
PsGetVersion
IoAllocateIrp
RtlCompareMemory
MmUnlockPages
ZwSetInformationObject
ZwOpenFile
wcsncmp
RtlImageNtHeader
IoAllocateMdl
IofCallDriver
ZwQueryVolumeInformationFile
ObReferenceObjectByPointer
IoBuildDeviceIoControlRequest
ZwOpenSection
RtlSubAuthoritySid
RtlLengthRequiredSid
ExReleaseFastMutex
ExAcquireFastMutex
RtlCreateAcl
RtlSetDaclSecurityDescriptor
RtlAddAccessAllowedAce
KeInitializeSemaphore
KeReleaseSemaphore
RtlInitializeSid
RtlCreateSecurityDescriptor
IoDeleteSymbolicLink
IoDeleteDevice
IoGetDeviceObjectPointer
ExEventObjectType
IofCompleteRequest
IoCreateSymbolicLink
ObOpenObjectByName
NtQueryInformationProcess
strncpy
NtOpenProcess
ObInsertObject
IoAcquireVpbSpinLock
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
KeAcquireQueuedSpinLock
KeReleaseQueuedSpinLock
IoReleaseVpbSpinLock
wcschr
IoGetConfigurationInformation
IoRegisterPlugPlayNotification
IoGetStackLimits
IoBuildSynchronousFsdRequest
KeReleaseSpinLock
ExpInterlockedPopEntrySList
FsRtlIsNameInExpression
wcsstr
ExAllocatePool
IoUnregisterPlugPlayNotification
MmProbeAndLockPages
RtlCompareUnicodeString
IoGetDeviceInterfaces
KeAcquireSpinLockRaiseToDpc
KeBugCheckEx
IoCreateDevice
IoDeviceObjectType
SeCaptureSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
IoIsWdmVersionAvailable
SeExports
RtlLengthSid
RtlGetSaclSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
ZwTerminateProcess
ExAcquireResourceExclusiveLite
__C_specific_handler

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QEAA@AEBV0@@Z
??0CAutoUpdateConfigThread@@QEAA@PEAU_UNICODE_STRING@@P6AX0PEAX@Z1@Z
??0CBlobConfig@@QEAA@AEBV0@@Z
??0CBlobConfig@@QEAA@K@Z
??0CContext@@QEAA@AEBV0@@Z
??0CContext@@QEAA@KP6AJPEAU_EVENT_REPORT@@PEAXPEAU_TMCE_REPORT@@PEAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QEAA@AEBV0@@Z
??0CContextList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CDebugLog@@QEAA@AEBV0@@Z
??0CDebugLog@@QEAA@PEBG@Z
??0CDebugLogEx@@QEAA@AEBV0@@Z
??0CDebugLogEx@@QEAA@K@Z
??0CDelayLoadThread@@QEAA@AEBV0@@Z
??0CDelayLoadThread@@QEAA@XZ
??0CExclusionExtConfig@@QEAA@AEBV0@@Z
??0CExclusionExtConfig@@QEAA@KKE@Z
??0CExclusionFileNameConfig@@QEAA@AEBV0@@Z
??0CExclusionFileNameConfig@@QEAA@KK@Z
??0CExclusionFilePathConfig@@QEAA@AEBV0@@Z
??0CExclusionFilePathConfig@@QEAA@KK@Z
??0CExclusionFolderConfig@@QEAA@AEBV0@@Z
??0CExclusionFolderConfig@@QEAA@KK@Z
??0CExclusionRegistryConfig@@QEAA@AEBV0@@Z
??0CExclusionRegistryConfig@@QEAA@KK@Z
??0CFile@@QEAA@AEBV0@@Z
??0CFile@@QEAA@E@Z
??0CFileExtension@@QEAA@AEBV0@@Z
??0CFileExtension@@QEAA@KEEPEAVIMemoryAllocator@@@Z
??0CInclusionExtConfig@@QEAA@AEBV0@@Z
??0CInclusionExtConfig@@QEAA@KKE@Z
??0CInclusionFileNameConfig@@QEAA@AEBV0@@Z
??0CInclusionFileNameConfig@@QEAA@KK@Z
??0CInclusionFilePathConfig@@QEAA@AEBV0@@Z
??0CInclusionFilePathConfig@@QEAA@KK@Z
??0CInclusionFolderConfig@@QEAA@AEBV0@@Z
??0CInclusionFolderConfig@@QEAA@KK@Z
??0CKEvent@@QEAA@AEBV0@@Z
??0CKEvent@@QEAA@W4_EVENT_TYPE@@E@Z
??0CList@@QEAA@AEBV0@@Z
??0CList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CLockEvent@@QEAA@AEBV0@@Z
??0CLockEvent@@QEAA@XZ
??0CLockList@@QEAA@AEBV0@@Z
??0CLockList@@QEAA@KKPEAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IEAA@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QEAA@AEBV0@@Z
??0CMemoryPoolAllocator@@IEAA@W4_POOL_TYPE@@_K1K@Z
??0CMemoryPoolAllocator@@QEAA@AEBV0@@Z
??0CModuleConfig@@QEAA@AEBV0@@Z
??0CModuleConfig@@QEAA@XZ
??0CModuleConfigList@@QEAA@AEBV0@@Z
??0CModuleConfigList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QEAA@AEBV0@@Z
??0CModuleFileExtConfig@@QEAA@KKE@Z
??0CModuleFlagConfig@@QEAA@AEBV0@@Z
??0CModuleFlagConfig@@QEAA@K@Z
??0CModuleMultiStringConfig@@QEAA@AEBV0@@Z
??0CModuleMultiStringConfig@@QEAA@KK@Z
??0CModuleStringConfig@@QEAA@AEBV0@@Z
??0CModuleStringConfig@@QEAA@K@Z
??0CNoLockList@@QEAA@AEBV0@@Z
??0CNoLockList@@QEAA@KKPEAVIMemoryAllocator@@@Z
??0CSmartLock@@QEAA@AEAVCLockEvent@@@Z
??0CSmartLock@@QEAA@XZ
??0CSmartReference@@QEAA@AEAJ@Z
??0CSmartReference@@QEAA@AEAK@Z
??0CSmartResource@@QEAA@AEAVCResource@@E@Z
??0CStrList@@QEAA@AEBV0@@Z
??0CStrList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CSystemThread@@QEAA@AEBV0@@Z
??0CSystemThread@@QEAA@K@Z
??0CUserFuncAdapterJob@@QEAA@AEBV0@@Z
??0CUserFuncAdapterJob@@QEAA@P6AXPEAX@Z01@Z
??0CWorkerThread@@IEAA@PEAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QEAA@AEBV0@@Z
??0CWorkerThreadJob@@QEAA@AEBV0@@Z
??0CWorkerThreadJob@@QEAA@E@Z
??0CWorkerThreadJobQueue@@QEAA@AEBV0@@Z
??0CWorkerThreadJobQueue@@QEAA@K@Z
??0CWorkerThreadPool@@QEAA@AEBV0@@Z
??0CWorkerThreadPool@@QEAA@K@Z
??0CWorkerThreadPoolEx@@QEAA@AEBV0@@Z
??0CWorkerThreadPoolEx@@QEAA@KK@Z
??0IMemoryAllocator@@QEAA@AEBV0@@Z
??0IMemoryAllocator@@QEAA@XZ
??1CAutoUpdateConfigThread@@UEAA@XZ
??1CBlobConfig@@UEAA@XZ
??1CContext@@UEAA@XZ
??1CContextList@@UEAA@XZ
??1CDebugLog@@UEAA@XZ
??1CDebugLogEx@@UEAA@XZ
??1CDelayLoadThread@@UEAA@XZ
??1CExclusionExtConfig@@UEAA@XZ
??1CExclusionFileNameConfig@@UEAA@XZ
??1CExclusionFilePathConfig@@UEAA@XZ
??1CExclusionFolderConfig@@UEAA@XZ
??1CExclusionRegistryConfig@@UEAA@XZ
??1CFile@@UEAA@XZ
??1CFileExtension@@UEAA@XZ
??1CInclusionExtConfig@@UEAA@XZ
??1CInclusionFileNameConfig@@UEAA@XZ
??1CInclusionFilePathConfig@@UEAA@XZ
??1CInclusionFolderConfig@@UEAA@XZ
??1CKEvent@@UEAA@XZ
??1CList@@UEAA@XZ
??1CLockEvent@@UEAA@XZ
??1CLockList@@UEAA@XZ
??1CMemoryAllocator@@UEAA@XZ
??1CMemoryPoolAllocator@@UEAA@XZ
??1CModuleConfig@@UEAA@XZ
??1CModuleConfigList@@UEAA@XZ
??1CModuleFileExtConfig@@UEAA@XZ
??1CModuleFlagConfig@@UEAA@XZ
??1CModuleMultiStringConfig@@UEAA@XZ
??1CModuleStringConfig@@UEAA@XZ
??1CNoLockList@@UEAA@XZ
??1CSmartLock@@QEAA@XZ
??1CSmartReference@@QEAA@XZ
??1CSmartResource@@QEAA@XZ
??1CStrList@@UEAA@XZ
??1CSystemThread@@UEAA@XZ
??1CUserFuncAdapterJob@@UEAA@XZ
??1CWorkerThread@@UEAA@XZ
??1CWorkerThreadJob@@UEAA@XZ
??1CWorkerThreadJobQueue@@UEAA@XZ
??1CWorkerThreadPool@@UEAA@XZ
??1CWorkerThreadPoolEx@@UEAA@XZ
??1IMemoryAllocator@@UEAA@XZ
??2@YAPEAX_KPEAVIMemoryAllocator@@PEBDK@Z
??2CMemoryAllocator@@SAPEAX_K@Z
??2CMemoryPoolAllocator@@SAPEAX_K@Z
??3@YAXPEAX@Z
??3IMemoryAllocator@@SAXPEAX@Z
??4CAutoUpdateConfigThread@@QEAAAEAV0@AEBV0@@Z
??4CBlobConfig@@QEAAAEAV0@AEBV0@@Z
??4CContext@@QEAAAEAV0@AEBV0@@Z
??4CDebugLog@@QEAAAEAV0@AEBV0@@Z
??4CDebugLogEx@@QEAAAEAV0@AEBV0@@Z
??4CDelayLoadThread@@QEAAAEAV0@AEBV0@@Z
??4CFile@@QEAAAEAV0@AEBV0@@Z
??4CKEvent@@QEAAAEAV0@AEBV0@@Z
??4CLockEvent@@QEAAAEAV0@AEBV0@@Z
??4CMemoryAllocator@@QEAAAEAV0@AEBV0@@Z
??4CMemoryPoolAllocator@@QEAAAEAV0@AEBV0@@Z
??4CModuleConfig@@QEAAAEAV0@AEBV0@@Z
??4CModuleFlagConfig@@QEAAAEAV0@AEBV0@@Z
??4CModuleStringConfig@@QEAAAEAV0@AEBV0@@Z
??4CSmartLock@@QEAAAEAV0@AEBV0@@Z
??4CSmartLock@@QEAAAEBV0@AEAVCLockEvent@@@Z
??4CSmartResource@@QEAAAEAV0@AEBV0@@Z
??4CSystemThread@@QEAAAEAV0@AEBV0@@Z
??4CUserFuncAdapterJob@@QEAAAEAV0@AEBV0@@Z
??4CWorkerThread@@QEAAAEAV0@AEBV0@@Z
??4CWorkerThreadJob@@QEAAAEAV0@AEBV0@@Z
??4IMemoryAllocator@@QEAAAEAV0@AEBV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CDebugLogEx@@6B@
??_7CDelayLoadThread@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CInclusionExtConfig@@6B@
??_7CInclusionFileNameConfig@@6B@
??_7CInclusionFilePathConfig@@6B@
??_7CInclusionFolderConfig@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CNoLockList@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7CWorkerThreadPoolEx@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QEAAXXZ
??_FCFile@@QEAAXXZ
??_FCFileExtension@@QEAAXXZ
??_FCModuleConfigList@@QEAAXXZ
??_FCStrList@@QEAAXXZ
??_FCSystemThread@@QEAAXXZ
??_FCWorkerThread@@QEAAXXZ
??_FCWorkerThreadJob@@QEAAXXZ
??_FCWorkerThreadJobQueue@@QEAAXXZ
??_U@YAPEAX_KPEAVIMemoryAllocator@@PEBDK@Z
??_V@YAXPEAX@Z
?Acquire@CLockEvent@@QEAAXXZ
?Add@CContextList@@QEAAEPEAVCContext@@@Z
?Add@CFileExtension@@QEAAEPEBGK@Z
?Add@CModuleConfigList@@QEAAEPEAVCModuleConfig@@@Z
?Add@CStrList@@QEAAEPEBG@Z
?AddNode@CLockList@@UEAAEQEAXE@Z
?AddNode@CNoLockList@@UEAAEQEAXE@Z
?Alloc@CMemoryAllocator@@UEAAPEAX_KPEBDK@Z
?Alloc@CMemoryPoolAllocator@@UEAAPEAX_KPEBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IEAAPEAX_K@Z
?AttachJobQueue@CWorkerThread@@QEAAXPEAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QEAAXXZ
?CheckNode@CLockList@@UEAAHQEAX@Z
?CheckNode@CNoLockList@@UEAAHQEAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QEAAXXZ
?Cleanup@CBlobConfig@@AEAAXXZ
?Cleanup@CModuleFileExtConfig@@IEAAXXZ
?Cleanup@CModuleMultiStringConfig@@IEAAXXZ
?Cleanup@CModuleStringConfig@@AEAAXXZ
?Close@CFile@@QEAAJXZ
?Count@CLockList@@QEAAKXZ
?Count@CNoLockList@@QEAAKXZ
?Create@CFile@@QEAAJPEBGKKKK@Z
?Create@CSystemThread@@QEAAEXZ
?CreateInstance@CMemoryAllocator@@SAPEAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SAPEAV1@W4_POOL_TYPE@@_K1K@Z
?CreatePool@CWorkerThreadPool@@QEAAEXZ
?CreatePool@CWorkerThreadPoolEx@@QEAAEXZ
?CreateThreads@CWorkerThreadPool@@QEAAEK@Z
?CreateThreads@CWorkerThreadPoolEx@@QEAAEK@Z
?CreateWIRP@CFile@@QEAAJPEBGKKKK@Z
?Delete@CFile@@QEAAJXZ
?Delete@CFileExtension@@QEAAEPEBGK@Z
?Delete@CStrList@@QEAAEPEBG@Z
?DeleteAll@CList@@UEAAXXZ
?DeleteAll@CLockList@@UEAAXXZ
?DeleteAll@CNoLockList@@UEAAXXZ
?DeleteNode@CContextList@@MEAAXPEAX@Z
?DeleteNode@CList@@UEAAXPEAX@Z
?DeleteNode@CModuleConfigList@@MEAAXPEAX@Z
?DeleteNode@CStrList@@EEAAXPEAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YAXPEAPEAX@Z
?DoIt@CWorkerThreadJob@@QEAAJXZ
?EntryPoint@CSystemThread@@KAXPEAX@Z
?Find@CContextList@@QEAAPEAVCContext@@K@Z
?Find@CContextList@@QEAAPEAVCContext@@PEAX@Z
?Find@CFileExtension@@QEAAPEAU_STR_LIST_NODE@CStrList@@PEBGK@Z
?Find@CModuleConfigList@@QEAAPEAVCModuleConfig@@K@Z
?Find@CStrList@@QEAAPEAU_STR_LIST_NODE@1@PEBG@Z
?FindNode@CContextList@@IEAAPEAXPEAX@Z
?FindPartiallyAndAllMatch@CStrList@@QEAAPEAU_STR_LIST_NODE@1@PEBG@Z
?FinishFunction@CUserFuncAdapterJob@@MEAAXXZ
?FinishIt@CWorkerThreadJob@@QEAAJXZ
?First@CList@@UEAAPEAXXZ
?First@CLockList@@UEAAPEAXXZ
?First@CNoLockList@@UEAAPEAXXZ
?Free@CMemoryAllocator@@UEAAXPEAX@Z
?Free@CMemoryPoolAllocator@@UEAAXPEAX@Z
?GetAttributes@CFile@@QEAAKXZ
?GetBasicInfomration@CFile@@IEAAJXZ
?GetBlobCofig@CContext@@UEAAJKPEAXPEAK@Z
?GetCategory@CContext@@QEAAKXZ
?GetData@CBlobConfig@@QEAAHPEAXPEAK@Z
?GetData@CModuleFileExtConfig@@QEAAHPEAGPEAK@Z
?GetData@CModuleFileExtConfig@@QEAAPEAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QEAAKXZ
?GetData@CModuleMultiStringConfig@@QEAAHPEAGPEAK@Z
?GetData@CModuleMultiStringConfig@@QEAAPEAVCStrList@@XZ
?GetData@CModuleStringConfig@@QEAAPEAGXZ
?GetData@CStrList@@QEAAEPEAGPEAK@Z
?GetDataType@CModuleConfig@@QEAAKXZ
?GetEngineContext@CContext@@QEAAPEAXXZ
?GetFileExtensionConfig@CContext@@QEAAPEAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UEAAJKPEAGPEAK@Z
?GetFileSize@CFile@@QEAAJPEAT_LARGE_INTEGER@@@Z
?GetFileSizeWIRP@CFile@@QEAAJPEAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UEAAJKPEAK@Z
?GetID@CModuleConfig@@QEAAKXZ
?GetJob@CWorkerThreadJobQueue@@QEAAPEAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QEAAKXZ
?GetLinkContext@CContext@@QEAAPEAXXZ
?GetLogFlag@CDebugLog@@QEAAKXZ
?GetLogFlag@CDebugLogEx@@QEAAKXZ
?GetModuleId@CModuleConfig@@QEAAKXZ
?GetMultiStringConfig@CContext@@QEAAPEAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UEAAJKPEAGPEAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QEAAPEAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPool@@QEAAPEAU_KTHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QEAAPEAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QEAAPEAU_KTHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QEAA_KXZ
?GetSize@CBlobConfig@@QEAAKXZ
?GetStringConfig@CContext@@QEAAPEAGK@Z
?GetStringConfig@CContext@@UEAAJKPEAGPEAK@Z
?GetThreadCount@CWorkerThreadPool@@QEAAKXZ
?GetThreadCount@CWorkerThreadPoolEx@@QEAAKXZ
?GetThreadID@CSystemThread@@QEAA_KXZ
?GetType@CContext@@QEAAKXZ
?GetUserParameter@CContext@@QEAA_KXZ
?InitProcMon@CDebugLogEx@@IEAAXXZ
?InitializeBlobConfig@CContext@@QEAAHKPEAXK@Z
?InitializeFileExtensionConfig@CContext@@QEAAHKPEBG@Z
?InitializeFlagConfig@CContext@@QEAAHKK@Z
?InitializeMultiStringConfig@CContext@@QEAAHKPEBG@Z
?InitializeStringConfig@CContext@@QEAAHKPEBG@Z
?Insert@CList@@UEAAXQEAXE@Z
?Insert@CLockList@@UEAAXQEAXE@Z
?Insert@CNoLockList@@UEAAXQEAXE@Z
?InsertAfter@CList@@UEAAXPEAX0@Z
?InsertBefore@CList@@UEAAXPEAX0@Z
?Instance@CWorkerThreadPool@@SAPEAV1@XZ
?IsEmpty@CList@@UEAAEXZ
?IsEmpty@CLockList@@UEAAEXZ
?IsEmpty@CNoLockList@@UEAAEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IEAAEK@Z
?IsFull@CLockList@@QEBAEXZ
?IsFull@CNoLockList@@QEBAEXZ
?IsInExclusionList@CExclusionExtConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionExtConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionFileNameConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionFilePathConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionFolderConfig@@QEAAEPEBG@Z
?IsOpened@CFile@@QEAAEXZ
?IsTerminated@CWorkerThreadPool@@QEAAEXZ
?IsTerminated@CWorkerThreadPoolEx@@QEAAEXZ
?IsValid@CMemoryAllocator@@UEAAEXZ
?IsValid@CMemoryPoolAllocator@@UEAAEXZ
?IsValid@IMemoryAllocator@@UEAAEXZ
?IsWorkerThread@CWorkerThreadPool@@QEAAE_K@Z
?IsWorkerThread@CWorkerThreadPoolEx@@QEAAE_K@Z
?JobFunction@CUserFuncAdapterJob@@MEAAXXZ
?JobQueue@CWorkerThreadPool@@QEAAAEAVCWorkerThreadJobQueue@@XZ
?JobQueue@CWorkerThreadPoolEx@@QEAAAEAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QEAAKXZ
?Limit@CNoLockList@@QEAAKXZ
?MatchAllExtensions@CFileExtension@@QEAAEXZ
?MatchNoExtensions@CFileExtension@@QEAAEXZ
?MergeLeft@CMemoryPoolAllocator@@IEAAPEAXPEAX@Z
?MergeRight@CMemoryPoolAllocator@@IEAAPEAXPEAX@Z
?NeedDelete@CWorkerThreadJob@@QEAAEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QEAAXE@Z
?NewNode@CList@@UEAAPEAXXZ
?NewNode@CStrList@@EEAAPEAXXZ
?NewNodeVariant@CList@@IEAAPEAXK@Z
?Next@CList@@UEBAPEAXQEAX@Z
?Next@CLockList@@UEBAPEAXQEAX@Z
?Next@CNoLockList@@UEBAPEAXQEAX@Z
?NextPool@CMemoryPoolAllocator@@QEAAPEAV1@XZ
?NotityTerminate@CWorkerThread@@QEAAXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QEAAJP6AXPEAX@Z0E@Z
?PostJobToWorkerThread@CWorkerThreadPoolEx@@QEAAJP6AXPEAX@Z0E1@Z
?Pulse@CKEvent@@QEAAJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QEAAEPEAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QEAAJPEAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPoolEx@@QEAAJPEAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SAPEAV1@XZ
?Read@CFile@@QEAAJPEADKPEAK@Z
?ReadWIRP@CFile@@QEAAJPEADKPEAK@Z
?ReferenceCount@CContext@@QEAAAEAKXZ
?Release@CLockEvent@@QEAAXXZ
?Remove@CContextList@@UEAAEQEAX@Z
?Remove@CList@@UEAAEQEAX@Z
?Remove@CLockList@@UEAAEQEAX@Z
?Remove@CNoLockList@@UEAAEQEAX@Z
?RemoveHead@CList@@UEAAPEAXXZ
?RemoveHead@CLockList@@UEAAPEAXXZ
?RemoveHead@CNoLockList@@UEAAPEAXXZ
?RemoveTail@CList@@UEAAPEAXXZ
?RemoveTail@CLockList@@UEAAPEAXXZ
?RemoveTail@CNoLockList@@UEAAPEAXXZ
?Reset@CKEvent@@QEAAXXZ
?ResetData@CInclusionExtConfig@@QEAAXXZ
?ResetData@CInclusionFileNameConfig@@QEAAXXZ
?ResetData@CInclusionFilePathConfig@@QEAAXXZ
?ResetData@CInclusionFolderConfig@@QEAAXXZ
?RestoreCR0@@YAXPEAX@Z
?Run@CAutoUpdateConfigThread@@UEAAXXZ
?Run@CDelayLoadThread@@UEAAXXZ
?Run@CWorkerThread@@UEAAXXZ
?SeekToEnd@CFile@@QEAAJXZ
?Set@CKEvent@@QEAAJJE@Z
?SetAttributes@CFile@@QEAAJK@Z
?SetBlobCofig@CContext@@UEAAJKPEAXK@Z
?SetData@CBlobConfig@@QEAAHPEAXK@Z
?SetData@CModuleFileExtConfig@@QEAAHPEBG@Z
?SetData@CModuleFlagConfig@@QEAAHK@Z
?SetData@CModuleMultiStringConfig@@QEAAHPEBGK@Z
?SetData@CModuleStringConfig@@QEAAHPEBG@Z
?SetEngineContext@CContext@@QEAAXPEAX@Z
?SetFileExtensionConfig@CContext@@UEAAJKPEBG@Z
?SetFlagConfig@CContext@@UEAAJKK@Z
?SetLinkContext@CContext@@QEAAXPEAX@Z
?SetLogFlag@CDebugLog@@QEAAEK@Z
?SetLogFlag@CDebugLogEx@@QEAAEK@Z
?SetMatchAllExtensions@CFileExtension@@QEAAXE@Z
?SetMatchNoExtensions@CFileExtension@@QEAAXE@Z
?SetMultiStringConfig@CContext@@UEAAJKPEBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QEAAXXZ
?SetPriority@CSystemThread@@QEAAXK@Z
?SetStopUse@CContext@@QEAAXXZ
?SetStringConfig@CContext@@UEAAJKPEBG@Z
?Setup@CSystemThread@@MEAAXXZ
?StopUse@CContext@@QEAAHXZ
?TearDown@CSystemThread@@MEAAXXZ
?Terminate@CSystemThread@@QEAAXE@Z
?Terminate@CWorkerThreadPool@@QEAAEXZ
?Terminate@CWorkerThreadPoolEx@@QEAAEXZ
?TmExceptionFilter@@YAJPEAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QEAAJPEAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QEAAXXZ
?WaitForInit@CDelayLoadThread@@QEAAEXZ
?WaitForLoad@CDelayLoadThread@@QEAAEXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QEAAEXZ
?WaitQueueEmpty@CWorkerThreadJobQueue@@QEAAXXZ
?Write@CDebugLog@@QEAAXPEBDZZ
?Write@CDebugLogEx@@QEAAXPEBDZZ
?Write@CFile@@QEAAJPEADKPEAT_LARGE_INTEGER@@PEAK@Z
?WriteDataToFile@CDebugLogEx@@IEAAXPEADK@Z
?WriteDataToProcMonW@CDebugLogEx@@IEAAXPEAD@Z
?WriteSystemInformation@CDebugLog@@QEAAXXZ
?WriteSystemInformation@CDebugLogEx@@QEAAXXZ
?WriteSystemStringInformation@CDebugLog@@IEAAXPEBG@Z
?WriteSystemStringInformation@CDebugLogEx@@IEAAXPEBG@Z
?WriteToFile@CDebugLog@@IEAAXPEADK@Z
?WriteToProcMonW@CDebugLogEx@@IEAAXPEAU_UNICODE_STRING@@@Z
?_pNonPagedAllocator@@3PEAVCMemoryAllocator@@EA
?_pPagedAllocator@@3PEAVCMemoryAllocator@@EA
?m_lpInstance@CWorkerThreadPool@@1PEAV1@EA
?m_lpRCMInstance@CWorkerThreadPool@@1PEAV1@EA
DeInitKm2UmCommunication
DeInitKmLPC
DuplicateFullFileName
FreeFullFileName
GetFileVersionOfNtoskrnl
GetKm2UmMode
GetModuleInfoByAddress
GetModuleInfoByModuleName
InitKm2UmCommunication
InitKmLPC
IsWindows8_1_update
KmCallUm
KmCallUmByLPC
KmCallUmEx
KmCleanupCommPortAPIs
KmGetUmInitProcess
KmSetCommPortAPIs
ModGetExportProcAddress
ModLoadDLLToBuffer
ModLoadDLLToBufferWithImageSize
ModLoadModule
ModUnLoadModule
NormalizeFileName
NormalizeFileName1
NormalizeFullNtPathToDosName
NormalizeFullNtPathToDosName1
TmCommConfigRoutine
UtilAddDeviceInDriveTable
UtilAddReparsePointMapping
UtilCleanFileReadOnly
UtilCloseExclusiveHandle
UtilCreateDosFileName
UtilDeleteFileForce
UtilGetDeviceObjectName
UtilGetFileNameFromFileObject
UtilGetFileObjectForProcessByEPROC
UtilGetFileObjectFromFileName
UtilGetProcessName
UtilGetSystemDirectory
UtilGetSystemDirectoryEx
UtilGetSystemDirectoryLength
UtilGetSystemTime
UtilIoSetFileInfo
UtilIopCreateFileIRP
UtilKeGetLowFileDevice
UtilModuleIATHook
UtilModuleIATUnHook
UtilPostJobToWorkerThread
UtilQueryExclusiveHandle
UtilQueryKeyValue
UtilRemoveDeviceFromDriveTable
UtilVolumeDeviceToDosName
UtilWaitValueChangeToZero
UtilWriteVersionToRegistry
UtilbuildDynamicDiskMappingTable
UtlWriteBinValueKeyToRegistry
ValidateAddressWithSize
_ResetProtectFromClose
_UtilDosPathNameToNtPathName

Sections

Expand

.text
.rdata
.data
.pdata
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2012-08-02 03:35:11
MD5	8580165a2803591e007380db9097bbcc
SHA1	5a55c227ca13e9373b87f1ef6534533c7ce1f4fb
SHA256	5027fce41ed60906a0e76b97c95c2a5a83d57a2d1cd42de232a21f26c0d58e48
Authentihash MD5	01266e09667dd8822e9895786c7802b5
Authentihash SHA1	7e52c3e0861290dd0d7e8807a6f6cfd52b7ab5c2
Authentihash SHA256	5e71106ee81d050e30afd84cade4ef4a581d70130477aa1e34549e6de50cde87
RichPEHeaderHash MD5	03cc0cf6cc93ab1faa8dd44481e28703
RichPEHeaderHash SHA1	7c749d49c0677c330200d6fcd0e2da5232be0970
RichPEHeaderHash SHA256	8ff0549239941077a9cfd73a1d1e0ca0a20d4df41e2b9d249e6115f9bc1857b4
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	Trend Micro Eyes
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 79a2a585f9d1154213d9b83ef6b68ded

Field	Value
ToBeSigned (TBS) MD5	e6d820afb23af20a65cf0b03247ea05e
ToBeSigned (TBS) SHA1	7a8f7c37453f99390ee1e94bb5d3d1cba3a0eea7
ToBeSigned (TBS) SHA256	7e722dc40e6b9abf8c20aa4d887e34b6d2c6b8cbe53a055d49bf9f5e946e0d27
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G3
ValidFrom	2012-05-01 00:00:00
ValidTo	2012-12-31 23:59:59
Signature	1e98aa27b778b508b5c9726db7dfc00e98a635c488c9d2f66df14b1afbd5f92d99009ed1e79b8be13fbd39800c66cd07bc5c9854a694ba10d14e8babf56f65cc6709a2807c52e80e03d66b7ac60518ecc8ac427c072ca73d0866dc00edfd941d73f2729893b111d68fef8eeaacf496510cd08ddf31524f5eaf7da74a75e64ece2b9f292be7cf5d9f037e6e277b23ad622966af92e82ccebd9c7fdccd173c43c2093f7545c79ee4d7607f97c6e4aac769f5fccd74ac2cb048c1504e70561eb535d38ebeb1edacbdfe0cec857dd5bb856644195d9f93eb82ba639ed37c61ffc81bd923587f30a366a139265e92c33ccb3732faf5a38ddcd5b0a3e9253655d781fa
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	79a2a585f9d1154213d9b83ef6b68ded
Version	3

Certificate 47bf1995df8d524643f7db6d480d31a4

Field	Value
ToBeSigned (TBS) MD5	518d2ea8a21e879c942d504824ac211c
ToBeSigned (TBS) SHA1	21ce87d827077e61abddf2beba69fde5432ea031
ToBeSigned (TBS) SHA256	1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7
Subject	C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
ValidFrom	2003-12-04 00:00:00
ValidTo	2013-12-03 23:59:59
Signature	4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	47bf1995df8d524643f7db6d480d31a4
Version	3

Certificate 4d6290e58c54f0f1eb17341a1310e6a4

Field	Value
ToBeSigned (TBS) MD5	b7d8444a70054990435f35a5630df5e1
ToBeSigned (TBS) SHA1	4678c6e4a8787a8e6ed2bce8792b122f6c08afd8
ToBeSigned (TBS) SHA256	0a8b4b359ea7890b358e56e436e9cfc6f32b037b2599b597ca7f7a80d475ec98
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-09-30 00:00:00
ValidTo	2014-01-01 23:59:59
Signature	aedd211d5f8f807ad25209eadb6ed25d8be8c21b6904be51a5010e59fa37d174a3eedced89742b62d5a6bf4fad361754f013e0a345d24c26cbe26da21fd01e7a070fb6b37b6f5068a2e931b3b7997d8070a0a7de0b1ea4fff34d811bdd20c91cc4afcff18ffad9da95f0ecdc5cbfe88c5a3e7ab0a3eb59437411e09b1a6af36f
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	4d6290e58c54f0f1eb17341a1310e6a4
Version	3

Certificate 610c120600000000001b

Field	Value
ToBeSigned (TBS) MD5	53c41bc1164e09e0cd1617a5bf913efd
ToBeSigned (TBS) SHA1	93c03aac8951d494ecd5696b1c08658541b18727
ToBeSigned (TBS) SHA256	40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b
Subject	C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
ValidFrom	2006-05-23 17:01:29
ValidTo	2016-05-23 17:11:29
Signature	01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	610c120600000000001b
Version	3

Certificate 6326c00ead256b6837eeb29b5ee84720

Field	Value
ToBeSigned (TBS) MD5	11b208a45459069f827186fe81c6badd
ToBeSigned (TBS) SHA1	456356986e8ecbb7b05e4617d37cb8cd69ce4969
ToBeSigned (TBS) SHA256	4a0336d7ffa5db42ece4b342e1244f5c2bd0681827f68f847d99195c83740145
Subject	C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, OU=RD, CN=Trend Micro, Inc.
ValidFrom	2011-12-27 00:00:00
ValidTo	2013-02-15 23:59:59
Signature	840ba0fc35187fe2edc7b17c101fd2bf035bbad8f3de048e250741e96a3f4ecee86f1f065ea76f2f8f430a13a75ff3eab29a8b11a13006d27bf3173fa49aabf9cef98fc4554f1732317c4b821c740eb58a91977d85e86574dd712718b15d24f7eb88b6d4520aef788478e1ef8cebd7fff06fadbc87ca6ca2b77da85be3c30b4d590bcb8945a0acfa013f89073933494d9c465c0036280a5af39f6802e60bd175a2603366dd935cb3458b1791411a06b6e5f38e3171de4238051c79b33117cb94674d0625c402bdfb0f99b80625dc0f827911c6c11263884a4e41d1abf60070ad46b7296e19e1cfcda7304a650d7a814319cc11e5a947e82b2d00a169e798b871
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	6326c00ead256b6837eeb29b5ee84720
Version	3

Imports

Expand

ntoskrnl.exe
HAL.dll
CLASSPNP.SYS

Imported Functions

Expand

wcsrchr
KeSetEvent
KePulseEvent
KeClearEvent
KeInitializeSemaphore
KeWaitForSingleObject
KeReleaseSemaphore
KeStackAttachProcess
KeUnstackDetachProcess
RtlSubAuthoritySid
RtlInitializeSid
ExAllocatePoolWithTag
RtlLengthRequiredSid
ExFreePoolWithTag
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
ObfDereferenceObject
ZwSetEvent
ZwClose
ZwRequestWaitReplyPort
ProbeForWrite
ZwFreeVirtualMemory
ZwAllocateVirtualMemory
ObOpenObjectByPointer
PsProcessType
memmove
ZwConnectPort
RtlInitUnicodeString
RtlUnicodeStringToInteger
ZwCreateSection
ZwWaitForSingleObject
ZwOpenEvent
ObfReferenceObject
IoGetCurrentProcess
DbgBreakPoint
PsGetProcessExitTime
MmSectionObjectType
DbgPrint
memset
MmIsAddressValid
ExInitializeResourceLite
ExDeleteResourceLite
ZwWriteFile
ZwReadFile
ZwQueryInformationFile
ZwSetInformationFile
ZwCreateFile
swprintf
towupper
_wcsnicmp
KeInitializeEvent
_snprintf
PsGetCurrentProcessId
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
ZwCreateKey
ZwCreateEvent
KeWaitForMultipleObjects
ObReferenceObjectByHandle
ZwNotifyChangeKey
PsGetCurrentThreadId
_vsnprintf
KeSetPriorityThread
PsTerminateSystemThread
PsCreateSystemThread
KeNumberProcessors
ZwQueryInformationProcess
PsLookupProcessByProcessId
KeDelayExecutionThread
ZwOpenDirectoryObject
PsSetCreateProcessNotifyRoutine
ZwQuerySystemInformation
ZwQueryDirectoryFile
ZwQueryDirectoryObject
ZwDuplicateObject
ZwOpenKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryValueKey
ZwDeleteValueKey
ZwDeleteKey
ExGetPreviousMode
ZwTerminateProcess
ZwOpenProcess
ZwQueryKey
ZwSetValueKey
MmHighestUserAddress
IoFreeIrp
memcpy
MmUnlockPages
IoBuildAsynchronousFsdRequest
_strnicmp
RtlQueryRegistryValues
RtlAppendUnicodeToString
mbstowcs
_purecall
ZwOpenSymbolicLinkObject
NtClose
ZwSetInformationObject
_stricmp
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwOpenFile
RtlEqualUnicodeString
IoFileObjectType
IoCreateFile
IofCallDriver
IoAllocateIrp
MmBuildMdlForNonPagedPool
IoAllocateMdl
ProbeForRead
PsGetVersion
MmGetSystemRoutineAddress
RtlCopyUnicodeString
RtlCompareMemory
_snwprintf
RtlImageNtHeader
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
strrchr
ZwQueryVolumeInformationFile
ObReferenceObjectByPointer
ObQueryNameString
IoBuildDeviceIoControlRequest
IofCompleteRequest
ExEventObjectType
_allmul
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoGetDeviceObjectPointer
RtlUpperChar
RtlCompareUnicodeString
strncpy
KeServiceDescriptorTable
NtOpenProcess
ObOpenObjectByName
IoDriverObjectType
RtlAppendUnicodeStringToString
strncmp
NtQueryInformationProcess
PsIsThreadTerminating
PsThreadType
KeAddSystemServiceTable
ZwQueryObject
ZwQuerySecurityObject
ObInsertObject
_allrem
IoReleaseVpbSpinLock
IoAcquireVpbSpinLock
SeCreateAccessState
IoGetFileObjectGenericMapping
RtlUpcaseUnicodeString
ObCreateObject
_allshr
ExInterlockedPopEntrySList
IoGetStackLimits
IoBuildSynchronousFsdRequest
MmSystemRangeStart
IoUnregisterPlugPlayNotification
FsRtlIsNameInExpression
wcsstr
IoGetConfigurationInformation
MmProbeAndLockPages
IoGetDeviceInterfaces
IoRegisterPlugPlayNotification
ExAllocatePool
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
strncat
wcschr
wcsncat
wcstombs
KeTickCount
KeBugCheckEx
RtlUnwind
wcsncpy
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
ExAcquireResourceSharedLite
ExReleaseFastMutexUnsafe
KeLeaveCriticalRegion
KeEnterCriticalRegion
IoFreeMdl
ExAcquireFastMutexUnsafe
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
RtlLengthSid
RtlAbsoluteToSelfRelativeSD
ZwQuerySymbolicLinkObject
KeGetCurrentThread
KfAcquireSpinLock
KfReleaseSpinLock
KeRaiseIrqlToDpcLevel
KfLowerIrql
KeGetCurrentIrql
ExAcquireFastMutex
ExReleaseFastMutex
KfRaiseIrql
ClassInitialize

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
??0CBlobConfig@@QAE@ABV0@@Z
??0CBlobConfig@@QAE@K@Z
??0CContext@@QAE@ABV0@@Z
??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QAE@ABV0@@Z
??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
??0CDebugLog@@QAE@ABV0@@Z
??0CDebugLog@@QAE@PBG@Z
??0CDelayLoadThread@@QAE@ABV0@@Z
??0CDelayLoadThread@@QAE@XZ
??0CExclusionExtConfig@@QAE@ABV0@@Z
??0CExclusionExtConfig@@QAE@KKE@Z
??0CExclusionFileNameConfig@@QAE@ABV0@@Z
??0CExclusionFileNameConfig@@QAE@KK@Z
??0CExclusionFilePathConfig@@QAE@ABV0@@Z
??0CExclusionFilePathConfig@@QAE@KK@Z
??0CExclusionFolderConfig@@QAE@ABV0@@Z
??0CExclusionFolderConfig@@QAE@KK@Z
??0CExclusionRegistryConfig@@QAE@ABV0@@Z
??0CExclusionRegistryConfig@@QAE@KK@Z
??0CFile@@QAE@ABV0@@Z
??0CFile@@QAE@E@Z
??0CFileExtension@@QAE@ABV0@@Z
??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
??0CInclusionExtConfig@@QAE@ABV0@@Z
??0CInclusionExtConfig@@QAE@KKE@Z
??0CInclusionFileNameConfig@@QAE@ABV0@@Z
??0CInclusionFileNameConfig@@QAE@KK@Z
??0CInclusionFilePathConfig@@QAE@ABV0@@Z
??0CInclusionFilePathConfig@@QAE@KK@Z
??0CInclusionFolderConfig@@QAE@ABV0@@Z
??0CInclusionFolderConfig@@QAE@KK@Z
??0CKEvent@@QAE@ABV0@@Z
??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
??0CList@@QAE@ABV0@@Z
??0CList@@QAE@KPAVIMemoryAllocator@@@Z
??0CLockEvent@@QAE@ABV0@@Z
??0CLockEvent@@QAE@XZ
??0CLockList@@QAE@ABV0@@Z
??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QAE@ABV0@@Z
??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
??0CMemoryPoolAllocator@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@XZ
??0CModuleConfigList@@QAE@ABV0@@Z
??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QAE@ABV0@@Z
??0CModuleFileExtConfig@@QAE@KKE@Z
??0CModuleFlagConfig@@QAE@ABV0@@Z
??0CModuleFlagConfig@@QAE@K@Z
??0CModuleMultiStringConfig@@QAE@ABV0@@Z
??0CModuleMultiStringConfig@@QAE@KK@Z
??0CModuleStringConfig@@QAE@ABV0@@Z
??0CModuleStringConfig@@QAE@K@Z
??0CNoLockList@@QAE@ABV0@@Z
??0CNoLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CSmartLock@@QAE@AAVCLockEvent@@@Z
??0CSmartLock@@QAE@XZ
??0CSmartReference@@QAE@AAJ@Z
??0CSmartReference@@QAE@AAK@Z
??0CSmartResource@@QAE@AAVCResource@@E@Z
??0CStrList@@QAE@ABV0@@Z
??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
??0CSystemThread@@QAE@ABV0@@Z
??0CSystemThread@@QAE@K@Z
??0CUserFuncAdapterJob@@QAE@ABV0@@Z
??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z0@Z
??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@E@Z
??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
??0CWorkerThreadJobQueue@@QAE@K@Z
??0CWorkerThreadPool@@QAE@ABV0@@Z
??0CWorkerThreadPool@@QAE@K@Z
??0IMemoryAllocator@@QAE@ABV0@@Z
??0IMemoryAllocator@@QAE@XZ
??1CAutoUpdateConfigThread@@UAE@XZ
??1CBlobConfig@@UAE@XZ
??1CContext@@UAE@XZ
??1CContextList@@UAE@XZ
??1CDebugLog@@UAE@XZ
??1CDelayLoadThread@@UAE@XZ
??1CExclusionExtConfig@@UAE@XZ
??1CExclusionFileNameConfig@@UAE@XZ
??1CExclusionFilePathConfig@@UAE@XZ
??1CExclusionFolderConfig@@UAE@XZ
??1CExclusionRegistryConfig@@UAE@XZ
??1CFile@@UAE@XZ
??1CFileExtension@@UAE@XZ
??1CInclusionExtConfig@@UAE@XZ
??1CInclusionFileNameConfig@@UAE@XZ
??1CInclusionFilePathConfig@@UAE@XZ
??1CInclusionFolderConfig@@UAE@XZ
??1CKEvent@@UAE@XZ
??1CList@@UAE@XZ
??1CLockEvent@@UAE@XZ
??1CLockList@@UAE@XZ
??1CMemoryAllocator@@UAE@XZ
??1CMemoryPoolAllocator@@UAE@XZ
??1CModuleConfig@@UAE@XZ
??1CModuleConfigList@@UAE@XZ
??1CModuleFileExtConfig@@UAE@XZ
??1CModuleFlagConfig@@UAE@XZ
??1CModuleMultiStringConfig@@UAE@XZ
??1CModuleStringConfig@@UAE@XZ
??1CNoLockList@@UAE@XZ
??1CSmartLock@@QAE@XZ
??1CSmartReference@@QAE@XZ
??1CSmartResource@@QAE@XZ
??1CStrList@@UAE@XZ
??1CSystemThread@@UAE@XZ
??1CUserFuncAdapterJob@@UAE@XZ
??1CWorkerThread@@UAE@XZ
??1CWorkerThreadJob@@UAE@XZ
??1CWorkerThreadJobQueue@@UAE@XZ
??1CWorkerThreadPool@@UAE@XZ
??1IMemoryAllocator@@UAE@XZ
??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??2CMemoryAllocator@@SGPAXI@Z
??2CMemoryPoolAllocator@@SGPAXI@Z
??3@YAXPAX@Z
??3IMemoryAllocator@@SGXPAX@Z
??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
??4CBlobConfig@@QAEAAV0@ABV0@@Z
??4CContext@@QAEAAV0@ABV0@@Z
??4CDebugLog@@QAEAAV0@ABV0@@Z
??4CDelayLoadThread@@QAEAAV0@ABV0@@Z
??4CFile@@QAEAAV0@ABV0@@Z
??4CKEvent@@QAEAAV0@ABV0@@Z
??4CLockEvent@@QAEAAV0@ABV0@@Z
??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
??4CModuleConfig@@QAEAAV0@ABV0@@Z
??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
??4CSmartResource@@QAEAAV0@ABV0@@Z
??4CSystemThread@@QAEAAV0@ABV0@@Z
??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
??4CWorkerThread@@QAEAAV0@ABV0@@Z
??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CDelayLoadThread@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CInclusionExtConfig@@6B@
??_7CInclusionFileNameConfig@@6B@
??_7CInclusionFilePathConfig@@6B@
??_7CInclusionFolderConfig@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CNoLockList@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QAEXXZ
??_FCFile@@QAEXXZ
??_FCFileExtension@@QAEXXZ
??_FCModuleConfigList@@QAEXXZ
??_FCStrList@@QAEXXZ
??_FCSystemThread@@QAEXXZ
??_FCWorkerThread@@QAEXXZ
??_FCWorkerThreadJob@@QAEXXZ
??_FCWorkerThreadJobQueue@@QAEXXZ
??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??_V@YAXPAX@Z
?Acquire@CLockEvent@@QAEXXZ
?Add@CContextList@@QAEEPAVCContext@@@Z
?Add@CFileExtension@@QAEEPBGK@Z
?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
?Add@CStrList@@QAEEPBG@Z
?AddNode@CLockList@@UAEEQAXE@Z
?AddNode@CNoLockList@@UAEEQAXE@Z
?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QAEXXZ
?CheckNode@CLockList@@UAEHQAX@Z
?CheckNode@CNoLockList@@UAEHQAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
?Cleanup@CBlobConfig@@AAEXXZ
?Cleanup@CModuleFileExtConfig@@IAEXXZ
?Cleanup@CModuleMultiStringConfig@@IAEXXZ
?Cleanup@CModuleStringConfig@@AAEXXZ
?Close@CFile@@QAEJXZ
?Count@CLockList@@QAEKXZ
?Count@CNoLockList@@QAEKXZ
?Create@CFile@@QAEJPBGKKKK@Z
?Create@CSystemThread@@QAEEXZ
?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
?CreatePool@CWorkerThreadPool@@QAEEXZ
?CreateThreads@CWorkerThreadPool@@QAEEK@Z
?CreateWIRP@CFile@@QAEJPBGKKKK@Z
?Delete@CFile@@QAEJXZ
?Delete@CFileExtension@@QAEEPBGK@Z
?Delete@CStrList@@QAEEPBG@Z
?DeleteAll@CList@@UAEXXZ
?DeleteAll@CLockList@@UAEXXZ
?DeleteAll@CNoLockList@@UAEXXZ
?DeleteNode@CContextList@@MAEXPAX@Z
?DeleteNode@CList@@UAEXPAX@Z
?DeleteNode@CModuleConfigList@@MAEXPAX@Z
?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YGXPAPAX@Z
?DoIt@CWorkerThreadJob@@QAEJXZ
?EntryPoint@CSystemThread@@KGXPAX@Z
?Find@CContextList@@QAEPAVCContext@@K@Z
?Find@CContextList@@QAEPAVCContext@@PAX@Z
?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FindNode@CContextList@@IAEPAXPAX@Z
?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?First@CList@@UAEPAXXZ
?First@CLockList@@UAEPAXXZ
?First@CNoLockList@@UAEPAXXZ
?Free@CMemoryAllocator@@UAEXPAX@Z
?Free@CMemoryPoolAllocator@@UAEXPAX@Z
?GetAttributes@CFile@@QAEKXZ
?GetBasicInfomration@CFile@@IAEJXZ
?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
?GetCategory@CContext@@QAEKXZ
?GetData@CBlobConfig@@QAEHPAXPAK@Z
?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QAEKXZ
?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
?GetData@CModuleStringConfig@@QAEPAGXZ
?GetData@CStrList@@QAEEPAGPAK@Z
?GetDataType@CModuleConfig@@QAEKXZ
?GetEngineContext@CContext@@QAEPAXXZ
?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UAEJKPAK@Z
?GetID@CModuleConfig@@QAEKXZ
?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QAEKXZ
?GetLinkContext@CContext@@QAEPAXXZ
?GetLogFlag@CDebugLog@@QAEKXZ
?GetModuleId@CModuleConfig@@QAEKXZ
?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QAEKXZ
?GetSize@CBlobConfig@@QAEKXZ
?GetStringConfig@CContext@@QAEPAGK@Z
?GetStringConfig@CContext@@UAEJKPAGPAK@Z
?GetThreadCount@CWorkerThreadPool@@QAEKXZ
?GetThreadID@CSystemThread@@QAEKXZ
?GetType@CContext@@QAEKXZ
?GetUserParameter@CContext@@QAEKXZ
?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
?InitializeFlagConfig@CContext@@QAEHKK@Z
?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
?InitializeStringConfig@CContext@@QAEHKPBG@Z
?Insert@CList@@UAEXQAXE@Z
?Insert@CLockList@@UAEXQAXE@Z
?Insert@CNoLockList@@UAEXQAXE@Z
?InsertAfter@CList@@UAEXPAX0@Z
?InsertBefore@CList@@UAEXPAX0@Z
?Instance@CWorkerThreadPool@@SGPAV1@XZ
?IsEmpty@CList@@UAEEXZ
?IsEmpty@CLockList@@UAEEXZ
?IsEmpty@CNoLockList@@UAEEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
?IsFull@CLockList@@QBEEXZ
?IsFull@CNoLockList@@QBEEXZ
?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionExtConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFileNameConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFilePathConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFolderConfig@@QAEEPBG@Z
?IsOpened@CFile@@QAEEXZ
?IsTerminated@CWorkerThreadPool@@QAEEXZ
?IsValid@CMemoryAllocator@@UAEEXZ
?IsValid@CMemoryPoolAllocator@@UAEEXZ
?IsValid@IMemoryAllocator@@UAEEXZ
?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
?JobFunction@CUserFuncAdapterJob@@MAEXXZ
?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QAEKXZ
?Limit@CNoLockList@@QAEKXZ
?MatchAllExtensions@CFileExtension@@QAEEXZ
?MatchNoExtensions@CFileExtension@@QAEEXZ
?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
?NeedDelete@CWorkerThreadJob@@QAEEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
?NewNode@CList@@UAEPAXXZ
?NewNode@CStrList@@EAEPAXXZ
?NewNodeVariant@CList@@IAEPAXK@Z
?Next@CList@@UBEPAXQAX@Z
?Next@CLockList@@UBEPAXQAX@Z
?Next@CNoLockList@@UBEPAXQAX@Z
?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
?NotityTerminate@CWorkerThread@@QAEXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
?Pulse@CKEvent@@QAEJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
?Read@CFile@@QAEJPADKPAK@Z
?ReferenceCount@CContext@@QAEAAKXZ
?Release@CLockEvent@@QAEXXZ
?Remove@CContextList@@UAEEQAX@Z
?Remove@CList@@UAEEQAX@Z
?Remove@CLockList@@UAEEQAX@Z
?Remove@CNoLockList@@UAEEQAX@Z
?RemoveHead@CList@@UAEPAXXZ
?RemoveHead@CLockList@@UAEPAXXZ
?RemoveHead@CNoLockList@@UAEPAXXZ
?RemoveTail@CList@@UAEPAXXZ
?RemoveTail@CLockList@@UAEPAXXZ
?RemoveTail@CNoLockList@@UAEPAXXZ
?Reset@CKEvent@@QAEXXZ
?ResetData@CInclusionExtConfig@@QAEXXZ
?ResetData@CInclusionFileNameConfig@@QAEXXZ
?ResetData@CInclusionFilePathConfig@@QAEXXZ
?ResetData@CInclusionFolderConfig@@QAEXXZ
?RestoreCR0@@YGXPAX@Z
?Run@CAutoUpdateConfigThread@@UAEXXZ
?Run@CDelayLoadThread@@UAEXXZ
?Run@CWorkerThread@@UAEXXZ
?SeekToEnd@CFile@@QAEJXZ
?Set@CKEvent@@QAEJJE@Z
?SetAttributes@CFile@@QAEJK@Z
?SetBlobCofig@CContext@@UAEJKPAXK@Z
?SetData@CBlobConfig@@QAEHPAXK@Z
?SetData@CModuleFileExtConfig@@QAEHPBG@Z
?SetData@CModuleFlagConfig@@QAEHK@Z
?SetData@CModuleMultiStringConfig@@QAEHPBGK@Z
?SetData@CModuleStringConfig@@QAEHPBG@Z
?SetEngineContext@CContext@@QAEXPAX@Z
?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
?SetFlagConfig@CContext@@UAEJKK@Z
?SetLinkContext@CContext@@QAEXPAX@Z
?SetLogFlag@CDebugLog@@QAEEK@Z
?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
?SetMultiStringConfig@CContext@@UAEJKPBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
?SetPriority@CSystemThread@@QAEXK@Z
?SetStopUse@CContext@@QAEXXZ
?SetStringConfig@CContext@@UAEJKPBG@Z
?Setup@CSystemThread@@MAEXXZ
?StopUse@CContext@@QAEHXZ
?TearDown@CSystemThread@@MAEXXZ
?Terminate@CSystemThread@@QAEXE@Z
?Terminate@CWorkerThreadPool@@QAEEXZ
?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QAEXXZ
?WaitForInit@CDelayLoadThread@@QAEEXZ
?WaitForLoad@CDelayLoadThread@@QAEEXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
?Write@CDebugLog@@QAAXPBDZZ
?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
?WriteSystemInformation@CDebugLog@@QAEXXZ
?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
?WriteToFile@CDebugLog@@IAEXPADK@Z
?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
?_pPagedAllocator@@3PAVCMemoryAllocator@@A
?m_lpInstance@CWorkerThreadPool@@1PAV1@A
?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
_DeInitKmLPC@0
_GetModuleInfoByAddress@8
_GetModuleInfoByModuleName@8
_InitKmLPC@0
_KmCallUm@8
_KmCallUmEx@12
_ModGetExportProcAddress@8
_ModLoadDLLToBuffer@4
_ModLoadDLLToBufferWithImageSize@8
_ModLoadModule@8
_ModUnLoadModule@4
_NormalizeFileName@4
_NormalizeFullNtPathToDosName@4
_TmCommConfigRoutine@4
_UtilAddDeviceInDriveTable@4
_UtilCleanFileReadOnly@4
_UtilDeleteFileForce@4
_UtilGetFileObjectForProcessByEPROC@8
_UtilGetFileObjectFromFileName@12
_UtilGetProcessName@12
_UtilGetSystemDirectory@4
_UtilGetSystemDirectoryEx@0
_UtilGetSystemDirectoryLength@0
_UtilGetSystemTime@4
_UtilIoSetFileInfo@24
_UtilIopCreateFileIRP@40
_UtilKeGetLowFileDevice@16
_UtilModuleIATHook@24
_UtilModuleIATUnHook@8
_UtilQueryKeyValue@24
_UtilRemoveDeviceFromDriveTable@4
_UtilVolumeDeviceToDosName@8
_UtilWaitValueChangeToZero@8
_UtilWriteVersionToRegistry@8
_UtilbuildDynamicDiskMappingTable@0
_UtlWriteBinValueKeyToRegistry@16
__UtilDosPathNameToNtPathName@12

Sections

Expand

.text
.rdata
.data
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2015-07-16 05:25:16
MD5	085d3423f3c12a17119920f1a293ab4d
SHA1	d3daa971580b9f94002f7257de44fcef13bb1673
SHA256	5192ec4501d0fe0b1c8f7bf9b778f7524a7a70a26bbbb66e5dab8480f6fdbb8b
Authentihash MD5	037efb773500b55fa774ab62ef60838c
Authentihash SHA1	9b1bc87c26d4a75e929ba54b88d32909d3cc6e5a
Authentihash SHA256	2e37c0e580bf6f0514af985b1581fef3d66b845aeefa790c625964512a911659
RichPEHeaderHash MD5	5b33b237bab6e0b50320054616983177
RichPEHeaderHash SHA1	754c63349a54279bb01f24974f9faf6da8294d27
RichPEHeaderHash SHA256	001d9e469d2c4160f8fbff1c0aee013e72881cffb568910a2c1473a17bf858b2
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	Trend Micro Eyes
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 009feac811b0f16247a5fc20d80523ace6

Field	Value
ToBeSigned (TBS) MD5	b6aa9cf28bcfc9f07ec1069fb425ab61
ToBeSigned (TBS) SHA1	ca7a166fcd53878ba5a38d4cac37c63513cfc1fa
ToBeSigned (TBS) SHA256	711394fc49f8948a831f687d42ced6b18514f57786ecc6cdbc3c3eb72e568a40
Subject	C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO Time Stamping Signer
ValidFrom	2015-05-05 00:00:00
ValidTo	2015-12-31 23:59:59
Signature	0dbbad60111bb5f00dcce6483a7a3e0e33dc1cb9ead620fea34dd0cc764ee818d879dfd34f9a4264238a29728a3a6c66a63c3a17a8704565c673c3d0ce8954fbac690f58b019cb869f7eb97eeb5192bf9bddebd165f0257b887cdebda5c8b51451bcc081308a85387be679fe67559387fe4fe88d0eedf37292b5c289806dd159e31d0deab138ee039d0019a5ab219b79c3ccc23e687ebdc94d694db46451fbb22874e25389ce9dfaade2dbceab7b7e064474fd0aa3c9b7a730cd49d29264f122a6b828457479e9a7ce3b33f98350947d68c01d49c760787a3c6426d5befa0a6de41ee109538fa9c523acc79d614221f02c1671493b10af2c6f1ae631f114fd6c
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	009feac811b0f16247a5fc20d80523ace6
Version	3

Certificate 250ce8e030612e9f2b89f7054d7cf8fd

Field	Value
ToBeSigned (TBS) MD5	918d9eb6a6cd36c531eceb926170a7e1
ToBeSigned (TBS) SHA1	0ae95700d65e6f59715aa47048993ca7858e676a
ToBeSigned (TBS) SHA256	47c46e6eaa3780eace3d0d891346cd373359d246b21a957219dbab4c8f37c166
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
ValidFrom	2006-11-08 00:00:00
ValidTo	2021-11-07 23:59:59
Signature	1302ddf8e88600f25af8f8200c59886207cecef74ef9bb59a198e5e138dd4ebc6618d3adeb18f20dc96d3e4a9420c33cbabd6554c6af44b310ad2c6b3eabd707b6b88163c5f95e2ee52a67cecd330c2ad7895603231fb3bee83a0859b4ec4535f78a5bff66cf50afc66d578d1978b7b9a2d157ea1f9a4bafbac98e127ec6bdff
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	250ce8e030612e9f2b89f7054d7cf8fd
Version	3

Certificate 610c120600000000001b

Field	Value
ToBeSigned (TBS) MD5	53c41bc1164e09e0cd1617a5bf913efd
ToBeSigned (TBS) SHA1	93c03aac8951d494ecd5696b1c08658541b18727
ToBeSigned (TBS) SHA256	40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b
Subject	C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
ValidFrom	2006-05-23 17:01:29
ValidTo	2016-05-23 17:11:29
Signature	01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	610c120600000000001b
Version	3

Certificate 1519396ee230f02cad1fcfdb077a35f0

Field	Value
ToBeSigned (TBS) MD5	7e2a6f93403382b4ec42463426d0a4b5
ToBeSigned (TBS) SHA1	62acc697c0e2dc37f3d37ab79751637346e051e2
ToBeSigned (TBS) SHA256	3e9a51973a839e5bc6e81c886e085b777d08ce2b24f816b7552cf2c44e322d59
Subject	C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.
ValidFrom	2015-02-20 00:00:00
ValidTo	2016-05-21 23:59:59
Signature	e480eb7f78216a855e34dbcb712d3879d6b1744c823c8e78c3661e55182a5c1f3a03686169393ef8778c893a49604a79769f5ba7156426c5431ae729a8dc5f8e22b14d124e46eff3f4f660552a57250a15e15d07ad548a02cddf8a204b5010be387a05b1019f618cf15078d80a809a7272b1822a63862c7db194f12697a786001ef630ac9d8bf9f5475191f327b8ed4839dff1ef65e5eb8f91379a66366451f99cb633848c57d4392096e6080fa327b23fc3834ad4f6043904d6c5aeb35454a265b3fda38167cffa8394f092a74bad1ea386f63b7baeb95271a97fc3bff0a2bc96a834f280a254d7170e5cc2830f3bd0649178f8b04514ecd1103753b1762902
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	1519396ee230f02cad1fcfdb077a35f0
Version	3

Certificate 5200e5aa2556fc1a86ed96c9d44b33c7

Field	Value
ToBeSigned (TBS) MD5	b30c31a572b0409383ed3fbe17e56e81
ToBeSigned (TBS) SHA1	4843a82ed3b1f2bfbee9671960e1940c942f688d
ToBeSigned (TBS) SHA256	03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-02-08 00:00:00
ValidTo	2020-02-07 23:59:59
Signature	5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	5200e5aa2556fc1a86ed96c9d44b33c7
Version	3

Imports

Expand

ntoskrnl.exe
HAL.dll
CLASSPNP.SYS

Imported Functions

Expand

wcsrchr
KeSetEvent
KePulseEvent
KeClearEvent
KeStackAttachProcess
KeUnstackDetachProcess
ObfDereferenceObject
ZwSetEvent
ZwClose
ZwConnectPort
RtlInitUnicodeString
RtlUnicodeStringToInteger
ZwCreateSection
ZwWaitForSingleObject
ZwOpenEvent
IoGetCurrentProcess
ObfReferenceObject
DbgBreakPoint
ZwRequestWaitReplyPort
ExFreePoolWithTag
ProbeForWrite
ZwFreeVirtualMemory
ZwAllocateVirtualMemory
ObOpenObjectByPointer
PsProcessType
memmove
PsGetProcessExitTime
MmSectionObjectType
PsThreadType
ObReleaseObjectSecurity
SeReleaseSubjectContext
SeAccessCheck
SeCaptureSubjectContext
ObGetObjectSecurity
DbgPrint
memset
MmIsAddressValid
ExInitializeResourceLite
ExDeleteResourceLite
ZwWriteFile
ZwReadFile
ZwQueryInformationFile
ZwSetInformationFile
ZwCreateFile
swprintf
towupper
_wcsnicmp
ExAllocatePoolWithTag
KeInitializeEvent
_snprintf
PsGetCurrentProcessId
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
PsGetCurrentThreadId
RtlInitAnsiString
ZwDeviceIoControlFile
ZwCreateKey
ZwCreateEvent
KeWaitForMultipleObjects
ObReferenceObjectByHandle
ZwNotifyChangeKey
_vsnprintf
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlEqualUnicodeString
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
RtlUpcaseUnicodeChar
ExGetPreviousMode
KeWaitForSingleObject
KeSetPriorityThread
PsTerminateSystemThread
PsCreateSystemThread
KeDelayExecutionThread
KeNumberProcessors
ZwQueryInformationProcess
PsLookupProcessByProcessId
ZwOpenDirectoryObject
PsSetCreateProcessNotifyRoutine
ZwQuerySystemInformation
ZwQueryDirectoryFile
ZwQueryDirectoryObject
ZwOpenKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryValueKey
ZwDeleteValueKey
ZwDeleteKey
ZwTerminateProcess
ZwOpenProcess
ZwQueryKey
ZwSetValueKey
IoFileObjectType
_allrem
ZwQuerySecurityObject
memcpy
RtlLengthSecurityDescriptor
MmHighestUserAddress
IoFreeIrp
IoFreeMdl
_purecall
IoBuildAsynchronousFsdRequest
_strnicmp
RtlQueryRegistryValues
RtlAppendUnicodeToString
mbstowcs
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
NtClose
ObQueryNameString
MmGetSystemRoutineAddress
ZwSetInformationObject
_stricmp
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwOpenFile
IoCreateFile
IofCallDriver
IoAllocateIrp
MmBuildMdlForNonPagedPool
IoAllocateMdl
ProbeForRead
PsGetVersion
RtlImageNtHeader
RtlCompareMemory
RtlUpcaseUnicodeString
_snwprintf
MmSystemRangeStart
wcsncmp
strrchr
ZwQueryVolumeInformationFile
ObReferenceObjectByPointer
IoBuildDeviceIoControlRequest
ZwOpenSection
_allmul
KeReleaseSemaphore
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
KeInitializeSemaphore
IofCompleteRequest
ExEventObjectType
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoGetDeviceObjectPointer
RtlUpperChar
ObReferenceObjectByName
IoDriverObjectType
RtlCompareUnicodeString
strncpy
KeServiceDescriptorTable
NtOpenProcess
ObOpenObjectByName
NtQueryInformationProcess
PsIsThreadTerminating
KeAddSystemServiceTable
ZwFsControlFile
ObInsertObject
IoReleaseVpbSpinLock
IoAcquireVpbSpinLock
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
_allshr
ExInterlockedPopEntrySList
IoGetStackLimits
IoBuildSynchronousFsdRequest
wcsstr
IoUnregisterPlugPlayNotification
FsRtlIsNameInExpression
IoGetConfigurationInformation
MmProbeAndLockPages
IoGetDeviceInterfaces
IoRegisterPlugPlayNotification
ExAllocatePool
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
strncat
wcschr
wcsncat
wcstombs
KeTickCount
KeBugCheckEx
RtlUnwind
wcsncpy
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
ExAcquireResourceSharedLite
ExReleaseFastMutexUnsafe
KeLeaveCriticalRegion
KeEnterCriticalRegion
ZwSetSecurityObject
ExAcquireFastMutexUnsafe
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
RtlLengthSid
RtlAbsoluteToSelfRelativeSD
MmUnlockPages
KeGetCurrentThread
KfAcquireSpinLock
KfReleaseSpinLock
KeRaiseIrqlToDpcLevel
KfLowerIrql
ExAcquireFastMutex
ExReleaseFastMutex
KeGetCurrentIrql
KfRaiseIrql
ClassInitialize

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
??0CBlobConfig@@QAE@ABV0@@Z
??0CBlobConfig@@QAE@K@Z
??0CContext@@QAE@ABV0@@Z
??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QAE@ABV0@@Z
??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
??0CDebugLog@@QAE@ABV0@@Z
??0CDebugLog@@QAE@PBG@Z
??0CDebugLogEx@@QAE@ABV0@@Z
??0CDebugLogEx@@QAE@K@Z
??0CDelayLoadThread@@QAE@ABV0@@Z
??0CDelayLoadThread@@QAE@XZ
??0CExclusionExtConfig@@QAE@ABV0@@Z
??0CExclusionExtConfig@@QAE@KKE@Z
??0CExclusionFileNameConfig@@QAE@ABV0@@Z
??0CExclusionFileNameConfig@@QAE@KK@Z
??0CExclusionFilePathConfig@@QAE@ABV0@@Z
??0CExclusionFilePathConfig@@QAE@KK@Z
??0CExclusionFolderConfig@@QAE@ABV0@@Z
??0CExclusionFolderConfig@@QAE@KK@Z
??0CExclusionRegistryConfig@@QAE@ABV0@@Z
??0CExclusionRegistryConfig@@QAE@KK@Z
??0CFile@@QAE@ABV0@@Z
??0CFile@@QAE@E@Z
??0CFileExtension@@QAE@ABV0@@Z
??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
??0CInclusionExtConfig@@QAE@ABV0@@Z
??0CInclusionExtConfig@@QAE@KKE@Z
??0CInclusionFileNameConfig@@QAE@ABV0@@Z
??0CInclusionFileNameConfig@@QAE@KK@Z
??0CInclusionFilePathConfig@@QAE@ABV0@@Z
??0CInclusionFilePathConfig@@QAE@KK@Z
??0CInclusionFolderConfig@@QAE@ABV0@@Z
??0CInclusionFolderConfig@@QAE@KK@Z
??0CKEvent@@QAE@ABV0@@Z
??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
??0CList@@QAE@ABV0@@Z
??0CList@@QAE@KPAVIMemoryAllocator@@@Z
??0CLockEvent@@QAE@ABV0@@Z
??0CLockEvent@@QAE@XZ
??0CLockList@@QAE@ABV0@@Z
??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QAE@ABV0@@Z
??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
??0CMemoryPoolAllocator@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@XZ
??0CModuleConfigList@@QAE@ABV0@@Z
??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QAE@ABV0@@Z
??0CModuleFileExtConfig@@QAE@KKE@Z
??0CModuleFlagConfig@@QAE@ABV0@@Z
??0CModuleFlagConfig@@QAE@K@Z
??0CModuleMultiStringConfig@@QAE@ABV0@@Z
??0CModuleMultiStringConfig@@QAE@KK@Z
??0CModuleStringConfig@@QAE@ABV0@@Z
??0CModuleStringConfig@@QAE@K@Z
??0CNoLockList@@QAE@ABV0@@Z
??0CNoLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CSmartLock@@QAE@AAVCLockEvent@@@Z
??0CSmartLock@@QAE@XZ
??0CSmartReference@@QAE@AAJ@Z
??0CSmartReference@@QAE@AAK@Z
??0CSmartResource@@QAE@AAVCResource@@E@Z
??0CStrList@@QAE@ABV0@@Z
??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
??0CSystemThread@@QAE@ABV0@@Z
??0CSystemThread@@QAE@K@Z
??0CUserFuncAdapterJob@@QAE@ABV0@@Z
??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z01@Z
??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@E@Z
??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
??0CWorkerThreadJobQueue@@QAE@K@Z
??0CWorkerThreadPool@@QAE@ABV0@@Z
??0CWorkerThreadPool@@QAE@K@Z
??0CWorkerThreadPoolEx@@QAE@ABV0@@Z
??0CWorkerThreadPoolEx@@QAE@KK@Z
??0IMemoryAllocator@@QAE@ABV0@@Z
??0IMemoryAllocator@@QAE@XZ
??1CAutoUpdateConfigThread@@UAE@XZ
??1CBlobConfig@@UAE@XZ
??1CContext@@UAE@XZ
??1CContextList@@UAE@XZ
??1CDebugLog@@UAE@XZ
??1CDebugLogEx@@UAE@XZ
??1CDelayLoadThread@@UAE@XZ
??1CExclusionExtConfig@@UAE@XZ
??1CExclusionFileNameConfig@@UAE@XZ
??1CExclusionFilePathConfig@@UAE@XZ
??1CExclusionFolderConfig@@UAE@XZ
??1CExclusionRegistryConfig@@UAE@XZ
??1CFile@@UAE@XZ
??1CFileExtension@@UAE@XZ
??1CInclusionExtConfig@@UAE@XZ
??1CInclusionFileNameConfig@@UAE@XZ
??1CInclusionFilePathConfig@@UAE@XZ
??1CInclusionFolderConfig@@UAE@XZ
??1CKEvent@@UAE@XZ
??1CList@@UAE@XZ
??1CLockEvent@@UAE@XZ
??1CLockList@@UAE@XZ
??1CMemoryAllocator@@UAE@XZ
??1CMemoryPoolAllocator@@UAE@XZ
??1CModuleConfig@@UAE@XZ
??1CModuleConfigList@@UAE@XZ
??1CModuleFileExtConfig@@UAE@XZ
??1CModuleFlagConfig@@UAE@XZ
??1CModuleMultiStringConfig@@UAE@XZ
??1CModuleStringConfig@@UAE@XZ
??1CNoLockList@@UAE@XZ
??1CSmartLock@@QAE@XZ
??1CSmartReference@@QAE@XZ
??1CSmartResource@@QAE@XZ
??1CStrList@@UAE@XZ
??1CSystemThread@@UAE@XZ
??1CUserFuncAdapterJob@@UAE@XZ
??1CWorkerThread@@UAE@XZ
??1CWorkerThreadJob@@UAE@XZ
??1CWorkerThreadJobQueue@@UAE@XZ
??1CWorkerThreadPool@@UAE@XZ
??1CWorkerThreadPoolEx@@UAE@XZ
??1IMemoryAllocator@@UAE@XZ
??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??2CMemoryAllocator@@SGPAXI@Z
??2CMemoryPoolAllocator@@SGPAXI@Z
??3@YAXPAX@Z
??3IMemoryAllocator@@SGXPAX@Z
??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
??4CBlobConfig@@QAEAAV0@ABV0@@Z
??4CContext@@QAEAAV0@ABV0@@Z
??4CDebugLog@@QAEAAV0@ABV0@@Z
??4CDebugLogEx@@QAEAAV0@ABV0@@Z
??4CDelayLoadThread@@QAEAAV0@ABV0@@Z
??4CFile@@QAEAAV0@ABV0@@Z
??4CKEvent@@QAEAAV0@ABV0@@Z
??4CLockEvent@@QAEAAV0@ABV0@@Z
??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
??4CModuleConfig@@QAEAAV0@ABV0@@Z
??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
??4CSmartResource@@QAEAAV0@ABV0@@Z
??4CSystemThread@@QAEAAV0@ABV0@@Z
??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
??4CWorkerThread@@QAEAAV0@ABV0@@Z
??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CDebugLogEx@@6B@
??_7CDelayLoadThread@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CInclusionExtConfig@@6B@
??_7CInclusionFileNameConfig@@6B@
??_7CInclusionFilePathConfig@@6B@
??_7CInclusionFolderConfig@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CNoLockList@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7CWorkerThreadPoolEx@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QAEXXZ
??_FCFile@@QAEXXZ
??_FCFileExtension@@QAEXXZ
??_FCModuleConfigList@@QAEXXZ
??_FCStrList@@QAEXXZ
??_FCSystemThread@@QAEXXZ
??_FCWorkerThread@@QAEXXZ
??_FCWorkerThreadJob@@QAEXXZ
??_FCWorkerThreadJobQueue@@QAEXXZ
??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??_V@YAXPAX@Z
?Acquire@CLockEvent@@QAEXXZ
?Add@CContextList@@QAEEPAVCContext@@@Z
?Add@CFileExtension@@QAEEPBGK@Z
?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
?Add@CStrList@@QAEEPBG@Z
?AddNode@CLockList@@UAEEQAXE@Z
?AddNode@CNoLockList@@UAEEQAXE@Z
?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QAEXXZ
?CheckNode@CLockList@@UAEHQAX@Z
?CheckNode@CNoLockList@@UAEHQAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
?Cleanup@CBlobConfig@@AAEXXZ
?Cleanup@CModuleFileExtConfig@@IAEXXZ
?Cleanup@CModuleMultiStringConfig@@IAEXXZ
?Cleanup@CModuleStringConfig@@AAEXXZ
?Close@CFile@@QAEJXZ
?Count@CLockList@@QAEKXZ
?Count@CNoLockList@@QAEKXZ
?Create@CFile@@QAEJPBGKKKK@Z
?Create@CSystemThread@@QAEEXZ
?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
?CreatePool@CWorkerThreadPool@@QAEEXZ
?CreatePool@CWorkerThreadPoolEx@@QAEEXZ
?CreateThreads@CWorkerThreadPool@@QAEEK@Z
?CreateThreads@CWorkerThreadPoolEx@@QAEEK@Z
?CreateWIRP@CFile@@QAEJPBGKKKK@Z
?Delete@CFile@@QAEJXZ
?Delete@CFileExtension@@QAEEPBGK@Z
?Delete@CStrList@@QAEEPBG@Z
?DeleteAll@CList@@UAEXXZ
?DeleteAll@CLockList@@UAEXXZ
?DeleteAll@CNoLockList@@UAEXXZ
?DeleteNode@CContextList@@MAEXPAX@Z
?DeleteNode@CList@@UAEXPAX@Z
?DeleteNode@CModuleConfigList@@MAEXPAX@Z
?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YGXPAPAX@Z
?DoIt@CWorkerThreadJob@@QAEJXZ
?EntryPoint@CSystemThread@@KGXPAX@Z
?Find@CContextList@@QAEPAVCContext@@K@Z
?Find@CContextList@@QAEPAVCContext@@PAX@Z
?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FindNode@CContextList@@IAEPAXPAX@Z
?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FinishFunction@CUserFuncAdapterJob@@MAEXXZ
?FinishIt@CWorkerThreadJob@@QAEJXZ
?First@CList@@UAEPAXXZ
?First@CLockList@@UAEPAXXZ
?First@CNoLockList@@UAEPAXXZ
?Free@CMemoryAllocator@@UAEXPAX@Z
?Free@CMemoryPoolAllocator@@UAEXPAX@Z
?GetAttributes@CFile@@QAEKXZ
?GetBasicInfomration@CFile@@IAEJXZ
?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
?GetCategory@CContext@@QAEKXZ
?GetData@CBlobConfig@@QAEHPAXPAK@Z
?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QAEKXZ
?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
?GetData@CModuleStringConfig@@QAEPAGXZ
?GetData@CStrList@@QAEEPAGPAK@Z
?GetDataType@CModuleConfig@@QAEKXZ
?GetEngineContext@CContext@@QAEPAXXZ
?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFileSizeWIRP@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UAEJKPAK@Z
?GetID@CModuleConfig@@QAEKXZ
?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QAEKXZ
?GetLinkContext@CContext@@QAEPAXXZ
?GetLogFlag@CDebugLog@@QAEKXZ
?GetLogFlag@CDebugLogEx@@QAEKXZ
?GetModuleId@CModuleConfig@@QAEKXZ
?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_KTHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_KTHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QAEKXZ
?GetSize@CBlobConfig@@QAEKXZ
?GetStringConfig@CContext@@QAEPAGK@Z
?GetStringConfig@CContext@@UAEJKPAGPAK@Z
?GetThreadCount@CWorkerThreadPool@@QAEKXZ
?GetThreadCount@CWorkerThreadPoolEx@@QAEKXZ
?GetThreadID@CSystemThread@@QAEKXZ
?GetType@CContext@@QAEKXZ
?GetUserParameter@CContext@@QAEKXZ
?InitProcMon@CDebugLogEx@@IAEXXZ
?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
?InitializeFlagConfig@CContext@@QAEHKK@Z
?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
?InitializeStringConfig@CContext@@QAEHKPBG@Z
?Insert@CList@@UAEXQAXE@Z
?Insert@CLockList@@UAEXQAXE@Z
?Insert@CNoLockList@@UAEXQAXE@Z
?InsertAfter@CList@@UAEXPAX0@Z
?InsertBefore@CList@@UAEXPAX0@Z
?Instance@CWorkerThreadPool@@SGPAV1@XZ
?IsEmpty@CList@@UAEEXZ
?IsEmpty@CLockList@@UAEEXZ
?IsEmpty@CNoLockList@@UAEEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
?IsFull@CLockList@@QBEEXZ
?IsFull@CNoLockList@@QBEEXZ
?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionExtConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFileNameConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFilePathConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFolderConfig@@QAEEPBG@Z
?IsOpened@CFile@@QAEEXZ
?IsTerminated@CWorkerThreadPool@@QAEEXZ
?IsTerminated@CWorkerThreadPoolEx@@QAEEXZ
?IsValid@CMemoryAllocator@@UAEEXZ
?IsValid@CMemoryPoolAllocator@@UAEEXZ
?IsValid@IMemoryAllocator@@UAEEXZ
?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
?IsWorkerThread@CWorkerThreadPoolEx@@QAEEK@Z
?JobFunction@CUserFuncAdapterJob@@MAEXXZ
?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
?JobQueue@CWorkerThreadPoolEx@@QAEAAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QAEKXZ
?Limit@CNoLockList@@QAEKXZ
?MatchAllExtensions@CFileExtension@@QAEEXZ
?MatchNoExtensions@CFileExtension@@QAEEXZ
?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
?NeedDelete@CWorkerThreadJob@@QAEEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
?NewNode@CList@@UAEPAXXZ
?NewNode@CStrList@@EAEPAXXZ
?NewNodeVariant@CList@@IAEPAXK@Z
?Next@CList@@UBEPAXQAX@Z
?Next@CLockList@@UBEPAXQAX@Z
?Next@CNoLockList@@UBEPAXQAX@Z
?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
?NotityTerminate@CWorkerThread@@QAEXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
?PostJobToWorkerThread@CWorkerThreadPoolEx@@QAEJP6GXPAX@Z0E1@Z
?Pulse@CKEvent@@QAEJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPoolEx@@QAEJPAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
?Read@CFile@@QAEJPADKPAK@Z
?ReadWIRP@CFile@@QAEJPADKPAK@Z
?ReferenceCount@CContext@@QAEAAKXZ
?Release@CLockEvent@@QAEXXZ
?Remove@CContextList@@UAEEQAX@Z
?Remove@CList@@UAEEQAX@Z
?Remove@CLockList@@UAEEQAX@Z
?Remove@CNoLockList@@UAEEQAX@Z
?RemoveHead@CList@@UAEPAXXZ
?RemoveHead@CLockList@@UAEPAXXZ
?RemoveHead@CNoLockList@@UAEPAXXZ
?RemoveTail@CList@@UAEPAXXZ
?RemoveTail@CLockList@@UAEPAXXZ
?RemoveTail@CNoLockList@@UAEPAXXZ
?Reset@CKEvent@@QAEXXZ
?ResetData@CInclusionExtConfig@@QAEXXZ
?ResetData@CInclusionFileNameConfig@@QAEXXZ
?ResetData@CInclusionFilePathConfig@@QAEXXZ
?ResetData@CInclusionFolderConfig@@QAEXXZ
?RestoreCR0@@YGXPAX@Z
?Run@CAutoUpdateConfigThread@@UAEXXZ
?Run@CDelayLoadThread@@UAEXXZ
?Run@CWorkerThread@@UAEXXZ
?SeekToEnd@CFile@@QAEJXZ
?Set@CKEvent@@QAEJJE@Z
?SetAttributes@CFile@@QAEJK@Z
?SetBlobCofig@CContext@@UAEJKPAXK@Z
?SetData@CBlobConfig@@QAEHPAXK@Z
?SetData@CModuleFileExtConfig@@QAEHPBG@Z
?SetData@CModuleFlagConfig@@QAEHK@Z
?SetData@CModuleMultiStringConfig@@QAEHPBGK@Z
?SetData@CModuleStringConfig@@QAEHPBG@Z
?SetEngineContext@CContext@@QAEXPAX@Z
?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
?SetFlagConfig@CContext@@UAEJKK@Z
?SetLinkContext@CContext@@QAEXPAX@Z
?SetLogFlag@CDebugLog@@QAEEK@Z
?SetLogFlag@CDebugLogEx@@QAEEK@Z
?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
?SetMultiStringConfig@CContext@@UAEJKPBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
?SetPriority@CSystemThread@@QAEXK@Z
?SetStopUse@CContext@@QAEXXZ
?SetStringConfig@CContext@@UAEJKPBG@Z
?Setup@CSystemThread@@MAEXXZ
?StopUse@CContext@@QAEHXZ
?TearDown@CSystemThread@@MAEXXZ
?Terminate@CSystemThread@@QAEXE@Z
?Terminate@CWorkerThreadPool@@QAEEXZ
?Terminate@CWorkerThreadPoolEx@@QAEEXZ
?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QAEXXZ
?WaitForInit@CDelayLoadThread@@QAEEXZ
?WaitForLoad@CDelayLoadThread@@QAEEXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
?WaitQueueEmpty@CWorkerThreadJobQueue@@QAEXXZ
?Write@CDebugLog@@QAAXPBDZZ
?Write@CDebugLogEx@@QAAXPBDZZ
?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
?WriteDataToFile@CDebugLogEx@@IAEXPADK@Z
?WriteDataToProcMonW@CDebugLogEx@@IAEXPAD@Z
?WriteSystemInformation@CDebugLog@@QAEXXZ
?WriteSystemInformation@CDebugLogEx@@QAEXXZ
?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
?WriteSystemStringInformation@CDebugLogEx@@IAEXPBG@Z
?WriteToFile@CDebugLog@@IAEXPADK@Z
?WriteToProcMonW@CDebugLogEx@@IAEXPAU_UNICODE_STRING@@@Z
?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
?_pPagedAllocator@@3PAVCMemoryAllocator@@A
?m_lpInstance@CWorkerThreadPool@@1PAV1@A
?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
_DeInitKm2UmCommunication@0
_DeInitKmLPC@0
_DuplicateFullFileName@4
_FreeFullFileName@4
_GetKm2UmMode@0
_GetModuleInfoByAddress@8
_GetModuleInfoByModuleName@8
_InitKm2UmCommunication@8
_InitKmLPC@0
_IsVerifierCodeCheckFlagOn@0
_IsWindows8_1_update@4
_KmCallUm@8
_KmCallUmByLPC@8
_KmCallUmEx@12
_KmCleanupCommPortAPIs@0
_KmGetUmInitProcess@0
_KmSetCommPortAPIs@4
_ModGetExportProcAddress@8
_ModLoadDLLToBuffer@4
_ModLoadDLLToBufferWithImageSize@8
_ModLoadModule@8
_ModUnLoadModule@4
_NormalizeFileName@4
_NormalizeFullNtPathToDosName@4
_TmCommConfigRoutine@4
_UtilAddDeviceInDriveTable@4
_UtilAddReparsePointMapping@8
_UtilCleanFileReadOnly@4
_UtilCloseExclusiveHandle@12
_UtilCreateDosFileName@8
_UtilDeleteFileForce@4
_UtilGetDeviceObjectName@8
_UtilGetFileNameFromFileObject@4
_UtilGetFileObjectForProcessByEPROC@8
_UtilGetFileObjectFromFileName@12
_UtilGetProcessName@12
_UtilGetSystemDirectory@4
_UtilGetSystemDirectoryEx@0
_UtilGetSystemDirectoryLength@0
_UtilGetSystemTime@4
_UtilIoSetFileInfo@24
_UtilIopCreateFileIRP@40
_UtilKeGetLowFileDevice@16
_UtilModuleIATHook@24
_UtilModuleIATUnHook@8
_UtilPostJobToWorkerThread@12
_UtilQueryExclusiveHandle@12
_UtilQueryKeyValue@24
_UtilRemoveDeviceFromDriveTable@4
_UtilVolumeDeviceToDosName@8
_UtilWaitValueChangeToZero@8
_UtilWriteVersionToRegistry@8
_UtilbuildDynamicDiskMappingTable@0
_UtlWriteBinValueKeyToRegistry@16
_ValidateAddressWithSize@20
__ResetProtectFromClose@4
__UtilDosPathNameToNtPathName@12

Sections

Expand

.text
.rdata
.data
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2008-07-22 06:53:20
MD5	08bac71557df8a9b1381c8c165f64520
SHA1	891c8d482e23222498022845a6b349fe1a186bcc
SHA256	61befeef14783eb0fed679fca179d2f5c33eb2dcbd40980669ca2ebeb3bf11cf
Authentihash MD5	cfb84fad4e23da054656c41b09c8c467
Authentihash SHA1	4dad9e501ec85acd2b405eca3fc1e5787d64ab34
Authentihash SHA256	14cfe7b4f7572aa3434ac5dd458a35f286538b34734cf7a310fb7bcba209921c
RichPEHeaderHash MD5	fd5680b44e33c644adb2a11aaf9c107b
RichPEHeaderHash SHA1	797adadf7d576be425cefa156494b0e490b2fc81
RichPEHeaderHash SHA256	bf0ee0f8675bb1fbe955bd5eedb7f49b38a8af2e99a9f101d826baf830fe6c55
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	AEGIS
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 3825d7faf861af9ef490e726b5d65ad5

Field	Value
ToBeSigned (TBS) MD5	d6c7684e9aaa508cf268335f83afe040
ToBeSigned (TBS) SHA1	18066d20ad92409c567cdfde745279ff71c75226
ToBeSigned (TBS) SHA256	a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff
Subject	C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2
ValidFrom	2007-06-15 00:00:00
ValidTo	2012-06-14 23:59:59
Signature	50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	3825d7faf861af9ef490e726b5d65ad5
Version	3

Certificate 47bf1995df8d524643f7db6d480d31a4

Field	Value
ToBeSigned (TBS) MD5	518d2ea8a21e879c942d504824ac211c
ToBeSigned (TBS) SHA1	21ce87d827077e61abddf2beba69fde5432ea031
ToBeSigned (TBS) SHA256	1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7
Subject	C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
ValidFrom	2003-12-04 00:00:00
ValidTo	2013-12-03 23:59:59
Signature	4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	47bf1995df8d524643f7db6d480d31a4
Version	3

Certificate 4191a15a3978dfcf496566381d4c75c2

Field	Value
ToBeSigned (TBS) MD5	41011f8d0e7c7a6408334ca387914c61
ToBeSigned (TBS) SHA1	c7fc1727f5b75a6421a1f95c73bbdb23580c48e5
ToBeSigned (TBS) SHA256	88dd3952638ee82738c03168e6fd863fe4eab1059ee5e2926ad8cb587c255dc0
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA
ValidFrom	2004-07-16 00:00:00
ValidTo	2014-07-15 23:59:59
Signature	ae3a17b84a7b55fa6455ec40a4ed494190999c89bcaf2e1dca7823f91c190f7feb68bc32d98838dedc3fd389b43fb18296f1a45abaed2e26d3de7c016e000a00a4069211480940f91c1879672324e0bbd5e150ae1bf50edde02e81cd80a36c524f9175558aba22f2d2ea4175882f63557d1e545a9559cad93481c05f5ef67ab5
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	4191a15a3978dfcf496566381d4c75c2
Version	3

Certificate 645212f783f4d7aba3555729e99ce065

Field	Value
ToBeSigned (TBS) MD5	e00f0a38c65f7c0b9f19b97448d6a0e3
ToBeSigned (TBS) SHA1	91c033a2f289418c4101654dceacef1b25bb55d0
ToBeSigned (TBS) SHA256	38b3fcbdb734b0e3439f3c9a3c4c1712091f577d2b616d41224137faf7ba7c86
Subject	C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, OU=RD, CN=Trend Micro, Inc.
ValidFrom	2008-01-16 00:00:00
ValidTo	2011-02-16 23:59:59
Signature	5a693868cea6ba49064b801a0d9e12887a37cbb92cca2950cc5e99c2df9aec5697422e67cd042836daf09a09e739f625255841fed1ec9657cb8b3edc08c55c302574cbdb3f7de2798ed769d766402619b48041f9d90f8c904488788412b1c632055e1afc4a5bbac642cb626bd20fece0feaa6cf9b287887788cf64586309a14a644b5f0595c0ddcb7d789831faedb48451e40e342da4ccbc38a5e992e57e7ce5328d531a8c68e61f9dc9be65605c1bedf3358579000b91a19b3be388bac36b58ca76b72358bd8e74e0a7b08b0587bb7a29758c01af40b80e8e72c76abd3a2babfe7c1ed6e7b1cd9b0221a605062b6d9d0ceb57e0eb305fdc5eb5bf6ea442f4c9
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	645212f783f4d7aba3555729e99ce065
Version	3

Certificate 610c120600000000001b

Field	Value
ToBeSigned (TBS) MD5	53c41bc1164e09e0cd1617a5bf913efd
ToBeSigned (TBS) SHA1	93c03aac8951d494ecd5696b1c08658541b18727
ToBeSigned (TBS) SHA256	40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b
Subject	C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
ValidFrom	2006-05-23 17:01:29
ValidTo	2016-05-23 17:11:29
Signature	01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	610c120600000000001b
Version	3

Imports

Expand

ntoskrnl.exe
CLASSPNP.SYS

Imported Functions

Expand

KeEnterCriticalRegion
KeGetCurrentThread
KeLeaveCriticalRegion
ExReleaseFastMutexUnsafe
wcsncpy
memcpy
wcsrchr
KeSetEvent
KePulseEvent
KeClearEvent
KeInitializeSemaphore
KeWaitForSingleObject
DbgPrint
KeReleaseSemaphore
RtlSubAuthoritySid
RtlInitializeSid
ExAllocatePoolWithTag
RtlLengthRequiredSid
ExFreePoolWithTag
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
ObfDereferenceObject
ZwSetEvent
ZwClose
KeUnstackDetachProcess
ZwRequestWaitReplyPort
memmove
KeStackAttachProcess
ZwConnectPort
RtlInitUnicodeString
ZwCreateSection
ZwWaitForSingleObject
ZwOpenEvent
ObfReferenceObject
IoGetCurrentProcess
memset
MmIsAddressValid
ZwWriteFile
ZwReadFile
ZwQueryInformationFile
ZwSetInformationFile
ZwCreateFile
swprintf
towupper
_wcsnicmp
KeInitializeEvent
_snprintf
PsGetCurrentProcessId
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
ZwCreateKey
ZwCreateEvent
KeWaitForMultipleObjects
ObReferenceObjectByHandle
ZwNotifyChangeKey
PsGetCurrentThreadId
_vsnprintf
MmMapLockedPagesSpecifyCache
MmBuildMdlForNonPagedPool
MmCreateMdl
MmUnmapLockedPages
KeSetPriorityThread
PsTerminateSystemThread
PsCreateSystemThread
KeNumberProcessors
ZwQuerySystemInformation
ZwQueryDirectoryFile
ZwOpenDirectoryObject
ZwQueryDirectoryObject
ZwDuplicateObject
ZwOpenKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryValueKey
ZwDeleteValueKey
ZwDeleteKey
ExGetPreviousMode
ExAcquireFastMutexUnsafe
ObOpenObjectByPointer
PsProcessType
ZwOpenProcess
ZwQueryKey
ZwSetValueKey
IoFreeIrp
IoBuildAsynchronousFsdRequest
ProbeForWrite
KeBugCheckEx
RtlImageNtHeader
_stricmp
_strnicmp
RtlQueryRegistryValues
RtlAppendUnicodeToString
KeDelayExecutionThread
mbstowcs
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
RtlEqualUnicodeString
IoFileObjectType
IoCreateFile
IofCallDriver
IoAllocateIrp
IoFreeMdl
IoAllocateMdl
PsGetVersion
MmGetSystemRoutineAddress
RtlCompareMemory
RtlCopyUnicodeString
RtlAppendUnicodeStringToString
IofCompleteRequest
ExEventObjectType
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
ProbeForRead
IoGetDeviceObjectPointer
ExAllocatePool
RtlUpperChar
RtlCompareUnicodeString
PsLookupProcessByProcessId
strncpy
KeServiceDescriptorTable
NtOpenProcess
ObReferenceObjectByPointer
MmSectionObjectType
ObQueryNameString
ObOpenObjectByName
NtQueryInformationProcess
_snwprintf
RtlAnsiStringToUnicodeString
KeAddSystemServiceTable
ZwQueryObject
ZwQuerySecurityObject
ObInsertObject
_allrem
IoReleaseVpbSpinLock
IoAcquireVpbSpinLock
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
KeTickCount
RtlUnwind
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
RtlLengthSid
wcschr
RtlAbsoluteToSelfRelativeSD
RtlFreeUnicodeString
ZwTerminateProcess
_purecall
ClassInitialize

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
??0CBlobConfig@@QAE@ABV0@@Z
??0CBlobConfig@@QAE@K@Z
??0CContext@@QAE@ABV0@@Z
??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QAE@ABV0@@Z
??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
??0CDebugLog@@QAE@ABV0@@Z
??0CDebugLog@@QAE@PBG@Z
??0CExclusionExtConfig@@QAE@ABV0@@Z
??0CExclusionExtConfig@@QAE@KKE@Z
??0CExclusionFileNameConfig@@QAE@ABV0@@Z
??0CExclusionFileNameConfig@@QAE@KK@Z
??0CExclusionFilePathConfig@@QAE@ABV0@@Z
??0CExclusionFilePathConfig@@QAE@KK@Z
??0CExclusionFolderConfig@@QAE@ABV0@@Z
??0CExclusionFolderConfig@@QAE@KK@Z
??0CExclusionRegistryConfig@@QAE@ABV0@@Z
??0CExclusionRegistryConfig@@QAE@KK@Z
??0CFile@@QAE@ABV0@@Z
??0CFile@@QAE@E@Z
??0CFileExtension@@QAE@ABV0@@Z
??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
??0CKEvent@@QAE@ABV0@@Z
??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
??0CList@@QAE@ABV0@@Z
??0CList@@QAE@KPAVIMemoryAllocator@@@Z
??0CLockEvent@@QAE@ABV0@@Z
??0CLockEvent@@QAE@XZ
??0CLockList@@QAE@ABV0@@Z
??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QAE@ABV0@@Z
??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
??0CMemoryPoolAllocator@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@XZ
??0CModuleConfigList@@QAE@ABV0@@Z
??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QAE@ABV0@@Z
??0CModuleFileExtConfig@@QAE@KKE@Z
??0CModuleFlagConfig@@QAE@ABV0@@Z
??0CModuleFlagConfig@@QAE@K@Z
??0CModuleMultiStringConfig@@QAE@ABV0@@Z
??0CModuleMultiStringConfig@@QAE@KK@Z
??0CModuleStringConfig@@QAE@ABV0@@Z
??0CModuleStringConfig@@QAE@K@Z
??0CSmartLock@@QAE@AAVCLockEvent@@@Z
??0CSmartLock@@QAE@XZ
??0CSmartReference@@QAE@AAJ@Z
??0CSmartReference@@QAE@AAK@Z
??0CStrList@@QAE@ABV0@@Z
??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
??0CSystemThread@@QAE@ABV0@@Z
??0CSystemThread@@QAE@K@Z
??0CUserFuncAdapterJob@@QAE@ABV0@@Z
??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z0@Z
??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@E@Z
??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
??0CWorkerThreadJobQueue@@QAE@K@Z
??0CWorkerThreadPool@@QAE@ABV0@@Z
??0CWorkerThreadPool@@QAE@K@Z
??0IMemoryAllocator@@QAE@ABV0@@Z
??0IMemoryAllocator@@QAE@XZ
??1CAutoUpdateConfigThread@@UAE@XZ
??1CBlobConfig@@UAE@XZ
??1CContext@@UAE@XZ
??1CContextList@@UAE@XZ
??1CDebugLog@@UAE@XZ
??1CExclusionExtConfig@@UAE@XZ
??1CExclusionFileNameConfig@@UAE@XZ
??1CExclusionFilePathConfig@@UAE@XZ
??1CExclusionFolderConfig@@UAE@XZ
??1CExclusionRegistryConfig@@UAE@XZ
??1CFile@@UAE@XZ
??1CFileExtension@@UAE@XZ
??1CKEvent@@UAE@XZ
??1CList@@UAE@XZ
??1CLockEvent@@UAE@XZ
??1CLockList@@UAE@XZ
??1CMemoryAllocator@@UAE@XZ
??1CMemoryPoolAllocator@@UAE@XZ
??1CModuleConfig@@UAE@XZ
??1CModuleConfigList@@UAE@XZ
??1CModuleFileExtConfig@@UAE@XZ
??1CModuleFlagConfig@@UAE@XZ
??1CModuleMultiStringConfig@@UAE@XZ
??1CModuleStringConfig@@UAE@XZ
??1CSmartLock@@QAE@XZ
??1CSmartReference@@QAE@XZ
??1CStrList@@UAE@XZ
??1CSystemThread@@UAE@XZ
??1CUserFuncAdapterJob@@UAE@XZ
??1CWorkerThread@@UAE@XZ
??1CWorkerThreadJob@@UAE@XZ
??1CWorkerThreadJobQueue@@UAE@XZ
??1CWorkerThreadPool@@UAE@XZ
??1IMemoryAllocator@@UAE@XZ
??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??2CMemoryAllocator@@SGPAXI@Z
??2CMemoryPoolAllocator@@SGPAXI@Z
??3@YAXPAX@Z
??3IMemoryAllocator@@SGXPAX@Z
??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
??4CBlobConfig@@QAEAAV0@ABV0@@Z
??4CContext@@QAEAAV0@ABV0@@Z
??4CDebugLog@@QAEAAV0@ABV0@@Z
??4CFile@@QAEAAV0@ABV0@@Z
??4CKEvent@@QAEAAV0@ABV0@@Z
??4CLockEvent@@QAEAAV0@ABV0@@Z
??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
??4CModuleConfig@@QAEAAV0@ABV0@@Z
??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
??4CSystemThread@@QAEAAV0@ABV0@@Z
??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
??4CWorkerThread@@QAEAAV0@ABV0@@Z
??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QAEXXZ
??_FCFile@@QAEXXZ
??_FCFileExtension@@QAEXXZ
??_FCModuleConfigList@@QAEXXZ
??_FCStrList@@QAEXXZ
??_FCSystemThread@@QAEXXZ
??_FCWorkerThread@@QAEXXZ
??_FCWorkerThreadJob@@QAEXXZ
??_FCWorkerThreadJobQueue@@QAEXXZ
??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??_V@YAXPAX@Z
?Acquire@CLockEvent@@QAEXXZ
?Add@CContextList@@QAEEPAVCContext@@@Z
?Add@CFileExtension@@QAEEPBGK@Z
?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
?Add@CStrList@@QAEEPBG@Z
?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QAEXXZ
?CheckNode@CLockList@@UAEHQAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
?Cleanup@CBlobConfig@@AAEXXZ
?Cleanup@CModuleFileExtConfig@@IAEXXZ
?Cleanup@CModuleMultiStringConfig@@IAEXXZ
?Cleanup@CModuleStringConfig@@AAEXXZ
?Close@CFile@@QAEJXZ
?Count@CLockList@@QAEKXZ
?Create@CFile@@QAEJPBGKKKK@Z
?Create@CSystemThread@@QAEEXZ
?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
?CreatePool@CWorkerThreadPool@@QAEEXZ
?CreateThreads@CWorkerThreadPool@@QAEEK@Z
?CreateWIRP@CFile@@QAEJPBGKKKK@Z
?Delete@CFile@@QAEJXZ
?Delete@CFileExtension@@QAEEPBGK@Z
?Delete@CStrList@@QAEEPBG@Z
?DeleteAll@CList@@UAEXXZ
?DeleteAll@CLockList@@UAEXXZ
?DeleteNode@CContextList@@MAEXPAX@Z
?DeleteNode@CList@@UAEXPAX@Z
?DeleteNode@CModuleConfigList@@MAEXPAX@Z
?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YGXPAPAX@Z
?DoIt@CWorkerThreadJob@@QAEJXZ
?EntryPoint@CSystemThread@@KGXPAX@Z
?Find@CContextList@@QAEPAVCContext@@K@Z
?Find@CContextList@@QAEPAVCContext@@PAX@Z
?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FindNode@CContextList@@IAEPAXPAX@Z
?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?First@CList@@UAEPAXXZ
?First@CLockList@@UAEPAXXZ
?Free@CMemoryAllocator@@UAEXPAX@Z
?Free@CMemoryPoolAllocator@@UAEXPAX@Z
?GetAttributes@CFile@@QAEKXZ
?GetBasicInfomration@CFile@@IAEJXZ
?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
?GetCategory@CContext@@QAEKXZ
?GetData@CBlobConfig@@QAEHPAXPAK@Z
?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QAEKXZ
?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
?GetData@CModuleStringConfig@@QAEPAGXZ
?GetData@CStrList@@QAEEPAGPAK@Z
?GetDataType@CModuleConfig@@QAEKXZ
?GetEngineContext@CContext@@QAEPAXXZ
?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UAEJKPAK@Z
?GetID@CModuleConfig@@QAEKXZ
?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QAEKXZ
?GetLinkContext@CContext@@QAEPAXXZ
?GetLogFlag@CDebugLog@@QAEKXZ
?GetModuleId@CModuleConfig@@QAEKXZ
?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QAEKXZ
?GetSize@CBlobConfig@@QAEKXZ
?GetStringConfig@CContext@@QAEPAGK@Z
?GetStringConfig@CContext@@UAEJKPAGPAK@Z
?GetThreadCount@CWorkerThreadPool@@QAEKXZ
?GetThreadID@CSystemThread@@QAEKXZ
?GetType@CContext@@QAEKXZ
?GetUserParameter@CContext@@QAEKXZ
?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
?InitializeFlagConfig@CContext@@QAEHKK@Z
?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
?InitializeStringConfig@CContext@@QAEHKPBG@Z
?Insert@CList@@UAEXQAXE@Z
?Insert@CLockList@@UAEXQAXE@Z
?InsertAfter@CList@@UAEXPAX0@Z
?InsertBefore@CList@@UAEXPAX0@Z
?Instance@CWorkerThreadPool@@SGPAV1@XZ
?IsEmpty@CList@@UAEEXZ
?IsEmpty@CLockList@@UAEEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
?IsFull@CLockList@@QBEEXZ
?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
?IsOpened@CFile@@QAEEXZ
?IsTerminated@CWorkerThreadPool@@QAEEXZ
?IsValid@CMemoryAllocator@@UAEEXZ
?IsValid@CMemoryPoolAllocator@@UAEEXZ
?IsValid@IMemoryAllocator@@UAEEXZ
?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
?JobFunction@CUserFuncAdapterJob@@MAEXXZ
?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QAEKXZ
?MatchAllExtensions@CFileExtension@@QAEEXZ
?MatchNoExtensions@CFileExtension@@QAEEXZ
?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
?NeedDelete@CWorkerThreadJob@@QAEEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
?NewNode@CList@@UAEPAXXZ
?NewNode@CStrList@@EAEPAXXZ
?NewNodeVariant@CList@@IAEPAXK@Z
?Next@CList@@UBEPAXQAX@Z
?Next@CLockList@@UBEPAXQAX@Z
?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
?NotityTerminate@CWorkerThread@@QAEXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
?Pulse@CKEvent@@QAEJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
?Read@CFile@@QAEJPADKPAK@Z
?ReferenceCount@CContext@@QAEAAKXZ
?Release@CLockEvent@@QAEXXZ
?Remove@CContextList@@UAEEQAX@Z
?Remove@CList@@UAEEQAX@Z
?Remove@CLockList@@UAEEQAX@Z
?RemoveHead@CList@@UAEPAXXZ
?RemoveHead@CLockList@@UAEPAXXZ
?RemoveTail@CList@@UAEPAXXZ
?RemoveTail@CLockList@@UAEPAXXZ
?Reset@CKEvent@@QAEXXZ
?RestoreCR0@@YGXPAX@Z
?Run@CAutoUpdateConfigThread@@UAEXXZ
?Run@CWorkerThread@@UAEXXZ
?SeekToEnd@CFile@@QAEJXZ
?Set@CKEvent@@QAEJJE@Z
?SetAttributes@CFile@@QAEJK@Z
?SetBlobCofig@CContext@@UAEJKPAXK@Z
?SetData@CBlobConfig@@QAEHPAXK@Z
?SetData@CModuleFileExtConfig@@QAEHPBG@Z
?SetData@CModuleFlagConfig@@QAEHK@Z
?SetData@CModuleMultiStringConfig@@QAEHPBG@Z
?SetData@CModuleStringConfig@@QAEHPBG@Z
?SetEngineContext@CContext@@QAEXPAX@Z
?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
?SetFlagConfig@CContext@@UAEJKK@Z
?SetLinkContext@CContext@@QAEXPAX@Z
?SetLogFlag@CDebugLog@@QAEEK@Z
?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
?SetMultiStringConfig@CContext@@UAEJKPBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
?SetPriority@CSystemThread@@QAEXK@Z
?SetStopUse@CContext@@QAEXXZ
?SetStringConfig@CContext@@UAEJKPBG@Z
?Setup@CSystemThread@@MAEXXZ
?StopUse@CContext@@QAEHXZ
?TearDown@CSystemThread@@MAEXXZ
?Terminate@CSystemThread@@QAEXE@Z
?Terminate@CWorkerThreadPool@@QAEEXZ
?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QAEXXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
?Write@CDebugLog@@QAAXPBDZZ
?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
?WriteSystemInformation@CDebugLog@@QAEXXZ
?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
?WriteToFile@CDebugLog@@IAEXPADK@Z
?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
?_pPagedAllocator@@3PAVCMemoryAllocator@@A
?m_lpInstance@CWorkerThreadPool@@1PAV1@A
?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
_DeInitKmLPC@0
_GetModuleInfoByAddress@8
_GetModuleInfoByModuleName@8
_InitKmLPC@0
_KmCallUm@8
_MapMem@12
_ModGetExportProcAddress@8
_ModLoadDLLToBuffer@4
_ModLoadModule@8
_ModUnLoadModule@4
_NormalizeFileName@4
_NormalizeFullNtPathToDosName@4
_TmCommConfigRoutine@4
_UnMapMem@8
_UtilGetFileObjectForProcessByEPROC@8
_UtilGetProcessName@12
_UtilGetSystemTime@4
_UtilIoSetFileInfo@24
_UtilIopCreateFileIRP@40
_UtilKeGetLowFileDevice@16
_UtilQueryKeyValue@24
_UtilVolumeDeviceToDosName@8
_UtilWaitValueChangeToZero@8
_UtilWriteVersionToRegistry@8
_UtilbuildDynamicDiskMappingTable@0
__UtilDosPathNameToNtPathName@12

Sections

Expand

.text
.rdata
.data
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2016-08-01 21:01:01
MD5	42132c7a755064f94314b01afb80e73c
SHA1	3e790c4e893513566916c76a677b0f98bd7334dd
SHA256	62f5e13b2edc00128716cb93e6a9eddffea67ce83d2bb426f18f5be08ead89e0
Authentihash MD5	37dd516b2406b4e5d95e260886230437
Authentihash SHA1	95e72a3ba11c83d127302e8327b2fe9580a61e3f
Authentihash SHA256	a553ba125adf00a769718d5cd26ed1a59b5e397956ebc6163973b10fe8c58214
RichPEHeaderHash MD5	15c4587da185e00df2f0c96851dcc38c
RichPEHeaderHash SHA1	d11202ca48859e8c148a964c6e4871cf1affc82d
RichPEHeaderHash SHA256	625832d0b9c8d6aef127c177634d2f29f994e6ed52ae7b78e592bc13316aa347
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	Trend Micro Eyes
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 1688f039255e638e69143907e6330b

Field	Value
ToBeSigned (TBS) MD5	0179e8ddeebaf8998fec419d65cdf13d
ToBeSigned (TBS) SHA1	34c724c3369f2da8c25b591808962f66f10bde28
ToBeSigned (TBS) SHA256	35b0bac11602847aaab65fb35199d3c8976cde3ccf7e061b130177c712cbd92f
Subject	C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO SHA,1 Time Stamping Signer
ValidFrom	2015-12-31 00:00:00
ValidTo	2019-07-09 18:40:36
Signature	ba332440408c7cdb589fb36098b2f5c031feeb1f6e50f60ae0e4e681ad2687a2dffdb3daf473f300fb291b891b153edb6b52932bc4ac3981d73c67579a3936e028089ae3394f9b89097f7bc5617f598932250a6aae1a3ef0a227a8b6c3b887f7160448413d5cd8ec9f4d203104d965a1edcd690753163ddd36020a88eb40e506300bb8164bdcefbc5509ffc63e122e76b3dcce42eff97657e1b70a054098589a5d711693718c6581ea6ff389f7fb73adb4e7bfd98e6faa0b4f25f3b8e1d5dd75986881f8aac0d180c2c4c43989c1f6c99e6cd774f9d997f84fc29a0acd5e8ff819e9e0a59fc4f09221e62d7925c922f9c3f03a8457ad3a16f46394101d5dd0c6
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	1688f039255e638e69143907e6330b
Version	3

Certificate 774d49c5649436de6bf3190a67eedcdf

Field	Value
ToBeSigned (TBS) MD5	b3ca7d6b821d8e3432b29874980af55e
ToBeSigned (TBS) SHA1	618d7e55a24c1d8b65a0bcce79120c5e3b13fa4d
ToBeSigned (TBS) SHA256	c645c6a7dc7243a4a3f78a6569c029401a7bda8bc4732ce7198d9f21f19b12fa
Subject	C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.
ValidFrom	2016-03-29 00:00:00
ValidTo	2017-06-28 23:59:59
Signature	27351697f046d1d43fe306dff30b83e7a404e3e6431c1e06829c558d99eb3f21776021e3e1bd4e485aba08b89bb0972f23daa471d7b432a44a591270f9a838f13dbda32ee936c0df792cff8c493e1f27b2282b3d896ae7b4155ca1a50bf7111f3f4bbbe11f17cfe5d49c0589c210966ef7e567153e802d2e783ff498c59585598d9d3e93273d1e81c07ce85c0cfb24834d448c3930120f1686bd472d916ac8f9475acfdb27be8528311f668d71dfc132a0ff62df7baa575a0cc732b3de003beca214954d4d97cf9511b9329eccbb7b716675b31e543a43570080dffce3fc8ca8fbb17d954b9678e2d0c1e1710a5cf03952a687fede59dcba3bf98900f9934f12
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	774d49c5649436de6bf3190a67eedcdf
Version	3

Certificate 611993e400000000001c

Field	Value
ToBeSigned (TBS) MD5	78a717e082dcc1cda3458d917e677d14
ToBeSigned (TBS) SHA1	4a872e0e51f9b304469cd1dedb496ee9b8b983a4
ToBeSigned (TBS) SHA256	317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
ValidFrom	2011-02-22 19:25:17
ValidTo	2021-02-22 19:35:17
Signature	812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	611993e400000000001c
Version	3

Certificate 5200e5aa2556fc1a86ed96c9d44b33c7

Field	Value
ToBeSigned (TBS) MD5	b30c31a572b0409383ed3fbe17e56e81
ToBeSigned (TBS) SHA1	4843a82ed3b1f2bfbee9671960e1940c942f688d
ToBeSigned (TBS) SHA256	03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-02-08 00:00:00
ValidTo	2020-02-07 23:59:59
Signature	5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	5200e5aa2556fc1a86ed96c9d44b33c7
Version	3

Imports

Expand

ntoskrnl.exe
CLASSPNP.SYS
HAL.dll

Imported Functions

Expand

ExAcquireFastMutexUnsafe
ExReleaseFastMutexUnsafe
ProbeForRead
ProbeForWrite
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
MmProbeAndLockPages
MmUnlockPages
MmMapLockedPagesSpecifyCache
IoAllocateMdl
IoFreeMdl
IoGetCurrentProcess
ObfReferenceObject
ObfDereferenceObject
ZwClose
ZwCreateSection
ZwOpenSection
ZwMapViewOfSection
ZwUnmapViewOfSection
ZwOpenEvent
KePulseEvent
KeStackAttachProcess
KeUnstackDetachProcess
ObOpenObjectByPointer
ZwAllocateVirtualMemory
ZwFreeVirtualMemory
ZwSetEvent
_allmul
memcpy
memset
PsProcessType
wcsncpy
wcsrchr
RtlUnicodeStringToInteger
ZwWaitForSingleObject
ZwRequestWaitReplyPort
ZwConnectPort
swprintf
RtlCopyUnicodeString
DbgPrint
KeDelayExecutionThread
KeQuerySystemTime
ExAllocatePoolWithTag
PsGetVersion
IofCompleteRequest
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
ObReferenceObjectByHandle
PsGetCurrentProcessId
ZwCreateEvent
ExEventObjectType
SeCaptureSubjectContext
SeReleaseSubjectContext
SeAccessCheck
ObGetObjectSecurity
ObReleaseObjectSecurity
PsGetProcessExitTime
PsThreadType
MmSectionObjectType
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
KeInitializeSemaphore
KeReleaseSemaphore
RtlCreateAcl
RtlAddAccessAllowedAce
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
ExGetPreviousMode
_wcsnicmp
PsSetCreateProcessNotifyRoutine
ZwQueryInformationProcess
PsLookupProcessByProcessId
ZwOpenDirectoryObject
MmIsAddressValid
ExInitializeResourceLite
ExDeleteResourceLite
ZwCreateFile
ZwQueryInformationFile
ZwSetInformationFile
ZwReadFile
ZwWriteFile
towupper
MmGetSystemRoutineAddress
ObReferenceObjectByPointer
ObQueryNameString
MmHighestUserAddress
_snprintf
_vsnprintf
RtlInitAnsiString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
RtlTimeToTimeFields
KeWaitForMultipleObjects
ExSystemTimeToLocalTime
ZwCreateKey
PsGetCurrentThreadId
ZwDeviceIoControlFile
ZwNotifyChangeKey
ZwOpenFile
ExFreePoolWithTag
mbstowcs
_stricmp
IoGetDeviceObjectPointer
RtlImageNtHeader
ZwQuerySystemInformation
_strnicmp
RtlCompareUnicodeString
RtlCompareMemory
MmBuildMdlForNonPagedPool
IoAllocateIrp
IofCallDriver
IoFreeIrp
RtlUpperChar
ObReferenceObjectByName
IoFileObjectType
IoDriverObjectType
IoBuildDeviceIoControlRequest
IoCreateFile
RtlEqualUnicodeString
RtlAppendUnicodeStringToString
RtlUpcaseUnicodeChar
_snwprintf
strncpy
NtOpenProcess
NtQueryInformationProcess
PsIsThreadTerminating
ObOpenObjectByName
KeServiceDescriptorTable
KeAddSystemServiceTable
KeSetPriorityThread
PsCreateSystemThread
PsTerminateSystemThread
KeNumberProcessors
RtlLengthSecurityDescriptor
ZwOpenKey
ZwDeleteKey
ZwDeleteValueKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryKey
ZwQueryValueKey
ZwSetValueKey
ZwTerminateProcess
ZwOpenProcess
ZwQuerySecurityObject
ZwSetSecurityObject
ZwQueryDirectoryObject
ZwQueryDirectoryFile
_allrem
RtlAppendUnicodeToString
ZwFsControlFile
ObInsertObject
strrchr
wcschr
wcsncmp
RtlQueryRegistryValues
IoBuildAsynchronousFsdRequest
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
RtlUpcaseUnicodeString
NtClose
ZwSetInformationObject
SeQueryAuthenticationIdToken
MmSystemRangeStart
IoGetFileObjectGenericMapping
ObCreateObject
SeCreateAccessState
IoAcquireVpbSpinLock
IoReleaseVpbSpinLock
wcstombs
strncat
wcsncat
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
wcsstr
ExAllocatePool
ExInterlockedPopEntrySList
IoBuildSynchronousFsdRequest
IoGetStackLimits
IoGetDeviceInterfaces
IoRegisterPlugPlayNotification
IoUnregisterPlugPlayNotification
IoGetConfigurationInformation
FsRtlIsNameInExpression
RtlUnwind
IoDeviceObjectType
IoCreateDevice
RtlGetOwnerSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
RtlLengthSid
SeExports
IoIsWdmVersionAvailable
RtlAbsoluteToSelfRelativeSD
KeWaitForSingleObject
KeLeaveCriticalRegion
KeBugCheckEx
KeEnterCriticalRegion
KeSetEvent
KeClearEvent
KeInitializeEvent
RtlInitUnicodeString
KeGetCurrentThread
memmove
ZwQueryVolumeInformationFile
_purecall
ClassInitialize
KeRaiseIrqlToDpcLevel
KfAcquireSpinLock
KeGetCurrentIrql
ExReleaseFastMutex
ExAcquireFastMutex
KfLowerIrql
KfRaiseIrql
KfReleaseSpinLock

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
??0CBlobConfig@@QAE@ABV0@@Z
??0CBlobConfig@@QAE@K@Z
??0CContext@@QAE@ABV0@@Z
??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QAE@ABV0@@Z
??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
??0CDebugLog@@QAE@ABV0@@Z
??0CDebugLog@@QAE@PBG@Z
??0CDebugLogEx@@QAE@ABV0@@Z
??0CDebugLogEx@@QAE@K@Z
??0CDelayLoadThread@@QAE@ABV0@@Z
??0CDelayLoadThread@@QAE@XZ
??0CExclusionExtConfig@@QAE@ABV0@@Z
??0CExclusionExtConfig@@QAE@KKE@Z
??0CExclusionFileNameConfig@@QAE@ABV0@@Z
??0CExclusionFileNameConfig@@QAE@KK@Z
??0CExclusionFilePathConfig@@QAE@ABV0@@Z
??0CExclusionFilePathConfig@@QAE@KK@Z
??0CExclusionFolderConfig@@QAE@ABV0@@Z
??0CExclusionFolderConfig@@QAE@KK@Z
??0CExclusionRegistryConfig@@QAE@ABV0@@Z
??0CExclusionRegistryConfig@@QAE@KK@Z
??0CFile@@QAE@ABV0@@Z
??0CFile@@QAE@E@Z
??0CFileExtension@@QAE@ABV0@@Z
??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
??0CInclusionExtConfig@@QAE@ABV0@@Z
??0CInclusionExtConfig@@QAE@KKE@Z
??0CInclusionFileNameConfig@@QAE@ABV0@@Z
??0CInclusionFileNameConfig@@QAE@KK@Z
??0CInclusionFilePathConfig@@QAE@ABV0@@Z
??0CInclusionFilePathConfig@@QAE@KK@Z
??0CInclusionFolderConfig@@QAE@ABV0@@Z
??0CInclusionFolderConfig@@QAE@KK@Z
??0CKEvent@@QAE@ABV0@@Z
??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
??0CList@@QAE@ABV0@@Z
??0CList@@QAE@KPAVIMemoryAllocator@@@Z
??0CLockEvent@@QAE@ABV0@@Z
??0CLockEvent@@QAE@XZ
??0CLockList@@QAE@ABV0@@Z
??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QAE@ABV0@@Z
??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
??0CMemoryPoolAllocator@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@XZ
??0CModuleConfigList@@QAE@ABV0@@Z
??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QAE@ABV0@@Z
??0CModuleFileExtConfig@@QAE@KKE@Z
??0CModuleFlagConfig@@QAE@ABV0@@Z
??0CModuleFlagConfig@@QAE@K@Z
??0CModuleMultiStringConfig@@QAE@ABV0@@Z
??0CModuleMultiStringConfig@@QAE@KK@Z
??0CModuleStringConfig@@QAE@ABV0@@Z
??0CModuleStringConfig@@QAE@K@Z
??0CNoLockList@@QAE@ABV0@@Z
??0CNoLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CSmartLock@@QAE@AAVCLockEvent@@@Z
??0CSmartLock@@QAE@XZ
??0CSmartReference@@QAE@AAJ@Z
??0CSmartReference@@QAE@AAK@Z
??0CSmartResource@@QAE@AAVCResource@@E@Z
??0CStrList@@QAE@ABV0@@Z
??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
??0CSystemThread@@QAE@ABV0@@Z
??0CSystemThread@@QAE@K@Z
??0CUserFuncAdapterJob@@QAE@ABV0@@Z
??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z01@Z
??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@E@Z
??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
??0CWorkerThreadJobQueue@@QAE@K@Z
??0CWorkerThreadPool@@QAE@ABV0@@Z
??0CWorkerThreadPool@@QAE@K@Z
??0CWorkerThreadPoolEx@@QAE@ABV0@@Z
??0CWorkerThreadPoolEx@@QAE@KK@Z
??0IMemoryAllocator@@QAE@ABV0@@Z
??0IMemoryAllocator@@QAE@XZ
??1CAutoUpdateConfigThread@@UAE@XZ
??1CBlobConfig@@UAE@XZ
??1CContext@@UAE@XZ
??1CContextList@@UAE@XZ
??1CDebugLog@@UAE@XZ
??1CDebugLogEx@@UAE@XZ
??1CDelayLoadThread@@UAE@XZ
??1CExclusionExtConfig@@UAE@XZ
??1CExclusionFileNameConfig@@UAE@XZ
??1CExclusionFilePathConfig@@UAE@XZ
??1CExclusionFolderConfig@@UAE@XZ
??1CExclusionRegistryConfig@@UAE@XZ
??1CFile@@UAE@XZ
??1CFileExtension@@UAE@XZ
??1CInclusionExtConfig@@UAE@XZ
??1CInclusionFileNameConfig@@UAE@XZ
??1CInclusionFilePathConfig@@UAE@XZ
??1CInclusionFolderConfig@@UAE@XZ
??1CKEvent@@UAE@XZ
??1CList@@UAE@XZ
??1CLockEvent@@UAE@XZ
??1CLockList@@UAE@XZ
??1CMemoryAllocator@@UAE@XZ
??1CMemoryPoolAllocator@@UAE@XZ
??1CModuleConfig@@UAE@XZ
??1CModuleConfigList@@UAE@XZ
??1CModuleFileExtConfig@@UAE@XZ
??1CModuleFlagConfig@@UAE@XZ
??1CModuleMultiStringConfig@@UAE@XZ
??1CModuleStringConfig@@UAE@XZ
??1CNoLockList@@UAE@XZ
??1CSmartLock@@QAE@XZ
??1CSmartReference@@QAE@XZ
??1CSmartResource@@QAE@XZ
??1CStrList@@UAE@XZ
??1CSystemThread@@UAE@XZ
??1CUserFuncAdapterJob@@UAE@XZ
??1CWorkerThread@@UAE@XZ
??1CWorkerThreadJob@@UAE@XZ
??1CWorkerThreadJobQueue@@UAE@XZ
??1CWorkerThreadPool@@UAE@XZ
??1CWorkerThreadPoolEx@@UAE@XZ
??1IMemoryAllocator@@UAE@XZ
??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??2CMemoryAllocator@@SGPAXI@Z
??2CMemoryPoolAllocator@@SGPAXI@Z
??3@YAXPAX@Z
??3@YAXPAXI@Z
??3IMemoryAllocator@@SGXPAX@Z
??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
??4CBlobConfig@@QAEAAV0@ABV0@@Z
??4CContext@@QAEAAV0@ABV0@@Z
??4CDebugLog@@QAEAAV0@ABV0@@Z
??4CDebugLogEx@@QAEAAV0@ABV0@@Z
??4CDelayLoadThread@@QAEAAV0@ABV0@@Z
??4CFile@@QAEAAV0@ABV0@@Z
??4CKEvent@@QAEAAV0@ABV0@@Z
??4CLockEvent@@QAEAAV0@ABV0@@Z
??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
??4CModuleConfig@@QAEAAV0@ABV0@@Z
??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
??4CSmartResource@@QAEAAV0@ABV0@@Z
??4CSystemThread@@QAEAAV0@ABV0@@Z
??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
??4CWorkerThread@@QAEAAV0@ABV0@@Z
??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CDebugLogEx@@6B@
??_7CDelayLoadThread@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CInclusionExtConfig@@6B@
??_7CInclusionFileNameConfig@@6B@
??_7CInclusionFilePathConfig@@6B@
??_7CInclusionFolderConfig@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CNoLockList@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7CWorkerThreadPoolEx@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QAEXXZ
??_FCFile@@QAEXXZ
??_FCFileExtension@@QAEXXZ
??_FCModuleConfigList@@QAEXXZ
??_FCStrList@@QAEXXZ
??_FCSystemThread@@QAEXXZ
??_FCWorkerThread@@QAEXXZ
??_FCWorkerThreadJob@@QAEXXZ
??_FCWorkerThreadJobQueue@@QAEXXZ
??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??_V@YAXPAX@Z
?Acquire@CLockEvent@@QAEXXZ
?Add@CContextList@@QAEEPAVCContext@@@Z
?Add@CFileExtension@@QAEEPBGK@Z
?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
?Add@CStrList@@QAEEPBG@Z
?AddNode@CLockList@@UAEEQAXE@Z
?AddNode@CNoLockList@@UAEEQAXE@Z
?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QAEXXZ
?CheckNode@CLockList@@UAEHQAX@Z
?CheckNode@CNoLockList@@UAEHQAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
?Cleanup@CBlobConfig@@AAEXXZ
?Cleanup@CModuleFileExtConfig@@IAEXXZ
?Cleanup@CModuleMultiStringConfig@@IAEXXZ
?Cleanup@CModuleStringConfig@@AAEXXZ
?Close@CFile@@QAEJXZ
?Count@CLockList@@QAEKXZ
?Count@CNoLockList@@QAEKXZ
?Create@CFile@@QAEJPBGKKKK@Z
?Create@CSystemThread@@QAEEXZ
?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
?CreatePool@CWorkerThreadPool@@QAEEXZ
?CreatePool@CWorkerThreadPoolEx@@QAEEXZ
?CreateThreads@CWorkerThreadPool@@QAEEK@Z
?CreateThreads@CWorkerThreadPoolEx@@QAEEK@Z
?CreateWIRP@CFile@@QAEJPBGKKKK@Z
?Delete@CFile@@QAEJXZ
?Delete@CFileExtension@@QAEEPBGK@Z
?Delete@CStrList@@QAEEPBG@Z
?DeleteAll@CList@@UAEXXZ
?DeleteAll@CLockList@@UAEXXZ
?DeleteAll@CNoLockList@@UAEXXZ
?DeleteNode@CContextList@@MAEXPAX@Z
?DeleteNode@CList@@UAEXPAX@Z
?DeleteNode@CModuleConfigList@@MAEXPAX@Z
?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YGXPAPAX@Z
?DoIt@CWorkerThreadJob@@QAEJXZ
?EntryPoint@CSystemThread@@KGXPAX@Z
?Find@CContextList@@QAEPAVCContext@@K@Z
?Find@CContextList@@QAEPAVCContext@@PAX@Z
?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FindNode@CContextList@@IAEPAXPAX@Z
?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FinishFunction@CUserFuncAdapterJob@@MAEXXZ
?FinishIt@CWorkerThreadJob@@QAEJXZ
?First@CList@@UAEPAXXZ
?First@CLockList@@UAEPAXXZ
?First@CNoLockList@@UAEPAXXZ
?Free@CMemoryAllocator@@UAEXPAX@Z
?Free@CMemoryPoolAllocator@@UAEXPAX@Z
?GetAttributes@CFile@@QAEKXZ
?GetBasicInfomration@CFile@@IAEJXZ
?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
?GetCategory@CContext@@QAEKXZ
?GetData@CBlobConfig@@QAEHPAXPAK@Z
?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QAEKXZ
?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
?GetData@CModuleStringConfig@@QAEPAGXZ
?GetData@CStrList@@QAEEPAGPAK@Z
?GetDataType@CModuleConfig@@QAEKXZ
?GetEngineContext@CContext@@QAEPAXXZ
?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFileSizeWIRP@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UAEJKPAK@Z
?GetID@CModuleConfig@@QAEKXZ
?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QAEKXZ
?GetLinkContext@CContext@@QAEPAXXZ
?GetLogFlag@CDebugLog@@QAEKXZ
?GetLogFlag@CDebugLogEx@@QAEKXZ
?GetModuleId@CModuleConfig@@QAEKXZ
?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_KTHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_KTHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QAEKXZ
?GetSize@CBlobConfig@@QAEKXZ
?GetStringConfig@CContext@@QAEPAGK@Z
?GetStringConfig@CContext@@UAEJKPAGPAK@Z
?GetThreadCount@CWorkerThreadPool@@QAEKXZ
?GetThreadCount@CWorkerThreadPoolEx@@QAEKXZ
?GetThreadID@CSystemThread@@QAEKXZ
?GetType@CContext@@QAEKXZ
?GetUserParameter@CContext@@QAEKXZ
?InitProcMon@CDebugLogEx@@IAEXXZ
?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
?InitializeFlagConfig@CContext@@QAEHKK@Z
?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
?InitializeStringConfig@CContext@@QAEHKPBG@Z
?Insert@CList@@UAEXQAXE@Z
?Insert@CLockList@@UAEXQAXE@Z
?Insert@CNoLockList@@UAEXQAXE@Z
?InsertAfter@CList@@UAEXPAX0@Z
?InsertBefore@CList@@UAEXPAX0@Z
?Instance@CWorkerThreadPool@@SGPAV1@XZ
?IsEmpty@CList@@UAEEXZ
?IsEmpty@CLockList@@UAEEXZ
?IsEmpty@CNoLockList@@UAEEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
?IsFull@CLockList@@QBEEXZ
?IsFull@CNoLockList@@QBEEXZ
?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionExtConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFileNameConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFilePathConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFolderConfig@@QAEEPBG@Z
?IsOpened@CFile@@QAEEXZ
?IsTerminated@CWorkerThreadPool@@QAEEXZ
?IsTerminated@CWorkerThreadPoolEx@@QAEEXZ
?IsValid@CMemoryAllocator@@UAEEXZ
?IsValid@CMemoryPoolAllocator@@UAEEXZ
?IsValid@IMemoryAllocator@@UAEEXZ
?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
?IsWorkerThread@CWorkerThreadPoolEx@@QAEEK@Z
?JobFunction@CUserFuncAdapterJob@@MAEXXZ
?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
?JobQueue@CWorkerThreadPoolEx@@QAEAAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QAEKXZ
?Limit@CNoLockList@@QAEKXZ
?MatchAllExtensions@CFileExtension@@QAEEXZ
?MatchNoExtensions@CFileExtension@@QAEEXZ
?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
?NeedDelete@CWorkerThreadJob@@QAEEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
?NewNode@CList@@UAEPAXXZ
?NewNode@CStrList@@EAEPAXXZ
?NewNodeVariant@CList@@IAEPAXK@Z
?Next@CList@@UBEPAXQAX@Z
?Next@CLockList@@UBEPAXQAX@Z
?Next@CNoLockList@@UBEPAXQAX@Z
?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
?NotityTerminate@CWorkerThread@@QAEXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
?PostJobToWorkerThread@CWorkerThreadPoolEx@@QAEJP6GXPAX@Z0E1@Z
?Pulse@CKEvent@@QAEJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPoolEx@@QAEJPAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
?Read@CFile@@QAEJPADKPAK@Z
?ReadWIRP@CFile@@QAEJPADKPAK@Z
?ReferenceCount@CContext@@QAEAAKXZ
?Release@CLockEvent@@QAEXXZ
?Remove@CContextList@@UAEEQAX@Z
?Remove@CList@@UAEEQAX@Z
?Remove@CLockList@@UAEEQAX@Z
?Remove@CNoLockList@@UAEEQAX@Z
?RemoveHead@CList@@UAEPAXXZ
?RemoveHead@CLockList@@UAEPAXXZ
?RemoveHead@CNoLockList@@UAEPAXXZ
?RemoveTail@CList@@UAEPAXXZ
?RemoveTail@CLockList@@UAEPAXXZ
?RemoveTail@CNoLockList@@UAEPAXXZ
?Reset@CKEvent@@QAEXXZ
?ResetData@CInclusionExtConfig@@QAEXXZ
?ResetData@CInclusionFileNameConfig@@QAEXXZ
?ResetData@CInclusionFilePathConfig@@QAEXXZ
?ResetData@CInclusionFolderConfig@@QAEXXZ
?RestoreCR0@@YGXPAX@Z
?Run@CAutoUpdateConfigThread@@UAEXXZ
?Run@CDelayLoadThread@@UAEXXZ
?Run@CWorkerThread@@UAEXXZ
?SeekToEnd@CFile@@QAEJXZ
?Set@CKEvent@@QAEJJE@Z
?SetAttributes@CFile@@QAEJK@Z
?SetBlobCofig@CContext@@UAEJKPAXK@Z
?SetData@CBlobConfig@@QAEHPAXK@Z
?SetData@CModuleFileExtConfig@@QAEHPBG@Z
?SetData@CModuleFlagConfig@@QAEHK@Z
?SetData@CModuleMultiStringConfig@@QAEHPBGK@Z
?SetData@CModuleStringConfig@@QAEHPBG@Z
?SetEngineContext@CContext@@QAEXPAX@Z
?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
?SetFlagConfig@CContext@@UAEJKK@Z
?SetLinkContext@CContext@@QAEXPAX@Z
?SetLogFlag@CDebugLog@@QAEEK@Z
?SetLogFlag@CDebugLogEx@@QAEEK@Z
?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
?SetMultiStringConfig@CContext@@UAEJKPBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
?SetPriority@CSystemThread@@QAEXK@Z
?SetStopUse@CContext@@QAEXXZ
?SetStringConfig@CContext@@UAEJKPBG@Z
?Setup@CSystemThread@@MAEXXZ
?StopUse@CContext@@QAEHXZ
?TearDown@CSystemThread@@MAEXXZ
?Terminate@CSystemThread@@QAEXE@Z
?Terminate@CWorkerThreadPool@@QAEEXZ
?Terminate@CWorkerThreadPoolEx@@QAEEXZ
?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QAEXXZ
?WaitForInit@CDelayLoadThread@@QAEEXZ
?WaitForLoad@CDelayLoadThread@@QAEEXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
?WaitQueueEmpty@CWorkerThreadJobQueue@@QAEXXZ
?Write@CDebugLog@@QAAXPBDZZ
?Write@CDebugLogEx@@QAAXPBDZZ
?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
?WriteDataToFile@CDebugLogEx@@IAEXPADK@Z
?WriteDataToProcMonW@CDebugLogEx@@IAEXPAD@Z
?WriteSystemInformation@CDebugLog@@QAEXXZ
?WriteSystemInformation@CDebugLogEx@@QAEXXZ
?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
?WriteSystemStringInformation@CDebugLogEx@@IAEXPBG@Z
?WriteToFile@CDebugLog@@IAEXPADK@Z
?WriteToProcMonW@CDebugLogEx@@IAEXPAU_UNICODE_STRING@@@Z
?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
?_pPagedAllocator@@3PAVCMemoryAllocator@@A
?m_lpInstance@CWorkerThreadPool@@1PAV1@A
?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
_AllocFullFileName@8
_DeInitKm2UmCommunication@0
_DeInitKmLPC@0
_DuplicateFullFileName@4
_FreeFullFileName@4
_GetKm2UmMode@0
_GetModuleInfoByAddress@8
_GetModuleInfoByModuleName@8
_InitKm2UmCommunication@8
_InitKmLPC@0
_IsVerifierCodeCheckFlagOn@0
_IsWindows8_1_update@4
_KmCallUm@8
_KmCallUmByLPC@8
_KmCallUmEx@12
_KmCleanupCommPortAPIs@0
_KmGetUmInitProcess@0
_KmSetBackupCommPortAPIs@4
_KmSetCommPortAPIs@4
_ModGetExportProcAddress@8
_ModLoadDLLToBuffer@4
_ModLoadDLLToBufferWithImageSize@8
_ModLoadModule@8
_ModUnLoadModule@4
_NormalizeFileName@4
_NormalizeFullNtPathToDosName@4
_TmCommConfigRoutine@4
_UtilAddDeviceInDriveTable@4
_UtilAddReparsePointMapping@8
_UtilCleanFileReadOnly@4
_UtilCloseExclusiveHandle@12
_UtilCreateDosFileName@8
_UtilDeleteFileForce@4
_UtilGetDeviceObjectName@8
_UtilGetFileNameFromFileObject@4
_UtilGetFileObjectForProcessByEPROC@8
_UtilGetFileObjectFromFileName@12
_UtilGetProcessName@12
_UtilGetSystemDirectory@4
_UtilGetSystemDirectoryEx@0
_UtilGetSystemDirectoryLength@0
_UtilGetSystemTime@4
_UtilIoSetFileInfo@24
_UtilIopCreateFileIRP@40
_UtilKeGetLowFileDevice@16
_UtilModuleIATHook@24
_UtilModuleIATUnHook@8
_UtilPostJobToWorkerThread@12
_UtilQueryExclusiveHandle@12
_UtilQueryKeyValue@24
_UtilRemoveDeviceFromDriveTable@4
_UtilVolumeDeviceToDosName@8
_UtilWaitValueChangeToZero@8
_UtilWriteVersionToRegistry@8
_UtilbuildDynamicDiskMappingTable@0
_UtlWriteBinValueKeyToRegistry@16
_ValidateAddressWithSize@20
__ResetProtectFromClose@4
__UtilDosPathNameToNtPathName@12

Sections

Expand

.text
.rdata
.data
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2013-09-27 20:56:05
MD5	f51065667fb127cf6de984daea2f6b24
SHA1	1768fb2b4796f624fa52b95dfdfbfb922ac21019
SHA256	654c5ba47f74008c8f49cbb97988017eec8c898adc3bb851bc6e1fdf9dcf54ad
Authentihash MD5	671205c31cc873b793bd9922b8c2594e
Authentihash SHA1	d8dea3a091ef24abd0cee37b74a6e6bf8dccea23
Authentihash SHA256	9bea1a92c747c203cd3e370f422ed6023787817a5495385e5ca473ef59396a2e
RichPEHeaderHash MD5	bbb76ea1d539dce2f6450c28c119dfc4
RichPEHeaderHash SHA1	93937617f04f056cdde3a44129645289bbf68c00
RichPEHeaderHash SHA256	559177f9f73571b4f376e356741cfbedbb9806f57e0a1a70cb6b8dd57b8d83fa
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	Trend Micro Eyes
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 478a8efb59e1d83f0ce142d2a28707be

Field	Value
ToBeSigned (TBS) MD5	f13ede9179075999ef7f856ec31e364b
ToBeSigned (TBS) SHA1	2f09867166e6107e17808317f5c8d4ee157f45bc
ToBeSigned (TBS) SHA256	089a2c4c6ac7432020acdb65c33bf39130da6f37c002ba79128bd4c94e4fa101
Subject	C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO Time Stamping Signer
ValidFrom	2010-05-10 00:00:00
ValidTo	2015-05-10 23:59:59
Signature	c8fb63f80b75752c3af1f213a72db6a31a9cad0107d3348e77e0c26eae025d484fa4d221b636fd2a35437c6bdf80870b15f0763200b4ceb567a42f2f201b9c549e833f1f5f149562820f2241221f70b3f3f742de6c51cd4bf821ac9b3b8cb1e5e6288fce2a8af9aa524d8c5b77ba4d5a58dbbb6a04cc521e9de228370ebbe70e91c7f8dbf18198ebcd37b30eab65d362ec3aa576eb13a83593c92e0a01ecc0e8cc3d7eb6ebe2c1ecd3149282668750dcfd5097acb34a767306c486113ab35f4304526feab3d074364ccaf11b7984377063ad74b9aa0ef398b08608ebdbe01f8c10f239649bae4f0a2c928a4f18b591e58d1a935f1faef1a6f02e97d0d2f62b3c
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	478a8efb59e1d83f0ce142d2a28707be
Version	3

Certificate 4d6290e58c54f0f1eb17341a1310e6a4

Field	Value
ToBeSigned (TBS) MD5	b7d8444a70054990435f35a5630df5e1
ToBeSigned (TBS) SHA1	4678c6e4a8787a8e6ed2bce8792b122f6c08afd8
ToBeSigned (TBS) SHA256	0a8b4b359ea7890b358e56e436e9cfc6f32b037b2599b597ca7f7a80d475ec98
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-09-30 00:00:00
ValidTo	2014-01-01 23:59:59
Signature	aedd211d5f8f807ad25209eadb6ed25d8be8c21b6904be51a5010e59fa37d174a3eedced89742b62d5a6bf4fad361754f013e0a345d24c26cbe26da21fd01e7a070fb6b37b6f5068a2e931b3b7997d8070a0a7de0b1ea4fff34d811bdd20c91cc4afcff18ffad9da95f0ecdc5cbfe88c5a3e7ab0a3eb59437411e09b1a6af36f
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	4d6290e58c54f0f1eb17341a1310e6a4
Version	3

Certificate 610c120600000000001b

Field	Value
ToBeSigned (TBS) MD5	53c41bc1164e09e0cd1617a5bf913efd
ToBeSigned (TBS) SHA1	93c03aac8951d494ecd5696b1c08658541b18727
ToBeSigned (TBS) SHA256	40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b
Subject	C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
ValidFrom	2006-05-23 17:01:29
ValidTo	2016-05-23 17:11:29
Signature	01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	610c120600000000001b
Version	3

Certificate 1a9d178ad334acdf47c8a0d15bb50e6e

Field	Value
ToBeSigned (TBS) MD5	685d99029d38a9d263ea82cd02a49f6c
ToBeSigned (TBS) SHA1	93464d8f54b4ee7caf22ca1db15a4211e0d3c79e
ToBeSigned (TBS) SHA256	894991f1477dff88c7c0707531073bb59483750bcad672fc388179affca07aa9
Subject	C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=Trend Micro, Inc.
ValidFrom	2013-01-17 00:00:00
ValidTo	2014-03-18 23:59:59
Signature	65c7e1e0f4051179852b819153b528c88db47ef50e897cd8ce0d03a7cc2dc896c89790410182186fecaf9da5c317bf57b5038311c10c2ec5ddb5c18165a7e92f92a6f39c042262126c714337a7c528041a04679217c1475a30231c967ca63b4430ccea52fe4f16fabb5c454d2aa8cdde347b8beaa973d76b3f9ba99d2597939a33d67ec4abc3974ef3792b8bc90d092cce62309d205129bbcbd3554382f24b2911b4904b09e7f52f24f2cc5a52fa49f3a163c32fde076e917301f22dd45d643b95319bae922bc861e5a8f90d4dd72603c7b1ea0229eca869ab8d086ae5286baeba9b99a12856dc1d3cd9f6d9da4b8d5a85896ba4587d8eba506a4fbba4a7bb49
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	1a9d178ad334acdf47c8a0d15bb50e6e
Version	3

Imports

Expand

ntoskrnl.exe

Imported Functions

Expand

KeLeaveCriticalRegion
wcsncpy
KeEnterCriticalRegion
ExAcquireFastMutexUnsafe
wcsrchr
ExAcquireResourceSharedLite
ExReleaseResourceLite
_purecall
ZwOpenEvent
ZwConnectPort
KeClearEvent
PsProcessType
ExFreePoolWithTag
RtlInitUnicodeString
KeSetEvent
ProbeForWrite
KeUnstackDetachProcess
ZwRequestWaitReplyPort
ZwWaitForSingleObject
DbgBreakPoint
ZwSetEvent
IoGetCurrentProcess
ZwFreeVirtualMemory
ZwClose
ObfReferenceObject
ObfDereferenceObject
RtlUnicodeStringToInteger
ZwCreateSection
ObOpenObjectByPointer
KeStackAttachProcess
KePulseEvent
ZwAllocateVirtualMemory
ObGetObjectSecurity
SeAccessCheck
SeReleaseSubjectContext
SeCaptureSubjectContext
PsThreadType
ObReleaseObjectSecurity
PsGetProcessExitTime
MmSectionObjectType
DbgPrint
ExDeleteResourceLite
ExInitializeResourceLite
ZwReadFile
swprintf
ZwSetInformationFile
ZwCreateFile
ZwQueryInformationFile
ZwWriteFile
_wcsnicmp
towupper
ExAllocatePoolWithTag
KeInitializeEvent
ZwCreateEvent
ZwCreateKey
RtlAnsiStringToUnicodeString
ZwNotifyChangeKey
RtlInitAnsiString
_snprintf
RtlFreeUnicodeString
ExSystemTimeToLocalTime
_vsnprintf
ObReferenceObjectByHandle
RtlTimeToTimeFields
ZwDeviceIoControlFile
PsGetCurrentThreadId
PsGetCurrentProcessId
KeWaitForMultipleObjects
RtlEqualUnicodeString
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
RtlUpcaseUnicodeChar
KeWaitForSingleObject
KeSetPriorityThread
PsCreateSystemThread
PsTerminateSystemThread
MmIsAddressValid
KeDelayExecutionThread
KeNumberProcessors
PsLookupProcessByProcessId
PsSetCreateProcessNotifyRoutine
ZwOpenDirectoryObject
ZwQueryInformationProcess
ExGetPreviousMode
NtSetInformationFile
ZwDeleteValueKey
ZwSetValueKey
ZwQuerySystemInformation
NtQueryInformationFile
IoFileObjectType
ZwQueryValueKey
ZwQueryDirectoryFile
NtCreateFile
ZwEnumerateValueKey
ZwQueryDirectoryObject
ZwDuplicateObject
ZwOpenProcess
ZwTerminateProcess
ZwDeleteKey
ZwEnumerateKey
ZwQueryKey
ZwOpenKey
ExReleaseFastMutexUnsafe
_stricmp
_strnicmp
mbstowcs
ProbeForRead
_snwprintf
ZwQuerySymbolicLinkObject
ZwMapViewOfSection
MmGetSystemRoutineAddress
RtlAppendUnicodeToString
IoCreateFile
RtlQueryRegistryValues
MmBuildMdlForNonPagedPool
ZwOpenSymbolicLinkObject
IoFreeMdl
ObQueryNameString
ZwUnmapViewOfSection
NtClose
IoFreeIrp
PsGetVersion
IoAllocateIrp
RtlCompareMemory
MmUnlockPages
ZwOpenFile
wcsncmp
RtlImageNtHeader
IoAllocateMdl
IofCallDriver
ZwQueryVolumeInformationFile
ObReferenceObjectByPointer
IoBuildDeviceIoControlRequest
ZwOpenSection
RtlSubAuthoritySid
RtlLengthRequiredSid
ExReleaseFastMutex
ExAcquireFastMutex
RtlCreateAcl
RtlSetDaclSecurityDescriptor
RtlAddAccessAllowedAce
KeInitializeSemaphore
KeReleaseSemaphore
RtlInitializeSid
RtlCreateSecurityDescriptor
IoDeleteSymbolicLink
IoDeleteDevice
ExEventObjectType
IofCompleteRequest
IoCreateSymbolicLink
IoGetDeviceObjectPointer
strncpy
NtOpenProcess
ObInsertObject
IoAcquireVpbSpinLock
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
IoReleaseVpbSpinLock
wcschr
strncat
RtlUnicodeStringToAnsiString
wcsncat
RtlFreeAnsiString
wcstombs
IoGetConfigurationInformation
IoRegisterPlugPlayNotification
RtlUpcaseUnicodeString
IoGetStackLimits
IoBuildSynchronousFsdRequest
KeReleaseSpinLock
ExpInterlockedPopEntrySList
FsRtlIsNameInExpression
wcsstr
ExAllocatePool
IoUnregisterPlugPlayNotification
MmProbeAndLockPages
RtlCompareUnicodeString
IoGetDeviceInterfaces
DbgPrintEx
KeAcquireSpinLockRaiseToDpc
KeBugCheckEx
IoCreateDevice
ZwSetSecurityObject
IoDeviceObjectType
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
IoIsWdmVersionAvailable
SeExports
RtlLengthSid
RtlGetSaclSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
MmSystemRangeStart
ExAcquireResourceExclusiveLite
__C_specific_handler

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QEAA@AEBV0@@Z
??0CAutoUpdateConfigThread@@QEAA@PEAU_UNICODE_STRING@@P6AX0PEAX@Z1@Z
??0CBlobConfig@@QEAA@AEBV0@@Z
??0CBlobConfig@@QEAA@K@Z
??0CContext@@QEAA@AEBV0@@Z
??0CContext@@QEAA@KP6AJPEAU_EVENT_REPORT@@PEAXPEAU_TMCE_REPORT@@PEAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QEAA@AEBV0@@Z
??0CContextList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CDebugLog@@QEAA@AEBV0@@Z
??0CDebugLog@@QEAA@PEBG@Z
??0CDebugLogEx@@QEAA@AEBV0@@Z
??0CDebugLogEx@@QEAA@K@Z
??0CDelayLoadThread@@QEAA@AEBV0@@Z
??0CDelayLoadThread@@QEAA@XZ
??0CExclusionExtConfig@@QEAA@AEBV0@@Z
??0CExclusionExtConfig@@QEAA@KKE@Z
??0CExclusionFileNameConfig@@QEAA@AEBV0@@Z
??0CExclusionFileNameConfig@@QEAA@KK@Z
??0CExclusionFilePathConfig@@QEAA@AEBV0@@Z
??0CExclusionFilePathConfig@@QEAA@KK@Z
??0CExclusionFolderConfig@@QEAA@AEBV0@@Z
??0CExclusionFolderConfig@@QEAA@KK@Z
??0CExclusionRegistryConfig@@QEAA@AEBV0@@Z
??0CExclusionRegistryConfig@@QEAA@KK@Z
??0CFile@@QEAA@AEBV0@@Z
??0CFile@@QEAA@E@Z
??0CFileExtension@@QEAA@AEBV0@@Z
??0CFileExtension@@QEAA@KEEPEAVIMemoryAllocator@@@Z
??0CInclusionExtConfig@@QEAA@AEBV0@@Z
??0CInclusionExtConfig@@QEAA@KKE@Z
??0CInclusionFileNameConfig@@QEAA@AEBV0@@Z
??0CInclusionFileNameConfig@@QEAA@KK@Z
??0CInclusionFilePathConfig@@QEAA@AEBV0@@Z
??0CInclusionFilePathConfig@@QEAA@KK@Z
??0CInclusionFolderConfig@@QEAA@AEBV0@@Z
??0CInclusionFolderConfig@@QEAA@KK@Z
??0CKEvent@@QEAA@AEBV0@@Z
??0CKEvent@@QEAA@W4_EVENT_TYPE@@E@Z
??0CList@@QEAA@AEBV0@@Z
??0CList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CLockEvent@@QEAA@AEBV0@@Z
??0CLockEvent@@QEAA@XZ
??0CLockList@@QEAA@AEBV0@@Z
??0CLockList@@QEAA@KKPEAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IEAA@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QEAA@AEBV0@@Z
??0CMemoryPoolAllocator@@IEAA@W4_POOL_TYPE@@_K1K@Z
??0CMemoryPoolAllocator@@QEAA@AEBV0@@Z
??0CModuleConfig@@QEAA@AEBV0@@Z
??0CModuleConfig@@QEAA@XZ
??0CModuleConfigList@@QEAA@AEBV0@@Z
??0CModuleConfigList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QEAA@AEBV0@@Z
??0CModuleFileExtConfig@@QEAA@KKE@Z
??0CModuleFlagConfig@@QEAA@AEBV0@@Z
??0CModuleFlagConfig@@QEAA@K@Z
??0CModuleMultiStringConfig@@QEAA@AEBV0@@Z
??0CModuleMultiStringConfig@@QEAA@KK@Z
??0CModuleStringConfig@@QEAA@AEBV0@@Z
??0CModuleStringConfig@@QEAA@K@Z
??0CNoLockList@@QEAA@AEBV0@@Z
??0CNoLockList@@QEAA@KKPEAVIMemoryAllocator@@@Z
??0CSmartLock@@QEAA@AEAVCLockEvent@@@Z
??0CSmartLock@@QEAA@XZ
??0CSmartReference@@QEAA@AEAJ@Z
??0CSmartReference@@QEAA@AEAK@Z
??0CSmartResource@@QEAA@AEAVCResource@@E@Z
??0CStrList@@QEAA@AEBV0@@Z
??0CStrList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CSystemThread@@QEAA@AEBV0@@Z
??0CSystemThread@@QEAA@K@Z
??0CUserFuncAdapterJob@@QEAA@AEBV0@@Z
??0CUserFuncAdapterJob@@QEAA@P6AXPEAX@Z01@Z
??0CWorkerThread@@IEAA@PEAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QEAA@AEBV0@@Z
??0CWorkerThreadJob@@QEAA@AEBV0@@Z
??0CWorkerThreadJob@@QEAA@E@Z
??0CWorkerThreadJobQueue@@QEAA@AEBV0@@Z
??0CWorkerThreadJobQueue@@QEAA@K@Z
??0CWorkerThreadPool@@QEAA@AEBV0@@Z
??0CWorkerThreadPool@@QEAA@K@Z
??0CWorkerThreadPoolEx@@QEAA@AEBV0@@Z
??0CWorkerThreadPoolEx@@QEAA@KK@Z
??0IMemoryAllocator@@QEAA@AEBV0@@Z
??0IMemoryAllocator@@QEAA@XZ
??1CAutoUpdateConfigThread@@UEAA@XZ
??1CBlobConfig@@UEAA@XZ
??1CContext@@UEAA@XZ
??1CContextList@@UEAA@XZ
??1CDebugLog@@UEAA@XZ
??1CDebugLogEx@@UEAA@XZ
??1CDelayLoadThread@@UEAA@XZ
??1CExclusionExtConfig@@UEAA@XZ
??1CExclusionFileNameConfig@@UEAA@XZ
??1CExclusionFilePathConfig@@UEAA@XZ
??1CExclusionFolderConfig@@UEAA@XZ
??1CExclusionRegistryConfig@@UEAA@XZ
??1CFile@@UEAA@XZ
??1CFileExtension@@UEAA@XZ
??1CInclusionExtConfig@@UEAA@XZ
??1CInclusionFileNameConfig@@UEAA@XZ
??1CInclusionFilePathConfig@@UEAA@XZ
??1CInclusionFolderConfig@@UEAA@XZ
??1CKEvent@@UEAA@XZ
??1CList@@UEAA@XZ
??1CLockEvent@@UEAA@XZ
??1CLockList@@UEAA@XZ
??1CMemoryAllocator@@UEAA@XZ
??1CMemoryPoolAllocator@@UEAA@XZ
??1CModuleConfig@@UEAA@XZ
??1CModuleConfigList@@UEAA@XZ
??1CModuleFileExtConfig@@UEAA@XZ
??1CModuleFlagConfig@@UEAA@XZ
??1CModuleMultiStringConfig@@UEAA@XZ
??1CModuleStringConfig@@UEAA@XZ
??1CNoLockList@@UEAA@XZ
??1CSmartLock@@QEAA@XZ
??1CSmartReference@@QEAA@XZ
??1CSmartResource@@QEAA@XZ
??1CStrList@@UEAA@XZ
??1CSystemThread@@UEAA@XZ
??1CUserFuncAdapterJob@@UEAA@XZ
??1CWorkerThread@@UEAA@XZ
??1CWorkerThreadJob@@UEAA@XZ
??1CWorkerThreadJobQueue@@UEAA@XZ
??1CWorkerThreadPool@@UEAA@XZ
??1CWorkerThreadPoolEx@@UEAA@XZ
??1IMemoryAllocator@@UEAA@XZ
??2@YAPEAX_KPEAVIMemoryAllocator@@PEBDK@Z
??2CMemoryAllocator@@SAPEAX_K@Z
??2CMemoryPoolAllocator@@SAPEAX_K@Z
??3@YAXPEAX@Z
??3IMemoryAllocator@@SAXPEAX@Z
??4CAutoUpdateConfigThread@@QEAAAEAV0@AEBV0@@Z
??4CBlobConfig@@QEAAAEAV0@AEBV0@@Z
??4CContext@@QEAAAEAV0@AEBV0@@Z
??4CDebugLog@@QEAAAEAV0@AEBV0@@Z
??4CDebugLogEx@@QEAAAEAV0@AEBV0@@Z
??4CDelayLoadThread@@QEAAAEAV0@AEBV0@@Z
??4CFile@@QEAAAEAV0@AEBV0@@Z
??4CKEvent@@QEAAAEAV0@AEBV0@@Z
??4CLockEvent@@QEAAAEAV0@AEBV0@@Z
??4CMemoryAllocator@@QEAAAEAV0@AEBV0@@Z
??4CMemoryPoolAllocator@@QEAAAEAV0@AEBV0@@Z
??4CModuleConfig@@QEAAAEAV0@AEBV0@@Z
??4CModuleFlagConfig@@QEAAAEAV0@AEBV0@@Z
??4CModuleStringConfig@@QEAAAEAV0@AEBV0@@Z
??4CSmartLock@@QEAAAEAV0@AEBV0@@Z
??4CSmartLock@@QEAAAEBV0@AEAVCLockEvent@@@Z
??4CSmartResource@@QEAAAEAV0@AEBV0@@Z
??4CSystemThread@@QEAAAEAV0@AEBV0@@Z
??4CUserFuncAdapterJob@@QEAAAEAV0@AEBV0@@Z
??4CWorkerThread@@QEAAAEAV0@AEBV0@@Z
??4CWorkerThreadJob@@QEAAAEAV0@AEBV0@@Z
??4IMemoryAllocator@@QEAAAEAV0@AEBV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CDebugLogEx@@6B@
??_7CDelayLoadThread@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CInclusionExtConfig@@6B@
??_7CInclusionFileNameConfig@@6B@
??_7CInclusionFilePathConfig@@6B@
??_7CInclusionFolderConfig@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CNoLockList@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7CWorkerThreadPoolEx@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QEAAXXZ
??_FCFile@@QEAAXXZ
??_FCFileExtension@@QEAAXXZ
??_FCModuleConfigList@@QEAAXXZ
??_FCStrList@@QEAAXXZ
??_FCSystemThread@@QEAAXXZ
??_FCWorkerThread@@QEAAXXZ
??_FCWorkerThreadJob@@QEAAXXZ
??_FCWorkerThreadJobQueue@@QEAAXXZ
??_U@YAPEAX_KPEAVIMemoryAllocator@@PEBDK@Z
??_V@YAXPEAX@Z
?Acquire@CLockEvent@@QEAAXXZ
?Add@CContextList@@QEAAEPEAVCContext@@@Z
?Add@CFileExtension@@QEAAEPEBGK@Z
?Add@CModuleConfigList@@QEAAEPEAVCModuleConfig@@@Z
?Add@CStrList@@QEAAEPEBG@Z
?AddNode@CLockList@@UEAAEQEAXE@Z
?AddNode@CNoLockList@@UEAAEQEAXE@Z
?Alloc@CMemoryAllocator@@UEAAPEAX_KPEBDK@Z
?Alloc@CMemoryPoolAllocator@@UEAAPEAX_KPEBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IEAAPEAX_K@Z
?AttachJobQueue@CWorkerThread@@QEAAXPEAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QEAAXXZ
?CheckNode@CLockList@@UEAAHQEAX@Z
?CheckNode@CNoLockList@@UEAAHQEAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QEAAXXZ
?Cleanup@CBlobConfig@@AEAAXXZ
?Cleanup@CModuleFileExtConfig@@IEAAXXZ
?Cleanup@CModuleMultiStringConfig@@IEAAXXZ
?Cleanup@CModuleStringConfig@@AEAAXXZ
?Close@CFile@@QEAAJXZ
?Count@CLockList@@QEAAKXZ
?Count@CNoLockList@@QEAAKXZ
?Create@CFile@@QEAAJPEBGKKKK@Z
?Create@CSystemThread@@QEAAEXZ
?CreateInstance@CMemoryAllocator@@SAPEAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SAPEAV1@W4_POOL_TYPE@@_K1K@Z
?CreatePool@CWorkerThreadPool@@QEAAEXZ
?CreatePool@CWorkerThreadPoolEx@@QEAAEXZ
?CreateThreads@CWorkerThreadPool@@QEAAEK@Z
?CreateThreads@CWorkerThreadPoolEx@@QEAAEK@Z
?CreateWIRP@CFile@@QEAAJPEBGKKKK@Z
?Delete@CFile@@QEAAJXZ
?Delete@CFileExtension@@QEAAEPEBGK@Z
?Delete@CStrList@@QEAAEPEBG@Z
?DeleteAll@CList@@UEAAXXZ
?DeleteAll@CLockList@@UEAAXXZ
?DeleteAll@CNoLockList@@UEAAXXZ
?DeleteNode@CContextList@@MEAAXPEAX@Z
?DeleteNode@CList@@UEAAXPEAX@Z
?DeleteNode@CModuleConfigList@@MEAAXPEAX@Z
?DeleteNode@CStrList@@EEAAXPEAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YAXPEAPEAX@Z
?DoIt@CWorkerThreadJob@@QEAAJXZ
?EntryPoint@CSystemThread@@KAXPEAX@Z
?Find@CContextList@@QEAAPEAVCContext@@K@Z
?Find@CContextList@@QEAAPEAVCContext@@PEAX@Z
?Find@CFileExtension@@QEAAPEAU_STR_LIST_NODE@CStrList@@PEBGK@Z
?Find@CModuleConfigList@@QEAAPEAVCModuleConfig@@K@Z
?Find@CStrList@@QEAAPEAU_STR_LIST_NODE@1@PEBG@Z
?FindNode@CContextList@@IEAAPEAXPEAX@Z
?FindPartiallyAndAllMatch@CStrList@@QEAAPEAU_STR_LIST_NODE@1@PEBG@Z
?FinishFunction@CUserFuncAdapterJob@@MEAAXXZ
?FinishIt@CWorkerThreadJob@@QEAAJXZ
?First@CList@@UEAAPEAXXZ
?First@CLockList@@UEAAPEAXXZ
?First@CNoLockList@@UEAAPEAXXZ
?Free@CMemoryAllocator@@UEAAXPEAX@Z
?Free@CMemoryPoolAllocator@@UEAAXPEAX@Z
?GetAttributes@CFile@@QEAAKXZ
?GetBasicInfomration@CFile@@IEAAJXZ
?GetBlobCofig@CContext@@UEAAJKPEAXPEAK@Z
?GetCategory@CContext@@QEAAKXZ
?GetData@CBlobConfig@@QEAAHPEAXPEAK@Z
?GetData@CModuleFileExtConfig@@QEAAHPEAGPEAK@Z
?GetData@CModuleFileExtConfig@@QEAAPEAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QEAAKXZ
?GetData@CModuleMultiStringConfig@@QEAAHPEAGPEAK@Z
?GetData@CModuleMultiStringConfig@@QEAAPEAVCStrList@@XZ
?GetData@CModuleStringConfig@@QEAAPEAGXZ
?GetData@CStrList@@QEAAEPEAGPEAK@Z
?GetDataType@CModuleConfig@@QEAAKXZ
?GetEngineContext@CContext@@QEAAPEAXXZ
?GetFileExtensionConfig@CContext@@QEAAPEAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UEAAJKPEAGPEAK@Z
?GetFileSize@CFile@@QEAAJPEAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UEAAJKPEAK@Z
?GetID@CModuleConfig@@QEAAKXZ
?GetJob@CWorkerThreadJobQueue@@QEAAPEAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QEAAKXZ
?GetLinkContext@CContext@@QEAAPEAXXZ
?GetLogFlag@CDebugLog@@QEAAKXZ
?GetLogFlag@CDebugLogEx@@QEAAKXZ
?GetModuleId@CModuleConfig@@QEAAKXZ
?GetMultiStringConfig@CContext@@QEAAPEAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UEAAJKPEAGPEAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QEAAPEAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPool@@QEAAPEAU_KTHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QEAAPEAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QEAAPEAU_KTHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QEAA_KXZ
?GetSize@CBlobConfig@@QEAAKXZ
?GetStringConfig@CContext@@QEAAPEAGK@Z
?GetStringConfig@CContext@@UEAAJKPEAGPEAK@Z
?GetThreadCount@CWorkerThreadPool@@QEAAKXZ
?GetThreadCount@CWorkerThreadPoolEx@@QEAAKXZ
?GetThreadID@CSystemThread@@QEAA_KXZ
?GetType@CContext@@QEAAKXZ
?GetUserParameter@CContext@@QEAA_KXZ
?InitProcMon@CDebugLogEx@@IEAAXXZ
?InitializeBlobConfig@CContext@@QEAAHKPEAXK@Z
?InitializeFileExtensionConfig@CContext@@QEAAHKPEBG@Z
?InitializeFlagConfig@CContext@@QEAAHKK@Z
?InitializeMultiStringConfig@CContext@@QEAAHKPEBG@Z
?InitializeStringConfig@CContext@@QEAAHKPEBG@Z
?Insert@CList@@UEAAXQEAXE@Z
?Insert@CLockList@@UEAAXQEAXE@Z
?Insert@CNoLockList@@UEAAXQEAXE@Z
?InsertAfter@CList@@UEAAXPEAX0@Z
?InsertBefore@CList@@UEAAXPEAX0@Z
?Instance@CWorkerThreadPool@@SAPEAV1@XZ
?IsEmpty@CList@@UEAAEXZ
?IsEmpty@CLockList@@UEAAEXZ
?IsEmpty@CNoLockList@@UEAAEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IEAAEK@Z
?IsFull@CLockList@@QEBAEXZ
?IsFull@CNoLockList@@QEBAEXZ
?IsInExclusionList@CExclusionExtConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionExtConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionFileNameConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionFilePathConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionFolderConfig@@QEAAEPEBG@Z
?IsOpened@CFile@@QEAAEXZ
?IsTerminated@CWorkerThreadPool@@QEAAEXZ
?IsTerminated@CWorkerThreadPoolEx@@QEAAEXZ
?IsValid@CMemoryAllocator@@UEAAEXZ
?IsValid@CMemoryPoolAllocator@@UEAAEXZ
?IsValid@IMemoryAllocator@@UEAAEXZ
?IsWorkerThread@CWorkerThreadPool@@QEAAE_K@Z
?IsWorkerThread@CWorkerThreadPoolEx@@QEAAE_K@Z
?JobFunction@CUserFuncAdapterJob@@MEAAXXZ
?JobQueue@CWorkerThreadPool@@QEAAAEAVCWorkerThreadJobQueue@@XZ
?JobQueue@CWorkerThreadPoolEx@@QEAAAEAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QEAAKXZ
?Limit@CNoLockList@@QEAAKXZ
?MatchAllExtensions@CFileExtension@@QEAAEXZ
?MatchNoExtensions@CFileExtension@@QEAAEXZ
?MergeLeft@CMemoryPoolAllocator@@IEAAPEAXPEAX@Z
?MergeRight@CMemoryPoolAllocator@@IEAAPEAXPEAX@Z
?NeedDelete@CWorkerThreadJob@@QEAAEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QEAAXE@Z
?NewNode@CList@@UEAAPEAXXZ
?NewNode@CStrList@@EEAAPEAXXZ
?NewNodeVariant@CList@@IEAAPEAXK@Z
?Next@CList@@UEBAPEAXQEAX@Z
?Next@CLockList@@UEBAPEAXQEAX@Z
?Next@CNoLockList@@UEBAPEAXQEAX@Z
?NextPool@CMemoryPoolAllocator@@QEAAPEAV1@XZ
?NotityTerminate@CWorkerThread@@QEAAXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QEAAJP6AXPEAX@Z0E@Z
?PostJobToWorkerThread@CWorkerThreadPoolEx@@QEAAJP6AXPEAX@Z0E1@Z
?Pulse@CKEvent@@QEAAJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QEAAEPEAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QEAAJPEAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPoolEx@@QEAAJPEAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SAPEAV1@XZ
?Read@CFile@@QEAAJPEADKPEAK@Z
?ReadWIRP@CFile@@QEAAJPEADKPEAK@Z
?ReferenceCount@CContext@@QEAAAEAKXZ
?Release@CLockEvent@@QEAAXXZ
?Remove@CContextList@@UEAAEQEAX@Z
?Remove@CList@@UEAAEQEAX@Z
?Remove@CLockList@@UEAAEQEAX@Z
?Remove@CNoLockList@@UEAAEQEAX@Z
?RemoveHead@CList@@UEAAPEAXXZ
?RemoveHead@CLockList@@UEAAPEAXXZ
?RemoveHead@CNoLockList@@UEAAPEAXXZ
?RemoveTail@CList@@UEAAPEAXXZ
?RemoveTail@CLockList@@UEAAPEAXXZ
?RemoveTail@CNoLockList@@UEAAPEAXXZ
?Reset@CKEvent@@QEAAXXZ
?ResetData@CInclusionExtConfig@@QEAAXXZ
?ResetData@CInclusionFileNameConfig@@QEAAXXZ
?ResetData@CInclusionFilePathConfig@@QEAAXXZ
?ResetData@CInclusionFolderConfig@@QEAAXXZ
?RestoreCR0@@YAXPEAX@Z
?Run@CAutoUpdateConfigThread@@UEAAXXZ
?Run@CDelayLoadThread@@UEAAXXZ
?Run@CWorkerThread@@UEAAXXZ
?SeekToEnd@CFile@@QEAAJXZ
?Set@CKEvent@@QEAAJJE@Z
?SetAttributes@CFile@@QEAAJK@Z
?SetBlobCofig@CContext@@UEAAJKPEAXK@Z
?SetData@CBlobConfig@@QEAAHPEAXK@Z
?SetData@CModuleFileExtConfig@@QEAAHPEBG@Z
?SetData@CModuleFlagConfig@@QEAAHK@Z
?SetData@CModuleMultiStringConfig@@QEAAHPEBGK@Z
?SetData@CModuleStringConfig@@QEAAHPEBG@Z
?SetEngineContext@CContext@@QEAAXPEAX@Z
?SetFileExtensionConfig@CContext@@UEAAJKPEBG@Z
?SetFlagConfig@CContext@@UEAAJKK@Z
?SetLinkContext@CContext@@QEAAXPEAX@Z
?SetLogFlag@CDebugLog@@QEAAEK@Z
?SetLogFlag@CDebugLogEx@@QEAAEK@Z
?SetMatchAllExtensions@CFileExtension@@QEAAXE@Z
?SetMatchNoExtensions@CFileExtension@@QEAAXE@Z
?SetMultiStringConfig@CContext@@UEAAJKPEBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QEAAXXZ
?SetPriority@CSystemThread@@QEAAXK@Z
?SetStopUse@CContext@@QEAAXXZ
?SetStringConfig@CContext@@UEAAJKPEBG@Z
?Setup@CSystemThread@@MEAAXXZ
?StopUse@CContext@@QEAAHXZ
?TearDown@CSystemThread@@MEAAXXZ
?Terminate@CSystemThread@@QEAAXE@Z
?Terminate@CWorkerThreadPool@@QEAAEXZ
?Terminate@CWorkerThreadPoolEx@@QEAAEXZ
?TmExceptionFilter@@YAJPEAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QEAAJPEAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QEAAXXZ
?WaitForInit@CDelayLoadThread@@QEAAEXZ
?WaitForLoad@CDelayLoadThread@@QEAAEXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QEAAEXZ
?WaitQueueEmpty@CWorkerThreadJobQueue@@QEAAXXZ
?Write@CDebugLog@@QEAAXPEBDZZ
?Write@CDebugLogEx@@QEAAXPEBDZZ
?Write@CFile@@QEAAJPEADKPEAT_LARGE_INTEGER@@PEAK@Z
?WriteDataToFile@CDebugLogEx@@IEAAXPEADK@Z
?WriteDataToProcMonW@CDebugLogEx@@IEAAXPEAD@Z
?WriteSystemInformation@CDebugLog@@QEAAXXZ
?WriteSystemInformation@CDebugLogEx@@QEAAXXZ
?WriteSystemStringInformation@CDebugLog@@IEAAXPEBG@Z
?WriteSystemStringInformation@CDebugLogEx@@IEAAXPEBG@Z
?WriteToFile@CDebugLog@@IEAAXPEADK@Z
?WriteToProcMonW@CDebugLogEx@@IEAAXPEAU_UNICODE_STRING@@@Z
?_pNonPagedAllocator@@3PEAVCMemoryAllocator@@EA
?_pPagedAllocator@@3PEAVCMemoryAllocator@@EA
?m_lpInstance@CWorkerThreadPool@@1PEAV1@EA
?m_lpRCMInstance@CWorkerThreadPool@@1PEAV1@EA
DeInitKm2UmCommunication
DeInitKmLPC
DuplicateFullFileName
FreeFullFileName
GetKm2UmMode
GetModuleInfoByAddress
GetModuleInfoByModuleName
InitKm2UmCommunication
InitKmLPC
KmCallUm
KmCallUmByLPC
KmCallUmEx
KmCleanupCommPortAPIs
KmGetUmInitProcess
KmSetCommPortAPIs
ModGetExportProcAddress
ModLoadDLLToBuffer
ModLoadDLLToBufferWithImageSize
ModLoadModule
ModUnLoadModule
NormalizeFileName
NormalizeFullNtPathToDosName
TmCommConfigRoutine
UtilAddDeviceInDriveTable
UtilAddReparsePointMapping
UtilCleanFileReadOnly
UtilCreateDosFileName
UtilDeleteFileForce
UtilGetDeviceObjectName
UtilGetFileNameFromFileObject
UtilGetFileObjectForProcessByEPROC
UtilGetFileObjectFromFileName
UtilGetProcessName
UtilGetSystemDirectory
UtilGetSystemDirectoryEx
UtilGetSystemDirectoryLength
UtilGetSystemTime
UtilIoSetFileInfo
UtilIopCreateFileIRP
UtilKeGetLowFileDevice
UtilModuleIATHook
UtilModuleIATUnHook
UtilPostJobToWorkerThread
UtilQueryKeyValue
UtilRemoveDeviceFromDriveTable
UtilVolumeDeviceToDosName
UtilWaitValueChangeToZero
UtilWriteVersionToRegistry
UtilbuildDynamicDiskMappingTable
UtlWriteBinValueKeyToRegistry
ValidateAddressWithSize
_UtilDosPathNameToNtPathName

Sections

Expand

.text
.rdata
.data
.pdata
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2011-06-20 22:08:35
MD5	a31246180e61140ad7ff9dd7edf1f6a1
SHA1	fe0afc6dd03a9bd7f6e673cc6b4af2266737e3d1
SHA256	6ffdde6bc6784c13c601442e47157062941c47015891e7139c2aaba676ab59cc
Authentihash MD5	9da7d62145d6f4c104da27b797fabc4c
Authentihash SHA1	597144e2c01496c32aeed3277f8619c229de17b4
Authentihash SHA256	d3227dc2e8f83258810cf43719f02a8d52648eb17939fddd79fd70155a47305d
RichPEHeaderHash MD5	b096b1994ceb1d288d734b2bd59137d7
RichPEHeaderHash SHA1	a9cb9331ae0ecb82e617ff09fe40796ab093035e
RichPEHeaderHash SHA256	0a5393cf21980cb34b6c35c2fe034fa52f56cd502b9bb49398d04d555bc5cc8f
Company	Trend Micro Inc.
Description	TrendMicro Common Module NoTrap Build
Product	Trend Micro Eyes
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 3825d7faf861af9ef490e726b5d65ad5

Field	Value
ToBeSigned (TBS) MD5	d6c7684e9aaa508cf268335f83afe040
ToBeSigned (TBS) SHA1	18066d20ad92409c567cdfde745279ff71c75226
ToBeSigned (TBS) SHA256	a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff
Subject	C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2
ValidFrom	2007-06-15 00:00:00
ValidTo	2012-06-14 23:59:59
Signature	50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	3825d7faf861af9ef490e726b5d65ad5
Version	3

Certificate 47bf1995df8d524643f7db6d480d31a4

Field	Value
ToBeSigned (TBS) MD5	518d2ea8a21e879c942d504824ac211c
ToBeSigned (TBS) SHA1	21ce87d827077e61abddf2beba69fde5432ea031
ToBeSigned (TBS) SHA256	1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7
Subject	C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
ValidFrom	2003-12-04 00:00:00
ValidTo	2013-12-03 23:59:59
Signature	4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	47bf1995df8d524643f7db6d480d31a4
Version	3

Certificate 4d6290e58c54f0f1eb17341a1310e6a4

Field	Value
ToBeSigned (TBS) MD5	b7d8444a70054990435f35a5630df5e1
ToBeSigned (TBS) SHA1	4678c6e4a8787a8e6ed2bce8792b122f6c08afd8
ToBeSigned (TBS) SHA256	0a8b4b359ea7890b358e56e436e9cfc6f32b037b2599b597ca7f7a80d475ec98
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-09-30 00:00:00
ValidTo	2014-01-01 23:59:59
Signature	aedd211d5f8f807ad25209eadb6ed25d8be8c21b6904be51a5010e59fa37d174a3eedced89742b62d5a6bf4fad361754f013e0a345d24c26cbe26da21fd01e7a070fb6b37b6f5068a2e931b3b7997d8070a0a7de0b1ea4fff34d811bdd20c91cc4afcff18ffad9da95f0ecdc5cbfe88c5a3e7ab0a3eb59437411e09b1a6af36f
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	4d6290e58c54f0f1eb17341a1310e6a4
Version	3

Certificate 610c120600000000001b

Field	Value
ToBeSigned (TBS) MD5	53c41bc1164e09e0cd1617a5bf913efd
ToBeSigned (TBS) SHA1	93c03aac8951d494ecd5696b1c08658541b18727
ToBeSigned (TBS) SHA256	40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b
Subject	C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
ValidFrom	2006-05-23 17:01:29
ValidTo	2016-05-23 17:11:29
Signature	01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	610c120600000000001b
Version	3

Certificate 24e3d70b86ed54d0b22c3450b960984e

Field	Value
ToBeSigned (TBS) MD5	8ddf6d6623a3f10024af513804bb606d
ToBeSigned (TBS) SHA1	4daedaec405b6dfefce005517e230b2419ad08bc
ToBeSigned (TBS) SHA256	54894db2dab64a4991b4deab1a3415d4ea0d9905711af3b67242a0568d799b95
Subject	C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, OU=RD, CN=Trend Micro, Inc.
ValidFrom	2011-01-31 00:00:00
ValidTo	2012-02-16 23:59:59
Signature	5ae5a2abcc8bbf832dd651a0cb396ee5af87305e67d20288d6d830699286ce0b1b3ec77c732d80564e6a482461bda52329dc301ec6286011fe60413c97f4207bf675a71460365e9d917b19d7b5e7c49ff035a5488f8fc703a61512b1588cb6fc8ceef0f6353d47c66a5edbef40e53197431ada77acef71cca7db0dbaa88d02355af0a62a7901e91bc8c59ad48b4ecfd67f137023601c308691ad14d6859c9d6b28c6a3e15314e55832cea94793436a5610bbe5f0901cedc6796c9ca53b5d55f79974cd6be7093bba119675614c1654139096e506c3fb92460d45879bdbc196bd833ae4dc31da6e14130df14a20c05615db7ea7e25aa0fe59801ec30a56501e56
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	24e3d70b86ed54d0b22c3450b960984e
Version	3

Imports

Expand

ntoskrnl.exe
HAL.dll
CLASSPNP.SYS
SCSIPORT.SYS

Imported Functions

Expand

KeWaitForSingleObject
KeReleaseSemaphore
KeStackAttachProcess
KeUnstackDetachProcess
RtlSubAuthoritySid
RtlInitializeSid
ExAllocatePoolWithTag
RtlLengthRequiredSid
ExFreePoolWithTag
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
ObfDereferenceObject
ZwSetEvent
ZwClose
ZwRequestWaitReplyPort
ProbeForWrite
ZwFreeVirtualMemory
ZwAllocateVirtualMemory
ObOpenObjectByPointer
PsProcessType
memmove
ZwConnectPort
RtlInitUnicodeString
RtlUnicodeStringToInteger
ZwCreateSection
ZwWaitForSingleObject
ZwOpenEvent
ObfReferenceObject
IoGetCurrentProcess
PsGetProcessExitTime
MmSectionObjectType
DbgPrint
memset
MmIsAddressValid
ExInitializeResourceLite
ExDeleteResourceLite
ZwWriteFile
ZwReadFile
ZwQueryInformationFile
ZwSetInformationFile
ZwCreateFile
swprintf
towupper
_wcsnicmp
KeInitializeEvent
_snprintf
PsGetCurrentProcessId
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
ZwCreateKey
ZwCreateEvent
KeWaitForMultipleObjects
ObReferenceObjectByHandle
ZwNotifyChangeKey
PsGetCurrentThreadId
_vsnprintf
KeSetPriorityThread
PsTerminateSystemThread
PsCreateSystemThread
KeNumberProcessors
ZwQueryInformationProcess
PsLookupProcessByProcessId
KeDelayExecutionThread
ZwOpenDirectoryObject
PsSetCreateProcessNotifyRoutine
ZwQuerySystemInformation
ZwQueryDirectoryFile
ZwQueryDirectoryObject
ZwDuplicateObject
ZwOpenKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryValueKey
ZwDeleteValueKey
ZwDeleteKey
ExGetPreviousMode
ZwTerminateProcess
ZwOpenProcess
ZwQueryKey
ZwSetValueKey
MmHighestUserAddress
IoFreeIrp
IoFreeMdl
MmUnlockPages
KeInitializeSemaphore
_strnicmp
RtlQueryRegistryValues
RtlAppendUnicodeToString
mbstowcs
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
NtClose
ZwSetInformationObject
_stricmp
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwOpenFile
RtlEqualUnicodeString
IoFileObjectType
IoCreateFile
IofCallDriver
IoAllocateIrp
MmBuildMdlForNonPagedPool
IoAllocateMdl
ProbeForRead
PsGetVersion
MmGetSystemRoutineAddress
RtlCopyUnicodeString
RtlCompareMemory
_snwprintf
RtlImageNtHeader
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
strrchr
ZwQueryVolumeInformationFile
ObReferenceObjectByPointer
ObQueryNameString
IoBuildDeviceIoControlRequest
IofCompleteRequest
ExEventObjectType
_allmul
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoGetDeviceObjectPointer
RtlUpperChar
RtlCompareUnicodeString
strncpy
KeServiceDescriptorTable
NtOpenProcess
ObOpenObjectByName
IoDriverObjectType
RtlAppendUnicodeStringToString
NtQueryInformationProcess
PsIsThreadTerminating
PsThreadType
KeAddSystemServiceTable
ZwQueryObject
ZwQuerySecurityObject
ObInsertObject
_allrem
IoReleaseVpbSpinLock
IoAcquireVpbSpinLock
SeCreateAccessState
IoGetFileObjectGenericMapping
RtlUpcaseUnicodeString
ObCreateObject
_allshr
MmUnmapIoSpace
MmGetPhysicalAddress
MmFreeContiguousMemory
MmAllocateContiguousMemory
MmMapIoSpace
KeTickCount
KeBugCheckEx
RtlUnwind
KeClearEvent
KePulseEvent
KeSetEvent
wcsrchr
memcpy
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
RtlLengthSid
wcschr
RtlAbsoluteToSelfRelativeSD
wcsncpy
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
ExAcquireResourceSharedLite
ExReleaseFastMutexUnsafe
KeLeaveCriticalRegion
KeEnterCriticalRegion
ExAcquireFastMutexUnsafe
_purecall
IoBuildAsynchronousFsdRequest
KeGetCurrentThread
KeRaiseIrqlToDpcLevel
KfLowerIrql
ExReleaseFastMutex
ExAcquireFastMutex
ClassInitialize
ScsiPortReadPortBufferUshort
ScsiPortReadPortUchar
ScsiPortWritePortUchar
ScsiPortStallExecution
ScsiPortWritePortBufferUshort

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
??0CBlobConfig@@QAE@ABV0@@Z
??0CBlobConfig@@QAE@K@Z
??0CContext@@QAE@ABV0@@Z
??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QAE@ABV0@@Z
??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
??0CDebugLog@@QAE@ABV0@@Z
??0CDebugLog@@QAE@PBG@Z
??0CDelayLoadThread@@QAE@ABV0@@Z
??0CDelayLoadThread@@QAE@XZ
??0CExclusionExtConfig@@QAE@ABV0@@Z
??0CExclusionExtConfig@@QAE@KKE@Z
??0CExclusionFileNameConfig@@QAE@ABV0@@Z
??0CExclusionFileNameConfig@@QAE@KK@Z
??0CExclusionFilePathConfig@@QAE@ABV0@@Z
??0CExclusionFilePathConfig@@QAE@KK@Z
??0CExclusionFolderConfig@@QAE@ABV0@@Z
??0CExclusionFolderConfig@@QAE@KK@Z
??0CExclusionRegistryConfig@@QAE@ABV0@@Z
??0CExclusionRegistryConfig@@QAE@KK@Z
??0CFile@@QAE@ABV0@@Z
??0CFile@@QAE@E@Z
??0CFileExtension@@QAE@ABV0@@Z
??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
??0CKEvent@@QAE@ABV0@@Z
??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
??0CList@@QAE@ABV0@@Z
??0CList@@QAE@KPAVIMemoryAllocator@@@Z
??0CLockEvent@@QAE@ABV0@@Z
??0CLockEvent@@QAE@XZ
??0CLockList@@QAE@ABV0@@Z
??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QAE@ABV0@@Z
??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
??0CMemoryPoolAllocator@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@XZ
??0CModuleConfigList@@QAE@ABV0@@Z
??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QAE@ABV0@@Z
??0CModuleFileExtConfig@@QAE@KKE@Z
??0CModuleFlagConfig@@QAE@ABV0@@Z
??0CModuleFlagConfig@@QAE@K@Z
??0CModuleMultiStringConfig@@QAE@ABV0@@Z
??0CModuleMultiStringConfig@@QAE@KK@Z
??0CModuleStringConfig@@QAE@ABV0@@Z
??0CModuleStringConfig@@QAE@K@Z
??0CNoLockList@@QAE@ABV0@@Z
??0CNoLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CSmartLock@@QAE@AAVCLockEvent@@@Z
??0CSmartLock@@QAE@XZ
??0CSmartReference@@QAE@AAJ@Z
??0CSmartReference@@QAE@AAK@Z
??0CSmartResource@@QAE@AAVCResource@@E@Z
??0CStrList@@QAE@ABV0@@Z
??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
??0CSystemThread@@QAE@ABV0@@Z
??0CSystemThread@@QAE@K@Z
??0CUserFuncAdapterJob@@QAE@ABV0@@Z
??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z0@Z
??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@E@Z
??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
??0CWorkerThreadJobQueue@@QAE@K@Z
??0CWorkerThreadPool@@QAE@ABV0@@Z
??0CWorkerThreadPool@@QAE@K@Z
??0IMemoryAllocator@@QAE@ABV0@@Z
??0IMemoryAllocator@@QAE@XZ
??1CAutoUpdateConfigThread@@UAE@XZ
??1CBlobConfig@@UAE@XZ
??1CContext@@UAE@XZ
??1CContextList@@UAE@XZ
??1CDebugLog@@UAE@XZ
??1CDelayLoadThread@@UAE@XZ
??1CExclusionExtConfig@@UAE@XZ
??1CExclusionFileNameConfig@@UAE@XZ
??1CExclusionFilePathConfig@@UAE@XZ
??1CExclusionFolderConfig@@UAE@XZ
??1CExclusionRegistryConfig@@UAE@XZ
??1CFile@@UAE@XZ
??1CFileExtension@@UAE@XZ
??1CKEvent@@UAE@XZ
??1CList@@UAE@XZ
??1CLockEvent@@UAE@XZ
??1CLockList@@UAE@XZ
??1CMemoryAllocator@@UAE@XZ
??1CMemoryPoolAllocator@@UAE@XZ
??1CModuleConfig@@UAE@XZ
??1CModuleConfigList@@UAE@XZ
??1CModuleFileExtConfig@@UAE@XZ
??1CModuleFlagConfig@@UAE@XZ
??1CModuleMultiStringConfig@@UAE@XZ
??1CModuleStringConfig@@UAE@XZ
??1CNoLockList@@UAE@XZ
??1CSmartLock@@QAE@XZ
??1CSmartReference@@QAE@XZ
??1CSmartResource@@QAE@XZ
??1CStrList@@UAE@XZ
??1CSystemThread@@UAE@XZ
??1CUserFuncAdapterJob@@UAE@XZ
??1CWorkerThread@@UAE@XZ
??1CWorkerThreadJob@@UAE@XZ
??1CWorkerThreadJobQueue@@UAE@XZ
??1CWorkerThreadPool@@UAE@XZ
??1IMemoryAllocator@@UAE@XZ
??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??2CMemoryAllocator@@SGPAXI@Z
??2CMemoryPoolAllocator@@SGPAXI@Z
??3@YAXPAX@Z
??3IMemoryAllocator@@SGXPAX@Z
??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
??4CBlobConfig@@QAEAAV0@ABV0@@Z
??4CContext@@QAEAAV0@ABV0@@Z
??4CDebugLog@@QAEAAV0@ABV0@@Z
??4CDelayLoadThread@@QAEAAV0@ABV0@@Z
??4CFile@@QAEAAV0@ABV0@@Z
??4CKEvent@@QAEAAV0@ABV0@@Z
??4CLockEvent@@QAEAAV0@ABV0@@Z
??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
??4CModuleConfig@@QAEAAV0@ABV0@@Z
??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
??4CSmartResource@@QAEAAV0@ABV0@@Z
??4CSystemThread@@QAEAAV0@ABV0@@Z
??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
??4CWorkerThread@@QAEAAV0@ABV0@@Z
??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CDelayLoadThread@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CNoLockList@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QAEXXZ
??_FCFile@@QAEXXZ
??_FCFileExtension@@QAEXXZ
??_FCModuleConfigList@@QAEXXZ
??_FCStrList@@QAEXXZ
??_FCSystemThread@@QAEXXZ
??_FCWorkerThread@@QAEXXZ
??_FCWorkerThreadJob@@QAEXXZ
??_FCWorkerThreadJobQueue@@QAEXXZ
??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??_V@YAXPAX@Z
?Acquire@CLockEvent@@QAEXXZ
?Add@CContextList@@QAEEPAVCContext@@@Z
?Add@CFileExtension@@QAEEPBGK@Z
?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
?Add@CStrList@@QAEEPBG@Z
?AddNode@CLockList@@UAEEQAXE@Z
?AddNode@CNoLockList@@UAEEQAXE@Z
?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QAEXXZ
?CheckNode@CLockList@@UAEHQAX@Z
?CheckNode@CNoLockList@@UAEHQAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
?Cleanup@CBlobConfig@@AAEXXZ
?Cleanup@CModuleFileExtConfig@@IAEXXZ
?Cleanup@CModuleMultiStringConfig@@IAEXXZ
?Cleanup@CModuleStringConfig@@AAEXXZ
?Close@CFile@@QAEJXZ
?Count@CLockList@@QAEKXZ
?Count@CNoLockList@@QAEKXZ
?Create@CFile@@QAEJPBGKKKK@Z
?Create@CSystemThread@@QAEEXZ
?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
?CreatePool@CWorkerThreadPool@@QAEEXZ
?CreateThreads@CWorkerThreadPool@@QAEEK@Z
?CreateWIRP@CFile@@QAEJPBGKKKK@Z
?Delete@CFile@@QAEJXZ
?Delete@CFileExtension@@QAEEPBGK@Z
?Delete@CStrList@@QAEEPBG@Z
?DeleteAll@CList@@UAEXXZ
?DeleteAll@CLockList@@UAEXXZ
?DeleteAll@CNoLockList@@UAEXXZ
?DeleteNode@CContextList@@MAEXPAX@Z
?DeleteNode@CList@@UAEXPAX@Z
?DeleteNode@CModuleConfigList@@MAEXPAX@Z
?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YGXPAPAX@Z
?DoIt@CWorkerThreadJob@@QAEJXZ
?EntryPoint@CSystemThread@@KGXPAX@Z
?Find@CContextList@@QAEPAVCContext@@K@Z
?Find@CContextList@@QAEPAVCContext@@PAX@Z
?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FindNode@CContextList@@IAEPAXPAX@Z
?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?First@CList@@UAEPAXXZ
?First@CLockList@@UAEPAXXZ
?First@CNoLockList@@UAEPAXXZ
?Free@CMemoryAllocator@@UAEXPAX@Z
?Free@CMemoryPoolAllocator@@UAEXPAX@Z
?GetAttributes@CFile@@QAEKXZ
?GetBasicInfomration@CFile@@IAEJXZ
?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
?GetCategory@CContext@@QAEKXZ
?GetData@CBlobConfig@@QAEHPAXPAK@Z
?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QAEKXZ
?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
?GetData@CModuleStringConfig@@QAEPAGXZ
?GetData@CStrList@@QAEEPAGPAK@Z
?GetDataType@CModuleConfig@@QAEKXZ
?GetEngineContext@CContext@@QAEPAXXZ
?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UAEJKPAK@Z
?GetID@CModuleConfig@@QAEKXZ
?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QAEKXZ
?GetLinkContext@CContext@@QAEPAXXZ
?GetLogFlag@CDebugLog@@QAEKXZ
?GetModuleId@CModuleConfig@@QAEKXZ
?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QAEKXZ
?GetSize@CBlobConfig@@QAEKXZ
?GetStringConfig@CContext@@QAEPAGK@Z
?GetStringConfig@CContext@@UAEJKPAGPAK@Z
?GetThreadCount@CWorkerThreadPool@@QAEKXZ
?GetThreadID@CSystemThread@@QAEKXZ
?GetType@CContext@@QAEKXZ
?GetUserParameter@CContext@@QAEKXZ
?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
?InitializeFlagConfig@CContext@@QAEHKK@Z
?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
?InitializeStringConfig@CContext@@QAEHKPBG@Z
?Insert@CList@@UAEXQAXE@Z
?Insert@CLockList@@UAEXQAXE@Z
?Insert@CNoLockList@@UAEXQAXE@Z
?InsertAfter@CList@@UAEXPAX0@Z
?InsertBefore@CList@@UAEXPAX0@Z
?Instance@CWorkerThreadPool@@SGPAV1@XZ
?IsEmpty@CList@@UAEEXZ
?IsEmpty@CLockList@@UAEEXZ
?IsEmpty@CNoLockList@@UAEEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
?IsFull@CLockList@@QBEEXZ
?IsFull@CNoLockList@@QBEEXZ
?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
?IsOpened@CFile@@QAEEXZ
?IsTerminated@CWorkerThreadPool@@QAEEXZ
?IsValid@CMemoryAllocator@@UAEEXZ
?IsValid@CMemoryPoolAllocator@@UAEEXZ
?IsValid@IMemoryAllocator@@UAEEXZ
?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
?JobFunction@CUserFuncAdapterJob@@MAEXXZ
?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QAEKXZ
?Limit@CNoLockList@@QAEKXZ
?MatchAllExtensions@CFileExtension@@QAEEXZ
?MatchNoExtensions@CFileExtension@@QAEEXZ
?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
?NeedDelete@CWorkerThreadJob@@QAEEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
?NewNode@CList@@UAEPAXXZ
?NewNode@CStrList@@EAEPAXXZ
?NewNodeVariant@CList@@IAEPAXK@Z
?Next@CList@@UBEPAXQAX@Z
?Next@CLockList@@UBEPAXQAX@Z
?Next@CNoLockList@@UBEPAXQAX@Z
?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
?NotityTerminate@CWorkerThread@@QAEXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
?Pulse@CKEvent@@QAEJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
?Read@CFile@@QAEJPADKPAK@Z
?ReferenceCount@CContext@@QAEAAKXZ
?Release@CLockEvent@@QAEXXZ
?Remove@CContextList@@UAEEQAX@Z
?Remove@CList@@UAEEQAX@Z
?Remove@CLockList@@UAEEQAX@Z
?Remove@CNoLockList@@UAEEQAX@Z
?RemoveHead@CList@@UAEPAXXZ
?RemoveHead@CLockList@@UAEPAXXZ
?RemoveHead@CNoLockList@@UAEPAXXZ
?RemoveTail@CList@@UAEPAXXZ
?RemoveTail@CLockList@@UAEPAXXZ
?RemoveTail@CNoLockList@@UAEPAXXZ
?Reset@CKEvent@@QAEXXZ
?RestoreCR0@@YGXPAX@Z
?Run@CAutoUpdateConfigThread@@UAEXXZ
?Run@CDelayLoadThread@@UAEXXZ
?Run@CWorkerThread@@UAEXXZ
?SeekToEnd@CFile@@QAEJXZ
?Set@CKEvent@@QAEJJE@Z
?SetAttributes@CFile@@QAEJK@Z
?SetBlobCofig@CContext@@UAEJKPAXK@Z
?SetData@CBlobConfig@@QAEHPAXK@Z
?SetData@CModuleFileExtConfig@@QAEHPBG@Z
?SetData@CModuleFlagConfig@@QAEHK@Z
?SetData@CModuleMultiStringConfig@@QAEHPBG@Z
?SetData@CModuleStringConfig@@QAEHPBG@Z
?SetEngineContext@CContext@@QAEXPAX@Z
?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
?SetFlagConfig@CContext@@UAEJKK@Z
?SetLinkContext@CContext@@QAEXPAX@Z
?SetLogFlag@CDebugLog@@QAEEK@Z
?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
?SetMultiStringConfig@CContext@@UAEJKPBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
?SetPriority@CSystemThread@@QAEXK@Z
?SetStopUse@CContext@@QAEXXZ
?SetStringConfig@CContext@@UAEJKPBG@Z
?Setup@CSystemThread@@MAEXXZ
?StopUse@CContext@@QAEHXZ
?TearDown@CSystemThread@@MAEXXZ
?Terminate@CSystemThread@@QAEXE@Z
?Terminate@CWorkerThreadPool@@QAEEXZ
?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QAEXXZ
?WaitForReady@CDelayLoadThread@@QAEEXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
?Write@CDebugLog@@QAAXPBDZZ
?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
?WriteSystemInformation@CDebugLog@@QAEXXZ
?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
?WriteToFile@CDebugLog@@IAEXPADK@Z
?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
?_pPagedAllocator@@3PAVCMemoryAllocator@@A
?m_lpInstance@CWorkerThreadPool@@1PAV1@A
?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
_DeInitKmLPC@0
_GetModuleInfoByAddress@8
_GetModuleInfoByModuleName@8
_InitKmLPC@0
_KmCallUm@8
_KmCallUmEx@12
_ModGetExportProcAddress@8
_ModLoadDLLToBuffer@4
_ModLoadDLLToBufferWithImageSize@8
_ModLoadModule@8
_ModUnLoadModule@4
_NormalizeFileName@4
_NormalizeFullNtPathToDosName@4
_TmCommConfigRoutine@4
_UtilAddDeviceInDriveTable@4
_UtilCleanFileReadOnly@4
_UtilDeleteFileForce@4
_UtilGetFileObjectForProcessByEPROC@8
_UtilGetFileObjectFromFileName@12
_UtilGetProcessName@12
_UtilGetSystemDirectory@4
_UtilGetSystemTime@4
_UtilIoSetFileInfo@24
_UtilIopCreateFileIRP@40
_UtilKeGetLowFileDevice@16
_UtilModuleIATHook@24
_UtilModuleIATUnHook@8
_UtilQueryKeyValue@24
_UtilRemoveDeviceFromDriveTable@4
_UtilVolumeDeviceToDosName@8
_UtilWaitValueChangeToZero@8
_UtilWriteVersionToRegistry@8
_UtilbuildDynamicDiskMappingTable@0
__UtilDosPathNameToNtPathName@12

Sections

Expand

.text
.rdata
.data
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2013-12-09 05:00:06
MD5	569676d3d45b0964ac6dd0815be8ff8c
SHA1	58b31fb2b623bd2c5d5c8c49b657a14a674664a4
SHA256	76e807b6c0214e66455f09a8de8faad40b738982ca84470f0043de0290449524
Authentihash MD5	6d3193458659666e4c86ec1b9fb06bf9
Authentihash SHA1	ef123d041e10d8a0b22786f6e471d0c18bc13167
Authentihash SHA256	83a67b544982a2fd1484af752cc4ab2f6c0b50cb3c9dba60b888c2c2e37d1036
RichPEHeaderHash MD5	db8673928b63031dda3b7e6b364d7157
RichPEHeaderHash SHA1	c7c04144287b50a964c97c1c0c43c141d3b53037
RichPEHeaderHash SHA256	70cca01aa262b7adf0baef899d17c4cbd896bf51543e6b22d4175db6bd26a838
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	Trend Micro Eyes
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 478a8efb59e1d83f0ce142d2a28707be

Field	Value
ToBeSigned (TBS) MD5	f13ede9179075999ef7f856ec31e364b
ToBeSigned (TBS) SHA1	2f09867166e6107e17808317f5c8d4ee157f45bc
ToBeSigned (TBS) SHA256	089a2c4c6ac7432020acdb65c33bf39130da6f37c002ba79128bd4c94e4fa101
Subject	C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO Time Stamping Signer
ValidFrom	2010-05-10 00:00:00
ValidTo	2015-05-10 23:59:59
Signature	c8fb63f80b75752c3af1f213a72db6a31a9cad0107d3348e77e0c26eae025d484fa4d221b636fd2a35437c6bdf80870b15f0763200b4ceb567a42f2f201b9c549e833f1f5f149562820f2241221f70b3f3f742de6c51cd4bf821ac9b3b8cb1e5e6288fce2a8af9aa524d8c5b77ba4d5a58dbbb6a04cc521e9de228370ebbe70e91c7f8dbf18198ebcd37b30eab65d362ec3aa576eb13a83593c92e0a01ecc0e8cc3d7eb6ebe2c1ecd3149282668750dcfd5097acb34a767306c486113ab35f4304526feab3d074364ccaf11b7984377063ad74b9aa0ef398b08608ebdbe01f8c10f239649bae4f0a2c928a4f18b591e58d1a935f1faef1a6f02e97d0d2f62b3c
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	478a8efb59e1d83f0ce142d2a28707be
Version	3

Certificate 4d6290e58c54f0f1eb17341a1310e6a4

Field	Value
ToBeSigned (TBS) MD5	b7d8444a70054990435f35a5630df5e1
ToBeSigned (TBS) SHA1	4678c6e4a8787a8e6ed2bce8792b122f6c08afd8
ToBeSigned (TBS) SHA256	0a8b4b359ea7890b358e56e436e9cfc6f32b037b2599b597ca7f7a80d475ec98
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-09-30 00:00:00
ValidTo	2014-01-01 23:59:59
Signature	aedd211d5f8f807ad25209eadb6ed25d8be8c21b6904be51a5010e59fa37d174a3eedced89742b62d5a6bf4fad361754f013e0a345d24c26cbe26da21fd01e7a070fb6b37b6f5068a2e931b3b7997d8070a0a7de0b1ea4fff34d811bdd20c91cc4afcff18ffad9da95f0ecdc5cbfe88c5a3e7ab0a3eb59437411e09b1a6af36f
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	4d6290e58c54f0f1eb17341a1310e6a4
Version	3

Certificate 610c120600000000001b

Field	Value
ToBeSigned (TBS) MD5	53c41bc1164e09e0cd1617a5bf913efd
ToBeSigned (TBS) SHA1	93c03aac8951d494ecd5696b1c08658541b18727
ToBeSigned (TBS) SHA256	40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b
Subject	C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
ValidFrom	2006-05-23 17:01:29
ValidTo	2016-05-23 17:11:29
Signature	01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	610c120600000000001b
Version	3

Certificate 1a9d178ad334acdf47c8a0d15bb50e6e

Field	Value
ToBeSigned (TBS) MD5	685d99029d38a9d263ea82cd02a49f6c
ToBeSigned (TBS) SHA1	93464d8f54b4ee7caf22ca1db15a4211e0d3c79e
ToBeSigned (TBS) SHA256	894991f1477dff88c7c0707531073bb59483750bcad672fc388179affca07aa9
Subject	C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=Trend Micro, Inc.
ValidFrom	2013-01-17 00:00:00
ValidTo	2014-03-18 23:59:59
Signature	65c7e1e0f4051179852b819153b528c88db47ef50e897cd8ce0d03a7cc2dc896c89790410182186fecaf9da5c317bf57b5038311c10c2ec5ddb5c18165a7e92f92a6f39c042262126c714337a7c528041a04679217c1475a30231c967ca63b4430ccea52fe4f16fabb5c454d2aa8cdde347b8beaa973d76b3f9ba99d2597939a33d67ec4abc3974ef3792b8bc90d092cce62309d205129bbcbd3554382f24b2911b4904b09e7f52f24f2cc5a52fa49f3a163c32fde076e917301f22dd45d643b95319bae922bc861e5a8f90d4dd72603c7b1ea0229eca869ab8d086ae5286baeba9b99a12856dc1d3cd9f6d9da4b8d5a85896ba4587d8eba506a4fbba4a7bb49
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	1a9d178ad334acdf47c8a0d15bb50e6e
Version	3

Imports

Expand

ntoskrnl.exe
HAL.dll
CLASSPNP.SYS

Imported Functions

Expand

wcsrchr
KeSetEvent
KePulseEvent
KeClearEvent
KeStackAttachProcess
KeUnstackDetachProcess
ObfDereferenceObject
ZwSetEvent
ZwClose
ZwConnectPort
RtlInitUnicodeString
RtlUnicodeStringToInteger
ZwCreateSection
ZwWaitForSingleObject
ZwOpenEvent
IoGetCurrentProcess
ObfReferenceObject
DbgBreakPoint
ZwRequestWaitReplyPort
ExFreePoolWithTag
ProbeForWrite
ZwFreeVirtualMemory
ZwAllocateVirtualMemory
ObOpenObjectByPointer
PsProcessType
memmove
PsGetProcessExitTime
MmSectionObjectType
PsThreadType
ObReleaseObjectSecurity
SeReleaseSubjectContext
SeAccessCheck
SeCaptureSubjectContext
ObGetObjectSecurity
DbgPrint
memset
MmIsAddressValid
ExInitializeResourceLite
ExDeleteResourceLite
ZwWriteFile
ZwReadFile
ZwQueryInformationFile
ZwSetInformationFile
ZwCreateFile
swprintf
towupper
_wcsnicmp
ExAllocatePoolWithTag
KeInitializeEvent
_snprintf
PsGetCurrentProcessId
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
PsGetCurrentThreadId
RtlInitAnsiString
ZwDeviceIoControlFile
ZwCreateKey
ZwCreateEvent
KeWaitForMultipleObjects
ObReferenceObjectByHandle
ZwNotifyChangeKey
_vsnprintf
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlEqualUnicodeString
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
RtlUpcaseUnicodeChar
KeWaitForSingleObject
KeSetPriorityThread
PsTerminateSystemThread
PsCreateSystemThread
KeDelayExecutionThread
KeNumberProcessors
ZwQueryInformationProcess
PsLookupProcessByProcessId
ZwOpenDirectoryObject
PsSetCreateProcessNotifyRoutine
ZwQuerySystemInformation
ZwQueryDirectoryFile
ZwQueryDirectoryObject
ZwDuplicateObject
ZwOpenKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryValueKey
ZwDeleteValueKey
ZwDeleteKey
ExGetPreviousMode
ZwTerminateProcess
ZwOpenProcess
ZwQueryKey
ZwSetValueKey
IoFileObjectType
_allrem
memcpy
IoFreeIrp
IoFreeMdl
MmUnlockPages
IoBuildAsynchronousFsdRequest
_strnicmp
_purecall
RtlAppendUnicodeToString
mbstowcs
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
NtClose
ObQueryNameString
MmGetSystemRoutineAddress
ZwSetInformationObject
_stricmp
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwOpenFile
IoCreateFile
IofCallDriver
IoAllocateIrp
MmBuildMdlForNonPagedPool
IoAllocateMdl
ProbeForRead
PsGetVersion
RtlCompareMemory
_snwprintf
MmSystemRangeStart
RtlImageNtHeader
wcsncmp
strrchr
ZwQueryVolumeInformationFile
ObReferenceObjectByPointer
IoBuildDeviceIoControlRequest
ZwOpenSection
_allmul
KeReleaseSemaphore
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
KeInitializeSemaphore
IofCompleteRequest
ExEventObjectType
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoGetDeviceObjectPointer
RtlUpperChar
ObReferenceObjectByName
IoDriverObjectType
RtlCompareUnicodeString
strncpy
KeServiceDescriptorTable
NtOpenProcess
ObOpenObjectByName
NtQueryInformationProcess
PsIsThreadTerminating
KeAddSystemServiceTable
ZwQueryObject
ZwQuerySecurityObject
ObInsertObject
IoReleaseVpbSpinLock
IoAcquireVpbSpinLock
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
_allshr
ExInterlockedPopEntrySList
IoGetStackLimits
IoBuildSynchronousFsdRequest
wcsstr
RtlUpcaseUnicodeString
IoUnregisterPlugPlayNotification
FsRtlIsNameInExpression
IoGetConfigurationInformation
MmProbeAndLockPages
IoGetDeviceInterfaces
IoRegisterPlugPlayNotification
ExAllocatePool
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
strncat
wcschr
wcsncat
wcstombs
KeTickCount
KeBugCheckEx
RtlUnwind
wcsncpy
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
ExAcquireResourceSharedLite
ExReleaseFastMutexUnsafe
KeLeaveCriticalRegion
KeEnterCriticalRegion
MmHighestUserAddress
ExAcquireFastMutexUnsafe
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
RtlLengthSid
RtlAbsoluteToSelfRelativeSD
RtlQueryRegistryValues
KeGetCurrentThread
KfAcquireSpinLock
KfReleaseSpinLock
KeRaiseIrqlToDpcLevel
KfLowerIrql
ExAcquireFastMutex
ExReleaseFastMutex
KeGetCurrentIrql
KfRaiseIrql
ClassInitialize

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
??0CBlobConfig@@QAE@ABV0@@Z
??0CBlobConfig@@QAE@K@Z
??0CContext@@QAE@ABV0@@Z
??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QAE@ABV0@@Z
??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
??0CDebugLog@@QAE@ABV0@@Z
??0CDebugLog@@QAE@PBG@Z
??0CDebugLogEx@@QAE@ABV0@@Z
??0CDebugLogEx@@QAE@K@Z
??0CDelayLoadThread@@QAE@ABV0@@Z
??0CDelayLoadThread@@QAE@XZ
??0CExclusionExtConfig@@QAE@ABV0@@Z
??0CExclusionExtConfig@@QAE@KKE@Z
??0CExclusionFileNameConfig@@QAE@ABV0@@Z
??0CExclusionFileNameConfig@@QAE@KK@Z
??0CExclusionFilePathConfig@@QAE@ABV0@@Z
??0CExclusionFilePathConfig@@QAE@KK@Z
??0CExclusionFolderConfig@@QAE@ABV0@@Z
??0CExclusionFolderConfig@@QAE@KK@Z
??0CExclusionRegistryConfig@@QAE@ABV0@@Z
??0CExclusionRegistryConfig@@QAE@KK@Z
??0CFile@@QAE@ABV0@@Z
??0CFile@@QAE@E@Z
??0CFileExtension@@QAE@ABV0@@Z
??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
??0CInclusionExtConfig@@QAE@ABV0@@Z
??0CInclusionExtConfig@@QAE@KKE@Z
??0CInclusionFileNameConfig@@QAE@ABV0@@Z
??0CInclusionFileNameConfig@@QAE@KK@Z
??0CInclusionFilePathConfig@@QAE@ABV0@@Z
??0CInclusionFilePathConfig@@QAE@KK@Z
??0CInclusionFolderConfig@@QAE@ABV0@@Z
??0CInclusionFolderConfig@@QAE@KK@Z
??0CKEvent@@QAE@ABV0@@Z
??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
??0CList@@QAE@ABV0@@Z
??0CList@@QAE@KPAVIMemoryAllocator@@@Z
??0CLockEvent@@QAE@ABV0@@Z
??0CLockEvent@@QAE@XZ
??0CLockList@@QAE@ABV0@@Z
??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QAE@ABV0@@Z
??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
??0CMemoryPoolAllocator@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@XZ
??0CModuleConfigList@@QAE@ABV0@@Z
??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QAE@ABV0@@Z
??0CModuleFileExtConfig@@QAE@KKE@Z
??0CModuleFlagConfig@@QAE@ABV0@@Z
??0CModuleFlagConfig@@QAE@K@Z
??0CModuleMultiStringConfig@@QAE@ABV0@@Z
??0CModuleMultiStringConfig@@QAE@KK@Z
??0CModuleStringConfig@@QAE@ABV0@@Z
??0CModuleStringConfig@@QAE@K@Z
??0CNoLockList@@QAE@ABV0@@Z
??0CNoLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CSmartLock@@QAE@AAVCLockEvent@@@Z
??0CSmartLock@@QAE@XZ
??0CSmartReference@@QAE@AAJ@Z
??0CSmartReference@@QAE@AAK@Z
??0CSmartResource@@QAE@AAVCResource@@E@Z
??0CStrList@@QAE@ABV0@@Z
??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
??0CSystemThread@@QAE@ABV0@@Z
??0CSystemThread@@QAE@K@Z
??0CUserFuncAdapterJob@@QAE@ABV0@@Z
??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z01@Z
??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@E@Z
??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
??0CWorkerThreadJobQueue@@QAE@K@Z
??0CWorkerThreadPool@@QAE@ABV0@@Z
??0CWorkerThreadPool@@QAE@K@Z
??0CWorkerThreadPoolEx@@QAE@ABV0@@Z
??0CWorkerThreadPoolEx@@QAE@KK@Z
??0IMemoryAllocator@@QAE@ABV0@@Z
??0IMemoryAllocator@@QAE@XZ
??1CAutoUpdateConfigThread@@UAE@XZ
??1CBlobConfig@@UAE@XZ
??1CContext@@UAE@XZ
??1CContextList@@UAE@XZ
??1CDebugLog@@UAE@XZ
??1CDebugLogEx@@UAE@XZ
??1CDelayLoadThread@@UAE@XZ
??1CExclusionExtConfig@@UAE@XZ
??1CExclusionFileNameConfig@@UAE@XZ
??1CExclusionFilePathConfig@@UAE@XZ
??1CExclusionFolderConfig@@UAE@XZ
??1CExclusionRegistryConfig@@UAE@XZ
??1CFile@@UAE@XZ
??1CFileExtension@@UAE@XZ
??1CInclusionExtConfig@@UAE@XZ
??1CInclusionFileNameConfig@@UAE@XZ
??1CInclusionFilePathConfig@@UAE@XZ
??1CInclusionFolderConfig@@UAE@XZ
??1CKEvent@@UAE@XZ
??1CList@@UAE@XZ
??1CLockEvent@@UAE@XZ
??1CLockList@@UAE@XZ
??1CMemoryAllocator@@UAE@XZ
??1CMemoryPoolAllocator@@UAE@XZ
??1CModuleConfig@@UAE@XZ
??1CModuleConfigList@@UAE@XZ
??1CModuleFileExtConfig@@UAE@XZ
??1CModuleFlagConfig@@UAE@XZ
??1CModuleMultiStringConfig@@UAE@XZ
??1CModuleStringConfig@@UAE@XZ
??1CNoLockList@@UAE@XZ
??1CSmartLock@@QAE@XZ
??1CSmartReference@@QAE@XZ
??1CSmartResource@@QAE@XZ
??1CStrList@@UAE@XZ
??1CSystemThread@@UAE@XZ
??1CUserFuncAdapterJob@@UAE@XZ
??1CWorkerThread@@UAE@XZ
??1CWorkerThreadJob@@UAE@XZ
??1CWorkerThreadJobQueue@@UAE@XZ
??1CWorkerThreadPool@@UAE@XZ
??1CWorkerThreadPoolEx@@UAE@XZ
??1IMemoryAllocator@@UAE@XZ
??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??2CMemoryAllocator@@SGPAXI@Z
??2CMemoryPoolAllocator@@SGPAXI@Z
??3@YAXPAX@Z
??3IMemoryAllocator@@SGXPAX@Z
??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
??4CBlobConfig@@QAEAAV0@ABV0@@Z
??4CContext@@QAEAAV0@ABV0@@Z
??4CDebugLog@@QAEAAV0@ABV0@@Z
??4CDebugLogEx@@QAEAAV0@ABV0@@Z
??4CDelayLoadThread@@QAEAAV0@ABV0@@Z
??4CFile@@QAEAAV0@ABV0@@Z
??4CKEvent@@QAEAAV0@ABV0@@Z
??4CLockEvent@@QAEAAV0@ABV0@@Z
??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
??4CModuleConfig@@QAEAAV0@ABV0@@Z
??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
??4CSmartResource@@QAEAAV0@ABV0@@Z
??4CSystemThread@@QAEAAV0@ABV0@@Z
??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
??4CWorkerThread@@QAEAAV0@ABV0@@Z
??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CDebugLogEx@@6B@
??_7CDelayLoadThread@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CInclusionExtConfig@@6B@
??_7CInclusionFileNameConfig@@6B@
??_7CInclusionFilePathConfig@@6B@
??_7CInclusionFolderConfig@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CNoLockList@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7CWorkerThreadPoolEx@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QAEXXZ
??_FCFile@@QAEXXZ
??_FCFileExtension@@QAEXXZ
??_FCModuleConfigList@@QAEXXZ
??_FCStrList@@QAEXXZ
??_FCSystemThread@@QAEXXZ
??_FCWorkerThread@@QAEXXZ
??_FCWorkerThreadJob@@QAEXXZ
??_FCWorkerThreadJobQueue@@QAEXXZ
??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??_V@YAXPAX@Z
?Acquire@CLockEvent@@QAEXXZ
?Add@CContextList@@QAEEPAVCContext@@@Z
?Add@CFileExtension@@QAEEPBGK@Z
?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
?Add@CStrList@@QAEEPBG@Z
?AddNode@CLockList@@UAEEQAXE@Z
?AddNode@CNoLockList@@UAEEQAXE@Z
?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QAEXXZ
?CheckNode@CLockList@@UAEHQAX@Z
?CheckNode@CNoLockList@@UAEHQAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
?Cleanup@CBlobConfig@@AAEXXZ
?Cleanup@CModuleFileExtConfig@@IAEXXZ
?Cleanup@CModuleMultiStringConfig@@IAEXXZ
?Cleanup@CModuleStringConfig@@AAEXXZ
?Close@CFile@@QAEJXZ
?Count@CLockList@@QAEKXZ
?Count@CNoLockList@@QAEKXZ
?Create@CFile@@QAEJPBGKKKK@Z
?Create@CSystemThread@@QAEEXZ
?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
?CreatePool@CWorkerThreadPool@@QAEEXZ
?CreatePool@CWorkerThreadPoolEx@@QAEEXZ
?CreateThreads@CWorkerThreadPool@@QAEEK@Z
?CreateThreads@CWorkerThreadPoolEx@@QAEEK@Z
?CreateWIRP@CFile@@QAEJPBGKKKK@Z
?Delete@CFile@@QAEJXZ
?Delete@CFileExtension@@QAEEPBGK@Z
?Delete@CStrList@@QAEEPBG@Z
?DeleteAll@CList@@UAEXXZ
?DeleteAll@CLockList@@UAEXXZ
?DeleteAll@CNoLockList@@UAEXXZ
?DeleteNode@CContextList@@MAEXPAX@Z
?DeleteNode@CList@@UAEXPAX@Z
?DeleteNode@CModuleConfigList@@MAEXPAX@Z
?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YGXPAPAX@Z
?DoIt@CWorkerThreadJob@@QAEJXZ
?EntryPoint@CSystemThread@@KGXPAX@Z
?Find@CContextList@@QAEPAVCContext@@K@Z
?Find@CContextList@@QAEPAVCContext@@PAX@Z
?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FindNode@CContextList@@IAEPAXPAX@Z
?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FinishFunction@CUserFuncAdapterJob@@MAEXXZ
?FinishIt@CWorkerThreadJob@@QAEJXZ
?First@CList@@UAEPAXXZ
?First@CLockList@@UAEPAXXZ
?First@CNoLockList@@UAEPAXXZ
?Free@CMemoryAllocator@@UAEXPAX@Z
?Free@CMemoryPoolAllocator@@UAEXPAX@Z
?GetAttributes@CFile@@QAEKXZ
?GetBasicInfomration@CFile@@IAEJXZ
?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
?GetCategory@CContext@@QAEKXZ
?GetData@CBlobConfig@@QAEHPAXPAK@Z
?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QAEKXZ
?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
?GetData@CModuleStringConfig@@QAEPAGXZ
?GetData@CStrList@@QAEEPAGPAK@Z
?GetDataType@CModuleConfig@@QAEKXZ
?GetEngineContext@CContext@@QAEPAXXZ
?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFileSizeWIRP@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UAEJKPAK@Z
?GetID@CModuleConfig@@QAEKXZ
?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QAEKXZ
?GetLinkContext@CContext@@QAEPAXXZ
?GetLogFlag@CDebugLog@@QAEKXZ
?GetLogFlag@CDebugLogEx@@QAEKXZ
?GetModuleId@CModuleConfig@@QAEKXZ
?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_KTHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_KTHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QAEKXZ
?GetSize@CBlobConfig@@QAEKXZ
?GetStringConfig@CContext@@QAEPAGK@Z
?GetStringConfig@CContext@@UAEJKPAGPAK@Z
?GetThreadCount@CWorkerThreadPool@@QAEKXZ
?GetThreadCount@CWorkerThreadPoolEx@@QAEKXZ
?GetThreadID@CSystemThread@@QAEKXZ
?GetType@CContext@@QAEKXZ
?GetUserParameter@CContext@@QAEKXZ
?InitProcMon@CDebugLogEx@@IAEXXZ
?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
?InitializeFlagConfig@CContext@@QAEHKK@Z
?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
?InitializeStringConfig@CContext@@QAEHKPBG@Z
?Insert@CList@@UAEXQAXE@Z
?Insert@CLockList@@UAEXQAXE@Z
?Insert@CNoLockList@@UAEXQAXE@Z
?InsertAfter@CList@@UAEXPAX0@Z
?InsertBefore@CList@@UAEXPAX0@Z
?Instance@CWorkerThreadPool@@SGPAV1@XZ
?IsEmpty@CList@@UAEEXZ
?IsEmpty@CLockList@@UAEEXZ
?IsEmpty@CNoLockList@@UAEEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
?IsFull@CLockList@@QBEEXZ
?IsFull@CNoLockList@@QBEEXZ
?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionExtConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFileNameConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFilePathConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFolderConfig@@QAEEPBG@Z
?IsOpened@CFile@@QAEEXZ
?IsTerminated@CWorkerThreadPool@@QAEEXZ
?IsTerminated@CWorkerThreadPoolEx@@QAEEXZ
?IsValid@CMemoryAllocator@@UAEEXZ
?IsValid@CMemoryPoolAllocator@@UAEEXZ
?IsValid@IMemoryAllocator@@UAEEXZ
?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
?IsWorkerThread@CWorkerThreadPoolEx@@QAEEK@Z
?JobFunction@CUserFuncAdapterJob@@MAEXXZ
?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
?JobQueue@CWorkerThreadPoolEx@@QAEAAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QAEKXZ
?Limit@CNoLockList@@QAEKXZ
?MatchAllExtensions@CFileExtension@@QAEEXZ
?MatchNoExtensions@CFileExtension@@QAEEXZ
?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
?NeedDelete@CWorkerThreadJob@@QAEEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
?NewNode@CList@@UAEPAXXZ
?NewNode@CStrList@@EAEPAXXZ
?NewNodeVariant@CList@@IAEPAXK@Z
?Next@CList@@UBEPAXQAX@Z
?Next@CLockList@@UBEPAXQAX@Z
?Next@CNoLockList@@UBEPAXQAX@Z
?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
?NotityTerminate@CWorkerThread@@QAEXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
?PostJobToWorkerThread@CWorkerThreadPoolEx@@QAEJP6GXPAX@Z0E1@Z
?Pulse@CKEvent@@QAEJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPoolEx@@QAEJPAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
?Read@CFile@@QAEJPADKPAK@Z
?ReadWIRP@CFile@@QAEJPADKPAK@Z
?ReferenceCount@CContext@@QAEAAKXZ
?Release@CLockEvent@@QAEXXZ
?Remove@CContextList@@UAEEQAX@Z
?Remove@CList@@UAEEQAX@Z
?Remove@CLockList@@UAEEQAX@Z
?Remove@CNoLockList@@UAEEQAX@Z
?RemoveHead@CList@@UAEPAXXZ
?RemoveHead@CLockList@@UAEPAXXZ
?RemoveHead@CNoLockList@@UAEPAXXZ
?RemoveTail@CList@@UAEPAXXZ
?RemoveTail@CLockList@@UAEPAXXZ
?RemoveTail@CNoLockList@@UAEPAXXZ
?Reset@CKEvent@@QAEXXZ
?ResetData@CInclusionExtConfig@@QAEXXZ
?ResetData@CInclusionFileNameConfig@@QAEXXZ
?ResetData@CInclusionFilePathConfig@@QAEXXZ
?ResetData@CInclusionFolderConfig@@QAEXXZ
?RestoreCR0@@YGXPAX@Z
?Run@CAutoUpdateConfigThread@@UAEXXZ
?Run@CDelayLoadThread@@UAEXXZ
?Run@CWorkerThread@@UAEXXZ
?SeekToEnd@CFile@@QAEJXZ
?Set@CKEvent@@QAEJJE@Z
?SetAttributes@CFile@@QAEJK@Z
?SetBlobCofig@CContext@@UAEJKPAXK@Z
?SetData@CBlobConfig@@QAEHPAXK@Z
?SetData@CModuleFileExtConfig@@QAEHPBG@Z
?SetData@CModuleFlagConfig@@QAEHK@Z
?SetData@CModuleMultiStringConfig@@QAEHPBGK@Z
?SetData@CModuleStringConfig@@QAEHPBG@Z
?SetEngineContext@CContext@@QAEXPAX@Z
?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
?SetFlagConfig@CContext@@UAEJKK@Z
?SetLinkContext@CContext@@QAEXPAX@Z
?SetLogFlag@CDebugLog@@QAEEK@Z
?SetLogFlag@CDebugLogEx@@QAEEK@Z
?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
?SetMultiStringConfig@CContext@@UAEJKPBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
?SetPriority@CSystemThread@@QAEXK@Z
?SetStopUse@CContext@@QAEXXZ
?SetStringConfig@CContext@@UAEJKPBG@Z
?Setup@CSystemThread@@MAEXXZ
?StopUse@CContext@@QAEHXZ
?TearDown@CSystemThread@@MAEXXZ
?Terminate@CSystemThread@@QAEXE@Z
?Terminate@CWorkerThreadPool@@QAEEXZ
?Terminate@CWorkerThreadPoolEx@@QAEEXZ
?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QAEXXZ
?WaitForInit@CDelayLoadThread@@QAEEXZ
?WaitForLoad@CDelayLoadThread@@QAEEXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
?WaitQueueEmpty@CWorkerThreadJobQueue@@QAEXXZ
?Write@CDebugLog@@QAAXPBDZZ
?Write@CDebugLogEx@@QAAXPBDZZ
?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
?WriteDataToFile@CDebugLogEx@@IAEXPADK@Z
?WriteDataToProcMonW@CDebugLogEx@@IAEXPAD@Z
?WriteSystemInformation@CDebugLog@@QAEXXZ
?WriteSystemInformation@CDebugLogEx@@QAEXXZ
?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
?WriteSystemStringInformation@CDebugLogEx@@IAEXPBG@Z
?WriteToFile@CDebugLog@@IAEXPADK@Z
?WriteToProcMonW@CDebugLogEx@@IAEXPAU_UNICODE_STRING@@@Z
?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
?_pPagedAllocator@@3PAVCMemoryAllocator@@A
?m_lpInstance@CWorkerThreadPool@@1PAV1@A
?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
_DeInitKm2UmCommunication@0
_DeInitKmLPC@0
_DuplicateFullFileName@4
_FreeFullFileName@4
_GetKm2UmMode@0
_GetModuleInfoByAddress@8
_GetModuleInfoByModuleName@8
_InitKm2UmCommunication@8
_InitKmLPC@0
_KmCallUm@8
_KmCallUmByLPC@8
_KmCallUmEx@12
_KmCleanupCommPortAPIs@0
_KmGetUmInitProcess@0
_KmSetCommPortAPIs@4
_ModGetExportProcAddress@8
_ModLoadDLLToBuffer@4
_ModLoadDLLToBufferWithImageSize@8
_ModLoadModule@8
_ModUnLoadModule@4
_NormalizeFileName@4
_NormalizeFullNtPathToDosName@4
_TmCommConfigRoutine@4
_UtilAddDeviceInDriveTable@4
_UtilAddReparsePointMapping@8
_UtilCleanFileReadOnly@4
_UtilCreateDosFileName@8
_UtilDeleteFileForce@4
_UtilGetDeviceObjectName@8
_UtilGetFileNameFromFileObject@4
_UtilGetFileObjectForProcessByEPROC@8
_UtilGetFileObjectFromFileName@12
_UtilGetProcessName@12
_UtilGetSystemDirectory@4
_UtilGetSystemDirectoryEx@0
_UtilGetSystemDirectoryLength@0
_UtilGetSystemTime@4
_UtilIoSetFileInfo@24
_UtilIopCreateFileIRP@40
_UtilKeGetLowFileDevice@16
_UtilModuleIATHook@24
_UtilModuleIATUnHook@8
_UtilPostJobToWorkerThread@12
_UtilQueryKeyValue@24
_UtilRemoveDeviceFromDriveTable@4
_UtilVolumeDeviceToDosName@8
_UtilWaitValueChangeToZero@8
_UtilWriteVersionToRegistry@8
_UtilbuildDynamicDiskMappingTable@0
_UtlWriteBinValueKeyToRegistry@16
_ValidateAddressWithSize@20
__UtilDosPathNameToNtPathName@12

Sections

Expand

.text
.rdata
.data
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2016-08-12 00:50:21
MD5	df9953fa93e1793456a8d428ba7e5700
SHA1	8db4376a86bd2164513c178a578a0bf8d90e7292
SHA256	7837cb350338c4958968d06b105466da6518f5bb522a6e70e87c0cad85128408
Authentihash MD5	33de043781d74ef12f02411b9944186e
Authentihash SHA1	a405bb5d0ca4862f40a0f9eadce8ef068f421004
Authentihash SHA256	d74599ab8960f16e8026dcd564c5407956444c46c3dea6b38b1c243fbbbdc517
RichPEHeaderHash MD5	c060a624a43f3a4972ee081f9209e4d3
RichPEHeaderHash SHA1	e630bbef7195d2e1c16d683b8f18c182aef98dc7
RichPEHeaderHash SHA256	b574f3894ffb1b628c20191e085a4ada2a5f0eb04ea86a3a1ddc1d9fffd22f99
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	Trend Micro Eyes
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 1688f039255e638e69143907e6330b

Field	Value
ToBeSigned (TBS) MD5	0179e8ddeebaf8998fec419d65cdf13d
ToBeSigned (TBS) SHA1	34c724c3369f2da8c25b591808962f66f10bde28
ToBeSigned (TBS) SHA256	35b0bac11602847aaab65fb35199d3c8976cde3ccf7e061b130177c712cbd92f
Subject	C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO SHA,1 Time Stamping Signer
ValidFrom	2015-12-31 00:00:00
ValidTo	2019-07-09 18:40:36
Signature	ba332440408c7cdb589fb36098b2f5c031feeb1f6e50f60ae0e4e681ad2687a2dffdb3daf473f300fb291b891b153edb6b52932bc4ac3981d73c67579a3936e028089ae3394f9b89097f7bc5617f598932250a6aae1a3ef0a227a8b6c3b887f7160448413d5cd8ec9f4d203104d965a1edcd690753163ddd36020a88eb40e506300bb8164bdcefbc5509ffc63e122e76b3dcce42eff97657e1b70a054098589a5d711693718c6581ea6ff389f7fb73adb4e7bfd98e6faa0b4f25f3b8e1d5dd75986881f8aac0d180c2c4c43989c1f6c99e6cd774f9d997f84fc29a0acd5e8ff819e9e0a59fc4f09221e62d7925c922f9c3f03a8457ad3a16f46394101d5dd0c6
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	1688f039255e638e69143907e6330b
Version	3

Certificate 774d49c5649436de6bf3190a67eedcdf

Field	Value
ToBeSigned (TBS) MD5	b3ca7d6b821d8e3432b29874980af55e
ToBeSigned (TBS) SHA1	618d7e55a24c1d8b65a0bcce79120c5e3b13fa4d
ToBeSigned (TBS) SHA256	c645c6a7dc7243a4a3f78a6569c029401a7bda8bc4732ce7198d9f21f19b12fa
Subject	C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.
ValidFrom	2016-03-29 00:00:00
ValidTo	2017-06-28 23:59:59
Signature	27351697f046d1d43fe306dff30b83e7a404e3e6431c1e06829c558d99eb3f21776021e3e1bd4e485aba08b89bb0972f23daa471d7b432a44a591270f9a838f13dbda32ee936c0df792cff8c493e1f27b2282b3d896ae7b4155ca1a50bf7111f3f4bbbe11f17cfe5d49c0589c210966ef7e567153e802d2e783ff498c59585598d9d3e93273d1e81c07ce85c0cfb24834d448c3930120f1686bd472d916ac8f9475acfdb27be8528311f668d71dfc132a0ff62df7baa575a0cc732b3de003beca214954d4d97cf9511b9329eccbb7b716675b31e543a43570080dffce3fc8ca8fbb17d954b9678e2d0c1e1710a5cf03952a687fede59dcba3bf98900f9934f12
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	774d49c5649436de6bf3190a67eedcdf
Version	3

Certificate 611993e400000000001c

Field	Value
ToBeSigned (TBS) MD5	78a717e082dcc1cda3458d917e677d14
ToBeSigned (TBS) SHA1	4a872e0e51f9b304469cd1dedb496ee9b8b983a4
ToBeSigned (TBS) SHA256	317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
ValidFrom	2011-02-22 19:25:17
ValidTo	2021-02-22 19:35:17
Signature	812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	611993e400000000001c
Version	3

Certificate 5200e5aa2556fc1a86ed96c9d44b33c7

Field	Value
ToBeSigned (TBS) MD5	b30c31a572b0409383ed3fbe17e56e81
ToBeSigned (TBS) SHA1	4843a82ed3b1f2bfbee9671960e1940c942f688d
ToBeSigned (TBS) SHA256	03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-02-08 00:00:00
ValidTo	2020-02-07 23:59:59
Signature	5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	5200e5aa2556fc1a86ed96c9d44b33c7
Version	3

Imports

Expand

ntoskrnl.exe
HAL.dll
CLASSPNP.SYS

Imported Functions

Expand

wcsrchr
KeSetEvent
KePulseEvent
KeClearEvent
KeStackAttachProcess
KeUnstackDetachProcess
ObfDereferenceObject
ZwSetEvent
ZwClose
ZwConnectPort
RtlInitUnicodeString
RtlUnicodeStringToInteger
ZwCreateSection
ZwWaitForSingleObject
ZwOpenEvent
IoGetCurrentProcess
ObfReferenceObject
DbgBreakPoint
ZwRequestWaitReplyPort
ExFreePoolWithTag
ProbeForWrite
ZwFreeVirtualMemory
ZwAllocateVirtualMemory
ObOpenObjectByPointer
PsProcessType
memmove
PsGetProcessExitTime
MmSectionObjectType
PsThreadType
MmGetSystemRoutineAddress
ObReleaseObjectSecurity
SeReleaseSubjectContext
SeAccessCheck
SeCaptureSubjectContext
ObGetObjectSecurity
DbgPrint
memset
MmIsAddressValid
ExInitializeResourceLite
ExDeleteResourceLite
ZwWriteFile
ZwReadFile
ZwQueryInformationFile
ZwSetInformationFile
ZwCreateFile
swprintf
towupper
_wcsnicmp
ExAllocatePoolWithTag
KeInitializeEvent
_snprintf
PsGetCurrentProcessId
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
PsGetCurrentThreadId
RtlInitAnsiString
ZwDeviceIoControlFile
ZwCreateKey
ZwCreateEvent
KeWaitForMultipleObjects
ObReferenceObjectByHandle
ZwNotifyChangeKey
_vsnprintf
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlEqualUnicodeString
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
RtlUpcaseUnicodeChar
ExGetPreviousMode
KeWaitForSingleObject
KeSetPriorityThread
PsTerminateSystemThread
PsCreateSystemThread
KeDelayExecutionThread
KeNumberProcessors
ZwQueryInformationProcess
PsLookupProcessByProcessId
ZwOpenDirectoryObject
PsSetCreateProcessNotifyRoutine
ZwQuerySystemInformation
ZwQueryDirectoryFile
ZwQueryDirectoryObject
ZwDuplicateObject
ZwOpenKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryValueKey
ZwDeleteValueKey
ZwDeleteKey
ZwTerminateProcess
ZwOpenProcess
ZwQueryKey
ZwSetValueKey
IoFileObjectType
_allrem
memcpy
ZwSetSecurityObject
RtlLengthSecurityDescriptor
MmHighestUserAddress
IoFreeIrp
IoFreeMdl
_purecall
IoBuildAsynchronousFsdRequest
_strnicmp
RtlQueryRegistryValues
RtlAppendUnicodeToString
mbstowcs
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
NtClose
ObQueryNameString
ZwSetInformationObject
_stricmp
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwOpenFile
IoCreateFile
IofCallDriver
IoAllocateIrp
MmBuildMdlForNonPagedPool
IoAllocateMdl
ProbeForRead
PsGetVersion
RtlImageNtHeader
RtlCompareMemory
RtlUpcaseUnicodeString
_snwprintf
MmSystemRangeStart
wcsncmp
RtlCompareUnicodeString
strrchr
ZwQueryVolumeInformationFile
ObReferenceObjectByPointer
IoBuildDeviceIoControlRequest
ZwOpenSection
_allmul
KeReleaseSemaphore
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
KeInitializeSemaphore
IofCompleteRequest
ExEventObjectType
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoGetDeviceObjectPointer
RtlUpperChar
ObReferenceObjectByName
IoDriverObjectType
strncpy
KeServiceDescriptorTable
NtOpenProcess
ObOpenObjectByName
NtQueryInformationProcess
PsIsThreadTerminating
KeAddSystemServiceTable
ZwQueryObject
ZwFsControlFile
ObInsertObject
IoReleaseVpbSpinLock
IoAcquireVpbSpinLock
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
_allshr
ExInterlockedPopEntrySList
IoGetStackLimits
IoBuildSynchronousFsdRequest
wcsstr
IoUnregisterPlugPlayNotification
FsRtlIsNameInExpression
IoGetConfigurationInformation
MmProbeAndLockPages
IoGetDeviceInterfaces
IoRegisterPlugPlayNotification
ExAllocatePool
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
strncat
wcschr
wcsncat
wcstombs
KeTickCount
KeBugCheckEx
RtlUnwind
wcsncpy
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
ExAcquireResourceSharedLite
ExReleaseFastMutexUnsafe
KeLeaveCriticalRegion
KeEnterCriticalRegion
ZwQuerySecurityObject
ExAcquireFastMutexUnsafe
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
RtlLengthSid
RtlAbsoluteToSelfRelativeSD
MmUnlockPages
KeGetCurrentThread
KfAcquireSpinLock
KfReleaseSpinLock
KeRaiseIrqlToDpcLevel
KfLowerIrql
ExAcquireFastMutex
ExReleaseFastMutex
KeGetCurrentIrql
KfRaiseIrql
ClassInitialize

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
??0CBlobConfig@@QAE@ABV0@@Z
??0CBlobConfig@@QAE@K@Z
??0CContext@@QAE@ABV0@@Z
??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QAE@ABV0@@Z
??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
??0CDebugLog@@QAE@ABV0@@Z
??0CDebugLog@@QAE@PBG@Z
??0CDebugLogEx@@QAE@ABV0@@Z
??0CDebugLogEx@@QAE@K@Z
??0CDelayLoadThread@@QAE@ABV0@@Z
??0CDelayLoadThread@@QAE@XZ
??0CExclusionExtConfig@@QAE@ABV0@@Z
??0CExclusionExtConfig@@QAE@KKE@Z
??0CExclusionFileNameConfig@@QAE@ABV0@@Z
??0CExclusionFileNameConfig@@QAE@KK@Z
??0CExclusionFilePathConfig@@QAE@ABV0@@Z
??0CExclusionFilePathConfig@@QAE@KK@Z
??0CExclusionFolderConfig@@QAE@ABV0@@Z
??0CExclusionFolderConfig@@QAE@KK@Z
??0CExclusionRegistryConfig@@QAE@ABV0@@Z
??0CExclusionRegistryConfig@@QAE@KK@Z
??0CFile@@QAE@ABV0@@Z
??0CFile@@QAE@E@Z
??0CFileExtension@@QAE@ABV0@@Z
??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
??0CInclusionExtConfig@@QAE@ABV0@@Z
??0CInclusionExtConfig@@QAE@KKE@Z
??0CInclusionFileNameConfig@@QAE@ABV0@@Z
??0CInclusionFileNameConfig@@QAE@KK@Z
??0CInclusionFilePathConfig@@QAE@ABV0@@Z
??0CInclusionFilePathConfig@@QAE@KK@Z
??0CInclusionFolderConfig@@QAE@ABV0@@Z
??0CInclusionFolderConfig@@QAE@KK@Z
??0CKEvent@@QAE@ABV0@@Z
??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
??0CList@@QAE@ABV0@@Z
??0CList@@QAE@KPAVIMemoryAllocator@@@Z
??0CLockEvent@@QAE@ABV0@@Z
??0CLockEvent@@QAE@XZ
??0CLockList@@QAE@ABV0@@Z
??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QAE@ABV0@@Z
??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
??0CMemoryPoolAllocator@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@XZ
??0CModuleConfigList@@QAE@ABV0@@Z
??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QAE@ABV0@@Z
??0CModuleFileExtConfig@@QAE@KKE@Z
??0CModuleFlagConfig@@QAE@ABV0@@Z
??0CModuleFlagConfig@@QAE@K@Z
??0CModuleMultiStringConfig@@QAE@ABV0@@Z
??0CModuleMultiStringConfig@@QAE@KK@Z
??0CModuleStringConfig@@QAE@ABV0@@Z
??0CModuleStringConfig@@QAE@K@Z
??0CNoLockList@@QAE@ABV0@@Z
??0CNoLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CSmartLock@@QAE@AAVCLockEvent@@@Z
??0CSmartLock@@QAE@XZ
??0CSmartReference@@QAE@AAJ@Z
??0CSmartReference@@QAE@AAK@Z
??0CSmartResource@@QAE@AAVCResource@@E@Z
??0CStrList@@QAE@ABV0@@Z
??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
??0CSystemThread@@QAE@ABV0@@Z
??0CSystemThread@@QAE@K@Z
??0CUserFuncAdapterJob@@QAE@ABV0@@Z
??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z01@Z
??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@E@Z
??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
??0CWorkerThreadJobQueue@@QAE@K@Z
??0CWorkerThreadPool@@QAE@ABV0@@Z
??0CWorkerThreadPool@@QAE@K@Z
??0CWorkerThreadPoolEx@@QAE@ABV0@@Z
??0CWorkerThreadPoolEx@@QAE@KK@Z
??0IMemoryAllocator@@QAE@ABV0@@Z
??0IMemoryAllocator@@QAE@XZ
??1CAutoUpdateConfigThread@@UAE@XZ
??1CBlobConfig@@UAE@XZ
??1CContext@@UAE@XZ
??1CContextList@@UAE@XZ
??1CDebugLog@@UAE@XZ
??1CDebugLogEx@@UAE@XZ
??1CDelayLoadThread@@UAE@XZ
??1CExclusionExtConfig@@UAE@XZ
??1CExclusionFileNameConfig@@UAE@XZ
??1CExclusionFilePathConfig@@UAE@XZ
??1CExclusionFolderConfig@@UAE@XZ
??1CExclusionRegistryConfig@@UAE@XZ
??1CFile@@UAE@XZ
??1CFileExtension@@UAE@XZ
??1CInclusionExtConfig@@UAE@XZ
??1CInclusionFileNameConfig@@UAE@XZ
??1CInclusionFilePathConfig@@UAE@XZ
??1CInclusionFolderConfig@@UAE@XZ
??1CKEvent@@UAE@XZ
??1CList@@UAE@XZ
??1CLockEvent@@UAE@XZ
??1CLockList@@UAE@XZ
??1CMemoryAllocator@@UAE@XZ
??1CMemoryPoolAllocator@@UAE@XZ
??1CModuleConfig@@UAE@XZ
??1CModuleConfigList@@UAE@XZ
??1CModuleFileExtConfig@@UAE@XZ
??1CModuleFlagConfig@@UAE@XZ
??1CModuleMultiStringConfig@@UAE@XZ
??1CModuleStringConfig@@UAE@XZ
??1CNoLockList@@UAE@XZ
??1CSmartLock@@QAE@XZ
??1CSmartReference@@QAE@XZ
??1CSmartResource@@QAE@XZ
??1CStrList@@UAE@XZ
??1CSystemThread@@UAE@XZ
??1CUserFuncAdapterJob@@UAE@XZ
??1CWorkerThread@@UAE@XZ
??1CWorkerThreadJob@@UAE@XZ
??1CWorkerThreadJobQueue@@UAE@XZ
??1CWorkerThreadPool@@UAE@XZ
??1CWorkerThreadPoolEx@@UAE@XZ
??1IMemoryAllocator@@UAE@XZ
??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??2CMemoryAllocator@@SGPAXI@Z
??2CMemoryPoolAllocator@@SGPAXI@Z
??3@YAXPAX@Z
??3IMemoryAllocator@@SGXPAX@Z
??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
??4CBlobConfig@@QAEAAV0@ABV0@@Z
??4CContext@@QAEAAV0@ABV0@@Z
??4CDebugLog@@QAEAAV0@ABV0@@Z
??4CDebugLogEx@@QAEAAV0@ABV0@@Z
??4CDelayLoadThread@@QAEAAV0@ABV0@@Z
??4CFile@@QAEAAV0@ABV0@@Z
??4CKEvent@@QAEAAV0@ABV0@@Z
??4CLockEvent@@QAEAAV0@ABV0@@Z
??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
??4CModuleConfig@@QAEAAV0@ABV0@@Z
??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
??4CSmartResource@@QAEAAV0@ABV0@@Z
??4CSystemThread@@QAEAAV0@ABV0@@Z
??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
??4CWorkerThread@@QAEAAV0@ABV0@@Z
??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CDebugLogEx@@6B@
??_7CDelayLoadThread@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CInclusionExtConfig@@6B@
??_7CInclusionFileNameConfig@@6B@
??_7CInclusionFilePathConfig@@6B@
??_7CInclusionFolderConfig@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CNoLockList@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7CWorkerThreadPoolEx@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QAEXXZ
??_FCFile@@QAEXXZ
??_FCFileExtension@@QAEXXZ
??_FCModuleConfigList@@QAEXXZ
??_FCStrList@@QAEXXZ
??_FCSystemThread@@QAEXXZ
??_FCWorkerThread@@QAEXXZ
??_FCWorkerThreadJob@@QAEXXZ
??_FCWorkerThreadJobQueue@@QAEXXZ
??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??_V@YAXPAX@Z
?Acquire@CLockEvent@@QAEXXZ
?Add@CContextList@@QAEEPAVCContext@@@Z
?Add@CFileExtension@@QAEEPBGK@Z
?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
?Add@CStrList@@QAEEPBG@Z
?AddNode@CLockList@@UAEEQAXE@Z
?AddNode@CNoLockList@@UAEEQAXE@Z
?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QAEXXZ
?CheckNode@CLockList@@UAEHQAX@Z
?CheckNode@CNoLockList@@UAEHQAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
?Cleanup@CBlobConfig@@AAEXXZ
?Cleanup@CModuleFileExtConfig@@IAEXXZ
?Cleanup@CModuleMultiStringConfig@@IAEXXZ
?Cleanup@CModuleStringConfig@@AAEXXZ
?Close@CFile@@QAEJXZ
?Count@CLockList@@QAEKXZ
?Count@CNoLockList@@QAEKXZ
?Create@CFile@@QAEJPBGKKKK@Z
?Create@CSystemThread@@QAEEXZ
?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
?CreatePool@CWorkerThreadPool@@QAEEXZ
?CreatePool@CWorkerThreadPoolEx@@QAEEXZ
?CreateThreads@CWorkerThreadPool@@QAEEK@Z
?CreateThreads@CWorkerThreadPoolEx@@QAEEK@Z
?CreateWIRP@CFile@@QAEJPBGKKKK@Z
?Delete@CFile@@QAEJXZ
?Delete@CFileExtension@@QAEEPBGK@Z
?Delete@CStrList@@QAEEPBG@Z
?DeleteAll@CList@@UAEXXZ
?DeleteAll@CLockList@@UAEXXZ
?DeleteAll@CNoLockList@@UAEXXZ
?DeleteNode@CContextList@@MAEXPAX@Z
?DeleteNode@CList@@UAEXPAX@Z
?DeleteNode@CModuleConfigList@@MAEXPAX@Z
?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YGXPAPAX@Z
?DoIt@CWorkerThreadJob@@QAEJXZ
?EntryPoint@CSystemThread@@KGXPAX@Z
?Find@CContextList@@QAEPAVCContext@@K@Z
?Find@CContextList@@QAEPAVCContext@@PAX@Z
?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FindNode@CContextList@@IAEPAXPAX@Z
?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FinishFunction@CUserFuncAdapterJob@@MAEXXZ
?FinishIt@CWorkerThreadJob@@QAEJXZ
?First@CList@@UAEPAXXZ
?First@CLockList@@UAEPAXXZ
?First@CNoLockList@@UAEPAXXZ
?Free@CMemoryAllocator@@UAEXPAX@Z
?Free@CMemoryPoolAllocator@@UAEXPAX@Z
?GetAttributes@CFile@@QAEKXZ
?GetBasicInfomration@CFile@@IAEJXZ
?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
?GetCategory@CContext@@QAEKXZ
?GetData@CBlobConfig@@QAEHPAXPAK@Z
?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QAEKXZ
?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
?GetData@CModuleStringConfig@@QAEPAGXZ
?GetData@CStrList@@QAEEPAGPAK@Z
?GetDataType@CModuleConfig@@QAEKXZ
?GetEngineContext@CContext@@QAEPAXXZ
?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFileSizeWIRP@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UAEJKPAK@Z
?GetID@CModuleConfig@@QAEKXZ
?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QAEKXZ
?GetLinkContext@CContext@@QAEPAXXZ
?GetLogFlag@CDebugLog@@QAEKXZ
?GetLogFlag@CDebugLogEx@@QAEKXZ
?GetModuleId@CModuleConfig@@QAEKXZ
?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_KTHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_KTHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QAEKXZ
?GetSize@CBlobConfig@@QAEKXZ
?GetStringConfig@CContext@@QAEPAGK@Z
?GetStringConfig@CContext@@UAEJKPAGPAK@Z
?GetThreadCount@CWorkerThreadPool@@QAEKXZ
?GetThreadCount@CWorkerThreadPoolEx@@QAEKXZ
?GetThreadID@CSystemThread@@QAEKXZ
?GetType@CContext@@QAEKXZ
?GetUserParameter@CContext@@QAEKXZ
?InitProcMon@CDebugLogEx@@IAEXXZ
?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
?InitializeFlagConfig@CContext@@QAEHKK@Z
?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
?InitializeStringConfig@CContext@@QAEHKPBG@Z
?Insert@CList@@UAEXQAXE@Z
?Insert@CLockList@@UAEXQAXE@Z
?Insert@CNoLockList@@UAEXQAXE@Z
?InsertAfter@CList@@UAEXPAX0@Z
?InsertBefore@CList@@UAEXPAX0@Z
?Instance@CWorkerThreadPool@@SGPAV1@XZ
?IsEmpty@CList@@UAEEXZ
?IsEmpty@CLockList@@UAEEXZ
?IsEmpty@CNoLockList@@UAEEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
?IsFull@CLockList@@QBEEXZ
?IsFull@CNoLockList@@QBEEXZ
?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionExtConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFileNameConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFilePathConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFolderConfig@@QAEEPBG@Z
?IsOpened@CFile@@QAEEXZ
?IsTerminated@CWorkerThreadPool@@QAEEXZ
?IsTerminated@CWorkerThreadPoolEx@@QAEEXZ
?IsValid@CMemoryAllocator@@UAEEXZ
?IsValid@CMemoryPoolAllocator@@UAEEXZ
?IsValid@IMemoryAllocator@@UAEEXZ
?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
?IsWorkerThread@CWorkerThreadPoolEx@@QAEEK@Z
?JobFunction@CUserFuncAdapterJob@@MAEXXZ
?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
?JobQueue@CWorkerThreadPoolEx@@QAEAAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QAEKXZ
?Limit@CNoLockList@@QAEKXZ
?MatchAllExtensions@CFileExtension@@QAEEXZ
?MatchNoExtensions@CFileExtension@@QAEEXZ
?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
?NeedDelete@CWorkerThreadJob@@QAEEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
?NewNode@CList@@UAEPAXXZ
?NewNode@CStrList@@EAEPAXXZ
?NewNodeVariant@CList@@IAEPAXK@Z
?Next@CList@@UBEPAXQAX@Z
?Next@CLockList@@UBEPAXQAX@Z
?Next@CNoLockList@@UBEPAXQAX@Z
?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
?NotityTerminate@CWorkerThread@@QAEXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
?PostJobToWorkerThread@CWorkerThreadPoolEx@@QAEJP6GXPAX@Z0E1@Z
?Pulse@CKEvent@@QAEJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPoolEx@@QAEJPAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
?Read@CFile@@QAEJPADKPAK@Z
?ReadWIRP@CFile@@QAEJPADKPAK@Z
?ReferenceCount@CContext@@QAEAAKXZ
?Release@CLockEvent@@QAEXXZ
?Remove@CContextList@@UAEEQAX@Z
?Remove@CList@@UAEEQAX@Z
?Remove@CLockList@@UAEEQAX@Z
?Remove@CNoLockList@@UAEEQAX@Z
?RemoveHead@CList@@UAEPAXXZ
?RemoveHead@CLockList@@UAEPAXXZ
?RemoveHead@CNoLockList@@UAEPAXXZ
?RemoveTail@CList@@UAEPAXXZ
?RemoveTail@CLockList@@UAEPAXXZ
?RemoveTail@CNoLockList@@UAEPAXXZ
?Reset@CKEvent@@QAEXXZ
?ResetData@CInclusionExtConfig@@QAEXXZ
?ResetData@CInclusionFileNameConfig@@QAEXXZ
?ResetData@CInclusionFilePathConfig@@QAEXXZ
?ResetData@CInclusionFolderConfig@@QAEXXZ
?RestoreCR0@@YGXPAX@Z
?Run@CAutoUpdateConfigThread@@UAEXXZ
?Run@CDelayLoadThread@@UAEXXZ
?Run@CWorkerThread@@UAEXXZ
?SeekToEnd@CFile@@QAEJXZ
?Set@CKEvent@@QAEJJE@Z
?SetAttributes@CFile@@QAEJK@Z
?SetBlobCofig@CContext@@UAEJKPAXK@Z
?SetData@CBlobConfig@@QAEHPAXK@Z
?SetData@CModuleFileExtConfig@@QAEHPBG@Z
?SetData@CModuleFlagConfig@@QAEHK@Z
?SetData@CModuleMultiStringConfig@@QAEHPBGK@Z
?SetData@CModuleStringConfig@@QAEHPBG@Z
?SetEngineContext@CContext@@QAEXPAX@Z
?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
?SetFlagConfig@CContext@@UAEJKK@Z
?SetLinkContext@CContext@@QAEXPAX@Z
?SetLogFlag@CDebugLog@@QAEEK@Z
?SetLogFlag@CDebugLogEx@@QAEEK@Z
?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
?SetMultiStringConfig@CContext@@UAEJKPBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
?SetPriority@CSystemThread@@QAEXK@Z
?SetStopUse@CContext@@QAEXXZ
?SetStringConfig@CContext@@UAEJKPBG@Z
?Setup@CSystemThread@@MAEXXZ
?StopUse@CContext@@QAEHXZ
?TearDown@CSystemThread@@MAEXXZ
?Terminate@CSystemThread@@QAEXE@Z
?Terminate@CWorkerThreadPool@@QAEEXZ
?Terminate@CWorkerThreadPoolEx@@QAEEXZ
?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QAEXXZ
?WaitForInit@CDelayLoadThread@@QAEEXZ
?WaitForLoad@CDelayLoadThread@@QAEEXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
?WaitQueueEmpty@CWorkerThreadJobQueue@@QAEXXZ
?Write@CDebugLog@@QAAXPBDZZ
?Write@CDebugLogEx@@QAAXPBDZZ
?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
?WriteDataToFile@CDebugLogEx@@IAEXPADK@Z
?WriteDataToProcMonW@CDebugLogEx@@IAEXPAD@Z
?WriteSystemInformation@CDebugLog@@QAEXXZ
?WriteSystemInformation@CDebugLogEx@@QAEXXZ
?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
?WriteSystemStringInformation@CDebugLogEx@@IAEXPBG@Z
?WriteToFile@CDebugLog@@IAEXPADK@Z
?WriteToProcMonW@CDebugLogEx@@IAEXPAU_UNICODE_STRING@@@Z
?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
?_pPagedAllocator@@3PAVCMemoryAllocator@@A
?m_lpInstance@CWorkerThreadPool@@1PAV1@A
?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
_DeInitKm2UmCommunication@0
_DeInitKmLPC@0
_DuplicateFullFileName@4
_FreeFullFileName@4
_GetKm2UmMode@0
_GetModuleInfoByAddress@8
_GetModuleInfoByModuleName@8
_InitKm2UmCommunication@8
_InitKmLPC@0
_IsVerifierCodeCheckFlagOn@0
_IsWindows8_1_update@4
_KmCallUm@8
_KmCallUmByLPC@8
_KmCallUmEx@12
_KmCleanupCommPortAPIs@0
_KmGetUmInitProcess@0
_KmSetCommPortAPIs@4
_ModGetExportProcAddress@8
_ModLoadDLLToBuffer@4
_ModLoadDLLToBufferWithImageSize@8
_ModLoadModule@8
_ModUnLoadModule@4
_NormalizeFileName@4
_NormalizeFullNtPathToDosName@4
_TmCommConfigRoutine@4
_UtilAddDeviceInDriveTable@4
_UtilAddReparsePointMapping@8
_UtilCleanFileReadOnly@4
_UtilCloseExclusiveHandle@12
_UtilCreateDosFileName@8
_UtilDeleteFileForce@4
_UtilGetDeviceObjectName@8
_UtilGetFileNameFromFileObject@4
_UtilGetFileObjectForProcessByEPROC@8
_UtilGetFileObjectFromFileName@12
_UtilGetProcessName@12
_UtilGetSystemDirectory@4
_UtilGetSystemDirectoryEx@0
_UtilGetSystemDirectoryLength@0
_UtilGetSystemTime@4
_UtilIoSetFileInfo@24
_UtilIopCreateFileIRP@40
_UtilKeGetLowFileDevice@16
_UtilModuleIATHook@24
_UtilModuleIATUnHook@8
_UtilPostJobToWorkerThread@12
_UtilQueryExclusiveHandle@12
_UtilQueryKeyValue@24
_UtilRemoveDeviceFromDriveTable@4
_UtilVolumeDeviceToDosName@8
_UtilWaitValueChangeToZero@8
_UtilWriteVersionToRegistry@8
_UtilbuildDynamicDiskMappingTable@0
_UtlWriteBinValueKeyToRegistry@16
_ValidateAddressWithSize@20
__ResetProtectFromClose@4
__UtilDosPathNameToNtPathName@12

Sections

Expand

.text
.rdata
.data
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2020-08-25 02:07:39
MD5	58a92520dda53166e322118ee0503364
SHA1	d2be76e79741454b4611675b58446e10fc3d0c6c
SHA256	7c731c0ea7f28671ab7787800db69739ea5cd6be16ea21045b4580cf95cbf73b
Authentihash MD5	7311c7bcd55dd7a769f43b480c1978d8
Authentihash SHA1	390bd5d395784a675a3b62929407a4f83e0bcc87
Authentihash SHA256	2175f4289f3bae19b058e5a4f590c200bede255cd2716dfb054d5e0840f70359
RichPEHeaderHash MD5	8ae6b3a63d3444e617eba17c3a93979e
RichPEHeaderHash SHA1	3cc95db9109125c87a3cb737bbe371034d9c3ade
RichPEHeaderHash SHA256	118d8d8e4d2d1ce80640e7b28300dd41389daf9bdbdc6ad2e9fefcde4aab7ad2
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	Trend Micro Eyes
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 61204db4000000000027

Field	Value
ToBeSigned (TBS) MD5	8e3ffc222fbcebdbb8b23115ab259be7
ToBeSigned (TBS) SHA1	ee20bff28ffe13be731c294c90d6ded5aae0ec0e
ToBeSigned (TBS) SHA256	59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821
Subject	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
ValidFrom	2011-04-15 19:45:33
ValidTo	2021-04-15 19:55:33
Signature	208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	61204db4000000000027
Version	3

Certificate 0f6146af9397c7fa04b13c2d0279a1ba

Field	Value
ToBeSigned (TBS) MD5	df4ab4b67a0e9b1f9ec4a1ad9ea6052a
ToBeSigned (TBS) SHA1	dc1d0c4be3072afed8b0739a21b87b14292815e0
ToBeSigned (TBS) SHA256	9c8450b3fa641a421a545e7e4fa7e1bcb657db4796bef147312c44b7a1b5ffe0
Subject	??=TW, ??=Private Organization, serialNumber=23310837, C=TW, ST=Taipei City, L=Daan District, O=Trend Micro, Inc., CN=Trend Micro, Inc.
ValidFrom	2020-08-07 00:00:00
ValidTo	2021-04-15 12:00:00
Signature	578aa329d98f23e576b6937a3146ca65f1ec8da04b5ec5f4c499436cfe710be5660f7c864950d9276a6dfdd2341048e6fe4f51044e7fce164f3b9203035bc3d311991685fbce0d90a4c7b2b511d0d3ba37b3558eae76db3ab30f4a2ef102faad1820e26b5fcbc216b368980655de80fe7177f9f1a80c75e4a0a21451a59c86986e5348318da4d295e8d02520fa674ce89756903b25521b5ad358f8328c5591a9702494cc24e340418dbcf08ef06214a8e90c4836dc6f8465fd59385bd56407d83bfc8a633e8125c523ff23dd8c669169848668d5aefe059ee5091e1776ec4686efd0d6ccee0e0bea5922ee41fb36e63d5704633f85115f9584926bdb708a9edb
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	0f6146af9397c7fa04b13c2d0279a1ba
Version	3

Certificate 03019a023aff58b16bd6d5eae617f066

Field	Value
ToBeSigned (TBS) MD5	a752afee44f017e8d74e3f3eb7914ae3
ToBeSigned (TBS) SHA1	8eca80a6b80e9c69dcef7745748524afb8019e2d
ToBeSigned (TBS) SHA256	82560fa7efec30b5ff82af643e6f3bf3d46868bbd5e7d76f93db185e9e3553a1
Subject	C=US, O=DigiCert, CN=DigiCert Timestamp Responder
ValidFrom	2014-10-22 00:00:00
ValidTo	2024-10-22 00:00:00
Signature	9d257e1b334db226815c9b86ce23200f8087e588ffffb1d46a2c31ed3a17197117cda91bbc5a1639009de36c84e45a40fbde06018c37fa9bb19d247efe20a457ad5bb79ab06026ea6957215d342f1f71b0839419056b359010a07b97c7f63fe7e21141a6bd62d9f0273d381d286f3a5209f0ec7062d3624bb0e073a692c0d38e31d82fe36d171306eee403b614abf38f43a7719d21dd14ca155d9241daf90f81d199740d26c40e7f1bb5f5a0f1c677062815e9d893e55516f0bb0aab1cdb5c482766c8a38b0a1ce595daaec42e59a061dddaf36da261e98a0b6dec1218bdf755544003922b6bc251c20a48afb0d46ee0f4140a3a1be38f3dcaaf6a8d7bdcd844
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	03019a023aff58b16bd6d5eae617f066
Version	3

Certificate 0dd0e3374ac95bdbfa6b434b2a48ec06

Field	Value
ToBeSigned (TBS) MD5	f92649915476229b093c211c2b18e6c4
ToBeSigned (TBS) SHA1	2d54c16a8f8b69ccdea48d0603c132f547a5cf75
ToBeSigned (TBS) SHA256	2cd702a7dec30aa441345672e8992ef9770ce4946f276d767b45b0ed627658fb
Subject	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA
ValidFrom	2012-04-18 12:00:00
ValidTo	2027-04-18 12:00:00
Signature	9e5b963a2e1288acab016da49f75e40187a3a532d7bcbaa97ea3d61417f7c2136b7c738f2b6ae50f265968b08e259b6ceffa6c939208c14dcf459e9c46d61e74a19b14a3fa012f4ab101e1724048111368b9369d914bd7c2391210c1c4dcbb6214142a615d4f387c661fc61bffadbe4f7f945b7343000f4d73b751cf0ef677c05bcd348cd96313aa0e6111d6f28e27fcb47bb8b91120918678ea0ed428ff2ad52438e837b2ec96bb9fbc4a1650e15ebf517d23a032c7c1949e7ac9c026a2cc2587a0127e749f2d8db1c8e784beb9d1e9debb6a4e887371e12238cb2487e9737e51b2ff98eb4e7e2fe0ca0efab35ed1ba0542a8489f83f63fc4caa8df68a05061
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	0dd0e3374ac95bdbfa6b434b2a48ec06
Version	3

Certificate 06fdf9039603adea000aeb3f27bbba1b

Field	Value
ToBeSigned (TBS) MD5	4e5ad189638cf52ba9cd881d4d44668c
ToBeSigned (TBS) SHA1	cdc115e98d798b33904c820d63cc1e1afc19251d
ToBeSigned (TBS) SHA256	37560fb9d548ab62cc3ed4669a4ab74828b5a108e67e829937ffb2d10a5f78dd
Subject	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID CA,1
ValidFrom	2006-11-10 00:00:00
ValidTo	2021-11-10 00:00:00
Signature	46503ec9b72824a7381db65b29af52cf52e93147ab565c7bd50d0b41b3efec751f7438f2b25c61a29c95c350e482b923d1ba3a8672ad3878ac755d1717347247859456d1ebbb368477cc24a5f3041955a9e7e3e7ab62cdfb8b2d90c2c0d2b594bd5e4fb105d20e3d1aa9145ba6863162a8a833e49b39a7c4f5ce1d7876942573e42aabcf9c764bed5fc24b16e44b704c00891efcc579bc4c1257fe5fe11ebc025da8fefb07384f0dc65d91b90f6745cdd683ede7920d8db1698c4ffb59e0230fd2aaae007cee9c420ecf91d727b716ee0fc3bd7c0aa0ee2c08558522b8eb181a4dfc2a21ad49318347957771dcb11b4b4b1c109c7714c19d4f2f5a9508291026
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	06fdf9039603adea000aeb3f27bbba1b
Version	3

Imports

Expand

ntoskrnl.exe
HAL.dll
CLASSPNP.SYS

Imported Functions

Expand

KePulseEvent
KeClearEvent
KeStackAttachProcess
KeUnstackDetachProcess
ObfDereferenceObject
ZwSetEvent
ZwClose
ZwConnectPort
RtlInitUnicodeString
RtlUnicodeStringToInteger
ZwCreateSection
ZwWaitForSingleObject
ZwOpenEvent
IoGetCurrentProcess
ObfReferenceObject
DbgBreakPoint
ZwRequestWaitReplyPort
ExFreePoolWithTag
ProbeForWrite
ZwFreeVirtualMemory
ZwAllocateVirtualMemory
ObOpenObjectByPointer
PsProcessType
memmove
PsGetProcessExitTime
MmSectionObjectType
PsThreadType
ObReleaseObjectSecurity
SeReleaseSubjectContext
SeAccessCheck
SeCaptureSubjectContext
ObGetObjectSecurity
DbgPrint
memset
MmIsAddressValid
ExInitializeResourceLite
ExDeleteResourceLite
ZwWriteFile
ZwReadFile
ZwQueryInformationFile
ZwSetInformationFile
ZwCreateFile
swprintf
towupper
_wcsnicmp
ExAllocatePoolWithTag
KeInitializeEvent
_snprintf
PsGetCurrentProcessId
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
PsGetCurrentThreadId
RtlInitAnsiString
ZwDeviceIoControlFile
ZwCreateKey
ZwCreateEvent
KeWaitForMultipleObjects
ObReferenceObjectByHandle
ZwNotifyChangeKey
_vsnprintf
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlEqualUnicodeString
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
RtlUpcaseUnicodeChar
RtlPrefixUnicodeString
ExGetPreviousMode
KeWaitForSingleObject
KeSetPriorityThread
PsTerminateSystemThread
PsCreateSystemThread
KeDelayExecutionThread
KeNumberProcessors
ZwQueryInformationProcess
PsLookupProcessByProcessId
ZwOpenDirectoryObject
PsSetCreateProcessNotifyRoutine
ZwQuerySystemInformation
ZwQueryDirectoryFile
ZwQueryDirectoryObject
ZwOpenKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryValueKey
ZwDeleteValueKey
ZwDeleteKey
ZwTerminateProcess
ZwOpenProcess
ZwQueryKey
ZwSetValueKey
IoFileObjectType
KeSetEvent
ZwQuerySecurityObject
ZwSetSecurityObject
RtlLengthSecurityDescriptor
MmHighestUserAddress
IoFreeIrp
_purecall
MmUnlockPages
IoBuildAsynchronousFsdRequest
_strnicmp
RtlQueryRegistryValues
RtlAppendUnicodeToString
mbstowcs
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
NtClose
ObQueryNameString
MmGetSystemRoutineAddress
ZwSetInformationObject
_stricmp
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwOpenFile
IoCreateFile
IofCallDriver
IoAllocateIrp
MmBuildMdlForNonPagedPool
IoAllocateMdl
ProbeForRead
PsGetVersion
RtlImageNtHeader
RtlCompareMemory
RtlUpcaseUnicodeString
_snwprintf
MmSystemRangeStart
wcsncmp
strrchr
ZwQueryVolumeInformationFile
ObReferenceObjectByPointer
IoBuildDeviceIoControlRequest
ZwOpenSection
_allmul
KeReleaseSemaphore
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
KeInitializeSemaphore
IoGetDeviceObjectPointer
IofCompleteRequest
ExEventObjectType
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
RtlUpperChar
ObReferenceObjectByName
IoDriverObjectType
RtlCompareUnicodeString
strncpy
KeServiceDescriptorTable
NtOpenProcess
ObOpenObjectByName
NtQueryInformationProcess
PsIsThreadTerminating
KeAddSystemServiceTable
ZwFsControlFile
ObInsertObject
IoReleaseVpbSpinLock
IoAcquireVpbSpinLock
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
_allshr
ExInterlockedPopEntrySList
IoGetStackLimits
IoBuildSynchronousFsdRequest
wcsstr
IoUnregisterPlugPlayNotification
FsRtlIsNameInExpression
IoGetConfigurationInformation
MmProbeAndLockPages
IoGetDeviceInterfaces
IoRegisterPlugPlayNotification
ExAllocatePool
wcschr
KeTickCount
KeBugCheckEx
RtlUnwind
wcsrchr
memcpy
wcsncpy
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
ExAcquireResourceSharedLite
ExReleaseFastMutexUnsafe
KeLeaveCriticalRegion
KeEnterCriticalRegion
_allrem
ExAcquireFastMutexUnsafe
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
RtlLengthSid
RtlAbsoluteToSelfRelativeSD
IoFreeMdl
KeGetCurrentThread
KfAcquireSpinLock
KfReleaseSpinLock
KeRaiseIrqlToDpcLevel
KfLowerIrql
KeAcquireQueuedSpinLock
KeReleaseQueuedSpinLock
ExAcquireFastMutex
ExReleaseFastMutex
KeGetCurrentIrql
KfRaiseIrql
ClassInitialize

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
??0CBlobConfig@@QAE@ABV0@@Z
??0CBlobConfig@@QAE@K@Z
??0CContext@@QAE@ABV0@@Z
??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QAE@ABV0@@Z
??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
??0CDebugLog@@QAE@ABV0@@Z
??0CDebugLog@@QAE@PBG@Z
??0CDebugLogEx@@QAE@ABV0@@Z
??0CDebugLogEx@@QAE@K@Z
??0CDelayLoadThread@@QAE@ABV0@@Z
??0CDelayLoadThread@@QAE@XZ
??0CExclusionExtConfig@@QAE@ABV0@@Z
??0CExclusionExtConfig@@QAE@KKE@Z
??0CExclusionFileNameConfig@@QAE@ABV0@@Z
??0CExclusionFileNameConfig@@QAE@KK@Z
??0CExclusionFilePathConfig@@QAE@ABV0@@Z
??0CExclusionFilePathConfig@@QAE@KK@Z
??0CExclusionFolderConfig@@QAE@ABV0@@Z
??0CExclusionFolderConfig@@QAE@KK@Z
??0CExclusionRegistryConfig@@QAE@ABV0@@Z
??0CExclusionRegistryConfig@@QAE@KK@Z
??0CFile@@QAE@ABV0@@Z
??0CFile@@QAE@E@Z
??0CFileExtension@@QAE@ABV0@@Z
??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
??0CInclusionExtConfig@@QAE@ABV0@@Z
??0CInclusionExtConfig@@QAE@KKE@Z
??0CInclusionFileNameConfig@@QAE@ABV0@@Z
??0CInclusionFileNameConfig@@QAE@KK@Z
??0CInclusionFilePathConfig@@QAE@ABV0@@Z
??0CInclusionFilePathConfig@@QAE@KK@Z
??0CInclusionFolderConfig@@QAE@ABV0@@Z
??0CInclusionFolderConfig@@QAE@KK@Z
??0CKEvent@@QAE@ABV0@@Z
??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
??0CList@@QAE@ABV0@@Z
??0CList@@QAE@KPAVIMemoryAllocator@@@Z
??0CLockEvent@@QAE@ABV0@@Z
??0CLockEvent@@QAE@XZ
??0CLockList@@QAE@ABV0@@Z
??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QAE@ABV0@@Z
??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
??0CMemoryPoolAllocator@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@XZ
??0CModuleConfigList@@QAE@ABV0@@Z
??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QAE@ABV0@@Z
??0CModuleFileExtConfig@@QAE@KKE@Z
??0CModuleFlagConfig@@QAE@ABV0@@Z
??0CModuleFlagConfig@@QAE@K@Z
??0CModuleMultiStringConfig@@QAE@ABV0@@Z
??0CModuleMultiStringConfig@@QAE@KK@Z
??0CModuleStringConfig@@QAE@ABV0@@Z
??0CModuleStringConfig@@QAE@K@Z
??0CNoLockList@@QAE@ABV0@@Z
??0CNoLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CSmartLock@@QAE@AAVCLockEvent@@@Z
??0CSmartLock@@QAE@XZ
??0CSmartReference@@QAE@AAJ@Z
??0CSmartReference@@QAE@AAK@Z
??0CSmartResource@@QAE@AAVCResource@@E@Z
??0CStrList@@QAE@ABV0@@Z
??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
??0CSystemThread@@QAE@ABV0@@Z
??0CSystemThread@@QAE@K@Z
??0CUserFuncAdapterJob@@QAE@ABV0@@Z
??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z01@Z
??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@E@Z
??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
??0CWorkerThreadJobQueue@@QAE@K@Z
??0CWorkerThreadPool@@QAE@ABV0@@Z
??0CWorkerThreadPool@@QAE@K@Z
??0CWorkerThreadPoolEx@@QAE@ABV0@@Z
??0CWorkerThreadPoolEx@@QAE@KK@Z
??0IMemoryAllocator@@QAE@ABV0@@Z
??0IMemoryAllocator@@QAE@XZ
??1CAutoUpdateConfigThread@@UAE@XZ
??1CBlobConfig@@UAE@XZ
??1CContext@@UAE@XZ
??1CContextList@@UAE@XZ
??1CDebugLog@@UAE@XZ
??1CDebugLogEx@@UAE@XZ
??1CDelayLoadThread@@UAE@XZ
??1CExclusionExtConfig@@UAE@XZ
??1CExclusionFileNameConfig@@UAE@XZ
??1CExclusionFilePathConfig@@UAE@XZ
??1CExclusionFolderConfig@@UAE@XZ
??1CExclusionRegistryConfig@@UAE@XZ
??1CFile@@UAE@XZ
??1CFileExtension@@UAE@XZ
??1CInclusionExtConfig@@UAE@XZ
??1CInclusionFileNameConfig@@UAE@XZ
??1CInclusionFilePathConfig@@UAE@XZ
??1CInclusionFolderConfig@@UAE@XZ
??1CKEvent@@UAE@XZ
??1CList@@UAE@XZ
??1CLockEvent@@UAE@XZ
??1CLockList@@UAE@XZ
??1CMemoryAllocator@@UAE@XZ
??1CMemoryPoolAllocator@@UAE@XZ
??1CModuleConfig@@UAE@XZ
??1CModuleConfigList@@UAE@XZ
??1CModuleFileExtConfig@@UAE@XZ
??1CModuleFlagConfig@@UAE@XZ
??1CModuleMultiStringConfig@@UAE@XZ
??1CModuleStringConfig@@UAE@XZ
??1CNoLockList@@UAE@XZ
??1CSmartLock@@QAE@XZ
??1CSmartReference@@QAE@XZ
??1CSmartResource@@QAE@XZ
??1CStrList@@UAE@XZ
??1CSystemThread@@UAE@XZ
??1CUserFuncAdapterJob@@UAE@XZ
??1CWorkerThread@@UAE@XZ
??1CWorkerThreadJob@@UAE@XZ
??1CWorkerThreadJobQueue@@UAE@XZ
??1CWorkerThreadPool@@UAE@XZ
??1CWorkerThreadPoolEx@@UAE@XZ
??1IMemoryAllocator@@UAE@XZ
??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??2CMemoryAllocator@@SGPAXI@Z
??2CMemoryPoolAllocator@@SGPAXI@Z
??3@YAXPAX@Z
??3IMemoryAllocator@@SGXPAX@Z
??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
??4CBlobConfig@@QAEAAV0@ABV0@@Z
??4CContext@@QAEAAV0@ABV0@@Z
??4CDebugLog@@QAEAAV0@ABV0@@Z
??4CDebugLogEx@@QAEAAV0@ABV0@@Z
??4CDelayLoadThread@@QAEAAV0@ABV0@@Z
??4CFile@@QAEAAV0@ABV0@@Z
??4CKEvent@@QAEAAV0@ABV0@@Z
??4CLockEvent@@QAEAAV0@ABV0@@Z
??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
??4CModuleConfig@@QAEAAV0@ABV0@@Z
??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
??4CSmartResource@@QAEAAV0@ABV0@@Z
??4CSystemThread@@QAEAAV0@ABV0@@Z
??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
??4CWorkerThread@@QAEAAV0@ABV0@@Z
??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CDebugLogEx@@6B@
??_7CDelayLoadThread@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CInclusionExtConfig@@6B@
??_7CInclusionFileNameConfig@@6B@
??_7CInclusionFilePathConfig@@6B@
??_7CInclusionFolderConfig@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CNoLockList@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7CWorkerThreadPoolEx@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QAEXXZ
??_FCFile@@QAEXXZ
??_FCFileExtension@@QAEXXZ
??_FCModuleConfigList@@QAEXXZ
??_FCStrList@@QAEXXZ
??_FCSystemThread@@QAEXXZ
??_FCWorkerThread@@QAEXXZ
??_FCWorkerThreadJob@@QAEXXZ
??_FCWorkerThreadJobQueue@@QAEXXZ
??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??_V@YAXPAX@Z
?Acquire@CLockEvent@@QAEXXZ
?Add@CContextList@@QAEEPAVCContext@@@Z
?Add@CFileExtension@@QAEEPBGK@Z
?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
?Add@CStrList@@QAEEPBG@Z
?AddNode@CLockList@@UAEEQAXE@Z
?AddNode@CNoLockList@@UAEEQAXE@Z
?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QAEXXZ
?CheckNode@CLockList@@UAEHQAX@Z
?CheckNode@CNoLockList@@UAEHQAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
?Cleanup@CBlobConfig@@AAEXXZ
?Cleanup@CModuleFileExtConfig@@IAEXXZ
?Cleanup@CModuleMultiStringConfig@@IAEXXZ
?Cleanup@CModuleStringConfig@@AAEXXZ
?Close@CFile@@QAEJXZ
?Count@CLockList@@QAEKXZ
?Count@CNoLockList@@QAEKXZ
?Create@CFile@@QAEJPBGKKKK@Z
?Create@CSystemThread@@QAEEXZ
?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
?CreatePool@CWorkerThreadPool@@QAEEXZ
?CreatePool@CWorkerThreadPoolEx@@QAEEXZ
?CreateThreads@CWorkerThreadPool@@QAEEK@Z
?CreateThreads@CWorkerThreadPoolEx@@QAEEK@Z
?CreateWIRP@CFile@@QAEJPBGKKKK@Z
?Delete@CFile@@QAEJXZ
?Delete@CFileExtension@@QAEEPBGK@Z
?Delete@CStrList@@QAEEPBG@Z
?DeleteAll@CList@@UAEXXZ
?DeleteAll@CLockList@@UAEXXZ
?DeleteAll@CNoLockList@@UAEXXZ
?DeleteNode@CContextList@@MAEXPAX@Z
?DeleteNode@CList@@UAEXPAX@Z
?DeleteNode@CModuleConfigList@@MAEXPAX@Z
?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YGXPAPAX@Z
?DoIt@CWorkerThreadJob@@QAEJXZ
?EntryPoint@CSystemThread@@KGXPAX@Z
?Find@CContextList@@QAEPAVCContext@@K@Z
?Find@CContextList@@QAEPAVCContext@@PAX@Z
?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FindNode@CContextList@@IAEPAXPAX@Z
?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FinishFunction@CUserFuncAdapterJob@@MAEXXZ
?FinishIt@CWorkerThreadJob@@QAEJXZ
?First@CList@@UAEPAXXZ
?First@CLockList@@UAEPAXXZ
?First@CNoLockList@@UAEPAXXZ
?Free@CMemoryAllocator@@UAEXPAX@Z
?Free@CMemoryPoolAllocator@@UAEXPAX@Z
?GetAttributes@CFile@@QAEKXZ
?GetBasicInfomration@CFile@@IAEJXZ
?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
?GetCategory@CContext@@QAEKXZ
?GetData@CBlobConfig@@QAEHPAXPAK@Z
?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QAEKXZ
?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
?GetData@CModuleStringConfig@@QAEPAGXZ
?GetData@CStrList@@QAEEPAGPAK@Z
?GetDataType@CModuleConfig@@QAEKXZ
?GetEngineContext@CContext@@QAEPAXXZ
?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFileSizeWIRP@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UAEJKPAK@Z
?GetID@CModuleConfig@@QAEKXZ
?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QAEKXZ
?GetLinkContext@CContext@@QAEPAXXZ
?GetLogFlag@CDebugLog@@QAEKXZ
?GetLogFlag@CDebugLogEx@@QAEKXZ
?GetModuleId@CModuleConfig@@QAEKXZ
?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_KTHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_KTHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QAEKXZ
?GetSize@CBlobConfig@@QAEKXZ
?GetStringConfig@CContext@@QAEPAGK@Z
?GetStringConfig@CContext@@UAEJKPAGPAK@Z
?GetThreadCount@CWorkerThreadPool@@QAEKXZ
?GetThreadCount@CWorkerThreadPoolEx@@QAEKXZ
?GetThreadID@CSystemThread@@QAEKXZ
?GetType@CContext@@QAEKXZ
?GetUserParameter@CContext@@QAEKXZ
?InitProcMon@CDebugLogEx@@IAEXXZ
?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
?InitializeFlagConfig@CContext@@QAEHKK@Z
?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
?InitializeStringConfig@CContext@@QAEHKPBG@Z
?Insert@CList@@UAEXQAXE@Z
?Insert@CLockList@@UAEXQAXE@Z
?Insert@CNoLockList@@UAEXQAXE@Z
?InsertAfter@CList@@UAEXPAX0@Z
?InsertBefore@CList@@UAEXPAX0@Z
?Instance@CWorkerThreadPool@@SGPAV1@XZ
?IsEmpty@CList@@UAEEXZ
?IsEmpty@CLockList@@UAEEXZ
?IsEmpty@CNoLockList@@UAEEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
?IsFull@CLockList@@QBEEXZ
?IsFull@CNoLockList@@QBEEXZ
?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionExtConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFileNameConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFilePathConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFolderConfig@@QAEEPBG@Z
?IsOpened@CFile@@QAEEXZ
?IsTerminated@CWorkerThreadPool@@QAEEXZ
?IsTerminated@CWorkerThreadPoolEx@@QAEEXZ
?IsValid@CMemoryAllocator@@UAEEXZ
?IsValid@CMemoryPoolAllocator@@UAEEXZ
?IsValid@IMemoryAllocator@@UAEEXZ
?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
?IsWorkerThread@CWorkerThreadPoolEx@@QAEEK@Z
?JobFunction@CUserFuncAdapterJob@@MAEXXZ
?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
?JobQueue@CWorkerThreadPoolEx@@QAEAAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QAEKXZ
?Limit@CNoLockList@@QAEKXZ
?MatchAllExtensions@CFileExtension@@QAEEXZ
?MatchNoExtensions@CFileExtension@@QAEEXZ
?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
?NeedDelete@CWorkerThreadJob@@QAEEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
?NewNode@CList@@UAEPAXXZ
?NewNode@CStrList@@EAEPAXXZ
?NewNodeVariant@CList@@IAEPAXK@Z
?Next@CList@@UBEPAXQAX@Z
?Next@CLockList@@UBEPAXQAX@Z
?Next@CNoLockList@@UBEPAXQAX@Z
?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
?NotityTerminate@CWorkerThread@@QAEXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
?PostJobToWorkerThread@CWorkerThreadPoolEx@@QAEJP6GXPAX@Z0E1@Z
?Pulse@CKEvent@@QAEJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPoolEx@@QAEJPAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
?Read@CFile@@QAEJPADKPAK@Z
?ReadWIRP@CFile@@QAEJPADKPAK@Z
?ReferenceCount@CContext@@QAEAAKXZ
?Release@CLockEvent@@QAEXXZ
?Remove@CContextList@@UAEEQAX@Z
?Remove@CList@@UAEEQAX@Z
?Remove@CLockList@@UAEEQAX@Z
?Remove@CNoLockList@@UAEEQAX@Z
?RemoveHead@CList@@UAEPAXXZ
?RemoveHead@CLockList@@UAEPAXXZ
?RemoveHead@CNoLockList@@UAEPAXXZ
?RemoveTail@CList@@UAEPAXXZ
?RemoveTail@CLockList@@UAEPAXXZ
?RemoveTail@CNoLockList@@UAEPAXXZ
?Reset@CKEvent@@QAEXXZ
?ResetData@CInclusionExtConfig@@QAEXXZ
?ResetData@CInclusionFileNameConfig@@QAEXXZ
?ResetData@CInclusionFilePathConfig@@QAEXXZ
?ResetData@CInclusionFolderConfig@@QAEXXZ
?RestoreCR0@@YGXPAX@Z
?Run@CAutoUpdateConfigThread@@UAEXXZ
?Run@CDelayLoadThread@@UAEXXZ
?Run@CWorkerThread@@UAEXXZ
?SeekToEnd@CFile@@QAEJXZ
?Set@CKEvent@@QAEJJE@Z
?SetAttributes@CFile@@QAEJK@Z
?SetBlobCofig@CContext@@UAEJKPAXK@Z
?SetData@CBlobConfig@@QAEHPAXK@Z
?SetData@CModuleFileExtConfig@@QAEHPBG@Z
?SetData@CModuleFlagConfig@@QAEHK@Z
?SetData@CModuleMultiStringConfig@@QAEHPBGK@Z
?SetData@CModuleStringConfig@@QAEHPBG@Z
?SetEngineContext@CContext@@QAEXPAX@Z
?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
?SetFlagConfig@CContext@@UAEJKK@Z
?SetLinkContext@CContext@@QAEXPAX@Z
?SetLogFlag@CDebugLog@@QAEEK@Z
?SetLogFlag@CDebugLogEx@@QAEEK@Z
?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
?SetMultiStringConfig@CContext@@UAEJKPBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
?SetPriority@CSystemThread@@QAEXK@Z
?SetStopUse@CContext@@QAEXXZ
?SetStringConfig@CContext@@UAEJKPBG@Z
?Setup@CSystemThread@@MAEXXZ
?StopUse@CContext@@QAEHXZ
?TearDown@CSystemThread@@MAEXXZ
?Terminate@CSystemThread@@QAEXE@Z
?Terminate@CWorkerThreadPool@@QAEEXZ
?Terminate@CWorkerThreadPoolEx@@QAEEXZ
?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QAEXXZ
?WaitForInit@CDelayLoadThread@@QAEEXZ
?WaitForLoad@CDelayLoadThread@@QAEEXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
?WaitQueueEmpty@CWorkerThreadJobQueue@@QAEXXZ
?Write@CDebugLog@@QAAXPBDZZ
?Write@CDebugLogEx@@QAAXPBDZZ
?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
?WriteDataToFile@CDebugLogEx@@IAEXPADK@Z
?WriteDataToProcMonW@CDebugLogEx@@IAEXPAD@Z
?WriteSystemInformation@CDebugLog@@QAEXXZ
?WriteSystemInformation@CDebugLogEx@@QAEXXZ
?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
?WriteSystemStringInformation@CDebugLogEx@@IAEXPBG@Z
?WriteToFile@CDebugLog@@IAEXPADK@Z
?WriteToProcMonW@CDebugLogEx@@IAEXPAU_UNICODE_STRING@@@Z
?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
?_pPagedAllocator@@3PAVCMemoryAllocator@@A
?m_lpInstance@CWorkerThreadPool@@1PAV1@A
?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
_DeInitKm2UmCommunication@0
_DeInitKmLPC@0
_DuplicateFullFileName@4
_FreeFullFileName@4
_GetFileVersionOfNtoskrnl@16
_GetKm2UmMode@0
_GetModuleInfoByAddress@8
_GetModuleInfoByModuleName@8
_InitKm2UmCommunication@8
_InitKmLPC@0
_IsWindows8_1_update@4
_KmCallUm@8
_KmCallUmByLPC@8
_KmCallUmEx@12
_KmCleanupCommPortAPIs@0
_KmGetUmInitProcess@0
_KmSetCommPortAPIs@4
_ModGetExportProcAddress@8
_ModLoadDLLToBuffer@4
_ModLoadDLLToBufferWithImageSize@8
_ModLoadModule@8
_ModUnLoadModule@4
_NormalizeFileName1@8
_NormalizeFileName@4
_NormalizeFullNtPathToDosName1@8
_NormalizeFullNtPathToDosName@4
_TmCommConfigRoutine@4
_UtilAddDeviceInDriveTable@4
_UtilAddReparsePointMapping@8
_UtilCleanFileReadOnly@4
_UtilCloseExclusiveHandle@12
_UtilCreateDosFileName@8
_UtilDeleteFileForce@4
_UtilGetDeviceObjectName@8
_UtilGetFileNameFromFileObject@4
_UtilGetFileObjectForProcessByEPROC@8
_UtilGetFileObjectFromFileName@12
_UtilGetProcessName@12
_UtilGetSystemDirectory@4
_UtilGetSystemDirectoryEx@0
_UtilGetSystemDirectoryLength@0
_UtilGetSystemTime@4
_UtilIoSetFileInfo@24
_UtilIopCreateFileIRP@40
_UtilKeGetLowFileDevice@16
_UtilModuleIATHook@24
_UtilModuleIATUnHook@8
_UtilPostJobToWorkerThread@12
_UtilQueryExclusiveHandle@12
_UtilQueryKeyValue@24
_UtilRemoveDeviceFromDriveTable@4
_UtilVolumeDeviceToDosName@8
_UtilWaitValueChangeToZero@8
_UtilWriteVersionToRegistry@8
_UtilbuildDynamicDiskMappingTable@0
_UtlWriteBinValueKeyToRegistry@16
_ValidateAddressWithSize@20
__ResetProtectFromClose@4
__UtilDosPathNameToNtPathName@12

Sections

Expand

.text
.rdata
.data
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2013-09-02 01:57:59
MD5	4c6d311e0b13c4f469f717db4ab4d0e7
SHA1	6da2dd8a0b4c0e09a04613bbabfc07c0b848ec77
SHA256	80a59ca71fc20961ccafc0686051e86ae4afbbd4578cb26ad4570b9207651085
Authentihash MD5	8dfae750a79d89ab846e49f1f587a361
Authentihash SHA1	1d11a90b1d32a812a7dd36a886254d446cdd823a
Authentihash SHA256	af45d91fefd4dfffda0ce70957a542b68775368432e52d20dfdf0fc159495c7f
RichPEHeaderHash MD5	01697b3eff62a3013d7497c38b3d0912
RichPEHeaderHash SHA1	92ba287f9a361cd285dec165334bbe382f84fbdf
RichPEHeaderHash SHA256	f63b567f5dd45b44a7a0d5177f8f6afad21bc8fb958ff75651ad3c55956f9008
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	Trend Micro Eyes
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 478a8efb59e1d83f0ce142d2a28707be

Field	Value
ToBeSigned (TBS) MD5	f13ede9179075999ef7f856ec31e364b
ToBeSigned (TBS) SHA1	2f09867166e6107e17808317f5c8d4ee157f45bc
ToBeSigned (TBS) SHA256	089a2c4c6ac7432020acdb65c33bf39130da6f37c002ba79128bd4c94e4fa101
Subject	C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO Time Stamping Signer
ValidFrom	2010-05-10 00:00:00
ValidTo	2015-05-10 23:59:59
Signature	c8fb63f80b75752c3af1f213a72db6a31a9cad0107d3348e77e0c26eae025d484fa4d221b636fd2a35437c6bdf80870b15f0763200b4ceb567a42f2f201b9c549e833f1f5f149562820f2241221f70b3f3f742de6c51cd4bf821ac9b3b8cb1e5e6288fce2a8af9aa524d8c5b77ba4d5a58dbbb6a04cc521e9de228370ebbe70e91c7f8dbf18198ebcd37b30eab65d362ec3aa576eb13a83593c92e0a01ecc0e8cc3d7eb6ebe2c1ecd3149282668750dcfd5097acb34a767306c486113ab35f4304526feab3d074364ccaf11b7984377063ad74b9aa0ef398b08608ebdbe01f8c10f239649bae4f0a2c928a4f18b591e58d1a935f1faef1a6f02e97d0d2f62b3c
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	478a8efb59e1d83f0ce142d2a28707be
Version	3

Certificate 4d6290e58c54f0f1eb17341a1310e6a4

Field	Value
ToBeSigned (TBS) MD5	b7d8444a70054990435f35a5630df5e1
ToBeSigned (TBS) SHA1	4678c6e4a8787a8e6ed2bce8792b122f6c08afd8
ToBeSigned (TBS) SHA256	0a8b4b359ea7890b358e56e436e9cfc6f32b037b2599b597ca7f7a80d475ec98
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-09-30 00:00:00
ValidTo	2014-01-01 23:59:59
Signature	aedd211d5f8f807ad25209eadb6ed25d8be8c21b6904be51a5010e59fa37d174a3eedced89742b62d5a6bf4fad361754f013e0a345d24c26cbe26da21fd01e7a070fb6b37b6f5068a2e931b3b7997d8070a0a7de0b1ea4fff34d811bdd20c91cc4afcff18ffad9da95f0ecdc5cbfe88c5a3e7ab0a3eb59437411e09b1a6af36f
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	4d6290e58c54f0f1eb17341a1310e6a4
Version	3

Certificate 610c120600000000001b

Field	Value
ToBeSigned (TBS) MD5	53c41bc1164e09e0cd1617a5bf913efd
ToBeSigned (TBS) SHA1	93c03aac8951d494ecd5696b1c08658541b18727
ToBeSigned (TBS) SHA256	40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b
Subject	C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
ValidFrom	2006-05-23 17:01:29
ValidTo	2016-05-23 17:11:29
Signature	01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	610c120600000000001b
Version	3

Certificate 1a9d178ad334acdf47c8a0d15bb50e6e

Field	Value
ToBeSigned (TBS) MD5	685d99029d38a9d263ea82cd02a49f6c
ToBeSigned (TBS) SHA1	93464d8f54b4ee7caf22ca1db15a4211e0d3c79e
ToBeSigned (TBS) SHA256	894991f1477dff88c7c0707531073bb59483750bcad672fc388179affca07aa9
Subject	C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=Trend Micro, Inc.
ValidFrom	2013-01-17 00:00:00
ValidTo	2014-03-18 23:59:59
Signature	65c7e1e0f4051179852b819153b528c88db47ef50e897cd8ce0d03a7cc2dc896c89790410182186fecaf9da5c317bf57b5038311c10c2ec5ddb5c18165a7e92f92a6f39c042262126c714337a7c528041a04679217c1475a30231c967ca63b4430ccea52fe4f16fabb5c454d2aa8cdde347b8beaa973d76b3f9ba99d2597939a33d67ec4abc3974ef3792b8bc90d092cce62309d205129bbcbd3554382f24b2911b4904b09e7f52f24f2cc5a52fa49f3a163c32fde076e917301f22dd45d643b95319bae922bc861e5a8f90d4dd72603c7b1ea0229eca869ab8d086ae5286baeba9b99a12856dc1d3cd9f6d9da4b8d5a85896ba4587d8eba506a4fbba4a7bb49
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	1a9d178ad334acdf47c8a0d15bb50e6e
Version	3

Imports

Expand

ntoskrnl.exe
HAL.dll
CLASSPNP.SYS

Imported Functions

Expand

wcsrchr
KeSetEvent
KePulseEvent
KeClearEvent
KeInitializeSemaphore
KeWaitForSingleObject
KeReleaseSemaphore
KeStackAttachProcess
KeUnstackDetachProcess
RtlSubAuthoritySid
RtlInitializeSid
ExAllocatePoolWithTag
RtlLengthRequiredSid
ExFreePoolWithTag
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
ObfDereferenceObject
ZwSetEvent
ZwClose
ZwRequestWaitReplyPort
ProbeForWrite
ZwFreeVirtualMemory
ZwAllocateVirtualMemory
ObOpenObjectByPointer
PsProcessType
memmove
ZwConnectPort
RtlInitUnicodeString
RtlUnicodeStringToInteger
ZwCreateSection
ZwWaitForSingleObject
ZwOpenEvent
ObfReferenceObject
IoGetCurrentProcess
DbgBreakPoint
PsGetProcessExitTime
MmSectionObjectType
PsThreadType
DbgPrint
memset
MmIsAddressValid
ExInitializeResourceLite
ExDeleteResourceLite
ZwWriteFile
ZwReadFile
ZwQueryInformationFile
ZwSetInformationFile
ZwCreateFile
swprintf
towupper
_wcsnicmp
KeInitializeEvent
_snprintf
PsGetCurrentProcessId
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
ZwCreateKey
ZwCreateEvent
KeWaitForMultipleObjects
ObReferenceObjectByHandle
ZwNotifyChangeKey
PsGetCurrentThreadId
_vsnprintf
KeSetPriorityThread
PsTerminateSystemThread
PsCreateSystemThread
KeNumberProcessors
ZwQueryInformationProcess
PsLookupProcessByProcessId
KeDelayExecutionThread
ZwOpenDirectoryObject
PsSetCreateProcessNotifyRoutine
ZwQuerySystemInformation
ZwQueryDirectoryFile
ZwQueryDirectoryObject
ZwDuplicateObject
ZwOpenKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryValueKey
ZwDeleteValueKey
ZwDeleteKey
ExGetPreviousMode
ZwTerminateProcess
ZwOpenProcess
ZwQueryKey
ZwSetValueKey
MmHighestUserAddress
IoFreeIrp
memcpy
MmUnlockPages
IoBuildAsynchronousFsdRequest
_strnicmp
RtlQueryRegistryValues
RtlAppendUnicodeToString
_purecall
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
NtClose
ZwSetInformationObject
_stricmp
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwOpenFile
RtlEqualUnicodeString
IoFileObjectType
IoCreateFile
IofCallDriver
IoAllocateIrp
MmBuildMdlForNonPagedPool
IoAllocateMdl
ProbeForRead
PsGetVersion
MmGetSystemRoutineAddress
RtlCopyUnicodeString
RtlCompareMemory
_snwprintf
RtlImageNtHeader
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
strrchr
ZwQueryVolumeInformationFile
ObReferenceObjectByPointer
ObQueryNameString
IoBuildDeviceIoControlRequest
IofCompleteRequest
ExEventObjectType
_allmul
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoGetDeviceObjectPointer
RtlUpperChar
RtlCompareUnicodeString
strncpy
KeServiceDescriptorTable
NtOpenProcess
ObOpenObjectByName
IoDriverObjectType
RtlAppendUnicodeStringToString
strncmp
NtQueryInformationProcess
IoThreadToProcess
PsIsThreadTerminating
KeAddSystemServiceTable
ZwQueryObject
ZwQuerySecurityObject
ObInsertObject
_allrem
IoReleaseVpbSpinLock
IoAcquireVpbSpinLock
SeCreateAccessState
IoGetFileObjectGenericMapping
RtlUpcaseUnicodeString
ObCreateObject
_allshr
ExInterlockedPopEntrySList
IoGetStackLimits
IoBuildSynchronousFsdRequest
MmSystemRangeStart
wcsstr
IoUnregisterPlugPlayNotification
FsRtlIsNameInExpression
IoGetConfigurationInformation
MmProbeAndLockPages
IoGetDeviceInterfaces
IoRegisterPlugPlayNotification
ExAllocatePool
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
strncat
wcschr
wcsncat
wcstombs
KeTickCount
KeBugCheckEx
RtlUnwind
wcsncpy
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
ExAcquireResourceSharedLite
ExReleaseFastMutexUnsafe
KeLeaveCriticalRegion
KeEnterCriticalRegion
IoFreeMdl
ExAcquireFastMutexUnsafe
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
RtlLengthSid
RtlAbsoluteToSelfRelativeSD
mbstowcs
KeGetCurrentThread
KfAcquireSpinLock
KfReleaseSpinLock
KeRaiseIrqlToDpcLevel
KfLowerIrql
KeGetCurrentIrql
ExAcquireFastMutex
ExReleaseFastMutex
KfRaiseIrql
ClassInitialize

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
??0CBlobConfig@@QAE@ABV0@@Z
??0CBlobConfig@@QAE@K@Z
??0CContext@@QAE@ABV0@@Z
??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QAE@ABV0@@Z
??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
??0CDebugLog@@QAE@ABV0@@Z
??0CDebugLog@@QAE@PBG@Z
??0CDelayLoadThread@@QAE@ABV0@@Z
??0CDelayLoadThread@@QAE@XZ
??0CExclusionExtConfig@@QAE@ABV0@@Z
??0CExclusionExtConfig@@QAE@KKE@Z
??0CExclusionFileNameConfig@@QAE@ABV0@@Z
??0CExclusionFileNameConfig@@QAE@KK@Z
??0CExclusionFilePathConfig@@QAE@ABV0@@Z
??0CExclusionFilePathConfig@@QAE@KK@Z
??0CExclusionFolderConfig@@QAE@ABV0@@Z
??0CExclusionFolderConfig@@QAE@KK@Z
??0CExclusionRegistryConfig@@QAE@ABV0@@Z
??0CExclusionRegistryConfig@@QAE@KK@Z
??0CFile@@QAE@ABV0@@Z
??0CFile@@QAE@E@Z
??0CFileExtension@@QAE@ABV0@@Z
??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
??0CInclusionExtConfig@@QAE@ABV0@@Z
??0CInclusionExtConfig@@QAE@KKE@Z
??0CInclusionFileNameConfig@@QAE@ABV0@@Z
??0CInclusionFileNameConfig@@QAE@KK@Z
??0CInclusionFilePathConfig@@QAE@ABV0@@Z
??0CInclusionFilePathConfig@@QAE@KK@Z
??0CInclusionFolderConfig@@QAE@ABV0@@Z
??0CInclusionFolderConfig@@QAE@KK@Z
??0CKEvent@@QAE@ABV0@@Z
??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
??0CList@@QAE@ABV0@@Z
??0CList@@QAE@KPAVIMemoryAllocator@@@Z
??0CLockEvent@@QAE@ABV0@@Z
??0CLockEvent@@QAE@XZ
??0CLockList@@QAE@ABV0@@Z
??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QAE@ABV0@@Z
??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
??0CMemoryPoolAllocator@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@XZ
??0CModuleConfigList@@QAE@ABV0@@Z
??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QAE@ABV0@@Z
??0CModuleFileExtConfig@@QAE@KKE@Z
??0CModuleFlagConfig@@QAE@ABV0@@Z
??0CModuleFlagConfig@@QAE@K@Z
??0CModuleMultiStringConfig@@QAE@ABV0@@Z
??0CModuleMultiStringConfig@@QAE@KK@Z
??0CModuleStringConfig@@QAE@ABV0@@Z
??0CModuleStringConfig@@QAE@K@Z
??0CNoLockList@@QAE@ABV0@@Z
??0CNoLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CSmartLock@@QAE@AAVCLockEvent@@@Z
??0CSmartLock@@QAE@XZ
??0CSmartReference@@QAE@AAJ@Z
??0CSmartReference@@QAE@AAK@Z
??0CSmartResource@@QAE@AAVCResource@@E@Z
??0CStrList@@QAE@ABV0@@Z
??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
??0CSystemThread@@QAE@ABV0@@Z
??0CSystemThread@@QAE@K@Z
??0CUserFuncAdapterJob@@QAE@ABV0@@Z
??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z0@Z
??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@E@Z
??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
??0CWorkerThreadJobQueue@@QAE@K@Z
??0CWorkerThreadPool@@QAE@ABV0@@Z
??0CWorkerThreadPool@@QAE@K@Z
??0IMemoryAllocator@@QAE@ABV0@@Z
??0IMemoryAllocator@@QAE@XZ
??1CAutoUpdateConfigThread@@UAE@XZ
??1CBlobConfig@@UAE@XZ
??1CContext@@UAE@XZ
??1CContextList@@UAE@XZ
??1CDebugLog@@UAE@XZ
??1CDelayLoadThread@@UAE@XZ
??1CExclusionExtConfig@@UAE@XZ
??1CExclusionFileNameConfig@@UAE@XZ
??1CExclusionFilePathConfig@@UAE@XZ
??1CExclusionFolderConfig@@UAE@XZ
??1CExclusionRegistryConfig@@UAE@XZ
??1CFile@@UAE@XZ
??1CFileExtension@@UAE@XZ
??1CInclusionExtConfig@@UAE@XZ
??1CInclusionFileNameConfig@@UAE@XZ
??1CInclusionFilePathConfig@@UAE@XZ
??1CInclusionFolderConfig@@UAE@XZ
??1CKEvent@@UAE@XZ
??1CList@@UAE@XZ
??1CLockEvent@@UAE@XZ
??1CLockList@@UAE@XZ
??1CMemoryAllocator@@UAE@XZ
??1CMemoryPoolAllocator@@UAE@XZ
??1CModuleConfig@@UAE@XZ
??1CModuleConfigList@@UAE@XZ
??1CModuleFileExtConfig@@UAE@XZ
??1CModuleFlagConfig@@UAE@XZ
??1CModuleMultiStringConfig@@UAE@XZ
??1CModuleStringConfig@@UAE@XZ
??1CNoLockList@@UAE@XZ
??1CSmartLock@@QAE@XZ
??1CSmartReference@@QAE@XZ
??1CSmartResource@@QAE@XZ
??1CStrList@@UAE@XZ
??1CSystemThread@@UAE@XZ
??1CUserFuncAdapterJob@@UAE@XZ
??1CWorkerThread@@UAE@XZ
??1CWorkerThreadJob@@UAE@XZ
??1CWorkerThreadJobQueue@@UAE@XZ
??1CWorkerThreadPool@@UAE@XZ
??1IMemoryAllocator@@UAE@XZ
??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??2CMemoryAllocator@@SGPAXI@Z
??2CMemoryPoolAllocator@@SGPAXI@Z
??3@YAXPAX@Z
??3IMemoryAllocator@@SGXPAX@Z
??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
??4CBlobConfig@@QAEAAV0@ABV0@@Z
??4CContext@@QAEAAV0@ABV0@@Z
??4CDebugLog@@QAEAAV0@ABV0@@Z
??4CDelayLoadThread@@QAEAAV0@ABV0@@Z
??4CFile@@QAEAAV0@ABV0@@Z
??4CKEvent@@QAEAAV0@ABV0@@Z
??4CLockEvent@@QAEAAV0@ABV0@@Z
??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
??4CModuleConfig@@QAEAAV0@ABV0@@Z
??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
??4CSmartResource@@QAEAAV0@ABV0@@Z
??4CSystemThread@@QAEAAV0@ABV0@@Z
??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
??4CWorkerThread@@QAEAAV0@ABV0@@Z
??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CDelayLoadThread@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CInclusionExtConfig@@6B@
??_7CInclusionFileNameConfig@@6B@
??_7CInclusionFilePathConfig@@6B@
??_7CInclusionFolderConfig@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CNoLockList@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QAEXXZ
??_FCFile@@QAEXXZ
??_FCFileExtension@@QAEXXZ
??_FCModuleConfigList@@QAEXXZ
??_FCStrList@@QAEXXZ
??_FCSystemThread@@QAEXXZ
??_FCWorkerThread@@QAEXXZ
??_FCWorkerThreadJob@@QAEXXZ
??_FCWorkerThreadJobQueue@@QAEXXZ
??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??_V@YAXPAX@Z
?Acquire@CLockEvent@@QAEXXZ
?Add@CContextList@@QAEEPAVCContext@@@Z
?Add@CFileExtension@@QAEEPBGK@Z
?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
?Add@CStrList@@QAEEPBG@Z
?AddNode@CLockList@@UAEEQAXE@Z
?AddNode@CNoLockList@@UAEEQAXE@Z
?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QAEXXZ
?CheckNode@CLockList@@UAEHQAX@Z
?CheckNode@CNoLockList@@UAEHQAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
?Cleanup@CBlobConfig@@AAEXXZ
?Cleanup@CModuleFileExtConfig@@IAEXXZ
?Cleanup@CModuleMultiStringConfig@@IAEXXZ
?Cleanup@CModuleStringConfig@@AAEXXZ
?Close@CFile@@QAEJXZ
?Count@CLockList@@QAEKXZ
?Count@CNoLockList@@QAEKXZ
?Create@CFile@@QAEJPBGKKKK@Z
?Create@CSystemThread@@QAEEXZ
?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
?CreatePool@CWorkerThreadPool@@QAEEXZ
?CreateThreads@CWorkerThreadPool@@QAEEK@Z
?CreateWIRP@CFile@@QAEJPBGKKKK@Z
?Delete@CFile@@QAEJXZ
?Delete@CFileExtension@@QAEEPBGK@Z
?Delete@CStrList@@QAEEPBG@Z
?DeleteAll@CList@@UAEXXZ
?DeleteAll@CLockList@@UAEXXZ
?DeleteAll@CNoLockList@@UAEXXZ
?DeleteNode@CContextList@@MAEXPAX@Z
?DeleteNode@CList@@UAEXPAX@Z
?DeleteNode@CModuleConfigList@@MAEXPAX@Z
?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YGXPAPAX@Z
?DoIt@CWorkerThreadJob@@QAEJXZ
?EntryPoint@CSystemThread@@KGXPAX@Z
?Find@CContextList@@QAEPAVCContext@@K@Z
?Find@CContextList@@QAEPAVCContext@@PAX@Z
?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FindNode@CContextList@@IAEPAXPAX@Z
?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?First@CList@@UAEPAXXZ
?First@CLockList@@UAEPAXXZ
?First@CNoLockList@@UAEPAXXZ
?Free@CMemoryAllocator@@UAEXPAX@Z
?Free@CMemoryPoolAllocator@@UAEXPAX@Z
?GetAttributes@CFile@@QAEKXZ
?GetBasicInfomration@CFile@@IAEJXZ
?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
?GetCategory@CContext@@QAEKXZ
?GetData@CBlobConfig@@QAEHPAXPAK@Z
?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QAEKXZ
?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
?GetData@CModuleStringConfig@@QAEPAGXZ
?GetData@CStrList@@QAEEPAGPAK@Z
?GetDataType@CModuleConfig@@QAEKXZ
?GetEngineContext@CContext@@QAEPAXXZ
?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UAEJKPAK@Z
?GetID@CModuleConfig@@QAEKXZ
?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QAEKXZ
?GetLinkContext@CContext@@QAEPAXXZ
?GetLogFlag@CDebugLog@@QAEKXZ
?GetModuleId@CModuleConfig@@QAEKXZ
?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QAEKXZ
?GetSize@CBlobConfig@@QAEKXZ
?GetStringConfig@CContext@@QAEPAGK@Z
?GetStringConfig@CContext@@UAEJKPAGPAK@Z
?GetThreadCount@CWorkerThreadPool@@QAEKXZ
?GetThreadID@CSystemThread@@QAEKXZ
?GetType@CContext@@QAEKXZ
?GetUserParameter@CContext@@QAEKXZ
?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
?InitializeFlagConfig@CContext@@QAEHKK@Z
?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
?InitializeStringConfig@CContext@@QAEHKPBG@Z
?Insert@CList@@UAEXQAXE@Z
?Insert@CLockList@@UAEXQAXE@Z
?Insert@CNoLockList@@UAEXQAXE@Z
?InsertAfter@CList@@UAEXPAX0@Z
?InsertBefore@CList@@UAEXPAX0@Z
?Instance@CWorkerThreadPool@@SGPAV1@XZ
?IsEmpty@CList@@UAEEXZ
?IsEmpty@CLockList@@UAEEXZ
?IsEmpty@CNoLockList@@UAEEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
?IsFull@CLockList@@QBEEXZ
?IsFull@CNoLockList@@QBEEXZ
?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionExtConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFileNameConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFilePathConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFolderConfig@@QAEEPBG@Z
?IsOpened@CFile@@QAEEXZ
?IsTerminated@CWorkerThreadPool@@QAEEXZ
?IsValid@CMemoryAllocator@@UAEEXZ
?IsValid@CMemoryPoolAllocator@@UAEEXZ
?IsValid@IMemoryAllocator@@UAEEXZ
?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
?JobFunction@CUserFuncAdapterJob@@MAEXXZ
?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QAEKXZ
?Limit@CNoLockList@@QAEKXZ
?MatchAllExtensions@CFileExtension@@QAEEXZ
?MatchNoExtensions@CFileExtension@@QAEEXZ
?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
?NeedDelete@CWorkerThreadJob@@QAEEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
?NewNode@CList@@UAEPAXXZ
?NewNode@CStrList@@EAEPAXXZ
?NewNodeVariant@CList@@IAEPAXK@Z
?Next@CList@@UBEPAXQAX@Z
?Next@CLockList@@UBEPAXQAX@Z
?Next@CNoLockList@@UBEPAXQAX@Z
?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
?NotityTerminate@CWorkerThread@@QAEXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
?Pulse@CKEvent@@QAEJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
?Read@CFile@@QAEJPADKPAK@Z
?ReferenceCount@CContext@@QAEAAKXZ
?Release@CLockEvent@@QAEXXZ
?Remove@CContextList@@UAEEQAX@Z
?Remove@CList@@UAEEQAX@Z
?Remove@CLockList@@UAEEQAX@Z
?Remove@CNoLockList@@UAEEQAX@Z
?RemoveHead@CList@@UAEPAXXZ
?RemoveHead@CLockList@@UAEPAXXZ
?RemoveHead@CNoLockList@@UAEPAXXZ
?RemoveTail@CList@@UAEPAXXZ
?RemoveTail@CLockList@@UAEPAXXZ
?RemoveTail@CNoLockList@@UAEPAXXZ
?Reset@CKEvent@@QAEXXZ
?ResetData@CInclusionExtConfig@@QAEXXZ
?ResetData@CInclusionFileNameConfig@@QAEXXZ
?ResetData@CInclusionFilePathConfig@@QAEXXZ
?ResetData@CInclusionFolderConfig@@QAEXXZ
?RestoreCR0@@YGXPAX@Z
?Run@CAutoUpdateConfigThread@@UAEXXZ
?Run@CDelayLoadThread@@UAEXXZ
?Run@CWorkerThread@@UAEXXZ
?SeekToEnd@CFile@@QAEJXZ
?Set@CKEvent@@QAEJJE@Z
?SetAttributes@CFile@@QAEJK@Z
?SetBlobCofig@CContext@@UAEJKPAXK@Z
?SetData@CBlobConfig@@QAEHPAXK@Z
?SetData@CModuleFileExtConfig@@QAEHPBG@Z
?SetData@CModuleFlagConfig@@QAEHK@Z
?SetData@CModuleMultiStringConfig@@QAEHPBGK@Z
?SetData@CModuleStringConfig@@QAEHPBG@Z
?SetEngineContext@CContext@@QAEXPAX@Z
?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
?SetFlagConfig@CContext@@UAEJKK@Z
?SetLinkContext@CContext@@QAEXPAX@Z
?SetLogFlag@CDebugLog@@QAEEK@Z
?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
?SetMultiStringConfig@CContext@@UAEJKPBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
?SetPriority@CSystemThread@@QAEXK@Z
?SetStopUse@CContext@@QAEXXZ
?SetStringConfig@CContext@@UAEJKPBG@Z
?Setup@CSystemThread@@MAEXXZ
?StopUse@CContext@@QAEHXZ
?TearDown@CSystemThread@@MAEXXZ
?Terminate@CSystemThread@@QAEXE@Z
?Terminate@CWorkerThreadPool@@QAEEXZ
?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QAEXXZ
?WaitForInit@CDelayLoadThread@@QAEEXZ
?WaitForLoad@CDelayLoadThread@@QAEEXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
?Write@CDebugLog@@QAAXPBDZZ
?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
?WriteSystemInformation@CDebugLog@@QAEXXZ
?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
?WriteToFile@CDebugLog@@IAEXPADK@Z
?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
?_pPagedAllocator@@3PAVCMemoryAllocator@@A
?m_lpInstance@CWorkerThreadPool@@1PAV1@A
?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
_DeInitKmLPC@0
_GetModuleInfoByAddress@8
_GetModuleInfoByModuleName@8
_InitKmLPC@0
_KmCallUm@8
_KmCallUmEx@12
_ModGetExportProcAddress@8
_ModLoadDLLToBuffer@4
_ModLoadDLLToBufferWithImageSize@8
_ModLoadModule@8
_ModUnLoadModule@4
_NormalizeFileName@4
_NormalizeFullNtPathToDosName@4
_TmCommConfigRoutine@4
_UtilAddDeviceInDriveTable@4
_UtilCleanFileReadOnly@4
_UtilDeleteFileForce@4
_UtilGetFileObjectForProcessByEPROC@8
_UtilGetFileObjectFromFileName@12
_UtilGetProcessName@12
_UtilGetSystemDirectory@4
_UtilGetSystemDirectoryEx@0
_UtilGetSystemDirectoryLength@0
_UtilGetSystemTime@4
_UtilIoSetFileInfo@24
_UtilIopCreateFileIRP@40
_UtilKeGetLowFileDevice@16
_UtilModuleIATHook@24
_UtilModuleIATUnHook@8
_UtilQueryKeyValue@24
_UtilRemoveDeviceFromDriveTable@4
_UtilVolumeDeviceToDosName@8
_UtilWaitValueChangeToZero@8
_UtilWriteVersionToRegistry@8
_UtilbuildDynamicDiskMappingTable@0
_UtlWriteBinValueKeyToRegistry@16
__UtilDosPathNameToNtPathName@12

Sections

Expand

.text
.rdata
.data
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2017-10-02 04:43:25
MD5	1db988eb9ac5f99756c33b91830a9cf6
SHA1	4471935df0e68fe149425703b66f1efca3d82168
SHA256	818e396595d08d724666803cd29dac566dc7db23bf50e9919d04b33afa988c01
Authentihash MD5	a134546e7fd28a27327fd6e4c7ddad9e
Authentihash SHA1	3f0972132e791e4b24c6a390633aff670afd7ccc
Authentihash SHA256	3912c38f4c09b107ee9bbb60f43a8193d6bacf00bfb3b59b7b146d76594797cf
RichPEHeaderHash MD5	9700ee6a34ba2b25ddc817d1a0743be8
RichPEHeaderHash SHA1	80283ee3a81f182a56da60791555c7a5ac734e1c
RichPEHeaderHash SHA256	7f352214a0d86b5a789492b8c5d18b8bb5fe7ec7145b883dbf27d6f1bc31a950
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	Trend Micro Eyes
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 7e93ebfb7cc64e59ea4b9a77d406fc3b

Field	Value
ToBeSigned (TBS) MD5	d0785ad36e427c92b19f6826ab1e8020
ToBeSigned (TBS) SHA1	365b7a9c21bd9373e49052c3e7b3e4646ddd4d43
ToBeSigned (TBS) SHA256	c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2
ValidFrom	2012-12-21 00:00:00
ValidTo	2020-12-30 23:59:59
Signature	03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	7e93ebfb7cc64e59ea4b9a77d406fc3b
Version	3

Certificate 0ecff438c8febf356e04d86a981b1a50

Field	Value
ToBeSigned (TBS) MD5	e9d38360b914c8863f6cba3ee58764d3
ToBeSigned (TBS) SHA1	4cba8eae47b6bf76f20b3504b98b8f062694a89b
ToBeSigned (TBS) SHA256	88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4
ValidFrom	2012-10-18 00:00:00
ValidTo	2020-12-29 23:59:59
Signature	783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	0ecff438c8febf356e04d86a981b1a50
Version	3

Certificate 497c4fad471540e6e453d0cafb155740

Field	Value
ToBeSigned (TBS) MD5	78eaa337666217b1c16a9a0ebd0b8434
ToBeSigned (TBS) SHA1	ff9cb835e78f6185eed4372096c3bae53b17d18d
ToBeSigned (TBS) SHA256	1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250
Subject	C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.
ValidFrom	2017-04-27 00:00:00
ValidTo	2018-07-16 23:59:59
Signature	f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	497c4fad471540e6e453d0cafb155740
Version	3

Certificate 611993e400000000001c

Field	Value
ToBeSigned (TBS) MD5	78a717e082dcc1cda3458d917e677d14
ToBeSigned (TBS) SHA1	4a872e0e51f9b304469cd1dedb496ee9b8b983a4
ToBeSigned (TBS) SHA256	317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
ValidFrom	2011-02-22 19:25:17
ValidTo	2021-02-22 19:35:17
Signature	812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	611993e400000000001c
Version	3

Certificate 5200e5aa2556fc1a86ed96c9d44b33c7

Field	Value
ToBeSigned (TBS) MD5	b30c31a572b0409383ed3fbe17e56e81
ToBeSigned (TBS) SHA1	4843a82ed3b1f2bfbee9671960e1940c942f688d
ToBeSigned (TBS) SHA256	03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-02-08 00:00:00
ValidTo	2020-02-07 23:59:59
Signature	5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	5200e5aa2556fc1a86ed96c9d44b33c7
Version	3

Imports

Expand

ntoskrnl.exe

Imported Functions

Expand

RtlInitUnicodeString
KeInitializeEvent
KeClearEvent
KeSetEvent
KeEnterCriticalRegion
KeLeaveCriticalRegion
KeWaitForSingleObject
ExFreePoolWithTag
ExAcquireFastMutexUnsafe
ExReleaseFastMutexUnsafe
ProbeForRead
ProbeForWrite
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
MmProbeAndLockPages
MmUnlockPages
MmMapLockedPagesSpecifyCache
IoAllocateMdl
IoFreeMdl
IoGetCurrentProcess
ObfReferenceObject
ObfDereferenceObject
ZwClose
ZwCreateSection
ZwOpenSection
ZwMapViewOfSection
ZwUnmapViewOfSection
ZwOpenEvent
KePulseEvent
KeStackAttachProcess
KeUnstackDetachProcess
ObOpenObjectByPointer
ZwAllocateVirtualMemory
ZwFreeVirtualMemory
ZwSetEvent
__C_specific_handler
PsProcessType
wcslen
wcsncpy
wcsrchr
RtlUnicodeStringToInteger
ZwWaitForSingleObject
ZwRequestWaitReplyPort
ZwConnectPort
_stricmp
ExAllocatePoolWithTag
MmIsAddressValid
RtlImageNtHeader
ZwQuerySystemInformation
SeCaptureSubjectContext
SeReleaseSubjectContext
SeAccessCheck
ObGetObjectSecurity
ObReleaseObjectSecurity
PsGetProcessExitTime
PsThreadType
MmSectionObjectType
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
KeInitializeSemaphore
KeReleaseSemaphore
ExAcquireFastMutex
ExReleaseFastMutex
RtlCreateAcl
RtlAddAccessAllowedAce
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
KeDelayExecutionThread
ExGetPreviousMode
DbgPrint
swprintf
RtlCopyUnicodeString
IofCompleteRequest
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
ObReferenceObjectByHandle
PsGetCurrentProcessId
ZwCreateEvent
ExEventObjectType
_wcsnicmp
PsSetCreateProcessNotifyRoutine
ZwQueryInformationProcess
PsLookupProcessByProcessId
ZwOpenDirectoryObject
ExInitializeResourceLite
ExDeleteResourceLite
ZwCreateFile
ZwQueryInformationFile
ZwSetInformationFile
ZwReadFile
ZwWriteFile
towupper
MmGetSystemRoutineAddress
ObReferenceObjectByPointer
PsGetCurrentThreadId
ObQueryNameString
PsGetVersion
_snprintf
_vsnprintf
RtlInitAnsiString
wcscat
RtlFreeUnicodeString
RtlTimeToTimeFields
KeWaitForMultipleObjects
ExSystemTimeToLocalTime
ZwCreateKey
ZwDeviceIoControlFile
ZwNotifyChangeKey
ZwOpenFile
ZwQueryVolumeInformationFile
mbstowcs
IoGetDeviceObjectPointer
IoBuildDeviceIoControlRequest
IofCallDriver
IoCreateFile
RtlEqualUnicodeString
RtlAppendUnicodeStringToString
RtlUpcaseUnicodeChar
_snwprintf
strlen
_strnicmp
strncpy
NtOpenProcess
NtQueryInformationProcess
ObOpenObjectByName
KeSetPriorityThread
PsCreateSystemThread
PsTerminateSystemThread
KeNumberProcessors
RtlLengthSecurityDescriptor
ZwOpenKey
ZwDeleteKey
ZwDeleteValueKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryKey
ZwQueryValueKey
ZwSetValueKey
ZwTerminateProcess
ZwOpenProcess
ZwDuplicateObject
ZwQuerySecurityObject
ZwSetSecurityObject
ZwQueryDirectoryObject
ZwQueryDirectoryFile
NtCreateFile
NtQueryInformationFile
NtSetInformationFile
IoFileObjectType
ObInsertObject
wcschr
wcsncmp
RtlQueryRegistryValues
RtlAppendUnicodeToString
RtlCompareMemory
MmBuildMdlForNonPagedPool
IoAllocateIrp
IoFreeIrp
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
RtlUpcaseUnicodeString
NtClose
ZwSetInformationObject
SeQueryAuthenticationIdToken
MmSystemRangeStart
IoGetFileObjectGenericMapping
ObCreateObject
SeCreateAccessState
IoAcquireVpbSpinLock
IoReleaseVpbSpinLock
wcstombs
strncat
wcsncat
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
strcpy
wcsstr
RtlCompareUnicodeString
DbgPrintEx
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
ExAllocatePool
ExpInterlockedPopEntrySList
IoBuildSynchronousFsdRequest
IoGetStackLimits
IoGetDeviceInterfaces
IoRegisterPlugPlayNotification
IoUnregisterPlugPlayNotification
IoGetConfigurationInformation
FsRtlIsNameInExpression
IoDeviceObjectType
IoCreateDevice
RtlGetOwnerSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
RtlLengthSid
SeExports
IoIsWdmVersionAvailable
RtlAbsoluteToSelfRelativeSD
RtlAnsiStringToUnicodeString
_purecall
KeBugCheckEx

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QEAA@AEBV0@@Z
??0CAutoUpdateConfigThread@@QEAA@PEAU_UNICODE_STRING@@P6AX0PEAX@Z1@Z
??0CBlobConfig@@QEAA@AEBV0@@Z
??0CBlobConfig@@QEAA@K@Z
??0CContext@@QEAA@AEBV0@@Z
??0CContext@@QEAA@KP6AJPEAU_EVENT_REPORT@@PEAXPEAU_TMCE_REPORT@@PEAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QEAA@AEBV0@@Z
??0CContextList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CDebugLog@@QEAA@AEBV0@@Z
??0CDebugLog@@QEAA@PEBG@Z
??0CDebugLogEx@@QEAA@AEBV0@@Z
??0CDebugLogEx@@QEAA@K@Z
??0CDelayLoadThread@@QEAA@AEBV0@@Z
??0CDelayLoadThread@@QEAA@XZ
??0CExclusionExtConfig@@QEAA@AEBV0@@Z
??0CExclusionExtConfig@@QEAA@KKE@Z
??0CExclusionFileNameConfig@@QEAA@AEBV0@@Z
??0CExclusionFileNameConfig@@QEAA@KK@Z
??0CExclusionFilePathConfig@@QEAA@AEBV0@@Z
??0CExclusionFilePathConfig@@QEAA@KK@Z
??0CExclusionFolderConfig@@QEAA@AEBV0@@Z
??0CExclusionFolderConfig@@QEAA@KK@Z
??0CExclusionRegistryConfig@@QEAA@AEBV0@@Z
??0CExclusionRegistryConfig@@QEAA@KK@Z
??0CFile@@QEAA@AEBV0@@Z
??0CFile@@QEAA@E@Z
??0CFileExtension@@QEAA@AEBV0@@Z
??0CFileExtension@@QEAA@KEEPEAVIMemoryAllocator@@@Z
??0CInclusionExtConfig@@QEAA@AEBV0@@Z
??0CInclusionExtConfig@@QEAA@KKE@Z
??0CInclusionFileNameConfig@@QEAA@AEBV0@@Z
??0CInclusionFileNameConfig@@QEAA@KK@Z
??0CInclusionFilePathConfig@@QEAA@AEBV0@@Z
??0CInclusionFilePathConfig@@QEAA@KK@Z
??0CInclusionFolderConfig@@QEAA@AEBV0@@Z
??0CInclusionFolderConfig@@QEAA@KK@Z
??0CKEvent@@QEAA@AEBV0@@Z
??0CKEvent@@QEAA@W4_EVENT_TYPE@@E@Z
??0CList@@QEAA@AEBV0@@Z
??0CList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CLockEvent@@QEAA@AEBV0@@Z
??0CLockEvent@@QEAA@XZ
??0CLockList@@QEAA@AEBV0@@Z
??0CLockList@@QEAA@KKPEAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IEAA@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QEAA@AEBV0@@Z
??0CMemoryPoolAllocator@@IEAA@W4_POOL_TYPE@@_K1K@Z
??0CMemoryPoolAllocator@@QEAA@AEBV0@@Z
??0CModuleConfig@@QEAA@AEBV0@@Z
??0CModuleConfig@@QEAA@XZ
??0CModuleConfigList@@QEAA@AEBV0@@Z
??0CModuleConfigList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QEAA@AEBV0@@Z
??0CModuleFileExtConfig@@QEAA@KKE@Z
??0CModuleFlagConfig@@QEAA@AEBV0@@Z
??0CModuleFlagConfig@@QEAA@K@Z
??0CModuleMultiStringConfig@@QEAA@AEBV0@@Z
??0CModuleMultiStringConfig@@QEAA@KK@Z
??0CModuleStringConfig@@QEAA@AEBV0@@Z
??0CModuleStringConfig@@QEAA@K@Z
??0CNoLockList@@QEAA@AEBV0@@Z
??0CNoLockList@@QEAA@KKPEAVIMemoryAllocator@@@Z
??0CSmartLock@@QEAA@AEAVCLockEvent@@@Z
??0CSmartLock@@QEAA@XZ
??0CSmartReference@@QEAA@AEAJ@Z
??0CSmartReference@@QEAA@AEAK@Z
??0CSmartResource@@QEAA@AEAVCResource@@E@Z
??0CStrList@@QEAA@AEBV0@@Z
??0CStrList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CSystemThread@@QEAA@AEBV0@@Z
??0CSystemThread@@QEAA@K@Z
??0CUserFuncAdapterJob@@QEAA@AEBV0@@Z
??0CUserFuncAdapterJob@@QEAA@P6AXPEAX@Z01@Z
??0CWorkerThread@@IEAA@PEAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QEAA@AEBV0@@Z
??0CWorkerThreadJob@@QEAA@AEBV0@@Z
??0CWorkerThreadJob@@QEAA@E@Z
??0CWorkerThreadJobQueue@@QEAA@AEBV0@@Z
??0CWorkerThreadJobQueue@@QEAA@K@Z
??0CWorkerThreadPool@@QEAA@AEBV0@@Z
??0CWorkerThreadPool@@QEAA@K@Z
??0CWorkerThreadPoolEx@@QEAA@AEBV0@@Z
??0CWorkerThreadPoolEx@@QEAA@KK@Z
??0IMemoryAllocator@@QEAA@AEBV0@@Z
??0IMemoryAllocator@@QEAA@XZ
??1CAutoUpdateConfigThread@@UEAA@XZ
??1CBlobConfig@@UEAA@XZ
??1CContext@@UEAA@XZ
??1CContextList@@UEAA@XZ
??1CDebugLog@@UEAA@XZ
??1CDebugLogEx@@UEAA@XZ
??1CDelayLoadThread@@UEAA@XZ
??1CExclusionExtConfig@@UEAA@XZ
??1CExclusionFileNameConfig@@UEAA@XZ
??1CExclusionFilePathConfig@@UEAA@XZ
??1CExclusionFolderConfig@@UEAA@XZ
??1CExclusionRegistryConfig@@UEAA@XZ
??1CFile@@UEAA@XZ
??1CFileExtension@@UEAA@XZ
??1CInclusionExtConfig@@UEAA@XZ
??1CInclusionFileNameConfig@@UEAA@XZ
??1CInclusionFilePathConfig@@UEAA@XZ
??1CInclusionFolderConfig@@UEAA@XZ
??1CKEvent@@UEAA@XZ
??1CList@@UEAA@XZ
??1CLockEvent@@UEAA@XZ
??1CLockList@@UEAA@XZ
??1CMemoryAllocator@@UEAA@XZ
??1CMemoryPoolAllocator@@UEAA@XZ
??1CModuleConfig@@UEAA@XZ
??1CModuleConfigList@@UEAA@XZ
??1CModuleFileExtConfig@@UEAA@XZ
??1CModuleFlagConfig@@UEAA@XZ
??1CModuleMultiStringConfig@@UEAA@XZ
??1CModuleStringConfig@@UEAA@XZ
??1CNoLockList@@UEAA@XZ
??1CSmartLock@@QEAA@XZ
??1CSmartReference@@QEAA@XZ
??1CSmartResource@@QEAA@XZ
??1CStrList@@UEAA@XZ
??1CSystemThread@@UEAA@XZ
??1CUserFuncAdapterJob@@UEAA@XZ
??1CWorkerThread@@UEAA@XZ
??1CWorkerThreadJob@@UEAA@XZ
??1CWorkerThreadJobQueue@@UEAA@XZ
??1CWorkerThreadPool@@UEAA@XZ
??1CWorkerThreadPoolEx@@UEAA@XZ
??1IMemoryAllocator@@UEAA@XZ
??2@YAPEAX_KPEAVIMemoryAllocator@@PEBDK@Z
??2CMemoryAllocator@@SAPEAX_K@Z
??2CMemoryPoolAllocator@@SAPEAX_K@Z
??3@YAXPEAX@Z
??3@YAXPEAX_K@Z
??3IMemoryAllocator@@SAXPEAX@Z
??4CAutoUpdateConfigThread@@QEAAAEAV0@AEBV0@@Z
??4CBlobConfig@@QEAAAEAV0@AEBV0@@Z
??4CContext@@QEAAAEAV0@AEBV0@@Z
??4CDebugLog@@QEAAAEAV0@AEBV0@@Z
??4CDebugLogEx@@QEAAAEAV0@AEBV0@@Z
??4CDelayLoadThread@@QEAAAEAV0@AEBV0@@Z
??4CFile@@QEAAAEAV0@AEBV0@@Z
??4CKEvent@@QEAAAEAV0@AEBV0@@Z
??4CLockEvent@@QEAAAEAV0@AEBV0@@Z
??4CMemoryAllocator@@QEAAAEAV0@AEBV0@@Z
??4CMemoryPoolAllocator@@QEAAAEAV0@AEBV0@@Z
??4CModuleConfig@@QEAAAEAV0@AEBV0@@Z
??4CModuleFlagConfig@@QEAAAEAV0@AEBV0@@Z
??4CModuleStringConfig@@QEAAAEAV0@AEBV0@@Z
??4CSmartLock@@QEAAAEAV0@AEBV0@@Z
??4CSmartLock@@QEAAAEBV0@AEAVCLockEvent@@@Z
??4CSmartResource@@QEAAAEAV0@AEBV0@@Z
??4CSystemThread@@QEAAAEAV0@AEBV0@@Z
??4CUserFuncAdapterJob@@QEAAAEAV0@AEBV0@@Z
??4CWorkerThread@@QEAAAEAV0@AEBV0@@Z
??4CWorkerThreadJob@@QEAAAEAV0@AEBV0@@Z
??4IMemoryAllocator@@QEAAAEAV0@AEBV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CDebugLogEx@@6B@
??_7CDelayLoadThread@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CInclusionExtConfig@@6B@
??_7CInclusionFileNameConfig@@6B@
??_7CInclusionFilePathConfig@@6B@
??_7CInclusionFolderConfig@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CNoLockList@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7CWorkerThreadPoolEx@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QEAAXXZ
??_FCFile@@QEAAXXZ
??_FCFileExtension@@QEAAXXZ
??_FCModuleConfigList@@QEAAXXZ
??_FCStrList@@QEAAXXZ
??_FCSystemThread@@QEAAXXZ
??_FCWorkerThread@@QEAAXXZ
??_FCWorkerThreadJob@@QEAAXXZ
??_FCWorkerThreadJobQueue@@QEAAXXZ
??_U@YAPEAX_KPEAVIMemoryAllocator@@PEBDK@Z
??_V@YAXPEAX@Z
??_V@YAXPEAX_K@Z
?Acquire@CLockEvent@@QEAAXXZ
?Add@CContextList@@QEAAEPEAVCContext@@@Z
?Add@CFileExtension@@QEAAEPEBGK@Z
?Add@CModuleConfigList@@QEAAEPEAVCModuleConfig@@@Z
?Add@CStrList@@QEAAEPEBG@Z
?AddNode@CLockList@@UEAAEQEAXE@Z
?AddNode@CNoLockList@@UEAAEQEAXE@Z
?Alloc@CMemoryAllocator@@UEAAPEAX_KPEBDK@Z
?Alloc@CMemoryPoolAllocator@@UEAAPEAX_KPEBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IEAAPEAX_K@Z
?AttachJobQueue@CWorkerThread@@QEAAXPEAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QEAAXXZ
?CheckNode@CLockList@@UEAAHQEAX@Z
?CheckNode@CNoLockList@@UEAAHQEAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QEAAXXZ
?Cleanup@CBlobConfig@@AEAAXXZ
?Cleanup@CModuleFileExtConfig@@IEAAXXZ
?Cleanup@CModuleMultiStringConfig@@IEAAXXZ
?Cleanup@CModuleStringConfig@@AEAAXXZ
?Close@CFile@@QEAAJXZ
?Count@CLockList@@QEAAKXZ
?Count@CNoLockList@@QEAAKXZ
?Create@CFile@@QEAAJPEBGKKKK@Z
?Create@CSystemThread@@QEAAEXZ
?CreateInstance@CMemoryAllocator@@SAPEAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SAPEAV1@W4_POOL_TYPE@@_K1K@Z
?CreatePool@CWorkerThreadPool@@QEAAEXZ
?CreatePool@CWorkerThreadPoolEx@@QEAAEXZ
?CreateThreads@CWorkerThreadPool@@QEAAEK@Z
?CreateThreads@CWorkerThreadPoolEx@@QEAAEK@Z
?CreateWIRP@CFile@@QEAAJPEBGKKKK@Z
?Delete@CFile@@QEAAJXZ
?Delete@CFileExtension@@QEAAEPEBGK@Z
?Delete@CStrList@@QEAAEPEBG@Z
?DeleteAll@CList@@UEAAXXZ
?DeleteAll@CLockList@@UEAAXXZ
?DeleteAll@CNoLockList@@UEAAXXZ
?DeleteNode@CContextList@@MEAAXPEAX@Z
?DeleteNode@CList@@UEAAXPEAX@Z
?DeleteNode@CModuleConfigList@@MEAAXPEAX@Z
?DeleteNode@CStrList@@EEAAXPEAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YAXPEAPEAX@Z
?DoIt@CWorkerThreadJob@@QEAAJXZ
?EntryPoint@CSystemThread@@KAXPEAX@Z
?Find@CContextList@@QEAAPEAVCContext@@K@Z
?Find@CContextList@@QEAAPEAVCContext@@PEAX@Z
?Find@CFileExtension@@QEAAPEAU_STR_LIST_NODE@CStrList@@PEBGK@Z
?Find@CModuleConfigList@@QEAAPEAVCModuleConfig@@K@Z
?Find@CStrList@@QEAAPEAU_STR_LIST_NODE@1@PEBG@Z
?FindNode@CContextList@@IEAAPEAXPEAX@Z
?FindPartiallyAndAllMatch@CStrList@@QEAAPEAU_STR_LIST_NODE@1@PEBG@Z
?FinishFunction@CUserFuncAdapterJob@@MEAAXXZ
?FinishIt@CWorkerThreadJob@@QEAAJXZ
?First@CList@@UEAAPEAXXZ
?First@CLockList@@UEAAPEAXXZ
?First@CNoLockList@@UEAAPEAXXZ
?Free@CMemoryAllocator@@UEAAXPEAX@Z
?Free@CMemoryPoolAllocator@@UEAAXPEAX@Z
?GetAttributes@CFile@@QEAAKXZ
?GetBasicInfomration@CFile@@IEAAJXZ
?GetBlobCofig@CContext@@UEAAJKPEAXPEAK@Z
?GetCategory@CContext@@QEAAKXZ
?GetData@CBlobConfig@@QEAAHPEAXPEAK@Z
?GetData@CModuleFileExtConfig@@QEAAHPEAGPEAK@Z
?GetData@CModuleFileExtConfig@@QEAAPEAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QEAAKXZ
?GetData@CModuleMultiStringConfig@@QEAAHPEAGPEAK@Z
?GetData@CModuleMultiStringConfig@@QEAAPEAVCStrList@@XZ
?GetData@CModuleStringConfig@@QEAAPEAGXZ
?GetData@CStrList@@QEAAEPEAGPEAK@Z
?GetDataType@CModuleConfig@@QEAAKXZ
?GetEngineContext@CContext@@QEAAPEAXXZ
?GetFileExtensionConfig@CContext@@QEAAPEAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UEAAJKPEAGPEAK@Z
?GetFileSize@CFile@@QEAAJPEAT_LARGE_INTEGER@@@Z
?GetFileSizeWIRP@CFile@@QEAAJPEAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UEAAJKPEAK@Z
?GetID@CModuleConfig@@QEAAKXZ
?GetJob@CWorkerThreadJobQueue@@QEAAPEAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QEAAKXZ
?GetLinkContext@CContext@@QEAAPEAXXZ
?GetLogFlag@CDebugLog@@QEAAKXZ
?GetLogFlag@CDebugLogEx@@QEAAKXZ
?GetModuleId@CModuleConfig@@QEAAKXZ
?GetMultiStringConfig@CContext@@QEAAPEAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UEAAJKPEAGPEAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QEAAPEAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPool@@QEAAPEAU_KTHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QEAAPEAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QEAAPEAU_KTHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QEAA_KXZ
?GetSize@CBlobConfig@@QEAAKXZ
?GetStringConfig@CContext@@QEAAPEAGK@Z
?GetStringConfig@CContext@@UEAAJKPEAGPEAK@Z
?GetThreadCount@CWorkerThreadPool@@QEAAKXZ
?GetThreadCount@CWorkerThreadPoolEx@@QEAAKXZ
?GetThreadID@CSystemThread@@QEAA_KXZ
?GetType@CContext@@QEAAKXZ
?GetUserParameter@CContext@@QEAA_KXZ
?InitProcMon@CDebugLogEx@@IEAAXXZ
?InitializeBlobConfig@CContext@@QEAAHKPEAXK@Z
?InitializeFileExtensionConfig@CContext@@QEAAHKPEBG@Z
?InitializeFlagConfig@CContext@@QEAAHKK@Z
?InitializeMultiStringConfig@CContext@@QEAAHKPEBG@Z
?InitializeStringConfig@CContext@@QEAAHKPEBG@Z
?Insert@CList@@UEAAXQEAXE@Z
?Insert@CLockList@@UEAAXQEAXE@Z
?Insert@CNoLockList@@UEAAXQEAXE@Z
?InsertAfter@CList@@UEAAXPEAX0@Z
?InsertBefore@CList@@UEAAXPEAX0@Z
?Instance@CWorkerThreadPool@@SAPEAV1@XZ
?IsEmpty@CList@@UEAAEXZ
?IsEmpty@CLockList@@UEAAEXZ
?IsEmpty@CNoLockList@@UEAAEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IEAAEK@Z
?IsFull@CLockList@@QEBAEXZ
?IsFull@CNoLockList@@QEBAEXZ
?IsInExclusionList@CExclusionExtConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionExtConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionFileNameConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionFilePathConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionFolderConfig@@QEAAEPEBG@Z
?IsOpened@CFile@@QEAAEXZ
?IsTerminated@CWorkerThreadPool@@QEAAEXZ
?IsTerminated@CWorkerThreadPoolEx@@QEAAEXZ
?IsValid@CMemoryAllocator@@UEAAEXZ
?IsValid@CMemoryPoolAllocator@@UEAAEXZ
?IsValid@IMemoryAllocator@@UEAAEXZ
?IsWorkerThread@CWorkerThreadPool@@QEAAE_K@Z
?IsWorkerThread@CWorkerThreadPoolEx@@QEAAE_K@Z
?JobFunction@CUserFuncAdapterJob@@MEAAXXZ
?JobQueue@CWorkerThreadPool@@QEAAAEAVCWorkerThreadJobQueue@@XZ
?JobQueue@CWorkerThreadPoolEx@@QEAAAEAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QEAAKXZ
?Limit@CNoLockList@@QEAAKXZ
?MatchAllExtensions@CFileExtension@@QEAAEXZ
?MatchNoExtensions@CFileExtension@@QEAAEXZ
?MergeLeft@CMemoryPoolAllocator@@IEAAPEAXPEAX@Z
?MergeRight@CMemoryPoolAllocator@@IEAAPEAXPEAX@Z
?NeedDelete@CWorkerThreadJob@@QEAAEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QEAAXE@Z
?NewNode@CList@@UEAAPEAXXZ
?NewNode@CStrList@@EEAAPEAXXZ
?NewNodeVariant@CList@@IEAAPEAXK@Z
?Next@CList@@UEBAPEAXQEAX@Z
?Next@CLockList@@UEBAPEAXQEAX@Z
?Next@CNoLockList@@UEBAPEAXQEAX@Z
?NextPool@CMemoryPoolAllocator@@QEAAPEAV1@XZ
?NotityTerminate@CWorkerThread@@QEAAXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QEAAJP6AXPEAX@Z0E@Z
?PostJobToWorkerThread@CWorkerThreadPoolEx@@QEAAJP6AXPEAX@Z0E1@Z
?Pulse@CKEvent@@QEAAJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QEAAEPEAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QEAAJPEAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPoolEx@@QEAAJPEAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SAPEAV1@XZ
?Read@CFile@@QEAAJPEADKPEAK@Z
?ReadWIRP@CFile@@QEAAJPEADKPEAK@Z
?ReferenceCount@CContext@@QEAAAEAKXZ
?Release@CLockEvent@@QEAAXXZ
?Remove@CContextList@@UEAAEQEAX@Z
?Remove@CList@@UEAAEQEAX@Z
?Remove@CLockList@@UEAAEQEAX@Z
?Remove@CNoLockList@@UEAAEQEAX@Z
?RemoveHead@CList@@UEAAPEAXXZ
?RemoveHead@CLockList@@UEAAPEAXXZ
?RemoveHead@CNoLockList@@UEAAPEAXXZ
?RemoveTail@CList@@UEAAPEAXXZ
?RemoveTail@CLockList@@UEAAPEAXXZ
?RemoveTail@CNoLockList@@UEAAPEAXXZ
?Reset@CKEvent@@QEAAXXZ
?ResetData@CInclusionExtConfig@@QEAAXXZ
?ResetData@CInclusionFileNameConfig@@QEAAXXZ
?ResetData@CInclusionFilePathConfig@@QEAAXXZ
?ResetData@CInclusionFolderConfig@@QEAAXXZ
?RestoreCR0@@YAXPEAX@Z
?Run@CAutoUpdateConfigThread@@UEAAXXZ
?Run@CDelayLoadThread@@UEAAXXZ
?Run@CWorkerThread@@UEAAXXZ
?SeekToEnd@CFile@@QEAAJXZ
?Set@CKEvent@@QEAAJJE@Z
?SetAttributes@CFile@@QEAAJK@Z
?SetBlobCofig@CContext@@UEAAJKPEAXK@Z
?SetData@CBlobConfig@@QEAAHPEAXK@Z
?SetData@CModuleFileExtConfig@@QEAAHPEBG@Z
?SetData@CModuleFlagConfig@@QEAAHK@Z
?SetData@CModuleMultiStringConfig@@QEAAHPEBGK@Z
?SetData@CModuleStringConfig@@QEAAHPEBG@Z
?SetEngineContext@CContext@@QEAAXPEAX@Z
?SetFileExtensionConfig@CContext@@UEAAJKPEBG@Z
?SetFlagConfig@CContext@@UEAAJKK@Z
?SetLinkContext@CContext@@QEAAXPEAX@Z
?SetLogFlag@CDebugLog@@QEAAEK@Z
?SetLogFlag@CDebugLogEx@@QEAAEK@Z
?SetMatchAllExtensions@CFileExtension@@QEAAXE@Z
?SetMatchNoExtensions@CFileExtension@@QEAAXE@Z
?SetMultiStringConfig@CContext@@UEAAJKPEBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QEAAXXZ
?SetPriority@CSystemThread@@QEAAXK@Z
?SetStopUse@CContext@@QEAAXXZ
?SetStringConfig@CContext@@UEAAJKPEBG@Z
?Setup@CSystemThread@@MEAAXXZ
?StopUse@CContext@@QEAAHXZ
?TearDown@CSystemThread@@MEAAXXZ
?Terminate@CSystemThread@@QEAAXE@Z
?Terminate@CWorkerThreadPool@@QEAAEXZ
?Terminate@CWorkerThreadPoolEx@@QEAAEXZ
?TmExceptionFilter@@YAJPEAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QEAAJPEAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QEAAXXZ
?WaitForInit@CDelayLoadThread@@QEAAEXZ
?WaitForLoad@CDelayLoadThread@@QEAAEXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QEAAEXZ
?WaitQueueEmpty@CWorkerThreadJobQueue@@QEAAXXZ
?Write@CDebugLog@@QEAAXPEBDZZ
?Write@CDebugLogEx@@QEAAXPEBDZZ
?Write@CFile@@QEAAJPEADKPEAT_LARGE_INTEGER@@PEAK@Z
?WriteDataToFile@CDebugLogEx@@IEAAXPEADK@Z
?WriteDataToProcMonW@CDebugLogEx@@IEAAXPEAD@Z
?WriteSystemInformation@CDebugLog@@QEAAXXZ
?WriteSystemInformation@CDebugLogEx@@QEAAXXZ
?WriteSystemStringInformation@CDebugLog@@IEAAXPEBG@Z
?WriteSystemStringInformation@CDebugLogEx@@IEAAXPEBG@Z
?WriteToFile@CDebugLog@@IEAAXPEADK@Z
?WriteToProcMonW@CDebugLogEx@@IEAAXPEAU_UNICODE_STRING@@@Z
?_pNonPagedAllocator@@3PEAVCMemoryAllocator@@EA
?_pPagedAllocator@@3PEAVCMemoryAllocator@@EA
?m_lpInstance@CWorkerThreadPool@@1PEAV1@EA
?m_lpRCMInstance@CWorkerThreadPool@@1PEAV1@EA
AllocFullFileName
DeInitKm2UmCommunication
DeInitKmLPC
DuplicateFullFileName
FreeFullFileName
GetKm2UmMode
GetModuleInfoByAddress
GetModuleInfoByModuleName
InitKm2UmCommunication
InitKmLPC
IsVerifierCodeCheckFlagOn
IsWindows8_1_update
KmCallUm
KmCallUmByLPC
KmCallUmEx
KmCleanupCommPortAPIs
KmGetUmInitProcess
KmSetBackupCommPortAPIs
KmSetCommPortAPIs
ModGetExportProcAddress
ModLoadDLLToBuffer
ModLoadDLLToBufferWithImageSize
ModLoadModule
ModUnLoadModule
NormalizeFileName
NormalizeFullNtPathToDosName
TmCommConfigRoutine
UtilAddDeviceInDriveTable
UtilAddReparsePointMapping
UtilCleanFileReadOnly
UtilCloseExclusiveHandle
UtilCreateDosFileName
UtilDeleteFileForce
UtilGetDeviceObjectName
UtilGetFileNameFromFileObject
UtilGetFileObjectForProcessByEPROC
UtilGetFileObjectFromFileName
UtilGetProcessName
UtilGetSystemDirectory
UtilGetSystemDirectoryEx
UtilGetSystemDirectoryLength
UtilGetSystemTime
UtilIoSetFileInfo
UtilIopCreateFileIRP
UtilKeGetLowFileDevice
UtilModuleIATHook
UtilModuleIATUnHook
UtilPostJobToWorkerThread
UtilQueryExclusiveHandle
UtilQueryKeyValue
UtilRemoveDeviceFromDriveTable
UtilVolumeDeviceToDosName
UtilWaitValueChangeToZero
UtilWriteVersionToRegistry
UtilbuildDynamicDiskMappingTable
UtlWriteBinValueKeyToRegistry
ValidateAddressWithSize
_ResetProtectFromClose
_UtilDosPathNameToNtPathName

Sections

Expand

.text
.rdata
.data
.pdata
.gfids
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2012-11-13 04:31:52
MD5	f33c3f08536f988aac84d72d83b139a6
SHA1	07f60b2b0e56cb15aad3ca8a96d9fe3a91491329
SHA256	89108a15f009b285db4ef94250b889d5b11b96b4aa7b190784a6d1396e893e10
Authentihash MD5	9c5ecf2cf0ba2a3297f9677d514c2a39
Authentihash SHA1	01df70bdb08dda678118d4449b6171fe387b5d0c
Authentihash SHA256	35a7be9b0cde8c3d409a472a320541df070d7af6008e6458a05947f2591da9b5
RichPEHeaderHash MD5	03cc0cf6cc93ab1faa8dd44481e28703
RichPEHeaderHash SHA1	7c749d49c0677c330200d6fcd0e2da5232be0970
RichPEHeaderHash SHA256	8ff0549239941077a9cfd73a1d1e0ca0a20d4df41e2b9d249e6115f9bc1857b4
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	Trend Micro Eyes
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 79a2a585f9d1154213d9b83ef6b68ded

Field	Value
ToBeSigned (TBS) MD5	e6d820afb23af20a65cf0b03247ea05e
ToBeSigned (TBS) SHA1	7a8f7c37453f99390ee1e94bb5d3d1cba3a0eea7
ToBeSigned (TBS) SHA256	7e722dc40e6b9abf8c20aa4d887e34b6d2c6b8cbe53a055d49bf9f5e946e0d27
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G3
ValidFrom	2012-05-01 00:00:00
ValidTo	2012-12-31 23:59:59
Signature	1e98aa27b778b508b5c9726db7dfc00e98a635c488c9d2f66df14b1afbd5f92d99009ed1e79b8be13fbd39800c66cd07bc5c9854a694ba10d14e8babf56f65cc6709a2807c52e80e03d66b7ac60518ecc8ac427c072ca73d0866dc00edfd941d73f2729893b111d68fef8eeaacf496510cd08ddf31524f5eaf7da74a75e64ece2b9f292be7cf5d9f037e6e277b23ad622966af92e82ccebd9c7fdccd173c43c2093f7545c79ee4d7607f97c6e4aac769f5fccd74ac2cb048c1504e70561eb535d38ebeb1edacbdfe0cec857dd5bb856644195d9f93eb82ba639ed37c61ffc81bd923587f30a366a139265e92c33ccb3732faf5a38ddcd5b0a3e9253655d781fa
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	79a2a585f9d1154213d9b83ef6b68ded
Version	3

Certificate 47bf1995df8d524643f7db6d480d31a4

Field	Value
ToBeSigned (TBS) MD5	518d2ea8a21e879c942d504824ac211c
ToBeSigned (TBS) SHA1	21ce87d827077e61abddf2beba69fde5432ea031
ToBeSigned (TBS) SHA256	1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7
Subject	C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
ValidFrom	2003-12-04 00:00:00
ValidTo	2013-12-03 23:59:59
Signature	4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	47bf1995df8d524643f7db6d480d31a4
Version	3

Certificate 4d6290e58c54f0f1eb17341a1310e6a4

Field	Value
ToBeSigned (TBS) MD5	b7d8444a70054990435f35a5630df5e1
ToBeSigned (TBS) SHA1	4678c6e4a8787a8e6ed2bce8792b122f6c08afd8
ToBeSigned (TBS) SHA256	0a8b4b359ea7890b358e56e436e9cfc6f32b037b2599b597ca7f7a80d475ec98
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-09-30 00:00:00
ValidTo	2014-01-01 23:59:59
Signature	aedd211d5f8f807ad25209eadb6ed25d8be8c21b6904be51a5010e59fa37d174a3eedced89742b62d5a6bf4fad361754f013e0a345d24c26cbe26da21fd01e7a070fb6b37b6f5068a2e931b3b7997d8070a0a7de0b1ea4fff34d811bdd20c91cc4afcff18ffad9da95f0ecdc5cbfe88c5a3e7ab0a3eb59437411e09b1a6af36f
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	4d6290e58c54f0f1eb17341a1310e6a4
Version	3

Certificate 610c120600000000001b

Field	Value
ToBeSigned (TBS) MD5	53c41bc1164e09e0cd1617a5bf913efd
ToBeSigned (TBS) SHA1	93c03aac8951d494ecd5696b1c08658541b18727
ToBeSigned (TBS) SHA256	40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b
Subject	C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
ValidFrom	2006-05-23 17:01:29
ValidTo	2016-05-23 17:11:29
Signature	01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	610c120600000000001b
Version	3

Certificate 6326c00ead256b6837eeb29b5ee84720

Field	Value
ToBeSigned (TBS) MD5	11b208a45459069f827186fe81c6badd
ToBeSigned (TBS) SHA1	456356986e8ecbb7b05e4617d37cb8cd69ce4969
ToBeSigned (TBS) SHA256	4a0336d7ffa5db42ece4b342e1244f5c2bd0681827f68f847d99195c83740145
Subject	C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, OU=RD, CN=Trend Micro, Inc.
ValidFrom	2011-12-27 00:00:00
ValidTo	2013-02-15 23:59:59
Signature	840ba0fc35187fe2edc7b17c101fd2bf035bbad8f3de048e250741e96a3f4ecee86f1f065ea76f2f8f430a13a75ff3eab29a8b11a13006d27bf3173fa49aabf9cef98fc4554f1732317c4b821c740eb58a91977d85e86574dd712718b15d24f7eb88b6d4520aef788478e1ef8cebd7fff06fadbc87ca6ca2b77da85be3c30b4d590bcb8945a0acfa013f89073933494d9c465c0036280a5af39f6802e60bd175a2603366dd935cb3458b1791411a06b6e5f38e3171de4238051c79b33117cb94674d0625c402bdfb0f99b80625dc0f827911c6c11263884a4e41d1abf60070ad46b7296e19e1cfcda7304a650d7a814319cc11e5a947e82b2d00a169e798b871
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	6326c00ead256b6837eeb29b5ee84720
Version	3

Imports

Expand

ntoskrnl.exe
HAL.dll
CLASSPNP.SYS

Imported Functions

Expand

wcsrchr
KeSetEvent
KePulseEvent
KeClearEvent
KeInitializeSemaphore
KeWaitForSingleObject
KeReleaseSemaphore
KeStackAttachProcess
KeUnstackDetachProcess
RtlSubAuthoritySid
RtlInitializeSid
ExAllocatePoolWithTag
RtlLengthRequiredSid
ExFreePoolWithTag
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
ObfDereferenceObject
ZwSetEvent
ZwClose
ZwRequestWaitReplyPort
ProbeForWrite
ZwFreeVirtualMemory
ZwAllocateVirtualMemory
ObOpenObjectByPointer
PsProcessType
memmove
ZwConnectPort
RtlInitUnicodeString
RtlUnicodeStringToInteger
ZwCreateSection
ZwWaitForSingleObject
ZwOpenEvent
ObfReferenceObject
IoGetCurrentProcess
DbgBreakPoint
PsGetProcessExitTime
MmSectionObjectType
PsThreadType
DbgPrint
memset
MmIsAddressValid
ExInitializeResourceLite
ExDeleteResourceLite
ZwWriteFile
ZwReadFile
ZwQueryInformationFile
ZwSetInformationFile
ZwCreateFile
swprintf
towupper
_wcsnicmp
KeInitializeEvent
_snprintf
PsGetCurrentProcessId
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
ZwCreateKey
ZwCreateEvent
KeWaitForMultipleObjects
ObReferenceObjectByHandle
ZwNotifyChangeKey
PsGetCurrentThreadId
_vsnprintf
KeSetPriorityThread
PsTerminateSystemThread
PsCreateSystemThread
KeNumberProcessors
ZwQueryInformationProcess
PsLookupProcessByProcessId
KeDelayExecutionThread
ZwOpenDirectoryObject
PsSetCreateProcessNotifyRoutine
ZwQuerySystemInformation
ZwQueryDirectoryFile
ZwQueryDirectoryObject
ZwDuplicateObject
ZwOpenKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryValueKey
ZwDeleteValueKey
ZwDeleteKey
ExGetPreviousMode
ZwTerminateProcess
ZwOpenProcess
ZwQueryKey
ZwSetValueKey
MmHighestUserAddress
memcpy
IoFreeMdl
MmUnlockPages
IoBuildAsynchronousFsdRequest
_strnicmp
RtlQueryRegistryValues
RtlAppendUnicodeToString
_purecall
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
NtClose
ZwSetInformationObject
_stricmp
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwOpenFile
RtlEqualUnicodeString
IoFileObjectType
IoCreateFile
IofCallDriver
IoAllocateIrp
MmBuildMdlForNonPagedPool
IoAllocateMdl
ProbeForRead
PsGetVersion
MmGetSystemRoutineAddress
RtlCopyUnicodeString
RtlCompareMemory
_snwprintf
RtlImageNtHeader
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
strrchr
ZwQueryVolumeInformationFile
ObReferenceObjectByPointer
ObQueryNameString
IoBuildDeviceIoControlRequest
IofCompleteRequest
ExEventObjectType
_allmul
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoGetDeviceObjectPointer
RtlUpperChar
RtlCompareUnicodeString
strncpy
KeServiceDescriptorTable
NtOpenProcess
ObOpenObjectByName
IoDriverObjectType
RtlAppendUnicodeStringToString
strncmp
NtQueryInformationProcess
PsIsThreadTerminating
KeAddSystemServiceTable
ZwQueryObject
ZwQuerySecurityObject
ObInsertObject
_allrem
IoReleaseVpbSpinLock
IoAcquireVpbSpinLock
SeCreateAccessState
IoGetFileObjectGenericMapping
RtlUpcaseUnicodeString
ObCreateObject
_allshr
ExInterlockedPopEntrySList
IoGetStackLimits
IoBuildSynchronousFsdRequest
MmSystemRangeStart
IoUnregisterPlugPlayNotification
FsRtlIsNameInExpression
wcsstr
IoGetConfigurationInformation
MmProbeAndLockPages
IoGetDeviceInterfaces
IoRegisterPlugPlayNotification
ExAllocatePool
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
strncat
wcschr
wcsncat
wcstombs
KeTickCount
KeBugCheckEx
RtlUnwind
wcsncpy
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
ExAcquireResourceSharedLite
ExReleaseFastMutexUnsafe
KeLeaveCriticalRegion
KeEnterCriticalRegion
IoFreeIrp
ExAcquireFastMutexUnsafe
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
RtlLengthSid
RtlAbsoluteToSelfRelativeSD
mbstowcs
KeGetCurrentThread
KfAcquireSpinLock
KfReleaseSpinLock
KeRaiseIrqlToDpcLevel
KfLowerIrql
KeGetCurrentIrql
ExAcquireFastMutex
ExReleaseFastMutex
KfRaiseIrql
ClassInitialize

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
??0CBlobConfig@@QAE@ABV0@@Z
??0CBlobConfig@@QAE@K@Z
??0CContext@@QAE@ABV0@@Z
??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QAE@ABV0@@Z
??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
??0CDebugLog@@QAE@ABV0@@Z
??0CDebugLog@@QAE@PBG@Z
??0CDelayLoadThread@@QAE@ABV0@@Z
??0CDelayLoadThread@@QAE@XZ
??0CExclusionExtConfig@@QAE@ABV0@@Z
??0CExclusionExtConfig@@QAE@KKE@Z
??0CExclusionFileNameConfig@@QAE@ABV0@@Z
??0CExclusionFileNameConfig@@QAE@KK@Z
??0CExclusionFilePathConfig@@QAE@ABV0@@Z
??0CExclusionFilePathConfig@@QAE@KK@Z
??0CExclusionFolderConfig@@QAE@ABV0@@Z
??0CExclusionFolderConfig@@QAE@KK@Z
??0CExclusionRegistryConfig@@QAE@ABV0@@Z
??0CExclusionRegistryConfig@@QAE@KK@Z
??0CFile@@QAE@ABV0@@Z
??0CFile@@QAE@E@Z
??0CFileExtension@@QAE@ABV0@@Z
??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
??0CInclusionExtConfig@@QAE@ABV0@@Z
??0CInclusionExtConfig@@QAE@KKE@Z
??0CInclusionFileNameConfig@@QAE@ABV0@@Z
??0CInclusionFileNameConfig@@QAE@KK@Z
??0CInclusionFilePathConfig@@QAE@ABV0@@Z
??0CInclusionFilePathConfig@@QAE@KK@Z
??0CInclusionFolderConfig@@QAE@ABV0@@Z
??0CInclusionFolderConfig@@QAE@KK@Z
??0CKEvent@@QAE@ABV0@@Z
??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
??0CList@@QAE@ABV0@@Z
??0CList@@QAE@KPAVIMemoryAllocator@@@Z
??0CLockEvent@@QAE@ABV0@@Z
??0CLockEvent@@QAE@XZ
??0CLockList@@QAE@ABV0@@Z
??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QAE@ABV0@@Z
??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
??0CMemoryPoolAllocator@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@XZ
??0CModuleConfigList@@QAE@ABV0@@Z
??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QAE@ABV0@@Z
??0CModuleFileExtConfig@@QAE@KKE@Z
??0CModuleFlagConfig@@QAE@ABV0@@Z
??0CModuleFlagConfig@@QAE@K@Z
??0CModuleMultiStringConfig@@QAE@ABV0@@Z
??0CModuleMultiStringConfig@@QAE@KK@Z
??0CModuleStringConfig@@QAE@ABV0@@Z
??0CModuleStringConfig@@QAE@K@Z
??0CNoLockList@@QAE@ABV0@@Z
??0CNoLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CSmartLock@@QAE@AAVCLockEvent@@@Z
??0CSmartLock@@QAE@XZ
??0CSmartReference@@QAE@AAJ@Z
??0CSmartReference@@QAE@AAK@Z
??0CSmartResource@@QAE@AAVCResource@@E@Z
??0CStrList@@QAE@ABV0@@Z
??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
??0CSystemThread@@QAE@ABV0@@Z
??0CSystemThread@@QAE@K@Z
??0CUserFuncAdapterJob@@QAE@ABV0@@Z
??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z0@Z
??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@E@Z
??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
??0CWorkerThreadJobQueue@@QAE@K@Z
??0CWorkerThreadPool@@QAE@ABV0@@Z
??0CWorkerThreadPool@@QAE@K@Z
??0IMemoryAllocator@@QAE@ABV0@@Z
??0IMemoryAllocator@@QAE@XZ
??1CAutoUpdateConfigThread@@UAE@XZ
??1CBlobConfig@@UAE@XZ
??1CContext@@UAE@XZ
??1CContextList@@UAE@XZ
??1CDebugLog@@UAE@XZ
??1CDelayLoadThread@@UAE@XZ
??1CExclusionExtConfig@@UAE@XZ
??1CExclusionFileNameConfig@@UAE@XZ
??1CExclusionFilePathConfig@@UAE@XZ
??1CExclusionFolderConfig@@UAE@XZ
??1CExclusionRegistryConfig@@UAE@XZ
??1CFile@@UAE@XZ
??1CFileExtension@@UAE@XZ
??1CInclusionExtConfig@@UAE@XZ
??1CInclusionFileNameConfig@@UAE@XZ
??1CInclusionFilePathConfig@@UAE@XZ
??1CInclusionFolderConfig@@UAE@XZ
??1CKEvent@@UAE@XZ
??1CList@@UAE@XZ
??1CLockEvent@@UAE@XZ
??1CLockList@@UAE@XZ
??1CMemoryAllocator@@UAE@XZ
??1CMemoryPoolAllocator@@UAE@XZ
??1CModuleConfig@@UAE@XZ
??1CModuleConfigList@@UAE@XZ
??1CModuleFileExtConfig@@UAE@XZ
??1CModuleFlagConfig@@UAE@XZ
??1CModuleMultiStringConfig@@UAE@XZ
??1CModuleStringConfig@@UAE@XZ
??1CNoLockList@@UAE@XZ
??1CSmartLock@@QAE@XZ
??1CSmartReference@@QAE@XZ
??1CSmartResource@@QAE@XZ
??1CStrList@@UAE@XZ
??1CSystemThread@@UAE@XZ
??1CUserFuncAdapterJob@@UAE@XZ
??1CWorkerThread@@UAE@XZ
??1CWorkerThreadJob@@UAE@XZ
??1CWorkerThreadJobQueue@@UAE@XZ
??1CWorkerThreadPool@@UAE@XZ
??1IMemoryAllocator@@UAE@XZ
??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??2CMemoryAllocator@@SGPAXI@Z
??2CMemoryPoolAllocator@@SGPAXI@Z
??3@YAXPAX@Z
??3IMemoryAllocator@@SGXPAX@Z
??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
??4CBlobConfig@@QAEAAV0@ABV0@@Z
??4CContext@@QAEAAV0@ABV0@@Z
??4CDebugLog@@QAEAAV0@ABV0@@Z
??4CDelayLoadThread@@QAEAAV0@ABV0@@Z
??4CFile@@QAEAAV0@ABV0@@Z
??4CKEvent@@QAEAAV0@ABV0@@Z
??4CLockEvent@@QAEAAV0@ABV0@@Z
??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
??4CModuleConfig@@QAEAAV0@ABV0@@Z
??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
??4CSmartResource@@QAEAAV0@ABV0@@Z
??4CSystemThread@@QAEAAV0@ABV0@@Z
??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
??4CWorkerThread@@QAEAAV0@ABV0@@Z
??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CDelayLoadThread@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CInclusionExtConfig@@6B@
??_7CInclusionFileNameConfig@@6B@
??_7CInclusionFilePathConfig@@6B@
??_7CInclusionFolderConfig@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CNoLockList@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QAEXXZ
??_FCFile@@QAEXXZ
??_FCFileExtension@@QAEXXZ
??_FCModuleConfigList@@QAEXXZ
??_FCStrList@@QAEXXZ
??_FCSystemThread@@QAEXXZ
??_FCWorkerThread@@QAEXXZ
??_FCWorkerThreadJob@@QAEXXZ
??_FCWorkerThreadJobQueue@@QAEXXZ
??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??_V@YAXPAX@Z
?Acquire@CLockEvent@@QAEXXZ
?Add@CContextList@@QAEEPAVCContext@@@Z
?Add@CFileExtension@@QAEEPBGK@Z
?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
?Add@CStrList@@QAEEPBG@Z
?AddNode@CLockList@@UAEEQAXE@Z
?AddNode@CNoLockList@@UAEEQAXE@Z
?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QAEXXZ
?CheckNode@CLockList@@UAEHQAX@Z
?CheckNode@CNoLockList@@UAEHQAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
?Cleanup@CBlobConfig@@AAEXXZ
?Cleanup@CModuleFileExtConfig@@IAEXXZ
?Cleanup@CModuleMultiStringConfig@@IAEXXZ
?Cleanup@CModuleStringConfig@@AAEXXZ
?Close@CFile@@QAEJXZ
?Count@CLockList@@QAEKXZ
?Count@CNoLockList@@QAEKXZ
?Create@CFile@@QAEJPBGKKKK@Z
?Create@CSystemThread@@QAEEXZ
?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
?CreatePool@CWorkerThreadPool@@QAEEXZ
?CreateThreads@CWorkerThreadPool@@QAEEK@Z
?CreateWIRP@CFile@@QAEJPBGKKKK@Z
?Delete@CFile@@QAEJXZ
?Delete@CFileExtension@@QAEEPBGK@Z
?Delete@CStrList@@QAEEPBG@Z
?DeleteAll@CList@@UAEXXZ
?DeleteAll@CLockList@@UAEXXZ
?DeleteAll@CNoLockList@@UAEXXZ
?DeleteNode@CContextList@@MAEXPAX@Z
?DeleteNode@CList@@UAEXPAX@Z
?DeleteNode@CModuleConfigList@@MAEXPAX@Z
?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YGXPAPAX@Z
?DoIt@CWorkerThreadJob@@QAEJXZ
?EntryPoint@CSystemThread@@KGXPAX@Z
?Find@CContextList@@QAEPAVCContext@@K@Z
?Find@CContextList@@QAEPAVCContext@@PAX@Z
?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FindNode@CContextList@@IAEPAXPAX@Z
?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?First@CList@@UAEPAXXZ
?First@CLockList@@UAEPAXXZ
?First@CNoLockList@@UAEPAXXZ
?Free@CMemoryAllocator@@UAEXPAX@Z
?Free@CMemoryPoolAllocator@@UAEXPAX@Z
?GetAttributes@CFile@@QAEKXZ
?GetBasicInfomration@CFile@@IAEJXZ
?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
?GetCategory@CContext@@QAEKXZ
?GetData@CBlobConfig@@QAEHPAXPAK@Z
?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QAEKXZ
?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
?GetData@CModuleStringConfig@@QAEPAGXZ
?GetData@CStrList@@QAEEPAGPAK@Z
?GetDataType@CModuleConfig@@QAEKXZ
?GetEngineContext@CContext@@QAEPAXXZ
?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UAEJKPAK@Z
?GetID@CModuleConfig@@QAEKXZ
?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QAEKXZ
?GetLinkContext@CContext@@QAEPAXXZ
?GetLogFlag@CDebugLog@@QAEKXZ
?GetModuleId@CModuleConfig@@QAEKXZ
?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QAEKXZ
?GetSize@CBlobConfig@@QAEKXZ
?GetStringConfig@CContext@@QAEPAGK@Z
?GetStringConfig@CContext@@UAEJKPAGPAK@Z
?GetThreadCount@CWorkerThreadPool@@QAEKXZ
?GetThreadID@CSystemThread@@QAEKXZ
?GetType@CContext@@QAEKXZ
?GetUserParameter@CContext@@QAEKXZ
?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
?InitializeFlagConfig@CContext@@QAEHKK@Z
?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
?InitializeStringConfig@CContext@@QAEHKPBG@Z
?Insert@CList@@UAEXQAXE@Z
?Insert@CLockList@@UAEXQAXE@Z
?Insert@CNoLockList@@UAEXQAXE@Z
?InsertAfter@CList@@UAEXPAX0@Z
?InsertBefore@CList@@UAEXPAX0@Z
?Instance@CWorkerThreadPool@@SGPAV1@XZ
?IsEmpty@CList@@UAEEXZ
?IsEmpty@CLockList@@UAEEXZ
?IsEmpty@CNoLockList@@UAEEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
?IsFull@CLockList@@QBEEXZ
?IsFull@CNoLockList@@QBEEXZ
?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionExtConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFileNameConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFilePathConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFolderConfig@@QAEEPBG@Z
?IsOpened@CFile@@QAEEXZ
?IsTerminated@CWorkerThreadPool@@QAEEXZ
?IsValid@CMemoryAllocator@@UAEEXZ
?IsValid@CMemoryPoolAllocator@@UAEEXZ
?IsValid@IMemoryAllocator@@UAEEXZ
?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
?JobFunction@CUserFuncAdapterJob@@MAEXXZ
?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QAEKXZ
?Limit@CNoLockList@@QAEKXZ
?MatchAllExtensions@CFileExtension@@QAEEXZ
?MatchNoExtensions@CFileExtension@@QAEEXZ
?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
?NeedDelete@CWorkerThreadJob@@QAEEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
?NewNode@CList@@UAEPAXXZ
?NewNode@CStrList@@EAEPAXXZ
?NewNodeVariant@CList@@IAEPAXK@Z
?Next@CList@@UBEPAXQAX@Z
?Next@CLockList@@UBEPAXQAX@Z
?Next@CNoLockList@@UBEPAXQAX@Z
?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
?NotityTerminate@CWorkerThread@@QAEXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
?Pulse@CKEvent@@QAEJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
?Read@CFile@@QAEJPADKPAK@Z
?ReferenceCount@CContext@@QAEAAKXZ
?Release@CLockEvent@@QAEXXZ
?Remove@CContextList@@UAEEQAX@Z
?Remove@CList@@UAEEQAX@Z
?Remove@CLockList@@UAEEQAX@Z
?Remove@CNoLockList@@UAEEQAX@Z
?RemoveHead@CList@@UAEPAXXZ
?RemoveHead@CLockList@@UAEPAXXZ
?RemoveHead@CNoLockList@@UAEPAXXZ
?RemoveTail@CList@@UAEPAXXZ
?RemoveTail@CLockList@@UAEPAXXZ
?RemoveTail@CNoLockList@@UAEPAXXZ
?Reset@CKEvent@@QAEXXZ
?ResetData@CInclusionExtConfig@@QAEXXZ
?ResetData@CInclusionFileNameConfig@@QAEXXZ
?ResetData@CInclusionFilePathConfig@@QAEXXZ
?ResetData@CInclusionFolderConfig@@QAEXXZ
?RestoreCR0@@YGXPAX@Z
?Run@CAutoUpdateConfigThread@@UAEXXZ
?Run@CDelayLoadThread@@UAEXXZ
?Run@CWorkerThread@@UAEXXZ
?SeekToEnd@CFile@@QAEJXZ
?Set@CKEvent@@QAEJJE@Z
?SetAttributes@CFile@@QAEJK@Z
?SetBlobCofig@CContext@@UAEJKPAXK@Z
?SetData@CBlobConfig@@QAEHPAXK@Z
?SetData@CModuleFileExtConfig@@QAEHPBG@Z
?SetData@CModuleFlagConfig@@QAEHK@Z
?SetData@CModuleMultiStringConfig@@QAEHPBGK@Z
?SetData@CModuleStringConfig@@QAEHPBG@Z
?SetEngineContext@CContext@@QAEXPAX@Z
?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
?SetFlagConfig@CContext@@UAEJKK@Z
?SetLinkContext@CContext@@QAEXPAX@Z
?SetLogFlag@CDebugLog@@QAEEK@Z
?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
?SetMultiStringConfig@CContext@@UAEJKPBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
?SetPriority@CSystemThread@@QAEXK@Z
?SetStopUse@CContext@@QAEXXZ
?SetStringConfig@CContext@@UAEJKPBG@Z
?Setup@CSystemThread@@MAEXXZ
?StopUse@CContext@@QAEHXZ
?TearDown@CSystemThread@@MAEXXZ
?Terminate@CSystemThread@@QAEXE@Z
?Terminate@CWorkerThreadPool@@QAEEXZ
?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QAEXXZ
?WaitForInit@CDelayLoadThread@@QAEEXZ
?WaitForLoad@CDelayLoadThread@@QAEEXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
?Write@CDebugLog@@QAAXPBDZZ
?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
?WriteSystemInformation@CDebugLog@@QAEXXZ
?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
?WriteToFile@CDebugLog@@IAEXPADK@Z
?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
?_pPagedAllocator@@3PAVCMemoryAllocator@@A
?m_lpInstance@CWorkerThreadPool@@1PAV1@A
?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
_DeInitKmLPC@0
_GetModuleInfoByAddress@8
_GetModuleInfoByModuleName@8
_InitKmLPC@0
_KmCallUm@8
_KmCallUmEx@12
_ModGetExportProcAddress@8
_ModLoadDLLToBuffer@4
_ModLoadDLLToBufferWithImageSize@8
_ModLoadModule@8
_ModUnLoadModule@4
_NormalizeFileName@4
_NormalizeFullNtPathToDosName@4
_TmCommConfigRoutine@4
_UtilAddDeviceInDriveTable@4
_UtilCleanFileReadOnly@4
_UtilDeleteFileForce@4
_UtilGetFileObjectForProcessByEPROC@8
_UtilGetFileObjectFromFileName@12
_UtilGetProcessName@12
_UtilGetSystemDirectory@4
_UtilGetSystemDirectoryEx@0
_UtilGetSystemDirectoryLength@0
_UtilGetSystemTime@4
_UtilIoSetFileInfo@24
_UtilIopCreateFileIRP@40
_UtilKeGetLowFileDevice@16
_UtilModuleIATHook@24
_UtilModuleIATUnHook@8
_UtilQueryKeyValue@24
_UtilRemoveDeviceFromDriveTable@4
_UtilVolumeDeviceToDosName@8
_UtilWaitValueChangeToZero@8
_UtilWriteVersionToRegistry@8
_UtilbuildDynamicDiskMappingTable@0
_UtlWriteBinValueKeyToRegistry@16
__UtilDosPathNameToNtPathName@12

Sections

Expand

.text
.rdata
.data
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2012-11-13 04:31:43
MD5	46edb648c1b5c3abd76bd5e912dac026
SHA1	3f43412c563889a5f5350f415f7040a71cc25221
SHA256	97b32ddf83f75637e3ba934df117081dd6a1c57d47a4c9700d35e736da11d5bd
Authentihash MD5	24d18871ef8362a3fc2296f859f34793
Authentihash SHA1	fcd9d88abae49a60c462fdfb0cca8f1d105eb3b1
Authentihash SHA256	92bb92314ad69e9d118df55924ddab76b983029f1eae7739bbb098c6bea86ca1
RichPEHeaderHash MD5	758d7e589c3ed9801189755eeacb7853
RichPEHeaderHash SHA1	3489d3411a9549281a52875dd5b15c14d16fe035
RichPEHeaderHash SHA256	41392221145207e9cc769dfaeda0bfa63ee6babeb2d86771a48cc97bd0ab89c0
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	Trend Micro Eyes
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 79a2a585f9d1154213d9b83ef6b68ded

Field	Value
ToBeSigned (TBS) MD5	e6d820afb23af20a65cf0b03247ea05e
ToBeSigned (TBS) SHA1	7a8f7c37453f99390ee1e94bb5d3d1cba3a0eea7
ToBeSigned (TBS) SHA256	7e722dc40e6b9abf8c20aa4d887e34b6d2c6b8cbe53a055d49bf9f5e946e0d27
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G3
ValidFrom	2012-05-01 00:00:00
ValidTo	2012-12-31 23:59:59
Signature	1e98aa27b778b508b5c9726db7dfc00e98a635c488c9d2f66df14b1afbd5f92d99009ed1e79b8be13fbd39800c66cd07bc5c9854a694ba10d14e8babf56f65cc6709a2807c52e80e03d66b7ac60518ecc8ac427c072ca73d0866dc00edfd941d73f2729893b111d68fef8eeaacf496510cd08ddf31524f5eaf7da74a75e64ece2b9f292be7cf5d9f037e6e277b23ad622966af92e82ccebd9c7fdccd173c43c2093f7545c79ee4d7607f97c6e4aac769f5fccd74ac2cb048c1504e70561eb535d38ebeb1edacbdfe0cec857dd5bb856644195d9f93eb82ba639ed37c61ffc81bd923587f30a366a139265e92c33ccb3732faf5a38ddcd5b0a3e9253655d781fa
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	79a2a585f9d1154213d9b83ef6b68ded
Version	3

Certificate 47bf1995df8d524643f7db6d480d31a4

Field	Value
ToBeSigned (TBS) MD5	518d2ea8a21e879c942d504824ac211c
ToBeSigned (TBS) SHA1	21ce87d827077e61abddf2beba69fde5432ea031
ToBeSigned (TBS) SHA256	1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7
Subject	C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
ValidFrom	2003-12-04 00:00:00
ValidTo	2013-12-03 23:59:59
Signature	4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	47bf1995df8d524643f7db6d480d31a4
Version	3

Certificate 4d6290e58c54f0f1eb17341a1310e6a4

Field	Value
ToBeSigned (TBS) MD5	b7d8444a70054990435f35a5630df5e1
ToBeSigned (TBS) SHA1	4678c6e4a8787a8e6ed2bce8792b122f6c08afd8
ToBeSigned (TBS) SHA256	0a8b4b359ea7890b358e56e436e9cfc6f32b037b2599b597ca7f7a80d475ec98
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-09-30 00:00:00
ValidTo	2014-01-01 23:59:59
Signature	aedd211d5f8f807ad25209eadb6ed25d8be8c21b6904be51a5010e59fa37d174a3eedced89742b62d5a6bf4fad361754f013e0a345d24c26cbe26da21fd01e7a070fb6b37b6f5068a2e931b3b7997d8070a0a7de0b1ea4fff34d811bdd20c91cc4afcff18ffad9da95f0ecdc5cbfe88c5a3e7ab0a3eb59437411e09b1a6af36f
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	4d6290e58c54f0f1eb17341a1310e6a4
Version	3

Certificate 610c120600000000001b

Field	Value
ToBeSigned (TBS) MD5	53c41bc1164e09e0cd1617a5bf913efd
ToBeSigned (TBS) SHA1	93c03aac8951d494ecd5696b1c08658541b18727
ToBeSigned (TBS) SHA256	40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b
Subject	C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
ValidFrom	2006-05-23 17:01:29
ValidTo	2016-05-23 17:11:29
Signature	01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	610c120600000000001b
Version	3

Certificate 6326c00ead256b6837eeb29b5ee84720

Field	Value
ToBeSigned (TBS) MD5	11b208a45459069f827186fe81c6badd
ToBeSigned (TBS) SHA1	456356986e8ecbb7b05e4617d37cb8cd69ce4969
ToBeSigned (TBS) SHA256	4a0336d7ffa5db42ece4b342e1244f5c2bd0681827f68f847d99195c83740145
Subject	C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, OU=RD, CN=Trend Micro, Inc.
ValidFrom	2011-12-27 00:00:00
ValidTo	2013-02-15 23:59:59
Signature	840ba0fc35187fe2edc7b17c101fd2bf035bbad8f3de048e250741e96a3f4ecee86f1f065ea76f2f8f430a13a75ff3eab29a8b11a13006d27bf3173fa49aabf9cef98fc4554f1732317c4b821c740eb58a91977d85e86574dd712718b15d24f7eb88b6d4520aef788478e1ef8cebd7fff06fadbc87ca6ca2b77da85be3c30b4d590bcb8945a0acfa013f89073933494d9c465c0036280a5af39f6802e60bd175a2603366dd935cb3458b1791411a06b6e5f38e3171de4238051c79b33117cb94674d0625c402bdfb0f99b80625dc0f827911c6c11263884a4e41d1abf60070ad46b7296e19e1cfcda7304a650d7a814319cc11e5a947e82b2d00a169e798b871
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	6326c00ead256b6837eeb29b5ee84720
Version	3

Imports

Expand

ntoskrnl.exe

Imported Functions

Expand

KeLeaveCriticalRegion
wcsncpy
KeEnterCriticalRegion
ExAcquireFastMutexUnsafe
wcsrchr
ExAcquireResourceSharedLite
ExReleaseResourceLite
_purecall
ZwOpenEvent
RtlSubAuthoritySid
RtlLengthRequiredSid
ZwConnectPort
ExAllocatePoolWithTag
KeClearEvent
PsProcessType
ExFreePoolWithTag
ExReleaseFastMutex
ExAcquireFastMutex
RtlCreateAcl
RtlSetDaclSecurityDescriptor
RtlInitUnicodeString
KeSetEvent
ProbeForWrite
KeUnstackDetachProcess
RtlAddAccessAllowedAce
ZwRequestWaitReplyPort
ZwWaitForSingleObject
DbgBreakPoint
ZwSetEvent
IoGetCurrentProcess
ZwFreeVirtualMemory
ZwClose
KeInitializeSemaphore
KeWaitForSingleObject
KeReleaseSemaphore
RtlInitializeSid
ObfReferenceObject
ObfDereferenceObject
RtlUnicodeStringToInteger
ZwCreateSection
ObOpenObjectByPointer
KeStackAttachProcess
RtlCreateSecurityDescriptor
KePulseEvent
ZwAllocateVirtualMemory
PsThreadType
PsGetProcessExitTime
MmSectionObjectType
DbgPrint
ExDeleteResourceLite
ExInitializeResourceLite
ZwReadFile
swprintf
ZwSetInformationFile
ZwCreateFile
ZwQueryInformationFile
ZwWriteFile
_wcsnicmp
towupper
KeInitializeEvent
ZwCreateEvent
ZwCreateKey
ZwNotifyChangeKey
_snprintf
ExSystemTimeToLocalTime
_vsnprintf
ObReferenceObjectByHandle
RtlTimeToTimeFields
PsGetCurrentThreadId
PsGetCurrentProcessId
MmIsAddressValid
KeWaitForMultipleObjects
KeSetPriorityThread
PsCreateSystemThread
PsTerminateSystemThread
KeNumberProcessors
PsLookupProcessByProcessId
PsSetCreateProcessNotifyRoutine
ZwOpenDirectoryObject
KeDelayExecutionThread
ZwQueryInformationProcess
ExGetPreviousMode
ExReleaseFastMutexUnsafe
ZwQuerySystemInformation
ZwQueryValueKey
ZwOpenKey
_stricmp
_strnicmp
mbstowcs
ProbeForRead
_snwprintf
ZwQuerySymbolicLinkObject
ZwMapViewOfSection
MmGetSystemRoutineAddress
RtlAppendUnicodeToString
IoCreateFile
RtlQueryRegistryValues
RtlEqualUnicodeString
MmBuildMdlForNonPagedPool
ZwOpenSymbolicLinkObject
IoFreeMdl
RtlFreeUnicodeString
IoFileObjectType
ZwUnmapViewOfSection
NtClose
IoFreeIrp
PsGetVersion
IoAllocateIrp
RtlCopyUnicodeString
ZwOpenFile
RtlImageNtHeader
IoAllocateMdl
IofCallDriver
ZwQueryVolumeInformationFile
ObQueryNameString
ObReferenceObjectByPointer
IoDeleteSymbolicLink
IoDeleteDevice
ExEventObjectType
IofCompleteRequest
IoCreateSymbolicLink
IoGetDeviceObjectPointer
ObInsertObject
IoAcquireVpbSpinLock
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
IoReleaseVpbSpinLock
KeBugCheckEx
IoCreateDevice
ZwSetSecurityObject
IoDeviceObjectType
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
IoIsWdmVersionAvailable
SeExports
wcschr
RtlLengthSid
RtlGetSaclSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
ZwSetValueKey
ExAcquireResourceExclusiveLite
__C_specific_handler

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QEAA@AEBV0@@Z
??0CAutoUpdateConfigThread@@QEAA@PEAU_UNICODE_STRING@@P6AX0PEAX@Z1@Z
??0CBlobConfig@@QEAA@AEBV0@@Z
??0CBlobConfig@@QEAA@K@Z
??0CContext@@QEAA@AEBV0@@Z
??0CContext@@QEAA@KP6AJPEAU_EVENT_REPORT@@PEAXPEAU_TMCE_REPORT@@PEAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QEAA@AEBV0@@Z
??0CContextList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CDebugLog@@QEAA@AEBV0@@Z
??0CDebugLog@@QEAA@PEBG@Z
??0CDelayLoadThread@@QEAA@AEBV0@@Z
??0CDelayLoadThread@@QEAA@XZ
??0CExclusionExtConfig@@QEAA@AEBV0@@Z
??0CExclusionExtConfig@@QEAA@KKE@Z
??0CExclusionFileNameConfig@@QEAA@AEBV0@@Z
??0CExclusionFileNameConfig@@QEAA@KK@Z
??0CExclusionFilePathConfig@@QEAA@AEBV0@@Z
??0CExclusionFilePathConfig@@QEAA@KK@Z
??0CExclusionFolderConfig@@QEAA@AEBV0@@Z
??0CExclusionFolderConfig@@QEAA@KK@Z
??0CExclusionRegistryConfig@@QEAA@AEBV0@@Z
??0CExclusionRegistryConfig@@QEAA@KK@Z
??0CFile@@QEAA@AEBV0@@Z
??0CFile@@QEAA@E@Z
??0CFileExtension@@QEAA@AEBV0@@Z
??0CFileExtension@@QEAA@KEEPEAVIMemoryAllocator@@@Z
??0CInclusionExtConfig@@QEAA@AEBV0@@Z
??0CInclusionExtConfig@@QEAA@KKE@Z
??0CInclusionFileNameConfig@@QEAA@AEBV0@@Z
??0CInclusionFileNameConfig@@QEAA@KK@Z
??0CInclusionFilePathConfig@@QEAA@AEBV0@@Z
??0CInclusionFilePathConfig@@QEAA@KK@Z
??0CInclusionFolderConfig@@QEAA@AEBV0@@Z
??0CInclusionFolderConfig@@QEAA@KK@Z
??0CKEvent@@QEAA@AEBV0@@Z
??0CKEvent@@QEAA@W4_EVENT_TYPE@@E@Z
??0CList@@QEAA@AEBV0@@Z
??0CList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CLockEvent@@QEAA@AEBV0@@Z
??0CLockEvent@@QEAA@XZ
??0CLockList@@QEAA@AEBV0@@Z
??0CLockList@@QEAA@KKPEAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IEAA@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QEAA@AEBV0@@Z
??0CMemoryPoolAllocator@@IEAA@W4_POOL_TYPE@@_K1K@Z
??0CMemoryPoolAllocator@@QEAA@AEBV0@@Z
??0CModuleConfig@@QEAA@AEBV0@@Z
??0CModuleConfig@@QEAA@XZ
??0CModuleConfigList@@QEAA@AEBV0@@Z
??0CModuleConfigList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QEAA@AEBV0@@Z
??0CModuleFileExtConfig@@QEAA@KKE@Z
??0CModuleFlagConfig@@QEAA@AEBV0@@Z
??0CModuleFlagConfig@@QEAA@K@Z
??0CModuleMultiStringConfig@@QEAA@AEBV0@@Z
??0CModuleMultiStringConfig@@QEAA@KK@Z
??0CModuleStringConfig@@QEAA@AEBV0@@Z
??0CModuleStringConfig@@QEAA@K@Z
??0CNoLockList@@QEAA@AEBV0@@Z
??0CNoLockList@@QEAA@KKPEAVIMemoryAllocator@@@Z
??0CSmartLock@@QEAA@AEAVCLockEvent@@@Z
??0CSmartLock@@QEAA@XZ
??0CSmartReference@@QEAA@AEAJ@Z
??0CSmartReference@@QEAA@AEAK@Z
??0CSmartResource@@QEAA@AEAVCResource@@E@Z
??0CStrList@@QEAA@AEBV0@@Z
??0CStrList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CSystemThread@@QEAA@AEBV0@@Z
??0CSystemThread@@QEAA@K@Z
??0CUserFuncAdapterJob@@QEAA@AEBV0@@Z
??0CUserFuncAdapterJob@@QEAA@P6AXPEAX@Z0@Z
??0CWorkerThread@@IEAA@PEAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QEAA@AEBV0@@Z
??0CWorkerThreadJob@@QEAA@AEBV0@@Z
??0CWorkerThreadJob@@QEAA@E@Z
??0CWorkerThreadJobQueue@@QEAA@AEBV0@@Z
??0CWorkerThreadJobQueue@@QEAA@K@Z
??0CWorkerThreadPool@@QEAA@AEBV0@@Z
??0CWorkerThreadPool@@QEAA@K@Z
??0IMemoryAllocator@@QEAA@AEBV0@@Z
??0IMemoryAllocator@@QEAA@XZ
??1CAutoUpdateConfigThread@@UEAA@XZ
??1CBlobConfig@@UEAA@XZ
??1CContext@@UEAA@XZ
??1CContextList@@UEAA@XZ
??1CDebugLog@@UEAA@XZ
??1CDelayLoadThread@@UEAA@XZ
??1CExclusionExtConfig@@UEAA@XZ
??1CExclusionFileNameConfig@@UEAA@XZ
??1CExclusionFilePathConfig@@UEAA@XZ
??1CExclusionFolderConfig@@UEAA@XZ
??1CExclusionRegistryConfig@@UEAA@XZ
??1CFile@@UEAA@XZ
??1CFileExtension@@UEAA@XZ
??1CInclusionExtConfig@@UEAA@XZ
??1CInclusionFileNameConfig@@UEAA@XZ
??1CInclusionFilePathConfig@@UEAA@XZ
??1CInclusionFolderConfig@@UEAA@XZ
??1CKEvent@@UEAA@XZ
??1CList@@UEAA@XZ
??1CLockEvent@@UEAA@XZ
??1CLockList@@UEAA@XZ
??1CMemoryAllocator@@UEAA@XZ
??1CMemoryPoolAllocator@@UEAA@XZ
??1CModuleConfig@@UEAA@XZ
??1CModuleConfigList@@UEAA@XZ
??1CModuleFileExtConfig@@UEAA@XZ
??1CModuleFlagConfig@@UEAA@XZ
??1CModuleMultiStringConfig@@UEAA@XZ
??1CModuleStringConfig@@UEAA@XZ
??1CNoLockList@@UEAA@XZ
??1CSmartLock@@QEAA@XZ
??1CSmartReference@@QEAA@XZ
??1CSmartResource@@QEAA@XZ
??1CStrList@@UEAA@XZ
??1CSystemThread@@UEAA@XZ
??1CUserFuncAdapterJob@@UEAA@XZ
??1CWorkerThread@@UEAA@XZ
??1CWorkerThreadJob@@UEAA@XZ
??1CWorkerThreadJobQueue@@UEAA@XZ
??1CWorkerThreadPool@@UEAA@XZ
??1IMemoryAllocator@@UEAA@XZ
??2@YAPEAX_KPEAVIMemoryAllocator@@PEBDK@Z
??2CMemoryAllocator@@SAPEAX_K@Z
??2CMemoryPoolAllocator@@SAPEAX_K@Z
??3@YAXPEAX@Z
??3IMemoryAllocator@@SAXPEAX@Z
??4CAutoUpdateConfigThread@@QEAAAEAV0@AEBV0@@Z
??4CBlobConfig@@QEAAAEAV0@AEBV0@@Z
??4CContext@@QEAAAEAV0@AEBV0@@Z
??4CDebugLog@@QEAAAEAV0@AEBV0@@Z
??4CDelayLoadThread@@QEAAAEAV0@AEBV0@@Z
??4CFile@@QEAAAEAV0@AEBV0@@Z
??4CKEvent@@QEAAAEAV0@AEBV0@@Z
??4CLockEvent@@QEAAAEAV0@AEBV0@@Z
??4CMemoryAllocator@@QEAAAEAV0@AEBV0@@Z
??4CMemoryPoolAllocator@@QEAAAEAV0@AEBV0@@Z
??4CModuleConfig@@QEAAAEAV0@AEBV0@@Z
??4CModuleFlagConfig@@QEAAAEAV0@AEBV0@@Z
??4CModuleStringConfig@@QEAAAEAV0@AEBV0@@Z
??4CSmartLock@@QEAAAEAV0@AEBV0@@Z
??4CSmartLock@@QEAAAEBV0@AEAVCLockEvent@@@Z
??4CSmartResource@@QEAAAEAV0@AEBV0@@Z
??4CSystemThread@@QEAAAEAV0@AEBV0@@Z
??4CUserFuncAdapterJob@@QEAAAEAV0@AEBV0@@Z
??4CWorkerThread@@QEAAAEAV0@AEBV0@@Z
??4CWorkerThreadJob@@QEAAAEAV0@AEBV0@@Z
??4IMemoryAllocator@@QEAAAEAV0@AEBV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CDelayLoadThread@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CInclusionExtConfig@@6B@
??_7CInclusionFileNameConfig@@6B@
??_7CInclusionFilePathConfig@@6B@
??_7CInclusionFolderConfig@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CNoLockList@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QEAAXXZ
??_FCFile@@QEAAXXZ
??_FCFileExtension@@QEAAXXZ
??_FCModuleConfigList@@QEAAXXZ
??_FCStrList@@QEAAXXZ
??_FCSystemThread@@QEAAXXZ
??_FCWorkerThread@@QEAAXXZ
??_FCWorkerThreadJob@@QEAAXXZ
??_FCWorkerThreadJobQueue@@QEAAXXZ
??_U@YAPEAX_KPEAVIMemoryAllocator@@PEBDK@Z
??_V@YAXPEAX@Z
?Acquire@CLockEvent@@QEAAXXZ
?Add@CContextList@@QEAAEPEAVCContext@@@Z
?Add@CFileExtension@@QEAAEPEBGK@Z
?Add@CModuleConfigList@@QEAAEPEAVCModuleConfig@@@Z
?Add@CStrList@@QEAAEPEBG@Z
?AddNode@CLockList@@UEAAEQEAXE@Z
?AddNode@CNoLockList@@UEAAEQEAXE@Z
?Alloc@CMemoryAllocator@@UEAAPEAX_KPEBDK@Z
?Alloc@CMemoryPoolAllocator@@UEAAPEAX_KPEBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IEAAPEAX_K@Z
?AttachJobQueue@CWorkerThread@@QEAAXPEAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QEAAXXZ
?CheckNode@CLockList@@UEAAHQEAX@Z
?CheckNode@CNoLockList@@UEAAHQEAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QEAAXXZ
?Cleanup@CBlobConfig@@AEAAXXZ
?Cleanup@CModuleFileExtConfig@@IEAAXXZ
?Cleanup@CModuleMultiStringConfig@@IEAAXXZ
?Cleanup@CModuleStringConfig@@AEAAXXZ
?Close@CFile@@QEAAJXZ
?Count@CLockList@@QEAAKXZ
?Count@CNoLockList@@QEAAKXZ
?Create@CFile@@QEAAJPEBGKKKK@Z
?Create@CSystemThread@@QEAAEXZ
?CreateInstance@CMemoryAllocator@@SAPEAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SAPEAV1@W4_POOL_TYPE@@_K1K@Z
?CreatePool@CWorkerThreadPool@@QEAAEXZ
?CreateThreads@CWorkerThreadPool@@QEAAEK@Z
?CreateWIRP@CFile@@QEAAJPEBGKKKK@Z
?Delete@CFile@@QEAAJXZ
?Delete@CFileExtension@@QEAAEPEBGK@Z
?Delete@CStrList@@QEAAEPEBG@Z
?DeleteAll@CList@@UEAAXXZ
?DeleteAll@CLockList@@UEAAXXZ
?DeleteAll@CNoLockList@@UEAAXXZ
?DeleteNode@CContextList@@MEAAXPEAX@Z
?DeleteNode@CList@@UEAAXPEAX@Z
?DeleteNode@CModuleConfigList@@MEAAXPEAX@Z
?DeleteNode@CStrList@@EEAAXPEAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YAXPEAPEAX@Z
?DoIt@CWorkerThreadJob@@QEAAJXZ
?EntryPoint@CSystemThread@@KAXPEAX@Z
?Find@CContextList@@QEAAPEAVCContext@@K@Z
?Find@CContextList@@QEAAPEAVCContext@@PEAX@Z
?Find@CFileExtension@@QEAAPEAU_STR_LIST_NODE@CStrList@@PEBGK@Z
?Find@CModuleConfigList@@QEAAPEAVCModuleConfig@@K@Z
?Find@CStrList@@QEAAPEAU_STR_LIST_NODE@1@PEBG@Z
?FindNode@CContextList@@IEAAPEAXPEAX@Z
?FindPartiallyAndAllMatch@CStrList@@QEAAPEAU_STR_LIST_NODE@1@PEBG@Z
?First@CList@@UEAAPEAXXZ
?First@CLockList@@UEAAPEAXXZ
?First@CNoLockList@@UEAAPEAXXZ
?Free@CMemoryAllocator@@UEAAXPEAX@Z
?Free@CMemoryPoolAllocator@@UEAAXPEAX@Z
?GetAttributes@CFile@@QEAAKXZ
?GetBasicInfomration@CFile@@IEAAJXZ
?GetBlobCofig@CContext@@UEAAJKPEAXPEAK@Z
?GetCategory@CContext@@QEAAKXZ
?GetData@CBlobConfig@@QEAAHPEAXPEAK@Z
?GetData@CModuleFileExtConfig@@QEAAHPEAGPEAK@Z
?GetData@CModuleFileExtConfig@@QEAAPEAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QEAAKXZ
?GetData@CModuleMultiStringConfig@@QEAAHPEAGPEAK@Z
?GetData@CModuleMultiStringConfig@@QEAAPEAVCStrList@@XZ
?GetData@CModuleStringConfig@@QEAAPEAGXZ
?GetData@CStrList@@QEAAEPEAGPEAK@Z
?GetDataType@CModuleConfig@@QEAAKXZ
?GetEngineContext@CContext@@QEAAPEAXXZ
?GetFileExtensionConfig@CContext@@QEAAPEAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UEAAJKPEAGPEAK@Z
?GetFileSize@CFile@@QEAAJPEAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UEAAJKPEAK@Z
?GetID@CModuleConfig@@QEAAKXZ
?GetJob@CWorkerThreadJobQueue@@QEAAPEAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QEAAKXZ
?GetLinkContext@CContext@@QEAAPEAXXZ
?GetLogFlag@CDebugLog@@QEAAKXZ
?GetModuleId@CModuleConfig@@QEAAKXZ
?GetMultiStringConfig@CContext@@QEAAPEAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UEAAJKPEAGPEAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QEAAPEAU_ETHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QEAA_KXZ
?GetSize@CBlobConfig@@QEAAKXZ
?GetStringConfig@CContext@@QEAAPEAGK@Z
?GetStringConfig@CContext@@UEAAJKPEAGPEAK@Z
?GetThreadCount@CWorkerThreadPool@@QEAAKXZ
?GetThreadID@CSystemThread@@QEAA_KXZ
?GetType@CContext@@QEAAKXZ
?GetUserParameter@CContext@@QEAA_KXZ
?InitializeBlobConfig@CContext@@QEAAHKPEAXK@Z
?InitializeFileExtensionConfig@CContext@@QEAAHKPEBG@Z
?InitializeFlagConfig@CContext@@QEAAHKK@Z
?InitializeMultiStringConfig@CContext@@QEAAHKPEBG@Z
?InitializeStringConfig@CContext@@QEAAHKPEBG@Z
?Insert@CList@@UEAAXQEAXE@Z
?Insert@CLockList@@UEAAXQEAXE@Z
?Insert@CNoLockList@@UEAAXQEAXE@Z
?InsertAfter@CList@@UEAAXPEAX0@Z
?InsertBefore@CList@@UEAAXPEAX0@Z
?Instance@CWorkerThreadPool@@SAPEAV1@XZ
?IsEmpty@CList@@UEAAEXZ
?IsEmpty@CLockList@@UEAAEXZ
?IsEmpty@CNoLockList@@UEAAEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IEAAEK@Z
?IsFull@CLockList@@QEBAEXZ
?IsFull@CNoLockList@@QEBAEXZ
?IsInExclusionList@CExclusionExtConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionExtConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionFileNameConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionFilePathConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionFolderConfig@@QEAAEPEBG@Z
?IsOpened@CFile@@QEAAEXZ
?IsTerminated@CWorkerThreadPool@@QEAAEXZ
?IsValid@CMemoryAllocator@@UEAAEXZ
?IsValid@CMemoryPoolAllocator@@UEAAEXZ
?IsValid@IMemoryAllocator@@UEAAEXZ
?IsWorkerThread@CWorkerThreadPool@@QEAAE_K@Z
?JobFunction@CUserFuncAdapterJob@@MEAAXXZ
?JobQueue@CWorkerThreadPool@@QEAAAEAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QEAAKXZ
?Limit@CNoLockList@@QEAAKXZ
?MatchAllExtensions@CFileExtension@@QEAAEXZ
?MatchNoExtensions@CFileExtension@@QEAAEXZ
?MergeLeft@CMemoryPoolAllocator@@IEAAPEAXPEAX@Z
?MergeRight@CMemoryPoolAllocator@@IEAAPEAXPEAX@Z
?NeedDelete@CWorkerThreadJob@@QEAAEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QEAAXE@Z
?NewNode@CList@@UEAAPEAXXZ
?NewNode@CStrList@@EEAAPEAXXZ
?NewNodeVariant@CList@@IEAAPEAXK@Z
?Next@CList@@UEBAPEAXQEAX@Z
?Next@CLockList@@UEBAPEAXQEAX@Z
?Next@CNoLockList@@UEBAPEAXQEAX@Z
?NextPool@CMemoryPoolAllocator@@QEAAPEAV1@XZ
?NotityTerminate@CWorkerThread@@QEAAXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QEAAJP6AXPEAX@Z0E@Z
?Pulse@CKEvent@@QEAAJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QEAAEPEAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QEAAJPEAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SAPEAV1@XZ
?Read@CFile@@QEAAJPEADKPEAK@Z
?ReferenceCount@CContext@@QEAAAEAKXZ
?Release@CLockEvent@@QEAAXXZ
?Remove@CContextList@@UEAAEQEAX@Z
?Remove@CList@@UEAAEQEAX@Z
?Remove@CLockList@@UEAAEQEAX@Z
?Remove@CNoLockList@@UEAAEQEAX@Z
?RemoveHead@CList@@UEAAPEAXXZ
?RemoveHead@CLockList@@UEAAPEAXXZ
?RemoveHead@CNoLockList@@UEAAPEAXXZ
?RemoveTail@CList@@UEAAPEAXXZ
?RemoveTail@CLockList@@UEAAPEAXXZ
?RemoveTail@CNoLockList@@UEAAPEAXXZ
?Reset@CKEvent@@QEAAXXZ
?ResetData@CInclusionExtConfig@@QEAAXXZ
?ResetData@CInclusionFileNameConfig@@QEAAXXZ
?ResetData@CInclusionFilePathConfig@@QEAAXXZ
?ResetData@CInclusionFolderConfig@@QEAAXXZ
?RestoreCR0@@YAXPEAX@Z
?Run@CAutoUpdateConfigThread@@UEAAXXZ
?Run@CDelayLoadThread@@UEAAXXZ
?Run@CWorkerThread@@UEAAXXZ
?SeekToEnd@CFile@@QEAAJXZ
?Set@CKEvent@@QEAAJJE@Z
?SetAttributes@CFile@@QEAAJK@Z
?SetBlobCofig@CContext@@UEAAJKPEAXK@Z
?SetData@CBlobConfig@@QEAAHPEAXK@Z
?SetData@CModuleFileExtConfig@@QEAAHPEBG@Z
?SetData@CModuleFlagConfig@@QEAAHK@Z
?SetData@CModuleMultiStringConfig@@QEAAHPEBGK@Z
?SetData@CModuleStringConfig@@QEAAHPEBG@Z
?SetEngineContext@CContext@@QEAAXPEAX@Z
?SetFileExtensionConfig@CContext@@UEAAJKPEBG@Z
?SetFlagConfig@CContext@@UEAAJKK@Z
?SetLinkContext@CContext@@QEAAXPEAX@Z
?SetLogFlag@CDebugLog@@QEAAEK@Z
?SetMatchAllExtensions@CFileExtension@@QEAAXE@Z
?SetMatchNoExtensions@CFileExtension@@QEAAXE@Z
?SetMultiStringConfig@CContext@@UEAAJKPEBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QEAAXXZ
?SetPriority@CSystemThread@@QEAAXK@Z
?SetStopUse@CContext@@QEAAXXZ
?SetStringConfig@CContext@@UEAAJKPEBG@Z
?Setup@CSystemThread@@MEAAXXZ
?StopUse@CContext@@QEAAHXZ
?TearDown@CSystemThread@@MEAAXXZ
?Terminate@CSystemThread@@QEAAXE@Z
?Terminate@CWorkerThreadPool@@QEAAEXZ
?TmExceptionFilter@@YAJPEAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QEAAJPEAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QEAAXXZ
?WaitForInit@CDelayLoadThread@@QEAAEXZ
?WaitForLoad@CDelayLoadThread@@QEAAEXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QEAAEXZ
?Write@CDebugLog@@QEAAXPEBDZZ
?Write@CFile@@QEAAJPEADKPEAT_LARGE_INTEGER@@PEAK@Z
?WriteSystemInformation@CDebugLog@@QEAAXXZ
?WriteSystemStringInformation@CDebugLog@@IEAAXPEBG@Z
?WriteToFile@CDebugLog@@IEAAXPEADK@Z
?_pNonPagedAllocator@@3PEAVCMemoryAllocator@@EA
?_pPagedAllocator@@3PEAVCMemoryAllocator@@EA
?m_lpInstance@CWorkerThreadPool@@1PEAV1@EA
?m_lpRCMInstance@CWorkerThreadPool@@1PEAV1@EA
DeInitKmLPC
GetModuleInfoByAddress
GetModuleInfoByModuleName
InitKmLPC
KmCallUm
KmCallUmEx
ModGetExportProcAddress
ModLoadDLLToBuffer
ModLoadDLLToBufferWithImageSize
ModLoadModule
ModUnLoadModule
NormalizeFileName
NormalizeFullNtPathToDosName
TmCommConfigRoutine
UtilAddDeviceInDriveTable
UtilDeleteFileForce
UtilGetFileObjectForProcessByEPROC
UtilGetFileObjectFromFileName
UtilGetProcessName
UtilGetSystemDirectory
UtilGetSystemDirectoryEx
UtilGetSystemDirectoryLength
UtilGetSystemTime
UtilIoSetFileInfo
UtilIopCreateFileIRP
UtilKeGetLowFileDevice
UtilModuleIATHook
UtilModuleIATUnHook
UtilQueryKeyValue
UtilRemoveDeviceFromDriveTable
UtilVolumeDeviceToDosName
UtilWaitValueChangeToZero
UtilWriteVersionToRegistry
UtilbuildDynamicDiskMappingTable
UtlWriteBinValueKeyToRegistry
_UtilDosPathNameToNtPathName

Sections

Expand

.text
.rdata
.data
.pdata
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2008-10-27 22:11:08
MD5	2ddd3c0e23bc0fd63702910c597298b4
SHA1	3fd7fda9c7dfdb2a845c39971572bd090bee3b1d
SHA256	a8027daa6facf1ff81405daf6763249e9acf232a1a191b6bf106711630e6188e
Authentihash MD5	007d2afd1aa5ebcd3cfa447087156319
Authentihash SHA1	a3e23bd4ea435781eb394581ac3fa1fe27e074ec
Authentihash SHA256	886b28af7d2907a61720da0b6ea5d88a9a8512ceb120e88889f3fedd6bf313b4
RichPEHeaderHash MD5	fd5680b44e33c644adb2a11aaf9c107b
RichPEHeaderHash SHA1	797adadf7d576be425cefa156494b0e490b2fc81
RichPEHeaderHash SHA256	bf0ee0f8675bb1fbe955bd5eedb7f49b38a8af2e99a9f101d826baf830fe6c55
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	AEGIS
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 3825d7faf861af9ef490e726b5d65ad5

Field	Value
ToBeSigned (TBS) MD5	d6c7684e9aaa508cf268335f83afe040
ToBeSigned (TBS) SHA1	18066d20ad92409c567cdfde745279ff71c75226
ToBeSigned (TBS) SHA256	a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff
Subject	C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2
ValidFrom	2007-06-15 00:00:00
ValidTo	2012-06-14 23:59:59
Signature	50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	3825d7faf861af9ef490e726b5d65ad5
Version	3

Certificate 47bf1995df8d524643f7db6d480d31a4

Field	Value
ToBeSigned (TBS) MD5	518d2ea8a21e879c942d504824ac211c
ToBeSigned (TBS) SHA1	21ce87d827077e61abddf2beba69fde5432ea031
ToBeSigned (TBS) SHA256	1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7
Subject	C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
ValidFrom	2003-12-04 00:00:00
ValidTo	2013-12-03 23:59:59
Signature	4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	47bf1995df8d524643f7db6d480d31a4
Version	3

Certificate 4191a15a3978dfcf496566381d4c75c2

Field	Value
ToBeSigned (TBS) MD5	41011f8d0e7c7a6408334ca387914c61
ToBeSigned (TBS) SHA1	c7fc1727f5b75a6421a1f95c73bbdb23580c48e5
ToBeSigned (TBS) SHA256	88dd3952638ee82738c03168e6fd863fe4eab1059ee5e2926ad8cb587c255dc0
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA
ValidFrom	2004-07-16 00:00:00
ValidTo	2014-07-15 23:59:59
Signature	ae3a17b84a7b55fa6455ec40a4ed494190999c89bcaf2e1dca7823f91c190f7feb68bc32d98838dedc3fd389b43fb18296f1a45abaed2e26d3de7c016e000a00a4069211480940f91c1879672324e0bbd5e150ae1bf50edde02e81cd80a36c524f9175558aba22f2d2ea4175882f63557d1e545a9559cad93481c05f5ef67ab5
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	4191a15a3978dfcf496566381d4c75c2
Version	3

Certificate 645212f783f4d7aba3555729e99ce065

Field	Value
ToBeSigned (TBS) MD5	e00f0a38c65f7c0b9f19b97448d6a0e3
ToBeSigned (TBS) SHA1	91c033a2f289418c4101654dceacef1b25bb55d0
ToBeSigned (TBS) SHA256	38b3fcbdb734b0e3439f3c9a3c4c1712091f577d2b616d41224137faf7ba7c86
Subject	C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, OU=RD, CN=Trend Micro, Inc.
ValidFrom	2008-01-16 00:00:00
ValidTo	2011-02-16 23:59:59
Signature	5a693868cea6ba49064b801a0d9e12887a37cbb92cca2950cc5e99c2df9aec5697422e67cd042836daf09a09e739f625255841fed1ec9657cb8b3edc08c55c302574cbdb3f7de2798ed769d766402619b48041f9d90f8c904488788412b1c632055e1afc4a5bbac642cb626bd20fece0feaa6cf9b287887788cf64586309a14a644b5f0595c0ddcb7d789831faedb48451e40e342da4ccbc38a5e992e57e7ce5328d531a8c68e61f9dc9be65605c1bedf3358579000b91a19b3be388bac36b58ca76b72358bd8e74e0a7b08b0587bb7a29758c01af40b80e8e72c76abd3a2babfe7c1ed6e7b1cd9b0221a605062b6d9d0ceb57e0eb305fdc5eb5bf6ea442f4c9
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	645212f783f4d7aba3555729e99ce065
Version	3

Certificate 610c120600000000001b

Field	Value
ToBeSigned (TBS) MD5	53c41bc1164e09e0cd1617a5bf913efd
ToBeSigned (TBS) SHA1	93c03aac8951d494ecd5696b1c08658541b18727
ToBeSigned (TBS) SHA256	40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b
Subject	C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
ValidFrom	2006-05-23 17:01:29
ValidTo	2016-05-23 17:11:29
Signature	01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	610c120600000000001b
Version	3

Imports

Expand

ntoskrnl.exe
CLASSPNP.SYS

Imported Functions

Expand

KeEnterCriticalRegion
KeGetCurrentThread
KeLeaveCriticalRegion
ExReleaseFastMutexUnsafe
wcsncpy
memcpy
wcsrchr
KeSetEvent
KePulseEvent
KeClearEvent
KeInitializeSemaphore
KeWaitForSingleObject
DbgPrint
KeReleaseSemaphore
RtlSubAuthoritySid
RtlInitializeSid
ExAllocatePoolWithTag
RtlLengthRequiredSid
ExFreePoolWithTag
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
ObfDereferenceObject
ZwSetEvent
ZwClose
KeUnstackDetachProcess
ZwRequestWaitReplyPort
memmove
KeStackAttachProcess
ZwConnectPort
RtlInitUnicodeString
ZwCreateSection
ZwWaitForSingleObject
ZwOpenEvent
ObfReferenceObject
IoGetCurrentProcess
memset
MmIsAddressValid
ZwWriteFile
ZwReadFile
ZwQueryInformationFile
ZwSetInformationFile
ZwCreateFile
swprintf
towupper
_wcsnicmp
KeInitializeEvent
_snprintf
PsGetCurrentProcessId
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
ZwCreateKey
ZwCreateEvent
KeWaitForMultipleObjects
ObReferenceObjectByHandle
ZwNotifyChangeKey
PsGetCurrentThreadId
_vsnprintf
MmMapLockedPagesSpecifyCache
MmBuildMdlForNonPagedPool
MmCreateMdl
MmUnmapLockedPages
KeSetPriorityThread
PsTerminateSystemThread
PsCreateSystemThread
KeNumberProcessors
ZwQuerySystemInformation
ZwQueryDirectoryFile
ZwOpenDirectoryObject
ZwQueryDirectoryObject
ZwDuplicateObject
ZwOpenKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryValueKey
ZwDeleteValueKey
ZwDeleteKey
ExGetPreviousMode
ExAcquireFastMutexUnsafe
ObOpenObjectByPointer
PsProcessType
ZwOpenProcess
ZwQueryKey
ZwSetValueKey
IoFreeIrp
IoBuildAsynchronousFsdRequest
ProbeForWrite
_stricmp
RtlImageNtHeader
_strnicmp
RtlQueryRegistryValues
RtlAppendUnicodeToString
KeDelayExecutionThread
mbstowcs
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
RtlEqualUnicodeString
IoFileObjectType
IoCreateFile
IofCallDriver
IoAllocateIrp
IoFreeMdl
IoAllocateMdl
PsGetVersion
MmGetSystemRoutineAddress
RtlCompareMemory
RtlCopyUnicodeString
KeBugCheckEx
RtlAppendUnicodeStringToString
IofCompleteRequest
ExEventObjectType
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
ProbeForRead
IoGetDeviceObjectPointer
ExAllocatePool
RtlUpperChar
RtlCompareUnicodeString
PsLookupProcessByProcessId
strncpy
KeServiceDescriptorTable
NtOpenProcess
ObReferenceObjectByPointer
MmSectionObjectType
ObQueryNameString
ObOpenObjectByName
NtQueryInformationProcess
_snwprintf
RtlAnsiStringToUnicodeString
KeAddSystemServiceTable
ZwQueryObject
ZwQuerySecurityObject
ObInsertObject
_allrem
IoReleaseVpbSpinLock
IoAcquireVpbSpinLock
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
KeTickCount
RtlUnwind
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
RtlLengthSid
wcschr
RtlAbsoluteToSelfRelativeSD
RtlFreeUnicodeString
ZwTerminateProcess
_purecall
ClassInitialize

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
??0CBlobConfig@@QAE@ABV0@@Z
??0CBlobConfig@@QAE@K@Z
??0CContext@@QAE@ABV0@@Z
??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QAE@ABV0@@Z
??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
??0CDebugLog@@QAE@ABV0@@Z
??0CDebugLog@@QAE@PBG@Z
??0CExclusionExtConfig@@QAE@ABV0@@Z
??0CExclusionExtConfig@@QAE@KKE@Z
??0CExclusionFileNameConfig@@QAE@ABV0@@Z
??0CExclusionFileNameConfig@@QAE@KK@Z
??0CExclusionFilePathConfig@@QAE@ABV0@@Z
??0CExclusionFilePathConfig@@QAE@KK@Z
??0CExclusionFolderConfig@@QAE@ABV0@@Z
??0CExclusionFolderConfig@@QAE@KK@Z
??0CExclusionRegistryConfig@@QAE@ABV0@@Z
??0CExclusionRegistryConfig@@QAE@KK@Z
??0CFile@@QAE@ABV0@@Z
??0CFile@@QAE@E@Z
??0CFileExtension@@QAE@ABV0@@Z
??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
??0CKEvent@@QAE@ABV0@@Z
??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
??0CList@@QAE@ABV0@@Z
??0CList@@QAE@KPAVIMemoryAllocator@@@Z
??0CLockEvent@@QAE@ABV0@@Z
??0CLockEvent@@QAE@XZ
??0CLockList@@QAE@ABV0@@Z
??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QAE@ABV0@@Z
??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
??0CMemoryPoolAllocator@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@XZ
??0CModuleConfigList@@QAE@ABV0@@Z
??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QAE@ABV0@@Z
??0CModuleFileExtConfig@@QAE@KKE@Z
??0CModuleFlagConfig@@QAE@ABV0@@Z
??0CModuleFlagConfig@@QAE@K@Z
??0CModuleMultiStringConfig@@QAE@ABV0@@Z
??0CModuleMultiStringConfig@@QAE@KK@Z
??0CModuleStringConfig@@QAE@ABV0@@Z
??0CModuleStringConfig@@QAE@K@Z
??0CSmartLock@@QAE@AAVCLockEvent@@@Z
??0CSmartLock@@QAE@XZ
??0CSmartReference@@QAE@AAJ@Z
??0CSmartReference@@QAE@AAK@Z
??0CStrList@@QAE@ABV0@@Z
??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
??0CSystemThread@@QAE@ABV0@@Z
??0CSystemThread@@QAE@K@Z
??0CUserFuncAdapterJob@@QAE@ABV0@@Z
??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z0@Z
??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@E@Z
??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
??0CWorkerThreadJobQueue@@QAE@K@Z
??0CWorkerThreadPool@@QAE@ABV0@@Z
??0CWorkerThreadPool@@QAE@K@Z
??0IMemoryAllocator@@QAE@ABV0@@Z
??0IMemoryAllocator@@QAE@XZ
??1CAutoUpdateConfigThread@@UAE@XZ
??1CBlobConfig@@UAE@XZ
??1CContext@@UAE@XZ
??1CContextList@@UAE@XZ
??1CDebugLog@@UAE@XZ
??1CExclusionExtConfig@@UAE@XZ
??1CExclusionFileNameConfig@@UAE@XZ
??1CExclusionFilePathConfig@@UAE@XZ
??1CExclusionFolderConfig@@UAE@XZ
??1CExclusionRegistryConfig@@UAE@XZ
??1CFile@@UAE@XZ
??1CFileExtension@@UAE@XZ
??1CKEvent@@UAE@XZ
??1CList@@UAE@XZ
??1CLockEvent@@UAE@XZ
??1CLockList@@UAE@XZ
??1CMemoryAllocator@@UAE@XZ
??1CMemoryPoolAllocator@@UAE@XZ
??1CModuleConfig@@UAE@XZ
??1CModuleConfigList@@UAE@XZ
??1CModuleFileExtConfig@@UAE@XZ
??1CModuleFlagConfig@@UAE@XZ
??1CModuleMultiStringConfig@@UAE@XZ
??1CModuleStringConfig@@UAE@XZ
??1CSmartLock@@QAE@XZ
??1CSmartReference@@QAE@XZ
??1CStrList@@UAE@XZ
??1CSystemThread@@UAE@XZ
??1CUserFuncAdapterJob@@UAE@XZ
??1CWorkerThread@@UAE@XZ
??1CWorkerThreadJob@@UAE@XZ
??1CWorkerThreadJobQueue@@UAE@XZ
??1CWorkerThreadPool@@UAE@XZ
??1IMemoryAllocator@@UAE@XZ
??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??2CMemoryAllocator@@SGPAXI@Z
??2CMemoryPoolAllocator@@SGPAXI@Z
??3@YAXPAX@Z
??3IMemoryAllocator@@SGXPAX@Z
??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
??4CBlobConfig@@QAEAAV0@ABV0@@Z
??4CContext@@QAEAAV0@ABV0@@Z
??4CDebugLog@@QAEAAV0@ABV0@@Z
??4CFile@@QAEAAV0@ABV0@@Z
??4CKEvent@@QAEAAV0@ABV0@@Z
??4CLockEvent@@QAEAAV0@ABV0@@Z
??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
??4CModuleConfig@@QAEAAV0@ABV0@@Z
??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
??4CSystemThread@@QAEAAV0@ABV0@@Z
??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
??4CWorkerThread@@QAEAAV0@ABV0@@Z
??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QAEXXZ
??_FCFile@@QAEXXZ
??_FCFileExtension@@QAEXXZ
??_FCModuleConfigList@@QAEXXZ
??_FCStrList@@QAEXXZ
??_FCSystemThread@@QAEXXZ
??_FCWorkerThread@@QAEXXZ
??_FCWorkerThreadJob@@QAEXXZ
??_FCWorkerThreadJobQueue@@QAEXXZ
??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??_V@YAXPAX@Z
?Acquire@CLockEvent@@QAEXXZ
?Add@CContextList@@QAEEPAVCContext@@@Z
?Add@CFileExtension@@QAEEPBGK@Z
?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
?Add@CStrList@@QAEEPBG@Z
?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QAEXXZ
?CheckNode@CLockList@@UAEHQAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
?Cleanup@CBlobConfig@@AAEXXZ
?Cleanup@CModuleFileExtConfig@@IAEXXZ
?Cleanup@CModuleMultiStringConfig@@IAEXXZ
?Cleanup@CModuleStringConfig@@AAEXXZ
?Close@CFile@@QAEJXZ
?Count@CLockList@@QAEKXZ
?Create@CFile@@QAEJPBGKKKK@Z
?Create@CSystemThread@@QAEEXZ
?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
?CreatePool@CWorkerThreadPool@@QAEEXZ
?CreateThreads@CWorkerThreadPool@@QAEEK@Z
?CreateWIRP@CFile@@QAEJPBGKKKK@Z
?Delete@CFile@@QAEJXZ
?Delete@CFileExtension@@QAEEPBGK@Z
?Delete@CStrList@@QAEEPBG@Z
?DeleteAll@CList@@UAEXXZ
?DeleteAll@CLockList@@UAEXXZ
?DeleteNode@CContextList@@MAEXPAX@Z
?DeleteNode@CList@@UAEXPAX@Z
?DeleteNode@CModuleConfigList@@MAEXPAX@Z
?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YGXPAPAX@Z
?DoIt@CWorkerThreadJob@@QAEJXZ
?EntryPoint@CSystemThread@@KGXPAX@Z
?Find@CContextList@@QAEPAVCContext@@K@Z
?Find@CContextList@@QAEPAVCContext@@PAX@Z
?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FindNode@CContextList@@IAEPAXPAX@Z
?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?First@CList@@UAEPAXXZ
?First@CLockList@@UAEPAXXZ
?Free@CMemoryAllocator@@UAEXPAX@Z
?Free@CMemoryPoolAllocator@@UAEXPAX@Z
?GetAttributes@CFile@@QAEKXZ
?GetBasicInfomration@CFile@@IAEJXZ
?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
?GetCategory@CContext@@QAEKXZ
?GetData@CBlobConfig@@QAEHPAXPAK@Z
?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QAEKXZ
?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
?GetData@CModuleStringConfig@@QAEPAGXZ
?GetData@CStrList@@QAEEPAGPAK@Z
?GetDataType@CModuleConfig@@QAEKXZ
?GetEngineContext@CContext@@QAEPAXXZ
?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UAEJKPAK@Z
?GetID@CModuleConfig@@QAEKXZ
?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QAEKXZ
?GetLinkContext@CContext@@QAEPAXXZ
?GetLogFlag@CDebugLog@@QAEKXZ
?GetModuleId@CModuleConfig@@QAEKXZ
?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QAEKXZ
?GetSize@CBlobConfig@@QAEKXZ
?GetStringConfig@CContext@@QAEPAGK@Z
?GetStringConfig@CContext@@UAEJKPAGPAK@Z
?GetThreadCount@CWorkerThreadPool@@QAEKXZ
?GetThreadID@CSystemThread@@QAEKXZ
?GetType@CContext@@QAEKXZ
?GetUserParameter@CContext@@QAEKXZ
?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
?InitializeFlagConfig@CContext@@QAEHKK@Z
?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
?InitializeStringConfig@CContext@@QAEHKPBG@Z
?Insert@CList@@UAEXQAXE@Z
?Insert@CLockList@@UAEXQAXE@Z
?InsertAfter@CList@@UAEXPAX0@Z
?InsertBefore@CList@@UAEXPAX0@Z
?InsertEx@CLockList@@UAEEQAXE@Z
?Instance@CWorkerThreadPool@@SGPAV1@XZ
?IsEmpty@CList@@UAEEXZ
?IsEmpty@CLockList@@UAEEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
?IsFull@CLockList@@QBEEXZ
?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
?IsOpened@CFile@@QAEEXZ
?IsTerminated@CWorkerThreadPool@@QAEEXZ
?IsValid@CMemoryAllocator@@UAEEXZ
?IsValid@CMemoryPoolAllocator@@UAEEXZ
?IsValid@IMemoryAllocator@@UAEEXZ
?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
?JobFunction@CUserFuncAdapterJob@@MAEXXZ
?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QAEKXZ
?MatchAllExtensions@CFileExtension@@QAEEXZ
?MatchNoExtensions@CFileExtension@@QAEEXZ
?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
?NeedDelete@CWorkerThreadJob@@QAEEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
?NewNode@CList@@UAEPAXXZ
?NewNode@CStrList@@EAEPAXXZ
?NewNodeVariant@CList@@IAEPAXK@Z
?Next@CList@@UBEPAXQAX@Z
?Next@CLockList@@UBEPAXQAX@Z
?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
?NotityTerminate@CWorkerThread@@QAEXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
?Pulse@CKEvent@@QAEJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
?Read@CFile@@QAEJPADKPAK@Z
?ReferenceCount@CContext@@QAEAAKXZ
?Release@CLockEvent@@QAEXXZ
?Remove@CContextList@@UAEEQAX@Z
?Remove@CList@@UAEEQAX@Z
?Remove@CLockList@@UAEEQAX@Z
?RemoveHead@CList@@UAEPAXXZ
?RemoveHead@CLockList@@UAEPAXXZ
?RemoveTail@CList@@UAEPAXXZ
?RemoveTail@CLockList@@UAEPAXXZ
?Reset@CKEvent@@QAEXXZ
?RestoreCR0@@YGXPAX@Z
?Run@CAutoUpdateConfigThread@@UAEXXZ
?Run@CWorkerThread@@UAEXXZ
?SeekToEnd@CFile@@QAEJXZ
?Set@CKEvent@@QAEJJE@Z
?SetAttributes@CFile@@QAEJK@Z
?SetBlobCofig@CContext@@UAEJKPAXK@Z
?SetData@CBlobConfig@@QAEHPAXK@Z
?SetData@CModuleFileExtConfig@@QAEHPBG@Z
?SetData@CModuleFlagConfig@@QAEHK@Z
?SetData@CModuleMultiStringConfig@@QAEHPBG@Z
?SetData@CModuleStringConfig@@QAEHPBG@Z
?SetEngineContext@CContext@@QAEXPAX@Z
?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
?SetFlagConfig@CContext@@UAEJKK@Z
?SetLinkContext@CContext@@QAEXPAX@Z
?SetLogFlag@CDebugLog@@QAEEK@Z
?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
?SetMultiStringConfig@CContext@@UAEJKPBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
?SetPriority@CSystemThread@@QAEXK@Z
?SetStopUse@CContext@@QAEXXZ
?SetStringConfig@CContext@@UAEJKPBG@Z
?Setup@CSystemThread@@MAEXXZ
?StopUse@CContext@@QAEHXZ
?TearDown@CSystemThread@@MAEXXZ
?Terminate@CSystemThread@@QAEXE@Z
?Terminate@CWorkerThreadPool@@QAEEXZ
?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QAEXXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
?Write@CDebugLog@@QAAXPBDZZ
?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
?WriteSystemInformation@CDebugLog@@QAEXXZ
?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
?WriteToFile@CDebugLog@@IAEXPADK@Z
?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
?_pPagedAllocator@@3PAVCMemoryAllocator@@A
?m_lpInstance@CWorkerThreadPool@@1PAV1@A
?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
_DeInitKmLPC@0
_GetModuleInfoByAddress@8
_GetModuleInfoByModuleName@8
_InitKmLPC@0
_KmCallUm@8
_MapMem@12
_ModGetExportProcAddress@8
_ModLoadDLLToBuffer@4
_ModLoadModule@8
_ModUnLoadModule@4
_NormalizeFileName@4
_NormalizeFullNtPathToDosName@4
_TmCommConfigRoutine@4
_UnMapMem@8
_UtilGetFileObjectForProcessByEPROC@8
_UtilGetProcessName@12
_UtilGetSystemTime@4
_UtilIoSetFileInfo@24
_UtilIopCreateFileIRP@40
_UtilKeGetLowFileDevice@16
_UtilQueryKeyValue@24
_UtilVolumeDeviceToDosName@8
_UtilWaitValueChangeToZero@8
_UtilWriteVersionToRegistry@8
_UtilbuildDynamicDiskMappingTable@0
__UtilDosPathNameToNtPathName@12

Sections

Expand

.text
.rdata
.data
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2007-01-24 02:45:21
MD5	3e4a1384a27013ab7b767a88b8a1bd34
SHA1	ae344c123ef6d206235f2a8448d07f86433db5a6
SHA256	a903f329b70f0078197cb7683aae1bb432eaf58572fe572f7cb4bc2080042d7e
Authentihash MD5	32f1d8b0fca32fd72a762cfa58870978
Authentihash SHA1	aef6765d5e4281854562e8e88cc09f5571ab17bc
Authentihash SHA256	2ffbb534c73106a2879d5a9d4ad3436c8d3ab8ac6aa8b217e26a6492fa1d16d0
RichPEHeaderHash MD5	ff2bc468594df99870a9307d5333053d
RichPEHeaderHash SHA1	9f3851edc3496cf5959366adf6f791fc32b797bb
RichPEHeaderHash SHA256	6086e316a4760ea6d1f73fa8682dd0c2a3111dca50bc01d10e7fd3ec249ec8c8
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	ActiveClean
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 47bf1995df8d524643f7db6d480d31a4

Field	Value
ToBeSigned (TBS) MD5	518d2ea8a21e879c942d504824ac211c
ToBeSigned (TBS) SHA1	21ce87d827077e61abddf2beba69fde5432ea031
ToBeSigned (TBS) SHA256	1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7
Subject	C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
ValidFrom	2003-12-04 00:00:00
ValidTo	2013-12-03 23:59:59
Signature	4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	47bf1995df8d524643f7db6d480d31a4
Version	3

Certificate 0de92bf0d4d82988183205095e9a7688

Field	Value
ToBeSigned (TBS) MD5	45c204b8a20f6abb0188d2d38a3fb0c9
ToBeSigned (TBS) SHA1	cdf3a3c5c2eda4c29621f30fd3154f9f8c765739
ToBeSigned (TBS) SHA256	e32839dddc0f4ed2474efaf37f59d46db400c700fd19533cb0895a111124bc77
Subject	C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer
ValidFrom	2003-12-04 00:00:00
ValidTo	2008-12-03 23:59:59
Signature	877870da4e5201205be079c98230c4fdb91996bd9100c3bdcdcdc6f40ed8fff94dc033623011c5f5741bd492de5f9c2013b17c45be50cd83e7801783a72793671346fbcab8984103cc9b515b058b7fa86ff31b501b242ef2698d6c22f7bbca1695ed0c74c06877d9eb996287c17390f889747a23aba3987b97b1f78f29714d2e751b4841daf0b50d2054d677a097826369fd09cf8af075bb099bd9f91155269a6132be7a02b07b86bea2c38b222c78d13576bc92735cf9b9e64c150a23cce4d2d4342e4940153c0f607a24c6a566ef96cf70eb3ee7f40d7edcd17ca3767169c19c4f47303521b1a2af1a623c2bd98eaa2a077bd818b35c7be29da56ffe3c89ad
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	0de92bf0d4d82988183205095e9a7688
Version	3

Certificate 4191a15a3978dfcf496566381d4c75c2

Field	Value
ToBeSigned (TBS) MD5	41011f8d0e7c7a6408334ca387914c61
ToBeSigned (TBS) SHA1	c7fc1727f5b75a6421a1f95c73bbdb23580c48e5
ToBeSigned (TBS) SHA256	88dd3952638ee82738c03168e6fd863fe4eab1059ee5e2926ad8cb587c255dc0
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA
ValidFrom	2004-07-16 00:00:00
ValidTo	2014-07-15 23:59:59
Signature	ae3a17b84a7b55fa6455ec40a4ed494190999c89bcaf2e1dca7823f91c190f7feb68bc32d98838dedc3fd389b43fb18296f1a45abaed2e26d3de7c016e000a00a4069211480940f91c1879672324e0bbd5e150ae1bf50edde02e81cd80a36c524f9175558aba22f2d2ea4175882f63557d1e545a9559cad93481c05f5ef67ab5
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	4191a15a3978dfcf496566381d4c75c2
Version	3

Certificate 681ce312057f03f206153b679ec06cb9

Field	Value
ToBeSigned (TBS) MD5	190c4a172b309e1a6c672bef0dc442a3
ToBeSigned (TBS) SHA1	0ef8720411ec5275234f4db0aedb0415bf63a45f
ToBeSigned (TBS) SHA256	dc9eb159ce2b994bb915ae48f8c38d16a54e1db0cc158ec9b0ff71041a1c73eb
Subject	C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, OU=RD, CN=Trend Micro, Inc.
ValidFrom	2006-01-20 00:00:00
ValidTo	2007-02-14 23:59:59
Signature	1cac25cad86c51f4576b3418ffcb10db11a2c24511d265ae343a6ea1cbd451223028151c63d1d75b95464083978c405a14fba8d2a2832c631a4c627cba1c9a2e957c381e24aa49cde6d45788e3ad48f0525db52080a83c55fb558cab104f1a3f9fd24fd3b2875132c02e709bd81cb750bc0f498267b1c28f9187eb63f7ac8217947b0275175dab5b8b6b57f8f785e38a38e851a0ec096eab530b219e9e9c5c2460ac97d5977cc90ab4cd9fcfd02b79b4099f099fb81910c680ff181f6c9baaf33fb128b18ee7939f45e537191e2f202fc358aed24b37a0d669a024cdb8630c99390e248e2907c25e5c9ca75008e0f915cfd5388cc889e6335e85de06a5e7fe97
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	681ce312057f03f206153b679ec06cb9
Version	3

Imports

Expand

ntoskrnl.exe

Imported Functions

Expand

KeInitializeEvent
_purecall
ExAcquireFastMutexUnsafe
KeEnterCriticalRegion
KeGetCurrentThread
KeLeaveCriticalRegion
ExReleaseFastMutexUnsafe
wcsncpy
KeSetEvent
KePulseEvent
KeClearEvent
IofCompleteRequest
ZwClose
KeDelayExecutionThread
ObfDereferenceObject
ObReferenceObjectByHandle
ExEventObjectType
ZwCreateEvent
RtlInitUnicodeString
swprintf
KeQuerySystemTime
KeWaitForSingleObject
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
RtlCopyUnicodeString
ProbeForWrite
ProbeForRead
ExGetPreviousMode
DbgPrint
memset
MmIsAddressValid
ZwWriteFile
ZwReadFile
ZwQueryInformationFile
ZwSetInformationFile
ZwCreateFile
towupper
_wcsnicmp
memcpy
sprintf
PsGetCurrentProcessId
IoGetCurrentProcess
RtlTimeToTimeFields
ExSystemTimeToLocalTime
ZwCreateKey
KeWaitForMultipleObjects
ZwNotifyChangeKey
PsGetCurrentThreadId
vsprintf
MmMapLockedPagesSpecifyCache
MmBuildMdlForNonPagedPool
MmCreateMdl
ExFreePoolWithTag
MmUnmapLockedPages
ExAllocatePoolWithTag
RtlImageNtHeader
mbstowcs
_stricmp
ZwQuerySystemInformation
IoGetDeviceObjectPointer
KeServiceDescriptorTable
KeSetPriorityThread
PsTerminateSystemThread
PsCreateSystemThread
KeNumberProcessors
ZwQueryDirectoryFile
ZwOpenDirectoryObject
ZwQueryDirectoryObject
ZwDuplicateObject
ZwOpenKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryValueKey
ZwDeleteValueKey
ZwDeleteKey
ZwQueryKey
ZwSetValueKey
ZwQuerySecurityObject
ObInsertObject
IoFileObjectType
_allrem
PsLookupProcessByProcessId
strncpy
NtOpenProcess
ObOpenObjectByPointer
PsProcessType
ObReferenceObjectByPointer
KeUnstackDetachProcess
MmSectionObjectType
KeStackAttachProcess
ObQueryNameString
ObOpenObjectByName
RtlAppendUnicodeStringToString
NtQueryInformationProcess
RtlAnsiStringToUnicodeString
_strnicmp
RtlQueryRegistryValues
RtlAppendUnicodeToString
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
RtlEqualUnicodeString
IoCreateFile
IoFreeIrp
IoReleaseVpbSpinLock
IoAcquireVpbSpinLock
IofCallDriver
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
IoAllocateIrp
IoFreeMdl
IoAllocateMdl
PsGetVersion
MmGetSystemRoutineAddress
KeTickCount
KeBugCheckEx
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
RtlUnwind
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
_snwprintf
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
RtlAddAccessAllowedAce
RtlLengthSid
wcschr
RtlAbsoluteToSelfRelativeSD
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlFreeUnicodeString

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
??0CContext@@QAE@ABV0@@Z
??0CContext@@QAE@KP6GXPAU_TMCE_EVENT_REPORT@@PAX@Z1@Z
??0CContextList@@QAE@ABV0@@Z
??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
??0CDebugLog@@QAE@ABV0@@Z
??0CDebugLog@@QAE@PBG@Z
??0CFile@@QAE@ABV0@@Z
??0CFile@@QAE@E@Z
??0CFileExtension@@QAE@ABV0@@Z
??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
??0CKEvent@@QAE@ABV0@@Z
??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
??0CList@@QAE@ABV0@@Z
??0CList@@QAE@KPAVIMemoryAllocator@@@Z
??0CLockEvent@@QAE@ABV0@@Z
??0CLockEvent@@QAE@XZ
??0CLockList@@QAE@ABV0@@Z
??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QAE@ABV0@@Z
??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
??0CMemoryPoolAllocator@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@XZ
??0CModuleConfigList@@QAE@ABV0@@Z
??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QAE@ABV0@@Z
??0CModuleFileExtConfig@@QAE@K@Z
??0CModuleFlagConfig@@QAE@ABV0@@Z
??0CModuleFlagConfig@@QAE@K@Z
??0CModuleMultiStringConfig@@QAE@ABV0@@Z
??0CModuleMultiStringConfig@@QAE@K@Z
??0CModuleStringConfig@@QAE@ABV0@@Z
??0CModuleStringConfig@@QAE@K@Z
??0CSmartLock@@QAE@AAVCLockEvent@@@Z
??0CSmartLock@@QAE@XZ
??0CSmartReference@@QAE@AAJ@Z
??0CSmartReference@@QAE@AAK@Z
??0CStrList@@QAE@ABV0@@Z
??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
??0CSystemThread@@QAE@ABV0@@Z
??0CSystemThread@@QAE@K@Z
??0CUserFuncAdapterJob@@QAE@ABV0@@Z
??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z0@Z
??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@E@Z
??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
??0CWorkerThreadJobQueue@@QAE@K@Z
??0CWorkerThreadPool@@QAE@ABV0@@Z
??0CWorkerThreadPool@@QAE@K@Z
??0IMemoryAllocator@@QAE@ABV0@@Z
??0IMemoryAllocator@@QAE@XZ
??1CAutoUpdateConfigThread@@UAE@XZ
??1CContext@@UAE@XZ
??1CContextList@@UAE@XZ
??1CDebugLog@@UAE@XZ
??1CFile@@UAE@XZ
??1CFileExtension@@UAE@XZ
??1CKEvent@@UAE@XZ
??1CList@@UAE@XZ
??1CLockEvent@@UAE@XZ
??1CLockList@@UAE@XZ
??1CMemoryAllocator@@UAE@XZ
??1CMemoryPoolAllocator@@UAE@XZ
??1CModuleConfig@@UAE@XZ
??1CModuleConfigList@@UAE@XZ
??1CModuleFileExtConfig@@UAE@XZ
??1CModuleFlagConfig@@UAE@XZ
??1CModuleMultiStringConfig@@UAE@XZ
??1CModuleStringConfig@@UAE@XZ
??1CSmartLock@@QAE@XZ
??1CSmartReference@@QAE@XZ
??1CStrList@@UAE@XZ
??1CSystemThread@@UAE@XZ
??1CUserFuncAdapterJob@@UAE@XZ
??1CWorkerThread@@UAE@XZ
??1CWorkerThreadJob@@UAE@XZ
??1CWorkerThreadJobQueue@@UAE@XZ
??1CWorkerThreadPool@@UAE@XZ
??1IMemoryAllocator@@UAE@XZ
??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??2CMemoryAllocator@@SGPAXI@Z
??2CMemoryPoolAllocator@@SGPAXI@Z
??3@YAXPAX@Z
??3IMemoryAllocator@@SGXPAX@Z
??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
??4CContext@@QAEAAV0@ABV0@@Z
??4CDebugLog@@QAEAAV0@ABV0@@Z
??4CFile@@QAEAAV0@ABV0@@Z
??4CKEvent@@QAEAAV0@ABV0@@Z
??4CLockEvent@@QAEAAV0@ABV0@@Z
??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
??4CModuleConfig@@QAEAAV0@ABV0@@Z
??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
??4CSystemThread@@QAEAAV0@ABV0@@Z
??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
??4CWorkerThread@@QAEAAV0@ABV0@@Z
??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QAEXXZ
??_FCFile@@QAEXXZ
??_FCFileExtension@@QAEXXZ
??_FCModuleConfigList@@QAEXXZ
??_FCStrList@@QAEXXZ
??_FCSystemThread@@QAEXXZ
??_FCWorkerThread@@QAEXXZ
??_FCWorkerThreadJob@@QAEXXZ
??_FCWorkerThreadJobQueue@@QAEXXZ
??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??_V@YAXPAX@Z
?Acquire@CLockEvent@@QAEXXZ
?Add@CContextList@@QAEEPAVCContext@@@Z
?Add@CFileExtension@@QAEEPBGK@Z
?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
?Add@CStrList@@QAEEPBG@Z
?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QAEXXZ
?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
?Cleanup@CModuleFileExtConfig@@AAEXXZ
?Cleanup@CModuleMultiStringConfig@@AAEXXZ
?Cleanup@CModuleStringConfig@@AAEXXZ
?Close@CFile@@QAEJXZ
?Count@CLockList@@QAEKXZ
?Create@CFile@@QAEJPBGKKKK@Z
?Create@CSystemThread@@QAEEXZ
?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
?CreatePool@CWorkerThreadPool@@QAEEXZ
?CreateThreads@CWorkerThreadPool@@QAEEK@Z
?Delete@CFile@@QAEJXZ
?Delete@CFileExtension@@QAEEPBGK@Z
?Delete@CStrList@@QAEEPBG@Z
?DeleteAll@CList@@UAEXXZ
?DeleteAll@CLockList@@UAEXXZ
?DeleteNode@CContextList@@MAEXPAX@Z
?DeleteNode@CList@@UAEXPAX@Z
?DeleteNode@CModuleConfigList@@MAEXPAX@Z
?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
?DoIt@CWorkerThreadJob@@QAEJXZ
?EntryPoint@CSystemThread@@KGXPAX@Z
?Find@CContextList@@QAEPAVCContext@@K@Z
?Find@CContextList@@QAEPAVCContext@@PAX@Z
?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FindNode@CContextList@@IAEPAXPAX@Z
?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?First@CList@@UAEPAXXZ
?First@CLockList@@UAEPAXXZ
?Free@CMemoryAllocator@@UAEXPAX@Z
?Free@CMemoryPoolAllocator@@UAEXPAX@Z
?GetAttributes@CFile@@QAEKXZ
?GetBasicInfomration@CFile@@IAEJXZ
?GetCategory@CContext@@QAEKXZ
?GetCatetory@CModuleConfig@@QAEKXZ
?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QAEKXZ
?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
?GetData@CModuleStringConfig@@QAEPAGXZ
?GetData@CStrList@@QAEEPAGPAK@Z
?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UAEHKPAGPAK@Z
?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UAEHKPAK@Z
?GetID@CModuleConfig@@QAEKXZ
?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QAEKXZ
?GetLinkContext@CContext@@QAEPAXXZ
?GetLogFlag@CDebugLog@@QAEKXZ
?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UAEHKPAGPAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QAEKXZ
?GetStringConfig@CContext@@QAEPAGK@Z
?GetStringConfig@CContext@@UAEHKPAGPAK@Z
?GetThreadCount@CWorkerThreadPool@@QAEKXZ
?GetThreadID@CSystemThread@@QAEKXZ
?GetType@CContext@@QAEKXZ
?GetType@CModuleConfig@@QAEKXZ
?GetUserParameter@CContext@@QAEKXZ
?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
?InitializeFlagConfig@CContext@@QAEHKK@Z
?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
?InitializeStringConfig@CContext@@QAEHKPBG@Z
?Insert@CList@@UAEXQAXE@Z
?Insert@CLockList@@UAEXQAXE@Z
?InsertAfter@CList@@UAEXPAX0@Z
?InsertBefore@CList@@UAEXPAX0@Z
?Instance@CWorkerThreadPool@@SGPAV1@XZ
?IsEmpty@CList@@UAEEXZ
?IsEmpty@CLockList@@UAEEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
?IsFull@CLockList@@QBEEXZ
?IsOpened@CFile@@QAEEXZ
?IsTerminated@CWorkerThreadPool@@QAEEXZ
?IsValid@CMemoryAllocator@@UAEEXZ
?IsValid@CMemoryPoolAllocator@@UAEEXZ
?IsValid@IMemoryAllocator@@UAEEXZ
?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
?JobFunction@CUserFuncAdapterJob@@MAEXXZ
?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QAEKXZ
?MatchAllExtensions@CFileExtension@@QAEEXZ
?MatchNoExtensions@CFileExtension@@QAEEXZ
?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
?NeedDelete@CWorkerThreadJob@@QAEEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
?NewNode@CList@@UAEPAXXZ
?NewNode@CStrList@@EAEPAXXZ
?NewNodeVariant@CList@@IAEPAXK@Z
?Next@CList@@UBEPAXQAX@Z
?Next@CLockList@@UBEPAXQAX@Z
?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
?NotityTerminate@CWorkerThread@@QAEXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
?Pulse@CKEvent@@QAEJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
?Read@CFile@@QAEJPADKPAK@Z
?ReferenceCount@CContext@@QAEAAKXZ
?Release@CLockEvent@@QAEXXZ
?Remove@CContextList@@UAEEQAX@Z
?Remove@CList@@UAEEQAX@Z
?Remove@CLockList@@UAEEQAX@Z
?RemoveHead@CList@@UAEPAXXZ
?RemoveHead@CLockList@@UAEPAXXZ
?RemoveTail@CList@@UAEPAXXZ
?RemoveTail@CLockList@@UAEPAXXZ
?Reset@CKEvent@@QAEXXZ
?Run@CAutoUpdateConfigThread@@UAEXXZ
?Run@CWorkerThread@@UAEXXZ
?SeekToEnd@CFile@@QAEJXZ
?Set@CKEvent@@QAEJJE@Z
?SetAttributes@CFile@@QAEJK@Z
?SetData@CModuleFileExtConfig@@QAEHPBG@Z
?SetData@CModuleFlagConfig@@QAEHK@Z
?SetData@CModuleMultiStringConfig@@QAEHPBG@Z
?SetData@CModuleStringConfig@@QAEHPBG@Z
?SetFileExtensionConfig@CContext@@UAEHKPBG@Z
?SetFlagConfig@CContext@@UAEHKK@Z
?SetLinkContext@CContext@@QAEXPAX@Z
?SetLogFlag@CDebugLog@@QAEEK@Z
?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
?SetMultiStringConfig@CContext@@UAEHKPBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
?SetPriority@CSystemThread@@QAEXK@Z
?SetStopUse@CContext@@QAEXXZ
?SetStringConfig@CContext@@UAEHKPBG@Z
?Setup@CSystemThread@@MAEXXZ
?StopUse@CContext@@QAEHXZ
?TearDown@CSystemThread@@MAEXXZ
?Terminate@CSystemThread@@QAEXE@Z
?Terminate@CWorkerThreadPool@@QAEEXZ
?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QAEXXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
?Write@CDebugLog@@QAAXPBDZZ
?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
?WriteSystemInformation@CDebugLog@@QAEXXZ
?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
?WriteToFile@CDebugLog@@IAEXPADK@Z
?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
?_pPagedAllocator@@3PAVCMemoryAllocator@@A
?m_lpInstance@CWorkerThreadPool@@1PAV1@A
_GetModuleInfoByAddress@8
_GetModuleInfoByModuleName@8
_MapMem@12
_ModGetExportProcAddress@8
_ModLoadDLLToBuffer@4
_ModLoadModule@8
_ModUnLoadModule@4
_TmCommConfigRoutine@4
_UnMapMem@8
_UtilGetProcessName@8
_UtilGetSystemTime@4
_UtilIoSetFileInfo@24
_UtilIopCreateFileIRP@40
_UtilKeGetLowFileDevice@16
_UtilQueryKeyValue@24
_UtilVolumeDeviceToDosName@8
_UtilWaitValueChangeToZero@8
_UtilWriteVersionToRegistry@8

Sections

Expand

.text
.rdata
.data
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2008-04-01 05:02:16
MD5	f65e545771fd922693f0ec68b2141012
SHA1	850f15fd67d9177a50f3efef07a805b9613f50d6
SHA256	adc10de960f40fa9f6e28449748250fa9ddfd331115b77a79809a50c606753ee
Authentihash MD5	18831ebdbd1eb06f09fe812e958dd2e0
Authentihash SHA1	5d39543a15234f7d472d5d9132bd0d0faa7cdcd3
Authentihash SHA256	c264c3d71a57a5dff031d74bd2f6ef715eff603cc8078df123e862603e096be4
RichPEHeaderHash MD5	f3b2261013f63e56fe626e4a998cf6d6
RichPEHeaderHash SHA1	00900236e6ee2030bce66466405b490a1eb8233b
RichPEHeaderHash SHA256	5bd5c40161e8e3231529247638ab7bb2ece6068a416e3bf775c9bde68138f458
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	AEGIS
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 3825d7faf861af9ef490e726b5d65ad5

Field	Value
ToBeSigned (TBS) MD5	d6c7684e9aaa508cf268335f83afe040
ToBeSigned (TBS) SHA1	18066d20ad92409c567cdfde745279ff71c75226
ToBeSigned (TBS) SHA256	a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff
Subject	C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2
ValidFrom	2007-06-15 00:00:00
ValidTo	2012-06-14 23:59:59
Signature	50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	3825d7faf861af9ef490e726b5d65ad5
Version	3

Certificate 47bf1995df8d524643f7db6d480d31a4

Field	Value
ToBeSigned (TBS) MD5	518d2ea8a21e879c942d504824ac211c
ToBeSigned (TBS) SHA1	21ce87d827077e61abddf2beba69fde5432ea031
ToBeSigned (TBS) SHA256	1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7
Subject	C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
ValidFrom	2003-12-04 00:00:00
ValidTo	2013-12-03 23:59:59
Signature	4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	47bf1995df8d524643f7db6d480d31a4
Version	3

Certificate 4191a15a3978dfcf496566381d4c75c2

Field	Value
ToBeSigned (TBS) MD5	41011f8d0e7c7a6408334ca387914c61
ToBeSigned (TBS) SHA1	c7fc1727f5b75a6421a1f95c73bbdb23580c48e5
ToBeSigned (TBS) SHA256	88dd3952638ee82738c03168e6fd863fe4eab1059ee5e2926ad8cb587c255dc0
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA
ValidFrom	2004-07-16 00:00:00
ValidTo	2014-07-15 23:59:59
Signature	ae3a17b84a7b55fa6455ec40a4ed494190999c89bcaf2e1dca7823f91c190f7feb68bc32d98838dedc3fd389b43fb18296f1a45abaed2e26d3de7c016e000a00a4069211480940f91c1879672324e0bbd5e150ae1bf50edde02e81cd80a36c524f9175558aba22f2d2ea4175882f63557d1e545a9559cad93481c05f5ef67ab5
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	4191a15a3978dfcf496566381d4c75c2
Version	3

Certificate 645212f783f4d7aba3555729e99ce065

Field	Value
ToBeSigned (TBS) MD5	e00f0a38c65f7c0b9f19b97448d6a0e3
ToBeSigned (TBS) SHA1	91c033a2f289418c4101654dceacef1b25bb55d0
ToBeSigned (TBS) SHA256	38b3fcbdb734b0e3439f3c9a3c4c1712091f577d2b616d41224137faf7ba7c86
Subject	C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, OU=RD, CN=Trend Micro, Inc.
ValidFrom	2008-01-16 00:00:00
ValidTo	2011-02-16 23:59:59
Signature	5a693868cea6ba49064b801a0d9e12887a37cbb92cca2950cc5e99c2df9aec5697422e67cd042836daf09a09e739f625255841fed1ec9657cb8b3edc08c55c302574cbdb3f7de2798ed769d766402619b48041f9d90f8c904488788412b1c632055e1afc4a5bbac642cb626bd20fece0feaa6cf9b287887788cf64586309a14a644b5f0595c0ddcb7d789831faedb48451e40e342da4ccbc38a5e992e57e7ce5328d531a8c68e61f9dc9be65605c1bedf3358579000b91a19b3be388bac36b58ca76b72358bd8e74e0a7b08b0587bb7a29758c01af40b80e8e72c76abd3a2babfe7c1ed6e7b1cd9b0221a605062b6d9d0ceb57e0eb305fdc5eb5bf6ea442f4c9
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	645212f783f4d7aba3555729e99ce065
Version	3

Certificate 610c120600000000001b

Field	Value
ToBeSigned (TBS) MD5	53c41bc1164e09e0cd1617a5bf913efd
ToBeSigned (TBS) SHA1	93c03aac8951d494ecd5696b1c08658541b18727
ToBeSigned (TBS) SHA256	40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b
Subject	C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
ValidFrom	2006-05-23 17:01:29
ValidTo	2016-05-23 17:11:29
Signature	01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	610c120600000000001b
Version	3

Imports

Expand

ntoskrnl.exe
CLASSPNP.SYS

Imported Functions

Expand

KeEnterCriticalRegion
KeGetCurrentThread
KeLeaveCriticalRegion
ExReleaseFastMutexUnsafe
wcsncpy
memcpy
wcsrchr
KeSetEvent
KePulseEvent
KeClearEvent
IofCompleteRequest
ZwClose
KeDelayExecutionThread
ObfDereferenceObject
ObReferenceObjectByHandle
ExEventObjectType
ZwCreateEvent
RtlInitUnicodeString
swprintf
KeQuerySystemTime
KeWaitForSingleObject
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
DbgPrint
RtlCopyUnicodeString
ProbeForWrite
ProbeForRead
ExGetPreviousMode
memset
MmIsAddressValid
ZwWriteFile
ZwReadFile
ZwQueryInformationFile
ZwSetInformationFile
ZwCreateFile
towupper
_wcsnicmp
_snprintf
PsGetCurrentProcessId
IoGetCurrentProcess
RtlTimeToTimeFields
ExSystemTimeToLocalTime
ZwCreateKey
KeInitializeEvent
KeWaitForMultipleObjects
ZwNotifyChangeKey
PsGetCurrentThreadId
_vsnprintf
MmMapLockedPagesSpecifyCache
MmBuildMdlForNonPagedPool
MmCreateMdl
ExFreePoolWithTag
MmUnmapLockedPages
ExAllocatePoolWithTag
RtlImageNtHeader
mbstowcs
_stricmp
ZwQuerySystemInformation
IoGetDeviceObjectPointer
KeServiceDescriptorTable
KeAddSystemServiceTable
_strnicmp
PsLookupProcessByProcessId
KeUnstackDetachProcess
KeStackAttachProcess
ZwQueryObject
ZwDuplicateObject
ZwOpenProcess
KeSetPriorityThread
PsTerminateSystemThread
PsCreateSystemThread
KeNumberProcessors
ZwQueryDirectoryFile
ZwOpenDirectoryObject
ZwQueryDirectoryObject
IoFreeIrp
IoFreeMdl
IofCallDriver
ExAcquireFastMutexUnsafe
IoAllocateIrp
IoFileObjectType
ZwOpenKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryValueKey
ZwDeleteValueKey
ZwDeleteKey
ZwQueryKey
ZwSetValueKey
ZwQuerySecurityObject
ObInsertObject
_allrem
strncpy
NtOpenProcess
ObOpenObjectByPointer
PsProcessType
ObReferenceObjectByPointer
MmSectionObjectType
ObQueryNameString
ObOpenObjectByName
RtlAppendUnicodeStringToString
ObfReferenceObject
NtQueryInformationProcess
_snwprintf
RtlAnsiStringToUnicodeString
IoBuildAsynchronousFsdRequest
KeBugCheckEx
RtlQueryRegistryValues
RtlAppendUnicodeToString
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
RtlEqualUnicodeString
IoCreateFile
PsGetVersion
MmGetSystemRoutineAddress
RtlCompareMemory
IoReleaseVpbSpinLock
IoAcquireVpbSpinLock
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
KeInitializeSemaphore
KeReleaseSemaphore
RtlSubAuthoritySid
RtlInitializeSid
RtlLengthRequiredSid
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
ZwSetEvent
ZwRequestWaitReplyPort
memmove
ZwConnectPort
ZwCreateSection
ZwWaitForSingleObject
ZwOpenEvent
ExAllocatePool
RtlUpperChar
RtlCompareUnicodeString
KeTickCount
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
RtlUnwind
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
RtlLengthSid
wcschr
RtlAbsoluteToSelfRelativeSD
RtlFreeUnicodeString
IoAllocateMdl
_purecall
ClassInitialize

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
??0CBlobConfig@@QAE@ABV0@@Z
??0CBlobConfig@@QAE@K@Z
??0CContext@@QAE@ABV0@@Z
??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QAE@ABV0@@Z
??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
??0CDebugLog@@QAE@ABV0@@Z
??0CDebugLog@@QAE@PBG@Z
??0CExclusionExtConfig@@QAE@ABV0@@Z
??0CExclusionExtConfig@@QAE@KKE@Z
??0CExclusionFileNameConfig@@QAE@ABV0@@Z
??0CExclusionFileNameConfig@@QAE@KK@Z
??0CExclusionFilePathConfig@@QAE@ABV0@@Z
??0CExclusionFilePathConfig@@QAE@KK@Z
??0CExclusionFolderConfig@@QAE@ABV0@@Z
??0CExclusionFolderConfig@@QAE@KK@Z
??0CExclusionRegistryConfig@@QAE@ABV0@@Z
??0CExclusionRegistryConfig@@QAE@KK@Z
??0CFile@@QAE@ABV0@@Z
??0CFile@@QAE@E@Z
??0CFileExtension@@QAE@ABV0@@Z
??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
??0CKEvent@@QAE@ABV0@@Z
??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
??0CList@@QAE@ABV0@@Z
??0CList@@QAE@KPAVIMemoryAllocator@@@Z
??0CLockEvent@@QAE@ABV0@@Z
??0CLockEvent@@QAE@XZ
??0CLockList@@QAE@ABV0@@Z
??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QAE@ABV0@@Z
??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
??0CMemoryPoolAllocator@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@XZ
??0CModuleConfigList@@QAE@ABV0@@Z
??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QAE@ABV0@@Z
??0CModuleFileExtConfig@@QAE@KKE@Z
??0CModuleFlagConfig@@QAE@ABV0@@Z
??0CModuleFlagConfig@@QAE@K@Z
??0CModuleMultiStringConfig@@QAE@ABV0@@Z
??0CModuleMultiStringConfig@@QAE@KK@Z
??0CModuleStringConfig@@QAE@ABV0@@Z
??0CModuleStringConfig@@QAE@K@Z
??0CSmartLock@@QAE@AAVCLockEvent@@@Z
??0CSmartLock@@QAE@XZ
??0CSmartReference@@QAE@AAJ@Z
??0CSmartReference@@QAE@AAK@Z
??0CStrList@@QAE@ABV0@@Z
??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
??0CSystemThread@@QAE@ABV0@@Z
??0CSystemThread@@QAE@K@Z
??0CUserFuncAdapterJob@@QAE@ABV0@@Z
??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z0@Z
??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@E@Z
??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
??0CWorkerThreadJobQueue@@QAE@K@Z
??0CWorkerThreadPool@@QAE@ABV0@@Z
??0CWorkerThreadPool@@QAE@K@Z
??0IMemoryAllocator@@QAE@ABV0@@Z
??0IMemoryAllocator@@QAE@XZ
??1CAutoUpdateConfigThread@@UAE@XZ
??1CBlobConfig@@UAE@XZ
??1CContext@@UAE@XZ
??1CContextList@@UAE@XZ
??1CDebugLog@@UAE@XZ
??1CExclusionExtConfig@@UAE@XZ
??1CExclusionFileNameConfig@@UAE@XZ
??1CExclusionFilePathConfig@@UAE@XZ
??1CExclusionFolderConfig@@UAE@XZ
??1CExclusionRegistryConfig@@UAE@XZ
??1CFile@@UAE@XZ
??1CFileExtension@@UAE@XZ
??1CKEvent@@UAE@XZ
??1CList@@UAE@XZ
??1CLockEvent@@UAE@XZ
??1CLockList@@UAE@XZ
??1CMemoryAllocator@@UAE@XZ
??1CMemoryPoolAllocator@@UAE@XZ
??1CModuleConfig@@UAE@XZ
??1CModuleConfigList@@UAE@XZ
??1CModuleFileExtConfig@@UAE@XZ
??1CModuleFlagConfig@@UAE@XZ
??1CModuleMultiStringConfig@@UAE@XZ
??1CModuleStringConfig@@UAE@XZ
??1CSmartLock@@QAE@XZ
??1CSmartReference@@QAE@XZ
??1CStrList@@UAE@XZ
??1CSystemThread@@UAE@XZ
??1CUserFuncAdapterJob@@UAE@XZ
??1CWorkerThread@@UAE@XZ
??1CWorkerThreadJob@@UAE@XZ
??1CWorkerThreadJobQueue@@UAE@XZ
??1CWorkerThreadPool@@UAE@XZ
??1IMemoryAllocator@@UAE@XZ
??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??2CMemoryAllocator@@SGPAXI@Z
??2CMemoryPoolAllocator@@SGPAXI@Z
??3@YAXPAX@Z
??3IMemoryAllocator@@SGXPAX@Z
??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
??4CBlobConfig@@QAEAAV0@ABV0@@Z
??4CContext@@QAEAAV0@ABV0@@Z
??4CDebugLog@@QAEAAV0@ABV0@@Z
??4CFile@@QAEAAV0@ABV0@@Z
??4CKEvent@@QAEAAV0@ABV0@@Z
??4CLockEvent@@QAEAAV0@ABV0@@Z
??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
??4CModuleConfig@@QAEAAV0@ABV0@@Z
??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
??4CSystemThread@@QAEAAV0@ABV0@@Z
??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
??4CWorkerThread@@QAEAAV0@ABV0@@Z
??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QAEXXZ
??_FCFile@@QAEXXZ
??_FCFileExtension@@QAEXXZ
??_FCModuleConfigList@@QAEXXZ
??_FCStrList@@QAEXXZ
??_FCSystemThread@@QAEXXZ
??_FCWorkerThread@@QAEXXZ
??_FCWorkerThreadJob@@QAEXXZ
??_FCWorkerThreadJobQueue@@QAEXXZ
??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??_V@YAXPAX@Z
?Acquire@CLockEvent@@QAEXXZ
?Add@CContextList@@QAEEPAVCContext@@@Z
?Add@CFileExtension@@QAEEPBGK@Z
?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
?Add@CStrList@@QAEEPBG@Z
?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QAEXXZ
?CheckNode@CLockList@@UAEHQAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
?Cleanup@CBlobConfig@@AAEXXZ
?Cleanup@CModuleFileExtConfig@@IAEXXZ
?Cleanup@CModuleMultiStringConfig@@IAEXXZ
?Cleanup@CModuleStringConfig@@AAEXXZ
?Close@CFile@@QAEJXZ
?Count@CLockList@@QAEKXZ
?Create@CFile@@QAEJPBGKKKK@Z
?Create@CSystemThread@@QAEEXZ
?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
?CreatePool@CWorkerThreadPool@@QAEEXZ
?CreateThreads@CWorkerThreadPool@@QAEEK@Z
?CreateWIRP@CFile@@QAEJPBGKKKK@Z
?Delete@CFile@@QAEJXZ
?Delete@CFileExtension@@QAEEPBGK@Z
?Delete@CStrList@@QAEEPBG@Z
?DeleteAll@CList@@UAEXXZ
?DeleteAll@CLockList@@UAEXXZ
?DeleteNode@CContextList@@MAEXPAX@Z
?DeleteNode@CList@@UAEXPAX@Z
?DeleteNode@CModuleConfigList@@MAEXPAX@Z
?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YGXPAPAX@Z
?DoIt@CWorkerThreadJob@@QAEJXZ
?EntryPoint@CSystemThread@@KGXPAX@Z
?Find@CContextList@@QAEPAVCContext@@K@Z
?Find@CContextList@@QAEPAVCContext@@PAX@Z
?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FindNode@CContextList@@IAEPAXPAX@Z
?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?First@CList@@UAEPAXXZ
?First@CLockList@@UAEPAXXZ
?Free@CMemoryAllocator@@UAEXPAX@Z
?Free@CMemoryPoolAllocator@@UAEXPAX@Z
?GetAttributes@CFile@@QAEKXZ
?GetBasicInfomration@CFile@@IAEJXZ
?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
?GetCategory@CContext@@QAEKXZ
?GetData@CBlobConfig@@QAEHPAXPAK@Z
?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QAEKXZ
?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
?GetData@CModuleStringConfig@@QAEPAGXZ
?GetData@CStrList@@QAEEPAGPAK@Z
?GetDataType@CModuleConfig@@QAEKXZ
?GetEngineContext@CContext@@QAEPAXXZ
?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UAEJKPAK@Z
?GetID@CModuleConfig@@QAEKXZ
?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QAEKXZ
?GetLinkContext@CContext@@QAEPAXXZ
?GetLogFlag@CDebugLog@@QAEKXZ
?GetModuleId@CModuleConfig@@QAEKXZ
?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QAEKXZ
?GetSize@CBlobConfig@@QAEKXZ
?GetStringConfig@CContext@@QAEPAGK@Z
?GetStringConfig@CContext@@UAEJKPAGPAK@Z
?GetThreadCount@CWorkerThreadPool@@QAEKXZ
?GetThreadID@CSystemThread@@QAEKXZ
?GetType@CContext@@QAEKXZ
?GetUserParameter@CContext@@QAEKXZ
?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
?InitializeFlagConfig@CContext@@QAEHKK@Z
?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
?InitializeStringConfig@CContext@@QAEHKPBG@Z
?Insert@CList@@UAEXQAXE@Z
?Insert@CLockList@@UAEXQAXE@Z
?InsertAfter@CList@@UAEXPAX0@Z
?InsertBefore@CList@@UAEXPAX0@Z
?Instance@CWorkerThreadPool@@SGPAV1@XZ
?IsEmpty@CList@@UAEEXZ
?IsEmpty@CLockList@@UAEEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
?IsFull@CLockList@@QBEEXZ
?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
?IsOpened@CFile@@QAEEXZ
?IsTerminated@CWorkerThreadPool@@QAEEXZ
?IsValid@CMemoryAllocator@@UAEEXZ
?IsValid@CMemoryPoolAllocator@@UAEEXZ
?IsValid@IMemoryAllocator@@UAEEXZ
?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
?JobFunction@CUserFuncAdapterJob@@MAEXXZ
?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QAEKXZ
?MatchAllExtensions@CFileExtension@@QAEEXZ
?MatchNoExtensions@CFileExtension@@QAEEXZ
?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
?NeedDelete@CWorkerThreadJob@@QAEEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
?NewNode@CList@@UAEPAXXZ
?NewNode@CStrList@@EAEPAXXZ
?NewNodeVariant@CList@@IAEPAXK@Z
?Next@CList@@UBEPAXQAX@Z
?Next@CLockList@@UBEPAXQAX@Z
?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
?NotityTerminate@CWorkerThread@@QAEXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
?Pulse@CKEvent@@QAEJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
?Read@CFile@@QAEJPADKPAK@Z
?ReferenceCount@CContext@@QAEAAKXZ
?Release@CLockEvent@@QAEXXZ
?Remove@CContextList@@UAEEQAX@Z
?Remove@CList@@UAEEQAX@Z
?Remove@CLockList@@UAEEQAX@Z
?RemoveHead@CList@@UAEPAXXZ
?RemoveHead@CLockList@@UAEPAXXZ
?RemoveTail@CList@@UAEPAXXZ
?RemoveTail@CLockList@@UAEPAXXZ
?Reset@CKEvent@@QAEXXZ
?RestoreCR0@@YGXPAX@Z
?Run@CAutoUpdateConfigThread@@UAEXXZ
?Run@CWorkerThread@@UAEXXZ
?SeekToEnd@CFile@@QAEJXZ
?Set@CKEvent@@QAEJJE@Z
?SetAttributes@CFile@@QAEJK@Z
?SetBlobCofig@CContext@@UAEJKPAXK@Z
?SetData@CBlobConfig@@QAEHPAXK@Z
?SetData@CModuleFileExtConfig@@QAEHPBG@Z
?SetData@CModuleFlagConfig@@QAEHK@Z
?SetData@CModuleMultiStringConfig@@QAEHPBG@Z
?SetData@CModuleStringConfig@@QAEHPBG@Z
?SetEngineContext@CContext@@QAEXPAX@Z
?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
?SetFlagConfig@CContext@@UAEJKK@Z
?SetLinkContext@CContext@@QAEXPAX@Z
?SetLogFlag@CDebugLog@@QAEEK@Z
?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
?SetMultiStringConfig@CContext@@UAEJKPBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
?SetPriority@CSystemThread@@QAEXK@Z
?SetStopUse@CContext@@QAEXXZ
?SetStringConfig@CContext@@UAEJKPBG@Z
?Setup@CSystemThread@@MAEXXZ
?StopUse@CContext@@QAEHXZ
?TearDown@CSystemThread@@MAEXXZ
?Terminate@CSystemThread@@QAEXE@Z
?Terminate@CWorkerThreadPool@@QAEEXZ
?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QAEXXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
?Write@CDebugLog@@QAAXPBDZZ
?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
?WriteSystemInformation@CDebugLog@@QAEXXZ
?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
?WriteToFile@CDebugLog@@IAEXPADK@Z
?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
?_pPagedAllocator@@3PAVCMemoryAllocator@@A
?m_lpInstance@CWorkerThreadPool@@1PAV1@A
?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
_DeInitKmLPC@0
_GetModuleInfoByAddress@8
_GetModuleInfoByModuleName@8
_InitKmLPC@0
_KmCallUm@8
_MapMem@12
_ModGetExportProcAddress@8
_ModLoadDLLToBuffer@4
_ModLoadModule@8
_ModUnLoadModule@4
_TmCommConfigRoutine@4
_UnMapMem@8
_UtilGetProcessName@12
_UtilGetSystemTime@4
_UtilIoSetFileInfo@24
_UtilIopCreateFileIRP@40
_UtilKeGetLowFileDevice@16
_UtilQueryKeyValue@24
_UtilVolumeDeviceToDosName@8
_UtilWaitValueChangeToZero@8
_UtilWriteVersionToRegistry@8

Sections

Expand

.text
.rdata
.data
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2017-07-12 21:24:09
MD5	9af5ae780b6a9ea485fa15f28ddb20a7
SHA1	6a60c5dc7d881ddb5d6fe954f10b8aa10d214e72
SHA256	b773511fdb2e370dec042530910a905472fcc2558eb108b246fd3200171b04d3
Authentihash MD5	c168260fa4a9a401b55e3b4c5962fa27
Authentihash SHA1	dac9b99363ccff7b11a53bf98bcaf64f41b66d77
Authentihash SHA256	45624a7469927b999cce153ff0074f675a8c062c5afa3f0c688b6124874ca27a
RichPEHeaderHash MD5	638421ba9c7c3d1243f119fd6a9e4bd0
RichPEHeaderHash SHA1	0073bd94451b7cbc3b7814b6df5c45c61f99016b
RichPEHeaderHash SHA256	0dd9eaf41e836f6a7165b1443ea778563dcd126fa15e4561b54bc6bdae0a6d01
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	Trend Micro Eyes
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 7e93ebfb7cc64e59ea4b9a77d406fc3b

Field	Value
ToBeSigned (TBS) MD5	d0785ad36e427c92b19f6826ab1e8020
ToBeSigned (TBS) SHA1	365b7a9c21bd9373e49052c3e7b3e4646ddd4d43
ToBeSigned (TBS) SHA256	c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2
ValidFrom	2012-12-21 00:00:00
ValidTo	2020-12-30 23:59:59
Signature	03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	7e93ebfb7cc64e59ea4b9a77d406fc3b
Version	3

Certificate 0ecff438c8febf356e04d86a981b1a50

Field	Value
ToBeSigned (TBS) MD5	e9d38360b914c8863f6cba3ee58764d3
ToBeSigned (TBS) SHA1	4cba8eae47b6bf76f20b3504b98b8f062694a89b
ToBeSigned (TBS) SHA256	88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4
ValidFrom	2012-10-18 00:00:00
ValidTo	2020-12-29 23:59:59
Signature	783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	0ecff438c8febf356e04d86a981b1a50
Version	3

Certificate 497c4fad471540e6e453d0cafb155740

Field	Value
ToBeSigned (TBS) MD5	78eaa337666217b1c16a9a0ebd0b8434
ToBeSigned (TBS) SHA1	ff9cb835e78f6185eed4372096c3bae53b17d18d
ToBeSigned (TBS) SHA256	1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250
Subject	C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.
ValidFrom	2017-04-27 00:00:00
ValidTo	2018-07-16 23:59:59
Signature	f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	497c4fad471540e6e453d0cafb155740
Version	3

Certificate 611993e400000000001c

Field	Value
ToBeSigned (TBS) MD5	78a717e082dcc1cda3458d917e677d14
ToBeSigned (TBS) SHA1	4a872e0e51f9b304469cd1dedb496ee9b8b983a4
ToBeSigned (TBS) SHA256	317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
ValidFrom	2011-02-22 19:25:17
ValidTo	2021-02-22 19:35:17
Signature	812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	611993e400000000001c
Version	3

Certificate 5200e5aa2556fc1a86ed96c9d44b33c7

Field	Value
ToBeSigned (TBS) MD5	b30c31a572b0409383ed3fbe17e56e81
ToBeSigned (TBS) SHA1	4843a82ed3b1f2bfbee9671960e1940c942f688d
ToBeSigned (TBS) SHA256	03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-02-08 00:00:00
ValidTo	2020-02-07 23:59:59
Signature	5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	5200e5aa2556fc1a86ed96c9d44b33c7
Version	3

Imports

Expand

ntoskrnl.exe
CLASSPNP.SYS
HAL.dll

Imported Functions

Expand

ExAcquireFastMutexUnsafe
ExReleaseFastMutexUnsafe
ProbeForRead
ProbeForWrite
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
MmProbeAndLockPages
MmUnlockPages
MmMapLockedPagesSpecifyCache
IoAllocateMdl
IoFreeMdl
IoGetCurrentProcess
ObfReferenceObject
ObfDereferenceObject
ZwClose
ZwCreateSection
ZwOpenSection
ZwMapViewOfSection
ZwUnmapViewOfSection
ZwOpenEvent
KePulseEvent
KeStackAttachProcess
KeUnstackDetachProcess
ObOpenObjectByPointer
ZwAllocateVirtualMemory
ZwFreeVirtualMemory
ZwSetEvent
_allmul
memcpy
memset
PsProcessType
wcsncpy
wcsrchr
RtlUnicodeStringToInteger
ZwWaitForSingleObject
ZwRequestWaitReplyPort
ZwConnectPort
_stricmp
ExAllocatePoolWithTag
MmIsAddressValid
RtlImageNtHeader
ZwQuerySystemInformation
swprintf
RtlCopyUnicodeString
DbgPrint
KeDelayExecutionThread
KeQuerySystemTime
IofCompleteRequest
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
ObReferenceObjectByHandle
PsGetCurrentProcessId
ZwCreateEvent
ExEventObjectType
PsThreadType
MmSectionObjectType
SeCaptureSubjectContext
SeReleaseSubjectContext
SeAccessCheck
ObGetObjectSecurity
ObReleaseObjectSecurity
PsGetProcessExitTime
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
KeInitializeSemaphore
KeReleaseSemaphore
RtlCreateAcl
RtlAddAccessAllowedAce
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
ExGetPreviousMode
_wcsnicmp
PsSetCreateProcessNotifyRoutine
ZwQueryInformationProcess
PsLookupProcessByProcessId
ZwOpenDirectoryObject
ExInitializeResourceLite
ExDeleteResourceLite
ZwCreateFile
ZwQueryInformationFile
ZwSetInformationFile
ZwReadFile
ZwWriteFile
towupper
MmGetSystemRoutineAddress
ObReferenceObjectByPointer
ObQueryNameString
MmHighestUserAddress
PsGetVersion
_snprintf
_vsnprintf
RtlInitAnsiString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
RtlTimeToTimeFields
KeWaitForMultipleObjects
ExSystemTimeToLocalTime
ExFreePoolWithTag
PsGetCurrentThreadId
ZwDeviceIoControlFile
ZwNotifyChangeKey
ZwOpenFile
ZwQueryVolumeInformationFile
mbstowcs
IoGetDeviceObjectPointer
_strnicmp
RtlCompareUnicodeString
RtlCompareMemory
MmBuildMdlForNonPagedPool
IoAllocateIrp
IofCallDriver
IoFreeIrp
RtlUpperChar
ObReferenceObjectByName
IoFileObjectType
IoDriverObjectType
IoBuildDeviceIoControlRequest
IoCreateFile
RtlEqualUnicodeString
RtlAppendUnicodeStringToString
RtlUpcaseUnicodeChar
_snwprintf
strncpy
NtOpenProcess
NtQueryInformationProcess
PsIsThreadTerminating
ObOpenObjectByName
KeServiceDescriptorTable
KeAddSystemServiceTable
KeSetPriorityThread
PsCreateSystemThread
PsTerminateSystemThread
KeNumberProcessors
RtlLengthSecurityDescriptor
ZwOpenKey
ZwDeleteKey
ZwDeleteValueKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryKey
ZwQueryValueKey
ZwSetValueKey
ZwTerminateProcess
ZwOpenProcess
ZwQuerySecurityObject
ZwSetSecurityObject
ZwQueryDirectoryObject
ZwQueryDirectoryFile
_allrem
RtlAppendUnicodeToString
ZwFsControlFile
ObInsertObject
strrchr
wcschr
wcsncmp
RtlQueryRegistryValues
IoBuildAsynchronousFsdRequest
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
RtlUpcaseUnicodeString
NtClose
ZwSetInformationObject
SeQueryAuthenticationIdToken
MmSystemRangeStart
IoGetFileObjectGenericMapping
ObCreateObject
SeCreateAccessState
IoAcquireVpbSpinLock
IoReleaseVpbSpinLock
wcstombs
strncat
wcsncat
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
wcsstr
ExAllocatePool
ExInterlockedPopEntrySList
IoBuildSynchronousFsdRequest
IoGetStackLimits
IoGetDeviceInterfaces
IoRegisterPlugPlayNotification
IoUnregisterPlugPlayNotification
IoGetConfigurationInformation
FsRtlIsNameInExpression
RtlUnwind
IoDeviceObjectType
IoCreateDevice
RtlGetOwnerSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
RtlLengthSid
SeExports
IoIsWdmVersionAvailable
RtlAbsoluteToSelfRelativeSD
KeWaitForSingleObject
KeLeaveCriticalRegion
KeBugCheckEx
KeEnterCriticalRegion
KeSetEvent
KeClearEvent
KeInitializeEvent
RtlInitUnicodeString
KeGetCurrentThread
memmove
ZwCreateKey
_purecall
ClassInitialize
KeRaiseIrqlToDpcLevel
KfAcquireSpinLock
KeGetCurrentIrql
ExReleaseFastMutex
ExAcquireFastMutex
KfLowerIrql
KfRaiseIrql
KfReleaseSpinLock

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
??0CBlobConfig@@QAE@ABV0@@Z
??0CBlobConfig@@QAE@K@Z
??0CContext@@QAE@ABV0@@Z
??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QAE@ABV0@@Z
??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
??0CDebugLog@@QAE@ABV0@@Z
??0CDebugLog@@QAE@PBG@Z
??0CDebugLogEx@@QAE@ABV0@@Z
??0CDebugLogEx@@QAE@K@Z
??0CDelayLoadThread@@QAE@ABV0@@Z
??0CDelayLoadThread@@QAE@XZ
??0CExclusionExtConfig@@QAE@ABV0@@Z
??0CExclusionExtConfig@@QAE@KKE@Z
??0CExclusionFileNameConfig@@QAE@ABV0@@Z
??0CExclusionFileNameConfig@@QAE@KK@Z
??0CExclusionFilePathConfig@@QAE@ABV0@@Z
??0CExclusionFilePathConfig@@QAE@KK@Z
??0CExclusionFolderConfig@@QAE@ABV0@@Z
??0CExclusionFolderConfig@@QAE@KK@Z
??0CExclusionRegistryConfig@@QAE@ABV0@@Z
??0CExclusionRegistryConfig@@QAE@KK@Z
??0CFile@@QAE@ABV0@@Z
??0CFile@@QAE@E@Z
??0CFileExtension@@QAE@ABV0@@Z
??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
??0CInclusionExtConfig@@QAE@ABV0@@Z
??0CInclusionExtConfig@@QAE@KKE@Z
??0CInclusionFileNameConfig@@QAE@ABV0@@Z
??0CInclusionFileNameConfig@@QAE@KK@Z
??0CInclusionFilePathConfig@@QAE@ABV0@@Z
??0CInclusionFilePathConfig@@QAE@KK@Z
??0CInclusionFolderConfig@@QAE@ABV0@@Z
??0CInclusionFolderConfig@@QAE@KK@Z
??0CKEvent@@QAE@ABV0@@Z
??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
??0CList@@QAE@ABV0@@Z
??0CList@@QAE@KPAVIMemoryAllocator@@@Z
??0CLockEvent@@QAE@ABV0@@Z
??0CLockEvent@@QAE@XZ
??0CLockList@@QAE@ABV0@@Z
??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QAE@ABV0@@Z
??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
??0CMemoryPoolAllocator@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@XZ
??0CModuleConfigList@@QAE@ABV0@@Z
??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QAE@ABV0@@Z
??0CModuleFileExtConfig@@QAE@KKE@Z
??0CModuleFlagConfig@@QAE@ABV0@@Z
??0CModuleFlagConfig@@QAE@K@Z
??0CModuleMultiStringConfig@@QAE@ABV0@@Z
??0CModuleMultiStringConfig@@QAE@KK@Z
??0CModuleStringConfig@@QAE@ABV0@@Z
??0CModuleStringConfig@@QAE@K@Z
??0CNoLockList@@QAE@ABV0@@Z
??0CNoLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CSmartLock@@QAE@AAVCLockEvent@@@Z
??0CSmartLock@@QAE@XZ
??0CSmartReference@@QAE@AAJ@Z
??0CSmartReference@@QAE@AAK@Z
??0CSmartResource@@QAE@AAVCResource@@E@Z
??0CStrList@@QAE@ABV0@@Z
??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
??0CSystemThread@@QAE@ABV0@@Z
??0CSystemThread@@QAE@K@Z
??0CUserFuncAdapterJob@@QAE@ABV0@@Z
??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z01@Z
??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@E@Z
??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
??0CWorkerThreadJobQueue@@QAE@K@Z
??0CWorkerThreadPool@@QAE@ABV0@@Z
??0CWorkerThreadPool@@QAE@K@Z
??0CWorkerThreadPoolEx@@QAE@ABV0@@Z
??0CWorkerThreadPoolEx@@QAE@KK@Z
??0IMemoryAllocator@@QAE@ABV0@@Z
??0IMemoryAllocator@@QAE@XZ
??1CAutoUpdateConfigThread@@UAE@XZ
??1CBlobConfig@@UAE@XZ
??1CContext@@UAE@XZ
??1CContextList@@UAE@XZ
??1CDebugLog@@UAE@XZ
??1CDebugLogEx@@UAE@XZ
??1CDelayLoadThread@@UAE@XZ
??1CExclusionExtConfig@@UAE@XZ
??1CExclusionFileNameConfig@@UAE@XZ
??1CExclusionFilePathConfig@@UAE@XZ
??1CExclusionFolderConfig@@UAE@XZ
??1CExclusionRegistryConfig@@UAE@XZ
??1CFile@@UAE@XZ
??1CFileExtension@@UAE@XZ
??1CInclusionExtConfig@@UAE@XZ
??1CInclusionFileNameConfig@@UAE@XZ
??1CInclusionFilePathConfig@@UAE@XZ
??1CInclusionFolderConfig@@UAE@XZ
??1CKEvent@@UAE@XZ
??1CList@@UAE@XZ
??1CLockEvent@@UAE@XZ
??1CLockList@@UAE@XZ
??1CMemoryAllocator@@UAE@XZ
??1CMemoryPoolAllocator@@UAE@XZ
??1CModuleConfig@@UAE@XZ
??1CModuleConfigList@@UAE@XZ
??1CModuleFileExtConfig@@UAE@XZ
??1CModuleFlagConfig@@UAE@XZ
??1CModuleMultiStringConfig@@UAE@XZ
??1CModuleStringConfig@@UAE@XZ
??1CNoLockList@@UAE@XZ
??1CSmartLock@@QAE@XZ
??1CSmartReference@@QAE@XZ
??1CSmartResource@@QAE@XZ
??1CStrList@@UAE@XZ
??1CSystemThread@@UAE@XZ
??1CUserFuncAdapterJob@@UAE@XZ
??1CWorkerThread@@UAE@XZ
??1CWorkerThreadJob@@UAE@XZ
??1CWorkerThreadJobQueue@@UAE@XZ
??1CWorkerThreadPool@@UAE@XZ
??1CWorkerThreadPoolEx@@UAE@XZ
??1IMemoryAllocator@@UAE@XZ
??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??2CMemoryAllocator@@SGPAXI@Z
??2CMemoryPoolAllocator@@SGPAXI@Z
??3@YAXPAX@Z
??3@YAXPAXI@Z
??3IMemoryAllocator@@SGXPAX@Z
??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
??4CBlobConfig@@QAEAAV0@ABV0@@Z
??4CContext@@QAEAAV0@ABV0@@Z
??4CDebugLog@@QAEAAV0@ABV0@@Z
??4CDebugLogEx@@QAEAAV0@ABV0@@Z
??4CDelayLoadThread@@QAEAAV0@ABV0@@Z
??4CFile@@QAEAAV0@ABV0@@Z
??4CKEvent@@QAEAAV0@ABV0@@Z
??4CLockEvent@@QAEAAV0@ABV0@@Z
??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
??4CModuleConfig@@QAEAAV0@ABV0@@Z
??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
??4CSmartResource@@QAEAAV0@ABV0@@Z
??4CSystemThread@@QAEAAV0@ABV0@@Z
??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
??4CWorkerThread@@QAEAAV0@ABV0@@Z
??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CDebugLogEx@@6B@
??_7CDelayLoadThread@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CInclusionExtConfig@@6B@
??_7CInclusionFileNameConfig@@6B@
??_7CInclusionFilePathConfig@@6B@
??_7CInclusionFolderConfig@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CNoLockList@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7CWorkerThreadPoolEx@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QAEXXZ
??_FCFile@@QAEXXZ
??_FCFileExtension@@QAEXXZ
??_FCModuleConfigList@@QAEXXZ
??_FCStrList@@QAEXXZ
??_FCSystemThread@@QAEXXZ
??_FCWorkerThread@@QAEXXZ
??_FCWorkerThreadJob@@QAEXXZ
??_FCWorkerThreadJobQueue@@QAEXXZ
??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??_V@YAXPAX@Z
?Acquire@CLockEvent@@QAEXXZ
?Add@CContextList@@QAEEPAVCContext@@@Z
?Add@CFileExtension@@QAEEPBGK@Z
?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
?Add@CStrList@@QAEEPBG@Z
?AddNode@CLockList@@UAEEQAXE@Z
?AddNode@CNoLockList@@UAEEQAXE@Z
?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QAEXXZ
?CheckNode@CLockList@@UAEHQAX@Z
?CheckNode@CNoLockList@@UAEHQAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
?Cleanup@CBlobConfig@@AAEXXZ
?Cleanup@CModuleFileExtConfig@@IAEXXZ
?Cleanup@CModuleMultiStringConfig@@IAEXXZ
?Cleanup@CModuleStringConfig@@AAEXXZ
?Close@CFile@@QAEJXZ
?Count@CLockList@@QAEKXZ
?Count@CNoLockList@@QAEKXZ
?Create@CFile@@QAEJPBGKKKK@Z
?Create@CSystemThread@@QAEEXZ
?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
?CreatePool@CWorkerThreadPool@@QAEEXZ
?CreatePool@CWorkerThreadPoolEx@@QAEEXZ
?CreateThreads@CWorkerThreadPool@@QAEEK@Z
?CreateThreads@CWorkerThreadPoolEx@@QAEEK@Z
?CreateWIRP@CFile@@QAEJPBGKKKK@Z
?Delete@CFile@@QAEJXZ
?Delete@CFileExtension@@QAEEPBGK@Z
?Delete@CStrList@@QAEEPBG@Z
?DeleteAll@CList@@UAEXXZ
?DeleteAll@CLockList@@UAEXXZ
?DeleteAll@CNoLockList@@UAEXXZ
?DeleteNode@CContextList@@MAEXPAX@Z
?DeleteNode@CList@@UAEXPAX@Z
?DeleteNode@CModuleConfigList@@MAEXPAX@Z
?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YGXPAPAX@Z
?DoIt@CWorkerThreadJob@@QAEJXZ
?EntryPoint@CSystemThread@@KGXPAX@Z
?Find@CContextList@@QAEPAVCContext@@K@Z
?Find@CContextList@@QAEPAVCContext@@PAX@Z
?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FindNode@CContextList@@IAEPAXPAX@Z
?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FinishFunction@CUserFuncAdapterJob@@MAEXXZ
?FinishIt@CWorkerThreadJob@@QAEJXZ
?First@CList@@UAEPAXXZ
?First@CLockList@@UAEPAXXZ
?First@CNoLockList@@UAEPAXXZ
?Free@CMemoryAllocator@@UAEXPAX@Z
?Free@CMemoryPoolAllocator@@UAEXPAX@Z
?GetAttributes@CFile@@QAEKXZ
?GetBasicInfomration@CFile@@IAEJXZ
?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
?GetCategory@CContext@@QAEKXZ
?GetData@CBlobConfig@@QAEHPAXPAK@Z
?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QAEKXZ
?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
?GetData@CModuleStringConfig@@QAEPAGXZ
?GetData@CStrList@@QAEEPAGPAK@Z
?GetDataType@CModuleConfig@@QAEKXZ
?GetEngineContext@CContext@@QAEPAXXZ
?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFileSizeWIRP@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UAEJKPAK@Z
?GetID@CModuleConfig@@QAEKXZ
?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QAEKXZ
?GetLinkContext@CContext@@QAEPAXXZ
?GetLogFlag@CDebugLog@@QAEKXZ
?GetLogFlag@CDebugLogEx@@QAEKXZ
?GetModuleId@CModuleConfig@@QAEKXZ
?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_KTHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_KTHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QAEKXZ
?GetSize@CBlobConfig@@QAEKXZ
?GetStringConfig@CContext@@QAEPAGK@Z
?GetStringConfig@CContext@@UAEJKPAGPAK@Z
?GetThreadCount@CWorkerThreadPool@@QAEKXZ
?GetThreadCount@CWorkerThreadPoolEx@@QAEKXZ
?GetThreadID@CSystemThread@@QAEKXZ
?GetType@CContext@@QAEKXZ
?GetUserParameter@CContext@@QAEKXZ
?InitProcMon@CDebugLogEx@@IAEXXZ
?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
?InitializeFlagConfig@CContext@@QAEHKK@Z
?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
?InitializeStringConfig@CContext@@QAEHKPBG@Z
?Insert@CList@@UAEXQAXE@Z
?Insert@CLockList@@UAEXQAXE@Z
?Insert@CNoLockList@@UAEXQAXE@Z
?InsertAfter@CList@@UAEXPAX0@Z
?InsertBefore@CList@@UAEXPAX0@Z
?Instance@CWorkerThreadPool@@SGPAV1@XZ
?IsEmpty@CList@@UAEEXZ
?IsEmpty@CLockList@@UAEEXZ
?IsEmpty@CNoLockList@@UAEEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
?IsFull@CLockList@@QBEEXZ
?IsFull@CNoLockList@@QBEEXZ
?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionExtConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFileNameConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFilePathConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFolderConfig@@QAEEPBG@Z
?IsOpened@CFile@@QAEEXZ
?IsTerminated@CWorkerThreadPool@@QAEEXZ
?IsTerminated@CWorkerThreadPoolEx@@QAEEXZ
?IsValid@CMemoryAllocator@@UAEEXZ
?IsValid@CMemoryPoolAllocator@@UAEEXZ
?IsValid@IMemoryAllocator@@UAEEXZ
?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
?IsWorkerThread@CWorkerThreadPoolEx@@QAEEK@Z
?JobFunction@CUserFuncAdapterJob@@MAEXXZ
?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
?JobQueue@CWorkerThreadPoolEx@@QAEAAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QAEKXZ
?Limit@CNoLockList@@QAEKXZ
?MatchAllExtensions@CFileExtension@@QAEEXZ
?MatchNoExtensions@CFileExtension@@QAEEXZ
?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
?NeedDelete@CWorkerThreadJob@@QAEEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
?NewNode@CList@@UAEPAXXZ
?NewNode@CStrList@@EAEPAXXZ
?NewNodeVariant@CList@@IAEPAXK@Z
?Next@CList@@UBEPAXQAX@Z
?Next@CLockList@@UBEPAXQAX@Z
?Next@CNoLockList@@UBEPAXQAX@Z
?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
?NotityTerminate@CWorkerThread@@QAEXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
?PostJobToWorkerThread@CWorkerThreadPoolEx@@QAEJP6GXPAX@Z0E1@Z
?Pulse@CKEvent@@QAEJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPoolEx@@QAEJPAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
?Read@CFile@@QAEJPADKPAK@Z
?ReadWIRP@CFile@@QAEJPADKPAK@Z
?ReferenceCount@CContext@@QAEAAKXZ
?Release@CLockEvent@@QAEXXZ
?Remove@CContextList@@UAEEQAX@Z
?Remove@CList@@UAEEQAX@Z
?Remove@CLockList@@UAEEQAX@Z
?Remove@CNoLockList@@UAEEQAX@Z
?RemoveHead@CList@@UAEPAXXZ
?RemoveHead@CLockList@@UAEPAXXZ
?RemoveHead@CNoLockList@@UAEPAXXZ
?RemoveTail@CList@@UAEPAXXZ
?RemoveTail@CLockList@@UAEPAXXZ
?RemoveTail@CNoLockList@@UAEPAXXZ
?Reset@CKEvent@@QAEXXZ
?ResetData@CInclusionExtConfig@@QAEXXZ
?ResetData@CInclusionFileNameConfig@@QAEXXZ
?ResetData@CInclusionFilePathConfig@@QAEXXZ
?ResetData@CInclusionFolderConfig@@QAEXXZ
?RestoreCR0@@YGXPAX@Z
?Run@CAutoUpdateConfigThread@@UAEXXZ
?Run@CDelayLoadThread@@UAEXXZ
?Run@CWorkerThread@@UAEXXZ
?SeekToEnd@CFile@@QAEJXZ
?Set@CKEvent@@QAEJJE@Z
?SetAttributes@CFile@@QAEJK@Z
?SetBlobCofig@CContext@@UAEJKPAXK@Z
?SetData@CBlobConfig@@QAEHPAXK@Z
?SetData@CModuleFileExtConfig@@QAEHPBG@Z
?SetData@CModuleFlagConfig@@QAEHK@Z
?SetData@CModuleMultiStringConfig@@QAEHPBGK@Z
?SetData@CModuleStringConfig@@QAEHPBG@Z
?SetEngineContext@CContext@@QAEXPAX@Z
?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
?SetFlagConfig@CContext@@UAEJKK@Z
?SetLinkContext@CContext@@QAEXPAX@Z
?SetLogFlag@CDebugLog@@QAEEK@Z
?SetLogFlag@CDebugLogEx@@QAEEK@Z
?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
?SetMultiStringConfig@CContext@@UAEJKPBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
?SetPriority@CSystemThread@@QAEXK@Z
?SetStopUse@CContext@@QAEXXZ
?SetStringConfig@CContext@@UAEJKPBG@Z
?Setup@CSystemThread@@MAEXXZ
?StopUse@CContext@@QAEHXZ
?TearDown@CSystemThread@@MAEXXZ
?Terminate@CSystemThread@@QAEXE@Z
?Terminate@CWorkerThreadPool@@QAEEXZ
?Terminate@CWorkerThreadPoolEx@@QAEEXZ
?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QAEXXZ
?WaitForInit@CDelayLoadThread@@QAEEXZ
?WaitForLoad@CDelayLoadThread@@QAEEXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
?WaitQueueEmpty@CWorkerThreadJobQueue@@QAEXXZ
?Write@CDebugLog@@QAAXPBDZZ
?Write@CDebugLogEx@@QAAXPBDZZ
?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
?WriteDataToFile@CDebugLogEx@@IAEXPADK@Z
?WriteDataToProcMonW@CDebugLogEx@@IAEXPAD@Z
?WriteSystemInformation@CDebugLog@@QAEXXZ
?WriteSystemInformation@CDebugLogEx@@QAEXXZ
?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
?WriteSystemStringInformation@CDebugLogEx@@IAEXPBG@Z
?WriteToFile@CDebugLog@@IAEXPADK@Z
?WriteToProcMonW@CDebugLogEx@@IAEXPAU_UNICODE_STRING@@@Z
?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
?_pPagedAllocator@@3PAVCMemoryAllocator@@A
?m_lpInstance@CWorkerThreadPool@@1PAV1@A
?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
_AllocFullFileName@8
_DeInitKm2UmCommunication@0
_DeInitKmLPC@0
_DuplicateFullFileName@4
_FreeFullFileName@4
_GetKm2UmMode@0
_GetModuleInfoByAddress@8
_GetModuleInfoByModuleName@8
_InitKm2UmCommunication@8
_InitKmLPC@0
_IsVerifierCodeCheckFlagOn@0
_IsWindows8_1_update@4
_KmCallUm@8
_KmCallUmByLPC@8
_KmCallUmEx@12
_KmCleanupCommPortAPIs@0
_KmGetUmInitProcess@0
_KmSetBackupCommPortAPIs@4
_KmSetCommPortAPIs@4
_ModGetExportProcAddress@8
_ModLoadDLLToBuffer@4
_ModLoadDLLToBufferWithImageSize@8
_ModLoadModule@8
_ModUnLoadModule@4
_NormalizeFileName@4
_NormalizeFullNtPathToDosName@4
_TmCommConfigRoutine@4
_UtilAddDeviceInDriveTable@4
_UtilAddReparsePointMapping@8
_UtilCleanFileReadOnly@4
_UtilCloseExclusiveHandle@12
_UtilCreateDosFileName@8
_UtilDeleteFileForce@4
_UtilGetDeviceObjectName@8
_UtilGetFileNameFromFileObject@4
_UtilGetFileObjectForProcessByEPROC@8
_UtilGetFileObjectFromFileName@12
_UtilGetProcessName@12
_UtilGetSystemDirectory@4
_UtilGetSystemDirectoryEx@0
_UtilGetSystemDirectoryLength@0
_UtilGetSystemTime@4
_UtilIoSetFileInfo@24
_UtilIopCreateFileIRP@40
_UtilKeGetLowFileDevice@16
_UtilModuleIATHook@24
_UtilModuleIATUnHook@8
_UtilPostJobToWorkerThread@12
_UtilQueryExclusiveHandle@12
_UtilQueryKeyValue@24
_UtilRemoveDeviceFromDriveTable@4
_UtilVolumeDeviceToDosName@8
_UtilWaitValueChangeToZero@8
_UtilWriteVersionToRegistry@8
_UtilbuildDynamicDiskMappingTable@0
_UtlWriteBinValueKeyToRegistry@16
_ValidateAddressWithSize@20
__ResetProtectFromClose@4
__UtilDosPathNameToNtPathName@12

Sections

Expand

.text
.rdata
.data
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2017-05-18 04:55:14
MD5	09927915aba84c8acd91efdaac674b86
SHA1	b304cb10c88ddd8461bad429ebfd2fd1b809ac2b
SHA256	bcfc2c9883e6c1b8429be44cc4db988a9eecb544988fbd756d18cfca6201876f
Authentihash MD5	d1f83eec944debf86cb97352d63f8fd3
Authentihash SHA1	923910c609673b7ffb23a0c3cd9d33aedd69607a
Authentihash SHA256	6bdf465db8860c80051d4d1b9db1c3153ab65c252f9500b85efc56d255b4cb1d
RichPEHeaderHash MD5	9700ee6a34ba2b25ddc817d1a0743be8
RichPEHeaderHash SHA1	80283ee3a81f182a56da60791555c7a5ac734e1c
RichPEHeaderHash SHA256	7f352214a0d86b5a789492b8c5d18b8bb5fe7ec7145b883dbf27d6f1bc31a950
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	Trend Micro Eyes
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 7e93ebfb7cc64e59ea4b9a77d406fc3b

Field	Value
ToBeSigned (TBS) MD5	d0785ad36e427c92b19f6826ab1e8020
ToBeSigned (TBS) SHA1	365b7a9c21bd9373e49052c3e7b3e4646ddd4d43
ToBeSigned (TBS) SHA256	c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2
ValidFrom	2012-12-21 00:00:00
ValidTo	2020-12-30 23:59:59
Signature	03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	7e93ebfb7cc64e59ea4b9a77d406fc3b
Version	3

Certificate 0ecff438c8febf356e04d86a981b1a50

Field	Value
ToBeSigned (TBS) MD5	e9d38360b914c8863f6cba3ee58764d3
ToBeSigned (TBS) SHA1	4cba8eae47b6bf76f20b3504b98b8f062694a89b
ToBeSigned (TBS) SHA256	88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4
ValidFrom	2012-10-18 00:00:00
ValidTo	2020-12-29 23:59:59
Signature	783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	0ecff438c8febf356e04d86a981b1a50
Version	3

Certificate 497c4fad471540e6e453d0cafb155740

Field	Value
ToBeSigned (TBS) MD5	78eaa337666217b1c16a9a0ebd0b8434
ToBeSigned (TBS) SHA1	ff9cb835e78f6185eed4372096c3bae53b17d18d
ToBeSigned (TBS) SHA256	1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250
Subject	C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.
ValidFrom	2017-04-27 00:00:00
ValidTo	2018-07-16 23:59:59
Signature	f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	497c4fad471540e6e453d0cafb155740
Version	3

Certificate 611993e400000000001c

Field	Value
ToBeSigned (TBS) MD5	78a717e082dcc1cda3458d917e677d14
ToBeSigned (TBS) SHA1	4a872e0e51f9b304469cd1dedb496ee9b8b983a4
ToBeSigned (TBS) SHA256	317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
ValidFrom	2011-02-22 19:25:17
ValidTo	2021-02-22 19:35:17
Signature	812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	611993e400000000001c
Version	3

Certificate 5200e5aa2556fc1a86ed96c9d44b33c7

Field	Value
ToBeSigned (TBS) MD5	b30c31a572b0409383ed3fbe17e56e81
ToBeSigned (TBS) SHA1	4843a82ed3b1f2bfbee9671960e1940c942f688d
ToBeSigned (TBS) SHA256	03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-02-08 00:00:00
ValidTo	2020-02-07 23:59:59
Signature	5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	5200e5aa2556fc1a86ed96c9d44b33c7
Version	3

Imports

Expand

ntoskrnl.exe

Imported Functions

Expand

RtlInitUnicodeString
KeInitializeEvent
KeClearEvent
KeSetEvent
KeEnterCriticalRegion
KeLeaveCriticalRegion
KeWaitForSingleObject
ExFreePoolWithTag
ExAcquireFastMutexUnsafe
ExReleaseFastMutexUnsafe
ProbeForRead
ProbeForWrite
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
MmProbeAndLockPages
MmUnlockPages
MmMapLockedPagesSpecifyCache
IoAllocateMdl
IoFreeMdl
IoGetCurrentProcess
ObfReferenceObject
ObfDereferenceObject
ZwClose
ZwCreateSection
ZwOpenSection
ZwMapViewOfSection
ZwUnmapViewOfSection
ZwOpenEvent
KePulseEvent
KeStackAttachProcess
KeUnstackDetachProcess
ObOpenObjectByPointer
ZwAllocateVirtualMemory
ZwFreeVirtualMemory
ZwSetEvent
__C_specific_handler
PsProcessType
wcslen
wcsncpy
wcsrchr
RtlUnicodeStringToInteger
ZwWaitForSingleObject
ZwRequestWaitReplyPort
ZwConnectPort
_stricmp
ExAllocatePoolWithTag
MmIsAddressValid
RtlImageNtHeader
ZwQuerySystemInformation
SeCaptureSubjectContext
SeReleaseSubjectContext
SeAccessCheck
ObGetObjectSecurity
ObReleaseObjectSecurity
PsGetProcessExitTime
PsThreadType
MmSectionObjectType
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
KeInitializeSemaphore
KeReleaseSemaphore
ExAcquireFastMutex
ExReleaseFastMutex
RtlCreateAcl
RtlAddAccessAllowedAce
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
KeDelayExecutionThread
ExGetPreviousMode
DbgPrint
swprintf
RtlCopyUnicodeString
IofCompleteRequest
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
ObReferenceObjectByHandle
PsGetCurrentProcessId
ZwCreateEvent
ExEventObjectType
_wcsnicmp
PsSetCreateProcessNotifyRoutine
ZwQueryInformationProcess
PsLookupProcessByProcessId
ZwOpenDirectoryObject
ExInitializeResourceLite
ExDeleteResourceLite
ZwCreateFile
ZwQueryInformationFile
ZwSetInformationFile
ZwReadFile
ZwWriteFile
towupper
MmGetSystemRoutineAddress
ObReferenceObjectByPointer
PsGetCurrentThreadId
ObQueryNameString
PsGetVersion
_snprintf
_vsnprintf
RtlInitAnsiString
wcscat
RtlFreeUnicodeString
RtlTimeToTimeFields
KeWaitForMultipleObjects
ExSystemTimeToLocalTime
ZwCreateKey
ZwDeviceIoControlFile
ZwNotifyChangeKey
ZwOpenFile
ZwQueryVolumeInformationFile
mbstowcs
IoGetDeviceObjectPointer
IoBuildDeviceIoControlRequest
IofCallDriver
IoCreateFile
RtlEqualUnicodeString
RtlAppendUnicodeStringToString
RtlUpcaseUnicodeChar
_snwprintf
strlen
_strnicmp
strncpy
NtOpenProcess
NtQueryInformationProcess
ObOpenObjectByName
KeSetPriorityThread
PsCreateSystemThread
PsTerminateSystemThread
KeNumberProcessors
RtlLengthSecurityDescriptor
ZwOpenKey
ZwDeleteKey
ZwDeleteValueKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryKey
ZwQueryValueKey
ZwSetValueKey
ZwTerminateProcess
ZwOpenProcess
ZwDuplicateObject
ZwQuerySecurityObject
ZwSetSecurityObject
ZwQueryDirectoryObject
ZwQueryDirectoryFile
NtCreateFile
NtQueryInformationFile
NtSetInformationFile
IoFileObjectType
ObInsertObject
wcschr
wcsncmp
RtlQueryRegistryValues
RtlAppendUnicodeToString
RtlCompareMemory
MmBuildMdlForNonPagedPool
IoAllocateIrp
IoFreeIrp
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
RtlUpcaseUnicodeString
NtClose
ZwSetInformationObject
SeQueryAuthenticationIdToken
MmSystemRangeStart
IoGetFileObjectGenericMapping
ObCreateObject
SeCreateAccessState
IoAcquireVpbSpinLock
IoReleaseVpbSpinLock
wcstombs
strncat
wcsncat
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
strcpy
wcsstr
RtlCompareUnicodeString
DbgPrintEx
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
ExAllocatePool
ExpInterlockedPopEntrySList
IoBuildSynchronousFsdRequest
IoGetStackLimits
IoGetDeviceInterfaces
IoRegisterPlugPlayNotification
IoUnregisterPlugPlayNotification
IoGetConfigurationInformation
FsRtlIsNameInExpression
IoDeviceObjectType
IoCreateDevice
RtlGetOwnerSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
RtlLengthSid
SeExports
IoIsWdmVersionAvailable
RtlAbsoluteToSelfRelativeSD
RtlAnsiStringToUnicodeString
_purecall
KeBugCheckEx

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QEAA@AEBV0@@Z
??0CAutoUpdateConfigThread@@QEAA@PEAU_UNICODE_STRING@@P6AX0PEAX@Z1@Z
??0CBlobConfig@@QEAA@AEBV0@@Z
??0CBlobConfig@@QEAA@K@Z
??0CContext@@QEAA@AEBV0@@Z
??0CContext@@QEAA@KP6AJPEAU_EVENT_REPORT@@PEAXPEAU_TMCE_REPORT@@PEAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QEAA@AEBV0@@Z
??0CContextList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CDebugLog@@QEAA@AEBV0@@Z
??0CDebugLog@@QEAA@PEBG@Z
??0CDebugLogEx@@QEAA@AEBV0@@Z
??0CDebugLogEx@@QEAA@K@Z
??0CDelayLoadThread@@QEAA@AEBV0@@Z
??0CDelayLoadThread@@QEAA@XZ
??0CExclusionExtConfig@@QEAA@AEBV0@@Z
??0CExclusionExtConfig@@QEAA@KKE@Z
??0CExclusionFileNameConfig@@QEAA@AEBV0@@Z
??0CExclusionFileNameConfig@@QEAA@KK@Z
??0CExclusionFilePathConfig@@QEAA@AEBV0@@Z
??0CExclusionFilePathConfig@@QEAA@KK@Z
??0CExclusionFolderConfig@@QEAA@AEBV0@@Z
??0CExclusionFolderConfig@@QEAA@KK@Z
??0CExclusionRegistryConfig@@QEAA@AEBV0@@Z
??0CExclusionRegistryConfig@@QEAA@KK@Z
??0CFile@@QEAA@AEBV0@@Z
??0CFile@@QEAA@E@Z
??0CFileExtension@@QEAA@AEBV0@@Z
??0CFileExtension@@QEAA@KEEPEAVIMemoryAllocator@@@Z
??0CInclusionExtConfig@@QEAA@AEBV0@@Z
??0CInclusionExtConfig@@QEAA@KKE@Z
??0CInclusionFileNameConfig@@QEAA@AEBV0@@Z
??0CInclusionFileNameConfig@@QEAA@KK@Z
??0CInclusionFilePathConfig@@QEAA@AEBV0@@Z
??0CInclusionFilePathConfig@@QEAA@KK@Z
??0CInclusionFolderConfig@@QEAA@AEBV0@@Z
??0CInclusionFolderConfig@@QEAA@KK@Z
??0CKEvent@@QEAA@AEBV0@@Z
??0CKEvent@@QEAA@W4_EVENT_TYPE@@E@Z
??0CList@@QEAA@AEBV0@@Z
??0CList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CLockEvent@@QEAA@AEBV0@@Z
??0CLockEvent@@QEAA@XZ
??0CLockList@@QEAA@AEBV0@@Z
??0CLockList@@QEAA@KKPEAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IEAA@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QEAA@AEBV0@@Z
??0CMemoryPoolAllocator@@IEAA@W4_POOL_TYPE@@_K1K@Z
??0CMemoryPoolAllocator@@QEAA@AEBV0@@Z
??0CModuleConfig@@QEAA@AEBV0@@Z
??0CModuleConfig@@QEAA@XZ
??0CModuleConfigList@@QEAA@AEBV0@@Z
??0CModuleConfigList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QEAA@AEBV0@@Z
??0CModuleFileExtConfig@@QEAA@KKE@Z
??0CModuleFlagConfig@@QEAA@AEBV0@@Z
??0CModuleFlagConfig@@QEAA@K@Z
??0CModuleMultiStringConfig@@QEAA@AEBV0@@Z
??0CModuleMultiStringConfig@@QEAA@KK@Z
??0CModuleStringConfig@@QEAA@AEBV0@@Z
??0CModuleStringConfig@@QEAA@K@Z
??0CNoLockList@@QEAA@AEBV0@@Z
??0CNoLockList@@QEAA@KKPEAVIMemoryAllocator@@@Z
??0CSmartLock@@QEAA@AEAVCLockEvent@@@Z
??0CSmartLock@@QEAA@XZ
??0CSmartReference@@QEAA@AEAJ@Z
??0CSmartReference@@QEAA@AEAK@Z
??0CSmartResource@@QEAA@AEAVCResource@@E@Z
??0CStrList@@QEAA@AEBV0@@Z
??0CStrList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CSystemThread@@QEAA@AEBV0@@Z
??0CSystemThread@@QEAA@K@Z
??0CUserFuncAdapterJob@@QEAA@AEBV0@@Z
??0CUserFuncAdapterJob@@QEAA@P6AXPEAX@Z01@Z
??0CWorkerThread@@IEAA@PEAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QEAA@AEBV0@@Z
??0CWorkerThreadJob@@QEAA@AEBV0@@Z
??0CWorkerThreadJob@@QEAA@E@Z
??0CWorkerThreadJobQueue@@QEAA@AEBV0@@Z
??0CWorkerThreadJobQueue@@QEAA@K@Z
??0CWorkerThreadPool@@QEAA@AEBV0@@Z
??0CWorkerThreadPool@@QEAA@K@Z
??0CWorkerThreadPoolEx@@QEAA@AEBV0@@Z
??0CWorkerThreadPoolEx@@QEAA@KK@Z
??0IMemoryAllocator@@QEAA@AEBV0@@Z
??0IMemoryAllocator@@QEAA@XZ
??1CAutoUpdateConfigThread@@UEAA@XZ
??1CBlobConfig@@UEAA@XZ
??1CContext@@UEAA@XZ
??1CContextList@@UEAA@XZ
??1CDebugLog@@UEAA@XZ
??1CDebugLogEx@@UEAA@XZ
??1CDelayLoadThread@@UEAA@XZ
??1CExclusionExtConfig@@UEAA@XZ
??1CExclusionFileNameConfig@@UEAA@XZ
??1CExclusionFilePathConfig@@UEAA@XZ
??1CExclusionFolderConfig@@UEAA@XZ
??1CExclusionRegistryConfig@@UEAA@XZ
??1CFile@@UEAA@XZ
??1CFileExtension@@UEAA@XZ
??1CInclusionExtConfig@@UEAA@XZ
??1CInclusionFileNameConfig@@UEAA@XZ
??1CInclusionFilePathConfig@@UEAA@XZ
??1CInclusionFolderConfig@@UEAA@XZ
??1CKEvent@@UEAA@XZ
??1CList@@UEAA@XZ
??1CLockEvent@@UEAA@XZ
??1CLockList@@UEAA@XZ
??1CMemoryAllocator@@UEAA@XZ
??1CMemoryPoolAllocator@@UEAA@XZ
??1CModuleConfig@@UEAA@XZ
??1CModuleConfigList@@UEAA@XZ
??1CModuleFileExtConfig@@UEAA@XZ
??1CModuleFlagConfig@@UEAA@XZ
??1CModuleMultiStringConfig@@UEAA@XZ
??1CModuleStringConfig@@UEAA@XZ
??1CNoLockList@@UEAA@XZ
??1CSmartLock@@QEAA@XZ
??1CSmartReference@@QEAA@XZ
??1CSmartResource@@QEAA@XZ
??1CStrList@@UEAA@XZ
??1CSystemThread@@UEAA@XZ
??1CUserFuncAdapterJob@@UEAA@XZ
??1CWorkerThread@@UEAA@XZ
??1CWorkerThreadJob@@UEAA@XZ
??1CWorkerThreadJobQueue@@UEAA@XZ
??1CWorkerThreadPool@@UEAA@XZ
??1CWorkerThreadPoolEx@@UEAA@XZ
??1IMemoryAllocator@@UEAA@XZ
??2@YAPEAX_KPEAVIMemoryAllocator@@PEBDK@Z
??2CMemoryAllocator@@SAPEAX_K@Z
??2CMemoryPoolAllocator@@SAPEAX_K@Z
??3@YAXPEAX@Z
??3@YAXPEAX_K@Z
??3IMemoryAllocator@@SAXPEAX@Z
??4CAutoUpdateConfigThread@@QEAAAEAV0@AEBV0@@Z
??4CBlobConfig@@QEAAAEAV0@AEBV0@@Z
??4CContext@@QEAAAEAV0@AEBV0@@Z
??4CDebugLog@@QEAAAEAV0@AEBV0@@Z
??4CDebugLogEx@@QEAAAEAV0@AEBV0@@Z
??4CDelayLoadThread@@QEAAAEAV0@AEBV0@@Z
??4CFile@@QEAAAEAV0@AEBV0@@Z
??4CKEvent@@QEAAAEAV0@AEBV0@@Z
??4CLockEvent@@QEAAAEAV0@AEBV0@@Z
??4CMemoryAllocator@@QEAAAEAV0@AEBV0@@Z
??4CMemoryPoolAllocator@@QEAAAEAV0@AEBV0@@Z
??4CModuleConfig@@QEAAAEAV0@AEBV0@@Z
??4CModuleFlagConfig@@QEAAAEAV0@AEBV0@@Z
??4CModuleStringConfig@@QEAAAEAV0@AEBV0@@Z
??4CSmartLock@@QEAAAEAV0@AEBV0@@Z
??4CSmartLock@@QEAAAEBV0@AEAVCLockEvent@@@Z
??4CSmartResource@@QEAAAEAV0@AEBV0@@Z
??4CSystemThread@@QEAAAEAV0@AEBV0@@Z
??4CUserFuncAdapterJob@@QEAAAEAV0@AEBV0@@Z
??4CWorkerThread@@QEAAAEAV0@AEBV0@@Z
??4CWorkerThreadJob@@QEAAAEAV0@AEBV0@@Z
??4IMemoryAllocator@@QEAAAEAV0@AEBV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CDebugLogEx@@6B@
??_7CDelayLoadThread@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CInclusionExtConfig@@6B@
??_7CInclusionFileNameConfig@@6B@
??_7CInclusionFilePathConfig@@6B@
??_7CInclusionFolderConfig@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CNoLockList@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7CWorkerThreadPoolEx@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QEAAXXZ
??_FCFile@@QEAAXXZ
??_FCFileExtension@@QEAAXXZ
??_FCModuleConfigList@@QEAAXXZ
??_FCStrList@@QEAAXXZ
??_FCSystemThread@@QEAAXXZ
??_FCWorkerThread@@QEAAXXZ
??_FCWorkerThreadJob@@QEAAXXZ
??_FCWorkerThreadJobQueue@@QEAAXXZ
??_U@YAPEAX_KPEAVIMemoryAllocator@@PEBDK@Z
??_V@YAXPEAX@Z
??_V@YAXPEAX_K@Z
?Acquire@CLockEvent@@QEAAXXZ
?Add@CContextList@@QEAAEPEAVCContext@@@Z
?Add@CFileExtension@@QEAAEPEBGK@Z
?Add@CModuleConfigList@@QEAAEPEAVCModuleConfig@@@Z
?Add@CStrList@@QEAAEPEBG@Z
?AddNode@CLockList@@UEAAEQEAXE@Z
?AddNode@CNoLockList@@UEAAEQEAXE@Z
?Alloc@CMemoryAllocator@@UEAAPEAX_KPEBDK@Z
?Alloc@CMemoryPoolAllocator@@UEAAPEAX_KPEBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IEAAPEAX_K@Z
?AttachJobQueue@CWorkerThread@@QEAAXPEAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QEAAXXZ
?CheckNode@CLockList@@UEAAHQEAX@Z
?CheckNode@CNoLockList@@UEAAHQEAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QEAAXXZ
?Cleanup@CBlobConfig@@AEAAXXZ
?Cleanup@CModuleFileExtConfig@@IEAAXXZ
?Cleanup@CModuleMultiStringConfig@@IEAAXXZ
?Cleanup@CModuleStringConfig@@AEAAXXZ
?Close@CFile@@QEAAJXZ
?Count@CLockList@@QEAAKXZ
?Count@CNoLockList@@QEAAKXZ
?Create@CFile@@QEAAJPEBGKKKK@Z
?Create@CSystemThread@@QEAAEXZ
?CreateInstance@CMemoryAllocator@@SAPEAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SAPEAV1@W4_POOL_TYPE@@_K1K@Z
?CreatePool@CWorkerThreadPool@@QEAAEXZ
?CreatePool@CWorkerThreadPoolEx@@QEAAEXZ
?CreateThreads@CWorkerThreadPool@@QEAAEK@Z
?CreateThreads@CWorkerThreadPoolEx@@QEAAEK@Z
?CreateWIRP@CFile@@QEAAJPEBGKKKK@Z
?Delete@CFile@@QEAAJXZ
?Delete@CFileExtension@@QEAAEPEBGK@Z
?Delete@CStrList@@QEAAEPEBG@Z
?DeleteAll@CList@@UEAAXXZ
?DeleteAll@CLockList@@UEAAXXZ
?DeleteAll@CNoLockList@@UEAAXXZ
?DeleteNode@CContextList@@MEAAXPEAX@Z
?DeleteNode@CList@@UEAAXPEAX@Z
?DeleteNode@CModuleConfigList@@MEAAXPEAX@Z
?DeleteNode@CStrList@@EEAAXPEAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YAXPEAPEAX@Z
?DoIt@CWorkerThreadJob@@QEAAJXZ
?EntryPoint@CSystemThread@@KAXPEAX@Z
?Find@CContextList@@QEAAPEAVCContext@@K@Z
?Find@CContextList@@QEAAPEAVCContext@@PEAX@Z
?Find@CFileExtension@@QEAAPEAU_STR_LIST_NODE@CStrList@@PEBGK@Z
?Find@CModuleConfigList@@QEAAPEAVCModuleConfig@@K@Z
?Find@CStrList@@QEAAPEAU_STR_LIST_NODE@1@PEBG@Z
?FindNode@CContextList@@IEAAPEAXPEAX@Z
?FindPartiallyAndAllMatch@CStrList@@QEAAPEAU_STR_LIST_NODE@1@PEBG@Z
?FinishFunction@CUserFuncAdapterJob@@MEAAXXZ
?FinishIt@CWorkerThreadJob@@QEAAJXZ
?First@CList@@UEAAPEAXXZ
?First@CLockList@@UEAAPEAXXZ
?First@CNoLockList@@UEAAPEAXXZ
?Free@CMemoryAllocator@@UEAAXPEAX@Z
?Free@CMemoryPoolAllocator@@UEAAXPEAX@Z
?GetAttributes@CFile@@QEAAKXZ
?GetBasicInfomration@CFile@@IEAAJXZ
?GetBlobCofig@CContext@@UEAAJKPEAXPEAK@Z
?GetCategory@CContext@@QEAAKXZ
?GetData@CBlobConfig@@QEAAHPEAXPEAK@Z
?GetData@CModuleFileExtConfig@@QEAAHPEAGPEAK@Z
?GetData@CModuleFileExtConfig@@QEAAPEAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QEAAKXZ
?GetData@CModuleMultiStringConfig@@QEAAHPEAGPEAK@Z
?GetData@CModuleMultiStringConfig@@QEAAPEAVCStrList@@XZ
?GetData@CModuleStringConfig@@QEAAPEAGXZ
?GetData@CStrList@@QEAAEPEAGPEAK@Z
?GetDataType@CModuleConfig@@QEAAKXZ
?GetEngineContext@CContext@@QEAAPEAXXZ
?GetFileExtensionConfig@CContext@@QEAAPEAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UEAAJKPEAGPEAK@Z
?GetFileSize@CFile@@QEAAJPEAT_LARGE_INTEGER@@@Z
?GetFileSizeWIRP@CFile@@QEAAJPEAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UEAAJKPEAK@Z
?GetID@CModuleConfig@@QEAAKXZ
?GetJob@CWorkerThreadJobQueue@@QEAAPEAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QEAAKXZ
?GetLinkContext@CContext@@QEAAPEAXXZ
?GetLogFlag@CDebugLog@@QEAAKXZ
?GetLogFlag@CDebugLogEx@@QEAAKXZ
?GetModuleId@CModuleConfig@@QEAAKXZ
?GetMultiStringConfig@CContext@@QEAAPEAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UEAAJKPEAGPEAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QEAAPEAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPool@@QEAAPEAU_KTHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QEAAPEAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QEAAPEAU_KTHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QEAA_KXZ
?GetSize@CBlobConfig@@QEAAKXZ
?GetStringConfig@CContext@@QEAAPEAGK@Z
?GetStringConfig@CContext@@UEAAJKPEAGPEAK@Z
?GetThreadCount@CWorkerThreadPool@@QEAAKXZ
?GetThreadCount@CWorkerThreadPoolEx@@QEAAKXZ
?GetThreadID@CSystemThread@@QEAA_KXZ
?GetType@CContext@@QEAAKXZ
?GetUserParameter@CContext@@QEAA_KXZ
?InitProcMon@CDebugLogEx@@IEAAXXZ
?InitializeBlobConfig@CContext@@QEAAHKPEAXK@Z
?InitializeFileExtensionConfig@CContext@@QEAAHKPEBG@Z
?InitializeFlagConfig@CContext@@QEAAHKK@Z
?InitializeMultiStringConfig@CContext@@QEAAHKPEBG@Z
?InitializeStringConfig@CContext@@QEAAHKPEBG@Z
?Insert@CList@@UEAAXQEAXE@Z
?Insert@CLockList@@UEAAXQEAXE@Z
?Insert@CNoLockList@@UEAAXQEAXE@Z
?InsertAfter@CList@@UEAAXPEAX0@Z
?InsertBefore@CList@@UEAAXPEAX0@Z
?Instance@CWorkerThreadPool@@SAPEAV1@XZ
?IsEmpty@CList@@UEAAEXZ
?IsEmpty@CLockList@@UEAAEXZ
?IsEmpty@CNoLockList@@UEAAEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IEAAEK@Z
?IsFull@CLockList@@QEBAEXZ
?IsFull@CNoLockList@@QEBAEXZ
?IsInExclusionList@CExclusionExtConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionExtConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionFileNameConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionFilePathConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionFolderConfig@@QEAAEPEBG@Z
?IsOpened@CFile@@QEAAEXZ
?IsTerminated@CWorkerThreadPool@@QEAAEXZ
?IsTerminated@CWorkerThreadPoolEx@@QEAAEXZ
?IsValid@CMemoryAllocator@@UEAAEXZ
?IsValid@CMemoryPoolAllocator@@UEAAEXZ
?IsValid@IMemoryAllocator@@UEAAEXZ
?IsWorkerThread@CWorkerThreadPool@@QEAAE_K@Z
?IsWorkerThread@CWorkerThreadPoolEx@@QEAAE_K@Z
?JobFunction@CUserFuncAdapterJob@@MEAAXXZ
?JobQueue@CWorkerThreadPool@@QEAAAEAVCWorkerThreadJobQueue@@XZ
?JobQueue@CWorkerThreadPoolEx@@QEAAAEAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QEAAKXZ
?Limit@CNoLockList@@QEAAKXZ
?MatchAllExtensions@CFileExtension@@QEAAEXZ
?MatchNoExtensions@CFileExtension@@QEAAEXZ
?MergeLeft@CMemoryPoolAllocator@@IEAAPEAXPEAX@Z
?MergeRight@CMemoryPoolAllocator@@IEAAPEAXPEAX@Z
?NeedDelete@CWorkerThreadJob@@QEAAEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QEAAXE@Z
?NewNode@CList@@UEAAPEAXXZ
?NewNode@CStrList@@EEAAPEAXXZ
?NewNodeVariant@CList@@IEAAPEAXK@Z
?Next@CList@@UEBAPEAXQEAX@Z
?Next@CLockList@@UEBAPEAXQEAX@Z
?Next@CNoLockList@@UEBAPEAXQEAX@Z
?NextPool@CMemoryPoolAllocator@@QEAAPEAV1@XZ
?NotityTerminate@CWorkerThread@@QEAAXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QEAAJP6AXPEAX@Z0E@Z
?PostJobToWorkerThread@CWorkerThreadPoolEx@@QEAAJP6AXPEAX@Z0E1@Z
?Pulse@CKEvent@@QEAAJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QEAAEPEAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QEAAJPEAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPoolEx@@QEAAJPEAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SAPEAV1@XZ
?Read@CFile@@QEAAJPEADKPEAK@Z
?ReadWIRP@CFile@@QEAAJPEADKPEAK@Z
?ReferenceCount@CContext@@QEAAAEAKXZ
?Release@CLockEvent@@QEAAXXZ
?Remove@CContextList@@UEAAEQEAX@Z
?Remove@CList@@UEAAEQEAX@Z
?Remove@CLockList@@UEAAEQEAX@Z
?Remove@CNoLockList@@UEAAEQEAX@Z
?RemoveHead@CList@@UEAAPEAXXZ
?RemoveHead@CLockList@@UEAAPEAXXZ
?RemoveHead@CNoLockList@@UEAAPEAXXZ
?RemoveTail@CList@@UEAAPEAXXZ
?RemoveTail@CLockList@@UEAAPEAXXZ
?RemoveTail@CNoLockList@@UEAAPEAXXZ
?Reset@CKEvent@@QEAAXXZ
?ResetData@CInclusionExtConfig@@QEAAXXZ
?ResetData@CInclusionFileNameConfig@@QEAAXXZ
?ResetData@CInclusionFilePathConfig@@QEAAXXZ
?ResetData@CInclusionFolderConfig@@QEAAXXZ
?RestoreCR0@@YAXPEAX@Z
?Run@CAutoUpdateConfigThread@@UEAAXXZ
?Run@CDelayLoadThread@@UEAAXXZ
?Run@CWorkerThread@@UEAAXXZ
?SeekToEnd@CFile@@QEAAJXZ
?Set@CKEvent@@QEAAJJE@Z
?SetAttributes@CFile@@QEAAJK@Z
?SetBlobCofig@CContext@@UEAAJKPEAXK@Z
?SetData@CBlobConfig@@QEAAHPEAXK@Z
?SetData@CModuleFileExtConfig@@QEAAHPEBG@Z
?SetData@CModuleFlagConfig@@QEAAHK@Z
?SetData@CModuleMultiStringConfig@@QEAAHPEBGK@Z
?SetData@CModuleStringConfig@@QEAAHPEBG@Z
?SetEngineContext@CContext@@QEAAXPEAX@Z
?SetFileExtensionConfig@CContext@@UEAAJKPEBG@Z
?SetFlagConfig@CContext@@UEAAJKK@Z
?SetLinkContext@CContext@@QEAAXPEAX@Z
?SetLogFlag@CDebugLog@@QEAAEK@Z
?SetLogFlag@CDebugLogEx@@QEAAEK@Z
?SetMatchAllExtensions@CFileExtension@@QEAAXE@Z
?SetMatchNoExtensions@CFileExtension@@QEAAXE@Z
?SetMultiStringConfig@CContext@@UEAAJKPEBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QEAAXXZ
?SetPriority@CSystemThread@@QEAAXK@Z
?SetStopUse@CContext@@QEAAXXZ
?SetStringConfig@CContext@@UEAAJKPEBG@Z
?Setup@CSystemThread@@MEAAXXZ
?StopUse@CContext@@QEAAHXZ
?TearDown@CSystemThread@@MEAAXXZ
?Terminate@CSystemThread@@QEAAXE@Z
?Terminate@CWorkerThreadPool@@QEAAEXZ
?Terminate@CWorkerThreadPoolEx@@QEAAEXZ
?TmExceptionFilter@@YAJPEAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QEAAJPEAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QEAAXXZ
?WaitForInit@CDelayLoadThread@@QEAAEXZ
?WaitForLoad@CDelayLoadThread@@QEAAEXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QEAAEXZ
?WaitQueueEmpty@CWorkerThreadJobQueue@@QEAAXXZ
?Write@CDebugLog@@QEAAXPEBDZZ
?Write@CDebugLogEx@@QEAAXPEBDZZ
?Write@CFile@@QEAAJPEADKPEAT_LARGE_INTEGER@@PEAK@Z
?WriteDataToFile@CDebugLogEx@@IEAAXPEADK@Z
?WriteDataToProcMonW@CDebugLogEx@@IEAAXPEAD@Z
?WriteSystemInformation@CDebugLog@@QEAAXXZ
?WriteSystemInformation@CDebugLogEx@@QEAAXXZ
?WriteSystemStringInformation@CDebugLog@@IEAAXPEBG@Z
?WriteSystemStringInformation@CDebugLogEx@@IEAAXPEBG@Z
?WriteToFile@CDebugLog@@IEAAXPEADK@Z
?WriteToProcMonW@CDebugLogEx@@IEAAXPEAU_UNICODE_STRING@@@Z
?_pNonPagedAllocator@@3PEAVCMemoryAllocator@@EA
?_pPagedAllocator@@3PEAVCMemoryAllocator@@EA
?m_lpInstance@CWorkerThreadPool@@1PEAV1@EA
?m_lpRCMInstance@CWorkerThreadPool@@1PEAV1@EA
AllocFullFileName
DeInitKm2UmCommunication
DeInitKmLPC
DuplicateFullFileName
FreeFullFileName
GetKm2UmMode
GetModuleInfoByAddress
GetModuleInfoByModuleName
InitKm2UmCommunication
InitKmLPC
IsVerifierCodeCheckFlagOn
IsWindows8_1_update
KmCallUm
KmCallUmByLPC
KmCallUmEx
KmCleanupCommPortAPIs
KmGetUmInitProcess
KmSetBackupCommPortAPIs
KmSetCommPortAPIs
ModGetExportProcAddress
ModLoadDLLToBuffer
ModLoadDLLToBufferWithImageSize
ModLoadModule
ModUnLoadModule
NormalizeFileName
NormalizeFullNtPathToDosName
TmCommConfigRoutine
UtilAddDeviceInDriveTable
UtilAddReparsePointMapping
UtilCleanFileReadOnly
UtilCloseExclusiveHandle
UtilCreateDosFileName
UtilDeleteFileForce
UtilGetDeviceObjectName
UtilGetFileNameFromFileObject
UtilGetFileObjectForProcessByEPROC
UtilGetFileObjectFromFileName
UtilGetProcessName
UtilGetSystemDirectory
UtilGetSystemDirectoryEx
UtilGetSystemDirectoryLength
UtilGetSystemTime
UtilIoSetFileInfo
UtilIopCreateFileIRP
UtilKeGetLowFileDevice
UtilModuleIATHook
UtilModuleIATUnHook
UtilPostJobToWorkerThread
UtilQueryExclusiveHandle
UtilQueryKeyValue
UtilRemoveDeviceFromDriveTable
UtilVolumeDeviceToDosName
UtilWaitValueChangeToZero
UtilWriteVersionToRegistry
UtilbuildDynamicDiskMappingTable
UtlWriteBinValueKeyToRegistry
ValidateAddressWithSize
_ResetProtectFromClose
_UtilDosPathNameToNtPathName

Sections

Expand

.text
.rdata
.data
.pdata
.gfids
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2020-06-28 23:59:05
MD5	113056ec5c679b6f74c9556339ebf962
SHA1	e7d8fc86b90f75864b7e2415235e17df4d85ee31
SHA256	c082514317bf80a2f5129d84a5a55e411a95e32d03a4df1274537704c80e41dd
Authentihash MD5	df0c799f44b29f166c1457111f1e2e44
Authentihash SHA1	8f304036c7dc0ba138cba81a45a8b0f9336231d4
Authentihash SHA256	13002b14aa6e63dc7117e2969d038beb009dbd6093a4590c6913b426d773dea3
RichPEHeaderHash MD5	8ae6b3a63d3444e617eba17c3a93979e
RichPEHeaderHash SHA1	3cc95db9109125c87a3cb737bbe371034d9c3ade
RichPEHeaderHash SHA256	118d8d8e4d2d1ce80640e7b28300dd41389daf9bdbdc6ad2e9fefcde4aab7ad2
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	Trend Micro Eyes
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 0ea0fe4dfb74cc64bc32143103c27c8b

Field	Value
ToBeSigned (TBS) MD5	e93e004baa6013b41135ac0648e29d5b
ToBeSigned (TBS) SHA1	dc91e26674d4b627319c700d3ebb1a6cf83d358e
ToBeSigned (TBS) SHA256	0d20335edb166a303411548471bee6f301c8b4f7f7e453d09c15303de2c888d7
Subject	C=TW, L=Taipei, O=Trend Micro, Inc., OU=Taipei, TW, CN=Trend Micro, Inc.
ValidFrom	2019-07-12 00:00:00
ValidTo	2020-07-10 12:00:00
Signature	5c08ae5d586a4751195382d6889dc2fc500e7c39c641e1a58def8d923e12b754e2cc35720cc8d3d29382980debf7d98fcc17d764187126dd07c134fdbb96dd44fe8a40195df6f6acd1881fa5ba2921dadceb3f64422344672834813916bbdf317533cf6aaf3317d78197d7d6c560ad681de135f39e2d4ad345b7fe491162660a5462c6075fd725382df1e6e6bc3a4c443be778f79b07f181082e38150ca28ab932f99e4bc4185dc5b3b6edf22c187fdfd84e23a21e7da1989837f43b89aa172e6b34dbcb297bffd511a1d1c100b25e0e921f622a0845e23317f9fec83659ca21c241800683e0dd66ce4d042a8aefc4142b5923a6fa93ee72c48e8dc04c13b4b0
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	0ea0fe4dfb74cc64bc32143103c27c8b
Version	3

Certificate 61204db4000000000027

Field	Value
ToBeSigned (TBS) MD5	8e3ffc222fbcebdbb8b23115ab259be7
ToBeSigned (TBS) SHA1	ee20bff28ffe13be731c294c90d6ded5aae0ec0e
ToBeSigned (TBS) SHA256	59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821
Subject	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
ValidFrom	2011-04-15 19:45:33
ValidTo	2021-04-15 19:55:33
Signature	208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	61204db4000000000027
Version	3

Certificate 03019a023aff58b16bd6d5eae617f066

Field	Value
ToBeSigned (TBS) MD5	a752afee44f017e8d74e3f3eb7914ae3
ToBeSigned (TBS) SHA1	8eca80a6b80e9c69dcef7745748524afb8019e2d
ToBeSigned (TBS) SHA256	82560fa7efec30b5ff82af643e6f3bf3d46868bbd5e7d76f93db185e9e3553a1
Subject	C=US, O=DigiCert, CN=DigiCert Timestamp Responder
ValidFrom	2014-10-22 00:00:00
ValidTo	2024-10-22 00:00:00
Signature	9d257e1b334db226815c9b86ce23200f8087e588ffffb1d46a2c31ed3a17197117cda91bbc5a1639009de36c84e45a40fbde06018c37fa9bb19d247efe20a457ad5bb79ab06026ea6957215d342f1f71b0839419056b359010a07b97c7f63fe7e21141a6bd62d9f0273d381d286f3a5209f0ec7062d3624bb0e073a692c0d38e31d82fe36d171306eee403b614abf38f43a7719d21dd14ca155d9241daf90f81d199740d26c40e7f1bb5f5a0f1c677062815e9d893e55516f0bb0aab1cdb5c482766c8a38b0a1ce595daaec42e59a061dddaf36da261e98a0b6dec1218bdf755544003922b6bc251c20a48afb0d46ee0f4140a3a1be38f3dcaaf6a8d7bdcd844
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	03019a023aff58b16bd6d5eae617f066
Version	3

Certificate 02c4d1e58a4a680c568da3047e7e4d5f

Field	Value
ToBeSigned (TBS) MD5	829995f702421dea833a24fb2c7f4442
ToBeSigned (TBS) SHA1	1d7e838accd498c2e5ba9373af819ec097bb955c
ToBeSigned (TBS) SHA256	92914d016cc46e125e50c4bd0bd7f72db87eed4ba68f3c589b4e86aa563108db
Subject	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1
ValidFrom	2011-02-11 12:00:00
ValidTo	2026-02-10 12:00:00
Signature	49eb7c60beaeefc97cb3c5ba4b64df1669e286fa29d9de98857d406626332f4455aaaa90e935700a34bed3ae542e8e6500d67a32203e6c26b898a939b1bc95c7aae9f5ee4666c6b3e812f8b3979dff74588234997550ac448fe892ce7d8b0f3196c7dcd31130987416c6e56b4576a39401cd33007a48f66f8631c9562b3322d5f801b644ce8cb4ca88d2e416e3e7f6e23ee109c09d7943437f555c05ad9310c62c0d6bc09eea78e5d277d6b8da9a987fba4c922b9dbda488b1ddafc34cd2979b03c6ae5f1b440f333715e3cbff2f56d316a45b55679da2cadb346c0c734ab57ba4b6b3e935027870ec007acbfc4b4f2236bb1484c98f91dd0f3c758cca0b88e7
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	02c4d1e58a4a680c568da3047e7e4d5f
Version	3

Certificate 06fdf9039603adea000aeb3f27bbba1b

Field	Value
ToBeSigned (TBS) MD5	4e5ad189638cf52ba9cd881d4d44668c
ToBeSigned (TBS) SHA1	cdc115e98d798b33904c820d63cc1e1afc19251d
ToBeSigned (TBS) SHA256	37560fb9d548ab62cc3ed4669a4ab74828b5a108e67e829937ffb2d10a5f78dd
Subject	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID CA,1
ValidFrom	2006-11-10 00:00:00
ValidTo	2021-11-10 00:00:00
Signature	46503ec9b72824a7381db65b29af52cf52e93147ab565c7bd50d0b41b3efec751f7438f2b25c61a29c95c350e482b923d1ba3a8672ad3878ac755d1717347247859456d1ebbb368477cc24a5f3041955a9e7e3e7ab62cdfb8b2d90c2c0d2b594bd5e4fb105d20e3d1aa9145ba6863162a8a833e49b39a7c4f5ce1d7876942573e42aabcf9c764bed5fc24b16e44b704c00891efcc579bc4c1257fe5fe11ebc025da8fefb07384f0dc65d91b90f6745cdd683ede7920d8db1698c4ffb59e0230fd2aaae007cee9c420ecf91d727b716ee0fc3bd7c0aa0ee2c08558522b8eb181a4dfc2a21ad49318347957771dcb11b4b4b1c109c7714c19d4f2f5a9508291026
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	06fdf9039603adea000aeb3f27bbba1b
Version	3

Imports

Expand

ntoskrnl.exe
HAL.dll
CLASSPNP.SYS

Imported Functions

Expand

KePulseEvent
KeClearEvent
KeStackAttachProcess
KeUnstackDetachProcess
ObfDereferenceObject
ZwSetEvent
ZwClose
ZwConnectPort
RtlInitUnicodeString
RtlUnicodeStringToInteger
ZwCreateSection
ZwWaitForSingleObject
ZwOpenEvent
IoGetCurrentProcess
ObfReferenceObject
DbgBreakPoint
ZwRequestWaitReplyPort
ExFreePoolWithTag
ProbeForWrite
ZwFreeVirtualMemory
ZwAllocateVirtualMemory
ObOpenObjectByPointer
PsProcessType
memmove
PsGetProcessExitTime
MmSectionObjectType
PsThreadType
MmGetSystemRoutineAddress
ObReleaseObjectSecurity
SeReleaseSubjectContext
SeAccessCheck
SeCaptureSubjectContext
ObGetObjectSecurity
DbgPrint
memset
MmIsAddressValid
ExInitializeResourceLite
ExDeleteResourceLite
ZwWriteFile
ZwReadFile
ZwQueryInformationFile
ZwSetInformationFile
ZwCreateFile
swprintf
towupper
_wcsnicmp
ExAllocatePoolWithTag
KeInitializeEvent
_snprintf
PsGetCurrentProcessId
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
PsGetCurrentThreadId
RtlInitAnsiString
ZwDeviceIoControlFile
ZwCreateKey
ZwCreateEvent
KeWaitForMultipleObjects
ObReferenceObjectByHandle
ZwNotifyChangeKey
_vsnprintf
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlEqualUnicodeString
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
RtlUpcaseUnicodeChar
ExGetPreviousMode
KeWaitForSingleObject
KeSetPriorityThread
PsTerminateSystemThread
PsCreateSystemThread
KeDelayExecutionThread
KeNumberProcessors
ZwQueryInformationProcess
PsLookupProcessByProcessId
ZwOpenDirectoryObject
PsSetCreateProcessNotifyRoutine
ZwQuerySystemInformation
ZwQueryDirectoryFile
ZwQueryDirectoryObject
ZwDuplicateObject
ZwOpenKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryValueKey
ZwDeleteValueKey
ZwDeleteKey
ZwTerminateProcess
ZwOpenProcess
ZwQueryKey
ZwSetValueKey
IoFileObjectType
KeSetEvent
ZwQuerySecurityObject
ZwSetSecurityObject
RtlLengthSecurityDescriptor
MmHighestUserAddress
IoFreeIrp
_purecall
MmUnlockPages
IoBuildAsynchronousFsdRequest
_strnicmp
RtlQueryRegistryValues
RtlAppendUnicodeToString
mbstowcs
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
NtClose
ObQueryNameString
ZwSetInformationObject
_stricmp
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwOpenFile
IoCreateFile
IofCallDriver
IoAllocateIrp
MmBuildMdlForNonPagedPool
IoAllocateMdl
ProbeForRead
PsGetVersion
RtlImageNtHeader
RtlCompareMemory
RtlUpcaseUnicodeString
_snwprintf
MmSystemRangeStart
wcsncmp
RtlCompareUnicodeString
strrchr
ZwQueryVolumeInformationFile
ObReferenceObjectByPointer
IoBuildDeviceIoControlRequest
ZwOpenSection
_allmul
KeReleaseSemaphore
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
KeInitializeSemaphore
IoGetDeviceObjectPointer
IofCompleteRequest
ExEventObjectType
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
RtlUpperChar
ObReferenceObjectByName
IoDriverObjectType
strncpy
KeServiceDescriptorTable
NtOpenProcess
ObOpenObjectByName
NtQueryInformationProcess
PsIsThreadTerminating
KeAddSystemServiceTable
ZwQueryObject
ZwFsControlFile
ObInsertObject
IoReleaseVpbSpinLock
IoAcquireVpbSpinLock
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
_allshr
ExInterlockedPopEntrySList
IoGetStackLimits
IoBuildSynchronousFsdRequest
wcsstr
IoUnregisterPlugPlayNotification
FsRtlIsNameInExpression
IoGetConfigurationInformation
MmProbeAndLockPages
IoGetDeviceInterfaces
IoRegisterPlugPlayNotification
ExAllocatePool
wcschr
KeTickCount
KeBugCheckEx
RtlUnwind
wcsrchr
memcpy
wcsncpy
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
ExAcquireResourceSharedLite
ExReleaseFastMutexUnsafe
KeLeaveCriticalRegion
KeEnterCriticalRegion
_allrem
ExAcquireFastMutexUnsafe
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
RtlLengthSid
RtlAbsoluteToSelfRelativeSD
IoFreeMdl
KeGetCurrentThread
KfAcquireSpinLock
KfReleaseSpinLock
KeRaiseIrqlToDpcLevel
KfLowerIrql
KeAcquireQueuedSpinLock
KeReleaseQueuedSpinLock
ExAcquireFastMutex
ExReleaseFastMutex
KeGetCurrentIrql
KfRaiseIrql
ClassInitialize

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
??0CBlobConfig@@QAE@ABV0@@Z
??0CBlobConfig@@QAE@K@Z
??0CContext@@QAE@ABV0@@Z
??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QAE@ABV0@@Z
??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
??0CDebugLog@@QAE@ABV0@@Z
??0CDebugLog@@QAE@PBG@Z
??0CDebugLogEx@@QAE@ABV0@@Z
??0CDebugLogEx@@QAE@K@Z
??0CDelayLoadThread@@QAE@ABV0@@Z
??0CDelayLoadThread@@QAE@XZ
??0CExclusionExtConfig@@QAE@ABV0@@Z
??0CExclusionExtConfig@@QAE@KKE@Z
??0CExclusionFileNameConfig@@QAE@ABV0@@Z
??0CExclusionFileNameConfig@@QAE@KK@Z
??0CExclusionFilePathConfig@@QAE@ABV0@@Z
??0CExclusionFilePathConfig@@QAE@KK@Z
??0CExclusionFolderConfig@@QAE@ABV0@@Z
??0CExclusionFolderConfig@@QAE@KK@Z
??0CExclusionRegistryConfig@@QAE@ABV0@@Z
??0CExclusionRegistryConfig@@QAE@KK@Z
??0CFile@@QAE@ABV0@@Z
??0CFile@@QAE@E@Z
??0CFileExtension@@QAE@ABV0@@Z
??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
??0CInclusionExtConfig@@QAE@ABV0@@Z
??0CInclusionExtConfig@@QAE@KKE@Z
??0CInclusionFileNameConfig@@QAE@ABV0@@Z
??0CInclusionFileNameConfig@@QAE@KK@Z
??0CInclusionFilePathConfig@@QAE@ABV0@@Z
??0CInclusionFilePathConfig@@QAE@KK@Z
??0CInclusionFolderConfig@@QAE@ABV0@@Z
??0CInclusionFolderConfig@@QAE@KK@Z
??0CKEvent@@QAE@ABV0@@Z
??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
??0CList@@QAE@ABV0@@Z
??0CList@@QAE@KPAVIMemoryAllocator@@@Z
??0CLockEvent@@QAE@ABV0@@Z
??0CLockEvent@@QAE@XZ
??0CLockList@@QAE@ABV0@@Z
??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QAE@ABV0@@Z
??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
??0CMemoryPoolAllocator@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@XZ
??0CModuleConfigList@@QAE@ABV0@@Z
??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QAE@ABV0@@Z
??0CModuleFileExtConfig@@QAE@KKE@Z
??0CModuleFlagConfig@@QAE@ABV0@@Z
??0CModuleFlagConfig@@QAE@K@Z
??0CModuleMultiStringConfig@@QAE@ABV0@@Z
??0CModuleMultiStringConfig@@QAE@KK@Z
??0CModuleStringConfig@@QAE@ABV0@@Z
??0CModuleStringConfig@@QAE@K@Z
??0CNoLockList@@QAE@ABV0@@Z
??0CNoLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CSmartLock@@QAE@AAVCLockEvent@@@Z
??0CSmartLock@@QAE@XZ
??0CSmartReference@@QAE@AAJ@Z
??0CSmartReference@@QAE@AAK@Z
??0CSmartResource@@QAE@AAVCResource@@E@Z
??0CStrList@@QAE@ABV0@@Z
??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
??0CSystemThread@@QAE@ABV0@@Z
??0CSystemThread@@QAE@K@Z
??0CUserFuncAdapterJob@@QAE@ABV0@@Z
??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z01@Z
??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@E@Z
??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
??0CWorkerThreadJobQueue@@QAE@K@Z
??0CWorkerThreadPool@@QAE@ABV0@@Z
??0CWorkerThreadPool@@QAE@K@Z
??0CWorkerThreadPoolEx@@QAE@ABV0@@Z
??0CWorkerThreadPoolEx@@QAE@KK@Z
??0IMemoryAllocator@@QAE@ABV0@@Z
??0IMemoryAllocator@@QAE@XZ
??1CAutoUpdateConfigThread@@UAE@XZ
??1CBlobConfig@@UAE@XZ
??1CContext@@UAE@XZ
??1CContextList@@UAE@XZ
??1CDebugLog@@UAE@XZ
??1CDebugLogEx@@UAE@XZ
??1CDelayLoadThread@@UAE@XZ
??1CExclusionExtConfig@@UAE@XZ
??1CExclusionFileNameConfig@@UAE@XZ
??1CExclusionFilePathConfig@@UAE@XZ
??1CExclusionFolderConfig@@UAE@XZ
??1CExclusionRegistryConfig@@UAE@XZ
??1CFile@@UAE@XZ
??1CFileExtension@@UAE@XZ
??1CInclusionExtConfig@@UAE@XZ
??1CInclusionFileNameConfig@@UAE@XZ
??1CInclusionFilePathConfig@@UAE@XZ
??1CInclusionFolderConfig@@UAE@XZ
??1CKEvent@@UAE@XZ
??1CList@@UAE@XZ
??1CLockEvent@@UAE@XZ
??1CLockList@@UAE@XZ
??1CMemoryAllocator@@UAE@XZ
??1CMemoryPoolAllocator@@UAE@XZ
??1CModuleConfig@@UAE@XZ
??1CModuleConfigList@@UAE@XZ
??1CModuleFileExtConfig@@UAE@XZ
??1CModuleFlagConfig@@UAE@XZ
??1CModuleMultiStringConfig@@UAE@XZ
??1CModuleStringConfig@@UAE@XZ
??1CNoLockList@@UAE@XZ
??1CSmartLock@@QAE@XZ
??1CSmartReference@@QAE@XZ
??1CSmartResource@@QAE@XZ
??1CStrList@@UAE@XZ
??1CSystemThread@@UAE@XZ
??1CUserFuncAdapterJob@@UAE@XZ
??1CWorkerThread@@UAE@XZ
??1CWorkerThreadJob@@UAE@XZ
??1CWorkerThreadJobQueue@@UAE@XZ
??1CWorkerThreadPool@@UAE@XZ
??1CWorkerThreadPoolEx@@UAE@XZ
??1IMemoryAllocator@@UAE@XZ
??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??2CMemoryAllocator@@SGPAXI@Z
??2CMemoryPoolAllocator@@SGPAXI@Z
??3@YAXPAX@Z
??3IMemoryAllocator@@SGXPAX@Z
??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
??4CBlobConfig@@QAEAAV0@ABV0@@Z
??4CContext@@QAEAAV0@ABV0@@Z
??4CDebugLog@@QAEAAV0@ABV0@@Z
??4CDebugLogEx@@QAEAAV0@ABV0@@Z
??4CDelayLoadThread@@QAEAAV0@ABV0@@Z
??4CFile@@QAEAAV0@ABV0@@Z
??4CKEvent@@QAEAAV0@ABV0@@Z
??4CLockEvent@@QAEAAV0@ABV0@@Z
??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
??4CModuleConfig@@QAEAAV0@ABV0@@Z
??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
??4CSmartResource@@QAEAAV0@ABV0@@Z
??4CSystemThread@@QAEAAV0@ABV0@@Z
??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
??4CWorkerThread@@QAEAAV0@ABV0@@Z
??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CDebugLogEx@@6B@
??_7CDelayLoadThread@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CInclusionExtConfig@@6B@
??_7CInclusionFileNameConfig@@6B@
??_7CInclusionFilePathConfig@@6B@
??_7CInclusionFolderConfig@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CNoLockList@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7CWorkerThreadPoolEx@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QAEXXZ
??_FCFile@@QAEXXZ
??_FCFileExtension@@QAEXXZ
??_FCModuleConfigList@@QAEXXZ
??_FCStrList@@QAEXXZ
??_FCSystemThread@@QAEXXZ
??_FCWorkerThread@@QAEXXZ
??_FCWorkerThreadJob@@QAEXXZ
??_FCWorkerThreadJobQueue@@QAEXXZ
??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??_V@YAXPAX@Z
?Acquire@CLockEvent@@QAEXXZ
?Add@CContextList@@QAEEPAVCContext@@@Z
?Add@CFileExtension@@QAEEPBGK@Z
?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
?Add@CStrList@@QAEEPBG@Z
?AddNode@CLockList@@UAEEQAXE@Z
?AddNode@CNoLockList@@UAEEQAXE@Z
?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QAEXXZ
?CheckNode@CLockList@@UAEHQAX@Z
?CheckNode@CNoLockList@@UAEHQAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
?Cleanup@CBlobConfig@@AAEXXZ
?Cleanup@CModuleFileExtConfig@@IAEXXZ
?Cleanup@CModuleMultiStringConfig@@IAEXXZ
?Cleanup@CModuleStringConfig@@AAEXXZ
?Close@CFile@@QAEJXZ
?Count@CLockList@@QAEKXZ
?Count@CNoLockList@@QAEKXZ
?Create@CFile@@QAEJPBGKKKK@Z
?Create@CSystemThread@@QAEEXZ
?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
?CreatePool@CWorkerThreadPool@@QAEEXZ
?CreatePool@CWorkerThreadPoolEx@@QAEEXZ
?CreateThreads@CWorkerThreadPool@@QAEEK@Z
?CreateThreads@CWorkerThreadPoolEx@@QAEEK@Z
?CreateWIRP@CFile@@QAEJPBGKKKK@Z
?Delete@CFile@@QAEJXZ
?Delete@CFileExtension@@QAEEPBGK@Z
?Delete@CStrList@@QAEEPBG@Z
?DeleteAll@CList@@UAEXXZ
?DeleteAll@CLockList@@UAEXXZ
?DeleteAll@CNoLockList@@UAEXXZ
?DeleteNode@CContextList@@MAEXPAX@Z
?DeleteNode@CList@@UAEXPAX@Z
?DeleteNode@CModuleConfigList@@MAEXPAX@Z
?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YGXPAPAX@Z
?DoIt@CWorkerThreadJob@@QAEJXZ
?EntryPoint@CSystemThread@@KGXPAX@Z
?Find@CContextList@@QAEPAVCContext@@K@Z
?Find@CContextList@@QAEPAVCContext@@PAX@Z
?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FindNode@CContextList@@IAEPAXPAX@Z
?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FinishFunction@CUserFuncAdapterJob@@MAEXXZ
?FinishIt@CWorkerThreadJob@@QAEJXZ
?First@CList@@UAEPAXXZ
?First@CLockList@@UAEPAXXZ
?First@CNoLockList@@UAEPAXXZ
?Free@CMemoryAllocator@@UAEXPAX@Z
?Free@CMemoryPoolAllocator@@UAEXPAX@Z
?GetAttributes@CFile@@QAEKXZ
?GetBasicInfomration@CFile@@IAEJXZ
?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
?GetCategory@CContext@@QAEKXZ
?GetData@CBlobConfig@@QAEHPAXPAK@Z
?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QAEKXZ
?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
?GetData@CModuleStringConfig@@QAEPAGXZ
?GetData@CStrList@@QAEEPAGPAK@Z
?GetDataType@CModuleConfig@@QAEKXZ
?GetEngineContext@CContext@@QAEPAXXZ
?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFileSizeWIRP@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UAEJKPAK@Z
?GetID@CModuleConfig@@QAEKXZ
?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QAEKXZ
?GetLinkContext@CContext@@QAEPAXXZ
?GetLogFlag@CDebugLog@@QAEKXZ
?GetLogFlag@CDebugLogEx@@QAEKXZ
?GetModuleId@CModuleConfig@@QAEKXZ
?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_KTHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_KTHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QAEKXZ
?GetSize@CBlobConfig@@QAEKXZ
?GetStringConfig@CContext@@QAEPAGK@Z
?GetStringConfig@CContext@@UAEJKPAGPAK@Z
?GetThreadCount@CWorkerThreadPool@@QAEKXZ
?GetThreadCount@CWorkerThreadPoolEx@@QAEKXZ
?GetThreadID@CSystemThread@@QAEKXZ
?GetType@CContext@@QAEKXZ
?GetUserParameter@CContext@@QAEKXZ
?InitProcMon@CDebugLogEx@@IAEXXZ
?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
?InitializeFlagConfig@CContext@@QAEHKK@Z
?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
?InitializeStringConfig@CContext@@QAEHKPBG@Z
?Insert@CList@@UAEXQAXE@Z
?Insert@CLockList@@UAEXQAXE@Z
?Insert@CNoLockList@@UAEXQAXE@Z
?InsertAfter@CList@@UAEXPAX0@Z
?InsertBefore@CList@@UAEXPAX0@Z
?Instance@CWorkerThreadPool@@SGPAV1@XZ
?IsEmpty@CList@@UAEEXZ
?IsEmpty@CLockList@@UAEEXZ
?IsEmpty@CNoLockList@@UAEEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
?IsFull@CLockList@@QBEEXZ
?IsFull@CNoLockList@@QBEEXZ
?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionExtConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFileNameConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFilePathConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFolderConfig@@QAEEPBG@Z
?IsOpened@CFile@@QAEEXZ
?IsTerminated@CWorkerThreadPool@@QAEEXZ
?IsTerminated@CWorkerThreadPoolEx@@QAEEXZ
?IsValid@CMemoryAllocator@@UAEEXZ
?IsValid@CMemoryPoolAllocator@@UAEEXZ
?IsValid@IMemoryAllocator@@UAEEXZ
?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
?IsWorkerThread@CWorkerThreadPoolEx@@QAEEK@Z
?JobFunction@CUserFuncAdapterJob@@MAEXXZ
?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
?JobQueue@CWorkerThreadPoolEx@@QAEAAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QAEKXZ
?Limit@CNoLockList@@QAEKXZ
?MatchAllExtensions@CFileExtension@@QAEEXZ
?MatchNoExtensions@CFileExtension@@QAEEXZ
?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
?NeedDelete@CWorkerThreadJob@@QAEEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
?NewNode@CList@@UAEPAXXZ
?NewNode@CStrList@@EAEPAXXZ
?NewNodeVariant@CList@@IAEPAXK@Z
?Next@CList@@UBEPAXQAX@Z
?Next@CLockList@@UBEPAXQAX@Z
?Next@CNoLockList@@UBEPAXQAX@Z
?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
?NotityTerminate@CWorkerThread@@QAEXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
?PostJobToWorkerThread@CWorkerThreadPoolEx@@QAEJP6GXPAX@Z0E1@Z
?Pulse@CKEvent@@QAEJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPoolEx@@QAEJPAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
?Read@CFile@@QAEJPADKPAK@Z
?ReadWIRP@CFile@@QAEJPADKPAK@Z
?ReferenceCount@CContext@@QAEAAKXZ
?Release@CLockEvent@@QAEXXZ
?Remove@CContextList@@UAEEQAX@Z
?Remove@CList@@UAEEQAX@Z
?Remove@CLockList@@UAEEQAX@Z
?Remove@CNoLockList@@UAEEQAX@Z
?RemoveHead@CList@@UAEPAXXZ
?RemoveHead@CLockList@@UAEPAXXZ
?RemoveHead@CNoLockList@@UAEPAXXZ
?RemoveTail@CList@@UAEPAXXZ
?RemoveTail@CLockList@@UAEPAXXZ
?RemoveTail@CNoLockList@@UAEPAXXZ
?Reset@CKEvent@@QAEXXZ
?ResetData@CInclusionExtConfig@@QAEXXZ
?ResetData@CInclusionFileNameConfig@@QAEXXZ
?ResetData@CInclusionFilePathConfig@@QAEXXZ
?ResetData@CInclusionFolderConfig@@QAEXXZ
?RestoreCR0@@YGXPAX@Z
?Run@CAutoUpdateConfigThread@@UAEXXZ
?Run@CDelayLoadThread@@UAEXXZ
?Run@CWorkerThread@@UAEXXZ
?SeekToEnd@CFile@@QAEJXZ
?Set@CKEvent@@QAEJJE@Z
?SetAttributes@CFile@@QAEJK@Z
?SetBlobCofig@CContext@@UAEJKPAXK@Z
?SetData@CBlobConfig@@QAEHPAXK@Z
?SetData@CModuleFileExtConfig@@QAEHPBG@Z
?SetData@CModuleFlagConfig@@QAEHK@Z
?SetData@CModuleMultiStringConfig@@QAEHPBGK@Z
?SetData@CModuleStringConfig@@QAEHPBG@Z
?SetEngineContext@CContext@@QAEXPAX@Z
?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
?SetFlagConfig@CContext@@UAEJKK@Z
?SetLinkContext@CContext@@QAEXPAX@Z
?SetLogFlag@CDebugLog@@QAEEK@Z
?SetLogFlag@CDebugLogEx@@QAEEK@Z
?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
?SetMultiStringConfig@CContext@@UAEJKPBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
?SetPriority@CSystemThread@@QAEXK@Z
?SetStopUse@CContext@@QAEXXZ
?SetStringConfig@CContext@@UAEJKPBG@Z
?Setup@CSystemThread@@MAEXXZ
?StopUse@CContext@@QAEHXZ
?TearDown@CSystemThread@@MAEXXZ
?Terminate@CSystemThread@@QAEXE@Z
?Terminate@CWorkerThreadPool@@QAEEXZ
?Terminate@CWorkerThreadPoolEx@@QAEEXZ
?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QAEXXZ
?WaitForInit@CDelayLoadThread@@QAEEXZ
?WaitForLoad@CDelayLoadThread@@QAEEXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
?WaitQueueEmpty@CWorkerThreadJobQueue@@QAEXXZ
?Write@CDebugLog@@QAAXPBDZZ
?Write@CDebugLogEx@@QAAXPBDZZ
?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
?WriteDataToFile@CDebugLogEx@@IAEXPADK@Z
?WriteDataToProcMonW@CDebugLogEx@@IAEXPAD@Z
?WriteSystemInformation@CDebugLog@@QAEXXZ
?WriteSystemInformation@CDebugLogEx@@QAEXXZ
?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
?WriteSystemStringInformation@CDebugLogEx@@IAEXPBG@Z
?WriteToFile@CDebugLog@@IAEXPADK@Z
?WriteToProcMonW@CDebugLogEx@@IAEXPAU_UNICODE_STRING@@@Z
?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
?_pPagedAllocator@@3PAVCMemoryAllocator@@A
?m_lpInstance@CWorkerThreadPool@@1PAV1@A
?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
_DeInitKm2UmCommunication@0
_DeInitKmLPC@0
_DuplicateFullFileName@4
_FreeFullFileName@4
_GetFileVersionOfNtoskrnl@16
_GetKm2UmMode@0
_GetModuleInfoByAddress@8
_GetModuleInfoByModuleName@8
_InitKm2UmCommunication@8
_InitKmLPC@0
_IsWindows8_1_update@4
_KmCallUm@8
_KmCallUmByLPC@8
_KmCallUmEx@12
_KmCleanupCommPortAPIs@0
_KmGetUmInitProcess@0
_KmSetCommPortAPIs@4
_ModGetExportProcAddress@8
_ModLoadDLLToBuffer@4
_ModLoadDLLToBufferWithImageSize@8
_ModLoadModule@8
_ModUnLoadModule@4
_NormalizeFileName@4
_NormalizeFullNtPathToDosName@4
_TmCommConfigRoutine@4
_UtilAddDeviceInDriveTable@4
_UtilAddReparsePointMapping@8
_UtilCleanFileReadOnly@4
_UtilCloseExclusiveHandle@12
_UtilCreateDosFileName@8
_UtilDeleteFileForce@4
_UtilGetDeviceObjectName@8
_UtilGetFileNameFromFileObject@4
_UtilGetFileObjectForProcessByEPROC@8
_UtilGetFileObjectFromFileName@12
_UtilGetProcessName@12
_UtilGetSystemDirectory@4
_UtilGetSystemDirectoryEx@0
_UtilGetSystemDirectoryLength@0
_UtilGetSystemTime@4
_UtilIoSetFileInfo@24
_UtilIopCreateFileIRP@40
_UtilKeGetLowFileDevice@16
_UtilModuleIATHook@24
_UtilModuleIATUnHook@8
_UtilPostJobToWorkerThread@12
_UtilQueryExclusiveHandle@12
_UtilQueryKeyValue@24
_UtilRemoveDeviceFromDriveTable@4
_UtilVolumeDeviceToDosName@8
_UtilWaitValueChangeToZero@8
_UtilWriteVersionToRegistry@8
_UtilbuildDynamicDiskMappingTable@0
_UtlWriteBinValueKeyToRegistry@16
_ValidateAddressWithSize@20
__ResetProtectFromClose@4
__UtilDosPathNameToNtPathName@12

Sections

Expand

.text
.rdata
.data
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2007-09-05 04:57:07
MD5	c42caa9cdcc50c01cb2fed985a03fe23
SHA1	b3c111d7192cfa8824e5c9b7c0660c37978025d6
SHA256	c9014b03866bf37faa8fdb16b6af7cfec976aaef179fd5797d0c0bf8079d3a8c
Authentihash MD5	eee43fab6af4ff34b0c35892e7765798
Authentihash SHA1	a8baa1f52375ab24150d0cba4c62a4b0f5080ef4
Authentihash SHA256	81c301c77dbfff44567165139e9a5ee3af2aee838298451c7075dc6e1aae489f
RichPEHeaderHash MD5	f2d5f582fbb201fc40e2d789cdbc267f
RichPEHeaderHash SHA1	ff1bf61fd8d7e4cee5a99e78b45d53aafac5a2f1
RichPEHeaderHash SHA256	10914edfdb5d97a4c14914cb4f058fc65f31e3b700fa9fe31ad4fcc1dc74cc1d
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	AEGIS
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 3825d7faf861af9ef490e726b5d65ad5

Field	Value
ToBeSigned (TBS) MD5	d6c7684e9aaa508cf268335f83afe040
ToBeSigned (TBS) SHA1	18066d20ad92409c567cdfde745279ff71c75226
ToBeSigned (TBS) SHA256	a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff
Subject	C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2
ValidFrom	2007-06-15 00:00:00
ValidTo	2012-06-14 23:59:59
Signature	50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	3825d7faf861af9ef490e726b5d65ad5
Version	3

Certificate 47bf1995df8d524643f7db6d480d31a4

Field	Value
ToBeSigned (TBS) MD5	518d2ea8a21e879c942d504824ac211c
ToBeSigned (TBS) SHA1	21ce87d827077e61abddf2beba69fde5432ea031
ToBeSigned (TBS) SHA256	1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7
Subject	C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
ValidFrom	2003-12-04 00:00:00
ValidTo	2013-12-03 23:59:59
Signature	4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	47bf1995df8d524643f7db6d480d31a4
Version	3

Certificate 4191a15a3978dfcf496566381d4c75c2

Field	Value
ToBeSigned (TBS) MD5	41011f8d0e7c7a6408334ca387914c61
ToBeSigned (TBS) SHA1	c7fc1727f5b75a6421a1f95c73bbdb23580c48e5
ToBeSigned (TBS) SHA256	88dd3952638ee82738c03168e6fd863fe4eab1059ee5e2926ad8cb587c255dc0
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA
ValidFrom	2004-07-16 00:00:00
ValidTo	2014-07-15 23:59:59
Signature	ae3a17b84a7b55fa6455ec40a4ed494190999c89bcaf2e1dca7823f91c190f7feb68bc32d98838dedc3fd389b43fb18296f1a45abaed2e26d3de7c016e000a00a4069211480940f91c1879672324e0bbd5e150ae1bf50edde02e81cd80a36c524f9175558aba22f2d2ea4175882f63557d1e545a9559cad93481c05f5ef67ab5
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	4191a15a3978dfcf496566381d4c75c2
Version	3

Certificate 225c8b52640584163ec1835017ded781

Field	Value
ToBeSigned (TBS) MD5	1be2a89d67bb40c5a169d9e31c1a85af
ToBeSigned (TBS) SHA1	626dfc9caa0b9c229d6327683e87e36da2f30a3d
ToBeSigned (TBS) SHA256	bb4688ce8067e75a34458bff65e0bf0fd213b3e9416108aabb410d305495dc77
Subject	C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, OU=RD, CN=Trend Micro, Inc.
ValidFrom	2007-01-30 00:00:00
ValidTo	2008-02-15 23:59:59
Signature	ad2b4e7b5257d4923230029228ae497edd7f8fb5694b021ef1e8a7dbc6c11f7302b8f8d07e7364296d45081c37e0a861df51e62a158847d4925dc5b78da837b24edcd18e671ff0ccbe56e7327437091db3a24e4f471c45cac3916132d2e9b721410b24e83b89779e73b6fef1f026cf155587e0610f872a87321afab6c53ec7a2cfe2048b5928b919e56223762d9c5ce4e2f09ee9a3a6933fb3453a4c808a41a47d245e1ddc951f57ee62ef636ff79e061ce084668d58f3a9f4e1b839af75204b203b7d827b037f3ebc19383e69c6540a780b75d6d22d5e05614665cfa12ca2fe65146d9d684c5a3377c79acc86723943bc522064ac4b545e1a13e88ee4b6fe76
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	225c8b52640584163ec1835017ded781
Version	3

Certificate 610c120600000000001b

Field	Value
ToBeSigned (TBS) MD5	53c41bc1164e09e0cd1617a5bf913efd
ToBeSigned (TBS) SHA1	93c03aac8951d494ecd5696b1c08658541b18727
ToBeSigned (TBS) SHA256	40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b
Subject	C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
ValidFrom	2006-05-23 17:01:29
ValidTo	2016-05-23 17:11:29
Signature	01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	610c120600000000001b
Version	3

Imports

Expand

ntoskrnl.exe

Imported Functions

Expand

_purecall
ExAcquireFastMutexUnsafe
KeEnterCriticalRegion
KeGetCurrentThread
KeLeaveCriticalRegion
ExReleaseFastMutexUnsafe
wcsncpy
memcpy
wcsrchr
KeSetEvent
KePulseEvent
KeClearEvent
IofCompleteRequest
ZwClose
KeDelayExecutionThread
ObfDereferenceObject
ObReferenceObjectByHandle
ExEventObjectType
ZwCreateEvent
RtlInitUnicodeString
swprintf
KeQuerySystemTime
KeWaitForSingleObject
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
DbgPrint
RtlCopyUnicodeString
ProbeForWrite
ProbeForRead
ExGetPreviousMode
memset
MmIsAddressValid
ZwWriteFile
ZwReadFile
ZwQueryInformationFile
ZwSetInformationFile
ZwCreateFile
towupper
_wcsnicmp
_snprintf
PsGetCurrentProcessId
IoGetCurrentProcess
RtlTimeToTimeFields
ExSystemTimeToLocalTime
ZwCreateKey
KeInitializeEvent
KeWaitForMultipleObjects
ZwNotifyChangeKey
PsGetCurrentThreadId
_vsnprintf
MmMapLockedPagesSpecifyCache
MmBuildMdlForNonPagedPool
MmCreateMdl
ExFreePoolWithTag
MmUnmapLockedPages
ExAllocatePoolWithTag
RtlImageNtHeader
mbstowcs
_stricmp
ZwQuerySystemInformation
IoGetDeviceObjectPointer
KeServiceDescriptorTable
KeAddSystemServiceTable
_strnicmp
PsLookupProcessByProcessId
KeUnstackDetachProcess
KeStackAttachProcess
ZwQueryObject
ZwDuplicateObject
ZwOpenProcess
KeSetPriorityThread
PsTerminateSystemThread
PsCreateSystemThread
KeNumberProcessors
ZwQueryDirectoryFile
ZwOpenDirectoryObject
ZwQueryDirectoryObject
IoFreeIrp
IoFreeMdl
IofCallDriver
IoAllocateMdl
IoAllocateIrp
IoFileObjectType
ZwOpenKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryValueKey
ZwDeleteValueKey
ZwDeleteKey
ZwQueryKey
ZwSetValueKey
ZwQuerySecurityObject
ObInsertObject
_allrem
strncpy
NtOpenProcess
ObOpenObjectByPointer
PsProcessType
ObReferenceObjectByPointer
MmSectionObjectType
ObQueryNameString
ObOpenObjectByName
RtlAppendUnicodeStringToString
ObfReferenceObject
NtQueryInformationProcess
_snwprintf
RtlAnsiStringToUnicodeString
RtlQueryRegistryValues
RtlAppendUnicodeToString
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
RtlEqualUnicodeString
IoCreateFile
PsGetVersion
MmGetSystemRoutineAddress
RtlCompareMemory
IoReleaseVpbSpinLock
IoAcquireVpbSpinLock
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
KeInitializeSemaphore
KeReleaseSemaphore
RtlSubAuthoritySid
RtlInitializeSid
RtlLengthRequiredSid
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
ZwSetEvent
ZwRequestWaitReplyPort
memmove
ZwConnectPort
ZwCreateSection
ZwWaitForSingleObject
ZwOpenEvent
ExAllocatePool
KeBugCheckEx
RtlUpperChar
RtlCompareUnicodeString
KeTickCount
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
RtlUnwind
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
RtlLengthSid
wcschr
RtlAbsoluteToSelfRelativeSD
RtlFreeUnicodeString

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
??0CBlobConfig@@QAE@ABV0@@Z
??0CBlobConfig@@QAE@K@Z
??0CContext@@QAE@ABV0@@Z
??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QAE@ABV0@@Z
??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
??0CDebugLog@@QAE@ABV0@@Z
??0CDebugLog@@QAE@PBG@Z
??0CExclusionExtConfig@@QAE@ABV0@@Z
??0CExclusionExtConfig@@QAE@KKE@Z
??0CExclusionFileNameConfig@@QAE@ABV0@@Z
??0CExclusionFileNameConfig@@QAE@KK@Z
??0CExclusionFilePathConfig@@QAE@ABV0@@Z
??0CExclusionFilePathConfig@@QAE@KK@Z
??0CExclusionFolderConfig@@QAE@ABV0@@Z
??0CExclusionFolderConfig@@QAE@KK@Z
??0CExclusionRegistryConfig@@QAE@ABV0@@Z
??0CExclusionRegistryConfig@@QAE@KK@Z
??0CFile@@QAE@ABV0@@Z
??0CFile@@QAE@E@Z
??0CFileExtension@@QAE@ABV0@@Z
??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
??0CKEvent@@QAE@ABV0@@Z
??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
??0CList@@QAE@ABV0@@Z
??0CList@@QAE@KPAVIMemoryAllocator@@@Z
??0CLockEvent@@QAE@ABV0@@Z
??0CLockEvent@@QAE@XZ
??0CLockList@@QAE@ABV0@@Z
??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QAE@ABV0@@Z
??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
??0CMemoryPoolAllocator@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@XZ
??0CModuleConfigList@@QAE@ABV0@@Z
??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QAE@ABV0@@Z
??0CModuleFileExtConfig@@QAE@KKE@Z
??0CModuleFlagConfig@@QAE@ABV0@@Z
??0CModuleFlagConfig@@QAE@K@Z
??0CModuleMultiStringConfig@@QAE@ABV0@@Z
??0CModuleMultiStringConfig@@QAE@KK@Z
??0CModuleStringConfig@@QAE@ABV0@@Z
??0CModuleStringConfig@@QAE@K@Z
??0CSmartLock@@QAE@AAVCLockEvent@@@Z
??0CSmartLock@@QAE@XZ
??0CSmartReference@@QAE@AAJ@Z
??0CSmartReference@@QAE@AAK@Z
??0CStrList@@QAE@ABV0@@Z
??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
??0CSystemThread@@QAE@ABV0@@Z
??0CSystemThread@@QAE@K@Z
??0CUserFuncAdapterJob@@QAE@ABV0@@Z
??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z0@Z
??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@E@Z
??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
??0CWorkerThreadJobQueue@@QAE@K@Z
??0CWorkerThreadPool@@QAE@ABV0@@Z
??0CWorkerThreadPool@@QAE@K@Z
??0IMemoryAllocator@@QAE@ABV0@@Z
??0IMemoryAllocator@@QAE@XZ
??1CAutoUpdateConfigThread@@UAE@XZ
??1CBlobConfig@@UAE@XZ
??1CContext@@UAE@XZ
??1CContextList@@UAE@XZ
??1CDebugLog@@UAE@XZ
??1CExclusionExtConfig@@UAE@XZ
??1CExclusionFileNameConfig@@UAE@XZ
??1CExclusionFilePathConfig@@UAE@XZ
??1CExclusionFolderConfig@@UAE@XZ
??1CExclusionRegistryConfig@@UAE@XZ
??1CFile@@UAE@XZ
??1CFileExtension@@UAE@XZ
??1CKEvent@@UAE@XZ
??1CList@@UAE@XZ
??1CLockEvent@@UAE@XZ
??1CLockList@@UAE@XZ
??1CMemoryAllocator@@UAE@XZ
??1CMemoryPoolAllocator@@UAE@XZ
??1CModuleConfig@@UAE@XZ
??1CModuleConfigList@@UAE@XZ
??1CModuleFileExtConfig@@UAE@XZ
??1CModuleFlagConfig@@UAE@XZ
??1CModuleMultiStringConfig@@UAE@XZ
??1CModuleStringConfig@@UAE@XZ
??1CSmartLock@@QAE@XZ
??1CSmartReference@@QAE@XZ
??1CStrList@@UAE@XZ
??1CSystemThread@@UAE@XZ
??1CUserFuncAdapterJob@@UAE@XZ
??1CWorkerThread@@UAE@XZ
??1CWorkerThreadJob@@UAE@XZ
??1CWorkerThreadJobQueue@@UAE@XZ
??1CWorkerThreadPool@@UAE@XZ
??1IMemoryAllocator@@UAE@XZ
??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??2CMemoryAllocator@@SGPAXI@Z
??2CMemoryPoolAllocator@@SGPAXI@Z
??3@YAXPAX@Z
??3IMemoryAllocator@@SGXPAX@Z
??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
??4CBlobConfig@@QAEAAV0@ABV0@@Z
??4CContext@@QAEAAV0@ABV0@@Z
??4CDebugLog@@QAEAAV0@ABV0@@Z
??4CFile@@QAEAAV0@ABV0@@Z
??4CKEvent@@QAEAAV0@ABV0@@Z
??4CLockEvent@@QAEAAV0@ABV0@@Z
??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
??4CModuleConfig@@QAEAAV0@ABV0@@Z
??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
??4CSystemThread@@QAEAAV0@ABV0@@Z
??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
??4CWorkerThread@@QAEAAV0@ABV0@@Z
??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QAEXXZ
??_FCFile@@QAEXXZ
??_FCFileExtension@@QAEXXZ
??_FCModuleConfigList@@QAEXXZ
??_FCStrList@@QAEXXZ
??_FCSystemThread@@QAEXXZ
??_FCWorkerThread@@QAEXXZ
??_FCWorkerThreadJob@@QAEXXZ
??_FCWorkerThreadJobQueue@@QAEXXZ
??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??_V@YAXPAX@Z
?Acquire@CLockEvent@@QAEXXZ
?Add@CContextList@@QAEEPAVCContext@@@Z
?Add@CFileExtension@@QAEEPBGK@Z
?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
?Add@CStrList@@QAEEPBG@Z
?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QAEXXZ
?CheckNode@CLockList@@UAEHQAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
?Cleanup@CBlobConfig@@AAEXXZ
?Cleanup@CModuleFileExtConfig@@IAEXXZ
?Cleanup@CModuleMultiStringConfig@@IAEXXZ
?Cleanup@CModuleStringConfig@@AAEXXZ
?Close@CFile@@QAEJXZ
?Count@CLockList@@QAEKXZ
?Create@CFile@@QAEJPBGKKKK@Z
?Create@CSystemThread@@QAEEXZ
?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
?CreatePool@CWorkerThreadPool@@QAEEXZ
?CreateThreads@CWorkerThreadPool@@QAEEK@Z
?Delete@CFile@@QAEJXZ
?Delete@CFileExtension@@QAEEPBGK@Z
?Delete@CStrList@@QAEEPBG@Z
?DeleteAll@CList@@UAEXXZ
?DeleteAll@CLockList@@UAEXXZ
?DeleteNode@CContextList@@MAEXPAX@Z
?DeleteNode@CList@@UAEXPAX@Z
?DeleteNode@CModuleConfigList@@MAEXPAX@Z
?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YGXPAPAX@Z
?DoIt@CWorkerThreadJob@@QAEJXZ
?EntryPoint@CSystemThread@@KGXPAX@Z
?Find@CContextList@@QAEPAVCContext@@K@Z
?Find@CContextList@@QAEPAVCContext@@PAX@Z
?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FindNode@CContextList@@IAEPAXPAX@Z
?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?First@CList@@UAEPAXXZ
?First@CLockList@@UAEPAXXZ
?Free@CMemoryAllocator@@UAEXPAX@Z
?Free@CMemoryPoolAllocator@@UAEXPAX@Z
?GetAttributes@CFile@@QAEKXZ
?GetBasicInfomration@CFile@@IAEJXZ
?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
?GetCategory@CContext@@QAEKXZ
?GetData@CBlobConfig@@QAEHPAXPAK@Z
?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QAEKXZ
?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
?GetData@CModuleStringConfig@@QAEPAGXZ
?GetData@CStrList@@QAEEPAGPAK@Z
?GetDataType@CModuleConfig@@QAEKXZ
?GetEngineContext@CContext@@QAEPAXXZ
?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UAEJKPAK@Z
?GetID@CModuleConfig@@QAEKXZ
?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QAEKXZ
?GetLinkContext@CContext@@QAEPAXXZ
?GetLogFlag@CDebugLog@@QAEKXZ
?GetModuleId@CModuleConfig@@QAEKXZ
?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QAEKXZ
?GetSize@CBlobConfig@@QAEKXZ
?GetStringConfig@CContext@@QAEPAGK@Z
?GetStringConfig@CContext@@UAEJKPAGPAK@Z
?GetThreadCount@CWorkerThreadPool@@QAEKXZ
?GetThreadID@CSystemThread@@QAEKXZ
?GetType@CContext@@QAEKXZ
?GetUserParameter@CContext@@QAEKXZ
?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
?InitializeFlagConfig@CContext@@QAEHKK@Z
?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
?InitializeStringConfig@CContext@@QAEHKPBG@Z
?Insert@CList@@UAEXQAXE@Z
?Insert@CLockList@@UAEXQAXE@Z
?InsertAfter@CList@@UAEXPAX0@Z
?InsertBefore@CList@@UAEXPAX0@Z
?Instance@CWorkerThreadPool@@SGPAV1@XZ
?IsEmpty@CList@@UAEEXZ
?IsEmpty@CLockList@@UAEEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
?IsFull@CLockList@@QBEEXZ
?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
?IsOpened@CFile@@QAEEXZ
?IsTerminated@CWorkerThreadPool@@QAEEXZ
?IsValid@CMemoryAllocator@@UAEEXZ
?IsValid@CMemoryPoolAllocator@@UAEEXZ
?IsValid@IMemoryAllocator@@UAEEXZ
?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
?JobFunction@CUserFuncAdapterJob@@MAEXXZ
?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QAEKXZ
?MatchAllExtensions@CFileExtension@@QAEEXZ
?MatchNoExtensions@CFileExtension@@QAEEXZ
?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
?NeedDelete@CWorkerThreadJob@@QAEEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
?NewNode@CList@@UAEPAXXZ
?NewNode@CStrList@@EAEPAXXZ
?NewNodeVariant@CList@@IAEPAXK@Z
?Next@CList@@UBEPAXQAX@Z
?Next@CLockList@@UBEPAXQAX@Z
?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
?NotityTerminate@CWorkerThread@@QAEXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
?Pulse@CKEvent@@QAEJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
?Read@CFile@@QAEJPADKPAK@Z
?ReferenceCount@CContext@@QAEAAKXZ
?Release@CLockEvent@@QAEXXZ
?Remove@CContextList@@UAEEQAX@Z
?Remove@CList@@UAEEQAX@Z
?Remove@CLockList@@UAEEQAX@Z
?RemoveHead@CList@@UAEPAXXZ
?RemoveHead@CLockList@@UAEPAXXZ
?RemoveTail@CList@@UAEPAXXZ
?RemoveTail@CLockList@@UAEPAXXZ
?Reset@CKEvent@@QAEXXZ
?RestoreCR0@@YGXPAX@Z
?Run@CAutoUpdateConfigThread@@UAEXXZ
?Run@CWorkerThread@@UAEXXZ
?SeekToEnd@CFile@@QAEJXZ
?Set@CKEvent@@QAEJJE@Z
?SetAttributes@CFile@@QAEJK@Z
?SetBlobCofig@CContext@@UAEJKPAXK@Z
?SetData@CBlobConfig@@QAEHPAXK@Z
?SetData@CModuleFileExtConfig@@QAEHPBG@Z
?SetData@CModuleFlagConfig@@QAEHK@Z
?SetData@CModuleMultiStringConfig@@QAEHPBG@Z
?SetData@CModuleStringConfig@@QAEHPBG@Z
?SetEngineContext@CContext@@QAEXPAX@Z
?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
?SetFlagConfig@CContext@@UAEJKK@Z
?SetLinkContext@CContext@@QAEXPAX@Z
?SetLogFlag@CDebugLog@@QAEEK@Z
?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
?SetMultiStringConfig@CContext@@UAEJKPBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
?SetPriority@CSystemThread@@QAEXK@Z
?SetStopUse@CContext@@QAEXXZ
?SetStringConfig@CContext@@UAEJKPBG@Z
?Setup@CSystemThread@@MAEXXZ
?StopUse@CContext@@QAEHXZ
?TearDown@CSystemThread@@MAEXXZ
?Terminate@CSystemThread@@QAEXE@Z
?Terminate@CWorkerThreadPool@@QAEEXZ
?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QAEXXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
?Write@CDebugLog@@QAAXPBDZZ
?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
?WriteSystemInformation@CDebugLog@@QAEXXZ
?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
?WriteToFile@CDebugLog@@IAEXPADK@Z
?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
?_pPagedAllocator@@3PAVCMemoryAllocator@@A
?m_lpInstance@CWorkerThreadPool@@1PAV1@A
?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
_DeInitKmLPC@0
_GetModuleInfoByAddress@8
_GetModuleInfoByModuleName@8
_InitKmLPC@0
_KmCallUm@8
_MapMem@12
_ModGetExportProcAddress@8
_ModLoadDLLToBuffer@4
_ModLoadModule@8
_ModUnLoadModule@4
_TmCommConfigRoutine@4
_UnMapMem@8
_UtilGetProcessName@12
_UtilGetSystemTime@4
_UtilIoSetFileInfo@24
_UtilIopCreateFileIRP@40
_UtilKeGetLowFileDevice@16
_UtilQueryKeyValue@24
_UtilVolumeDeviceToDosName@8
_UtilWaitValueChangeToZero@8
_UtilWriteVersionToRegistry@8

Sections

Expand

.text
.rdata
.data
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2012-06-05 01:36:19
MD5	d79b8b7bed8d30387c22663b24e8c191
SHA1	af5b7556706e09ee9e74ee2e87eab5c0a49d2d35
SHA256	d783ace822f8fe4e25d5387e5dd249cb72e62f62079023216dc436f1853a150f
Authentihash MD5	ab680a8ed6b727bb2a4e27d124191b89
Authentihash SHA1	62fe5d3ebcd192fcf985f2e3a27c214051ecf854
Authentihash SHA256	44120b712e4b5ef3b302f03b7aa61f9f6fe6820d966addbcc43d8e09402e5906
RichPEHeaderHash MD5	03cc0cf6cc93ab1faa8dd44481e28703
RichPEHeaderHash SHA1	7c749d49c0677c330200d6fcd0e2da5232be0970
RichPEHeaderHash SHA256	8ff0549239941077a9cfd73a1d1e0ca0a20d4df41e2b9d249e6115f9bc1857b4
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	Trend Micro Eyes
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 79a2a585f9d1154213d9b83ef6b68ded

Field	Value
ToBeSigned (TBS) MD5	e6d820afb23af20a65cf0b03247ea05e
ToBeSigned (TBS) SHA1	7a8f7c37453f99390ee1e94bb5d3d1cba3a0eea7
ToBeSigned (TBS) SHA256	7e722dc40e6b9abf8c20aa4d887e34b6d2c6b8cbe53a055d49bf9f5e946e0d27
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G3
ValidFrom	2012-05-01 00:00:00
ValidTo	2012-12-31 23:59:59
Signature	1e98aa27b778b508b5c9726db7dfc00e98a635c488c9d2f66df14b1afbd5f92d99009ed1e79b8be13fbd39800c66cd07bc5c9854a694ba10d14e8babf56f65cc6709a2807c52e80e03d66b7ac60518ecc8ac427c072ca73d0866dc00edfd941d73f2729893b111d68fef8eeaacf496510cd08ddf31524f5eaf7da74a75e64ece2b9f292be7cf5d9f037e6e277b23ad622966af92e82ccebd9c7fdccd173c43c2093f7545c79ee4d7607f97c6e4aac769f5fccd74ac2cb048c1504e70561eb535d38ebeb1edacbdfe0cec857dd5bb856644195d9f93eb82ba639ed37c61ffc81bd923587f30a366a139265e92c33ccb3732faf5a38ddcd5b0a3e9253655d781fa
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	79a2a585f9d1154213d9b83ef6b68ded
Version	3

Certificate 47bf1995df8d524643f7db6d480d31a4

Field	Value
ToBeSigned (TBS) MD5	518d2ea8a21e879c942d504824ac211c
ToBeSigned (TBS) SHA1	21ce87d827077e61abddf2beba69fde5432ea031
ToBeSigned (TBS) SHA256	1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7
Subject	C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
ValidFrom	2003-12-04 00:00:00
ValidTo	2013-12-03 23:59:59
Signature	4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	47bf1995df8d524643f7db6d480d31a4
Version	3

Certificate 4d6290e58c54f0f1eb17341a1310e6a4

Field	Value
ToBeSigned (TBS) MD5	b7d8444a70054990435f35a5630df5e1
ToBeSigned (TBS) SHA1	4678c6e4a8787a8e6ed2bce8792b122f6c08afd8
ToBeSigned (TBS) SHA256	0a8b4b359ea7890b358e56e436e9cfc6f32b037b2599b597ca7f7a80d475ec98
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-09-30 00:00:00
ValidTo	2014-01-01 23:59:59
Signature	aedd211d5f8f807ad25209eadb6ed25d8be8c21b6904be51a5010e59fa37d174a3eedced89742b62d5a6bf4fad361754f013e0a345d24c26cbe26da21fd01e7a070fb6b37b6f5068a2e931b3b7997d8070a0a7de0b1ea4fff34d811bdd20c91cc4afcff18ffad9da95f0ecdc5cbfe88c5a3e7ab0a3eb59437411e09b1a6af36f
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	4d6290e58c54f0f1eb17341a1310e6a4
Version	3

Certificate 610c120600000000001b

Field	Value
ToBeSigned (TBS) MD5	53c41bc1164e09e0cd1617a5bf913efd
ToBeSigned (TBS) SHA1	93c03aac8951d494ecd5696b1c08658541b18727
ToBeSigned (TBS) SHA256	40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b
Subject	C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
ValidFrom	2006-05-23 17:01:29
ValidTo	2016-05-23 17:11:29
Signature	01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	610c120600000000001b
Version	3

Certificate 6326c00ead256b6837eeb29b5ee84720

Field	Value
ToBeSigned (TBS) MD5	11b208a45459069f827186fe81c6badd
ToBeSigned (TBS) SHA1	456356986e8ecbb7b05e4617d37cb8cd69ce4969
ToBeSigned (TBS) SHA256	4a0336d7ffa5db42ece4b342e1244f5c2bd0681827f68f847d99195c83740145
Subject	C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, OU=RD, CN=Trend Micro, Inc.
ValidFrom	2011-12-27 00:00:00
ValidTo	2013-02-15 23:59:59
Signature	840ba0fc35187fe2edc7b17c101fd2bf035bbad8f3de048e250741e96a3f4ecee86f1f065ea76f2f8f430a13a75ff3eab29a8b11a13006d27bf3173fa49aabf9cef98fc4554f1732317c4b821c740eb58a91977d85e86574dd712718b15d24f7eb88b6d4520aef788478e1ef8cebd7fff06fadbc87ca6ca2b77da85be3c30b4d590bcb8945a0acfa013f89073933494d9c465c0036280a5af39f6802e60bd175a2603366dd935cb3458b1791411a06b6e5f38e3171de4238051c79b33117cb94674d0625c402bdfb0f99b80625dc0f827911c6c11263884a4e41d1abf60070ad46b7296e19e1cfcda7304a650d7a814319cc11e5a947e82b2d00a169e798b871
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	6326c00ead256b6837eeb29b5ee84720
Version	3

Imports

Expand

ntoskrnl.exe
HAL.dll
CLASSPNP.SYS

Imported Functions

Expand

wcsrchr
KeSetEvent
KePulseEvent
KeClearEvent
KeInitializeSemaphore
KeWaitForSingleObject
KeReleaseSemaphore
KeStackAttachProcess
KeUnstackDetachProcess
RtlSubAuthoritySid
RtlInitializeSid
ExAllocatePoolWithTag
RtlLengthRequiredSid
ExFreePoolWithTag
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
ObfDereferenceObject
ZwSetEvent
ZwClose
ZwRequestWaitReplyPort
ProbeForWrite
ZwFreeVirtualMemory
ZwAllocateVirtualMemory
ObOpenObjectByPointer
PsProcessType
memmove
ZwConnectPort
RtlInitUnicodeString
RtlUnicodeStringToInteger
ZwCreateSection
ZwWaitForSingleObject
ZwOpenEvent
ObfReferenceObject
IoGetCurrentProcess
DbgBreakPoint
PsGetProcessExitTime
MmSectionObjectType
DbgPrint
memset
MmIsAddressValid
ExInitializeResourceLite
ExDeleteResourceLite
ZwWriteFile
ZwReadFile
ZwQueryInformationFile
ZwSetInformationFile
ZwCreateFile
swprintf
towupper
_wcsnicmp
KeInitializeEvent
_snprintf
PsGetCurrentProcessId
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
ZwCreateKey
ZwCreateEvent
KeWaitForMultipleObjects
ObReferenceObjectByHandle
ZwNotifyChangeKey
PsGetCurrentThreadId
_vsnprintf
KeSetPriorityThread
PsTerminateSystemThread
PsCreateSystemThread
KeNumberProcessors
ZwQueryInformationProcess
PsLookupProcessByProcessId
KeDelayExecutionThread
ZwOpenDirectoryObject
PsSetCreateProcessNotifyRoutine
ZwQuerySystemInformation
ZwQueryDirectoryFile
ZwQueryDirectoryObject
ZwDuplicateObject
ZwOpenKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryValueKey
ZwDeleteValueKey
ZwDeleteKey
ExGetPreviousMode
ZwTerminateProcess
ZwOpenProcess
ZwQueryKey
ZwSetValueKey
MmHighestUserAddress
IoFreeIrp
memcpy
MmUnlockPages
IoBuildAsynchronousFsdRequest
_strnicmp
RtlQueryRegistryValues
RtlAppendUnicodeToString
mbstowcs
_purecall
ZwOpenSymbolicLinkObject
NtClose
ZwSetInformationObject
_stricmp
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwOpenFile
RtlEqualUnicodeString
IoFileObjectType
IoCreateFile
IofCallDriver
IoAllocateIrp
MmBuildMdlForNonPagedPool
IoAllocateMdl
ProbeForRead
PsGetVersion
MmGetSystemRoutineAddress
RtlCopyUnicodeString
RtlCompareMemory
_snwprintf
RtlImageNtHeader
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
strrchr
ZwQueryVolumeInformationFile
ObReferenceObjectByPointer
ObQueryNameString
IoBuildDeviceIoControlRequest
IofCompleteRequest
ExEventObjectType
_allmul
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoGetDeviceObjectPointer
RtlUpperChar
RtlCompareUnicodeString
strncpy
KeServiceDescriptorTable
NtOpenProcess
ObOpenObjectByName
IoDriverObjectType
RtlAppendUnicodeStringToString
strncmp
NtQueryInformationProcess
PsIsThreadTerminating
PsThreadType
KeAddSystemServiceTable
ZwQueryObject
ZwQuerySecurityObject
ObInsertObject
_allrem
IoReleaseVpbSpinLock
IoAcquireVpbSpinLock
SeCreateAccessState
IoGetFileObjectGenericMapping
RtlUpcaseUnicodeString
ObCreateObject
_allshr
ExInterlockedPopEntrySList
IoGetStackLimits
IoBuildSynchronousFsdRequest
MmSystemRangeStart
IoUnregisterPlugPlayNotification
FsRtlIsNameInExpression
wcsstr
IoGetConfigurationInformation
MmProbeAndLockPages
IoGetDeviceInterfaces
IoRegisterPlugPlayNotification
ExAllocatePool
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
strncat
wcschr
wcsncat
KeCancelTimer
KeSetTimerEx
KeInitializeTimer
wcstombs
KeTickCount
KeBugCheckEx
RtlUnwind
wcsncpy
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
ExAcquireResourceSharedLite
ExReleaseFastMutexUnsafe
KeLeaveCriticalRegion
KeEnterCriticalRegion
IoFreeMdl
ExAcquireFastMutexUnsafe
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
RtlLengthSid
RtlAbsoluteToSelfRelativeSD
ZwQuerySymbolicLinkObject
KeGetCurrentThread
KfAcquireSpinLock
KfReleaseSpinLock
KeRaiseIrqlToDpcLevel
KfLowerIrql
KeGetCurrentIrql
ExAcquireFastMutex
ExReleaseFastMutex
KfRaiseIrql
ClassInitialize

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
??0CBlobConfig@@QAE@ABV0@@Z
??0CBlobConfig@@QAE@K@Z
??0CContext@@QAE@ABV0@@Z
??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QAE@ABV0@@Z
??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
??0CDebugLog@@QAE@ABV0@@Z
??0CDebugLog@@QAE@PBG@Z
??0CDelayLoadThread@@QAE@ABV0@@Z
??0CDelayLoadThread@@QAE@XZ
??0CExclusionExtConfig@@QAE@ABV0@@Z
??0CExclusionExtConfig@@QAE@KKE@Z
??0CExclusionFileNameConfig@@QAE@ABV0@@Z
??0CExclusionFileNameConfig@@QAE@KK@Z
??0CExclusionFilePathConfig@@QAE@ABV0@@Z
??0CExclusionFilePathConfig@@QAE@KK@Z
??0CExclusionFolderConfig@@QAE@ABV0@@Z
??0CExclusionFolderConfig@@QAE@KK@Z
??0CExclusionRegistryConfig@@QAE@ABV0@@Z
??0CExclusionRegistryConfig@@QAE@KK@Z
??0CFile@@QAE@ABV0@@Z
??0CFile@@QAE@E@Z
??0CFileExtension@@QAE@ABV0@@Z
??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
??0CInclusionExtConfig@@QAE@ABV0@@Z
??0CInclusionExtConfig@@QAE@KKE@Z
??0CInclusionFileNameConfig@@QAE@ABV0@@Z
??0CInclusionFileNameConfig@@QAE@KK@Z
??0CInclusionFilePathConfig@@QAE@ABV0@@Z
??0CInclusionFilePathConfig@@QAE@KK@Z
??0CInclusionFolderConfig@@QAE@ABV0@@Z
??0CInclusionFolderConfig@@QAE@KK@Z
??0CKEvent@@QAE@ABV0@@Z
??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
??0CList@@QAE@ABV0@@Z
??0CList@@QAE@KPAVIMemoryAllocator@@@Z
??0CLockEvent@@QAE@ABV0@@Z
??0CLockEvent@@QAE@XZ
??0CLockList@@QAE@ABV0@@Z
??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QAE@ABV0@@Z
??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
??0CMemoryPoolAllocator@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@XZ
??0CModuleConfigList@@QAE@ABV0@@Z
??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QAE@ABV0@@Z
??0CModuleFileExtConfig@@QAE@KKE@Z
??0CModuleFlagConfig@@QAE@ABV0@@Z
??0CModuleFlagConfig@@QAE@K@Z
??0CModuleMultiStringConfig@@QAE@ABV0@@Z
??0CModuleMultiStringConfig@@QAE@KK@Z
??0CModuleStringConfig@@QAE@ABV0@@Z
??0CModuleStringConfig@@QAE@K@Z
??0CNoLockList@@QAE@ABV0@@Z
??0CNoLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CSmartLock@@QAE@AAVCLockEvent@@@Z
??0CSmartLock@@QAE@XZ
??0CSmartReference@@QAE@AAJ@Z
??0CSmartReference@@QAE@AAK@Z
??0CSmartResource@@QAE@AAVCResource@@E@Z
??0CStrList@@QAE@ABV0@@Z
??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
??0CSystemThread@@QAE@ABV0@@Z
??0CSystemThread@@QAE@K@Z
??0CUserFuncAdapterJob@@QAE@ABV0@@Z
??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z0@Z
??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@E@Z
??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
??0CWorkerThreadJobQueue@@QAE@K@Z
??0CWorkerThreadPool@@QAE@ABV0@@Z
??0CWorkerThreadPool@@QAE@K@Z
??0IMemoryAllocator@@QAE@ABV0@@Z
??0IMemoryAllocator@@QAE@XZ
??1CAutoUpdateConfigThread@@UAE@XZ
??1CBlobConfig@@UAE@XZ
??1CContext@@UAE@XZ
??1CContextList@@UAE@XZ
??1CDebugLog@@UAE@XZ
??1CDelayLoadThread@@UAE@XZ
??1CExclusionExtConfig@@UAE@XZ
??1CExclusionFileNameConfig@@UAE@XZ
??1CExclusionFilePathConfig@@UAE@XZ
??1CExclusionFolderConfig@@UAE@XZ
??1CExclusionRegistryConfig@@UAE@XZ
??1CFile@@UAE@XZ
??1CFileExtension@@UAE@XZ
??1CInclusionExtConfig@@UAE@XZ
??1CInclusionFileNameConfig@@UAE@XZ
??1CInclusionFilePathConfig@@UAE@XZ
??1CInclusionFolderConfig@@UAE@XZ
??1CKEvent@@UAE@XZ
??1CList@@UAE@XZ
??1CLockEvent@@UAE@XZ
??1CLockList@@UAE@XZ
??1CMemoryAllocator@@UAE@XZ
??1CMemoryPoolAllocator@@UAE@XZ
??1CModuleConfig@@UAE@XZ
??1CModuleConfigList@@UAE@XZ
??1CModuleFileExtConfig@@UAE@XZ
??1CModuleFlagConfig@@UAE@XZ
??1CModuleMultiStringConfig@@UAE@XZ
??1CModuleStringConfig@@UAE@XZ
??1CNoLockList@@UAE@XZ
??1CSmartLock@@QAE@XZ
??1CSmartReference@@QAE@XZ
??1CSmartResource@@QAE@XZ
??1CStrList@@UAE@XZ
??1CSystemThread@@UAE@XZ
??1CUserFuncAdapterJob@@UAE@XZ
??1CWorkerThread@@UAE@XZ
??1CWorkerThreadJob@@UAE@XZ
??1CWorkerThreadJobQueue@@UAE@XZ
??1CWorkerThreadPool@@UAE@XZ
??1IMemoryAllocator@@UAE@XZ
??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??2CMemoryAllocator@@SGPAXI@Z
??2CMemoryPoolAllocator@@SGPAXI@Z
??3@YAXPAX@Z
??3IMemoryAllocator@@SGXPAX@Z
??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
??4CBlobConfig@@QAEAAV0@ABV0@@Z
??4CContext@@QAEAAV0@ABV0@@Z
??4CDebugLog@@QAEAAV0@ABV0@@Z
??4CDelayLoadThread@@QAEAAV0@ABV0@@Z
??4CFile@@QAEAAV0@ABV0@@Z
??4CKEvent@@QAEAAV0@ABV0@@Z
??4CLockEvent@@QAEAAV0@ABV0@@Z
??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
??4CModuleConfig@@QAEAAV0@ABV0@@Z
??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
??4CSmartResource@@QAEAAV0@ABV0@@Z
??4CSystemThread@@QAEAAV0@ABV0@@Z
??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
??4CWorkerThread@@QAEAAV0@ABV0@@Z
??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CDelayLoadThread@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CInclusionExtConfig@@6B@
??_7CInclusionFileNameConfig@@6B@
??_7CInclusionFilePathConfig@@6B@
??_7CInclusionFolderConfig@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CNoLockList@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QAEXXZ
??_FCFile@@QAEXXZ
??_FCFileExtension@@QAEXXZ
??_FCModuleConfigList@@QAEXXZ
??_FCStrList@@QAEXXZ
??_FCSystemThread@@QAEXXZ
??_FCWorkerThread@@QAEXXZ
??_FCWorkerThreadJob@@QAEXXZ
??_FCWorkerThreadJobQueue@@QAEXXZ
??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??_V@YAXPAX@Z
?Acquire@CLockEvent@@QAEXXZ
?Add@CContextList@@QAEEPAVCContext@@@Z
?Add@CFileExtension@@QAEEPBGK@Z
?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
?Add@CStrList@@QAEEPBG@Z
?AddNode@CLockList@@UAEEQAXE@Z
?AddNode@CNoLockList@@UAEEQAXE@Z
?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QAEXXZ
?CheckNode@CLockList@@UAEHQAX@Z
?CheckNode@CNoLockList@@UAEHQAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
?Cleanup@CBlobConfig@@AAEXXZ
?Cleanup@CModuleFileExtConfig@@IAEXXZ
?Cleanup@CModuleMultiStringConfig@@IAEXXZ
?Cleanup@CModuleStringConfig@@AAEXXZ
?Close@CFile@@QAEJXZ
?Count@CLockList@@QAEKXZ
?Count@CNoLockList@@QAEKXZ
?Create@CFile@@QAEJPBGKKKK@Z
?Create@CSystemThread@@QAEEXZ
?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
?CreatePool@CWorkerThreadPool@@QAEEXZ
?CreateThreads@CWorkerThreadPool@@QAEEK@Z
?CreateWIRP@CFile@@QAEJPBGKKKK@Z
?Delete@CFile@@QAEJXZ
?Delete@CFileExtension@@QAEEPBGK@Z
?Delete@CStrList@@QAEEPBG@Z
?DeleteAll@CList@@UAEXXZ
?DeleteAll@CLockList@@UAEXXZ
?DeleteAll@CNoLockList@@UAEXXZ
?DeleteNode@CContextList@@MAEXPAX@Z
?DeleteNode@CList@@UAEXPAX@Z
?DeleteNode@CModuleConfigList@@MAEXPAX@Z
?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YGXPAPAX@Z
?DoIt@CWorkerThreadJob@@QAEJXZ
?EntryPoint@CSystemThread@@KGXPAX@Z
?Find@CContextList@@QAEPAVCContext@@K@Z
?Find@CContextList@@QAEPAVCContext@@PAX@Z
?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FindNode@CContextList@@IAEPAXPAX@Z
?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?First@CList@@UAEPAXXZ
?First@CLockList@@UAEPAXXZ
?First@CNoLockList@@UAEPAXXZ
?Free@CMemoryAllocator@@UAEXPAX@Z
?Free@CMemoryPoolAllocator@@UAEXPAX@Z
?GetAttributes@CFile@@QAEKXZ
?GetBasicInfomration@CFile@@IAEJXZ
?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
?GetCategory@CContext@@QAEKXZ
?GetData@CBlobConfig@@QAEHPAXPAK@Z
?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QAEKXZ
?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
?GetData@CModuleStringConfig@@QAEPAGXZ
?GetData@CStrList@@QAEEPAGPAK@Z
?GetDataType@CModuleConfig@@QAEKXZ
?GetEngineContext@CContext@@QAEPAXXZ
?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UAEJKPAK@Z
?GetID@CModuleConfig@@QAEKXZ
?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QAEKXZ
?GetLinkContext@CContext@@QAEPAXXZ
?GetLogFlag@CDebugLog@@QAEKXZ
?GetModuleId@CModuleConfig@@QAEKXZ
?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QAEKXZ
?GetSize@CBlobConfig@@QAEKXZ
?GetStringConfig@CContext@@QAEPAGK@Z
?GetStringConfig@CContext@@UAEJKPAGPAK@Z
?GetThreadCount@CWorkerThreadPool@@QAEKXZ
?GetThreadID@CSystemThread@@QAEKXZ
?GetType@CContext@@QAEKXZ
?GetUserParameter@CContext@@QAEKXZ
?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
?InitializeFlagConfig@CContext@@QAEHKK@Z
?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
?InitializeStringConfig@CContext@@QAEHKPBG@Z
?Insert@CList@@UAEXQAXE@Z
?Insert@CLockList@@UAEXQAXE@Z
?Insert@CNoLockList@@UAEXQAXE@Z
?InsertAfter@CList@@UAEXPAX0@Z
?InsertBefore@CList@@UAEXPAX0@Z
?Instance@CWorkerThreadPool@@SGPAV1@XZ
?IsEmpty@CList@@UAEEXZ
?IsEmpty@CLockList@@UAEEXZ
?IsEmpty@CNoLockList@@UAEEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
?IsFull@CLockList@@QBEEXZ
?IsFull@CNoLockList@@QBEEXZ
?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionExtConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFileNameConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFilePathConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFolderConfig@@QAEEPBG@Z
?IsOpened@CFile@@QAEEXZ
?IsTerminated@CWorkerThreadPool@@QAEEXZ
?IsValid@CMemoryAllocator@@UAEEXZ
?IsValid@CMemoryPoolAllocator@@UAEEXZ
?IsValid@IMemoryAllocator@@UAEEXZ
?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
?JobFunction@CUserFuncAdapterJob@@MAEXXZ
?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QAEKXZ
?Limit@CNoLockList@@QAEKXZ
?MatchAllExtensions@CFileExtension@@QAEEXZ
?MatchNoExtensions@CFileExtension@@QAEEXZ
?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
?NeedDelete@CWorkerThreadJob@@QAEEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
?NewNode@CList@@UAEPAXXZ
?NewNode@CStrList@@EAEPAXXZ
?NewNodeVariant@CList@@IAEPAXK@Z
?Next@CList@@UBEPAXQAX@Z
?Next@CLockList@@UBEPAXQAX@Z
?Next@CNoLockList@@UBEPAXQAX@Z
?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
?NotityTerminate@CWorkerThread@@QAEXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
?Pulse@CKEvent@@QAEJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
?Read@CFile@@QAEJPADKPAK@Z
?ReferenceCount@CContext@@QAEAAKXZ
?Release@CLockEvent@@QAEXXZ
?Remove@CContextList@@UAEEQAX@Z
?Remove@CList@@UAEEQAX@Z
?Remove@CLockList@@UAEEQAX@Z
?Remove@CNoLockList@@UAEEQAX@Z
?RemoveHead@CList@@UAEPAXXZ
?RemoveHead@CLockList@@UAEPAXXZ
?RemoveHead@CNoLockList@@UAEPAXXZ
?RemoveTail@CList@@UAEPAXXZ
?RemoveTail@CLockList@@UAEPAXXZ
?RemoveTail@CNoLockList@@UAEPAXXZ
?Reset@CKEvent@@QAEXXZ
?ResetData@CInclusionExtConfig@@QAEXXZ
?ResetData@CInclusionFileNameConfig@@QAEXXZ
?ResetData@CInclusionFilePathConfig@@QAEXXZ
?ResetData@CInclusionFolderConfig@@QAEXXZ
?RestoreCR0@@YGXPAX@Z
?Run@CAutoUpdateConfigThread@@UAEXXZ
?Run@CDelayLoadThread@@UAEXXZ
?Run@CWorkerThread@@UAEXXZ
?SeekToEnd@CFile@@QAEJXZ
?Set@CKEvent@@QAEJJE@Z
?SetAttributes@CFile@@QAEJK@Z
?SetBlobCofig@CContext@@UAEJKPAXK@Z
?SetData@CBlobConfig@@QAEHPAXK@Z
?SetData@CModuleFileExtConfig@@QAEHPBG@Z
?SetData@CModuleFlagConfig@@QAEHK@Z
?SetData@CModuleMultiStringConfig@@QAEHPBGK@Z
?SetData@CModuleStringConfig@@QAEHPBG@Z
?SetEngineContext@CContext@@QAEXPAX@Z
?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
?SetFlagConfig@CContext@@UAEJKK@Z
?SetLinkContext@CContext@@QAEXPAX@Z
?SetLogFlag@CDebugLog@@QAEEK@Z
?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
?SetMultiStringConfig@CContext@@UAEJKPBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
?SetPriority@CSystemThread@@QAEXK@Z
?SetStopUse@CContext@@QAEXXZ
?SetStringConfig@CContext@@UAEJKPBG@Z
?Setup@CSystemThread@@MAEXXZ
?StopUse@CContext@@QAEHXZ
?TearDown@CSystemThread@@MAEXXZ
?Terminate@CSystemThread@@QAEXE@Z
?Terminate@CWorkerThreadPool@@QAEEXZ
?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QAEXXZ
?WaitForInit@CDelayLoadThread@@QAEEXZ
?WaitForLoad@CDelayLoadThread@@QAEEXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
?Write@CDebugLog@@QAAXPBDZZ
?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
?WriteSystemInformation@CDebugLog@@QAEXXZ
?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
?WriteToFile@CDebugLog@@IAEXPADK@Z
?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
?_pPagedAllocator@@3PAVCMemoryAllocator@@A
?m_lpInstance@CWorkerThreadPool@@1PAV1@A
?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
_DeInitKmLPC@0
_GetModuleInfoByAddress@8
_GetModuleInfoByModuleName@8
_InitKmLPC@0
_KmCallUm@8
_KmCallUmEx@12
_ModGetExportProcAddress@8
_ModLoadDLLToBuffer@4
_ModLoadDLLToBufferWithImageSize@8
_ModLoadModule@8
_ModUnLoadModule@4
_NormalizeFileName@4
_NormalizeFullNtPathToDosName@4
_TmCommConfigRoutine@4
_UtilAddDeviceInDriveTable@4
_UtilCleanFileReadOnly@4
_UtilDeleteFileForce@4
_UtilGetFileObjectForProcessByEPROC@8
_UtilGetFileObjectFromFileName@12
_UtilGetProcessName@12
_UtilGetSystemDirectory@4
_UtilGetSystemDirectoryEx@0
_UtilGetSystemDirectoryLength@0
_UtilGetSystemTime@4
_UtilIoSetFileInfo@24
_UtilIopCreateFileIRP@40
_UtilKeGetLowFileDevice@16
_UtilModuleIATHook@24
_UtilModuleIATUnHook@8
_UtilQueryKeyValue@24
_UtilRemoveDeviceFromDriveTable@4
_UtilVolumeDeviceToDosName@8
_UtilWaitValueChangeToZero@8
_UtilWriteVersionToRegistry@8
_UtilbuildDynamicDiskMappingTable@0
_UtlWriteBinValueKeyToRegistry@16
__UtilDosPathNameToNtPathName@12

Sections

Expand

.text
.rdata
.data
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2014-07-14 01:39:00
MD5	e28ce623e3e5fa1d2fe16c721efad4c2
SHA1	4cd5bf02edf6883a08dfed7702267612e21ed56e
SHA256	dbc604b4e01362a3e51357af4a87686834fe913852a4e0a8c0d4c1a0f7d076ed
Authentihash MD5	ae1b6ea856ae1be7cf1929618e5d78ad
Authentihash SHA1	93d07ce0258ae8595833b8c5c6aee14b1a210405
Authentihash SHA256	6d6fe20c9f7ccfe723bf7feecb5acf773a85cb61286452dc4001589f82b1a424
RichPEHeaderHash MD5	c060a624a43f3a4972ee081f9209e4d3
RichPEHeaderHash SHA1	e630bbef7195d2e1c16d683b8f18c182aef98dc7
RichPEHeaderHash SHA256	b574f3894ffb1b628c20191e085a4ada2a5f0eb04ea86a3a1ddc1d9fffd22f99
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	Trend Micro Eyes
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 478a8efb59e1d83f0ce142d2a28707be

Field	Value
ToBeSigned (TBS) MD5	f13ede9179075999ef7f856ec31e364b
ToBeSigned (TBS) SHA1	2f09867166e6107e17808317f5c8d4ee157f45bc
ToBeSigned (TBS) SHA256	089a2c4c6ac7432020acdb65c33bf39130da6f37c002ba79128bd4c94e4fa101
Subject	C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO Time Stamping Signer
ValidFrom	2010-05-10 00:00:00
ValidTo	2015-05-10 23:59:59
Signature	c8fb63f80b75752c3af1f213a72db6a31a9cad0107d3348e77e0c26eae025d484fa4d221b636fd2a35437c6bdf80870b15f0763200b4ceb567a42f2f201b9c549e833f1f5f149562820f2241221f70b3f3f742de6c51cd4bf821ac9b3b8cb1e5e6288fce2a8af9aa524d8c5b77ba4d5a58dbbb6a04cc521e9de228370ebbe70e91c7f8dbf18198ebcd37b30eab65d362ec3aa576eb13a83593c92e0a01ecc0e8cc3d7eb6ebe2c1ecd3149282668750dcfd5097acb34a767306c486113ab35f4304526feab3d074364ccaf11b7984377063ad74b9aa0ef398b08608ebdbe01f8c10f239649bae4f0a2c928a4f18b591e58d1a935f1faef1a6f02e97d0d2f62b3c
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	478a8efb59e1d83f0ce142d2a28707be
Version	3

Certificate 250ce8e030612e9f2b89f7054d7cf8fd

Field	Value
ToBeSigned (TBS) MD5	918d9eb6a6cd36c531eceb926170a7e1
ToBeSigned (TBS) SHA1	0ae95700d65e6f59715aa47048993ca7858e676a
ToBeSigned (TBS) SHA256	47c46e6eaa3780eace3d0d891346cd373359d246b21a957219dbab4c8f37c166
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
ValidFrom	2006-11-08 00:00:00
ValidTo	2021-11-07 23:59:59
Signature	1302ddf8e88600f25af8f8200c59886207cecef74ef9bb59a198e5e138dd4ebc6618d3adeb18f20dc96d3e4a9420c33cbabd6554c6af44b310ad2c6b3eabd707b6b88163c5f95e2ee52a67cecd330c2ad7895603231fb3bee83a0859b4ec4535f78a5bff66cf50afc66d578d1978b7b9a2d157ea1f9a4bafbac98e127ec6bdff
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	250ce8e030612e9f2b89f7054d7cf8fd
Version	3

Certificate 610c120600000000001b

Field	Value
ToBeSigned (TBS) MD5	53c41bc1164e09e0cd1617a5bf913efd
ToBeSigned (TBS) SHA1	93c03aac8951d494ecd5696b1c08658541b18727
ToBeSigned (TBS) SHA256	40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b
Subject	C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
ValidFrom	2006-05-23 17:01:29
ValidTo	2016-05-23 17:11:29
Signature	01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	610c120600000000001b
Version	3

Certificate 5bb307b9e6fbf0c0fd40f5772d1ad8e3

Field	Value
ToBeSigned (TBS) MD5	e8f93ae74cc54a00e4278f92c46c42e9
ToBeSigned (TBS) SHA1	1e2d3a7e0be7d05f35ede330e922292e6ffa1a0c
ToBeSigned (TBS) SHA256	9d5606f127dc9d395d41a511d41831b7fff0954458d6c2d09297e25d2a44671f
Subject	C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, CN=Trend Micro, Inc.
ValidFrom	2014-02-07 00:00:00
ValidTo	2015-04-08 23:59:59
Signature	95676d657200d1a91b1629ed0bb118cc53bbacd5393d361300de6c1107b5007664bf846a75e03f5f4c9d6d9882cbb744621deee429f37c0695f829dace5b0f44309bdaa5a132dfbd8161e0a490752ecc340e7ae1c40c01c2029b7d8c0ecc9a717843e22a7a7232b64dfdec2f1312a6fd514a59d27eb2486dc5e9cbe7aa1ea6e21598f06bbd3faf3c37073e2f363b4133336ecb536a7735f53ddd666509cef465ae1c5e01a23b674a7bf4a8835c3ddd85168f84ff5c63a1685a15939bc0c7e5dd92bc95e41a0fd443d384e328be7374e95e28230365a7489d114009911ecee502afe8dbcdb44055df9b59feebc6d05eeffba205a4d62574936463bb05f79b5be4
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	5bb307b9e6fbf0c0fd40f5772d1ad8e3
Version	3

Certificate 5200e5aa2556fc1a86ed96c9d44b33c7

Field	Value
ToBeSigned (TBS) MD5	b30c31a572b0409383ed3fbe17e56e81
ToBeSigned (TBS) SHA1	4843a82ed3b1f2bfbee9671960e1940c942f688d
ToBeSigned (TBS) SHA256	03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-02-08 00:00:00
ValidTo	2020-02-07 23:59:59
Signature	5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	5200e5aa2556fc1a86ed96c9d44b33c7
Version	3

Imports

Expand

ntoskrnl.exe
HAL.dll
CLASSPNP.SYS

Imported Functions

Expand

wcsrchr
KeSetEvent
KePulseEvent
KeClearEvent
KeStackAttachProcess
KeUnstackDetachProcess
ObfDereferenceObject
ZwSetEvent
ZwClose
ZwConnectPort
RtlInitUnicodeString
RtlUnicodeStringToInteger
ZwCreateSection
ZwWaitForSingleObject
ZwOpenEvent
IoGetCurrentProcess
ObfReferenceObject
DbgBreakPoint
ZwRequestWaitReplyPort
ExFreePoolWithTag
ProbeForWrite
ZwFreeVirtualMemory
ZwAllocateVirtualMemory
ObOpenObjectByPointer
PsProcessType
memmove
PsGetProcessExitTime
MmSectionObjectType
PsThreadType
ObReleaseObjectSecurity
SeReleaseSubjectContext
SeAccessCheck
SeCaptureSubjectContext
ObGetObjectSecurity
DbgPrint
memset
MmIsAddressValid
ExInitializeResourceLite
ExDeleteResourceLite
ZwWriteFile
ZwReadFile
ZwQueryInformationFile
ZwSetInformationFile
ZwCreateFile
swprintf
towupper
_wcsnicmp
ExAllocatePoolWithTag
KeInitializeEvent
_snprintf
PsGetCurrentProcessId
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
PsGetCurrentThreadId
RtlInitAnsiString
ZwDeviceIoControlFile
ZwCreateKey
ZwCreateEvent
KeWaitForMultipleObjects
ObReferenceObjectByHandle
ZwNotifyChangeKey
_vsnprintf
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlEqualUnicodeString
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
RtlUpcaseUnicodeChar
KeWaitForSingleObject
KeSetPriorityThread
PsTerminateSystemThread
PsCreateSystemThread
KeDelayExecutionThread
KeNumberProcessors
ZwQueryInformationProcess
PsLookupProcessByProcessId
ZwOpenDirectoryObject
PsSetCreateProcessNotifyRoutine
ZwQuerySystemInformation
ZwQueryDirectoryFile
ZwQueryDirectoryObject
ZwDuplicateObject
ZwOpenKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryValueKey
ZwDeleteValueKey
ZwDeleteKey
ExGetPreviousMode
ZwTerminateProcess
ZwOpenProcess
ZwQueryKey
ZwSetValueKey
IoFileObjectType
_allrem
ZwQuerySecurityObject
memcpy
RtlLengthSecurityDescriptor
MmHighestUserAddress
IoFreeIrp
IoFreeMdl
MmUnlockPages
_purecall
_strnicmp
RtlQueryRegistryValues
RtlAppendUnicodeToString
mbstowcs
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
NtClose
ObQueryNameString
MmGetSystemRoutineAddress
ZwSetInformationObject
_stricmp
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwOpenFile
IoCreateFile
IofCallDriver
IoAllocateIrp
MmBuildMdlForNonPagedPool
IoAllocateMdl
ProbeForRead
PsGetVersion
RtlImageNtHeader
RtlCompareMemory
_snwprintf
MmSystemRangeStart
wcsncmp
strrchr
ZwQueryVolumeInformationFile
ObReferenceObjectByPointer
IoBuildDeviceIoControlRequest
ZwOpenSection
_allmul
KeReleaseSemaphore
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
KeInitializeSemaphore
IofCompleteRequest
ExEventObjectType
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoGetDeviceObjectPointer
RtlUpperChar
ObReferenceObjectByName
IoDriverObjectType
RtlCompareUnicodeString
strncpy
KeServiceDescriptorTable
NtOpenProcess
ObOpenObjectByName
NtQueryInformationProcess
PsIsThreadTerminating
KeAddSystemServiceTable
ZwQueryObject
ZwFsControlFile
ObInsertObject
IoReleaseVpbSpinLock
IoAcquireVpbSpinLock
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
_allshr
ExInterlockedPopEntrySList
IoGetStackLimits
IoBuildSynchronousFsdRequest
wcsstr
RtlUpcaseUnicodeString
IoUnregisterPlugPlayNotification
FsRtlIsNameInExpression
IoGetConfigurationInformation
MmProbeAndLockPages
IoGetDeviceInterfaces
IoRegisterPlugPlayNotification
ExAllocatePool
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
strncat
wcschr
wcsncat
wcstombs
KeTickCount
KeBugCheckEx
RtlUnwind
wcsncpy
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
ExAcquireResourceSharedLite
ExReleaseFastMutexUnsafe
KeLeaveCriticalRegion
KeEnterCriticalRegion
ZwSetSecurityObject
ExAcquireFastMutexUnsafe
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
RtlLengthSid
RtlAbsoluteToSelfRelativeSD
IoBuildAsynchronousFsdRequest
KeGetCurrentThread
KfAcquireSpinLock
KfReleaseSpinLock
KeRaiseIrqlToDpcLevel
KfLowerIrql
ExAcquireFastMutex
ExReleaseFastMutex
KeGetCurrentIrql
KfRaiseIrql
ClassInitialize

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
??0CBlobConfig@@QAE@ABV0@@Z
??0CBlobConfig@@QAE@K@Z
??0CContext@@QAE@ABV0@@Z
??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QAE@ABV0@@Z
??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
??0CDebugLog@@QAE@ABV0@@Z
??0CDebugLog@@QAE@PBG@Z
??0CDebugLogEx@@QAE@ABV0@@Z
??0CDebugLogEx@@QAE@K@Z
??0CDelayLoadThread@@QAE@ABV0@@Z
??0CDelayLoadThread@@QAE@XZ
??0CExclusionExtConfig@@QAE@ABV0@@Z
??0CExclusionExtConfig@@QAE@KKE@Z
??0CExclusionFileNameConfig@@QAE@ABV0@@Z
??0CExclusionFileNameConfig@@QAE@KK@Z
??0CExclusionFilePathConfig@@QAE@ABV0@@Z
??0CExclusionFilePathConfig@@QAE@KK@Z
??0CExclusionFolderConfig@@QAE@ABV0@@Z
??0CExclusionFolderConfig@@QAE@KK@Z
??0CExclusionRegistryConfig@@QAE@ABV0@@Z
??0CExclusionRegistryConfig@@QAE@KK@Z
??0CFile@@QAE@ABV0@@Z
??0CFile@@QAE@E@Z
??0CFileExtension@@QAE@ABV0@@Z
??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
??0CInclusionExtConfig@@QAE@ABV0@@Z
??0CInclusionExtConfig@@QAE@KKE@Z
??0CInclusionFileNameConfig@@QAE@ABV0@@Z
??0CInclusionFileNameConfig@@QAE@KK@Z
??0CInclusionFilePathConfig@@QAE@ABV0@@Z
??0CInclusionFilePathConfig@@QAE@KK@Z
??0CInclusionFolderConfig@@QAE@ABV0@@Z
??0CInclusionFolderConfig@@QAE@KK@Z
??0CKEvent@@QAE@ABV0@@Z
??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
??0CList@@QAE@ABV0@@Z
??0CList@@QAE@KPAVIMemoryAllocator@@@Z
??0CLockEvent@@QAE@ABV0@@Z
??0CLockEvent@@QAE@XZ
??0CLockList@@QAE@ABV0@@Z
??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QAE@ABV0@@Z
??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
??0CMemoryPoolAllocator@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@XZ
??0CModuleConfigList@@QAE@ABV0@@Z
??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QAE@ABV0@@Z
??0CModuleFileExtConfig@@QAE@KKE@Z
??0CModuleFlagConfig@@QAE@ABV0@@Z
??0CModuleFlagConfig@@QAE@K@Z
??0CModuleMultiStringConfig@@QAE@ABV0@@Z
??0CModuleMultiStringConfig@@QAE@KK@Z
??0CModuleStringConfig@@QAE@ABV0@@Z
??0CModuleStringConfig@@QAE@K@Z
??0CNoLockList@@QAE@ABV0@@Z
??0CNoLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CSmartLock@@QAE@AAVCLockEvent@@@Z
??0CSmartLock@@QAE@XZ
??0CSmartReference@@QAE@AAJ@Z
??0CSmartReference@@QAE@AAK@Z
??0CSmartResource@@QAE@AAVCResource@@E@Z
??0CStrList@@QAE@ABV0@@Z
??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
??0CSystemThread@@QAE@ABV0@@Z
??0CSystemThread@@QAE@K@Z
??0CUserFuncAdapterJob@@QAE@ABV0@@Z
??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z01@Z
??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@E@Z
??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
??0CWorkerThreadJobQueue@@QAE@K@Z
??0CWorkerThreadPool@@QAE@ABV0@@Z
??0CWorkerThreadPool@@QAE@K@Z
??0CWorkerThreadPoolEx@@QAE@ABV0@@Z
??0CWorkerThreadPoolEx@@QAE@KK@Z
??0IMemoryAllocator@@QAE@ABV0@@Z
??0IMemoryAllocator@@QAE@XZ
??1CAutoUpdateConfigThread@@UAE@XZ
??1CBlobConfig@@UAE@XZ
??1CContext@@UAE@XZ
??1CContextList@@UAE@XZ
??1CDebugLog@@UAE@XZ
??1CDebugLogEx@@UAE@XZ
??1CDelayLoadThread@@UAE@XZ
??1CExclusionExtConfig@@UAE@XZ
??1CExclusionFileNameConfig@@UAE@XZ
??1CExclusionFilePathConfig@@UAE@XZ
??1CExclusionFolderConfig@@UAE@XZ
??1CExclusionRegistryConfig@@UAE@XZ
??1CFile@@UAE@XZ
??1CFileExtension@@UAE@XZ
??1CInclusionExtConfig@@UAE@XZ
??1CInclusionFileNameConfig@@UAE@XZ
??1CInclusionFilePathConfig@@UAE@XZ
??1CInclusionFolderConfig@@UAE@XZ
??1CKEvent@@UAE@XZ
??1CList@@UAE@XZ
??1CLockEvent@@UAE@XZ
??1CLockList@@UAE@XZ
??1CMemoryAllocator@@UAE@XZ
??1CMemoryPoolAllocator@@UAE@XZ
??1CModuleConfig@@UAE@XZ
??1CModuleConfigList@@UAE@XZ
??1CModuleFileExtConfig@@UAE@XZ
??1CModuleFlagConfig@@UAE@XZ
??1CModuleMultiStringConfig@@UAE@XZ
??1CModuleStringConfig@@UAE@XZ
??1CNoLockList@@UAE@XZ
??1CSmartLock@@QAE@XZ
??1CSmartReference@@QAE@XZ
??1CSmartResource@@QAE@XZ
??1CStrList@@UAE@XZ
??1CSystemThread@@UAE@XZ
??1CUserFuncAdapterJob@@UAE@XZ
??1CWorkerThread@@UAE@XZ
??1CWorkerThreadJob@@UAE@XZ
??1CWorkerThreadJobQueue@@UAE@XZ
??1CWorkerThreadPool@@UAE@XZ
??1CWorkerThreadPoolEx@@UAE@XZ
??1IMemoryAllocator@@UAE@XZ
??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??2CMemoryAllocator@@SGPAXI@Z
??2CMemoryPoolAllocator@@SGPAXI@Z
??3@YAXPAX@Z
??3IMemoryAllocator@@SGXPAX@Z
??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
??4CBlobConfig@@QAEAAV0@ABV0@@Z
??4CContext@@QAEAAV0@ABV0@@Z
??4CDebugLog@@QAEAAV0@ABV0@@Z
??4CDebugLogEx@@QAEAAV0@ABV0@@Z
??4CDelayLoadThread@@QAEAAV0@ABV0@@Z
??4CFile@@QAEAAV0@ABV0@@Z
??4CKEvent@@QAEAAV0@ABV0@@Z
??4CLockEvent@@QAEAAV0@ABV0@@Z
??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
??4CModuleConfig@@QAEAAV0@ABV0@@Z
??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
??4CSmartResource@@QAEAAV0@ABV0@@Z
??4CSystemThread@@QAEAAV0@ABV0@@Z
??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
??4CWorkerThread@@QAEAAV0@ABV0@@Z
??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CDebugLogEx@@6B@
??_7CDelayLoadThread@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CInclusionExtConfig@@6B@
??_7CInclusionFileNameConfig@@6B@
??_7CInclusionFilePathConfig@@6B@
??_7CInclusionFolderConfig@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CNoLockList@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7CWorkerThreadPoolEx@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QAEXXZ
??_FCFile@@QAEXXZ
??_FCFileExtension@@QAEXXZ
??_FCModuleConfigList@@QAEXXZ
??_FCStrList@@QAEXXZ
??_FCSystemThread@@QAEXXZ
??_FCWorkerThread@@QAEXXZ
??_FCWorkerThreadJob@@QAEXXZ
??_FCWorkerThreadJobQueue@@QAEXXZ
??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??_V@YAXPAX@Z
?Acquire@CLockEvent@@QAEXXZ
?Add@CContextList@@QAEEPAVCContext@@@Z
?Add@CFileExtension@@QAEEPBGK@Z
?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
?Add@CStrList@@QAEEPBG@Z
?AddNode@CLockList@@UAEEQAXE@Z
?AddNode@CNoLockList@@UAEEQAXE@Z
?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QAEXXZ
?CheckNode@CLockList@@UAEHQAX@Z
?CheckNode@CNoLockList@@UAEHQAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
?Cleanup@CBlobConfig@@AAEXXZ
?Cleanup@CModuleFileExtConfig@@IAEXXZ
?Cleanup@CModuleMultiStringConfig@@IAEXXZ
?Cleanup@CModuleStringConfig@@AAEXXZ
?Close@CFile@@QAEJXZ
?Count@CLockList@@QAEKXZ
?Count@CNoLockList@@QAEKXZ
?Create@CFile@@QAEJPBGKKKK@Z
?Create@CSystemThread@@QAEEXZ
?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
?CreatePool@CWorkerThreadPool@@QAEEXZ
?CreatePool@CWorkerThreadPoolEx@@QAEEXZ
?CreateThreads@CWorkerThreadPool@@QAEEK@Z
?CreateThreads@CWorkerThreadPoolEx@@QAEEK@Z
?CreateWIRP@CFile@@QAEJPBGKKKK@Z
?Delete@CFile@@QAEJXZ
?Delete@CFileExtension@@QAEEPBGK@Z
?Delete@CStrList@@QAEEPBG@Z
?DeleteAll@CList@@UAEXXZ
?DeleteAll@CLockList@@UAEXXZ
?DeleteAll@CNoLockList@@UAEXXZ
?DeleteNode@CContextList@@MAEXPAX@Z
?DeleteNode@CList@@UAEXPAX@Z
?DeleteNode@CModuleConfigList@@MAEXPAX@Z
?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YGXPAPAX@Z
?DoIt@CWorkerThreadJob@@QAEJXZ
?EntryPoint@CSystemThread@@KGXPAX@Z
?Find@CContextList@@QAEPAVCContext@@K@Z
?Find@CContextList@@QAEPAVCContext@@PAX@Z
?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FindNode@CContextList@@IAEPAXPAX@Z
?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FinishFunction@CUserFuncAdapterJob@@MAEXXZ
?FinishIt@CWorkerThreadJob@@QAEJXZ
?First@CList@@UAEPAXXZ
?First@CLockList@@UAEPAXXZ
?First@CNoLockList@@UAEPAXXZ
?Free@CMemoryAllocator@@UAEXPAX@Z
?Free@CMemoryPoolAllocator@@UAEXPAX@Z
?GetAttributes@CFile@@QAEKXZ
?GetBasicInfomration@CFile@@IAEJXZ
?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
?GetCategory@CContext@@QAEKXZ
?GetData@CBlobConfig@@QAEHPAXPAK@Z
?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QAEKXZ
?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
?GetData@CModuleStringConfig@@QAEPAGXZ
?GetData@CStrList@@QAEEPAGPAK@Z
?GetDataType@CModuleConfig@@QAEKXZ
?GetEngineContext@CContext@@QAEPAXXZ
?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFileSizeWIRP@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UAEJKPAK@Z
?GetID@CModuleConfig@@QAEKXZ
?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QAEKXZ
?GetLinkContext@CContext@@QAEPAXXZ
?GetLogFlag@CDebugLog@@QAEKXZ
?GetLogFlag@CDebugLogEx@@QAEKXZ
?GetModuleId@CModuleConfig@@QAEKXZ
?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_KTHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_KTHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QAEKXZ
?GetSize@CBlobConfig@@QAEKXZ
?GetStringConfig@CContext@@QAEPAGK@Z
?GetStringConfig@CContext@@UAEJKPAGPAK@Z
?GetThreadCount@CWorkerThreadPool@@QAEKXZ
?GetThreadCount@CWorkerThreadPoolEx@@QAEKXZ
?GetThreadID@CSystemThread@@QAEKXZ
?GetType@CContext@@QAEKXZ
?GetUserParameter@CContext@@QAEKXZ
?InitProcMon@CDebugLogEx@@IAEXXZ
?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
?InitializeFlagConfig@CContext@@QAEHKK@Z
?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
?InitializeStringConfig@CContext@@QAEHKPBG@Z
?Insert@CList@@UAEXQAXE@Z
?Insert@CLockList@@UAEXQAXE@Z
?Insert@CNoLockList@@UAEXQAXE@Z
?InsertAfter@CList@@UAEXPAX0@Z
?InsertBefore@CList@@UAEXPAX0@Z
?Instance@CWorkerThreadPool@@SGPAV1@XZ
?IsEmpty@CList@@UAEEXZ
?IsEmpty@CLockList@@UAEEXZ
?IsEmpty@CNoLockList@@UAEEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
?IsFull@CLockList@@QBEEXZ
?IsFull@CNoLockList@@QBEEXZ
?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionExtConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFileNameConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFilePathConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFolderConfig@@QAEEPBG@Z
?IsOpened@CFile@@QAEEXZ
?IsTerminated@CWorkerThreadPool@@QAEEXZ
?IsTerminated@CWorkerThreadPoolEx@@QAEEXZ
?IsValid@CMemoryAllocator@@UAEEXZ
?IsValid@CMemoryPoolAllocator@@UAEEXZ
?IsValid@IMemoryAllocator@@UAEEXZ
?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
?IsWorkerThread@CWorkerThreadPoolEx@@QAEEK@Z
?JobFunction@CUserFuncAdapterJob@@MAEXXZ
?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
?JobQueue@CWorkerThreadPoolEx@@QAEAAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QAEKXZ
?Limit@CNoLockList@@QAEKXZ
?MatchAllExtensions@CFileExtension@@QAEEXZ
?MatchNoExtensions@CFileExtension@@QAEEXZ
?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
?NeedDelete@CWorkerThreadJob@@QAEEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
?NewNode@CList@@UAEPAXXZ
?NewNode@CStrList@@EAEPAXXZ
?NewNodeVariant@CList@@IAEPAXK@Z
?Next@CList@@UBEPAXQAX@Z
?Next@CLockList@@UBEPAXQAX@Z
?Next@CNoLockList@@UBEPAXQAX@Z
?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
?NotityTerminate@CWorkerThread@@QAEXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
?PostJobToWorkerThread@CWorkerThreadPoolEx@@QAEJP6GXPAX@Z0E1@Z
?Pulse@CKEvent@@QAEJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPoolEx@@QAEJPAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
?Read@CFile@@QAEJPADKPAK@Z
?ReadWIRP@CFile@@QAEJPADKPAK@Z
?ReferenceCount@CContext@@QAEAAKXZ
?Release@CLockEvent@@QAEXXZ
?Remove@CContextList@@UAEEQAX@Z
?Remove@CList@@UAEEQAX@Z
?Remove@CLockList@@UAEEQAX@Z
?Remove@CNoLockList@@UAEEQAX@Z
?RemoveHead@CList@@UAEPAXXZ
?RemoveHead@CLockList@@UAEPAXXZ
?RemoveHead@CNoLockList@@UAEPAXXZ
?RemoveTail@CList@@UAEPAXXZ
?RemoveTail@CLockList@@UAEPAXXZ
?RemoveTail@CNoLockList@@UAEPAXXZ
?Reset@CKEvent@@QAEXXZ
?ResetData@CInclusionExtConfig@@QAEXXZ
?ResetData@CInclusionFileNameConfig@@QAEXXZ
?ResetData@CInclusionFilePathConfig@@QAEXXZ
?ResetData@CInclusionFolderConfig@@QAEXXZ
?RestoreCR0@@YGXPAX@Z
?Run@CAutoUpdateConfigThread@@UAEXXZ
?Run@CDelayLoadThread@@UAEXXZ
?Run@CWorkerThread@@UAEXXZ
?SeekToEnd@CFile@@QAEJXZ
?Set@CKEvent@@QAEJJE@Z
?SetAttributes@CFile@@QAEJK@Z
?SetBlobCofig@CContext@@UAEJKPAXK@Z
?SetData@CBlobConfig@@QAEHPAXK@Z
?SetData@CModuleFileExtConfig@@QAEHPBG@Z
?SetData@CModuleFlagConfig@@QAEHK@Z
?SetData@CModuleMultiStringConfig@@QAEHPBGK@Z
?SetData@CModuleStringConfig@@QAEHPBG@Z
?SetEngineContext@CContext@@QAEXPAX@Z
?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
?SetFlagConfig@CContext@@UAEJKK@Z
?SetLinkContext@CContext@@QAEXPAX@Z
?SetLogFlag@CDebugLog@@QAEEK@Z
?SetLogFlag@CDebugLogEx@@QAEEK@Z
?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
?SetMultiStringConfig@CContext@@UAEJKPBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
?SetPriority@CSystemThread@@QAEXK@Z
?SetStopUse@CContext@@QAEXXZ
?SetStringConfig@CContext@@UAEJKPBG@Z
?Setup@CSystemThread@@MAEXXZ
?StopUse@CContext@@QAEHXZ
?TearDown@CSystemThread@@MAEXXZ
?Terminate@CSystemThread@@QAEXE@Z
?Terminate@CWorkerThreadPool@@QAEEXZ
?Terminate@CWorkerThreadPoolEx@@QAEEXZ
?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QAEXXZ
?WaitForInit@CDelayLoadThread@@QAEEXZ
?WaitForLoad@CDelayLoadThread@@QAEEXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
?WaitQueueEmpty@CWorkerThreadJobQueue@@QAEXXZ
?Write@CDebugLog@@QAAXPBDZZ
?Write@CDebugLogEx@@QAAXPBDZZ
?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
?WriteDataToFile@CDebugLogEx@@IAEXPADK@Z
?WriteDataToProcMonW@CDebugLogEx@@IAEXPAD@Z
?WriteSystemInformation@CDebugLog@@QAEXXZ
?WriteSystemInformation@CDebugLogEx@@QAEXXZ
?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
?WriteSystemStringInformation@CDebugLogEx@@IAEXPBG@Z
?WriteToFile@CDebugLog@@IAEXPADK@Z
?WriteToProcMonW@CDebugLogEx@@IAEXPAU_UNICODE_STRING@@@Z
?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
?_pPagedAllocator@@3PAVCMemoryAllocator@@A
?m_lpInstance@CWorkerThreadPool@@1PAV1@A
?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
_DeInitKm2UmCommunication@0
_DeInitKmLPC@0
_DuplicateFullFileName@4
_FreeFullFileName@4
_GetKm2UmMode@0
_GetModuleInfoByAddress@8
_GetModuleInfoByModuleName@8
_InitKm2UmCommunication@8
_InitKmLPC@0
_IsWindows8_1_update@4
_KmCallUm@8
_KmCallUmByLPC@8
_KmCallUmEx@12
_KmCleanupCommPortAPIs@0
_KmGetUmInitProcess@0
_KmSetCommPortAPIs@4
_ModGetExportProcAddress@8
_ModLoadDLLToBuffer@4
_ModLoadDLLToBufferWithImageSize@8
_ModLoadModule@8
_ModUnLoadModule@4
_NormalizeFileName@4
_NormalizeFullNtPathToDosName@4
_TmCommConfigRoutine@4
_UtilAddDeviceInDriveTable@4
_UtilAddReparsePointMapping@8
_UtilCleanFileReadOnly@4
_UtilCreateDosFileName@8
_UtilDeleteFileForce@4
_UtilGetDeviceObjectName@8
_UtilGetFileNameFromFileObject@4
_UtilGetFileObjectForProcessByEPROC@8
_UtilGetFileObjectFromFileName@12
_UtilGetProcessName@12
_UtilGetSystemDirectory@4
_UtilGetSystemDirectoryEx@0
_UtilGetSystemDirectoryLength@0
_UtilGetSystemTime@4
_UtilIoSetFileInfo@24
_UtilIopCreateFileIRP@40
_UtilKeGetLowFileDevice@16
_UtilModuleIATHook@24
_UtilModuleIATUnHook@8
_UtilPostJobToWorkerThread@12
_UtilQueryKeyValue@24
_UtilRemoveDeviceFromDriveTable@4
_UtilVolumeDeviceToDosName@8
_UtilWaitValueChangeToZero@8
_UtilWriteVersionToRegistry@8
_UtilbuildDynamicDiskMappingTable@0
_UtlWriteBinValueKeyToRegistry@16
_ValidateAddressWithSize@20
__UtilDosPathNameToNtPathName@12

Sections

Expand

.text
.rdata
.data
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2016-08-22 19:36:21
MD5	62eed4173c566a248531fb6f20a5900d
SHA1	0e60414750c48676d7aa9c9ec81c0a3b3a4d53d0
SHA256	e3eff841ea0f2786e5e0fed2744c0829719ad711fc9258eeaf81ed65a52a8918
Authentihash MD5	8b3b8e708437670247e2e8af98e9c269
Authentihash SHA1	c9fd7be77bad0db66831c5fdaef66d96574ae2e4
Authentihash SHA256	d33fe3bbcdf1ef7e42faf4ac81d7da3a6451eb67b477e78b75506b0df21cf598
RichPEHeaderHash MD5	f24ab92249f890976db4810956894104
RichPEHeaderHash SHA1	5abe3da2e90de43df4ee61c89b8adb402176edb3
RichPEHeaderHash SHA256	da02581a92aa11134e23d9ee3cf7d60945700fec9b37c0a3365e2aebe68ec5b3
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	Trend Micro Eyes
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 1688f039255e638e69143907e6330b

Field	Value
ToBeSigned (TBS) MD5	0179e8ddeebaf8998fec419d65cdf13d
ToBeSigned (TBS) SHA1	34c724c3369f2da8c25b591808962f66f10bde28
ToBeSigned (TBS) SHA256	35b0bac11602847aaab65fb35199d3c8976cde3ccf7e061b130177c712cbd92f
Subject	C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO SHA,1 Time Stamping Signer
ValidFrom	2015-12-31 00:00:00
ValidTo	2019-07-09 18:40:36
Signature	ba332440408c7cdb589fb36098b2f5c031feeb1f6e50f60ae0e4e681ad2687a2dffdb3daf473f300fb291b891b153edb6b52932bc4ac3981d73c67579a3936e028089ae3394f9b89097f7bc5617f598932250a6aae1a3ef0a227a8b6c3b887f7160448413d5cd8ec9f4d203104d965a1edcd690753163ddd36020a88eb40e506300bb8164bdcefbc5509ffc63e122e76b3dcce42eff97657e1b70a054098589a5d711693718c6581ea6ff389f7fb73adb4e7bfd98e6faa0b4f25f3b8e1d5dd75986881f8aac0d180c2c4c43989c1f6c99e6cd774f9d997f84fc29a0acd5e8ff819e9e0a59fc4f09221e62d7925c922f9c3f03a8457ad3a16f46394101d5dd0c6
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	1688f039255e638e69143907e6330b
Version	3

Certificate 774d49c5649436de6bf3190a67eedcdf

Field	Value
ToBeSigned (TBS) MD5	b3ca7d6b821d8e3432b29874980af55e
ToBeSigned (TBS) SHA1	618d7e55a24c1d8b65a0bcce79120c5e3b13fa4d
ToBeSigned (TBS) SHA256	c645c6a7dc7243a4a3f78a6569c029401a7bda8bc4732ce7198d9f21f19b12fa
Subject	C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.
ValidFrom	2016-03-29 00:00:00
ValidTo	2017-06-28 23:59:59
Signature	27351697f046d1d43fe306dff30b83e7a404e3e6431c1e06829c558d99eb3f21776021e3e1bd4e485aba08b89bb0972f23daa471d7b432a44a591270f9a838f13dbda32ee936c0df792cff8c493e1f27b2282b3d896ae7b4155ca1a50bf7111f3f4bbbe11f17cfe5d49c0589c210966ef7e567153e802d2e783ff498c59585598d9d3e93273d1e81c07ce85c0cfb24834d448c3930120f1686bd472d916ac8f9475acfdb27be8528311f668d71dfc132a0ff62df7baa575a0cc732b3de003beca214954d4d97cf9511b9329eccbb7b716675b31e543a43570080dffce3fc8ca8fbb17d954b9678e2d0c1e1710a5cf03952a687fede59dcba3bf98900f9934f12
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	774d49c5649436de6bf3190a67eedcdf
Version	3

Certificate 611993e400000000001c

Field	Value
ToBeSigned (TBS) MD5	78a717e082dcc1cda3458d917e677d14
ToBeSigned (TBS) SHA1	4a872e0e51f9b304469cd1dedb496ee9b8b983a4
ToBeSigned (TBS) SHA256	317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
ValidFrom	2011-02-22 19:25:17
ValidTo	2021-02-22 19:35:17
Signature	812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	611993e400000000001c
Version	3

Certificate 5200e5aa2556fc1a86ed96c9d44b33c7

Field	Value
ToBeSigned (TBS) MD5	b30c31a572b0409383ed3fbe17e56e81
ToBeSigned (TBS) SHA1	4843a82ed3b1f2bfbee9671960e1940c942f688d
ToBeSigned (TBS) SHA256	03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-02-08 00:00:00
ValidTo	2020-02-07 23:59:59
Signature	5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	5200e5aa2556fc1a86ed96c9d44b33c7
Version	3

Imports

Expand

ntoskrnl.exe

Imported Functions

Expand

RtlInitUnicodeString
KeInitializeEvent
KeClearEvent
KeSetEvent
KeEnterCriticalRegion
KeLeaveCriticalRegion
KeWaitForSingleObject
ExFreePoolWithTag
ExAcquireFastMutexUnsafe
ExReleaseFastMutexUnsafe
ProbeForRead
ProbeForWrite
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
MmProbeAndLockPages
MmUnlockPages
MmMapLockedPagesSpecifyCache
IoAllocateMdl
IoFreeMdl
IoGetCurrentProcess
ObfReferenceObject
ObfDereferenceObject
ZwClose
ZwCreateSection
ZwOpenSection
ZwMapViewOfSection
ZwUnmapViewOfSection
ZwOpenEvent
KePulseEvent
KeStackAttachProcess
KeUnstackDetachProcess
ObOpenObjectByPointer
ZwAllocateVirtualMemory
ZwFreeVirtualMemory
ZwSetEvent
__C_specific_handler
PsProcessType
wcslen
wcsncpy
wcsrchr
RtlUnicodeStringToInteger
ZwWaitForSingleObject
ZwRequestWaitReplyPort
ZwConnectPort
SeCaptureSubjectContext
SeReleaseSubjectContext
SeAccessCheck
ObGetObjectSecurity
ObReleaseObjectSecurity
PsGetProcessExitTime
PsThreadType
MmSectionObjectType
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
KeInitializeSemaphore
KeReleaseSemaphore
ExAllocatePoolWithTag
ExAcquireFastMutex
ExReleaseFastMutex
RtlCreateAcl
RtlAddAccessAllowedAce
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
KeDelayExecutionThread
ExGetPreviousMode
DbgPrint
swprintf
RtlCopyUnicodeString
PsGetVersion
IofCompleteRequest
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
ObReferenceObjectByHandle
PsGetCurrentProcessId
ZwCreateEvent
ExEventObjectType
_wcsnicmp
PsSetCreateProcessNotifyRoutine
ZwQueryInformationProcess
PsLookupProcessByProcessId
ZwOpenDirectoryObject
ExInitializeResourceLite
ExDeleteResourceLite
ZwCreateFile
ZwQueryInformationFile
ZwSetInformationFile
ZwReadFile
ZwWriteFile
towupper
MmGetSystemRoutineAddress
ObReferenceObjectByPointer
MmIsAddressValid
PsGetCurrentThreadId
ObQueryNameString
_snprintf
_vsnprintf
RtlInitAnsiString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
RtlTimeToTimeFields
KeWaitForMultipleObjects
ExSystemTimeToLocalTime
wcscat
ZwDeviceIoControlFile
ZwNotifyChangeKey
ZwOpenFile
ZwQueryVolumeInformationFile
mbstowcs
_stricmp
IoGetDeviceObjectPointer
RtlImageNtHeader
ZwQuerySystemInformation
IoBuildDeviceIoControlRequest
IofCallDriver
IoCreateFile
RtlEqualUnicodeString
RtlAppendUnicodeStringToString
RtlUpcaseUnicodeChar
_snwprintf
strlen
_strnicmp
strncpy
NtOpenProcess
NtQueryInformationProcess
ObOpenObjectByName
KeSetPriorityThread
PsCreateSystemThread
PsTerminateSystemThread
KeNumberProcessors
RtlLengthSecurityDescriptor
ZwOpenKey
ZwDeleteKey
ZwDeleteValueKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryKey
ZwQueryValueKey
ZwSetValueKey
ZwTerminateProcess
ZwOpenProcess
ZwDuplicateObject
ZwQuerySecurityObject
ZwSetSecurityObject
ZwQueryDirectoryObject
ZwQueryDirectoryFile
NtCreateFile
NtQueryInformationFile
NtSetInformationFile
IoFileObjectType
ObInsertObject
wcschr
wcsncmp
RtlQueryRegistryValues
RtlAppendUnicodeToString
RtlCompareMemory
MmBuildMdlForNonPagedPool
IoAllocateIrp
IoFreeIrp
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
RtlUpcaseUnicodeString
NtClose
ZwSetInformationObject
SeQueryAuthenticationIdToken
MmSystemRangeStart
IoGetFileObjectGenericMapping
ObCreateObject
SeCreateAccessState
IoAcquireVpbSpinLock
IoReleaseVpbSpinLock
wcstombs
strncat
wcsncat
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
strcpy
wcsstr
RtlCompareUnicodeString
DbgPrintEx
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
ExAllocatePool
ExpInterlockedPopEntrySList
IoBuildSynchronousFsdRequest
IoGetStackLimits
IoGetDeviceInterfaces
IoRegisterPlugPlayNotification
IoUnregisterPlugPlayNotification
IoGetConfigurationInformation
FsRtlIsNameInExpression
IoDeviceObjectType
IoCreateDevice
RtlGetOwnerSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
RtlLengthSid
SeExports
IoIsWdmVersionAvailable
RtlAbsoluteToSelfRelativeSD
ZwCreateKey
_purecall
KeBugCheckEx

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QEAA@AEBV0@@Z
??0CAutoUpdateConfigThread@@QEAA@PEAU_UNICODE_STRING@@P6AX0PEAX@Z1@Z
??0CBlobConfig@@QEAA@AEBV0@@Z
??0CBlobConfig@@QEAA@K@Z
??0CContext@@QEAA@AEBV0@@Z
??0CContext@@QEAA@KP6AJPEAU_EVENT_REPORT@@PEAXPEAU_TMCE_REPORT@@PEAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QEAA@AEBV0@@Z
??0CContextList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CDebugLog@@QEAA@AEBV0@@Z
??0CDebugLog@@QEAA@PEBG@Z
??0CDebugLogEx@@QEAA@AEBV0@@Z
??0CDebugLogEx@@QEAA@K@Z
??0CDelayLoadThread@@QEAA@AEBV0@@Z
??0CDelayLoadThread@@QEAA@XZ
??0CExclusionExtConfig@@QEAA@AEBV0@@Z
??0CExclusionExtConfig@@QEAA@KKE@Z
??0CExclusionFileNameConfig@@QEAA@AEBV0@@Z
??0CExclusionFileNameConfig@@QEAA@KK@Z
??0CExclusionFilePathConfig@@QEAA@AEBV0@@Z
??0CExclusionFilePathConfig@@QEAA@KK@Z
??0CExclusionFolderConfig@@QEAA@AEBV0@@Z
??0CExclusionFolderConfig@@QEAA@KK@Z
??0CExclusionRegistryConfig@@QEAA@AEBV0@@Z
??0CExclusionRegistryConfig@@QEAA@KK@Z
??0CFile@@QEAA@AEBV0@@Z
??0CFile@@QEAA@E@Z
??0CFileExtension@@QEAA@AEBV0@@Z
??0CFileExtension@@QEAA@KEEPEAVIMemoryAllocator@@@Z
??0CInclusionExtConfig@@QEAA@AEBV0@@Z
??0CInclusionExtConfig@@QEAA@KKE@Z
??0CInclusionFileNameConfig@@QEAA@AEBV0@@Z
??0CInclusionFileNameConfig@@QEAA@KK@Z
??0CInclusionFilePathConfig@@QEAA@AEBV0@@Z
??0CInclusionFilePathConfig@@QEAA@KK@Z
??0CInclusionFolderConfig@@QEAA@AEBV0@@Z
??0CInclusionFolderConfig@@QEAA@KK@Z
??0CKEvent@@QEAA@AEBV0@@Z
??0CKEvent@@QEAA@W4_EVENT_TYPE@@E@Z
??0CList@@QEAA@AEBV0@@Z
??0CList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CLockEvent@@QEAA@AEBV0@@Z
??0CLockEvent@@QEAA@XZ
??0CLockList@@QEAA@AEBV0@@Z
??0CLockList@@QEAA@KKPEAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IEAA@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QEAA@AEBV0@@Z
??0CMemoryPoolAllocator@@IEAA@W4_POOL_TYPE@@_K1K@Z
??0CMemoryPoolAllocator@@QEAA@AEBV0@@Z
??0CModuleConfig@@QEAA@AEBV0@@Z
??0CModuleConfig@@QEAA@XZ
??0CModuleConfigList@@QEAA@AEBV0@@Z
??0CModuleConfigList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QEAA@AEBV0@@Z
??0CModuleFileExtConfig@@QEAA@KKE@Z
??0CModuleFlagConfig@@QEAA@AEBV0@@Z
??0CModuleFlagConfig@@QEAA@K@Z
??0CModuleMultiStringConfig@@QEAA@AEBV0@@Z
??0CModuleMultiStringConfig@@QEAA@KK@Z
??0CModuleStringConfig@@QEAA@AEBV0@@Z
??0CModuleStringConfig@@QEAA@K@Z
??0CNoLockList@@QEAA@AEBV0@@Z
??0CNoLockList@@QEAA@KKPEAVIMemoryAllocator@@@Z
??0CSmartLock@@QEAA@AEAVCLockEvent@@@Z
??0CSmartLock@@QEAA@XZ
??0CSmartReference@@QEAA@AEAJ@Z
??0CSmartReference@@QEAA@AEAK@Z
??0CSmartResource@@QEAA@AEAVCResource@@E@Z
??0CStrList@@QEAA@AEBV0@@Z
??0CStrList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CSystemThread@@QEAA@AEBV0@@Z
??0CSystemThread@@QEAA@K@Z
??0CUserFuncAdapterJob@@QEAA@AEBV0@@Z
??0CUserFuncAdapterJob@@QEAA@P6AXPEAX@Z01@Z
??0CWorkerThread@@IEAA@PEAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QEAA@AEBV0@@Z
??0CWorkerThreadJob@@QEAA@AEBV0@@Z
??0CWorkerThreadJob@@QEAA@E@Z
??0CWorkerThreadJobQueue@@QEAA@AEBV0@@Z
??0CWorkerThreadJobQueue@@QEAA@K@Z
??0CWorkerThreadPool@@QEAA@AEBV0@@Z
??0CWorkerThreadPool@@QEAA@K@Z
??0CWorkerThreadPoolEx@@QEAA@AEBV0@@Z
??0CWorkerThreadPoolEx@@QEAA@KK@Z
??0IMemoryAllocator@@QEAA@AEBV0@@Z
??0IMemoryAllocator@@QEAA@XZ
??1CAutoUpdateConfigThread@@UEAA@XZ
??1CBlobConfig@@UEAA@XZ
??1CContext@@UEAA@XZ
??1CContextList@@UEAA@XZ
??1CDebugLog@@UEAA@XZ
??1CDebugLogEx@@UEAA@XZ
??1CDelayLoadThread@@UEAA@XZ
??1CExclusionExtConfig@@UEAA@XZ
??1CExclusionFileNameConfig@@UEAA@XZ
??1CExclusionFilePathConfig@@UEAA@XZ
??1CExclusionFolderConfig@@UEAA@XZ
??1CExclusionRegistryConfig@@UEAA@XZ
??1CFile@@UEAA@XZ
??1CFileExtension@@UEAA@XZ
??1CInclusionExtConfig@@UEAA@XZ
??1CInclusionFileNameConfig@@UEAA@XZ
??1CInclusionFilePathConfig@@UEAA@XZ
??1CInclusionFolderConfig@@UEAA@XZ
??1CKEvent@@UEAA@XZ
??1CList@@UEAA@XZ
??1CLockEvent@@UEAA@XZ
??1CLockList@@UEAA@XZ
??1CMemoryAllocator@@UEAA@XZ
??1CMemoryPoolAllocator@@UEAA@XZ
??1CModuleConfig@@UEAA@XZ
??1CModuleConfigList@@UEAA@XZ
??1CModuleFileExtConfig@@UEAA@XZ
??1CModuleFlagConfig@@UEAA@XZ
??1CModuleMultiStringConfig@@UEAA@XZ
??1CModuleStringConfig@@UEAA@XZ
??1CNoLockList@@UEAA@XZ
??1CSmartLock@@QEAA@XZ
??1CSmartReference@@QEAA@XZ
??1CSmartResource@@QEAA@XZ
??1CStrList@@UEAA@XZ
??1CSystemThread@@UEAA@XZ
??1CUserFuncAdapterJob@@UEAA@XZ
??1CWorkerThread@@UEAA@XZ
??1CWorkerThreadJob@@UEAA@XZ
??1CWorkerThreadJobQueue@@UEAA@XZ
??1CWorkerThreadPool@@UEAA@XZ
??1CWorkerThreadPoolEx@@UEAA@XZ
??1IMemoryAllocator@@UEAA@XZ
??2@YAPEAX_KPEAVIMemoryAllocator@@PEBDK@Z
??2CMemoryAllocator@@SAPEAX_K@Z
??2CMemoryPoolAllocator@@SAPEAX_K@Z
??3@YAXPEAX@Z
??3@YAXPEAX_K@Z
??3IMemoryAllocator@@SAXPEAX@Z
??4CAutoUpdateConfigThread@@QEAAAEAV0@AEBV0@@Z
??4CBlobConfig@@QEAAAEAV0@AEBV0@@Z
??4CContext@@QEAAAEAV0@AEBV0@@Z
??4CDebugLog@@QEAAAEAV0@AEBV0@@Z
??4CDebugLogEx@@QEAAAEAV0@AEBV0@@Z
??4CDelayLoadThread@@QEAAAEAV0@AEBV0@@Z
??4CFile@@QEAAAEAV0@AEBV0@@Z
??4CKEvent@@QEAAAEAV0@AEBV0@@Z
??4CLockEvent@@QEAAAEAV0@AEBV0@@Z
??4CMemoryAllocator@@QEAAAEAV0@AEBV0@@Z
??4CMemoryPoolAllocator@@QEAAAEAV0@AEBV0@@Z
??4CModuleConfig@@QEAAAEAV0@AEBV0@@Z
??4CModuleFlagConfig@@QEAAAEAV0@AEBV0@@Z
??4CModuleStringConfig@@QEAAAEAV0@AEBV0@@Z
??4CSmartLock@@QEAAAEAV0@AEBV0@@Z
??4CSmartLock@@QEAAAEBV0@AEAVCLockEvent@@@Z
??4CSmartResource@@QEAAAEAV0@AEBV0@@Z
??4CSystemThread@@QEAAAEAV0@AEBV0@@Z
??4CUserFuncAdapterJob@@QEAAAEAV0@AEBV0@@Z
??4CWorkerThread@@QEAAAEAV0@AEBV0@@Z
??4CWorkerThreadJob@@QEAAAEAV0@AEBV0@@Z
??4IMemoryAllocator@@QEAAAEAV0@AEBV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CDebugLogEx@@6B@
??_7CDelayLoadThread@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CInclusionExtConfig@@6B@
??_7CInclusionFileNameConfig@@6B@
??_7CInclusionFilePathConfig@@6B@
??_7CInclusionFolderConfig@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CNoLockList@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7CWorkerThreadPoolEx@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QEAAXXZ
??_FCFile@@QEAAXXZ
??_FCFileExtension@@QEAAXXZ
??_FCModuleConfigList@@QEAAXXZ
??_FCStrList@@QEAAXXZ
??_FCSystemThread@@QEAAXXZ
??_FCWorkerThread@@QEAAXXZ
??_FCWorkerThreadJob@@QEAAXXZ
??_FCWorkerThreadJobQueue@@QEAAXXZ
??_U@YAPEAX_KPEAVIMemoryAllocator@@PEBDK@Z
??_V@YAXPEAX@Z
??_V@YAXPEAX_K@Z
?Acquire@CLockEvent@@QEAAXXZ
?Add@CContextList@@QEAAEPEAVCContext@@@Z
?Add@CFileExtension@@QEAAEPEBGK@Z
?Add@CModuleConfigList@@QEAAEPEAVCModuleConfig@@@Z
?Add@CStrList@@QEAAEPEBG@Z
?AddNode@CLockList@@UEAAEQEAXE@Z
?AddNode@CNoLockList@@UEAAEQEAXE@Z
?Alloc@CMemoryAllocator@@UEAAPEAX_KPEBDK@Z
?Alloc@CMemoryPoolAllocator@@UEAAPEAX_KPEBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IEAAPEAX_K@Z
?AttachJobQueue@CWorkerThread@@QEAAXPEAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QEAAXXZ
?CheckNode@CLockList@@UEAAHQEAX@Z
?CheckNode@CNoLockList@@UEAAHQEAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QEAAXXZ
?Cleanup@CBlobConfig@@AEAAXXZ
?Cleanup@CModuleFileExtConfig@@IEAAXXZ
?Cleanup@CModuleMultiStringConfig@@IEAAXXZ
?Cleanup@CModuleStringConfig@@AEAAXXZ
?Close@CFile@@QEAAJXZ
?Count@CLockList@@QEAAKXZ
?Count@CNoLockList@@QEAAKXZ
?Create@CFile@@QEAAJPEBGKKKK@Z
?Create@CSystemThread@@QEAAEXZ
?CreateInstance@CMemoryAllocator@@SAPEAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SAPEAV1@W4_POOL_TYPE@@_K1K@Z
?CreatePool@CWorkerThreadPool@@QEAAEXZ
?CreatePool@CWorkerThreadPoolEx@@QEAAEXZ
?CreateThreads@CWorkerThreadPool@@QEAAEK@Z
?CreateThreads@CWorkerThreadPoolEx@@QEAAEK@Z
?CreateWIRP@CFile@@QEAAJPEBGKKKK@Z
?Delete@CFile@@QEAAJXZ
?Delete@CFileExtension@@QEAAEPEBGK@Z
?Delete@CStrList@@QEAAEPEBG@Z
?DeleteAll@CList@@UEAAXXZ
?DeleteAll@CLockList@@UEAAXXZ
?DeleteAll@CNoLockList@@UEAAXXZ
?DeleteNode@CContextList@@MEAAXPEAX@Z
?DeleteNode@CList@@UEAAXPEAX@Z
?DeleteNode@CModuleConfigList@@MEAAXPEAX@Z
?DeleteNode@CStrList@@EEAAXPEAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YAXPEAPEAX@Z
?DoIt@CWorkerThreadJob@@QEAAJXZ
?EntryPoint@CSystemThread@@KAXPEAX@Z
?Find@CContextList@@QEAAPEAVCContext@@K@Z
?Find@CContextList@@QEAAPEAVCContext@@PEAX@Z
?Find@CFileExtension@@QEAAPEAU_STR_LIST_NODE@CStrList@@PEBGK@Z
?Find@CModuleConfigList@@QEAAPEAVCModuleConfig@@K@Z
?Find@CStrList@@QEAAPEAU_STR_LIST_NODE@1@PEBG@Z
?FindNode@CContextList@@IEAAPEAXPEAX@Z
?FindPartiallyAndAllMatch@CStrList@@QEAAPEAU_STR_LIST_NODE@1@PEBG@Z
?FinishFunction@CUserFuncAdapterJob@@MEAAXXZ
?FinishIt@CWorkerThreadJob@@QEAAJXZ
?First@CList@@UEAAPEAXXZ
?First@CLockList@@UEAAPEAXXZ
?First@CNoLockList@@UEAAPEAXXZ
?Free@CMemoryAllocator@@UEAAXPEAX@Z
?Free@CMemoryPoolAllocator@@UEAAXPEAX@Z
?GetAttributes@CFile@@QEAAKXZ
?GetBasicInfomration@CFile@@IEAAJXZ
?GetBlobCofig@CContext@@UEAAJKPEAXPEAK@Z
?GetCategory@CContext@@QEAAKXZ
?GetData@CBlobConfig@@QEAAHPEAXPEAK@Z
?GetData@CModuleFileExtConfig@@QEAAHPEAGPEAK@Z
?GetData@CModuleFileExtConfig@@QEAAPEAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QEAAKXZ
?GetData@CModuleMultiStringConfig@@QEAAHPEAGPEAK@Z
?GetData@CModuleMultiStringConfig@@QEAAPEAVCStrList@@XZ
?GetData@CModuleStringConfig@@QEAAPEAGXZ
?GetData@CStrList@@QEAAEPEAGPEAK@Z
?GetDataType@CModuleConfig@@QEAAKXZ
?GetEngineContext@CContext@@QEAAPEAXXZ
?GetFileExtensionConfig@CContext@@QEAAPEAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UEAAJKPEAGPEAK@Z
?GetFileSize@CFile@@QEAAJPEAT_LARGE_INTEGER@@@Z
?GetFileSizeWIRP@CFile@@QEAAJPEAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UEAAJKPEAK@Z
?GetID@CModuleConfig@@QEAAKXZ
?GetJob@CWorkerThreadJobQueue@@QEAAPEAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QEAAKXZ
?GetLinkContext@CContext@@QEAAPEAXXZ
?GetLogFlag@CDebugLog@@QEAAKXZ
?GetLogFlag@CDebugLogEx@@QEAAKXZ
?GetModuleId@CModuleConfig@@QEAAKXZ
?GetMultiStringConfig@CContext@@QEAAPEAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UEAAJKPEAGPEAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QEAAPEAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPool@@QEAAPEAU_KTHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QEAAPEAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QEAAPEAU_KTHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QEAA_KXZ
?GetSize@CBlobConfig@@QEAAKXZ
?GetStringConfig@CContext@@QEAAPEAGK@Z
?GetStringConfig@CContext@@UEAAJKPEAGPEAK@Z
?GetThreadCount@CWorkerThreadPool@@QEAAKXZ
?GetThreadCount@CWorkerThreadPoolEx@@QEAAKXZ
?GetThreadID@CSystemThread@@QEAA_KXZ
?GetType@CContext@@QEAAKXZ
?GetUserParameter@CContext@@QEAA_KXZ
?InitProcMon@CDebugLogEx@@IEAAXXZ
?InitializeBlobConfig@CContext@@QEAAHKPEAXK@Z
?InitializeFileExtensionConfig@CContext@@QEAAHKPEBG@Z
?InitializeFlagConfig@CContext@@QEAAHKK@Z
?InitializeMultiStringConfig@CContext@@QEAAHKPEBG@Z
?InitializeStringConfig@CContext@@QEAAHKPEBG@Z
?Insert@CList@@UEAAXQEAXE@Z
?Insert@CLockList@@UEAAXQEAXE@Z
?Insert@CNoLockList@@UEAAXQEAXE@Z
?InsertAfter@CList@@UEAAXPEAX0@Z
?InsertBefore@CList@@UEAAXPEAX0@Z
?Instance@CWorkerThreadPool@@SAPEAV1@XZ
?IsEmpty@CList@@UEAAEXZ
?IsEmpty@CLockList@@UEAAEXZ
?IsEmpty@CNoLockList@@UEAAEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IEAAEK@Z
?IsFull@CLockList@@QEBAEXZ
?IsFull@CNoLockList@@QEBAEXZ
?IsInExclusionList@CExclusionExtConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionExtConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionFileNameConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionFilePathConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionFolderConfig@@QEAAEPEBG@Z
?IsOpened@CFile@@QEAAEXZ
?IsTerminated@CWorkerThreadPool@@QEAAEXZ
?IsTerminated@CWorkerThreadPoolEx@@QEAAEXZ
?IsValid@CMemoryAllocator@@UEAAEXZ
?IsValid@CMemoryPoolAllocator@@UEAAEXZ
?IsValid@IMemoryAllocator@@UEAAEXZ
?IsWorkerThread@CWorkerThreadPool@@QEAAE_K@Z
?IsWorkerThread@CWorkerThreadPoolEx@@QEAAE_K@Z
?JobFunction@CUserFuncAdapterJob@@MEAAXXZ
?JobQueue@CWorkerThreadPool@@QEAAAEAVCWorkerThreadJobQueue@@XZ
?JobQueue@CWorkerThreadPoolEx@@QEAAAEAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QEAAKXZ
?Limit@CNoLockList@@QEAAKXZ
?MatchAllExtensions@CFileExtension@@QEAAEXZ
?MatchNoExtensions@CFileExtension@@QEAAEXZ
?MergeLeft@CMemoryPoolAllocator@@IEAAPEAXPEAX@Z
?MergeRight@CMemoryPoolAllocator@@IEAAPEAXPEAX@Z
?NeedDelete@CWorkerThreadJob@@QEAAEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QEAAXE@Z
?NewNode@CList@@UEAAPEAXXZ
?NewNode@CStrList@@EEAAPEAXXZ
?NewNodeVariant@CList@@IEAAPEAXK@Z
?Next@CList@@UEBAPEAXQEAX@Z
?Next@CLockList@@UEBAPEAXQEAX@Z
?Next@CNoLockList@@UEBAPEAXQEAX@Z
?NextPool@CMemoryPoolAllocator@@QEAAPEAV1@XZ
?NotityTerminate@CWorkerThread@@QEAAXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QEAAJP6AXPEAX@Z0E@Z
?PostJobToWorkerThread@CWorkerThreadPoolEx@@QEAAJP6AXPEAX@Z0E1@Z
?Pulse@CKEvent@@QEAAJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QEAAEPEAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QEAAJPEAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPoolEx@@QEAAJPEAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SAPEAV1@XZ
?Read@CFile@@QEAAJPEADKPEAK@Z
?ReadWIRP@CFile@@QEAAJPEADKPEAK@Z
?ReferenceCount@CContext@@QEAAAEAKXZ
?Release@CLockEvent@@QEAAXXZ
?Remove@CContextList@@UEAAEQEAX@Z
?Remove@CList@@UEAAEQEAX@Z
?Remove@CLockList@@UEAAEQEAX@Z
?Remove@CNoLockList@@UEAAEQEAX@Z
?RemoveHead@CList@@UEAAPEAXXZ
?RemoveHead@CLockList@@UEAAPEAXXZ
?RemoveHead@CNoLockList@@UEAAPEAXXZ
?RemoveTail@CList@@UEAAPEAXXZ
?RemoveTail@CLockList@@UEAAPEAXXZ
?RemoveTail@CNoLockList@@UEAAPEAXXZ
?Reset@CKEvent@@QEAAXXZ
?ResetData@CInclusionExtConfig@@QEAAXXZ
?ResetData@CInclusionFileNameConfig@@QEAAXXZ
?ResetData@CInclusionFilePathConfig@@QEAAXXZ
?ResetData@CInclusionFolderConfig@@QEAAXXZ
?RestoreCR0@@YAXPEAX@Z
?Run@CAutoUpdateConfigThread@@UEAAXXZ
?Run@CDelayLoadThread@@UEAAXXZ
?Run@CWorkerThread@@UEAAXXZ
?SeekToEnd@CFile@@QEAAJXZ
?Set@CKEvent@@QEAAJJE@Z
?SetAttributes@CFile@@QEAAJK@Z
?SetBlobCofig@CContext@@UEAAJKPEAXK@Z
?SetData@CBlobConfig@@QEAAHPEAXK@Z
?SetData@CModuleFileExtConfig@@QEAAHPEBG@Z
?SetData@CModuleFlagConfig@@QEAAHK@Z
?SetData@CModuleMultiStringConfig@@QEAAHPEBGK@Z
?SetData@CModuleStringConfig@@QEAAHPEBG@Z
?SetEngineContext@CContext@@QEAAXPEAX@Z
?SetFileExtensionConfig@CContext@@UEAAJKPEBG@Z
?SetFlagConfig@CContext@@UEAAJKK@Z
?SetLinkContext@CContext@@QEAAXPEAX@Z
?SetLogFlag@CDebugLog@@QEAAEK@Z
?SetLogFlag@CDebugLogEx@@QEAAEK@Z
?SetMatchAllExtensions@CFileExtension@@QEAAXE@Z
?SetMatchNoExtensions@CFileExtension@@QEAAXE@Z
?SetMultiStringConfig@CContext@@UEAAJKPEBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QEAAXXZ
?SetPriority@CSystemThread@@QEAAXK@Z
?SetStopUse@CContext@@QEAAXXZ
?SetStringConfig@CContext@@UEAAJKPEBG@Z
?Setup@CSystemThread@@MEAAXXZ
?StopUse@CContext@@QEAAHXZ
?TearDown@CSystemThread@@MEAAXXZ
?Terminate@CSystemThread@@QEAAXE@Z
?Terminate@CWorkerThreadPool@@QEAAEXZ
?Terminate@CWorkerThreadPoolEx@@QEAAEXZ
?TmExceptionFilter@@YAJPEAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QEAAJPEAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QEAAXXZ
?WaitForInit@CDelayLoadThread@@QEAAEXZ
?WaitForLoad@CDelayLoadThread@@QEAAEXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QEAAEXZ
?WaitQueueEmpty@CWorkerThreadJobQueue@@QEAAXXZ
?Write@CDebugLog@@QEAAXPEBDZZ
?Write@CDebugLogEx@@QEAAXPEBDZZ
?Write@CFile@@QEAAJPEADKPEAT_LARGE_INTEGER@@PEAK@Z
?WriteDataToFile@CDebugLogEx@@IEAAXPEADK@Z
?WriteDataToProcMonW@CDebugLogEx@@IEAAXPEAD@Z
?WriteSystemInformation@CDebugLog@@QEAAXXZ
?WriteSystemInformation@CDebugLogEx@@QEAAXXZ
?WriteSystemStringInformation@CDebugLog@@IEAAXPEBG@Z
?WriteSystemStringInformation@CDebugLogEx@@IEAAXPEBG@Z
?WriteToFile@CDebugLog@@IEAAXPEADK@Z
?WriteToProcMonW@CDebugLogEx@@IEAAXPEAU_UNICODE_STRING@@@Z
?_pNonPagedAllocator@@3PEAVCMemoryAllocator@@EA
?_pPagedAllocator@@3PEAVCMemoryAllocator@@EA
?m_lpInstance@CWorkerThreadPool@@1PEAV1@EA
?m_lpRCMInstance@CWorkerThreadPool@@1PEAV1@EA
AllocFullFileName
DeInitKm2UmCommunication
DeInitKmLPC
DuplicateFullFileName
FreeFullFileName
GetKm2UmMode
GetModuleInfoByAddress
GetModuleInfoByModuleName
InitKm2UmCommunication
InitKmLPC
IsVerifierCodeCheckFlagOn
IsWindows8_1_update
KmCallUm
KmCallUmByLPC
KmCallUmEx
KmCleanupCommPortAPIs
KmGetUmInitProcess
KmSetBackupCommPortAPIs
KmSetCommPortAPIs
ModGetExportProcAddress
ModLoadDLLToBuffer
ModLoadDLLToBufferWithImageSize
ModLoadModule
ModUnLoadModule
NormalizeFileName
NormalizeFullNtPathToDosName
TmCommConfigRoutine
UtilAddDeviceInDriveTable
UtilAddReparsePointMapping
UtilCleanFileReadOnly
UtilCloseExclusiveHandle
UtilCreateDosFileName
UtilDeleteFileForce
UtilGetDeviceObjectName
UtilGetFileNameFromFileObject
UtilGetFileObjectForProcessByEPROC
UtilGetFileObjectFromFileName
UtilGetProcessName
UtilGetSystemDirectory
UtilGetSystemDirectoryEx
UtilGetSystemDirectoryLength
UtilGetSystemTime
UtilIoSetFileInfo
UtilIopCreateFileIRP
UtilKeGetLowFileDevice
UtilModuleIATHook
UtilModuleIATUnHook
UtilPostJobToWorkerThread
UtilQueryExclusiveHandle
UtilQueryKeyValue
UtilRemoveDeviceFromDriveTable
UtilVolumeDeviceToDosName
UtilWaitValueChangeToZero
UtilWriteVersionToRegistry
UtilbuildDynamicDiskMappingTable
UtlWriteBinValueKeyToRegistry
ValidateAddressWithSize
_ResetProtectFromClose
_UtilDosPathNameToNtPathName

Sections

Expand

.text
.rdata
.data
.pdata
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2015-05-29 01:42:42
MD5	8cb2ffb8bb0bbf8cd0dd685611854637
SHA1	3ca51b23f8562485820883e894b448413891183a
SHA256	e4d9f037411284e996a002b15b49bc227d085ee869ae1cd91ba54ff7c244f036
Authentihash MD5	cc40deb90f473e8cc92ba1440f546068
Authentihash SHA1	0a8f087ac86cb29b206c436f8b2ce58c7f43ec7d
Authentihash SHA256	ab3e5217c5ec836a882d68a23b017de5b4f88328510e4bcb9564759926aec89f
RichPEHeaderHash MD5	c060a624a43f3a4972ee081f9209e4d3
RichPEHeaderHash SHA1	e630bbef7195d2e1c16d683b8f18c182aef98dc7
RichPEHeaderHash SHA256	b574f3894ffb1b628c20191e085a4ada2a5f0eb04ea86a3a1ddc1d9fffd22f99
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	Trend Micro Eyes
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 009feac811b0f16247a5fc20d80523ace6

Field	Value
ToBeSigned (TBS) MD5	b6aa9cf28bcfc9f07ec1069fb425ab61
ToBeSigned (TBS) SHA1	ca7a166fcd53878ba5a38d4cac37c63513cfc1fa
ToBeSigned (TBS) SHA256	711394fc49f8948a831f687d42ced6b18514f57786ecc6cdbc3c3eb72e568a40
Subject	C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO Time Stamping Signer
ValidFrom	2015-05-05 00:00:00
ValidTo	2015-12-31 23:59:59
Signature	0dbbad60111bb5f00dcce6483a7a3e0e33dc1cb9ead620fea34dd0cc764ee818d879dfd34f9a4264238a29728a3a6c66a63c3a17a8704565c673c3d0ce8954fbac690f58b019cb869f7eb97eeb5192bf9bddebd165f0257b887cdebda5c8b51451bcc081308a85387be679fe67559387fe4fe88d0eedf37292b5c289806dd159e31d0deab138ee039d0019a5ab219b79c3ccc23e687ebdc94d694db46451fbb22874e25389ce9dfaade2dbceab7b7e064474fd0aa3c9b7a730cd49d29264f122a6b828457479e9a7ce3b33f98350947d68c01d49c760787a3c6426d5befa0a6de41ee109538fa9c523acc79d614221f02c1671493b10af2c6f1ae631f114fd6c
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	009feac811b0f16247a5fc20d80523ace6
Version	3

Certificate 250ce8e030612e9f2b89f7054d7cf8fd

Field	Value
ToBeSigned (TBS) MD5	918d9eb6a6cd36c531eceb926170a7e1
ToBeSigned (TBS) SHA1	0ae95700d65e6f59715aa47048993ca7858e676a
ToBeSigned (TBS) SHA256	47c46e6eaa3780eace3d0d891346cd373359d246b21a957219dbab4c8f37c166
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
ValidFrom	2006-11-08 00:00:00
ValidTo	2021-11-07 23:59:59
Signature	1302ddf8e88600f25af8f8200c59886207cecef74ef9bb59a198e5e138dd4ebc6618d3adeb18f20dc96d3e4a9420c33cbabd6554c6af44b310ad2c6b3eabd707b6b88163c5f95e2ee52a67cecd330c2ad7895603231fb3bee83a0859b4ec4535f78a5bff66cf50afc66d578d1978b7b9a2d157ea1f9a4bafbac98e127ec6bdff
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	250ce8e030612e9f2b89f7054d7cf8fd
Version	3

Certificate 610c120600000000001b

Field	Value
ToBeSigned (TBS) MD5	53c41bc1164e09e0cd1617a5bf913efd
ToBeSigned (TBS) SHA1	93c03aac8951d494ecd5696b1c08658541b18727
ToBeSigned (TBS) SHA256	40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b
Subject	C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
ValidFrom	2006-05-23 17:01:29
ValidTo	2016-05-23 17:11:29
Signature	01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	610c120600000000001b
Version	3

Certificate 1519396ee230f02cad1fcfdb077a35f0

Field	Value
ToBeSigned (TBS) MD5	7e2a6f93403382b4ec42463426d0a4b5
ToBeSigned (TBS) SHA1	62acc697c0e2dc37f3d37ab79751637346e051e2
ToBeSigned (TBS) SHA256	3e9a51973a839e5bc6e81c886e085b777d08ce2b24f816b7552cf2c44e322d59
Subject	C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.
ValidFrom	2015-02-20 00:00:00
ValidTo	2016-05-21 23:59:59
Signature	e480eb7f78216a855e34dbcb712d3879d6b1744c823c8e78c3661e55182a5c1f3a03686169393ef8778c893a49604a79769f5ba7156426c5431ae729a8dc5f8e22b14d124e46eff3f4f660552a57250a15e15d07ad548a02cddf8a204b5010be387a05b1019f618cf15078d80a809a7272b1822a63862c7db194f12697a786001ef630ac9d8bf9f5475191f327b8ed4839dff1ef65e5eb8f91379a66366451f99cb633848c57d4392096e6080fa327b23fc3834ad4f6043904d6c5aeb35454a265b3fda38167cffa8394f092a74bad1ea386f63b7baeb95271a97fc3bff0a2bc96a834f280a254d7170e5cc2830f3bd0649178f8b04514ecd1103753b1762902
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	1519396ee230f02cad1fcfdb077a35f0
Version	3

Certificate 5200e5aa2556fc1a86ed96c9d44b33c7

Field	Value
ToBeSigned (TBS) MD5	b30c31a572b0409383ed3fbe17e56e81
ToBeSigned (TBS) SHA1	4843a82ed3b1f2bfbee9671960e1940c942f688d
ToBeSigned (TBS) SHA256	03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-02-08 00:00:00
ValidTo	2020-02-07 23:59:59
Signature	5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	5200e5aa2556fc1a86ed96c9d44b33c7
Version	3

Imports

Expand

ntoskrnl.exe
HAL.dll
CLASSPNP.SYS

Imported Functions

Expand

wcsrchr
KeSetEvent
KePulseEvent
KeClearEvent
KeStackAttachProcess
KeUnstackDetachProcess
ObfDereferenceObject
ZwSetEvent
ZwClose
ZwConnectPort
RtlInitUnicodeString
RtlUnicodeStringToInteger
ZwCreateSection
ZwWaitForSingleObject
ZwOpenEvent
IoGetCurrentProcess
ObfReferenceObject
DbgBreakPoint
ZwRequestWaitReplyPort
ExFreePoolWithTag
ProbeForWrite
ZwFreeVirtualMemory
ZwAllocateVirtualMemory
ObOpenObjectByPointer
PsProcessType
memmove
PsGetProcessExitTime
MmSectionObjectType
PsThreadType
MmGetSystemRoutineAddress
ObReleaseObjectSecurity
SeReleaseSubjectContext
SeAccessCheck
SeCaptureSubjectContext
ObGetObjectSecurity
DbgPrint
memset
MmIsAddressValid
ExInitializeResourceLite
ExDeleteResourceLite
ZwWriteFile
ZwReadFile
ZwQueryInformationFile
ZwSetInformationFile
ZwCreateFile
swprintf
towupper
_wcsnicmp
ExAllocatePoolWithTag
KeInitializeEvent
_snprintf
PsGetCurrentProcessId
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
PsGetCurrentThreadId
RtlInitAnsiString
ZwDeviceIoControlFile
ZwCreateKey
ZwCreateEvent
KeWaitForMultipleObjects
ObReferenceObjectByHandle
ZwNotifyChangeKey
_vsnprintf
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlEqualUnicodeString
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
RtlUpcaseUnicodeChar
ExGetPreviousMode
KeWaitForSingleObject
KeSetPriorityThread
PsTerminateSystemThread
PsCreateSystemThread
KeDelayExecutionThread
KeNumberProcessors
ZwQueryInformationProcess
PsLookupProcessByProcessId
ZwOpenDirectoryObject
PsSetCreateProcessNotifyRoutine
ZwQuerySystemInformation
ZwQueryDirectoryFile
ZwQueryDirectoryObject
ZwDuplicateObject
ZwOpenKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryValueKey
ZwDeleteValueKey
ZwDeleteKey
ZwTerminateProcess
ZwOpenProcess
ZwQueryKey
ZwSetValueKey
IoFileObjectType
_allrem
memcpy
ZwSetSecurityObject
RtlLengthSecurityDescriptor
MmHighestUserAddress
IoFreeIrp
IoFreeMdl
_purecall
IoBuildAsynchronousFsdRequest
_strnicmp
RtlQueryRegistryValues
RtlAppendUnicodeToString
mbstowcs
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
NtClose
ObQueryNameString
ZwSetInformationObject
_stricmp
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwOpenFile
IoCreateFile
IofCallDriver
IoAllocateIrp
MmBuildMdlForNonPagedPool
IoAllocateMdl
ProbeForRead
PsGetVersion
RtlImageNtHeader
RtlCompareMemory
RtlUpcaseUnicodeString
_snwprintf
MmSystemRangeStart
wcsncmp
strrchr
ZwQueryVolumeInformationFile
ObReferenceObjectByPointer
IoBuildDeviceIoControlRequest
ZwOpenSection
_allmul
KeReleaseSemaphore
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
KeInitializeSemaphore
IofCompleteRequest
ExEventObjectType
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
IoGetDeviceObjectPointer
RtlUpperChar
ObReferenceObjectByName
IoDriverObjectType
RtlCompareUnicodeString
strncpy
KeServiceDescriptorTable
NtOpenProcess
ObOpenObjectByName
NtQueryInformationProcess
PsIsThreadTerminating
KeAddSystemServiceTable
ZwQueryObject
ZwFsControlFile
ObInsertObject
IoReleaseVpbSpinLock
IoAcquireVpbSpinLock
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
_allshr
ExInterlockedPopEntrySList
IoGetStackLimits
IoBuildSynchronousFsdRequest
wcsstr
IoUnregisterPlugPlayNotification
FsRtlIsNameInExpression
IoGetConfigurationInformation
MmProbeAndLockPages
IoGetDeviceInterfaces
IoRegisterPlugPlayNotification
ExAllocatePool
RtlFreeAnsiString
RtlUnicodeStringToAnsiString
strncat
wcschr
wcsncat
wcstombs
KeTickCount
KeBugCheckEx
RtlUnwind
wcsncpy
ExReleaseResourceLite
ExAcquireResourceExclusiveLite
ExAcquireResourceSharedLite
ExReleaseFastMutexUnsafe
KeLeaveCriticalRegion
KeEnterCriticalRegion
ZwQuerySecurityObject
ExAcquireFastMutexUnsafe
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
RtlLengthSid
RtlAbsoluteToSelfRelativeSD
MmUnlockPages
KeGetCurrentThread
KfAcquireSpinLock
KfReleaseSpinLock
KeRaiseIrqlToDpcLevel
KfLowerIrql
ExAcquireFastMutex
ExReleaseFastMutex
KeGetCurrentIrql
KfRaiseIrql
ClassInitialize

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
??0CBlobConfig@@QAE@ABV0@@Z
??0CBlobConfig@@QAE@K@Z
??0CContext@@QAE@ABV0@@Z
??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QAE@ABV0@@Z
??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
??0CDebugLog@@QAE@ABV0@@Z
??0CDebugLog@@QAE@PBG@Z
??0CDebugLogEx@@QAE@ABV0@@Z
??0CDebugLogEx@@QAE@K@Z
??0CDelayLoadThread@@QAE@ABV0@@Z
??0CDelayLoadThread@@QAE@XZ
??0CExclusionExtConfig@@QAE@ABV0@@Z
??0CExclusionExtConfig@@QAE@KKE@Z
??0CExclusionFileNameConfig@@QAE@ABV0@@Z
??0CExclusionFileNameConfig@@QAE@KK@Z
??0CExclusionFilePathConfig@@QAE@ABV0@@Z
??0CExclusionFilePathConfig@@QAE@KK@Z
??0CExclusionFolderConfig@@QAE@ABV0@@Z
??0CExclusionFolderConfig@@QAE@KK@Z
??0CExclusionRegistryConfig@@QAE@ABV0@@Z
??0CExclusionRegistryConfig@@QAE@KK@Z
??0CFile@@QAE@ABV0@@Z
??0CFile@@QAE@E@Z
??0CFileExtension@@QAE@ABV0@@Z
??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
??0CInclusionExtConfig@@QAE@ABV0@@Z
??0CInclusionExtConfig@@QAE@KKE@Z
??0CInclusionFileNameConfig@@QAE@ABV0@@Z
??0CInclusionFileNameConfig@@QAE@KK@Z
??0CInclusionFilePathConfig@@QAE@ABV0@@Z
??0CInclusionFilePathConfig@@QAE@KK@Z
??0CInclusionFolderConfig@@QAE@ABV0@@Z
??0CInclusionFolderConfig@@QAE@KK@Z
??0CKEvent@@QAE@ABV0@@Z
??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
??0CList@@QAE@ABV0@@Z
??0CList@@QAE@KPAVIMemoryAllocator@@@Z
??0CLockEvent@@QAE@ABV0@@Z
??0CLockEvent@@QAE@XZ
??0CLockList@@QAE@ABV0@@Z
??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QAE@ABV0@@Z
??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
??0CMemoryPoolAllocator@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@XZ
??0CModuleConfigList@@QAE@ABV0@@Z
??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QAE@ABV0@@Z
??0CModuleFileExtConfig@@QAE@KKE@Z
??0CModuleFlagConfig@@QAE@ABV0@@Z
??0CModuleFlagConfig@@QAE@K@Z
??0CModuleMultiStringConfig@@QAE@ABV0@@Z
??0CModuleMultiStringConfig@@QAE@KK@Z
??0CModuleStringConfig@@QAE@ABV0@@Z
??0CModuleStringConfig@@QAE@K@Z
??0CNoLockList@@QAE@ABV0@@Z
??0CNoLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CSmartLock@@QAE@AAVCLockEvent@@@Z
??0CSmartLock@@QAE@XZ
??0CSmartReference@@QAE@AAJ@Z
??0CSmartReference@@QAE@AAK@Z
??0CSmartResource@@QAE@AAVCResource@@E@Z
??0CStrList@@QAE@ABV0@@Z
??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
??0CSystemThread@@QAE@ABV0@@Z
??0CSystemThread@@QAE@K@Z
??0CUserFuncAdapterJob@@QAE@ABV0@@Z
??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z01@Z
??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@E@Z
??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
??0CWorkerThreadJobQueue@@QAE@K@Z
??0CWorkerThreadPool@@QAE@ABV0@@Z
??0CWorkerThreadPool@@QAE@K@Z
??0CWorkerThreadPoolEx@@QAE@ABV0@@Z
??0CWorkerThreadPoolEx@@QAE@KK@Z
??0IMemoryAllocator@@QAE@ABV0@@Z
??0IMemoryAllocator@@QAE@XZ
??1CAutoUpdateConfigThread@@UAE@XZ
??1CBlobConfig@@UAE@XZ
??1CContext@@UAE@XZ
??1CContextList@@UAE@XZ
??1CDebugLog@@UAE@XZ
??1CDebugLogEx@@UAE@XZ
??1CDelayLoadThread@@UAE@XZ
??1CExclusionExtConfig@@UAE@XZ
??1CExclusionFileNameConfig@@UAE@XZ
??1CExclusionFilePathConfig@@UAE@XZ
??1CExclusionFolderConfig@@UAE@XZ
??1CExclusionRegistryConfig@@UAE@XZ
??1CFile@@UAE@XZ
??1CFileExtension@@UAE@XZ
??1CInclusionExtConfig@@UAE@XZ
??1CInclusionFileNameConfig@@UAE@XZ
??1CInclusionFilePathConfig@@UAE@XZ
??1CInclusionFolderConfig@@UAE@XZ
??1CKEvent@@UAE@XZ
??1CList@@UAE@XZ
??1CLockEvent@@UAE@XZ
??1CLockList@@UAE@XZ
??1CMemoryAllocator@@UAE@XZ
??1CMemoryPoolAllocator@@UAE@XZ
??1CModuleConfig@@UAE@XZ
??1CModuleConfigList@@UAE@XZ
??1CModuleFileExtConfig@@UAE@XZ
??1CModuleFlagConfig@@UAE@XZ
??1CModuleMultiStringConfig@@UAE@XZ
??1CModuleStringConfig@@UAE@XZ
??1CNoLockList@@UAE@XZ
??1CSmartLock@@QAE@XZ
??1CSmartReference@@QAE@XZ
??1CSmartResource@@QAE@XZ
??1CStrList@@UAE@XZ
??1CSystemThread@@UAE@XZ
??1CUserFuncAdapterJob@@UAE@XZ
??1CWorkerThread@@UAE@XZ
??1CWorkerThreadJob@@UAE@XZ
??1CWorkerThreadJobQueue@@UAE@XZ
??1CWorkerThreadPool@@UAE@XZ
??1CWorkerThreadPoolEx@@UAE@XZ
??1IMemoryAllocator@@UAE@XZ
??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??2CMemoryAllocator@@SGPAXI@Z
??2CMemoryPoolAllocator@@SGPAXI@Z
??3@YAXPAX@Z
??3IMemoryAllocator@@SGXPAX@Z
??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
??4CBlobConfig@@QAEAAV0@ABV0@@Z
??4CContext@@QAEAAV0@ABV0@@Z
??4CDebugLog@@QAEAAV0@ABV0@@Z
??4CDebugLogEx@@QAEAAV0@ABV0@@Z
??4CDelayLoadThread@@QAEAAV0@ABV0@@Z
??4CFile@@QAEAAV0@ABV0@@Z
??4CKEvent@@QAEAAV0@ABV0@@Z
??4CLockEvent@@QAEAAV0@ABV0@@Z
??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
??4CModuleConfig@@QAEAAV0@ABV0@@Z
??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
??4CSmartResource@@QAEAAV0@ABV0@@Z
??4CSystemThread@@QAEAAV0@ABV0@@Z
??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
??4CWorkerThread@@QAEAAV0@ABV0@@Z
??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CDebugLogEx@@6B@
??_7CDelayLoadThread@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CInclusionExtConfig@@6B@
??_7CInclusionFileNameConfig@@6B@
??_7CInclusionFilePathConfig@@6B@
??_7CInclusionFolderConfig@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CNoLockList@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7CWorkerThreadPoolEx@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QAEXXZ
??_FCFile@@QAEXXZ
??_FCFileExtension@@QAEXXZ
??_FCModuleConfigList@@QAEXXZ
??_FCStrList@@QAEXXZ
??_FCSystemThread@@QAEXXZ
??_FCWorkerThread@@QAEXXZ
??_FCWorkerThreadJob@@QAEXXZ
??_FCWorkerThreadJobQueue@@QAEXXZ
??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??_V@YAXPAX@Z
?Acquire@CLockEvent@@QAEXXZ
?Add@CContextList@@QAEEPAVCContext@@@Z
?Add@CFileExtension@@QAEEPBGK@Z
?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
?Add@CStrList@@QAEEPBG@Z
?AddNode@CLockList@@UAEEQAXE@Z
?AddNode@CNoLockList@@UAEEQAXE@Z
?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QAEXXZ
?CheckNode@CLockList@@UAEHQAX@Z
?CheckNode@CNoLockList@@UAEHQAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
?Cleanup@CBlobConfig@@AAEXXZ
?Cleanup@CModuleFileExtConfig@@IAEXXZ
?Cleanup@CModuleMultiStringConfig@@IAEXXZ
?Cleanup@CModuleStringConfig@@AAEXXZ
?Close@CFile@@QAEJXZ
?Count@CLockList@@QAEKXZ
?Count@CNoLockList@@QAEKXZ
?Create@CFile@@QAEJPBGKKKK@Z
?Create@CSystemThread@@QAEEXZ
?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
?CreatePool@CWorkerThreadPool@@QAEEXZ
?CreatePool@CWorkerThreadPoolEx@@QAEEXZ
?CreateThreads@CWorkerThreadPool@@QAEEK@Z
?CreateThreads@CWorkerThreadPoolEx@@QAEEK@Z
?CreateWIRP@CFile@@QAEJPBGKKKK@Z
?Delete@CFile@@QAEJXZ
?Delete@CFileExtension@@QAEEPBGK@Z
?Delete@CStrList@@QAEEPBG@Z
?DeleteAll@CList@@UAEXXZ
?DeleteAll@CLockList@@UAEXXZ
?DeleteAll@CNoLockList@@UAEXXZ
?DeleteNode@CContextList@@MAEXPAX@Z
?DeleteNode@CList@@UAEXPAX@Z
?DeleteNode@CModuleConfigList@@MAEXPAX@Z
?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YGXPAPAX@Z
?DoIt@CWorkerThreadJob@@QAEJXZ
?EntryPoint@CSystemThread@@KGXPAX@Z
?Find@CContextList@@QAEPAVCContext@@K@Z
?Find@CContextList@@QAEPAVCContext@@PAX@Z
?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FindNode@CContextList@@IAEPAXPAX@Z
?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FinishFunction@CUserFuncAdapterJob@@MAEXXZ
?FinishIt@CWorkerThreadJob@@QAEJXZ
?First@CList@@UAEPAXXZ
?First@CLockList@@UAEPAXXZ
?First@CNoLockList@@UAEPAXXZ
?Free@CMemoryAllocator@@UAEXPAX@Z
?Free@CMemoryPoolAllocator@@UAEXPAX@Z
?GetAttributes@CFile@@QAEKXZ
?GetBasicInfomration@CFile@@IAEJXZ
?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
?GetCategory@CContext@@QAEKXZ
?GetData@CBlobConfig@@QAEHPAXPAK@Z
?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QAEKXZ
?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
?GetData@CModuleStringConfig@@QAEPAGXZ
?GetData@CStrList@@QAEEPAGPAK@Z
?GetDataType@CModuleConfig@@QAEKXZ
?GetEngineContext@CContext@@QAEPAXXZ
?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFileSizeWIRP@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UAEJKPAK@Z
?GetID@CModuleConfig@@QAEKXZ
?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QAEKXZ
?GetLinkContext@CContext@@QAEPAXXZ
?GetLogFlag@CDebugLog@@QAEKXZ
?GetLogFlag@CDebugLogEx@@QAEKXZ
?GetModuleId@CModuleConfig@@QAEKXZ
?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_KTHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_KTHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QAEKXZ
?GetSize@CBlobConfig@@QAEKXZ
?GetStringConfig@CContext@@QAEPAGK@Z
?GetStringConfig@CContext@@UAEJKPAGPAK@Z
?GetThreadCount@CWorkerThreadPool@@QAEKXZ
?GetThreadCount@CWorkerThreadPoolEx@@QAEKXZ
?GetThreadID@CSystemThread@@QAEKXZ
?GetType@CContext@@QAEKXZ
?GetUserParameter@CContext@@QAEKXZ
?InitProcMon@CDebugLogEx@@IAEXXZ
?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
?InitializeFlagConfig@CContext@@QAEHKK@Z
?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
?InitializeStringConfig@CContext@@QAEHKPBG@Z
?Insert@CList@@UAEXQAXE@Z
?Insert@CLockList@@UAEXQAXE@Z
?Insert@CNoLockList@@UAEXQAXE@Z
?InsertAfter@CList@@UAEXPAX0@Z
?InsertBefore@CList@@UAEXPAX0@Z
?Instance@CWorkerThreadPool@@SGPAV1@XZ
?IsEmpty@CList@@UAEEXZ
?IsEmpty@CLockList@@UAEEXZ
?IsEmpty@CNoLockList@@UAEEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
?IsFull@CLockList@@QBEEXZ
?IsFull@CNoLockList@@QBEEXZ
?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionExtConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFileNameConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFilePathConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFolderConfig@@QAEEPBG@Z
?IsOpened@CFile@@QAEEXZ
?IsTerminated@CWorkerThreadPool@@QAEEXZ
?IsTerminated@CWorkerThreadPoolEx@@QAEEXZ
?IsValid@CMemoryAllocator@@UAEEXZ
?IsValid@CMemoryPoolAllocator@@UAEEXZ
?IsValid@IMemoryAllocator@@UAEEXZ
?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
?IsWorkerThread@CWorkerThreadPoolEx@@QAEEK@Z
?JobFunction@CUserFuncAdapterJob@@MAEXXZ
?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
?JobQueue@CWorkerThreadPoolEx@@QAEAAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QAEKXZ
?Limit@CNoLockList@@QAEKXZ
?MatchAllExtensions@CFileExtension@@QAEEXZ
?MatchNoExtensions@CFileExtension@@QAEEXZ
?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
?NeedDelete@CWorkerThreadJob@@QAEEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
?NewNode@CList@@UAEPAXXZ
?NewNode@CStrList@@EAEPAXXZ
?NewNodeVariant@CList@@IAEPAXK@Z
?Next@CList@@UBEPAXQAX@Z
?Next@CLockList@@UBEPAXQAX@Z
?Next@CNoLockList@@UBEPAXQAX@Z
?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
?NotityTerminate@CWorkerThread@@QAEXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
?PostJobToWorkerThread@CWorkerThreadPoolEx@@QAEJP6GXPAX@Z0E1@Z
?Pulse@CKEvent@@QAEJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPoolEx@@QAEJPAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
?Read@CFile@@QAEJPADKPAK@Z
?ReadWIRP@CFile@@QAEJPADKPAK@Z
?ReferenceCount@CContext@@QAEAAKXZ
?Release@CLockEvent@@QAEXXZ
?Remove@CContextList@@UAEEQAX@Z
?Remove@CList@@UAEEQAX@Z
?Remove@CLockList@@UAEEQAX@Z
?Remove@CNoLockList@@UAEEQAX@Z
?RemoveHead@CList@@UAEPAXXZ
?RemoveHead@CLockList@@UAEPAXXZ
?RemoveHead@CNoLockList@@UAEPAXXZ
?RemoveTail@CList@@UAEPAXXZ
?RemoveTail@CLockList@@UAEPAXXZ
?RemoveTail@CNoLockList@@UAEPAXXZ
?Reset@CKEvent@@QAEXXZ
?ResetData@CInclusionExtConfig@@QAEXXZ
?ResetData@CInclusionFileNameConfig@@QAEXXZ
?ResetData@CInclusionFilePathConfig@@QAEXXZ
?ResetData@CInclusionFolderConfig@@QAEXXZ
?RestoreCR0@@YGXPAX@Z
?Run@CAutoUpdateConfigThread@@UAEXXZ
?Run@CDelayLoadThread@@UAEXXZ
?Run@CWorkerThread@@UAEXXZ
?SeekToEnd@CFile@@QAEJXZ
?Set@CKEvent@@QAEJJE@Z
?SetAttributes@CFile@@QAEJK@Z
?SetBlobCofig@CContext@@UAEJKPAXK@Z
?SetData@CBlobConfig@@QAEHPAXK@Z
?SetData@CModuleFileExtConfig@@QAEHPBG@Z
?SetData@CModuleFlagConfig@@QAEHK@Z
?SetData@CModuleMultiStringConfig@@QAEHPBGK@Z
?SetData@CModuleStringConfig@@QAEHPBG@Z
?SetEngineContext@CContext@@QAEXPAX@Z
?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
?SetFlagConfig@CContext@@UAEJKK@Z
?SetLinkContext@CContext@@QAEXPAX@Z
?SetLogFlag@CDebugLog@@QAEEK@Z
?SetLogFlag@CDebugLogEx@@QAEEK@Z
?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
?SetMultiStringConfig@CContext@@UAEJKPBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
?SetPriority@CSystemThread@@QAEXK@Z
?SetStopUse@CContext@@QAEXXZ
?SetStringConfig@CContext@@UAEJKPBG@Z
?Setup@CSystemThread@@MAEXXZ
?StopUse@CContext@@QAEHXZ
?TearDown@CSystemThread@@MAEXXZ
?Terminate@CSystemThread@@QAEXE@Z
?Terminate@CWorkerThreadPool@@QAEEXZ
?Terminate@CWorkerThreadPoolEx@@QAEEXZ
?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QAEXXZ
?WaitForInit@CDelayLoadThread@@QAEEXZ
?WaitForLoad@CDelayLoadThread@@QAEEXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
?WaitQueueEmpty@CWorkerThreadJobQueue@@QAEXXZ
?Write@CDebugLog@@QAAXPBDZZ
?Write@CDebugLogEx@@QAAXPBDZZ
?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
?WriteDataToFile@CDebugLogEx@@IAEXPADK@Z
?WriteDataToProcMonW@CDebugLogEx@@IAEXPAD@Z
?WriteSystemInformation@CDebugLog@@QAEXXZ
?WriteSystemInformation@CDebugLogEx@@QAEXXZ
?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
?WriteSystemStringInformation@CDebugLogEx@@IAEXPBG@Z
?WriteToFile@CDebugLog@@IAEXPADK@Z
?WriteToProcMonW@CDebugLogEx@@IAEXPAU_UNICODE_STRING@@@Z
?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
?_pPagedAllocator@@3PAVCMemoryAllocator@@A
?m_lpInstance@CWorkerThreadPool@@1PAV1@A
?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
_DeInitKm2UmCommunication@0
_DeInitKmLPC@0
_DuplicateFullFileName@4
_FreeFullFileName@4
_GetKm2UmMode@0
_GetModuleInfoByAddress@8
_GetModuleInfoByModuleName@8
_InitKm2UmCommunication@8
_InitKmLPC@0
_IsWindows8_1_update@4
_KmCallUm@8
_KmCallUmByLPC@8
_KmCallUmEx@12
_KmCleanupCommPortAPIs@0
_KmGetUmInitProcess@0
_KmSetCommPortAPIs@4
_ModGetExportProcAddress@8
_ModLoadDLLToBuffer@4
_ModLoadDLLToBufferWithImageSize@8
_ModLoadModule@8
_ModUnLoadModule@4
_NormalizeFileName@4
_NormalizeFullNtPathToDosName@4
_TmCommConfigRoutine@4
_UtilAddDeviceInDriveTable@4
_UtilAddReparsePointMapping@8
_UtilCleanFileReadOnly@4
_UtilCreateDosFileName@8
_UtilDeleteFileForce@4
_UtilGetDeviceObjectName@8
_UtilGetFileNameFromFileObject@4
_UtilGetFileObjectForProcessByEPROC@8
_UtilGetFileObjectFromFileName@12
_UtilGetProcessName@12
_UtilGetSystemDirectory@4
_UtilGetSystemDirectoryEx@0
_UtilGetSystemDirectoryLength@0
_UtilGetSystemTime@4
_UtilIoSetFileInfo@24
_UtilIopCreateFileIRP@40
_UtilKeGetLowFileDevice@16
_UtilModuleIATHook@24
_UtilModuleIATUnHook@8
_UtilPostJobToWorkerThread@12
_UtilQueryKeyValue@24
_UtilRemoveDeviceFromDriveTable@4
_UtilVolumeDeviceToDosName@8
_UtilWaitValueChangeToZero@8
_UtilWriteVersionToRegistry@8
_UtilbuildDynamicDiskMappingTable@0
_UtlWriteBinValueKeyToRegistry@16
_ValidateAddressWithSize@20
__UtilDosPathNameToNtPathName@12

Sections

Expand

.text
.rdata
.data
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2015-08-27 07:19:02
MD5	59f6320772a2e6b0b3587536be4cc022
SHA1	fc8fbd92f6e64682360885c188d1bdfbc14ca579
SHA256	ec5fac0b6bb267a2bd10fc80c8cca6718439d56e82e053d3ff799ce5f3475db5
Authentihash MD5	d47678b2b6a24ffb8778d44bb2245abf
Authentihash SHA1	27ac9d934e3a700c1d391cfbaecff8049a6ed97c
Authentihash SHA256	cb21a13819bf295f34f5b34e3e566d25d880b045831e90ff610daf9e8b1f15cd
RichPEHeaderHash MD5	c8ad68543dfad5dd6755280509f19422
RichPEHeaderHash SHA1	c69e969805de6ca1201e67409b7dcb005cfdc8b8
RichPEHeaderHash SHA256	74a96f12a0a25d6abdf05628a4a1fad9c3f4fcb2db2b43549616e33071123a39
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	Trend Micro Eyes
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 009feac811b0f16247a5fc20d80523ace6

Field	Value
ToBeSigned (TBS) MD5	b6aa9cf28bcfc9f07ec1069fb425ab61
ToBeSigned (TBS) SHA1	ca7a166fcd53878ba5a38d4cac37c63513cfc1fa
ToBeSigned (TBS) SHA256	711394fc49f8948a831f687d42ced6b18514f57786ecc6cdbc3c3eb72e568a40
Subject	C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO Time Stamping Signer
ValidFrom	2015-05-05 00:00:00
ValidTo	2015-12-31 23:59:59
Signature	0dbbad60111bb5f00dcce6483a7a3e0e33dc1cb9ead620fea34dd0cc764ee818d879dfd34f9a4264238a29728a3a6c66a63c3a17a8704565c673c3d0ce8954fbac690f58b019cb869f7eb97eeb5192bf9bddebd165f0257b887cdebda5c8b51451bcc081308a85387be679fe67559387fe4fe88d0eedf37292b5c289806dd159e31d0deab138ee039d0019a5ab219b79c3ccc23e687ebdc94d694db46451fbb22874e25389ce9dfaade2dbceab7b7e064474fd0aa3c9b7a730cd49d29264f122a6b828457479e9a7ce3b33f98350947d68c01d49c760787a3c6426d5befa0a6de41ee109538fa9c523acc79d614221f02c1671493b10af2c6f1ae631f114fd6c
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	009feac811b0f16247a5fc20d80523ace6
Version	3

Certificate 250ce8e030612e9f2b89f7054d7cf8fd

Field	Value
ToBeSigned (TBS) MD5	918d9eb6a6cd36c531eceb926170a7e1
ToBeSigned (TBS) SHA1	0ae95700d65e6f59715aa47048993ca7858e676a
ToBeSigned (TBS) SHA256	47c46e6eaa3780eace3d0d891346cd373359d246b21a957219dbab4c8f37c166
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
ValidFrom	2006-11-08 00:00:00
ValidTo	2021-11-07 23:59:59
Signature	1302ddf8e88600f25af8f8200c59886207cecef74ef9bb59a198e5e138dd4ebc6618d3adeb18f20dc96d3e4a9420c33cbabd6554c6af44b310ad2c6b3eabd707b6b88163c5f95e2ee52a67cecd330c2ad7895603231fb3bee83a0859b4ec4535f78a5bff66cf50afc66d578d1978b7b9a2d157ea1f9a4bafbac98e127ec6bdff
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	250ce8e030612e9f2b89f7054d7cf8fd
Version	3

Certificate 610c120600000000001b

Field	Value
ToBeSigned (TBS) MD5	53c41bc1164e09e0cd1617a5bf913efd
ToBeSigned (TBS) SHA1	93c03aac8951d494ecd5696b1c08658541b18727
ToBeSigned (TBS) SHA256	40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b
Subject	C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
ValidFrom	2006-05-23 17:01:29
ValidTo	2016-05-23 17:11:29
Signature	01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	610c120600000000001b
Version	3

Certificate 1519396ee230f02cad1fcfdb077a35f0

Field	Value
ToBeSigned (TBS) MD5	7e2a6f93403382b4ec42463426d0a4b5
ToBeSigned (TBS) SHA1	62acc697c0e2dc37f3d37ab79751637346e051e2
ToBeSigned (TBS) SHA256	3e9a51973a839e5bc6e81c886e085b777d08ce2b24f816b7552cf2c44e322d59
Subject	C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.
ValidFrom	2015-02-20 00:00:00
ValidTo	2016-05-21 23:59:59
Signature	e480eb7f78216a855e34dbcb712d3879d6b1744c823c8e78c3661e55182a5c1f3a03686169393ef8778c893a49604a79769f5ba7156426c5431ae729a8dc5f8e22b14d124e46eff3f4f660552a57250a15e15d07ad548a02cddf8a204b5010be387a05b1019f618cf15078d80a809a7272b1822a63862c7db194f12697a786001ef630ac9d8bf9f5475191f327b8ed4839dff1ef65e5eb8f91379a66366451f99cb633848c57d4392096e6080fa327b23fc3834ad4f6043904d6c5aeb35454a265b3fda38167cffa8394f092a74bad1ea386f63b7baeb95271a97fc3bff0a2bc96a834f280a254d7170e5cc2830f3bd0649178f8b04514ecd1103753b1762902
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	1519396ee230f02cad1fcfdb077a35f0
Version	3

Certificate 5200e5aa2556fc1a86ed96c9d44b33c7

Field	Value
ToBeSigned (TBS) MD5	b30c31a572b0409383ed3fbe17e56e81
ToBeSigned (TBS) SHA1	4843a82ed3b1f2bfbee9671960e1940c942f688d
ToBeSigned (TBS) SHA256	03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-02-08 00:00:00
ValidTo	2020-02-07 23:59:59
Signature	5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	5200e5aa2556fc1a86ed96c9d44b33c7
Version	3

Imports

Expand

ntoskrnl.exe

Imported Functions

Expand

KeLeaveCriticalRegion
wcsncpy
KeEnterCriticalRegion
ExAcquireFastMutexUnsafe
wcsrchr
ExAcquireResourceSharedLite
ExReleaseResourceLite
_purecall
ZwOpenEvent
ZwConnectPort
KeClearEvent
PsProcessType
ExFreePoolWithTag
RtlInitUnicodeString
KeSetEvent
ProbeForWrite
KeUnstackDetachProcess
ZwRequestWaitReplyPort
ZwWaitForSingleObject
DbgBreakPoint
ZwSetEvent
IoGetCurrentProcess
ZwFreeVirtualMemory
ZwClose
ObfReferenceObject
ObfDereferenceObject
RtlUnicodeStringToInteger
ZwCreateSection
ObOpenObjectByPointer
KeStackAttachProcess
KePulseEvent
ZwAllocateVirtualMemory
ObGetObjectSecurity
SeAccessCheck
SeReleaseSubjectContext
SeCaptureSubjectContext
PsThreadType
ObReleaseObjectSecurity
PsGetProcessExitTime
MmSectionObjectType
DbgPrint
ExDeleteResourceLite
ExInitializeResourceLite
ZwReadFile
swprintf
ZwSetInformationFile
ZwCreateFile
ZwQueryInformationFile
ZwWriteFile
_wcsnicmp
towupper
ExAllocatePoolWithTag
KeInitializeEvent
ZwCreateEvent
ZwCreateKey
RtlAnsiStringToUnicodeString
ZwNotifyChangeKey
RtlInitAnsiString
_snprintf
RtlFreeUnicodeString
ExSystemTimeToLocalTime
_vsnprintf
ObReferenceObjectByHandle
RtlTimeToTimeFields
ZwDeviceIoControlFile
PsGetCurrentThreadId
PsGetCurrentProcessId
KeWaitForMultipleObjects
ExGetPreviousMode
RtlEqualUnicodeString
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
RtlUpcaseUnicodeChar
KeWaitForSingleObject
KeSetPriorityThread
PsCreateSystemThread
PsTerminateSystemThread
MmIsAddressValid
KeDelayExecutionThread
KeNumberProcessors
PsLookupProcessByProcessId
PsSetCreateProcessNotifyRoutine
ZwOpenDirectoryObject
ZwQueryInformationProcess
ZwQuerySecurityObject
NtSetInformationFile
ZwDeleteValueKey
ZwSetValueKey
ZwQuerySystemInformation
NtQueryInformationFile
IoFileObjectType
ZwQueryValueKey
ZwQueryDirectoryFile
NtCreateFile
ZwEnumerateValueKey
RtlLengthSecurityDescriptor
ZwQueryDirectoryObject
ZwSetSecurityObject
ZwDuplicateObject
ZwOpenProcess
ZwTerminateProcess
ZwDeleteKey
ExReleaseFastMutexUnsafe
ZwQueryKey
ZwOpenKey
MmSystemRangeStart
_stricmp
_strnicmp
mbstowcs
ProbeForRead
RtlUpcaseUnicodeString
_snwprintf
ZwQuerySymbolicLinkObject
ZwMapViewOfSection
MmGetSystemRoutineAddress
RtlAppendUnicodeToString
IoCreateFile
RtlQueryRegistryValues
MmBuildMdlForNonPagedPool
ZwOpenSymbolicLinkObject
IoFreeMdl
ObQueryNameString
ZwUnmapViewOfSection
NtClose
IoFreeIrp
PsGetVersion
IoAllocateIrp
RtlCompareMemory
MmUnlockPages
ZwSetInformationObject
ZwOpenFile
wcsncmp
RtlImageNtHeader
IoAllocateMdl
IofCallDriver
ZwQueryVolumeInformationFile
ObReferenceObjectByPointer
IoBuildDeviceIoControlRequest
ZwOpenSection
RtlSubAuthoritySid
RtlLengthRequiredSid
ExReleaseFastMutex
ExAcquireFastMutex
RtlCreateAcl
RtlSetDaclSecurityDescriptor
RtlAddAccessAllowedAce
KeInitializeSemaphore
KeReleaseSemaphore
RtlInitializeSid
RtlCreateSecurityDescriptor
IoDeleteSymbolicLink
IoDeleteDevice
ExEventObjectType
IofCompleteRequest
IoCreateSymbolicLink
IoGetDeviceObjectPointer
ObOpenObjectByName
NtQueryInformationProcess
strncpy
NtOpenProcess
ObInsertObject
IoAcquireVpbSpinLock
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
IoReleaseVpbSpinLock
wcschr
strncat
RtlUnicodeStringToAnsiString
wcsncat
RtlFreeAnsiString
wcstombs
IoGetConfigurationInformation
IoRegisterPlugPlayNotification
IoGetStackLimits
IoBuildSynchronousFsdRequest
KeReleaseSpinLock
ExpInterlockedPopEntrySList
FsRtlIsNameInExpression
wcsstr
ExAllocatePool
IoUnregisterPlugPlayNotification
MmProbeAndLockPages
RtlCompareUnicodeString
IoGetDeviceInterfaces
DbgPrintEx
KeAcquireSpinLockRaiseToDpc
KeBugCheckEx
IoCreateDevice
IoDeviceObjectType
SeCaptureSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
IoIsWdmVersionAvailable
SeExports
RtlLengthSid
RtlGetSaclSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
ZwEnumerateKey
ExAcquireResourceExclusiveLite
__C_specific_handler

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QEAA@AEBV0@@Z
??0CAutoUpdateConfigThread@@QEAA@PEAU_UNICODE_STRING@@P6AX0PEAX@Z1@Z
??0CBlobConfig@@QEAA@AEBV0@@Z
??0CBlobConfig@@QEAA@K@Z
??0CContext@@QEAA@AEBV0@@Z
??0CContext@@QEAA@KP6AJPEAU_EVENT_REPORT@@PEAXPEAU_TMCE_REPORT@@PEAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QEAA@AEBV0@@Z
??0CContextList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CDebugLog@@QEAA@AEBV0@@Z
??0CDebugLog@@QEAA@PEBG@Z
??0CDebugLogEx@@QEAA@AEBV0@@Z
??0CDebugLogEx@@QEAA@K@Z
??0CDelayLoadThread@@QEAA@AEBV0@@Z
??0CDelayLoadThread@@QEAA@XZ
??0CExclusionExtConfig@@QEAA@AEBV0@@Z
??0CExclusionExtConfig@@QEAA@KKE@Z
??0CExclusionFileNameConfig@@QEAA@AEBV0@@Z
??0CExclusionFileNameConfig@@QEAA@KK@Z
??0CExclusionFilePathConfig@@QEAA@AEBV0@@Z
??0CExclusionFilePathConfig@@QEAA@KK@Z
??0CExclusionFolderConfig@@QEAA@AEBV0@@Z
??0CExclusionFolderConfig@@QEAA@KK@Z
??0CExclusionRegistryConfig@@QEAA@AEBV0@@Z
??0CExclusionRegistryConfig@@QEAA@KK@Z
??0CFile@@QEAA@AEBV0@@Z
??0CFile@@QEAA@E@Z
??0CFileExtension@@QEAA@AEBV0@@Z
??0CFileExtension@@QEAA@KEEPEAVIMemoryAllocator@@@Z
??0CInclusionExtConfig@@QEAA@AEBV0@@Z
??0CInclusionExtConfig@@QEAA@KKE@Z
??0CInclusionFileNameConfig@@QEAA@AEBV0@@Z
??0CInclusionFileNameConfig@@QEAA@KK@Z
??0CInclusionFilePathConfig@@QEAA@AEBV0@@Z
??0CInclusionFilePathConfig@@QEAA@KK@Z
??0CInclusionFolderConfig@@QEAA@AEBV0@@Z
??0CInclusionFolderConfig@@QEAA@KK@Z
??0CKEvent@@QEAA@AEBV0@@Z
??0CKEvent@@QEAA@W4_EVENT_TYPE@@E@Z
??0CList@@QEAA@AEBV0@@Z
??0CList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CLockEvent@@QEAA@AEBV0@@Z
??0CLockEvent@@QEAA@XZ
??0CLockList@@QEAA@AEBV0@@Z
??0CLockList@@QEAA@KKPEAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IEAA@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QEAA@AEBV0@@Z
??0CMemoryPoolAllocator@@IEAA@W4_POOL_TYPE@@_K1K@Z
??0CMemoryPoolAllocator@@QEAA@AEBV0@@Z
??0CModuleConfig@@QEAA@AEBV0@@Z
??0CModuleConfig@@QEAA@XZ
??0CModuleConfigList@@QEAA@AEBV0@@Z
??0CModuleConfigList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QEAA@AEBV0@@Z
??0CModuleFileExtConfig@@QEAA@KKE@Z
??0CModuleFlagConfig@@QEAA@AEBV0@@Z
??0CModuleFlagConfig@@QEAA@K@Z
??0CModuleMultiStringConfig@@QEAA@AEBV0@@Z
??0CModuleMultiStringConfig@@QEAA@KK@Z
??0CModuleStringConfig@@QEAA@AEBV0@@Z
??0CModuleStringConfig@@QEAA@K@Z
??0CNoLockList@@QEAA@AEBV0@@Z
??0CNoLockList@@QEAA@KKPEAVIMemoryAllocator@@@Z
??0CSmartLock@@QEAA@AEAVCLockEvent@@@Z
??0CSmartLock@@QEAA@XZ
??0CSmartReference@@QEAA@AEAJ@Z
??0CSmartReference@@QEAA@AEAK@Z
??0CSmartResource@@QEAA@AEAVCResource@@E@Z
??0CStrList@@QEAA@AEBV0@@Z
??0CStrList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CSystemThread@@QEAA@AEBV0@@Z
??0CSystemThread@@QEAA@K@Z
??0CUserFuncAdapterJob@@QEAA@AEBV0@@Z
??0CUserFuncAdapterJob@@QEAA@P6AXPEAX@Z01@Z
??0CWorkerThread@@IEAA@PEAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QEAA@AEBV0@@Z
??0CWorkerThreadJob@@QEAA@AEBV0@@Z
??0CWorkerThreadJob@@QEAA@E@Z
??0CWorkerThreadJobQueue@@QEAA@AEBV0@@Z
??0CWorkerThreadJobQueue@@QEAA@K@Z
??0CWorkerThreadPool@@QEAA@AEBV0@@Z
??0CWorkerThreadPool@@QEAA@K@Z
??0CWorkerThreadPoolEx@@QEAA@AEBV0@@Z
??0CWorkerThreadPoolEx@@QEAA@KK@Z
??0IMemoryAllocator@@QEAA@AEBV0@@Z
??0IMemoryAllocator@@QEAA@XZ
??1CAutoUpdateConfigThread@@UEAA@XZ
??1CBlobConfig@@UEAA@XZ
??1CContext@@UEAA@XZ
??1CContextList@@UEAA@XZ
??1CDebugLog@@UEAA@XZ
??1CDebugLogEx@@UEAA@XZ
??1CDelayLoadThread@@UEAA@XZ
??1CExclusionExtConfig@@UEAA@XZ
??1CExclusionFileNameConfig@@UEAA@XZ
??1CExclusionFilePathConfig@@UEAA@XZ
??1CExclusionFolderConfig@@UEAA@XZ
??1CExclusionRegistryConfig@@UEAA@XZ
??1CFile@@UEAA@XZ
??1CFileExtension@@UEAA@XZ
??1CInclusionExtConfig@@UEAA@XZ
??1CInclusionFileNameConfig@@UEAA@XZ
??1CInclusionFilePathConfig@@UEAA@XZ
??1CInclusionFolderConfig@@UEAA@XZ
??1CKEvent@@UEAA@XZ
??1CList@@UEAA@XZ
??1CLockEvent@@UEAA@XZ
??1CLockList@@UEAA@XZ
??1CMemoryAllocator@@UEAA@XZ
??1CMemoryPoolAllocator@@UEAA@XZ
??1CModuleConfig@@UEAA@XZ
??1CModuleConfigList@@UEAA@XZ
??1CModuleFileExtConfig@@UEAA@XZ
??1CModuleFlagConfig@@UEAA@XZ
??1CModuleMultiStringConfig@@UEAA@XZ
??1CModuleStringConfig@@UEAA@XZ
??1CNoLockList@@UEAA@XZ
??1CSmartLock@@QEAA@XZ
??1CSmartReference@@QEAA@XZ
??1CSmartResource@@QEAA@XZ
??1CStrList@@UEAA@XZ
??1CSystemThread@@UEAA@XZ
??1CUserFuncAdapterJob@@UEAA@XZ
??1CWorkerThread@@UEAA@XZ
??1CWorkerThreadJob@@UEAA@XZ
??1CWorkerThreadJobQueue@@UEAA@XZ
??1CWorkerThreadPool@@UEAA@XZ
??1CWorkerThreadPoolEx@@UEAA@XZ
??1IMemoryAllocator@@UEAA@XZ
??2@YAPEAX_KPEAVIMemoryAllocator@@PEBDK@Z
??2CMemoryAllocator@@SAPEAX_K@Z
??2CMemoryPoolAllocator@@SAPEAX_K@Z
??3@YAXPEAX@Z
??3IMemoryAllocator@@SAXPEAX@Z
??4CAutoUpdateConfigThread@@QEAAAEAV0@AEBV0@@Z
??4CBlobConfig@@QEAAAEAV0@AEBV0@@Z
??4CContext@@QEAAAEAV0@AEBV0@@Z
??4CDebugLog@@QEAAAEAV0@AEBV0@@Z
??4CDebugLogEx@@QEAAAEAV0@AEBV0@@Z
??4CDelayLoadThread@@QEAAAEAV0@AEBV0@@Z
??4CFile@@QEAAAEAV0@AEBV0@@Z
??4CKEvent@@QEAAAEAV0@AEBV0@@Z
??4CLockEvent@@QEAAAEAV0@AEBV0@@Z
??4CMemoryAllocator@@QEAAAEAV0@AEBV0@@Z
??4CMemoryPoolAllocator@@QEAAAEAV0@AEBV0@@Z
??4CModuleConfig@@QEAAAEAV0@AEBV0@@Z
??4CModuleFlagConfig@@QEAAAEAV0@AEBV0@@Z
??4CModuleStringConfig@@QEAAAEAV0@AEBV0@@Z
??4CSmartLock@@QEAAAEAV0@AEBV0@@Z
??4CSmartLock@@QEAAAEBV0@AEAVCLockEvent@@@Z
??4CSmartResource@@QEAAAEAV0@AEBV0@@Z
??4CSystemThread@@QEAAAEAV0@AEBV0@@Z
??4CUserFuncAdapterJob@@QEAAAEAV0@AEBV0@@Z
??4CWorkerThread@@QEAAAEAV0@AEBV0@@Z
??4CWorkerThreadJob@@QEAAAEAV0@AEBV0@@Z
??4IMemoryAllocator@@QEAAAEAV0@AEBV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CDebugLogEx@@6B@
??_7CDelayLoadThread@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CInclusionExtConfig@@6B@
??_7CInclusionFileNameConfig@@6B@
??_7CInclusionFilePathConfig@@6B@
??_7CInclusionFolderConfig@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CNoLockList@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7CWorkerThreadPoolEx@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QEAAXXZ
??_FCFile@@QEAAXXZ
??_FCFileExtension@@QEAAXXZ
??_FCModuleConfigList@@QEAAXXZ
??_FCStrList@@QEAAXXZ
??_FCSystemThread@@QEAAXXZ
??_FCWorkerThread@@QEAAXXZ
??_FCWorkerThreadJob@@QEAAXXZ
??_FCWorkerThreadJobQueue@@QEAAXXZ
??_U@YAPEAX_KPEAVIMemoryAllocator@@PEBDK@Z
??_V@YAXPEAX@Z
?Acquire@CLockEvent@@QEAAXXZ
?Add@CContextList@@QEAAEPEAVCContext@@@Z
?Add@CFileExtension@@QEAAEPEBGK@Z
?Add@CModuleConfigList@@QEAAEPEAVCModuleConfig@@@Z
?Add@CStrList@@QEAAEPEBG@Z
?AddNode@CLockList@@UEAAEQEAXE@Z
?AddNode@CNoLockList@@UEAAEQEAXE@Z
?Alloc@CMemoryAllocator@@UEAAPEAX_KPEBDK@Z
?Alloc@CMemoryPoolAllocator@@UEAAPEAX_KPEBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IEAAPEAX_K@Z
?AttachJobQueue@CWorkerThread@@QEAAXPEAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QEAAXXZ
?CheckNode@CLockList@@UEAAHQEAX@Z
?CheckNode@CNoLockList@@UEAAHQEAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QEAAXXZ
?Cleanup@CBlobConfig@@AEAAXXZ
?Cleanup@CModuleFileExtConfig@@IEAAXXZ
?Cleanup@CModuleMultiStringConfig@@IEAAXXZ
?Cleanup@CModuleStringConfig@@AEAAXXZ
?Close@CFile@@QEAAJXZ
?Count@CLockList@@QEAAKXZ
?Count@CNoLockList@@QEAAKXZ
?Create@CFile@@QEAAJPEBGKKKK@Z
?Create@CSystemThread@@QEAAEXZ
?CreateInstance@CMemoryAllocator@@SAPEAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SAPEAV1@W4_POOL_TYPE@@_K1K@Z
?CreatePool@CWorkerThreadPool@@QEAAEXZ
?CreatePool@CWorkerThreadPoolEx@@QEAAEXZ
?CreateThreads@CWorkerThreadPool@@QEAAEK@Z
?CreateThreads@CWorkerThreadPoolEx@@QEAAEK@Z
?CreateWIRP@CFile@@QEAAJPEBGKKKK@Z
?Delete@CFile@@QEAAJXZ
?Delete@CFileExtension@@QEAAEPEBGK@Z
?Delete@CStrList@@QEAAEPEBG@Z
?DeleteAll@CList@@UEAAXXZ
?DeleteAll@CLockList@@UEAAXXZ
?DeleteAll@CNoLockList@@UEAAXXZ
?DeleteNode@CContextList@@MEAAXPEAX@Z
?DeleteNode@CList@@UEAAXPEAX@Z
?DeleteNode@CModuleConfigList@@MEAAXPEAX@Z
?DeleteNode@CStrList@@EEAAXPEAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YAXPEAPEAX@Z
?DoIt@CWorkerThreadJob@@QEAAJXZ
?EntryPoint@CSystemThread@@KAXPEAX@Z
?Find@CContextList@@QEAAPEAVCContext@@K@Z
?Find@CContextList@@QEAAPEAVCContext@@PEAX@Z
?Find@CFileExtension@@QEAAPEAU_STR_LIST_NODE@CStrList@@PEBGK@Z
?Find@CModuleConfigList@@QEAAPEAVCModuleConfig@@K@Z
?Find@CStrList@@QEAAPEAU_STR_LIST_NODE@1@PEBG@Z
?FindNode@CContextList@@IEAAPEAXPEAX@Z
?FindPartiallyAndAllMatch@CStrList@@QEAAPEAU_STR_LIST_NODE@1@PEBG@Z
?FinishFunction@CUserFuncAdapterJob@@MEAAXXZ
?FinishIt@CWorkerThreadJob@@QEAAJXZ
?First@CList@@UEAAPEAXXZ
?First@CLockList@@UEAAPEAXXZ
?First@CNoLockList@@UEAAPEAXXZ
?Free@CMemoryAllocator@@UEAAXPEAX@Z
?Free@CMemoryPoolAllocator@@UEAAXPEAX@Z
?GetAttributes@CFile@@QEAAKXZ
?GetBasicInfomration@CFile@@IEAAJXZ
?GetBlobCofig@CContext@@UEAAJKPEAXPEAK@Z
?GetCategory@CContext@@QEAAKXZ
?GetData@CBlobConfig@@QEAAHPEAXPEAK@Z
?GetData@CModuleFileExtConfig@@QEAAHPEAGPEAK@Z
?GetData@CModuleFileExtConfig@@QEAAPEAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QEAAKXZ
?GetData@CModuleMultiStringConfig@@QEAAHPEAGPEAK@Z
?GetData@CModuleMultiStringConfig@@QEAAPEAVCStrList@@XZ
?GetData@CModuleStringConfig@@QEAAPEAGXZ
?GetData@CStrList@@QEAAEPEAGPEAK@Z
?GetDataType@CModuleConfig@@QEAAKXZ
?GetEngineContext@CContext@@QEAAPEAXXZ
?GetFileExtensionConfig@CContext@@QEAAPEAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UEAAJKPEAGPEAK@Z
?GetFileSize@CFile@@QEAAJPEAT_LARGE_INTEGER@@@Z
?GetFileSizeWIRP@CFile@@QEAAJPEAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UEAAJKPEAK@Z
?GetID@CModuleConfig@@QEAAKXZ
?GetJob@CWorkerThreadJobQueue@@QEAAPEAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QEAAKXZ
?GetLinkContext@CContext@@QEAAPEAXXZ
?GetLogFlag@CDebugLog@@QEAAKXZ
?GetLogFlag@CDebugLogEx@@QEAAKXZ
?GetModuleId@CModuleConfig@@QEAAKXZ
?GetMultiStringConfig@CContext@@QEAAPEAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UEAAJKPEAGPEAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QEAAPEAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPool@@QEAAPEAU_KTHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QEAAPEAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QEAAPEAU_KTHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QEAA_KXZ
?GetSize@CBlobConfig@@QEAAKXZ
?GetStringConfig@CContext@@QEAAPEAGK@Z
?GetStringConfig@CContext@@UEAAJKPEAGPEAK@Z
?GetThreadCount@CWorkerThreadPool@@QEAAKXZ
?GetThreadCount@CWorkerThreadPoolEx@@QEAAKXZ
?GetThreadID@CSystemThread@@QEAA_KXZ
?GetType@CContext@@QEAAKXZ
?GetUserParameter@CContext@@QEAA_KXZ
?InitProcMon@CDebugLogEx@@IEAAXXZ
?InitializeBlobConfig@CContext@@QEAAHKPEAXK@Z
?InitializeFileExtensionConfig@CContext@@QEAAHKPEBG@Z
?InitializeFlagConfig@CContext@@QEAAHKK@Z
?InitializeMultiStringConfig@CContext@@QEAAHKPEBG@Z
?InitializeStringConfig@CContext@@QEAAHKPEBG@Z
?Insert@CList@@UEAAXQEAXE@Z
?Insert@CLockList@@UEAAXQEAXE@Z
?Insert@CNoLockList@@UEAAXQEAXE@Z
?InsertAfter@CList@@UEAAXPEAX0@Z
?InsertBefore@CList@@UEAAXPEAX0@Z
?Instance@CWorkerThreadPool@@SAPEAV1@XZ
?IsEmpty@CList@@UEAAEXZ
?IsEmpty@CLockList@@UEAAEXZ
?IsEmpty@CNoLockList@@UEAAEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IEAAEK@Z
?IsFull@CLockList@@QEBAEXZ
?IsFull@CNoLockList@@QEBAEXZ
?IsInExclusionList@CExclusionExtConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionExtConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionFileNameConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionFilePathConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionFolderConfig@@QEAAEPEBG@Z
?IsOpened@CFile@@QEAAEXZ
?IsTerminated@CWorkerThreadPool@@QEAAEXZ
?IsTerminated@CWorkerThreadPoolEx@@QEAAEXZ
?IsValid@CMemoryAllocator@@UEAAEXZ
?IsValid@CMemoryPoolAllocator@@UEAAEXZ
?IsValid@IMemoryAllocator@@UEAAEXZ
?IsWorkerThread@CWorkerThreadPool@@QEAAE_K@Z
?IsWorkerThread@CWorkerThreadPoolEx@@QEAAE_K@Z
?JobFunction@CUserFuncAdapterJob@@MEAAXXZ
?JobQueue@CWorkerThreadPool@@QEAAAEAVCWorkerThreadJobQueue@@XZ
?JobQueue@CWorkerThreadPoolEx@@QEAAAEAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QEAAKXZ
?Limit@CNoLockList@@QEAAKXZ
?MatchAllExtensions@CFileExtension@@QEAAEXZ
?MatchNoExtensions@CFileExtension@@QEAAEXZ
?MergeLeft@CMemoryPoolAllocator@@IEAAPEAXPEAX@Z
?MergeRight@CMemoryPoolAllocator@@IEAAPEAXPEAX@Z
?NeedDelete@CWorkerThreadJob@@QEAAEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QEAAXE@Z
?NewNode@CList@@UEAAPEAXXZ
?NewNode@CStrList@@EEAAPEAXXZ
?NewNodeVariant@CList@@IEAAPEAXK@Z
?Next@CList@@UEBAPEAXQEAX@Z
?Next@CLockList@@UEBAPEAXQEAX@Z
?Next@CNoLockList@@UEBAPEAXQEAX@Z
?NextPool@CMemoryPoolAllocator@@QEAAPEAV1@XZ
?NotityTerminate@CWorkerThread@@QEAAXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QEAAJP6AXPEAX@Z0E@Z
?PostJobToWorkerThread@CWorkerThreadPoolEx@@QEAAJP6AXPEAX@Z0E1@Z
?Pulse@CKEvent@@QEAAJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QEAAEPEAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QEAAJPEAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPoolEx@@QEAAJPEAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SAPEAV1@XZ
?Read@CFile@@QEAAJPEADKPEAK@Z
?ReadWIRP@CFile@@QEAAJPEADKPEAK@Z
?ReferenceCount@CContext@@QEAAAEAKXZ
?Release@CLockEvent@@QEAAXXZ
?Remove@CContextList@@UEAAEQEAX@Z
?Remove@CList@@UEAAEQEAX@Z
?Remove@CLockList@@UEAAEQEAX@Z
?Remove@CNoLockList@@UEAAEQEAX@Z
?RemoveHead@CList@@UEAAPEAXXZ
?RemoveHead@CLockList@@UEAAPEAXXZ
?RemoveHead@CNoLockList@@UEAAPEAXXZ
?RemoveTail@CList@@UEAAPEAXXZ
?RemoveTail@CLockList@@UEAAPEAXXZ
?RemoveTail@CNoLockList@@UEAAPEAXXZ
?Reset@CKEvent@@QEAAXXZ
?ResetData@CInclusionExtConfig@@QEAAXXZ
?ResetData@CInclusionFileNameConfig@@QEAAXXZ
?ResetData@CInclusionFilePathConfig@@QEAAXXZ
?ResetData@CInclusionFolderConfig@@QEAAXXZ
?RestoreCR0@@YAXPEAX@Z
?Run@CAutoUpdateConfigThread@@UEAAXXZ
?Run@CDelayLoadThread@@UEAAXXZ
?Run@CWorkerThread@@UEAAXXZ
?SeekToEnd@CFile@@QEAAJXZ
?Set@CKEvent@@QEAAJJE@Z
?SetAttributes@CFile@@QEAAJK@Z
?SetBlobCofig@CContext@@UEAAJKPEAXK@Z
?SetData@CBlobConfig@@QEAAHPEAXK@Z
?SetData@CModuleFileExtConfig@@QEAAHPEBG@Z
?SetData@CModuleFlagConfig@@QEAAHK@Z
?SetData@CModuleMultiStringConfig@@QEAAHPEBGK@Z
?SetData@CModuleStringConfig@@QEAAHPEBG@Z
?SetEngineContext@CContext@@QEAAXPEAX@Z
?SetFileExtensionConfig@CContext@@UEAAJKPEBG@Z
?SetFlagConfig@CContext@@UEAAJKK@Z
?SetLinkContext@CContext@@QEAAXPEAX@Z
?SetLogFlag@CDebugLog@@QEAAEK@Z
?SetLogFlag@CDebugLogEx@@QEAAEK@Z
?SetMatchAllExtensions@CFileExtension@@QEAAXE@Z
?SetMatchNoExtensions@CFileExtension@@QEAAXE@Z
?SetMultiStringConfig@CContext@@UEAAJKPEBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QEAAXXZ
?SetPriority@CSystemThread@@QEAAXK@Z
?SetStopUse@CContext@@QEAAXXZ
?SetStringConfig@CContext@@UEAAJKPEBG@Z
?Setup@CSystemThread@@MEAAXXZ
?StopUse@CContext@@QEAAHXZ
?TearDown@CSystemThread@@MEAAXXZ
?Terminate@CSystemThread@@QEAAXE@Z
?Terminate@CWorkerThreadPool@@QEAAEXZ
?Terminate@CWorkerThreadPoolEx@@QEAAEXZ
?TmExceptionFilter@@YAJPEAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QEAAJPEAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QEAAXXZ
?WaitForInit@CDelayLoadThread@@QEAAEXZ
?WaitForLoad@CDelayLoadThread@@QEAAEXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QEAAEXZ
?WaitQueueEmpty@CWorkerThreadJobQueue@@QEAAXXZ
?Write@CDebugLog@@QEAAXPEBDZZ
?Write@CDebugLogEx@@QEAAXPEBDZZ
?Write@CFile@@QEAAJPEADKPEAT_LARGE_INTEGER@@PEAK@Z
?WriteDataToFile@CDebugLogEx@@IEAAXPEADK@Z
?WriteDataToProcMonW@CDebugLogEx@@IEAAXPEAD@Z
?WriteSystemInformation@CDebugLog@@QEAAXXZ
?WriteSystemInformation@CDebugLogEx@@QEAAXXZ
?WriteSystemStringInformation@CDebugLog@@IEAAXPEBG@Z
?WriteSystemStringInformation@CDebugLogEx@@IEAAXPEBG@Z
?WriteToFile@CDebugLog@@IEAAXPEADK@Z
?WriteToProcMonW@CDebugLogEx@@IEAAXPEAU_UNICODE_STRING@@@Z
?_pNonPagedAllocator@@3PEAVCMemoryAllocator@@EA
?_pPagedAllocator@@3PEAVCMemoryAllocator@@EA
?m_lpInstance@CWorkerThreadPool@@1PEAV1@EA
?m_lpRCMInstance@CWorkerThreadPool@@1PEAV1@EA
DeInitKm2UmCommunication
DeInitKmLPC
DuplicateFullFileName
FreeFullFileName
GetKm2UmMode
GetModuleInfoByAddress
GetModuleInfoByModuleName
InitKm2UmCommunication
InitKmLPC
IsVerifierCodeCheckFlagOn
IsWindows8_1_update
KmCallUm
KmCallUmByLPC
KmCallUmEx
KmCleanupCommPortAPIs
KmGetUmInitProcess
KmSetCommPortAPIs
ModGetExportProcAddress
ModLoadDLLToBuffer
ModLoadDLLToBufferWithImageSize
ModLoadModule
ModUnLoadModule
NormalizeFileName
NormalizeFullNtPathToDosName
TmCommConfigRoutine
UtilAddDeviceInDriveTable
UtilAddReparsePointMapping
UtilCleanFileReadOnly
UtilCloseExclusiveHandle
UtilCreateDosFileName
UtilDeleteFileForce
UtilGetDeviceObjectName
UtilGetFileNameFromFileObject
UtilGetFileObjectForProcessByEPROC
UtilGetFileObjectFromFileName
UtilGetProcessName
UtilGetSystemDirectory
UtilGetSystemDirectoryEx
UtilGetSystemDirectoryLength
UtilGetSystemTime
UtilIoSetFileInfo
UtilIopCreateFileIRP
UtilKeGetLowFileDevice
UtilModuleIATHook
UtilModuleIATUnHook
UtilPostJobToWorkerThread
UtilQueryExclusiveHandle
UtilQueryKeyValue
UtilRemoveDeviceFromDriveTable
UtilVolumeDeviceToDosName
UtilWaitValueChangeToZero
UtilWriteVersionToRegistry
UtilbuildDynamicDiskMappingTable
UtlWriteBinValueKeyToRegistry
ValidateAddressWithSize
_ResetProtectFromClose
_UtilDosPathNameToNtPathName

Sections

Expand

.text
.rdata
.data
.pdata
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2019-10-25 05:13:45
MD5	c006d1844f20b91d0ea52bf32d611f30
SHA1	70258117b5efe65476f85143fd14fa0b7f148adb
SHA256	ecd07df7ad6fee9269a9e9429eb199bf3e24cf672aa1d013b7e8d90d75324566
Authentihash MD5	893a04662ec3207278510b671992072d
Authentihash SHA1	61ec0fdef8d1c5248fab9a3cf0764b7be9ddea37
Authentihash SHA256	2c1b6a278ff90171a7472423a2626edcf75233aacac1bd7d1995716ef26f8dcf
RichPEHeaderHash MD5	43b6bdf46f2eed0061a488cd8b6e0417
RichPEHeaderHash SHA1	92e68f440af273e47d6e42c6cfeb27de0069e8eb
RichPEHeaderHash SHA256	fb37cac37cea05fdfdf6006b40bf804d46870e037ac1c836014bb9613c2256a0
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	Trend Micro Eyes
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 7e93ebfb7cc64e59ea4b9a77d406fc3b

Field	Value
ToBeSigned (TBS) MD5	d0785ad36e427c92b19f6826ab1e8020
ToBeSigned (TBS) SHA1	365b7a9c21bd9373e49052c3e7b3e4646ddd4d43
ToBeSigned (TBS) SHA256	c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2
ValidFrom	2012-12-21 00:00:00
ValidTo	2020-12-30 23:59:59
Signature	03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	7e93ebfb7cc64e59ea4b9a77d406fc3b
Version	3

Certificate 0ecff438c8febf356e04d86a981b1a50

Field	Value
ToBeSigned (TBS) MD5	e9d38360b914c8863f6cba3ee58764d3
ToBeSigned (TBS) SHA1	4cba8eae47b6bf76f20b3504b98b8f062694a89b
ToBeSigned (TBS) SHA256	88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4
ValidFrom	2012-10-18 00:00:00
ValidTo	2020-12-29 23:59:59
Signature	783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	0ecff438c8febf356e04d86a981b1a50
Version	3

Certificate 0ea0fe4dfb74cc64bc32143103c27c8b

Field	Value
ToBeSigned (TBS) MD5	e93e004baa6013b41135ac0648e29d5b
ToBeSigned (TBS) SHA1	dc91e26674d4b627319c700d3ebb1a6cf83d358e
ToBeSigned (TBS) SHA256	0d20335edb166a303411548471bee6f301c8b4f7f7e453d09c15303de2c888d7
Subject	C=TW, L=Taipei, O=Trend Micro, Inc., OU=Taipei, TW, CN=Trend Micro, Inc.
ValidFrom	2019-07-12 00:00:00
ValidTo	2020-07-10 12:00:00
Signature	5c08ae5d586a4751195382d6889dc2fc500e7c39c641e1a58def8d923e12b754e2cc35720cc8d3d29382980debf7d98fcc17d764187126dd07c134fdbb96dd44fe8a40195df6f6acd1881fa5ba2921dadceb3f64422344672834813916bbdf317533cf6aaf3317d78197d7d6c560ad681de135f39e2d4ad345b7fe491162660a5462c6075fd725382df1e6e6bc3a4c443be778f79b07f181082e38150ca28ab932f99e4bc4185dc5b3b6edf22c187fdfd84e23a21e7da1989837f43b89aa172e6b34dbcb297bffd511a1d1c100b25e0e921f622a0845e23317f9fec83659ca21c241800683e0dd66ce4d042a8aefc4142b5923a6fa93ee72c48e8dc04c13b4b0
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	0ea0fe4dfb74cc64bc32143103c27c8b
Version	3

Certificate 61204db4000000000027

Field	Value
ToBeSigned (TBS) MD5	8e3ffc222fbcebdbb8b23115ab259be7
ToBeSigned (TBS) SHA1	ee20bff28ffe13be731c294c90d6ded5aae0ec0e
ToBeSigned (TBS) SHA256	59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821
Subject	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
ValidFrom	2011-04-15 19:45:33
ValidTo	2021-04-15 19:55:33
Signature	208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	61204db4000000000027
Version	3

Certificate 02c4d1e58a4a680c568da3047e7e4d5f

Field	Value
ToBeSigned (TBS) MD5	829995f702421dea833a24fb2c7f4442
ToBeSigned (TBS) SHA1	1d7e838accd498c2e5ba9373af819ec097bb955c
ToBeSigned (TBS) SHA256	92914d016cc46e125e50c4bd0bd7f72db87eed4ba68f3c589b4e86aa563108db
Subject	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance Code Signing CA,1
ValidFrom	2011-02-11 12:00:00
ValidTo	2026-02-10 12:00:00
Signature	49eb7c60beaeefc97cb3c5ba4b64df1669e286fa29d9de98857d406626332f4455aaaa90e935700a34bed3ae542e8e6500d67a32203e6c26b898a939b1bc95c7aae9f5ee4666c6b3e812f8b3979dff74588234997550ac448fe892ce7d8b0f3196c7dcd31130987416c6e56b4576a39401cd33007a48f66f8631c9562b3322d5f801b644ce8cb4ca88d2e416e3e7f6e23ee109c09d7943437f555c05ad9310c62c0d6bc09eea78e5d277d6b8da9a987fba4c922b9dbda488b1ddafc34cd2979b03c6ae5f1b440f333715e3cbff2f56d316a45b55679da2cadb346c0c734ab57ba4b6b3e935027870ec007acbfc4b4f2236bb1484c98f91dd0f3c758cca0b88e7
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	02c4d1e58a4a680c568da3047e7e4d5f
Version	3

Imports

Expand

ntoskrnl.exe
CLASSPNP.SYS
HAL.dll

Imported Functions

Expand

ProbeForRead
ProbeForWrite
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
MmProbeAndLockPages
MmUnlockPages
MmMapLockedPagesSpecifyCache
IoAllocateMdl
IoFreeMdl
IoGetCurrentProcess
ObfReferenceObject
ObfDereferenceObject
ZwClose
ZwCreateSection
ZwOpenSection
ZwMapViewOfSection
ZwUnmapViewOfSection
ZwOpenEvent
KePulseEvent
KeStackAttachProcess
KeUnstackDetachProcess
ObOpenObjectByPointer
ZwAllocateVirtualMemory
ZwFreeVirtualMemory
ZwSetEvent
_allmul
memcpy
memset
PsProcessType
wcsncpy
wcsrchr
RtlUnicodeStringToInteger
ZwWaitForSingleObject
ZwRequestWaitReplyPort
ZwConnectPort
swprintf
RtlCopyUnicodeString
DbgPrint
KeDelayExecutionThread
KeQuerySystemTime
ExAllocatePoolWithTag
ExInitializeResourceLite
ExDeleteResourceLite
PsGetVersion
IofCompleteRequest
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoGetDeviceObjectPointer
ObReferenceObjectByHandle
PsGetCurrentProcessId
ZwCreateEvent
ExEventObjectType
MmSectionObjectType
PsThreadType
SeCaptureSubjectContext
SeReleaseSubjectContext
SeAccessCheck
ObGetObjectSecurity
ObReleaseObjectSecurity
PsGetProcessExitTime
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
KeInitializeSemaphore
KeReleaseSemaphore
RtlCreateAcl
RtlAddAccessAllowedAce
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
ExGetPreviousMode
_wcsnicmp
PsSetCreateProcessNotifyRoutine
ZwQueryInformationProcess
PsLookupProcessByProcessId
ZwOpenDirectoryObject
MmIsAddressValid
ZwCreateFile
ZwQueryInformationFile
ZwSetInformationFile
ZwReadFile
ZwWriteFile
towupper
MmGetSystemRoutineAddress
ObReferenceObjectByPointer
ObQueryNameString
MmHighestUserAddress
_snprintf
_vsnprintf
RtlInitAnsiString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
RtlTimeToTimeFields
KeWaitForMultipleObjects
ExSystemTimeToLocalTime
ZwCreateKey
PsGetCurrentThreadId
ZwDeviceIoControlFile
ZwNotifyChangeKey
ExReleaseFastMutexUnsafe
ZwQueryVolumeInformationFile
mbstowcs
_stricmp
RtlImageNtHeader
ZwQuerySystemInformation
_strnicmp
RtlCompareUnicodeString
RtlCompareMemory
MmBuildMdlForNonPagedPool
IoAllocateIrp
IofCallDriver
IoFreeIrp
RtlUpperChar
ObReferenceObjectByName
IoFileObjectType
IoDriverObjectType
IoBuildDeviceIoControlRequest
IoCreateFile
RtlEqualUnicodeString
RtlAppendUnicodeStringToString
RtlUpcaseUnicodeChar
RtlPrefixUnicodeString
_snwprintf
strncpy
NtOpenProcess
NtQueryInformationProcess
PsIsThreadTerminating
ObOpenObjectByName
KeServiceDescriptorTable
KeAddSystemServiceTable
KeSetPriorityThread
PsCreateSystemThread
PsTerminateSystemThread
KeNumberProcessors
RtlLengthSecurityDescriptor
ZwOpenKey
ZwDeleteKey
ZwDeleteValueKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryKey
ZwQueryValueKey
ZwSetValueKey
ZwTerminateProcess
ZwOpenProcess
ZwQuerySecurityObject
ZwSetSecurityObject
ZwQueryDirectoryObject
ZwQueryDirectoryFile
_allrem
RtlAppendUnicodeToString
ZwFsControlFile
ObInsertObject
strrchr
wcschr
wcsncmp
RtlQueryRegistryValues
IoBuildAsynchronousFsdRequest
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
RtlUpcaseUnicodeString
NtClose
ZwSetInformationObject
SeQueryAuthenticationIdToken
MmSystemRangeStart
IoGetFileObjectGenericMapping
ObCreateObject
SeCreateAccessState
IoAcquireVpbSpinLock
IoReleaseVpbSpinLock
wcstombs
strncat
wcsncat
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
wcsstr
ExAllocatePool
ExInterlockedPopEntrySList
IoBuildSynchronousFsdRequest
IoGetStackLimits
IoGetDeviceInterfaces
IoRegisterPlugPlayNotification
IoUnregisterPlugPlayNotification
IoGetConfigurationInformation
FsRtlIsNameInExpression
RtlUnwind
IoDeviceObjectType
IoCreateDevice
RtlGetOwnerSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
RtlLengthSid
SeExports
IoIsWdmVersionAvailable
RtlAbsoluteToSelfRelativeSD
ExAcquireFastMutexUnsafe
ExFreePoolWithTag
KeBugCheckEx
KeWaitForSingleObject
KeLeaveCriticalRegion
KeEnterCriticalRegion
KeSetEvent
KeClearEvent
KeInitializeEvent
RtlInitUnicodeString
KeGetCurrentThread
memmove
ZwOpenFile
_purecall
ClassInitialize
KfRaiseIrql
KeReleaseQueuedSpinLock
KeAcquireQueuedSpinLock
KfAcquireSpinLock
KfLowerIrql
KeGetCurrentIrql
ExReleaseFastMutex
ExAcquireFastMutex
KeRaiseIrqlToDpcLevel
KfReleaseSpinLock

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
??0CBlobConfig@@QAE@ABV0@@Z
??0CBlobConfig@@QAE@K@Z
??0CContext@@QAE@ABV0@@Z
??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QAE@ABV0@@Z
??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
??0CDebugLog@@QAE@ABV0@@Z
??0CDebugLog@@QAE@PBG@Z
??0CDebugLogEx@@QAE@ABV0@@Z
??0CDebugLogEx@@QAE@K@Z
??0CDelayLoadThread@@QAE@ABV0@@Z
??0CDelayLoadThread@@QAE@XZ
??0CExclusionExtConfig@@QAE@ABV0@@Z
??0CExclusionExtConfig@@QAE@KKE@Z
??0CExclusionFileNameConfig@@QAE@ABV0@@Z
??0CExclusionFileNameConfig@@QAE@KK@Z
??0CExclusionFilePathConfig@@QAE@ABV0@@Z
??0CExclusionFilePathConfig@@QAE@KK@Z
??0CExclusionFolderConfig@@QAE@ABV0@@Z
??0CExclusionFolderConfig@@QAE@KK@Z
??0CExclusionRegistryConfig@@QAE@ABV0@@Z
??0CExclusionRegistryConfig@@QAE@KK@Z
??0CFile@@QAE@ABV0@@Z
??0CFile@@QAE@E@Z
??0CFileExtension@@QAE@ABV0@@Z
??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
??0CInclusionExtConfig@@QAE@ABV0@@Z
??0CInclusionExtConfig@@QAE@KKE@Z
??0CInclusionFileNameConfig@@QAE@ABV0@@Z
??0CInclusionFileNameConfig@@QAE@KK@Z
??0CInclusionFilePathConfig@@QAE@ABV0@@Z
??0CInclusionFilePathConfig@@QAE@KK@Z
??0CInclusionFolderConfig@@QAE@ABV0@@Z
??0CInclusionFolderConfig@@QAE@KK@Z
??0CKEvent@@QAE@ABV0@@Z
??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
??0CList@@QAE@ABV0@@Z
??0CList@@QAE@KPAVIMemoryAllocator@@@Z
??0CLockEvent@@QAE@ABV0@@Z
??0CLockEvent@@QAE@XZ
??0CLockList@@QAE@ABV0@@Z
??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QAE@ABV0@@Z
??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
??0CMemoryPoolAllocator@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@XZ
??0CModuleConfigList@@QAE@ABV0@@Z
??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QAE@ABV0@@Z
??0CModuleFileExtConfig@@QAE@KKE@Z
??0CModuleFlagConfig@@QAE@ABV0@@Z
??0CModuleFlagConfig@@QAE@K@Z
??0CModuleMultiStringConfig@@QAE@ABV0@@Z
??0CModuleMultiStringConfig@@QAE@KK@Z
??0CModuleStringConfig@@QAE@ABV0@@Z
??0CModuleStringConfig@@QAE@K@Z
??0CNoLockList@@QAE@ABV0@@Z
??0CNoLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CSmartLock@@QAE@AAVCLockEvent@@@Z
??0CSmartLock@@QAE@XZ
??0CSmartReference@@QAE@AAJ@Z
??0CSmartReference@@QAE@AAK@Z
??0CSmartResource@@QAE@AAVCResource@@E@Z
??0CStrList@@QAE@ABV0@@Z
??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
??0CSystemThread@@QAE@ABV0@@Z
??0CSystemThread@@QAE@K@Z
??0CUserFuncAdapterJob@@QAE@ABV0@@Z
??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z01@Z
??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@E@Z
??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
??0CWorkerThreadJobQueue@@QAE@K@Z
??0CWorkerThreadPool@@QAE@ABV0@@Z
??0CWorkerThreadPool@@QAE@K@Z
??0CWorkerThreadPoolEx@@QAE@ABV0@@Z
??0CWorkerThreadPoolEx@@QAE@KK@Z
??0IMemoryAllocator@@QAE@ABV0@@Z
??0IMemoryAllocator@@QAE@XZ
??1CAutoUpdateConfigThread@@UAE@XZ
??1CBlobConfig@@UAE@XZ
??1CContext@@UAE@XZ
??1CContextList@@UAE@XZ
??1CDebugLog@@UAE@XZ
??1CDebugLogEx@@UAE@XZ
??1CDelayLoadThread@@UAE@XZ
??1CExclusionExtConfig@@UAE@XZ
??1CExclusionFileNameConfig@@UAE@XZ
??1CExclusionFilePathConfig@@UAE@XZ
??1CExclusionFolderConfig@@UAE@XZ
??1CExclusionRegistryConfig@@UAE@XZ
??1CFile@@UAE@XZ
??1CFileExtension@@UAE@XZ
??1CInclusionExtConfig@@UAE@XZ
??1CInclusionFileNameConfig@@UAE@XZ
??1CInclusionFilePathConfig@@UAE@XZ
??1CInclusionFolderConfig@@UAE@XZ
??1CKEvent@@UAE@XZ
??1CList@@UAE@XZ
??1CLockEvent@@UAE@XZ
??1CLockList@@UAE@XZ
??1CMemoryAllocator@@UAE@XZ
??1CMemoryPoolAllocator@@UAE@XZ
??1CModuleConfig@@UAE@XZ
??1CModuleConfigList@@UAE@XZ
??1CModuleFileExtConfig@@UAE@XZ
??1CModuleFlagConfig@@UAE@XZ
??1CModuleMultiStringConfig@@UAE@XZ
??1CModuleStringConfig@@UAE@XZ
??1CNoLockList@@UAE@XZ
??1CSmartLock@@QAE@XZ
??1CSmartReference@@QAE@XZ
??1CSmartResource@@QAE@XZ
??1CStrList@@UAE@XZ
??1CSystemThread@@UAE@XZ
??1CUserFuncAdapterJob@@UAE@XZ
??1CWorkerThread@@UAE@XZ
??1CWorkerThreadJob@@UAE@XZ
??1CWorkerThreadJobQueue@@UAE@XZ
??1CWorkerThreadPool@@UAE@XZ
??1CWorkerThreadPoolEx@@UAE@XZ
??1IMemoryAllocator@@UAE@XZ
??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??2CMemoryAllocator@@SGPAXI@Z
??2CMemoryPoolAllocator@@SGPAXI@Z
??3@YAXPAX@Z
??3@YAXPAXI@Z
??3IMemoryAllocator@@SGXPAX@Z
??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
??4CBlobConfig@@QAEAAV0@ABV0@@Z
??4CContext@@QAEAAV0@ABV0@@Z
??4CDebugLog@@QAEAAV0@ABV0@@Z
??4CDebugLogEx@@QAEAAV0@ABV0@@Z
??4CDelayLoadThread@@QAEAAV0@ABV0@@Z
??4CFile@@QAEAAV0@ABV0@@Z
??4CKEvent@@QAEAAV0@ABV0@@Z
??4CLockEvent@@QAEAAV0@ABV0@@Z
??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
??4CModuleConfig@@QAEAAV0@ABV0@@Z
??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
??4CSmartResource@@QAEAAV0@ABV0@@Z
??4CSystemThread@@QAEAAV0@ABV0@@Z
??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
??4CWorkerThread@@QAEAAV0@ABV0@@Z
??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CDebugLogEx@@6B@
??_7CDelayLoadThread@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CInclusionExtConfig@@6B@
??_7CInclusionFileNameConfig@@6B@
??_7CInclusionFilePathConfig@@6B@
??_7CInclusionFolderConfig@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CNoLockList@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7CWorkerThreadPoolEx@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QAEXXZ
??_FCFile@@QAEXXZ
??_FCFileExtension@@QAEXXZ
??_FCModuleConfigList@@QAEXXZ
??_FCStrList@@QAEXXZ
??_FCSystemThread@@QAEXXZ
??_FCWorkerThread@@QAEXXZ
??_FCWorkerThreadJob@@QAEXXZ
??_FCWorkerThreadJobQueue@@QAEXXZ
??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??_V@YAXPAX@Z
?Acquire@CLockEvent@@QAEXXZ
?Add@CContextList@@QAEEPAVCContext@@@Z
?Add@CFileExtension@@QAEEPBGK@Z
?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
?Add@CStrList@@QAEEPBG@Z
?AddNode@CLockList@@UAEEQAXE@Z
?AddNode@CNoLockList@@UAEEQAXE@Z
?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QAEXXZ
?CheckNode@CLockList@@UAEHQAX@Z
?CheckNode@CNoLockList@@UAEHQAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
?Cleanup@CBlobConfig@@AAEXXZ
?Cleanup@CModuleFileExtConfig@@IAEXXZ
?Cleanup@CModuleMultiStringConfig@@IAEXXZ
?Cleanup@CModuleStringConfig@@AAEXXZ
?Close@CFile@@QAEJXZ
?Count@CLockList@@QAEKXZ
?Count@CNoLockList@@QAEKXZ
?Create@CFile@@QAEJPBGKKKK@Z
?Create@CSystemThread@@QAEEXZ
?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
?CreatePool@CWorkerThreadPool@@QAEEXZ
?CreatePool@CWorkerThreadPoolEx@@QAEEXZ
?CreateThreads@CWorkerThreadPool@@QAEEK@Z
?CreateThreads@CWorkerThreadPoolEx@@QAEEK@Z
?CreateWIRP@CFile@@QAEJPBGKKKK@Z
?Delete@CFile@@QAEJXZ
?Delete@CFileExtension@@QAEEPBGK@Z
?Delete@CStrList@@QAEEPBG@Z
?DeleteAll@CList@@UAEXXZ
?DeleteAll@CLockList@@UAEXXZ
?DeleteAll@CNoLockList@@UAEXXZ
?DeleteNode@CContextList@@MAEXPAX@Z
?DeleteNode@CList@@UAEXPAX@Z
?DeleteNode@CModuleConfigList@@MAEXPAX@Z
?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YGXPAPAX@Z
?DoIt@CWorkerThreadJob@@QAEJXZ
?EntryPoint@CSystemThread@@KGXPAX@Z
?Find@CContextList@@QAEPAVCContext@@K@Z
?Find@CContextList@@QAEPAVCContext@@PAX@Z
?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FindNode@CContextList@@IAEPAXPAX@Z
?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FinishFunction@CUserFuncAdapterJob@@MAEXXZ
?FinishIt@CWorkerThreadJob@@QAEJXZ
?First@CList@@UAEPAXXZ
?First@CLockList@@UAEPAXXZ
?First@CNoLockList@@UAEPAXXZ
?Free@CMemoryAllocator@@UAEXPAX@Z
?Free@CMemoryPoolAllocator@@UAEXPAX@Z
?GetAttributes@CFile@@QAEKXZ
?GetBasicInfomration@CFile@@IAEJXZ
?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
?GetCategory@CContext@@QAEKXZ
?GetData@CBlobConfig@@QAEHPAXPAK@Z
?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QAEKXZ
?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
?GetData@CModuleStringConfig@@QAEPAGXZ
?GetData@CStrList@@QAEEPAGPAK@Z
?GetDataType@CModuleConfig@@QAEKXZ
?GetEngineContext@CContext@@QAEPAXXZ
?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFileSizeWIRP@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UAEJKPAK@Z
?GetID@CModuleConfig@@QAEKXZ
?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QAEKXZ
?GetLinkContext@CContext@@QAEPAXXZ
?GetLogFlag@CDebugLog@@QAEKXZ
?GetLogFlag@CDebugLogEx@@QAEKXZ
?GetModuleId@CModuleConfig@@QAEKXZ
?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_KTHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QAEPAU_KTHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QAEKXZ
?GetSize@CBlobConfig@@QAEKXZ
?GetStringConfig@CContext@@QAEPAGK@Z
?GetStringConfig@CContext@@UAEJKPAGPAK@Z
?GetThreadCount@CWorkerThreadPool@@QAEKXZ
?GetThreadCount@CWorkerThreadPoolEx@@QAEKXZ
?GetThreadID@CSystemThread@@QAEKXZ
?GetType@CContext@@QAEKXZ
?GetUserParameter@CContext@@QAEKXZ
?InitProcMon@CDebugLogEx@@IAEXXZ
?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
?InitializeFlagConfig@CContext@@QAEHKK@Z
?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
?InitializeStringConfig@CContext@@QAEHKPBG@Z
?Insert@CList@@UAEXQAXE@Z
?Insert@CLockList@@UAEXQAXE@Z
?Insert@CNoLockList@@UAEXQAXE@Z
?InsertAfter@CList@@UAEXPAX0@Z
?InsertBefore@CList@@UAEXPAX0@Z
?Instance@CWorkerThreadPool@@SGPAV1@XZ
?IsEmpty@CList@@UAEEXZ
?IsEmpty@CLockList@@UAEEXZ
?IsEmpty@CNoLockList@@UAEEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
?IsFull@CLockList@@QBEEXZ
?IsFull@CNoLockList@@QBEEXZ
?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionExtConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFileNameConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFilePathConfig@@QAEEPBG@Z
?IsInInclusionList@CInclusionFolderConfig@@QAEEPBG@Z
?IsOpened@CFile@@QAEEXZ
?IsTerminated@CWorkerThreadPool@@QAEEXZ
?IsTerminated@CWorkerThreadPoolEx@@QAEEXZ
?IsValid@CMemoryAllocator@@UAEEXZ
?IsValid@CMemoryPoolAllocator@@UAEEXZ
?IsValid@IMemoryAllocator@@UAEEXZ
?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
?IsWorkerThread@CWorkerThreadPoolEx@@QAEEK@Z
?JobFunction@CUserFuncAdapterJob@@MAEXXZ
?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
?JobQueue@CWorkerThreadPoolEx@@QAEAAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QAEKXZ
?Limit@CNoLockList@@QAEKXZ
?MatchAllExtensions@CFileExtension@@QAEEXZ
?MatchNoExtensions@CFileExtension@@QAEEXZ
?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
?NeedDelete@CWorkerThreadJob@@QAEEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
?NewNode@CList@@UAEPAXXZ
?NewNode@CStrList@@EAEPAXXZ
?NewNodeVariant@CList@@IAEPAXK@Z
?Next@CList@@UBEPAXQAX@Z
?Next@CLockList@@UBEPAXQAX@Z
?Next@CNoLockList@@UBEPAXQAX@Z
?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
?NotityTerminate@CWorkerThread@@QAEXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
?PostJobToWorkerThread@CWorkerThreadPoolEx@@QAEJP6GXPAX@Z0E1@Z
?Pulse@CKEvent@@QAEJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPoolEx@@QAEJPAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
?Read@CFile@@QAEJPADKPAK@Z
?ReadWIRP@CFile@@QAEJPADKPAK@Z
?ReferenceCount@CContext@@QAEAAKXZ
?Release@CLockEvent@@QAEXXZ
?Remove@CContextList@@UAEEQAX@Z
?Remove@CList@@UAEEQAX@Z
?Remove@CLockList@@UAEEQAX@Z
?Remove@CNoLockList@@UAEEQAX@Z
?RemoveHead@CList@@UAEPAXXZ
?RemoveHead@CLockList@@UAEPAXXZ
?RemoveHead@CNoLockList@@UAEPAXXZ
?RemoveTail@CList@@UAEPAXXZ
?RemoveTail@CLockList@@UAEPAXXZ
?RemoveTail@CNoLockList@@UAEPAXXZ
?Reset@CKEvent@@QAEXXZ
?ResetData@CInclusionExtConfig@@QAEXXZ
?ResetData@CInclusionFileNameConfig@@QAEXXZ
?ResetData@CInclusionFilePathConfig@@QAEXXZ
?ResetData@CInclusionFolderConfig@@QAEXXZ
?RestoreCR0@@YGXPAX@Z
?Run@CAutoUpdateConfigThread@@UAEXXZ
?Run@CDelayLoadThread@@UAEXXZ
?Run@CWorkerThread@@UAEXXZ
?SeekToEnd@CFile@@QAEJXZ
?Set@CKEvent@@QAEJJE@Z
?SetAttributes@CFile@@QAEJK@Z
?SetBlobCofig@CContext@@UAEJKPAXK@Z
?SetData@CBlobConfig@@QAEHPAXK@Z
?SetData@CModuleFileExtConfig@@QAEHPBG@Z
?SetData@CModuleFlagConfig@@QAEHK@Z
?SetData@CModuleMultiStringConfig@@QAEHPBGK@Z
?SetData@CModuleStringConfig@@QAEHPBG@Z
?SetEngineContext@CContext@@QAEXPAX@Z
?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
?SetFlagConfig@CContext@@UAEJKK@Z
?SetLinkContext@CContext@@QAEXPAX@Z
?SetLogFlag@CDebugLog@@QAEEK@Z
?SetLogFlag@CDebugLogEx@@QAEEK@Z
?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
?SetMultiStringConfig@CContext@@UAEJKPBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
?SetPriority@CSystemThread@@QAEXK@Z
?SetStopUse@CContext@@QAEXXZ
?SetStringConfig@CContext@@UAEJKPBG@Z
?Setup@CSystemThread@@MAEXXZ
?StopUse@CContext@@QAEHXZ
?TearDown@CSystemThread@@MAEXXZ
?Terminate@CSystemThread@@QAEXE@Z
?Terminate@CWorkerThreadPool@@QAEEXZ
?Terminate@CWorkerThreadPoolEx@@QAEEXZ
?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QAEXXZ
?WaitForInit@CDelayLoadThread@@QAEEXZ
?WaitForLoad@CDelayLoadThread@@QAEEXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
?WaitQueueEmpty@CWorkerThreadJobQueue@@QAEXXZ
?Write@CDebugLog@@QAAXPBDZZ
?Write@CDebugLogEx@@QAAXPBDZZ
?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
?WriteDataToFile@CDebugLogEx@@IAEXPADK@Z
?WriteDataToProcMonW@CDebugLogEx@@IAEXPAD@Z
?WriteSystemInformation@CDebugLog@@QAEXXZ
?WriteSystemInformation@CDebugLogEx@@QAEXXZ
?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
?WriteSystemStringInformation@CDebugLogEx@@IAEXPBG@Z
?WriteToFile@CDebugLog@@IAEXPADK@Z
?WriteToProcMonW@CDebugLogEx@@IAEXPAU_UNICODE_STRING@@@Z
?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
?_pPagedAllocator@@3PAVCMemoryAllocator@@A
?m_lpInstance@CWorkerThreadPool@@1PAV1@A
?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
_AllocFullFileName@8
_DeInitKm2UmCommunication@0
_DeInitKmLPC@0
_DuplicateFullFileName@4
_FreeFullFileName@4
_GetKm2UmMode@0
_GetModuleInfoByAddress@8
_GetModuleInfoByModuleName@8
_InitKm2UmCommunication@8
_InitKmLPC@0
_IsVerifierCodeCheckFlagOn@0
_IsWindows8_1_update@4
_KmCallUm@8
_KmCallUmByLPC@8
_KmCallUmEx@12
_KmCleanupCommPortAPIs@0
_KmGetUmInitProcess@0
_KmSetBackupCommPortAPIs@4
_KmSetCommPortAPIs@4
_ModGetExportProcAddress@8
_ModLoadDLLToBuffer@4
_ModLoadDLLToBufferWithImageSize@8
_ModLoadModule@8
_ModUnLoadModule@4
_NormalizeFileName@4
_NormalizeFullNtPathToDosName@4
_TmCommConfigRoutine@4
_UtilAddDeviceInDriveTable@4
_UtilAddReparsePointMapping@8
_UtilCleanFileReadOnly@4
_UtilCloseExclusiveHandle@12
_UtilCreateDosFileName@8
_UtilDeleteFileForce@4
_UtilGetDeviceObjectName@8
_UtilGetFileNameFromFileObject@4
_UtilGetFileObjectForProcessByEPROC@8
_UtilGetFileObjectFromFileName@12
_UtilGetProcessName@12
_UtilGetSystemDirectory@4
_UtilGetSystemDirectoryEx@0
_UtilGetSystemDirectoryLength@0
_UtilGetSystemTime@4
_UtilIoSetFileInfo@24
_UtilIopCreateFileIRP@40
_UtilKeGetLowFileDevice@16
_UtilModuleIATHook@24
_UtilModuleIATUnHook@8
_UtilPostJobToWorkerThread@12
_UtilQueryExclusiveHandle@12
_UtilQueryKeyValue@24
_UtilRemoveDeviceFromDriveTable@4
_UtilVolumeDeviceToDosName@8
_UtilWaitValueChangeToZero@8
_UtilWriteVersionToRegistry@8
_UtilbuildDynamicDiskMappingTable@0
_UtlWriteBinValueKeyToRegistry@16
_ValidateAddressWithSize@20
__ResetProtectFromClose@4
__UtilDosPathNameToNtPathName@12

Sections

Expand

.text
.rdata
.data
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2009-07-06 00:10:25
MD5	949ef0df929a71d6cc77494dfcb1ddeb
SHA1	a34adabde63514e1916713a588905c4019f83efb
SHA256	ed2f33452ec32830ffef2d5dc832985db9600c306ed890c47f3f33ccbb335c39
Authentihash MD5	aa72488d023f12e4252ac8c34499bc3c
Authentihash SHA1	f3beb6685e5b2a2492d1da242c6e1e15a32b1c4f
Authentihash SHA256	a4a7794cdb933d71f57cf9f31188c1152bdc9fc429e17a84c4f639942965311d
RichPEHeaderHash MD5	2c7538db9e2150b157db62468368078c
RichPEHeaderHash SHA1	1a6a54134b5ce1388022fe473d7c6e62378f141f
RichPEHeaderHash SHA256	959224dcc6d4785f77422ee227d14464e7b63c0f034b04c474ee3b9ef658eaeb
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	Trend Micro AEGIS
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 3825d7faf861af9ef490e726b5d65ad5

Field	Value
ToBeSigned (TBS) MD5	d6c7684e9aaa508cf268335f83afe040
ToBeSigned (TBS) SHA1	18066d20ad92409c567cdfde745279ff71c75226
ToBeSigned (TBS) SHA256	a612fb22ce8be6dab75e47c98508f98496583e79c9c97b936a8caee9ea9f3fff
Subject	C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services Signer , G2
ValidFrom	2007-06-15 00:00:00
ValidTo	2012-06-14 23:59:59
Signature	50c54bc82480dfe40d24c2de1ab1a102a1a6822d0c831581370a820e2cb05a1761b5d805fe88dbf19191b3561a40a6eb92be3839b07536743a984fe437ba9989ca95421db0b9c7a08d57e0fad5640442354e01d133a217c84daa27c7f2e1864c02384d8378c6fc53e0ebe00687dda4969e5e0c98e2a5bebf8285c360e1dfad28d8c7a54b64dac71b5bbdac3908d53822a1338b2f8a9aebbc07213f44410907b5651c24bc48d34480eba1cfc902b414cf54c716a3805cf9793e5d727d88179e2c43a2ca53ce7d3df62a3ab84f9400a56d0a835df95e53f418b3570f70c3fbf5ad95a00e17dec4168060c90f2b6e8604f1ebf47827d105c5ee345b5eb94932f233
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	3825d7faf861af9ef490e726b5d65ad5
Version	3

Certificate 47bf1995df8d524643f7db6d480d31a4

Field	Value
ToBeSigned (TBS) MD5	518d2ea8a21e879c942d504824ac211c
ToBeSigned (TBS) SHA1	21ce87d827077e61abddf2beba69fde5432ea031
ToBeSigned (TBS) SHA256	1ec3b4f02e03930a470020e0e48d24b84678bb558f46182888d870541f5e25c7
Subject	C=US, O=VeriSign, Inc., CN=VeriSign Time Stamping Services CA
ValidFrom	2003-12-04 00:00:00
ValidTo	2013-12-03 23:59:59
Signature	4a6bf9ea58c2441c318979992b96bf82ac01d61c4ccdb08a586edf0829a35ec8ca9313e704520def47272f0038b0e4c9934e9ad4226215f73f37214f703180f18b3887b3e8e89700fecf55964e24d2a9274e7aaeb76141f32acee7c9d95eddbb2b853eb59db5d9e157ffbeb4c57ef5cf0c9ef097fe2bd33b521b1b3827f73f4a
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	47bf1995df8d524643f7db6d480d31a4
Version	3

Certificate 4191a15a3978dfcf496566381d4c75c2

Field	Value
ToBeSigned (TBS) MD5	41011f8d0e7c7a6408334ca387914c61
ToBeSigned (TBS) SHA1	c7fc1727f5b75a6421a1f95c73bbdb23580c48e5
ToBeSigned (TBS) SHA256	88dd3952638ee82738c03168e6fd863fe4eab1059ee5e2926ad8cb587c255dc0
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)04, CN=VeriSign Class 3 Code Signing 2004 CA
ValidFrom	2004-07-16 00:00:00
ValidTo	2014-07-15 23:59:59
Signature	ae3a17b84a7b55fa6455ec40a4ed494190999c89bcaf2e1dca7823f91c190f7feb68bc32d98838dedc3fd389b43fb18296f1a45abaed2e26d3de7c016e000a00a4069211480940f91c1879672324e0bbd5e150ae1bf50edde02e81cd80a36c524f9175558aba22f2d2ea4175882f63557d1e545a9559cad93481c05f5ef67ab5
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	4191a15a3978dfcf496566381d4c75c2
Version	3

Certificate 645212f783f4d7aba3555729e99ce065

Field	Value
ToBeSigned (TBS) MD5	e00f0a38c65f7c0b9f19b97448d6a0e3
ToBeSigned (TBS) SHA1	91c033a2f289418c4101654dceacef1b25bb55d0
ToBeSigned (TBS) SHA256	38b3fcbdb734b0e3439f3c9a3c4c1712091f577d2b616d41224137faf7ba7c86
Subject	C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., OU=Digital ID Class 3 , Microsoft Software Validation v2, OU=RD, CN=Trend Micro, Inc.
ValidFrom	2008-01-16 00:00:00
ValidTo	2011-02-16 23:59:59
Signature	5a693868cea6ba49064b801a0d9e12887a37cbb92cca2950cc5e99c2df9aec5697422e67cd042836daf09a09e739f625255841fed1ec9657cb8b3edc08c55c302574cbdb3f7de2798ed769d766402619b48041f9d90f8c904488788412b1c632055e1afc4a5bbac642cb626bd20fece0feaa6cf9b287887788cf64586309a14a644b5f0595c0ddcb7d789831faedb48451e40e342da4ccbc38a5e992e57e7ce5328d531a8c68e61f9dc9be65605c1bedf3358579000b91a19b3be388bac36b58ca76b72358bd8e74e0a7b08b0587bb7a29758c01af40b80e8e72c76abd3a2babfe7c1ed6e7b1cd9b0221a605062b6d9d0ceb57e0eb305fdc5eb5bf6ea442f4c9
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	645212f783f4d7aba3555729e99ce065
Version	3

Certificate 610c120600000000001b

Field	Value
ToBeSigned (TBS) MD5	53c41bc1164e09e0cd1617a5bf913efd
ToBeSigned (TBS) SHA1	93c03aac8951d494ecd5696b1c08658541b18727
ToBeSigned (TBS) SHA256	40bddadac24dc61ca4fb5cab2a2bc5d876bc36808311039a7a3e1a4066f7489b
Subject	C=US, O=VeriSign, Inc., OU=Class 3 Public Primary Certification Authority
ValidFrom	2006-05-23 17:01:29
ValidTo	2016-05-23 17:11:29
Signature	01e446b33b457f7513877e5f43de468ecb8abdb64741bccccc7491d8ce395195a4a6b547c0efd2da7b8f5711f4328c7ccd3fee42da04214af7c843884a6f5cca14fc4bd19f4cbdd4556ecc02be0da6888f8609baa425bde8b0f0fa8b714e67b0cb82a8d78e55f737ebf03e88efe4e08afd1c6e2e61414875b4b02c1d28d8490fd715f02473253ccc880cde284c6554fe5eae8cea19ad2c51b29b3a47f53c80350117e24987d6544afb4bab07bcbf7d79cfbf35005cbb9ecffc82891b39a05197b6dec0b307ff449644c0342a195cabeef03bec294eb513c537857e75d5b4d60d066eb5d26c237167eaf1718eaf4e74aa0cf9ecbf4c58fa5e909b6d39cb86883f8b1ca81632d5fe6db9f1f8b3ead791f6364778c0272a15c768d6f4c5fc4f4ec8673f102d409ff11ec96148e7a703fc31730cf04688fe56da492995ef09daa3e5beef60ecd954a0599c28bd54ef66157f874c84dba60e95672e517b3439b641c28c846826dc240209e7818e0a972defeea7b998a60f818dc710b5e1ed982f486f53854964789bec5dac970b5526c3efba8dc8d1a52f5a7f936b611a339b18b8a26210de24ea76e12f43ebecdd7c12342489da2855aee5754e312b6763b6a8d7ab730a03cec5ea593fc7eb2a45aea8625b2f009939abb45f73c308ec80118f470e8f2a1343e191066255bbffba3da9a93d260faeca7d628b155589d694344dd665
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	610c120600000000001b
Version	3

Imports

Expand

ntoskrnl.exe
HAL.dll
CLASSPNP.SYS

Imported Functions

Expand

ExReleaseFastMutexUnsafe
wcsncpy
memcpy
wcsrchr
KeSetEvent
KePulseEvent
KeClearEvent
KeInitializeSemaphore
KeWaitForSingleObject
DbgPrint
KeReleaseSemaphore
RtlSubAuthoritySid
RtlInitializeSid
ExAllocatePoolWithTag
RtlLengthRequiredSid
ExFreePoolWithTag
RtlSetDaclSecurityDescriptor
RtlCreateSecurityDescriptor
RtlAddAccessAllowedAce
RtlCreateAcl
ObfDereferenceObject
ZwSetEvent
ZwClose
KeUnstackDetachProcess
ZwRequestWaitReplyPort
memmove
KeStackAttachProcess
ZwConnectPort
RtlInitUnicodeString
ZwCreateSection
ZwWaitForSingleObject
ZwOpenEvent
ObfReferenceObject
IoGetCurrentProcess
memset
MmIsAddressValid
ZwWriteFile
ZwReadFile
ZwQueryInformationFile
ZwSetInformationFile
ZwCreateFile
swprintf
towupper
_wcsnicmp
KeInitializeEvent
_snprintf
PsGetCurrentProcessId
RtlTimeToTimeFields
ExSystemTimeToLocalTime
KeQuerySystemTime
ZwCreateKey
ZwCreateEvent
KeWaitForMultipleObjects
ObReferenceObjectByHandle
ZwNotifyChangeKey
PsGetCurrentThreadId
_vsnprintf
KeSetPriorityThread
PsTerminateSystemThread
PsCreateSystemThread
KeNumberProcessors
ZwQuerySystemInformation
ZwQueryDirectoryFile
ZwOpenDirectoryObject
ZwQueryDirectoryObject
ZwDuplicateObject
ZwOpenKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryValueKey
ZwDeleteValueKey
ZwDeleteKey
ExGetPreviousMode
ZwTerminateProcess
KeLeaveCriticalRegion
PsProcessType
ZwOpenProcess
ZwQueryKey
ZwSetValueKey
IoFreeIrp
_purecall
MmUnlockPages
IoBuildAsynchronousFsdRequest
ProbeForWrite
_strnicmp
RtlQueryRegistryValues
RtlAppendUnicodeToString
KeDelayExecutionThread
mbstowcs
ZwQuerySymbolicLinkObject
ZwOpenSymbolicLinkObject
NtClose
ZwSetInformationObject
_stricmp
ZwUnmapViewOfSection
ZwMapViewOfSection
ZwOpenFile
RtlEqualUnicodeString
IoFileObjectType
IoCreateFile
IofCallDriver
IoAllocateIrp
MmBuildMdlForNonPagedPool
IoAllocateMdl
PsGetVersion
MmGetSystemRoutineAddress
RtlCompareMemory
RtlCopyUnicodeString
RtlImageNtHeader
PsLookupProcessByProcessId
RtlFreeUnicodeString
RtlAnsiStringToUnicodeString
RtlInitAnsiString
strrchr
KeBugCheckEx
RtlAppendUnicodeStringToString
IofCompleteRequest
ExEventObjectType
IoDeleteDevice
IoDeleteSymbolicLink
IoCreateSymbolicLink
ProbeForRead
IoGetDeviceObjectPointer
RtlUpperChar
RtlCompareUnicodeString
strncpy
KeServiceDescriptorTable
NtOpenProcess
ObReferenceObjectByPointer
MmSectionObjectType
ObQueryNameString
ObOpenObjectByName
IoDriverObjectType
NtQueryInformationProcess
_snwprintf
KeAddSystemServiceTable
ZwQueryObject
ZwQuerySecurityObject
ObInsertObject
_allrem
IoReleaseVpbSpinLock
IoAcquireVpbSpinLock
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
KeTickCount
RtlUnwind
KeEnterCriticalRegion
ObOpenObjectByPointer
ExAcquireFastMutexUnsafe
ZwSetSecurityObject
IoDeviceObjectType
IoCreateDevice
RtlGetDaclSecurityDescriptor
RtlGetSaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
RtlLengthSecurityDescriptor
SeCaptureSecurityDescriptor
SeExports
IoIsWdmVersionAvailable
RtlLengthSid
wcschr
RtlAbsoluteToSelfRelativeSD
IoFreeMdl
KeGetCurrentThread
KfLowerIrql
KeRaiseIrqlToDpcLevel
ClassInitialize

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QAE@ABV0@@Z
??0CAutoUpdateConfigThread@@QAE@PAU_UNICODE_STRING@@P6GX0PAX@Z1@Z
??0CBlobConfig@@QAE@ABV0@@Z
??0CBlobConfig@@QAE@K@Z
??0CContext@@QAE@ABV0@@Z
??0CContext@@QAE@KP6GJPAU_EVENT_REPORT@@PAXPAU_TMCE_REPORT@@PAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QAE@ABV0@@Z
??0CContextList@@QAE@KPAVIMemoryAllocator@@@Z
??0CDebugLog@@QAE@ABV0@@Z
??0CDebugLog@@QAE@PBG@Z
??0CExclusionExtConfig@@QAE@ABV0@@Z
??0CExclusionExtConfig@@QAE@KKE@Z
??0CExclusionFileNameConfig@@QAE@ABV0@@Z
??0CExclusionFileNameConfig@@QAE@KK@Z
??0CExclusionFilePathConfig@@QAE@ABV0@@Z
??0CExclusionFilePathConfig@@QAE@KK@Z
??0CExclusionFolderConfig@@QAE@ABV0@@Z
??0CExclusionFolderConfig@@QAE@KK@Z
??0CExclusionRegistryConfig@@QAE@ABV0@@Z
??0CExclusionRegistryConfig@@QAE@KK@Z
??0CFile@@QAE@ABV0@@Z
??0CFile@@QAE@E@Z
??0CFileExtension@@QAE@ABV0@@Z
??0CFileExtension@@QAE@KEEPAVIMemoryAllocator@@@Z
??0CKEvent@@QAE@ABV0@@Z
??0CKEvent@@QAE@W4_EVENT_TYPE@@E@Z
??0CList@@QAE@ABV0@@Z
??0CList@@QAE@KPAVIMemoryAllocator@@@Z
??0CLockEvent@@QAE@ABV0@@Z
??0CLockEvent@@QAE@XZ
??0CLockList@@QAE@ABV0@@Z
??0CLockList@@QAE@KKPAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IAE@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QAE@ABV0@@Z
??0CMemoryPoolAllocator@@IAE@W4_POOL_TYPE@@KKK@Z
??0CMemoryPoolAllocator@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@ABV0@@Z
??0CModuleConfig@@QAE@XZ
??0CModuleConfigList@@QAE@ABV0@@Z
??0CModuleConfigList@@QAE@KPAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QAE@ABV0@@Z
??0CModuleFileExtConfig@@QAE@KKE@Z
??0CModuleFlagConfig@@QAE@ABV0@@Z
??0CModuleFlagConfig@@QAE@K@Z
??0CModuleMultiStringConfig@@QAE@ABV0@@Z
??0CModuleMultiStringConfig@@QAE@KK@Z
??0CModuleStringConfig@@QAE@ABV0@@Z
??0CModuleStringConfig@@QAE@K@Z
??0CSmartLock@@QAE@AAVCLockEvent@@@Z
??0CSmartLock@@QAE@XZ
??0CSmartReference@@QAE@AAJ@Z
??0CSmartReference@@QAE@AAK@Z
??0CStrList@@QAE@ABV0@@Z
??0CStrList@@QAE@KPAVIMemoryAllocator@@@Z
??0CSystemThread@@QAE@ABV0@@Z
??0CSystemThread@@QAE@K@Z
??0CUserFuncAdapterJob@@QAE@ABV0@@Z
??0CUserFuncAdapterJob@@QAE@P6GXPAX@Z0@Z
??0CWorkerThread@@IAE@PAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@ABV0@@Z
??0CWorkerThreadJob@@QAE@E@Z
??0CWorkerThreadJobQueue@@QAE@ABV0@@Z
??0CWorkerThreadJobQueue@@QAE@K@Z
??0CWorkerThreadPool@@QAE@ABV0@@Z
??0CWorkerThreadPool@@QAE@K@Z
??0IMemoryAllocator@@QAE@ABV0@@Z
??0IMemoryAllocator@@QAE@XZ
??1CAutoUpdateConfigThread@@UAE@XZ
??1CBlobConfig@@UAE@XZ
??1CContext@@UAE@XZ
??1CContextList@@UAE@XZ
??1CDebugLog@@UAE@XZ
??1CExclusionExtConfig@@UAE@XZ
??1CExclusionFileNameConfig@@UAE@XZ
??1CExclusionFilePathConfig@@UAE@XZ
??1CExclusionFolderConfig@@UAE@XZ
??1CExclusionRegistryConfig@@UAE@XZ
??1CFile@@UAE@XZ
??1CFileExtension@@UAE@XZ
??1CKEvent@@UAE@XZ
??1CList@@UAE@XZ
??1CLockEvent@@UAE@XZ
??1CLockList@@UAE@XZ
??1CMemoryAllocator@@UAE@XZ
??1CMemoryPoolAllocator@@UAE@XZ
??1CModuleConfig@@UAE@XZ
??1CModuleConfigList@@UAE@XZ
??1CModuleFileExtConfig@@UAE@XZ
??1CModuleFlagConfig@@UAE@XZ
??1CModuleMultiStringConfig@@UAE@XZ
??1CModuleStringConfig@@UAE@XZ
??1CSmartLock@@QAE@XZ
??1CSmartReference@@QAE@XZ
??1CStrList@@UAE@XZ
??1CSystemThread@@UAE@XZ
??1CUserFuncAdapterJob@@UAE@XZ
??1CWorkerThread@@UAE@XZ
??1CWorkerThreadJob@@UAE@XZ
??1CWorkerThreadJobQueue@@UAE@XZ
??1CWorkerThreadPool@@UAE@XZ
??1IMemoryAllocator@@UAE@XZ
??2@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??2CMemoryAllocator@@SGPAXI@Z
??2CMemoryPoolAllocator@@SGPAXI@Z
??3@YAXPAX@Z
??3IMemoryAllocator@@SGXPAX@Z
??4CAutoUpdateConfigThread@@QAEAAV0@ABV0@@Z
??4CBlobConfig@@QAEAAV0@ABV0@@Z
??4CContext@@QAEAAV0@ABV0@@Z
??4CDebugLog@@QAEAAV0@ABV0@@Z
??4CFile@@QAEAAV0@ABV0@@Z
??4CKEvent@@QAEAAV0@ABV0@@Z
??4CLockEvent@@QAEAAV0@ABV0@@Z
??4CMemoryAllocator@@QAEAAV0@ABV0@@Z
??4CMemoryPoolAllocator@@QAEAAV0@ABV0@@Z
??4CModuleConfig@@QAEAAV0@ABV0@@Z
??4CModuleFlagConfig@@QAEAAV0@ABV0@@Z
??4CModuleStringConfig@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEAAV0@ABV0@@Z
??4CSmartLock@@QAEABV0@AAVCLockEvent@@@Z
??4CSystemThread@@QAEAAV0@ABV0@@Z
??4CUserFuncAdapterJob@@QAEAAV0@ABV0@@Z
??4CWorkerThread@@QAEAAV0@ABV0@@Z
??4CWorkerThreadJob@@QAEAAV0@ABV0@@Z
??4IMemoryAllocator@@QAEAAV0@ABV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QAEXXZ
??_FCFile@@QAEXXZ
??_FCFileExtension@@QAEXXZ
??_FCModuleConfigList@@QAEXXZ
??_FCStrList@@QAEXXZ
??_FCSystemThread@@QAEXXZ
??_FCWorkerThread@@QAEXXZ
??_FCWorkerThreadJob@@QAEXXZ
??_FCWorkerThreadJobQueue@@QAEXXZ
??_U@YAPAXIPAVIMemoryAllocator@@PBDK@Z
??_V@YAXPAX@Z
?Acquire@CLockEvent@@QAEXXZ
?Add@CContextList@@QAEEPAVCContext@@@Z
?Add@CFileExtension@@QAEEPBGK@Z
?Add@CModuleConfigList@@QAEEPAVCModuleConfig@@@Z
?Add@CStrList@@QAEEPBG@Z
?AddNode@CLockList@@UAEEQAXE@Z
?Alloc@CMemoryAllocator@@UAEPAXKPBDK@Z
?Alloc@CMemoryPoolAllocator@@UAEPAXKPBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IAEPAXK@Z
?AttachJobQueue@CWorkerThread@@QAEXPAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QAEXXZ
?CheckNode@CLockList@@UAEHQAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QAEXXZ
?Cleanup@CBlobConfig@@AAEXXZ
?Cleanup@CModuleFileExtConfig@@IAEXXZ
?Cleanup@CModuleMultiStringConfig@@IAEXXZ
?Cleanup@CModuleStringConfig@@AAEXXZ
?Close@CFile@@QAEJXZ
?Count@CLockList@@QAEKXZ
?Create@CFile@@QAEJPBGKKKK@Z
?Create@CSystemThread@@QAEEXZ
?CreateInstance@CMemoryAllocator@@SGPAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SGPAV1@W4_POOL_TYPE@@KKK@Z
?CreatePool@CWorkerThreadPool@@QAEEXZ
?CreateThreads@CWorkerThreadPool@@QAEEK@Z
?CreateWIRP@CFile@@QAEJPBGKKKK@Z
?Delete@CFile@@QAEJXZ
?Delete@CFileExtension@@QAEEPBGK@Z
?Delete@CStrList@@QAEEPBG@Z
?DeleteAll@CList@@UAEXXZ
?DeleteAll@CLockList@@UAEXXZ
?DeleteNode@CContextList@@MAEXPAX@Z
?DeleteNode@CList@@UAEXPAX@Z
?DeleteNode@CModuleConfigList@@MAEXPAX@Z
?DeleteNode@CStrList@@EAEXPAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YGXPAPAX@Z
?DoIt@CWorkerThreadJob@@QAEJXZ
?EntryPoint@CSystemThread@@KGXPAX@Z
?Find@CContextList@@QAEPAVCContext@@K@Z
?Find@CContextList@@QAEPAVCContext@@PAX@Z
?Find@CFileExtension@@QAEPAU_STR_LIST_NODE@CStrList@@PBGK@Z
?Find@CModuleConfigList@@QAEPAVCModuleConfig@@K@Z
?Find@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?FindNode@CContextList@@IAEPAXPAX@Z
?FindPartiallyAndAllMatch@CStrList@@QAEPAU_STR_LIST_NODE@1@PBG@Z
?First@CList@@UAEPAXXZ
?First@CLockList@@UAEPAXXZ
?Free@CMemoryAllocator@@UAEXPAX@Z
?Free@CMemoryPoolAllocator@@UAEXPAX@Z
?GetAttributes@CFile@@QAEKXZ
?GetBasicInfomration@CFile@@IAEJXZ
?GetBlobCofig@CContext@@UAEJKPAXPAK@Z
?GetCategory@CContext@@QAEKXZ
?GetData@CBlobConfig@@QAEHPAXPAK@Z
?GetData@CModuleFileExtConfig@@QAEHPAGPAK@Z
?GetData@CModuleFileExtConfig@@QAEPAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QAEKXZ
?GetData@CModuleMultiStringConfig@@QAEHPAGPAK@Z
?GetData@CModuleMultiStringConfig@@QAEPAVCStrList@@XZ
?GetData@CModuleStringConfig@@QAEPAGXZ
?GetData@CStrList@@QAEEPAGPAK@Z
?GetDataType@CModuleConfig@@QAEKXZ
?GetEngineContext@CContext@@QAEPAXXZ
?GetFBCallBackRoutine@CContext@@QAEKXZ
?GetFileExtensionConfig@CContext@@QAEPAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UAEJKPAGPAK@Z
?GetFileSize@CFile@@QAEJPAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UAEJKPAK@Z
?GetID@CModuleConfig@@QAEKXZ
?GetJob@CWorkerThreadJobQueue@@QAEPAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QAEKXZ
?GetLinkContext@CContext@@QAEPAXXZ
?GetLogFlag@CDebugLog@@QAEKXZ
?GetModuleId@CModuleConfig@@QAEKXZ
?GetMultiStringConfig@CContext@@QAEPAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UAEJKPAGPAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QAEPAU_ETHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QAEKXZ
?GetSize@CBlobConfig@@QAEKXZ
?GetStringConfig@CContext@@QAEPAGK@Z
?GetStringConfig@CContext@@UAEJKPAGPAK@Z
?GetThreadCount@CWorkerThreadPool@@QAEKXZ
?GetThreadID@CSystemThread@@QAEKXZ
?GetType@CContext@@QAEKXZ
?GetUserParameter@CContext@@QAEKXZ
?InitializeBlobConfig@CContext@@QAEHKPAXK@Z
?InitializeFileExtensionConfig@CContext@@QAEHKPBG@Z
?InitializeFlagConfig@CContext@@QAEHKK@Z
?InitializeMultiStringConfig@CContext@@QAEHKPBG@Z
?InitializeStringConfig@CContext@@QAEHKPBG@Z
?Insert@CList@@UAEXQAXE@Z
?Insert@CLockList@@UAEXQAXE@Z
?InsertAfter@CList@@UAEXPAX0@Z
?InsertBefore@CList@@UAEXPAX0@Z
?Instance@CWorkerThreadPool@@SGPAV1@XZ
?IsEmpty@CList@@UAEEXZ
?IsEmpty@CLockList@@UAEEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IAEEK@Z
?IsFull@CLockList@@QBEEXZ
?IsInExclusionList@CExclusionExtConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QAEEPBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QAEEPBG@Z
?IsOpened@CFile@@QAEEXZ
?IsTerminated@CWorkerThreadPool@@QAEEXZ
?IsValid@CMemoryAllocator@@UAEEXZ
?IsValid@CMemoryPoolAllocator@@UAEEXZ
?IsValid@IMemoryAllocator@@UAEEXZ
?IsWorkerThread@CWorkerThreadPool@@QAEEK@Z
?JobFunction@CUserFuncAdapterJob@@MAEXXZ
?JobQueue@CWorkerThreadPool@@QAEAAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QAEKXZ
?MatchAllExtensions@CFileExtension@@QAEEXZ
?MatchNoExtensions@CFileExtension@@QAEEXZ
?MergeLeft@CMemoryPoolAllocator@@IAEPAXPAX@Z
?MergeRight@CMemoryPoolAllocator@@IAEPAXPAX@Z
?NeedDelete@CWorkerThreadJob@@QAEEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QAEXE@Z
?NewNode@CList@@UAEPAXXZ
?NewNode@CStrList@@EAEPAXXZ
?NewNodeVariant@CList@@IAEPAXK@Z
?Next@CList@@UBEPAXQAX@Z
?Next@CLockList@@UBEPAXQAX@Z
?NextPool@CMemoryPoolAllocator@@QAEPAV1@XZ
?NotityTerminate@CWorkerThread@@QAEXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QAEJP6GXPAX@Z0E@Z
?Pulse@CKEvent@@QAEJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QAEEPAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QAEJPAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SGPAV1@XZ
?Read@CFile@@QAEJPADKPAK@Z
?ReferenceCount@CContext@@QAEAAKXZ
?Release@CLockEvent@@QAEXXZ
?Remove@CContextList@@UAEEQAX@Z
?Remove@CList@@UAEEQAX@Z
?Remove@CLockList@@UAEEQAX@Z
?RemoveHead@CList@@UAEPAXXZ
?RemoveHead@CLockList@@UAEPAXXZ
?RemoveTail@CList@@UAEPAXXZ
?RemoveTail@CLockList@@UAEPAXXZ
?Reset@CKEvent@@QAEXXZ
?RestoreCR0@@YGXPAX@Z
?Run@CAutoUpdateConfigThread@@UAEXXZ
?Run@CWorkerThread@@UAEXXZ
?SeekToEnd@CFile@@QAEJXZ
?Set@CKEvent@@QAEJJE@Z
?SetAttributes@CFile@@QAEJK@Z
?SetBlobCofig@CContext@@UAEJKPAXK@Z
?SetData@CBlobConfig@@QAEHPAXK@Z
?SetData@CModuleFileExtConfig@@QAEHPBG@Z
?SetData@CModuleFlagConfig@@QAEHK@Z
?SetData@CModuleMultiStringConfig@@QAEHPBG@Z
?SetData@CModuleStringConfig@@QAEHPBG@Z
?SetEngineContext@CContext@@QAEXPAX@Z
?SetFileExtensionConfig@CContext@@UAEJKPBG@Z
?SetFlagConfig@CContext@@UAEJKK@Z
?SetLinkContext@CContext@@QAEXPAX@Z
?SetLogFlag@CDebugLog@@QAEEK@Z
?SetMatchAllExtensions@CFileExtension@@QAEXE@Z
?SetMatchNoExtensions@CFileExtension@@QAEXE@Z
?SetMultiStringConfig@CContext@@UAEJKPBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QAEXXZ
?SetPriority@CSystemThread@@QAEXK@Z
?SetStopUse@CContext@@QAEXXZ
?SetStringConfig@CContext@@UAEJKPBG@Z
?Setup@CSystemThread@@MAEXXZ
?StopUse@CContext@@QAEHXZ
?TearDown@CSystemThread@@MAEXXZ
?Terminate@CSystemThread@@QAEXE@Z
?Terminate@CWorkerThreadPool@@QAEEXZ
?TmExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QAEJPAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QAEXXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QAEEXZ
?Write@CDebugLog@@QAAXPBDZZ
?Write@CFile@@QAEJPADKPAT_LARGE_INTEGER@@PAK@Z
?WriteSystemInformation@CDebugLog@@QAEXXZ
?WriteSystemStringInformation@CDebugLog@@IAEXPBG@Z
?WriteToFile@CDebugLog@@IAEXPADK@Z
?_pNonPagedAllocator@@3PAVCMemoryAllocator@@A
?_pPagedAllocator@@3PAVCMemoryAllocator@@A
?m_lpInstance@CWorkerThreadPool@@1PAV1@A
?m_lpRCMInstance@CWorkerThreadPool@@1PAV1@A
_DeInitKmLPC@0
_GetModuleInfoByAddress@8
_GetModuleInfoByModuleName@8
_InitKmLPC@0
_KmCallUm@8
_ModGetExportProcAddress@8
_ModLoadDLLToBuffer@4
_ModLoadModule@8
_ModUnLoadModule@4
_NormalizeFileName@4
_NormalizeFullNtPathToDosName@4
_TmCommConfigRoutine@4
_UtilCleanFileReadOnly@4
_UtilDeleteFileForce@4
_UtilGetFileObjectForProcessByEPROC@8
_UtilGetFileObjectFromFileName@12
_UtilGetProcessName@12
_UtilGetSystemTime@4
_UtilIoSetFileInfo@24
_UtilIopCreateFileIRP@40
_UtilKeGetLowFileDevice@16
_UtilModuleIATHook@24
_UtilModuleIATUnHook@8
_UtilQueryKeyValue@24
_UtilVolumeDeviceToDosName@8
_UtilWaitValueChangeToZero@8
_UtilWriteVersionToRegistry@8
_UtilbuildDynamicDiskMappingTable@0
__UtilDosPathNameToNtPathName@12

Sections

Expand

.text
.rdata
.data
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2016-08-01 21:07:52
MD5	d6b259b2dfe80bdf4d026063accd752c
SHA1	0adc1320421f02f2324e764aa344018758514436
SHA256	ee3ff12943ced401e2b6df9e66e8a0be8e449fa9326cab241f471b2d8ffefdd7
Authentihash MD5	451feb7fca0b5d5816babd65d34074c4
Authentihash SHA1	84913e5e61158fa8ff45dffb4e60cd589a9e69a9
Authentihash SHA256	03192bacd96989bad4181609295764f61a86d2ec9f7918a90a219e674ae3097f
RichPEHeaderHash MD5	f24ab92249f890976db4810956894104
RichPEHeaderHash SHA1	5abe3da2e90de43df4ee61c89b8adb402176edb3
RichPEHeaderHash SHA256	da02581a92aa11134e23d9ee3cf7d60945700fec9b37c0a3365e2aebe68ec5b3
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	Trend Micro Eyes
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 1688f039255e638e69143907e6330b

Field	Value
ToBeSigned (TBS) MD5	0179e8ddeebaf8998fec419d65cdf13d
ToBeSigned (TBS) SHA1	34c724c3369f2da8c25b591808962f66f10bde28
ToBeSigned (TBS) SHA256	35b0bac11602847aaab65fb35199d3c8976cde3ccf7e061b130177c712cbd92f
Subject	C=GB, ST=Greater Manchester, L=Salford, O=COMODO CA Limited, CN=COMODO SHA,1 Time Stamping Signer
ValidFrom	2015-12-31 00:00:00
ValidTo	2019-07-09 18:40:36
Signature	ba332440408c7cdb589fb36098b2f5c031feeb1f6e50f60ae0e4e681ad2687a2dffdb3daf473f300fb291b891b153edb6b52932bc4ac3981d73c67579a3936e028089ae3394f9b89097f7bc5617f598932250a6aae1a3ef0a227a8b6c3b887f7160448413d5cd8ec9f4d203104d965a1edcd690753163ddd36020a88eb40e506300bb8164bdcefbc5509ffc63e122e76b3dcce42eff97657e1b70a054098589a5d711693718c6581ea6ff389f7fb73adb4e7bfd98e6faa0b4f25f3b8e1d5dd75986881f8aac0d180c2c4c43989c1f6c99e6cd774f9d997f84fc29a0acd5e8ff819e9e0a59fc4f09221e62d7925c922f9c3f03a8457ad3a16f46394101d5dd0c6
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	1688f039255e638e69143907e6330b
Version	3

Certificate 774d49c5649436de6bf3190a67eedcdf

Field	Value
ToBeSigned (TBS) MD5	b3ca7d6b821d8e3432b29874980af55e
ToBeSigned (TBS) SHA1	618d7e55a24c1d8b65a0bcce79120c5e3b13fa4d
ToBeSigned (TBS) SHA256	c645c6a7dc7243a4a3f78a6569c029401a7bda8bc4732ce7198d9f21f19b12fa
Subject	C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.
ValidFrom	2016-03-29 00:00:00
ValidTo	2017-06-28 23:59:59
Signature	27351697f046d1d43fe306dff30b83e7a404e3e6431c1e06829c558d99eb3f21776021e3e1bd4e485aba08b89bb0972f23daa471d7b432a44a591270f9a838f13dbda32ee936c0df792cff8c493e1f27b2282b3d896ae7b4155ca1a50bf7111f3f4bbbe11f17cfe5d49c0589c210966ef7e567153e802d2e783ff498c59585598d9d3e93273d1e81c07ce85c0cfb24834d448c3930120f1686bd472d916ac8f9475acfdb27be8528311f668d71dfc132a0ff62df7baa575a0cc732b3de003beca214954d4d97cf9511b9329eccbb7b716675b31e543a43570080dffce3fc8ca8fbb17d954b9678e2d0c1e1710a5cf03952a687fede59dcba3bf98900f9934f12
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	774d49c5649436de6bf3190a67eedcdf
Version	3

Certificate 611993e400000000001c

Field	Value
ToBeSigned (TBS) MD5	78a717e082dcc1cda3458d917e677d14
ToBeSigned (TBS) SHA1	4a872e0e51f9b304469cd1dedb496ee9b8b983a4
ToBeSigned (TBS) SHA256	317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
ValidFrom	2011-02-22 19:25:17
ValidTo	2021-02-22 19:35:17
Signature	812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	611993e400000000001c
Version	3

Certificate 5200e5aa2556fc1a86ed96c9d44b33c7

Field	Value
ToBeSigned (TBS) MD5	b30c31a572b0409383ed3fbe17e56e81
ToBeSigned (TBS) SHA1	4843a82ed3b1f2bfbee9671960e1940c942f688d
ToBeSigned (TBS) SHA256	03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-02-08 00:00:00
ValidTo	2020-02-07 23:59:59
Signature	5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	5200e5aa2556fc1a86ed96c9d44b33c7
Version	3

Imports

Expand

ntoskrnl.exe

Imported Functions

Expand

RtlInitUnicodeString
KeInitializeEvent
KeClearEvent
KeSetEvent
KeEnterCriticalRegion
KeLeaveCriticalRegion
KeWaitForSingleObject
ExFreePoolWithTag
ExAcquireFastMutexUnsafe
ExReleaseFastMutexUnsafe
ProbeForRead
ProbeForWrite
ExAcquireResourceSharedLite
ExAcquireResourceExclusiveLite
ExReleaseResourceLite
MmProbeAndLockPages
MmUnlockPages
MmMapLockedPagesSpecifyCache
IoAllocateMdl
IoFreeMdl
IoGetCurrentProcess
ObfReferenceObject
ObfDereferenceObject
ZwClose
ZwCreateSection
ZwOpenSection
ZwMapViewOfSection
ZwUnmapViewOfSection
ZwOpenEvent
KePulseEvent
KeStackAttachProcess
KeUnstackDetachProcess
ObOpenObjectByPointer
ZwAllocateVirtualMemory
ZwFreeVirtualMemory
ZwSetEvent
__C_specific_handler
PsProcessType
wcslen
wcsncpy
wcsrchr
RtlUnicodeStringToInteger
ZwWaitForSingleObject
ZwRequestWaitReplyPort
ZwConnectPort
SeCaptureSubjectContext
SeReleaseSubjectContext
SeAccessCheck
ObGetObjectSecurity
ObReleaseObjectSecurity
PsGetProcessExitTime
PsThreadType
MmSectionObjectType
RtlCreateSecurityDescriptor
RtlSetDaclSecurityDescriptor
KeInitializeSemaphore
KeReleaseSemaphore
ExAllocatePoolWithTag
ExAcquireFastMutex
ExReleaseFastMutex
RtlCreateAcl
RtlAddAccessAllowedAce
RtlLengthRequiredSid
RtlInitializeSid
RtlSubAuthoritySid
KeDelayExecutionThread
ExGetPreviousMode
DbgPrint
swprintf
RtlCopyUnicodeString
PsGetVersion
IofCompleteRequest
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
ObReferenceObjectByHandle
PsGetCurrentProcessId
ZwCreateEvent
ExEventObjectType
_wcsnicmp
PsSetCreateProcessNotifyRoutine
ZwQueryInformationProcess
PsLookupProcessByProcessId
ZwOpenDirectoryObject
ExInitializeResourceLite
ExDeleteResourceLite
ZwCreateFile
ZwQueryInformationFile
ZwSetInformationFile
ZwReadFile
ZwWriteFile
towupper
MmGetSystemRoutineAddress
ObReferenceObjectByPointer
MmIsAddressValid
PsGetCurrentThreadId
ObQueryNameString
_snprintf
_vsnprintf
RtlInitAnsiString
RtlAnsiStringToUnicodeString
RtlFreeUnicodeString
RtlTimeToTimeFields
KeWaitForMultipleObjects
ExSystemTimeToLocalTime
wcscat
ZwDeviceIoControlFile
ZwNotifyChangeKey
ZwOpenFile
ZwQueryVolumeInformationFile
mbstowcs
_stricmp
IoGetDeviceObjectPointer
RtlImageNtHeader
ZwQuerySystemInformation
IoBuildDeviceIoControlRequest
IofCallDriver
IoCreateFile
RtlEqualUnicodeString
RtlAppendUnicodeStringToString
RtlUpcaseUnicodeChar
_snwprintf
strlen
_strnicmp
strncpy
NtOpenProcess
NtQueryInformationProcess
ObOpenObjectByName
KeSetPriorityThread
PsCreateSystemThread
PsTerminateSystemThread
KeNumberProcessors
RtlLengthSecurityDescriptor
ZwOpenKey
ZwDeleteKey
ZwDeleteValueKey
ZwEnumerateKey
ZwEnumerateValueKey
ZwQueryKey
ZwQueryValueKey
ZwSetValueKey
ZwTerminateProcess
ZwOpenProcess
ZwDuplicateObject
ZwQuerySecurityObject
ZwSetSecurityObject
ZwQueryDirectoryObject
ZwQueryDirectoryFile
NtCreateFile
NtQueryInformationFile
NtSetInformationFile
IoFileObjectType
ObInsertObject
wcschr
wcsncmp
RtlQueryRegistryValues
RtlAppendUnicodeToString
RtlCompareMemory
MmBuildMdlForNonPagedPool
IoAllocateIrp
IoFreeIrp
ZwOpenSymbolicLinkObject
ZwQuerySymbolicLinkObject
RtlUpcaseUnicodeString
NtClose
ZwSetInformationObject
SeQueryAuthenticationIdToken
MmSystemRangeStart
IoGetFileObjectGenericMapping
ObCreateObject
SeCreateAccessState
IoAcquireVpbSpinLock
IoReleaseVpbSpinLock
wcstombs
strncat
wcsncat
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
strcpy
wcsstr
RtlCompareUnicodeString
DbgPrintEx
KeAcquireSpinLockRaiseToDpc
KeReleaseSpinLock
ExAllocatePool
ExpInterlockedPopEntrySList
IoBuildSynchronousFsdRequest
IoGetStackLimits
IoGetDeviceInterfaces
IoRegisterPlugPlayNotification
IoUnregisterPlugPlayNotification
IoGetConfigurationInformation
FsRtlIsNameInExpression
IoDeviceObjectType
IoCreateDevice
RtlGetOwnerSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetSaclSecurityDescriptor
SeCaptureSecurityDescriptor
RtlLengthSid
SeExports
IoIsWdmVersionAvailable
RtlAbsoluteToSelfRelativeSD
ZwCreateKey
_purecall
KeBugCheckEx

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QEAA@AEBV0@@Z
??0CAutoUpdateConfigThread@@QEAA@PEAU_UNICODE_STRING@@P6AX0PEAX@Z1@Z
??0CBlobConfig@@QEAA@AEBV0@@Z
??0CBlobConfig@@QEAA@K@Z
??0CContext@@QEAA@AEBV0@@Z
??0CContext@@QEAA@KP6AJPEAU_EVENT_REPORT@@PEAXPEAU_TMCE_REPORT@@PEAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QEAA@AEBV0@@Z
??0CContextList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CDebugLog@@QEAA@AEBV0@@Z
??0CDebugLog@@QEAA@PEBG@Z
??0CDebugLogEx@@QEAA@AEBV0@@Z
??0CDebugLogEx@@QEAA@K@Z
??0CDelayLoadThread@@QEAA@AEBV0@@Z
??0CDelayLoadThread@@QEAA@XZ
??0CExclusionExtConfig@@QEAA@AEBV0@@Z
??0CExclusionExtConfig@@QEAA@KKE@Z
??0CExclusionFileNameConfig@@QEAA@AEBV0@@Z
??0CExclusionFileNameConfig@@QEAA@KK@Z
??0CExclusionFilePathConfig@@QEAA@AEBV0@@Z
??0CExclusionFilePathConfig@@QEAA@KK@Z
??0CExclusionFolderConfig@@QEAA@AEBV0@@Z
??0CExclusionFolderConfig@@QEAA@KK@Z
??0CExclusionRegistryConfig@@QEAA@AEBV0@@Z
??0CExclusionRegistryConfig@@QEAA@KK@Z
??0CFile@@QEAA@AEBV0@@Z
??0CFile@@QEAA@E@Z
??0CFileExtension@@QEAA@AEBV0@@Z
??0CFileExtension@@QEAA@KEEPEAVIMemoryAllocator@@@Z
??0CInclusionExtConfig@@QEAA@AEBV0@@Z
??0CInclusionExtConfig@@QEAA@KKE@Z
??0CInclusionFileNameConfig@@QEAA@AEBV0@@Z
??0CInclusionFileNameConfig@@QEAA@KK@Z
??0CInclusionFilePathConfig@@QEAA@AEBV0@@Z
??0CInclusionFilePathConfig@@QEAA@KK@Z
??0CInclusionFolderConfig@@QEAA@AEBV0@@Z
??0CInclusionFolderConfig@@QEAA@KK@Z
??0CKEvent@@QEAA@AEBV0@@Z
??0CKEvent@@QEAA@W4_EVENT_TYPE@@E@Z
??0CList@@QEAA@AEBV0@@Z
??0CList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CLockEvent@@QEAA@AEBV0@@Z
??0CLockEvent@@QEAA@XZ
??0CLockList@@QEAA@AEBV0@@Z
??0CLockList@@QEAA@KKPEAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IEAA@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QEAA@AEBV0@@Z
??0CMemoryPoolAllocator@@IEAA@W4_POOL_TYPE@@_K1K@Z
??0CMemoryPoolAllocator@@QEAA@AEBV0@@Z
??0CModuleConfig@@QEAA@AEBV0@@Z
??0CModuleConfig@@QEAA@XZ
??0CModuleConfigList@@QEAA@AEBV0@@Z
??0CModuleConfigList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QEAA@AEBV0@@Z
??0CModuleFileExtConfig@@QEAA@KKE@Z
??0CModuleFlagConfig@@QEAA@AEBV0@@Z
??0CModuleFlagConfig@@QEAA@K@Z
??0CModuleMultiStringConfig@@QEAA@AEBV0@@Z
??0CModuleMultiStringConfig@@QEAA@KK@Z
??0CModuleStringConfig@@QEAA@AEBV0@@Z
??0CModuleStringConfig@@QEAA@K@Z
??0CNoLockList@@QEAA@AEBV0@@Z
??0CNoLockList@@QEAA@KKPEAVIMemoryAllocator@@@Z
??0CSmartLock@@QEAA@AEAVCLockEvent@@@Z
??0CSmartLock@@QEAA@XZ
??0CSmartReference@@QEAA@AEAJ@Z
??0CSmartReference@@QEAA@AEAK@Z
??0CSmartResource@@QEAA@AEAVCResource@@E@Z
??0CStrList@@QEAA@AEBV0@@Z
??0CStrList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CSystemThread@@QEAA@AEBV0@@Z
??0CSystemThread@@QEAA@K@Z
??0CUserFuncAdapterJob@@QEAA@AEBV0@@Z
??0CUserFuncAdapterJob@@QEAA@P6AXPEAX@Z01@Z
??0CWorkerThread@@IEAA@PEAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QEAA@AEBV0@@Z
??0CWorkerThreadJob@@QEAA@AEBV0@@Z
??0CWorkerThreadJob@@QEAA@E@Z
??0CWorkerThreadJobQueue@@QEAA@AEBV0@@Z
??0CWorkerThreadJobQueue@@QEAA@K@Z
??0CWorkerThreadPool@@QEAA@AEBV0@@Z
??0CWorkerThreadPool@@QEAA@K@Z
??0CWorkerThreadPoolEx@@QEAA@AEBV0@@Z
??0CWorkerThreadPoolEx@@QEAA@KK@Z
??0IMemoryAllocator@@QEAA@AEBV0@@Z
??0IMemoryAllocator@@QEAA@XZ
??1CAutoUpdateConfigThread@@UEAA@XZ
??1CBlobConfig@@UEAA@XZ
??1CContext@@UEAA@XZ
??1CContextList@@UEAA@XZ
??1CDebugLog@@UEAA@XZ
??1CDebugLogEx@@UEAA@XZ
??1CDelayLoadThread@@UEAA@XZ
??1CExclusionExtConfig@@UEAA@XZ
??1CExclusionFileNameConfig@@UEAA@XZ
??1CExclusionFilePathConfig@@UEAA@XZ
??1CExclusionFolderConfig@@UEAA@XZ
??1CExclusionRegistryConfig@@UEAA@XZ
??1CFile@@UEAA@XZ
??1CFileExtension@@UEAA@XZ
??1CInclusionExtConfig@@UEAA@XZ
??1CInclusionFileNameConfig@@UEAA@XZ
??1CInclusionFilePathConfig@@UEAA@XZ
??1CInclusionFolderConfig@@UEAA@XZ
??1CKEvent@@UEAA@XZ
??1CList@@UEAA@XZ
??1CLockEvent@@UEAA@XZ
??1CLockList@@UEAA@XZ
??1CMemoryAllocator@@UEAA@XZ
??1CMemoryPoolAllocator@@UEAA@XZ
??1CModuleConfig@@UEAA@XZ
??1CModuleConfigList@@UEAA@XZ
??1CModuleFileExtConfig@@UEAA@XZ
??1CModuleFlagConfig@@UEAA@XZ
??1CModuleMultiStringConfig@@UEAA@XZ
??1CModuleStringConfig@@UEAA@XZ
??1CNoLockList@@UEAA@XZ
??1CSmartLock@@QEAA@XZ
??1CSmartReference@@QEAA@XZ
??1CSmartResource@@QEAA@XZ
??1CStrList@@UEAA@XZ
??1CSystemThread@@UEAA@XZ
??1CUserFuncAdapterJob@@UEAA@XZ
??1CWorkerThread@@UEAA@XZ
??1CWorkerThreadJob@@UEAA@XZ
??1CWorkerThreadJobQueue@@UEAA@XZ
??1CWorkerThreadPool@@UEAA@XZ
??1CWorkerThreadPoolEx@@UEAA@XZ
??1IMemoryAllocator@@UEAA@XZ
??2@YAPEAX_KPEAVIMemoryAllocator@@PEBDK@Z
??2CMemoryAllocator@@SAPEAX_K@Z
??2CMemoryPoolAllocator@@SAPEAX_K@Z
??3@YAXPEAX@Z
??3@YAXPEAX_K@Z
??3IMemoryAllocator@@SAXPEAX@Z
??4CAutoUpdateConfigThread@@QEAAAEAV0@AEBV0@@Z
??4CBlobConfig@@QEAAAEAV0@AEBV0@@Z
??4CContext@@QEAAAEAV0@AEBV0@@Z
??4CDebugLog@@QEAAAEAV0@AEBV0@@Z
??4CDebugLogEx@@QEAAAEAV0@AEBV0@@Z
??4CDelayLoadThread@@QEAAAEAV0@AEBV0@@Z
??4CFile@@QEAAAEAV0@AEBV0@@Z
??4CKEvent@@QEAAAEAV0@AEBV0@@Z
??4CLockEvent@@QEAAAEAV0@AEBV0@@Z
??4CMemoryAllocator@@QEAAAEAV0@AEBV0@@Z
??4CMemoryPoolAllocator@@QEAAAEAV0@AEBV0@@Z
??4CModuleConfig@@QEAAAEAV0@AEBV0@@Z
??4CModuleFlagConfig@@QEAAAEAV0@AEBV0@@Z
??4CModuleStringConfig@@QEAAAEAV0@AEBV0@@Z
??4CSmartLock@@QEAAAEAV0@AEBV0@@Z
??4CSmartLock@@QEAAAEBV0@AEAVCLockEvent@@@Z
??4CSmartResource@@QEAAAEAV0@AEBV0@@Z
??4CSystemThread@@QEAAAEAV0@AEBV0@@Z
??4CUserFuncAdapterJob@@QEAAAEAV0@AEBV0@@Z
??4CWorkerThread@@QEAAAEAV0@AEBV0@@Z
??4CWorkerThreadJob@@QEAAAEAV0@AEBV0@@Z
??4IMemoryAllocator@@QEAAAEAV0@AEBV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CDebugLogEx@@6B@
??_7CDelayLoadThread@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CInclusionExtConfig@@6B@
??_7CInclusionFileNameConfig@@6B@
??_7CInclusionFilePathConfig@@6B@
??_7CInclusionFolderConfig@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CNoLockList@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7CWorkerThreadPoolEx@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QEAAXXZ
??_FCFile@@QEAAXXZ
??_FCFileExtension@@QEAAXXZ
??_FCModuleConfigList@@QEAAXXZ
??_FCStrList@@QEAAXXZ
??_FCSystemThread@@QEAAXXZ
??_FCWorkerThread@@QEAAXXZ
??_FCWorkerThreadJob@@QEAAXXZ
??_FCWorkerThreadJobQueue@@QEAAXXZ
??_U@YAPEAX_KPEAVIMemoryAllocator@@PEBDK@Z
??_V@YAXPEAX@Z
??_V@YAXPEAX_K@Z
?Acquire@CLockEvent@@QEAAXXZ
?Add@CContextList@@QEAAEPEAVCContext@@@Z
?Add@CFileExtension@@QEAAEPEBGK@Z
?Add@CModuleConfigList@@QEAAEPEAVCModuleConfig@@@Z
?Add@CStrList@@QEAAEPEBG@Z
?AddNode@CLockList@@UEAAEQEAXE@Z
?AddNode@CNoLockList@@UEAAEQEAXE@Z
?Alloc@CMemoryAllocator@@UEAAPEAX_KPEBDK@Z
?Alloc@CMemoryPoolAllocator@@UEAAPEAX_KPEBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IEAAPEAX_K@Z
?AttachJobQueue@CWorkerThread@@QEAAXPEAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QEAAXXZ
?CheckNode@CLockList@@UEAAHQEAX@Z
?CheckNode@CNoLockList@@UEAAHQEAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QEAAXXZ
?Cleanup@CBlobConfig@@AEAAXXZ
?Cleanup@CModuleFileExtConfig@@IEAAXXZ
?Cleanup@CModuleMultiStringConfig@@IEAAXXZ
?Cleanup@CModuleStringConfig@@AEAAXXZ
?Close@CFile@@QEAAJXZ
?Count@CLockList@@QEAAKXZ
?Count@CNoLockList@@QEAAKXZ
?Create@CFile@@QEAAJPEBGKKKK@Z
?Create@CSystemThread@@QEAAEXZ
?CreateInstance@CMemoryAllocator@@SAPEAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SAPEAV1@W4_POOL_TYPE@@_K1K@Z
?CreatePool@CWorkerThreadPool@@QEAAEXZ
?CreatePool@CWorkerThreadPoolEx@@QEAAEXZ
?CreateThreads@CWorkerThreadPool@@QEAAEK@Z
?CreateThreads@CWorkerThreadPoolEx@@QEAAEK@Z
?CreateWIRP@CFile@@QEAAJPEBGKKKK@Z
?Delete@CFile@@QEAAJXZ
?Delete@CFileExtension@@QEAAEPEBGK@Z
?Delete@CStrList@@QEAAEPEBG@Z
?DeleteAll@CList@@UEAAXXZ
?DeleteAll@CLockList@@UEAAXXZ
?DeleteAll@CNoLockList@@UEAAXXZ
?DeleteNode@CContextList@@MEAAXPEAX@Z
?DeleteNode@CList@@UEAAXPEAX@Z
?DeleteNode@CModuleConfigList@@MEAAXPEAX@Z
?DeleteNode@CStrList@@EEAAXPEAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YAXPEAPEAX@Z
?DoIt@CWorkerThreadJob@@QEAAJXZ
?EntryPoint@CSystemThread@@KAXPEAX@Z
?Find@CContextList@@QEAAPEAVCContext@@K@Z
?Find@CContextList@@QEAAPEAVCContext@@PEAX@Z
?Find@CFileExtension@@QEAAPEAU_STR_LIST_NODE@CStrList@@PEBGK@Z
?Find@CModuleConfigList@@QEAAPEAVCModuleConfig@@K@Z
?Find@CStrList@@QEAAPEAU_STR_LIST_NODE@1@PEBG@Z
?FindNode@CContextList@@IEAAPEAXPEAX@Z
?FindPartiallyAndAllMatch@CStrList@@QEAAPEAU_STR_LIST_NODE@1@PEBG@Z
?FinishFunction@CUserFuncAdapterJob@@MEAAXXZ
?FinishIt@CWorkerThreadJob@@QEAAJXZ
?First@CList@@UEAAPEAXXZ
?First@CLockList@@UEAAPEAXXZ
?First@CNoLockList@@UEAAPEAXXZ
?Free@CMemoryAllocator@@UEAAXPEAX@Z
?Free@CMemoryPoolAllocator@@UEAAXPEAX@Z
?GetAttributes@CFile@@QEAAKXZ
?GetBasicInfomration@CFile@@IEAAJXZ
?GetBlobCofig@CContext@@UEAAJKPEAXPEAK@Z
?GetCategory@CContext@@QEAAKXZ
?GetData@CBlobConfig@@QEAAHPEAXPEAK@Z
?GetData@CModuleFileExtConfig@@QEAAHPEAGPEAK@Z
?GetData@CModuleFileExtConfig@@QEAAPEAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QEAAKXZ
?GetData@CModuleMultiStringConfig@@QEAAHPEAGPEAK@Z
?GetData@CModuleMultiStringConfig@@QEAAPEAVCStrList@@XZ
?GetData@CModuleStringConfig@@QEAAPEAGXZ
?GetData@CStrList@@QEAAEPEAGPEAK@Z
?GetDataType@CModuleConfig@@QEAAKXZ
?GetEngineContext@CContext@@QEAAPEAXXZ
?GetFileExtensionConfig@CContext@@QEAAPEAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UEAAJKPEAGPEAK@Z
?GetFileSize@CFile@@QEAAJPEAT_LARGE_INTEGER@@@Z
?GetFileSizeWIRP@CFile@@QEAAJPEAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UEAAJKPEAK@Z
?GetID@CModuleConfig@@QEAAKXZ
?GetJob@CWorkerThreadJobQueue@@QEAAPEAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QEAAKXZ
?GetLinkContext@CContext@@QEAAPEAXXZ
?GetLogFlag@CDebugLog@@QEAAKXZ
?GetLogFlag@CDebugLogEx@@QEAAKXZ
?GetModuleId@CModuleConfig@@QEAAKXZ
?GetMultiStringConfig@CContext@@QEAAPEAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UEAAJKPEAGPEAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QEAAPEAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPool@@QEAAPEAU_KTHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QEAAPEAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QEAAPEAU_KTHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QEAA_KXZ
?GetSize@CBlobConfig@@QEAAKXZ
?GetStringConfig@CContext@@QEAAPEAGK@Z
?GetStringConfig@CContext@@UEAAJKPEAGPEAK@Z
?GetThreadCount@CWorkerThreadPool@@QEAAKXZ
?GetThreadCount@CWorkerThreadPoolEx@@QEAAKXZ
?GetThreadID@CSystemThread@@QEAA_KXZ
?GetType@CContext@@QEAAKXZ
?GetUserParameter@CContext@@QEAA_KXZ
?InitProcMon@CDebugLogEx@@IEAAXXZ
?InitializeBlobConfig@CContext@@QEAAHKPEAXK@Z
?InitializeFileExtensionConfig@CContext@@QEAAHKPEBG@Z
?InitializeFlagConfig@CContext@@QEAAHKK@Z
?InitializeMultiStringConfig@CContext@@QEAAHKPEBG@Z
?InitializeStringConfig@CContext@@QEAAHKPEBG@Z
?Insert@CList@@UEAAXQEAXE@Z
?Insert@CLockList@@UEAAXQEAXE@Z
?Insert@CNoLockList@@UEAAXQEAXE@Z
?InsertAfter@CList@@UEAAXPEAX0@Z
?InsertBefore@CList@@UEAAXPEAX0@Z
?Instance@CWorkerThreadPool@@SAPEAV1@XZ
?IsEmpty@CList@@UEAAEXZ
?IsEmpty@CLockList@@UEAAEXZ
?IsEmpty@CNoLockList@@UEAAEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IEAAEK@Z
?IsFull@CLockList@@QEBAEXZ
?IsFull@CNoLockList@@QEBAEXZ
?IsInExclusionList@CExclusionExtConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionExtConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionFileNameConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionFilePathConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionFolderConfig@@QEAAEPEBG@Z
?IsOpened@CFile@@QEAAEXZ
?IsTerminated@CWorkerThreadPool@@QEAAEXZ
?IsTerminated@CWorkerThreadPoolEx@@QEAAEXZ
?IsValid@CMemoryAllocator@@UEAAEXZ
?IsValid@CMemoryPoolAllocator@@UEAAEXZ
?IsValid@IMemoryAllocator@@UEAAEXZ
?IsWorkerThread@CWorkerThreadPool@@QEAAE_K@Z
?IsWorkerThread@CWorkerThreadPoolEx@@QEAAE_K@Z
?JobFunction@CUserFuncAdapterJob@@MEAAXXZ
?JobQueue@CWorkerThreadPool@@QEAAAEAVCWorkerThreadJobQueue@@XZ
?JobQueue@CWorkerThreadPoolEx@@QEAAAEAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QEAAKXZ
?Limit@CNoLockList@@QEAAKXZ
?MatchAllExtensions@CFileExtension@@QEAAEXZ
?MatchNoExtensions@CFileExtension@@QEAAEXZ
?MergeLeft@CMemoryPoolAllocator@@IEAAPEAXPEAX@Z
?MergeRight@CMemoryPoolAllocator@@IEAAPEAXPEAX@Z
?NeedDelete@CWorkerThreadJob@@QEAAEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QEAAXE@Z
?NewNode@CList@@UEAAPEAXXZ
?NewNode@CStrList@@EEAAPEAXXZ
?NewNodeVariant@CList@@IEAAPEAXK@Z
?Next@CList@@UEBAPEAXQEAX@Z
?Next@CLockList@@UEBAPEAXQEAX@Z
?Next@CNoLockList@@UEBAPEAXQEAX@Z
?NextPool@CMemoryPoolAllocator@@QEAAPEAV1@XZ
?NotityTerminate@CWorkerThread@@QEAAXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QEAAJP6AXPEAX@Z0E@Z
?PostJobToWorkerThread@CWorkerThreadPoolEx@@QEAAJP6AXPEAX@Z0E1@Z
?Pulse@CKEvent@@QEAAJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QEAAEPEAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QEAAJPEAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPoolEx@@QEAAJPEAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SAPEAV1@XZ
?Read@CFile@@QEAAJPEADKPEAK@Z
?ReadWIRP@CFile@@QEAAJPEADKPEAK@Z
?ReferenceCount@CContext@@QEAAAEAKXZ
?Release@CLockEvent@@QEAAXXZ
?Remove@CContextList@@UEAAEQEAX@Z
?Remove@CList@@UEAAEQEAX@Z
?Remove@CLockList@@UEAAEQEAX@Z
?Remove@CNoLockList@@UEAAEQEAX@Z
?RemoveHead@CList@@UEAAPEAXXZ
?RemoveHead@CLockList@@UEAAPEAXXZ
?RemoveHead@CNoLockList@@UEAAPEAXXZ
?RemoveTail@CList@@UEAAPEAXXZ
?RemoveTail@CLockList@@UEAAPEAXXZ
?RemoveTail@CNoLockList@@UEAAPEAXXZ
?Reset@CKEvent@@QEAAXXZ
?ResetData@CInclusionExtConfig@@QEAAXXZ
?ResetData@CInclusionFileNameConfig@@QEAAXXZ
?ResetData@CInclusionFilePathConfig@@QEAAXXZ
?ResetData@CInclusionFolderConfig@@QEAAXXZ
?RestoreCR0@@YAXPEAX@Z
?Run@CAutoUpdateConfigThread@@UEAAXXZ
?Run@CDelayLoadThread@@UEAAXXZ
?Run@CWorkerThread@@UEAAXXZ
?SeekToEnd@CFile@@QEAAJXZ
?Set@CKEvent@@QEAAJJE@Z
?SetAttributes@CFile@@QEAAJK@Z
?SetBlobCofig@CContext@@UEAAJKPEAXK@Z
?SetData@CBlobConfig@@QEAAHPEAXK@Z
?SetData@CModuleFileExtConfig@@QEAAHPEBG@Z
?SetData@CModuleFlagConfig@@QEAAHK@Z
?SetData@CModuleMultiStringConfig@@QEAAHPEBGK@Z
?SetData@CModuleStringConfig@@QEAAHPEBG@Z
?SetEngineContext@CContext@@QEAAXPEAX@Z
?SetFileExtensionConfig@CContext@@UEAAJKPEBG@Z
?SetFlagConfig@CContext@@UEAAJKK@Z
?SetLinkContext@CContext@@QEAAXPEAX@Z
?SetLogFlag@CDebugLog@@QEAAEK@Z
?SetLogFlag@CDebugLogEx@@QEAAEK@Z
?SetMatchAllExtensions@CFileExtension@@QEAAXE@Z
?SetMatchNoExtensions@CFileExtension@@QEAAXE@Z
?SetMultiStringConfig@CContext@@UEAAJKPEBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QEAAXXZ
?SetPriority@CSystemThread@@QEAAXK@Z
?SetStopUse@CContext@@QEAAXXZ
?SetStringConfig@CContext@@UEAAJKPEBG@Z
?Setup@CSystemThread@@MEAAXXZ
?StopUse@CContext@@QEAAHXZ
?TearDown@CSystemThread@@MEAAXXZ
?Terminate@CSystemThread@@QEAAXE@Z
?Terminate@CWorkerThreadPool@@QEAAEXZ
?Terminate@CWorkerThreadPoolEx@@QEAAEXZ
?TmExceptionFilter@@YAJPEAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QEAAJPEAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QEAAXXZ
?WaitForInit@CDelayLoadThread@@QEAAEXZ
?WaitForLoad@CDelayLoadThread@@QEAAEXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QEAAEXZ
?WaitQueueEmpty@CWorkerThreadJobQueue@@QEAAXXZ
?Write@CDebugLog@@QEAAXPEBDZZ
?Write@CDebugLogEx@@QEAAXPEBDZZ
?Write@CFile@@QEAAJPEADKPEAT_LARGE_INTEGER@@PEAK@Z
?WriteDataToFile@CDebugLogEx@@IEAAXPEADK@Z
?WriteDataToProcMonW@CDebugLogEx@@IEAAXPEAD@Z
?WriteSystemInformation@CDebugLog@@QEAAXXZ
?WriteSystemInformation@CDebugLogEx@@QEAAXXZ
?WriteSystemStringInformation@CDebugLog@@IEAAXPEBG@Z
?WriteSystemStringInformation@CDebugLogEx@@IEAAXPEBG@Z
?WriteToFile@CDebugLog@@IEAAXPEADK@Z
?WriteToProcMonW@CDebugLogEx@@IEAAXPEAU_UNICODE_STRING@@@Z
?_pNonPagedAllocator@@3PEAVCMemoryAllocator@@EA
?_pPagedAllocator@@3PEAVCMemoryAllocator@@EA
?m_lpInstance@CWorkerThreadPool@@1PEAV1@EA
?m_lpRCMInstance@CWorkerThreadPool@@1PEAV1@EA
AllocFullFileName
DeInitKm2UmCommunication
DeInitKmLPC
DuplicateFullFileName
FreeFullFileName
GetKm2UmMode
GetModuleInfoByAddress
GetModuleInfoByModuleName
InitKm2UmCommunication
InitKmLPC
IsVerifierCodeCheckFlagOn
IsWindows8_1_update
KmCallUm
KmCallUmByLPC
KmCallUmEx
KmCleanupCommPortAPIs
KmGetUmInitProcess
KmSetBackupCommPortAPIs
KmSetCommPortAPIs
ModGetExportProcAddress
ModLoadDLLToBuffer
ModLoadDLLToBufferWithImageSize
ModLoadModule
ModUnLoadModule
NormalizeFileName
NormalizeFullNtPathToDosName
TmCommConfigRoutine
UtilAddDeviceInDriveTable
UtilAddReparsePointMapping
UtilCleanFileReadOnly
UtilCloseExclusiveHandle
UtilCreateDosFileName
UtilDeleteFileForce
UtilGetDeviceObjectName
UtilGetFileNameFromFileObject
UtilGetFileObjectForProcessByEPROC
UtilGetFileObjectFromFileName
UtilGetProcessName
UtilGetSystemDirectory
UtilGetSystemDirectoryEx
UtilGetSystemDirectoryLength
UtilGetSystemTime
UtilIoSetFileInfo
UtilIopCreateFileIRP
UtilKeGetLowFileDevice
UtilModuleIATHook
UtilModuleIATUnHook
UtilPostJobToWorkerThread
UtilQueryExclusiveHandle
UtilQueryKeyValue
UtilRemoveDeviceFromDriveTable
UtilVolumeDeviceToDosName
UtilWaitValueChangeToZero
UtilWriteVersionToRegistry
UtilbuildDynamicDiskMappingTable
UtlWriteBinValueKeyToRegistry
ValidateAddressWithSize
_ResetProtectFromClose
_UtilDosPathNameToNtPathName

Sections

Expand

.text
.rdata
.data
.pdata
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2020-08-25 02:07:44
MD5	996ded363410dfd38af50c76bd5b4fbc
SHA1	d7597d27eeb2658a7c7362193f4e5c813c5013e5
SHA256	fca10cde7d331b7f614118682d834d46125a65888e97bd9fda2df3f15797166c
Authentihash MD5	8668e5f58ae2a95ada7f83f280974cba
Authentihash SHA1	0ad65356dae97eebd80c059e1ee1ec39c8119b95
Authentihash SHA256	683f0af364f8a19f81d2e095e17de6d403ba3672bdf4a1caf601bca5b57454df
RichPEHeaderHash MD5	f4be961fdf2f7511374b1df8df43f982
RichPEHeaderHash SHA1	548170450c7a94ed3369b8ea52224efc6207e53e
RichPEHeaderHash SHA256	afb90f23e79bf9a8d2b7c8cfe6668b65edca751317215ad400d3240b652eea37
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	Trend Micro Eyes
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 61204db4000000000027

Field	Value
ToBeSigned (TBS) MD5	8e3ffc222fbcebdbb8b23115ab259be7
ToBeSigned (TBS) SHA1	ee20bff28ffe13be731c294c90d6ded5aae0ec0e
ToBeSigned (TBS) SHA256	59826b69bc8c28118c96323b627da59aaca0b142cc5d8bad25a8fcfd399aa821
Subject	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert High Assurance EV Root CA
ValidFrom	2011-04-15 19:45:33
ValidTo	2021-04-15 19:55:33
Signature	208cc159ed6f9c6b2dc14a3e751d454c41501cbd80ead9b0928b062a133f53169e56396a8a63b6782479f57db8b947a10a96c2f6cbbda2669f06e1acd279090efd3cdcac020c70af3f1bec787ed4eb4b056026d973619121edb06863e09712ab6fa012edd99fd2da273cb3e456f9d1d4810f71bd427ca689dccdd5bd95a2abf193117de8ac3129a85d6670419dfc75c9d5b31a392ad08505508bac91cac493cb71a59da4946f580cfa6e20c40831b5859d7e81f9d23dca5b18856c0a86ec22091ba574344f7f28bc954aab1db698b05d09a477767eefa78e5d84f61824cbd16da6c3a19cc2107580ff9d32fde6cf433a82f7ce8fe1722a9b62b75fed951a395c2f946d48b7015f332fbbdc2d73348904420a1c8b79f9a3fa17effaa11a10dfe0b2c195eb5c0c05973b353e18884ddb6cbf24898dc8bdd89f7b393a24a0d5dfd1f34a1a97f6a66f7a1fb090a9b3ac013991d361b764f13e573803afce7ad2b590f5aedc3999d5b63c97eda6cb16c77d6b2a4c9094e64c54fd1ecd20ecce689c8758e96160beeb0ec9d5197d9fe978bd0eac2175078fa96ee08c6a2a6b9ce3e765bcbc2d3c6ddc04dc67453632af0481bca8006e614c95c55cd48e8e9f2fc13274bdbd11650307cdefb75e0257da86d41a2834af8849b2cfa5dd82566f68aa14e25954feffeaeeefea9270226081e32523c09fcc0f49b235aa58c33ac3d9169410
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	61204db4000000000027
Version	3

Certificate 0f6146af9397c7fa04b13c2d0279a1ba

Field	Value
ToBeSigned (TBS) MD5	df4ab4b67a0e9b1f9ec4a1ad9ea6052a
ToBeSigned (TBS) SHA1	dc1d0c4be3072afed8b0739a21b87b14292815e0
ToBeSigned (TBS) SHA256	9c8450b3fa641a421a545e7e4fa7e1bcb657db4796bef147312c44b7a1b5ffe0
Subject	??=TW, ??=Private Organization, serialNumber=23310837, C=TW, ST=Taipei City, L=Daan District, O=Trend Micro, Inc., CN=Trend Micro, Inc.
ValidFrom	2020-08-07 00:00:00
ValidTo	2021-04-15 12:00:00
Signature	578aa329d98f23e576b6937a3146ca65f1ec8da04b5ec5f4c499436cfe710be5660f7c864950d9276a6dfdd2341048e6fe4f51044e7fce164f3b9203035bc3d311991685fbce0d90a4c7b2b511d0d3ba37b3558eae76db3ab30f4a2ef102faad1820e26b5fcbc216b368980655de80fe7177f9f1a80c75e4a0a21451a59c86986e5348318da4d295e8d02520fa674ce89756903b25521b5ad358f8328c5591a9702494cc24e340418dbcf08ef06214a8e90c4836dc6f8465fd59385bd56407d83bfc8a633e8125c523ff23dd8c669169848668d5aefe059ee5091e1776ec4686efd0d6ccee0e0bea5922ee41fb36e63d5704633f85115f9584926bdb708a9edb
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	0f6146af9397c7fa04b13c2d0279a1ba
Version	3

Certificate 03019a023aff58b16bd6d5eae617f066

Field	Value
ToBeSigned (TBS) MD5	a752afee44f017e8d74e3f3eb7914ae3
ToBeSigned (TBS) SHA1	8eca80a6b80e9c69dcef7745748524afb8019e2d
ToBeSigned (TBS) SHA256	82560fa7efec30b5ff82af643e6f3bf3d46868bbd5e7d76f93db185e9e3553a1
Subject	C=US, O=DigiCert, CN=DigiCert Timestamp Responder
ValidFrom	2014-10-22 00:00:00
ValidTo	2024-10-22 00:00:00
Signature	9d257e1b334db226815c9b86ce23200f8087e588ffffb1d46a2c31ed3a17197117cda91bbc5a1639009de36c84e45a40fbde06018c37fa9bb19d247efe20a457ad5bb79ab06026ea6957215d342f1f71b0839419056b359010a07b97c7f63fe7e21141a6bd62d9f0273d381d286f3a5209f0ec7062d3624bb0e073a692c0d38e31d82fe36d171306eee403b614abf38f43a7719d21dd14ca155d9241daf90f81d199740d26c40e7f1bb5f5a0f1c677062815e9d893e55516f0bb0aab1cdb5c482766c8a38b0a1ce595daaec42e59a061dddaf36da261e98a0b6dec1218bdf755544003922b6bc251c20a48afb0d46ee0f4140a3a1be38f3dcaaf6a8d7bdcd844
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	03019a023aff58b16bd6d5eae617f066
Version	3

Certificate 0dd0e3374ac95bdbfa6b434b2a48ec06

Field	Value
ToBeSigned (TBS) MD5	f92649915476229b093c211c2b18e6c4
ToBeSigned (TBS) SHA1	2d54c16a8f8b69ccdea48d0603c132f547a5cf75
ToBeSigned (TBS) SHA256	2cd702a7dec30aa441345672e8992ef9770ce4946f276d767b45b0ed627658fb
Subject	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert EV Code Signing CA
ValidFrom	2012-04-18 12:00:00
ValidTo	2027-04-18 12:00:00
Signature	9e5b963a2e1288acab016da49f75e40187a3a532d7bcbaa97ea3d61417f7c2136b7c738f2b6ae50f265968b08e259b6ceffa6c939208c14dcf459e9c46d61e74a19b14a3fa012f4ab101e1724048111368b9369d914bd7c2391210c1c4dcbb6214142a615d4f387c661fc61bffadbe4f7f945b7343000f4d73b751cf0ef677c05bcd348cd96313aa0e6111d6f28e27fcb47bb8b91120918678ea0ed428ff2ad52438e837b2ec96bb9fbc4a1650e15ebf517d23a032c7c1949e7ac9c026a2cc2587a0127e749f2d8db1c8e784beb9d1e9debb6a4e887371e12238cb2487e9737e51b2ff98eb4e7e2fe0ca0efab35ed1ba0542a8489f83f63fc4caa8df68a05061
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	0dd0e3374ac95bdbfa6b434b2a48ec06
Version	3

Certificate 06fdf9039603adea000aeb3f27bbba1b

Field	Value
ToBeSigned (TBS) MD5	4e5ad189638cf52ba9cd881d4d44668c
ToBeSigned (TBS) SHA1	cdc115e98d798b33904c820d63cc1e1afc19251d
ToBeSigned (TBS) SHA256	37560fb9d548ab62cc3ed4669a4ab74828b5a108e67e829937ffb2d10a5f78dd
Subject	C=US, O=DigiCert Inc, OU=www.digicert.com, CN=DigiCert Assured ID CA,1
ValidFrom	2006-11-10 00:00:00
ValidTo	2021-11-10 00:00:00
Signature	46503ec9b72824a7381db65b29af52cf52e93147ab565c7bd50d0b41b3efec751f7438f2b25c61a29c95c350e482b923d1ba3a8672ad3878ac755d1717347247859456d1ebbb368477cc24a5f3041955a9e7e3e7ab62cdfb8b2d90c2c0d2b594bd5e4fb105d20e3d1aa9145ba6863162a8a833e49b39a7c4f5ce1d7876942573e42aabcf9c764bed5fc24b16e44b704c00891efcc579bc4c1257fe5fe11ebc025da8fefb07384f0dc65d91b90f6745cdd683ede7920d8db1698c4ffb59e0230fd2aaae007cee9c420ecf91d727b716ee0fc3bd7c0aa0ee2c08558522b8eb181a4dfc2a21ad49318347957771dcb11b4b4b1c109c7714c19d4f2f5a9508291026
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	06fdf9039603adea000aeb3f27bbba1b
Version	3

Imports

Expand

ntoskrnl.exe

Imported Functions

Expand

KeLeaveCriticalRegion
wcsncpy
KeEnterCriticalRegion
ExAcquireFastMutexUnsafe
wcsrchr
ExAcquireResourceSharedLite
ExReleaseResourceLite
_purecall
ZwOpenEvent
ZwConnectPort
KeClearEvent
PsProcessType
ExFreePoolWithTag
RtlInitUnicodeString
KeSetEvent
ProbeForWrite
KeUnstackDetachProcess
ZwRequestWaitReplyPort
ZwWaitForSingleObject
DbgBreakPoint
ZwSetEvent
IoGetCurrentProcess
ZwFreeVirtualMemory
ZwClose
ObfReferenceObject
ObfDereferenceObject
RtlUnicodeStringToInteger
ZwCreateSection
ObOpenObjectByPointer
KeStackAttachProcess
KePulseEvent
ZwAllocateVirtualMemory
ObGetObjectSecurity
SeAccessCheck
SeReleaseSubjectContext
SeCaptureSubjectContext
PsThreadType
ObReleaseObjectSecurity
PsGetProcessExitTime
MmSectionObjectType
DbgPrint
ExDeleteResourceLite
ExInitializeResourceLite
ZwReadFile
swprintf
ZwSetInformationFile
ZwCreateFile
ZwQueryInformationFile
ZwWriteFile
_wcsnicmp
towupper
ExAllocatePoolWithTag
KeInitializeEvent
ZwCreateEvent
ZwCreateKey
RtlAnsiStringToUnicodeString
ZwNotifyChangeKey
RtlInitAnsiString
_snprintf
RtlFreeUnicodeString
ExSystemTimeToLocalTime
_vsnprintf
ObReferenceObjectByHandle
RtlTimeToTimeFields
ZwDeviceIoControlFile
PsGetCurrentThreadId
PsGetCurrentProcessId
KeWaitForMultipleObjects
ExGetPreviousMode
RtlEqualUnicodeString
RtlPrefixUnicodeString
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
RtlUpcaseUnicodeChar
KeWaitForSingleObject
KeSetPriorityThread
PsCreateSystemThread
PsTerminateSystemThread
MmIsAddressValid
KeDelayExecutionThread
KeNumberProcessors
PsLookupProcessByProcessId
PsSetCreateProcessNotifyRoutine
ZwOpenDirectoryObject
ZwQueryInformationProcess
ZwQuerySecurityObject
NtSetInformationFile
ZwDeleteValueKey
ZwSetValueKey
ZwQuerySystemInformation
NtQueryInformationFile
IoFileObjectType
ZwQueryValueKey
ZwQueryDirectoryFile
NtCreateFile
ZwEnumerateValueKey
RtlLengthSecurityDescriptor
ZwQueryDirectoryObject
ZwSetSecurityObject
ZwDuplicateObject
ZwOpenProcess
ExReleaseFastMutexUnsafe
ZwDeleteKey
ZwEnumerateKey
ZwQueryKey
ZwOpenKey
MmSystemRangeStart
_stricmp
_strnicmp
mbstowcs
ProbeForRead
RtlUpcaseUnicodeString
_snwprintf
ZwQuerySymbolicLinkObject
ZwMapViewOfSection
MmGetSystemRoutineAddress
RtlAppendUnicodeToString
IoCreateFile
RtlQueryRegistryValues
MmBuildMdlForNonPagedPool
ZwOpenSymbolicLinkObject
IoFreeMdl
ObQueryNameString
ZwUnmapViewOfSection
NtClose
IoFreeIrp
PsGetVersion
IoAllocateIrp
RtlCompareMemory
MmUnlockPages
ZwSetInformationObject
ZwOpenFile
wcsncmp
RtlImageNtHeader
IoAllocateMdl
IofCallDriver
ZwQueryVolumeInformationFile
ObReferenceObjectByPointer
IoBuildDeviceIoControlRequest
ZwOpenSection
RtlSubAuthoritySid
RtlLengthRequiredSid
ExReleaseFastMutex
ExAcquireFastMutex
RtlCreateAcl
RtlSetDaclSecurityDescriptor
RtlAddAccessAllowedAce
KeInitializeSemaphore
KeReleaseSemaphore
RtlInitializeSid
RtlCreateSecurityDescriptor
IoDeleteSymbolicLink
IoDeleteDevice
IoGetDeviceObjectPointer
ExEventObjectType
IofCompleteRequest
IoCreateSymbolicLink
ObOpenObjectByName
NtQueryInformationProcess
strncpy
NtOpenProcess
ObInsertObject
IoAcquireVpbSpinLock
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
KeAcquireQueuedSpinLock
KeReleaseQueuedSpinLock
IoReleaseVpbSpinLock
wcschr
IoGetConfigurationInformation
IoRegisterPlugPlayNotification
IoGetStackLimits
IoBuildSynchronousFsdRequest
KeReleaseSpinLock
ExpInterlockedPopEntrySList
FsRtlIsNameInExpression
wcsstr
ExAllocatePool
IoUnregisterPlugPlayNotification
MmProbeAndLockPages
RtlCompareUnicodeString
IoGetDeviceInterfaces
KeAcquireSpinLockRaiseToDpc
KeBugCheckEx
IoCreateDevice
IoDeviceObjectType
SeCaptureSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
IoIsWdmVersionAvailable
SeExports
RtlLengthSid
RtlGetSaclSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
ZwTerminateProcess
ExAcquireResourceExclusiveLite
__C_specific_handler

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QEAA@AEBV0@@Z
??0CAutoUpdateConfigThread@@QEAA@PEAU_UNICODE_STRING@@P6AX0PEAX@Z1@Z
??0CBlobConfig@@QEAA@AEBV0@@Z
??0CBlobConfig@@QEAA@K@Z
??0CContext@@QEAA@AEBV0@@Z
??0CContext@@QEAA@KP6AJPEAU_EVENT_REPORT@@PEAXPEAU_TMCE_REPORT@@PEAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QEAA@AEBV0@@Z
??0CContextList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CDebugLog@@QEAA@AEBV0@@Z
??0CDebugLog@@QEAA@PEBG@Z
??0CDebugLogEx@@QEAA@AEBV0@@Z
??0CDebugLogEx@@QEAA@K@Z
??0CDelayLoadThread@@QEAA@AEBV0@@Z
??0CDelayLoadThread@@QEAA@XZ
??0CExclusionExtConfig@@QEAA@AEBV0@@Z
??0CExclusionExtConfig@@QEAA@KKE@Z
??0CExclusionFileNameConfig@@QEAA@AEBV0@@Z
??0CExclusionFileNameConfig@@QEAA@KK@Z
??0CExclusionFilePathConfig@@QEAA@AEBV0@@Z
??0CExclusionFilePathConfig@@QEAA@KK@Z
??0CExclusionFolderConfig@@QEAA@AEBV0@@Z
??0CExclusionFolderConfig@@QEAA@KK@Z
??0CExclusionRegistryConfig@@QEAA@AEBV0@@Z
??0CExclusionRegistryConfig@@QEAA@KK@Z
??0CFile@@QEAA@AEBV0@@Z
??0CFile@@QEAA@E@Z
??0CFileExtension@@QEAA@AEBV0@@Z
??0CFileExtension@@QEAA@KEEPEAVIMemoryAllocator@@@Z
??0CInclusionExtConfig@@QEAA@AEBV0@@Z
??0CInclusionExtConfig@@QEAA@KKE@Z
??0CInclusionFileNameConfig@@QEAA@AEBV0@@Z
??0CInclusionFileNameConfig@@QEAA@KK@Z
??0CInclusionFilePathConfig@@QEAA@AEBV0@@Z
??0CInclusionFilePathConfig@@QEAA@KK@Z
??0CInclusionFolderConfig@@QEAA@AEBV0@@Z
??0CInclusionFolderConfig@@QEAA@KK@Z
??0CKEvent@@QEAA@AEBV0@@Z
??0CKEvent@@QEAA@W4_EVENT_TYPE@@E@Z
??0CList@@QEAA@AEBV0@@Z
??0CList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CLockEvent@@QEAA@AEBV0@@Z
??0CLockEvent@@QEAA@XZ
??0CLockList@@QEAA@AEBV0@@Z
??0CLockList@@QEAA@KKPEAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IEAA@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QEAA@AEBV0@@Z
??0CMemoryPoolAllocator@@IEAA@W4_POOL_TYPE@@_K1K@Z
??0CMemoryPoolAllocator@@QEAA@AEBV0@@Z
??0CModuleConfig@@QEAA@AEBV0@@Z
??0CModuleConfig@@QEAA@XZ
??0CModuleConfigList@@QEAA@AEBV0@@Z
??0CModuleConfigList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QEAA@AEBV0@@Z
??0CModuleFileExtConfig@@QEAA@KKE@Z
??0CModuleFlagConfig@@QEAA@AEBV0@@Z
??0CModuleFlagConfig@@QEAA@K@Z
??0CModuleMultiStringConfig@@QEAA@AEBV0@@Z
??0CModuleMultiStringConfig@@QEAA@KK@Z
??0CModuleStringConfig@@QEAA@AEBV0@@Z
??0CModuleStringConfig@@QEAA@K@Z
??0CNoLockList@@QEAA@AEBV0@@Z
??0CNoLockList@@QEAA@KKPEAVIMemoryAllocator@@@Z
??0CSmartLock@@QEAA@AEAVCLockEvent@@@Z
??0CSmartLock@@QEAA@XZ
??0CSmartReference@@QEAA@AEAJ@Z
??0CSmartReference@@QEAA@AEAK@Z
??0CSmartResource@@QEAA@AEAVCResource@@E@Z
??0CStrList@@QEAA@AEBV0@@Z
??0CStrList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CSystemThread@@QEAA@AEBV0@@Z
??0CSystemThread@@QEAA@K@Z
??0CUserFuncAdapterJob@@QEAA@AEBV0@@Z
??0CUserFuncAdapterJob@@QEAA@P6AXPEAX@Z01@Z
??0CWorkerThread@@IEAA@PEAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QEAA@AEBV0@@Z
??0CWorkerThreadJob@@QEAA@AEBV0@@Z
??0CWorkerThreadJob@@QEAA@E@Z
??0CWorkerThreadJobQueue@@QEAA@AEBV0@@Z
??0CWorkerThreadJobQueue@@QEAA@K@Z
??0CWorkerThreadPool@@QEAA@AEBV0@@Z
??0CWorkerThreadPool@@QEAA@K@Z
??0CWorkerThreadPoolEx@@QEAA@AEBV0@@Z
??0CWorkerThreadPoolEx@@QEAA@KK@Z
??0IMemoryAllocator@@QEAA@AEBV0@@Z
??0IMemoryAllocator@@QEAA@XZ
??1CAutoUpdateConfigThread@@UEAA@XZ
??1CBlobConfig@@UEAA@XZ
??1CContext@@UEAA@XZ
??1CContextList@@UEAA@XZ
??1CDebugLog@@UEAA@XZ
??1CDebugLogEx@@UEAA@XZ
??1CDelayLoadThread@@UEAA@XZ
??1CExclusionExtConfig@@UEAA@XZ
??1CExclusionFileNameConfig@@UEAA@XZ
??1CExclusionFilePathConfig@@UEAA@XZ
??1CExclusionFolderConfig@@UEAA@XZ
??1CExclusionRegistryConfig@@UEAA@XZ
??1CFile@@UEAA@XZ
??1CFileExtension@@UEAA@XZ
??1CInclusionExtConfig@@UEAA@XZ
??1CInclusionFileNameConfig@@UEAA@XZ
??1CInclusionFilePathConfig@@UEAA@XZ
??1CInclusionFolderConfig@@UEAA@XZ
??1CKEvent@@UEAA@XZ
??1CList@@UEAA@XZ
??1CLockEvent@@UEAA@XZ
??1CLockList@@UEAA@XZ
??1CMemoryAllocator@@UEAA@XZ
??1CMemoryPoolAllocator@@UEAA@XZ
??1CModuleConfig@@UEAA@XZ
??1CModuleConfigList@@UEAA@XZ
??1CModuleFileExtConfig@@UEAA@XZ
??1CModuleFlagConfig@@UEAA@XZ
??1CModuleMultiStringConfig@@UEAA@XZ
??1CModuleStringConfig@@UEAA@XZ
??1CNoLockList@@UEAA@XZ
??1CSmartLock@@QEAA@XZ
??1CSmartReference@@QEAA@XZ
??1CSmartResource@@QEAA@XZ
??1CStrList@@UEAA@XZ
??1CSystemThread@@UEAA@XZ
??1CUserFuncAdapterJob@@UEAA@XZ
??1CWorkerThread@@UEAA@XZ
??1CWorkerThreadJob@@UEAA@XZ
??1CWorkerThreadJobQueue@@UEAA@XZ
??1CWorkerThreadPool@@UEAA@XZ
??1CWorkerThreadPoolEx@@UEAA@XZ
??1IMemoryAllocator@@UEAA@XZ
??2@YAPEAX_KPEAVIMemoryAllocator@@PEBDK@Z
??2CMemoryAllocator@@SAPEAX_K@Z
??2CMemoryPoolAllocator@@SAPEAX_K@Z
??3@YAXPEAX@Z
??3IMemoryAllocator@@SAXPEAX@Z
??4CAutoUpdateConfigThread@@QEAAAEAV0@AEBV0@@Z
??4CBlobConfig@@QEAAAEAV0@AEBV0@@Z
??4CContext@@QEAAAEAV0@AEBV0@@Z
??4CDebugLog@@QEAAAEAV0@AEBV0@@Z
??4CDebugLogEx@@QEAAAEAV0@AEBV0@@Z
??4CDelayLoadThread@@QEAAAEAV0@AEBV0@@Z
??4CFile@@QEAAAEAV0@AEBV0@@Z
??4CKEvent@@QEAAAEAV0@AEBV0@@Z
??4CLockEvent@@QEAAAEAV0@AEBV0@@Z
??4CMemoryAllocator@@QEAAAEAV0@AEBV0@@Z
??4CMemoryPoolAllocator@@QEAAAEAV0@AEBV0@@Z
??4CModuleConfig@@QEAAAEAV0@AEBV0@@Z
??4CModuleFlagConfig@@QEAAAEAV0@AEBV0@@Z
??4CModuleStringConfig@@QEAAAEAV0@AEBV0@@Z
??4CSmartLock@@QEAAAEAV0@AEBV0@@Z
??4CSmartLock@@QEAAAEBV0@AEAVCLockEvent@@@Z
??4CSmartResource@@QEAAAEAV0@AEBV0@@Z
??4CSystemThread@@QEAAAEAV0@AEBV0@@Z
??4CUserFuncAdapterJob@@QEAAAEAV0@AEBV0@@Z
??4CWorkerThread@@QEAAAEAV0@AEBV0@@Z
??4CWorkerThreadJob@@QEAAAEAV0@AEBV0@@Z
??4IMemoryAllocator@@QEAAAEAV0@AEBV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CDebugLogEx@@6B@
??_7CDelayLoadThread@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CInclusionExtConfig@@6B@
??_7CInclusionFileNameConfig@@6B@
??_7CInclusionFilePathConfig@@6B@
??_7CInclusionFolderConfig@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CNoLockList@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7CWorkerThreadPoolEx@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QEAAXXZ
??_FCFile@@QEAAXXZ
??_FCFileExtension@@QEAAXXZ
??_FCModuleConfigList@@QEAAXXZ
??_FCStrList@@QEAAXXZ
??_FCSystemThread@@QEAAXXZ
??_FCWorkerThread@@QEAAXXZ
??_FCWorkerThreadJob@@QEAAXXZ
??_FCWorkerThreadJobQueue@@QEAAXXZ
??_U@YAPEAX_KPEAVIMemoryAllocator@@PEBDK@Z
??_V@YAXPEAX@Z
?Acquire@CLockEvent@@QEAAXXZ
?Add@CContextList@@QEAAEPEAVCContext@@@Z
?Add@CFileExtension@@QEAAEPEBGK@Z
?Add@CModuleConfigList@@QEAAEPEAVCModuleConfig@@@Z
?Add@CStrList@@QEAAEPEBG@Z
?AddNode@CLockList@@UEAAEQEAXE@Z
?AddNode@CNoLockList@@UEAAEQEAXE@Z
?Alloc@CMemoryAllocator@@UEAAPEAX_KPEBDK@Z
?Alloc@CMemoryPoolAllocator@@UEAAPEAX_KPEBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IEAAPEAX_K@Z
?AttachJobQueue@CWorkerThread@@QEAAXPEAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QEAAXXZ
?CheckNode@CLockList@@UEAAHQEAX@Z
?CheckNode@CNoLockList@@UEAAHQEAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QEAAXXZ
?Cleanup@CBlobConfig@@AEAAXXZ
?Cleanup@CModuleFileExtConfig@@IEAAXXZ
?Cleanup@CModuleMultiStringConfig@@IEAAXXZ
?Cleanup@CModuleStringConfig@@AEAAXXZ
?Close@CFile@@QEAAJXZ
?Count@CLockList@@QEAAKXZ
?Count@CNoLockList@@QEAAKXZ
?Create@CFile@@QEAAJPEBGKKKK@Z
?Create@CSystemThread@@QEAAEXZ
?CreateInstance@CMemoryAllocator@@SAPEAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SAPEAV1@W4_POOL_TYPE@@_K1K@Z
?CreatePool@CWorkerThreadPool@@QEAAEXZ
?CreatePool@CWorkerThreadPoolEx@@QEAAEXZ
?CreateThreads@CWorkerThreadPool@@QEAAEK@Z
?CreateThreads@CWorkerThreadPoolEx@@QEAAEK@Z
?CreateWIRP@CFile@@QEAAJPEBGKKKK@Z
?Delete@CFile@@QEAAJXZ
?Delete@CFileExtension@@QEAAEPEBGK@Z
?Delete@CStrList@@QEAAEPEBG@Z
?DeleteAll@CList@@UEAAXXZ
?DeleteAll@CLockList@@UEAAXXZ
?DeleteAll@CNoLockList@@UEAAXXZ
?DeleteNode@CContextList@@MEAAXPEAX@Z
?DeleteNode@CList@@UEAAXPEAX@Z
?DeleteNode@CModuleConfigList@@MEAAXPEAX@Z
?DeleteNode@CStrList@@EEAAXPEAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YAXPEAPEAX@Z
?DoIt@CWorkerThreadJob@@QEAAJXZ
?EntryPoint@CSystemThread@@KAXPEAX@Z
?Find@CContextList@@QEAAPEAVCContext@@K@Z
?Find@CContextList@@QEAAPEAVCContext@@PEAX@Z
?Find@CFileExtension@@QEAAPEAU_STR_LIST_NODE@CStrList@@PEBGK@Z
?Find@CModuleConfigList@@QEAAPEAVCModuleConfig@@K@Z
?Find@CStrList@@QEAAPEAU_STR_LIST_NODE@1@PEBG@Z
?FindNode@CContextList@@IEAAPEAXPEAX@Z
?FindPartiallyAndAllMatch@CStrList@@QEAAPEAU_STR_LIST_NODE@1@PEBG@Z
?FinishFunction@CUserFuncAdapterJob@@MEAAXXZ
?FinishIt@CWorkerThreadJob@@QEAAJXZ
?First@CList@@UEAAPEAXXZ
?First@CLockList@@UEAAPEAXXZ
?First@CNoLockList@@UEAAPEAXXZ
?Free@CMemoryAllocator@@UEAAXPEAX@Z
?Free@CMemoryPoolAllocator@@UEAAXPEAX@Z
?GetAttributes@CFile@@QEAAKXZ
?GetBasicInfomration@CFile@@IEAAJXZ
?GetBlobCofig@CContext@@UEAAJKPEAXPEAK@Z
?GetCategory@CContext@@QEAAKXZ
?GetData@CBlobConfig@@QEAAHPEAXPEAK@Z
?GetData@CModuleFileExtConfig@@QEAAHPEAGPEAK@Z
?GetData@CModuleFileExtConfig@@QEAAPEAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QEAAKXZ
?GetData@CModuleMultiStringConfig@@QEAAHPEAGPEAK@Z
?GetData@CModuleMultiStringConfig@@QEAAPEAVCStrList@@XZ
?GetData@CModuleStringConfig@@QEAAPEAGXZ
?GetData@CStrList@@QEAAEPEAGPEAK@Z
?GetDataType@CModuleConfig@@QEAAKXZ
?GetEngineContext@CContext@@QEAAPEAXXZ
?GetFileExtensionConfig@CContext@@QEAAPEAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UEAAJKPEAGPEAK@Z
?GetFileSize@CFile@@QEAAJPEAT_LARGE_INTEGER@@@Z
?GetFileSizeWIRP@CFile@@QEAAJPEAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UEAAJKPEAK@Z
?GetID@CModuleConfig@@QEAAKXZ
?GetJob@CWorkerThreadJobQueue@@QEAAPEAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QEAAKXZ
?GetLinkContext@CContext@@QEAAPEAXXZ
?GetLogFlag@CDebugLog@@QEAAKXZ
?GetLogFlag@CDebugLogEx@@QEAAKXZ
?GetModuleId@CModuleConfig@@QEAAKXZ
?GetMultiStringConfig@CContext@@QEAAPEAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UEAAJKPEAGPEAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QEAAPEAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPool@@QEAAPEAU_KTHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QEAAPEAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QEAAPEAU_KTHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QEAA_KXZ
?GetSize@CBlobConfig@@QEAAKXZ
?GetStringConfig@CContext@@QEAAPEAGK@Z
?GetStringConfig@CContext@@UEAAJKPEAGPEAK@Z
?GetThreadCount@CWorkerThreadPool@@QEAAKXZ
?GetThreadCount@CWorkerThreadPoolEx@@QEAAKXZ
?GetThreadID@CSystemThread@@QEAA_KXZ
?GetType@CContext@@QEAAKXZ
?GetUserParameter@CContext@@QEAA_KXZ
?InitProcMon@CDebugLogEx@@IEAAXXZ
?InitializeBlobConfig@CContext@@QEAAHKPEAXK@Z
?InitializeFileExtensionConfig@CContext@@QEAAHKPEBG@Z
?InitializeFlagConfig@CContext@@QEAAHKK@Z
?InitializeMultiStringConfig@CContext@@QEAAHKPEBG@Z
?InitializeStringConfig@CContext@@QEAAHKPEBG@Z
?Insert@CList@@UEAAXQEAXE@Z
?Insert@CLockList@@UEAAXQEAXE@Z
?Insert@CNoLockList@@UEAAXQEAXE@Z
?InsertAfter@CList@@UEAAXPEAX0@Z
?InsertBefore@CList@@UEAAXPEAX0@Z
?Instance@CWorkerThreadPool@@SAPEAV1@XZ
?IsEmpty@CList@@UEAAEXZ
?IsEmpty@CLockList@@UEAAEXZ
?IsEmpty@CNoLockList@@UEAAEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IEAAEK@Z
?IsFull@CLockList@@QEBAEXZ
?IsFull@CNoLockList@@QEBAEXZ
?IsInExclusionList@CExclusionExtConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionExtConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionFileNameConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionFilePathConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionFolderConfig@@QEAAEPEBG@Z
?IsOpened@CFile@@QEAAEXZ
?IsTerminated@CWorkerThreadPool@@QEAAEXZ
?IsTerminated@CWorkerThreadPoolEx@@QEAAEXZ
?IsValid@CMemoryAllocator@@UEAAEXZ
?IsValid@CMemoryPoolAllocator@@UEAAEXZ
?IsValid@IMemoryAllocator@@UEAAEXZ
?IsWorkerThread@CWorkerThreadPool@@QEAAE_K@Z
?IsWorkerThread@CWorkerThreadPoolEx@@QEAAE_K@Z
?JobFunction@CUserFuncAdapterJob@@MEAAXXZ
?JobQueue@CWorkerThreadPool@@QEAAAEAVCWorkerThreadJobQueue@@XZ
?JobQueue@CWorkerThreadPoolEx@@QEAAAEAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QEAAKXZ
?Limit@CNoLockList@@QEAAKXZ
?MatchAllExtensions@CFileExtension@@QEAAEXZ
?MatchNoExtensions@CFileExtension@@QEAAEXZ
?MergeLeft@CMemoryPoolAllocator@@IEAAPEAXPEAX@Z
?MergeRight@CMemoryPoolAllocator@@IEAAPEAXPEAX@Z
?NeedDelete@CWorkerThreadJob@@QEAAEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QEAAXE@Z
?NewNode@CList@@UEAAPEAXXZ
?NewNode@CStrList@@EEAAPEAXXZ
?NewNodeVariant@CList@@IEAAPEAXK@Z
?Next@CList@@UEBAPEAXQEAX@Z
?Next@CLockList@@UEBAPEAXQEAX@Z
?Next@CNoLockList@@UEBAPEAXQEAX@Z
?NextPool@CMemoryPoolAllocator@@QEAAPEAV1@XZ
?NotityTerminate@CWorkerThread@@QEAAXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QEAAJP6AXPEAX@Z0E@Z
?PostJobToWorkerThread@CWorkerThreadPoolEx@@QEAAJP6AXPEAX@Z0E1@Z
?Pulse@CKEvent@@QEAAJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QEAAEPEAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QEAAJPEAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPoolEx@@QEAAJPEAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SAPEAV1@XZ
?Read@CFile@@QEAAJPEADKPEAK@Z
?ReadWIRP@CFile@@QEAAJPEADKPEAK@Z
?ReferenceCount@CContext@@QEAAAEAKXZ
?Release@CLockEvent@@QEAAXXZ
?Remove@CContextList@@UEAAEQEAX@Z
?Remove@CList@@UEAAEQEAX@Z
?Remove@CLockList@@UEAAEQEAX@Z
?Remove@CNoLockList@@UEAAEQEAX@Z
?RemoveHead@CList@@UEAAPEAXXZ
?RemoveHead@CLockList@@UEAAPEAXXZ
?RemoveHead@CNoLockList@@UEAAPEAXXZ
?RemoveTail@CList@@UEAAPEAXXZ
?RemoveTail@CLockList@@UEAAPEAXXZ
?RemoveTail@CNoLockList@@UEAAPEAXXZ
?Reset@CKEvent@@QEAAXXZ
?ResetData@CInclusionExtConfig@@QEAAXXZ
?ResetData@CInclusionFileNameConfig@@QEAAXXZ
?ResetData@CInclusionFilePathConfig@@QEAAXXZ
?ResetData@CInclusionFolderConfig@@QEAAXXZ
?RestoreCR0@@YAXPEAX@Z
?Run@CAutoUpdateConfigThread@@UEAAXXZ
?Run@CDelayLoadThread@@UEAAXXZ
?Run@CWorkerThread@@UEAAXXZ
?SeekToEnd@CFile@@QEAAJXZ
?Set@CKEvent@@QEAAJJE@Z
?SetAttributes@CFile@@QEAAJK@Z
?SetBlobCofig@CContext@@UEAAJKPEAXK@Z
?SetData@CBlobConfig@@QEAAHPEAXK@Z
?SetData@CModuleFileExtConfig@@QEAAHPEBG@Z
?SetData@CModuleFlagConfig@@QEAAHK@Z
?SetData@CModuleMultiStringConfig@@QEAAHPEBGK@Z
?SetData@CModuleStringConfig@@QEAAHPEBG@Z
?SetEngineContext@CContext@@QEAAXPEAX@Z
?SetFileExtensionConfig@CContext@@UEAAJKPEBG@Z
?SetFlagConfig@CContext@@UEAAJKK@Z
?SetLinkContext@CContext@@QEAAXPEAX@Z
?SetLogFlag@CDebugLog@@QEAAEK@Z
?SetLogFlag@CDebugLogEx@@QEAAEK@Z
?SetMatchAllExtensions@CFileExtension@@QEAAXE@Z
?SetMatchNoExtensions@CFileExtension@@QEAAXE@Z
?SetMultiStringConfig@CContext@@UEAAJKPEBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QEAAXXZ
?SetPriority@CSystemThread@@QEAAXK@Z
?SetStopUse@CContext@@QEAAXXZ
?SetStringConfig@CContext@@UEAAJKPEBG@Z
?Setup@CSystemThread@@MEAAXXZ
?StopUse@CContext@@QEAAHXZ
?TearDown@CSystemThread@@MEAAXXZ
?Terminate@CSystemThread@@QEAAXE@Z
?Terminate@CWorkerThreadPool@@QEAAEXZ
?Terminate@CWorkerThreadPoolEx@@QEAAEXZ
?TmExceptionFilter@@YAJPEAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QEAAJPEAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QEAAXXZ
?WaitForInit@CDelayLoadThread@@QEAAEXZ
?WaitForLoad@CDelayLoadThread@@QEAAEXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QEAAEXZ
?WaitQueueEmpty@CWorkerThreadJobQueue@@QEAAXXZ
?Write@CDebugLog@@QEAAXPEBDZZ
?Write@CDebugLogEx@@QEAAXPEBDZZ
?Write@CFile@@QEAAJPEADKPEAT_LARGE_INTEGER@@PEAK@Z
?WriteDataToFile@CDebugLogEx@@IEAAXPEADK@Z
?WriteDataToProcMonW@CDebugLogEx@@IEAAXPEAD@Z
?WriteSystemInformation@CDebugLog@@QEAAXXZ
?WriteSystemInformation@CDebugLogEx@@QEAAXXZ
?WriteSystemStringInformation@CDebugLog@@IEAAXPEBG@Z
?WriteSystemStringInformation@CDebugLogEx@@IEAAXPEBG@Z
?WriteToFile@CDebugLog@@IEAAXPEADK@Z
?WriteToProcMonW@CDebugLogEx@@IEAAXPEAU_UNICODE_STRING@@@Z
?_pNonPagedAllocator@@3PEAVCMemoryAllocator@@EA
?_pPagedAllocator@@3PEAVCMemoryAllocator@@EA
?m_lpInstance@CWorkerThreadPool@@1PEAV1@EA
?m_lpRCMInstance@CWorkerThreadPool@@1PEAV1@EA
DeInitKm2UmCommunication
DeInitKmLPC
DuplicateFullFileName
FreeFullFileName
GetFileVersionOfNtoskrnl
GetKm2UmMode
GetModuleInfoByAddress
GetModuleInfoByModuleName
InitKm2UmCommunication
InitKmLPC
IsWindows8_1_update
KmCallUm
KmCallUmByLPC
KmCallUmEx
KmCleanupCommPortAPIs
KmGetUmInitProcess
KmSetCommPortAPIs
ModGetExportProcAddress
ModLoadDLLToBuffer
ModLoadDLLToBufferWithImageSize
ModLoadModule
ModUnLoadModule
NormalizeFileName
NormalizeFileName1
NormalizeFullNtPathToDosName
NormalizeFullNtPathToDosName1
TmCommConfigRoutine
UtilAddDeviceInDriveTable
UtilAddReparsePointMapping
UtilCleanFileReadOnly
UtilCloseExclusiveHandle
UtilCreateDosFileName
UtilDeleteFileForce
UtilGetDeviceObjectName
UtilGetFileNameFromFileObject
UtilGetFileObjectForProcessByEPROC
UtilGetFileObjectFromFileName
UtilGetProcessName
UtilGetSystemDirectory
UtilGetSystemDirectoryEx
UtilGetSystemDirectoryLength
UtilGetSystemTime
UtilIoSetFileInfo
UtilIopCreateFileIRP
UtilKeGetLowFileDevice
UtilModuleIATHook
UtilModuleIATUnHook
UtilPostJobToWorkerThread
UtilQueryExclusiveHandle
UtilQueryKeyValue
UtilRemoveDeviceFromDriveTable
UtilVolumeDeviceToDosName
UtilWaitValueChangeToZero
UtilWriteVersionToRegistry
UtilbuildDynamicDiskMappingTable
UtlWriteBinValueKeyToRegistry
ValidateAddressWithSize
_ResetProtectFromClose
_UtilDosPathNameToNtPathName

Sections

Expand

.text
.rdata
.data
.pdata
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

Property	Value
Filename	TmComm.sys
Creation Timestamp	2019-04-26 02:43:26
MD5	148bd10da8c8d64928a213c7bf1f2fca
SHA1	dfd801b6c2715f5525f8ffb38e3396a5ad9b831d
SHA256	fda93c6e41212e86af07f57ca95db841161f00b08dae6304a51b467056e56280
Authentihash MD5	4fdf46c89a0eb3a5482552a69bd4e21e
Authentihash SHA1	1a45053380feb519b9388c513b8867b0b40d8b8b
Authentihash SHA256	ef0dbc4c4735f30e96e16375b18c2f5fa58e15ef60d17786e39e616a4438e264
RichPEHeaderHash MD5	10609f326d2f94c82a36fc64676533d8
RichPEHeaderHash SHA1	2a6eaf986eff3455a32fb6a20ceb7c3ffe70bf41
RichPEHeaderHash SHA256	b61ea91d46738a0387b4bbfb7c154f3a1881c8cab9360fd8eb85e1dd8c5d386c
Company	Trend Micro Inc.
Description	TrendMicro Common Module
Product	Trend Micro Eyes
OriginalFilename	TmComm.sys

Download

Certificates

Expand

Certificate 7e93ebfb7cc64e59ea4b9a77d406fc3b

Field	Value
ToBeSigned (TBS) MD5	d0785ad36e427c92b19f6826ab1e8020
ToBeSigned (TBS) SHA1	365b7a9c21bd9373e49052c3e7b3e4646ddd4d43
ToBeSigned (TBS) SHA256	c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2
ValidFrom	2012-12-21 00:00:00
ValidTo	2020-12-30 23:59:59
Signature	03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	7e93ebfb7cc64e59ea4b9a77d406fc3b
Version	3

Certificate 0ecff438c8febf356e04d86a981b1a50

Field	Value
ToBeSigned (TBS) MD5	e9d38360b914c8863f6cba3ee58764d3
ToBeSigned (TBS) SHA1	4cba8eae47b6bf76f20b3504b98b8f062694a89b
ToBeSigned (TBS) SHA256	88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976
Subject	C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4
ValidFrom	2012-10-18 00:00:00
ValidTo	2020-12-29 23:59:59
Signature	783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	0ecff438c8febf356e04d86a981b1a50
Version	3

Certificate 60d927b542b7d1147fb2f0c4b9c1bbb2

Field	Value
ToBeSigned (TBS) MD5	869d63236005004b14196f1446676514
ToBeSigned (TBS) SHA1	5ab0ae52f86a1af51af5a3421d581cc4899f1ccf
ToBeSigned (TBS) SHA256	55c2a996787daba322e26cfeb97216d96f9b0d12fd89b075c3a544f31c9930bd
Subject	C=TW, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.
ValidFrom	2018-05-22 00:00:00
ValidTo	2019-07-16 23:59:59
Signature	f51f3f5ad8cfb51aee3156e1761cf440c448eda8ccacbc48cda1a43f3478a66508bf41a9080e901c134a5d067db2b1175f7352e2b1212a89b0860a46d610412556c2edc049b661d682b418501a89b1e8334ef89be22cc41286eb88be9d529466c5f7455be0a55046c78a77c839524125351d8468b822584925a1466f81e631794b8bfb9f3844b8249cfa8b4fc5ab102cfe61dc182a24fcd1eb15043d98615a5fe574a64af3c9f83621fd4f74be0cce77fa3a7fc5d17b07bbbb034163dbc573be495ebc59b7ea9f4bfde65cb16125195ac4cf2d9d4a50c8c3bcf120cd3b26a5194c0672dd1349fe432df6c6afcc4f82700df8f899dbf035a70c8b294466bf3ae6
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	False
SerialNumber	60d927b542b7d1147fb2f0c4b9c1bbb2
Version	3

Certificate 611993e400000000001c

Field	Value
ToBeSigned (TBS) MD5	78a717e082dcc1cda3458d917e677d14
ToBeSigned (TBS) SHA1	4a872e0e51f9b304469cd1dedb496ee9b8b983a4
ToBeSigned (TBS) SHA256	317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5
ValidFrom	2011-02-22 19:25:17
ValidTo	2021-02-22 19:35:17
Signature	812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	611993e400000000001c
Version	3

Certificate 5200e5aa2556fc1a86ed96c9d44b33c7

Field	Value
ToBeSigned (TBS) MD5	b30c31a572b0409383ed3fbe17e56e81
ToBeSigned (TBS) SHA1	4843a82ed3b1f2bfbee9671960e1940c942f688d
ToBeSigned (TBS) SHA256	03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9
Subject	C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA
ValidFrom	2010-02-08 00:00:00
ValidTo	2020-02-07 23:59:59
Signature	5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3
SignatureAlgorithmOID	1.2.840.113549.1.1.5
IsCertificateAuthority	True
SerialNumber	5200e5aa2556fc1a86ed96c9d44b33c7
Version	3

Imports

Expand

ntoskrnl.exe

Imported Functions

Expand

KeLeaveCriticalRegion
wcsncpy
KeEnterCriticalRegion
ExAcquireFastMutexUnsafe
wcsrchr
ExAcquireResourceSharedLite
ExReleaseResourceLite
_purecall
ZwOpenEvent
ZwConnectPort
KeClearEvent
PsProcessType
ExFreePoolWithTag
RtlInitUnicodeString
KeSetEvent
ProbeForWrite
KeUnstackDetachProcess
ZwRequestWaitReplyPort
ZwWaitForSingleObject
DbgBreakPoint
ZwSetEvent
IoGetCurrentProcess
ZwFreeVirtualMemory
ZwClose
ObfReferenceObject
ObfDereferenceObject
RtlUnicodeStringToInteger
ZwCreateSection
ObOpenObjectByPointer
KeStackAttachProcess
KePulseEvent
ZwAllocateVirtualMemory
ObGetObjectSecurity
SeAccessCheck
SeReleaseSubjectContext
SeCaptureSubjectContext
PsThreadType
ObReleaseObjectSecurity
PsGetProcessExitTime
MmSectionObjectType
DbgPrint
ExDeleteResourceLite
ExInitializeResourceLite
ZwReadFile
swprintf
ZwSetInformationFile
ZwCreateFile
ZwQueryInformationFile
ZwWriteFile
_wcsnicmp
towupper
ExAllocatePoolWithTag
KeInitializeEvent
ZwCreateEvent
ZwCreateKey
RtlAnsiStringToUnicodeString
ZwNotifyChangeKey
RtlInitAnsiString
_snprintf
RtlFreeUnicodeString
ExSystemTimeToLocalTime
_vsnprintf
ObReferenceObjectByHandle
RtlTimeToTimeFields
ZwDeviceIoControlFile
PsGetCurrentThreadId
PsGetCurrentProcessId
KeWaitForMultipleObjects
ExGetPreviousMode
RtlEqualUnicodeString
RtlPrefixUnicodeString
RtlAppendUnicodeStringToString
RtlCopyUnicodeString
RtlUpcaseUnicodeChar
KeWaitForSingleObject
KeSetPriorityThread
PsCreateSystemThread
PsTerminateSystemThread
MmIsAddressValid
KeDelayExecutionThread
KeNumberProcessors
PsLookupProcessByProcessId
PsSetCreateProcessNotifyRoutine
ZwOpenDirectoryObject
ZwQueryInformationProcess
ZwQuerySecurityObject
NtSetInformationFile
ZwDeleteValueKey
ZwSetValueKey
ZwQuerySystemInformation
NtQueryInformationFile
IoFileObjectType
ZwQueryValueKey
ZwQueryDirectoryFile
NtCreateFile
ZwEnumerateValueKey
RtlLengthSecurityDescriptor
ZwQueryDirectoryObject
ZwSetSecurityObject
ZwDuplicateObject
ZwOpenProcess
ZwTerminateProcess
ExReleaseFastMutexUnsafe
ZwEnumerateKey
ZwQueryKey
ZwOpenKey
MmSystemRangeStart
_stricmp
_strnicmp
mbstowcs
ProbeForRead
RtlUpcaseUnicodeString
_snwprintf
ZwQuerySymbolicLinkObject
ZwMapViewOfSection
MmGetSystemRoutineAddress
RtlAppendUnicodeToString
IoCreateFile
RtlQueryRegistryValues
MmBuildMdlForNonPagedPool
ZwOpenSymbolicLinkObject
IoFreeMdl
ObQueryNameString
ZwUnmapViewOfSection
NtClose
IoFreeIrp
PsGetVersion
IoAllocateIrp
RtlCompareMemory
MmUnlockPages
ZwSetInformationObject
ZwOpenFile
wcsncmp
RtlImageNtHeader
IoAllocateMdl
IofCallDriver
ZwQueryVolumeInformationFile
ObReferenceObjectByPointer
IoBuildDeviceIoControlRequest
ZwOpenSection
RtlSubAuthoritySid
RtlLengthRequiredSid
ExReleaseFastMutex
ExAcquireFastMutex
RtlCreateAcl
RtlSetDaclSecurityDescriptor
RtlAddAccessAllowedAce
KeInitializeSemaphore
KeReleaseSemaphore
RtlInitializeSid
RtlCreateSecurityDescriptor
IoDeleteSymbolicLink
IoDeleteDevice
IoGetDeviceObjectPointer
ExEventObjectType
IofCompleteRequest
IoCreateSymbolicLink
ObOpenObjectByName
NtQueryInformationProcess
strncpy
NtOpenProcess
ObInsertObject
IoAcquireVpbSpinLock
SeCreateAccessState
IoGetFileObjectGenericMapping
ObCreateObject
KeAcquireQueuedSpinLock
KeReleaseQueuedSpinLock
IoReleaseVpbSpinLock
wcschr
strncat
RtlUnicodeStringToAnsiString
wcsncat
RtlFreeAnsiString
wcstombs
IoGetConfigurationInformation
IoRegisterPlugPlayNotification
IoGetStackLimits
IoBuildSynchronousFsdRequest
KeReleaseSpinLock
ExpInterlockedPopEntrySList
FsRtlIsNameInExpression
wcsstr
ExAllocatePool
IoUnregisterPlugPlayNotification
MmProbeAndLockPages
RtlCompareUnicodeString
IoGetDeviceInterfaces
KeAcquireSpinLockRaiseToDpc
KeBugCheckEx
IoCreateDevice
IoDeviceObjectType
SeCaptureSecurityDescriptor
RtlAbsoluteToSelfRelativeSD
IoIsWdmVersionAvailable
SeExports
RtlLengthSid
RtlGetSaclSecurityDescriptor
RtlGetDaclSecurityDescriptor
RtlGetGroupSecurityDescriptor
RtlGetOwnerSecurityDescriptor
ZwDeleteKey
ExAcquireResourceExclusiveLite
__C_specific_handler

Exported Functions

Expand

??0CAutoUpdateConfigThread@@QEAA@AEBV0@@Z
??0CAutoUpdateConfigThread@@QEAA@PEAU_UNICODE_STRING@@P6AX0PEAX@Z1@Z
??0CBlobConfig@@QEAA@AEBV0@@Z
??0CBlobConfig@@QEAA@K@Z
??0CContext@@QEAA@AEBV0@@Z
??0CContext@@QEAA@KP6AJPEAU_EVENT_REPORT@@PEAXPEAU_TMCE_REPORT@@PEAU_TMCE_FEEDBACK@@@Z1K@Z
??0CContextList@@QEAA@AEBV0@@Z
??0CContextList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CDebugLog@@QEAA@AEBV0@@Z
??0CDebugLog@@QEAA@PEBG@Z
??0CDebugLogEx@@QEAA@AEBV0@@Z
??0CDebugLogEx@@QEAA@K@Z
??0CDelayLoadThread@@QEAA@AEBV0@@Z
??0CDelayLoadThread@@QEAA@XZ
??0CExclusionExtConfig@@QEAA@AEBV0@@Z
??0CExclusionExtConfig@@QEAA@KKE@Z
??0CExclusionFileNameConfig@@QEAA@AEBV0@@Z
??0CExclusionFileNameConfig@@QEAA@KK@Z
??0CExclusionFilePathConfig@@QEAA@AEBV0@@Z
??0CExclusionFilePathConfig@@QEAA@KK@Z
??0CExclusionFolderConfig@@QEAA@AEBV0@@Z
??0CExclusionFolderConfig@@QEAA@KK@Z
??0CExclusionRegistryConfig@@QEAA@AEBV0@@Z
??0CExclusionRegistryConfig@@QEAA@KK@Z
??0CFile@@QEAA@AEBV0@@Z
??0CFile@@QEAA@E@Z
??0CFileExtension@@QEAA@AEBV0@@Z
??0CFileExtension@@QEAA@KEEPEAVIMemoryAllocator@@@Z
??0CInclusionExtConfig@@QEAA@AEBV0@@Z
??0CInclusionExtConfig@@QEAA@KKE@Z
??0CInclusionFileNameConfig@@QEAA@AEBV0@@Z
??0CInclusionFileNameConfig@@QEAA@KK@Z
??0CInclusionFilePathConfig@@QEAA@AEBV0@@Z
??0CInclusionFilePathConfig@@QEAA@KK@Z
??0CInclusionFolderConfig@@QEAA@AEBV0@@Z
??0CInclusionFolderConfig@@QEAA@KK@Z
??0CKEvent@@QEAA@AEBV0@@Z
??0CKEvent@@QEAA@W4_EVENT_TYPE@@E@Z
??0CList@@QEAA@AEBV0@@Z
??0CList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CLockEvent@@QEAA@AEBV0@@Z
??0CLockEvent@@QEAA@XZ
??0CLockList@@QEAA@AEBV0@@Z
??0CLockList@@QEAA@KKPEAVIMemoryAllocator@@@Z
??0CMemoryAllocator@@IEAA@W4_POOL_TYPE@@K@Z
??0CMemoryAllocator@@QEAA@AEBV0@@Z
??0CMemoryPoolAllocator@@IEAA@W4_POOL_TYPE@@_K1K@Z
??0CMemoryPoolAllocator@@QEAA@AEBV0@@Z
??0CModuleConfig@@QEAA@AEBV0@@Z
??0CModuleConfig@@QEAA@XZ
??0CModuleConfigList@@QEAA@AEBV0@@Z
??0CModuleConfigList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CModuleFileExtConfig@@QEAA@AEBV0@@Z
??0CModuleFileExtConfig@@QEAA@KKE@Z
??0CModuleFlagConfig@@QEAA@AEBV0@@Z
??0CModuleFlagConfig@@QEAA@K@Z
??0CModuleMultiStringConfig@@QEAA@AEBV0@@Z
??0CModuleMultiStringConfig@@QEAA@KK@Z
??0CModuleStringConfig@@QEAA@AEBV0@@Z
??0CModuleStringConfig@@QEAA@K@Z
??0CNoLockList@@QEAA@AEBV0@@Z
??0CNoLockList@@QEAA@KKPEAVIMemoryAllocator@@@Z
??0CSmartLock@@QEAA@AEAVCLockEvent@@@Z
??0CSmartLock@@QEAA@XZ
??0CSmartReference@@QEAA@AEAJ@Z
??0CSmartReference@@QEAA@AEAK@Z
??0CSmartResource@@QEAA@AEAVCResource@@E@Z
??0CStrList@@QEAA@AEBV0@@Z
??0CStrList@@QEAA@KPEAVIMemoryAllocator@@@Z
??0CSystemThread@@QEAA@AEBV0@@Z
??0CSystemThread@@QEAA@K@Z
??0CUserFuncAdapterJob@@QEAA@AEBV0@@Z
??0CUserFuncAdapterJob@@QEAA@P6AXPEAX@Z01@Z
??0CWorkerThread@@IEAA@PEAVCWorkerThreadJobQueue@@@Z
??0CWorkerThread@@QEAA@AEBV0@@Z
??0CWorkerThreadJob@@QEAA@AEBV0@@Z
??0CWorkerThreadJob@@QEAA@E@Z
??0CWorkerThreadJobQueue@@QEAA@AEBV0@@Z
??0CWorkerThreadJobQueue@@QEAA@K@Z
??0CWorkerThreadPool@@QEAA@AEBV0@@Z
??0CWorkerThreadPool@@QEAA@K@Z
??0CWorkerThreadPoolEx@@QEAA@AEBV0@@Z
??0CWorkerThreadPoolEx@@QEAA@KK@Z
??0IMemoryAllocator@@QEAA@AEBV0@@Z
??0IMemoryAllocator@@QEAA@XZ
??1CAutoUpdateConfigThread@@UEAA@XZ
??1CBlobConfig@@UEAA@XZ
??1CContext@@UEAA@XZ
??1CContextList@@UEAA@XZ
??1CDebugLog@@UEAA@XZ
??1CDebugLogEx@@UEAA@XZ
??1CDelayLoadThread@@UEAA@XZ
??1CExclusionExtConfig@@UEAA@XZ
??1CExclusionFileNameConfig@@UEAA@XZ
??1CExclusionFilePathConfig@@UEAA@XZ
??1CExclusionFolderConfig@@UEAA@XZ
??1CExclusionRegistryConfig@@UEAA@XZ
??1CFile@@UEAA@XZ
??1CFileExtension@@UEAA@XZ
??1CInclusionExtConfig@@UEAA@XZ
??1CInclusionFileNameConfig@@UEAA@XZ
??1CInclusionFilePathConfig@@UEAA@XZ
??1CInclusionFolderConfig@@UEAA@XZ
??1CKEvent@@UEAA@XZ
??1CList@@UEAA@XZ
??1CLockEvent@@UEAA@XZ
??1CLockList@@UEAA@XZ
??1CMemoryAllocator@@UEAA@XZ
??1CMemoryPoolAllocator@@UEAA@XZ
??1CModuleConfig@@UEAA@XZ
??1CModuleConfigList@@UEAA@XZ
??1CModuleFileExtConfig@@UEAA@XZ
??1CModuleFlagConfig@@UEAA@XZ
??1CModuleMultiStringConfig@@UEAA@XZ
??1CModuleStringConfig@@UEAA@XZ
??1CNoLockList@@UEAA@XZ
??1CSmartLock@@QEAA@XZ
??1CSmartReference@@QEAA@XZ
??1CSmartResource@@QEAA@XZ
??1CStrList@@UEAA@XZ
??1CSystemThread@@UEAA@XZ
??1CUserFuncAdapterJob@@UEAA@XZ
??1CWorkerThread@@UEAA@XZ
??1CWorkerThreadJob@@UEAA@XZ
??1CWorkerThreadJobQueue@@UEAA@XZ
??1CWorkerThreadPool@@UEAA@XZ
??1CWorkerThreadPoolEx@@UEAA@XZ
??1IMemoryAllocator@@UEAA@XZ
??2@YAPEAX_KPEAVIMemoryAllocator@@PEBDK@Z
??2CMemoryAllocator@@SAPEAX_K@Z
??2CMemoryPoolAllocator@@SAPEAX_K@Z
??3@YAXPEAX@Z
??3IMemoryAllocator@@SAXPEAX@Z
??4CAutoUpdateConfigThread@@QEAAAEAV0@AEBV0@@Z
??4CBlobConfig@@QEAAAEAV0@AEBV0@@Z
??4CContext@@QEAAAEAV0@AEBV0@@Z
??4CDebugLog@@QEAAAEAV0@AEBV0@@Z
??4CDebugLogEx@@QEAAAEAV0@AEBV0@@Z
??4CDelayLoadThread@@QEAAAEAV0@AEBV0@@Z
??4CFile@@QEAAAEAV0@AEBV0@@Z
??4CKEvent@@QEAAAEAV0@AEBV0@@Z
??4CLockEvent@@QEAAAEAV0@AEBV0@@Z
??4CMemoryAllocator@@QEAAAEAV0@AEBV0@@Z
??4CMemoryPoolAllocator@@QEAAAEAV0@AEBV0@@Z
??4CModuleConfig@@QEAAAEAV0@AEBV0@@Z
??4CModuleFlagConfig@@QEAAAEAV0@AEBV0@@Z
??4CModuleStringConfig@@QEAAAEAV0@AEBV0@@Z
??4CSmartLock@@QEAAAEAV0@AEBV0@@Z
??4CSmartLock@@QEAAAEBV0@AEAVCLockEvent@@@Z
??4CSmartResource@@QEAAAEAV0@AEBV0@@Z
??4CSystemThread@@QEAAAEAV0@AEBV0@@Z
??4CUserFuncAdapterJob@@QEAAAEAV0@AEBV0@@Z
??4CWorkerThread@@QEAAAEAV0@AEBV0@@Z
??4CWorkerThreadJob@@QEAAAEAV0@AEBV0@@Z
??4IMemoryAllocator@@QEAAAEAV0@AEBV0@@Z
??_7CAutoUpdateConfigThread@@6B@
??_7CBlobConfig@@6B@
??_7CContext@@6B@
??_7CContextList@@6B@
??_7CDebugLog@@6B@
??_7CDebugLogEx@@6B@
??_7CDelayLoadThread@@6B@
??_7CExclusionExtConfig@@6B@
??_7CExclusionFileNameConfig@@6B@
??_7CExclusionFilePathConfig@@6B@
??_7CExclusionFolderConfig@@6B@
??_7CExclusionRegistryConfig@@6B@
??_7CFile@@6B@
??_7CFileExtension@@6B@
??_7CInclusionExtConfig@@6B@
??_7CInclusionFileNameConfig@@6B@
??_7CInclusionFilePathConfig@@6B@
??_7CInclusionFolderConfig@@6B@
??_7CKEvent@@6B@
??_7CList@@6B@
??_7CLockEvent@@6B@
??_7CLockList@@6B@
??_7CMemoryAllocator@@6B@
??_7CMemoryPoolAllocator@@6B@
??_7CModuleConfig@@6B@
??_7CModuleConfigList@@6B@
??_7CModuleFileExtConfig@@6B@
??_7CModuleFlagConfig@@6B@
??_7CModuleMultiStringConfig@@6B@
??_7CModuleStringConfig@@6B@
??_7CNoLockList@@6B@
??_7CStrList@@6B@
??_7CSystemThread@@6B@
??_7CUserFuncAdapterJob@@6B@
??_7CWorkerThread@@6B@
??_7CWorkerThreadJob@@6B@
??_7CWorkerThreadJobQueue@@6B@
??_7CWorkerThreadPool@@6B@
??_7CWorkerThreadPoolEx@@6B@
??_7IMemoryAllocator@@6B@
??_FCContextList@@QEAAXXZ
??_FCFile@@QEAAXXZ
??_FCFileExtension@@QEAAXXZ
??_FCModuleConfigList@@QEAAXXZ
??_FCStrList@@QEAAXXZ
??_FCSystemThread@@QEAAXXZ
??_FCWorkerThread@@QEAAXXZ
??_FCWorkerThreadJob@@QEAAXXZ
??_FCWorkerThreadJobQueue@@QEAAXXZ
??_U@YAPEAX_KPEAVIMemoryAllocator@@PEBDK@Z
??_V@YAXPEAX@Z
?Acquire@CLockEvent@@QEAAXXZ
?Add@CContextList@@QEAAEPEAVCContext@@@Z
?Add@CFileExtension@@QEAAEPEBGK@Z
?Add@CModuleConfigList@@QEAAEPEAVCModuleConfig@@@Z
?Add@CStrList@@QEAAEPEBG@Z
?AddNode@CLockList@@UEAAEQEAXE@Z
?AddNode@CNoLockList@@UEAAEQEAXE@Z
?Alloc@CMemoryAllocator@@UEAAPEAX_KPEBDK@Z
?Alloc@CMemoryPoolAllocator@@UEAAPEAX_KPEBDK@Z
?AllocBlock@CMemoryPoolAllocator@@IEAAPEAX_K@Z
?AttachJobQueue@CWorkerThread@@QEAAXPEAVCWorkerThreadJobQueue@@@Z
?Cancel@CWorkerThreadJob@@QEAAXXZ
?CheckNode@CLockList@@UEAAHQEAX@Z
?CheckNode@CNoLockList@@UEAAHQEAX@Z
?CleanQueue@CWorkerThreadJobQueue@@QEAAXXZ
?Cleanup@CBlobConfig@@AEAAXXZ
?Cleanup@CModuleFileExtConfig@@IEAAXXZ
?Cleanup@CModuleMultiStringConfig@@IEAAXXZ
?Cleanup@CModuleStringConfig@@AEAAXXZ
?Close@CFile@@QEAAJXZ
?Count@CLockList@@QEAAKXZ
?Count@CNoLockList@@QEAAKXZ
?Create@CFile@@QEAAJPEBGKKKK@Z
?Create@CSystemThread@@QEAAEXZ
?CreateInstance@CMemoryAllocator@@SAPEAV1@W4_POOL_TYPE@@K@Z
?CreateInstance@CMemoryPoolAllocator@@SAPEAV1@W4_POOL_TYPE@@_K1K@Z
?CreatePool@CWorkerThreadPool@@QEAAEXZ
?CreatePool@CWorkerThreadPoolEx@@QEAAEXZ
?CreateThreads@CWorkerThreadPool@@QEAAEK@Z
?CreateThreads@CWorkerThreadPoolEx@@QEAAEK@Z
?CreateWIRP@CFile@@QEAAJPEBGKKKK@Z
?Delete@CFile@@QEAAJXZ
?Delete@CFileExtension@@QEAAEPEBGK@Z
?Delete@CStrList@@QEAAEPEBG@Z
?DeleteAll@CList@@UEAAXXZ
?DeleteAll@CLockList@@UEAAXXZ
?DeleteAll@CNoLockList@@UEAAXXZ
?DeleteNode@CContextList@@MEAAXPEAX@Z
?DeleteNode@CList@@UEAAXPEAX@Z
?DeleteNode@CModuleConfigList@@MEAAXPEAX@Z
?DeleteNode@CStrList@@EEAAXPEAU_STR_LIST_NODE@1@@Z
?DisableWriteProtectFromCR0@@YAXPEAPEAX@Z
?DoIt@CWorkerThreadJob@@QEAAJXZ
?EntryPoint@CSystemThread@@KAXPEAX@Z
?Find@CContextList@@QEAAPEAVCContext@@K@Z
?Find@CContextList@@QEAAPEAVCContext@@PEAX@Z
?Find@CFileExtension@@QEAAPEAU_STR_LIST_NODE@CStrList@@PEBGK@Z
?Find@CModuleConfigList@@QEAAPEAVCModuleConfig@@K@Z
?Find@CStrList@@QEAAPEAU_STR_LIST_NODE@1@PEBG@Z
?FindNode@CContextList@@IEAAPEAXPEAX@Z
?FindPartiallyAndAllMatch@CStrList@@QEAAPEAU_STR_LIST_NODE@1@PEBG@Z
?FinishFunction@CUserFuncAdapterJob@@MEAAXXZ
?FinishIt@CWorkerThreadJob@@QEAAJXZ
?First@CList@@UEAAPEAXXZ
?First@CLockList@@UEAAPEAXXZ
?First@CNoLockList@@UEAAPEAXXZ
?Free@CMemoryAllocator@@UEAAXPEAX@Z
?Free@CMemoryPoolAllocator@@UEAAXPEAX@Z
?GetAttributes@CFile@@QEAAKXZ
?GetBasicInfomration@CFile@@IEAAJXZ
?GetBlobCofig@CContext@@UEAAJKPEAXPEAK@Z
?GetCategory@CContext@@QEAAKXZ
?GetData@CBlobConfig@@QEAAHPEAXPEAK@Z
?GetData@CModuleFileExtConfig@@QEAAHPEAGPEAK@Z
?GetData@CModuleFileExtConfig@@QEAAPEAVCFileExtension@@XZ
?GetData@CModuleFlagConfig@@QEAAKXZ
?GetData@CModuleMultiStringConfig@@QEAAHPEAGPEAK@Z
?GetData@CModuleMultiStringConfig@@QEAAPEAVCStrList@@XZ
?GetData@CModuleStringConfig@@QEAAPEAGXZ
?GetData@CStrList@@QEAAEPEAGPEAK@Z
?GetDataType@CModuleConfig@@QEAAKXZ
?GetEngineContext@CContext@@QEAAPEAXXZ
?GetFileExtensionConfig@CContext@@QEAAPEAVCFileExtension@@K@Z
?GetFileExtensionConfig@CContext@@UEAAJKPEAGPEAK@Z
?GetFileSize@CFile@@QEAAJPEAT_LARGE_INTEGER@@@Z
?GetFileSizeWIRP@CFile@@QEAAJPEAT_LARGE_INTEGER@@@Z
?GetFlagConfig@CContext@@UEAAJKPEAK@Z
?GetID@CModuleConfig@@QEAAKXZ
?GetJob@CWorkerThreadJobQueue@@QEAAPEAVCWorkerThreadJob@@XZ
?GetLength@CModuleStringConfig@@QEAAKXZ
?GetLinkContext@CContext@@QEAAPEAXXZ
?GetLogFlag@CDebugLog@@QEAAKXZ
?GetLogFlag@CDebugLogEx@@QEAAKXZ
?GetModuleId@CModuleConfig@@QEAAKXZ
?GetMultiStringConfig@CContext@@QEAAPEAVCStrList@@K@Z
?GetMultiStringConfig@CContext@@UEAAJKPEAGPEAK@Z
?GetOneThreadTEB@CWorkerThreadPool@@QEAAPEAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPool@@QEAAPEAU_KTHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QEAAPEAU_ETHREAD@@XZ
?GetOneThreadTEB@CWorkerThreadPoolEx@@QEAAPEAU_KTHREAD@@XZ
?GetReportCallBackRoutine@CContext@@QEAA_KXZ
?GetSize@CBlobConfig@@QEAAKXZ
?GetStringConfig@CContext@@QEAAPEAGK@Z
?GetStringConfig@CContext@@UEAAJKPEAGPEAK@Z
?GetThreadCount@CWorkerThreadPool@@QEAAKXZ
?GetThreadCount@CWorkerThreadPoolEx@@QEAAKXZ
?GetThreadID@CSystemThread@@QEAA_KXZ
?GetType@CContext@@QEAAKXZ
?GetUserParameter@CContext@@QEAA_KXZ
?InitProcMon@CDebugLogEx@@IEAAXXZ
?InitializeBlobConfig@CContext@@QEAAHKPEAXK@Z
?InitializeFileExtensionConfig@CContext@@QEAAHKPEBG@Z
?InitializeFlagConfig@CContext@@QEAAHKK@Z
?InitializeMultiStringConfig@CContext@@QEAAHKPEBG@Z
?InitializeStringConfig@CContext@@QEAAHKPEBG@Z
?Insert@CList@@UEAAXQEAXE@Z
?Insert@CLockList@@UEAAXQEAXE@Z
?Insert@CNoLockList@@UEAAXQEAXE@Z
?InsertAfter@CList@@UEAAXPEAX0@Z
?InsertBefore@CList@@UEAAXPEAX0@Z
?Instance@CWorkerThreadPool@@SAPEAV1@XZ
?IsEmpty@CList@@UEAAEXZ
?IsEmpty@CLockList@@UEAAEXZ
?IsEmpty@CNoLockList@@UEAAEXZ
?IsExceedLimitation@CMemoryPoolAllocator@@IEAAEK@Z
?IsFull@CLockList@@QEBAEXZ
?IsFull@CNoLockList@@QEBAEXZ
?IsInExclusionList@CExclusionExtConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionFileNameConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionFilePathConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionFolderConfig@@QEAAEPEBG@Z
?IsInExclusionList@CExclusionRegistryConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionExtConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionFileNameConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionFilePathConfig@@QEAAEPEBG@Z
?IsInInclusionList@CInclusionFolderConfig@@QEAAEPEBG@Z
?IsOpened@CFile@@QEAAEXZ
?IsTerminated@CWorkerThreadPool@@QEAAEXZ
?IsTerminated@CWorkerThreadPoolEx@@QEAAEXZ
?IsValid@CMemoryAllocator@@UEAAEXZ
?IsValid@CMemoryPoolAllocator@@UEAAEXZ
?IsValid@IMemoryAllocator@@UEAAEXZ
?IsWorkerThread@CWorkerThreadPool@@QEAAE_K@Z
?IsWorkerThread@CWorkerThreadPoolEx@@QEAAE_K@Z
?JobFunction@CUserFuncAdapterJob@@MEAAXXZ
?JobQueue@CWorkerThreadPool@@QEAAAEAVCWorkerThreadJobQueue@@XZ
?JobQueue@CWorkerThreadPoolEx@@QEAAAEAVCWorkerThreadJobQueue@@XZ
?Limit@CLockList@@QEAAKXZ
?Limit@CNoLockList@@QEAAKXZ
?MatchAllExtensions@CFileExtension@@QEAAEXZ
?MatchNoExtensions@CFileExtension@@QEAAEXZ
?MergeLeft@CMemoryPoolAllocator@@IEAAPEAXPEAX@Z
?MergeRight@CMemoryPoolAllocator@@IEAAPEAXPEAX@Z
?NeedDelete@CWorkerThreadJob@@QEAAEXZ
?NeedDeleteWhenFinish@CWorkerThreadJob@@QEAAXE@Z
?NewNode@CList@@UEAAPEAXXZ
?NewNode@CStrList@@EEAAPEAXXZ
?NewNodeVariant@CList@@IEAAPEAXK@Z
?Next@CList@@UEBAPEAXQEAX@Z
?Next@CLockList@@UEBAPEAXQEAX@Z
?Next@CNoLockList@@UEBAPEAXQEAX@Z
?NextPool@CMemoryPoolAllocator@@QEAAPEAV1@XZ
?NotityTerminate@CWorkerThread@@QEAAXXZ
?PostJobToWorkerThread@CWorkerThreadPool@@QEAAJP6AXPEAX@Z0E@Z
?PostJobToWorkerThread@CWorkerThreadPoolEx@@QEAAJP6AXPEAX@Z0E1@Z
?Pulse@CKEvent@@QEAAJJE@Z
?QueueJob@CWorkerThreadJobQueue@@QEAAEPEAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPool@@QEAAJPEAVCWorkerThreadJob@@@Z
?QueueJobItem@CWorkerThreadPoolEx@@QEAAJPEAVCWorkerThreadJob@@@Z
?RCMInstance@CWorkerThreadPool@@SAPEAV1@XZ
?Read@CFile@@QEAAJPEADKPEAK@Z
?ReadWIRP@CFile@@QEAAJPEADKPEAK@Z
?ReferenceCount@CContext@@QEAAAEAKXZ
?Release@CLockEvent@@QEAAXXZ
?Remove@CContextList@@UEAAEQEAX@Z
?Remove@CList@@UEAAEQEAX@Z
?Remove@CLockList@@UEAAEQEAX@Z
?Remove@CNoLockList@@UEAAEQEAX@Z
?RemoveHead@CList@@UEAAPEAXXZ
?RemoveHead@CLockList@@UEAAPEAXXZ
?RemoveHead@CNoLockList@@UEAAPEAXXZ
?RemoveTail@CList@@UEAAPEAXXZ
?RemoveTail@CLockList@@UEAAPEAXXZ
?RemoveTail@CNoLockList@@UEAAPEAXXZ
?Reset@CKEvent@@QEAAXXZ
?ResetData@CInclusionExtConfig@@QEAAXXZ
?ResetData@CInclusionFileNameConfig@@QEAAXXZ
?ResetData@CInclusionFilePathConfig@@QEAAXXZ
?ResetData@CInclusionFolderConfig@@QEAAXXZ
?RestoreCR0@@YAXPEAX@Z
?Run@CAutoUpdateConfigThread@@UEAAXXZ
?Run@CDelayLoadThread@@UEAAXXZ
?Run@CWorkerThread@@UEAAXXZ
?SeekToEnd@CFile@@QEAAJXZ
?Set@CKEvent@@QEAAJJE@Z
?SetAttributes@CFile@@QEAAJK@Z
?SetBlobCofig@CContext@@UEAAJKPEAXK@Z
?SetData@CBlobConfig@@QEAAHPEAXK@Z
?SetData@CModuleFileExtConfig@@QEAAHPEBG@Z
?SetData@CModuleFlagConfig@@QEAAHK@Z
?SetData@CModuleMultiStringConfig@@QEAAHPEBGK@Z
?SetData@CModuleStringConfig@@QEAAHPEBG@Z
?SetEngineContext@CContext@@QEAAXPEAX@Z
?SetFileExtensionConfig@CContext@@UEAAJKPEBG@Z
?SetFlagConfig@CContext@@UEAAJKK@Z
?SetLinkContext@CContext@@QEAAXPEAX@Z
?SetLogFlag@CDebugLog@@QEAAEK@Z
?SetLogFlag@CDebugLogEx@@QEAAEK@Z
?SetMatchAllExtensions@CFileExtension@@QEAAXE@Z
?SetMatchNoExtensions@CFileExtension@@QEAAXE@Z
?SetMultiStringConfig@CContext@@UEAAJKPEBG@Z
?SetNewJobItemEvent@CWorkerThreadJobQueue@@QEAAXXZ
?SetPriority@CSystemThread@@QEAAXK@Z
?SetStopUse@CContext@@QEAAXXZ
?SetStringConfig@CContext@@UEAAJKPEBG@Z
?Setup@CSystemThread@@MEAAXXZ
?StopUse@CContext@@QEAAHXZ
?TearDown@CSystemThread@@MEAAXXZ
?Terminate@CSystemThread@@QEAAXE@Z
?Terminate@CWorkerThreadPool@@QEAAEXZ
?Terminate@CWorkerThreadPoolEx@@QEAAEXZ
?TmExceptionFilter@@YAJPEAU_EXCEPTION_POINTERS@@@Z
?Wait@CKEvent@@QEAAJPEAT_LARGE_INTEGER@@E@Z
?WaitFinish@CWorkerThreadJob@@QEAAXXZ
?WaitForInit@CDelayLoadThread@@QEAAEXZ
?WaitForLoad@CDelayLoadThread@@QEAAEXZ
?WaitNewJobAvailable@CWorkerThreadJobQueue@@QEAAEXZ
?WaitQueueEmpty@CWorkerThreadJobQueue@@QEAAXXZ
?Write@CDebugLog@@QEAAXPEBDZZ
?Write@CDebugLogEx@@QEAAXPEBDZZ
?Write@CFile@@QEAAJPEADKPEAT_LARGE_INTEGER@@PEAK@Z
?WriteDataToFile@CDebugLogEx@@IEAAXPEADK@Z
?WriteDataToProcMonW@CDebugLogEx@@IEAAXPEAD@Z
?WriteSystemInformation@CDebugLog@@QEAAXXZ
?WriteSystemInformation@CDebugLogEx@@QEAAXXZ
?WriteSystemStringInformation@CDebugLog@@IEAAXPEBG@Z
?WriteSystemStringInformation@CDebugLogEx@@IEAAXPEBG@Z
?WriteToFile@CDebugLog@@IEAAXPEADK@Z
?WriteToProcMonW@CDebugLogEx@@IEAAXPEAU_UNICODE_STRING@@@Z
?_pNonPagedAllocator@@3PEAVCMemoryAllocator@@EA
?_pPagedAllocator@@3PEAVCMemoryAllocator@@EA
?m_lpInstance@CWorkerThreadPool@@1PEAV1@EA
?m_lpRCMInstance@CWorkerThreadPool@@1PEAV1@EA
DeInitKm2UmCommunication
DeInitKmLPC
DuplicateFullFileName
FreeFullFileName
GetKm2UmMode
GetModuleInfoByAddress
GetModuleInfoByModuleName
InitKm2UmCommunication
InitKmLPC
IsVerifierCodeCheckFlagOn
IsWindows8_1_update
KmCallUm
KmCallUmByLPC
KmCallUmEx
KmCleanupCommPortAPIs
KmGetUmInitProcess
KmSetCommPortAPIs
ModGetExportProcAddress
ModLoadDLLToBuffer
ModLoadDLLToBufferWithImageSize
ModLoadModule
ModUnLoadModule
NormalizeFileName
NormalizeFullNtPathToDosName
TmCommConfigRoutine
UtilAddDeviceInDriveTable
UtilAddReparsePointMapping
UtilCleanFileReadOnly
UtilCloseExclusiveHandle
UtilCreateDosFileName
UtilDeleteFileForce
UtilGetDeviceObjectName
UtilGetFileNameFromFileObject
UtilGetFileObjectForProcessByEPROC
UtilGetFileObjectFromFileName
UtilGetProcessName
UtilGetSystemDirectory
UtilGetSystemDirectoryEx
UtilGetSystemDirectoryLength
UtilGetSystemTime
UtilIoSetFileInfo
UtilIopCreateFileIRP
UtilKeGetLowFileDevice
UtilModuleIATHook
UtilModuleIATUnHook
UtilPostJobToWorkerThread
UtilQueryExclusiveHandle
UtilQueryKeyValue
UtilRemoveDeviceFromDriveTable
UtilVolumeDeviceToDosName
UtilWaitValueChangeToZero
UtilWriteVersionToRegistry
UtilbuildDynamicDiskMappingTable
UtlWriteBinValueKeyToRegistry
ValidateAddressWithSize
_ResetProtectFromClose
_UtilDosPathNameToNtPathName

Sections

Expand

.text
.rdata
.data
.pdata
PAGE
.edata
INIT
.rsrc
.reloc

Signature

Expand

{
  "Certificates": [
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "7e93ebfb7cc64e59ea4b9a77d406fc3b",
      "Signature": "03099b8f79ef7f5930aaef68b5fae3091dbb4f82065d375fa6529f168dea1c9209446ef56deb587c30e8f9698d23730b126f47a9ae3911f82ab19bb01ac38eeb599600adce0c4db2d031a6085c2a7afce27a1d574ca86518e979406225966ec7c7376a8321088e41eaddd9573f1d7749872a16065ea6386a2212a35119837eb6",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services CA , G2",
      "TBS": {
        "MD5": "d0785ad36e427c92b19f6826ab1e8020",
        "SHA1": "365b7a9c21bd9373e49052c3e7b3e4646ddd4d43",
        "SHA256": "c2abb7484da91a658548de089d52436175fdb760a1387d225611dc0613a1e2ff",
        "SHA384": "eab4fe5ef90e0de4a6aa3a27769a5e879f588df5e4785aa4104debd1f81e19ea56d33e3a16e5facf99f68b5d8e3d287b"
      },
      "ValidFrom": "2012-12-21 00:00:00",
      "ValidTo": "2020-12-30 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "0ecff438c8febf356e04d86a981b1a50",
      "Signature": "783bb4912a004cf08f62303778a38427076f18b2de25dca0d49403aa864e259f9a40031cddcee379cb216806dab632b46dbff42c266333e449646d0de6c3670ef705a4356c7c8916c6e9b2dfb2e9dd20c6710fcd9574dcb65cdebd371f4378e678b5cd280420a3aaf14bc48829910e80d111fcdd5c766e4f5e0e4546416e0db0ea389ab13ada097110fc1c79b4807bac69f4fd9cb60c162bf17f5b093d9b5be216ca13816d002e380da8298f2ce1b2f45aa901af159c2c2f491bdb22bbc3fe789451c386b182885df03db451a179332b2e7bb9dc20091371eb6a195bcfe8a530572c89493fb9cf7fc9bf3e226863539abd6974acc51d3c7f92e0c3bc1cd80475",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=Symantec Corporation, CN=Symantec Time Stamping Services Signer , G4",
      "TBS": {
        "MD5": "e9d38360b914c8863f6cba3ee58764d3",
        "SHA1": "4cba8eae47b6bf76f20b3504b98b8f062694a89b",
        "SHA256": "88901d86a4cc1f1bb193d08e1fb63d27452e63f83e228c657ab1a92e4ade3976",
        "SHA384": "e9f2a75334a9e336c5a4712eadee88d0374b0fdc273262f4e65c9040ad2793067cc076696db5279a478773485e285652"
      },
      "ValidFrom": "2012-10-18 00:00:00",
      "ValidTo": "2020-12-29 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": false,
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Signature": "f3b20c020c826fd9e2629408ffc97c9e245959d1050c9ce7708069d366d26af191812e16fce674eaca0d8f05b2a796280831737299800d2bfe0071efecf655117b7952a4d7c0701b97de034a1d42e928fd1a2082b081f9d22e9d39af3233cf05c1e61ae1f8fbfec872e78d9a0b29b4f147f1a053d1757a824601df2bb07c75c591fe7efbaf0021764b90cd446f85f80d14bc2cd42c83edfa7d2510f8f94c82d1b3ea999b1cff9093291977c7e996dc32904d3934f167077684ff76aa5327654a0bd7223d9d67657b47c5b46012dca6723d89e7fa051b3380d0c4977b9df537e75da3186ab149b27c089715a01bd695f408f7ded66bfbe920d27a6f6a7d4cc8b3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=TW, ST=Taiwan, L=Taipei, O=Trend Micro, Inc., CN=Trend Micro, Inc.",
      "TBS": {
        "MD5": "78eaa337666217b1c16a9a0ebd0b8434",
        "SHA1": "ff9cb835e78f6185eed4372096c3bae53b17d18d",
        "SHA256": "1c0d9746725e176b4a7c2852878f14d7587f58e65d346bc1247f1c8ee6374250",
        "SHA384": "ffe3c75b860679a5de399c7d2c2844dbfac51d5d8581e24648d208daba1e4bed5c867808e02dc8d7cb3df1d4b2b53d10"
      },
      "ValidFrom": "2017-04-27 00:00:00",
      "ValidTo": "2018-07-16 23:59:59",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "611993e400000000001c",
      "Signature": "812a82168c34672be503eb347b8ca2a3508af45586f11e8c8eae7dee0319ce72951848ad6211fd20fd3f4706015ae2e06f8c152c4e3c6a506c0b36a3cf7a0d9c42bc5cf819d560e369e6e22341678c6883762b8f93a32ab57fbe59fba9c9b2268fcaa2f3821b983e919527978661ee5b5d076bcd86a8e26580a8e215e2b2be23056aba0cf347934daca48c077939c061123a050d89a3ec9f578984fbecca7c47661491d8b60f195de6b84aacbc47c8714396e63220a5dc7786fd3ce38b71db7b9b03fcb71d3264eb1652a043a3fa2ead59924e7cc7f233424838513a7c38c71b242228401e1a461f17db18f7f027356cb863d9cdb9645d2ba55eefc629b4f2c7f821cc04ba57fd01b6abc667f9e7d3997ff4f522fa72f5fdff3a1c423aa1f98018a5ee8d1cd4669e4501feaaeefffb178f30f7f1cd29c59decb5d549003d85b8cbbb933a276a49c030ae66c9f723283276f9a48356c848ce5a96aaa0cc0cc47fb48e97af6de35427c39f86c0d6e473089705dbd054625e0348c2d59f7fa7668cd09db04fd4d3985f4b7ac97fb22952d01280c70f54b61e67cdc6a06c110384d34875e72afeb03b6e0a3aa66b769905a3f177686133144706fc537f52bd92145c4a246a678caf8d90aad0f679211b93267cc3ce1ebd883892ae45c6196a4950b305f8ae59378a6a250394b1598150e8ba8380b72335f476b9671d5918ad208d94",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=(c) 2006 VeriSign, Inc. , For authorized use only, CN=VeriSign Class 3 Public Primary Certification Authority , G5",
      "TBS": {
        "MD5": "78a717e082dcc1cda3458d917e677d14",
        "SHA1": "4a872e0e51f9b304469cd1dedb496ee9b8b983a4",
        "SHA256": "317fa1d234ebc49040ebc5e8746f8997471496051b185a91bdd9dfbb23fab5f8",
        "SHA384": "b71052da4eb9157c8c1a5d7f55df19d69b9128598b72fcca608e5b7cc7d64c43c5504b9c86355a6dc22ee40c88cc385c"
      },
      "ValidFrom": "2011-02-22 19:25:17",
      "ValidTo": "2021-02-22 19:35:17",
      "Version": 3
    },
    {
      "IsCertificateAuthority": true,
      "SerialNumber": "5200e5aa2556fc1a86ed96c9d44b33c7",
      "Signature": "5622e634a4c461cb48b901ad56a8640fd98c91c4bbcc0ce5ad7aa0227fdf47384a2d6cd17f711a7cec70a9b1f04fe40f0c53fa155efe749849248581261c911447b04c638cbba134d4c645e80d85267303d0a98c646ddc7192e645056015595139fc58146bfed4a4ed796b080c4172e737220609be23e93f449a1ee9619dccb1905cfc3dd28dac423d6536d4b43d40288f9b10cf2326cc4b20cb901f5d8c4c34ca3cd8e537d66fa520bd34eb26d9ae0de7c59af7a1b42191336f86e858bb257c740e58fe751b633fce317c9b8f1b969ec55376845b9cad91faaced93ba5dc82153c2825363af120d5087111b3d5452968a2c9c3d921a089a052ec793a54891d3",
      "SignatureAlgorithmOID": "1.2.840.113549.1.1.5",
      "Subject": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "TBS": {
        "MD5": "b30c31a572b0409383ed3fbe17e56e81",
        "SHA1": "4843a82ed3b1f2bfbee9671960e1940c942f688d",
        "SHA256": "03cda47a6e654ed85d932714fc09ce4874600eda29ec6628cfbaeb155cab78c9",
        "SHA384": "bbda8407c4f9fc4e54d772f1c7fb9d30bc97e1f97ecd51c443063d1fa0644e266328781776cd5c44896c457c75f4d7da"
      },
      "ValidFrom": "2010-02-08 00:00:00",
      "ValidTo": "2020-02-07 23:59:59",
      "Version": 3
    }
  ],
  "CertificatesInfo": "",
  "Signer": [
    {
      "Issuer": "C=US, O=VeriSign, Inc., OU=VeriSign Trust Network, OU=Terms of use at https://www.verisign.com/rpa (c)10, CN=VeriSign Class 3 Code Signing 2010 CA",
      "SerialNumber": "497c4fad471540e6e453d0cafb155740",
      "Version": 1
    }
  ],
  "SignerInfo": ""
}

source

last_updated: 2024-04-09