v6[.]19[.]3_installer_x64_[.]zip

resource
unpack001/wbem/NCProv.dll
unpack001/wbem/NetAdapterCim.dll
unpack001/wbem/NetEventPacketCapture.dll
unpack001/wbem/appbackgroundtask.dll
unpack001/wbem/ndisimplatcim.dll
unpack001/wbem/netdacim.dll

v6.19.3_installer_x64_.zip

.zip

Password: Inicio2020!

APPLETS/IMJPCD.DLL

.dll windows:10 windows x64 arch:x64

Password: Inicio2020!

086d7fe731041bf6b7b4ead4eca05f07

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

f4:51:16:0e:9a:74:4f:92:2e:f8:66:5d:5e:6d:2f:8d:4f:32:3b:fc:c3:df:dc:c5:5b:9e:ed:3f:bf:35:ad:fd
Signer

Actual PE Digest

f4:51:16:0e:9a:74:4f:92:2e:f8:66:5d:5e:6d:2f:8d:4f:32:3b:fc:c3:df:dc:c5:5b:9e:ed:3f:bf:35:ad:fd

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

PDB Paths

imjpcd.pdb

Imports

msvcrt

memmove_s

?terminate@@YAXXZ

_callnewh

malloc

_purecall

_wtoi

??0exception@@QEAA@XZ

??3@YAXPEAX@Z

??0exception@@QEAA@AEBQEBD@Z

??0exception@@QEAA@AEBQEBDH@Z

??0exception@@QEAA@AEBV0@@Z

??1exception@@UEAA@XZ

?what@exception@@UEBAPEBDXZ

_CxxThrowException

__CxxFrameHandler3

memcpy

memcmp

??1type_info@@UEAA@XZ

_onexit

??_V@YAXPEAX@Z

__dllonexit

_unlock

wcsncpy_s

_lock

__C_specific_handler

_vsnprintf_s

_initterm

free

_amsg_exit

_XcptFilter

memmove

memcpy_s

_vsnwprintf

wcsncat_s

_vsnwprintf_s

memset

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW

RegQueryValueExW

RegCreateKeyExW

RegCloseKey

RegSetValueExW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-memory-l1-1-0

MapViewOfFile

UnmapViewOfFile

CreateFileMappingW

api-ms-win-core-errorhandling-l1-1-0

SetLastError

UnhandledExceptionFilter

GetLastError

SetUnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress

GetModuleFileNameA

GetModuleHandleExW

GetModuleHandleW

LoadStringW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-rtcore-ntuser-window-l1-1-0

SetWindowLongPtrW

GetWindowLongPtrW

api-ms-win-core-synch-l1-2-0

Sleep

SleepConditionVariableSRW

WakeAllConditionVariable

api-ms-win-core-synch-l1-1-0

CreateSemaphoreExW

ReleaseSRWLockExclusive

AcquireSRWLockShared

AcquireSRWLockExclusive

ReleaseSRWLockShared

DeleteCriticalSection

InitializeCriticalSectionEx

EnterCriticalSection

LeaveCriticalSection

WaitForSingleObject

ReleaseMutex

OpenSemaphoreW

WaitForSingleObjectEx

ReleaseSemaphore

CreateMutexExW

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind

RtlLookupFunctionEntry

RtlCaptureContext

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess

TerminateProcess

GetCurrentProcessId

OpenProcessToken

GetCurrentThreadId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW

GetSystemTimeAsFileTime

GetTickCount

api-ms-win-security-base-l1-1-0

IsValidSid

GetSidSubAuthorityCount

GetTokenInformation

GetSidSubAuthority

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-heap-l1-1-0

HeapFree

HeapAlloc

GetProcessHeap

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer

CreateThreadpoolTimer

CloseThreadpoolTimer

WaitForThreadpoolTimerCallbacks

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW

IsDebuggerPresent

DebugBreak

ext-ms-win-ntuser-dialogbox-l1-1-0

CheckDlgButton

IsDlgButtonChecked

EndDialog

DialogBoxParamW

Exports

CreateIImeSystemDictInstance

Sections

.text
Size: 51KB - Virtual size: 50KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 107KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 47KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 548B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

APPLETS/IMJPCMLD.DLL

.dll regsvr32 windows:10 windows x64 arch:x64

Password: Inicio2020!

985fdef47db40313b27bfccaaf554989

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

e4:fb:45:3f:23:c4:51:7f:e7:e0:02:ce:85:87:9c:a7:41:6f:df:cf:07:bd:3d:b6:8d:6d:ff:5b:18:a7:db:92
Signer

Actual PE Digest

e4:fb:45:3f:23:c4:51:7f:e7:e0:02:ce:85:87:9c:a7:41:6f:df:cf:07:bd:3d:b6:8d:6d:ff:5b:18:a7:db:92

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

PDB Paths

imjpcmld.pdb

Imports

msvcrt

_XcptFilter

??0exception@@QEAA@AEBQEBDH@Z

_amsg_exit

_errno

??0exception@@QEAA@AEBQEBD@Z

_callnewh

realloc

?terminate@@YAXXZ

?what@exception@@UEBAPEBDXZ

_lock

_unlock

__dllonexit

wcscat_s

_onexit

wcscpy_s

wcsncpy_s

malloc

free

_vsnprintf_s

??0exception@@QEAA@AEBV0@@Z

??1type_info@@UEAA@XZ

memcmp

??3@YAXPEAX@Z

??0exception@@QEAA@XZ

??1exception@@UEAA@XZ

memmove

memcpy

_purecall

memmove_s

_CxxThrowException

memcpy_s

toupper

_wcsicmp

_vsnwprintf

??_V@YAXPEAX@Z

__C_specific_handler

_vsnwprintf_s

__CxxFrameHandler3

wcsnlen

wcsncat_s

expf

logf

_initterm

memset

oleaut32

UnRegisterTypeLi

SysAllocString

SysAllocStringByteLen

LoadTypeLi

SysStringByteLen

SysAllocStringLen

RegisterTypeLi

SysStringLen

SysFreeString

VarUI4FromStr

api-ms-win-core-libraryloader-l1-2-0

LoadResource

LockResource

SizeofResource

GetProcAddress

GetModuleHandleExW

LoadLibraryExW

GetModuleFileNameW

GetModuleFileNameA

GetModuleHandleW

FreeLibrary

FindResourceExW

api-ms-win-core-synch-l1-1-0

ReleaseMutex

EnterCriticalSection

ReleaseSemaphore

CreateSemaphoreExW

DeleteCriticalSection

CreateMutexExW

InitializeCriticalSectionEx

WaitForSingleObject

ReleaseSRWLockExclusive

ReleaseSRWLockShared

AcquireSRWLockExclusive

AcquireSRWLockShared

WaitForSingleObjectEx

InitializeCriticalSection

OpenSemaphoreW

LeaveCriticalSection

api-ms-win-core-heap-l1-1-0

HeapAlloc

GetProcessHeap

HeapFree

api-ms-win-core-errorhandling-l1-1-0

SetErrorMode

SetUnhandledExceptionFilter

RaiseException

GetLastError

UnhandledExceptionFilter

SetLastError

api-ms-win-core-com-l1-1-0

CoCreateInstance

CoTaskMemFree

CoTaskMemAlloc

CoTaskMemRealloc

StringFromGUID2

api-ms-win-core-registry-l1-1-0

RegOpenCurrentUser

RegCreateKeyExW

RegEnumKeyExW

RegOpenKeyExW

RegCloseKey

RegSetValueExW

RegQueryValueExW

RegGetValueW

RegDeleteValueW

RegQueryInfoKeyW

api-ms-win-core-processthreads-l1-1-0

CreateProcessW

TerminateProcess

GetCurrentProcess

GetCurrentThreadId

OpenProcessToken

GetCurrentProcessId

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

CompareStringW

GetStringTypeW

CompareStringOrdinal

MultiByteToWideChar

api-ms-win-core-localization-l1-2-0

LCMapStringEx

GetThreadLocale

SetThreadLocale

FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak

IsDebuggerPresent

OutputDebugStringA

OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

GetTickCount

GetVersionExW

GetTickCount64

GetSystemTime

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-synch-l1-2-0

InitOnceComplete

InitOnceBeginInitialize

WakeAllConditionVariable

SleepConditionVariableSRW

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry

RtlVirtualUnwind

RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

profapi

ord104

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer

CreateThreadpoolTimer

WaitForThreadpoolTimerCallbacks

SetThreadpoolTimer

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-memory-l1-1-0

MapViewOfFile

UnmapViewOfFile

CreateFileMappingW

api-ms-win-core-file-l1-1-0

GetFileAttributesW

GetTempFileNameW

CreateDirectoryW

SetFileTime

CreateFileW

SetEndOfFile

SetFilePointer

GetFileSize

DeleteFileW

WriteFile

api-ms-win-core-file-l2-1-0

MoveFileExW

ReplaceFileW

api-ms-win-security-base-l1-1-0

GetSidSubAuthority

GetSidSubAuthorityCount

IsValidSid

GetTokenInformation

CreateWellKnownSid

CheckTokenMembership

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-heap-l2-1-0

LocalAlloc

LocalFree

ntdll

RtlGetDeviceFamilyInfoEnum

api-ms-win-eventing-provider-l1-1-0

EventSetInformation

EventProviderEnabled

EventUnregister

EventWriteTransfer

EventRegister

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-path-l1-1-0

PathCchCanonicalize

PathIsUNCEx

PathCchRemoveBackslash

api-ms-win-core-io-l1-1-1

GetOverlappedResultEx

api-ms-win-appmodel-runtime-l1-1-0

GetPackageFullName

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

DllCanUnloadNow

DllGetClassObject

DllRegisterServer

DllUnregisterServer

Sections

.text
Size: 209KB - Virtual size: 208KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 69KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

APPLETS/IMJPDAPI.DLL

.dll regsvr32 windows:10 windows x64 arch:x64

Password: Inicio2020!

4e2dcafbee4f4b70ff67e2813462b8dd

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

74:b2:b8:5d:95:b0:75:77:fb:1e:81:38:5f:88:d0:8b:1a:77:4d:52:67:35:55:34:98:18:b1:89:ea:fe:1b:48
Signer

Actual PE Digest

74:b2:b8:5d:95:b0:75:77:fb:1e:81:38:5f:88:d0:8b:1a:77:4d:52:67:35:55:34:98:18:b1:89:ea:fe:1b:48

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

PDB Paths

imjpdapi.pdb

Imports

msvcrt

_errno

realloc

?terminate@@YAXXZ

_lock

wcsnlen

expf

_initterm

__dllonexit

_onexit

wcsncmp

_amsg_exit

_XcptFilter

memmove

memcpy

_CxxThrowException

??0exception@@QEAA@AEBQEBDH@Z

??0exception@@QEAA@AEBQEBD@Z

_wtoi

_callnewh

vswprintf_s

exit

_wcsicmp

?what@exception@@UEBAPEBDXZ

wcsncat_s

wcsrchr

_vsnwprintf_s

wcscat_s

wcscpy_s

wcsncpy_s

malloc

qsort

logf

memmove_s

free

_vsnprintf_s

??0exception@@QEAA@AEBV0@@Z

??0exception@@QEAA@XZ

memcmp

toupper

??1exception@@UEAA@XZ

memset

??1type_info@@UEAA@XZ

_purecall

memcpy_s

_vsnwprintf

??3@YAXPEAX@Z

??_V@YAXPEAX@Z

__C_specific_handler

__CxxFrameHandler3

_unlock

wcscmp

oleaut32

SafeArrayDestroy

SafeArrayUnlock

SystemTimeToVariantTime

VarBstrCmp

SysAllocStringByteLen

SysStringByteLen

SysAllocStringLen

SysStringLen

RegisterTypeLi

LoadTypeLi

SafeArrayCreate

UnRegisterTypeLi

BSTR_UserMarshal64

BSTR_UserSize64

BSTR_UserFree64

BSTR_UserMarshal

BSTR_UserUnmarshal

BSTR_UserUnmarshal64

BSTR_UserFree

BSTR_UserSize

SysFreeString

SafeArrayGetUBound

SafeArrayLock

SysAllocString

SafeArrayGetLBound

VarUI4FromStr

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

LockResource

LoadResource

FindResourceExW

LoadLibraryExW

GetModuleFileNameA

SizeofResource

GetProcAddress

FreeLibrary

GetModuleHandleExW

GetModuleFileNameW

api-ms-win-core-synch-l1-1-0

OpenMutexW

CreateSemaphoreExW

EnterCriticalSection

ReleaseSemaphore

LeaveCriticalSection

InitializeCriticalSection

InitializeCriticalSectionEx

WaitForSingleObject

CreateMutexW

ReleaseMutex

ReleaseSRWLockExclusive

DeleteCriticalSection

AcquireSRWLockExclusive

AcquireSRWLockShared

WaitForSingleObjectEx

CreateMutexExW

OpenSemaphoreW

ReleaseSRWLockShared

api-ms-win-core-heap-l1-1-0

GetProcessHeap

HeapAlloc

HeapFree

api-ms-win-core-errorhandling-l1-1-0

SetLastError

GetLastError

UnhandledExceptionFilter

RaiseException

SetUnhandledExceptionFilter

SetErrorMode

api-ms-win-core-com-l1-1-0

CoTaskMemRealloc

CoCreateInstance

CoCreateGuid

StringFromGUID2

IIDFromString

CoTaskMemAlloc

CoTaskMemFree

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW

RegCloseKey

RegQueryValueExW

RegOpenKeyExW

RegOpenCurrentUser

RegEnumValueW

RegDeleteValueW

RegGetValueW

RegCreateKeyExW

RegSetValueExW

RegEnumKeyExW

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer

CloseThreadpoolTimer

CreateThreadpoolTimer

WaitForThreadpoolTimerCallbacks

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId

GetCurrentProcess

TerminateProcess

OpenProcessToken

GetCurrentProcessId

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

CompareStringW

MultiByteToWideChar

api-ms-win-core-localization-l1-2-0

GetThreadLocale

FormatMessageW

SetThreadLocale

LCMapStringEx

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

OutputDebugStringA

OutputDebugStringW

DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

rpcrt4

CStdStubBuffer_DebugServerRelease

CStdStubBuffer_CountRefs

NdrOleFree

NdrDllUnregisterProxy

NdrDllRegisterProxy

IUnknown_AddRef_Proxy

CStdStubBuffer_AddRef

IUnknown_Release_Proxy

NdrDllGetClassObject

NdrOleAllocate

NdrCStdStubBuffer_Release

CStdStubBuffer_Connect

NdrDllCanUnloadNow

CStdStubBuffer_IsIIDSupported

CStdStubBuffer_Invoke

IUnknown_QueryInterface_Proxy

CStdStubBuffer_DebugServerQueryInterface

CStdStubBuffer_Disconnect

CStdStubBuffer_QueryInterface

api-ms-win-core-com-midlproxystub-l1-1-0

ObjectStublessClient4

ObjectStublessClient5

ObjectStublessClient7

ObjectStublessClient3

ObjectStublessClient6

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW

GetTickCount

GetTickCount64

GetSystemTime

GetSystemTimeAsFileTime

GetLocalTime

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-file-l1-1-0

GetFileAttributesExW

DeleteFileW

SetFilePointer

SetEndOfFile

WriteFile

GetTempFileNameW

SetFileAttributesW

CreateFileW

CreateDirectoryW

GetFileSize

GetFileAttributesW

api-ms-win-core-version-l1-1-1

GetFileVersionInfoSizeW

GetFileVersionInfoW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindExtensionW

PathRemoveFileSpecW

PathFindFileNameW

PathIsUNCServerW

PathRemoveBackslashW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

SystemTimeToFileTime

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize

InitOnceComplete

WakeAllConditionVariable

Sleep

SleepConditionVariableSRW

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind

RtlLookupFunctionEntry

RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

kernel32

UpdateResourceW

BeginUpdateResourceW

EndUpdateResourceW

profapi

ord104

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile

MapViewOfFile

CreateFileMappingW

api-ms-win-core-file-l2-1-0

MoveFileExW

ReplaceFileW

api-ms-win-eventing-provider-l1-1-0

EventProviderEnabled

EventRegister

EventWriteTransfer

EventUnregister

EventSetInformation

api-ms-win-security-base-l1-1-0

CreateWellKnownSid

CheckTokenMembership

GetSidSubAuthority

GetTokenInformation

IsValidSid

GetSidSubAuthorityCount

api-ms-win-security-sddl-l1-1-0

ConvertSidToStringSidW

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-heap-l2-1-0

LocalFree

LocalAlloc

ntdll

NtQueryWnfStateData

RtlGetDeviceFamilyInfoEnum

api-ms-win-core-path-l1-1-0

PathIsUNCEx

PathCchRemoveBackslash

PathCchCanonicalize

api-ms-win-core-io-l1-1-1

GetOverlappedResultEx

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW

RegSetKeyValueW

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

DllCanUnloadNow

DllGetClassObject

DllRegisterServer

DllUnregisterServer

Sections

.text
Size: 353KB - Virtual size: 353KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 121KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 64B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

APPLETS/IMJPDCTP.DLL

.dll windows:10 windows x64 arch:x64

Password: Inicio2020!

dfd0ba769eceeabb8c09a3f86ce8ade9

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

f2:75:ed:15:87:68:a4:e0:34:03:09:ec:31:66:b9:35:6c:7c:fe:f3:b2:f9:ba:1f:34:43:36:2d:b6:25:af:5e
Signer

Actual PE Digest

f2:75:ed:15:87:68:a4:e0:34:03:09:ec:31:66:b9:35:6c:7c:fe:f3:b2:f9:ba:1f:34:43:36:2d:b6:25:af:5e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

PDB Paths

imjpdctp.pdb

Imports

msvcrt

??_V@YAXPEAX@Z

_onexit

__dllonexit

_unlock

_lock

?terminate@@YAXXZ

__C_specific_handler

_initterm

memset

__CxxFrameHandler3

memcmp

??1type_info@@UEAA@XZ

_amsg_exit

_XcptFilter

?what@exception@@UEBAPEBDXZ

??1exception@@UEAA@XZ

??0exception@@QEAA@AEBV0@@Z

??0exception@@QEAA@AEBQEBDH@Z

??0exception@@QEAA@AEBQEBD@Z

??0exception@@QEAA@XZ

memmove

memcpy

_CxxThrowException

_callnewh

free

malloc

wcsncpy_s

_purecall

??3@YAXPEAX@Z

kernel32

UnhandledExceptionFilter

SetUnhandledExceptionFilter

GetCurrentProcess

TerminateProcess

QueryPerformanceCounter

GetCurrentProcessId

GetCurrentThreadId

GetSystemTimeAsFileTime

GetTickCount

RtlLookupFunctionEntry

RtlCaptureContext

Sleep

LockResource

LoadResource

FindResourceExW

GlobalUnlock

MultiByteToWideChar

GlobalLock

RtlVirtualUnwind

DelayLoadFailureHook

FreeLibraryAndExitThread

ResumeThread

SetEvent

GetTickCount64

CreateThread

CreateEventW

GetCurrentPackageFullName

CreateProcessW

IsDebuggerPresent

DebugBreak

GetModuleHandleW

AcquireSRWLockShared

CreateMutexExW

ReleaseSRWLockShared

OpenSemaphoreW

WaitForSingleObjectEx

OutputDebugStringW

FormatMessageW

ReleaseMutex

WaitForSingleObject

InitializeCriticalSectionEx

GetModuleHandleExW

ReleaseSemaphore

CreateSemaphoreExW

GetModuleFileNameA

ExpandEnvironmentStringsW

WaitForThreadpoolTimerCallbacks

CloseThreadpoolTimer

CreateThreadpoolTimer

SetThreadpoolTimer

AcquireSRWLockExclusive

ReleaseSRWLockExclusive

GetLastError

SetLastError

HeapAlloc

HeapFree

GetProcessHeap

CloseHandle

GetVersionExW

GetProcAddress

FreeLibrary

ResolveDelayLoadedAPI

LoadLibraryW

LeaveCriticalSection

EnterCriticalSection

DeleteCriticalSection

InitializeCriticalSection

user32

IsWindow

DestroyWindow

DialogBoxIndirectParamW

GetWindowLongPtrA

GetWindowLongPtrW

SetWindowLongPtrA

SetWindowLongPtrW

DefWindowProcA

DefWindowProcW

PeekMessageW

AllowSetForegroundWindow

MsgWaitForMultipleObjects

WaitForInputIdle

IsWindowUnicode

CloseClipboard

GetClipboardData

IsClipboardFormatAvailable

OpenClipboard

EndDialog

KillTimer

SetTimer

SetWindowPos

ntdll

_vsnwprintf_s

memcpy_s

wcsnlen

_vsnwprintf

_vsnprintf_s

memmove_s

wcsncat_s

RtlSleepConditionVariableSRW

RtlWakeAllConditionVariable

RtlAcquireSRWLockExclusive

RtlReleaseSRWLockExclusive

swscanf_s

oleaut32

SysFreeString

SysAllocString

advapi32

GetSidSubAuthority

RegOpenKeyExW

RegQueryValueExW

RegCloseKey

OpenProcessToken

GetTokenInformation

IsValidSid

GetSidSubAuthorityCount

ole32

CoTaskMemFree

CoTaskMemAlloc

CoCreateInstance

CoInitializeEx

StringFromGUID2

CoUninitialize

rpcrt4

RpcStringFreeW

NdrClientCall3

RpcBindingFree

RpcBindingFromStringBindingW

RpcStringBindingComposeW

Exports

OpenDicTool

OpenRegisterWord

Sections

.text
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 656B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

APPLETS/IMJPPRED.DLL

.dll regsvr32 windows:10 windows x64 arch:x64

Password: Inicio2020!

e9f38c63ee5dd637f0c7e6e30091ab52

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

85:90:b9:3c:b9:d3:3b:72:70:e7:35:58:f9:14:7c:ea:cf:b4:f7:65:54:63:ed:fa:43:f1:b4:04:16:e1:6b:2d
Signer

Actual PE Digest

85:90:b9:3c:b9:d3:3b:72:70:e7:35:58:f9:14:7c:ea:cf:b4:f7:65:54:63:ed:fa:43:f1:b4:04:16:e1:6b:2d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

PDB Paths

imjppred.pdb

Imports

msvcrt

?what@exception@@UEBAPEBDXZ

??0exception@@QEAA@AEBQEBDH@Z

??0exception@@QEAA@AEBQEBD@Z

_callnewh

malloc

_vsnwprintf_s

free

??8type_info@@QEBAHAEBV0@@Z

__ExceptionPtrRethrow

_initterm

memmove_s

_CxxThrowException

_XcptFilter

__ExceptionPtrDestroy

__ExceptionPtrCopy

realloc

memcpy

_vsnprintf_s

wcsrchr

??0exception@@QEAA@AEBV0@@Z

??0exception@@QEAA@XZ

??_V@YAXPEAX@Z

memmove

_wcsicmp

__ExceptionPtrCurrentException

wcsncpy_s

__C_specific_handler

_lock

??1exception@@UEAA@XZ

_purecall

wcsnlen

_unlock

??3@YAXPEAX@Z

__dllonexit

sprintf

_amsg_exit

_onexit

__CxxFrameHandler3

__ExceptionPtrCreate

?terminate@@YAXXZ

memcpy_s

_vsnwprintf

??1type_info@@UEAA@XZ

memcmp

vsprintf_s

wcsncat_s

memset

api-ms-win-core-libraryloader-l1-2-0

FreeLibrary

GetModuleHandleW

GetProcAddress

GetModuleHandleExW

LoadLibraryExW

LoadStringW

GetModuleFileNameA

FreeLibraryAndExitThread

GetModuleFileNameW

FindStringOrdinal

api-ms-win-core-heap-l1-1-0

GetProcessHeap

HeapFree

HeapAlloc

api-ms-win-core-processthreads-l1-1-0

TerminateProcess

OpenProcessToken

ResumeThread

GetCurrentThread

CreateThread

GetCurrentProcessId

SetThreadPriority

GetCurrentThreadId

GetCurrentProcess

api-ms-win-core-localization-l1-2-0

LCMapStringW

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW

IsDebuggerPresent

DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-synch-l1-1-0

SetEvent

CreateEventW

InitializeCriticalSectionEx

DeleteCriticalSection

ReleaseSRWLockExclusive

ReleaseSRWLockShared

ReleaseSemaphore

ReleaseMutex

CreateMutexExW

LeaveCriticalSection

ResetEvent

EnterCriticalSection

InitializeCriticalSection

WaitForSingleObjectEx

CreateEventExW

AcquireSRWLockExclusive

OpenSemaphoreW

CreateSemaphoreExW

AcquireSRWLockShared

WaitForSingleObject

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter

UnhandledExceptionFilter

RaiseException

SetLastError

GetLastError

api-ms-win-eventing-provider-l1-1-0

EventActivityIdControl

EventUnregister

EventSetInformation

EventRegister

EventWriteTransfer

api-ms-win-core-threadpool-l1-2-0

WaitForThreadpoolTimerCallbacks

CreateThreadpoolTimer

SetThreadpoolThreadMinimum

SubmitThreadpoolWork

CreateThreadpool

CreateThreadpoolWork

CloseThreadpool

CloseThreadpoolWork

SetThreadpoolThreadMaximum

CloseThreadpoolTimer

SetThreadpoolTimer

WaitForThreadpoolWorkCallbacks

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW

RegSetValueExW

RegCreateKeyExW

RegCloseKey

RegOpenCurrentUser

RegOpenKeyExW

RegQueryValueExW

RegGetValueW

oleaut32

SysFreeString

SysStringLen

SysAllocStringLen

SysAllocString

api-ms-win-core-sysinfo-l1-1-0

GetTickCount

GetSystemTime

GetVersionExW

GetSystemTimeAsFileTime

api-ms-win-core-synch-l1-2-0

WakeAllConditionVariable

SleepConditionVariableSRW

InitOnceComplete

InitOnceBeginInitialize

Sleep

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-com-l1-1-0

StringFromGUID2

CoUninitialize

CoCreateInstance

CreateStreamOnHGlobal

CoInitializeEx

CoTaskMemAlloc

CoCreateGuid

CoCreateFreeThreadedMarshaler

CLSIDFromProgID

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry

RtlVirtualUnwind

RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-security-base-l1-1-0

GetSidSubAuthorityCount

GetSidSubAuthority

GetTokenInformation

CheckTokenMembership

IsValidSid

CreateWellKnownSid

ntdll

RtlGetDeviceFamilyInfoEnum

RtlPublishWnfStateData

RtlIsMultiSessionSku

api-ms-win-core-heap-l2-1-0

LocalFree

GlobalAlloc

GlobalFree

LocalAlloc

api-ms-win-core-sysinfo-l1-2-0

VerSetConditionMask

api-ms-win-core-kernel32-legacy-l1-1-1

VerifyVersionInfoW

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

ConvertSidToStringSidW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-string-l2-1-0

CharLowerW

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

api-ms-win-rtcore-ntuser-window-l1-1-0

PeekMessageW

DispatchMessageW

TranslateMessage

api-ms-win-rtcore-ntuser-synch-l1-1-0

MsgWaitForMultipleObjectsEx

MsgWaitForMultipleObjects

api-ms-win-shcore-stream-l1-1-0

SHCreateMemStream

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

RoInitialize

RoUninitialize

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString

WindowsCreateString

WindowsCreateStringReference

WindowsGetStringRawBuffer

api-ms-win-core-file-l1-1-0

CreateFileW

SetEndOfFile

GetTempFileNameW

WriteFile

CompareFileTime

ReadFile

DeleteFileW

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-file-l2-1-2

CopyFileW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFindFileNameW

PathFileExistsW

api-ms-win-shell-shdirectory-l1-1-0

ord292

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

SetRestrictedErrorInfo

api-ms-win-core-winrt-error-l1-1-1

RoGetMatchingRestrictedErrorInfo

cabinet

ord40

ord30

ord33

ord35

ord45

ord43

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

profapi

ord104

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

DllCanUnloadNow

DllGetClassObject

DllRegisterServer

DllUnregisterServer

Sections

.text
Size: 563KB - Virtual size: 562KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 209KB - Virtual size: 208KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

APPLETS/imjpcus.dll

.dll windows:10 windows x64 arch:x64

Password: Inicio2020!

874ea7e2da73b3aab257cd32c1b554c9

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

bf:96:d3:34:e6:b0:64:a8:5d:08:71:ce:71:98:23:2b:e9:e3:41:ea:06:01:aa:5c:b8:b7:d8:3a:03:a4:d7:7f
Signer

Actual PE Digest

bf:96:d3:34:e6:b0:64:a8:5d:08:71:ce:71:98:23:2b:e9:e3:41:ea:06:01:aa:5c:b8:b7:d8:3a:03:a4:d7:7f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

PDB Paths

imjpcus.pdb

Imports

msvcrt

_unlock

_lock

__C_specific_handler

_initterm

_amsg_exit

_XcptFilter

memmove

vswprintf_s

??_V@YAXPEAX@Z

wcsnlen

memcpy

_CxxThrowException

?what@exception@@UEBAPEBDXZ

??0exception@@QEAA@AEBQEBDH@Z

??0exception@@QEAA@AEBQEBD@Z

_callnewh

strncpy_s

iswlower

iswalpha

islower

isdigit

isxdigit

memmove_s

_onexit

?terminate@@YAXXZ

wcsrchr

_vsnwprintf_s

_snprintf_s

sscanf_s

iswdigit

wcsncpy_s

wcsncat_s

free

malloc

_vsnprintf_s

??0exception@@QEAA@AEBV0@@Z

??0exception@@QEAA@XZ

??1exception@@UEAA@XZ

_purecall

memcpy_s

_vsnwprintf

__CxxFrameHandler3

__dllonexit

??1type_info@@UEAA@XZ

memcmp

??3@YAXPEAX@Z

memset

imm32

ImmSetOpenStatus

ImmGetOpenStatus

ImmSetConversionStatus

ImmReleaseContext

ImmGetConversionStatus

ImmGetContext

ImmAssociateContext

comctl32

PropertySheetW

ord17

gdi32

ExtTextOutW

GetLayout

GetTextExtentPoint32W

Rectangle

MoveToEx

DeleteObject

TextOutW

GetTextMetricsW

SetTextAlign

SetROP2

SetBkMode

SetBkColor

SetTextColor

CreatePatternBrush

CreateBitmap

CreateSolidBrush

LineTo

PatBlt

SelectObject

CreateRectRgn

CreatePen

kernel32

QueryPerformanceCounter

GetSystemTimeAsFileTime

InitializeCriticalSection

LoadLibraryW

FreeLibrary

LoadLibraryExA

ExpandEnvironmentStringsA

GetVersionExW

LocalFree

ExpandEnvironmentStringsW

GetEnvironmentVariableW

GetTickCount

UnhandledExceptionFilter

GetModuleFileNameA

HeapFree

GetModuleHandleExW

GetCurrentThreadId

FormatMessageW

HeapAlloc

GetProcAddress

GetProcessHeap

GetModuleHandleW

DebugBreak

CompareStringW

IsDBCSLeadByteEx

CloseHandle

MultiByteToWideChar

WideCharToMultiByte

SetLastError

lstrcmpW

GetLastError

FindResourceExW

LoadResource

LockResource

FindResourceW

OutputDebugStringW

IsDebuggerPresent

WaitForSingleObject

ReleaseSemaphore

OpenSemaphoreW

ReleaseSRWLockExclusive

AcquireSRWLockExclusive

CreateThreadpoolTimer

SetThreadpoolTimer

AcquireSRWLockShared

ReleaseSRWLockShared

LeaveCriticalSection

EnterCriticalSection

DeleteCriticalSection

InitializeCriticalSectionEx

GetCurrentProcessId

CreateMutexExW

ReleaseMutex

CreateSemaphoreExW

WaitForSingleObjectEx

WaitForThreadpoolTimerCallbacks

CloseThreadpoolTimer

GlobalLock

GlobalAlloc

GlobalUnlock

GlobalHandle

GlobalFree

Sleep

RtlCaptureContext

RtlLookupFunctionEntry

RtlVirtualUnwind

SleepConditionVariableSRW

SetUnhandledExceptionFilter

GetCurrentProcess

TerminateProcess

WakeAllConditionVariable

user32

GetKeyboardState

SetKeyboardState

CallWindowProcW

MapDialogRect

PostMessageW

GetDlgItem

GetWindowLongPtrW

SendMessageW

SetWindowLongPtrW

GetWindowTextW

InvalidateRect

GetParent

EnableWindow

SetWindowTextW

GetClientRect

GetSystemMetrics

DrawFocusRect

GetSysColor

GetDC

ReleaseDC

LoadIconW

LoadCursorW

RegisterClassExW

UnregisterClassW

CreateWindowExW

DefWindowProcW

BeginPaint

EndPaint

CharNextA

GetClassNameW

SendMessageTimeoutW

RegisterWindowMessageW

EnumWindows

DialogBoxIndirectParamW

GetWindow

MoveWindow

WinHelpW

SetFocus

IsWindowUnicode

SendMessageA

EndDialog

MessageBoxW

GetCursorPos

CreatePopupMenu

AppendMenuW

TrackPopupMenu

DestroyMenu

FillRect

CopyRect

ScreenToClient

PtInRect

GetKeyState

CheckRadioButton

MessageBeep

VkKeyScanW

GetWindowRect

IsWindowEnabled

GetSysColorBrush

DrawTextW

GetClassInfoW

GetClassInfoExW

DrawFrameControl

advapi32

RegQueryValueExA

RegDeleteValueW

ConvertSidToStringSidW

GetSidSubAuthority

GetSidSubAuthorityCount

IsValidSid

GetTokenInformation

OpenProcessToken

RegEnumKeyExW

RegOpenKeyExA

RegGetValueW

RegDeleteKeyW

RegOpenKeyExW

RegCreateKeyExW

RegSetValueExW

RegQueryValueExW

RegCloseKey

RegEnumValueW

ole32

StringFromGUID2

Exports

DllMain

OpenDetailDialog

Sections

.text
Size: 131KB - Virtual size: 130KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 83KB - Virtual size: 82KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 976B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

IMEKR/imkrapi.dll

.dll regsvr32 windows:10 windows x64 arch:x64

Password: Inicio2020!

f045987fa86e336bcbb8585fd7dd178a

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

a0:70:5c:70:b5:e0:fb:a2:38:91:94:35:15:36:ea:f7:eb:44:70:40:3e:41:21:ae:ac:f3:e4:8c:73:99:c1:08
Signer

Actual PE Digest

a0:70:5c:70:b5:e0:fb:a2:38:91:94:35:15:36:ea:f7:eb:44:70:40:3e:41:21:ae:ac:f3:e4:8c:73:99:c1:08

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

PDB Paths

imkrapi.pdb

Imports

msvcrt

??1type_info@@UEAA@XZ

_onexit

__dllonexit

_unlock

_lock

?terminate@@YAXXZ

realloc

_errno

_initterm

_amsg_exit

_XcptFilter

memmove

memcpy

_CxxThrowException

?what@exception@@UEBAPEBDXZ

??0exception@@QEAA@AEBQEBDH@Z

??0exception@@QEAA@AEBQEBD@Z

_callnewh

memcmp

_wcsicmp

memmove_s

wcscat_s

wcscpy_s

wcsncpy_s

malloc

free

_vsnprintf_s

??0exception@@QEAA@AEBV0@@Z

??0exception@@QEAA@XZ

??1exception@@UEAA@XZ

_purecall

memcpy_s

_vsnwprintf

??_V@YAXPEAX@Z

_resetstkoflw

__C_specific_handler

__CxxFrameHandler3

wcsncat_s

??3@YAXPEAX@Z

calloc

_vsnwprintf_s

wcsnlen

_time32

iswalpha

iswupper

towupper

memset

policymanager

PolicyManager_GetPolicy

PolicyManager_FreeGetPolicyData

kernel32

CreateFileMappingW

OpenFileMappingW

CreateMutexW

ExpandEnvironmentStringsW

GetModuleFileNameA

SizeofResource

CreateSemaphoreExW

HeapFree

SetLastError

ReleaseSemaphore

GetModuleHandleExW

GetModuleFileNameW

InitializeCriticalSection

WaitForSingleObject

GetCurrentThreadId

ReleaseMutex

MultiByteToWideChar

FormatMessageW

GetLastError

OutputDebugStringW

WaitForSingleObjectEx

OpenSemaphoreW

CloseHandle

RaiseException

FindResourceExW

LoadResource

HeapAlloc

GetProcAddress

CreateMutexExW

DeleteCriticalSection

GetCurrentProcessId

GetProcessHeap

GetModuleHandleW

FreeLibrary

DebugBreak

lstrcmpiW

LoadLibraryExW

IsDebuggerPresent

GetThreadLocale

SetThreadLocale

EnterCriticalSection

LeaveCriticalSection

AcquireSRWLockExclusive

ReleaseSRWLockExclusive

AcquireSRWLockShared

ReleaseSRWLockShared

SetThreadpoolTimer

CloseThreadpoolTimer

WaitForThreadpoolTimerCallbacks

InitializeCriticalSectionEx

VerSetConditionMask

VerifyVersionInfoW

MapViewOfFile

UnmapViewOfFile

InitOnceBeginInitialize

InitOnceComplete

CreateThreadpoolTimer

Sleep

WakeAllConditionVariable

SleepConditionVariableSRW

RtlCaptureContext

RtlLookupFunctionEntry

RtlVirtualUnwind

UnhandledExceptionFilter

SetUnhandledExceptionFilter

LocalFree

TerminateProcess

QueryPerformanceCounter

GetSystemTimeAsFileTime

GetTickCount

OutputDebugStringA

LoadLibraryW

GetVersionExW

GetCurrentProcess

user32

CharNextW

CharPrevW

GetSystemMetrics

SystemParametersInfoW

UnregisterClassA

ole32

ObjectStublessClient8

ObjectStublessClient6

ObjectStublessClient5

ObjectStublessClient7

ObjectStublessClient9

ObjectStublessClient11

CoTaskMemRealloc

CoTaskMemFree

CoTaskMemAlloc

ObjectStublessClient10

ObjectStublessClient4

StringFromGUID2

ObjectStublessClient3

oleaut32

SafeArrayLock

SafeArrayUnlock

SafeArrayGetVartype

SafeArrayGetLBound

SafeArrayDestroy

SafeArrayGetUBound

VarBstrCat

SysAllocStringByteLen

SysStringByteLen

SysAllocStringLen

SysStringLen

RegisterTypeLi

LoadTypeLi

SysAllocString

UnRegisterTypeLi

BSTR_UserMarshal64

BSTR_UserSize64

BSTR_UserFree64

BSTR_UserMarshal

BSTR_UserUnmarshal

BSTR_UserUnmarshal64

BSTR_UserFree

BSTR_UserSize

VarUI4FromStr

SysFreeString

advapi32

RegCreateKeyExW

RegEnumKeyExW

RegSetValueExW

RegOpenKeyExW

RegDeleteValueW

RegQueryValueExW

EventRegister

EventUnregister

EventWriteTransfer

EventSetInformation

ConvertSidToStringSidW

ConvertStringSecurityDescriptorToSecurityDescriptorW

GetNamedSecurityInfoW

SetEntriesInAclW

SetNamedSecurityInfoW

AllocateAndInitializeSid

EqualSid

AreAllAccessesGranted

RegQueryInfoKeyW

RegCloseKey

RegOpenCurrentUser

AreAnyAccessesGranted

GetSidSubAuthority

GetSidSubAuthorityCount

IsValidSid

GetTokenInformation

OpenProcessToken

EventActivityIdControl

RegSetKeyValueW

RegGetValueW

rpcrt4

CStdStubBuffer_Disconnect

NdrDllGetClassObject

NdrDllRegisterProxy

NdrCStdStubBuffer_Release

CStdStubBuffer_Connect

CStdStubBuffer_DebugServerRelease

NdrOleAllocate

CStdStubBuffer_QueryInterface

CStdStubBuffer_CountRefs

NdrDllUnregisterProxy

IUnknown_Release_Proxy

CStdStubBuffer_AddRef

NdrOleFree

CStdStubBuffer_DebugServerQueryInterface

NdrDllCanUnloadNow

CStdStubBuffer_IsIIDSupported

IUnknown_QueryInterface_Proxy

IUnknown_AddRef_Proxy

CStdStubBuffer_Invoke

version

GetFileVersionInfoW

GetFileVersionInfoSizeW

VerQueryValueW

ntdll

RtlDeriveCapabilitySidsFromName

RtlNtStatusToDosError

Exports

DllCanUnloadNow

DllGetClassObject

DllRegisterServer

DllUnregisterServer

Sections

.text
Size: 150KB - Virtual size: 149KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

IMEKR/imkrotip.dll

.dll regsvr32 windows:10 windows x64 arch:x64

Password: Inicio2020!

6fc24d0878d9a5856abcd6e9037f5a1b

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

7b:5e:0a:b1:c8:ba:a5:b3:54:b5:85:c5:1b:7b:7d:3d:3a:90:d4:3b:14:4d:5d:2d:78:04:8b:19:af:b0:d6:2e
Signer

Actual PE Digest

7b:5e:0a:b1:c8:ba:a5:b3:54:b5:85:c5:1b:7b:7d:3d:3a:90:d4:3b:14:4d:5d:2d:78:04:8b:19:af:b0:d6:2e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

PDB Paths

imkrotip.pdb

Imports

msvcrt

memcmp

_vsnwprintf_s

??3@YAXPEAX@Z

memset

??1type_info@@UEAA@XZ

?terminate@@YAXXZ

_onexit

__dllonexit

_unlock

_lock

__C_specific_handler

_initterm

free

_amsg_exit

_XcptFilter

memmove

memcpy

_CxxThrowException

?what@exception@@UEBAPEBDXZ

??0exception@@QEAA@AEBQEBDH@Z

??0exception@@QEAA@AEBQEBD@Z

_callnewh

malloc

??_V@YAXPEAX@Z

wcsncat_s

wcsncpy_s

memmove_s

_vsnprintf_s

??0exception@@QEAA@AEBV0@@Z

??0exception@@QEAA@XZ

??1exception@@UEAA@XZ

_purecall

memcpy_s

_vsnwprintf

__CxxFrameHandler3

wcsnlen

wcscmp

kernel32

CloseHandle

HeapAlloc

GetProcAddress

CreateMutexExW

GetCurrentProcessId

GetProcessHeap

GetModuleHandleW

DebugBreak

IsDebuggerPresent

InitOnceBeginInitialize

GetCurrentThreadId

ReleaseSRWLockExclusive

AcquireSRWLockExclusive

AcquireSRWLockShared

ReleaseSRWLockShared

SetThreadpoolTimer

LeaveCriticalSection

EnterCriticalSection

DeleteCriticalSection

CloseThreadpoolTimer

WaitForThreadpoolTimerCallbacks

InitializeCriticalSectionEx

GetTickCount64

CompareStringW

CreateThreadpoolTimer

GetModuleFileNameW

GetUserDefaultUILanguage

MulDiv

OpenSemaphoreW

InitializeCriticalSection

Sleep

RtlCaptureContext

RtlLookupFunctionEntry

RtlVirtualUnwind

UnhandledExceptionFilter

SetUnhandledExceptionFilter

GetCurrentProcess

TerminateProcess

QueryPerformanceCounter

GetSystemTimeAsFileTime

GetTickCount

WaitForSingleObject

WaitForSingleObjectEx

GetModuleHandleExW

OutputDebugStringW

GetLastError

ReleaseSemaphore

SetLastError

HeapFree

CreateSemaphoreExW

FreeLibrary

GetModuleFileNameA

LoadResource

LockResource

ResolveDelayLoadedAPI

DelayLoadFailureHook

WakeAllConditionVariable

FormatMessageW

SleepConditionVariableSRW

ReleaseMutex

LoadLibraryExW

ExpandEnvironmentStringsW

GetVersionExW

FindResourceExW

InitOnceComplete

LoadLibraryW

user32

CopyImage

ReleaseDC

GetDC

GetParent

CheckDlgButton

DispatchMessageW

TranslateMessage

DestroyWindow

SendMessageW

SetForegroundWindow

IsWindow

MapVirtualKeyExW

ToUnicode

keybd_event

GetKeyState

SystemParametersInfoW

GetSysColor

GetDpiForWindow

GetForegroundWindow

GetGUIThreadInfo

MessageBoxW

SendInput

PostMessageW

GetKeyboardLayout

DestroyIcon

LoadImageW

CopyIcon

GetMessageW

GetDesktopWindow

GetSystemMetrics

IsDlgButtonChecked

gdi32

EnumFontFamiliesExW

advapi32

GetSidSubAuthority

RegGetValueW

EventActivityIdControl

RegDeleteValueW

RegDeleteKeyW

RegEnumKeyExW

RegSetValueExW

RegCreateKeyExW

RegCloseKey

RegQueryValueExW

RegOpenKeyExW

EventUnregister

GetSidSubAuthorityCount

IsValidSid

GetTokenInformation

OpenProcessToken

EventRegister

EventSetInformation

EventWriteTransfer

ole32

PropVariantClear

CLSIDFromProgID

CoCreateInstance

oleaut32

VariantClear

VariantInit

SysStringLen

VariantCopy

SysFreeString

SysAllocString

imm32

ImmGetContext

ImmGetCompositionStringW

ImmEscapeW

ImmReleaseContext

propsys

PSCreateMemoryPropertyStore

Exports

DllCanUnloadNow

DllGetClassObject

DllRegisterServer

DllUnregisterServer

Sections

.text
Size: 218KB - Virtual size: 217KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 504KB - Virtual size: 504KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

IMEKR/imkrtip.dll

.dll regsvr32 windows:10 windows x64 arch:x64

ae11853857aaa77d501220f7af7f3760

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

13:19:11:03:2d:60:ff:54:47:a4:98:cc:c8:0b:25:3a:4a:4e:05:e5:6c:72:79:cc:33:90:0f:b5:11:23:9a:2f
Signer

Actual PE Digest

13:19:11:03:2d:60:ff:54:47:a4:98:cc:c8:0b:25:3a:4a:4e:05:e5:6c:72:79:cc:33:90:0f:b5:11:23:9a:2f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

PDB Paths

imkrtip.pdb

Imports

msvcrt

memcmp

_vsnwprintf_s

??3@YAXPEAX@Z

memset

??1type_info@@UEAA@XZ

?terminate@@YAXXZ

_onexit

__dllonexit

_unlock

_lock

__C_specific_handler

_initterm

free

_amsg_exit

_XcptFilter

memmove

memcpy

_CxxThrowException

?what@exception@@UEBAPEBDXZ

??0exception@@QEAA@AEBQEBDH@Z

??0exception@@QEAA@AEBQEBD@Z

_callnewh

malloc

??_V@YAXPEAX@Z

wcsncat_s

wcsncpy_s

memmove_s

_vsnprintf_s

??0exception@@QEAA@AEBV0@@Z

??0exception@@QEAA@XZ

??1exception@@UEAA@XZ

_purecall

memcpy_s

_vsnwprintf

__CxxFrameHandler3

wcsnlen

wcscmp

kernel32

CloseHandle

HeapAlloc

GetProcAddress

CreateMutexExW

GetCurrentProcessId

GetProcessHeap

GetModuleHandleW

DebugBreak

IsDebuggerPresent

InitOnceBeginInitialize

GetCurrentThreadId

ReleaseSRWLockExclusive

AcquireSRWLockExclusive

AcquireSRWLockShared

ReleaseSRWLockShared

SetThreadpoolTimer

LeaveCriticalSection

EnterCriticalSection

DeleteCriticalSection

CloseThreadpoolTimer

WaitForThreadpoolTimerCallbacks

InitializeCriticalSectionEx

GetTickCount64

CompareStringW

CreateThreadpoolTimer

GetModuleFileNameW

GetUserDefaultUILanguage

MulDiv

OpenSemaphoreW

InitializeCriticalSection

Sleep

RtlCaptureContext

RtlLookupFunctionEntry

RtlVirtualUnwind

UnhandledExceptionFilter

SetUnhandledExceptionFilter

GetCurrentProcess

TerminateProcess

QueryPerformanceCounter

GetSystemTimeAsFileTime

GetTickCount

WaitForSingleObject

WaitForSingleObjectEx

GetModuleHandleExW

OutputDebugStringW

GetLastError

ReleaseSemaphore

SetLastError

HeapFree

CreateSemaphoreExW

FreeLibrary

GetModuleFileNameA

LoadResource

LockResource

ResolveDelayLoadedAPI

DelayLoadFailureHook

WakeAllConditionVariable

FormatMessageW

SleepConditionVariableSRW

ReleaseMutex

LoadLibraryExW

ExpandEnvironmentStringsW

GetVersionExW

InitOnceComplete

FindResourceExW

LoadLibraryW

user32

CopyImage

ReleaseDC

GetDC

IsDlgButtonChecked

CheckDlgButton

CheckRadioButton

DispatchMessageW

TranslateMessage

DestroyWindow

SendMessageW

SetForegroundWindow

IsWindow

MapVirtualKeyExW

ToUnicode

keybd_event

GetKeyState

SystemParametersInfoW

GetSysColor

GetDpiForWindow

GetForegroundWindow

GetGUIThreadInfo

MessageBoxW

SendInput

PostMessageW

GetKeyboardLayout

DestroyIcon

LoadImageW

CopyIcon

GetMessageW

GetDesktopWindow

GetSystemMetrics

GetParent

gdi32

EnumFontFamiliesExW

advapi32

GetSidSubAuthority

RegGetValueW

EventActivityIdControl

RegDeleteValueW

RegDeleteKeyW

RegEnumKeyExW

RegSetValueExW

RegCreateKeyExW

RegCloseKey

RegQueryValueExW

RegOpenKeyExW

EventUnregister

GetSidSubAuthorityCount

IsValidSid

GetTokenInformation

OpenProcessToken

EventRegister

EventSetInformation

EventWriteTransfer

ole32

PropVariantClear

CLSIDFromProgID

CoCreateInstance

oleaut32

VariantClear

VariantInit

SysStringLen

VariantCopy

SysFreeString

SysAllocString

imm32

ImmGetContext

ImmGetCompositionStringW

ImmEscapeW

ImmReleaseContext

propsys

PSCreateMemoryPropertyStore

Exports

DllCanUnloadNow

DllGetClassObject

DllRegisterServer

DllUnregisterServer

Sections

.text
Size: 219KB - Virtual size: 218KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 497KB - Virtual size: 496KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

IMEKR/imkrudt.dll

.dll regsvr32 windows:10 windows x64 arch:x64

bbcc0796298c5faf8df06ace02482b0b

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

23:28:3f:f6:e9:a7:e4:19:a3:c9:d8:a3:e0:22:f3:46:02:98:10:a6:7b:e0:1f:3e:3a:46:be:18:15:03:9a:d9
Signer

Actual PE Digest

23:28:3f:f6:e9:a7:e4:19:a3:c9:d8:a3:e0:22:f3:46:02:98:10:a6:7b:e0:1f:3e:3a:46:be:18:15:03:9a:d9

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

PDB Paths

imkrudt.pdb

Imports

msvcrt

memcpy

_CxxThrowException

?what@exception@@UEBAPEBDXZ

_initterm

??0exception@@QEAA@AEBQEBDH@Z

??0exception@@QEAA@AEBQEBD@Z

_callnewh

_lock

_unlock

__dllonexit

_onexit

??1type_info@@UEAA@XZ

memmove

realloc

memcmp

_XcptFilter

_amsg_exit

memmove_s

wcscat_s

wcscpy_s

free

malloc

wcsncpy_s

__C_specific_handler

wcsnlen

_vsnprintf_s

??0exception@@QEAA@AEBV0@@Z

??3@YAXPEAX@Z

_errno

??0exception@@QEAA@XZ

??1exception@@UEAA@XZ

_purecall

memcpy_s

_vsnwprintf

??_V@YAXPEAX@Z

__CxxFrameHandler3

?terminate@@YAXXZ

memset

kernel32

SetThreadpoolTimer

GetVersionExW

CreateThreadpoolTimer

CloseThreadpoolTimer

GetModuleFileNameA

CreateSemaphoreExW

HeapFree

SetLastError

ReleaseSemaphore

GetModuleHandleExW

WaitForSingleObject

GetCurrentThreadId

ReleaseMutex

FormatMessageW

GetLastError

OutputDebugStringW

WaitForSingleObjectEx

OpenSemaphoreW

CloseHandle

WaitForThreadpoolTimerCallbacks

GetProcAddress

CreateMutexExW

GetCurrentProcessId

GetProcessHeap

GetModuleHandleW

DebugBreak

IsDebuggerPresent

LoadLibraryW

GetUserDefaultUILanguage

FindResourceExW

LoadResource

LockResource

FreeLibrary

InitOnceBeginInitialize

InitOnceComplete

LoadLibraryExW

lstrcmpiW

RaiseException

MultiByteToWideChar

SizeofResource

GetModuleFileNameW

DeleteCriticalSection

InitializeCriticalSection

DisableThreadLibraryCalls

EnterCriticalSection

LeaveCriticalSection

Sleep

RtlCaptureContext

RtlLookupFunctionEntry

RtlVirtualUnwind

UnhandledExceptionFilter

SetUnhandledExceptionFilter

GetCurrentProcess

TerminateProcess

ReleaseSRWLockExclusive

AcquireSRWLockExclusive

WakeAllConditionVariable

SleepConditionVariableSRW

QueryPerformanceCounter

InitializeCriticalSectionEx

GetTickCount

OutputDebugStringA

ReleaseSRWLockShared

AcquireSRWLockShared

HeapAlloc

GetSystemTimeAsFileTime

user32

IsDialogMessageW

GetWindowPlacement

GetWindowRect

SetWindowPlacement

GetWindowLongPtrW

GetDlgItem

MapWindowPoints

CreateWindowExW

SendMessageW

SetFocus

GetNextDlgTabItem

MessageBoxW

GetDlgCtrlID

GetDC

ReleaseDC

UnregisterClassA

CallNextHookEx

GetDlgItemTextW

GetForegroundWindow

TranslateAcceleratorW

DestroyAcceleratorTable

DestroyWindow

UnhookWindowsHookEx

LoadAcceleratorsW

SetWindowsHookExW

ShowWindow

CreateDialogIndirectParamW

GetFocus

CharNextW

gdi32

GetStockObject

DeleteObject

GetObjectW

GetDeviceCaps

CreateFontIndirectW

EnumFontFamiliesExW

advapi32

GetSidSubAuthority

GetSidSubAuthorityCount

IsValidSid

GetTokenInformation

OpenProcessToken

EventWriteTransfer

EventUnregister

EventSetInformation

EventRegister

RegQueryInfoKeyW

RegEnumKeyExW

RegDeleteValueW

RegOpenKeyExW

RegCreateKeyExW

RegSetValueExW

RegQueryValueExW

RegCloseKey

ole32

CoTaskMemRealloc

CoTaskMemFree

CoCreateInstance

CoTaskMemAlloc

StringFromGUID2

oleaut32

VarUI4FromStr

SysFreeString

SysStringLen

LoadTypeLi

UnRegisterTypeLi

RegisterTypeLi

SysAllocString

VariantClear

Exports

DllCanUnloadNow

DllGetClassObject

DllRegisterServer

DllUnregisterServer

Sections

.text
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 25KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 740B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

app__v6.19.3_.msi

.msi

migration/APMonPortMig.dll

.dll regsvr32 windows:10 windows x64 arch:x64

72bf59904e010e22435bd2ded7575c53

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

80:9c:77:46:40:22:f1:86:00:00:8f:07:c5:a2:28:f9:e1:3d:59:54:c3:5d:93:82:a3:20:4b:89:19:fa:e5:75
Signer

Actual PE Digest

80:9c:77:46:40:22:f1:86:00:00:8f:07:c5:a2:28:f9:e1:3d:59:54:c3:5d:93:82:a3:20:4b:89:19:fa:e5:75

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

PDB Paths

APMonPortMig.pdb

Imports

msvcrt

wcsncpy_s

__C_specific_handler

_vsnprintf_s

??0exception@@QEAA@AEBV0@@Z

??0exception@@QEAA@XZ

??1exception@@UEAA@XZ

??3@YAXPEAX@Z

memcpy_s

_vsnwprintf

__CxxFrameHandler3

malloc

memcpy

memmove

realloc

_errno

??1type_info@@UEAA@XZ

_onexit

__dllonexit

_unlock

_lock

?terminate@@YAXXZ

_initterm

_amsg_exit

_XcptFilter

_CxxThrowException

_callnewh

??0exception@@QEAA@AEBQEBDH@Z

_wcsicmp

towlower

??0exception@@QEAA@AEBQEBD@Z

?what@exception@@UEBAPEBDXZ

_purecall

wcscat_s

wcscpy_s

??_V@YAXPEAX@Z

free

memset

ntdll

RtlCaptureContext

RtlLookupFunctionEntry

RtlVirtualUnwind

winspool.drv

XcvDataW

OpenPrinterW

ClosePrinter

EnumPortsW

oleaut32

VariantClear

VariantInit

GetErrorInfo

SysFreeString

VarUI4FromStr

SysAllocString

user32

UnregisterClassA

CharNextW

advapi32

RegSetKeyValueW

EventRegister

EventSetInformation

EventWriteTransfer

EventUnregister

RegDeleteValueW

RegCreateKeyExW

RegSetValueExW

RegOpenKeyExW

RegEnumKeyExW

RegQueryInfoKeyW

RegCloseKey

kernel32

OutputDebugStringA

GetTickCount

GetSystemTimeAsFileTime

QueryPerformanceCounter

SleepConditionVariableSRW

WakeAllConditionVariable

AcquireSRWLockExclusive

ReleaseSRWLockExclusive

TerminateProcess

GetCurrentProcess

SetUnhandledExceptionFilter

UnhandledExceptionFilter

Sleep

LocalFree

GetVersionExW

InitOnceComplete

InitOnceBeginInitialize

InitializeCriticalSection

DelayLoadFailureHook

ResolveDelayLoadedAPI

DeleteCriticalSection

LeaveCriticalSection

EnterCriticalSection

GetModuleFileNameW

FindResourceExW

LoadResource

SizeofResource

MultiByteToWideChar

RaiseException

lstrcmpiW

LoadLibraryExW

FreeLibrary

IsDebuggerPresent

DebugBreak

GetModuleHandleW

GetProcessHeap

GetCurrentProcessId

CreateMutexExW

GetProcAddress

HeapAlloc

CloseHandle

OpenSemaphoreW

WaitForSingleObjectEx

OutputDebugStringW

GetLastError

FormatMessageW

ReleaseMutex

GetCurrentThreadId

WaitForSingleObject

GetModuleHandleExW

ReleaseSemaphore

SetLastError

HeapFree

CreateSemaphoreExW

GetModuleFileNameA

ole32

CoTaskMemFree

CoInitializeEx

CoUninitialize

CoTaskMemRealloc

StringFromGUID2

CoCreateInstance

CoTaskMemAlloc

Exports

DllCanUnloadNow

DllGetClassObject

DllRegisterServer

DllUnregisterServer

Sections

.text
Size: 60KB - Virtual size: 60KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

migration/AppxUpgradeMigrationPlugin.dll

.dll windows:10 windows x64 arch:x64

a5114578e2e8d0b9d6cdb867c595a244

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

e8:fd:9b:d1:1c:60:59:c6:82:67:8c:ac:1a:43:79:0c:ef:c9:81:b2:c3:93:60:2d:6a:9d:1e:c0:5d:f5:da:0d
Signer

Actual PE Digest

e8:fd:9b:d1:1c:60:59:c6:82:67:8c:ac:1a:43:79:0c:ef:c9:81:b2:c3:93:60:2d:6a:9d:1e:c0:5d:f5:da:0d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

IMAGE_FILE_NET_RUN_FROM_SWAP

IMAGE_FILE_DLL

PDB Paths

AppxUpgradeMigrationPlugin.pdb

Imports

msvcrt

realloc

free

?terminate@@YAXXZ

_wcsicmp

_wcsnicmp

wcsstr

_lock

_unlock

__dllonexit

_onexit

??1type_info@@UEAA@XZ

memset

_XcptFilter

_initterm

__CxxFrameHandler3

memmove

memcmp

_CxxThrowException

wcsrchr

memmove_s

_vsnprintf_s

??0exception@@QEAA@AEBV0@@Z

_amsg_exit

??0exception@@QEAA@XZ

??1exception@@UEAA@XZ

_purecall

memcpy_s

_vsnwprintf

malloc

__C_specific_handler

memcpy

wcscmp

api-ms-win-core-heap-l1-1-0

HeapAlloc

HeapFree

GetProcessHeap

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection

InitializeSRWLock

AcquireSRWLockExclusive

ReleaseSRWLockExclusive

AcquireSRWLockShared

InitializeCriticalSection

InitializeCriticalSectionEx

EnterCriticalSection

LeaveCriticalSection

CreateSemaphoreExW

ReleaseSRWLockShared

CreateMutexExW

WaitForSingleObject

WaitForSingleObjectEx

ReleaseMutex

OpenSemaphoreW

CreateEventW

SetEvent

ReleaseSemaphore

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc

CoTaskMemFree

CoGetApartmentType

CoCreateInstance

CLSIDFromString

api-ms-win-core-processthreads-l1-1-0

TerminateProcess

GetCurrentProcess

CreateThread

GetExitCodeProcess

CreateProcessW

GetCurrentProcessId

GetCurrentThreadId

UpdateProcThreadAttribute

InitializeProcThreadAttributeList

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-libraryloader-l1-1-0

GetModuleFileNameW

GetProcAddress

GetModuleHandleW

DisableThreadLibraryCalls

LoadLibraryExW

FreeLibrary

api-ms-win-core-registry-l1-1-0

RegCloseKey

RegQueryInfoKeyW

RegEnumValueW

RegSetKeySecurity

RegSetValueExW

RegDeleteValueW

RegEnumKeyExW

RegCreateKeyExW

RegCopyTreeW

RegGetKeySecurity

RegDeleteTreeW

RegDeleteKeyExW

RegOpenKeyExW

RegGetValueW

RegQueryValueExW

api-ms-win-core-errorhandling-l1-1-0

GetLastError

UnhandledExceptionFilter

SetUnhandledExceptionFilter

SetLastError

RaiseException

api-ms-win-core-file-l1-1-0

RemoveDirectoryW

FindFirstFileW

FindClose

GetFileAttributesW

WriteFile

DeleteFileW

ReadFile

CreateFileW

FindNextFileW

SetFileAttributesW

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer

CloseThreadpoolTimer

CreateThreadpoolTimer

WaitForThreadpoolTimerCallbacks

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-kernel32-legacy-l1-1-0

LoadLibraryW

CopyFileW

api-ms-win-core-version-l1-1-0

VerQueryValueW

GetFileVersionInfoExW

GetFileVersionInfoSizeExW

api-ms-win-service-management-l1-1-0

CloseServiceHandle

OpenServiceW

OpenSCManagerW

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-eventing-provider-l1-1-0

EventUnregister

EventWriteTransfer

EventSetInformation

EventRegister

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize

Sleep

InitOnceComplete

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

GetSystemWindowsDirectoryW

GetTickCount

GetTickCount64

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW

api-ms-win-security-provider-l1-1-0

GetNamedSecurityInfoW

SetEntriesInAclW

SetNamedSecurityInfoW

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree

api-ms-win-security-base-l1-1-0

SetSecurityDescriptorDacl

SetSecurityDescriptorControl

CreateWellKnownSid

DestroyPrivateObjectSecurity

InitializeSecurityDescriptor

InitializeAcl

AddAccessAllowedAceEx

CreatePrivateObjectSecurityEx

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext

RtlLookupFunctionEntry

RtlVirtualUnwind

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

ntdll

NtMapViewOfSection

RtlNtStatusToDosErrorNoTeb

NtClose

RtlAllocateHeap

RtlReAllocateHeap

RtlFreeHeap

RtlReleaseSRWLockShared

RtlAcquireSRWLockShared

RtlReleaseSRWLockExclusive

RtlAcquireSRWLockExclusive

NtUnmapViewOfSection

NtCreateSection

EtwEventUnregister

EtwEventWrite

EtwEventRegister

RtlInsertElementGenericTableAvl

RtlLengthSid

RtlIsGenericTableEmptyAvl

RtlLookupElementGenericTableAvl

RtlGetVersion

RtlEnumerateGenericTableWithoutSplayingAvl

RtlInitUnicodeString

RtlDeleteElementGenericTableAvl

RtlInitializeGenericTableAvl

RtlCompareUnicodeString

iphlpapi

GetIfEntry2

ConvertInterfaceGuidToLuid

oleaut32

SysFreeString

VariantClear

SysAllocStringLen

SysStringLen

SysAllocString

GetErrorInfo

kernel32

PackageFamilyNameFromFullName

advapi32

GetEffectiveRightsFromAclW

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

RoActivateInstance

api-ms-win-core-winrt-string-l1-1-0

WindowsDuplicateString

WindowsCreateStringReference

WindowsCreateString

WindowsDeleteString

WindowsGetStringRawBuffer

WindowsStringHasEmbeddedNull

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError

RoTransformError

devobj

DevObjCreateDeviceInfoList

DevObjDestroyDeviceInfoList

DevObjOpenDevRegKey

DevObjGetClassDevs

DevObjEnumDeviceInfo

api-ms-win-core-io-l1-1-0

DeviceIoControl

Exports

DllCanUnloadNow

DllGetClassObject

Sections

.text
Size: 225KB - Virtual size: 224KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 212KB - Virtual size: 212KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 956B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

migration/audmigplugin.dll

.dll regsvr32 windows:10 windows x64 arch:x64

129672cc4d9f93d06764e571d9bb75cd

Code Sign

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

94:2e:d1:ec:5b:32:74:17:ec:74:9f:37:da:7e:12:ad:f7:be:34:b9:2f:4a:f8:fe:71:4e:c6:14:c0:fd:67:52
Signer

Actual PE Digest

94:2e:d1:ec:5b:32:74:17:ec:74:9f:37:da:7e:12:ad:f7:be:34:b9:2f:4a:f8:fe:71:4e:c6:14:c0:fd:67:52

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

IMAGE_FILE_NET_RUN_FROM_SWAP

IMAGE_FILE_DLL

PDB Paths

AudMigPlugin.pdb

Imports

msvcrt

_lock

__dllonexit

_unlock

realloc

??1type_info@@UEAA@XZ

_errno

memcmp

_CxxThrowException

__C_specific_handler

_initterm

_amsg_exit

_XcptFilter

_callnewh

wcsstr

_wcslwr

swprintf_s

_vsnwprintf

_purecall

memmove_s

wcscat_s

wcscpy_s

memcpy_s

free

malloc

wcsncpy_s

_onexit

memset

ntdll

RtlCaptureContext

RtlLookupFunctionEntry

RtlVirtualUnwind

oleaut32

SysAllocString

LoadTypeLi

SysStringByteLen

SysAllocStringByteLen

GetErrorInfo

SysFreeString

VarBstrCmp

LoadRegTypeLi

SysStringLen

RegisterTypeLi

UnRegisterTypeLi

VarUI4FromStr

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress

LockResource

FindResourceExW

LoadResource

SizeofResource

GetModuleHandleW

GetModuleFileNameW

FreeLibrary

LoadLibraryExW

api-ms-win-core-com-l1-1-0

StringFromGUID2

CoTaskMemRealloc

StringFromCLSID

CoTaskMemAlloc

CoCreateInstance

CoTaskMemFree

api-ms-win-core-string-l2-1-0

CharNextW

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter

GetLastError

RaiseException

SetUnhandledExceptionFilter

api-ms-win-core-registry-l1-1-0

RegDeleteValueW

RegGetValueW

RegDeleteTreeW

RegCloseKey

RegCreateKeyExW

RegQueryInfoKeyW

RegSetValueExW

RegEnumKeyExW

RegOpenKeyExW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-localization-l1-2-0

GetThreadLocale

SetThreadLocale

api-ms-win-core-synch-l1-1-0

InitializeCriticalSection

LeaveCriticalSection

DeleteCriticalSection

EnterCriticalSection

api-ms-win-core-debug-l1-1-0

OutputDebugStringW

OutputDebugStringA

api-ms-win-core-registry-l1-1-1

RegSetKeyValueW

api-ms-win-core-heap-l1-1-0

GetProcessHeap

HeapFree

HeapReAlloc

HeapAlloc

HeapSize

HeapDestroy

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId

TerminateProcess

GetCurrentThreadId

GetCurrentProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

GetTickCount

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

setupapi

SetupOpenLog

SetupLogErrorW

SetupDiGetClassDevsW

SetupCloseLog

SetupDiGetDeviceInstanceIdW

SetupDiEnumDeviceInfo

SetupDiDestroyDeviceInfoList

SetupDiGetDevicePropertyW

SetupDiEnumDriverInfoW

SetupDiGetDriverInfoDetailW

SetupDiBuildDriverInfoList

newdev

DiInstallDevice

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

DllCanUnloadNow

DllGetClassObject

DllMain

DllRegisterServer

DllUnregisterServer

Sections

.text
Size: 38KB - Virtual size: 38KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 460B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

migration/bridgemigplugin.dll

.dll regsvr32 windows:10 windows x64 arch:x64

2638f6a2f8c41fac5b5cd266d2e8c5c4

Code Sign

33:00:00:04:15:82:95:a1:a3:d8:2e:28:57:00:00:00:00:04:15
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

2b:4e:d1:3f:a2:e2:a8:fd:96:d0:4d:50:df:c0:ac:9b:a1:5d:95:7d:b6:09:17:8c:00:35:e1:74:fb:fc:93:cf
Signer

Actual PE Digest

2b:4e:d1:3f:a2:e2:a8:fd:96:d0:4d:50:df:c0:ac:9b:a1:5d:95:7d:b6:09:17:8c:00:35:e1:74:fb:fc:93:cf

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

IMAGE_FILE_NET_RUN_FROM_SWAP

IMAGE_FILE_DLL

PDB Paths

BridgeMigPlugin.pdb

Imports

msvcrt

_purecall

??1exception@@UEAA@XZ

??0exception@@QEAA@XZ

_vsnwprintf

wcsncpy_s

malloc

free

wcscat_s

wcscpy_s

memcpy_s

__C_specific_handler

??0exception@@QEAA@AEBQEBDH@Z

??0exception@@QEAA@AEBQEBD@Z

??0exception@@QEAA@AEBV0@@Z

wcschr

memmove_s

?what@exception@@UEBAPEBDXZ

_callnewh

_CxxThrowException

_XcptFilter

_amsg_exit

_initterm

_errno

__CxxFrameHandler3

realloc

?terminate@@YAXXZ

_lock

_unlock

__dllonexit

_onexit

??1type_info@@UEAA@XZ

wcsncmp

memcmp

memset

kernel32

OutputDebugStringA

GetTickCount

GetSystemTimeAsFileTime

GetCurrentThreadId

GetCurrentProcessId

QueryPerformanceCounter

TerminateProcess

GetCurrentProcess

SetUnhandledExceptionFilter

UnhandledExceptionFilter

RtlVirtualUnwind

RtlLookupFunctionEntry

RtlCaptureContext

Sleep

LocalFree

HeapDestroy

GetProcessHeap

SizeofResource

SetThreadLocale

EnterCriticalSection

GetModuleFileNameW

GetThreadLocale

LeaveCriticalSection

InitializeCriticalSection

MultiByteToWideChar

GetLastError

RaiseException

FindResourceExW

LoadResource

GetProcAddress

DeleteCriticalSection

GetModuleHandleW

FreeLibrary

lstrcmpiW

LoadLibraryExW

lstrlenW

GetVersionExW

CreateEventW

CloseHandle

LoadLibraryW

LockResource

HeapSize

HeapReAlloc

HeapFree

HeapAlloc

user32

CharNextW

UnregisterClassA

advapi32

RegQueryInfoKeyW

RegOpenKeyExW

RegEnumValueW

RegQueryValueExW

RegCloseKey

RegDeleteValueW

RegCreateKeyExW

RegEnumKeyExW

RegSetValueExW

ole32

CoSetProxyBlanket

CLSIDFromString

CoUninitialize

CoWaitForMultipleHandles

StringFromCLSID

CoTaskMemRealloc

CoTaskMemFree

CoCreateInstance

StringFromGUID2

CoTaskMemAlloc

CoInitialize

oleaut32

UnRegisterTypeLi

LoadTypeLi

SysFreeString

RegisterTypeLi

SysAllocString

VarUI4FromStr

GetErrorInfo

SysStringLen

LoadRegTypeLi

shlwapi

SHDeleteKeyW

shell32

SHGetFileInfoW

nsi

NsiSetAllParameters

Exports

DllCanUnloadNow

DllGetClassObject

DllMain

DllRegisterServer

DllUnregisterServer

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

migration/bthmigplugin.dll

.dll regsvr32 windows:10 windows x64 arch:x64

66121ef6612c88e7717e606995f096ee

Code Sign

33:00:00:04:13:31:bc:19:88:07:a9:07:74:00:00:00:00:04:13
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

03/02/2023, 00:05

Not After

01/02/2024, 00:05

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

30:4b:02:dc:a5:cd:5b:d8:a5:86:dc:e5:2e:f4:33:f5:b1:3e:eb:9e:ab:63:80:f4:b0:0b:39:da:19:54:83:42
Signer

Actual PE Digest

30:4b:02:dc:a5:cd:5b:d8:a5:86:dc:e5:2e:f4:33:f5:b1:3e:eb:9e:ab:63:80:f4:b0:0b:39:da:19:54:83:42

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

IMAGE_FILE_NET_RUN_FROM_SWAP

IMAGE_FILE_DLL

PDB Paths

BthMigPlugin.pdb

Imports

msvcrt

??1exception@@UEAA@XZ

?what@exception@@UEBAPEBDXZ

??0exception@@QEAA@AEBV0@@Z

__CxxFrameHandler3

??3@YAXPEAX@Z

memcpy

memmove

_XcptFilter

_amsg_exit

_initterm

_errno

??0exception@@QEAA@AEBQEBD@Z

_callnewh

calloc

wcscpy_s

free

memmove_s

malloc

wcsncpy_s

wcscat_s

_purecall

_vsnwprintf

wcstoul

swprintf_s

_wcsnicmp

_vscwprintf

vswprintf_s

_wcsicmp

_CxxThrowException

memcmp

??1type_info@@UEAA@XZ

_onexit

__dllonexit

_unlock

_lock

??0exception@@QEAA@AEBQEBDH@Z

memcpy_s

??_V@YAXPEAX@Z

__C_specific_handler

realloc

memset

ntdll

RtlLookupFunctionEntry

RtlVirtualUnwind

RtlCaptureContext

kernel32

LocalAlloc

SetLastError

CloseHandle

SizeofResource

EnterCriticalSection

GetModuleFileNameW

LeaveCriticalSection

InitializeCriticalSection

GetLastError

LockResource

RaiseException

FindResourceExW

LoadResource

GetProcAddress

DeleteCriticalSection

GetModuleHandleW

lstrcmpiW

LoadLibraryExW

FreeLibrary

MultiByteToWideChar

GetThreadLocale

SetThreadLocale

DisableThreadLibraryCalls

OutputDebugStringW

HeapSize

HeapReAlloc

HeapFree

HeapAlloc

GetProcessHeap

HeapDestroy

LocalFree

Sleep

UnhandledExceptionFilter

SetUnhandledExceptionFilter

GetCurrentProcess

TerminateProcess

QueryPerformanceCounter

GetCurrentProcessId

GetCurrentThreadId

GetSystemTimeAsFileTime

GetTickCount

OutputDebugStringA

VerSetConditionMask

VerifyVersionInfoW

advapi32

RegQueryInfoKeyW

GetSecurityDescriptorDacl

GetTokenInformation

SetNamedSecurityInfoW

FreeSid

SetSecurityInfo

SetEntriesInAclW

AllocateAndInitializeSid

GetSecurityInfo

CreateWellKnownSid

RegQueryValueExW

RegSetKeySecurity

ConvertStringSecurityDescriptorToSecurityDescriptorW

AdjustTokenPrivileges

LookupPrivilegeValueW

OpenProcessToken

RegEnumValueW

RegDeleteValueW

RegCloseKey

RegCreateKeyExW

RegEnumKeyExW

RegSetValueExW

RegOpenKeyExW

user32

UnregisterClassA

CharNextW

ole32

StringFromGUID2

CoTaskMemRealloc

CoTaskMemAlloc

CoCreateInstance

CoTaskMemFree

StringFromCLSID

oleaut32

GetErrorInfo

RegisterTypeLi

SysAllocString

UnRegisterTypeLi

LoadRegTypeLi

LoadTypeLi

SysFreeString

SysStringLen

VarUI4FromStr

shlwapi

SHDeleteKeyW

shell32

SHGetFileInfoW

setupapi

CM_Get_Device_ID_ExW

SetupDiEnumDeviceInfo

SetupDiGetClassDevsW

SetupDiGetDeviceInstanceIdW

CM_Get_Parent_Ex

SetupDiOpenDevRegKey

CM_Get_DevNode_Registry_Property_ExW

SetupDiGetDeviceInfoListDetailW

SetupDiGetDeviceRegistryPropertyW

Exports

DllCanUnloadNow

DllGetClassObject

DllMain

DllRegisterServer

DllUnregisterServer

Sections

.text
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

migration/chxmig.dll

.dll windows:10 windows x64 arch:x64

04ed949102c97f40c910d61ff125f4af

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

76:75:fa:52:42:14:42:1a:9e:31:cc:c0:4b:26:fd:fc:bb:93:f8:67:86:be:c6:44:9e:eb:84:77:4b:0c:85:98
Signer

Actual PE Digest

76:75:fa:52:42:14:42:1a:9e:31:cc:c0:4b:26:fd:fc:bb:93:f8:67:86:be:c6:44:9e:eb:84:77:4b:0c:85:98

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

PDB Paths

ChxMig.pdb

Imports

msvcrt

_vsnwprintf

??1type_info@@UEAA@XZ

?terminate@@YAXXZ

_onexit

__dllonexit

_unlock

??1bad_cast@@UEAA@XZ

??0bad_cast@@QEAA@PEBD@Z

??0bad_cast@@QEAA@AEBV0@@Z

swscanf

_errno

setlocale

__uncaught_exception

__pctype_func

___lc_handle_func

___lc_codepage_func

calloc

___mb_cur_max_func

_ismbblead

abort

memset

_wcsdup

__crtLCMapStringW

_wsetlocale

_lock

__C_specific_handler

_initterm

free

_amsg_exit

_XcptFilter

memmove

memcpy

_CxxThrowException

?what@exception@@UEBAPEBDXZ

??0exception@@QEAA@AEBQEBDH@Z

??0exception@@QEAA@AEBQEBD@Z

_callnewh

malloc

wcsncmp

_wcsicmp

??_V@YAXPEAX@Z

_vsnprintf_s

??0exception@@QEAA@AEBV0@@Z

??0exception@@QEAA@XZ

??1exception@@UEAA@XZ

_purecall

??3@YAXPEAX@Z

memcpy_s

__CxxFrameHandler3

kernel32

EnterCriticalSection

WideCharToMultiByte

GetStringTypeW

MultiByteToWideChar

LoadLibraryExW

FreeLibrary

LoadLibraryW

GetSystemDirectoryW

GetModuleFileNameW

GetFullPathNameW

LeaveCriticalSection

EncodePointer

DecodePointer

InitializeCriticalSectionEx

GetTickCount

GetModuleFileNameA

CreateSemaphoreExW

HeapFree

SetLastError

ReleaseSemaphore

GetModuleHandleExW

WaitForSingleObject

GetCurrentThreadId

ReleaseMutex

FormatMessageW

GetLastError

GetSystemTimeAsFileTime

WaitForSingleObjectEx

OpenSemaphoreW

CloseHandle

HeapAlloc

GetProcAddress

CreateMutexExW

GetCurrentProcessId

GetProcessHeap

GetModuleHandleW

DebugBreak

IsDebuggerPresent

DisableThreadLibraryCalls

InitializeCriticalSection

DeleteCriticalSection

GetSystemDefaultLangID

LocalFree

Sleep

RtlCaptureContext

RtlLookupFunctionEntry

RtlVirtualUnwind

UnhandledExceptionFilter

SetUnhandledExceptionFilter

GetCurrentProcess

TerminateProcess

ReleaseSRWLockExclusive

AcquireSRWLockExclusive

WakeAllConditionVariable

SleepConditionVariableSRW

QueryPerformanceCounter

OutputDebugStringW

oleaut32

SysFreeString

SysAllocString

GetErrorInfo

SysStringLen

advapi32

LookupPrivilegeValueW

AdjustTokenPrivileges

RegSetKeyValueW

RegDeleteKeyValueW

RegCreateKeyExW

RegSetValueExW

OpenProcessToken

RegGetValueW

RegEnumKeyExW

RegQueryInfoKeyW

RegEnumValueW

RegOpenKeyExW

RegDeleteKeyW

RegCloseKey

RegQueryValueExW

Exports

ApplySuccess

Gather

PreApply

Sections

.text
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 53KB - Virtual size: 53KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1008B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 712B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

migwiz/MXEAgent.dll

.dll windows:10 windows x64 arch:x64

1e206e43c8057412b49917c02c56ca25

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

86:23:69:27:16:d8:45:9b:a1:72:59:6f:ac:10:a6:ab:c7:dd:c1:fa:30:c9:5a:c8:a9:bf:c1:9e:44:e6:d6:81
Signer

Actual PE Digest

86:23:69:27:16:d8:45:9b:a1:72:59:6f:ac:10:a6:ab:c7:dd:c1:fa:30:c9:5a:c8:a9:bf:c1:9e:44:e6:d6:81

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

IMAGE_FILE_NET_RUN_FROM_SWAP

IMAGE_FILE_DLL

PDB Paths

MXEAgent.pdb

Imports

msvcrt

__RTDynamicCast

??1type_info@@UEAA@XZ

_onexit

__dllonexit

_unlock

_lock

?terminate@@YAXXZ

__C_specific_handler

_initterm

_amsg_exit

_XcptFilter

_CxxThrowException

_callnewh

?what@exception@@UEBAPEBDXZ

??1exception@@UEAA@XZ

??0exception@@QEAA@AEBV0@@Z

??0exception@@QEAA@AEBQEBDH@Z

malloc

memmove_s

free

?name@type_info@@QEBAPEBDXZ

_purecall

calloc

__CxxFrameHandler3

memset

kernel32

TerminateProcess

GetLastError

Sleep

QueryPerformanceCounter

GetCurrentProcess

SetUnhandledExceptionFilter

UnhandledExceptionFilter

RtlVirtualUnwind

RtlLookupFunctionEntry

RtlCaptureContext

GetTickCount

GetSystemTimeAsFileTime

GetCurrentThreadId

GetCurrentProcessId

WaitForSingleObject

unbcl

??C?$SmartPtr@V?$ArrayList@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@QEBAPEAV?$ArrayList@PEAVString@UnBCL@@@1@XZ

??1?$SmartPtr@V?$ArrayList@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@UEAA@XZ

??0?$SmartPtr@V?$ArrayList@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@QEAA@PEAV?$ArrayList@PEAVString@UnBCL@@@1@@Z

?Combine@Path@UnBCL@@SAPEAVString@2@PEBV32@0@Z

?SanitizeTypeName@SerializationStream@UnBCL@@SAPEAVString@2@AEBV32@@Z

?GetCallingModule@SerializationStream@UnBCL@@SAPEAUHINSTANCE__@@XZ

?CanRegister@SerializationStream@UnBCL@@SAHXZ

?UnregisterType@SerializationStream@UnBCL@@SAXPEBVString@2@HPEAUHINSTANCE__@@@Z

?RegisterType@SerializationStream@UnBCL@@SAXPEBVString@2@HPEAUHINSTANCE__@@PEAUIInstanceFactory@2@@Z

??5SerializationStream@UnBCL@@QEAAAEAV01@AEAH@Z

??5SerializationStream@UnBCL@@QEAAAEAV01@AEAPEAVString@1@@Z

??5SerializationStream@UnBCL@@QEAAAEAV01@AEAPEAUISerializable@1@@Z

??6SerializationStream@UnBCL@@QEAAAEAV01@H@Z

??6SerializationStream@UnBCL@@QEAAAEAV01@PEBVString@1@@Z

??6SerializationStream@UnBCL@@QEAAAEAV01@PEBUISerializable@1@@Z

??0XmlDocument@UnBCL@@QEAA@XZ

?FormatV@String@UnBCL@@SAPEAV12@PEBGPEAD@Z

?Concat@String@UnBCL@@SAPEAV12@PEBG00@Z

?Trim@String@UnBCL@@QEBAPEAV12@XZ

?Substring@String@UnBCL@@QEBAPEAV12@HH@Z

?Split@String@UnBCL@@QEBAPEAV?$ArrayList@PEAVString@UnBCL@@@2@PEBG@Z

?LastIndexOf@String@UnBCL@@QEBAHG@Z

?get_CString@String@UnBCL@@QEBAPEBGXZ

?CompareTo@String@UnBCL@@UEBAHPEBVObject@2@@Z

?Clone@String@UnBCL@@UEBAPEAVObject@2@XZ

?ToString@String@UnBCL@@UEBAPEAV12@XZ

?GetHashCode@String@UnBCL@@UEBAHXZ

?Equals@String@UnBCL@@UEBAHPEBVObject@2@@Z

??1String@UnBCL@@UEAA@XZ

??0String@UnBCL@@QEAA@PEBV01@@Z

??0String@UnBCL@@QEAA@PEBG@Z

??0String@UnBCL@@QEAA@AEBV01@@Z

?SetLiteralStorage@_@UnBCL@@YAXPEAPEBVString@2@PEBG@Z

?DecRef@Object@UnBCL@@QEAAHXZ

?AddRef@Object@UnBCL@@QEAAXXZ

??3Object@UnBCL@@SAXPEAX@Z

??2Object@UnBCL@@SAPEAX_K@Z

??2Object@UnBCL@@SAPEAX_KI@Z

?Clone@Object@UnBCL@@UEBAPEAV12@XZ

?CompareTo@Object@UnBCL@@UEBAHPEBV12@@Z

?GetObjectID@Object@UnBCL@@UEBAIXZ

?ToString@Object@UnBCL@@UEBAPEAVString@2@XZ

?GetType@Object@UnBCL@@UEBAPEAVType@2@XZ

?GetHashCode@Object@UnBCL@@UEBAHXZ

?Equals@Object@UnBCL@@UEBAHPEBV12@@Z

??1Object@UnBCL@@UEAA@XZ

??0Object@UnBCL@@QEAA@XZ

??0Object@UnBCL@@QEAA@AEBV01@@Z

?Clone@?$ArrayList@PEAVString@UnBCL@@@UnBCL@@UEBAPEAVObject@2@XZ

?Equals@?$ArrayList@PEAVString@UnBCL@@@UnBCL@@UEBAHPEBVObject@2@@Z

??0?$ArrayList@PEAVString@UnBCL@@@UnBCL@@QEAA@XZ

??0Win32Exception@UnBCL@@QEAA@K@Z

??0Win32Exception@UnBCL@@QEAA@KPEBG@Z

??0IInstanceFactory@UnBCL@@QEAA@XZ

??1?$IEnumerator@PEAVString@UnBCL@@@UnBCL@@UEAA@XZ

??0?$IEnumerator@PEAVString@UnBCL@@@UnBCL@@QEAA@XZ

??0?$ICollection@PEAVString@UnBCL@@@UnBCL@@QEAA@XZ

??0?$IEnumerable@PEAVString@UnBCL@@@UnBCL@@QEAA@XZ

??1NotSupportedException@UnBCL@@UEAA@XZ

??1InvalidCastException@UnBCL@@UEAA@XZ

??4Object@UnBCL@@QEAAAEAV01@AEBV01@@Z

??1ArgumentOutOfRangeException@UnBCL@@UEAA@XZ

??1?$ICollection@PEAVString@UnBCL@@@UnBCL@@UEAA@XZ

??_D?$ArrayList@PEAVString@UnBCL@@@UnBCL@@QEAAXXZ

??1InvalidOperationException@UnBCL@@UEAA@XZ

??1ISerializable@UnBCL@@UEAA@XZ

??0ISerializable@UnBCL@@QEAA@XZ

??1Win32Exception@UnBCL@@UEAA@XZ

??1ArgumentException@UnBCL@@UEAA@XZ

??1ArgumentNullException@UnBCL@@UEAA@XZ

?get_P@?$SmartPtr@V?$ArrayList@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@QEBAPEAV?$ArrayList@PEAVString@UnBCL@@@2@XZ

??1XmlDocument@UnBCL@@UEAA@XZ

?Load@XmlDocument@UnBCL@@QEAAXPEAVString@2@@Z

?Exists@Directory@UnBCL@@SAHPEBVString@2@@Z

?GetFiles@Directory@UnBCL@@SAPEAV?$Array@PEAVString@UnBCL@@@2@PEBVString@2@0H@Z

?GetCurrentDir@Directory@UnBCL@@SAPEAVString@2@XZ

??0InvalidCastException@UnBCL@@QEAA@XZ

?MemAllocFailed@Allocator@UnBCL@@SAHXZ

?ToString@Exception@UnBCL@@UEBAPEAVString@2@XZ

?get_InnerException@Exception@UnBCL@@UEBAPEBV12@XZ

?get_Message@Exception@UnBCL@@UEBAPEBVString@2@XZ

?get_Source@Exception@UnBCL@@UEBAPEBVString@2@XZ

?set_Source@Exception@UnBCL@@UEAAXPEBVString@2@@Z

?AddStackTrace@Exception@UnBCL@@QEAAXPEBD@Z

?GetBaseException@Exception@UnBCL@@UEBAPEBV12@XZ

?get_HResult@Exception@UnBCL@@UEBAJXZ

?set_HResult@Exception@UnBCL@@MEAAXJ@Z

?SetMessage@Exception@UnBCL@@MEAAXPEAVString@2@@Z

??0ArgumentNullException@UnBCL@@QEAA@PEBG@Z

??0NotSupportedException@UnBCL@@QEAA@PEBG@Z

??0ArgumentException@UnBCL@@QEAA@PEBG@Z

??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAA@PEAVString@1@@Z

??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAA@XZ

??1?$SmartPtr@VString@UnBCL@@@UnBCL@@UEAA@XZ

??4?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAAAEAV01@AEBV01@@Z

??D?$SmartPtr@VString@UnBCL@@@UnBCL@@QEBAAEAVString@1@XZ

??C?$SmartPtr@VString@UnBCL@@@UnBCL@@QEBAPEAVString@1@XZ

?get_P@?$SmartPtr@VString@UnBCL@@@UnBCL@@QEBAPEAVString@2@XZ

??0InvalidOperationException@UnBCL@@QEAA@PEBVString@1@PEAVException@1@@Z

??0InvalidOperationException@UnBCL@@QEAA@PEBG@Z

??0InvalidOperationException@UnBCL@@QEAA@PEBVString@1@@Z

??0?$SmartPtr@V?$Array@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@QEAA@PEAV?$Array@PEAVString@UnBCL@@@1@@Z

??1?$SmartPtr@V?$Array@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@UEAA@XZ

??C?$SmartPtr@V?$Array@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@QEBAPEAV?$Array@PEAVString@UnBCL@@@1@XZ

?EnqueueSbRegistration@SbRegistrationList@UnBCL@@SAXPEBDHPEAUHINSTANCE__@@PEAUIInstanceFactory@2@@Z

?ExpandEnvironmentVariables@Environment@UnBCL@@SAPEAVString@2@PEBV32@@Z

??0ArgumentOutOfRangeException@UnBCL@@QEAA@PEBG@Z

?Exists@File@UnBCL@@SAHPEBVString@2@@Z

?FromASCII@String@UnBCL@@SAPEAV12@PEBD@Z

migcore

??4CAgent@Mig@@QEAAAEAV01@AEBV01@@Z

??0CAgent@Mig@@QEAA@AEBV01@@Z

??1?$ICollection@PEAVCMigUnit@Mig@@@UnBCL@@UEAA@XZ

??1?$IList@PEAVCMigUnit@Mig@@@UnBCL@@UEAA@XZ

??0?$IEnumerable@PEAVCMigUnit@Mig@@@UnBCL@@QEAA@XZ

??0?$ICollection@PEAVCMigUnit@Mig@@@UnBCL@@QEAA@XZ

??0?$IList@PEAVCMigUnit@Mig@@@UnBCL@@QEAA@XZ

??_D?$ArrayList@PEAVCMigUnit@Mig@@@UnBCL@@QEAAXXZ

?AddMigrationXml@CMXEService@Mig@@SAPEAVString@UnBCL@@PEAVCPlatform@2@PEAV34@PEAVXmlDocument@4@11PEAH@Z

?GetMigrationUnits@CMXEService@Mig@@SAXPEAVString@UnBCL@@PEAVCPlatform@2@PEAVCUserContext@2@PEAV?$Hashtable@PEAVString@UnBCL@@PEAVCMigUnit@Mig@@@4@@Z

?SetWorkingDirectory@CMXEService@Mig@@SAXPEAVString@UnBCL@@0@Z

?AddDetectInfo@CMXEService@Mig@@SAXPEAVString@UnBCL@@PEAVCPlatform@2@PEAVCUserContext@2@PEAVCMigUnit@2@@Z

?AddGatherInfo@CMXEService@Mig@@SAXPEAVString@UnBCL@@PEAVCPlatform@2@PEAVCUserContext@2@PEAVCMigUnit@2@@Z

?AddApplyInfo@CMXEService@Mig@@SAXPEAVString@UnBCL@@0PEAVCPlatform@2@1PEAVCUserContext@2@PEAVCMigUnit@2@@Z

?AdjustRules@CMXEService@Mig@@SAXPEAVString@UnBCL@@PEAVCPlatform@2@1PEAVCUserContext@2@PEAVCMigUnit@2@@Z

?set_AgentName@CMigUnit@Mig@@QEAAXPEAVString@UnBCL@@@Z

?set_ExtraData@CMigUnit@Mig@@QEAAXPEAVObject@UnBCL@@@Z

?Clone@?$ArrayList@PEAVCMigUnit@Mig@@@UnBCL@@UEBAPEAVObject@2@XZ

??0CMigUnitList@Mig@@QEAA@XZ

??_DCMigUnitList@Mig@@QEAAXXZ

??0?$ArrayList@PEAVCMigUnit@Mig@@@UnBCL@@QEAA@PEBU?$ICollection@PEAVCMigUnit@Mig@@@1@@Z

?Equals@?$ArrayList@PEAVCMigUnit@Mig@@@UnBCL@@UEBAHPEBVObject@2@@Z

?Init@CAgent@Mig@@UEAAXPEAVCPlatform@2@PEAVString@UnBCL@@@Z

?Done@CAgent@Mig@@UEAAXH@Z

?RefreshGatherInfo@CAgent@Mig@@UEAAXPEAVCMigUnit@2@PEAUICancelable@@@Z

?InitApply@CAgent@Mig@@UEAAXPEAVCPlatform@2@0PEAVString@UnBCL@@@Z

??0CAgent@Mig@@IEAA@PEAVString@UnBCL@@@Z

??1CAgent@Mig@@UEAA@XZ

wdscore

ConstructPartialMsgVW

CurrentIP

WdsSetupLogMessageW

Exports

??0CMXEAgent@Mig@@QEAA@$$QEAV01@@Z

??0CMXEAgent@Mig@@QEAA@AEBV01@@Z

??0CMXEAgent@Mig@@QEAA@PEAVString@UnBCL@@@Z

??1CMXEAgent@Mig@@UEAA@XZ

??4CMXEAgent@Mig@@QEAAAEAV01@$$QEAV01@@Z

??4CMXEAgent@Mig@@QEAAAEAV01@AEBV01@@Z

??_7CMXEAgent@Mig@@6B01@@

??_7CMXEAgent@Mig@@6BCAgent@1@@

??_8CMXEAgent@Mig@@7B@

??_DCMXEAgent@Mig@@QEAAXXZ

?AddApplyInfo@CMXEAgent@Mig@@UEAAXPEAVCMigUnit@2@@Z

?AddGatherInfo@CMXEAgent@Mig@@UEAAXPEAVCMigUnit@2@PEAUICancelable@@@Z

?AddXmlFile@CMXEAgent@Mig@@IEAAXPEAVString@UnBCL@@@Z

?AdjustRules@CMXEAgent@Mig@@UEAAXPEAVCMigUnit@2@0@Z

?Detect@CMXEAgent@Mig@@UEAAPEAVCMigUnitList@2@PEAVCUserContext@2@PEAUICancelable@@@Z

?Done@CMXEAgent@Mig@@UEAAXH@Z

?Init@CMXEAgent@Mig@@UEAAXPEAVCPlatform@2@PEAVString@UnBCL@@@Z

?Init@CMXEAgent@Mig@@UEAAXPEAVCPlatform@2@PEAVString@UnBCL@@PEAV?$ArrayList@PEAVString@UnBCL@@@5@@Z

?InitApply@CMXEAgent@Mig@@UEAAXPEAVCPlatform@2@0PEAVString@UnBCL@@@Z

LoadAgent

Sections

.text
Size: 158KB - Virtual size: 157KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 151KB - Virtual size: 150KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

migwiz/cmi2migxml.dll

.dll windows:10 windows x64 arch:x64

ed7988298b6c68e0a63a784ef1147f68

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

7d:40:a6:33:5e:da:f1:f9:7a:09:6d:03:4e:e6:ce:82:fc:9c:60:75:cc:ca:7c:74:4c:d2:12:e7:b5:cf:77:72
Signer

Actual PE Digest

7d:40:a6:33:5e:da:f1:f9:7a:09:6d:03:4e:e6:ce:82:fc:9c:60:75:cc:ca:7c:74:4c:d2:12:e7:b5:cf:77:72

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

IMAGE_FILE_NET_RUN_FROM_SWAP

IMAGE_FILE_DLL

PDB Paths

cmi2migxml.pdb

Imports

msvcrt

??1type_info@@UEAA@XZ

?terminate@@YAXXZ

__C_specific_handler

_initterm

_amsg_exit

_XcptFilter

_CxxThrowException

_callnewh

?what@exception@@UEBAPEBDXZ

??1exception@@UEAA@XZ

??0exception@@QEAA@AEBV0@@Z

??0exception@@QEAA@AEBQEBDH@Z

malloc

memmove_s

free

_purecall

calloc

__CxxFrameHandler3

__RTDynamicCast

kernel32

RtlCaptureContext

GetLastError

Sleep

TerminateProcess

GetCurrentProcess

SetUnhandledExceptionFilter

UnhandledExceptionFilter

RtlVirtualUnwind

RtlLookupFunctionEntry

SetLastError

GetTickCount

GetSystemTimeAsFileTime

GetCurrentThreadId

GetCurrentProcessId

QueryPerformanceCounter

unbcl

??0InvalidOperationException@UnBCL@@QEAA@PEBG@Z

??0InvalidOperationException@UnBCL@@QEAA@PEBVString@1@PEAVException@1@@Z

?get_P@?$SmartPtr@VString@UnBCL@@@UnBCL@@QEBAPEAVString@2@XZ

??C?$SmartPtr@VString@UnBCL@@@UnBCL@@QEBAPEAVString@1@XZ

??4?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAAAEAV01@AEBV01@@Z

?Steal@?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAAPEAVString@2@XZ

??1?$SmartPtr@VString@UnBCL@@@UnBCL@@UEAA@XZ

??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAA@XZ

??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAA@PEAVString@1@@Z

??0ArgumentException@UnBCL@@QEAA@PEBG@Z

??0NotSupportedException@UnBCL@@QEAA@PEBG@Z

??0ArgumentNullException@UnBCL@@QEAA@PEBG@Z

?SetNamedItem@XmlAttributeCollection@UnBCL@@QEAAPEAVXmlNode@2@PEAV32@@Z

?get_Item@XmlAttributeCollection@UnBCL@@QEAAPEAVXmlAttribute@2@PEAVString@2@@Z

?SetMessage@Exception@UnBCL@@MEAAXPEAVString@2@@Z

?set_HResult@Exception@UnBCL@@MEAAXJ@Z

?get_HResult@Exception@UnBCL@@UEBAJXZ

?GetBaseException@Exception@UnBCL@@UEBAPEBV12@XZ

?AddStackTrace@Exception@UnBCL@@QEAAXPEBD@Z

?set_Source@Exception@UnBCL@@UEAAXPEBVString@2@@Z

?get_Source@Exception@UnBCL@@UEBAPEBVString@2@XZ

?get_Message@Exception@UnBCL@@UEBAPEBVString@2@XZ

?get_InnerException@Exception@UnBCL@@UEBAPEBV12@XZ

?ToString@Exception@UnBCL@@UEBAPEAVString@2@XZ

?MemAllocFailed@Allocator@UnBCL@@SAHXZ

?ExpandEnvironmentVariables@Environment@UnBCL@@SAPEAVString@2@PEBV32@@Z

?AppendChild@XmlNode@UnBCL@@QEAAPEAV12@PEAV12@@Z

?SelectSingleNode@XmlNode@UnBCL@@QEAAPEAV12@PEAVString@2@@Z

?SelectNodes@XmlNode@UnBCL@@QEAAPEAVXmlNodeList@2@PEAVString@2@@Z

?get_OwnerDocument@XmlNode@UnBCL@@QEAAPEAVXmlDocument@2@XZ

?get_OuterXml@XmlNode@UnBCL@@QEAAPEAVString@2@XZ

?get_ChildNodes@XmlNode@UnBCL@@QEAAPEAVXmlNodeList@2@XZ

?set_InnerText@XmlNode@UnBCL@@QEAAXPEAVString@2@@Z

?get_InnerText@XmlNode@UnBCL@@QEAAPEAVString@2@XZ

?get_Value@XmlNode@UnBCL@@QEAAPEAVString@2@XZ

?get_Name@XmlNode@UnBCL@@QEAAPEAVString@2@XZ

?get_NodeType@XmlNode@UnBCL@@QEAA?AW4XmlNodeType@2@XZ

?get_Attributes@XmlNode@UnBCL@@QEAAPEAVXmlAttributeCollection@2@XZ

?set_ValidateOnParse@XmlDocument@UnBCL@@QEAAXH@Z

?CreateNode@XmlDocument@UnBCL@@QEAAPEAVXmlNode@2@W4XmlNodeType@2@PEAVString@2@1@Z

?LoadXml@XmlDocument@UnBCL@@QEAAXPEAVString@2@@Z

??1XmlDocument@UnBCL@@UEAA@XZ

??0XmlDocument@UnBCL@@QEAA@XZ

?Format@String@UnBCL@@SAPEAV12@PEBGZZ

?Copy@String@UnBCL@@SAPEAV12@PEBV12@@Z

?Concat@String@UnBCL@@SAPEAV12@PEBG0@Z

?Concat@String@UnBCL@@SAPEAV12@PEBG00@Z

?Concat@String@UnBCL@@SAPEAV12@HZZ

?Compare@String@UnBCL@@SAHPEBG0H@Z

?Compare@String@UnBCL@@SAHPEBV12@0H@Z

?Trim@String@UnBCL@@QEBAPEAV12@XZ

?Replace@String@UnBCL@@QEBAPEAV12@PEBG0W4StringCasing@12@@Z

?IndexOfAny@String@UnBCL@@QEBAHPEBGH@Z

?IndexOf@String@UnBCL@@QEBAHPEBGH@Z

?StartsWith@String@UnBCL@@QEBAHPEBGH@Z

?get_CString@String@UnBCL@@QEBAPEBGXZ

?get_Length@String@UnBCL@@QEBAHXZ

?CompareTo@String@UnBCL@@UEBAHPEBVObject@2@@Z

?Clone@String@UnBCL@@UEBAPEAVObject@2@XZ

?ToString@String@UnBCL@@UEBAPEAV12@XZ

?GetHashCode@String@UnBCL@@UEBAHXZ

?Equals@String@UnBCL@@UEBAHPEBVObject@2@@Z

??1String@UnBCL@@UEAA@XZ

??0String@UnBCL@@QEAA@PEBV01@@Z

??0String@UnBCL@@QEAA@PEBG@Z

?get_Item@XmlNodeList@UnBCL@@QEAAPEAVXmlNode@2@H@Z

?get_Count@XmlNodeList@UnBCL@@QEAAHXZ

?SetLiteralStorage@_@UnBCL@@YAXPEAPEBVString@2@PEBG@Z

?DecRef@Object@UnBCL@@QEAAHXZ

?AddRef@Object@UnBCL@@QEAAXXZ

??3Object@UnBCL@@SAXPEAX@Z

??2Object@UnBCL@@SAPEAX_K@Z

?Clone@Object@UnBCL@@UEBAPEAV12@XZ

?CompareTo@Object@UnBCL@@UEBAHPEBV12@@Z

?GetObjectID@Object@UnBCL@@UEBAIXZ

?ToString@Object@UnBCL@@UEBAPEAVString@2@XZ

?GetType@Object@UnBCL@@UEBAPEAVType@2@XZ

?GetHashCode@Object@UnBCL@@UEBAHXZ

?Equals@Object@UnBCL@@UEBAHPEBV12@@Z

??1Object@UnBCL@@UEAA@XZ

??0Object@UnBCL@@QEAA@XZ

??0Object@UnBCL@@QEAA@AEBV01@@Z

??1NotSupportedException@UnBCL@@UEAA@XZ

??1InvalidOperationException@UnBCL@@UEAA@XZ

??1ArgumentOutOfRangeException@UnBCL@@UEAA@XZ

??4Object@UnBCL@@QEAAAEAV01@AEBV01@@Z

??1ArgumentException@UnBCL@@UEAA@XZ

??1ArgumentNullException@UnBCL@@UEAA@XZ

??4MutableString@UnBCL@@QEAAAEAV01@PEBG@Z

??0InvalidOperationException@UnBCL@@QEAA@PEBVString@1@@Z

?GetEnvironmentVar@Environment@UnBCL@@SAPEAVString@2@PEBV32@@Z

?SetEnvironmentVar@Environment@UnBCL@@SAXPEBVString@2@0@Z

??0ArgumentOutOfRangeException@UnBCL@@QEAA@PEBG@Z

?CloneNode@XmlNode@UnBCL@@QEAAPEAV12@H@Z

wdscore

WdsSetupLogMessageW

CurrentIP

ConstructPartialMsgVW

Exports

??0CAppendNewAttributeRule@Mig@@QEAA@AEBV01@@Z

??0CAppendNewAttributeRule@Mig@@QEAA@PEAVString@UnBCL@@00PEAUITranslationRule@1@@Z

??0CAppendNewChildRule@Mig@@QEAA@AEBV01@@Z

??0CAppendNewChildRule@Mig@@QEAA@PEAVString@UnBCL@@W4XmlNodeType@3@PEAUITranslationRule@1@H@Z

??0CComponentPathRule@Mig@@QEAA@$$QEAV01@@Z

??0CComponentPathRule@Mig@@QEAA@AEBV01@@Z

??0CComponentPathRule@Mig@@QEAA@XZ

??0CCopyAttributesRule@Mig@@QEAA@$$QEAV01@@Z

??0CCopyAttributesRule@Mig@@QEAA@AEBV01@@Z

??0CCopyAttributesRule@Mig@@QEAA@XZ

??0CCopyChildrenRule@Mig@@QEAA@$$QEAV01@@Z

??0CCopyChildrenRule@Mig@@QEAA@AEBV01@@Z

??0CCopyChildrenRule@Mig@@QEAA@XZ

??0CEnvExpandRule@Mig@@QEAA@AEBV01@@Z

??0CEnvExpandRule@Mig@@QEAA@PEAVString@UnBCL@@@Z

??0CIdStringAsInnerTextRule@Mig@@QEAA@$$QEAV01@@Z

??0CIdStringAsInnerTextRule@Mig@@QEAA@AEBV01@@Z

??0CIdStringAsInnerTextRule@Mig@@QEAA@XZ

??0CLinkedRule@Mig@@QEAA@AEBV01@@Z

??0CLinkedRule@Mig@@QEAA@PEAUITranslationRule@1@@Z

??0CNodeInnerTextCopyRule@Mig@@QEAA@$$QEAV01@@Z

??0CNodeInnerTextCopyRule@Mig@@QEAA@AEBV01@@Z

??0CNodeInnerTextCopyRule@Mig@@QEAA@XZ

??0CSelectRule@Mig@@QEAA@AEBV01@@Z

??0CSelectRule@Mig@@QEAA@XZ

??0CStatePatternRule@Mig@@QEAA@$$QEAV01@@Z

??0CStatePatternRule@Mig@@QEAA@AEBV01@@Z

??0CStatePatternRule@Mig@@QEAA@XZ

??0CSupportedIdRule@Mig@@QEAA@$$QEAV01@@Z

??0CSupportedIdRule@Mig@@QEAA@AEBV01@@Z

??0CSupportedIdRule@Mig@@QEAA@XZ

??0CTranslationMigAttrib@Mig@@QEAA@AEBV01@@Z

??0CTranslationMigAttrib@Mig@@QEAA@PEAVString@UnBCL@@PEAVXmlNode@3@@Z

??0CTranslationPattern@Mig@@QEAA@AEBV01@@Z

??0CTranslationPattern@Mig@@QEAA@PEAVString@UnBCL@@0@Z

??0CTranslationRuleCollection@Mig@@QEAA@AEBV01@@Z

??0CTranslationRuleCollection@Mig@@QEAA@XZ

??0CUrlIdRule@Mig@@QEAA@$$QEAV01@@Z

??0CUrlIdRule@Mig@@QEAA@AEBV01@@Z

??0CUrlIdRule@Mig@@QEAA@XZ

??0CXPathRule@Mig@@QEAA@AEBV01@@Z

??0CXPathRule@Mig@@QEAA@PEAVString@UnBCL@@IIPEAUITranslationRule@1@@Z

??0ITranslationRule@Mig@@QEAA@$$QEAU01@@Z

??0ITranslationRule@Mig@@QEAA@AEBU01@@Z

??0ITranslationRule@Mig@@QEAA@XZ

??1CAppendNewAttributeRule@Mig@@UEAA@XZ

??1CAppendNewChildRule@Mig@@UEAA@XZ

??1CComponentPathRule@Mig@@UEAA@XZ

??1CCopyAttributesRule@Mig@@UEAA@XZ

??1CCopyChildrenRule@Mig@@UEAA@XZ

??1CEnvExpandRule@Mig@@UEAA@XZ

??1CIdStringAsInnerTextRule@Mig@@UEAA@XZ

??1CLinkedRule@Mig@@UEAA@XZ

??1CNodeInnerTextCopyRule@Mig@@UEAA@XZ

??1CSelectRule@Mig@@UEAA@XZ

??1CStatePatternRule@Mig@@UEAA@XZ

??1CSupportedIdRule@Mig@@UEAA@XZ

??1CTranslationMigAttrib@Mig@@UEAA@XZ

??1CTranslationPattern@Mig@@UEAA@XZ

??1CTranslationRuleCollection@Mig@@UEAA@XZ

??1CUrlIdRule@Mig@@UEAA@XZ

??1CXPathRule@Mig@@UEAA@XZ

??1ITranslationRule@Mig@@UEAA@XZ

??4CAppendNewAttributeRule@Mig@@QEAAAEAV01@AEBV01@@Z

??4CAppendNewChildRule@Mig@@QEAAAEAV01@AEBV01@@Z

??4CComponentPathRule@Mig@@QEAAAEAV01@$$QEAV01@@Z

??4CComponentPathRule@Mig@@QEAAAEAV01@AEBV01@@Z

??4CCopyAttributesRule@Mig@@QEAAAEAV01@$$QEAV01@@Z

??4CCopyAttributesRule@Mig@@QEAAAEAV01@AEBV01@@Z

??4CCopyChildrenRule@Mig@@QEAAAEAV01@$$QEAV01@@Z

??4CCopyChildrenRule@Mig@@QEAAAEAV01@AEBV01@@Z

??4CEnvExpandRule@Mig@@QEAAAEAV01@AEBV01@@Z

??4CIdStringAsInnerTextRule@Mig@@QEAAAEAV01@$$QEAV01@@Z

??4CIdStringAsInnerTextRule@Mig@@QEAAAEAV01@AEBV01@@Z

??4CLinkedRule@Mig@@QEAAAEAV01@AEBV01@@Z

??4CNodeInnerTextCopyRule@Mig@@QEAAAEAV01@$$QEAV01@@Z

??4CNodeInnerTextCopyRule@Mig@@QEAAAEAV01@AEBV01@@Z

??4CSelectRule@Mig@@QEAAAEAV01@AEBV01@@Z

??4CStatePatternRule@Mig@@QEAAAEAV01@$$QEAV01@@Z

??4CStatePatternRule@Mig@@QEAAAEAV01@AEBV01@@Z

??4CSupportedIdRule@Mig@@QEAAAEAV01@$$QEAV01@@Z

??4CSupportedIdRule@Mig@@QEAAAEAV01@AEBV01@@Z

??4CTranslationMigAttrib@Mig@@QEAAAEAV01@AEBV01@@Z

??4CTranslationPattern@Mig@@QEAAAEAV01@AEBV01@@Z

??4CTranslationRuleCollection@Mig@@QEAAAEAV01@AEBV01@@Z

??4CTranslationRuleFactory@Mig@@QEAAAEAV01@$$QEAV01@@Z

??4CTranslationRuleFactory@Mig@@QEAAAEAV01@AEBV01@@Z

??4CUrlIdRule@Mig@@QEAAAEAV01@$$QEAV01@@Z

??4CUrlIdRule@Mig@@QEAAAEAV01@AEBV01@@Z

??4CXPathRule@Mig@@QEAAAEAV01@AEBV01@@Z

??4ITranslationRule@Mig@@QEAAAEAU01@$$QEAU01@@Z

??4ITranslationRule@Mig@@QEAAAEAU01@AEBU01@@Z

??_7CAppendNewAttributeRule@Mig@@6BITranslationRule@1@@

??_7CAppendNewAttributeRule@Mig@@6BObject@UnBCL@@@

??_7CAppendNewChildRule@Mig@@6BITranslationRule@1@@

??_7CAppendNewChildRule@Mig@@6BObject@UnBCL@@@

??_7CComponentPathRule@Mig@@6B@

??_7CComponentPathRule@Mig@@6BITranslationRule@1@@

??_7CComponentPathRule@Mig@@6BObject@UnBCL@@@

??_7CCopyAttributesRule@Mig@@6BITranslationRule@1@@

??_7CCopyAttributesRule@Mig@@6BObject@UnBCL@@@

??_7CCopyChildrenRule@Mig@@6BITranslationRule@1@@

??_7CCopyChildrenRule@Mig@@6BObject@UnBCL@@@

??_7CEnvExpandRule@Mig@@6BITranslationRule@1@@

??_7CEnvExpandRule@Mig@@6BObject@UnBCL@@@

??_7CIdStringAsInnerTextRule@Mig@@6B@

??_7CIdStringAsInnerTextRule@Mig@@6BITranslationRule@1@@

??_7CIdStringAsInnerTextRule@Mig@@6BObject@UnBCL@@@

??_7CLinkedRule@Mig@@6BITranslationRule@1@@

??_7CLinkedRule@Mig@@6BObject@UnBCL@@@

??_7CNodeInnerTextCopyRule@Mig@@6BITranslationRule@1@@

??_7CNodeInnerTextCopyRule@Mig@@6BObject@UnBCL@@@

??_7CSelectRule@Mig@@6BITranslationRule@1@@

??_7CSelectRule@Mig@@6BObject@UnBCL@@@

??_7CStatePatternRule@Mig@@6BITranslationRule@1@@

??_7CStatePatternRule@Mig@@6BObject@UnBCL@@@

??_7CSupportedIdRule@Mig@@6B@

??_7CSupportedIdRule@Mig@@6BITranslationRule@1@@

??_7CSupportedIdRule@Mig@@6BObject@UnBCL@@@

??_7CTranslationMigAttrib@Mig@@6B@

??_7CTranslationPattern@Mig@@6B@

??_7CTranslationRuleCollection@Mig@@6BITranslationRule@1@@

??_7CTranslationRuleCollection@Mig@@6BObject@UnBCL@@@

??_7CUrlIdRule@Mig@@6B@

??_7CUrlIdRule@Mig@@6BITranslationRule@1@@

??_7CUrlIdRule@Mig@@6BObject@UnBCL@@@

??_7CXPathRule@Mig@@6BITranslationRule@1@@

??_7CXPathRule@Mig@@6BObject@UnBCL@@@

??_8CAppendNewAttributeRule@Mig@@7B@

??_8CAppendNewAttributeRule@Mig@@7BCLinkedRule@1@@

??_8CAppendNewAttributeRule@Mig@@7BITranslationRule@1@@

??_8CAppendNewChildRule@Mig@@7B@

??_8CAppendNewChildRule@Mig@@7BCLinkedRule@1@@

??_8CAppendNewChildRule@Mig@@7BITranslationRule@1@@

??_8CComponentPathRule@Mig@@7B@

??_8CComponentPathRule@Mig@@7BCIdStringAsInnerTextRule@1@@

??_8CComponentPathRule@Mig@@7BITranslationRule@1@@

??_8CCopyAttributesRule@Mig@@7B01@@

??_8CCopyAttributesRule@Mig@@7BITranslationRule@1@@

??_8CCopyChildrenRule@Mig@@7B01@@

??_8CCopyChildrenRule@Mig@@7BITranslationRule@1@@

??_8CEnvExpandRule@Mig@@7B01@@

??_8CEnvExpandRule@Mig@@7BITranslationRule@1@@

??_8CNodeInnerTextCopyRule@Mig@@7B01@@

??_8CNodeInnerTextCopyRule@Mig@@7BITranslationRule@1@@

??_8CSelectRule@Mig@@7B01@@

??_8CSelectRule@Mig@@7BITranslationRule@1@@

??_8CStatePatternRule@Mig@@7B01@@

??_8CStatePatternRule@Mig@@7BITranslationRule@1@@

??_8CSupportedIdRule@Mig@@7B01@@

??_8CSupportedIdRule@Mig@@7BCIdStringAsInnerTextRule@1@@

??_8CSupportedIdRule@Mig@@7BCUrlIdRule@1@@

??_8CSupportedIdRule@Mig@@7BITranslationRule@1@@

??_8CTranslationMigAttrib@Mig@@7B@

??_8CTranslationPattern@Mig@@7B@

??_8CTranslationRuleCollection@Mig@@7B01@@

??_8CTranslationRuleCollection@Mig@@7BITranslationRule@1@@

??_8CUrlIdRule@Mig@@7B@

??_8CUrlIdRule@Mig@@7BCIdStringAsInnerTextRule@1@@

??_8CUrlIdRule@Mig@@7BITranslationRule@1@@

??_8CXPathRule@Mig@@7B@

??_8CXPathRule@Mig@@7BCLinkedRule@1@@

??_8CXPathRule@Mig@@7BITranslationRule@1@@

??_DCAppendNewAttributeRule@Mig@@QEAAXXZ

??_DCAppendNewChildRule@Mig@@QEAAXXZ

??_DCComponentPathRule@Mig@@QEAAXXZ

??_DCCopyAttributesRule@Mig@@QEAAXXZ

??_DCCopyChildrenRule@Mig@@QEAAXXZ

??_DCEnvExpandRule@Mig@@QEAAXXZ

??_DCNodeInnerTextCopyRule@Mig@@QEAAXXZ

??_DCSelectRule@Mig@@QEAAXXZ

??_DCStatePatternRule@Mig@@QEAAXXZ

??_DCSupportedIdRule@Mig@@QEAAXXZ

??_DCTranslationMigAttrib@Mig@@QEAAXXZ

??_DCTranslationPattern@Mig@@QEAAXXZ

??_DCTranslationRuleCollection@Mig@@QEAAXXZ

??_DCUrlIdRule@Mig@@QEAAXXZ

??_DCXPathRule@Mig@@QEAAXXZ

?AddAssemblyIdentityRule@CSelectRule@Mig@@QEAAXPEAUITranslationRule@2@@Z

?AddRule@CTranslationRuleCollection@Mig@@QEAAXPEAUITranslationRule@2@@Z

?AddSupportedComponentIdentityRule@CSelectRule@Mig@@QEAAXPEAUITranslationRule@2@@Z

?CreateRuleNode@CStatePatternRule@Mig@@IEAAPEAVXmlNode@UnBCL@@PEAV34@PEAVString@4@0@Z

?CreateTranslationRule@CTranslationRuleFactory@Mig@@SAPEAUITranslationRule@2@PEAVString@UnBCL@@HH@Z

?GetIdString@CIdStringAsInnerTextRule@Mig@@IEAAPEAVString@UnBCL@@PEAVXmlNode@4@@Z

?GetPatterns@CStatePatternRule@Mig@@IEAAPEAV?$ArrayList@PEAVCTranslationPattern@Mig@@@UnBCL@@PEAVXmlNode@4@H@Z

?GetType@CStatePatternRule@Mig@@IEAAPEAVString@UnBCL@@XZ

?TransformIdString@CComponentPathRule@Mig@@UEAAPEAVString@UnBCL@@PEAVXmlNode@4@PEAV34@@Z

?TransformIdString@CSupportedIdRule@Mig@@UEAAPEAVString@UnBCL@@PEAVXmlNode@4@PEAV34@@Z

?TransformIdString@CUrlIdRule@Mig@@MEAAPEAVString@UnBCL@@PEAVXmlNode@4@PEAV34@@Z

?Translate@CAppendNewAttributeRule@Mig@@UEAAHPEAVXmlNode@UnBCL@@0@Z

?Translate@CAppendNewChildRule@Mig@@UEAAHPEAVXmlNode@UnBCL@@0@Z

?Translate@CCopyAttributesRule@Mig@@UEAAHPEAVXmlNode@UnBCL@@0@Z

?Translate@CCopyChildrenRule@Mig@@UEAAHPEAVXmlNode@UnBCL@@0@Z

?Translate@CEnvExpandRule@Mig@@UEAAHPEAVXmlNode@UnBCL@@0@Z

?Translate@CIdStringAsInnerTextRule@Mig@@UEAAHPEAVXmlNode@UnBCL@@0@Z

?Translate@CNodeInnerTextCopyRule@Mig@@UEAAHPEAVXmlNode@UnBCL@@0@Z

?Translate@CSelectRule@Mig@@UEAAHPEAVXmlNode@UnBCL@@0@Z

?Translate@CStatePatternRule@Mig@@UEAAHPEAVXmlNode@UnBCL@@0@Z

?Translate@CTranslationRuleCollection@Mig@@UEAAHPEAVXmlNode@UnBCL@@0@Z

?Translate@CXPathRule@Mig@@UEAAHPEAVXmlNode@UnBCL@@0@Z

?TranslateToMigRule@CStatePatternRule@Mig@@IEAAPEAVXmlNode@UnBCL@@PEAVXmlDocument@4@PEAVString@4@PEAVCTranslationMigAttrib@2@@Z

?get_Attribute@CTranslationMigAttrib@Mig@@QEAAPEAVXmlNode@UnBCL@@XZ

?get_Context@CTranslationPattern@Mig@@QEAAPEAVString@UnBCL@@XZ

?get_PatternString@CTranslationPattern@Mig@@QEAAPEAVString@UnBCL@@XZ

?get_RuleName@CTranslationMigAttrib@Mig@@QEAAPEAVString@UnBCL@@XZ

Translate

Sections

.text
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 78KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

migwiz/csiagent.dll

.dll windows:10 windows x64 arch:x64

564b754bf7fd59236c6191d34b8d1d5e

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

7b:09:2e:23:08:df:c6:b1:14:c8:98:df:00:3a:05:b2:f4:dd:cf:4b:7e:c0:4a:75:43:16:8c:13:35:f9:cf:79
Signer

Actual PE Digest

7b:09:2e:23:08:df:c6:b1:14:c8:98:df:00:3a:05:b2:f4:dd:cf:4b:7e:c0:4a:75:43:16:8c:13:35:f9:cf:79

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

IMAGE_FILE_NET_RUN_FROM_SWAP

IMAGE_FILE_DLL

PDB Paths

csiagent.pdb

Imports

msvcrt

_wcsicmp

_wcsnicmp

wcsncmp

bsearch

towlower

iswdigit

__RTDynamicCast

memcpy

??1type_info@@UEAA@XZ

_onexit

__dllonexit

_unlock

_lock

_vsnwprintf

__C_specific_handler

_initterm

_amsg_exit

_XcptFilter

_CxxThrowException

_callnewh

?what@exception@@UEBAPEBDXZ

??1exception@@UEAA@XZ

??0exception@@QEAA@AEBV0@@Z

??0exception@@QEAA@AEBQEBDH@Z

malloc

memmove_s

free

?name@type_info@@QEBAPEBDXZ

__CxxFrameHandler3

_purecall

swscanf_s

calloc

?terminate@@YAXXZ

memset

kernel32

SearchPathW

SetLastError

GetSystemDefaultUILanguage

GetUserDefaultUILanguage

GetLocaleInfoW

GetVersionExW

UnmapViewOfFile

FindResourceExW

LoadResource

CreateFileMappingW

MapViewOfFile

LoadLibraryExW

GetModuleFileNameW

GetModuleHandleExW

ReadFile

FindFirstFileW

GetFileSizeEx

FindNextFileW

FindClose

CreateFileW

GetLastError

GlobalAlloc

GlobalFree

CloseHandle

LoadLibraryW

GetProcAddress

GlobalLock

FreeLibrary

GlobalUnlock

Sleep

QueryPerformanceCounter

GetCurrentProcessId

GetCurrentThreadId

GetSystemTimeAsFileTime

GetTickCount

RtlCaptureContext

RtlLookupFunctionEntry

RtlVirtualUnwind

UnhandledExceptionFilter

SetUnhandledExceptionFilter

GetCurrentProcess

TerminateProcess

SizeofResource

LockResource

WaitForSingleObject

EnumResourceLanguagesExW

unbcl

??0?$IEnumerator@PEAVString@UnBCL@@@UnBCL@@QEAA@XZ

??1?$IEnumerator@PEAVString@UnBCL@@@UnBCL@@UEAA@XZ

??0IInstanceFactory@UnBCL@@QEAA@XZ

?get_Platform@OperatingSystem@UnBCL@@QEBA?AW4PlatformID@2@XZ

?get_OSVersion@OperatingSystem@UnBCL@@QEBAPEBVVersion@2@XZ

??0Object@UnBCL@@QEAA@AEBV01@@Z

??0Object@UnBCL@@QEAA@XZ

??1Object@UnBCL@@UEAA@XZ

?Equals@Object@UnBCL@@UEBAHPEBV12@@Z

?GetHashCode@Object@UnBCL@@UEBAHXZ

?GetType@Object@UnBCL@@UEBAPEAVType@2@XZ

?ToString@Object@UnBCL@@UEBAPEAVString@2@XZ

?GetObjectID@Object@UnBCL@@UEBAIXZ

?CompareTo@Object@UnBCL@@UEBAHPEBV12@@Z

?Clone@Object@UnBCL@@UEBAPEAV12@XZ

??2Object@UnBCL@@SAPEAX_KI@Z

??2Object@UnBCL@@SAPEAX_K@Z

??3Object@UnBCL@@SAXPEAX@Z

?AddRef@Object@UnBCL@@QEAAXXZ

?DecRef@Object@UnBCL@@QEAAHXZ

?SetLiteralStorage@_@UnBCL@@YAXPEAPEBVString@2@PEBG@Z

?get_Count@XmlNodeList@UnBCL@@QEAAHXZ

?get_Item@XmlNodeList@UnBCL@@QEAAPEAVXmlNode@2@H@Z

??0String@UnBCL@@QEAA@AEBV01@@Z

??0String@UnBCL@@QEAA@PEBG@Z

??0String@UnBCL@@QEAA@PEBV01@@Z

??1String@UnBCL@@UEAA@XZ

?Equals@String@UnBCL@@UEBAHPEBVObject@2@@Z

?GetHashCode@String@UnBCL@@UEBAHXZ

?ToString@String@UnBCL@@UEBAPEAV12@XZ

?Clone@String@UnBCL@@UEBAPEAVObject@2@XZ

?CompareTo@String@UnBCL@@UEBAHPEBVObject@2@@Z

?get_Length@String@UnBCL@@QEBAHXZ

?get_CString@String@UnBCL@@QEBAPEBGXZ

?IndexOf@String@UnBCL@@QEBAHG@Z

?LastIndexOf@String@UnBCL@@QEBAHPEBG@Z

??0?$ICollection@PEAVString@UnBCL@@@UnBCL@@QEAA@XZ

?Remove@String@UnBCL@@QEBAPEAV12@HH@Z

?Split@String@UnBCL@@QEBAPEAV?$ArrayList@PEAVString@UnBCL@@@2@PEBG@Z

?Substring@String@UnBCL@@QEBAPEAV12@HH@Z

?ToLower@String@UnBCL@@QEBAPEAV12@XZ

?Trim@String@UnBCL@@QEBAPEAV12@XZ

?Compare@String@UnBCL@@SAHPEBV12@0H@Z

?Compare@String@UnBCL@@SAHPEBG0H@Z

?Concat@String@UnBCL@@SAPEAV12@HZZ

?Concat@String@UnBCL@@SAPEAV12@PEBG00@Z

?Copy@String@UnBCL@@SAPEAV12@PEBV12@@Z

?Format@String@UnBCL@@SAPEAV12@PEBGZZ

?FormatV@String@UnBCL@@SAPEAV12@PEBGPEAD@Z

?FromASCII@String@UnBCL@@SAPEAV12@PEBD@Z

??6SerializationStream@UnBCL@@QEAAAEAV01@PEBUISerializable@1@@Z

??6SerializationStream@UnBCL@@QEAAAEAV01@PEBVString@1@@Z

??6SerializationStream@UnBCL@@QEAAAEAV01@H@Z

??5SerializationStream@UnBCL@@QEAAAEAV01@AEAPEAUISerializable@1@@Z

??5SerializationStream@UnBCL@@QEAAAEAV01@AEAPEAVString@1@@Z

??5SerializationStream@UnBCL@@QEAAAEAV01@AEAH@Z

?RegisterType@SerializationStream@UnBCL@@SAXPEBVString@2@HPEAUHINSTANCE__@@PEAUIInstanceFactory@2@@Z

?UnregisterType@SerializationStream@UnBCL@@SAXPEBVString@2@HPEAUHINSTANCE__@@@Z

?CanRegister@SerializationStream@UnBCL@@SAHXZ

?GetCallingModule@SerializationStream@UnBCL@@SAPEAUHINSTANCE__@@XZ

?SanitizeTypeName@SerializationStream@UnBCL@@SAPEAVString@2@AEBV32@@Z

?GetParentPath@Path@UnBCL@@SAPEAVString@2@PEBV32@@Z

?GetFullPath@Path@UnBCL@@SAPEAVString@2@PEBV32@@Z

?Combine@Path@UnBCL@@SAPEAVString@2@PEBV32@0@Z

?WithLongPrefix@Path@UnBCL@@SAPEAVString@2@PEBV32@H@Z

??0?$SmartPtr@V?$ArrayList@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@QEAA@PEAV?$ArrayList@PEAVString@UnBCL@@@1@@Z

??1?$SmartPtr@V?$ArrayList@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@UEAA@XZ

??4?$SmartPtr@V?$ArrayList@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@QEAAAEAV01@AEBV01@@Z

??C?$SmartPtr@V?$ArrayList@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@QEBAPEAV?$ArrayList@PEAVString@UnBCL@@@1@XZ

??0XmlDocument@UnBCL@@QEAA@XZ

??1XmlDocument@UnBCL@@UEAA@XZ

?Load@XmlDocument@UnBCL@@QEAAXPEAUIStream@@@Z

?Load@XmlDocument@UnBCL@@QEAAXPEAVString@2@@Z

??0?$IEnumerable@PEAVString@UnBCL@@@UnBCL@@QEAA@XZ

??1InvalidCastException@UnBCL@@UEAA@XZ

?LastIndexOf@String@UnBCL@@QEBAHG@Z

??1NotSupportedException@UnBCL@@UEAA@XZ

??4Object@UnBCL@@QEAAAEAV01@AEBV01@@Z

??_D?$Hashtable@PEAVString@UnBCL@@PEAV12@@UnBCL@@QEAAXXZ

??1ArgumentOutOfRangeException@UnBCL@@UEAA@XZ

??1?$ICollection@PEAVString@UnBCL@@@UnBCL@@UEAA@XZ

??1InvalidOperationException@UnBCL@@UEAA@XZ

??1ISerializable@UnBCL@@UEAA@XZ

??0ISerializable@UnBCL@@QEAA@XZ

??1ArgumentException@UnBCL@@UEAA@XZ

??1ArgumentNullException@UnBCL@@UEAA@XZ

??_DVersion@UnBCL@@QEAAXXZ

?LoadXml@XmlDocument@UnBCL@@QEAAXPEAVString@2@@Z

?get_NodeType@XmlNode@UnBCL@@QEAA?AW4XmlNodeType@2@XZ

?get_Value@XmlNode@UnBCL@@QEAAPEAVString@2@XZ

?get_InnerText@XmlNode@UnBCL@@QEAAPEAVString@2@XZ

?get_FirstChild@XmlNode@UnBCL@@QEAAPEAV12@XZ

?get_OuterXml@XmlNode@UnBCL@@QEAAPEAVString@2@XZ

?SelectNodes@XmlNode@UnBCL@@QEAAPEAVXmlNodeList@2@PEAVString@2@@Z

?SelectSingleNode@XmlNode@UnBCL@@QEAAPEAV12@PEAVString@2@@Z

?Exists@Directory@UnBCL@@SAHPEBVString@2@@Z

?GetFiles@Directory@UnBCL@@SAPEAV?$Array@PEAVString@UnBCL@@@2@PEBVString@2@0H@Z

?GetLoadedModuleDir@Directory@UnBCL@@SAPEAVString@2@PEBV32@@Z

??0InvalidCastException@UnBCL@@QEAA@XZ

?MemAllocFailed@Allocator@UnBCL@@SAHXZ

??0Version@UnBCL@@QEAA@HH@Z

??0?$Hashtable@PEAVString@UnBCL@@PEAV12@@UnBCL@@QEAA@HH@Z

?Clone@?$Hashtable@PEAVString@UnBCL@@PEAV12@@UnBCL@@UEBAPEAVObject@2@XZ

??0Exception@UnBCL@@QEAA@XZ

??1Exception@UnBCL@@UEAA@XZ

?ToString@Exception@UnBCL@@UEBAPEAVString@2@XZ

?get_InnerException@Exception@UnBCL@@UEBAPEBV12@XZ

?get_Message@Exception@UnBCL@@UEBAPEBVString@2@XZ

?get_Source@Exception@UnBCL@@UEBAPEBVString@2@XZ

?set_Source@Exception@UnBCL@@UEAAXPEBVString@2@@Z

?AddStackTrace@Exception@UnBCL@@QEAAXPEBD@Z

?GetBaseException@Exception@UnBCL@@UEBAPEBV12@XZ

?get_HResult@Exception@UnBCL@@UEBAJXZ

?set_HResult@Exception@UnBCL@@MEAAXJ@Z

?SetMessage@Exception@UnBCL@@MEAAXPEAVString@2@@Z

??0ArgumentNullException@UnBCL@@QEAA@PEBG@Z

??0NotSupportedException@UnBCL@@QEAA@PEBG@Z

??0ArgumentException@UnBCL@@QEAA@PEBG@Z

??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAA@AEBV01@@Z

??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAA@PEAVString@1@@Z

??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAA@XZ

??1?$SmartPtr@VString@UnBCL@@@UnBCL@@UEAA@XZ

?Steal@?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAAPEAVString@2@XZ

??4?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAAAEAV01@AEBV01@@Z

??D?$SmartPtr@VString@UnBCL@@@UnBCL@@QEBAAEAVString@1@XZ

??C?$SmartPtr@VString@UnBCL@@@UnBCL@@QEBAPEAVString@1@XZ

?get_P@?$SmartPtr@VString@UnBCL@@@UnBCL@@QEBAPEAVString@2@XZ

??B?$SmartPtr@VString@UnBCL@@@UnBCL@@QEBAPEAVNullTest@01@XZ

??0InvalidOperationException@UnBCL@@QEAA@PEBVString@1@PEAVException@1@@Z

??0InvalidOperationException@UnBCL@@QEAA@PEBG@Z

??0InvalidOperationException@UnBCL@@QEAA@PEBVString@1@@Z

??0InvalidOperationException@UnBCL@@QEAA@XZ

?EnqueueSbRegistration@SbRegistrationList@UnBCL@@SAXPEBDHPEAUHINSTANCE__@@PEAUIInstanceFactory@2@@Z

?get_P@?$SmartPtr@V?$ArrayList@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@QEBAPEAV?$ArrayList@PEAVString@UnBCL@@@2@XZ

?ExpandEnvironmentVariables@Environment@UnBCL@@SAPEAVString@2@PEBV32@@Z

?GetEnvironmentVar@Environment@UnBCL@@SAPEAVString@2@PEBV32@@Z

?SetEnvironmentVar@Environment@UnBCL@@SAXPEBVString@2@0@Z

?IsEnvironmentVarSetTrue@Environment@UnBCL@@SAHPEBVString@2@H@Z

??0ArgumentOutOfRangeException@UnBCL@@QEAA@PEBG@Z

??1MutableString@UnBCL@@UEAA@XZ

?Exists@File@UnBCL@@SAHPEBVString@2@@Z

??0MutableString@UnBCL@@QEAA@XZ

migcore

?CompareTo@CMigUnit@Mig@@UEBAHPEBVObject@UnBCL@@@Z

?GetFullName@CMigUnit@Mig@@SAPEAVString@UnBCL@@PEAV12@PEAVCMigUnitList@2@H@Z

??0CMigUnitList@Mig@@QEAA@XZ

??0?$SmartPtr@VCRegistryLocation@Mig@@@UnBCL@@QEAA@PEAVCRegistryLocation@Mig@@@Z

??1?$SmartPtr@VCRegistryLocation@Mig@@@UnBCL@@UEAA@XZ

?get_P@?$SmartPtr@VCRegistryLocation@Mig@@@UnBCL@@QEBAPEAVCRegistryLocation@Mig@@XZ

??0?$SmartPtr@VCPointOfView@Mig@@@UnBCL@@QEAA@PEAVCPointOfView@Mig@@@Z

??1?$SmartPtr@VCPointOfView@Mig@@@UnBCL@@UEAA@XZ

??C?$SmartPtr@VCPointOfView@Mig@@@UnBCL@@QEBAPEAVCPointOfView@Mig@@XZ

?Clone@?$ArrayList@PEAVCMigUnit@Mig@@@UnBCL@@UEBAPEAVObject@2@XZ

?Equals@?$ArrayList@PEAVCMigUnit@Mig@@@UnBCL@@UEBAHPEBVObject@2@@Z

??0?$ArrayList@PEAVCMigUnit@Mig@@@UnBCL@@QEAA@PEBU?$ICollection@PEAVCMigUnit@Mig@@@1@@Z

?set_DestinationPOV@CMigUnit@Mig@@QEAAXPEAVCPointOfView@2@@Z

?set_ExcludePOV@CMigUnit@Mig@@QEAAXPEAVCPointOfView@2@@Z

?set_IncludePOV@CMigUnit@Mig@@QEAAXPEAVCPointOfView@2@@Z

?set_Scopes@CMigUnit@Mig@@QEAAXPEAVString@UnBCL@@@Z

?set_ParentID@CMigUnit@Mig@@QEAAXPEAVCMigUnitID@2@@Z

?set_AgentName@CMigUnit@Mig@@QEAAXPEAVString@UnBCL@@@Z

?Clone@CMigUnit@Mig@@UEBAPEAVObject@UnBCL@@XZ

??0CMigUnit@Mig@@QEAA@PEAVCMigUnitID@1@W4ConfidenceLevel@1@W4MigrationGroup@@PEAVString@UnBCL@@3033@Z

?GetEnumerator@CPointOfView@Mig@@QEAAPEAVCPointOfViewEnum@2@PEAVIDataStore@2@PEAVCPatternConfirmDelegate@2@PEAVCStorageType@2@PEAVCLocationTickDelegate@2@HPEAV?$ArrayList@PEAVCStorageType@Mig@@@UnBCL@@@Z

?AddPattern@CPointOfView@Mig@@QEAAXPEAUILocationPattern@2@PEAVObject@UnBCL@@@Z

??0CPointOfView@Mig@@QEAA@PEAV?$ArrayList@PEAVCStorageType@Mig@@@UnBCL@@@Z

?set_ExtraData@CMigUnit@Mig@@QEAAXPEAVObject@UnBCL@@@Z

?set_MergePOV@CMigUnit@Mig@@QEAAXPEAVCPointOfView@2@@Z

?set_ContentGeneralPOV@CMigUnit@Mig@@QEAAXPEAVCPointOfView@2@@Z

?set_ContentSpecificPOV@CMigUnit@Mig@@QEAAXPEAVCPointOfView@2@@Z

??C?$SmartPtr@V?$Hashtable@PEAVString@UnBCL@@PEAV12@@UnBCL@@@UnBCL@@QEBAPEAV?$Hashtable@PEAVString@UnBCL@@PEAV12@@1@XZ

?set_LocationGeneralPOV@CMigUnit@Mig@@QEAAXPEAVCPointOfView@2@@Z

?set_LocationSpecificPOV@CMigUnit@Mig@@QEAAXPEAVCPointOfView@2@@Z

?set_UnconditionalExcludePOV@CMigUnit@Mig@@QEAAXPEAVCPointOfView@2@@Z

?get_P@?$SmartPtr@V?$Hashtable@PEAVString@UnBCL@@PEAV12@@UnBCL@@@UnBCL@@QEBAPEAV?$Hashtable@PEAVString@UnBCL@@PEAV12@@2@XZ

??4?$SmartPtr@V?$Hashtable@PEAVString@UnBCL@@PEAV12@@UnBCL@@@UnBCL@@QEAAAEAV01@AEBV01@@Z

?set_AttribPOV@CMigUnit@Mig@@QEAAXPEAVCPointOfView@2@@Z

?Steal@?$SmartPtr@V?$Hashtable@PEAVString@UnBCL@@PEAV12@@UnBCL@@@UnBCL@@QEAAPEAV?$Hashtable@PEAVString@UnBCL@@PEAV12@@2@XZ

??1?$SmartPtr@V?$Hashtable@PEAVString@UnBCL@@PEAV12@@UnBCL@@@UnBCL@@UEAA@XZ

?set_SysObjPOV@CMigUnit@Mig@@QEAAXPEAVCPointOfView@2@@Z

?GetFileType@CStorageType@Mig@@SAPEAV12@XZ

?Init@CAgent@Mig@@UEAAXPEAVCPlatform@2@PEAVString@UnBCL@@@Z

?Done@CAgent@Mig@@UEAAXH@Z

?InitApply@CAgent@Mig@@UEAAXPEAVCPlatform@2@0PEAVString@UnBCL@@@Z

??0CAgent@Mig@@IEAA@PEAVString@UnBCL@@@Z

??1CAgent@Mig@@UEAA@XZ

?Clone@CRegistryPattern@Mig@@UEBAPEAVObject@UnBCL@@XZ

??_DCRegistryPattern@Mig@@QEAAXXZ

?Clone@CRegistryLocation@Mig@@UEBAPEAVObject@UnBCL@@XZ

??_DCRegistryLocation@Mig@@QEAAXXZ

?Clone@CMigUnitID@Mig@@UEBAPEAVObject@UnBCL@@XZ

??_DCMigUnitID@Mig@@QEAAXXZ

?get_ID@CMigUnit@Mig@@QEAAPEAVCMigUnitID@2@XZ

?set_ActionPairs@CMigUnit@Mig@@QEAAXPEAV?$ArrayList@PEAVCActionPair@Mig@@@UnBCL@@@Z

?set_SimulatedObjects@CMigUnit@Mig@@QEAAXPEAV?$ArrayList@PEAVCDataUnit@Mig@@@UnBCL@@@Z

??0CAgent@Mig@@QEAA@AEBV01@@Z

??4CAgent@Mig@@QEAAAEAV01@AEBV01@@Z

??_DCPointOfView@Mig@@QEAAXXZ

??_DCMigUnitList@Mig@@QEAAXXZ

??1?$ICollection@PEAVCMigUnit@Mig@@@UnBCL@@UEAA@XZ

??1?$IList@PEAVCMigUnit@Mig@@@UnBCL@@UEAA@XZ

??_DCMigUnit@Mig@@QEAAXXZ

??0?$IEnumerable@PEAVCMigUnit@Mig@@@UnBCL@@QEAA@XZ

??0?$ICollection@PEAVCMigUnit@Mig@@@UnBCL@@QEAA@XZ

??0?$IList@PEAVCMigUnit@Mig@@@UnBCL@@QEAA@XZ

??_D?$ArrayList@PEAVCMigUnit@Mig@@@UnBCL@@QEAAXXZ

??0CRegistryLocation@Mig@@QEAA@PEAVString@UnBCL@@0@Z

?ToString@CRegistryLocation@Mig@@UEBAPEAVString@UnBCL@@XZ

??0CMigUnitID@Mig@@QEAA@PEAVCUserContext@1@W4MigrationRole@@PEAVString@UnBCL@@2222@Z

?GetRegString@CRegUtil@Mig@@SAPEAVString@UnBCL@@PEAVIDataStore@2@PEAVCRegistryLocation@2@@Z

?MapOfflineToLivePath@CFileDataStore@Mig@@QEAAPEAVString@UnBCL@@PEAV34@@Z

?get_Location@CPointOfViewEnum@Mig@@QEBAPEAUIMigLocation@2@XZ

?MoveNext@CPointOfViewEnum@Mig@@QEAAHXZ

?AddMigrationXml@CMXEService@Mig@@SAPEAVString@UnBCL@@PEAVCPlatform@2@PEAV34@PEAVXmlDocument@4@11PEAH@Z

?GetMigrationUnits@CMXEService@Mig@@SAXPEAVString@UnBCL@@PEAVCPlatform@2@PEAVCUserContext@2@PEAV?$Hashtable@PEAVString@UnBCL@@PEAVCMigUnit@Mig@@@4@@Z

?SetWorkingDirectory@CMXEService@Mig@@SAXPEAVString@UnBCL@@0@Z

?AddDetectInfo@CMXEService@Mig@@SAXPEAVString@UnBCL@@PEAVCPlatform@2@PEAVCUserContext@2@PEAVCMigUnit@2@@Z

?AddGatherInfo@CMXEService@Mig@@SAXPEAVString@UnBCL@@PEAVCPlatform@2@PEAVCUserContext@2@PEAVCMigUnit@2@@Z

?AddApplyInfo@CMXEService@Mig@@SAXPEAVString@UnBCL@@0PEAVCPlatform@2@1PEAVCUserContext@2@PEAVCMigUnit@2@@Z

?AdjustRules@CMXEService@Mig@@SAXPEAVString@UnBCL@@PEAVCPlatform@2@1PEAVCUserContext@2@PEAVCMigUnit@2@@Z

??0CRegistryPattern@Mig@@QEAA@PEAVString@UnBCL@@@Z

?Equals@CRegistryPattern@Mig@@UEBAHPEBVObject@UnBCL@@@Z

?GetHashCode@CRegistryPattern@Mig@@UEBAHXZ

?CompareTo@CRegistryPattern@Mig@@UEBAHPEBVObject@UnBCL@@@Z

??0?$SmartPtr@V?$Hashtable@PEAVString@UnBCL@@PEAV12@@UnBCL@@@UnBCL@@QEAA@PEAV?$Hashtable@PEAVString@UnBCL@@PEAV12@@1@@Z

wdscore

ConstructPartialMsgVW

CurrentIP

WdsSetupLogMessageW

user32

LoadStringW

ole32

CreateStreamOnHGlobal

ntdll

RtlNtStatusToDosErrorNoTeb

DbgPrintEx

RtlReAllocateHeap

RtlFreeHeap

RtlAllocateHeap

RtlRaiseStatus

advapi32

RegCloseKey

RegQueryValueExW

RegOpenKeyExW

Exports

??0?$SmartPtr@V?$ArrayList@PEAV?$DictionaryEntry@PEAVString@UnBCL@@PEAV12@@UnBCL@@@UnBCL@@@UnBCL@@QEAA@AEBV01@@Z

??0?$SmartPtr@V?$ArrayList@PEAV?$DictionaryEntry@PEAVString@UnBCL@@PEAV12@@UnBCL@@@UnBCL@@@UnBCL@@QEAA@PEAV?$ArrayList@PEAV?$DictionaryEntry@PEAVString@UnBCL@@PEAV12@@UnBCL@@@1@@Z

??0?$SmartPtr@V?$ArrayList@PEAV?$DictionaryEntry@PEAVString@UnBCL@@PEAV12@@UnBCL@@@UnBCL@@@UnBCL@@QEAA@XZ

??0?$SmartPtr@VXmlDocument@UnBCL@@@UnBCL@@QEAA@AEBV01@@Z

??0?$SmartPtr@VXmlDocument@UnBCL@@@UnBCL@@QEAA@PEAVXmlDocument@1@@Z

??0?$SmartPtr@VXmlDocument@UnBCL@@@UnBCL@@QEAA@XZ

??0CCSIAgent@Mig@@QEAA@$$QEAV01@@Z

??0CCSIAgent@Mig@@QEAA@AEBV01@@Z

??0CCSIAgent@Mig@@QEAA@PEAVString@UnBCL@@@Z

??0CComponentBuilder@Mig@@QEAA@AEBV01@@Z

??0CComponentBuilder@Mig@@QEAA@PEAUIResourceLocator@1@PEAVString@UnBCL@@PEAUIManifestParser@1@11H@Z

??0CComponentState@Mig@@QEAA@AEBV01@@Z

??0CComponentState@Mig@@QEAA@PEAVString@UnBCL@@@Z

??0CDirManifestEnumerator@Mig@@QEAA@AEBV01@@Z

??0CDirManifestEnumerator@Mig@@QEAA@PEAVString@UnBCL@@@Z

??0CDllManifestParser@Mig@@QEAA@AEBV01@@Z

??0CDllManifestParser@Mig@@QEAA@PEAVString@UnBCL@@@Z

??0CInstalledManifestEnumerator@Mig@@QEAA@AEBV01@@Z

??0CInstalledManifestEnumerator@Mig@@QEAA@PEAVCPlatform@1@@Z

??0CListManifestEnumerator@Mig@@QEAA@AEBV01@@Z

??0CListManifestEnumerator@Mig@@QEAA@PEAVString@UnBCL@@@Z

??0CManifestSource@Mig@@QEAA@AEBV01@@Z

??0CManifestSource@Mig@@QEAA@PEAUIManifestEnumerator@1@@Z

??0CManifestSourceFactory@Mig@@QEAA@$$QEAV01@@Z

??0CManifestSourceFactory@Mig@@QEAA@AEBV01@@Z

??0CManifestSourceFactory@Mig@@QEAA@XZ

??0CMigUnitListGenerator@Mig@@QEAA@AEBV01@@Z

??0CMigUnitListGenerator@Mig@@QEAA@PEAV?$ArrayList@PEAVCComponentState@Mig@@@UnBCL@@PEAVCPlatform@1@PEAVString@3@@Z

??0CReplManData@Mig@@QEAA@$$QEAV01@@Z

??0CReplManData@Mig@@QEAA@AEBV01@@Z

??0CReplManData@Mig@@QEAA@PEAVString@UnBCL@@000000PEAVXmlDocument@3@0@Z

??0CReplManifestSourceFactory@Mig@@QEAA@$$QEAV01@@Z

??0CReplManifestSourceFactory@Mig@@QEAA@AEBV01@@Z

??0CReplManifestSourceFactory@Mig@@QEAA@XZ

??0CResourceLocator@Mig@@QEAA@$$QEAV01@@Z

??0CResourceLocator@Mig@@QEAA@AEBV01@@Z

??0CResourceLocator@Mig@@QEAA@PEAVCPlatform@1@@Z

??0IManifestEnumerator@Mig@@QEAA@$$QEAU01@@Z

??0IManifestEnumerator@Mig@@QEAA@AEBU01@@Z

??0IManifestEnumerator@Mig@@QEAA@XZ

??0IManifestParser@Mig@@QEAA@$$QEAU01@@Z

??0IManifestParser@Mig@@QEAA@AEBU01@@Z

??0IManifestParser@Mig@@QEAA@XZ

??0IManifestSourceFactory@Mig@@QEAA@$$QEAU01@@Z

??0IManifestSourceFactory@Mig@@QEAA@AEBU01@@Z

??0IManifestSourceFactory@Mig@@QEAA@XZ

??0IResourceLocator@Mig@@QEAA@$$QEAU01@@Z

??0IResourceLocator@Mig@@QEAA@AEBU01@@Z

??0IResourceLocator@Mig@@QEAA@XZ

??1?$SmartPtr@V?$ArrayList@PEAV?$DictionaryEntry@PEAVString@UnBCL@@PEAV12@@UnBCL@@@UnBCL@@@UnBCL@@UEAA@XZ

??1?$SmartPtr@VXmlDocument@UnBCL@@@UnBCL@@UEAA@XZ

??1CCSIAgent@Mig@@UEAA@XZ

??1CComponentBuilder@Mig@@UEAA@XZ

??1CComponentState@Mig@@UEAA@XZ

??1CDirManifestEnumerator@Mig@@UEAA@XZ

??1CDllManifestParser@Mig@@UEAA@XZ

??1CInstalledManifestEnumerator@Mig@@UEAA@XZ

??1CListManifestEnumerator@Mig@@UEAA@XZ

??1CManifestSource@Mig@@UEAA@XZ

??1CManifestSourceFactory@Mig@@UEAA@XZ

??1CMigUnitListGenerator@Mig@@UEAA@XZ

??1CReplManData@Mig@@UEAA@XZ

??1CReplManifestSourceFactory@Mig@@UEAA@XZ

??1CResourceLocator@Mig@@UEAA@XZ

??1IManifestEnumerator@Mig@@UEAA@XZ

??1IManifestParser@Mig@@UEAA@XZ

??1IManifestSourceFactory@Mig@@UEAA@XZ

??1IResourceLocator@Mig@@UEAA@XZ

??4?$SmartPtr@V?$ArrayList@PEAV?$DictionaryEntry@PEAVString@UnBCL@@PEAV12@@UnBCL@@@UnBCL@@@UnBCL@@QEAAAEAV01@AEBV01@@Z

??4?$SmartPtr@VXmlDocument@UnBCL@@@UnBCL@@QEAAAEAV01@AEBV01@@Z

??4CCSIAgent@Mig@@QEAAAEAV01@$$QEAV01@@Z

??4CCSIAgent@Mig@@QEAAAEAV01@AEBV01@@Z

??4CComponentBuilder@Mig@@QEAAAEAV01@AEBV01@@Z

??4CComponentState@Mig@@QEAAAEAV01@AEBV01@@Z

??4CDirManifestEnumerator@Mig@@QEAAAEAV01@AEBV01@@Z

??4CDllManifestParser@Mig@@QEAAAEAV01@AEBV01@@Z

??4CInstalledManifestEnumerator@Mig@@QEAAAEAV01@AEBV01@@Z

??4CListManifestEnumerator@Mig@@QEAAAEAV01@AEBV01@@Z

??4CManifestSource@Mig@@QEAAAEAV01@AEBV01@@Z

??4CManifestSourceFactory@Mig@@QEAAAEAV01@$$QEAV01@@Z

??4CManifestSourceFactory@Mig@@QEAAAEAV01@AEBV01@@Z

??4CMigUnitListGenerator@Mig@@QEAAAEAV01@AEBV01@@Z

??4CReplManData@Mig@@QEAAAEAV01@$$QEAV01@@Z

??4CReplManData@Mig@@QEAAAEAV01@AEBV01@@Z

??4CReplManifestSourceFactory@Mig@@QEAAAEAV01@$$QEAV01@@Z

??4CReplManifestSourceFactory@Mig@@QEAAAEAV01@AEBV01@@Z

??4CResourceLocator@Mig@@QEAAAEAV01@$$QEAV01@@Z

??4CResourceLocator@Mig@@QEAAAEAV01@AEBV01@@Z

??4IManifestEnumerator@Mig@@QEAAAEAU01@$$QEAU01@@Z

??4IManifestEnumerator@Mig@@QEAAAEAU01@AEBU01@@Z

??4IManifestParser@Mig@@QEAAAEAU01@$$QEAU01@@Z

??4IManifestParser@Mig@@QEAAAEAU01@AEBU01@@Z

??4IManifestSourceFactory@Mig@@QEAAAEAU01@$$QEAU01@@Z

??4IManifestSourceFactory@Mig@@QEAAAEAU01@AEBU01@@Z

??4IResourceLocator@Mig@@QEAAAEAU01@$$QEAU01@@Z

??4IResourceLocator@Mig@@QEAAAEAU01@AEBU01@@Z

??7?$SmartPtr@V?$ArrayList@PEAV?$DictionaryEntry@PEAVString@UnBCL@@PEAV12@@UnBCL@@@UnBCL@@@UnBCL@@QEBA_NXZ

??7?$SmartPtr@VXmlDocument@UnBCL@@@UnBCL@@QEBA_NXZ

??B?$SmartPtr@V?$ArrayList@PEAV?$DictionaryEntry@PEAVString@UnBCL@@PEAV12@@UnBCL@@@UnBCL@@@UnBCL@@QEBAPEAVNullTest@01@XZ

??B?$SmartPtr@VXmlDocument@UnBCL@@@UnBCL@@QEBAPEAVNullTest@01@XZ

??C?$SmartPtr@V?$ArrayList@PEAV?$DictionaryEntry@PEAVString@UnBCL@@PEAV12@@UnBCL@@@UnBCL@@@UnBCL@@QEBAPEAV?$ArrayList@PEAV?$DictionaryEntry@PEAVString@UnBCL@@PEAV12@@UnBCL@@@1@XZ

??C?$SmartPtr@VXmlDocument@UnBCL@@@UnBCL@@QEBAPEAVXmlDocument@1@XZ

??D?$SmartPtr@V?$ArrayList@PEAV?$DictionaryEntry@PEAVString@UnBCL@@PEAV12@@UnBCL@@@UnBCL@@@UnBCL@@QEBAAEAV?$ArrayList@PEAV?$DictionaryEntry@PEAVString@UnBCL@@PEAV12@@UnBCL@@@1@XZ

??D?$SmartPtr@VXmlDocument@UnBCL@@@UnBCL@@QEBAAEAVXmlDocument@1@XZ

??_7?$SmartPtr@V?$ArrayList@PEAV?$DictionaryEntry@PEAVString@UnBCL@@PEAV12@@UnBCL@@@UnBCL@@@UnBCL@@6B@

??_7?$SmartPtr@VXmlDocument@UnBCL@@@UnBCL@@6B@

??_7CCSIAgent@Mig@@6B01@@

??_7CCSIAgent@Mig@@6BCAgent@1@@

??_7CComponentBuilder@Mig@@6B@

??_7CComponentState@Mig@@6B@

??_7CDirManifestEnumerator@Mig@@6B@

??_7CDllManifestParser@Mig@@6B@

??_7CInstalledManifestEnumerator@Mig@@6B@

??_7CListManifestEnumerator@Mig@@6B@

??_7CManifestSource@Mig@@6B@

??_7CManifestSourceFactory@Mig@@6B@

??_7CMigUnitListGenerator@Mig@@6B@

??_7CReplManData@Mig@@6B@

??_7CReplManifestSourceFactory@Mig@@6B@

??_7CResourceLocator@Mig@@6B@

??_8CCSIAgent@Mig@@7B@

??_DCCSIAgent@Mig@@QEAAXXZ

?AddApplyInfo@CCSIAgent@Mig@@UEAAXPEAVCMigUnit@2@@Z

?AddGatherInfo@CCSIAgent@Mig@@UEAAXPEAVCMigUnit@2@PEAUICancelable@@@Z

?AddMigUnit@CMigUnitListGenerator@Mig@@AEAAXPEAVString@UnBCL@@0PEAVCUserContext@2@PEAVCMigUnitList@2@PEAVCMigUnitID@2@H@Z

?AdjustRules@CCSIAgent@Mig@@UEAAXPEAVCMigUnit@2@0@Z

?Assign@?$SmartPtr@V?$ArrayList@PEAV?$DictionaryEntry@PEAVString@UnBCL@@PEAV12@@UnBCL@@@UnBCL@@@UnBCL@@AEAAXAEBV12@@Z

?Assign@?$SmartPtr@V?$ArrayList@PEAV?$DictionaryEntry@PEAVString@UnBCL@@PEAV12@@UnBCL@@@UnBCL@@@UnBCL@@AEAAXPEAV?$ArrayList@PEAV?$DictionaryEntry@PEAVString@UnBCL@@PEAV12@@UnBCL@@@2@@Z

?Assign@?$SmartPtr@VXmlDocument@UnBCL@@@UnBCL@@AEAAXAEBV12@@Z

?Assign@?$SmartPtr@VXmlDocument@UnBCL@@@UnBCL@@AEAAXPEAVXmlDocument@2@@Z

?BuildComponentState@CComponentBuilder@Mig@@QEAAPEAVCComponentState@2@PEAVXmlDocument@UnBCL@@PEAVString@5@1PEAV?$Hashtable@PEAVString@UnBCL@@PEAV12@@5@2@Z

?BuildDisplayID@CComponentBuilder@Mig@@AEAAHPEAVXmlDocument@UnBCL@@PEAVString@4@PEAVCComponentState@2@@Z

?BuildDisplayStringTable@CComponentBuilder@Mig@@AEAAHPEAVXmlDocument@UnBCL@@PEAVString@4@PEAVCComponentState@2@@Z

?BuildGlobalDisplayTable@CMigUnitListGenerator@Mig@@AEAAXXZ

?BuildMigXmlID@CComponentBuilder@Mig@@AEAAHPEAVXmlDocument@UnBCL@@PEAVString@4@PEAVCComponentState@2@@Z

?CreateManifestSources@CManifestSourceFactory@Mig@@UEAAPEAV?$ArrayList@PEAVCManifestSource@Mig@@@UnBCL@@PEAVCPlatform@2@@Z

?CreateManifestSources@CReplManifestSourceFactory@Mig@@UEAAPEAV?$ArrayList@PEAVCManifestSource@Mig@@@UnBCL@@PEAVCPlatform@2@@Z

?DeAssign@?$SmartPtr@V?$ArrayList@PEAV?$DictionaryEntry@PEAVString@UnBCL@@PEAV12@@UnBCL@@@UnBCL@@@UnBCL@@AEAAXXZ

?DeAssign@?$SmartPtr@VXmlDocument@UnBCL@@@UnBCL@@AEAAXXZ

?Detect@CCSIAgent@Mig@@UEAAPEAVCMigUnitList@2@PEAVCUserContext@2@PEAUICancelable@@@Z

?Done@CCSIAgent@Mig@@UEAAXH@Z

?FilterByArchitecture@CComponentBuilder@Mig@@AEAAHPEAVXmlDocument@UnBCL@@PEAVString@4@PEAVCComponentState@2@@Z

?FindReplacementManifest@CCSIAgent@Mig@@AEAAPEAVXmlDocument@UnBCL@@PEAV34@PEAPEAVString@4@1@Z

?GenerateMigUnitList@CMigUnitListGenerator@Mig@@QEAAPEAVCMigUnitList@2@PEAVCUserContext@2@PEAUICancelable@@@Z

?GetResourceString@CResourceLocator@Mig@@UEAAPEAVString@UnBCL@@PEAV34@@Z

?Init@CCSIAgent@Mig@@UEAAXPEAVCPlatform@2@PEAVString@UnBCL@@@Z

?Init@CCSIAgent@Mig@@UEAAXPEAVCPlatform@2@PEAVString@UnBCL@@PEAUIManifestSourceFactory@2@2@Z

?InitApply@CCSIAgent@Mig@@UEAAXPEAVCPlatform@2@0PEAVString@UnBCL@@@Z

?LoadReplacementManifests@CCSIAgent@Mig@@AEAAPEAV?$Hashtable@PEAVString@UnBCL@@PEAV?$ArrayList@PEAVCReplManData@Mig@@@2@@UnBCL@@XZ

?MoveNext@CDirManifestEnumerator@Mig@@UEAAHPEAUICancelable@@@Z

?MoveNext@CInstalledManifestEnumerator@Mig@@UEAAHPEAUICancelable@@@Z

?MoveNext@CListManifestEnumerator@Mig@@UEAAHPEAUICancelable@@@Z

?Nullify@?$SmartPtr@V?$ArrayList@PEAV?$DictionaryEntry@PEAVString@UnBCL@@PEAV12@@UnBCL@@@UnBCL@@@UnBCL@@QEAAAEAV12@XZ

?Nullify@?$SmartPtr@VXmlDocument@UnBCL@@@UnBCL@@QEAAAEAV12@XZ

?Parse@CDllManifestParser@Mig@@UEAAHPEAVString@UnBCL@@0PEAVMutableString@4@@Z

?ProcessContainer@CMigUnitListGenerator@Mig@@AEAAPEAVCMigUnitID@2@PEAVString@UnBCL@@PEAVCUserContext@2@PEAV?$Hashtable@PEAVString@UnBCL@@PEAVCMigUnit@Mig@@@5@@Z

?RefreshGatherInfo@CCSIAgent@Mig@@UEAAXPEAVCMigUnit@2@PEAUICancelable@@@Z

?Reset@CDirManifestEnumerator@Mig@@UEAAXXZ

?Reset@CInstalledManifestEnumerator@Mig@@UEAAXXZ

?Reset@CListManifestEnumerator@Mig@@UEAAXXZ

?Steal@?$SmartPtr@V?$ArrayList@PEAV?$DictionaryEntry@PEAVString@UnBCL@@PEAV12@@UnBCL@@@UnBCL@@@UnBCL@@QEAAPEAV?$ArrayList@PEAV?$DictionaryEntry@PEAVString@UnBCL@@PEAV12@@UnBCL@@@2@XZ

?Steal@?$SmartPtr@VXmlDocument@UnBCL@@@UnBCL@@QEAAPEAVXmlDocument@2@XZ

?get_AlwaysProcessRange@CReplManData@Mig@@QEAAPEAVString@UnBCL@@XZ

?get_BasePath@CComponentState@Mig@@QEAAPEAVString@UnBCL@@XZ

?get_BasePath@CDirManifestEnumerator@Mig@@UEAAPEAVString@UnBCL@@XZ

?get_BasePath@CInstalledManifestEnumerator@Mig@@UEAAPEAVString@UnBCL@@XZ

?get_BasePath@CListManifestEnumerator@Mig@@UEAAPEAVString@UnBCL@@XZ

?get_BasePath@CReplManData@Mig@@QEAAPEAVString@UnBCL@@XZ

?get_ClonedCurrent@CDirManifestEnumerator@Mig@@UEAAPEAVXmlDocument@UnBCL@@XZ

?get_ClonedCurrent@CInstalledManifestEnumerator@Mig@@UEAAPEAVXmlDocument@UnBCL@@XZ

?get_ClonedCurrent@CListManifestEnumerator@Mig@@UEAAPEAVXmlDocument@UnBCL@@XZ

?get_Content@CReplManData@Mig@@QEAAPEAVXmlDocument@UnBCL@@XZ

?get_Current@CDirManifestEnumerator@Mig@@UEAAPEAVXmlDocument@UnBCL@@XZ

?get_Current@CInstalledManifestEnumerator@Mig@@UEAAPEAVXmlDocument@UnBCL@@XZ

?get_Current@CListManifestEnumerator@Mig@@UEAAPEAVXmlDocument@UnBCL@@XZ

?get_DisplayID@CComponentState@Mig@@QEAAPEAVString@UnBCL@@XZ

?get_DisplayStringTable@CComponentState@Mig@@QEAAPEAV?$Hashtable@PEAVString@UnBCL@@PEAV12@@UnBCL@@XZ

?get_Hidden@CComponentState@Mig@@QEAAHXZ

?get_ManifestEnumerator@CManifestSource@Mig@@UEAAPEAUIManifestEnumerator@2@XZ

?get_ManifestFile@CDirManifestEnumerator@Mig@@UEAAPEAVString@UnBCL@@XZ

?get_ManifestFile@CInstalledManifestEnumerator@Mig@@UEAAPEAVString@UnBCL@@XZ

?get_ManifestFile@CListManifestEnumerator@Mig@@UEAAPEAVString@UnBCL@@XZ

?get_ManifestFile@CReplManData@Mig@@QEAAPEAVString@UnBCL@@XZ

?get_MigXmlID@CComponentState@Mig@@QEAAPEAVString@UnBCL@@XZ

?get_Name@CReplManData@Mig@@QEAAPEAVString@UnBCL@@XZ

?get_P@?$SmartPtr@V?$ArrayList@PEAV?$DictionaryEntry@PEAVString@UnBCL@@PEAV12@@UnBCL@@@UnBCL@@@UnBCL@@QEBAPEAV?$ArrayList@PEAV?$DictionaryEntry@PEAVString@UnBCL@@PEAV12@@UnBCL@@@2@XZ

?get_P@?$SmartPtr@VXmlDocument@UnBCL@@@UnBCL@@QEBAPEAVXmlDocument@2@XZ

?get_Processed@CReplManData@Mig@@QEAAHXZ

?get_ReplacementVersion@CReplManData@Mig@@QEAAPEAVString@UnBCL@@XZ

?get_Scopes@CComponentState@Mig@@QEAAPEAVString@UnBCL@@XZ

?get_SettingsVersionRange@CReplManData@Mig@@QEAAPEAVString@UnBCL@@XZ

?get_Version@CReplManData@Mig@@QEAAPEAVString@UnBCL@@XZ

?get_VersionRange@CReplManData@Mig@@QEAAPEAVString@UnBCL@@XZ

?set_DisplayID@CComponentState@Mig@@QEAAXPEAVString@UnBCL@@@Z

?set_DisplayStringTable@CComponentState@Mig@@QEAAXPEAV?$Hashtable@PEAVString@UnBCL@@PEAV12@@UnBCL@@@Z

?set_Hidden@CComponentState@Mig@@QEAAXH@Z

?set_MigXmlID@CComponentState@Mig@@QEAAXPEAVString@UnBCL@@@Z

?set_Processed@CReplManData@Mig@@QEAAXH@Z

?set_Scopes@CComponentState@Mig@@QEAAXPEAVString@UnBCL@@@Z

LoadAgent

Sections

.text
Size: 332KB - Virtual size: 332KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 304KB - Virtual size: 303KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 30KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

migwiz/migres.dll

.dll windows:10 windows x64 arch:x64

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

ef:4a:ee:46:83:5f:fd:de:65:99:7d:2f:65:cf:3c:ab:22:a0:9e:31:91:42:f1:f7:49:89:19:8a:98:dc:36:38
Signer

Actual PE Digest

ef:4a:ee:46:83:5f:fd:de:65:99:7d:2f:65:cf:3c:ab:22:a0:9e:31:91:42:f1:f7:49:89:19:8a:98:dc:36:38

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

IMAGE_FILE_NET_RUN_FROM_SWAP

IMAGE_FILE_DLL

Sections

.rdata
Size: 512B - Virtual size: 208B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

migwiz/migstore.dll

.dll windows:10 windows x64 arch:x64

9c2671b33957c0c6ef2954c37aa281a1

Code Sign

33:00:00:04:5f:f3:c9:6c:1a:7f:f7:da:1d:00:00:00:00:04:5f
Certificate

Issuer

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

16/11/2023, 19:20

Not After

14/11/2024, 19:20

Subject

CN=Microsoft Windows,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

61:07:76:56:00:00:00:00:00:08
Certificate

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

19/10/2011, 18:41

Not After

19/10/2026, 18:51

Subject

CN=Microsoft Windows Production PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

KeyUsageCertSign

KeyUsageCRLSign

c5:30:0d:d5:e8:e7:35:d2:3c:a5:87:b8:83:32:bd:ca:18:00:c3:0d:91:25:9e:77:4d:3b:1b:8f:6f:d8:6f:f0
Signer

Actual PE Digest

c5:30:0d:d5:e8:e7:35:d2:3c:a5:87:b8:83:32:bd:ca:18:00:c3:0d:91:25:9e:77:4d:3b:1b:8f:6f:d8:6f:f0

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP

IMAGE_FILE_NET_RUN_FROM_SWAP

IMAGE_FILE_DLL

PDB Paths

MigStore.pdb

Imports

msvcrt

__RTDynamicCast

_setjmp

memcpy

memmove

_onexit

__dllonexit

_unlock

_lock

?terminate@@YAXXZ

??1type_info@@UEAA@XZ

__C_specific_handler

_initterm

_amsg_exit

_XcptFilter

_CxxThrowException

_callnewh

?what@exception@@UEBAPEBDXZ

??1exception@@UEAA@XZ

??0exception@@QEAA@AEBV0@@Z

??0exception@@QEAA@AEBQEBDH@Z

iswlower

iswalpha

longjmp

swscanf_s

_wcsnicmp

_wtoi64

_purecall

malloc

calloc

memmove_s

free

?name@type_info@@QEBAPEBDXZ

wcschr

towlower

__CxxFrameHandler3

memset

kernel32

GetProcessHeap

HeapAlloc

HeapFree

CloseHandle

GetLastError

SetFilePointer

SetEndOfFile

CreateFileW

ReadFile

SetFileAttributesW

DeleteFileW

WriteFile

FlushFileBuffers

GetFileSize

DuplicateHandle

GetCurrentProcess

CreateEventW

SetEvent

ResetEvent

WaitForMultipleObjects

EnterCriticalSection

LeaveCriticalSection

WaitForSingleObject

InitializeCriticalSection

DeleteCriticalSection

CreateDirectoryW

SetLastError

CreateThread

GetFileAttributesW

FindFirstFileW

FindClose

SetErrorMode

GetDriveTypeW

GetVolumeInformationW

CreateHardLinkW

DeviceIoControl

GetModuleHandleW

GetProcAddress

Sleep

QueryPerformanceCounter

GetCurrentProcessId

GetCurrentThreadId

GetSystemTimeAsFileTime

GetTickCount

RtlCaptureContext

RtlLookupFunctionEntry

RtlVirtualUnwind

UnhandledExceptionFilter

SetUnhandledExceptionFilter

TerminateProcess

unbcl

?AddRef@Object@UnBCL@@QEAAXXZ

?GetCallingModule@SerializationStream@UnBCL@@SAPEAUHINSTANCE__@@XZ

?CanRegister@SerializationStream@UnBCL@@SAHXZ

?RegisterType@SerializationStream@UnBCL@@SAXPEBVString@2@HPEAUHINSTANCE__@@PEAUIInstanceFactory@2@@Z

?EnqueueSbRegistration@SbRegistrationList@UnBCL@@SAXPEBDHPEAUHINSTANCE__@@PEAUIInstanceFactory@2@@Z

??0NotSupportedException@UnBCL@@QEAA@PEBG@Z

??1NotSupportedException@UnBCL@@UEAA@XZ

??0InvalidOperationException@UnBCL@@QEAA@PEBVString@1@@Z

?SetLiteralStorage@_@UnBCL@@YAXPEAPEBVString@2@PEBG@Z

??1?$ICollection@G@UnBCL@@UEAA@XZ

?UnregisterType@SerializationStream@UnBCL@@SAXPEBVString@2@HPEAUHINSTANCE__@@@Z

?Clone@?$ArrayList@PEAVString@UnBCL@@@UnBCL@@UEBAPEAVObject@2@XZ

?Equals@?$ArrayList@PEAVString@UnBCL@@@UnBCL@@UEBAHPEBVObject@2@@Z

??0IInstanceFactory@UnBCL@@QEAA@XZ

??1?$IEnumerator@PEAVString@UnBCL@@@UnBCL@@UEAA@XZ

??0?$IEnumerator@PEAVString@UnBCL@@@UnBCL@@QEAA@XZ

??0?$ICollection@G@UnBCL@@QEAA@XZ

??0?$IEnumerable@G@UnBCL@@QEAA@XZ

??0?$ICollection@PEAVString@UnBCL@@@UnBCL@@QEAA@XZ

??0?$IEnumerable@PEAVString@UnBCL@@@UnBCL@@QEAA@XZ

??1InvalidCastException@UnBCL@@UEAA@XZ

??_DStringPtr@UnBCL@@QEAAXXZ

??_DFileStream@UnBCL@@QEAAXXZ

??_D?$ArrayList@PEAVString@UnBCL@@@UnBCL@@QEAAXXZ

??4SyncObject@UnBCL@@QEAAAEAV01@AEBV01@@Z

??4MemoryStream@UnBCL@@QEAAAEAV01@AEBV01@@Z

??_DMemoryStream@UnBCL@@QEAAXXZ

??0MemoryStream@UnBCL@@QEAA@AEBV01@@Z

??0ISerializable@UnBCL@@QEAA@$$QEAU01@@Z

??0ISerializable@UnBCL@@QEAA@AEBU01@@Z

??4ISerializable@UnBCL@@QEAAAEAU01@AEBU01@@Z

??4ISerializable@UnBCL@@QEAAAEAU01@$$QEAU01@@Z

??1InvalidOperationException@UnBCL@@UEAA@XZ

??0ISerializable@UnBCL@@QEAA@XZ

??0Win32Exception@UnBCL@@QEAA@XZ

??0OutOfMemoryException@UnBCL@@QEAA@XZ

??1Stream@UnBCL@@UEAA@XZ

??_7Stream@UnBCL@@6B01@@

??_7Stream@UnBCL@@6BObject@1@@

??_7Stream@UnBCL@@6BIDisposable@1@@

??0NotSupportedException@UnBCL@@QEAA@XZ

?Concat@String@UnBCL@@SAPEAV12@PEBG0@Z

??0StringBuilder@UnBCL@@QEAA@XZ

??1StringBuilder@UnBCL@@UEAA@XZ

?Append@StringBuilder@UnBCL@@QEAAPEAV12@PEBVString@2@@Z

?Append@StringBuilder@UnBCL@@QEAAPEAV12@G@Z

?get_CString@StringBuilder@UnBCL@@QEBAPEBGXZ

?WithoutLongPrefix@Path@UnBCL@@SAPEAVString@2@PEBV32@@Z

?WithLongPrefix@Path@UnBCL@@SAPEAVString@2@PEBV32@H@Z

??B?$SmartPtr@VString@UnBCL@@@UnBCL@@QEBAPEAVNullTest@01@XZ

?set_Length@StringBuilder@UnBCL@@QEAAXH@Z

?get_Length@StringBuilder@UnBCL@@QEBAHXZ

??0FileStream@UnBCL@@QEAA@PEBVString@1@W4FileMode@1@W4FileAccess@1@W4FileShare@1@K@Z

??0?$SmartPtr@VStream@UnBCL@@@UnBCL@@QEAA@XZ

??1?$SmartPtr@VStream@UnBCL@@@UnBCL@@UEAA@XZ

??4?$SmartPtr@VStream@UnBCL@@@UnBCL@@QEAAAEAV01@AEBV01@@Z

??0?$SmartPtr@VStream@UnBCL@@@UnBCL@@QEAA@PEAVStream@1@@Z

?get_P@?$SmartPtr@VStream@UnBCL@@@UnBCL@@QEBAPEAVStream@2@XZ

??C?$SmartPtr@VStream@UnBCL@@@UnBCL@@QEBAPEAVStream@1@XZ

??B?$SmartPtr@VStream@UnBCL@@@UnBCL@@QEBAPEAVNullTest@01@XZ

??0ArgumentException@UnBCL@@QEAA@XZ

?Append@StringBuilder@UnBCL@@QEAAPEAV12@PEBG@Z

?Create@File@UnBCL@@SAPEAVFileStream@2@PEBVString@2@@Z

?GetTemporaryFileName@File@UnBCL@@SAPEAVString@2@PEBV32@@Z

?Delete@File@UnBCL@@SAXPEBVString@2@@Z

?Add@StreamCounter@UnBCL@@QEAAX_J@Z

??0Exception@UnBCL@@QEAA@PEBG@Z

??0IDisposable@UnBCL@@QEAA@XZ

??1IDisposable@UnBCL@@UEAA@XZ

??1OutOfMemoryException@UnBCL@@UEAA@XZ

?get_Length@String@UnBCL@@QEBAHXZ

?GetEnvironmentVar@Environment@UnBCL@@SAPEAVString@2@PEBV32@@Z

?MatchI@String@UnBCL@@SAHPEBG0@Z

?Steal@?$SmartPtr@VStream@UnBCL@@@UnBCL@@QEAAPEAVStream@2@XZ

?GetFileNameWithoutExtension@Path@UnBCL@@SAPEAVString@2@PEBV32@@Z

?Concat@String@UnBCL@@SAPEAV12@PEBG000@Z

?Exists@File@UnBCL@@SAHPEBVString@2@@Z

??0IDisposable@UnBCL@@QEAA@AEBU01@@Z

??4Stream@UnBCL@@QEAAAEAV01@$$QEAV01@@Z

??4Stream@UnBCL@@QEAAAEAV01@AEBV01@@Z

??0Stream@UnBCL@@QEAA@$$QEAV01@@Z

??0Stream@UnBCL@@QEAA@AEBV01@@Z

?Compare@String@UnBCL@@SAHPEBG0H@Z

?GetDirectoryRoot@Directory@UnBCL@@SAPEAVString@2@PEBV32@@Z

?ExpandEnvironmentVariables@Environment@UnBCL@@SAPEAVString@2@PEBV32@@Z

?GetPathRoot@Path@UnBCL@@SAPEAVString@2@PEBV32@@Z

??0IDisposable@UnBCL@@QEAA@$$QEAU01@@Z

?Clone@?$Array@E@UnBCL@@UEBAPEAVObject@2@XZ

?Equals@?$Array@E@UnBCL@@UEBAHPEBVObject@2@@Z

??0?$Hashtable@PEAVString@UnBCL@@PEAV12@@UnBCL@@QEAA@HH@Z

??0InvalidOperationException@UnBCL@@QEAA@XZ

?Join@String@UnBCL@@SAPEAV12@PEBGPEAV?$Array@PEAVString@UnBCL@@@2@@Z

?get_Chars@String@UnBCL@@QEBAAEBGH@Z

??0?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QEAA@PEAV?$Array@E@1@@Z

??1?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@UEAA@XZ

?get_P@?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QEBAPEAV?$Array@E@2@XZ

??C?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QEBAPEAV?$Array@E@1@XZ

?Steal@?$SmartPtr@V?$Array@E@UnBCL@@@UnBCL@@QEAAPEAV?$Array@E@2@XZ

?GetFileName@Path@UnBCL@@SAPEAVString@2@PEBV32@@Z

?IsPathRooted@Path@UnBCL@@SAHPEBVString@2@@Z

?Clone@?$Hashtable@PEAVString@UnBCL@@PEAV12@@UnBCL@@UEBAPEAVObject@2@XZ

??_D?$Hashtable@PEAVString@UnBCL@@PEAV12@@UnBCL@@QEAAXXZ

??0String@UnBCL@@QEAA@PEBGHH@Z

?Exists@Directory@UnBCL@@SAHPEBVString@2@@Z

?IsDirectoryEmpty@Directory@UnBCL@@SAHPEBVString@2@@Z

??0Win32Exception@UnBCL@@QEAA@PEBG@Z

??0?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QEAA@PEAVEncoding@1@@Z

?GetASCII@Encoding@UnBCL@@SAPEAV12@XZ

??1?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@UEAA@XZ

??0StreamReader@UnBCL@@QEAA@PEBVString@1@PEAVEncoding@1@@Z

?get_P@?$SmartPtr@VEncoding@UnBCL@@@UnBCL@@QEBAPEAVEncoding@2@XZ

?DeleteNE@Directory@UnBCL@@SAHPEBVString@2@H@Z

??0StreamWriter@UnBCL@@QEAA@PEBVString@1@HPEAVEncoding@1@HH@Z

?Combine@Path@UnBCL@@SAPEAVString@2@PEBV32@0@Z

??0String@UnBCL@@QEAA@XZ

?Delete@Directory@UnBCL@@SAXPEBVString@2@H@Z

?StartsWith@String@UnBCL@@QEBAHPEBGH@Z

?ReadByte@Stream@UnBCL@@UEAAHXZ

??_DStreamWriter@UnBCL@@QEAAXXZ

??_DStreamReader@UnBCL@@QEAAXXZ

??0InvalidCastException@UnBCL@@QEAA@XZ

??5SerializationStream@UnBCL@@QEAAAEAV01@AEAPEAUISerializable@1@@Z

??0String@UnBCL@@QEAA@AEBV01@@Z

??2Object@UnBCL@@SAPEAX_KI@Z

??D?$SmartPtr@VString@UnBCL@@@UnBCL@@QEBAAEAVString@1@XZ

?SanitizeTypeName@SerializationStream@UnBCL@@SAPEAVString@2@AEBV32@@Z

?DecRef@Object@UnBCL@@QEAAHXZ

?get_P@?$SmartPtr@V?$Array@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@QEBAPEAV?$Array@PEAVString@UnBCL@@@2@XZ

?Substring@String@UnBCL@@QEBAPEAV12@HH@Z

?LastIndexOf@String@UnBCL@@QEBAHG@Z

?FromASCII@String@UnBCL@@SAPEAV12@PEBD@Z

?FormatV@String@UnBCL@@SAPEAV12@PEBGPEAD@Z

?Concat@String@UnBCL@@SAPEAV12@PEBG00@Z

?Equals@?$Array@PEAVString@UnBCL@@@UnBCL@@UEBAHPEBVObject@2@@Z

?Clone@?$Array@PEAVString@UnBCL@@@UnBCL@@UEBAPEAVObject@2@XZ

??0?$Array@PEAVString@UnBCL@@@UnBCL@@QEAA@HH@Z

??5SerializationStream@UnBCL@@QEAAAEAV01@AEAK@Z

??0MemoryStream@UnBCL@@QEAA@PEAV?$Array@E@1@HH@Z

?get_Context@SerializationStream@UnBCL@@QEBAPEAVObject@2@XZ

?ReadBytes@SerializationStream@UnBCL@@QEAAXPEAEH@Z

??5SerializationStream@UnBCL@@QEAAAEAV01@AEAG@Z

??6SerializationStream@UnBCL@@QEAAAEAV01@K@Z

?WriteBytes@SerializationStream@UnBCL@@QEAAXPEBEH@Z

??6SerializationStream@UnBCL@@QEAAAEAV01@G@Z

??_D?$Array@E@UnBCL@@QEAAXXZ

??0StringPtr@UnBCL@@QEAA@PEAVString@1@@Z

??4?$SmartPtr@V?$Array@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@QEAAAEAV01@AEBV01@@Z

?Compare@String@UnBCL@@SAHPEBV12@0H@Z

??_D?$Array@PEAVString@UnBCL@@@UnBCL@@QEAAXXZ

??0FileStream@UnBCL@@QEAA@PEAXW4FileAccess@1@@Z

??1ScopedObjectLock@UnBCL@@QEAA@XZ

??0ScopedObjectLock@UnBCL@@QEAA@PEAVSyncObject@1@@Z

?set_Context@SerializationStream@UnBCL@@QEAAXPEAVObject@2@@Z

??1SerializationStream@UnBCL@@UEAA@XZ

??0SerializationStream@UnBCL@@QEAA@PEAVStream@1@W4Mode@01@PEAVObject@1@@Z

??1?$ICollection@PEAVString@UnBCL@@@UnBCL@@UEAA@XZ

?MemAllocFailed@Allocator@UnBCL@@SAHXZ

?Steal@?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAAPEAVString@2@XZ

?ToLower@String@UnBCL@@QEBAPEAV12@XZ

??C?$SmartPtr@V?$ArrayList@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@QEBAPEAV?$ArrayList@PEAVString@UnBCL@@@1@XZ

??0?$ArrayList@PEAVString@UnBCL@@@UnBCL@@QEAA@XZ

?get_Win32ErrorCode@Win32Exception@UnBCL@@QEBAKXZ

?CreateDir@Directory@UnBCL@@SAPEAVDirectoryInfo@2@PEBVString@2@@Z

?GetParentPath@Path@UnBCL@@SAPEAVString@2@PEBV32@@Z

??0SyncObject@UnBCL@@QEAA@XZ

??0MemoryStream@UnBCL@@QEAA@XZ

??0Exception@UnBCL@@QEAA@XZ

??C?$SmartPtr@VString@UnBCL@@@UnBCL@@QEBAPEAVString@1@XZ

??5SerializationStream@UnBCL@@QEAAAEAV01@AEAH@Z

??6SerializationStream@UnBCL@@QEAAAEAV01@PEBUISerializable@1@@Z

??6SerializationStream@UnBCL@@QEAAAEAV01@H@Z

??5SerializationStream@UnBCL@@QEAAAEAV01@AEA_K@Z

??5SerializationStream@UnBCL@@QEAAAEAV01@AEAPEAVString@1@@Z

??6SerializationStream@UnBCL@@QEAAAEAV01@_K@Z

??6SerializationStream@UnBCL@@QEAAAEAV01@PEBVString@1@@Z

??C?$SmartPtr@V?$Array@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@QEBAPEAV?$Array@PEAVString@UnBCL@@@1@XZ

??1?$SmartPtr@V?$Array@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@UEAA@XZ

??0?$SmartPtr@V?$Array@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@QEAA@PEAV?$Array@PEAVString@UnBCL@@@1@@Z

?get_CString@String@UnBCL@@QEBAPEBGXZ

??1SyncObject@UnBCL@@UEAA@XZ

??0SyncObject@UnBCL@@QEAA@AEBV01@@Z

??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAA@AEBV01@@Z

??0Win32Exception@UnBCL@@QEAA@KPEBGPEAVException@1@@Z

??0Win32Exception@UnBCL@@QEAA@KPEBG@Z

?ReAlloc@Allocator@UnBCL@@SAPEAXPEAX_KI@Z

??0ArgumentNullException@UnBCL@@QEAA@PEBG@Z

??1Exception@UnBCL@@UEAA@XZ

??1Win32Exception@UnBCL@@UEAA@XZ

??1ArgumentException@UnBCL@@UEAA@XZ

??1ArgumentNullException@UnBCL@@UEAA@XZ

??0ArgumentNullException@UnBCL@@QEAA@XZ

??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAA@XZ

??0Object@UnBCL@@QEAA@AEBV01@@Z

??1String@UnBCL@@UEAA@XZ

??0String@UnBCL@@QEAA@PEBG@Z

?ToString@Object@UnBCL@@UEBAPEAVString@2@XZ

??0?$Array@E@UnBCL@@QEAA@HH@Z

?GetBuffer@?$Array@E@UnBCL@@UEAAPEAEH@Z

??0ArgumentException@UnBCL@@QEAA@PEBG@Z

??1ISerializable@UnBCL@@UEAA@XZ

??1Object@UnBCL@@UEAA@XZ

??0Object@UnBCL@@QEAA@XZ

?Equals@String@UnBCL@@UEBAHPEBVObject@2@@Z

?GetHashCode@String@UnBCL@@UEBAHXZ

?ToString@String@UnBCL@@UEBAPEAV12@XZ

?CompareTo@String@UnBCL@@UEBAHPEBVObject@2@@Z

?Clone@String@UnBCL@@UEBAPEAVObject@2@XZ

??0String@UnBCL@@QEAA@PEBV01@@Z

?Format@String@UnBCL@@SAPEAV12@PEBGZZ

??0Win32Exception@UnBCL@@QEAA@K@Z

??1?$SmartPtr@V?$ArrayList@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@UEAA@XZ

??0?$SmartPtr@V?$ArrayList@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@QEAA@PEAV?$ArrayList@PEAVString@UnBCL@@@1@@Z

?get_P@?$SmartPtr@V?$ArrayList@PEAVString@UnBCL@@@UnBCL@@@UnBCL@@QEBAPEAV?$ArrayList@PEAVString@UnBCL@@@2@XZ

??1?$SmartPtr@VString@UnBCL@@@UnBCL@@UEAA@XZ

??0?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAA@PEAVString@1@@Z

??4?$SmartPtr@VString@UnBCL@@@UnBCL@@QEAAAEAV01@AEBV01@@Z

?get_P@?$SmartPtr@VString@UnBCL@@@UnBCL@@QEBAPEAVString@2@XZ

?Free@Allocator@UnBCL@@SAXPEAXI@Z

??1ArgumentOutOfRangeException@UnBCL@@UEAA@XZ

?Equals@Object@UnBCL@@UEBAHPEBV12@@Z

?GetHashCode@Object@UnBCL@@UEBAHXZ

?GetType@Object@UnBCL@@UEBAPEAVType@2@XZ

?ToString@Exception@UnBCL@@UEBAPEAVString@2@XZ

?GetObjectID@Object@UnBCL@@UEBAIXZ

?WritePhantomObject@SerializationStream@UnBCL@@QEAAHPEBVObject@2@@Z

??0SerializationException@UnBCL@@QEAA@PEBG@Z

?ToArray@MemoryStream@UnBCL@@UEBAPEAV?$Array@E@2@XZ

?ReadPhantomObject@SerializationStream@UnBCL@@QEAAXAEAPEAVObject@2@@Z

??1SerializationException@UnBCL@@UEAA@XZ

??0InvalidOperationException@UnBCL@@QEAA@PEBG@Z

??0InvalidOperationException@UnBCL@@QEAA@PEBVString@1@PEAVException@1@@Z

?CompareTo@Object@UnBCL@@UEBAHPEBV12@@Z

?Clone@Object@UnBCL@@UEBAPEAV12@XZ

?get_InnerException@Exception@UnBCL@@UEBAPEBV12@XZ

?get_Message@Exception@UnBCL@@UEBAPEBVString@2@XZ

?get_Source@Exception@UnBCL@@UEBAPEBVString@2@XZ

?set_Source@Exception@UnBCL@@UEAAXPEBVString@2@@Z

?GetBaseException@Exception@UnBCL@@UEBAPEBV12@XZ

?get_HResult@Exception@UnBCL@@UEBAJXZ

?set_HResult@Exception@UnBCL@@MEAAXJ@Z

?SetMessage@Exception@UnBCL@@MEAAXPEAVString@2@@Z

??0ArgumentOutOfRangeException@UnBCL@@QEAA@PEBG@Z

??3Object@UnBCL@@SAXPEAX@Z

??2Object@UnBCL@@SAPEAX_K@Z

?AddStackTrace@Exception@UnBCL@@QEAAXPEBD@Z

?Alloc@Allocator@UnBCL@@SAPEAX_KI@Z

??4Object@UnBCL@@QEAAAEAV01@AEBV01@@Z

migcore

??1IFileStreamProxy@Mig@@UEAA@XZ

??4IOptimizedFileStreamProxy@Mig@@QEAAAEAU01@AEBU01@@Z

??1IOptimizedFileStreamProxy@Mig@@UEAA@XZ

??0IOptimizedFileStreamProxy@Mig@@QEAA@XZ

??1CAbortException@Mig@@UEAA@XZ

??1SideAwareWin32Exception@Mig@@UEAA@XZ

??0CAbortException@Mig@@QEAA@PEBG@Z

?get_Name@CStorageType@Mig@@QEAAPEAVString@UnBCL@@XZ

?CopyStream@Mig@@YAXPEAVStream@UnBCL@@0PEAUILocalProgress@@H_J@Z

??C?$SmartPtr@UIMigLocation@Mig@@@UnBCL@@QEBAPEAUIMigLocation@Mig@@XZ

?get_P@?$SmartPtr@UIMigLocation@Mig@@@UnBCL@@QEBAPEAUIMigLocation@Mig@@XZ

?GetTypeFromString@CStorageType@Mig@@SAPEAV12@PEAVString@UnBCL@@@Z

??0SideAwareWin32Exception@Mig@@QEAA@HK@Z

??1IStreamProxy@Mig@@UEAA@XZ

?MappedFileSystemPath@CFileSystemRootMapping@Mig@@QEAAPEAVString@UnBCL@@PEAV34@@Z

??0?$SmartPtr@UIMigLocation@Mig@@@UnBCL@@QEAA@PEAUIMigLocation@Mig@@@Z

??1?$SmartPtr@UIMigLocation@Mig@@@UnBCL@@UEAA@XZ

?Clone@CFileLocation@Mig@@UEBAPEAVObject@UnBCL@@XZ

?CompareTo@CFilePattern@Mig@@UEBAHPEBVObject@UnBCL@@@Z

?ToString@CFileLocation@Mig@@UEBAPEAVString@UnBCL@@XZ

?GetHashCode@CFilePattern@Mig@@UEBAHXZ

??0IStreamProxy@Mig@@QEAA@XZ

?CreateFolder@IOptimizedFileStreamProxy@Mig@@UEAAXPEAVString@UnBCL@@HPEAHPEAUILocalProgress@@@Z

?CanCreateFolder@IOptimizedFileStreamProxy@Mig@@UEAAHXZ

??0IDataStoreNavigator@Mig@@QEAA@AEBU01@@Z

??1IDataStoreNavigator@Mig@@UEAA@XZ

??4IDataStoreNavigator@Mig@@QEAAAEAU01@AEBU01@@Z

??0IDataStoreNavigator@Mig@@QEAA@XZ

?CreateInstance@CLocationFactory@Mig@@SAPEAUIMigLocation@2@PEAVCStorageType@2@PEAV?$Array@PEAVString@UnBCL@@@UnBCL@@@Z

??1NavigatorRootAbsentException@Mig@@UEAA@XZ

??0NavigatorRootAbsentException@Mig@@QEAA@PEAUIMigLocation@1@@Z

??0?$SmartPtr@VCFileLocation@Mig@@@UnBCL@@QEAA@PEAVCFileLocation@Mig@@@Z

??1?$SmartPtr@VCFileLocation@Mig@@@UnBCL@@UEAA@XZ

?get_IsDirectory@CFileLocation@Mig@@QEBAHXZ

??0CFileLocation@Mig@@QEAA@HPEAVString@UnBCL@@@Z

??0IFileStreamProxy@Mig@@QEAA@XZ

??4?$SmartPtr@VCFileLocation@Mig@@@UnBCL@@QEAAAEAV01@AEBV01@@Z

?GetFullPath@CFileLocation@Mig@@QEBAPEAVString@UnBCL@@XZ

??0SideAwareWin32Exception@Mig@@QEAA@HKQEBGPEAVException@UnBCL@@@Z

?Equals@CFilePattern@Mig@@UEBAHPEBVObject@UnBCL@@@Z

?MakeSureDirectoryExists@CNativeFileUtils@Mig@@SAKPEAGPEAH@Z

?get_Location@CPhysicalFile@Mig@@QEAAPEAVCFileLocation@2@XZ

?CanCreateFile@IOptimizedFileStreamProxy@Mig@@UEAAHXZ

?CreateFileW@IOptimizedFileStreamProxy@Mig@@UEAAXPEAVString@UnBCL@@KPEAH1PEAUILocalProgress@@@Z

??_DCBlobStreamProxy@Mig@@QEAAXXZ

??1CPhysicalFile@Mig@@UEAA@XZ

??_DCEfsFileReadStream@Mig@@QEAAXXZ

?Clone@CBlobStreamProxy@Mig@@UEBAPEAVObject@UnBCL@@XZ

??0CEfsFileReadStream@Mig@@QEAA@PEBVString@UnBCL@@HW4FileMode@3@W4FileAccess@3@W4FileShare@3@K@Z

??0CPhysicalFile@Mig@@QEAA@PEAVCFileLocation@1@H@Z

?Clone@CPhysicalFile@Mig@@UEBAPEAVObject@UnBCL@@XZ

?Steal@?$SmartPtr@UIMigLocation@Mig@@@UnBCL@@QEAAPEAUIMigLocation@Mig@@XZ

??0CBlobStreamProxy@Mig@@QEAA@PEAV?$Array@E@UnBCL@@H@Z

?GetStateType@CStorageType@Mig@@SAPEAV12@XZ

?GetRegistryType@CStorageType@Mig@@SAPEAV12@XZ

?GetFileType@CStorageType@Mig@@SAPEAV12@XZ

??0SideAwareWin32Exception@Mig@@QEAA@HPEAVWin32Exception@UnBCL@@@Z

?GetTempDir@CFacadeState@Mig@@SAPEAVString@UnBCL@@XZ

?GetInitialized@CFacadeState@Mig@@SAHXZ

?GetIOBufferSet@CFacadeState@Mig@@SAAEAVCIOBufferSet@2@XZ

??C?$SmartPtr@VCFileLocation@Mig@@@UnBCL@@QEBAPEAVCFileLocation@Mig@@XZ

?get_P@?$SmartPtr@VCFileLocation@Mig@@@UnBCL@@QEBAPEAVCFileLocation@Mig@@XZ

??_DCFileLocation@Mig@@QEAAXXZ

wdscore

CurrentIP

ConstructPartialMsgVW

WdsSetupLogMessageW

user32

GetMessageW

PostThreadMessageW

PeekMessageW

advapi32

CryptEncrypt

CryptDuplicateKey

CryptDestroyKey

CryptDecrypt

CryptSetKeyParam

CryptGetKeyParam

rpcrt4

UuidToStringW

UuidCreate

RpcStringFreeW

Exports

??0?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@AEAA@AEBV01@@Z

??0?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@QEAA@HH@Z

??0?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@QEAA@PEBU?$ICollection@PEAVCCatalogUser@Mig@@@1@@Z

??0?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@QEAA@XZ

??0?$Hashtable@IPEAUIDevice@Mig@@@UnBCL@@QEAA@AEBV01@@Z

??0?$Hashtable@IPEAUIDevice@Mig@@@UnBCL@@QEAA@H@Z

??0?$Hashtable@IPEAUIDevice@Mig@@@UnBCL@@QEAA@HH@Z

??0?$Hashtable@IPEAUIDevice@Mig@@@UnBCL@@QEAA@PEBU?$IDictionary@IPEAUIDevice@Mig@@@1@@Z

??0?$Hashtable@IPEAUIDevice@Mig@@@UnBCL@@QEAA@XZ

??0?$ICollection@PEAVCCatalogUser@Mig@@@UnBCL@@QEAA@AEBU01@@Z

??0?$ICollection@PEAVCCatalogUser@Mig@@@UnBCL@@QEAA@XZ

??0?$ICollection@V?$DictionaryEntry@IPEAUIDevice@Mig@@@UnBCL@@@UnBCL@@QEAA@AEBU01@@Z

??0?$ICollection@V?$DictionaryEntry@IPEAUIDevice@Mig@@@UnBCL@@@UnBCL@@QEAA@XZ

??0?$IDictionary@IPEAUIDevice@Mig@@@UnBCL@@QEAA@AEBU01@@Z

??0?$IDictionary@IPEAUIDevice@Mig@@@UnBCL@@QEAA@XZ

??0?$IEnumerable@PEAVCCatalogUser@Mig@@@UnBCL@@QEAA@AEBU01@@Z

??0?$IEnumerable@PEAVCCatalogUser@Mig@@@UnBCL@@QEAA@XZ

??0?$IEnumerable@V?$DictionaryEntry@IPEAUIDevice@Mig@@@UnBCL@@@UnBCL@@QEAA@AEBU01@@Z

??0?$IEnumerable@V?$DictionaryEntry@IPEAUIDevice@Mig@@@UnBCL@@@UnBCL@@QEAA@XZ

??0?$IList@PEAVCCatalogUser@Mig@@@UnBCL@@QEAA@AEBU01@@Z

??0?$IList@PEAVCCatalogUser@Mig@@@UnBCL@@QEAA@XZ

??0?$SerializableArrayListBase@PEAVCCatalogUser@Mig@@@_@UnBCL@@QEAA@AEBV012@@Z

??0?$SerializableArrayListBase@PEAVCCatalogUser@Mig@@@_@UnBCL@@QEAA@XZ

??0?$SerializableBase@V?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@@_@UnBCL@@SAPEAUISerializable@4@XZ@2@@UnBCL@@IEAA@XZ

??0?$SerializableBase@V?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@@_@UnBCL@@SAPEAUISerializable@4@XZ@2@@UnBCL@@QEAA@AEBV01@@Z

??0?$SerializableBase@VCCatalogEntry@Mig@@$0A@V?$DefaultInstanceFactory@VCCatalogEntry@Mig@@@UnBCL@@@UnBCL@@IEAA@XZ

??0?$SerializableBase@VCCatalogEntry@Mig@@$0A@V?$DefaultInstanceFactory@VCCatalogEntry@Mig@@@UnBCL@@@UnBCL@@QEAA@AEBV01@@Z

??0?$SerializableBase@VCCatalogUser@Mig@@$0A@V?$DefaultInstanceFactory@VCCatalogUser@Mig@@@UnBCL@@@UnBCL@@IEAA@XZ

??0?$SerializableBase@VCCatalogUser@Mig@@$0A@V?$DefaultInstanceFactory@VCCatalogUser@Mig@@@UnBCL@@@UnBCL@@QEAA@AEBV01@@Z

??0?$SerializableBase@VCCatalogUserList@Mig@@$0A@V?$DefaultInstanceFactory@VCCatalogUserList@Mig@@@UnBCL@@@UnBCL@@IEAA@XZ

??0?$SerializableBase@VCCatalogUserList@Mig@@$0A@V?$DefaultInstanceFactory@VCCatalogUserList@Mig@@@UnBCL@@@UnBCL@@QEAA@AEBV01@@Z

??0?$SmartPtr@UITrimableStream@Mig@@@UnBCL@@QEAA@AEBV01@@Z

??0?$SmartPtr@UITrimableStream@Mig@@@UnBCL@@QEAA@PEAUITrimableStream@Mig@@@Z

??0?$SmartPtr@UITrimableStream@Mig@@@UnBCL@@QEAA@XZ

??0?$SmartPtr@V?$ArrayList@G@UnBCL@@@UnBCL@@QEAA@AEBV01@@Z

??0?$SmartPtr@V?$ArrayList@G@UnBCL@@@UnBCL@@QEAA@PEAV?$ArrayList@G@1@@Z

??0?$SmartPtr@V?$ArrayList@G@UnBCL@@@UnBCL@@QEAA@XZ

??0?$SmartPtr@V?$ArrayList@PEAV?$DictionaryEntry@PEAVCFileLocation@Mig@@PEAV12@@UnBCL@@@UnBCL@@@UnBCL@@QEAA@AEBV01@@Z

??0?$SmartPtr@V?$ArrayList@PEAV?$DictionaryEntry@PEAVCFileLocation@Mig@@PEAV12@@UnBCL@@@UnBCL@@@UnBCL@@QEAA@PEAV?$ArrayList@PEAV?$DictionaryEntry@PEAVCFileLocation@Mig@@PEAV12@@UnBCL@@@1@@Z

??0?$SmartPtr@V?$ArrayList@PEAV?$DictionaryEntry@PEAVCFileLocation@Mig@@PEAV12@@UnBCL@@@UnBCL@@@UnBCL@@QEAA@XZ

??0?$SmartPtr@VCLibrarian@Mig@@@UnBCL@@QEAA@AEBV01@@Z

??0?$SmartPtr@VCLibrarian@Mig@@@UnBCL@@QEAA@PEAVCLibrarian@Mig@@@Z

??0?$SmartPtr@VCLibrarian@Mig@@@UnBCL@@QEAA@XZ

??0?$SmartPtr@VSendState@Mig@@@UnBCL@@QEAA@AEBV01@@Z

??0?$SmartPtr@VSendState@Mig@@@UnBCL@@QEAA@PEAVSendState@Mig@@@Z

??0?$SmartPtr@VSendState@Mig@@@UnBCL@@QEAA@XZ

??0CAlternateStreamHolder@Mig@@QEAA@AEBV01@@Z

??0CAlternateStreamHolder@Mig@@QEAA@PEAVStream@UnBCL@@@Z

??0CAlternateStreamHolder@Mig@@QEAA@PEAVString@UnBCL@@@Z

??0CCatalog@Mig@@QEAA@AEBV01@@Z

??0CCatalog@Mig@@QEAA@PEAVString@UnBCL@@HHPEAV?$Array@PEAVString@UnBCL@@@3@HHH@Z

??0CCatalogEntry@Mig@@IEAA@XZ

??0CCatalogEntry@Mig@@QEAA@AEAV?$CBitVector2D@$01@1@PEAVString@UnBCL@@PEAUIMigLocation@1@22PEAVStream@4@PEAV?$Array@E@4@41PEAU?$IDictionary@PEAVString@UnBCL@@PEAVCAlternateStreamHolder@Mig@@@4@K@Z

??0CCatalogEntry@Mig@@QEAA@AEBV01@@Z

??0CCatalogLinearIterator@Mig@@AEAA@AEAVCCatalog@1@@Z

??0CCatalogLinearIterator@Mig@@QEAA@AEBV01@@Z

??0CCatalogNavigator@Mig@@IEAA@PEAUIMigLocation@1@PEAVString@UnBCL@@PEBVCCatalogTreeData@1@PEAV?$CTreeNode@VCCatalogTreeData@Mig@@@1@@Z

??0CCatalogNavigator@Mig@@QEAA@AEBV01@@Z

??0CCatalogUser@Mig@@QEAA@$$QEAV01@@Z

??0CCatalogUser@Mig@@QEAA@AEBV01@@Z

??0CCatalogUser@Mig@@QEAA@PEAVString@UnBCL@@@Z

??0CCatalogUser@Mig@@QEAA@XZ

??0CCatalogUserList@Mig@@QEAA@XZ

??0CConnectionPipeTransportStreamProxy@Mig@@IEAA@AEBV01@@Z

??0CConnectionPipeTransportStreamProxy@Mig@@QEAA@PEAVCConnectionPipeTransport@1@PEAVString@UnBCL@@1PEAVCFileSystemRootMapping@1@PEAVCDeviceProgressAdapter@1@PEAX@Z

??0CDeviceLockedObject@Mig@@IEAA@AEBV01@@Z

??0CDeviceLockedObject@Mig@@QEAA@PEAVString@UnBCL@@H@Z

??0CDeviceProgressAdapter@Mig@@QEAA@$$QEAV01@@Z

??0CDeviceProgressAdapter@Mig@@QEAA@AEBV01@@Z

??0CDeviceProgressAdapter@Mig@@QEAA@XZ

??0CExternalTransport@Mig@@QEAA@AEBV01@@Z

??0CExternalTransport@Mig@@QEAA@XZ

??0CExternalTransportInitializationData@Mig@@QEAA@$$QEAV01@@Z

??0CExternalTransportInitializationData@Mig@@QEAA@AEBV01@@Z

??0CExternalTransportInitializationData@Mig@@QEAA@PEAVCPlatform@1@PEAUIExternalStore@@PEAVString@UnBCL@@@Z

??0CExternalTransportStreamProxy@Mig@@IEAA@AEBV01@@Z

??0CExternalTransportStreamProxy@Mig@@QEAA@PEAVCExternalTransport@1@PEAUIExternalStore@@PEAVString@UnBCL@@PEAVCFileSystemRootMapping@1@PEAVCDeviceProgressAdapter@1@@Z

??0CHardLinkTransportStreamProxy@Mig@@IEAA@AEBV01@@Z

??0CHardLinkTransportStreamProxy@Mig@@QEAA@PEAVCUNCTransport@1@PEAVString@UnBCL@@1PEAVCFileSystemRootMapping@1@PEAVCDeviceProgressAdapter@1@@Z

??0CIMGTransport@Mig@@QEAA@AEBV01@@Z

??0CIMGTransport@Mig@@QEAA@XZ

??0CLibTransport@Mig@@QEAA@$$QEAV01@@Z

??0CLibTransport@Mig@@QEAA@AEBV01@@Z

??0CLibTransport@Mig@@QEAA@XZ

??0CLibTransportInitializationData@Mig@@QEAA@$$QEAV01@@Z

??0CLibTransportInitializationData@Mig@@QEAA@AEBV01@@Z

??0CLibTransportInitializationData@Mig@@QEAA@PEBG0PEAUITransportUI@@PEAUIMigStreamSizeRecorder@@@Z

??0CLibrarian@Mig@@QEAA@AEBV01@@Z

??0CLibrarian@Mig@@QEAA@PEAUITrimableStream@1@HH_K@Z

??0CLibrarian@Mig@@QEAA@PEAUITrimableStream@1@HH_KPEAH2@Z

??0CMediaManager@Mig@@QEAA@AEBV01@@Z

??0CMediaManager@Mig@@QEAA@PEAVCPlatform@1@@Z

??0CMediaManagerStreamProxy@Mig@@IEAA@AEBV01@@Z

??0CMediaManagerStreamProxy@Mig@@QEAA@PEAUIDevice@1@PEAVString@UnBCL@@PEAVCDeviceProgressAdapter@1@@Z

??0CNonTrimableFileStream@Mig@@QEAA@AEBV01@@Z

??0CNonTrimableFileStream@Mig@@QEAA@PEBVString@UnBCL@@W4FileMode@3@W4FileAccess@3@W4FileShare@3@KPEAUIDevice@1@@Z

??0CSimulationTableStream@@QEAA@AEBV0@@Z

??0CSimulationTableStream@@QEAA@PEAUIMigStreamSizeRecorder@@PEBG@Z

??0CSimulationTrimableStream@Mig@@QEAA@$$QEAV01@@Z

??0CSimulationTrimableStream@Mig@@QEAA@AEBV01@@Z

??0CSimulationTrimableStream@Mig@@QEAA@PEAUIMigStreamSizeRecorder@@@Z

??0CSplitFileStream@Mig@@QEAA@AEBV01@@Z

??0CSplitFileStream@Mig@@QEAA@PEAVString@UnBCL@@IP6AXPEAEIH@ZP6AH1IH@Z_JHPEAUIDevice@1@@Z

??0CUNCTransport@Mig@@QEAA@AEBV01@@Z

??0CUNCTransport@Mig@@QEAA@XZ

??0CUNCTransportInitializationData@Mig@@QEAA@$$QEAV01@@Z

??0CUNCTransportInitializationData@Mig@@QEAA@AEBV01@@Z

??0CUNCTransportInitializationData@Mig@@QEAA@PEBGPEAUIMigHardLinkPolicy@@PEAV?$ArrayList@G@UnBCL@@PEAVCPlatform@1@PEAUIMigStreamSizeRecorder@@@Z

??0IDevice@Mig@@QEAA@$$QEAU01@@Z

??0IDevice@Mig@@QEAA@AEBU01@@Z

??0IDevice@Mig@@QEAA@XZ

??0IDeviceInitializationData@Mig@@QEAA@$$QEAU01@@Z

??0IDeviceInitializationData@Mig@@QEAA@AEBU01@@Z

??0IDeviceInitializationData@Mig@@QEAA@XZ

??0IStoreInterface@Mig@@QEAA@$$QEAU01@@Z

??0IStoreInterface@Mig@@QEAA@AEBU01@@Z

??0IStoreInterface@Mig@@QEAA@XZ

??0ITrimableStream@Mig@@QEAA@$$QEAU01@@Z

??0ITrimableStream@Mig@@QEAA@AEBU01@@Z

??0ITrimableStream@Mig@@QEAA@XZ

??0SendState@Mig@@QEAA@$$QEAV01@@Z

??0SendState@Mig@@QEAA@AEBV01@@Z

??0SendState@Mig@@QEAA@XZ

??1?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@UEAA@XZ

??1?$Hashtable@IPEAUIDevice@Mig@@@UnBCL@@UEAA@XZ

??1?$ICollection@PEAVCCatalogUser@Mig@@@UnBCL@@UEAA@XZ

??1?$ICollection@V?$DictionaryEntry@IPEAUIDevice@Mig@@@UnBCL@@@UnBCL@@UEAA@XZ

??1?$IDictionary@IPEAUIDevice@Mig@@@UnBCL@@UEAA@XZ

??1?$IList@PEAVCCatalogUser@Mig@@@UnBCL@@UEAA@XZ

??1?$SerializableArrayListBase@PEAVCCatalogUser@Mig@@@_@UnBCL@@UEAA@XZ

??1?$SerializableBase@V?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@@_@UnBCL@@SAPEAUISerializable@4@XZ@2@@UnBCL@@UEAA@XZ

??1?$SerializableBase@VCCatalogEntry@Mig@@$0A@V?$DefaultInstanceFactory@VCCatalogEntry@Mig@@@UnBCL@@@UnBCL@@UEAA@XZ

??1?$SerializableBase@VCCatalogUser@Mig@@$0A@V?$DefaultInstanceFactory@VCCatalogUser@Mig@@@UnBCL@@@UnBCL@@UEAA@XZ

??1?$SerializableBase@VCCatalogUserList@Mig@@$0A@V?$DefaultInstanceFactory@VCCatalogUserList@Mig@@@UnBCL@@@UnBCL@@UEAA@XZ

??1?$SmartPtr@UITrimableStream@Mig@@@UnBCL@@UEAA@XZ

??1?$SmartPtr@V?$ArrayList@G@UnBCL@@@UnBCL@@UEAA@XZ

??1?$SmartPtr@V?$ArrayList@PEAV?$DictionaryEntry@PEAVCFileLocation@Mig@@PEAV12@@UnBCL@@@UnBCL@@@UnBCL@@UEAA@XZ

??1?$SmartPtr@VCLibrarian@Mig@@@UnBCL@@UEAA@XZ

??1?$SmartPtr@VSendState@Mig@@@UnBCL@@UEAA@XZ

??1CAlternateStreamHolder@Mig@@UEAA@XZ

??1CCatalog@Mig@@UEAA@XZ

??1CCatalogEntry@Mig@@UEAA@XZ

??1CCatalogLinearIterator@Mig@@UEAA@XZ

??1CCatalogNavigator@Mig@@UEAA@XZ

??1CCatalogUser@Mig@@UEAA@XZ

??1CCatalogUserList@Mig@@UEAA@XZ

??1CConnectionPipeTransportStreamProxy@Mig@@UEAA@XZ

??1CDeviceLockedObject@Mig@@UEAA@XZ

??1CDeviceProgressAdapter@Mig@@UEAA@XZ

??1CExternalTransport@Mig@@UEAA@XZ

??1CExternalTransportInitializationData@Mig@@UEAA@XZ

??1CExternalTransportStreamProxy@Mig@@UEAA@XZ

??1CHardLinkTransportStreamProxy@Mig@@UEAA@XZ

??1CIMGTransport@Mig@@UEAA@XZ

??1CLibTransport@Mig@@UEAA@XZ

??1CLibTransportInitializationData@Mig@@UEAA@XZ

??1CLibrarian@Mig@@UEAA@XZ

??1CMediaManager@Mig@@UEAA@XZ

??1CMediaManagerStreamProxy@Mig@@UEAA@XZ

??1CNonTrimableFileStream@Mig@@UEAA@XZ

??1CSimulationTableStream@@UEAA@XZ

??1CSimulationTrimableStream@Mig@@UEAA@XZ

??1CSplitFileStream@Mig@@UEAA@XZ

??1CUNCTransport@Mig@@UEAA@XZ

??1CUNCTransportInitializationData@Mig@@UEAA@XZ

??1IDevice@Mig@@UEAA@XZ

??1IDeviceInitializationData@Mig@@UEAA@XZ

??1IStoreInterface@Mig@@UEAA@XZ

??1ITrimableStream@Mig@@UEAA@XZ

??1SendState@Mig@@UEAA@XZ

??4?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@QEAAAEAV01@AEBV01@@Z

??4?$Hashtable@IPEAUIDevice@Mig@@@UnBCL@@QEAAAEAV01@AEBV01@@Z

??4?$ICollection@PEAVCCatalogUser@Mig@@@UnBCL@@QEAAAEAU01@$$QEAU01@@Z

??4?$ICollection@PEAVCCatalogUser@Mig@@@UnBCL@@QEAAAEAU01@AEBU01@@Z

??4?$ICollection@V?$DictionaryEntry@IPEAUIDevice@Mig@@@UnBCL@@@UnBCL@@QEAAAEAU01@$$QEAU01@@Z

??4?$ICollection@V?$DictionaryEntry@IPEAUIDevice@Mig@@@UnBCL@@@UnBCL@@QEAAAEAU01@AEBU01@@Z

??4?$IDictionary@IPEAUIDevice@Mig@@@UnBCL@@QEAAAEAU01@$$QEAU01@@Z

??4?$IDictionary@IPEAUIDevice@Mig@@@UnBCL@@QEAAAEAU01@AEBU01@@Z

??4?$IEnumerable@PEAVCCatalogUser@Mig@@@UnBCL@@QEAAAEAU01@$$QEAU01@@Z

??4?$IEnumerable@PEAVCCatalogUser@Mig@@@UnBCL@@QEAAAEAU01@AEBU01@@Z

??4?$IEnumerable@V?$DictionaryEntry@IPEAUIDevice@Mig@@@UnBCL@@@UnBCL@@QEAAAEAU01@$$QEAU01@@Z

??4?$IEnumerable@V?$DictionaryEntry@IPEAUIDevice@Mig@@@UnBCL@@@UnBCL@@QEAAAEAU01@AEBU01@@Z

??4?$IList@PEAVCCatalogUser@Mig@@@UnBCL@@QEAAAEAU01@$$QEAU01@@Z

??4?$IList@PEAVCCatalogUser@Mig@@@UnBCL@@QEAAAEAU01@AEBU01@@Z

??4?$SerializableArrayListBase@PEAVCCatalogUser@Mig@@@_@UnBCL@@QEAAAEAV012@$$QEAV012@@Z

??4?$SerializableArrayListBase@PEAVCCatalogUser@Mig@@@_@UnBCL@@QEAAAEAV012@AEBV012@@Z

??4?$SerializableBase@V?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@@_@UnBCL@@SAPEAUISerializable@4@XZ@2@@UnBCL@@QEAAAEAV01@$$QEAV01@@Z

??4?$SerializableBase@V?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@@_@UnBCL@@SAPEAUISerializable@4@XZ@2@@UnBCL@@QEAAAEAV01@AEBV01@@Z

??4?$SerializableBase@VCCatalogEntry@Mig@@$0A@V?$DefaultInstanceFactory@VCCatalogEntry@Mig@@@UnBCL@@@UnBCL@@QEAAAEAV01@$$QEAV01@@Z

??4?$SerializableBase@VCCatalogEntry@Mig@@$0A@V?$DefaultInstanceFactory@VCCatalogEntry@Mig@@@UnBCL@@@UnBCL@@QEAAAEAV01@AEBV01@@Z

??4?$SerializableBase@VCCatalogUser@Mig@@$0A@V?$DefaultInstanceFactory@VCCatalogUser@Mig@@@UnBCL@@@UnBCL@@QEAAAEAV01@$$QEAV01@@Z

??4?$SerializableBase@VCCatalogUser@Mig@@$0A@V?$DefaultInstanceFactory@VCCatalogUser@Mig@@@UnBCL@@@UnBCL@@QEAAAEAV01@AEBV01@@Z

??4?$SerializableBase@VCCatalogUserList@Mig@@$0A@V?$DefaultInstanceFactory@VCCatalogUserList@Mig@@@UnBCL@@@UnBCL@@QEAAAEAV01@$$QEAV01@@Z

??4?$SerializableBase@VCCatalogUserList@Mig@@$0A@V?$DefaultInstanceFactory@VCCatalogUserList@Mig@@@UnBCL@@@UnBCL@@QEAAAEAV01@AEBV01@@Z

??4?$SmartPtr@UITrimableStream@Mig@@@UnBCL@@QEAAAEAV01@AEBV01@@Z

??4?$SmartPtr@V?$ArrayList@G@UnBCL@@@UnBCL@@QEAAAEAV01@AEBV01@@Z

??4?$SmartPtr@V?$ArrayList@PEAV?$DictionaryEntry@PEAVCFileLocation@Mig@@PEAV12@@UnBCL@@@UnBCL@@@UnBCL@@QEAAAEAV01@AEBV01@@Z

??4?$SmartPtr@VCLibrarian@Mig@@@UnBCL@@QEAAAEAV01@AEBV01@@Z

??4?$SmartPtr@VSendState@Mig@@@UnBCL@@QEAAAEAV01@AEBV01@@Z

??4CAlternateStreamHolder@Mig@@QEAAAEAV01@AEBV01@@Z

??4CCatalog@Mig@@QEAAAEAV01@AEBV01@@Z

??4CCatalogEntry@Mig@@QEAAAEAV01@AEBV01@@Z

??4CCatalogNavigator@Mig@@QEAAAEAV01@AEBV01@@Z

??4CCatalogUser@Mig@@QEAAAEAV01@$$QEAV01@@Z

??4CCatalogUser@Mig@@QEAAAEAV01@AEBV01@@Z

??4CCatalogUserList@Mig@@QEAAAEAV01@$$QEAV01@@Z

??4CCatalogUserList@Mig@@QEAAAEAV01@AEBV01@@Z

??4CConnectionPipeTransportStreamProxy@Mig@@QEAAAEAV01@AEBV01@@Z

??4CDeviceLockedObject@Mig@@QEAAAEAV01@AEBV01@@Z

??4CDeviceProgressAdapter@Mig@@QEAAAEAV01@$$QEAV01@@Z

??4CDeviceProgressAdapter@Mig@@QEAAAEAV01@AEBV01@@Z

??4CExternalTransport@Mig@@QEAAAEAV01@AEBV01@@Z

??4CExternalTransportInitializationData@Mig@@QEAAAEAV01@$$QEAV01@@Z

??4CExternalTransportInitializationData@Mig@@QEAAAEAV01@AEBV01@@Z

??4CExternalTransportStreamProxy@Mig@@QEAAAEAV01@AEBV01@@Z

??4CHardLinkTransportStreamProxy@Mig@@QEAAAEAV01@AEBV01@@Z

??4CIMGTransport@Mig@@QEAAAEAV01@AEBV01@@Z

??4CLibTransport@Mig@@QEAAAEAV01@$$QEAV01@@Z

??4CLibTransport@Mig@@QEAAAEAV01@AEBV01@@Z

??4CLibTransportInitializationData@Mig@@QEAAAEAV01@$$QEAV01@@Z

??4CLibTransportInitializationData@Mig@@QEAAAEAV01@AEBV01@@Z

??4CLibrarian@Mig@@QEAAAEAV01@AEBV01@@Z

??4CMediaManager@Mig@@QEAAAEAV01@AEBV01@@Z

??4CMediaManagerStreamProxy@Mig@@QEAAAEAV01@AEBV01@@Z

??4CNonTrimableFileStream@Mig@@QEAAAEAV01@AEBV01@@Z

??4CSimulationTableStream@@QEAAAEAV0@AEBV0@@Z

??4CSimulationTrimableStream@Mig@@QEAAAEAV01@$$QEAV01@@Z

??4CSimulationTrimableStream@Mig@@QEAAAEAV01@AEBV01@@Z

??4CSplitFileStream@Mig@@QEAAAEAV01@AEBV01@@Z

??4CUNCTransport@Mig@@QEAAAEAV01@AEBV01@@Z

??4CUNCTransportInitializationData@Mig@@QEAAAEAV01@$$QEAV01@@Z

??4CUNCTransportInitializationData@Mig@@QEAAAEAV01@AEBV01@@Z

??4IDevice@Mig@@QEAAAEAU01@$$QEAU01@@Z

??4IDevice@Mig@@QEAAAEAU01@AEBU01@@Z

??4IDeviceInitializationData@Mig@@QEAAAEAU01@$$QEAU01@@Z

??4IDeviceInitializationData@Mig@@QEAAAEAU01@AEBU01@@Z

??4IStoreInterface@Mig@@QEAAAEAU01@$$QEAU01@@Z

??4IStoreInterface@Mig@@QEAAAEAU01@AEBU01@@Z

??4ITrimableStream@Mig@@QEAAAEAU01@$$QEAU01@@Z

??4ITrimableStream@Mig@@QEAAAEAU01@AEBU01@@Z

??4SendState@Mig@@QEAAAEAV01@$$QEAV01@@Z

??4SendState@Mig@@QEAAAEAV01@AEBV01@@Z

??7?$SmartPtr@UITrimableStream@Mig@@@UnBCL@@QEBA_NXZ

??7?$SmartPtr@V?$ArrayList@G@UnBCL@@@UnBCL@@QEBA_NXZ

??7?$SmartPtr@V?$ArrayList@PEAV?$DictionaryEntry@PEAVCFileLocation@Mig@@PEAV12@@UnBCL@@@UnBCL@@@UnBCL@@QEBA_NXZ

??7?$SmartPtr@VCLibrarian@Mig@@@UnBCL@@QEBA_NXZ

??7?$SmartPtr@VSendState@Mig@@@UnBCL@@QEBA_NXZ

??B?$SmartPtr@UITrimableStream@Mig@@@UnBCL@@QEBAPEAVNullTest@01@XZ

??B?$SmartPtr@V?$ArrayList@G@UnBCL@@@UnBCL@@QEBAPEAVNullTest@01@XZ

??B?$SmartPtr@V?$ArrayList@PEAV?$DictionaryEntry@PEAVCFileLocation@Mig@@PEAV12@@UnBCL@@@UnBCL@@@UnBCL@@QEBAPEAVNullTest@01@XZ

??B?$SmartPtr@VCLibrarian@Mig@@@UnBCL@@QEBAPEAVNullTest@01@XZ

??B?$SmartPtr@VSendState@Mig@@@UnBCL@@QEBAPEAVNullTest@01@XZ

??C?$SmartPtr@UITrimableStream@Mig@@@UnBCL@@QEBAPEAUITrimableStream@Mig@@XZ

??C?$SmartPtr@V?$ArrayList@G@UnBCL@@@UnBCL@@QEBAPEAV?$ArrayList@G@1@XZ

??C?$SmartPtr@V?$ArrayList@PEAV?$DictionaryEntry@PEAVCFileLocation@Mig@@PEAV12@@UnBCL@@@UnBCL@@@UnBCL@@QEBAPEAV?$ArrayList@PEAV?$DictionaryEntry@PEAVCFileLocation@Mig@@PEAV12@@UnBCL@@@1@XZ

??C?$SmartPtr@VCLibrarian@Mig@@@UnBCL@@QEBAPEAVCLibrarian@Mig@@XZ

??C?$SmartPtr@VSendState@Mig@@@UnBCL@@QEBAPEAVSendState@Mig@@XZ

??D?$SmartPtr@UITrimableStream@Mig@@@UnBCL@@QEBAAEAUITrimableStream@Mig@@XZ

??D?$SmartPtr@V?$ArrayList@G@UnBCL@@@UnBCL@@QEBAAEAV?$ArrayList@G@1@XZ

??D?$SmartPtr@V?$ArrayList@PEAV?$DictionaryEntry@PEAVCFileLocation@Mig@@PEAV12@@UnBCL@@@UnBCL@@@UnBCL@@QEBAAEAV?$ArrayList@PEAV?$DictionaryEntry@PEAVCFileLocation@Mig@@PEAV12@@UnBCL@@@1@XZ

??D?$SmartPtr@VCLibrarian@Mig@@@UnBCL@@QEBAAEAVCLibrarian@Mig@@XZ

??D?$SmartPtr@VSendState@Mig@@@UnBCL@@QEBAAEAVSendState@Mig@@XZ

??_7?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@6B01@@

??_7?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@6B?$ICollection@PEAVCCatalogUser@Mig@@@1@@

??_7?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@6B?$IEnumerable@PEAVCCatalogUser@Mig@@@1@@

??_7?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@6B?$IList@PEAVCCatalogUser@Mig@@@1@@

??_7?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@6B?$SerializableBase@V?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@@_@UnBCL@@SAPEAUISerializable@4@XZ@2@@1@@

??_7?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@6BISerializable@1@@

??_7?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@6BObject@1@@

??_7?$Hashtable@IPEAUIDevice@Mig@@@UnBCL@@6B01@@

??_7?$Hashtable@IPEAUIDevice@Mig@@@UnBCL@@6B?$ICollection@V?$DictionaryEntry@IPEAUIDevice@Mig@@@UnBCL@@@1@@

??_7?$Hashtable@IPEAUIDevice@Mig@@@UnBCL@@6B?$IDictionary@IPEAUIDevice@Mig@@@1@@

??_7?$Hashtable@IPEAUIDevice@Mig@@@UnBCL@@6B?$IEnumerable@V?$DictionaryEntry@IPEAUIDevice@Mig@@@UnBCL@@@1@@

??_7?$Hashtable@IPEAUIDevice@Mig@@@UnBCL@@6BObject@1@@

??_7?$SerializableArrayListBase@PEAVCCatalogUser@Mig@@@_@UnBCL@@6B?$ICollection@PEAVCCatalogUser@Mig@@@2@@

??_7?$SerializableArrayListBase@PEAVCCatalogUser@Mig@@@_@UnBCL@@6B?$IEnumerable@PEAVCCatalogUser@Mig@@@2@@

??_7?$SerializableArrayListBase@PEAVCCatalogUser@Mig@@@_@UnBCL@@6B?$IList@PEAVCCatalogUser@Mig@@@2@@

??_7?$SerializableArrayListBase@PEAVCCatalogUser@Mig@@@_@UnBCL@@6B?$SerializableBase@V?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@@_@UnBCL@@SAPEAUISerializable@4@XZ@2@@2@@

??_7?$SerializableArrayListBase@PEAVCCatalogUser@Mig@@@_@UnBCL@@6BISerializable@2@@

??_7?$SerializableArrayListBase@PEAVCCatalogUser@Mig@@@_@UnBCL@@6BObject@2@@

??_7?$SerializableBase@V?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@@_@UnBCL@@SAPEAUISerializable@4@XZ@2@@UnBCL@@6B01@@

??_7?$SerializableBase@V?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@@_@UnBCL@@SAPEAUISerializable@4@XZ@2@@UnBCL@@6BISerializable@1@@

??_7?$SerializableBase@V?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@@_@UnBCL@@SAPEAUISerializable@4@XZ@2@@UnBCL@@6BObject@1@@

??_7?$SerializableBase@VCCatalogEntry@Mig@@$0A@V?$DefaultInstanceFactory@VCCatalogEntry@Mig@@@UnBCL@@@UnBCL@@6B01@@

??_7?$SerializableBase@VCCatalogEntry@Mig@@$0A@V?$DefaultInstanceFactory@VCCatalogEntry@Mig@@@UnBCL@@@UnBCL@@6BISerializable@1@@

??_7?$SerializableBase@VCCatalogEntry@Mig@@$0A@V?$DefaultInstanceFactory@VCCatalogEntry@Mig@@@UnBCL@@@UnBCL@@6BObject@1@@

??_7?$SerializableBase@VCCatalogUser@Mig@@$0A@V?$DefaultInstanceFactory@VCCatalogUser@Mig@@@UnBCL@@@UnBCL@@6B01@@

??_7?$SerializableBase@VCCatalogUser@Mig@@$0A@V?$DefaultInstanceFactory@VCCatalogUser@Mig@@@UnBCL@@@UnBCL@@6BISerializable@1@@

??_7?$SerializableBase@VCCatalogUser@Mig@@$0A@V?$DefaultInstanceFactory@VCCatalogUser@Mig@@@UnBCL@@@UnBCL@@6BObject@1@@

??_7?$SerializableBase@VCCatalogUserList@Mig@@$0A@V?$DefaultInstanceFactory@VCCatalogUserList@Mig@@@UnBCL@@@UnBCL@@6B01@@

??_7?$SerializableBase@VCCatalogUserList@Mig@@$0A@V?$DefaultInstanceFactory@VCCatalogUserList@Mig@@@UnBCL@@@UnBCL@@6BISerializable@1@@

??_7?$SerializableBase@VCCatalogUserList@Mig@@$0A@V?$DefaultInstanceFactory@VCCatalogUserList@Mig@@@UnBCL@@@UnBCL@@6BObject@1@@

??_7?$SmartPtr@UITrimableStream@Mig@@@UnBCL@@6B@

??_7?$SmartPtr@V?$ArrayList@G@UnBCL@@@UnBCL@@6B@

??_7?$SmartPtr@V?$ArrayList@PEAV?$DictionaryEntry@PEAVCFileLocation@Mig@@PEAV12@@UnBCL@@@UnBCL@@@UnBCL@@6B@

??_7?$SmartPtr@VCLibrarian@Mig@@@UnBCL@@6B@

??_7?$SmartPtr@VSendState@Mig@@@UnBCL@@6B@

??_7CAlternateStreamHolder@Mig@@6B@

??_7CCatalog@Mig@@6B@

??_7CCatalogEntry@Mig@@6B?$SerializableBase@VCCatalogEntry@Mig@@$0A@V?$DefaultInstanceFactory@VCCatalogEntry@Mig@@@UnBCL@@@UnBCL@@@

??_7CCatalogEntry@Mig@@6B@

??_7CCatalogEntry@Mig@@6BISerializable@UnBCL@@@

??_7CCatalogLinearIterator@Mig@@6B@

??_7CCatalogNavigator@Mig@@6B@

??_7CCatalogNavigator@Mig@@6BIDataStoreNavigator@1@@

??_7CCatalogUser@Mig@@6B?$SerializableBase@VCCatalogUser@Mig@@$0A@V?$DefaultInstanceFactory@VCCatalogUser@Mig@@@UnBCL@@@UnBCL@@@

??_7CCatalogUser@Mig@@6B@

??_7CCatalogUser@Mig@@6BISerializable@UnBCL@@@

??_7CCatalogUserList@Mig@@6B?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@@

??_7CCatalogUserList@Mig@@6B?$ICollection@PEAVCCatalogUser@Mig@@@UnBCL@@@

??_7CCatalogUserList@Mig@@6B?$IEnumerable@PEAVCCatalogUser@Mig@@@UnBCL@@@

??_7CCatalogUserList@Mig@@6B?$IList@PEAVCCatalogUser@Mig@@@UnBCL@@@

??_7CCatalogUserList@Mig@@6B?$SerializableBase@V?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@@_@UnBCL@@SAPEAUISerializable@4@XZ@2@@UnBCL@@@

??_7CCatalogUserList@Mig@@6B?$SerializableBase@VCCatalogUserList@Mig@@$0A@V?$DefaultInstanceFactory@VCCatalogUserList@Mig@@@UnBCL@@@UnBCL@@@

??_7CCatalogUserList@Mig@@6BISerializable@UnBCL@@@

??_7CCatalogUserList@Mig@@6BObject@UnBCL@@@

??_7CConnectionPipeTransportStreamProxy@Mig@@6B@

??_7CConnectionPipeTransportStreamProxy@Mig@@6BIFileStreamProxy@1@@

??_7CConnectionPipeTransportStreamProxy@Mig@@6BIOptimizedFileStreamProxy@1@@

??_7CConnectionPipeTransportStreamProxy@Mig@@6BIStreamProxy@1@@

??_7CConnectionPipeTransportStreamProxy@Mig@@6BObject@UnBCL@@@

??_7CDeviceLockedObject@Mig@@6B@

??_7CDeviceProgressAdapter@Mig@@6B@

??_7CExternalTransport@Mig@@6B@

??_7CExternalTransportInitializationData@Mig@@6B@

??_7CExternalTransportStreamProxy@Mig@@6B@

??_7CExternalTransportStreamProxy@Mig@@6BIFileStreamProxy@1@@

??_7CExternalTransportStreamProxy@Mig@@6BIOptimizedFileStreamProxy@1@@

??_7CExternalTransportStreamProxy@Mig@@6BIStreamProxy@1@@

??_7CExternalTransportStreamProxy@Mig@@6BObject@UnBCL@@@

??_7CHardLinkTransportStreamProxy@Mig@@6B@

??_7CHardLinkTransportStreamProxy@Mig@@6BIFileStreamProxy@1@@

??_7CHardLinkTransportStreamProxy@Mig@@6BIOptimizedFileStreamProxy@1@@

??_7CHardLinkTransportStreamProxy@Mig@@6BIStreamProxy@1@@

??_7CHardLinkTransportStreamProxy@Mig@@6BObject@UnBCL@@@

??_7CIMGTransport@Mig@@6B@

??_7CLibTransport@Mig@@6B@

??_7CLibTransportInitializationData@Mig@@6B@

??_7CLibrarian@Mig@@6B@

??_7CMediaManager@Mig@@6B@

??_7CMediaManager@Mig@@6BIStoreInterface@1@@

??_7CMediaManagerStreamProxy@Mig@@6B@

??_7CMediaManagerStreamProxy@Mig@@6BIFileStreamProxy@1@@

??_7CMediaManagerStreamProxy@Mig@@6BIOptimizedFileStreamProxy@1@@

??_7CMediaManagerStreamProxy@Mig@@6BIStreamProxy@1@@

??_7CMediaManagerStreamProxy@Mig@@6BObject@UnBCL@@@

??_7CNonTrimableFileStream@Mig@@6BIDisposable@UnBCL@@@

??_7CNonTrimableFileStream@Mig@@6BObject@UnBCL@@@

??_7CNonTrimableFileStream@Mig@@6BStream@UnBCL@@@

??_7CSimulationTableStream@@6BIDisposable@UnBCL@@@

??_7CSimulationTableStream@@6BObject@UnBCL@@@

??_7CSimulationTableStream@@6BStream@UnBCL@@@

??_7CSimulationTrimableStream@Mig@@6BIDisposable@UnBCL@@@

??_7CSimulationTrimableStream@Mig@@6BObject@UnBCL@@@

??_7CSimulationTrimableStream@Mig@@6BStream@UnBCL@@@

??_7CSplitFileStream@Mig@@6BIDisposable@UnBCL@@@

??_7CSplitFileStream@Mig@@6BObject@UnBCL@@@

??_7CSplitFileStream@Mig@@6BStream@UnBCL@@@

??_7CUNCTransport@Mig@@6B@

??_7CUNCTransportInitializationData@Mig@@6B@

??_7SendState@Mig@@6B@

??_8?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@7B?$ICollection@PEAVCCatalogUser@Mig@@@1@@

??_8?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@7B?$IList@PEAVCCatalogUser@Mig@@@1@@

??_8?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@7B?$SerializableArrayListBase@PEAVCCatalogUser@Mig@@@_@1@@

??_8?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@7B?$SerializableBase@V?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@@_@UnBCL@@SAPEAUISerializable@4@XZ@2@@1@@

??_8?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@7B@

??_8?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@7BISerializable@1@@

??_8?$Hashtable@IPEAUIDevice@Mig@@@UnBCL@@7B?$ICollection@V?$DictionaryEntry@IPEAUIDevice@Mig@@@UnBCL@@@1@@

??_8?$Hashtable@IPEAUIDevice@Mig@@@UnBCL@@7B?$IDictionary@IPEAUIDevice@Mig@@@1@@

??_8?$Hashtable@IPEAUIDevice@Mig@@@UnBCL@@7B@

??_8CCatalogEntry@Mig@@7B01@@

??_8CCatalogEntry@Mig@@7B?$SerializableBase@VCCatalogEntry@Mig@@$0A@V?$DefaultInstanceFactory@VCCatalogEntry@Mig@@@UnBCL@@@UnBCL@@@

??_8CCatalogEntry@Mig@@7BISerializable@UnBCL@@@

??_8CCatalogNavigator@Mig@@7B01@@

??_8CCatalogNavigator@Mig@@7BIDataStoreNavigator@1@@

??_8CCatalogUser@Mig@@7B?$SerializableBase@VCCatalogUser@Mig@@$0A@V?$DefaultInstanceFactory@VCCatalogUser@Mig@@@UnBCL@@@UnBCL@@@

??_8CCatalogUser@Mig@@7B@

??_8CCatalogUser@Mig@@7BISerializable@UnBCL@@@

??_8CCatalogUserList@Mig@@7B01@@

??_8CCatalogUserList@Mig@@7B?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@@

??_8CCatalogUserList@Mig@@7B?$ICollection@PEAVCCatalogUser@Mig@@@UnBCL@@@

??_8CCatalogUserList@Mig@@7B?$IList@PEAVCCatalogUser@Mig@@@UnBCL@@@

??_8CCatalogUserList@Mig@@7B?$SerializableArrayListBase@PEAVCCatalogUser@Mig@@@_@UnBCL@@@

??_8CCatalogUserList@Mig@@7B?$SerializableBase@V?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@$0A@V?$SimpleInstanceFactory@$1?OperatorNew@?$StaticOps@V?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@@_@UnBCL@@SAPEAUISerializable@4@XZ@2@@UnBCL@@@

??_8CCatalogUserList@Mig@@7B?$SerializableBase@VCCatalogUserList@Mig@@$0A@V?$DefaultInstanceFactory@VCCatalogUserList@Mig@@@UnBCL@@@UnBCL@@@

??_8CCatalogUserList@Mig@@7BISerializable@UnBCL@@@

??_8CConnectionPipeTransportStreamProxy@Mig@@7B@

??_8CConnectionPipeTransportStreamProxy@Mig@@7BCMediaManagerStreamProxy@1@@

??_8CConnectionPipeTransportStreamProxy@Mig@@7BIFileStreamProxy@1@@

??_8CConnectionPipeTransportStreamProxy@Mig@@7BIOptimizedFileStreamProxy@1@@

??_8CConnectionPipeTransportStreamProxy@Mig@@7BIStreamProxy@1@@

??_8CExternalTransportStreamProxy@Mig@@7B@

??_8CExternalTransportStreamProxy@Mig@@7BCMediaManagerStreamProxy@1@@

??_8CExternalTransportStreamProxy@Mig@@7BIFileStreamProxy@1@@

??_8CExternalTransportStreamProxy@Mig@@7BIOptimizedFileStreamProxy@1@@

??_8CExternalTransportStreamProxy@Mig@@7BIStreamProxy@1@@

??_8CHardLinkTransportStreamProxy@Mig@@7B@

??_8CHardLinkTransportStreamProxy@Mig@@7BCMediaManagerStreamProxy@1@@

??_8CHardLinkTransportStreamProxy@Mig@@7BIFileStreamProxy@1@@

??_8CHardLinkTransportStreamProxy@Mig@@7BIOptimizedFileStreamProxy@1@@

??_8CHardLinkTransportStreamProxy@Mig@@7BIStreamProxy@1@@

??_8CMediaManager@Mig@@7B01@@

??_8CMediaManager@Mig@@7BIStoreInterface@1@@

??_8CMediaManagerStreamProxy@Mig@@7B01@@

??_8CMediaManagerStreamProxy@Mig@@7BIFileStreamProxy@1@@

??_8CMediaManagerStreamProxy@Mig@@7BIOptimizedFileStreamProxy@1@@

??_8CMediaManagerStreamProxy@Mig@@7BIStreamProxy@1@@

??_8CNonTrimableFileStream@Mig@@7BIDisposable@UnBCL@@@

??_8CNonTrimableFileStream@Mig@@7BStream@UnBCL@@@

??_8CSimulationTableStream@@7BIDisposable@UnBCL@@@

??_8CSimulationTableStream@@7BStream@UnBCL@@@

??_8CSimulationTrimableStream@Mig@@7BIDisposable@UnBCL@@@

??_8CSimulationTrimableStream@Mig@@7BStream@UnBCL@@@

??_8CSplitFileStream@Mig@@7BIDisposable@UnBCL@@@

??_8CSplitFileStream@Mig@@7BStream@UnBCL@@@

??_D?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@QEAAXXZ

??_D?$Hashtable@IPEAUIDevice@Mig@@@UnBCL@@QEAAXXZ

??_DCCatalogEntry@Mig@@QEAAXXZ

??_DCCatalogNavigator@Mig@@QEAAXXZ

??_DCCatalogUser@Mig@@QEAAXXZ

??_DCCatalogUserList@Mig@@QEAAXXZ

??_DCConnectionPipeTransportStreamProxy@Mig@@QEAAXXZ

??_DCExternalTransportStreamProxy@Mig@@QEAAXXZ

??_DCHardLinkTransportStreamProxy@Mig@@QEAAXXZ

??_DCMediaManager@Mig@@QEAAXXZ

??_DCMediaManagerStreamProxy@Mig@@QEAAXXZ

??_DCNonTrimableFileStream@Mig@@QEAAXXZ

??_DCSimulationTableStream@@QEAAXXZ

??_DCSimulationTrimableStream@Mig@@QEAAXXZ

??_DCSplitFileStream@Mig@@QEAAXXZ

?AbandonCommited@CNonTrimableFileStream@Mig@@UEAAXXZ

?AbandonCommited@CSimulationTrimableStream@Mig@@UEAAXXZ

?AbandonCommited@CSplitFileStream@Mig@@UEAAXXZ

?Add@?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@UEAAHPEAVCCatalogUser@Mig@@@Z

?Add@?$Hashtable@IPEAUIDevice@Mig@@@UnBCL@@UEAAXIPEAUIDevice@Mig@@@Z

?AddComplexNode@CCatalog@Mig@@AEAAXPEAPEAV?$CTreeNode@VCCatalogTreeData@Mig@@@2@0PEAVString@UnBCL@@PEAUIMigLocation@2@2@Z

?AddDictionary@?$Hashtable@IPEAUIDevice@Mig@@@UnBCL@@AEAAXPEBU?$IDictionary@IPEAUIDevice@Mig@@@2@@Z

?AddNonExistEntry@CCatalog@Mig@@QEAAHW4CatalogNamespace@2@PEAVString@UnBCL@@PEAUIMigLocation@2@@Z

?AddObject@CCatalog@Mig@@QEAAHW4CatalogNamespace@2@PEAVString@UnBCL@@PEAUIMigLocation@2@22PEAVStream@5@PEAV?$Array@E@5@41KPEAU?$IDictionary@PEAVString@UnBCL@@PEAVCAlternateStreamHolder@Mig@@@5@@Z

?AddObject@CLibrarian@Mig@@QEAAXPEAVStream@UnBCL@@PEAVString@4@PEAUILocalProgress@@PEA_J@Z

?AddObject@CMediaManager@Mig@@UEAAXPEAVCUserContext@2@PEAVCFileSystemRootMapping@2@PEAVCDataUnit@2@PEAUIMigLocation@2@3PEAUILocalProgress@@HH@Z

?AddObjectNode@CCatalog@Mig@@AEAAPEAV?$CTreeNode@VCCatalogTreeData@Mig@@@2@PEAVString@UnBCL@@PEAUIMigLocation@2@@Z

?AddObjectToUserView@CCatalog@Mig@@QEAAHW4CatalogNamespace@2@PEAVString@UnBCL@@PEAUIMigLocation@2@@Z

?AddRange@?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@UEAAXPEBU?$ICollection@PEAVCCatalogUser@Mig@@@2@@Z

?Assign@?$SmartPtr@UITrimableStream@Mig@@@UnBCL@@AEAAXAEBV12@@Z

?Assign@?$SmartPtr@UITrimableStream@Mig@@@UnBCL@@AEAAXPEAUITrimableStream@Mig@@@Z

?Assign@?$SmartPtr@V?$ArrayList@G@UnBCL@@@UnBCL@@AEAAXAEBV12@@Z

?Assign@?$SmartPtr@V?$ArrayList@G@UnBCL@@@UnBCL@@AEAAXPEAV?$ArrayList@G@2@@Z

?Assign@?$SmartPtr@V?$ArrayList@PEAV?$DictionaryEntry@PEAVCFileLocation@Mig@@PEAV12@@UnBCL@@@UnBCL@@@UnBCL@@AEAAXAEBV12@@Z

?Assign@?$SmartPtr@V?$ArrayList@PEAV?$DictionaryEntry@PEAVCFileLocation@Mig@@PEAV12@@UnBCL@@@UnBCL@@@UnBCL@@AEAAXPEAV?$ArrayList@PEAV?$DictionaryEntry@PEAVCFileLocation@Mig@@PEAV12@@UnBCL@@@2@@Z

?Assign@?$SmartPtr@VCLibrarian@Mig@@@UnBCL@@AEAAXAEBV12@@Z

?Assign@?$SmartPtr@VCLibrarian@Mig@@@UnBCL@@AEAAXPEAVCLibrarian@Mig@@@Z

?Assign@?$SmartPtr@VSendState@Mig@@@UnBCL@@AEAAXAEBV12@@Z

?Assign@?$SmartPtr@VSendState@Mig@@@UnBCL@@AEAAXPEAVSendState@Mig@@@Z

?BeginContext@CDeviceProgressAdapter@Mig@@UEAAXPEAVString@UnBCL@@@Z

?BeginMigrationUnit@CDeviceProgressAdapter@Mig@@UEAAXPEAUIMigUnit@@W4EXECUTION_PHASE@@@Z

?BinarySearch@?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@AEAAHHHPEAVCCatalogUser@Mig@@PEAU?$IComparer@PEAVCCatalogUser@Mig@@@2@@Z

?BinarySearch@?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@SAHPEAV12@PEAVCCatalogUser@Mig@@PEAU?$IComparer@PEAVCCatalogUser@Mig@@@2@@Z

?BinarySearch@?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@UEAAHPEAVCCatalogUser@Mig@@PEAU?$IComparer@PEAVCCatalogUser@Mig@@@2@@Z

?BuildObjectFilePath@CUNCTransport@Mig@@IEAAPEAVString@UnBCL@@PEBGGG@Z

?BuildObjectFilePath@CUNCTransport@Mig@@IEAAPEAVString@UnBCL@@PEBGHPEAPEAV34@@Z

?BuildSearchTree@CCatalog@Mig@@AEAAXT_ULARGE_INTEGER@@HPEAVString@UnBCL@@@Z

?BuildUserMap@CCatalog@Mig@@AEAAXPEAV?$ArrayList@PEAVString@UnBCL@@@UnBCL@@@Z

?BuildUserMap@CCatalog@Mig@@AEAAXPEAVCCatalogUserList@2@@Z

?CanCreateFile@CConnectionPipeTransportStreamProxy@Mig@@UEAAHXZ

?CanCreateFile@CExternalTransportStreamProxy@Mig@@UEAAHXZ

?CanCreateFile@CHardLinkTransportStreamProxy@Mig@@UEAAHXZ

?CheckForDeviceErrors@CNonTrimableFileStream@Mig@@IEBAXPEAVException@UnBCL@@@Z

?CheckForDeviceErrors@CSplitFileStream@Mig@@IEBAXPEAVException@UnBCL@@@Z

?Clear@?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@UEAAXXZ

?Clear@?$Hashtable@IPEAUIDevice@Mig@@@UnBCL@@UEAAXXZ

?Clone@?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@UEBAPEAVObject@2@XZ

?Clone@?$Hashtable@IPEAUIDevice@Mig@@@UnBCL@@UEBAPEAVObject@2@XZ

?Clone@CConnectionPipeTransportStreamProxy@Mig@@UEBAPEAVObject@UnBCL@@XZ

?Clone@CDeviceLockedObject@Mig@@UEBAPEAVObject@UnBCL@@XZ

?Clone@CExternalTransportStreamProxy@Mig@@UEBAPEAVObject@UnBCL@@XZ

?Clone@CHardLinkTransportStreamProxy@Mig@@UEBAPEAVObject@UnBCL@@XZ

?Clone@CMediaManagerStreamProxy@Mig@@UEBAPEAVObject@UnBCL@@XZ

?Close@CExternalTransport@Mig@@UEAAXH@Z

?Close@CIMGTransport@Mig@@UEAAXH@Z

?Close@CLibTransport@Mig@@UEAAXH@Z

?Close@CLibrarian@Mig@@QEAAXH@Z

?Close@CNonTrimableFileStream@Mig@@UEAAXXZ

?Close@CSimulationTableStream@@UEAAXXZ

?Close@CSimulationTrimableStream@Mig@@UEAAXXZ

?Close@CSplitFileStream@Mig@@UEAAXXZ

?Close@CUNCTransport@Mig@@UEAAXH@Z

?CloseTransport@CMediaManager@Mig@@UEAAXH@Z

?Commit@CNonTrimableFileStream@Mig@@UEAAX_J@Z

?Commit@CSimulationTrimableStream@Mig@@UEAAX_J@Z

?Commit@CSplitFileStream@Mig@@UEAAX_J@Z

?CompressAndEncryptBuffer@CLibrarian@Mig@@IEAAXKH@Z

?Contains@?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@UEBAHQEAVCCatalogUser@Mig@@@Z

?Contains@?$Hashtable@IPEAUIDevice@Mig@@@UnBCL@@UEBAHI@Z

?ContainsKey@?$Hashtable@IPEAUIDevice@Mig@@@UnBCL@@UEBAHI@Z

?ContainsValue@?$Hashtable@IPEAUIDevice@Mig@@@UnBCL@@UEBAHPEAUIDevice@Mig@@@Z

?Copy@?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@SAXPEBV12@HPEAV12@HH@Z

?Copy@?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@SAXPEBV12@PEAV12@H@Z

?CopyTo@?$ArrayList@PEAVCCatalogUser@Mig@@@UnBCL@@UEBAXPEAV?$Array@PEAVCCatalogUser@Mig@@@2@H@Z

?CopyTo@?$Hashtable@IPEAUIDevice@Mig@@@UnBCL@@UEBAXPEAV?$Array@V?$DictionaryEntry@IPEAUIDevice@Mig@@@UnBCL@@@2@H@Z

Sections

.text
Size: 589KB - Virtual size: 589KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 558KB - Virtual size: 557KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 47KB - Virtual size: 49KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

wbem/NCProv.dll

.dll regsvr32 windows:10 windows x64 arch:x64

1ef54f8bb5f737b5c94ff9ec456fb61b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

PDB Paths

NCProv.pdb

Imports

msvcrt

??0exception@@QEAA@AEBQEBD@Z

??0exception@@QEAA@AEBQEBDH@Z

_onexit

_wcsupr

??0exception@@QEAA@AEBV0@@Z

wcsstr

wcscpy_s

??1exception@@UEAA@XZ

__CxxFrameHandler3

realloc

wcscat_s

malloc

?what@exception@@UEBAPEBDXZ

_CxxThrowException

memcpy

memmove

_XcptFilter

_amsg_exit

_initterm

?terminate@@YAXXZ

??1type_info@@UEAA@XZ

_lock

free

__C_specific_handler

_unlock

__dllonexit

_purecall

_vsnwprintf

memcmp

memset

api-ms-win-core-heap-l1-1-0

HeapDestroy

GetProcessHeap

api-ms-win-core-synch-l1-1-0

WaitForSingleObject

DeleteCriticalSection

SetEvent

CreateEventW

WaitForMultipleObjectsEx

OpenEventW

ResetEvent

InitializeCriticalSection

EnterCriticalSection

LeaveCriticalSection

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter

GetLastError

SetUnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess

GetCurrentProcessId

GetCurrentThreadId

TerminateProcess

CreateThread

api-ms-win-core-namedpipe-l1-1-0

DisconnectNamedPipe

CreateNamedPipeW

ConnectNamedPipe

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-io-l1-1-0

GetOverlappedResult

api-ms-win-core-file-l1-1-0

WriteFile

ReadFileEx

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

FreeLibrary

GetModuleFileNameW

SizeofResource

LoadResource

GetProcAddress

LoadLibraryExW

FindResourceExW

DisableThreadLibraryCalls

api-ms-win-core-string-l2-1-0

CharPrevW

CharNextW

api-ms-win-core-registry-l1-1-0

RegDeleteValueW

RegSetValueExW

RegCreateKeyExW

RegEnumValueW

RegQueryInfoKeyW

RegCloseKey

RegEnumKeyExW

RegOpenKeyExW

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

lstrcpyW

lstrcpynW

api-ms-win-core-memory-l1-1-0

VirtualQuery

VirtualProtect

VirtualAlloc

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo

GetTickCount

GetSystemTimeAsFileTime

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry

RtlVirtualUnwind

RtlCaptureContext

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

ntdll

EtwGetTraceEnableFlags

EtwRegisterTraceGuidsW

EtwUnregisterTraceGuids

EtwGetTraceEnableLevel

EtwGetTraceLoggerHandle

EtwTraceMessage

wbemcomn

?Next@CAbstractQl1Parser@@MEAAHH@Z

??1QL1_Parser@@UEAA@XZ

??1QL_LEVEL_1_RPN_EXPRESSION@@QEAA@XZ

??0QL1_Parser@@QEAA@PEAVCGenLexSource@@@Z

GetMemLogObject

?Write@CMemoryLog@@QEAAXJ@Z

_ThrowMemoryException_

?WbemHeapInitialize@CWin32DefaultArena@@SAHPEAX@Z

?WbemMemFree@CWin32DefaultArena@@SAHPEAX@Z

?Parse@QL1_Parser@@QEAAHPEAPEAUQL_LEVEL_1_RPN_EXPRESSION@@@Z

?WbemMemAlloc@CWin32DefaultArena@@SAPEAX_K@Z

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

DllCanUnloadNow

DllGetClassObject

DllRegisterServer

DllUnregisterServer

Sections

.text
Size: 62KB - Virtual size: 61KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 160B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 768B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

wbem/NetAdapterCim.dll

.dll regsvr32 windows:10 windows x64 arch:x64

fbb0ff989ef228f1ae4047715d66db08

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

PDB Paths

NetAdapterCim.pdb

Imports

msvcp_win

?_Xbad_function_call@std@@YAXXZ

?_Xout_of_range@std@@YAXPEBD@Z

?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-string-l1-1-0

wcsnlen

memset

api-ms-win-crt-runtime-l1-1-0

_initterm_e

_initterm

api-ms-win-crt-private-l1-1-0

_o__errno

_o__execute_onexit_table

_o__initialize_narrow_environment

_o__initialize_onexit_table

_o__invalid_parameter_noinfo

_o__invalid_parameter_noinfo_noreturn

_o__itow_s

_o__ltow_s

_o__register_onexit_function

_o__seh_filter_dll

_o___stdio_common_vsnprintf_s

memmove

_o__ui64tow_s

_o__ultow_s

_o__wcsdup

_o__wcsicmp

_o__wcstoui64

_o__wcsupr_s

_o__wtoi

_o_free

_o_iswxdigit

_o_malloc

_o_toupper

_o_wcstok_s

_o_wcstol

_o_wcstoul

__C_specific_handler

__CxxFrameHandler3

_CxxThrowException

_o__cexit

_o__callnewh

_o___std_type_info_destroy_list

_o___std_exception_destroy

_o___std_exception_copy

_o__crt_atexit

_o__configure_narrow_argv

_o___stdio_common_vswprintf_s

_o___stdio_common_vswprintf

wcsstr

__std_terminate

__CxxFrameHandler4

memcpy

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress

GetModuleFileNameA

LoadLibraryExW

DisableThreadLibraryCalls

FreeLibrary

GetModuleHandleExW

GetModuleHandleW

api-ms-win-core-synch-l1-1-0

CreateSemaphoreExW

InitializeCriticalSection

DeleteCriticalSection

InitializeCriticalSectionAndSpinCount

SetEvent

ResetEvent

LeaveCriticalSection

EnterCriticalSection

CreateEventW

WaitForSingleObject

ReleaseMutex

WaitForSingleObjectEx

ReleaseSemaphore

OpenSemaphoreW

CreateMutexExW

api-ms-win-core-heap-l1-1-0

HeapFree

GetProcessHeap

HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter

SetUnhandledExceptionFilter

SetLastError

GetLastError

api-ms-win-core-processthreads-l1-1-0

TerminateProcess

GetCurrentProcessId

GetCurrentProcess

GetCurrentThreadId

api-ms-win-core-localization-l1-2-0

SetThreadPreferredUILanguages

FormatMessageW

GetThreadPreferredUILanguages

api-ms-win-core-debug-l1-1-0

OutputDebugStringW

DebugBreak

IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-sysinfo-l1-1-0

GetComputerNameExW

GetSystemTimeAsFileTime

GetSystemDirectoryW

api-ms-win-core-heap-l2-1-0

LocalAlloc

LocalFree

iphlpapi

ConvertInterfaceIndexToLuid

ConvertInterfaceLuidToAlias

GetIfStackTable

FreeMibTable

ConvertInterfaceLuidToNameW

api-ms-win-devices-config-l1-1-1

CM_Locate_DevNodeW

CM_Get_DevNode_Status

CM_Get_Parent

CM_Get_Device_ID_Size

CM_Get_DevNode_PropertyW

CM_Get_Device_IDW

CM_Open_DevNode_Key

CM_MapCrToWin32Err

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW

RegEnumValueW

RegQueryValueExW

RegOpenKeyExW

RegCloseKey

RegDeleteValueW

RegGetValueW

RegEnumKeyExW

RegSetValueExW

api-ms-win-service-management-l1-1-0

CloseServiceHandle

OpenSCManagerW

OpenServiceW

api-ms-win-service-management-l2-1-0

QueryServiceConfigW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime

api-ms-win-core-com-l1-1-0

CoUninitialize

StringFromIID

CoInitializeEx

CoTaskMemFree

CoCreateInstance

StringFromGUID2

api-ms-win-core-io-l1-1-0

DeviceIoControl

oleaut32

VariantClear

SysFreeString

SysAllocString

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext

RtlLookupFunctionEntry

RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

nsi

NsiGetAllParameters

NsiAllocateAndGetTable

NsiFreeTable

devobj

DevObjGetDeviceProperty

DevObjOpenDevRegKey

DevObjEnumDeviceInfo

DevObjGetClassDevs

DevObjCreateDeviceInfoList

DevObjDestroyDeviceInfoList

DevObjChangeState

DevObjOpenDeviceInfo

winnsi

NsiRpcGetAllParameters

api-ms-win-core-localization-private-l1-1-0

LoadStringByReference

ntdll

RtlNtStatusToDosError

RtlAddAtomToAtomTable

EtwRegisterTraceGuidsW

RtlDestroyAtomTable

RtlEmptyAtomTable

RtlCreateAtomTable

RtlLoadString

NtOpenFile

RtlGetCurrentServiceSessionId

RtlIpv6AddressToStringW

RtlIpv4AddressToStringW

RtlEthernetAddressToStringW

NtClose

NtDeviceIoControlFile

EtwUnregisterTraceGuids

EtwGetTraceEnableFlags

EtwTraceMessage

EtwGetTraceLoggerHandle

RtlDeleteAtomFromAtomTable

EtwGetTraceEnableLevel

RtlQueryAtomInAtomTable

netsetupapi

NetSetupSetObjectProperties

NetSetupCommit

NetSetupFreeObjectProperties

NetSetupGetObjectProperties

NetSetupGetObjects

NetSetupFreeObjects

NetSetupClose

NetSetupInitialize

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

DllCanUnloadNow

DllGetClassObject

DllMain

DllRegisterServer

DllUnregisterServer

GetProviderClassID

MI_Main

Sections

.text
Size: 350KB - Virtual size: 350KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 248KB - Virtual size: 248KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

wbem/NetEventPacketCapture.dll

.dll regsvr32 windows:10 windows x64 arch:x64

a1a1336d4b2381c909c2c8473904e9a7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

PDB Paths

NetEventPacketCapture.pdb

Imports

msvcp_win

?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-runtime-l1-1-0

_initterm_e

_initterm

api-ms-win-crt-private-l1-1-0

_o__errno

_o__execute_onexit_table

_o__initialize_narrow_environment

_o__initialize_onexit_table

_o__invalid_parameter_noinfo

_o__invalid_parameter_noinfo_noreturn

_o__purecall

_o__register_onexit_function

_o__seh_filter_dll

memmove

_o__wcsicmp

_o_free

_o_malloc

_o_terminate

_o_tolower

_o_toupper

__C_specific_handler

__CxxFrameHandler3

_CxxThrowException

_o__crt_atexit

_o__configure_narrow_argv

_o___stdio_common_vswscanf

_o___stdio_common_vswprintf_s

_o___stdio_common_vswprintf

_o___stdio_common_vsnprintf_s

__std_terminate

_o___std_type_info_destroy_list

_o___std_exception_destroy

_o___std_exception_copy

__CxxFrameHandler4

_o__cexit

_o__callnewh

memchr

memcmp

memcpy

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

GetModuleHandleExW

GetProcAddress

LoadLibraryExW

GetModuleFileNameA

DisableThreadLibraryCalls

FreeLibrary

api-ms-win-core-heap-l1-1-0

HeapFree

GetProcessHeap

HeapAlloc

api-ms-win-core-processthreads-l1-1-0

CreateProcessW

GetCurrentThreadId

GetCurrentProcessId

GetCurrentProcess

TerminateProcess

GetExitCodeProcess

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW

IsDebuggerPresent

DebugBreak

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage

GetTraceLoggerHandle

GetTraceEnableLevel

GetTraceEnableFlags

RegisterTraceGuidsW

UnregisterTraceGuids

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW

GetSystemTimeAsFileTime

GetVersionExW

api-ms-win-core-errorhandling-l1-1-0

GetLastError

UnhandledExceptionFilter

SetLastError

SetUnhandledExceptionFilter

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-com-l1-1-0

StringFromGUID2

CoCreateGuid

CoUninitialize

CoInitializeEx

CoCreateInstance

api-ms-win-core-file-l1-1-0

CreateFileW

api-ms-win-core-synch-l1-1-0

CreateEventA

CreateMutexExW

OpenSemaphoreW

ReleaseMutex

CreateEventW

WaitForSingleObjectEx

DeleteCriticalSection

InitializeCriticalSectionAndSpinCount

LeaveCriticalSection

EnterCriticalSection

WaitForSingleObject

InitializeCriticalSection

CreateSemaphoreExW

ReleaseSemaphore

InitializeCriticalSectionEx

AcquireSRWLockShared

ReleaseSRWLockShared

AcquireSRWLockExclusive

ReleaseSRWLockExclusive

api-ms-win-core-handle-l1-1-0

CloseHandle

oleaut32

VariantClear

VariantInit

SysFreeString

api-ms-win-eventing-controller-l1-1-0

EnableTraceEx2

ControlTraceW

StartTraceW

StopTraceW

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW

RegQueryValueExW

RegDeleteTreeW

RegSetValueExW

RegCloseKey

RegCreateKeyExW

api-ms-win-core-io-l1-1-0

GetOverlappedResult

DeviceIoControl

api-ms-win-security-base-l1-1-0

FreeSid

AllocateAndInitializeSid

CheckTokenMembership

iphlpapi

ConvertInterfaceGuidToLuid

ConvertInterfaceLuidToIndex

api-ms-win-service-management-l1-1-0

OpenSCManagerW

CloseServiceHandle

StartServiceW

OpenServiceW

api-ms-win-service-winsvc-l1-1-0

ControlService

ws2_32

ntohl

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext

RtlLookupFunctionEntry

RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-shlwapi-legacy-l1-1-0

PathIsRelativeW

ntdll

RtlEthernetAddressToStringW

RtlIpv4AddressToStringW

RtlIpv4StringToAddressW

RtlEthernetStringToAddressW

RtlIpv6StringToAddressW

NtOpenFile

RtlIpv6AddressToStringW

netsetupapi

NetSetupClose

NetSetupInitialize

NetSetupGetObjectProperties

NetSetupFreeObjectProperties

NetSetupFreeObjects

NetSetupGetObjects

fwpuclnt

FwpmEngineOpen0

FwpmSubLayerAdd0

FwpmProviderAdd0

FwpmCalloutDeleteById0

FwpmEngineClose0

FwpmCalloutAdd0

FwpmFilterAdd0

FwpmFilterDeleteById0

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer

WaitForThreadpoolTimerCallbacks

SetThreadpoolTimer

CloseThreadpoolTimer

Exports

DllCanUnloadNow

DllGetClassObject

DllMain

DllRegisterServer

DllUnregisterServer

GetProviderClassID

MI_Main

Sections

.text
Size: 186KB - Virtual size: 185KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 80KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

wbem/appbackgroundtask.dll

.dll regsvr32 windows:10 windows x64 arch:x64

2e1ed8e14d5a11566896d404533b10ac

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

PDB Paths

appbackgroundtask.pdb

Imports

msvcrt

swprintf_s

__CxxFrameHandler3

_vsnwprintf

wcsncpy_s

??0exception@@QEAA@AEBV0@@Z

memcpy_s

?what@exception@@UEBAPEBDXZ

??0exception@@QEAA@AEBQEBD@Z

memmove_s

??0exception@@QEAA@XZ

_CxxThrowException

??1type_info@@UEAA@XZ

__C_specific_handler

_initterm

_amsg_exit

_XcptFilter

malloc

free

??1exception@@UEAA@XZ

memset

ntdll

RtlAllocateHeap

RtlStringFromGUID

RtlGUIDFromString

RtlInitUnicodeString

RtlFreeUnicodeString

RtlFreeHeap

RtlVirtualUnwind

RtlLookupFunctionEntry

RtlCaptureContext

kernel32

RaiseException

LocalFree

GetPackagesByPackageFamily

PackageFamilyNameFromFullName

FormatMessageW

GetTickCount

GetSystemTimeAsFileTime

GetCurrentThreadId

GetSystemDirectoryW

GetLastError

DisableThreadLibraryCalls

GetProcAddress

FreeLibrary

LoadLibraryExW

Sleep

UnhandledExceptionFilter

SetUnhandledExceptionFilter

GetCurrentProcess

TerminateProcess

QueryPerformanceCounter

GetCurrentProcessId

api-ms-win-core-biptcltapi-l1-1-7

BiPtQueryWorkItem

BiPtActivateWorkItem

BiPtDisassociateWorkItem

BiPtEnumerateWorkItemsForPackageName

BiPtFreeMemory

api-ms-win-core-psm-info-l1-1-0

PsmQueryApplicationPerformanceInformation

api-ms-win-core-winrt-l1-1-0

RoActivateInstance

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString

WindowsCreateStringReference

WindowsGetStringRawBuffer

advapi32

CheckTokenMembership

FreeSid

AllocateAndInitializeSid

api-ms-win-core-com-l1-1-0

CoSwitchCallContext

Exports

DllCanUnloadNow

DllGetClassObject

DllMain

DllRegisterServer

DllUnregisterServer

GetProviderClassID

MI_Main

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 972B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 820B

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

wbem/ndisimplatcim.dll

.dll regsvr32 windows:10 windows x64 arch:x64

37ebfa6305c8823cec2b50169eaa2cbc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

PDB Paths

NdisImplatCim.pdb

Imports

msvcrt

_initterm

__C_specific_handler

__CxxFrameHandler3

_lock

memset

?terminate@@YAXXZ

memcmp

??1type_info@@UEAA@XZ

memcpy

_CxxThrowException

_unlock

__dllonexit

?what@exception@@UEBAPEBDXZ

memmove

??0exception@@QEAA@AEBQEBDH@Z

??0exception@@QEAA@AEBQEBD@Z

_callnewh

_wcsicmp

iswspace

vswprintf_s

malloc

free

swprintf_s

toupper

_vsnprintf_s

??0exception@@QEAA@AEBV0@@Z

??0exception@@QEAA@XZ

??1exception@@UEAA@XZ

_purecall

??_V@YAXPEAX@Z

_amsg_exit

??3@YAXPEAX@Z

memcpy_s

_vsnwprintf

_onexit

_XcptFilter

wcscmp

ntdll

RtlVirtualUnwind

RtlLookupFunctionEntry

RtlCaptureContext

EtwUnregisterTraceGuids

EtwGetTraceEnableFlags

EtwTraceMessage

EtwGetTraceLoggerHandle

EtwGetTraceEnableLevel

EtwRegisterTraceGuidsW

RtlNtStatusToDosError

api-ms-win-core-libraryloader-l1-2-0

LoadStringW

FreeLibrary

GetProcAddress

GetModuleFileNameA

GetModuleHandleW

DisableThreadLibraryCalls

LoadLibraryExW

GetModuleHandleExW

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx

ReleaseSemaphore

WaitForSingleObject

CreateMutexExW

OpenSemaphoreW

CreateSemaphoreExW

ReleaseMutex

api-ms-win-core-heap-l1-1-0

GetProcessHeap

HeapFree

HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter

GetLastError

SetUnhandledExceptionFilter

SetLastError

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId

GetCurrentProcessId

TerminateProcess

GetCurrentProcess

api-ms-win-core-localization-l1-2-0

SetThreadPreferredUILanguages

GetThreadPreferredUILanguages

FormatMessageW

api-ms-win-core-debug-l1-1-0

OutputDebugStringW

IsDebuggerPresent

DebugBreak

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

GetSystemDirectoryW

GetTickCount

GetTickCount64

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-com-l1-1-0

StringFromGUID2

IIDFromString

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

netsetupapi

NetSetupSynchronizeDevices

NetSetupCreateObject

NetSetupDeleteObject

NetSetupGetObjectProperties

NetSetupClose

NetSetupInitialize

NetSetupFreeObjects

NetSetupGetObjects

NetSetupCommit

NetSetupValidateTransaction

NetSetupFreeObjectProperties

NetSetupSetObjectProperties

rpcrt4

UuidCreate

api-ms-win-core-file-l1-1-0

CreateFileW

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-eventing-classicprovider-l1-1-0

TraceMessage

api-ms-win-core-heap-l2-1-0

LocalFree

mi

MI_Application_InitializeV1

Exports

DllCanUnloadNow

DllGetClassObject

DllMain

DllRegisterServer

DllUnregisterServer

GetProviderClassID

MI_Main

Sections

.text
Size: 136KB - Virtual size: 135KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

wbem/netdacim.dll

.dll regsvr32 windows:10 windows x64 arch:x64

c2b3ad892319a4711be4694947f3c6af

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE

IMAGE_FILE_LARGE_ADDRESS_AWARE

IMAGE_FILE_DLL

PDB Paths

netdacim.pdb

Imports

msvcrt

__C_specific_handler

malloc

_wcsicmp

_wcslwr_s

wcsstr

wcstok_s

wcschr

_vsnwprintf

_wcsupr_s

_initterm

_amsg_exit

_XcptFilter

free

swprintf_s

memcpy

memset

advapi32

RegOpenKeyExW

RegCloseKey

RegOpenKeyW

RegEnumValueW

RegEnumKeyExW

RegDeleteKeyW

CreateWellKnownSid

RegQueryInfoKeyW

RegDeleteTreeW

RegCreateKeyExW

RegDeleteValueW

RegSetValueExW

RegQueryValueExW

dnsapi

DnsValidateName_W

kernel32

CreateEventW

SetEvent

HeapFree

GetProcessHeap

WaitForSingleObject

DisableThreadLibraryCalls

FreeLibrary

GetSystemDirectoryW

LoadLibraryExW

GetLastError

GetProcAddress

Sleep

RtlCaptureContext

RtlLookupFunctionEntry

RtlVirtualUnwind

UnhandledExceptionFilter

SetUnhandledExceptionFilter

GetCurrentProcess

TerminateProcess

QueryPerformanceCounter

GetCurrentProcessId

GetCurrentThreadId

GetSystemTimeAsFileTime

GetTickCount

EnterCriticalSection

LeaveCriticalSection

InitializeCriticalSection

DeleteCriticalSection

GetComputerNameExW

LocalFree

IsValidLocaleName

GetThreadPreferredUILanguages

LocalAlloc

SetThreadPreferredUILanguages

CloseHandle

GetModuleHandleExW

FormatMessageW

RtlCompareMemory

HeapAlloc

wevtapi

EvtSubscribe

EvtClose

ws2_32

FreeAddrInfoW

GetAddrInfoW

WSAStartup

WSACleanup

wldap32

ord27

ord41

ord13

ord224

ord301

ord97

ord140

ord127

ord26

ord145

ord16

ord118

ord18

ord14

ord88

ord73

ord208

ord36

netutils

NetApiBufferFree

logoncli

DsGetDcNameW

api-ms-win-core-com-l1-1-0

CoCreateGuid

iphlpapi

ConvertStringToGuidW

ConvertGuidToStringW

ParseNetworkString

rpcrt4

RpcBindingFree

RpcBindingUnbind

NdrClientCall3

RpcBindingCreateW

RpcBindingBind

Exports

DllCanUnloadNow

DllGetClassObject

DllMain

DllRegisterServer

DllUnregisterServer

GetProviderClassID

MI_Main

Sections

.text
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_CODE

IMAGE_SCN_MEM_EXECUTE

IMAGE_SCN_MEM_READ

.rdata
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA

IMAGE_SCN_MEM_DISCARDABLE

IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: Inicio2020!

Password: Inicio2020!

086d7fe731041bf6b7b4ead4eca05f07

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

f4:51:16:0e:9a:74:4f:92:2e:f8:66:5d:5e:6d:2f:8d:4f:32:3b:fc:c3:df:dc:c5:5b:9e:ed:3f:bf:35:ad:fdSigner

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-registry-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-rtcore-ntuser-window-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

ext-ms-win-ntuser-dialogbox-l1-1-0

Exports

Exports

Sections

.text Size: 51KB - Virtual size: 50KB

.rdata Size: 107KB - Virtual size: 107KB

.data Size: 47KB - Virtual size: 50KB

.pdata Size: 3KB - Virtual size: 2KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 1024B - Virtual size: 548B

Password: Inicio2020!

985fdef47db40313b27bfccaaf554989

Code Sign

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60Certificate

Extended Key Usages

61:07:76:56:00:00:00:00:00:08Certificate

Key Usages

e4:fb:45:3f:23:c4:51:7f:e7:e0:02:ce:85:87:9c:a7:41:6f:df:cf:07:bd:3d:b6:8d:6d:ff:5b:18:a7:db:92Signer

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

oleaut32

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

f4:51:16:0e:9a:74:4f:92:2e:f8:66:5d:5e:6d:2f:8d:4f:32:3b:fc:c3:df:dc:c5:5b:9e:ed:3f:bf:35:ad:fd
Signer

.text
Size: 51KB - Virtual size: 50KB

.rdata
Size: 107KB - Virtual size: 107KB

.data
Size: 47KB - Virtual size: 50KB

.pdata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 1024B - Virtual size: 548B

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

e4:fb:45:3f:23:c4:51:7f:e7:e0:02:ce:85:87:9c:a7:41:6f:df:cf:07:bd:3d:b6:8d:6d:ff:5b:18:a7:db:92
Signer

.text
Size: 209KB - Virtual size: 208KB

.rdata
Size: 69KB - Virtual size: 68KB

.data
Size: 2KB - Virtual size: 5KB

.pdata
Size: 10KB - Virtual size: 10KB

.didat
Size: 512B - Virtual size: 56B

.rsrc
Size: 7KB - Virtual size: 7KB

.reloc
Size: 2KB - Virtual size: 1KB

33:00:00:04:60:cf:42:a9:12:31:5f:6f:b3:00:00:00:00:04:60
Certificate

61:07:76:56:00:00:00:00:00:08
Certificate

74:b2:b8:5d:95:b0:75:77:fb:1e:81:38:5f:88:d0:8b:1a:77:4d:52:67:35:55:34:98:18:b1:89:ea:fe:1b:48
Signer