Generated by JEB on 2019/08/01

PE: C:\Windows\System32\drivers\wimmount.sys Base=0x1C0000000 SHA-256=785F9B0635A73169B5D46638AEB6C2CDDA5FE99374551E5B1FA5CB5CE3DE5D7A
PDB: wimmount.pdb GUID={B997EBE4-8722-E759-73365047CAFD2A49} Age=1

154 located named symbols:
0x1C00060F8: "__cdecl _imp_FltSetCallbackDataDirty" __imp_FltSetCallbackDataDirty
0x1C0003338: ".tmp" ??_C@_19LKKOIHJI@?$AA?4?$AAt?$AAm?$AAp?$AA?$AA@
0x1C00060B8: "__cdecl _imp_FltGetFileNameInformation" __imp_FltGetFileNameInformation
0x1C0004048: "__cdecl _security_cookie_complement" __security_cookie_complement
0x1C0006200: "__cdecl _imp_ObfDereferenceObject" __imp_ObfDereferenceObject
0x1C00078F0: PFReleaseContextAndUntagFile
0x1C00061F8: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x1C0006158: "__cdecl _imp_ExEventObjectType" __imp_ExEventObjectType
0x1C00025A0: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x1C0007A50: PFOnlyConsiderDirectories
0x1C0006140: "__cdecl _imp_ZwOpenProcess" __imp_ZwOpenProcess
0x1C0006058: "__cdecl _imp_FltCloseCommunicationPort" __imp_FltCloseCommunicationPort
0x1C0006038: "__cdecl _imp_FltGetRoutineAddress" __imp_FltGetRoutineAddress
0x1C00032F0: "TmTransactionObjectType" ??_C@_1DA@PPICJKPO@?$AAT?$AAm?$AAT?$AAr?$AAa?$AAn?$AAs?$AAa?$AAc?$AAt?$AAi?$AAo?$AAn?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x1C0008080: PFPortConnect
0x1C0006050: "__cdecl _imp_FltFreeSecurityDescriptor" __imp_FltFreeSecurityDescriptor
0x1C0006000: "__cdecl _imp_FltAllocateContext" __imp_FltAllocateContext
0x1C0006228: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x1C0003320: "FltCreateFileEx2" ??_C@_0BB@DFMMKFOE@FltCreateFileEx2?$AA@
0x1C0006168: "__cdecl _imp_MmGetSystemRoutineAddress" __imp_MmGetSystemRoutineAddress
0x1C00031E0: "isDirTest!DriverEntry: Entered " ??_C@_0CA@LNCECPMK@isDirTest?$CBDriverEntry?3?5Entered?6?$AA@
0x1C00071A0: PFPreCreate
0x1C0006160: "__cdecl _imp_ZwCreateEvent" __imp_ZwCreateEvent
0x1C00023E0: WMCommListEntryAddRef
0x1C0003280: PfContexts
0x1C00061B0: "__cdecl _imp_KeWaitForSingleObject" __imp_KeWaitForSingleObject
0x1C0006190: "__cdecl _imp_RtlAppendUnicodeStringToString" __imp_RtlAppendUnicodeStringToString
0x1C0003000: Callbacks
0x1C0001758: PFSetSubsumedStatus
0x1C00031D8: "__cdecl _guard_iat_table" __guard_iat_table
0x1C00025C0: memcpy
0x1C00090E0: WMCommListCreate
0x1C00060E8: "__cdecl _imp_FltReleaseResource" __imp_FltReleaseResource
0x1C00024D3: "__cdecl _C_specific_handler" __C_specific_handler
0x1C00025C0: memmove
0x1C0006008: "__cdecl _imp_FltAcquireResourceShared" __imp_FltAcquireResourceShared
0x1C000252C: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x1C0006108: "__cdecl _imp_FltRegisterFilter" __imp_FltRegisterFilter
0x1C00060A0: "__cdecl _imp_FltReleaseFileNameInformation" __imp_FltReleaseFileNameInformation
0x1C0006070: "__cdecl _imp_FltClose" __imp_FltClose
0x1C0006208: "__cdecl _imp_ExDeleteResourceLite" __imp_ExDeleteResourceLite
0x1C0006040: "__cdecl _imp_FltGetVolumeName" __imp_FltGetVolumeName
0x1C00061D0: "__cdecl _imp_IoGetTopLevelIrp" __imp_IoGetTopLevelIrp
0x1C00061C8: "__cdecl _imp_ExAllocatePoolWithTag" __imp_ExAllocatePoolWithTag
0x1C00089C0: PriDuplicateUserBuffer
0x1C00061E8: "__cdecl _imp_PsGetCurrentProcessId" __imp_PsGetCurrentProcessId
0x1C0007AF0: PFCheckReparse
0x1C00060B0: "__cdecl _imp_FltFsControlFile" __imp_FltFsControlFile
0x1C0003210: "isDirTest!Unload: Entered " ??_C@_0BL@NKIJMIOD@isDirTest?$CBUnload?3?5Entered?6?$AA@
0x1C0006120: FLTMGR_NULL_THUNK_DATA
0x1C0006198: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x1C00040E0: g_CommList
0x1C0008A4C: PriGetObjectsFromUserHandle
0x1C00060C8: "__cdecl _imp_FltAcquireResourceExclusive" __imp_FltAcquireResourceExclusive
0x1C0002508: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x1C0003060: FilterRegistration
0x1C00060C0: "__cdecl _imp_FltIsDirectory" __imp_FltIsDirectory
0x1C0006068: "__cdecl _imp_FltGetDiskDeviceObject" __imp_FltGetDiskDeviceObject
0x1C0006048: "__cdecl _imp_FltEnumerateInstances" __imp_FltEnumerateInstances
0x1C0003230: "System Volume Information" ??_C@_1DE@LIBHJBEH@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?5?$AAV?$AAo?$AAl?$AAu?$AAm?$AAe?$AA?5?$AAI?$AAn?$AAf?$AAo?$AAr?$AAm?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x1C00060D8: "__cdecl _imp_FltReleaseContext" __imp_FltReleaseContext
0x1C0001478: PFSubsumeContext
0x1C00040C8: PfCommunicationPort
0x1C00060F0: "__cdecl _imp_FltBuildDefaultSecurityDescriptor" __imp_FltBuildDefaultSecurityDescriptor
0x1C0008FFC: PriSubsumeContext
0x1C000A1A0: GsDriverEntry
0x1C0006220: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x1C0006158: ExEventObjectType
0x1C0008E7C: PriStubRename
0x1C00061D8: "__cdecl _imp_ObReferenceObjectByHandle" __imp_ObReferenceObjectByHandle
0x1C0006010: "__cdecl _imp_FltGetVolumeFromFileObject" __imp_FltGetVolumeFromFileObject
0x1C0009160: PriGetEntry
0x1C0006180: PsProcessType
0x1C00070A0: Unload
0x1C0006090: "__cdecl _imp_FltStartFiltering" __imp_FltStartFiltering
0x1C00061A0: "__cdecl _imp_RtlCompareUnicodeString" __imp_RtlCompareUnicodeString
0x1C0002470: "__cdecl _security_check_cookie" __security_check_cookie
0x1C0006028: "__cdecl _imp_FltObjectDereference" __imp_FltObjectDereference
0x1C00060E0: "__cdecl _imp_FltCreateCommunicationPort" __imp_FltCreateCommunicationPort
0x1C0006244: "__cdecl _IMPORT_DESCRIPTOR_FLTMGR" __IMPORT_DESCRIPTOR_FLTMGR
0x1C0006230: "__cdecl _IMPORT_DESCRIPTOR_ntoskrnl" __IMPORT_DESCRIPTOR_ntoskrnl
0x1C0006030: "__cdecl _imp_FltCloseClientPort" __imp_FltCloseClientPort
0x1C0007F50: PFFileSystemControl
0x1C000728C: PFOpenReparseTarget
0x1C0009150: MatchByProcessId
0x1C0009388: WMCommListGet
0x1C0006170: "__cdecl _imp_ProbeForWrite" __imp_ProbeForWrite
0x1C000B000: "__cdecl _guard_fids_table" __guard_fids_table
0x1C0006098: "__cdecl _imp_FltGetStreamContext" __imp_FltGetStreamContext
0x1C00023EC: WMCommListEntryRelease
0x1C00030D0: "__cdecl load_config_used" _load_config_used
0x1C00040C0: gFilterHandle
0x1C00085AC: PFSendExtractMessage
0x1C0006150: "__cdecl _imp_ZwClose" __imp_ZwClose
0x1C0006018: "__cdecl _imp_FltSendMessage" __imp_FltSendMessage
0x1C00061F0: IoFileObjectType
0x1C00061B8: "__cdecl _imp_KeInitializeEvent" __imp_KeInitializeEvent
0x1C0006178: "__cdecl _imp_ObOpenObjectByPointer" __imp_ObOpenObjectByPointer
0x1C0003268: "WimMount" ??_C@_1BC@IOMKEFHD@?$AAW?$AAi?$AAm?$AAM?$AAo?$AAu?$AAn?$AAt?$AA?$AA@
0x1C00091C8: WMCommListInsert
0x1C0009120: MatchByGuid
0x1C00024F0: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x1C0006088: "__cdecl _imp_FltReissueSynchronousIo" __imp_FltReissueSynchronousIo
0x1C0008C78: PriStubCreateChild
0x1C00088C0: PFSendExchangeCloseHandlesMessage
0x1C0006130: "__cdecl _imp_KeBugCheckEx" __imp_KeBugCheckEx
0x1C0006180: "__cdecl _imp_PsProcessType" __imp_PsProcessType
0x1C0007488: PFGetWritableHandle
0x1C0004040: "__cdecl _security_cookie" __security_cookie
0x1C0006138: "__cdecl _imp_RtlCompareMemory" __imp_RtlCompareMemory
0x1C0008210: PFReceiveMessage
0x1C00060A8: "__cdecl _imp_FltQueryInformationFile" __imp_FltQueryInformationFile
0x1C00040B8: gTraceFlags
0x1C0006148: "__cdecl _imp_ProbeForRead" __imp_ProbeForRead
0x1C0006100: "__cdecl _imp_FltUnregisterFilter" __imp_FltUnregisterFilter
0x1C00061A8: "__cdecl _imp_DbgPrint" __imp_DbgPrint
0x1C0007010: InstanceSetup
0x1C0006020: "__cdecl _imp_FltObjectReference" __imp_FltObjectReference
0x1C000A1D4: "__cdecl _security_init_cookie" __security_init_cookie
0x1C0006118: "__cdecl _imp_FltCreateFile" __imp_FltCreateFile
0x1C00061E0: "__cdecl _imp_KeSetEvent" __imp_KeSetEvent
0x1C0006210: "__cdecl _imp_ZwDuplicateObject" __imp_ZwDuplicateObject
0x1C0003200: "\PFPort" ??_C@_1BA@JGACNJNF@?$AA?2?$AAP?$AAF?$AAP?$AAo?$AAr?$AAt?$AA?$AA@
0x1C00076A4: PFGetContextByFileObject
0x1C0008244: PriProcessMessage
0x1C0006078: "__cdecl _imp_FltSetStreamContext" __imp_FltSetStreamContext
0x1C0006060: "__cdecl _imp_FltGetRequestorProcessId" __imp_FltGetRequestorProcessId
0x1C0006080: "__cdecl _imp_FltDeleteStreamContext" __imp_FltDeleteStreamContext
0x1C00024A0: "__cdecl _report_gsfailure" __report_gsfailure
0x1C0006188: "__cdecl _imp_KeWaitForMultipleObjects" __imp_KeWaitForMultipleObjects
0x1C0008140: PFPortDisconnect
0x1C00061F0: "__cdecl _imp_IoFileObjectType" __imp_IoFileObjectType
0x1C0006128: "__cdecl _imp_ExInitializeResourceLite" __imp_ExInitializeResourceLite
0x1C0006218: ntoskrnl_NULL_THUNK_DATA
0x1C00061C0: "__cdecl _imp_ExFreePoolWithTag" __imp_ExFreePoolWithTag
0x1C00060D0: "__cdecl _imp_FltSetInformationFile" __imp_FltSetInformationFile
0x1C000A008: DriverEntry
0x1C0006110: "__cdecl _imp_FltUntagFile" __imp_FltUntagFile
0x1C0002900: memset
0x1C0006258: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR

[JEB Decompiler by PNF Software]