Generated by JEB on 2019/08/01

PE: C:\Windows\System32\irmon.dll Base=0x180000000 SHA-256=99D62C73D5D4E125B1C7D4528D55700A61696817CFB38627D6B5F62993DF02A0
PDB: irmon.pdb GUID={072CC0F3-D41E-AA5B-EDBF15C3D51C8126} Age=1

248 located named symbols:
0x1800065F0: "__cdecl _hmod__WS2_32_dll" __hmod__WS2_32_dll
0x180004240: "__cdecl _imp_RegisterClassW" __imp_RegisterClassW
0x18000355C: "__cdecl _raise_securityfailure" __raise_securityfailure
0x180004340: "__cdecl _imp_EtwUnregisterTraceGuids" __imp_EtwUnregisterTraceGuids
0x180004248: "__cdecl _imp_MsgWaitForMultipleObjectsEx" __imp_MsgWaitForMultipleObjectsEx
0x180003370: "__cdecl FindPESection" _FindPESection
0x180002DD0: "__cdecl _delayLoadHelper2" __delayLoadHelper2
0x180004E68: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x180006020: "__cdecl _security_cookie_complement" __security_cookie_complement
0x18000A040: "__cdecl _imp_WSADuplicateSocketW" __imp_WSADuplicateSocketW
0x18000265C: CreateListenSocket
0x180002E4C: "__cdecl CRT_INIT" _CRT_INIT
0x1800042B0: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x18000102C: WPP_SF_L
0x180004380: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x180004228: "__cdecl _imp_GetWindowLongPtrW" __imp_GetWindowLongPtrW
0x1800019A0: WppControlCallback
0x1800039D0: "__cdecl _imp_load_WTSEnumerateSessionsW" __imp_load_WTSEnumerateSessionsW
0x180003A90: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x180004C30: USERENV_NULL_THUNK_DATA_DLN
0x1800037B1: "__cdecl _imp_load_DestroyEnvironmentBlock" __imp_load_DestroyEnvironmentBlock
0x180004350: "__cdecl _imp_EtwGetTraceLoggerHandle" __imp_EtwGetTraceLoggerHandle
0x1800045F0: "__cdecl _pfnDliFailureHook2" __pfnDliFailureHook2
0x1800065E8: "__cdecl _hmod__USERENV_dll" __hmod__USERENV_dll
0x1800045D8: WPP_678f92b1414f3b2e16b9988541ed381d_Traceguids
0x180004210: "__cdecl _imp_CancelIo" __imp_CancelIo
0x180004D70: api-ms-win-security-sddl-l1-1-0_NULL_THUNK_DATA_DLB
0x1800041E0: "__cdecl _imp_SetEvent" __imp_SetEvent
0x1800043A8: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x180003921: "__cdecl _imp_load_closesocket" __imp_load_closesocket
0x18000A048: "__cdecl _imp_listen" __imp_listen
0x18000383C: "__cdecl _imp_load_CreateEnvironmentBlock" __imp_load_CreateEnvironmentBlock
0x180004260: "__cdecl _imp_DispatchMessageW" __imp_DispatchMessageW
0x1800042D8: "__cdecl _imp_RegisterServiceCtrlHandlerExW" __imp_RegisterServiceCtrlHandlerExW
0x180003354: "__cdecl XcptFilter" _XcptFilter
0x18000A068: "__cdecl _imp_WTSQueryUserToken" __imp_WTSQueryUserToken
0x1800043B0: "__cdecl _xc_a" __xc_a
0x1800039E2: "__cdecl _imp_load_WTSFreeMemory" __imp_load_WTSFreeMemory
0x180004288: "__cdecl _imp_SetWindowLongPtrW" __imp_SetWindowLongPtrW
0x18000A080: api-ms-win-security-sddl-l1-1-0_NULL_THUNK_DATA_DLA
0x1800044D8: WPP_37209f4b6a163e99f9c42565681d6a23_Traceguids
0x180004520: "WinSta0\Default" ??_C@_1CA@JJIMMJJP@?$AAW?$AAi?$AAn?$AAS?$AAt?$AAa?$AA0?$AA?2?$AAD?$AAe?$AAf?$AAa?$AAu?$AAl?$AAt?$AA?$AA@
0x180001ED0: ServiceMain
0x18000A038: "__cdecl _imp_socket" __imp_socket
0x180004414: "__cdecl _guard_iat_table" __guard_iat_table
0x1800010AC: CreateIrDiscoveryObject
0x180001BB4: IrmonUpdateServiceStatus
0x180004320: "__cdecl _imp_memset" __imp_memset
0x1800041D8: "__cdecl _imp_WaitForSingleObjectEx" __imp_WaitForSingleObjectEx
0x1800041F0: "__cdecl _imp_CreateEventW" __imp_CreateEventW
0x18000352F: "__cdecl initterm" _initterm
0x180006620: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x180004118: "__cdecl _imp_Sleep" __imp_Sleep
0x1800043D0: "__cdecl _xi_z" __xi_z
0x180004188: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x18000390F: "__cdecl _imp_load_WSADuplicateSocketW" __imp_load_WSADuplicateSocketW
0x180004360: "__cdecl _imp_EtwRegisterTraceGuidsW" __imp_EtwRegisterTraceGuidsW
0x18000353B: "__cdecl _C_specific_handler" __C_specific_handler
0x1800041C0: "__cdecl _imp_WTSGetActiveConsoleSessionId" __imp_WTSGetActiveConsoleSessionId
0x180004208: "__cdecl _imp_HeapFree" __imp_HeapFree
0x180008CA8: WPP_REGISTRATION_GUIDS
0x180003726: "__cdecl _imp_load_ConvertStringSecurityDescriptorToSecurityDescriptorW" __imp_load_ConvertStringSecurityDescriptorToSecurityDescriptorW
0x180004268: "__cdecl _imp_DestroyWindow" __imp_DestroyWindow
0x180004138: "__cdecl _imp_InitializeCriticalSectionAndSpinCount" __imp_InitializeCriticalSectionAndSpinCount
0x18000A018: "__cdecl _imp_closesocket" __imp_closesocket
0x180004250: "__cdecl _imp_PeekMessageW" __imp_PeekMessageW
0x180003A18: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x1800044F0: "irftp.exe /z" ??_C@_1BK@IOFAKEMF@?$AAi?$AAr?$AAf?$AAt?$AAp?$AA?4?$AAe?$AAx?$AAe?$AA?5?$AA?1?$AAz?$AA?$AA@
0x180002B44: StartThread
0x180008A60: WPP_MAIN_CB
0x180003360: "__cdecl amsg_exit" _amsg_exit
0x180004470: "__cdecl _sz_WTSAPI32_dll" __sz_WTSAPI32_dll
0x1800045E8: "__cdecl _DefaultResolveDelayLoadedAPIFlags" __DefaultResolveDelayLoadedAPIFlags
0x180004200: "__cdecl _imp_CreateWaitableTimerW" __imp_CreateWaitableTimerW
0x1800088D0: LinkStatus
0x1800065E0: "__cdecl _hmod__api_ms_win_security_sddl_l1_1_0_dll" __hmod__api_ms_win_security_sddl_l1_1_0_dll
0x180004278: "__cdecl _imp_WaitForInputIdle" __imp_WaitForInputIdle
0x180004BBC: "__cdecl _DELAY_IMPORT_DESCRIPTOR_WS2_32_dll" __DELAY_IMPORT_DESCRIPTOR_WS2_32_dll
0x180001520: DiscoverComplete
0x180004C90: WTSAPI32_NULL_THUNK_DATA_DLN
0x18000A070: WTSAPI32_NULL_THUNK_DATA_DLA
0x180004DD8: WTSAPI32_NULL_THUNK_DATA_DLB
0x180004480: "IRMON2: discovery object closed " ??_C@_0CB@KLLNOPJI@IRMON2?3?5discovery?5object?5closed?6@
0x1800042E8: api-ms-win-service-core-l1-1-0_NULL_THUNK_DATA
0x180004148: "__cdecl _imp_EnterCriticalSection" __imp_EnterCriticalSection
0x18000A058: "__cdecl _imp_WTSEnumerateSessionsW" __imp_WTSEnumerateSessionsW
0x18000A030: "__cdecl _imp_bind" __imp_bind
0x180004540: "D:(A;OICI;GA;;;SY) (A;OICI;GR;;;" ??_C@_1EI@GOGOPKGP@?$AAD?$AA?3?$AA?$CI?$AAA?$AA?$DL?$AAO?$AAI?$AAC?$AAI?$AA?$DL?$AAG?$AAA?$AA?$DL?$AA?$DL?$AA?$DL?$AAS?$AAY?$AA?$CJ?$AA?5?$AA?$CI?$AAA?$AA?$DL?$AAO?$AAI?$AAC?$AAI?$AA?$DL?$AAG?$AAR?$AA?$DL?$AA?$DL?$AA?$DL@
0x180003933: "__cdecl _imp_load_bind" __imp_load_bind
0x1800042C0: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x1800038D9: "__cdecl _imp_load_socket" __imp_load_socket
0x180004B9C: "__cdecl _DELAY_IMPORT_DESCRIPTOR_USERENV_dll" __DELAY_IMPORT_DESCRIPTOR_USERENV_dll
0x180006610: "__cdecl _native_startup_lock" __native_startup_lock
0x180002CAC: DllMain
0x1800042F0: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x180006030: IrmonClassName
0x1800016A8: GetDeviceList
0x1800042C8: "__cdecl _imp_ResumeThread" __imp_ResumeThread
0x180004338: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x180004218: KERNEL32_NULL_THUNK_DATA
0x1800041D0: "__cdecl _imp_GetLastError" __imp_GetLastError
0x1800044A8: "\Device\IrDA" ??_C@_1BK@EJLAPAJD@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAI?$AAr?$AAD?$AAA?$AA?$AA@
0x180006010: "__cdecl _native_dllmain_reason" __native_dllmain_reason
0x1800039F4: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x180004460: "__cdecl _sz_WS2_32_dll" __sz_WS2_32_dll
0x180001320: TimerApcRoutine
0x180004388: "__cdecl _imp_EtwTraceMessage" __imp_EtwTraceMessage
0x180001CA0: ServiceHandler
0x180004C70: WS2_32_NULL_THUNK_DATA_DLN
0x180004D98: WS2_32_NULL_THUNK_DATA_DLB
0x18000A050: WS2_32_NULL_THUNK_DATA_DLA
0x180004378: "__cdecl _imp_NtDeviceIoControlFile" __imp_NtDeviceIoControlFile
0x1800011BC: RemoveRefCount
0x1800042A8: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x180004128: "__cdecl _imp_WaitForSingleObject" __imp_WaitForSingleObject
0x180001B40: IrmonReportServiceStatus
0x1800045E8: "__cdecl _ResolveDelayLoadedAPIFlags" __ResolveDelayLoadedAPIFlags
0x180003420: "__cdecl ValidateImageBase" _ValidateImageBase
0x180004230: "__cdecl _imp_PostMessageW" __imp_PostMessageW
0x180001008: WPP_SF_
0x180004158: "__cdecl _imp_HeapAlloc" __imp_HeapAlloc
0x180004BFC: "__cdecl _NULL_DELAY_IMPORT_DESCRIPTOR" __NULL_DELAY_IMPORT_DESCRIPTOR
0x180003090: "__cdecl DllMainCRTStartup" _DllMainCRTStartup
0x1800042F8: "__cdecl _imp__initterm" __imp__initterm
0x180003951: "__cdecl _tailMerge_wtsapi32_dll" __tailMerge_wtsapi32_dll
0x180006640: FoundDevListBuf
0x180006600: "__cdecl _onexitend" __onexitend
0x180004370: "__cdecl _imp_NtCreateFile" __imp_NtCreateFile
0x180004298: "__cdecl _imp_CreateThread" __imp_CreateThread
0x1800043A0: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x180004280: "__cdecl _imp_CreateWindowExW" __imp_CreateWindowExW
0x180004258: "__cdecl _imp_IsDialogMessageW" __imp_IsDialogMessageW
0x1800044E8: "NULL" ??_C@_04HIBGFPH@NULL?$AA@
0x1800042B8: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x180004290: USER32_NULL_THUNK_DATA
0x180004220: "__cdecl _imp_DefWindowProcW" __imp_DefWindowProcW
0x18000A008: "__cdecl _imp_CreateEnvironmentBlock" __imp_CreateEnvironmentBlock
0x1800065F8: "__cdecl _hmod__WTSAPI32_dll" __hmod__WTSAPI32_dll
0x1800043C0: "__cdecl _xi_a" __xi_a
0x1800044C8: WPP_ThisDir_CTLGUID_IrmonGeneral
0x1800041A0: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x180004170: "__cdecl _imp_ResolveDelayLoadedAPI" __imp_ResolveDelayLoadedAPI
0x180003945: "__cdecl _imp_load_WTSQueryUserToken" __imp_load_WTSQueryUserToken
0x180001848: WPP_SF_dd
0x180006000: WPP_GLOBAL_Control
0x180004E7C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0
0x180001800: WPP_SF_D
0x180001070: WPP_SF_d
0x180006628: "__cdecl pRawDllMain" _pRawDllMain
0x1800041B8: "__cdecl _imp_DeleteCriticalSection" __imp_DeleteCriticalSection
0x180003330: "__cdecl _security_check_cookie" __security_check_cookie
0x1800043B8: "__cdecl _xc_z" __xc_z
0x1800042D0: api-ms-win-core-processthreads-l1-1-0_NULL_THUNK_DATA
0x1800042A0: "__cdecl _imp_CreateProcessAsUserW" __imp_CreateProcessAsUserW
0x1800038FD: "__cdecl _imp_load_listen" __imp_load_listen
0x180001C2C: NotifyUserChange
0x180004190: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x1800041F8: "__cdecl _imp_CancelWaitableTimer" __imp_CancelWaitableTimer
0x180004390: "__cdecl _imp_EtwGetTraceEnableLevel" __imp_EtwGetTraceEnableLevel
0x180004168: "__cdecl _imp_DelayLoadFailureHook" __imp_DelayLoadFailureHook
0x180004150: "__cdecl _imp_GetProcessHeap" __imp_GetProcessHeap
0x1800042E0: "__cdecl _imp_SetServiceStatus" __imp_SetServiceStatus
0x18000A028: "__cdecl _imp_WSAGetLastError" __imp_WSAGetLastError
0x180004120: "__cdecl _imp_UnmapViewOfFile" __imp_UnmapViewOfFile
0x180004450: "__cdecl _sz_USERENV_dll" __sz_USERENV_dll
0x1800027D0: IrmonThreadStart
0x1800041E8: "__cdecl _imp_MultiByteToWideChar" __imp_MultiByteToWideChar
0x1800043D8: "__cdecl _guard_fids_table" __guard_fids_table
0x180004328: msvcrt_NULL_THUNK_DATA
0x18000384E: "__cdecl _imp_load_WSAGetLastError" __imp_load_WSAGetLastError
0x180004010: "__cdecl load_config_used" _load_config_used
0x180004B7C: "__cdecl _DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_sddl_l1_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_sddl_l1_1_0_dll
0x180004EA4: "__cdecl _IMPORT_DESCRIPTOR_USER32" __IMPORT_DESCRIPTOR_USER32
0x180004310: "__cdecl _imp__amsg_exit" __imp__amsg_exit
0x180008AA0: CommandLine
0x1800041C8: "__cdecl _imp_DisableThreadLibraryCalls" __imp_DisableThreadLibraryCalls
0x180004330: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x180004198: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x180004140: "__cdecl _imp_WaitForMultipleObjects" __imp_WaitForMultipleObjects
0x180004348: "__cdecl _imp_EtwGetTraceEnableFlags" __imp_EtwGetTraceEnableFlags
0x180001898: WPP_SF_sdD
0x1800041B0: "__cdecl _imp_CreateFileMappingW" __imp_CreateFileMappingW
0x180004358: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x1800045F0: "__cdecl _pfnDefaultDliFailureHook2" __pfnDefaultDliFailureHook2
0x180003732: "__cdecl _tailMerge_api_ms_win_security_sddl_l1_1_0_dll" __tailMerge_api_ms_win_security_sddl_l1_1_0_dll
0x180008900: GlobalIrmonControl
0x180003550: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x180004510: "irmon" ??_C@_1M@KKNILCHJ@?$AAi?$AAr?$AAm?$AAo?$AAn?$AA?$AA@
0x18000A078: "__cdecl _imp_ConvertStringSecurityDescriptorToSecurityDescriptorW" __imp_ConvertStringSecurityDescriptorToSecurityDescriptorW
0x1800088E0: ghInstance
0x180004238: "__cdecl _imp_TranslateMessage" __imp_TranslateMessage
0x180004318: "__cdecl _imp__XcptFilter" __imp__XcptFilter
0x180004398: ntdll_NULL_THUNK_DATA
0x1800038EB: "__cdecl _imp_load_WSAStartup" __imp_load_WSAStartup
0x180006018: "__cdecl _security_cookie" __security_cookie
0x180004D80: USERENV_NULL_THUNK_DATA_DLB
0x180004160: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x18000A060: "__cdecl _imp_WTSFreeMemory" __imp_WTSFreeMemory
0x180004594: "OBEX" ??_C@_04NGFAMPLL@OBEX?$AA@
0x180006608: "__cdecl _onexitbegin" __onexitbegin
0x180001A30: WndProc
0x180001254: CloseIrDiscoveryObject
0x180004368: "__cdecl _imp_DbgPrint" __imp_DbgPrint
0x180004180: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x18000A000: "__cdecl _imp_DestroyEnvironmentBlock" __imp_DestroyEnvironmentBlock
0x180004CA0: api-ms-win-security-sddl-l1-1-0_NULL_THUNK_DATA_DLN
0x180004EB8: "__cdecl _IMPORT_DESCRIPTOR_KERNEL32" __IMPORT_DESCRIPTOR_KERNEL32
0x180003454: "__cdecl _security_init_cookie" __security_init_cookie
0x180004E90: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-service-core-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-service-core-l1-1-0
0x180004E54: "__cdecl _IMPORT_DESCRIPTOR_msvcrt" __IMPORT_DESCRIPTOR_msvcrt
0x180004178: "__cdecl _imp_SetWaitableTimer" __imp_SetWaitableTimer
0x180004300: "__cdecl _imp_malloc" __imp_malloc
0x180004BDC: "__cdecl _DELAY_IMPORT_DESCRIPTOR_WTSAPI32_dll" __DELAY_IMPORT_DESCRIPTOR_WTSAPI32_dll
0x180004270: "__cdecl _imp_UnregisterClassW" __imp_UnregisterClassW
0x1800035A0: "__cdecl _report_gsfailure" __report_gsfailure
0x180004130: "__cdecl _imp_LeaveCriticalSection" __imp_LeaveCriticalSection
0x180006618: "__cdecl _native_startup_state" __native_startup_state
0x1800037BD: "__cdecl _tailMerge_userenv_dll" __tailMerge_userenv_dll
0x180004420: "__cdecl _sz_api_ms_win_security_sddl_l1_1_0_dll" __sz_api_ms_win_security_sddl_l1_1_0_dll
0x1800041A8: "__cdecl _imp_MapViewOfFile" __imp_MapViewOfFile
0x18000385A: "__cdecl _tailMerge_ws2_32_dll" __tailMerge_ws2_32_dll
0x180004588: "OBEX:IrXfer" ??_C@_0M@DPKPHDAK@OBEX?3IrXfer?$AA@
0x180001924: WPP_SF_sl
0x180004308: "__cdecl _imp_free" __imp_free
0x1800033C0: "__cdecl IsNonwritableInCurrentImage" _IsNonwritableInCurrentImage
0x18000A020: "__cdecl _imp_WSAStartup" __imp_WSAStartup
0x180003A79: memset
0x180004ECC: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x1800045A0: "Global\Irmon-shared-memory" ??_C@_1DG@PJNMBAP@?$AAG?$AAl?$AAo?$AAb?$AAa?$AAl?$AA?2?$AAI?$AAr?$AAm?$AAo?$AAn?$AA?9?$AAs?$AAh?$AAa?$AAr?$AAe?$AAd?$AA?9?$AAm?$AAe?$AAm?$AAo?$AAr?$AAy?$AA?$AA@
0x18000A010: USERENV_NULL_THUNK_DATA_DLA

[JEB Decompiler by PNF Software]