ci.dll

Description: Code Integrity Module

Version: 10.0.19041.6456

Architecture: 64-bit

Operating System: Windows NT

SHA256: 22b2642903f1c93ce63e948e5540a4fa

File Size: 928.2 KB

Uploaded At: Dec. 1, 2025, 7:24 a.m.

Views: 12

Exported Functions

(Ordinal: 1, Address: 0x55030)
(Ordinal: 2, Address: 0x5f550)
(Ordinal: 3, Address: 0x5f7a0)
CiCheckSignedFile (Ordinal: 4, Address: 0x45df0)
CiFindPageHashesInCatalog (Ordinal: 5, Address: 0x45eb0)
CiFindPageHashesInSignedFile (Ordinal: 6, Address: 0x45f30)
CiFreePolicyInfo (Ordinal: 7, Address: 0x45f70)
CiGetCertPublisherName (Ordinal: 8, Address: 0x638d0)
CiGetPEInformation (Ordinal: 9, Address: 0x45cd0)
CiInitialize (Ordinal: 10, Address: 0x44420)
CiSetTrustedOriginClaimId (Ordinal: 11, Address: 0x63c90)
CiValidateFileObject (Ordinal: 12, Address: 0x545c0)
CiVerifyHashInCatalog (Ordinal: 13, Address: 0x45d70)

Imported DLLs & Functions

ext-ms-win-ci-xbox-l1-1-0.dll

XciInitialize (Address: 0x1c0041020)
XciQueryInformation (Address: 0x1c0041018)
XciSupported (Address: 0x1c0041028)
XciValidateImageData (Address: 0x1c0041030)
XciValidateImageHeader (Address: 0x1c0041010)

HAL.dll

KeQueryPerformanceCounter (Address: 0x1c0041000)

msrpc.sys

I_RpcExceptionFilter (Address: 0x1c0041060)
Ndr64AsyncClientCall (Address: 0x1c0041088)
RpcAsyncCancelCall (Address: 0x1c0041048)
RpcAsyncCompleteCall (Address: 0x1c0041050)
RpcAsyncGetCallStatus (Address: 0x1c0041058)
RpcAsyncInitializeHandle (Address: 0x1c0041070)
RpcBindingBind (Address: 0x1c0041068)
RpcBindingCreateW (Address: 0x1c0041078)
RpcBindingFree (Address: 0x1c0041080)
RpcBindingUnbind (Address: 0x1c0041040)

ntoskrnl.exe

__C_specific_handler (Address: 0x1c0041810)
__chkstk (Address: 0x1c00415f8)
_local_unwind (Address: 0x1c0041820)
_stricmp (Address: 0x1c0041558)
_ultow_s (Address: 0x1c0041600)
_vsnprintf (Address: 0x1c0041098)
_vsnwprintf (Address: 0x1c0041710)
_wcsupr (Address: 0x1c0041448)
atoi (Address: 0x1c00416b8)
bsearch (Address: 0x1c0041358)
bsearch_s (Address: 0x1c00416a8)
DbgPrint (Address: 0x1c0041430)
DbgPrintEx (Address: 0x1c0041648)
EtwActivityIdControl (Address: 0x1c0041480)
EtwEventEnabled (Address: 0x1c00414d0)
EtwRegister (Address: 0x1c0041138)
EtwSetInformation (Address: 0x1c0041640)
EtwUnregister (Address: 0x1c0041100)
EtwWrite (Address: 0x1c00414f0)
EtwWriteTransfer (Address: 0x1c00414b8)
ExAcquirePushLockExclusiveEx (Address: 0x1c00410d0)
ExAcquirePushLockSharedEx (Address: 0x1c0041130)
ExAcquireResourceExclusiveLite (Address: 0x1c0041300)
ExAcquireResourceSharedLite (Address: 0x1c0041318)
ExAcquireSpinLockExclusive (Address: 0x1c0041800)
ExAcquireSpinLockShared (Address: 0x1c00417e8)
ExAcquireSpinLockSharedAtDpcLevel (Address: 0x1c00417f8)
ExAllocatePoolWithQuotaTag (Address: 0x1c00413c8)
ExAllocatePoolWithTag (Address: 0x1c0041128)
ExAllocateTimer (Address: 0x1c00417c8)
ExConvertExclusiveToSharedLite (Address: 0x1c0041398)
ExConvertPushLockExclusiveToShared (Address: 0x1c00415e8)
ExDeletePagedLookasideList (Address: 0x1c0041818)
ExDeleteResourceLite (Address: 0x1c00412e0)
ExDeleteTimer (Address: 0x1c00417c0)
ExEnterCriticalRegionAndAcquireResourceExclusive (Address: 0x1c0041808)
ExEnterCriticalRegionAndAcquireResourceShared (Address: 0x1c00413e8)
ExFreePoolWithTag (Address: 0x1c0041150)
ExGetPreviousMode (Address: 0x1c0041160)
ExInitializePagedLookasideList (Address: 0x1c0041230)
ExInitializeResourceLite (Address: 0x1c0041388)
ExIsResourceAcquiredExclusiveLite (Address: 0x1c0041310)
ExpInterlockedPopEntrySList (Address: 0x1c0041200)
ExpInterlockedPushEntrySList (Address: 0x1c0041228)
ExQueryDepthSList (Address: 0x1c0041248)
ExQueueWorkItem (Address: 0x1c00410a8)
ExRaiseDatatypeMisalignment (Address: 0x1c0041370)
ExReleasePushLockEx (Address: 0x1c00415f0)
ExReleasePushLockExclusiveEx (Address: 0x1c00410e0)
ExReleasePushLockSharedEx (Address: 0x1c0041110)
ExReleaseResourceAndLeaveCriticalRegion (Address: 0x1c00413f0)
ExReleaseResourceLite (Address: 0x1c0041348)
ExReleaseSpinLockExclusive (Address: 0x1c00417b8)
ExReleaseSpinLockShared (Address: 0x1c00417e0)
ExReleaseSpinLockSharedFromDpcLevel (Address: 0x1c00417d8)
ExSetTimer (Address: 0x1c00417b0)
ExSystemExceptionFilter (Address: 0x1c0041180)
ExTryAcquirePushLockExclusiveEx (Address: 0x1c00417d0)
FsRtlGetFileNameInformation (Address: 0x1c00414e8)
FsRtlGetFileSize (Address: 0x1c0041658)
FsRtlKernelFsControlFile (Address: 0x1c0041288)
FsRtlQueryKernelEaFile (Address: 0x1c00411e8)
FsRtlReleaseFileNameInformation (Address: 0x1c0041500)
FsRtlSetKernelEaFile (Address: 0x1c0041298)
IoAllocateMdl (Address: 0x1c00412f0)
IoClearActivityIdThread (Address: 0x1c0041460)
IoConvertFileHandleToKernelHandle (Address: 0x1c00412a0)
IoFileObjectType (Address: 0x1c0041268)
IoFreeMdl (Address: 0x1c0041360)
IoGetActivityIdThread (Address: 0x1c00414e0)
IoGetCurrentProcess (Address: 0x1c0041770)
IoGetDeviceAttachmentBaseRef (Address: 0x1c0041250)
IoGetDiskDeviceObject (Address: 0x1c0041258)
IoGetRelatedDeviceObject (Address: 0x1c0041218)
IoQueryFileInformation (Address: 0x1c0041278)
IoQueryVolumeInformation (Address: 0x1c0041220)
IoSetActivityIdThread (Address: 0x1c00414a0)
IoVolumeDeviceToDosName (Address: 0x1c0041510)
isdigit (Address: 0x1c00416c0)
KdDebuggerEnabled (Address: 0x1c0041670)
KdDebuggerNotPresent (Address: 0x1c0041628)
KeBugCheckEx (Address: 0x1c0041560)
KeDelayExecutionThread (Address: 0x1c00413a0)
KeEnterCriticalRegion (Address: 0x1c0041618)
KeExpandKernelStackAndCalloutEx (Address: 0x1c0041170)
KeInitializeDpc (Address: 0x1c0041650)
KeInitializeEvent (Address: 0x1c00413b0)
KeInitializeTimer (Address: 0x1c00410c0)
KeIsExecutingDpc (Address: 0x1c00417a8)
KeLeaveCriticalRegion (Address: 0x1c00411c0)
KeQueryActiveProcessorCountEx (Address: 0x1c0041438)
KeRestoreExtendedProcessorState (Address: 0x1c0041688)
KeSaveExtendedProcessorState (Address: 0x1c0041698)
KeSetCoalescableTimer (Address: 0x1c00411c8)
KeSetEvent (Address: 0x1c00417f0)
KeSetPriorityThread (Address: 0x1c0041790)
KeStackAttachProcess (Address: 0x1c00410e8)
KeUnstackDetachProcess (Address: 0x1c00411a8)
KeWaitForSingleObject (Address: 0x1c00413b8)
LdrResFindResource (Address: 0x1c0041470)
LdrResSearchResource (Address: 0x1c0041718)
MmMapViewInSystemSpaceEx (Address: 0x1c00413e0)
MmProbeAndLockPages (Address: 0x1c00412c8)
MmSectionObjectType (Address: 0x1c00413c0)
MmSizeOfMdl (Address: 0x1c00415c8)
MmUnlockPages (Address: 0x1c00412b0)
MmUnmapViewInSystemSpace (Address: 0x1c00413d0)
MmUserProbeAddress (Address: 0x1c0041328)
NtQueryInformationThread (Address: 0x1c0041788)
NtQuerySystemInformation (Address: 0x1c00414a8)
NtSetInformationThread (Address: 0x1c0041778)
ObfDereferenceObject (Address: 0x1c0041608)
ObOpenObjectByPointer (Address: 0x1c00413d8)
ObQueryNameString (Address: 0x1c00411f8)
ObReferenceObjectByHandle (Address: 0x1c0041270)
PsAttachSiloToCurrentThread (Address: 0x1c0041238)
PsCreateSiloContext (Address: 0x1c0041588)
PsCreateSystemThread (Address: 0x1c0041750)
PsDereferencePrimaryToken (Address: 0x1c0041740)
PsDereferenceSiloContext (Address: 0x1c00415a0)
PsDetachSiloFromCurrentThread (Address: 0x1c0041290)
PsGetCurrentProcess (Address: 0x1c0041118)
PsGetCurrentProcessId (Address: 0x1c00410f0)
PsGetCurrentServerSilo (Address: 0x1c0041368)
PsGetPermanentSiloContext (Address: 0x1c0041568)
PsGetProcessProtection (Address: 0x1c0041240)
PsGetProcessSectionBaseAddress (Address: 0x1c0041148)
PsGetProcessServerSilo (Address: 0x1c00411f0)
PsGetProcessSignatureLevel (Address: 0x1c0041490)
PsGetSiloMonitorContextSlot (Address: 0x1c0041578)
PsInitialSystemProcess (Address: 0x1c0041780)
PsInsertPermanentSiloContext (Address: 0x1c0041598)
PsIsCurrentThreadInServerSilo (Address: 0x1c0041458)
PsIsCurrentThreadPrefetching (Address: 0x1c0041478)
PsIsProtectedProcess (Address: 0x1c0041440)
PsIsProtectedProcessLight (Address: 0x1c00411d0)
PsProcessType (Address: 0x1c00413f8)
PsQueryProcessAttributesByToken (Address: 0x1c0041450)
PsReferencePrimaryToken (Address: 0x1c0041730)
PsReferenceProcessFilePointer (Address: 0x1c0041120)
PsRegisterSiloMonitor (Address: 0x1c0041580)
PsSetCreateProcessNotifyRoutine (Address: 0x1c0041768)
PsSetCreateProcessNotifyRoutineEx (Address: 0x1c0041400)
PsStartSiloMonitor (Address: 0x1c0041590)
PsTerminateSystemThread (Address: 0x1c0041798)
PsUnregisterSiloMonitor (Address: 0x1c0041570)
qsort (Address: 0x1c0041320)
RtlAnsiStringToUnicodeString (Address: 0x1c00416c8)
RtlAppendUnicodeStringToString (Address: 0x1c00412d0)
RtlAppendUnicodeToString (Address: 0x1c00412d8)
RtlAvlInsertNodeEx (Address: 0x1c00412c0)
RtlAvlRemoveNode (Address: 0x1c0041380)
RtlCapabilityCheck (Address: 0x1c0041540)
RtlCheckRegistryKey (Address: 0x1c0041620)
RtlCheckTokenMembership (Address: 0x1c00410b8)
RtlCompareMemory (Address: 0x1c0041390)
RtlCompareUnicodeString (Address: 0x1c00412a8)
RtlCompareUnicodeStrings (Address: 0x1c0041728)
RtlCopyUnicodeString (Address: 0x1c00410c8)
RtlCreateUnicodeString (Address: 0x1c0041410)
RtlDeleteRegistryValue (Address: 0x1c00415b0)
RtlDuplicateUnicodeString (Address: 0x1c0041188)
RtlEqualSid (Address: 0x1c00416f0)
RtlEqualString (Address: 0x1c0041208)
RtlEqualUnicodeString (Address: 0x1c0041638)
RtlFindUnicodeSubstring (Address: 0x1c00414c0)
RtlFreeUnicodeString (Address: 0x1c0041408)
RtlGetAce (Address: 0x1c00416d0)
RtlGetDaclSecurityDescriptor (Address: 0x1c00416f8)
RtlGetEnabledExtendedFeatures (Address: 0x1c0041690)
RtlGetNtSystemRoot (Address: 0x1c00416e0)
RtlGetOwnerSecurityDescriptor (Address: 0x1c00416d8)
RtlGetPersistedStateLocation (Address: 0x1c0041548)
RtlGetVersion (Address: 0x1c00416a0)
RtlGUIDFromString (Address: 0x1c0041528)
RtlImageDirectoryEntryToData (Address: 0x1c00415c0)
RtlImageNtHeader (Address: 0x1c0041488)
RtlImageNtHeaderEx (Address: 0x1c0041428)
RtlInitAnsiString (Address: 0x1c0041758)
RtlInitializeBitMap (Address: 0x1c00415e0)
RtlInitializeSidEx (Address: 0x1c00416e8)
RtlInitUnicodeString (Address: 0x1c00410a0)
RtlInterlockedClearBitRun (Address: 0x1c00415d8)
RtlInterlockedSetClearRun (Address: 0x1c00415d0)
RtlIsStateSeparationEnabled (Address: 0x1c0041420)
RtlNotifyFeatureUsage (Address: 0x1c00411b8)
RtlPrefixUnicodeString (Address: 0x1c0041468)
RtlQueryFeatureConfiguration (Address: 0x1c0041660)
RtlQueryFeatureConfigurationChangeStamp (Address: 0x1c00410d8)
RtlQueryPackageClaims (Address: 0x1c0041530)
RtlQueryPackageIdentity (Address: 0x1c0041738)
RtlRegisterFeatureConfigurationChangeNotification (Address: 0x1c0041668)
RtlRunOnceExecuteOnce (Address: 0x1c00413a8)
RtlStringFromGUID (Address: 0x1c0041700)
RtlTimeFieldsToTime (Address: 0x1c00416b0)
RtlTimeToTimeFields (Address: 0x1c00414b0)
RtlUnicodeStringToAnsiString (Address: 0x1c0041708)
RtlUnicodeStringToInteger (Address: 0x1c0041748)
RtlUnicodeToUTF8N (Address: 0x1c0041280)
RtlUnregisterFeatureConfigurationChangeNotification (Address: 0x1c00410f8)
RtlUTF8ToUnicodeN (Address: 0x1c0041260)
SeExports (Address: 0x1c00411a0)
SeLocateProcessImageName (Address: 0x1c00414f8)
SeQuerySecureBootPlatformManifest (Address: 0x1c0041520)
SeQuerySecureBootPolicyValue (Address: 0x1c0041630)
SeQuerySecurityAttributesToken (Address: 0x1c0041550)
SeReportSecurityEventWithSubCategory (Address: 0x1c00414d8)
SeSinglePrivilegeCheck (Address: 0x1c0041178)
wcschr (Address: 0x1c0041760)
wcsncmp (Address: 0x1c00417a0)
wcsstr (Address: 0x1c0041498)
ZwClose (Address: 0x1c0041190)
ZwCreateFile (Address: 0x1c0041210)
ZwCreateKey (Address: 0x1c00410b0)
ZwCreateSection (Address: 0x1c00412f8)
ZwDeleteFile (Address: 0x1c0041720)
ZwDeleteKey (Address: 0x1c0041108)
ZwEnumerateKey (Address: 0x1c0041538)
ZwEnumerateValueKey (Address: 0x1c0041418)
ZwFsControlFile (Address: 0x1c00411e0)
ZwMapViewOfSection (Address: 0x1c0041338)
ZwOpenDirectoryObject (Address: 0x1c0041350)
ZwOpenFile (Address: 0x1c0041158)
ZwOpenKey (Address: 0x1c00411b0)
ZwPowerInformation (Address: 0x1c00411d8)
ZwQueryDirectoryFile (Address: 0x1c0041330)
ZwQueryDirectoryObject (Address: 0x1c00412e8)
ZwQueryInformationFile (Address: 0x1c0041378)
ZwQueryInformationThread (Address: 0x1c0041308)
ZwQueryLicenseValue (Address: 0x1c0041680)
ZwQuerySecurityObject (Address: 0x1c0041518)
ZwQuerySystemEnvironmentValueEx (Address: 0x1c0041168)
ZwQuerySystemInformation (Address: 0x1c0041678)
ZwQueryValueKey (Address: 0x1c0041140)
ZwQueryVolumeInformationFile (Address: 0x1c0041508)
ZwQueryWnfStateData (Address: 0x1c0041610)
ZwReadFile (Address: 0x1c00414c8)
ZwSetInformationThread (Address: 0x1c0041340)
ZwSetValueKey (Address: 0x1c0041198)
ZwUnmapViewOfSection (Address: 0x1c00412b8)
ZwUpdateWnfStateData (Address: 0x1c00415a8)
ZwWriteFile (Address: 0x1c00415b8)