/**
 * @file modules/generated/module_pe_generated.h
 * @brief Definition of module_pe written in array. Generated by json_to_array.py
 * @copyright (c) 2021 Avast Software, licensed under the MIT license
 */
 #pragma once

 #include "yaramod/types/modules/module_content.h"

 namespace yaramod {

 namespace modules {

 class Gmodule_pe : public ModuleContent
 {
 public:
    static constexpr std::size_t module_content_size = 46879;
    static constexpr const char* module_content_parts[] = {
"{\"kind\": \"struct\", \"name\": \"pe\", \"attributes\": [{\"kind\": \"value\", \"name\": \"MACHINE_UNKNOWN\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACHINE_AM33\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACHINE_AMD64\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACHINE_ARM\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACHINE_ARMNT\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACHINE_ARM64\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACHINE_EBC\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACHINE_I386\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACHINE_IA64\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACHINE_M32R\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACHINE_MIPS16\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACHINE_MIPSFPU\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACHINE_MIPSFPU1",
"6\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACHINE_POWERPC\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACHINE_POWERPCFP\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACHINE_R4000\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACHINE_SH3\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACHINE_SH3DSP\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACHINE_SH4\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACHINE_SH5\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACHINE_THUMB\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACHINE_WCEMIPSV2\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACHINE_TARGET_HOST\", \"documentation\": \"Interacts with the host and not a WOW64 guest\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACHINE_R3000\", \"documentation\": \"MIPS little-endian, 0x160 big-endian\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACHINE_",
"R10000\", \"documentation\": \"MIPS little-endian\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACHINE_ALPHA\", \"documentation\": \"Alpha_AXP\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACHINE_SH3E\", \"documentation\": \"SH3E little-endian\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACHINE_AXP64\", \"documentation\": \"AXP64\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACHINE_ALPHA64\", \"documentation\": \"ALPHA64\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACHINE_TRICORE\", \"documentation\": \"Infineon\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACHINE_CEF\", \"documentation\": \"CEF\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACHINE_CEE\", \"documentation\": \"CEE\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SUBSYSTEM_UNKNOWN\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SUBSYSTEM_NATIVE\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SUBSYSTEM_WINDOWS_GUI\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SUBSYSTEM_WINDOWS_CUI\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SU",
"BSYSTEM_OS2_CUI\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SUBSYSTEM_POSIX_CUI\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SUBSYSTEM_NATIVE_WINDOWS\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SUBSYSTEM_WINDOWS_CE_GUI\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SUBSYSTEM_EFI_APPLICATION\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SUBSYSTEM_EFI_BOOT_SERVICE_DRIVER\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SUBSYSTEM_EFI_RUNTIME_DRIVER\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SUBSYSTEM_XBOX\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SUBSYSTEM_WINDOWS_BOOT_APPLICATION\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SUBSYSTEM_EFI_ROM_IMAGE\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"HIGH_ENTROPY_VA\", \"documentation\": \"DllCharacteristics ASLR with 64 bit address space.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"DYNAM",
"IC_BASE\", \"documentation\": \"File can be relocated - also marks the file as ASLR compatible\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"FORCE_INTEGRITY\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"NX_COMPAT\", \"documentation\": \"Marks the file as DEP compatible\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"NO_ISOLATION\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"NO_SEH\", \"documentation\": \"The file does not contain structured exception handlers, this must be set to use SafeSEH\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"NO_BIND\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"APPCONTAINER\", \"documentation\": \"DllCharacteristics Image should execute in an AppContainer.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"WDM_DRIVER\", \"documentation\": \"Marks the file as a Windows Driver Model (WDM) device driver.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"GUARD_CF\", \"documentation\": \"Image supports Control Flow Guard.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"TERMINAL_SERVER_AWARE\", \"documentation\": \"Marks the file as terminal server comp",
"atible\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"RELOCS_STRIPPED\", \"documentation\": \"Relocation info stripped from file.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"EXECUTABLE_IMAGE\", \"documentation\": \"File is executable (i.e. no unresolved external references).\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"LINE_NUMS_STRIPPED\", \"documentation\": \"Line numbers stripped from file.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"LOCAL_SYMS_STRIPPED\", \"documentation\": \"Local symbols stripped from file.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"AGGRESIVE_WS_TRIM\", \"documentation\": \"Aggressively trim working set\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"LARGE_ADDRESS_AWARE\", \"documentation\": \"App can handle >2gb addresses\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"BYTES_REVERSED_LO\", \"documentation\": \"Bytes of machine word are reversed.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"MACHINE_32BIT\", \"documentation\": \"32 bit word machine.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"DEBUG_STRIPPED\", \"documentation\": \"Debugging in",
"fo stripped from file in .DBG file\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"REMOVABLE_RUN_FROM_SWAP\", \"documentation\": \"If Image is on removable media, copy and run from the swap file.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"NET_RUN_FROM_SWAP\", \"documentation\": \"If Image is on Net, copy and run from the swap file.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SYSTEM\", \"documentation\": \"System File.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"DLL\", \"documentation\": \"File is a DLL.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"UP_SYSTEM_ONLY\", \"documentation\": \"File should only be run on a UP machine\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"BYTES_REVERSED_HI\", \"documentation\": \"Bytes of machine word are reversed.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IMAGE_DIRECTORY_ENTRY_EXPORT\", \"documentation\": \"Data directory for exported functions.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IMAGE_DIRECTORY_ENTRY_IMPORT\", \"documentation\": \"Data directory for import directory.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"",
"IMAGE_DIRECTORY_ENTRY_RESOURCE\", \"documentation\": \"Data directory for resource section.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IMAGE_DIRECTORY_ENTRY_EXCEPTION\", \"documentation\": \"Data directory for exception information.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IMAGE_DIRECTORY_ENTRY_SECURITY\", \"documentation\": \"This is the raw file offset and length of the image digital signature. If the image has no embedded digital signature, this directory will contain zeros.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IMAGE_DIRECTORY_ENTRY_BASERELOC\", \"documentation\": \"Data directory for image relocation table.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IMAGE_DIRECTORY_ENTRY_DEBUG\", \"documentation\": \"Data directory for debug information.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IMAGE_DIRECTORY_ENTRY_ARCHITECTURE\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IMAGE_DIRECTORY_ENTRY_COPYRIGHT\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IMAGE_DIRECTORY_ENTRY_GLOBALPTR\", \"documentati",
"on\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IMAGE_DIRECTORY_ENTRY_TLS\", \"documentation\": \"Data directory for image thread local storage.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG\", \"documentation\": \"Data directory for image load configuration.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT\", \"documentation\": \"Data directory for image bound import table.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IMAGE_DIRECTORY_ENTRY_IAT\", \"documentation\": \"Data directory for image Import Address Table.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT\", \"documentation\": \"Data directory for Delayed Import Table. Structure of the delayed import table is linker-dependent. Microsoft version of delayed imports is described in the souces \\\"delayimp.h\\\" and \\\"delayimp.cpp\\\", which can be found in MS Visual Studio 2008 CRT sources.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\", \"documentation\": \"Data",
" directory for .NET headers.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IMAGE_DIRECTORY_ENTRY_COPYRIGHT\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IMAGE_NT_OPTIONAL_HDR32_MAGIC\", \"documentation\": \"The file is an executable image. \", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IMAGE_NT_OPTIONAL_HDR64_MAGIC\", \"documentation\": \"The file is an executable image. \", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IMAGE_ROM_OPTIONAL_HDR_MAGIC\", \"documentation\": \"The file is a ROM image. \", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_NO_PAD\", \"documentation\": \"The section should not be padded to the next boundary. This flag is obsolete and is replaced by IMAGE_SCN_ALIGN_1BYTES. \", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_CNT_CODE\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_CNT_INITIALIZED_DATA\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_CNT_UNINITIALIZED_DATA\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_LNK_OTHE",
"R\", \"documentation\": \"Reserved\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_LNK_INFO\", \"documentation\": \"The section contains comments or other information. This is valid only for object files. \", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_LNK_REMOVE\", \"documentation\": \"The section will not become part of the image. This is valid only for object files. \", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_LNK_COMDAT\", \"documentation\": \"The section contains COMDAT data. This is valid only for object files. \", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_NO_DEFER_SPEC_EXC\", \"documentation\": \"Reset speculative exceptions handling bits in the TLB entries for this section. \", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_GPREL\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_MEM_FARDATA\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_MEM_PURGEABLE\", \"documentation\": \"Reserved\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_MEM_PURGEABLE\", \"document",
"ation\": \"Reserved\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_MEM_16BIT\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_LNK_NRELOC_OVFL\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_MEM_LOCKED\", \"documentation\": \"Reserved\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_MEM_PRELOAD\", \"documentation\": \"Reserved\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_ALIGN_1BYTES\", \"documentation\": \"Align data on a 1-byte boundary. This is valid only for object files. \", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_ALIGN_2BYTES\", \"documentation\": \"Align data on a 2-byte boundary. This is valid only for object files. \", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_ALIGN_4BYTES\", \"documentation\": \"Align data on a 4-byte boundary. This is valid only for object files. \", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_ALIGN_8BYTES\", \"documentation\": \"Align data on a 8-byte boundary. This is valid only for object files. \", \"type\": \"i\"}, {\"kind\": \"value\",",
" \"name\": \"SECTION_ALIGN_16BYTES\", \"documentation\": \"Align data on a 16-byte boundary. This is valid only for object files. \", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_ALIGN_32BYTES\", \"documentation\": \"Align data on a 32-byte boundary. This is valid only for object files. \", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_ALIGN_64BYTES\", \"documentation\": \"Align data on a 64-byte boundary. This is valid only for object files. \", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_ALIGN_128BYTES\", \"documentation\": \"Align data on a 128-byte boundary. This is valid only for object files. \", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_ALIGN_256BYTES\", \"documentation\": \"Align data on a 256-byte boundary. This is valid only for object files. \", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_ALIGN_512BYTES\", \"documentation\": \"Align data on a 512-byte boundary. This is valid only for object files. \", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_ALIGN_1024BYTES\", \"documentation\": \"Align data on a 1024-b",
"yte boundary. This is valid only for object files. \", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_ALIGN_2048BYTES\", \"documentation\": \"Align data on a 2048-byte boundary. This is valid only for object files. \", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_ALIGN_4096BYTES\", \"documentation\": \"Align data on a 4096-byte boundary. This is valid only for object files. \", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_ALIGN_8192BYTES\", \"documentation\": \"Align data on a 8192-byte boundary. This is valid only for object files. \", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_ALIGN_MASK\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_MEM_DISCARDABLE\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_MEM_NOT_CACHED\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_MEM_NOT_PAGED\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_MEM_SHARED\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_MEM_EXECUTE",
"\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_MEM_READ\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_MEM_WRITE\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"SECTION_SCALE_INDEX\", \"documentation\": \"Tls index is scaled\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"RESOURCE_TYPE_CURSOR\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"RESOURCE_TYPE_BITMAP\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"RESOURCE_TYPE_ICON\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"RESOURCE_TYPE_MENU\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"RESOURCE_TYPE_DIALOG\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"RESOURCE_TYPE_STRING\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"RESOURCE_TYPE_FONTDIR\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"RESOURCE_TYPE_FONT\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"RESOURCE_TYPE_ACCE",
"LERATOR\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"RESOURCE_TYPE_RCDATA\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"RESOURCE_TYPE_MESSAGETABLE\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"RESOURCE_TYPE_GROUP_CURSOR\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"RESOURCE_TYPE_GROUP_ICON\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"RESOURCE_TYPE_VERSION\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"RESOURCE_TYPE_DLGINCLUDE\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"RESOURCE_TYPE_PLUGPLAY\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"RESOURCE_TYPE_VXD\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"RESOURCE_TYPE_ANICURSOR\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"RESOURCE_TYPE_ANIICON\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"RESOURCE_TYPE_HTML\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"nam",
"e\": \"RESOURCE_TYPE_MANIFEST\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IMAGE_DEBUG_TYPE_UNKNOWN\", \"documentation\": \"Unknown value, ignored by all tools. \", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IMAGE_DEBUG_TYPE_COFF\", \"documentation\": \"COFF debugging information (line numbers, symbol table, and string table). This type of debugging information is also pointed to by fields in the file headers. \", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IMAGE_DEBUG_TYPE_CODEVIEW\", \"documentation\": \"CodeView debugging information. The format of the data block is described by the CodeView 4.0 specification.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IMAGE_DEBUG_TYPE_FPO\", \"documentation\": \"Frame pointer omission (FPO) information. This information tells the debugger how to interpret nonstandard stack frames, which use the EBP register for a purpose other than as a frame pointer. \", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IMAGE_DEBUG_TYPE_MISC\", \"documentation\": \"Miscellaneous information. \", \"type\": \"i\"}",
", {\"kind\": \"value\", \"name\": \"IMAGE_DEBUG_TYPE_EXCEPTION\", \"documentation\": \"Exception information. \", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IMAGE_DEBUG_TYPE_FIXUP\", \"documentation\": \"Fixup information. \", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IMAGE_DEBUG_TYPE_OMAP_FROM_SRC\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IMAGE_DEBUG_TYPE_OMAP_TO_SRC\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IMAGE_DEBUG_TYPE_BORLAND\", \"documentation\": \"Borland debugging information.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IMAGE_DEBUG_TYPE_RESERVED10\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IMAGE_DEBUG_TYPE_CLSID\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IMAGE_DEBUG_TYPE_VC_FEATURE\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IMAGE_DEBUG_TYPE_POGO\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IMAGE_DEBUG_TYPE_ILTCG\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IMAGE_DEBUG_TYPE_MPX\", \"",
"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IMAGE_DEBUG_TYPE_REPRO\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"is_pe\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"machine\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"number_of_sections\", \"documentation\": \"Number of sections in the PE.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"timestamp\", \"documentation\": \"PE timestamp.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"pointer_to_symbol_table\", \"documentation\": \"Value of IMAGE_FILE_HEADER::PointerToSymbolTable. Used when the PE image has COFF debug info.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"number_of_symbols\", \"documentation\": \"Value of IMAGE_FILE_HEADER::NumberOfSymbols. Used when the PE image has COFF debug info.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"size_of_optional_header\", \"documentation\": \"Value of IMAGE_FILE_HEADER::SizeOfOptionalHeader. This is real size of the optional header and reflects differences between 32-bit and 64-bi",
"t optional header and number of data directories.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"characteristics\", \"documentation\": \"Bitmap with PE FileHeader characteristics. Individual characteristics can be inspected by performing a bitwise AND operation with specific constants.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"entry_point\", \"documentation\": \"Entry point file offset or virtual address depending on whether YARA is scanning a file or process memory respectively. This is equivalent to the deprecated `entrypoint` keyword.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"entry_point_raw\", \"documentation\": \"Entry point raw value from the optional header of the PE. This value is not converted to a file offset or an RVA.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"image_base\", \"documentation\": \"Image base relative virtual address.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"number_of_rva_and_sizes\", \"documentation\": \"Value of IMAGE_OPTIONAL_HEADER::NumberOfRvaAndSizes. This is the number of items in the IMAGE_OPTION",
"AL_HEADER::DataDirectory array.\", \"type\": \"i\"}, {\"kind\": \"dictionary\", \"name\": \"version_info\", \"documentation\": \"Dictionary containing the PE's version information. Typical keys are: Comments, CompanyName, FileDescription, FileVersion, InternalName, LegalCopyright, LegalTrademarks, OriginalFilename, ProductName, ProductVersion. For more information refer to: ```Example: pe.version_info[\\\"CompanyName\\\"] contains \\\"Microsoft\\\"```\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"number_of_version_infos\", \"documentation\": \"Number of extracted version information records\", \"type\": \"i\"}, {\"kind\": \"array\", \"name\": \"version_info_list\", \"documentation\": \"A array of version information records. Each data record contains key and value of the appropriate data record.\", \"structure\": {\"kind\": \"struct\", \"name\": \"version_info_list\", \"attributes\": [{\"kind\": \"value\", \"name\": \"key\", \"documentation\": \"Key of version information record directory.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"value\", \"documentation\": \"Value of version info",
"rmation record directory.\", \"type\": \"s\"}]}}, {\"kind\": \"value\", \"name\": \"opthdr_magic\", \"documentation\": \"Value of IMAGE_OPTIONAL_HEADER::Magic.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"size_of_code\", \"documentation\": \"Value of IMAGE_OPTIONAL_HEADER::SizeOfCode. This is the sum of raw data sizes in code sections.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"size_of_initialized_data\", \"documentation\": \"Value of IMAGE_OPTIONAL_HEADER::SizeOfInitializedData.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"size_of_uninitialized_data\", \"documentation\": \"Value of IMAGE_OPTIONAL_HEADER::SizeOfUninitializedData.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"base_of_code\", \"documentation\": \"Value of IMAGE_OPTIONAL_HEADER::BaseOfCode.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"base_of_data\", \"documentation\": \"Value of IMAGE_OPTIONAL_HEADER::BaseOfData. This field only exists in 32-bit PE files.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"section_alignment\", \"documentation\": \"Value of IMAGE_OPTIONAL_HEADER::SectionAlignment. When",
" Windows maps a PE image to memory, all raw sizes (including size of header) are aligned up to this value.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"file_alignment\", \"documentation\": \"Value of IMAGE_OPTIONAL_HEADER::FileAlignment. All raw data sizes of sections in the PE image are aligned to this value.\", \"type\": \"i\"}, {\"kind\": \"struct\", \"name\": \"linker_version\", \"documentation\": \"An object with two integer attributes, one for each major and minor linker version.\", \"attributes\": [{\"kind\": \"value\", \"name\": \"major\", \"documentation\": \"Major linker version.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"minor\", \"documentation\": \"Minor linker version.\", \"type\": \"i\"}]}, {\"kind\": \"struct\", \"name\": \"os_version\", \"documentation\": \"An object with two integer attributes, one for each major and minor OS version.\", \"attributes\": [{\"kind\": \"value\", \"name\": \"major\", \"documentation\": \"Major OS version.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"minor\", \"documentation\": \"Minor OS version.\", \"type\": \"i\"}]}, {\"kind\": \"struct\", \"na",
"me\": \"image_version\", \"documentation\": \"An object with two integer attributes, one for each major and minor image version.\", \"attributes\": [{\"kind\": \"value\", \"name\": \"major\", \"documentation\": \"Major image version.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"minor\", \"documentation\": \"Minor image version.\", \"type\": \"i\"}]}, {\"kind\": \"struct\", \"name\": \"subsystem_version\", \"documentation\": \"An object with two integer attributes, one for each major and minor subsystem version.\", \"attributes\": [{\"kind\": \"value\", \"name\": \"major\", \"documentation\": \"Major subsystem version.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"minor\", \"documentation\": \"Minor subsystem version.\", \"type\": \"i\"}]}, {\"kind\": \"value\", \"name\": \"win32_version_value\", \"documentation\": \"Value of IMAGE_OPTIONAL_HEADER::Win32VersionValue.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"size_of_image\", \"documentation\": \"Value of IMAGE_OPTIONAL_HEADER::SizeOfImage. This is the total virtual size of header and all sections.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"",
"size_of_headers\", \"documentation\": \"Value of IMAGE_OPTIONAL_HEADER::SizeOfHeaders. This is the raw data size of the PE headers including DOS header, file header, optional header and all section headers. When PE is mapped to memory, this value is subject to aligning up to SectionAlignment.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"checksum\", \"documentation\": \"Integer with the \\\"PE checksum\\\" as stored in the OptionalHeader\", \"type\": \"i\"}, {\"kind\": \"function\", \"name\": \"calculate_checksum\", \"return_type\": \"i\", \"overloads\": [{\"arguments\": [], \"documentation\": \"Function that calculates the \\\"PE checksum\\\" ```Example: pe.checksum == pe.calculate_checksum()```\"}]}, {\"kind\": \"value\", \"name\": \"subsystem\", \"documentation\": \"\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"dll_characteristics\", \"documentation\": \"Bitmap with PE OptionalHeader DllCharacteristics. Do not confuse these flags with the PE FileHeader Characteristics. Individual characteristics can be inspected by performing a bitwise AND operation with specific co",
"nstants.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"dll_name\", \"documentation\": \"The name of the DLL, if it exists in the export directory.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"export_timestamp\", \"documentation\": \"The timestamp the export data was created.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"size_of_stack_reserve\", \"documentation\": \"Value of IMAGE_OPTIONAL_HEADER::SizeOfStackReserve. This is the default amount of virtual memory that will be reserved for stack.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"size_of_stack_commit\", \"documentation\": \"Value of IMAGE_OPTIONAL_HEADER::SizeOfStackCommit. This is the default amount of virtual memory that will be allocated for stack.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"size_of_heap_reserve\", \"documentation\": \"Value of IMAGE_OPTIONAL_HEADER::SizeOfHeapReserve. This is the default amount of virtual memory that will be reserved for main process heap.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"size_of_heap_commit\", \"documentation\": \"Value of IMAGE_OPTIONAL_",
"HEADER::SizeOfHeapCommit. This is the default amount of virtual memory that will be allocated for main process heap.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"loader_flags\", \"documentation\": \"Value of IMAGE_OPTIONAL_HEADER::LoaderFlags.\", \"type\": \"i\"}, {\"kind\": \"array\", \"name\": \"data_directories\", \"documentation\": \"A zero-based array of data directories. Each data directory contains virtual address and length of the appropriate data directory. Example:  ```pe.data_directories[pe.IMAGE_DIRECTORY_ENTRY_EXPORT].virtual_address != 0``` Each data directory has the following entries:\", \"structure\": {\"kind\": \"struct\", \"name\": \"data_directories\", \"attributes\": [{\"kind\": \"value\", \"name\": \"virtual_address\", \"documentation\": \"Relative virtual address (RVA) of the PE data directory. If this is zero, then the data directory is missing. Note that for digital signature, this is the file offset, not RVA.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"size\", \"documentation\": \"Size of the PE data directory, in bytes.\", \"type\": \"i",
"\"}]}}, {\"kind\": \"array\", \"name\": \"sections\", \"documentation\": \"Individual section characteristics can be inspected using a bitwise AND operation with specific constants. Examples: ```pe.sections[0].name == \\\".text\\\"```, ```pe.sections[1].characteristics & pe.SECTION_CNT_CODE```\", \"structure\": {\"kind\": \"struct\", \"name\": \"sections\", \"attributes\": [{\"kind\": \"value\", \"name\": \"name\", \"documentation\": \"Section name.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"characteristics\", \"documentation\": \"Section characteristics.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"virtual_address\", \"documentation\": \"Section virtual address.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"virtual_size\", \"documentation\": \"Section virtual size.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"raw_data_offset\", \"documentation\": \"Section raw offset.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"raw_data_size\", \"documentation\": \"Section raw size.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"pointer_to_relocations\", \"documentation\": \"Value of IMAGE_SECTION_H",
"EADER::PointerToRelocations.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"pointer_to_line_numbers\", \"documentation\": \"Value of IMAGE_SECTION_HEADER::PointerToLinenumbers.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"number_of_relocations\", \"documentation\": \"Value of IMAGE_SECTION_HEADER::NumberOfRelocations.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"number_of_line_numbers\", \"documentation\": \"Value of IMAGE_SECTION_HEADER::NumberOfLineNumbers.\", \"type\": \"i\"}]}}, {\"kind\": \"struct\", \"name\": \"overlay\", \"documentation\": \"A structure containing members offset and size.\", \"attributes\": [{\"kind\": \"value\", \"name\": \"offset\", \"documentation\": \"Overlay section offset.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"size\", \"documentation\": \"Overlay section size.\", \"type\": \"i\"}]}, {\"kind\": \"struct\", \"name\": \"rich_signature\", \"documentation\": \"Structure containing information about the PE's rich signature as documented in http://www.ntcore.com/files/richsign.htm.\", \"attributes\": [{\"kind\": \"value\", \"name\": \"offset\", \"documentation\":",
" \"Offset where the rich signature starts. It will be undefined if the file doesn't have a rich signature.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"length\", \"documentation\": \"Length of the rich signature, not including the final 'Rich' marker.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"key\", \"documentation\": \"Key used to encrypt the data with XOR.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"raw_data\", \"documentation\": \"Raw data as it appears in the file.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"clear_data\", \"documentation\": \"Data after being decrypted by XORing it with the key.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"version_data\", \"documentation\": \"Version fields after being decrypted by XORing it with the key.\", \"type\": \"s\"}, {\"kind\": \"function\", \"name\": \"version\", \"documentation\": \"Function returning a sum of count values of all matching version records. Provide the optional toolid argument to only match when both match for one entry. More information can be found here: http://www.ntcore.com/files/ric",
"hsign.htm Note: Prior to version 3.11.0, this function returns only a boolean value (0 or 1) if the given version and optional toolid is present in an entry. ```Example: pe.rich_signature.version(24215, 261) == 61```\", \"return_type\": \"i\", \"overloads\": [{\"arguments\": [{\"type\": \"i\", \"name\": \"version\"}], \"documentation\": \"Function returning a sum of count values of all matching `version` records.\"}, {\"arguments\": [{\"type\": \"i\", \"name\": \"version\"}, {\"type\": \"i\", \"name\": \"toolid\"}], \"documentation\": \"Function returning a sum of count values of all matching `version` records that also match the specified `toolid`.\"}]}, {\"kind\": \"function\", \"name\": \"toolid\", \"return_type\": \"i\", \"documentation\": \"Function returning a sum of count values of all matching toolid records. Provide the optional version argument to only match when both match for one entry. More information can be found here: http://www.ntcore.com/files/richsign.htm Note: Prior to version 3.11.0, this function returns only a boolean value (0 or 1) if the giv",
"en toolid and optional version is present in an entry. ```Example: pe.rich_signature.toolid(170, 40219) >= 99```\", \"overloads\": [{\"arguments\": [{\"type\": \"i\", \"name\": \"toolid\"}]}, {\"arguments\": [{\"type\": \"i\", \"name\": \"toolid\"}, {\"type\": \"i\", \"name\": \"version\"}]}]}]}, {\"kind\": \"function\", \"name\": \"imphash\", \"return_type\": \"s\", \"overloads\": [{\"arguments\": [], \"documentation\": \"Function returning the import hash or imphash for the PE. The imphash is a MD5 hash of the PE's import table after some normalization. The imphash for a PE can be also computed with pefile and you can find more information in Mandiant's blog.\"}]}, {\"kind\": \"function\", \"name\": \"section_index\", \"return_type\": \"i\", \"overloads\": [{\"arguments\": [{\"type\": \"s\", \"name\": \"name\"}], \"documentation\": \"Function returning the index into the sections array for the section that has name. name is case sensitive.\"}, {\"arguments\": [{\"type\": \"i\", \"name\": \"addr\"}], \"documentation\": \"Function returning the index into the sections array for the section that has ",
"addr. addr can be an offset into the file or a memory address.\"}]}, {\"kind\": \"function\", \"name\": \"exports\", \"return_type\": \"i\", \"overloads\": [{\"arguments\": [{\"type\": \"s\", \"name\": \"function_name\"}], \"documentation\": \"Function returning true if the PE exports function_name or false otherwise.\"}, {\"arguments\": [{\"type\": \"i\", \"name\": \"ordinal\"}], \"documentation\": \"Function returning true if the PE exports ordinal or false otherwise.\"}, {\"arguments\": [{\"type\": \"r\", \"name\": \"regular_expression\"}], \"documentation\": \"Function returning true if the PE exports regular_expression or false otherwise.\"}]}, {\"kind\": \"function\", \"name\": \"exports_index\", \"return_type\": \"i\", \"overloads\": [{\"arguments\": [{\"type\": \"s\", \"name\": \"function_name\"}], \"documentation\": \"Function returning the index into the export_details array where the named function is, undefined otherwise.\"}, {\"arguments\": [{\"type\": \"i\", \"name\": \"ordinal\"}], \"documentation\": \"Function returning the index into the export_details array where the exported ordinal is,",
" undefined otherwise.\"}, {\"arguments\": [{\"type\": \"r\", \"name\": \"regular_expression\"}], \"documentation\": \"Function returning the first index into the export_details array where the regular expression matches the exported name, undefined otherwise.\"}]}, {\"kind\": \"array\", \"name\": \"export_details\", \"documentation\": \"Array of structures containing information about the PE's exports.\", \"structure\": {\"kind\": \"struct\", \"name\": \"export_details\", \"attributes\": [{\"kind\": \"value\", \"name\": \"offset\", \"documentation\": \"Offset where the exported function starts.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"name\", \"documentation\": \"Name of the exported function. It will be undefined if the function has no name.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"forward_name\", \"documentation\": \"The name of the function where this export forwards to. It will be undefined if the export is not a forwarding export.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"ordinal\", \"documentation\": \"The ordinal of the exported function, after the ordinal b",
"ase has been applied to it.\", \"type\": \"i\"}]}}, {\"kind\": \"value\", \"name\": \"IMPORT_STANDARD\", \"documentation\": \"Flag specifying which import should function imports(int,...) search\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IMPORT_DELAYED\", \"documentation\": \"Flag specifying which import should function imports(int,...) search\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"IMPORT_ANY\", \"documentation\": \"Flag specifying which import should function imports(int,...) search\", \"type\": \"i\"}, {\"kind\": \"function\", \"name\": \"imports\", \"return_type\": \"i\", \"overloads\": [{\"arguments\": [{\"type\": \"s\", \"name\": \"dll_name\"}, {\"type\": \"s\", \"name\": \"function_name\"}], \"documentation\": \"Function returning true if the PE imports function_name from dll_name, or false otherwise. dll_name is case insensitive.\"}, {\"arguments\": [{\"type\": \"s\", \"name\": \"dll_name\"}, {\"type\": \"i\", \"name\": \"ordinal\"}], \"documentation\": \"Function returning true if the PE imports ordinal from dll_name, or false otherwise. dll_name is case insensitive.\"}, {\"arguments",
"\": [{\"type\": \"s\", \"name\": \"dll_name\"}], \"documentation\": \"Function returning the number of functions from the dll_name, in the PE imports. dll_name is case insensitive.\"}, {\"arguments\": [{\"type\": \"r\", \"name\": \"dll_regexp\"}, {\"type\": \"r\", \"name\": \"function_regexp\"}], \"documentation\": \"Function returning the number of functions from the PE imports where a function name matches function_regexp and a DLL name matches dll_regexp. Both dll_regexp and function_regexp are case sensitive unless you use the \\\"/i\\\" modifier in the regexp.\"}, {\"arguments\": [{\"type\": \"i\", \"name\": \"import_flag\"}, {\"type\": \"s\", \"name\": \"dll_name\"}, {\"type\": \"s\", \"name\": \"function_name\"}], \"documentation\": \"Function returning true if the PE imports function_name from dll_name in specified import type, or false otherwise. dll_name is case insensitive.\"}, {\"arguments\": [{\"type\": \"i\", \"name\": \"import_flag\"}, {\"type\": \"s\", \"name\": \"dll_name\"}, {\"type\": \"i\", \"name\": \"ordinal\"}], \"documentation\": \"Function returning true if the PE imports ordinal ",
"from dll_name in specified import type, or false otherwise. dll_name is case insensitive.\"}, {\"arguments\": [{\"type\": \"i\", \"name\": \"import_flag\"}, {\"type\": \"s\", \"name\": \"dll_name\"}], \"documentation\": \"Function returning the number of functions from the dll_name in specified import type, in the PE imports. dll_name is case insensitive.\"}, {\"arguments\": [{\"type\": \"i\", \"name\": \"import_flag\"}, {\"type\": \"r\", \"name\": \"dll_regexp\"}, {\"type\": \"r\", \"name\": \"function_regexp\"}], \"documentation\": \"Function returning the number of functions from the PE imports where a function name matches function_regexp and a DLL name matches dll_regexp in specified import type. Both dll_regexp and function_regexp are case sensitive unless you use the \\\"/i\\\" modifier in the regexp.\"}]}, {\"kind\": \"array\", \"name\": \"import_details\", \"documentation\": \"Array of structures containing information about the PE's imports libraries.\", \"structure\": {\"kind\": \"struct\", \"name\": \"import_details\", \"attributes\": [{\"kind\": \"value\", \"name\": \"library_name\",",
" \"documentation\": \"Library name.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"number_of_functions\", \"documentation\": \"Number of imported function.\", \"type\": \"i\"}, {\"kind\": \"array\", \"name\": \"functions\", \"documentation\": \"Array of structures containing information about the PE's imports functions.\", \"structure\": {\"kind\": \"struct\", \"name\": \"functions\", \"attributes\": [{\"kind\": \"value\", \"name\": \"name\", \"documentation\": \"Name of imported function.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"ordinal\", \"documentation\": \"Ordinal of imported function. If ordinal does not exist this value is YR_UNDEFINED.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"rva\", \"documentation\": \"Relative virtual address (RVA) of imported function. If rva not found then this value is YR_UNDEFINED.\", \"type\": \"i\"}]}}]}}, {\"kind\": \"value\", \"name\": \"number_of_imported_functions\", \"documentation\": \"Number of imported functions in the PE.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"number_of_delayed_imported_functions\", \"documentation\": \"Number of delay i",
"mported functions in the PE.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"number_of_delayed_imports\", \"documentation\": \"Number of delay imported DLLs in the PE. (Number of IMAGE_DELAYLOAD_DESCRIPTOR parsed from file).\", \"type\": \"i\"}, {\"kind\": \"array\", \"name\": \"delayed_import_details\", \"documentation\": \"Array of structures containing information about the PE's delay imports libraries.\", \"structure\": {\"kind\": \"struct\", \"name\": \"import_details\", \"attributes\": [{\"kind\": \"value\", \"name\": \"library_name\", \"documentation\": \"Library name.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"number_of_functions\", \"documentation\": \"Number of imported function.\", \"type\": \"i\"}, {\"kind\": \"array\", \"name\": \"functions\", \"documentation\": \"Array of structures containing information about the PE's imports functions.\", \"structure\": {\"kind\": \"struct\", \"name\": \"functions\", \"attributes\": [{\"kind\": \"value\", \"name\": \"name\", \"documentation\": \"Name of imported function.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"ordinal\", \"documentation\": \" Ordinal",
" of imported function. If ordinal does not exist this value is YR_UNDEFINED.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"rva\", \"documentation\": \"Relative virtual address (RVA) of imported function. If rva not found then this value is YR_UNDEFINED.\", \"type\": \"i\"}]}}]}}, {\"kind\": \"function\", \"name\": \"locale\", \"return_type\": \"i\", \"overloads\": [{\"arguments\": [{\"type\": \"i\", \"name\": \"locale_identifier\"}], \"documentation\": \"Function returning true if the PE has a resource with the specified locale identifier. Locale identifiers are 16-bit integers.\"}]}, {\"kind\": \"function\", \"name\": \"language\", \"return_type\": \"i\", \"overloads\": [{\"arguments\": [{\"type\": \"i\", \"name\": \"language_identifier\"}], \"documentation\": \"Function returning true if the PE has a resource with the specified language identifier. Language identifiers are 8-bit integers.\"}]}, {\"kind\": \"function\", \"name\": \"is_dll\", \"return_type\": \"i\", \"overloads\": [{\"arguments\": [], \"documentation\": \"Function returning true if the PE is a DLL.\"}]}, {\"kind\": \"function\", \"na",
"me\": \"is_32bit\", \"return_type\": \"i\", \"overloads\": [{\"arguments\": [], \"documentation\": \"Function returning true if the PE is 32bits.\"}]}, {\"kind\": \"function\", \"name\": \"is_64bit\", \"return_type\": \"i\", \"overloads\": [{\"arguments\": [], \"documentation\": \"Function returning true if the PE is 64bits.\"}]}, {\"kind\": \"value\", \"name\": \"number_of_imports\", \"documentation\": \"Number of imports in the PE.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"number_of_exports\", \"documentation\": \"Number of exports in the PE.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"resource_timestamp\", \"documentation\": \"Resource timestamp. This is stored as an integer.\", \"type\": \"i\"}, {\"kind\": \"struct\", \"name\": \"resource_version\", \"documentation\": \"An object with two integer attributes, major and minor versions.\", \"attributes\": [{\"kind\": \"value\", \"name\": \"major\", \"documentation\": \"Major resource version.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"minor\", \"documentation\": \"Minor resource version.\", \"type\": \"i\"}]}, {\"kind\": \"array\", \"name\": \"resources\", ",
"\"documentation\": \"A zero-based array of resource objects, one for each resource the PE has. Individual resources can be accessed by using the [] operator.All resources must have a type, id (name), and language specified. They can be either an integer or string, but never both, for any given level. ```Example: pe.resources[0].type == pe.RESOURCE_TYPE_RCDATA``` ```Example: pe.resources[0].name_string == \\\"F\\\\x00I\\\\x00L\\\\x00E\\\\x00```\\\"\", \"structure\": {\"kind\": \"struct\", \"name\": \"resources\", \"attributes\": [{\"kind\": \"value\", \"name\": \"offset\", \"documentation\": \"Offset for the resource data.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"length\", \"documentation\": \"Length of the resource data.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"type\", \"documentation\": \"Type of the resource (integer).\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"id\", \"documentation\": \"ID of the resource (integer).\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"language\", \"documentation\": \"Language of the resource (integer).\", \"type\": \"i\"}, {\"kind\": \"valu",
"e\", \"name\": \"type_string\", \"documentation\": \"Type of the resource as a string, if specified.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"name_string\", \"documentation\": \"Name of the resource as a string, if specified.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"language_string\", \"documentation\": \"Language of the resource as a string, if specified.\", \"type\": \"s\"}]}}, {\"kind\": \"value\", \"name\": \"number_of_resources\", \"documentation\": \"Number of resources in the PE.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"pdb_path\", \"documentation\": \"Path of the PDB file for this PE if present. Example: ```pe.pdb_path == \\\"D:\\\\workspace\\\\2018_R9_RelBld\\target\\\\checkout\\\\custprof\\\\Release\\\\custprof.pdb\\\"``` \", \"type\": \"s\"}, {\"kind\": \"array\", \"name\": \"signatures\", \"documentation\": \"A zero-based array of signature objects, one for each authenticode signature in the PE file. Usually PE files have a single signature.\", \"structure\": {\"kind\": \"struct\", \"name\": \"signatures\", \"documentation\": \"A zero-based array of signature objects, one ",
"for each authenticode signature in the PE file. Usually PE files have a single signature.\", \"attributes\": [{\"kind\": \"value\", \"name\": \"thumbprint\", \"documentation\": \"A string containing the thumbprint of the signature.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"issuer\", \"documentation\": \"A string containing information about the issuer.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"subject\", \"documentation\": \"A string containing information about the subject.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"version\", \"documentation\": \"Version number.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"algorithm\", \"documentation\": \"String representation of the algorithm used for this signature. Usually \\\"sha1WithRSAEncryption\\\". It depends on the X.509 and PKCS#7 implementationss and possibly their versions, consider using algorithm_oid instead.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"algorithm_oid\", \"documentation\": \"Object ID of the algorithm used for this signature, expressed in numeric ASN.1 dot notation. The name contain",
"ed in algorithm is derived from this value. The object id is expected to be stable across X.509 and PKCS#7 implementations and their versions.\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"serial\", \"documentation\": \"A string containing the serial number. This is an example: 52:00:e5:aa:25:56:fc:1a:86:ed:96:c9:d4:4b:33:c7\", \"type\": \"s\"}, {\"kind\": \"value\", \"name\": \"not_before\", \"documentation\": \"Unix timestamp on which the validity period for this signature begins.\", \"type\": \"i\"}, {\"kind\": \"value\", \"name\": \"not_after\", \"documentation\": \"Unix timestamp on which the validity period for this signature ends.\", \"type\": \"i\"}, {\"kind\": \"function\", \"name\": \"valid_on\", \"return_type\": \"i\", \"overloads\": [{\"arguments\": [{\"type\": \"i\", \"name\": \"file\"}], \"documentation\": \"    Function returning true if the signature was valid on the date indicated by timestamp. The following sentence: ```pe.signatures[n].valid_on(timestamp)``` Is equivalent to: ```timestamp >= pe.signatures[n].not_before and timestamp <= pe.signatures[n].not_aft",
"er```\"}]}]}}, {\"kind\": \"value\", \"name\": \"number_of_signatures\", \"documentation\": \"Number of authenticode signatures in the PE.\", \"type\": \"i\"}, {\"kind\": \"function\", \"name\": \"iconhash\", \"return_type\": \"s\", \"overloads\": [{\"arguments\": [], \"documentation\": \"\"}]}, {\"kind\": \"function\", \"name\": \"rva_to_offset\", \"return_type\": \"i\", \"overloads\": [{\"arguments\": [{\"type\": \"i\", \"name\": \"addr\"}], \"documentation\": \"Function returning the file offset for RVA addr. Be careful to pass relative addresses here and not absolute addresses, like pe.entry_point when scanning a process. Example: ```pe.rva_to_offset(pe.sections[0].virtual_address) == pe.sections[0].raw_data_offset``` This example will make sure the offset for the virtual address in the first section equals the file offset for that section.\"}]}]}"
    };

    Gmodule_pe() : ModuleContent("pe")
    {
        std::string content;
        content.reserve(module_content_size);
        for (std::size_t i = 0; i < 46; ++i)
            content += module_content_parts[i];
        setContent(std::move(content));
    }
 };

 } // namespace modules

 } // namespace yaramod
