Generated by JEB on 2019/08/01

PE: C:\Windows\System32\drivers\dfsc.sys Base=0x1C0000000 SHA-256=00B5AA11D450F1BC58AD94E583B281747BA5A3106345309A5E4CBCA5EA139BE6
PDB: dfsc.pdb GUID={122A2536-3247-414E-80B7541CA891163A} Age=1

668 located named symbols:
0x1C000E108: "__cdecl _imp_RtlInitUnicodeStringEx" __imp_RtlInitUnicodeStringEx
0x1C000E380: "__cdecl _imp_IoAllocateIrp" __imp_IoAllocateIrp
0x1C0021D00: DfscCreateNameFromUnicodeString
0x1C0020C58: DfscNetUseCreate
0x1C000E058: "__cdecl _imp_MapSecurityError" __imp_MapSecurityError
0x1C0023468: DfscReferralGetClientInfoSize
0x1C000B1E0: g_DfscTimer
0x1C001E6DC: DfscFsctrlGetServerName
0x1C0021DF0: DfscInitDfsPath
0x1C0003740: WppClassicProviderCallback
0x1C000E310: "__cdecl _imp_ZwSetInformationThread" __imp_ZwSetInformationThread
0x1C0022BCC: DfscGetLinkReferral
0x1C000E0D0: "__cdecl _imp_KeExpandKernelStackAndCalloutEx" __imp_KeExpandKernelStackAndCalloutEx
0x1C000E258: "__cdecl _imp_SeCaptureSubjectContext" __imp_SeCaptureSubjectContext
0x1C000E028: "__cdecl _imp_MupSurrogateDeregisterProvider" __imp_MupSurrogateDeregisterProvider
0x1C00256A0: DfscRmIsTimeToRefresh
0x1C000B180: NetworkService
0x1C0023600: DfscReferralGetCurrentTarget
0x1C0007A60: "AuthIdentity" ??_C@_0N@IKCLIIIC@AuthIdentity?$AA@
0x1C001DF30: DfscFsctrlGetDriveLetterConnectionPath
0x1C000B0C8: "__cdecl _security_cookie_complement" __security_cookie_complement
0x1C0019F00: WppTraceCallback
0x1C0015FD4: DfscCallDriver
0x1C000E128: "__cdecl _imp_ObfDereferenceObject" __imp_ObfDereferenceObject
0x1C0002E84: WPP_SF_LL
0x1C001C384: DfscCopyDcList
0x1C0001BB4: DfscClusterSetCachePurge
0x1C0011D60: DfscConnOpenIpcConnectionCallin
0x1C0007678: "Parameters" ??_C@_1BG@PGIGMDPA@?$AAP?$AAa?$AAr?$AAa?$AAm?$AAe?$AAt?$AAe?$AAr?$AAs?$AA?$AA@
0x1C0017B30: DfscRmValidateRootGetParent
0x1C00258C0: DfscSetMatchingTarget
0x1C000E088: "__cdecl _imp_RpcAsyncCompleteCall" __imp_RpcAsyncCompleteCall
0x1C00081D0: GUID_ECP_DOMAIN_SERVICE_NAME_CONTEXT
0x1C000B6C0: DfscPathNameLookasideList
0x1C001A470: DfscPopulateDomainNameCache
0x1C0007AC0: WPP_ae17dc0d30fa3affe9c618659f7f07c4_Traceguids
0x1C0017AE0: DfscRmValidateLinkIterate
0x1C0002028: WPP_SF_L
0x1C0003BC0: WPP_SF_l
0x1C000E0C8: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x1C001C640: DfscCreateLinkedConnectionWorker
0x1C0001570: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x1C0010600: DfscCmInitializeContext
0x1C000E010: "__cdecl _imp_MupSurrogateRestoreFileNameInFileObject" __imp_MupSurrogateRestoreFileNameInFileObject
0x1C0024304: DfscRmGenerateDomainReferralsFromResponse
0x1C0007BA8: "GetSysvolNetlogonReferral" ??_C@_1DE@OBKLHFIC@?$AAG?$AAe?$AAt?$AAS?$AAy?$AAs?$AAv?$AAo?$AAl?$AAN?$AAe?$AAt?$AAl?$AAo?$AAg?$AAo?$AAn?$AAR?$AAe?$AAf?$AAe?$AAr?$AAr?$AAa?$AAl?$AA?$AA@
0x1C00077F8: "MaxReferralTTLInSeconds" ??_C@_1DA@NOGEPAPL@?$AAM?$AAa?$AAx?$AAR?$AAe?$AAf?$AAe?$AAr?$AAr?$AAa?$AAl?$AAT?$AAT?$AAL?$AAI?$AAn?$AAS?$AAe?$AAc?$AAo?$AAn?$AAd?$AAs?$AA?$AA@
0x1C0008488: WPP_22deaa4848353301c90c3fc87a612d3b_Traceguids
0x1C0008440: "ROOT_REF" ??_C@_1BC@DPCMHBLN@?$AAR?$AAO?$AAO?$AAT?$AA_?$AAR?$AAE?$AAF?$AA?$AA@
0x1C0007A40: GUID_ECP_NETWORK_OPEN_CONTEXT
0x1C000E330: "__cdecl _imp_PsTerminateSystemThread" __imp_PsTerminateSystemThread
0x1C0021F10: DfscDAConnectivityChangeHandler
0x1C0027660: DfscApplyDeviceAcl
0x1C000E1B8: "__cdecl _imp_IoCreateDevice" __imp_IoCreateDevice
0x1C000E2C0: "__cdecl _imp_SeCreateClientSecurityFromSubjectContext" __imp_SeCreateClientSecurityFromSubjectContext
0x1C000E3F8: "__cdecl _imp_PsAttachSiloToCurrentThread" __imp_PsAttachSiloToCurrentThread
0x1C0019A94: DfscRestartCreateViaReparse
0x1C0007A00: "WmiTraceMessage" ??_C@_1CA@OFIBBPKJ@?$AAW?$AAm?$AAi?$AAT?$AAr?$AAa?$AAc?$AAe?$AAM?$AAe?$AAs?$AAs?$AAa?$AAg?$AAe?$AA?$AA@
0x1C000E420: "__cdecl _imp_PsGetPermanentSiloContext" __imp_PsGetPermanentSiloContext
0x1C000E480: "__cdecl _imp_IofCompleteRequest" __imp_IofCompleteRequest
0x1C000E230: "__cdecl _imp_RtlCreateSecurityDescriptor" __imp_RtlCreateSecurityDescriptor
0x1C000E178: "__cdecl _imp_FsRtlFindExtraCreateParameter" __imp_FsRtlFindExtraCreateParameter
0x1C000E050: "__cdecl _imp_SspiMarshalAuthIdentity" __imp_SspiMarshalAuthIdentity
0x1C00161E0: DfscCmDataAccessState
0x1C0022198: DfscInitializeSiteNameAndRegisterChangeNotification
0x1C000E2A0: "__cdecl _imp_wcschr" __imp_wcschr
0x1C0008328: WPP_3b137a23268c3ac8ea48cab52d483dcb_Traceguids
0x1C001B118: DfscCreateTreeConnectName
0x1C000E518: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x1C0019BE8: DfscInitUnwind
0x1C000E1F0: "__cdecl _imp_ExDeletePagedLookasideList" __imp_ExDeletePagedLookasideList
0x1C000E160: "__cdecl _imp_RtlEnumerateGenericTableAvl" __imp_RtlEnumerateGenericTableAvl
0x1C0019210: DfscNetUseTableFreeEntry
0x1C0004D1C: DfscRmGenerateClusterSetReferralFromName
0x1C000E270: "__cdecl _imp_SeQuerySessionIdToken" __imp_SeQuerySessionIdToken
0x1C000E1E8: "__cdecl _imp_KeAllocateCalloutStack" __imp_KeAllocateCalloutStack
0x1C0008290: "<Def>" ??_C@_1M@FEAKCIMF@?$AA?$DM?$AAD?$AAe?$AAf?$AA?$DO?$AA?$AA@
0x1C000E1A8: "__cdecl _imp_MmGetSystemRoutineAddress" __imp_MmGetSystemRoutineAddress
0x1C00172A0: DfscCmValidateState
0x1C0003DB0: DfscFsctrlSqmGetData
0x1C000E0C0: "__cdecl _imp_IoGetAttachedDevice" __imp_IoGetAttachedDevice
0x1C000E398: "__cdecl _imp_KeInitializeSpinLock" __imp_KeInitializeSpinLock
0x1C0007C28: "InterLink" ??_C@_1BE@JNCLLAGO@?$AAI?$AAn?$AAt?$AAe?$AAr?$AAL?$AAi?$AAn?$AAk?$AA?$AA@
0x1C0007710: "MaxDomainCacheKBytes" ??_C@_1CK@GHJLGLCL@?$AAM?$AAa?$AAx?$AAD?$AAo?$AAm?$AAa?$AAi?$AAn?$AAC?$AAa?$AAc?$AAh?$AAe?$AAK?$AAB?$AAy?$AAt?$AAe?$AAs?$AA?$AA@
0x1C00075A0: "\IPC$" ??_C@_1M@CMEOLBBK@?$AA?2?$AAI?$AAP?$AAC?$AA$?$AA?$AA@
0x1C000E300: "__cdecl _imp_ZwQueryInformationToken" __imp_ZwQueryInformationToken
0x1C0023630: DfscReferralGetPrimaryTarget
0x1C0022F34: DfscIsKnownDomainName
0x1C000E278: "__cdecl _imp_KeWaitForSingleObject" __imp_KeWaitForSingleObject
0x1C000E448: "__cdecl _imp_RtlAppendUnicodeStringToString" __imp_RtlAppendUnicodeStringToString
0x1C000E3C0: "__cdecl _imp_KeReleaseSpinLock" __imp_KeReleaseSpinLock
0x1C000206C: WPP_SF_DDZ
0x1C0002BA0: DfscGetIpcConnectionSmbProtocolVersion
0x1C000E418: "__cdecl _imp_PsDereferenceSiloContext" __imp_PsDereferenceSiloContext
0x1C0004474: WPP_SF_dSZ
0x1C0003298: WPP_SF_dsZ
0x1C000E148: "__cdecl _imp_RtlInsertElementGenericTableFullAvl" __imp_RtlInsertElementGenericTableFullAvl
0x1C0007AD0: WPP_095eb534ef2135544a15de33f8236416_Traceguids
0x1C0003990: WPP_SF_ZZD
0x1C002189C: DfscNetUseTableDump
0x1C000E240: "__cdecl _imp_ObSetSecurityObjectByPointer" __imp_ObSetSecurityObjectByPointer
0x1C000B0D0: DfscFailoverErrorList
0x1C0021520: DfscNetUseTableAllocateEntry
0x1C001FFBC: DfscGetDcListForDomain
0x1C001C930: DfscDeleteLinkedConnectionWorker
0x1C00049F4: DfscReferralReference
0x1C0004918: WPP_SF_dqZq
0x1C0011F30: DfscFileSystemControl
0x1C001C080: DfscImpersonateCaller
0x1C0012240: DfscRmValidateDomainGetParent
0x1C0007640: "EnableDfsLoopbackTargets" ??_C@_1DC@MFBKMOHK@?$AAE?$AAn?$AAa?$AAb?$AAl?$AAe?$AAD?$AAf?$AAs?$AAL?$AAo?$AAo?$AAp?$AAb?$AAa?$AAc?$AAk?$AAT?$AAa?$AAr?$AAg?$AAe?$AAt?$AAs?$AA?$AA@
0x1C0008318: WPP_fcfe3ba7d83839681334022f71369620_Traceguids
0x1C0001580: memcpy
0x1C0007C08: "GetLinkReferral" ??_C@_1CA@EFHKJLFF@?$AAG?$AAe?$AAt?$AAL?$AAi?$AAn?$AAk?$AAR?$AAe?$AAf?$AAe?$AAr?$AAr?$AAa?$AAl?$AA?$AA@
0x1C0021550: DfscNetUseTableCompareEntries
0x1C000B060: DfscValidateLinkStatesTable
0x1C0022110: DfscGetUlongRegistryParameter
0x1C0023BF0: DfscCopyTargetAccessStatus
0x1C00229D0: DfscGetDsDCReferral
0x1C0007690: "MaxEntriesDeletedPerInterval" ??_C@_1DK@IEDEBOFI@?$AAM?$AAa?$AAx?$AAE?$AAn?$AAt?$AAr?$AAi?$AAe?$AAs?$AAD?$AAe?$AAl?$AAe?$AAt?$AAe?$AAd?$AAP?$AAe?$AAr?$AAI?$AAn?$AAt?$AAe?$AAr?$AAv?$AAa?$AAl?$AA?$AA@
0x1C0017800: DfscRmValidateDomainIterate
0x1C000E3A0: "__cdecl _imp_KeInitializeDpc" __imp_KeInitializeDpc
0x1C000B230: g_DfscTimerCompleteEvent
0x1C0019354: DfscCredTableStore
0x1C000E218: "__cdecl _imp_RtlSubAuthoritySid" __imp_RtlSubAuthoritySid
0x1C000E048: "__cdecl _imp_SspiFreeAuthIdentity" __imp_SspiFreeAuthIdentity
0x1C000E2D0: "__cdecl _imp_SeTokenType" __imp_SeTokenType
0x1C000E1C0: "__cdecl _imp_IoDeleteDevice" __imp_IoDeleteDevice
0x1C000B670: pfnWppGetVersion
0x1C0019024: DfscCredTableDump
0x1C00028AC: DfscValidateSysvolNetlogonReferral
0x1C000E460: "__cdecl _imp_FsRtlCancellableWaitForSingleObject" __imp_FsRtlCancellableWaitForSingleObject
0x1C00013FD: "__cdecl _C_specific_handler" __C_specific_handler
0x1C000E488: "__cdecl _imp_RtlNextUnicodePrefix" __imp_RtlNextUnicodePrefix
0x1C000E468: "__cdecl _imp_IofCallDriver" __imp_IofCallDriver
0x1C0006150: MIDL_user_free
0x1C0023ACC: DfscRmSetReferralType
0x1C000E0A8: "__cdecl _imp_RpcBindingUnbind" __imp_RpcBindingUnbind
0x1C000B090: DfscDefaultLogString
0x1C001D444: DfscFsctrlFlushDomainCache
0x1C000B660: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUuhUivnlgvuhUwuhUxorvmgUlyquivUznwGEUwuhxPkxsOlyq@dfsc" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUuhUivnlgvuhUwuhUxorvmgUlyquivUznwGEUwuhxPkxsOlyq@dfsc
0x1C0001580: memmove
0x1C001A7A4: DfscReleaseDcContext
0x1C001D610: DfscFsctrlFlushRefCache
0x1C000E208: "__cdecl _imp_RtlLengthRequiredSid" __imp_RtlLengthRequiredSid
0x1C000E1D8: "__cdecl _imp_RtlCopyUnicodeString" __imp_RtlCopyUnicodeString
0x1C0005BB8: DfscIsDomainController
0x1C000E220: "__cdecl _imp_RtlCreateAcl" __imp_RtlCreateAcl
0x1C0026148: DfscQueryInformationFile
0x1C002389C: DfscRefreshBootstrapDCAndGetDCReferral
0x1C0008258: WPP_0e8012921dfb3416f8b80d515010d73b_Traceguids
0x1C000E400: "__cdecl _imp_PsDetachSiloFromCurrentThread" __imp_PsDetachSiloFromCurrentThread
0x1C000E450: "__cdecl _imp_KeReadStateEvent" __imp_KeReadStateEvent
0x1C000144C: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x1C0007770: "DomainTTLMultiplier" ??_C@_1CI@MCLKOEO@?$AAD?$AAo?$AAm?$AAa?$AAi?$AAn?$AAT?$AAT?$AAL?$AAM?$AAu?$AAl?$AAt?$AAi?$AAp?$AAl?$AAi?$AAe?$AAr?$AA?$AA@
0x1C0024FE0: DfscRmGetDomainReferral
0x1C00198B0: DfscGetNetworkOpenEcpIntegrityLevelFromHardeningCapabilities
0x1C00225AC: DfscCleanupGetClientInfoParameters
0x1C0012558: DfscRegisterMup
0x1C0015E40: DfscDomainCacheLookup
0x1C000E150: "__cdecl _imp_RtlDeleteElementGenericTableAvl" __imp_RtlDeleteElementGenericTableAvl
0x1C0018FBC: DfscCredTableDelete
0x1C000B3E0: WPP_MAIN_CB
0x1C000E4D8: "__cdecl _imp_ExDeleteResourceLite" __imp_ExDeleteResourceLite
0x1C0021AF0: DfscNetUseTablePurge
0x1C001BB78: DfscGetEffectiveRequestorSessionId
0x1C0008338: WPP_0dea3fcb179134ae4659f3e371921dc2_Traceguids
0x1C001A2C4: DfscIterateAndGetReferral
0x1C000E430: "__cdecl _imp_PsStartSiloMonitor" __imp_PsStartSiloMonitor
0x1C0023660: DfscReferralIsValid
0x1C00082D8: "DFSCreate" ??_C@_09FHDGEKOA@DFSCreate?$AA@
0x1C00075C8: WPP_ThisDir_CTLGUID_RFSMon
0x1C0007140: DfscCmDispatchTable
0x1C000B240: g_OsVersionInfo
0x1C00125D0: DfscInitializeAndRegisterDAKeyChangeNotification
0x1C001CA34: DfscFsctrlCreateDriveLetter
0x1C0007A50: WPP_f27d491f790537f565c7b8549e4ec1d4_Traceguids
0x1C000E4A8: "__cdecl _imp_RtlInsertUnicodePrefix" __imp_RtlInsertUnicodePrefix
0x1C000E038: MUP_NULL_THUNK_DATA
0x1C0007B68: "CheckRefType" ??_C@_1BK@HLKCNAJI@?$AAC?$AAh?$AAe?$AAc?$AAk?$AAR?$AAe?$AAf?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x1C000E3E8: "__cdecl _imp_IoQueueWorkItem" __imp_IoQueueWorkItem
0x1C0016CA0: DfscCmCheckRefTypeState
0x1C001A154: DfscCreateDcContext
0x1C000E118: "__cdecl _imp_ZwQueryInformationFile" __imp_ZwQueryInformationFile
0x1C0027270: DfscInitVariables
0x1C0002CC0: WPP_SF_ZqsZZD
0x1C0007798: "ReferralTTLMultiplier" ??_C@_1CM@ILAIBAPM@?$AAR?$AAe?$AAf?$AAe?$AAr?$AAr?$AAa?$AAl?$AAT?$AAT?$AAL?$AAM?$AAu?$AAl?$AAt?$AAi?$AAp?$AAl?$AAi?$AAe?$AAr?$AA?$AA@
0x1C00041F4: WPP_SF_h
0x1C000E500: "__cdecl _imp_strcmp" __imp_strcmp
0x1C0012490: DfscCacheInitialize
0x1C000E1D0: "__cdecl _imp_IoCreateSymbolicLink" __imp_IoCreateSymbolicLink
0x1C000E1A0: "__cdecl _imp_FsRtlAcknowledgeEcp" __imp_FsRtlAcknowledgeEcp
0x1C000E190: "__cdecl _imp_RtlPrefixUnicodeString" __imp_RtlPrefixUnicodeString
0x1C0024A34: DfscRmGenerateReferralFromResponse
0x1C000E000: "__cdecl _imp_MupSurrogateGetUncProviderDeviceObject" __imp_MupSurrogateGetUncProviderDeviceObject
0x1C0021A68: DfscNetUseTableLookup
0x1C001C458: DfscCreateLinkedConnection
0x1C000E4F8: "__cdecl _imp_ExAllocatePoolWithTag" __imp_ExAllocatePoolWithTag
0x1C00082F8: "%08x%08x" ??_C@_1BC@JCJHFE@?$AA?$CF?$AA0?$AA8?$AAx?$AA?$CF?$AA0?$AA8?$AAx?$AA?$AA@
0x1C0015F44: DfscRefCacheStore
0x1C0007840: "\Registry\Machine\System\Current" ??_C@_1HA@IMIGLNCK@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1C000E008: "__cdecl _imp_MupSurrogatePurgeNegativeCacheEntry" __imp_MupSurrogatePurgeNegativeCacheEntry
0x1C002610C: DfscRmIntegratedStringCheck
0x1C000B690: pfnWppQueryTraceInformation
0x1C0008478: WPP_b4a46605afb33803fc9baa4e8bf2b8ef_Traceguids
0x1C0010050: DfscSurrogateCreate
0x1C0008278: "NETLOGON" ??_C@_1BC@KNIBMHCO@?$AAN?$AAE?$AAT?$AAL?$AAO?$AAG?$AAO?$AAN?$AA?$AA@
0x1C000E2B0: "__cdecl _imp_SeCaptureSubjectContextEx" __imp_SeCaptureSubjectContextEx
0x1C001944C: DfscAddEcpToIrp
0x1C001AAD8: DfscCreateNetUseConnection
0x1C00075B0: "\Device\Mup" ??_C@_1BI@GOOABFBJ@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAM?$AAu?$AAp?$AA?$AA@
0x1C0012190: DfscCreate
0x1C00081EC: "" ??_C@_13BLAPAIAM@?$AA?$AI?$AA?$AA@
0x1C000B698: DfsLUIDDeviceMapsEnabled
0x1C000E318: "__cdecl _imp_ZwOpenThreadTokenEx" __imp_ZwOpenThreadTokenEx
0x1C0020B68: DfscNetUseCopyEnumEntry
0x1C00014B4: "__cdecl _GSHandlerCheck_SEH" __GSHandlerCheck_SEH
0x1C000E534: "__cdecl _IMPORT_DESCRIPTOR_MUP" __IMPORT_DESCRIPTOR_MUP
0x1C001FD34: DfscFsctrlSpecialSetDc
0x1C000E2E8: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x1C0007CB0: "TSCLIENT" ??_C@_1BC@JMKNIMAL@?$AAT?$AAS?$AAC?$AAL?$AAI?$AAE?$AAN?$AAT?$AA?$AA@
0x1C00210F4: DfscNetUseRelease
0x1C001EA84: DfscFsctrlIsValidDriveLetterConnection
0x1C000E490: "__cdecl _imp_KeLeaveCriticalRegion" __imp_KeLeaveCriticalRegion
0x1C0008268: "SYSVOL" ??_C@_1O@DKFKJANF@?$AAS?$AAY?$AAS?$AAV?$AAO?$AAL?$AA?$AA@
0x1C0020630: DfscRevert
0x1C00156E8: DfscCacheLookup
0x1C0001010: DfscScavenger
0x1C0025758: DfscRmSendSynchFsctlIrp
0x1C000E3E0: "__cdecl _imp_KeReleaseSpinLockFromDpcLevel" __imp_KeReleaseSpinLockFromDpcLevel
0x1C0022688: DfscGetCacheReferral
0x1C0001428: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x1C0007A20: "PsGetVersion" ??_C@_1BK@DHLDGJM@?$AAP?$AAs?$AAG?$AAe?$AAt?$AAV?$AAe?$AAr?$AAs?$AAi?$AAo?$AAn?$AA?$AA@
0x1C000E4B0: "__cdecl _imp_RtlRemoveUnicodePrefix" __imp_RtlRemoveUnicodePrefix
0x1C000E228: "__cdecl _imp_RtlAddAccessAllowedAce" __imp_RtlAddAccessAllowedAce
0x1C000B168: DfscCreatePathErrorList
0x1C000E0A0: "__cdecl _imp_RpcBindingCreateW" __imp_RpcBindingCreateW
0x1C000E3D0: "__cdecl _imp_IoFreeWorkItem" __imp_IoFreeWorkItem
0x1C0007AB0: WPP_177e528756b136e20252ffb00d4be96b_Traceguids
0x1C000E250: "__cdecl _imp_ZwCreateFile" __imp_ZwCreateFile
0x1C0003C10: DfscFsctrlGetUseInfo
0x1C000E328: "__cdecl _imp_PsCreateSystemThread" __imp_PsCreateSystemThread
0x1C0024088: DfscRmGenerateDomainDcReferralFromResponse
0x1C0019A1C: DfscRemoveEcpFromIrp
0x1C0003390: DfscGetReferralFromPath
0x1C00081E0: "NULL" ??_C@_19CIJIHAKK@?$AAN?$AAU?$AAL?$AAL?$AA?$AA@
0x1C000B678: pfnEtwRegisterClassicProvider
0x1C000E0B0: msrpc_NULL_THUNK_DATA
0x1C0007828: "DisableDfs" ??_C@_1BG@NPJDDMBG@?$AAD?$AAi?$AAs?$AAa?$AAb?$AAl?$AAe?$AAD?$AAf?$AAs?$AA?$AA@
0x1C000B238: g_DfscTimerPosted
0x1C000B228: g_DfscTimerSpinLock
0x1C0005E6C: DfscRpcConnect
0x1C000E348: "__cdecl _imp_RtlGetVersion" __imp_RtlGetVersion
0x1C000B69C: DfscInitializationStatus
0x1C000E0D8: "__cdecl _imp_IoGetSiloParameters" __imp_IoGetSiloParameters
0x1C00038EC: WPP_SF_ZD
0x1C000236C: WPP_SF_ZZ
0x1C000409C: WPP_SF_Zq
0x1C000E1C8: "__cdecl _imp_IoDeleteSymbolicLink" __imp_IoDeleteSymbolicLink
0x1C0025710: DfscRmReferralTargetSortFunc
0x1C001C774: DfscDeleteLinkedConnection
0x1C00022E8: WPP_SF_Z
0x1C00075AC: "\" ??_C@_13FPGAJAPJ@?$AA?2?$AA?$AA@
0x1C000E440: "__cdecl _imp_PsReferenceSiloContext" __imp_PsReferenceSiloContext
0x1C0001D10: WPP_SF_
0x1C0020684: DfscSetActiveDcForDomain
0x1C000E090: "__cdecl _imp_RpcBindingFree" __imp_RpcBindingFree
0x1C0008240: WPP_95e8a59ed2cc358d1f9b342a7980648e_Traceguids
0x1C00123F0: DfscNetUseTableInitialize
0x1C000B680: pfnEtwUnregister
0x1C001B990: DfscGetConnection
0x1C00082E8: "\??\X:" ??_C@_1O@KBDNNIJO@?$AA?2?$AA?$DP?$AA?$DP?$AA?2?$AAX?$AA?3?$AA?$AA@
0x1C0008428: "LINK_REF" ??_C@_1BC@LILAMFDD@?$AAL?$AAI?$AAN?$AAK?$AA_?$AAR?$AAE?$AAF?$AA?$AA@
0x1C00116B0: DfscCmGetRootReferralState
0x1C001B3D8: DfscDeleteNetUseConnection
0x1C0019EB0: DfscSystemControl
0x1C0012DA8: DfscReadLinkedConnectionPolicy
0x1C0003774: RtlStringCbPrintfW
0x1C00199C4: DfscIsSpecialShare
0x1C000E2F0: "__cdecl _imp_IoIs32bitProcess" __imp_IoIs32bitProcess
0x1C000E360: "__cdecl _imp_RtlEqualUnicodeString" __imp_RtlEqualUnicodeString
0x1C0008228: WPP_43abde38d2cb349fa108b9b88e2cf2bf_Traceguids
0x1C000E268: "__cdecl _imp_SeReleaseSubjectContext" __imp_SeReleaseSubjectContext
0x1C0001F34: WPP_SF_qqZ
0x1C0004AC4: WPP_SF_qZZ
0x1C00169A0: DfscPostProcessDataAccessState
0x1C0008468: WPP_0e46497630893ff6a4652ac3f8c8092a_Traceguids
0x1C000E298: "__cdecl _imp_RtlIntegerToUnicodeString" __imp_RtlIntegerToUnicodeString
0x1C00267C0: DfscpContainerTerminateNotify
0x1C0002550: DfscCmGetSysvolNetlogonReferralState
0x1C0018218: DfscCredCopyNonCredEAs
0x1C0027010: GsDriverEntry
0x1C000E510: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x1C0007B40: "Init" ??_C@_19HABNGADD@?$AAI?$AAn?$AAi?$AAt?$AA?$AA@
0x1C0001260: DfscCachePurge
0x1C0020484: DfscImpersonateLinkedToken
0x1C0008238: "<Def>" ??_C@_05JBJBMMNN@?$DMDef?$DO?$AA@
0x1C000E3B0: "__cdecl _imp_KeSetCoalescableTimer" __imp_KeSetCoalescableTimer
0x1C0003524: DfscPathPrefixMatch
0x1C00122B0: DfscRmUnlinkReferral
0x1C0017374: DfscLookupRootTarget
0x1C00261F0: DfscpContainerCleanupNotify
0x1C00081F0: "NULL" ??_C@_04HIBGFPH@NULL?$AA@
0x1C0011D10: DfscConnOpenIpcConnectionCallout
0x1C001F818: DfscFsctrlSetDcName
0x1C000E0B8: "__cdecl _imp_RtlAppendUnicodeToString" __imp_RtlAppendUnicodeToString
0x1C00082C0: "WAS" ??_C@_17NIICKDMM@?$AAW?$AAA?$AAS?$AA?$AA@
0x1C000E110: "__cdecl _imp_ObReferenceObjectByHandle" __imp_ObReferenceObjectByHandle
0x1C0001170: DfscTimerDispatch
0x1C0019210: DfscCredTableFreeEntry
0x1C0022E94: DfscGetSiteName
0x1C000B460: DfscGlobalData
0x1C0015EC4: DfscDomainCacheStore
0x1C0007A70: "UserName" ??_C@_08KAFEAHEM@UserName?$AA@
0x1C000E3F0: "__cdecl _imp_PsCreateSiloContext" __imp_PsCreateSiloContext
0x1C001E010: DfscFsctrlGetRefCache
0x1C0007BF0: "DataAccess" ??_C@_1BG@LCOKDBF@?$AAD?$AAa?$AAt?$AAa?$AAA?$AAc?$AAc?$AAe?$AAs?$AAs?$AA?$AA@
0x1C000E158: "__cdecl _imp_RtlNumberGenericTableElementsAvl" __imp_RtlNumberGenericTableElementsAvl
0x1C0021C30: DfscNetUseTableStore
0x1C0016D30: DfscCmGetLinkReferralState
0x1C0020808: DfscNetUseAdd
0x1C0004138: WPP_SF_dD
0x1C0003594: WPP_SF_Dd
0x1C0001D3C: WPP_SF_DD
0x1C0001D3C: WPP_SF_dd
0x1C000212C: WPP_SF_DZ
0x1C0017110: DfscCmIterateState
0x1C0003EC4: WPP_SF_DS
0x1C000403C: WPP_SF_Dq
0x1C000B000: WPP_GLOBAL_Control
0x1C0021A38: DfscNetUseTableFree
0x1C000E340: "__cdecl _imp_ZwQueryValueKey" __imp_ZwQueryValueKey
0x1C0007C68: "PIPE" ??_C@_19DDPHGIPP@?$AAP?$AAI?$AAP?$AAE?$AA?$AA@
0x1C0008250: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x1C0019914: DfscIsPseudoServer
0x1C000E308: "__cdecl _imp_ZwDuplicateToken" __imp_ZwDuplicateToken
0x1C0002028: WPP_SF_D
0x1C00198C8: DfscIsErrorInList
0x1C000E248: "__cdecl _imp_PsRevertToSelf" __imp_PsRevertToSelf
0x1C000E2A8: "__cdecl _imp_towupper" __imp_towupper
0x1C0017040: DfscCmInterLinkState
0x1C000E080: "__cdecl _imp_I_RpcExceptionFilter" __imp_I_RpcExceptionFilter
0x1C001C2FC: DfscPackString
0x1C0001546: strcmp
0x1C0007A90: WPP_dbfc52cb7ff43ba3cefb07087b52e2fc_Traceguids
0x1C0005398: DfscCredDelete
0x1C00082B0: WPP_a5555193293732220b6fb2a3a1caf24a_Traceguids
0x1C000B080: DfscValidateDomainStatesTable
0x1C000E1E0: "__cdecl _imp_ExInitializePagedLookasideList" __imp_ExInitializePagedLookasideList
0x1C0007AA0: WPP_e6508306fe7e3969018b85e154650217_Traceguids
0x1C001C1B8: DfscIsValidDriveLetter
0x1C000E168: "__cdecl _imp_RtlCompareUnicodeString" __imp_RtlCompareUnicodeString
0x1C000E018: "__cdecl _imp_MupSurrogateCheckNegativeCache" __imp_MupSurrogateCheckNegativeCache
0x1C00013C0: "__cdecl _security_check_cookie" __security_check_cookie
0x1C00250A4: DfscRmGetNormalReferral
0x1C0012250: DfscRmDereferenceReferral
0x1C000830C: "\;" ??_C@_15BCFLOJHA@?$AA?2?$AA?$DL?$AA?$AA@
0x1C000E4E0: "__cdecl _imp_RtlInitializeUnicodePrefix" __imp_RtlInitializeUnicodePrefix
0x1C002293C: DfscGetDomainReferral
0x1C0008380: "\Registry\Machine\System\Current" ??_C@_1JA@IHGIOFBF@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1C001BCD8: DfscGetNormalizedDriveLetterUnicodeString
0x1C000E520: "__cdecl _IMPORT_DESCRIPTOR_ntoskrnl" __IMPORT_DESCRIPTOR_ntoskrnl
0x1C00239C8: DfscRmCreateRefContext
0x1C000E1F8: "__cdecl _imp_KeFreeCalloutStack" __imp_KeFreeCalloutStack
0x1C00191CC: DfscCredTableFree
0x1C001B040: DfscCreateSymbolicLink
0x1C00047D8: WPP_SF_qdd
0x1C0001E24: WPP_SF_qDD
0x1C0010010: DfscSurrogatePreProcess
0x1C000E0F0: "__cdecl _imp_FsRtlInsertExtraCreateParameter" __imp_FsRtlInsertExtraCreateParameter
0x1C00051A8: WPP_SF_Dqq
0x1C00036D8: WPP_SF_qqd
0x1C0004570: WPP_SF_qZD
0x1C000E55C: "__cdecl _IMPORT_DESCRIPTOR_msrpc" __IMPORT_DESCRIPTOR_msrpc
0x1C002529C: DfscRmGetNormalReferralSize
0x1C000B6A0: DfscPathNameMaxDepth
0x1C001DD74: DfscFsctrlGetDomainCache
0x1C00158EC: DfscCacheStore
0x1C000E180: "__cdecl _imp_FsRtlRemoveExtraCreateParameter" __imp_FsRtlRemoveExtraCreateParameter
0x1C000E170: "__cdecl _imp_IoGetIrpExtraCreateParameter" __imp_IoGetIrpExtraCreateParameter
0x1C0018994: DfscCredGetKeymgrCredentials
0x1C0004BD8: WPP_SF_qqDZ
0x1C0019590: DfscCmReleaseContext
0x1C000E198: "__cdecl _imp_IoSetIrpExtraCreateParameter" __imp_IoSetIrpExtraCreateParameter
0x1C000E3D8: "__cdecl _imp_KeAcquireSpinLockAtDpcLevel" __imp_KeAcquireSpinLockAtDpcLevel
0x1C0024D98: DfscRmGetDomainDcReferral
0x1C0008498: WPP_36278d9ed63e3b0c9d774e9bbb1cb708_Traceguids
0x1C001996C: DfscIsReservedShare
0x1C00042D4: DfscNetUseIncrementOpenHandleCount
0x1C0024EF8: DfscRmGetDomainDcReferralSize
0x1C000B6A8: g_DfscTimerWorkItem
0x1C000B070: DfscValidateRootStatesTable
0x1C0003170: WPP_SF_dqZdDDd
0x1C0017BC0: DfscRmValidateRootIterate
0x1C0015580: DfscAgeOutOldestCacheEntries
0x1C0007C98: "MAILSLOT" ??_C@_1BC@BNCCNADH@?$AAM?$AAA?$AAI?$AAL?$AAS?$AAL?$AAO?$AAT?$AA?$AA@
0x1C0012E1C: DfscInitializeTimer
0x1C00082A0: WPP_196f2b68c1a530a22097350d41bf5e4d_Traceguids
0x1C0005280: DfscTearDownTimer
0x1C001E954: DfscFsctrlIsDfsPath
0x1C000E0E8: "__cdecl _imp_FsRtlAllocateExtraCreateParameter" __imp_FsRtlAllocateExtraCreateParameter
0x1C0011020: DfscGetPathComponents
0x1C0017A40: DfscRmValidateLinkGetParent
0x1C000E410: "__cdecl _imp_PsGetSiloMonitorContextSlot" __imp_PsGetSiloMonitorContextSlot
0x1C00076D0: "ScavengerThreadIntervalSeconds" ??_C@_1DO@JKOFAIFI@?$AAS?$AAc?$AAa?$AAv?$AAe?$AAn?$AAg?$AAe?$AAr?$AAT?$AAh?$AAr?$AAe?$AAa?$AAd?$AAI?$AAn?$AAt?$AAe?$AAr?$AAv?$AAa?$AAl?$AAS?$AAe?$AAc?$AAo?$AAn?$AAd?$AAs?$AA?$AA@
0x1C0028000: "__cdecl _guard_fids_table" __guard_fids_table
0x1C000E4C0: "__cdecl _imp_ExAcquireResourceExclusiveLite" __imp_ExAcquireResourceExclusiveLite
0x1C000E188: "__cdecl _imp_FsRtlFreeExtraCreateParameter" __imp_FsRtlFreeExtraCreateParameter
0x1C0026360: DfscpContainerCreateNotify
0x1C0007610: "UseDcLocatorSiteName" ??_C@_1CK@CNMCONPB@?$AAU?$AAs?$AAe?$AAD?$AAc?$AAL?$AAo?$AAc?$AAa?$AAt?$AAo?$AAr?$AAS?$AAi?$AAt?$AAe?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x1C0017CC4: DfscValidateReferral
0x1C0025D84: DfscRmCheckReferralSyntaxV2
0x1C0007030: "__cdecl load_config_used" _load_config_used
0x1C0025C70: DfscRmCheckReferralSyntaxV1
0x1C000E200: "__cdecl _imp_ZwQueryInformationProcess" __imp_ZwQueryInformationProcess
0x1C000564C: DfscCredWrite
0x1C0025378: DfscRmGetPathConsumed
0x1C000E2D8: "__cdecl _imp_PsDereferencePrimaryToken" __imp_PsDereferencePrimaryToken
0x1C0018ED0: DfscCredTableCompareEntries
0x1C0018EA0: DfscCredTableAllocateEntry
0x1C000B3A0: SiteNameRegKeyMonitor
0x1C00197D0: DfscCompareStringsIgnoreTrailingChars
0x1C000E320: "__cdecl _imp_ZwOpenProcessTokenEx" __imp_ZwOpenProcessTokenEx
0x1C000E458: "__cdecl _imp_IoCancelIrp" __imp_IoCancelIrp
0x1C001AE4C: DfscCreateNetUseTreeConnection
0x1C000E120: "__cdecl _imp_ZwClose" __imp_ZwClose
0x1C001F674: DfscFsctrlSetClusterSetName
0x1C0018D6C: DfscCredVerify
0x1C002236C: DfscUpdateSiteNameFromRegistry
0x1C000E138: "__cdecl _imp_RtlInitializeGenericTableAvl" __imp_RtlInitializeGenericTableAvl
0x1C0018930: DfscCredCreateTargetNameCopy
0x1C000E098: "__cdecl _imp_Ndr64AsyncClientCall" __imp_Ndr64AsyncClientCall
0x1C000E388: "__cdecl _imp_qsort" __imp_qsort
0x1C000E438: "__cdecl _imp_PsUnregisterSiloMonitor" __imp_PsUnregisterSiloMonitor
0x1C0022050: DfscDeInitSiteNameMonitoring
0x1C0022F6C: DfscReferralGetClientInfoMarshall
0x1C000E2E0: "__cdecl _imp_PsDereferenceImpersonationToken" __imp_PsDereferenceImpersonationToken
0x1C0023E88: DfscRmEquivalentReferral
0x1C000E2B8: "__cdecl _imp_IoThreadToProcess" __imp_IoThreadToProcess
0x1C0019774: DfscCmReleaseHandleContext
0x1C0018098: DfscGetIpcConnectionHandle
0x1C0007C88: "ADMIN$" ??_C@_1O@IGADBKJD@?$AAA?$AAD?$AAM?$AAI?$AAN?$AA$?$AA?$AA@
0x1C000E470: "__cdecl _imp_KeInitializeEvent" __imp_KeInitializeEvent
0x1C00079C8: "WmiQueryTraceInformation" ??_C@_1DC@DOCOAJH@?$AAW?$AAm?$AAi?$AAQ?$AAu?$AAe?$AAr?$AAy?$AAT?$AAr?$AAa?$AAc?$AAe?$AAI?$AAn?$AAf?$AAo?$AAr?$AAm?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x1C00237FC: DfscReferralIterateInitialize
0x1C000E130: "__cdecl _imp_RtlCopyLuid" __imp_RtlCopyLuid
0x1C0005904: DfscGetDCName
0x1C000E068: ksecdd_NULL_THUNK_DATA
0x1C0007570: ExplicitNullCredentials
0x1C0007970: "EtwUnregister" ??_C@_1BM@CJMKDOJH@?$AAE?$AAt?$AAw?$AAU?$AAn?$AAr?$AAe?$AAg?$AAi?$AAs?$AAt?$AAe?$AAr?$AA?$AA@
0x1C0007948: "\Device\DfsClient" ??_C@_1CE@ILNIBLPI@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAD?$AAf?$AAs?$AAC?$AAl?$AAi?$AAe?$AAn?$AAt?$AA?$AA@
0x1C001FA1C: DfscFsctrlSetDomainNameDns
0x1C0020338: DfscGetRefCacheSizeLocked
0x1C001A9E4: DfscCreateCscEa
0x1C00222A0: DfscSiteNameChangeHandler
0x1C001B8B4: DfscDeleteSymbolicLink
0x1C000E378: "__cdecl _imp_IoFreeIrp" __imp_IoFreeIrp
0x1C00121E0: DfscCleanup
0x1C000E288: "__cdecl _imp_ZwMakeTemporaryObject" __imp_ZwMakeTemporaryObject
0x1C0006120: MIDL_user_allocate
0x1C0001410: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x1C00021D4: WPP_SF_DZsq
0x1C001FBA8: DfscFsctrlSetDomainNameFlat
0x1C0020FCC: DfscNetUseGetSearchKey
0x1C00261D0: DfscGetDriveLetterNetUseTable
0x1C000E140: "__cdecl _imp_RtlLookupElementGenericTableFullAvl" __imp_RtlLookupElementGenericTableFullAvl
0x1C0007B50: "Validate" ??_C@_1BC@NOEKLIAN@?$AAV?$AAa?$AAl?$AAi?$AAd?$AAa?$AAt?$AAe?$AA?$AA@
0x1C00081F8: "<nada>" ??_C@_06CHGIAFEO@?$DMnada?$DO?$AA@
0x1C0017FB8: DfscConnFree
0x1C000E428: "__cdecl _imp_PsRegisterSiloMonitor" __imp_PsRegisterSiloMonitor
0x1C0012F60: WppLoadTracingSupport
0x1C0025B54: DfscRmCheckReferralString
0x1C000E1B0: "__cdecl _imp_IoWMIRegistrationControl" __imp_IoWMIRegistrationControl
0x1C0007BE0: "Iterate" ??_C@_1BA@NBMFNGKO@?$AAI?$AAt?$AAe?$AAr?$AAa?$AAt?$AAe?$AA?$AA@
0x1C0020194: DfscGetDomainCacheNames
0x1C00213B0: DfscIsPathEqualString
0x1C000E370: "__cdecl _imp_IoGetRelatedDeviceObject" __imp_IoGetRelatedDeviceObject
0x1C000E548: "__cdecl _IMPORT_DESCRIPTOR_ksecdd" __IMPORT_DESCRIPTOR_ksecdd
0x1C001BC7C: DfscGetLogonId
0x1C00182E4: DfscCredCreateExplicitCredentials
0x1C000E4F0: "__cdecl _imp_ZwCreateSymbolicLinkObject" __imp_ZwCreateSymbolicLinkObject
0x1C000E078: "__cdecl _imp_RpcBindingBind" __imp_RpcBindingBind
0x1C0004A04: DfscReferralSetCurrentAccessStatus
0x1C0007C78: "IPC$" ??_C@_19INGAAIIO@?$AAI?$AAP?$AAC?$AA$?$AA?$AA@
0x1C0007C50: "Terminate" ??_C@_1BE@PBPGMODO@?$AAT?$AAe?$AAr?$AAm?$AAi?$AAn?$AAa?$AAt?$AAe?$AA?$AA@
0x1C000E368: "__cdecl _imp_ExAcquireResourceSharedLite" __imp_ExAcquireResourceSharedLite
0x1C0025BAC: DfscRmCheckReferralSyntax
0x1C000E4A0: "__cdecl _imp_KeBugCheckEx" __imp_KeBugCheckEx
0x1C001BD80: DfscGetUseInfo
0x1C0007240: DfscStateTextTable
0x1C0004190: WPP_SF_ddd
0x1C0002C5C: WPP_SF_Ddd
0x1C0004840: WPP_SF_qdq
0x1C0003A8C: WPP_SF_ZsZ
0x1C0019EE0: DriverUnload
0x1C0004638: WPP_SF_qZq
0x1C000E2C8: "__cdecl _imp_SeImpersonateClientEx" __imp_SeImpersonateClientEx
0x1C000E408: "__cdecl _imp_PsInsertPermanentSiloContext" __imp_PsInsertPermanentSiloContext
0x1C0011B90: DfscAgeOutExpiredCacheEntries
0x1C000E3B8: "__cdecl _imp_KeAcquireSpinLockRaiseToDpc" __imp_KeAcquireSpinLockRaiseToDpc
0x1C0022CF4: DfscGetRootReferral
0x1C0002000: DfscCmCompletionRoutine
0x1C000E0F8: "__cdecl _imp_IoCreateFileEx" __imp_IoCreateFileEx
0x1C0005210: DfscRmCheckReferralTargetAddressSyntax
0x1C0008458: WPP_d204b68b072a3b2e0bf31ea408355d7e_Traceguids
0x1C0002000: DfscRmCompletionRoutine
0x1C0002EDC: WPP_SF_ZsZq
0x1C000E498: "__cdecl _imp_ExReleaseResourceLite" __imp_ExReleaseResourceLite
0x1C00048A8: WPP_SF_dDDd
0x1C00078B0: "\Registry\Machine\Software\Micro" ??_C@_1JI@FLCAMDIB@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x1C000E4B8: "__cdecl _imp_RtlFindUnicodePrefix" __imp_RtlFindUnicodePrefix
0x1C000B0C0: "__cdecl _security_cookie" __security_cookie
0x1C0025EE0: DfscRmCheckReferralSyntaxV34
0x1C000309C: WPP_SF_dDDZ
0x1C0003F60: WPP_SF_DZDD
0x1C00046F8: WPP_SF_qZqD
0x1C000B1A0: g_DfscTimerDpc
0x1C0007740: "MaxReferralCacheKBytes" ??_C@_1CO@CPOLNFED@?$AAM?$AAa?$AAx?$AAR?$AAe?$AAf?$AAe?$AAr?$AAr?$AAa?$AAl?$AAC?$AAa?$AAc?$AAh?$AAe?$AAK?$AAB?$AAy?$AAt?$AAe?$AAs?$AA?$AA@
0x1C000E3C8: "__cdecl _imp_KeCancelTimer" __imp_KeCancelTimer
0x1C000E060: "__cdecl _imp_SspiEncodeStringsAsAuthIdentity" __imp_SspiEncodeStringsAsAuthIdentity
0x1C000B220: g_DfscTimerSet
0x1C0007C40: "Done" ??_C@_19LMOJOLFP@?$AAD?$AAo?$AAn?$AAe?$AA?$AA@
0x1C000E030: "__cdecl _imp_MupSurrogateResolvePrefix" __imp_MupSurrogateResolvePrefix
0x1C0003E4C: RtlStringCbLengthW
0x1C0007990: "EtwRegisterClassicProvider" ??_C@_1DG@PFOPAIND@?$AAE?$AAt?$AAw?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAe?$AAr?$AAC?$AAl?$AAa?$AAs?$AAs?$AAi?$AAc?$AAP?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AA?$AA@
0x1C0008208: WPP_7142470dad4b30f96cbd91a403ceab97_Traceguids
0x1C000E040: "__cdecl _imp_SspiLocalFree" __imp_SspiLocalFree
0x1C0016C1C: DfscReplaceFileObjectInformation
0x1C0008218: WPP_fe27071ff7873fd04c4ac6d2de6393eb_Traceguids
0x1C0012790: DfscPolicyReadRegistryParameters
0x1C000E3A8: "__cdecl _imp_KeInitializeTimer" __imp_KeInitializeTimer
0x1C0019230: DfscCredTablePurge
0x1C0004E6C: DfscRmGenerateDomainDcReferralFromDCName
0x1C001FE40: DfscGetActiveDcInfo
0x1C000E290: "__cdecl _imp__vsnwprintf" __imp__vsnwprintf
0x1C0001DD0: WPP_SF_qd
0x1C0001DD0: WPP_SF_qD
0x1C0007580: DFSC_DFS_SHARE_CHECK_ECP_GUID
0x1C0008348: "EnableLinkedConnections" ??_C@_1DA@CNOBEIJJ@?$AAE?$AAn?$AAa?$AAb?$AAl?$AAe?$AAL?$AAi?$AAn?$AAk?$AAe?$AAd?$AAC?$AAo?$AAn?$AAn?$AAe?$AAc?$AAt?$AAi?$AAo?$AAn?$AAs?$AA?$AA@
0x1C0001E8C: WPP_SF_qZ
0x1C000285C: WPP_SF_qq
0x1C0004244: WPP_SF_qS
0x1C0003DFC: DfscFsctrlSqmGetReg
0x1C0019B60: DfscSurrogateClose
0x1C0008410: "SiteName" ??_C@_1BC@GFOEOJDE@?$AAS?$AAi?$AAt?$AAe?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x1C000E338: "__cdecl _imp_RtlLookupElementGenericTableAvl" __imp_RtlLookupElementGenericTableAvl
0x1C0004FCC: DfscRmGenerateSysvolNetlogonReferral
0x1C00121E0: DfscClose
0x1C0027044: "__cdecl _security_init_cookie" __security_init_cookie
0x1C001D938: DfscFsctrlGetClientInfo
0x1C0001D8C: WPP_SF_q
0x1C000E2F8: "__cdecl _imp_KeQueryTimeIncrement" __imp_KeQueryTimeIncrement
0x1C000E390: "__cdecl _imp_IoAllocateWorkItem" __imp_IoAllocateWorkItem
0x1C000B668: WPPTraceSuite
0x1C000E478: "__cdecl _imp_KeSetEvent" __imp_KeSetEvent
0x1C0007A80: "Password" ??_C@_08FJIAHGMM@Password?$AA@
0x1C0027584: DfscInitializeContainerModule
0x1C0011840: DfscRmGetReferral
0x1C0023D7C: DfscRmBuildFsctlIrp
0x1C0010D30: DfscRewritePath
0x1C00075E8: "\Dfs" ??_C@_19LFKNNOGN@?$AA?2?$AAD?$AAf?$AAs?$AA?$AA@
0x1C0025610: DfscRmGetReferralTtlTickCounts
0x1C0021654: DfscNetUseTableCredentialsConflictDetect
0x1C0024708: DfscRmGenerateReferralEx
0x1C00075F8: "\Parameters" ??_C@_1BI@BPNCJPFJ@?$AA?2?$AAP?$AAa?$AAr?$AAa?$AAm?$AAe?$AAt?$AAe?$AAr?$AAs?$AA?$AA@
0x1C0007590: "Principal" ??_C@_09JODJDLFC@Principal?$AA@
0x1C000B360: DAConnectivityMonitor
0x1C0012CF8: DfscCredTableInitialize
0x1C0012230: DfscCmDoneState
0x1C00244D0: DfscRmGenerateReferral
0x1C001D110: DfscFsctrlFlushClusterSetCache
0x1C00013F0: "__cdecl _report_gsfailure" __report_gsfailure
0x1C0002450: WPP_SF_qZs
0x1C0015698: DfscCacheDelete
0x1C0010520: DfscSurrogatePostProcess
0x1C000E070: "__cdecl _imp_RpcAsyncInitializeHandle" __imp_RpcAsyncInitializeHandle
0x1C001801C: DfscConnOpenIpcConnection
0x1C00077C8: "MaxDomainTTLInSeconds" ??_C@_1CM@FPJJMHKP@?$AAM?$AAa?$AAx?$AAD?$AAo?$AAm?$AAa?$AAi?$AAn?$AAT?$AAT?$AAL?$AAI?$AAn?$AAS?$AAe?$AAc?$AAo?$AAn?$AAd?$AAs?$AA?$AA@
0x1C00035EC: WPP_SF_qDSS
0x1C002381C: DfscReferralRelease
0x1C0020DBC: DfscNetUseEnum
0x1C001EB4C: DfscFsctrlRemoveDriveLetter
0x1C00228CC: DfscGetDomainDCReferral
0x1C000E4E8: "__cdecl _imp_ExInitializeResourceLite" __imp_ExInitializeResourceLite
0x1C00217F4: DfscNetUseTableDelete
0x1C00112E0: DfscCmInitState
0x1C00075D8: WPP_ThisDir_CTLGUID_MupLog
0x1C002369C: DfscReferralIterate
0x1C0008200: "<none>" ??_C@_06PAOMPDJH@?$DMnone?$DO?$AA@
0x1C000E0E0: "__cdecl _imp_FsRtlAllocateExtraCreateParameterList" __imp_FsRtlAllocateExtraCreateParameterList
0x1C000E508: ntoskrnl_NULL_THUNK_DATA
0x1C0018BE0: DfscCredRelease
0x1C000E4D0: "__cdecl _imp_ExFreePoolWithTag" __imp_ExFreePoolWithTag
0x1C000E4C8: "__cdecl _imp_KeEnterCriticalRegion" __imp_KeEnterCriticalRegion
0x1C0001200: DfscGetContainerContextFromIrp
0x1C000E210: "__cdecl _imp_RtlInitializeSid" __imp_RtlInitializeSid
0x1C00181B8: DfscReleaseIpcConnection
0x1C0004CB4: DfscRmAllocateReferral
0x1C001ECEC: DfscFsctrlSetClientInfo
0x1C000E020: "__cdecl _imp_MupSurrogateRegisterProviderEx" __imp_MupSurrogateRegisterProviderEx
0x1C00082C8: "WAS NOT" ??_C@_1BA@HIJMOJID@?$AAW?$AAA?$AAS?$AA?5?$AAN?$AAO?$AAT?$AA?$AA@
0x1C000E238: "__cdecl _imp_RtlSetDaclSecurityDescriptor" __imp_RtlSetDaclSecurityDescriptor
0x1C000E358: "__cdecl _imp_ZwNotifyChangeKey" __imp_ZwNotifyChangeKey
0x1C0007B88: "GetRootReferral" ??_C@_1CA@LOJDNNLE@?$AAG?$AAe?$AAt?$AAR?$AAo?$AAo?$AAt?$AAR?$AAe?$AAf?$AAe?$AAr?$AAr?$AAa?$AAl?$AA?$AA@
0x1C000E280: "__cdecl _imp_ZwOpenSymbolicLinkObject" __imp_ZwOpenSymbolicLinkObject
0x1C000B148: DfscFsctlPathTryCscErrorList
0x1C0027080: DriverEntry
0x1C000385C: WPP_SF_SD
0x1C0004A2C: WPP_SF_SS
0x1C000E260: "__cdecl _imp_SeQueryAuthenticationIdToken" __imp_SeQueryAuthenticationIdToken
0x1C000B688: pfnWppTraceMessage
0x1C000E350: "__cdecl _imp_ZwOpenKey" __imp_ZwOpenKey
0x1C000E100: "__cdecl _imp_FsRtlFreeExtraCreateParameterList" __imp_FsRtlFreeExtraCreateParameterList
0x1C0012EEC: WppInitKm
0x1C001873C: DfscCredCreateKeymgrCredentials
0x1C000302C: WPP_SF_s
0x1C0002B30: WPP_SF_S
0x1C001A914: DfscSetCurrentDcContext
0x1C00018C0: memset
0x1C000E570: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x1C001A218: DfscGetCurrentDcContext

[JEB Decompiler by PNF Software]