Generated by JEB on 2019/08/01

PE: C:\Windows\System32\drivers\wcifs.sys Base=0x1C0000000 SHA-256=129ABEDD2E4C400F4CA293F4CAA8E3113DD10B31FD9ED4AA66B511B485AAEB69
PDB: wcifs.pdb GUID={24D6A0DA-DAE7-A8F9-65A133848D5CE4C0} Age=1

552 located named symbols:
0x1C0004EB0: WcSyncPlaceholderFileSize
0x1C000C1B0: "__cdecl _imp_FltAllocatePoolAlignedWithTag" __imp_FltAllocatePoolAlignedWithTag
0x1C001AD70: WcPostFsControl
0x1C000FC10: WcGetSetSiloContext
0x1C000C218: "__cdecl _imp_FltGetFileContext" __imp_FltGetFileContext
0x1C000C298: "__cdecl _imp_FltSetCallbackDataDirty" __imp_FltSetCallbackDataDirty
0x1C00040C0: WppClassicProviderCallback
0x1C001E7A8: WcSetUnionContext
0x1C000C5E8: "__cdecl _imp_ExAcquireFastMutex" __imp_ExAcquireFastMutex
0x1C0007118: EmptyUnicodeString
0x1C0028938: WcSetBootConfiguration
0x1C0020498: WcOpenDefaultStream
0x1C000C520: "__cdecl _imp_FsRtlQueryKernelEaFile" __imp_FsRtlQueryKernelEaFile
0x1C0004774: WcIsPlaceHolderStream
0x1C000C5D0: "__cdecl _imp_FsRtlReleaseFile" __imp_FsRtlReleaseFile
0x1C0007A50: "onecore\base\fs\wci\wcifs\utils." ??_C@_0CC@ICHLNIB@onecore?2base?2fs?2wci?2wcifs?2utils?4@
0x1C0015DCC: WcUntagFile
0x1C001A4D8: WcFsctlReadQueryUsnJournal
0x1C000C4F8: "__cdecl _imp_RtlFreeUnicodeString" __imp_RtlFreeUnicodeString
0x1C0017300: WcPopulateDirectory
0x1C0007CC8: NULL_GUID
0x1C0007AB0: "\Device\vmsmb\VSMB-{dcc079ae-60b" ??_C@_1HM@DJCEPBII@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAv?$AAm?$AAs?$AAm?$AAb?$AA?2?$AAV?$AAS?$AAM?$AAB?$AA?9?$AA?$HL?$AAd?$AAc?$AAc?$AA0?$AA7?$AA9?$AAa?$AAe?$AA?9?$AA6?$AA0?$AAb@
0x1C000C248: "__cdecl _imp_FltGetFileNameInformation" __imp_FltGetFileNameInformation
0x1C00267E0: WcUnload
0x1C000A098: "__cdecl _security_cookie_complement" __security_cookie_complement
0x1C001C590: WppTraceCallback
0x1C000F3BC: WcGetSetStreamContext
0x1C000C590: "__cdecl _imp_ObfDereferenceObject" __imp_ObfDereferenceObject
0x1C0007BE0: "Parameters" ??_C@_1BG@PGIGMDPA@?$AAP?$AAa?$AAr?$AAa?$AAm?$AAe?$AAt?$AAe?$AAr?$AAs?$AA?$AA@
0x1C000C4B0: "__cdecl _imp_PsGetCurrentSilo" __imp_PsGetCurrentSilo
0x1C00211C4: WcCopyFileCompression
0x1C000C378: "__cdecl _imp_ExInitializeNPagedLookasideList" __imp_ExInitializeNPagedLookasideList
0x1C000C578: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x1C0005BF0: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x1C001D618: WcProcessTombstoneBounce
0x1C0015640: WcPreQueryEa
0x1C000C000: "__cdecl _imp_FltCancellableWaitForSingleObject" __imp_FltCancellableWaitForSingleObject
0x1C000C3C0: "__cdecl _imp_RtlGetNextEntryHashTable" __imp_RtlGetNextEntryHashTable
0x1C000C430: "__cdecl _imp_RtlInsertEntryHashTable" __imp_RtlInsertEntryHashTable
0x1C000C1C8: "__cdecl _imp_FltGetFileNameInformationUnsafe" __imp_FltGetFileNameInformationUnsafe
0x1C0007D78: "__cdecl TraceLoggingMetadata" _TraceLoggingMetadata
0x1C0007A88: "onecore\base\fs\wci\wcifs\wcifs." ??_C@_0CC@KCMLAABN@onecore?2base?2fs?2wci?2wcifs?2wcifs?4@
0x1C000C178: "__cdecl _imp_FltWriteFile" __imp_FltWriteFile
0x1C0002784: WPP_RECORDER_SF_sDqZDld
0x1C000A690: Microsoft_Windows_Containers_WcifsEnableBits
0x1C000C580: "__cdecl _imp_ExpInterlockedPushEntrySList" __imp_ExpInterlockedPushEntrySList
0x1C000C018: "__cdecl _imp_FltCloseCommunicationPort" __imp_FltCloseCommunicationPort
0x1C001CD34: WcRemoveInMemoryTombstone
0x1C000A0F8: "__cdecl WcVerboseRecorder" _WcVerboseRecorder
0x1C0024ED4: WcIsDirectoryEmpty
0x1C0013050: WcMungeDirectoryEnumerateWithoutShortname
0x1C0007930: "WmiTraceMessage" ??_C@_1CA@OFIBBPKJ@?$AAW?$AAm?$AAi?$AAT?$AAr?$AAa?$AAc?$AAe?$AAM?$AAe?$AAs?$AAs?$AAa?$AAg?$AAe?$AA?$AA@
0x1C0002DCC: WPP_RECORDER_SF_sDDd
0x1C0002338: WPP_RECORDER_SF_sDdd
0x1C0002F9C: WcSetupVolumeInformationHandler
0x1C000C010: "__cdecl _imp_FltFreeSecurityDescriptor" __imp_FltFreeSecurityDescriptor
0x1C001FA90: WcGetSourceList
0x1C00079E0: "onecore\base\fs\wci\wcifs\teleme" ??_C@_0CG@CKOCJDLP@onecore?2base?2fs?2wci?2wcifs?2teleme@
0x1C000C610: "__cdecl _imp_ExInitializeRundownProtection" __imp_ExInitializeRundownProtection
0x1C000C654: "__cdecl _IMPORT_DESCRIPTOR_HAL" __IMPORT_DESCRIPTOR_HAL
0x1C000C2E8: "__cdecl _imp_FltAllocateContext" __imp_FltAllocateContext
0x1C000A010: PROV_WCIFS_Context
0x1C0023C88: WcCleanupLayer
0x1C000C0E8: "__cdecl _imp_FltQuerySecurityObject" __imp_FltQuerySecurityObject
0x1C0007C90: "InstanceName" ??_C@_1BK@LKABBJHE@?$AAI?$AAn?$AAs?$AAt?$AAa?$AAn?$AAc?$AAe?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x1C00157A0: WcPreSetEa
0x1C0001008: "__cdecl TlgWrite" _TlgWrite
0x1C000C638: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x1C00075F4: "." ??_C@_13JOFGPIOO@?$AA?4?$AA?$AA@
0x1C000C128: "__cdecl _imp_FltCreateFileEx2" __imp_FltCreateFileEx2
0x1C001D3F0: WcRemoveTombstonesFromDirectory
0x1C000C388: "__cdecl _imp_ExDeletePagedLookasideList" __imp_ExDeletePagedLookasideList
0x1C000C3C8: "__cdecl _imp_RtlEnumerateGenericTableAvl" __imp_RtlEnumerateGenericTableAvl
0x1C0004610: WcIsInstanceUnionRootDirectory
0x1C0022830: WcSetPlaceHolderFlagsSynchronized
0x1C000C338: WppRecorder_NULL_THUNK_DATA
0x1C000C518: "__cdecl _imp_FsRtlSetKernelEaFile" __imp_FsRtlSetKernelEaFile
0x1C0018444: WcPreCreateExpansion
0x1C000C478: "__cdecl _imp_MmGetSystemRoutineAddress" __imp_MmGetSystemRoutineAddress
0x1C0026200: WcNormalizeNameComponent
0x1C0001E70: WPP_RECORDER_SF_sDZd
0x1C0015B00: WcExpansionCsqPeekNextIo
0x1C001C380: WcPreSetSecurity
0x1C0007790: WPP_8826dda0c03938fd9b94101794bd6b8f_Traceguids
0x1C00076C8: WcifsUnloadSuccessful
0x1C000C1E8: "__cdecl _imp_FltParseFileName" __imp_FltParseFileName
0x1C0016140: WcExpandDirectory
0x1C0007BC8: "\WcifsPort" ??_C@_1BG@DJCDJBJH@?$AA?2?$AAW?$AAc?$AAi?$AAf?$AAs?$AAP?$AAo?$AAr?$AAt?$AA?$AA@
0x1C000C318: "__cdecl _imp_imp_WppRecorderConfigure" __imp_imp_WppRecorderConfigure
0x1C000C528: "__cdecl _imp_KeWaitForSingleObject" __imp_KeWaitForSingleObject
0x1C000C5A0: "__cdecl _imp_RtlAppendUnicodeStringToString" __imp_RtlAppendUnicodeStringToString
0x1C000C410: "__cdecl _imp_PsGetJobSilo" __imp_PsGetJobSilo
0x1C000C030: "__cdecl _imp_FltSetInstanceContext" __imp_FltSetInstanceContext
0x1C000C5B8: "__cdecl _imp_PsDereferenceSiloContext" __imp_PsDereferenceSiloContext
0x1C0024308: WcIsTargetPartialDirectory
0x1C0004E98: WcGetUnionContext
0x1C0007130: Callbacks
0x1C0011CF0: WcPostCreate
0x1C0007B60: "\Registry\Machine\System\Current" ??_C@_1GG@KMAKALDL@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1C000C188: "__cdecl _imp_FltFreePoolAlignedWithTag" __imp_FltFreePoolAlignedWithTag
0x1C0004728: WcIsPlaceHolder
0x1C0005C00: memcpy
0x1C00257E0: WcPreQueryVolumeInformation
0x1C000C0D0: "__cdecl _imp_FltReleaseResource" __imp_FltReleaseResource
0x1C001CB18: WcAddInMemoryTombstone
0x1C00029F4: WPP_RECORDER_SF_sDqd
0x1C0007C48: "IsHvsiContainer" ??_C@_1CA@ECBCOFIO@?$AAI?$AAs?$AAH?$AAv?$AAs?$AAi?$AAC?$AAo?$AAn?$AAt?$AAa?$AAi?$AAn?$AAe?$AAr?$AA?$AA@
0x1C000C440: "__cdecl _imp_RtlRemoveEntryHashTable" __imp_RtlRemoveEntryHashTable
0x1C0022428: WcOpenReparsePoint
0x1C000C2B0: "__cdecl _imp_FltGetStreamHandleContext" __imp_FltGetStreamHandleContext
0x1C001E6E0: WcFreeLayerTableEntry
0x1C000A0D0: pfnWppGetVersion
0x1C000411C: "__cdecl TlgDefineProvider_annotation__TlgWcifsTelemetryProviderProv" _TlgDefineProvider_annotation__TlgWcifsTelemetryProviderProv
0x1C000C3D8: "__cdecl _imp_RtlInsertElementGenericTableAvl" __imp_RtlInsertElementGenericTableAvl
0x1C0005A4D: "__cdecl _C_specific_handler" __C_specific_handler
0x1C0007698: WcifsInstanceAttachFailure
0x1C000C140: "__cdecl _imp_FltGetVolumeFromName" __imp_FltGetVolumeFromName
0x1C0019DA0: WcPreQueryQuota
0x1C00077E0: "onecore\base\fs\wci\wcifs\filein" ??_C@_0CF@LPFKBAJA@onecore?2base?2fs?2wci?2wcifs?2filein@
0x1C000C108: "__cdecl _imp_FltGetVolumeInstanceFromName" __imp_FltGetVolumeInstanceFromName
0x1C0016540: WcExpansionWorker
0x1C00077C8: "*" ??_C@_13BBDEGPLJ@?$AA?$CK?$AA?$AA@
0x1C0005C00: memmove
0x1C0015D64: WcFreeExpansionContext
0x1C0014264: WcMergeEnumerationResults
0x1C000C0C8: "__cdecl _imp_FltAcquireResourceShared" __imp_FltAcquireResourceShared
0x1C000C5F0: "__cdecl _imp_PsInsertSiloContext" __imp_PsInsertSiloContext
0x1C000C570: "__cdecl _imp_RtlCopyUnicodeString" __imp_RtlCopyUnicodeString
0x1C000C1F0: "__cdecl _imp_FltLockUserBuffer" __imp_FltLockUserBuffer
0x1C0016F68: WcExpandAndPend
0x1C0005A9C: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x1C00078C8: WPP_9b7ebd58589a3e60866fbe07b21c6b2f_Traceguids
0x1C00049EC: WcFreeEnumContexts
0x1C0016E20: WcExpandAndWait
0x1C000C138: "__cdecl _imp_FltCreateFileEx" __imp_FltCreateFileEx
0x1C000C080: "__cdecl _imp_FltRegisterFilter" __imp_FltRegisterFilter
0x1C000C238: "__cdecl _imp_FltReleaseFileNameInformation" __imp_FltReleaseFileNameInformation
0x1C000C2D0: "__cdecl _imp_FltSetFileContext" __imp_FltSetFileContext
0x1C000C620: "__cdecl _imp_PsIsHostSilo" __imp_PsIsHostSilo
0x1C0024590: WcPrepareForDelete
0x1C000C208: "__cdecl _imp_FltClose" __imp_FltClose
0x1C000C408: "__cdecl _imp_RtlDeleteElementGenericTableAvl" __imp_RtlDeleteElementGenericTableAvl
0x1C001A170: WcFsctlGetDeleteReparsePoint
0x1C000A640: WPP_MAIN_CB
0x1C000C400: "__cdecl _imp_ExDeleteResourceLite" __imp_ExDeleteResourceLite
0x1C00269C0: WcPreCleanup
0x1C000C250: "__cdecl _imp_FltQueryInformationByName" __imp_FltQueryInformationByName
0x1C000C1D8: "__cdecl _imp_FltGetVolumeName" __imp_FltGetVolumeName
0x1C000C4C8: "__cdecl _imp_ObfReferenceObject" __imp_ObfReferenceObject
0x1C0007818: "onecore\base\fs\wci\wcifs\fsctrl" ??_C@_0CD@HECFKDOP@onecore?2base?2fs?2wci?2wcifs?2fsctrl@
0x1C0007668: WcifsDriverEntryFailure
0x1C0020A8C: WcQueryEa
0x1C000C608: "__cdecl _imp_PsGetParentSilo" __imp_PsGetParentSilo
0x1C0007760: WPP_da241d50a8353cae3e0fcb4fa9284d04_Traceguids
0x1C001C000: WcPortConnect
0x1C0025310: WcInsertDirectoryTableSourceList
0x1C00226A0: WcOpenPlaceHolder
0x1C000C340: "__cdecl _imp_ExReleaseFastMutex" __imp_ExReleaseFastMutex
0x1C001CE58: WcDeleteTombstoneIfExists
0x1C000C070: "__cdecl _imp_FltIsVolumeSnapshot" __imp_FltIsVolumeSnapshot
0x1C00286F0: WcSetConfiguration
0x1C0003BB4: WPP_RECORDER_SF_sDqLiLLZ
0x1C000C488: "__cdecl _imp_EtwSetInformation" __imp_EtwSetInformation
0x1C0007688: GUID_NULL
0x1C000A0F0: WcDbgProtectPackage
0x1C001804C: WcPartiallyExpandDirectory
0x1C0013544: WcMungeDirectoryEnumerateWithShortname
0x1C0003450: WcPreRead
0x1C001D128: WcCreateTombstone
0x1C000C110: "__cdecl _imp_FltFreeExtraCreateParameterList" __imp_FltFreeExtraCreateParameterList
0x1C002522C: WcGetInstanceFromVolumeName
0x1C000C5D8: "__cdecl _imp_ExAllocatePoolWithTag" __imp_ExAllocatePoolWithTag
0x1C0005570: WcSetupVsmbUnionContext
0x1C0003E18: WPP_RECORDER_SF_sDqLiLZii
0x1C0007628: "onecore\base\fs\wci\wcifs\contex" ??_C@_0CE@BOIIHPOK@onecore?2base?2fs?2wci?2wcifs?2contex@
0x1C0025078: WcDoesDirectoryHaveTombstones
0x1C0023A8C: WcCreateUnionContext
0x1C000A0E0: pfnWppQueryTraceInformation
0x1C000C360: "__cdecl _imp_PsFreeSiloContextSlot" __imp_PsFreeSiloContextSlot
0x1C00076D8: GUID_ECP_ATOMIC_CREATE
0x1C000C668: "__cdecl _IMPORT_DESCRIPTOR_WppRecorder" __IMPORT_DESCRIPTOR_WppRecorder
0x1C000C1E0: "__cdecl _imp_FltCompletePendedPreOperation" __imp_FltCompletePendedPreOperation
0x1C000C1A0: "__cdecl _imp_FltCbdqInitialize" __imp_FltCbdqInitialize
0x1C000C278: "__cdecl _imp_FltQueryDirectoryFileEx" __imp_FltQueryDirectoryFileEx
0x1C000C560: "__cdecl _imp_EtwWriteTransfer" __imp_EtwWriteTransfer
0x1C000C268: "__cdecl _imp_FltAcknowledgeEcp" __imp_FltAcknowledgeEcp
0x1C000C180: "__cdecl _imp_FltFsControlFile" __imp_FltFsControlFile
0x1C0007734: "" ??_C@_13BLAPAIAM@?$AA?$AI?$AA?$AA@
0x1C000C4A8: "__cdecl _imp_PsIsCurrentThreadInServerSilo" __imp_PsIsCurrentThreadInServerSilo
0x1C00212F4: WcSetFileAttributes
0x1C00044FC: WcClearOfflineAttribute
0x1C000C2F0: FLTMGR_NULL_THUNK_DATA
0x1C001FF1C: WcFreeSourceList
0x1C000C550: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x1C0019820: WcPreQueryInformation
0x1C000C0B8: "__cdecl _imp_FltAcquireResourceExclusive" __imp_FltAcquireResourceExclusive
0x1C000C210: "__cdecl _imp_FltCancelFileOpen" __imp_FltCancelFileOpen
0x1C0019FB8: WcFsctlSetReparsePoint
0x1C0010C70: WcRedirectCallbackData
0x1C0007C18: "BootContainer" ??_C@_1BM@PIGIFOBL@?$AAB?$AAo?$AAo?$AAt?$AAC?$AAo?$AAn?$AAt?$AAa?$AAi?$AAn?$AAe?$AAr?$AA?$AA@
0x1C00104DC: WcProcessWciReparsePointOpen
0x1C000C450: "__cdecl _imp_RtlCreateHashTable" __imp_RtlCreateHashTable
0x1C0005A78: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x1C0013F5C: WcAdvanceNextEnumEntry
0x1C0025484: WcLookupDirectoryTableEntry
0x1C000C098: "__cdecl _imp_FltPerformSynchronousIo" __imp_FltPerformSynchronousIo
0x1C0004888: WcGetSource
0x1C00019C8: WPP_RECORDER_SF_sDZDld
0x1C000C1F8: "__cdecl _imp_FltAllocateExtraCreateParameterList" __imp_FltAllocateExtraCreateParameterList
0x1C0007650: "::$DATA" ??_C@_1BA@LCOICFNN@?$AA?3?$AA?3?$AA$?$AAD?$AAA?$AAT?$AAA?$AA?$AA@
0x1C0007910: "PsGetVersion" ??_C@_1BK@DHLDGJM@?$AAP?$AAs?$AAG?$AAe?$AAt?$AAV?$AAe?$AAr?$AAs?$AAi?$AAo?$AAn?$AA?$AA@
0x1C000C510: "__cdecl _imp_ExRundownCompleted" __imp_ExRundownCompleted
0x1C0012D60: WcPostNetworkQueryOpen
0x1C000FED4: WcCopySectionObjectPointers
0x1C000C598: "__cdecl _imp_ExpInterlockedPopEntrySList" __imp_ExpInterlockedPopEntrySList
0x1C0004830: WcShouldRedirectEaAndUsn
0x1C0007728: "NULL" ??_C@_19CIJIHAKK@?$AAN?$AAU?$AAL?$AAL?$AA?$AA@
0x1C0023E50: WcCleanupSiloContext
0x1C00073F0: FilterRegistration
0x1C000A0C0: pfnEtwRegisterClassicProvider
0x1C000C020: "__cdecl _imp_FltGetDiskDeviceObject" __imp_FltGetDiskDeviceObject
0x1C00046E0: WcIsExpanded
0x1C0011800: WcPreTransaction
0x1C000C618: "__cdecl _imp_PsGetSiloContext" __imp_PsGetSiloContext
0x1C000C600: "__cdecl _imp_IoGetSilo" __imp_IoGetSilo
0x1C0004B38: WcSiloExistsForInstance
0x1C000C198: "__cdecl _imp_FltGetInstanceContext" __imp_FltGetInstanceContext
0x1C001C350: WcPrePnp
0x1C001C050: WcPortMessage
0x1C0007CD8: WPP_29df1bdf1f4a30a95f0007620cf63b6e_Traceguids
0x1C001E630: WcFreeUnionTableEntry
0x1C0007BF8: "DebugOptions" ??_C@_1BK@CKCBKOL@?$AAD?$AAe?$AAb?$AAu?$AAg?$AAO?$AAp?$AAt?$AAi?$AAo?$AAn?$AAs?$AA?$AA@
0x1C000C2D8: "__cdecl _imp_FltReleaseContext" __imp_FltReleaseContext
0x1C0023BEC: WcCleanupUnionContext
0x1C00077CC: "\" ??_C@_13FPGAJAPJ@?$AA?2?$AA?$AA@
0x1C001B7D8: WcCopyAsPlaceHolderHandler
0x1C000C5B0: "__cdecl _imp_FsRtlAcquireFileExclusive" __imp_FsRtlAcquireFileExclusive
0x1C00202CC: WcRelativeStreamOpen
0x1C0007CF0: "__cdecl _xmm@7fffffffffffffff0000000000000000" __xmm@7fffffffffffffff0000000000000000
0x1C0007880: "\System Volume Information\Wcifs" ??_C@_1EI@NMPIIPMK@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?5?$AAV?$AAo?$AAl?$AAu?$AAm?$AAe?$AA?5?$AAI?$AAn?$AAf?$AAo?$AAr?$AAm?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?2?$AAW?$AAc?$AAi?$AAf?$AAs@
0x1C000A0E8: pfnEtwUnregister
0x1C0017234: WcLocateSourceDirectory
0x1C000C2C8: "__cdecl _imp_FltSetStreamHandleContext" __imp_FltSetStreamHandleContext
0x1C0019150: WcPreSetInformation
0x1C00119E0: WcPreCreate
0x1C000C4D0: "__cdecl _imp_KeClearEvent" __imp_KeClearEvent
0x1C000C060: "__cdecl _imp_FltBuildDefaultSecurityDescriptor" __imp_FltBuildDefaultSecurityDescriptor
0x1C000C168: "__cdecl _imp_FltCbdqRemoveNextIo" __imp_FltCbdqRemoveNextIo
0x1C0002618: WPP_RECORDER_SF_sDqDld
0x1C0007600: "wcifs Instance" ??_C@_1BO@FAEPKNGE@?$AAw?$AAc?$AAi?$AAf?$AAs?$AA?5?$AAI?$AAn?$AAs?$AAt?$AAa?$AAn?$AAc?$AAe?$AA?$AA@
0x1C000C120: "__cdecl _imp_FltIsEcpAcknowledged" __imp_FltIsEcpAcknowledged
0x1C0014698: WcEnumerateLayeredDirectories
0x1C0007B30: "Name Not Available" ??_C@_1CG@MAKNKNKJ@?$AAN?$AAa?$AAm?$AAe?$AA?5?$AAN?$AAo?$AAt?$AA?5?$AAA?$AAv?$AAa?$AAi?$AAl?$AAa?$AAb?$AAl?$AAe?$AA?$AA@
0x1C000C508: "__cdecl _imp_RtlEqualUnicodeString" __imp_RtlEqualUnicodeString
0x1C0016B88: WcLaunchExpansion
0x1C0007A08: WPP_b5d475e97d003e268ca52ff429e8208a_Traceguids
0x1C000C3F0: "__cdecl _imp_ObIsKernelHandle" __imp_ObIsKernelHandle
0x1C00215B8: WcGetReparseData
0x1C000C228: "__cdecl _imp_FltRemoveOpenReparseEntry" __imp_FltRemoveOpenReparseEntry
0x1C001DD54: WcRemoveInMemoryTombstoneAfterRenameLink
0x1C000C1D0: "__cdecl _imp_FltFlushBuffers" __imp_FltFlushBuffers
0x1C0028EC0: GsDriverEntry
0x1C000C0C0: "__cdecl _imp_FltAdjustDeviceStackSizeForIoRedirection" __imp_FltAdjustDeviceStackSizeForIoRedirection
0x1C000C630: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x1C001A220: WcFsctlBlockOperation
0x1C0007620: "NULL" ??_C@_04HIBGFPH@NULL?$AA@
0x1C001A7E8: WcFsctlRedirectDirectMappedRequest
0x1C000C500: "__cdecl _imp_RtlAppendUnicodeToString" __imp_RtlAppendUnicodeToString
0x1C001E670: WcCompareLayerTableEntry
0x1C0019C40: WcPreSetQuota
0x1C00199A0: WcPostQueryInformation
0x1C000C3D0: "__cdecl _imp_ObReferenceObjectByHandle" __imp_ObReferenceObjectByHandle
0x1C0007770: "onecore\base\fs\wci\wcifs\dir.c" ??_C@_0CA@GNOBBIKE@onecore?2base?2fs?2wci?2wcifs?2dir?4c?$AA@
0x1C000C448: "__cdecl _imp_PsGetHostSilo" __imp_PsGetHostSilo
0x1C000C288: "__cdecl _imp_FltAddOpenReparseEntry" __imp_FltAddOpenReparseEntry
0x1C000C5E0: "__cdecl _imp_PsCreateSiloContext" __imp_PsCreateSiloContext
0x1C0015AD0: WcExpansionCsqRemoveIo
0x1C000C1A8: "__cdecl _imp_FltQueryDirectoryFile" __imp_FltQueryDirectoryFile
0x1C0001530: WPP_RECORDER_SF_sDDqDlZ
0x1C000C438: "__cdecl _imp_RtlInitEnumerationHashTable" __imp_RtlInitEnumerationHashTable
0x1C0004800: WcUsesSourceSectionObjectPointers
0x1C00052BC: WPP_RECORDER_SF_sDlLD
0x1C0007C38: "Hvsi" ??_C@_19DALPIPCM@?$AAH?$AAv?$AAs?$AAi?$AA?$AA@
0x1C000C4A0: "__cdecl _imp_FsRtlValidateReparsePointBuffer" __imp_FsRtlValidateReparsePointBuffer
0x1C002062C: WcCopyFileMetaData
0x1C002178C: WcSuppressTimestamps
0x1C00050BC: McGenEventWrite
0x1C000A000: WPP_GLOBAL_Control
0x1C0007678: WPP_ee006c6b7e8836d63b82a402d4c41581_Traceguids
0x1C0014C78: WcEnumerateDirectoryWithMerge
0x1C000C370: "__cdecl _imp_ZwQueryValueKey" __imp_ZwQueryValueKey
0x1C000C048: "__cdecl _imp_FltQueryVolumeInformation" __imp_FltQueryVolumeInformation
0x1C00075F0: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x1C001C3D0: "__cdecl TlgEnableCallback" _TlgEnableCallback
0x1C000C0D8: "__cdecl _imp_FltIsIoRedirectionAllowed" __imp_FltIsIoRedirectionAllowed
0x1C0007840: WPP_e2a3e719f4793bd2a2bf233cf82fc109_Traceguids
0x1C000C200: "__cdecl _imp_FltInsertExtraCreateParameter" __imp_FltInsertExtraCreateParameter
0x1C0026140: WcGenerateFileName
0x1C0013FF8: WcResetEnumContexts
0x1C00075F8: ".." ??_C@_15DDHGOCBH@?$AA?4?$AA?4?$AA?$AA@
0x1C000C038: "__cdecl _imp_FltStartFiltering" __imp_FltStartFiltering
0x1C000C398: "__cdecl _imp_ExInitializePagedLookasideList" __imp_ExInitializePagedLookasideList
0x1C000C2E0: "__cdecl _imp_FltAllocateGenericWorkItem" __imp_FltAllocateGenericWorkItem
0x1C000C100: "__cdecl _imp_FltAllocateCallbackData" __imp_FltAllocateCallbackData
0x1C000C548: "__cdecl _imp_RtlCompareUnicodeString" __imp_RtlCompareUnicodeString
0x1C000FF5C: WcGetSetContextFileObject
0x1C0005A10: "__cdecl _security_check_cookie" __security_check_cookie
0x1C00047A4: WcIsPlaceHolderDirectory
0x1C000F8E8: WcGetSetStreamHandleContext
0x1C000C130: "__cdecl _imp_FltReadFileEx" __imp_FltReadFileEx
0x1C000C260: "__cdecl _imp_FltObjectDereference" __imp_FltObjectDereference
0x1C000C058: "__cdecl _imp_FltCreateCommunicationPort" __imp_FltCreateCommunicationPort
0x1C000C67C: "__cdecl _IMPORT_DESCRIPTOR_FLTMGR" __IMPORT_DESCRIPTOR_FLTMGR
0x1C000C640: "__cdecl _IMPORT_DESCRIPTOR_ntoskrnl" __IMPORT_DESCRIPTOR_ntoskrnl
0x1C000C150: "__cdecl _imp_FltCloseClientPort" __imp_FltCloseClientPort
0x1C00256BC: WcInitializeDirectoryTable
0x1C0008723: "__cdecl TraceLoggingMetadataEnd" _TraceLoggingMetadataEnd
0x1C000C3F8: "__cdecl _imp_RtlRandomEx" __imp_RtlRandomEx
0x1C000C160: "__cdecl _imp_FltCbdqInsertIo" __imp_FltCbdqInsertIo
0x1C00013E8: WPP_RECORDER_SF_sDDld
0x1C0018FE4: WcBlockQuerySetInformation
0x1C000C068: "__cdecl _imp_FltGetVolumeProperties" __imp_FltGetVolumeProperties
0x1C000C5A8: "__cdecl _imp_IoReplaceFileObjectName" __imp_IoReplaceFileObjectName
0x1C00152C0: WcPreDirectoryControl
0x1C000C308: "__cdecl _imp_WppAutoLogStart" __imp_WppAutoLogStart
0x1C000C310: "__cdecl _imp_imp_WppRecorderLogDelete" __imp_imp_WppRecorderLogDelete
0x1C001C020: WcPortDisconnect
0x1C0012FA0: WcPostQueryOpen
0x1C00205D8: WcValidateWcReparseInfo
0x1C000F22C: WcGetSetFileContext
0x1C000C588: "__cdecl _imp_RtlHashUnicodeString" __imp_RtlHashUnicodeString
0x1C0007718: Microsoft_Windows_Containers_WcifsKeywords
0x1C0014084: WcSkipReparsePointInEnumeration
0x1C001A380: WcFsctlFindFilesBySid
0x1C0007000: ContextRegistration
0x1C0013B40: WcAddSubContext
0x1C000C0B0: "__cdecl _imp_FltTagFile" __imp_FltTagFile
0x1C000C540: "__cdecl _imp_ProbeForWrite" __imp_ProbeForWrite
0x1C000C3E8: "__cdecl _imp_PsJobType" __imp_PsJobType
0x1C000C320: "__cdecl _imp_WppAutoLogStop" __imp_WppAutoLogStop
0x1C000C2C0: "__cdecl _imp_FltReferenceContext" __imp_FltReferenceContext
0x1C000C480: "__cdecl _imp_EtwUnregister" __imp_EtwUnregister
0x1C000C290: "__cdecl _imp_FltAllocateExtraCreateParameterFromLookasideList" __imp_FltAllocateExtraCreateParameterFromLookasideList
0x1C001C8AC: WcTelemetryAndTracingCleanup
0x1C000C348: "__cdecl _imp_PsAllocSiloContextSlot" __imp_PsAllocSiloContextSlot
0x1C0029000: "__cdecl _guard_fids_table" __guard_fids_table
0x1C000C230: "__cdecl _imp_FltGetStreamContext" __imp_FltGetStreamContext
0x1C0007A18: "onecore\base\fs\wci\wcifs\tombst" ??_C@_0CG@DNLIBJFD@onecore?2base?2fs?2wci?2wcifs?2tombst@
0x1C001E714: WcValidateContainerRootId
0x1C00074E0: "__cdecl load_config_used" _load_config_used
0x1C00076F8: ECP_TYPE_OPEN_REPARSE_GUID
0x1C000C270: "__cdecl _imp_FltFindExtraCreateParameter" __imp_FltFindExtraCreateParameter
0x1C0021808: WcOpenAsReparsePoint
0x1C0015B30: WcExpansionCsqCompleteCanceledIo
0x1C001A900: WcPreFsControl
0x1C0023F94: WcShouldAutoAttach
0x1C00182A8: WcPrePopulatePath
0x1C0004C20: WcpGetUnionContext
0x1C0007CB0: "ReparseTag" ??_C@_1BG@JLNOEDOE@?$AAR?$AAe?$AAp?$AAa?$AAr?$AAs?$AAe?$AAT?$AAa?$AAg?$AA?$AA@
0x1C000515C: McGenEventUnregister
0x1C000C358: "__cdecl _imp_ZwClose" __imp_ZwClose
0x1C000C4D8: "__cdecl _imp_ExAcquireRundownProtection" __imp_ExAcquireRundownProtection
0x1C0007660: Microsoft_Windows_Containers_WcifsLevels
0x1C000C418: "__cdecl _imp_RtlInitializeGenericTableAvl" __imp_RtlInitializeGenericTableAvl
0x1C00279C0: WcPreLockControl
0x1C000C428: "__cdecl _imp_RtlDeleteHashTable" __imp_RtlDeleteHashTable
0x1C000FE90: WcCancelFileOpen
0x1C0015A30: WcExpansionCsqAcquireLock
0x1C000C088: "__cdecl _imp_FltQueryVolumeInformationFile" __imp_FltQueryVolumeInformationFile
0x1C00077A0: "onecore\base\fs\wci\wcifs\expans" ??_C@_0CG@NIDEAIMN@onecore?2base?2fs?2wci?2wcifs?2expans@
0x1C00277E0: WcPreReleaseForSectionSynchronization
0x1C0020CE8: WcCopyFileDataStreams
0x1C0004128: WPP_RECORDER_SF_sD_guid_Zd
0x1C0015B7C: WcCreateExpansionContext
0x1C0020788: WcCopyDataStreamByName
0x1C000C390: IoFileObjectType
0x1C0014758: WcEnumerateDirectoryWithMunge
0x1C002398C: WcEnumerateDirectory
0x1C000C5C0: "__cdecl _imp_KeInitializeEvent" __imp_KeInitializeEvent
0x1C000C008: "__cdecl _imp_FltInitExtraCreateParameterLookasideList" __imp_FltInitExtraCreateParameterLookasideList
0x1C000C558: "__cdecl _imp_FsRtlSetEcpListIntoIrp" __imp_FsRtlSetEcpListIntoIrp
0x1C0007950: "WmiQueryTraceInformation" ??_C@_1DC@DOCOAJH@?$AAW?$AAm?$AAi?$AAQ?$AAu?$AAe?$AAr?$AAy?$AAT?$AAr?$AAa?$AAc?$AAe?$AAI?$AAn?$AAf?$AAo?$AAr?$AAm?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x1C0013A34: WcMungeNamesEnumerate
0x1C001FFE4: WcReopenFile
0x1C0004494: WcCloseHandleAsync
0x1C0004898: WcGetContextFileObject
0x1C000C4E8: "__cdecl _imp_IoClearActivityIdThread" __imp_IoClearActivityIdThread
0x1C0015A90: WcExpansionCsqInsertIo
0x1C00079C0: "EtwUnregister" ??_C@_1BM@CJMKDOJH@?$AAE?$AAt?$AAw?$AAU?$AAn?$AAr?$AAe?$AAg?$AAi?$AAs?$AAt?$AAe?$AAr?$AA?$AA@
0x1C0007A40: WPP_b7402af714d33e8819f9cf27da2032b1_Traceguids
0x1C0024B80: WcPrepareTargetForRenameOrLink
0x1C000C078: "__cdecl _imp_FltGetInstanceInformation" __imp_FltGetInstanceInformation
0x1C000C2A0: "__cdecl _imp_FltFreeGenericWorkItem" __imp_FltFreeGenericWorkItem
0x1C000C0E0: "__cdecl _imp_FltFreeCallbackData" __imp_FltFreeCallbackData
0x1C000C3A0: "__cdecl _imp_ExDeleteNPagedLookasideList" __imp_ExDeleteNPagedLookasideList
0x1C001E6B0: WcAllocateLayerTableEntry
0x1C000C380: "__cdecl _imp_FsRtlChangeBackingFileObject" __imp_FsRtlChangeBackingFileObject
0x1C00192F0: WcPostSetInformation
0x1C0005A60: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x1C0005B10: memcmp
0x1C000C4E0: "__cdecl _imp_RtlDowncaseUnicodeString" __imp_RtlDowncaseUnicodeString
0x1C000C460: "__cdecl _imp_RtlEnumerateEntryHashTable" __imp_RtlEnumerateEntryHashTable
0x1C000C530: "__cdecl _imp_MmMapLockedPagesSpecifyCache" __imp_MmMapLockedPagesSpecifyCache
0x1C000C490: "__cdecl _imp_PsGetSiloIdentifier" __imp_PsGetSiloIdentifier
0x1C000C220: "__cdecl _imp_FltReissueSynchronousIo" __imp_FltReissueSynchronousIo
0x1C0013EA4: WcGetNextEnumEntry
0x1C000C3A8: "__cdecl _imp_RtlGUIDFromString" __imp_RtlGUIDFromString
0x1C00129C0: WcPreNetworkQueryOpen
0x1C0001BFC: WPP_RECORDER_SF_sDZZd
0x1C001C450: WppLoadTracingSupport
0x1C00051D0: McTemplateK0d
0x1C0007850: "onecore\base\fs\wci\wcifs\messag" ??_C@_0CE@CGPCKNAM@onecore?2base?2fs?2wci?2wcifs?2messag@
0x1C000C468: "__cdecl _imp_IoWMIRegistrationControl" __imp_IoWMIRegistrationControl
0x1C000C190: "__cdecl _imp_FltReadFile" __imp_FltReadFile
0x1C00140E8: WcTranslateNextEnumEntry
0x1C0013AEC: WcMungeReparseEnumerate
0x1C00076B8: GUID_ECP_CREATE_REDIRECTION
0x1C00077D0: WPP_8b57c7cb44833a72ea68ad50d53ae1e3_Traceguids
0x1C0005190: McTemplateK0
0x1C000C328: "__cdecl _imp_imp_WppRecorderReplay" __imp_imp_WppRecorderReplay
0x1C001A620: WcFsctlSetLayerRoot
0x1C000C0A0: "__cdecl _imp_FltAttachVolume" __imp_FltAttachVolume
0x1C000C028: "__cdecl _imp_FltCheckAndGrowNameControl" __imp_FltCheckAndGrowNameControl
0x1C001C97C: WcTelemetryPostDirectoryExpansionTrigger
0x1C000C148: "__cdecl _imp_FltCreateSystemVolumeInformationFolder" __imp_FltCreateSystemVolumeInformationFolder
0x1C0005404: WPP_RECORDER_SF_sDlLDd
0x1C000C2F8: "__cdecl _imp_KeQueryPerformanceCounter" __imp_KeQueryPerformanceCounter
0x1C00076E8: PROV_WCIFS
0x1C0025584: WcClearDirectoryTable
0x1C0007808: WPP_2f6c4f4406ce333c064bd4ed8d1302aa_Traceguids
0x1C001E500: WcCompareUnionTableEntry
0x1C000A090: "__cdecl _security_cookie" __security_cookie
0x1C0001238: WPP_RECORDER_SF_sDD
0x1C0001238: WPP_RECORDER_SF_sDd
0x1C00037B0: WcPostRead
0x1C000250C: WPP_RECORDER_SF_sDq
0x1C0016FEC: WcSynchronizeExpansionPreopWithReason
0x1C0001794: WPP_RECORDER_SF_sDZ
0x1C0005234: McTemplateK0dhzr1
0x1C0004AAC: WcIsSiloFileObject
0x1C000C170: "__cdecl _imp_FltPropagateActivityIdToThread" __imp_FltPropagateActivityIdToThread
0x1C000C3B0: "__cdecl _imp_RtlCompareMemory" __imp_RtlCompareMemory
0x1C00010B0: WPP_RECORDER_SF_sD
0x1C0007D00: "__cdecl _xmm@fffffffffffffffefffffffffffffffe" __xmm@fffffffffffffffefffffffffffffffe
0x1C0007D10: "__cdecl _xmm@ffffffffffffffffffffffffffffffff" __xmm@ffffffffffffffffffffffffffffffff
0x1C0007708: WPP_ThisDir_CTLGUID_WcifsTrace
0x1C0004FB0: McGenControlCallbackV2
0x1C0007988: "EtwRegisterClassicProvider" ??_C@_1DG@PFOPAIND@?$AAE?$AAt?$AAw?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAe?$AAr?$AAC?$AAl?$AAa?$AAs?$AAs?$AAi?$AAc?$AAP?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AA?$AA@
0x1C00260D0: WcInstanceQueryTeardown
0x1C000C2B8: "__cdecl _imp_FltQueryInformationFile" __imp_FltQueryInformationFile
0x1C000C040: "__cdecl _imp_FltDeleteExtraCreateParameterLookasideList" __imp_FltDeleteExtraCreateParameterLookasideList
0x1C00258A0: WcInstanceSetup
0x1C001AF58: WcCopyFileHandler
0x1C0002BD0: WPP_RECORDER_SF_sDqZd
0x1C0022B30: WcCopyAsPlaceHolder
0x1C000C498: "__cdecl _imp_ProbeForRead" __imp_ProbeForRead
0x1C000C240: "__cdecl _imp_FltGetEcpListFromCallbackData" __imp_FltGetEcpListFromCallbackData
0x1C000C090: "__cdecl _imp_FltUnregisterFilter" __imp_FltUnregisterFilter
0x1C000C050: "__cdecl _imp_FltGetVolumeGuidName" __imp_FltGetVolumeGuidName
0x1C0021408: WcCopyFileBasicInformation
0x1C0020FF8: WcQuerySecurity
0x1C0026130: WcInstanceTeardownComplete
0x1C0015F38: WcCopyStreamData
0x1C0019F00: WcPreDismountLockRemove
0x1C0018954: WcProcessSetRenameInformation
0x1C000C3E0: "__cdecl _imp_RtlLookupElementGenericTableAvl" __imp_RtlLookupElementGenericTableAvl
0x1C0007738: "onecore\base\fs\wci\wcifs\create" ??_C@_0CD@DAJLPKAG@onecore?2base?2fs?2wci?2wcifs?2create@
0x1C0027540: WcPreAcquireForSectionSynchronization
0x1C000C258: "__cdecl _imp_FltObjectReference" __imp_FltObjectReference
0x1C0028EF4: "__cdecl _security_init_cookie" __security_init_cookie
0x1C00233A4: WcCopyFile
0x1C000C470: "__cdecl _imp_EtwRegister" __imp_EtwRegister
0x1C0023D8C: WcInitializeSiloContext
0x1C000A0D8: WPPTraceSuite
0x1C00037D0: WcPreWrite
0x1C0017564: WcPopulateFile
0x1C000C538: "__cdecl _imp_KeSetEvent" __imp_KeSetEvent
0x1C001AE30: WcRelPathToFullPath
0x1C000C3E8: PsJobType
0x1C0022974: WcSetPlaceHolderFlags
0x1C00158C4: WcScheduleExpansionWorkItem
0x1C000C0F0: "__cdecl _imp_FltDeleteContext" __imp_FltDeleteContext
0x1C000C420: "__cdecl _imp_RtlCreateHashTableEx" __imp_RtlCreateHashTableEx
0x1C0024DB4: WcPrepareTargetDirectoryForRenameOrLink
0x1C000511C: McGenEventRegister
0x1C0010F9C: WcProcessWciReparsePointBounce
0x1C000C0A8: "__cdecl _imp_FltGetVolumeFromInstance" __imp_FltGetVolumeFromInstance
0x1C0010E60: WcFastLookupInLayer
0x1C001E600: WcAllocateUnionTableEntry
0x1C000C4B8: "__cdecl _imp_ExReleaseRundownProtection" __imp_ExReleaseRundownProtection
0x1C000C2A8: "__cdecl _imp_FltSetStreamContext" __imp_FltSetStreamContext
0x1C000C1B8: "__cdecl _imp_FltCompletePendedPostOperation" __imp_FltCompletePendedPostOperation
0x1C0005A40: "__cdecl _report_gsfailure" __report_gsfailure
0x1C0004600: WcConvertNtfsFileIdTo64
0x1C000C158: "__cdecl _imp_FltQueueGenericWorkItem" __imp_FltQueueGenericWorkItem
0x1C0016400: WcExpandFile
0x1C000C330: "__cdecl _imp_WppAutoLogTrace" __imp_WppAutoLogTrace
0x1C000C568: "__cdecl _imp_ExQueryDepthSList" __imp_ExQueryDepthSList
0x1C0004920: WcCopyAsPlaceHolderWorker
0x1C0012F70: WcPreQueryOpen
0x1C00076A8: WcifsDriverEntrySuccess
0x1C000C390: "__cdecl _imp_IoFileObjectType" __imp_IoFileObjectType
0x1C0013C60: WcPrepareEnumerationContexts
0x1C000C3B8: "__cdecl _imp_ExInitializeResourceLite" __imp_ExInitializeResourceLite
0x1C0004328: WPP_RECORDER_SF_sD_guid_d
0x1C0025820: WcPostQueryVolumeInformation
0x1C00277A0: WcPostAcquireForSectionSynchronization
0x1C000C628: ntoskrnl_NULL_THUNK_DATA
0x1C001F678: WcLookupLayer
0x1C000C5C8: "__cdecl _imp_ExFreePoolWithTag" __imp_ExFreePoolWithTag
0x1C000C368: "__cdecl _imp_IoGetTransactionParameterBlock" __imp_IoGetTransactionParameterBlock
0x1C0004460: WcCloseHandleAsyncWorker
0x1C000C458: "__cdecl _imp_RtlEndEnumerationHashTable" __imp_RtlEndEnumerationHashTable
0x1C0007A78: WPP_5ba18d0a34ff3b6c300f15381665b10a_Traceguids
0x1C0026130: WcInstanceTeardownStart
0x1C0015A60: WcExpansionCsqReleaseLock
0x1C000C118: "__cdecl _imp_FltSetInformationFile" __imp_FltSetInformationFile
0x1C001F74C: WcOpenSourceFile
0x1C000C0F8: "__cdecl _imp_FltQueryEaFile" __imp_FltQueryEaFile
0x1C0028008: DriverEntry
0x1C001E4B4: WcAllocateUnicodeString
0x1C00020D4: WPP_RECORDER_SF_sDdZ
0x1C0007C68: "BootContainerGuid" ??_C@_1CE@MNLBJENH@?$AAB?$AAo?$AAo?$AAt?$AAC?$AAo?$AAn?$AAt?$AAa?$AAi?$AAn?$AAe?$AAr?$AAG?$AAu?$AAi?$AAd?$AA?$AA@
0x1C000C1C0: "__cdecl _imp_FltUntagFile" __imp_FltUntagFile
0x1C000C4C0: "__cdecl _imp_RtlLookupEntryHashTable" __imp_RtlLookupEntryHashTable
0x1C000C4F0: "__cdecl _imp_ExWaitForRundownProtectionRelease" __imp_ExWaitForRundownProtectionRelease
0x1C000A0C8: pfnWppTraceMessage
0x1C000C350: "__cdecl _imp_ZwOpenKey" __imp_ZwOpenKey
0x1C001C7E4: WppInitKm
0x1C00078D8: "onecore\base\fs\wci\wcifs\readwr" ??_C@_0CG@ECJPCKMN@onecore?2base?2fs?2wci?2wcifs?2readwr@
0x1C0027470: WcPreClose
0x1C001E0D0: WcRevertDelete
0x1C000C280: "__cdecl _imp_FltParseFileNameInformation" __imp_FltParseFileNameInformation
0x1C00047D4: WcIsSourcedStream
0x1C000C300: HAL_NULL_THUNK_DATA
0x1C00270B0: WcPostCleanup
0x1C0005F40: memset
0x1C000C690: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x1C000C5F8: "__cdecl _imp_CcCoherencyFlushAndPurgeCache" __imp_CcCoherencyFlushAndPurgeCache
0x1C000F010: WcContextCleanup
0x1C0007900: WPP_205faa78ab3434488d27948237a2db4a_Traceguids
0x1C000A100: Globals

[JEB Decompiler by PNF Software]