Generated by JEB on 2019/08/01

PE: C:\Windows\System32\radarrs.dll Base=0x180000000 SHA-256=196785D7941CA45292F91F735349FE87508C5D5F8BBA17814A7EE2B832C410C6
PDB: radarrs.pdb GUID={12573D55-FBB3-8BC4-8232FE2C87EE3542} Age=1

379 located named symbols:
0x18000D198: "__cdecl _imp_EnumServicesStatusExW" __imp_EnumServicesStatusExW
0x18000D130: "__cdecl _imp_UnregisterTraceGuids" __imp_UnregisterTraceGuids
0x18000DB4C: "1" ??_C@_13JGCMLPCH@?$AA1?$AA?$AA@
0x18000BA9C: "__cdecl _raise_securityfailure" __raise_securityfailure
0x18000DB18: "%u.%u.%u.%u.%u.%u" ??_C@_1CE@KJLCBBDG@?$AA?$CF?$AAu?$AA?4?$AA?$CF?$AAu?$AA?4?$AA?$CF?$AAu?$AA?4?$AA?$CF?$AAu?$AA?4?$AA?$CF?$AAu?$AA?4?$AA?$CF?$AAu?$AA?$AA@
0x18000B8B0: "__cdecl FindPESection" _FindPESection
0x18000DB98: "RDR" ??_C@_17HIBDFLHO@?$AAR?$AAD?$AAR?$AA?$AA@
0x18000D688: RDR_RES
0x18000D738: RDR_RES_STOP_FAIL_EVENT
0x180005B08: StringCchCatW
0x180007F00: RdrpLogUICloseInfo
0x18000E6D8: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x18000D768: RDR_RES_STOP_SUCCESS_EVENT
0x18000D310: "__cdecl _imp_IsWow64Process" __imp_IsWow64Process
0x180010020: "__cdecl _security_cookie_complement" __security_cookie_complement
0x18000D578: "__cdecl _imp_CoInitialize" __imp_CoInitialize
0x18000D228: "__cdecl _imp_HeapDestroy" __imp_HeapDestroy
0x18000DC58: "radarrs" ??_C@_1BA@JODEEBOD@?$AAr?$AAa?$AAd?$AAa?$AAr?$AAr?$AAs?$AA?$AA@
0x18000D328: "__cdecl _imp_GetProcessId" __imp_GetProcessId
0x18000B38C: "__cdecl CRT_INIT" _CRT_INIT
0x18000D350: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x1800105D0: gszTitle
0x1800121C0: gszDlgTitle
0x18000D540: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x180003270: WppControlCallback
0x18000BD10: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x18000D3C0: SHELL32_NULL_THUNK_DATA
0x18000544C: RdrpResolveCommitLimitExhaustion
0x18000D260: "__cdecl _imp_CreateFileW" __imp_CreateFileW
0x18000D1E8: "__cdecl _imp_GetProcessTimes" __imp_GetProcessTimes
0x18000E78C: "__cdecl _IMPORT_DESCRIPTOR_OLEAUT32" __IMPORT_DESCRIPTOR_OLEAUT32
0x18000D5A0: "__cdecl _imp_WdiGetParameterByIndex" __imp_WdiGetParameterByIndex
0x1800121B8: gszCloseOneProgram
0x18000D9A0: "%windir%\system32\RdrLeakDiag.ex" ??_C@_1EE@MAEPFMID@?$AA?$CF?$AAw?$AAi?$AAn?$AAd?$AAi?$AAr?$AA?$CF?$AA?2?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAR?$AAd?$AAr?$AAL?$AAe?$AAa?$AAk?$AAD?$AAi?$AAa?$AAg?$AA?4?$AAe?$AAx@
0x18000D250: "__cdecl _imp_RemoveDirectoryW" __imp_RemoveDirectoryW
0x180009354: RdrpTaskDialogWithActCtx
0x18000D4E0: "__cdecl _imp_wcstoul" __imp_wcstoul
0x180005E24: RdrpProcessHeapLeakEvent
0x18000D2B0: "__cdecl _imp_DeactivateActCtx" __imp_DeactivateActCtx
0x18000D498: VERSION_NULL_THUNK_DATA
0x18000DB80: "MemoryDump" ??_C@_1BG@NGEBDJKH@?$AAM?$AAe?$AAm?$AAo?$AAr?$AAy?$AAD?$AAu?$AAm?$AAp?$AA?$AA@
0x18000D940: "PI" ??_C@_15KEKPEBBM@?$AAP?$AAI?$AA?$AA@
0x180003128: WPP_SF_DiI
0x1800011E0: WPP_SF_IId
0x18000D7C0: "Software\Microsoft\Windows\Curre" ??_C@_1GA@DFGOKFK@?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe@
0x18000D580: ole32_NULL_THUNK_DATA
0x18000D5F8: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x18000D210: "__cdecl _imp_InitializeCriticalSection" __imp_InitializeCriticalSection
0x18000DB50: "DC.RADAR_PR_Interval" ??_C@_1CK@MFALDMKA@?$AAD?$AAC?$AA?4?$AAR?$AAA?$AAD?$AAA?$AAR?$AA_?$AAP?$AAR?$AA_?$AAI?$AAn?$AAt?$AAe?$AAr?$AAv?$AAa?$AAl?$AA?$AA@
0x18000D6E8: RDR_RES_DROPPED_CLNE_EVENT
0x18000D788: RDR_RES_CLRESOLUTION_SUCCESS1_EVENT
0x18000D748: RDR_RES_CLRESOLUTION_SUCCESS2_EVENT
0x18000D460: "__cdecl _imp_DispatchMessageW" __imp_DispatchMessageW
0x18000DC48: WPP_960c9c6a705b391c604116c486046a8d_Traceguids
0x18000DB40: "idata" ??_C@_1M@OGLFLEJH@?$AAi?$AAd?$AAa?$AAt?$AAa?$AA?$AA@
0x1800022C0: RdrpEnumWindowsFunc
0x18000B894: "__cdecl XcptFilter" _XcptFilter
0x18000D600: "__cdecl _xc_a" __xc_a
0x18000D288: "__cdecl _imp_CreateProcessW" __imp_CreateProcessW
0x18000DC98: "ServicesActive" ??_C@_1BO@JHOJBCBI@?$AAS?$AAe?$AAr?$AAv?$AAi?$AAc?$AAe?$AAs?$AAA?$AAc?$AAt?$AAi?$AAv?$AAe?$AA?$AA@
0x18000D490: "__cdecl _imp_GetFileVersionInfoSizeW" __imp_GetFileVersionInfoSizeW
0x18000D3A8: "__cdecl _imp_RmRegisterResources" __imp_RmRegisterResources
0x180002198: RdrpGetProcessType
0x1800072B0: RdrpWerCallback
0x180001008: StringCchCopyW
0x18000D1C8: COMCTL32_NULL_THUNK_DATA
0x18000D400: "__cdecl _imp_EnumWindows" __imp_EnumWindows
0x18000D428: "__cdecl _imp_DestroyIcon" __imp_DestroyIcon
0x18000D408: "__cdecl _imp_GetWindow" __imp_GetWindow
0x18000D330: "__cdecl _imp_DeleteFileW" __imp_DeleteFileW
0x18000D8F8: "ReflectionInterval" ??_C@_1CG@ECFEKHED@?$AAR?$AAe?$AAf?$AAl?$AAe?$AAc?$AAt?$AAi?$AAo?$AAn?$AAI?$AAn?$AAt?$AAe?$AAr?$AAv?$AAa?$AAl?$AA?$AA@
0x18000D290: "__cdecl _imp_GetTempFileNameW" __imp_GetTempFileNameW
0x18000D4A8: "__cdecl _imp_memset" __imp_memset
0x18000BA6F: "__cdecl initterm" _initterm
0x18000D820: "CLResolutionInterval" ??_C@_1CK@MFHLNNPP@?$AAC?$AAL?$AAR?$AAe?$AAs?$AAo?$AAl?$AAu?$AAt?$AAi?$AAo?$AAn?$AAI?$AAn?$AAt?$AAe?$AAr?$AAv?$AAa?$AAl?$AA?$AA@
0x18000D148: "__cdecl _imp_TraceMessage" __imp_TraceMessage
0x18000DA68: " -memdmp" ??_C@_1BC@PPOMMIFF@?$AA?5?$AA?9?$AAm?$AAe?$AAm?$AAd?$AAm?$AAp?$AA?$AA@
0x1800121F8: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x18000D758: RDR_RES_ALLOC_FAIL_EVENT
0x18000D2B8: "__cdecl _imp_Sleep" __imp_Sleep
0x18000D9F0: "%s -p %u -h %u -tp 2 -cleanup -w" ??_C@_1FO@DDFECPJJ@?$AA?$CF?$AAs?$AA?5?$AA?9?$AAp?$AA?5?$AA?$CF?$AAu?$AA?5?$AA?9?$AAh?$AA?5?$AA?$CF?$AAu?$AA?5?$AA?9?$AAt?$AAp?$AA?5?$AA2?$AA?5?$AA?9?$AAc?$AAl?$AAe?$AAa?$AAn?$AAu?$AAp?$AA?5?$AA?9?$AAw@
0x18000D620: "__cdecl _xi_z" __xi_z
0x1800121A0: gszInfo
0x18000D2F0: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x18000BA7B: "__cdecl _C_specific_handler" __C_specific_handler
0x18000DC6C: " " ??_C@_13LBAGMAIH@?$AA?6?$AA?$AA@
0x18000D230: "__cdecl _imp_HeapFree" __imp_HeapFree
0x180012288: WPP_REGISTRATION_GUIDS
0x18000D438: "__cdecl _imp_DestroyWindow" __imp_DestroyWindow
0x18000D1A8: "__cdecl _imp_OpenServiceW" __imp_OpenServiceW
0x18000DCB8: "%s_%s" ??_C@_1M@LLCLNBHO@?$AA?$CF?$AAs?$AA_?$AA?$CF?$AAs?$AA?$AA@
0x18000D118: "__cdecl _imp_RegCloseKey" __imp_RegCloseKey
0x18000D450: "__cdecl _imp_PeekMessageW" __imp_PeekMessageW
0x18000BC8C: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x18000E7C8: "__cdecl _IMPORT_DESCRIPTOR_VERSION" __IMPORT_DESCRIPTOR_VERSION
0x1800035C0: WdiHandleInstance
0x180012178: gszExplorerSuffix
0x18000DD40: CLSID_HxHelpPane
0x180007954: RdrpGetProcessToken
0x180012260: WPP_MAIN_CB
0x180008B24: RdrpLogRecvdEventInfo
0x18000B8A0: "__cdecl amsg_exit" _amsg_exit
0x18000AF7C: RdrpAdjustDebugPrivilege
0x18000D890: "Software\Microsoft\RADAR\HeapLea" ??_C@_1GI@NFBNPEAM@?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAR?$AAA?$AAD?$AAA?$AAR?$AA?2?$AAH?$AAe?$AAa?$AAp?$AAL?$AAe?$AAa@
0x1800074CC: RdrpCreateEmptyFile
0x18000E714: "__cdecl _IMPORT_DESCRIPTOR_wdi" __IMPORT_DESCRIPTOR_wdi
0x18000D718: RDR_RES_EVENT_RECVD_EVENT
0x18000D370: OLEAUT32_NULL_THUNK_DATA
0x180012170: gszResolverName
0x18000DC68: " " ??_C@_13HOIJIPNN@?$AA?5?$AA?$AA@
0x18000D570: "__cdecl _imp_CoUninitialize" __imp_CoUninitialize
0x18000D200: "__cdecl _imp_EnterCriticalSection" __imp_EnterCriticalSection
0x18000D158: "__cdecl _imp_GetTraceLoggerHandle" __imp_GetTraceLoggerHandle
0x18000D1C0: "__cdecl _imp_TaskDialogIndirect" __imp_TaskDialogIndirect
0x1800068E4: RdrpLaunchLeakDiagnoser
0x18000D478: "__cdecl _imp_GetFileVersionInfoW" __imp_GetFileVersionInfoW
0x18000D120: "__cdecl _imp_GetTraceEnableLevel" __imp_GetTraceEnableLevel
0x18000D5A8: wdi_NULL_THUNK_DATA
0x18000D300: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x1800121B0: gszHelpTaskUrl
0x180008978: RdrpLogCLResolutionSuccessInfo
0x1800121E8: "__cdecl _native_startup_lock" __native_startup_lock
0x1800032F8: DllMain
0x18000118C: WPP_SF_II
0x1800049E8: RdrpResolverInit
0x18000E7B4: "__cdecl _IMPORT_DESCRIPTOR_wer" __IMPORT_DESCRIPTOR_wer
0x180004790: RdrpFreeStrings
0x18000D4B0: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x18000DBA0: "%s\%s" ??_C@_1M@DFKENGJN@?$AA?$CF?$AAs?$AA?2?$AA?$CF?$AAs?$AA?$AA@
0x18000D510: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x18000D358: KERNEL32_NULL_THUNK_DATA
0x18000D418: "__cdecl _imp_GetWindowLongW" __imp_GetWindowLongW
0x18000322C: WPP_SF_i
0x18000D278: "__cdecl _imp_GetLastError" __imp_GetLastError
0x180008E88: RdrpDisplayNotification
0x180010010: "__cdecl _native_dllmain_reason" __native_dllmain_reason
0x18000BC68: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x18000DB00: "%u.%u.%u.%u" ??_C@_1BI@IEJCOLMP@?$AA?$CF?$AAu?$AA?4?$AA?$CF?$AAu?$AA?4?$AA?$CF?$AAu?$AA?4?$AA?$CF?$AAu?$AA?$AA@
0x18000D5D8: "__cdecl _imp_WerpGetReportConsent" __imp_WerpGetReportConsent
0x18000E750: "__cdecl _IMPORT_DESCRIPTOR_SHLWAPI" __IMPORT_DESCRIPTOR_SHLWAPI
0x180012160: gszDlgFooter
0x18000D298: "__cdecl _imp_CreateActCtxW" __imp_CreateActCtxW
0x18000D7A8: WPP_87e6ddaa4bf538bd087fec5bcefb5a38_Traceguids
0x18000E700: "__cdecl _IMPORT_DESCRIPTOR_ADVAPI32" __IMPORT_DESCRIPTOR_ADVAPI32
0x18000D668: "NULL" ??_C@_19CIJIHAKK@?$AAN?$AAU?$AAL?$AAL?$AA?$AA@
0x18000D1E0: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x18000D2A0: "__cdecl _imp_ActivateActCtx" __imp_ActivateActCtx
0x18000394C: RdrpLoadResourceString
0x180012220: gResolverCritSec
0x180002D30: RdrpFilterUnsupportedTypes
0x18000D420: "__cdecl _imp_LoadIconW" __imp_LoadIconW
0x18000B960: "__cdecl ValidateImageBase" _ValidateImageBase
0x180008BDC: RdrpLogGenericFailureEventInfo
0x18000D150: "__cdecl _imp_DuplicateTokenEx" __imp_DuplicateTokenEx
0x18000A6A8: GetTicks
0x1800098D4: RdrpDisplayResolutionDialog
0x1800095CC: RdrpDisplayFailureDialog
0x18000D660: "\" ??_C@_13FPGAJAPJ@?$AA?2?$AA?$AA@
0x18000D258: "__cdecl _imp_GetTempPathW" __imp_GetTempPathW
0x180001090: WPP_SF_
0x18000D5C8: "__cdecl _imp_WerReportCloseHandle" __imp_WerReportCloseHandle
0x18000D1D8: "__cdecl _imp_HeapAlloc" __imp_HeapAlloc
0x18000E73C: "__cdecl _IMPORT_DESCRIPTOR_ole32" __IMPORT_DESCRIPTOR_ole32
0x18000D240: "__cdecl _imp_CompareStringW" __imp_CompareStringW
0x180009DFC: RdrpDisplayHelp
0x18000D270: "__cdecl _imp_ProcessIdToSessionId" __imp_ProcessIdToSessionId
0x18000D2D8: "__cdecl _imp_OpenProcess" __imp_OpenProcess
0x180006CD8: RdrpGetServerResponse
0x180012190: gszDlgInfo
0x18000D1F0: "__cdecl _imp_TryEnterCriticalSection" __imp_TryEnterCriticalSection
0x18000B5D0: "__cdecl DllMainCRTStartup" _DllMainCRTStartup
0x18000D4B8: "__cdecl _imp__initterm" __imp__initterm
0x18000D340: "__cdecl _imp_SetLastError" __imp_SetLastError
0x18000D2A8: "__cdecl _imp_GetModuleFileNameW" __imp_GetModuleFileNameW
0x18000D6B8: RDR_RES_DROPPED_LEAK_DIAGNOSIS_EVENT
0x18000D698: RDR_RES_GEN_FAILURE_EVENT
0x18000D5D0: "__cdecl _imp_WerReportCreate" __imp_WerReportCreate
0x18000D548: "__cdecl _imp_RtlEqualUnicodeString" __imp_RtlEqualUnicodeString
0x18000D268: "__cdecl _imp_GetVersionExW" __imp_GetVersionExW
0x18000DA80: "RADAR_PRE_LEAK_32" ??_C@_1CE@PCPECED@?$AAR?$AAA?$AAD?$AAA?$AAR?$AA_?$AAP?$AAR?$AAE?$AA_?$AAL?$AAE?$AAA?$AAK?$AA_?$AA3?$AA2?$AA?$AA@
0x1800085E8: RdrpLogResDroppedCLEventInfo
0x180005BE0: StringCchPrintfW
0x18000DC38: WPP_9e3d9b96f4f931db4897b313381b8219_Traceguids
0x18000D3E0: SHLWAPI_NULL_THUNK_DATA
0x18000D3F0: "__cdecl _imp_GetMessageW" __imp_GetMessageW
0x1800121D8: "__cdecl _onexitend" __onexitend
0x18000D180: "__cdecl _imp_AdjustTokenPrivileges" __imp_AdjustTokenPrivileges
0x18000DBB0: "Software\Microsoft\RADAR\HeapLea" ??_C@_1IE@LANLOOOL@?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAR?$AAA?$AAD?$AAA?$AAR?$AA?2?$AAH?$AAe?$AAa?$AAp?$AAL?$AAe?$AAa@
0x180008D10: RdrpWorkerWndProc
0x18000D5F0: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x18000D708: RDR_RES_START_FAIL_EVENT
0x18000D388: "__cdecl _imp_RmGetList" __imp_RmGetList
0x18000D308: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x18000D6C8: RDR_RES_CLRESOLUTION_FAIL2_EVENT
0x18000D468: USER32_NULL_THUNK_DATA
0x18000D3F8: "__cdecl _imp_DefWindowProcW" __imp_DefWindowProcW
0x18000D530: "__cdecl _imp_EtwEventRegister" __imp_EtwEventRegister
0x18000D2C8: "__cdecl _imp_ReleaseActCtx" __imp_ReleaseActCtx
0x18000D528: "__cdecl _imp_RtlNtStatusToDosError" __imp_RtlNtStatusToDosError
0x18000D610: "__cdecl _xi_a" __xi_a
0x18000D2E8: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x1800105F0: gszClosePrograms
0x18000DCF0: gMmMaximumCommitConditionEventName
0x180012180: ghIcon
0x1800121D0: gbSkipWatson
0x18000DC80: "svchost.exe" ??_C@_1BI@GOFOEOMC@?$AAs?$AAv?$AAc?$AAh?$AAo?$AAs?$AAt?$AA?4?$AAe?$AAx?$AAe?$AA?$AA@
0x18000B2D4: RdrpLogErrorInfo
0x1800010F0: WPP_SF_DI
0x180008CBC: WPP_SF_DD
0x180001144: WPP_SF_dd
0x180001144: WPP_SF_Dd
0x18000D188: "__cdecl _imp_CloseServiceHandle" __imp_CloseServiceHandle
0x180010000: WPP_GLOBAL_Control
0x18000D850: "DisplayInterval" ??_C@_1CA@IPCLGOFC@?$AAD?$AAi?$AAs?$AAp?$AAl?$AAa?$AAy?$AAI?$AAn?$AAt?$AAe?$AAr?$AAv?$AAa?$AAl?$AA?$AA@
0x18000D1F8: "__cdecl _imp_HeapCreate" __imp_HeapCreate
0x18000DA50: "%s -wait %u" ??_C@_1BI@KHGGLBDN@?$AA?$CF?$AAs?$AA?5?$AA?9?$AAw?$AAa?$AAi?$AAt?$AA?5?$AA?$CF?$AAu?$AA?$AA@
0x18000D778: RDR_RES_UI_LAUNCH_FAIL_EVENT
0x1800010B4: WPP_SF_D
0x1800010B4: WPP_SF_d
0x180012200: "__cdecl pRawDllMain" _pRawDllMain
0x18000D508: "__cdecl _imp_RtlFreeSid" __imp_RtlFreeSid
0x18000DAD0: "RADAR_PRE_LEAK_WOW64" ??_C@_1CK@ICJIKDHI@?$AAR?$AAA?$AAD?$AAA?$AAR?$AA_?$AAP?$AAR?$AAE?$AA_?$AAL?$AAE?$AAA?$AAK?$AA_?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?$AA@
0x18000D6D8: WPP_ThisDir_CTLGUID_RdrResTraceGuid
0x18000E728: "__cdecl _IMPORT_DESCRIPTOR_COMCTL32" __IMPORT_DESCRIPTOR_COMCTL32
0x180003AD8: RdrpLoadStrings
0x18000D470: "__cdecl _imp_VerQueryValueW" __imp_VerQueryValueW
0x18000D348: "__cdecl _imp_DeleteCriticalSection" __imp_DeleteCriticalSection
0x18000B870: "__cdecl _security_check_cookie" __security_check_cookie
0x18000D608: "__cdecl _xc_z" __xc_z
0x18000D5B8: "__cdecl _imp_WerReportSetParameter" __imp_WerReportSetParameter
0x180001380: RdrpGetProcessNames
0x180010600: gResCLData
0x18000D3B8: "__cdecl _imp_Shell_NotifyIconW" __imp_Shell_NotifyIconW
0x180002450: RdrpCloseApplications
0x180002A80: RdrpFilterProcesses
0x18000DD50: IID_IHxHelpPane
0x180009B7C: RdrpResolveApplications
0x18000D568: "__cdecl _imp_CoCreateInstance" __imp_CoCreateInstance
0x18000D2E0: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x18000D320: "__cdecl _imp_LocalAlloc" __imp_LocalAlloc
0x18000D950: "%windir%\SysWow64\RdrLeakDiag.ex" ??_C@_1EE@CDDDADKJ@?$AA?$CF?$AAw?$AAi?$AAn?$AAd?$AAi?$AAr?$AA?$CF?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAo?$AAw?$AA6?$AA4?$AA?2?$AAR?$AAd?$AAr?$AAL?$AAe?$AAa?$AAk?$AAD?$AAi?$AAa?$AAg?$AA?4?$AAe?$AAx@
0x18000D280: "__cdecl _imp_GetProcessHeap" __imp_GetProcessHeap
0x1800034A0: WdiDiagnosticModuleMain
0x1800105C0: ghMaxEvent
0x18000D3A0: "__cdecl _imp_RmShutdown" __imp_RmShutdown
0x18000D798: RDR_RES_UI_CLOSE_EVENT
0x18000D488: "__cdecl _imp_GetFileVersionInfoSizeExW" __imp_GetFileVersionInfoSizeExW
0x18000D238: "__cdecl _imp_CreateDirectoryW" __imp_CreateDirectoryW
0x18000D628: "__cdecl _guard_fids_table" __guard_fids_table
0x18000D4F0: msvcrt_NULL_THUNK_DATA
0x18000D010: "__cdecl load_config_used" _load_config_used
0x18000D220: "__cdecl _imp_QueryPerformanceFrequency" __imp_QueryPerformanceFrequency
0x18000D398: "__cdecl _imp_RmReserveHeap" __imp_RmReserveHeap
0x18000D440: "__cdecl _imp_KillTimer" __imp_KillTimer
0x18000D3E8: "__cdecl _imp_PostQuitMessage" __imp_PostQuitMessage
0x18000D410: "__cdecl _imp_GetWindowThreadProcessId" __imp_GetWindowThreadProcessId
0x18000DCC8: "SeDebugPrivilege" ??_C@_1CC@DMDJMJLM@?$AAS?$AAe?$AAD?$AAe?$AAb?$AAu?$AAg?$AAP?$AAr?$AAi?$AAv?$AAi?$AAl?$AAe?$AAg?$AAe?$AA?$AA@
0x18000E764: "__cdecl _IMPORT_DESCRIPTOR_USER32" __IMPORT_DESCRIPTOR_USER32
0x18000D6A8: RDR_RES_CLRESOLUTION_FAIL1_EVENT
0x18000783C: RdrpUseReflection
0x18000D4D0: "__cdecl _imp__amsg_exit" __imp__amsg_exit
0x180007BC8: RdrpIsResolverElevatedAdmin
0x18000D218: "__cdecl _imp_DisableThreadLibraryCalls" __imp_DisableThreadLibraryCalls
0x18000D430: "__cdecl _imp_LoadStringW" __imp_LoadStringW
0x18000D930: "UNKNOWN" ??_C@_1BA@HABJOAEE@?$AAU?$AAN?$AAK?$AAN?$AAO?$AAW?$AAN?$AA?$AA@
0x18000D518: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x18000D2D0: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x18000D3D0: "__cdecl _imp_SHCreateWorkerWindowW" __imp_SHCreateWorkerWindowW
0x18000D3D8: "__cdecl _imp_StrRChrW" __imp_StrRChrW
0x180001C4C: RdrpGetEventParameters
0x18000D6F8: RDR_RES_FAILURE_UI_EVENT
0x18000D160: "__cdecl _imp_EventWrite" __imp_EventWrite
0x180005D88: WPP_SF_SDd
0x18000D550: "__cdecl _imp_NtOpenEvent" __imp_NtOpenEvent
0x18000D520: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x1800051CC: RdrpResolverShutdown
0x180005CD4: WPP_SF_SDDD
0x18000BA90: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x18000D248: "__cdecl _imp_ExpandEnvironmentStringsW" __imp_ExpandEnvironmentStringsW
0x18000D4A0: "__cdecl _imp_wcsrchr" __imp_wcsrchr
0x18000D920: WPP_622a31a8ce2e327a3f9f614a8fd26604_Traceguids
0x18000D5E0: "__cdecl _imp_WerReportSubmit" __imp_WerReportSubmit
0x18000A6E4: RdrpGetProcessImageName
0x18000D2C0: "__cdecl _imp_GetModuleHandleW" __imp_GetModuleHandleW
0x18000D448: "__cdecl _imp_TranslateMessage" __imp_TranslateMessage
0x18000D5C0: "__cdecl _imp_WerReportAddFile" __imp_WerReportAddFile
0x18000D728: RDR_RES_START_SUCCESS_EVENT
0x18000D4D8: "__cdecl _imp__XcptFilter" __imp__XcptFilter
0x18000D560: ntdll_NULL_THUNK_DATA
0x18000318C: WPP_SF_Pd
0x18000D4F8: "__cdecl _imp_EtwEventUnregister" __imp_EtwEventUnregister
0x18000A840: RdrpAppendSvchostServiceGroup
0x18000D390: "__cdecl _imp_RmEndSession" __imp_RmEndSession
0x18000D538: "__cdecl _imp_NtQueryEvent" __imp_NtQueryEvent
0x18000E7A0: "__cdecl _IMPORT_DESCRIPTOR_RstrtMgr" __IMPORT_DESCRIPTOR_RstrtMgr
0x18000D1B0: "__cdecl _imp_GetTraceEnableFlags" __imp_GetTraceEnableFlags
0x18000D128: "__cdecl _imp_RegisterTraceGuidsW" __imp_RegisterTraceGuidsW
0x180010018: "__cdecl _security_cookie" __security_cookie
0x18000D140: "__cdecl _imp_RegQueryValueExW" __imp_RegQueryValueExW
0x180010030: gdwReflectionInterval
0x18000D170: "__cdecl _imp_CheckTokenMembership" __imp_CheckTokenMembership
0x18000D458: "__cdecl _imp_SetTimer" __imp_SetTimer
0x18000D1D0: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x18000D318: "__cdecl _imp_LocalFree" __imp_LocalFree
0x18000D3B0: RstrtMgr_NULL_THUNK_DATA
0x18000B0A4: Parse_Cmdline
0x18000D360: "__cdecl _imp_SysAllocString" __imp_SysAllocString
0x1800121E0: "__cdecl _onexitbegin" __onexitbegin
0x18000D480: "__cdecl _imp_GetFileVersionInfoExW" __imp_GetFileVersionInfoExW
0x1800105E8: ghEventLog
0x1800087BC: RdrpLogCLResolutionFailureInfo
0x18000D870: "SkipWatson" ??_C@_1BG@NONIENAM@?$AAS?$AAk?$AAi?$AAp?$AAW?$AAa?$AAt?$AAs?$AAo?$AAn?$AA?$AA@
0x18000DAA8: "RADAR_PRE_LEAK_64" ??_C@_1CE@HKIJIMCM@?$AAR?$AAA?$AAD?$AAA?$AAR?$AA_?$AAP?$AAR?$AAE?$AA_?$AAL?$AAE?$AAA?$AAK?$AA_?$AA6?$AA4?$AA?$AA@
0x18000D500: "__cdecl _imp_RtlAllocateAndInitializeSid" __imp_RtlAllocateAndInitializeSid
0x18000D4E8: "__cdecl _imp__vsnwprintf" __imp__vsnwprintf
0x18000D2F8: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x18000DC70: WPP_977efef819a63ddb9d132bab1fc448fd_Traceguids
0x18000E6EC: "__cdecl _IMPORT_DESCRIPTOR_KERNEL32" __IMPORT_DESCRIPTOR_KERNEL32
0x18000D138: "__cdecl _imp_RegOpenKeyExW" __imp_RegOpenKeyExW
0x18000D588: "__cdecl _imp_WdiGetParameterData" __imp_WdiGetParameterData
0x18000B994: "__cdecl _security_init_cookie" __security_init_cookie
0x18000D380: "__cdecl _imp_RmRestart" __imp_RmRestart
0x18000AD54: RdrpGetProcessVersion
0x18000D590: "__cdecl _imp_WdiGetParameterCount" __imp_WdiGetParameterCount
0x18000E6C4: "__cdecl _IMPORT_DESCRIPTOR_msvcrt" __IMPORT_DESCRIPTOR_msvcrt
0x1800080BC: RdrpLogUIInfo
0x1800029BC: RdrpIsMaxSet
0x18000D5E8: wer_NULL_THUNK_DATA
0x18000D4C0: "__cdecl _imp_malloc" __imp_malloc
0x18000D1B8: ADVAPI32_NULL_THUNK_DATA
0x180007D88: RdrpLogAllocFailEvent
0x18000D178: "__cdecl _imp_LookupPrivilegeValueW" __imp_LookupPrivilegeValueW
0x18000BAE0: "__cdecl _report_gsfailure" __report_gsfailure
0x18000D558: "__cdecl _imp_EtwEventWrite" __imp_EtwEventWrite
0x18000D208: "__cdecl _imp_LeaveCriticalSection" __imp_LeaveCriticalSection
0x18000D678: RDR_RES_UI_INFO_EVENT
0x18000D5B0: "__cdecl _imp_WerpSetCallBack" __imp_WerpSetCallBack
0x1800105E0: ghResolverModule
0x18000D1A0: "__cdecl _imp_QueryServiceConfigW" __imp_QueryServiceConfigW
0x1800121F0: "__cdecl _native_startup_state" __native_startup_state
0x180012150: gszEmptyDotTxt
0x18000D378: "__cdecl _imp_RmStartSession" __imp_RmStartSession
0x18000D190: "__cdecl _imp_OpenSCManagerW" __imp_OpenSCManagerW
0x180003430: WdiGetDiagnosticModuleInterfaceVersion
0x18000E778: "__cdecl _IMPORT_DESCRIPTOR_SHELL32" __IMPORT_DESCRIPTOR_SHELL32
0x18000A054: RdrpDisplayProcessInformation
0x18000D368: "__cdecl _imp_SysFreeString" __imp_SysFreeString
0x18000D3C8: "__cdecl _imp_SHGetFileDescriptionW" __imp_SHGetFileDescriptionW
0x18000D598: "__cdecl _imp_WdiGetParameterByName" __imp_WdiGetParameterByName
0x18000124C: WPP_SF_SD
0x18000124C: WPP_SF_Sd
0x18000D4C8: "__cdecl _imp_free" __imp_free
0x18000B900: "__cdecl IsNonwritableInCurrentImage" _IsNonwritableInCurrentImage
0x1800012C8: WPP_SF_SS
0x18000D168: "__cdecl _imp_OpenProcessToken" __imp_OpenProcessToken
0x18000D338: "__cdecl _imp_K32GetModuleFileNameExW" __imp_K32GetModuleFileNameExW
0x180005C60: WPP_SF_S
0x1800031E0: WPP_SF_c
0x18000BCED: memset
0x18000E7DC: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR

[JEB Decompiler by PNF Software]