Generated by JEB on 2019/08/01

PE: C:\Windows\System32\cipher.exe Base=0x140000000 SHA-256=1C7BAFE5742197741FC3724753C952C9AF890F8A6B2C61561C33CAABA8CF07CC
PDB: cipher.pdb GUID={FD2B0D1E-590B-6BCD-AE3E5BDECC699C8F} Age=1

436 located named symbols:
0x1400091E8: "__cdecl _imp_CertEnumCertificatesInStore" __imp_CertEnumCertificatesInStore
0x140002110: ListAFile
0x140007BA4: "__cdecl _raise_securityfailure" __raise_securityfailure
0x14000C601: bUseSmartcard
0x140003394: CipherConvertToDriveLetter
0x140007F90: "__cdecl FindPESection" _FindPESection
0x1400034C8: CipherTouchDirFiles
0x140001748: StringCchCatW
0x140009318: "__cdecl _imp_GetCurrentDirectoryW" __imp_GetCurrentDirectoryW
0x140007810: "__cdecl _delayLoadHelper2" __delayLoadHelper2
0x14000A614: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x140003D74: Safe_fgets
0x140007F80: "__cdecl wsetargv" _wsetargv
0x14000C010: "__cdecl _security_cookie_complement" __security_cookie_complement
0x140009598: "__cdecl _imp___wgetmainargs" __imp___wgetmainargs
0x1400092A0: "__cdecl _imp_DeviceIoControl" __imp_DeviceIoControl
0x14000EAC8: hOutput
0x14000A68C: "__cdecl _IMPORT_DESCRIPTOR_EFSUTIL" __IMPORT_DESCRIPTOR_EFSUTIL
0x140009380: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x140009130: "__cdecl _imp_LookupAccountSidW" __imp_LookupAccountSidW
0x1400094A0: "__cdecl _imp_DsUnBindW" __imp_DsUnBindW
0x140009B2C: "/n" ??_C@_15GDDOGJIP@?$AA?1?$AAn?$AA?$AA@
0x14000A5D0: edputil_NULL_THUNK_DATA_DLB
0x1400091B0: "__cdecl _imp_DecryptFileW" __imp_DecryptFileW
0x140002220: CipherEncryptAction
0x1400083B0: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x1400091D8: "__cdecl _imp_CertFreeCertificateContext" __imp_CertFreeCertificateContext
0x1400092E0: "__cdecl _imp_CreateFileW" __imp_CreateFileW
0x14000CAC0: Buf
0x140001820: GetSidName
0x140009350: "__cdecl _imp_FindNextVolumeW" __imp_FindNextVolumeW
0x14000EAC0: ConsoleOutput
0x14000C612: GenerateDRA
0x140009A30: "fil" ??_C@_17NCFCJPID@?$AAf?$AAi?$AAl?$AA?$AA@
0x14000C5F0: "__cdecl _hmod__SHELL32_dll" __hmod__SHELL32_dll
0x1400092B0: "__cdecl _imp_RemoveDirectoryW" __imp_RemoveDirectoryW
0x1400094B8: NTDSAPI_NULL_THUNK_DATA
0x140003A2C: CreateSelfSignedCertificate
0x140009B24: "/u" ??_C@_15OECGLJBB@?$AA?1?$AAu?$AA?$AA@
0x1400098C0: "A:\" ??_C@_17FLNAHGDE@?$AAA?$AA?3?$AA?2?$AA?$AA@
0x140009518: "__cdecl _imp_BCryptDestroyKey" __imp_BCryptDestroyKey
0x14000C5E0: "__cdecl commode" _commode
0x140009CA0: "__cdecl _pfnDliFailureHook2" __pfnDliFailureHook2
0x140009408: "__cdecl _imp_GetFileType" __imp_GetFileType
0x140009528: bcrypt_NULL_THUNK_DATA
0x140001110: MySetThreadUILanguage
0x14000C60E: GenerateRecoveryPolicy
0x1400095D8: "__cdecl _imp_wcschr" __imp_wcschr
0x140009AB0: "ADDRESSBOOK" ??_C@_1BI@BLIGDLDB@?$AAA?$AAD?$AAD?$AAR?$AAE?$AAS?$AAS?$AAB?$AAO?$AAO?$AAK?$AA?$AA@
0x140005B1C: SupportEncryptedFileSystem
0x140009310: "__cdecl _imp_HeapSetInformation" __imp_HeapSetInformation
0x140009120: "__cdecl _imp_CryptReleaseContext" __imp_CryptReleaseContext
0x140007E60: "long __cdecl __CxxUnhandledExceptionFilter(struct _EXCEPTION_POINTERS * __ptr64)" ?__CxxUnhandledExceptionFilter@@YAJPEAU_EXCEPTION_POINTERS@@@Z
0x140009648: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x14000980C: "." ??_C@_13JOFGPIOO@?$AA?4?$AA?$AA@
0x140004D94: SecureProcessFreeClusters
0x140009798: "DESX" ??_C@_19GOPKKBMO@?$AAD?$AAE?$AAS?$AAX?$AA?$AA@
0x1400098A0: "CertificateHash" ??_C@_1CA@LBKMOPLJ@?$AAC?$AAe?$AAr?$AAt?$AAi?$AAf?$AAi?$AAc?$AAa?$AAt?$AAe?$AAH?$AAa?$AAs?$AAh?$AA?$AA@
0x14000C5EC: "__cdecl fmode" _fmode
0x140009450: "__cdecl _imp_FormatMessageW" __imp_FormatMessageW
0x1400095B8: "__cdecl _imp__wcsnicmp" __imp__wcsnicmp
0x140009600: "__cdecl _imp_fgetws" __imp_fgetws
0x1400092C0: "__cdecl _imp_SetFilePointer" __imp_SetFilePointer
0x140004950: SecureDeleteRandomFill
0x140009C20: "/x" ??_C@_15BGEMGBMM@?$AA?1?$AAx?$AA?$AA@
0x140007EBE: "__cdecl XcptFilter" _XcptFilter
0x14000C606: FillUnusedSpace
0x140009650: "__cdecl _xc_a" __xc_a
0x14000A4F4: "__cdecl _DELAY_IMPORT_DESCRIPTOR_edputil_dll" __DELAY_IMPORT_DESCRIPTOR_edputil_dll
0x14000C600: DisplayFilesOnly
0x140009160: "__cdecl _imp_ConvertStringSidToSidW" __imp_ConvertStringSidToSidW
0x140009488: "__cdecl _imp_FindClose" __imp_FindClose
0x140009790: "AES" ??_C@_17PJMHNJHG@?$AAA?$AAE?$AAS?$AA?$AA@
0x140001008: StringCchCopyW
0x140001718: CipherFree
0x140009320: "__cdecl _imp_SetCurrentDirectoryW" __imp_SetCurrentDirectoryW
0x14000674C: FindArg
0x140009210: "__cdecl _imp_CertOpenStore" __imp_CertOpenStore
0x14000197C: DisplayFileHashList
0x1400096D8: "__cdecl _guard_iat_table" __guard_iat_table
0x140009190: "__cdecl _imp_CryptAcquireContextW" __imp_CryptAcquireContextW
0x140008369: memcpy
0x1400094E0: "__cdecl _imp_MessageBoxW" __imp_MessageBoxW
0x140009280: "__cdecl _imp_EfsClientGetEncryptedFileVersion" __imp_EfsClientGetEncryptedFileVersion
0x140009348: "__cdecl _imp_GetTempFileNameW" __imp_GetTempFileNameW
0x140009540: "__cdecl _imp_memset" __imp_memset
0x14000814F: "__cdecl initterm" _initterm
0x1400049B0: CreateMyTempFile
0x14000C638: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x14000116C: FileIsConsole
0x1400093C0: "__cdecl _imp_Sleep" __imp_Sleep
0x140002BE0: AddUserToAFile
0x140009680: "__cdecl _xi_z" __xi_z
0x140009AD0: ".PFX" ??_C@_19MPHPJJBA@?$AA?4?$AAP?$AAF?$AAX?$AA?$AA@
0x1400095F8: "__cdecl _imp___iob_func" __imp___iob_func
0x14000C610: UserSpecifiedFileSpec
0x1400093B8: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x140009608: "__cdecl _imp_wcscmp" __imp_wcscmp
0x14000A550: SHELL32_NULL_THUNK_DATA_DLN
0x14000815B: "__cdecl _C_specific_handler" __C_specific_handler
0x140009478: "__cdecl _imp_lstrlenW" __imp_lstrlenW
0x140009990: " " ??_C@_13LBAGMAIH@?$AA?6?$AA?$AA@
0x14000C613: SetUpNewUserKey
0x140009818: "*" ??_C@_13BBDEGPLJ@?$AA?$CK?$AA?$AA@
0x140009480: "__cdecl _imp_HeapFree" __imp_HeapFree
0x14000A6B4: "__cdecl _IMPORT_DESCRIPTOR_DSROLE" __IMPORT_DESCRIPTOR_DSROLE
0x140009198: "__cdecl _imp_RegCloseKey" __imp_RegCloseKey
0x1400093C8: "__cdecl _imp_GetVolumeInformationW" __imp_GetVolumeInformationW
0x140008308: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x140010028: edputil_NULL_THUNK_DATA_DLA
0x14000569C: GetCertFromStore
0x1400092B8: "__cdecl _imp_SetErrorMode" __imp_SetErrorMode
0x14000C880: StartingDirectory
0x1400029B0: DoFinalRekeyAction
0x1400099A8: "%s.CER" ??_C@_1O@PMEAGJBC@?$AA?$CF?$AAs?$AA?4?$AAC?$AAE?$AAR?$AA?$AA@
0x140009B34: "/h" ??_C@_15EGFFDGFD@?$AA?1?$AAh?$AA?$AA@
0x1400091B8: "__cdecl _imp_CryptGetUserKey" __imp_CryptGetUserKey
0x140007F73: "__cdecl amsg_exit" _amsg_exit
0x140009740: "%s%s%s" ??_C@_1O@JBBHAGJJ@?$AA?$CF?$AAs?$AA?$CF?$AAs?$AA?$CF?$AAs?$AA?$AA@
0x140005E10: GetEncryptionCertificateList
0x140009C9C: "__cdecl _DefaultResolveDelayLoadedAPIFlags" __DefaultResolveDelayLoadedAPIFlags
0x14000C605: DisplayAllFiles
0x14000A678: "__cdecl _IMPORT_DESCRIPTOR_bcrypt" __IMPORT_DESCRIPTOR_bcrypt
0x140002180: DoFinalListAction
0x140009588: "__cdecl _imp_exit" __imp_exit
0x140009BA8: "/USER" ??_C@_1M@FEIKJIMG@?$AA?1?$AAU?$AAS?$AAE?$AAR?$AA?$AA@
0x140009410: "__cdecl _imp_WideCharToMultiByte" __imp_WideCharToMultiByte
0x140009538: "__cdecl _imp_strcmp" __imp_strcmp
0x140009270: "__cdecl _imp_EfsClientQueryProtectors" __imp_EfsClientQueryProtectors
0x1400092C8: "__cdecl _imp_SetEndOfFile" __imp_SetEndOfFile
0x1400091A8: "__cdecl _imp_FreeEncryptedFileKeyInfo" __imp_FreeEncryptedFileKeyInfo
0x140009B0C: "/k" ??_C@_15FEOAJJLN@?$AA?1?$AAk?$AA?$AA@
0x1400093E8: "__cdecl _imp_VirtualFree" __imp_VirtualFree
0x1400099D8: "BlockLength" ??_C@_1BI@JJDKEEML@?$AAB?$AAl?$AAo?$AAc?$AAk?$AAL?$AAe?$AAn?$AAg?$AAt?$AAh?$AA?$AA@
0x1400093A8: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x140002E40: DecryptAFile
0x14000C628: "__cdecl _native_startup_lock" __native_startup_lock
0x140007EA0: "__cdecl _CxxSetUnhandledExceptionFilter" __CxxSetUnhandledExceptionFilter
0x1400095E0: "__cdecl _imp__wcsicmp" __imp__wcsicmp
0x140009560: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x1400097E8: "%s\%s" ??_C@_1M@DFKENGJN@?$AA?$CF?$AAs?$AA?2?$AA?$CF?$AAs?$AA?$AA@
0x140009618: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x14000824B: "__cdecl _imp_load_EdpConvertProtectorToExternalId" __imp_load_EdpConvertProtectorToExternalId
0x1400091F8: "__cdecl _imp_CertCloseStore" __imp_CertCloseStore
0x1400091D0: "__cdecl _imp_CertGetEnhancedKeyUsage" __imp_CertGetEnhancedKeyUsage
0x140009490: KERNEL32_NULL_THUNK_DATA
0x140009C10: "/SERVER" ??_C@_1BA@GJACHGIJ@?$AA?1?$AAS?$AAE?$AAR?$AAV?$AAE?$AAR?$AA?$AA@
0x140009448: "__cdecl _imp_GetLastError" __imp_GetLastError
0x1400098C8: "NTFS" ??_C@_19ENNDBEJL@?$AAN?$AAT?$AAF?$AAS?$AA?$AA@
0x1400082E4: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x1400016EC: CipherAlloc
0x140009AFC: "/i" ??_C@_15POOJFBDG@?$AA?1?$AAi?$AA?$AA@
0x140009530: "__cdecl _imp__commode" __imp__commode
0x1400095C0: "__cdecl _imp__putws" __imp__putws
0x14000CAA0: GlobalSecureFill
0x140009570: "__cdecl _imp___setusermatherr" __imp___setusermatherr
0x1400094F8: "__cdecl _imp_BCryptCloseAlgorithmProvider" __imp_BCryptCloseAlgorithmProvider
0x1400096F0: "__cdecl _sz_edputil_dll" __sz_edputil_dll
0x140009188: "__cdecl _imp_EqualSid" __imp_EqualSid
0x14000A5D8: "__cdecl _IMPORT_DESCRIPTOR_ADVAPI32" __IMPORT_DESCRIPTOR_ADVAPI32
0x140009208: "__cdecl _imp_CertFindCertificateInStore" __imp_CertFindCertificateInStore
0x1400097D0: "AddressBook" ??_C@_1BI@EICBFBMK@?$AAA?$AAd?$AAd?$AAr?$AAe?$AAs?$AAs?$AAB?$AAo?$AAo?$AAk?$AA?$AA@
0x1400055C0: GetUserInput
0x140009388: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x140009808: " " ??_C@_01EEMJAFIK@?6?$AA@
0x140009B60: "/f" ??_C@_15KGIKEBGA@?$AA?1?$AAf?$AA?$AA@
0x140009168: "__cdecl _imp_QueryRecoveryAgentsOnEncryptedFile" __imp_QueryRecoveryAgentsOnEncryptedFile
0x140008227: "__cdecl _imp_load_SHChangeNotifySuspendResume" __imp_load_SHChangeNotifySuspendResume
0x1400095C8: "__cdecl _imp_getchar" __imp_getchar
0x140009C9C: "__cdecl _ResolveDelayLoadedAPIFlags" __ResolveDelayLoadedAPIFlags
0x140008040: "__cdecl ValidateImageBase" _ValidateImageBase
0x140009A90: "TRUSTEDPEOPLE" ??_C@_1BM@MBAIKKOO@?$AAT?$AAR?$AAU?$AAS?$AAT?$AAE?$AAD?$AAP?$AAE?$AAO?$AAP?$AAL?$AAE?$AA?$AA@
0x140009B40: "/SMARTCARD" ??_C@_1BG@IMOGCMIA@?$AA?1?$AAS?$AAM?$AAA?$AAR?$AAT?$AAC?$AAA?$AAR?$AAD?$AA?$AA@
0x140009A38: "1.3.6.1.4.1.311.10.3.4" ??_C@_0BH@ELINB@1?43?46?41?44?41?4311?410?43?44?$AA@
0x140009418: "__cdecl _imp_VerSetConditionMask" __imp_VerSetConditionMask
0x140002A30: DoFinalEncryptAction
0x140009368: "__cdecl _imp_FlushFileBuffers" __imp_FlushFileBuffers
0x140009784: "\" ??_C@_13FPGAJAPJ@?$AA?2?$AA?$AA@
0x1400092F0: "__cdecl _imp_GetVolumeNameForVolumeMountPointW" __imp_GetVolumeNameForVolumeMountPointW
0x140009C88: "ECDH_P521" ??_C@_1BE@NAPMNIN@?$AAE?$AAC?$AAD?$AAH?$AA_?$AAP?$AA5?$AA2?$AA1?$AA?$AA@
0x140009440: "__cdecl _imp_HeapAlloc" __imp_HeapAlloc
0x140009A20: "%s%s" ??_C@_19LJDFFCJJ@?$AA?$CF?$AAs?$AA?$CF?$AAs?$AA?$AA@
0x1400012E4: DisplayMsg
0x140009250: "__cdecl _imp_EfsUtilGetSmartcardProviderName" __imp_EfsUtilGetSmartcardProviderName
0x14000A514: "__cdecl _NULL_DELAY_IMPORT_DESCRIPTOR" __NULL_DELAY_IMPORT_DESCRIPTOR
0x140005750: GetEncryptionCertificateHashList
0x140009AC8: "My" ??_C@_15OLMMKIPI@?$AAM?$AAy?$AA?$AA@
0x14000C5E8: "__cdecl newmode" _newmode
0x140009B68: "/y" ??_C@_15KOPAAGKJ@?$AA?1?$AAy?$AA?$AA@
0x140008178: "__cdecl _acrt_iob_func" __acrt_iob_func
0x140009568: "__cdecl _imp__initterm" __imp__initterm
0x1400092F8: "__cdecl _imp_GetDiskFreeSpaceExW" __imp_GetDiskFreeSpaceExW
0x140009590: "__cdecl _imp___set_app_type" __imp___set_app_type
0x140009400: "__cdecl _imp_FindFirstVolumeW" __imp_FindFirstVolumeW
0x1400093F0: "__cdecl _imp_SetLastError" __imp_SetLastError
0x14000C5F8: "__cdecl _hmod__edputil_dll" __hmod__edputil_dll
0x140009B18: "/ECC" ??_C@_19MDDDIMEM@?$AA?1?$AAE?$AAC?$AAC?$AA?$AA@
0x140009290: "__cdecl _imp_GetDiskFreeSpaceW" __imp_GetDiskFreeSpaceW
0x140009230: CRYPT32_NULL_THUNK_DATA
0x140001090: StringCchPrintfW
0x140009AE4: "/d" ??_C@_15MIDIJOL@?$AA?1?$AAd?$AA?$AA@
0x140009498: "__cdecl _imp_DsFreeNameResultW" __imp_DsFreeNameResultW
0x14000C618: "__cdecl _onexitend" __onexitend
0x140002F70: DoFinalDecryptAction
0x140009580: "__cdecl _imp__exit" __imp__exit
0x140003E8C: GetPassword
0x140009640: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x140009820: "Software\Microsoft\Windows NT\Cu" ??_C@_1HK@BJFCPEJN@?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAN?$AAT?$AA?2?$AAC?$AAu@
0x140009510: "__cdecl _imp_BCryptGetProperty" __imp_BCryptGetProperty
0x140009328: "__cdecl _imp_FindFirstFileW" __imp_FindFirstFileW
0x140009520: "__cdecl _imp_BCryptEncrypt" __imp_BCryptEncrypt
0x1400093A0: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x14000CA88: TotalFileCount
0x1400094E8: USER32_NULL_THUNK_DATA
0x140004BA4: SecureProcessMft
0x140009260: "__cdecl _imp_EfsUtilGetCurrentUserInformation" __imp_EfsUtilGetCurrentUserInformation
0x140009BE0: "/REMOVEUSER" ??_C@_1BI@DGNIJLDM@?$AA?1?$AAR?$AAE?$AAM?$AAO?$AAV?$AAE?$AAU?$AAS?$AAE?$AAR?$AA?$AA@
0x140008257: "__cdecl _tailMerge_edputil_dll" __tailMerge_edputil_dll
0x140009258: "__cdecl _imp_EfsUtilCreateSelfSignedCertificate" __imp_EfsUtilCreateSelfSignedCertificate
0x140009458: "__cdecl _imp_GetConsoleMode" __imp_GetConsoleMode
0x140009620: "__cdecl _imp_RtlNtStatusToDosError" __imp_RtlNtStatusToDosError
0x140009A00: "." ??_C@_01LFCBOECM@?4?$AA@
0x140009180: "__cdecl _imp_FreeEncryptionCertificateHashList" __imp_FreeEncryptionCertificateHashList
0x140009668: "__cdecl _xi_a" __xi_a
0x140009370: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x140009398: "__cdecl _imp_ResolveDelayLoadedAPI" __imp_ResolveDelayLoadedAPI
0x140007F80: "__cdecl matherr" _matherr
0x140009150: "__cdecl _imp_AddUsersToEncryptedFile" __imp_AddUsersToEncryptedFile
0x140006828: wmain
0x140010008: "__cdecl _imp_SHChangeNotifySuspendResume" __imp_SHChangeNotifySuspendResume
0x1400093D0: "__cdecl _imp_QueryDosDeviceW" __imp_QueryDosDeviceW
0x140009A50: "ldap:///%s?userCertificate" ??_C@_1DG@BCKBKPDL@?$AAl?$AAd?$AAa?$AAp?$AA?3?$AA?1?$AA?1?$AA?1?$AA?$CF?$AAs?$AA?$DP?$AAu?$AAs?$AAe?$AAr?$AAC?$AAe?$AAr?$AAt?$AAi?$AAf?$AAi?$AAc?$AAa?$AAt?$AAe?$AA?$AA@
0x14000C60C: FlushEfsUseCache
0x140009788: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x140002D10: RekeyAFile
0x14000218C: CipherDispatch
0x140007D58: "__cdecl _report_rangecheckfailure" __report_rangecheckfailure
0x1400095B0: "__cdecl _imp_towupper" __imp_towupper
0x140009810: ".." ??_C@_15DDHGOCBH@?$AA?4?$AA?4?$AA?$AA@
0x1400097B8: "DES" ??_C@_17LBCHNHBC@?$AAD?$AAE?$AAS?$AA?$AA@
0x14000A6A0: "__cdecl _IMPORT_DESCRIPTOR_FeClient" __IMPORT_DESCRIPTOR_FeClient
0x140008381: strcmp
0x140009360: "__cdecl _imp_GetDriveTypeW" __imp_GetDriveTypeW
0x140009438: "__cdecl _imp_WriteConsoleW" __imp_WriteConsoleW
0x140002930: DoFinalAddUserAction
0x140005BD0: FindUserAndLoadCertificateList
0x140009B58: "/s" ??_C@_15MBENOGMN@?$AA?1?$AAs?$AA?$AA@
0x140007B80: "__cdecl _security_check_cookie" __security_check_cookie
0x14000C640: TotalDirectoryCount
0x14000819C: "__cdecl _imp_load_ILFree" __imp_load_ILFree
0x140009660: "__cdecl _xc_z" __xc_z
0x140009238: "__cdecl _imp_DsRoleGetPrimaryDomainInformation" __imp_DsRoleGetPrimaryDomainInformation
0x140002FE0: CipherConvertHashToStr
0x14000C660: CertFilePath
0x140009430: "__cdecl _imp_GetProcAddress" __imp_GetProcAddress
0x140004714: SecureInitializeRandomFill
0x140009148: "__cdecl _imp_QueryUsersOnEncryptedFile" __imp_QueryUsersOnEncryptedFile
0x140009288: FeClient_NULL_THUNK_DATA
0x140009C48: "ECDH_P256" ??_C@_1BE@IHBIMMJF@?$AAE?$AAC?$AAD?$AAH?$AA_?$AAP?$AA2?$AA5?$AA6?$AA?$AA@
0x140009178: "__cdecl _imp_FlushEfsCache" __imp_FlushEfsCache
0x14000EAD8: ConsoleError
0x140009550: "__cdecl _imp_?terminate@@YAXXZ" __imp_?terminate@@YAXXZ
0x140009378: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x140009468: "__cdecl _imp_GetStdHandle" __imp_GetStdHandle
0x140009470: "__cdecl _imp_DelayLoadFailureHook" __imp_DelayLoadFailureHook
0x140009760: "\bootmgr" ??_C@_1BC@EONGMCPP@?$AA?2?$AAb?$AAo?$AAo?$AAt?$AAm?$AAg?$AAr?$AA?$AA@
0x1400092D0: "__cdecl _imp_GetProcessHeap" __imp_GetProcessHeap
0x1400096E0: "__cdecl _sz_SHELL32_dll" __sz_SHELL32_dll
0x1400093E0: "__cdecl _imp_FindNextFileW" __imp_FindNextFileW
0x14000C603: DisplayUseOptionW
0x140008239: "__cdecl _imp_load_ILCreateFromPathW" __imp_load_ILCreateFromPathW
0x140001368: DisplayErr
0x140003108: CipherGetCrntEfsHash
0x1400092D8: "__cdecl _imp_GetVolumePathNameW" __imp_GetVolumePathNameW
0x140009A88: "MY" ??_C@_15ELPOAHMG@?$AAM?$AAY?$AA?$AA@
0x140009278: "__cdecl _imp_EfsClientFreeProtectorList" __imp_EfsClientFreeProtectorList
0x140009200: "__cdecl _imp_PFXExportCertStoreEx" __imp_PFXExportCertStoreEx
0x1400093D8: "__cdecl _imp_CreateDirectoryW" __imp_CreateDirectoryW
0x14000C611: ExportEfsCert
0x1400091A0: "__cdecl _imp_SetUserFileEncryptionKey" __imp_SetUserFileEncryptionKey
0x1400091C0: "__cdecl _imp_CryptDestroyKey" __imp_CryptDestroyKey
0x140009228: "__cdecl _imp_CryptBinaryToStringW" __imp_CryptBinaryToStringW
0x140009218: "__cdecl _imp_CryptStringToBinaryW" __imp_CryptStringToBinaryW
0x140009688: "__cdecl _guard_fids_table" __guard_fids_table
0x140009358: "__cdecl _imp_lstrcmpW" __imp_lstrcmpW
0x140009610: msvcrt_NULL_THUNK_DATA
0x140009010: "__cdecl load_config_used" _load_config_used
0x140002860: DoFinalRemoveUserAction
0x1400050B8: SecureDeleteFreeSpace
0x1400095D0: "__cdecl _imp_printf" __imp_printf
0x140003714: CipherTouchEncryptedFiles
0x140010010: "__cdecl _imp_ILFree" __imp_ILFree
0x1400094A8: "__cdecl _imp_DsCrackNamesW" __imp_DsCrackNamesW
0x1400095E8: "__cdecl _imp__get_osfhandle" __imp__get_osfhandle
0x140009298: "__cdecl _imp_SetConsoleMode" __imp_SetConsoleMode
0x1400016AC: FormatFileSize
0x140009750: "\ntldr" ??_C@_1O@MIGMNGND@?$AA?2?$AAn?$AAt?$AAl?$AAd?$AAr?$AA?$AA@
0x14000A664: "__cdecl _IMPORT_DESCRIPTOR_CRYPT32" __IMPORT_DESCRIPTOR_CRYPT32
0x140001BF0: ProtectorBelongsToUser
0x140009170: "__cdecl _imp_EncryptedFileKeyInfo" __imp_EncryptedFileKeyInfo
0x14000A63C: "__cdecl _IMPORT_DESCRIPTOR_USER32" __IMPORT_DESCRIPTOR_USER32
0x140006004: BackEfsCert
0x14000EAD0: hError
0x1400095A0: "__cdecl _imp__amsg_exit" __imp__amsg_exit
0x140009508: "__cdecl _imp_BCryptOpenAlgorithmProvider" __imp_BCryptOpenAlgorithmProvider
0x140009B70: "/c" ??_C@_15JBFELBFC@?$AA?1?$AAc?$AA?$AA@
0x1400097C0: "UNKNOWN" ??_C@_1BA@HABJOAEE@?$AAU?$AAN?$AAK?$AAN?$AAO?$AAW?$AAN?$AA?$AA@
0x1400099F0: "%ld" ??_C@_17OADJODNB@?$AA?$CF?$AAl?$AAd?$AA?$AA@
0x140009628: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x140009500: "__cdecl _imp_BCryptGenRandom" __imp_BCryptGenRandom
0x1400094F0: "__cdecl _imp_BCryptGenerateSymmetricKey" __imp_BCryptGenerateSymmetricKey
0x140009390: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x140009700: "kernel32.dll" ??_C@_1BK@MGMFAEKH@?$AAk?$AAe?$AAr?$AAn?$AAe?$AAl?$AA3?$AA2?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x14000C5E4: "__cdecl dowildcard" _dowildcard
0x140009998: "%s.PFX" ??_C@_1O@OHFNMNBA@?$AA?$CF?$AAs?$AA?4?$AAP?$AAF?$AAX?$AA?$AA@
0x1400099B8: "ObjectLength" ??_C@_1BK@GPNIFMAA@?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAL?$AAe?$AAn?$AAg?$AAt?$AAh?$AA?$AA@
0x1400092A8: "__cdecl _imp_VirtualAlloc" __imp_VirtualAlloc
0x140009C60: "384" ??_C@_17GPPJODO@?$AA3?$AA8?$AA4?$AA?$AA@
0x140009248: DSROLE_NULL_THUNK_DATA
0x14000C60D: RefreshUserKeyOnFiles
0x140009C80: "521" ??_C@_17FGNFEEON@?$AA5?$AA2?$AA1?$AA?$AA@
0x140001530: GetResourceString
0x1400094D0: "__cdecl _imp_RpcStringFreeW" __imp_RpcStringFreeW
0x140009630: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x140009A08: "EFSTMPWP\" ??_C@_1BE@EAPBJCOK@?$AAE?$AAF?$AAS?$AAT?$AAM?$AAP?$AAW?$AAP?$AA?2?$AA?$AA@
0x140009CA0: "__cdecl _pfnDefaultDliFailureHook2" __pfnDefaultDliFailureHook2
0x140009930: "Microsoft Enhanced Cryptographic" ??_C@_1FO@GBKEFGLF@?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?5?$AAE?$AAn?$AAh?$AAa?$AAn?$AAc?$AAe?$AAd?$AA?5?$AAC?$AAr?$AAy?$AAp?$AAt?$AAo?$AAg?$AAr?$AAa?$AAp?$AAh?$AAi?$AAc@
0x140009118: "__cdecl _imp_EncryptFileW" __imp_EncryptFileW
0x14000C60F: DisplayCrntCert
0x140002180: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x140009BF8: "/FLUSHCACHE" ??_C@_1BI@CCHPBAIG@?$AA?1?$AAF?$AAL?$AAU?$AAS?$AAH?$AAC?$AAA?$AAC?$AAH?$AAE?$AA?$AA@
0x140007ECC: RtlpImageNtHeader
0x14000C602: DisplayDetail
0x14000C020: IgnoreErrors
0x140009C28: "/r" ??_C@_15HJPBIBKI@?$AA?1?$AAr?$AA?$AA@
0x140009268: EFSUTIL_NULL_THUNK_DATA
0x140009420: "__cdecl _imp_GetModuleHandleW" __imp_GetModuleHandleW
0x140009340: "__cdecl _imp_VerifyVersionInfoW" __imp_VerifyVersionInfoW
0x140009AEC: "/a" ??_C@_15DLFNHJNJ@?$AA?1?$AAa?$AA?$AA@
0x140010018: SHELL32_NULL_THUNK_DATA_DLA
0x1400099F8: ".E" ??_C@_15NPFBJCBF@?$AA?4?$AAE?$AA?$AA@
0x1400095A8: "__cdecl _imp__XcptFilter" __imp__XcptFilter
0x140009B90: "/CERTFILE" ??_C@_1BE@BKFLGAMM@?$AA?1?$AAC?$AAE?$AAR?$AAT?$AAF?$AAI?$AAL?$AAE?$AA?$AA@
0x140009638: ntdll_NULL_THUNK_DATA
0x140009548: "__cdecl _imp_memcpy" __imp_memcpy
0x140009AF4: "/B" ??_C@_15IJNKHJAJ@?$AA?1?$AAB?$AA?$AA@
0x1400082D6: "__cdecl _iob_func" __iob_func
0x1400093F8: "__cdecl _imp_GetComputerNameW" __imp_GetComputerNameW
0x140009C40: "256" ??_C@_17NMMCEFPF@?$AA2?$AA5?$AA6?$AA?$AA@
0x140009720: "SetThreadUILanguage" ??_C@_0BE@FGMANJOG@SetThreadUILanguage?$AA@
0x14000A4D4: "__cdecl _DELAY_IMPORT_DESCRIPTOR_SHELL32_dll" __DELAY_IMPORT_DESCRIPTOR_SHELL32_dll
0x14000A560: edputil_NULL_THUNK_DATA_DLN
0x14000C008: "__cdecl _security_cookie" __security_cookie
0x140002AB0: RemoveUserFromAFile
0x140009128: "__cdecl _imp_RegQueryValueExW" __imp_RegQueryValueExW
0x1400091E0: "__cdecl _imp_CertAddCertificateContextToStore" __imp_CertAddCertificateContextToStore
0x140009138: "__cdecl _imp_RemoveUsersFromEncryptedFile" __imp_RemoveUsersFromEncryptedFile
0x140009158: "__cdecl _imp_AddUsersToEncryptedFileEx" __imp_AddUsersToEncryptedFileEx
0x140009330: "__cdecl _imp_GetFullPathNameW" __imp_GetFullPathNameW
0x140009308: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x1400097F8: "%s [%s]" ??_C@_1BA@LEKOOGDK@?$AA?$CF?$AAs?$AA?5?$AA?$FL?$AA?$CF?$AAs?$AA?$FN?$AA?$AA@
0x140009428: "__cdecl _imp_LocalFree" __imp_LocalFree
0x14000C000: "__cdecl _defaultmatherr" __defaultmatherr
0x1400058FC: FreeEncryptionCertificateList
0x1400098E0: "Microsoft Software Key Storage P" ??_C@_1FA@OAAKELHB@?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?5?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?5?$AAK?$AAe?$AAy?$AA?5?$AAS?$AAt?$AAo?$AAr?$AAa?$AAg?$AAe?$AA?5?$AAP@
0x1400092E8: "__cdecl _imp_GetFileAttributesW" __imp_GetFileAttributesW
0x140009240: "__cdecl _imp_DsRoleFreeMemory" __imp_DsRoleFreeMemory
0x140004078: PromptUserYesNo
0x14000C620: "__cdecl _onexitbegin" __onexitbegin
0x140005A4C: DsCrackNameAutoChaseW
0x1400091F0: "__cdecl _imp_CryptQueryObject" __imp_CryptQueryObject
0x1400095F0: "__cdecl _imp__vsnwprintf" __imp__vsnwprintf
0x1400093B0: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x140009300: "__cdecl _imp_ReadConsoleW" __imp_ReadConsoleW
0x140009BD0: "/REKEY" ??_C@_1O@IAAAEHCN@?$AA?1?$AAR?$AAE?$AAK?$AAE?$AAY?$AA?$AA@
0x140004320: GenerateCertFiles
0x14000A5EC: "__cdecl _IMPORT_DESCRIPTOR_KERNEL32" __IMPORT_DESCRIPTOR_KERNEL32
0x140004158: MakeRecoveryPolicyBlob
0x140010020: "__cdecl _imp_EdpConvertProtectorToExternalId" __imp_EdpConvertProtectorToExternalId
0x140009140: "__cdecl _imp_RegOpenKeyExW" __imp_RegOpenKeyExW
0x140008074: "__cdecl _security_init_cookie" __security_init_cookie
0x140009578: "__cdecl _imp__cexit" __imp__cexit
0x140001CB0: QueryFileInfo
0x140007F28: "__cdecl get_image_app_type" _get_image_app_type
0x14000A600: "__cdecl _IMPORT_DESCRIPTOR_msvcrt" __IMPORT_DESCRIPTOR_msvcrt
0x14000838D: wcscmp
0x140009C68: "ECDH_P384" ??_C@_1BE@FNCFBHFO@?$AAE?$AAC?$AAD?$AAH?$AA_?$AAP?$AA3?$AA8?$AA4?$AA?$AA@
0x1400081A8: "__cdecl _tailMerge_shell32_dll" __tailMerge_shell32_dll
0x1400097A8: "3DES" ??_C@_19LEELFJDG@?$AA3?$AAD?$AAE?$AAS?$AA?$AA@
0x140009B04: "/q" ??_C@_15GLEECOEG@?$AA?1?$AAq?$AA?$AA@
0x140007B50: wmainCRTStartup
0x1400094C0: "__cdecl _imp_UuidToStringW" __imp_UuidToStringW
0x140002340: EncryptAFile
0x1400091C8: ADVAPI32_NULL_THUNK_DATA
0x140009C38: "/w" ??_C@_15EOCPHBJK@?$AA?1?$AAw?$AA?$AA@
0x140009460: "__cdecl _imp_WriteFile" __imp_WriteFile
0x14000A628: "__cdecl _IMPORT_DESCRIPTOR_RPCRT4" __IMPORT_DESCRIPTOR_RPCRT4
0x140009B78: "/CERTHASH" ??_C@_1BE@NHJNCDFJ@?$AA?1?$AAC?$AAE?$AAR?$AAT?$AAH?$AAA?$AAS?$AAH?$AA?$AA@
0x1400094D8: RPCRT4_NULL_THUNK_DATA
0x1400011EC: WriteString
0x140007BE0: "__cdecl _report_gsfailure" __report_gsfailure
0x140005494: CheckMinVersion
0x1400015D0: IsNtldr
0x140009734: ": " ??_C@_15ELOONFKJ@?$AA?3?$AA?5?$AA?$AA@
0x140009778: "%I64u" ??_C@_1M@OGLPPGPN@?$AA?$CF?$AAI?$AA6?$AA4?$AAu?$AA?$AA@
0x140002494: DoAction
0x14000C630: "__cdecl _native_startup_state" __native_startup_state
0x140003214: CipherDisplayCrntEfsHash
0x140009220: "__cdecl _imp_CertGetCertificateContextProperty" __imp_CertGetCertificateContextProperty
0x14000A650: "__cdecl _IMPORT_DESCRIPTOR_NTDSAPI" __IMPORT_DESCRIPTOR_NTDSAPI
0x140009338: "__cdecl _imp_FindVolumeClose" __imp_FindVolumeClose
0x140009C30: "/p" ??_C@_15NDPIEJCD@?$AA?1?$AAp?$AA?$AA@
0x1400094B0: "__cdecl _imp_DsBindW" __imp_DsBindW
0x140009558: "__cdecl _imp__fmode" __imp__fmode
0x1400094C8: "__cdecl _imp_UuidCreate" __imp_UuidCreate
0x14000A5B0: SHELL32_NULL_THUNK_DATA_DLB
0x140010000: "__cdecl _imp_ILCreateFromPathW" __imp_ILCreateFromPathW
0x14000C604: DoSubdirectories
0x140005970: BuildCertListFromCertContext
0x140007FE0: "__cdecl IsNonwritableInCurrentImage" _IsNonwritableInCurrentImage
0x140009BB8: "/ADDUSER" ??_C@_1BC@GCLOFKDL@?$AA?1?$AAA?$AAD?$AAD?$AAU?$AAS?$AAE?$AAR?$AA?$AA@
0x140009ADC: "/e" ??_C@_15LEDPOOIO@?$AA?1?$AAe?$AA?$AA@
0x140005540: GetKeyProvInfo
0x140008375: memset
0x14000A6C8: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR

[JEB Decompiler by PNF Software]