Generated by JEB on 2019/08/01

PE: C:\Windows\System32\userinit.exe Base=0x140000000 SHA-256=1FE7F7C59EC7EAA276739FA85F7DDA6136D81184E0AEB385B6AC9FEAAA8C4394
PDB: userinit.pdb GUID={50551850-49ED-53EB-9F5662FC9D9A5A5E} Age=1

471 located named symbols:
0x140003FA8: IsCreateExplorerSessionKeyPresent
0x1400067D8: "PATH" ??_C@_19IJOJOJIB@?$AAP?$AAA?$AAT?$AAH?$AA?$AA@
0x140006488: "__cdecl _imp_UnregisterTraceGuids" __imp_UnregisterTraceGuids
0x140006B7C: "1" ??_C@_13JGCMLPCH@?$AA1?$AA?$AA@
0x140004C94: "__cdecl _raise_securityfailure" __raise_securityfailure
0x1400028CC: RunLogonScript
0x1400061F0: api-ms-win-core-file-l1-1-0_NULL_THUNK_DATA
0x140004928: "void __cdecl __scrt_initialize_type_info(void)" ?__scrt_initialize_type_info@@YAXXZ
0x140003FA8: IsPerformXForestLogonCheckPresent
0x140001708: PrependToPath
0x140001090: StringCchCatW
0x140006590: "__cdecl _sz_WLDAP32_dll" __sz_WLDAP32_dll
0x140003934: RunLogonScriptSync
0x140003D70: "__cdecl _delayLoadHelper2" __delayLoadHelper2
0x1400079F8: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x140004910: "__cdecl get_startup_commit_mode" _get_startup_commit_mode
0x140007B4C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-crt-private-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-crt-private-l1-1-0
0x140006E08: "AlternateShell" ??_C@_1BO@JHCAMFBN@?$AAA?$AAl?$AAt?$AAe?$AAr?$AAn?$AAa?$AAt?$AAe?$AAS?$AAh?$AAe?$AAl?$AAl?$AA?$AA@
0x140009090: "__cdecl _scrt_current_native_startup_state" __scrt_current_native_startup_state
0x140009018: "__cdecl _security_cookie_complement" __security_cookie_complement
0x14000507A: "__cdecl o__configthreadlocale" _o__configthreadlocale
0x1400068C0: "ShellExecuteExW" ??_C@_0BA@LIPPODFA@ShellExecuteExW?$AA@
0x140004990: "__cdecl _scrt_get_dyn_tls_dtor_callback" __scrt_get_dyn_tls_dtor_callback
0x1400027D8: RunScriptHidden
0x14000B020: "__cdecl _imp_ldap_set_optionW" __imp_ldap_set_optionW
0x1400062B8: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x140005086: "__cdecl configure_narrow_argv" _configure_narrow_argv
0x14000348C: WinMain
0x14000503E: "__cdecl c_exit" _c_exit
0x140001500: WppControlCallback
0x140005200: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x140005116: exit
0x1400063E0: "__cdecl _imp__seh_filter_exe" __imp__seh_filter_exe
0x140006528: "__cdecl _xp_a" __xp_a
0x1400063C0: "__cdecl _imp__o__initialize_narrow_environment" __imp__o__initialize_narrow_environment
0x140004C00: "__cdecl RTC_Initialize" _RTC_Initialize
0x1400063A8: "__cdecl _imp__crt_atexit" __imp__crt_atexit
0x140006F58: "__cdecl _pfnDliFailureHook2" __pfnDliFailureHook2
0x140006418: "__cdecl _imp_terminate" __imp_terminate
0x1400019F0: ExecApplication
0x140007330: "__cdecl _rtc_taa" __rtc_taa
0x140006818: "shell32.dll" ??_C@_1BI@BNFKGMFK@?$AAs?$AAh?$AAe?$AAl?$AAl?$AA3?$AA2?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x140006310: "__cdecl _imp_RegEnumValueW" __imp_RegEnumValueW
0x140007A0C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-1-0
0x140004910: "__cdecl get_startup_thread_locale_mode" _get_startup_thread_locale_mode
0x140007A70: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-eventing-classicprovider-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-eventing-classicprovider-l1-1-0
0x140006448: "__cdecl _imp__initterm_e" __imp__initterm_e
0x140006228: api-ms-win-core-heap-l2-1-0_NULL_THUNK_DATA
0x140006458: api-ms-win-crt-runtime-l1-1-0_NULL_THUNK_DATA
0x140006CC8: "\repl\import\scripts" ??_C@_1CK@MCCEBMMI@?$AA?2?$AAr?$AAe?$AAp?$AAl?$AA?2?$AAi?$AAm?$AAp?$AAo?$AAr?$AAt?$AA?2?$AAs?$AAc?$AAr?$AAi?$AAp?$AAt?$AAs?$AA?$AA@
0x140005010: "__cdecl _scrt_is_ucrt_dll_in_use" __scrt_is_ucrt_dll_in_use
0x14000493C: "__cdecl _vcrt_initialize" __vcrt_initialize
0x1400063C8: "__cdecl _imp__initialize_onexit_table" __imp__initialize_onexit_table
0x14000248C: SearchAndAllocPath
0x1400050DA: "__cdecl o__seh_filter_exe" _o__seh_filter_exe
0x140006208: "__cdecl _imp_HeapSetInformation" __imp_HeapSetInformation
0x140006F30: WPP_ThisDir_CTLGUID_Userinit
0x1400064D8: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x14000B070: "__cdecl _imp_IsTSAppCompatOn" __imp_IsTSAppCompatOn
0x140007320: "__cdecl _rtc_iaa" __rtc_iaa
0x14000181C: UpdateUserEnvironment
0x140003F95: "__cdecl _imp_load_ldap_initW" __imp_load_ldap_initW
0x1400064E0: "__cdecl _xc_a" __xc_a
0x140006298: "__cdecl _imp_CreateProcessW" __imp_CreateProcessW
0x140006B68: "vmapplet" ??_C@_1BC@JHAKKBEE@?$AAv?$AAm?$AAa?$AAp?$AAp?$AAl?$AAe?$AAt?$AA?$AA@
0x1400062D8: "__cdecl _imp_GetStartupInfoW" __imp_GetStartupInfoW
0x1400063A0: "__cdecl _imp__o__configure_narrow_argv" __imp__o__configure_narrow_argv
0x140009030: "__cdecl _scrt_ucrt_dll_is_in_use" __scrt_ucrt_dll_is_in_use
0x140001008: StringCchCopyW
0x140003150: AddToMessageAlias
0x140003AE4: RegValChoice_GetAndCompareRegValues
0x140006210: api-ms-win-core-heap-l1-1-0_NULL_THUNK_DATA
0x140009028: "__cdecl _memcpy_nt_iters" __memcpy_nt_iters
0x140003E37: "__cdecl _imp_load_ldap_unbind_s" __imp_load_ldap_unbind_s
0x140003FA8: IsIsTSAppCompatOnPresent
0x140006588: "__cdecl _guard_iat_table" __guard_iat_table
0x140006290: api-ms-win-core-processenvironment-l1-1-0_NULL_THUNK_DATA
0x140006240: "__cdecl _imp_LoadLibraryExW" __imp_LoadLibraryExW
0x140003FFC: "__cdecl _imp_load_SetupHotKeyForKeyboardLayout" __imp_load_SetupHotKeyForKeyboardLayout
0x140006460: "__cdecl _imp_memset" __imp_memset
0x14000493C: "__cdecl _acrt_initialize" __acrt_initialize
0x140006BB0: "HideLegacyLogonScripts" ??_C@_1CO@FOJLPNCG@?$AAH?$AAi?$AAd?$AAe?$AAL?$AAe?$AAg?$AAa?$AAc?$AAy?$AAL?$AAo?$AAg?$AAo?$AAn?$AAS?$AAc?$AAr?$AAi?$AAp?$AAt?$AAs?$AA?$AA@
0x140005026: "__cdecl initterm" _initterm
0x140006490: "__cdecl _imp_TraceMessage" __imp_TraceMessage
0x1400065B0: "__cdecl _sz_netutils_dll" __sz_netutils_dll
0x1400063B8: "__cdecl _imp__get_narrow_winmain_command_line" __imp__get_narrow_winmain_command_line
0x1400050C2: "__cdecl o__initialize_onexit_table" _o__initialize_onexit_table
0x140007AC0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0
0x140009690: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x140006360: "__cdecl _imp_Sleep" __imp_Sleep
0x140006520: "__cdecl _xi_z" __xi_z
0x14000509E: "__cdecl exit" _exit
0x1400061B8: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x14000512E: "__cdecl _C_specific_handler" __C_specific_handler
0x140002020: ExecProcesses
0x140006EC0: "EnableProfileQuota" ??_C@_1CG@HKEPCJLE@?$AAE?$AAn?$AAa?$AAb?$AAl?$AAe?$AAP?$AAr?$AAo?$AAf?$AAi?$AAl?$AAe?$AAQ?$AAu?$AAo?$AAt?$AAa?$AA?$AA@
0x140006410: "__cdecl _imp__o_exit" __imp__o_exit
0x14000B0C0: netutils_NULL_THUNK_DATA_DLA
0x140006868: "explorer.exe" ??_C@_1BK@BPIGMGKF@?$AAe?$AAx?$AAp?$AAl?$AAo?$AAr?$AAe?$AAr?$AA?4?$AAe?$AAx?$AAe?$AA?$AA@
0x140007978: netutils_NULL_THUNK_DATA_DLB
0x1400077B0: netutils_NULL_THUNK_DATA_DLN
0x1400051DD: memmove
0x1400063F0: "__cdecl _imp__set_fmode" __imp__set_fmode
0x1400096C8: WPP_REGISTRATION_GUIDS
0x140006BE0: "\\" ??_C@_15LEKKCGMK@?$AA?2?$AA?2?$AA?$AA@
0x1400025DC: ExecScript
0x1400047A4: "__cdecl _scrt_uninitialize_crt" __scrt_uninitialize_crt
0x140006408: "__cdecl _imp__wtoi" __imp__wtoi
0x140006200: api-ms-win-core-handle-l1-1-0_NULL_THUNK_DATA
0x140004B44: "__cdecl _scrt_initialize_mta" __scrt_initialize_mta
0x140006318: "__cdecl _imp_RegCloseKey" __imp_RegCloseKey
0x14000B018: "__cdecl _imp_ldap_connect" __imp_ldap_connect
0x140005170: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x1400046D8: "__cdecl _scrt_is_nonwritable_in_current_image" __scrt_is_nonwritable_in_current_image
0x14000506E: "__cdecl cexit" _cexit
0x1400045A8: "__cdecl _scrt_initialize_crt" __scrt_initialize_crt
0x14000493C: "__cdecl _acrt_uninitialize" __acrt_uninitialize
0x140006468: api-ms-win-crt-string-l1-1-0_NULL_THUNK_DATA
0x140005122: terminate
0x140003FA8: IsDisplayMessageAndExitWindowsPresent
0x1400096A0: WPP_MAIN_CB
0x140006288: "__cdecl _imp_SetEnvironmentVariableW" __imp_SetEnvironmentVariableW
0x14000507A: "__cdecl configthreadlocale" _configthreadlocale
0x140004BA8: "__cdecl _scrt_set_unhandled_exception_filter" __scrt_set_unhandled_exception_filter
0x140006F50: "__cdecl _DefaultResolveDelayLoadedAPIFlags" __DefaultResolveDelayLoadedAPIFlags
0x1400067B8: ".bat" ??_C@_19PINKOIBI@?$AA?4?$AAb?$AAa?$AAt?$AA?$AA@
0x1400050AA: "__cdecl get_narrow_winmain_command_line" _get_narrow_winmain_command_line
0x140007780: ext-ms-win-session-userinit-l1-1-0_NULL_THUNK_DATA_DLN
0x14000B090: ext-ms-win-session-userinit-l1-1-0_NULL_THUNK_DATA_DLA
0x140007990: ext-ms-win-session-userinit-l1-1-0_NULL_THUNK_DATA_DLB
0x140005062: "__cdecl o___p__commode" _o___p__commode
0x140004950: "__cdecl initialize_denormal_control" _initialize_denormal_control
0x140006410: "__cdecl _imp_exit" __imp_exit
0x14000413B: "__cdecl _imp_load_WinStationIsBoundToCacheTerminal" __imp_load_WinStationIsBoundToCacheTerminal
0x14000B008: "__cdecl _imp_ldap_get_optionW" __imp_ldap_get_optionW
0x140004830: atexit
0x140006A60: "Software\Microsoft\Windows NT\Cu" ??_C@_1GM@NFOGLLJA@?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAN?$AAT?$AA?2?$AAC?$AAu@
0x1400050B6: "__cdecl o__initialize_narrow_environment" _o__initialize_narrow_environment
0x14000504A: "__cdecl register_thread_local_exe_atexit_callback" _register_thread_local_exe_atexit_callback
0x140009048: "__cdecl _hmod__logoncli_dll" __hmod__logoncli_dll
0x140006330: api-ms-win-core-registry-l1-1-0_NULL_THUNK_DATA
0x140006498: "__cdecl _imp_GetTraceLoggerHandle" __imp_GetTraceLoggerHandle
0x14000493C: "__cdecl _scrt_stub_for_acrt_initialize" __scrt_stub_for_acrt_initialize
0x1400061D8: api-ms-win-core-errorhandling-l1-1-0_NULL_THUNK_DATA
0x140006478: "__cdecl _imp_GetTraceEnableLevel" __imp_GetTraceEnableLevel
0x140003FA8: IsSetupHotKeyForKeyboardLayoutPresent
0x1400065C0: "ext-ms-win-session-userinit-l1-1" ??_C@_1EG@HBLDJLHL@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAs?$AAe?$AAs?$AAs?$AAi?$AAo?$AAn?$AA?9?$AAu?$AAs?$AAe?$AAr?$AAi?$AAn?$AAi?$AAt?$AA?9?$AAl?$AA1?$AA?9?$AA1@
0x140006538: "__cdecl _xt_a" __xt_a
0x1400090F0: "__cdecl _scrt_debugger_hook_flag" __scrt_debugger_hook_flag
0x1400062C0: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x1400067E4: ";" ??_C@_13PJJBFPED@?$AA?$DL?$AA?$AA@
0x140004C50: "__cdecl RTC_Terminate" _RTC_Terminate
0x140006400: "__cdecl _imp__wcsicmp" __imp__wcsicmp
0x140007AAC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-string-l2-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-string-l2-1-0
0x140006420: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x1400064A8: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x140006268: api-ms-win-core-libraryloader-l1-2-0_NULL_THUNK_DATA
0x1400050AA: "__cdecl o__get_narrow_winmain_command_line" _o__get_narrow_winmain_command_line
0x14000B030: WLDAP32_NULL_THUNK_DATA_DLA
0x140006760: "ext-ms-win-session-winsta-l1-1-3" ??_C@_1EC@GMNGGCEH@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAs?$AAe?$AAs?$AAs?$AAi?$AAo?$AAn?$AA?9?$AAw?$AAi?$AAn?$AAs?$AAt?$AAa?$AA?9?$AAl?$AA1?$AA?9?$AA1?$AA?9?$AA3@
0x1400061D0: "__cdecl _imp_GetLastError" __imp_GetLastError
0x14000514C: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x140004008: "__cdecl _tailMerge_ext_ms_win_session_userinit_l1_1_0_dll" __tailMerge_ext_ms_win_session_userinit_l1_1_0_dll
0x140006CF8: "ShellReadyEvent" ??_C@_1CA@HICAHBAK@?$AAS?$AAh?$AAe?$AAl?$AAl?$AAR?$AAe?$AAa?$AAd?$AAy?$AAE?$AAv?$AAe?$AAn?$AAt?$AA?$AA@
0x1400050B6: "__cdecl initialize_narrow_environment" _initialize_narrow_environment
0x140006428: "__cdecl _imp_memcmp" __imp_memcmp
0x14000491C: "__cdecl get_startup_file_mode" _get_startup_file_mode
0x140009024: "__cdecl _isa_enabled" __isa_enabled
0x1400067A8: "NULL" ??_C@_19CIJIHAKK@?$AAN?$AAU?$AAL?$AAL?$AA?$AA@
0x140007BC4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-0
0x1400062C8: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x140006348: "__cdecl _imp_WaitForSingleObject" __imp_WaitForSingleObject
0x140009068: "__cdecl _hmod__ext_ms_win_session_winsta_l1_1_3_dll" __hmod__ext_ms_win_session_winsta_l1_1_3_dll
0x140006610: "__cdecl _sz_ext_ms_win_session_userinit_l1_1_0_dll" __sz_ext_ms_win_session_userinit_l1_1_0_dll
0x140003DAC: "__cdecl _imp_load_ldap_bind_sW" __imp_load_ldap_bind_sW
0x1400050C2: "__cdecl initialize_onexit_table" _initialize_onexit_table
0x140006F50: "__cdecl _ResolveDelayLoadedAPIFlags" __ResolveDelayLoadedAPIFlags
0x140004910: "__cdecl _scrt_stub_for_initialize_mta" __scrt_stub_for_initialize_mta
0x140009098: "__cdecl _scrt_native_startup_lock" __scrt_native_startup_lock
0x140003FA8: IsLoadRemoteFontsAndInitMiscWorkerPresent
0x140006280: "__cdecl _imp_GetEnvironmentVariableW" __imp_GetEnvironmentVariableW
0x14000510A: "__cdecl wtoi" _wtoi
0x14000762C: "__cdecl _DELAY_IMPORT_DESCRIPTOR_WLDAP32_dll" __DELAY_IMPORT_DESCRIPTOR_WLDAP32_dll
0x14000493C: "__cdecl _vcrt_uninitialize" __vcrt_uninitialize
0x1400062E8: "__cdecl _imp_IsProcessorFeaturePresent" __imp_IsProcessorFeaturePresent
0x140006510: "__cdecl _PLEASE_LINK_WITH_legacy_stdio_wide_specifiers.lib" __PLEASE_LINK_WITH_legacy_stdio_wide_specifiers.lib
0x140007938: WLDAP32_NULL_THUNK_DATA_DLB
0x140007B10: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0
0x1400067A4: "\" ??_C@_13FPGAJAPJ@?$AA?2?$AA?$AA@
0x140003DB8: "__cdecl _tailMerge_wldap32_dll" __tailMerge_wldap32_dll
0x140001168: WPP_SF_
0x140006260: "__cdecl _imp_FreeLibrary" __imp_FreeLibrary
0x140007790: ext-ms-win-session-winsta-l1-1-3_NULL_THUNK_DATA_DLN
0x1400076CC: "__cdecl _NULL_DELAY_IMPORT_DESCRIPTOR" __NULL_DELAY_IMPORT_DESCRIPTOR
0x140006F40: WPP_3e8d26f89e183ad4e46f0c4aab2c9d6f_Traceguids
0x1400079F0: ext-ms-win-session-winsta-l1-1-3_NULL_THUNK_DATA_DLB
0x14000B0A0: ext-ms-win-session-winsta-l1-1-3_NULL_THUNK_DATA_DLA
0x140006340: api-ms-win-core-string-l2-1-0_NULL_THUNK_DATA
0x14000B068: "__cdecl _imp_IsSubDesktopSession" __imp_IsSubDesktopSession
0x1400066C0: "ext-ms-win-session-winsta-l1-1-1" ??_C@_1EC@MGNPKKMM@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAs?$AAe?$AAs?$AAs?$AAi?$AAo?$AAn?$AA?9?$AAw?$AAi?$AAn?$AAs?$AAt?$AAa?$AA?9?$AAl?$AA1?$AA?9?$AA1?$AA?9?$AA1@
0x140006440: "__cdecl _imp__initterm" __imp__initterm
0x140007B88: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-debug-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-debug-l1-1-0
0x1400061C0: "__cdecl _imp_SetLastError" __imp_SetLastError
0x140007BB0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-1" __IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-1
0x140009050: "__cdecl _hmod__netutils_dll" __hmod__netutils_dll
0x140003FA8: IsProcessTermSrvIniFilesPresent
0x140006E40: "UserInitLogonServer" ??_C@_1CI@KBECCHCH@?$AAU?$AAs?$AAe?$AAr?$AAI?$AAn?$AAi?$AAt?$AAL?$AAo?$AAg?$AAo?$AAn?$AAS?$AAe?$AAr?$AAv?$AAe?$AAr?$AA?$AA@
0x140007A34: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0
0x14000B098: "__cdecl _imp_WinStationIsBoundToCacheTerminal" __imp_WinStationIsBoundToCacheTerminal
0x140004087: "__cdecl _imp_load_IsSubDesktopSession" __imp_load_IsSubDesktopSession
0x140006D20: "system\currentcontrolset\control" ??_C@_1GC@GAJBLHJJ@?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAc?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAc?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAs?$AAe?$AAt?$AA?2?$AAc?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl@
0x1400063A8: "__cdecl _imp__o__crt_atexit" __imp__o__crt_atexit
0x140005086: "__cdecl o__configure_narrow_argv" _o__configure_narrow_argv
0x14000495C: "__cdecl _scrt_initialize_default_local_stdio_options" __scrt_initialize_default_local_stdio_options
0x1400062A0: "__cdecl _imp_CreateThread" __imp_CreateThread
0x140003FA8: IsIsSubDesktopSessionPresent
0x1400063B0: "__cdecl _imp__exit" __imp__exit
0x1400045F8: "__cdecl _scrt_initialize_onexit_tables" __scrt_initialize_onexit_tables
0x1400064D0: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x14000B088: "__cdecl _imp_ProcessTermSrvIniFiles" __imp_ProcessTermSrvIniFiles
0x1400049A0: "__cdecl _crt_debugger_hook" __crt_debugger_hook
0x1400062D0: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x14000493C: "__cdecl should_initialize_environment" _should_initialize_environment
0x140003F16: "__cdecl _tailMerge_netutils_dll" __tailMerge_netutils_dll
0x1400061E8: "__cdecl _imp_GetFileAttributesExW" __imp_GetFileAttributesExW
0x140006850: "explorer" ??_C@_1BC@KHABBIHB@?$AAe?$AAx?$AAp?$AAl?$AAo?$AAr?$AAe?$AAr?$AA?$AA@
0x1400065A0: "__cdecl _sz_logoncli_dll" __sz_logoncli_dll
0x140003E5B: "__cdecl _imp_load_DsGetDcNameW" __imp_load_DsGetDcNameW
0x1400050CE: "__cdecl register_onexit_function" _register_onexit_function
0x140004910: "__cdecl _scrt_exe_initialize_mta" __scrt_exe_initialize_mta
0x140006188: "__cdecl _imp_IsDebuggerPresent" __imp_IsDebuggerPresent
0x140006380: api-ms-win-core-sysinfo-l1-1-0_NULL_THUNK_DATA
0x140006670: "ext-ms-win-session-winsta-l1-1-0" ??_C@_1EC@HOGDMNKJ@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAs?$AAe?$AAs?$AAs?$AAi?$AAo?$AAn?$AA?9?$AAw?$AAi?$AAn?$AAs?$AAt?$AAa?$AA?9?$AAl?$AA1?$AA?9?$AA1?$AA?9?$AA0@
0x1400064F8: "__cdecl _xi_a" __xi_a
0x1400062F0: api-ms-win-core-processthreads-l1-1-1_NULL_THUNK_DATA
0x140006190: api-ms-win-core-debug-l1-1-0_NULL_THUNK_DATA
0x1400061A8: "__cdecl _imp_ResolveDelayLoadedAPI" __imp_ResolveDelayLoadedAPI
0x14000B048: "__cdecl _imp_SetShellDesktopSwitchEvent" __imp_SetShellDesktopSwitchEvent
0x140004568: "__cdecl _scrt_acquire_startup_lock" __scrt_acquire_startup_lock
0x140009040: "__cdecl _hmod__WLDAP32_dll" __hmod__WLDAP32_dll
0x140006D88: "UseAlternateShell" ??_C@_1CE@NIBHOEBE@?$AAU?$AAs?$AAe?$AAA?$AAl?$AAt?$AAe?$AAr?$AAn?$AAa?$AAt?$AAe?$AAS?$AAh?$AAe?$AAl?$AAl?$AA?$AA@
0x1400076AC: "__cdecl _DELAY_IMPORT_DESCRIPTOR_ext_ms_win_session_winsta_l1_1_3_dll" __DELAY_IMPORT_DESCRIPTOR_ext_ms_win_session_winsta_l1_1_3_dll
0x140005092: "__cdecl o__crt_atexit" _o__crt_atexit
0x14000B0B0: logoncli_NULL_THUNK_DATA_DLA
0x140007958: logoncli_NULL_THUNK_DATA_DLB
0x140004910: "__cdecl get_startup_new_mode" _get_startup_new_mode
0x1400077A0: logoncli_NULL_THUNK_DATA_DLN
0x140004B50: "__cdecl _scrt_is_managed_app" __scrt_is_managed_app
0x14000B0B8: "__cdecl _imp_NetApiBufferFree" __imp_NetApiBufferFree
0x140003FA8: IsUserinitExtPresent
0x140004BC0: "__cdecl _scrt_unhandled_exception_filter" __scrt_unhandled_exception_filter
0x14000506E: "__cdecl o__cexit" _o__cexit
0x140006C00: "SOFTWARE\Policies\Microsoft\Wind" ??_C@_1FG@ILACPNMM@?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAP?$AAo?$AAl?$AAi?$AAc?$AAi?$AAe?$AAs?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd@
0x140006450: "__cdecl _imp__register_thread_local_exe_atexit_callback" __imp__register_thread_local_exe_atexit_callback
0x140009000: WPP_GLOBAL_Control
0x140005122: "__cdecl o_terminate" _o_terminate
0x1400064C0: "__cdecl _imp_RtlGetActiveConsoleId" __imp_RtlGetActiveConsoleId
0x140007A5C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0
0x140007B9C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-1" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-1
0x140006388: "__cdecl _imp__o___p__commode" __imp__o___p__commode
0x140003FA8: IsSetShellDesktopSwitchEventPresent
0x14000145C: WPP_SF_d
0x140004147: "__cdecl _tailMerge_ext_ms_win_session_winsta_l1_1_3_dll" __tailMerge_ext_ms_win_session_winsta_l1_1_3_dll
0x140004950: "__cdecl initialize_invalid_parameter_handler" _initialize_invalid_parameter_handler
0x140004129: "__cdecl _imp_load_ImmWorker" __imp_load_ImmWorker
0x140004E50: "__cdecl _isa_available_init" __isa_available_init
0x140004904: "__cdecl get_startup_argv_mode" _get_startup_argv_mode
0x140007AFC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-l1-1-0
0x140007328: "__cdecl _rtc_izz" __rtc_izz
0x14000766C: "__cdecl _DELAY_IMPORT_DESCRIPTOR_netutils_dll" __DELAY_IMPORT_DESCRIPTOR_netutils_dll
0x140004540: "__cdecl _security_check_cookie" __security_check_cookie
0x1400064F0: "__cdecl _xc_z" __xc_z
0x140007A98: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0
0x1400062E0: api-ms-win-core-processthreads-l1-1-0_NULL_THUNK_DATA
0x140006258: "__cdecl _imp_GetProcAddress" __imp_GetProcAddress
0x14000B010: "__cdecl _imp_ldap_unbind_s" __imp_ldap_unbind_s
0x140009060: "__cdecl _hmod__ext_ms_win_session_userinit_l1_1_0_dll" __hmod__ext_ms_win_session_userinit_l1_1_0_dll
0x140003F0A: "__cdecl _imp_load_NetApiBufferFree" __imp_load_NetApiBufferFree
0x140003C34: RegValChoice_GetHighestValue
0x140006378: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x140006220: "__cdecl _imp_LocalAlloc" __imp_LocalAlloc
0x140006E68: "UserInitLogonScript" ??_C@_1CI@JNJEGNLE@?$AAU?$AAs?$AAe?$AAr?$AAI?$AAn?$AAi?$AAt?$AAL?$AAo?$AAg?$AAo?$AAn?$AAS?$AAc?$AAr?$AAi?$AAp?$AAt?$AA?$AA@
0x140006198: "__cdecl _imp_DelayLoadFailureHook" __imp_DelayLoadFailureHook
0x1400063E8: "__cdecl _imp__set_app_type" __imp__set_app_type
0x140006BE8: "\NETLOGON" ??_C@_1BE@MDEHKFDG@?$AA?2?$AAN?$AAE?$AAT?$AAL?$AAO?$AAG?$AAO?$AAN?$AA?$AA@
0x140004117: "__cdecl _imp_load_SetShellDesktopSwitchEvent" __imp_load_SetShellDesktopSwitchEvent
0x140004099: "__cdecl _imp_load_IsTSAppCompatOn" __imp_load_IsTSAppCompatOn
0x14000764C: "__cdecl _DELAY_IMPORT_DESCRIPTOR_logoncli_dll" __DELAY_IMPORT_DESCRIPTOR_logoncli_dll
0x1400069B0: "DefaultShell" ??_C@_1BK@KLBNBNNL@?$AAD?$AAe?$AAf?$AAa?$AAu?$AAl?$AAt?$AAS?$AAh?$AAe?$AAl?$AAl?$AA?$AA@
0x140006530: "__cdecl _xp_z" __xp_z
0x140006C60: "Allow-LogonScript-NetbiosDisable" ??_C@_1EE@BBEHODA@?$AAA?$AAl?$AAl?$AAo?$AAw?$AA?9?$AAL?$AAo?$AAg?$AAo?$AAn?$AAS?$AAc?$AAr?$AAi?$AAp?$AAt?$AA?9?$AAN?$AAe?$AAt?$AAb?$AAi?$AAo?$AAs?$AAD?$AAi?$AAs?$AAa?$AAb?$AAl?$AAe@
0x1400063E8: "__cdecl _imp__o__set_app_type" __imp__o__set_app_type
0x140003E67: "__cdecl _tailMerge_logoncli_dll" __tailMerge_logoncli_dll
0x1400063F0: "__cdecl _imp__o__set_fmode" __imp__o__set_fmode
0x140007BD8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-apiquery-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-apiquery-l1-1-0
0x140006300: api-ms-win-core-profile-l1-1-0_NULL_THUNK_DATA
0x140007338: "__cdecl _rtc_tzz" __rtc_tzz
0x14000B000: "__cdecl _imp_ldap_bind_sW" __imp_ldap_bind_sW
0x14000B038: "__cdecl _imp_CreateExplorerSessionKey" __imp_CreateExplorerSessionKey
0x140006548: "__cdecl _guard_fids_table" __guard_fids_table
0x140006830: "RegenerateUserEnvironment" ??_C@_0BK@IDEBKBOG@RegenerateUserEnvironment?$AA@
0x140006338: "__cdecl _imp_CharNextW" __imp_CharNextW
0x140003E49: "__cdecl _imp_load_ldap_connect" __imp_load_ldap_connect
0x140006070: "__cdecl load_config_used" _load_config_used
0x1400040CF: "__cdecl _imp_load_PerformXForestLogonCheck" __imp_load_PerformXForestLogonCheck
0x1400050FE: "__cdecl set_new_mode" _set_new_mode
0x140006E28: "AppSetup" ??_C@_1BC@JMNDBCCD@?$AAA?$AAp?$AAp?$AAS?$AAe?$AAt?$AAu?$AAp?$AA?$AA@
0x1400061B0: api-ms-win-core-delayload-l1-1-1_NULL_THUNK_DATA
0x14000B060: "__cdecl _imp_PerformXForestLogonCheck" __imp_PerformXForestLogonCheck
0x1400061A0: api-ms-win-core-delayload-l1-1-0_NULL_THUNK_DATA
0x14000509E: "__cdecl o__exit" _o__exit
0x140006518: "__cdecl _scrt_stdio_legacy_msvcrt_compatibility" __scrt_stdio_legacy_msvcrt_compatibility
0x140006B80: "SEE_MASK_NOZONECHECKS" ??_C@_1CM@FJNPJAGB@?$AAS?$AAE?$AAE?$AA_?$AAM?$AAA?$AAS?$AAK?$AA_?$AAN?$AAO?$AAZ?$AAO?$AAN?$AAE?$AAC?$AAH?$AAE?$AAC?$AAK?$AAS?$AA?$AA@
0x1400068E0: "runas" ??_C@_1M@CDHIAJCD@?$AAr?$AAu?$AAn?$AAa?$AAs?$AA?$AA@
0x140007720: WLDAP32_NULL_THUNK_DATA_DLN
0x140006398: "__cdecl _imp__configthreadlocale" __imp__configthreadlocale
0x140007A20: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processenvironment-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processenvironment-l1-1-0
0x140006350: "__cdecl _imp_OpenEventW" __imp_OpenEventW
0x14000510A: "__cdecl o__wtoi" _o__wtoi
0x140004980: "__cdecl _scrt_get_dyn_tls_init_callback" __scrt_get_dyn_tls_init_callback
0x140006250: "__cdecl _imp_LoadStringW" __imp_LoadStringW
0x1400063B8: "__cdecl _imp__o__get_narrow_winmain_command_line" __imp__o__get_narrow_winmain_command_line
0x1400064B8: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x1400062F8: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x140009678: g_LastWrite
0x140007B38: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-crt-string-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-crt-string-l1-1-0
0x140005062: "__cdecl _p__commode" __p__commode
0x140006F08: "RunLogonScriptSync" ??_C@_1CG@EDBLOFEH@?$AAR?$AAu?$AAn?$AAL?$AAo?$AAg?$AAo?$AAn?$AAS?$AAc?$AAr?$AAi?$AAp?$AAt?$AAS?$AAy?$AAn?$AAc?$AA?$AA@
0x1400063F8: "__cdecl _imp__o__set_new_mode" __imp__o__set_new_mode
0x140005140: ApiSetQueryApiSetPresence
0x1400063C0: "__cdecl _imp__initialize_narrow_environment" __imp__initialize_narrow_environment
0x140006230: "__cdecl _imp_InitializeSListHead" __imp_InitializeSListHead
0x1400064B0: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x140006328: "__cdecl _imp_RegQueryInfoKeyW" __imp_RegQueryInfoKeyW
0x140006F58: "__cdecl _pfnDefaultDliFailureHook2" __pfnDefaultDliFailureHook2
0x14000B028: "__cdecl _imp_ldap_initW" __imp_ldap_initW
0x1400050CE: "__cdecl o__register_onexit_function" _o__register_onexit_function
0x140009080: "unsigned __int64 `__local_stdio_printf_options'::`2'::_OptionsStorage" ?_OptionsStorage@?1??__local_stdio_printf_options@@9@4_KA
0x140004950: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x140006278: "__cdecl _imp_ExpandEnvironmentStringsW" __imp_ExpandEnvironmentStringsW
0x1400051D1: memcmp
0x140006370: "__cdecl _imp_GetSystemDirectoryW" __imp_GetSystemDirectoryW
0x14000493C: "__cdecl _scrt_stub_for_acrt_uninitialize" __scrt_stub_for_acrt_uninitialize
0x1400040F3: "__cdecl _imp_load_DisplayMessageAndExitWindows" __imp_load_DisplayMessageAndExitWindows
0x140009680: g_pfnShellExecuteEx
0x14000B078: "__cdecl _imp_LoadRemoteFontsAndInitMiscWorker" __imp_LoadRemoteFontsAndInitMiscWorker
0x140007B74: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-interlocked-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-interlocked-l1-1-0
0x140007AE8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0
0x140006248: "__cdecl _imp_GetModuleHandleW" __imp_GetModuleHandleW
0x1400068D0: "open" ??_C@_19BDAJEHDN@?$AAo?$AAp?$AAe?$AAn?$AA?$AA@
0x1400069D0: "Software\Microsoft\Windows NT\Cu" ??_C@_1IM@FJPEAHOM@?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAN?$AAT?$AA?2?$AAC?$AAu@
0x140003EE6: "__cdecl _imp_load_ldap_set_optionW" __imp_load_ldap_set_optionW
0x140003EF8: "__cdecl _imp_load_ldap_get_optionW" __imp_load_ldap_get_optionW
0x14000B0A8: "__cdecl _imp_DsGetDcNameW" __imp_DsGetDcNameW
0x140006E90: "UserInitMprLogonScript" ??_C@_1CO@BJDLBKNK@?$AAU?$AAs?$AAe?$AAr?$AAI?$AAn?$AAi?$AAt?$AAM?$AAp?$AAr?$AAL?$AAo?$AAg?$AAo?$AAn?$AAS?$AAc?$AAr?$AAi?$AAp?$AAt?$AA?$AA@
0x140005032: "__cdecl initterm_e" _initterm_e
0x1400064A0: api-ms-win-eventing-classicprovider-l1-1-0_NULL_THUNK_DATA
0x140004778: "__cdecl _scrt_release_startup_lock" __scrt_release_startup_lock
0x1400050E6: "__cdecl o__set_app_type" _o__set_app_type
0x140006408: "__cdecl _imp__o__wtoi" __imp__o__wtoi
0x1400064C8: ntdll_NULL_THUNK_DATA
0x1400067C8: ".cmd" ??_C@_19BDKLHPGC@?$AA?4?$AAc?$AAm?$AAd?$AA?$AA@
0x1400014A0: WPP_SF_ddd
0x140003FA8: IsProcesRemoteSessionInitialCommandPresent
0x1400050DA: "__cdecl seh_filter_exe" _seh_filter_exe
0x140006398: "__cdecl _imp__o__configthreadlocale" __imp__o__configthreadlocale
0x1400063F8: "__cdecl _imp__set_new_mode" __imp__set_new_mode
0x140006480: "__cdecl _imp_GetTraceEnableFlags" __imp_GetTraceEnableFlags
0x140007A84: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0
0x140005116: "__cdecl o_exit" _o_exit
0x140006470: "__cdecl _imp_RegisterTraceGuidsW" __imp_RegisterTraceGuidsW
0x140006178: "__cdecl _imp_ApiSetQueryApiSetPresence" __imp_ApiSetQueryApiSetPresence
0x140009010: "__cdecl _security_cookie" __security_cookie
0x1400012B8: WPP_SF_SSSd
0x140006308: "__cdecl _imp_RegQueryValueExW" __imp_RegQueryValueExW
0x14000306C: RunMprLogonScripts
0x1400049B0: "__cdecl _scrt_fastfail" __scrt_fastfail
0x1400050FE: "__cdecl o__set_new_mode" _o__set_new_mode
0x1400041C8: IsWinStationIsBoundToCacheTerminalPresent
0x14000B080: "__cdecl _imp_ProcesRemoteSessionInitialCommand" __imp_ProcesRemoteSessionInitialCommand
0x140007B24: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-crt-runtime-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-crt-runtime-l1-1-0
0x1400061F8: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x140006218: "__cdecl _imp_LocalFree" __imp_LocalFree
0x140007A48: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0
0x140006238: api-ms-win-core-interlocked-l1-1-0_NULL_THUNK_DATA
0x140006430: api-ms-win-crt-private-l1-1-0_NULL_THUNK_DATA
0x140006CA8: "USERDNSDOMAIN" ??_C@_1BM@OPCNFIBF@?$AAU?$AAS?$AAE?$AAR?$AAD?$AAN?$AAS?$AAD?$AAO?$AAM?$AAA?$AAI?$AAN?$AA?$AA@
0x1400040BD: "__cdecl _imp_load_ProcesRemoteSessionInitialCommand" __imp_load_ProcesRemoteSessionInitialCommand
0x140009020: "__cdecl _isa_available" __isa_available
0x140001994: GetArgs
0x140004B04: "__cdecl _scrt_get_show_window_mode" __scrt_get_show_window_mode
0x1400061C8: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x140004510: WinMainCRTStartup
0x1400062A8: "__cdecl _imp_GetCurrentThread" __imp_GetCurrentThread
0x140006900: "Software\Microsoft\Windows NT\Cu" ??_C@_1KM@DKDKDFHO@?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAN?$AAT?$AA?2?$AAC?$AAu@
0x140004254: "__cdecl _local_stdio_scanf_options" __local_stdio_scanf_options
0x140006320: "__cdecl _imp_RegOpenKeyExW" __imp_RegOpenKeyExW
0x140006DB0: "system\currentcontrolset\control" ??_C@_1FE@HADKHIBH@?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAc?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAc?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAs?$AAe?$AAt?$AA?2?$AAc?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl@
0x1400063C8: "__cdecl _imp__o__initialize_onexit_table" __imp__o__initialize_onexit_table
0x140009674: "__cdecl _favor" __favor
0x140006388: "__cdecl _imp___p__commode" __imp___p__commode
0x140004850: "__cdecl _security_init_cookie" __security_init_cookie
0x1400040AB: "__cdecl _imp_load_LoadRemoteFontsAndInitMiscWorker" __imp_load_LoadRemoteFontsAndInitMiscWorker
0x140006390: "__cdecl _imp__cexit" __imp__cexit
0x14000B050: "__cdecl _imp_ImmWorker" __imp_ImmWorker
0x1400063D8: "__cdecl _imp__o__register_onexit_function" __imp__o__register_onexit_function
0x140006400: "__cdecl _imp__o__wcsicmp" __imp__o__wcsicmp
0x1400063D0: "__cdecl _imp_memmove" __imp_memmove
0x1400061E0: "__cdecl _imp_CompareFileTime" __imp_CompareFileTime
0x1400050F2: "__cdecl set_fmode" _set_fmode
0x140006540: "__cdecl _xt_z" __xt_z
0x140004105: "__cdecl _imp_load_CreateExplorerSessionKey" __imp_load_CreateExplorerSessionKey
0x140006EE8: "proquota.exe" ??_C@_1BK@DOBKFOK@?$AAp?$AAr?$AAo?$AAq?$AAu?$AAo?$AAt?$AAa?$AA?4?$AAe?$AAx?$AAe?$AA?$AA@
0x1400063D8: "__cdecl _imp__register_onexit_function" __imp__register_onexit_function
0x14000B040: "__cdecl _imp_DisplayMessageAndExitWindows" __imp_DisplayMessageAndExitWindows
0x140004D00: "__cdecl _report_gsfailure" __report_gsfailure
0x140006180: api-ms-win-core-apiquery-l1-1-0_NULL_THUNK_DATA
0x140003FA8: IsImmWorkerPresent
0x140006B48: "ppishell.exe" ??_C@_1BK@IABKEPIC@?$AAp?$AAp?$AAi?$AAs?$AAh?$AAe?$AAl?$AAl?$AA?4?$AAe?$AAx?$AAe?$AA?$AA@
0x140005092: "__cdecl crt_atexit" _crt_atexit
0x1400040E1: "__cdecl _imp_load_ProcessTermSrvIniFiles" __imp_load_ProcessTermSrvIniFiles
0x140004244: "__cdecl _local_stdio_printf_options" __local_stdio_printf_options
0x1400047D8: "__cdecl onexit" _onexit
0x1400031D0: StartTheShell
0x140006270: "__cdecl _imp_SearchPathW" __imp_SearchPathW
0x140006888: "%SystemRoot%\Explorer.EXE" ??_C@_1DE@IDCEOKOE@?$AA?$CF?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAo?$AAo?$AAt?$AA?$CF?$AA?2?$AAE?$AAx?$AAp?$AAl?$AAo?$AAr?$AAe?$AAr?$AA?4?$AAE?$AAX?$AAE?$AA?$AA@
0x140009688: "__cdecl _dyn_tls_dtor_callback" __dyn_tls_dtor_callback
0x1400067E8: "Volatile Environment" ??_C@_1CK@FFBPGAMN@?$AAV?$AAo?$AAl?$AAa?$AAt?$AAi?$AAl?$AAe?$AA?5?$AAE?$AAn?$AAv?$AAi?$AAr?$AAo?$AAn?$AAm?$AAe?$AAn?$AAt?$AA?$AA@
0x140001588: AllocAndGetEnvironmentVariable
0x140006418: "__cdecl _imp__o_terminate" __imp__o_terminate
0x1400090E0: "struct __type_info_node __type_info_root_node" ?__type_info_root_node@@3U__type_info_node@@A
0x140006710: "ext-ms-win-session-winsta-l1-1-2" ??_C@_1EC@NEGKAFCC@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAs?$AAe?$AAs?$AAs?$AAi?$AAo?$AAn?$AA?9?$AAw?$AAi?$AAn?$AAs?$AAt?$AAa?$AA?9?$AAl?$AA1?$AA?9?$AA1?$AA?9?$AA2@
0x1400063B0: "__cdecl _imp__o__exit" __imp__o__exit
0x140006AD0: "Software\Microsoft\Windows\Curre" ??_C@_1HE@KMAPOOMM@?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe@
0x1400062B0: "__cdecl _imp_SetThreadPriority" __imp_SetThreadPriority
0x1400063A0: "__cdecl _imp__configure_narrow_argv" __imp__configure_narrow_argv
0x1400068F0: "shell" ??_C@_1M@IDADAHFF@?$AAs?$AAh?$AAe?$AAl?$AAl?$AA?$AA@
0x140006438: "__cdecl _imp__c_exit" __imp__c_exit
0x14000768C: "__cdecl _DELAY_IMPORT_DESCRIPTOR_ext_ms_win_session_userinit_l1_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_ext_ms_win_session_userinit_l1_1_0_dll
0x140007B60: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0
0x140006390: "__cdecl _imp__o__cexit" __imp__o__cexit
0x1400013D8: WPP_SF_Sd
0x140006368: api-ms-win-core-synch-l1-2-0_NULL_THUNK_DATA
0x140001204: WPP_SF_SS
0x14000B058: "__cdecl _imp_SetupHotKeyForKeyboardLayout" __imp_SetupHotKeyForKeyboardLayout
0x1400050F2: "__cdecl o__set_fmode" _o__set_fmode
0x140004910: "__cdecl _scrt_initialize_winrt" __scrt_initialize_winrt
0x1400050E6: "__cdecl set_app_type" _set_app_type
0x1400063E0: "__cdecl _imp__o__seh_filter_exe" __imp__o__seh_filter_exe
0x140006358: api-ms-win-core-synch-l1-1-0_NULL_THUNK_DATA
0x140007AD4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0
0x140001194: WPP_SF_S
0x140005056: memset
0x140007BEC: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x140006640: "__cdecl _sz_ext_ms_win_session_winsta_l1_1_3_dll" __sz_ext_ms_win_session_winsta_l1_1_3_dll
0x140009088: "unsigned __int64 `__local_stdio_scanf_options'::`2'::_OptionsStorage" ?_OptionsStorage@?1??__local_stdio_scanf_options@@9@4_KA

[JEB Decompiler by PNF Software]