PDB Symbols - keepaliveprovider.dll (0x2745FD729DF1BF4616F2EA89FB55892E5715E31117FDD24C7DCDF26873139FFB)

Generated by JEB on 2019/08/01

PE: C:\Windows\System32\keepaliveprovider.dll Base=0x180000000 SHA-256=2745FD729DF1BF4616F2EA89FB55892E5715E31117FDD24C7DCDF26873139FFB
PDB: keepaliveprovider.pdb GUID={7595E670-D328-7FF3-4E65F03FE3742A2B} Age=1

260 located named symbols:
0x180011010: "NtQuerySystemInformation" ??_C@_0BJ@NDLOPGCH@NtQuerySystemInformation?$AA@
0x18000E898: "__cdecl _imp_UnregisterTraceGuids" __imp_UnregisterTraceGuids
0x18000D45C: "__cdecl _raise_securityfailure" __raise_securityfailure
0x18000D280: "__cdecl FindPESection" _FindPESection
0x180011618: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x18000CBF0: "struct HBITMAP__ * __ptr64 __cdecl WARBIRD_DELAY_LOAD::CreateDIBSection(struct HDC__ * __ptr64,struct tagBITMAPINFO const * __ptr64,unsigned int,void * __ptr64 * __ptr64,void * __ptr64,unsigned long)" ?CreateDIBSection@WARBIRD_DELAY_LOAD@@YAPEAUHBITMAP__@@PEAUHDC__@@PEBUtagBITMAPINFO@@IPEAPEAXPEAXK@Z
0x180013190: "__cdecl _security_cookie_complement" __security_cookie_complement
0x18000CD4C: "__cdecl CRT_INIT" _CRT_INIT
0x18000E7F0: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x18000B81C: FreeSampleSetHelper
0x18000E718: "__cdecl _imp_RpcAsyncCompleteCall" __imp_RpcAsyncCompleteCall
0x180001030: WppControlCallback
0x18000D780: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x18000CBF0: "struct HDC__ * __ptr64 __cdecl WARBIRD_DELAY_LOAD::GetDC(struct HWND__ * __ptr64)" ?GetDC@WARBIRD_DELAY_LOAD@@YAPEAUHDC__@@PEAUHWND__@@@Z
0x18000136C: InitializeGlobals
0x18000E710: "__cdecl _imp_RpcAsyncCancelCall" __imp_RpcAsyncCancelCall
0x18000CBF0: "int __cdecl WARBIRD_DELAY_LOAD::EnumDisplaySettingsW(unsigned short const * __ptr64,unsigned long,struct _devicemodeW * __ptr64)" ?EnumDisplaySettingsW@WARBIRD_DELAY_LOAD@@YAHPEBGKPEAU_devicemodeW@@@Z
0x180013908: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxunrmrlUhvxfirgbUorxvmhrmtUhkxzooUoryUyfrowPxorvmgPfnUlyquivUznwGEUhgwzucOlyq@spcall_client_um" __@@_PchSym_@00@KxulyqvxgPillgKxunrmrlUhvxfirgbUorxvmhrmtUhkxzooUoryUyfrowPxorvmgPfnUlyquivUznwGEUhgwzucOlyq@spcall_client_um
0x180001228: FreeSampleSetHelperTemplate
0x18001162C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-eventing-classicprovider-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-eventing-classicprovider-l1-1-0
0x18000E7B0: api-ms-win-core-heap-l2-1-0_NULL_THUNK_DATA
0x18000C770: KapiReceiveKaUpdateRequestCompletion
0x18000CBF0: "int __cdecl WARBIRD_DELAY_LOAD::GetObjectW(void * __ptr64,int,void * __ptr64)" ?GetObjectW@WARBIRD_DELAY_LOAD@@YAHPEAXH0@Z
0x18000CBF0: "void * __ptr64 __cdecl WARBIRD_DELAY_LOAD::GetCurrentObject(struct HDC__ * __ptr64,unsigned int)" ?GetCurrentObject@WARBIRD_DELAY_LOAD@@YAPEAXPEAUHDC__@@I@Z
0x18000CBF0: "struct HBRUSH__ * __ptr64 __cdecl WARBIRD_DELAY_LOAD::CreateSolidBrush(unsigned long)" ?CreateSolidBrush@WARBIRD_DELAY_LOAD@@YAPEAUHBRUSH__@@K@Z
0x18000E950: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x18000E7C0: "__cdecl _imp_GetModuleHandleExW" __imp_GetModuleHandleExW
0x1800131B0: "unsigned char * `WarbirdUmGetEncryptionCipher'::`2'::EncryptionCipher" ?EncryptionCipher@?1??WarbirdUmGetEncryptionCipher@@9@4PAEA
0x180013988: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivfzkUmvgUmvgrlUrksokhexUpzkilerwviUpzkrwooUlyquivUznwGEUkivxlnkOlyq@keepaliveprovider" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivfzkUmvgUmvgrlUrksokhexUpzkilerwviUpzkrwooUlyquivUznwGEUkivxlnkOlyq@keepaliveprovider
0x18000D260: "__cdecl XcptFilter" _XcptFilter
0x18000E958: "__cdecl _xc_a" __xc_a
0x18000CBF0: "int __cdecl WARBIRD_DELAY_LOAD::InvalidateRect(struct HWND__ * __ptr64,struct tagRECT const * __ptr64,int)" ?InvalidateRect@WARBIRD_DELAY_LOAD@@YAHPEAUHWND__@@PEBUtagRECT@@H@Z
0x18000C0F0: midl_kapi_allocate
0x180013000: "void * __ptr64 * WARBIRD::g_FuncAddress" ?g_FuncAddress@WARBIRD@@3PAPEAXA
0x18000E798: api-ms-win-core-heap-l1-1-0_NULL_THUNK_DATA
0x18000CBF0: "struct HDC__ * __ptr64 __cdecl WARBIRD_DELAY_LOAD::GetDCEx(struct HWND__ * __ptr64,struct HRGN__ * __ptr64,unsigned long)" ?GetDCEx@WARBIRD_DELAY_LOAD@@YAPEAUHDC__@@PEAUHWND__@@PEAUHRGN__@@K@Z
0x18000CC54: "public: void __cdecl SP<unsigned long,class SP_MEM<unsigned long> >::Reset(void) __ptr64" ?Reset@?$SP@KV?$SP_MEM@K@@@@QEAAXXZ
0x1800109D8: "unsigned short const * const `public: static long __cdecl CUxDisplayStringsT<class CEmptyType>::GetAllPreferredStrings(unsigned short * __ptr64,unsigned int,unsigned short * __ptr64 * __ptr64 * __ptr64,int * __ptr64,struct _LANG_FONT_NAMES * __ptr64)'::`2'::wStringIds" ?wStringIds@?1??GetAllPreferredStrings@?$CUxDisplayStringsT@VCEmptyType@@@@SAJPEAGIPEAPEAPEAGPEAHPEAU_LANG_FONT_NAMES@@@Z@4QBGB
0x18000CC20: "int __cdecl WARBIRD_DELAY_LOAD::MulDiv(int,int,int)" ?MulDiv@WARBIRD_DELAY_LOAD@@YAHHHH@Z
0x18000D746: memcpy
0x180013940: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivfzkUmvgUmvgrlUrksokhexUfgrooryUlyquivUznwGEUkivxlnkOlyq@IphlpsvcUtils" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivfzkUmvgUmvgrlUrksokhexUfgrooryUlyquivUznwGEUkivxlnkOlyq@IphlpsvcUtils
0x18000B8A4: FreeNetworkGuidsHelper
0x18000CBF0: "int __cdecl WARBIRD_DELAY_LOAD::FillRect(struct HDC__ * __ptr64,struct tagRECT const * __ptr64,struct HBRUSH__ * __ptr64)" ?FillRect@WARBIRD_DELAY_LOAD@@YAHPEAUHDC__@@PEBUtagRECT@@PEAUHBRUSH__@@@Z
0x18000CBF0: "int __cdecl WARBIRD_DELAY_LOAD::DeleteObject(void * __ptr64)" ?DeleteObject@WARBIRD_DELAY_LOAD@@YAHPEAX@Z
0x18000E8D8: "__cdecl _imp_memset" __imp_memset
0x18000E838: "__cdecl _imp_CreateEventW" __imp_CreateEventW
0x18000D43F: "__cdecl initterm" _initterm
0x18000E8A0: "__cdecl _imp_TraceMessage" __imp_TraceMessage
0x180011730: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0
0x180013930: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x18000E848: "__cdecl _imp_Sleep" __imp_Sleep
0x18000E978: "__cdecl _xi_z" __xi_z
0x18000E748: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x18000E918: "__cdecl _imp_wcscmp" __imp_wcscmp
0x18000CBF0: "struct HBITMAP__ * __ptr64 __cdecl WARBIRD_DELAY_LOAD::CreateCompatibleBitmap(struct HDC__ * __ptr64,int,int)" ?CreateCompatibleBitmap@WARBIRD_DELAY_LOAD@@YAPEAUHBITMAP__@@PEAUHDC__@@HH@Z
0x18000E9D0: WPP_9c8d04f68b673166442eda755b536801_Traceguids
0x18000D254: "__cdecl _C_specific_handler" __C_specific_handler
0x18000E728: "__cdecl _imp_RpcBindingUnbind" __imp_RpcBindingUnbind
0x18000E788: "__cdecl _imp_HeapFree" __imp_HeapFree
0x180013950: WPP_REGISTRATION_GUIDS
0x18000CBF0: "struct HWND__ * __ptr64 __cdecl WARBIRD_DELAY_LOAD::GetDesktopWindow(void)" ?GetDesktopWindow@WARBIRD_DELAY_LOAD@@YAPEAUHWND__@@XZ
0x18000E778: api-ms-win-core-handle-l1-1-0_NULL_THUNK_DATA
0x18000D64C: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x18000CBF0: "int __cdecl WARBIRD_DELAY_LOAD::LCIDToLocaleName(unsigned long,unsigned short * __ptr64,int,unsigned long)" ?LCIDToLocaleName@WARBIRD_DELAY_LOAD@@YAHKPEAGHK@Z
0x1800138A0: "struct WARBIRD::_MODULE_INFO * WARBIRD::g_arModuleInfo" ?g_arModuleInfo@WARBIRD@@3PAU_MODULE_INFO@1@A
0x18000BE80: KAMSS_DeregisterProvider
0x180013960: WPP_MAIN_CB
0x18001167C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0
0x18000D26C: "__cdecl amsg_exit" _amsg_exit
0x18000CC10: "int __cdecl WARBIRD_DELAY_LOAD::GdiGradientFill(struct HDC__ * __ptr64,struct _TRIVERTEX * __ptr64,unsigned long,void * __ptr64,unsigned long,unsigned long)" ?GdiGradientFill@WARBIRD_DELAY_LOAD@@YAHPEAUHDC__@@PEAU_TRIVERTEX@@KPEAXKK@Z
0x1800116B8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-threadpool-legacy-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-threadpool-legacy-l1-1-0
0x18000CBF0: "void * __ptr64 __cdecl WARBIRD_DELAY_LOAD::SelectObject(struct HDC__ * __ptr64,void * __ptr64)" ?SelectObject@WARBIRD_DELAY_LOAD@@YAPEAXPEAUHDC__@@PEAX@Z
0x18000CBF0: "int __cdecl WARBIRD_DELAY_LOAD::GetDIBits(struct HDC__ * __ptr64,struct HBITMAP__ * __ptr64,unsigned int,unsigned int,void * __ptr64,struct tagBITMAPINFO * __ptr64,unsigned int)" ?GetDIBits@WARBIRD_DELAY_LOAD@@YAHPEAUHDC__@@PEAUHBITMAP__@@IIPEAXPEAUtagBITMAPINFO@@I@Z
0x18000CC10: "int __cdecl WARBIRD_DELAY_LOAD::DrawTextExW(struct HDC__ * __ptr64,unsigned short * __ptr64,int,struct tagRECT * __ptr64,unsigned int,struct tagDRAWTEXTPARAMS * __ptr64)" ?DrawTextExW@WARBIRD_DELAY_LOAD@@YAHPEAUHDC__@@PEAGHPEAUtagRECT@@IPEAUtagDRAWTEXTPARAMS@@@Z
0x18000CC10: "int __cdecl WARBIRD_DELAY_LOAD::GdiAlphaBlend(struct HDC__ * __ptr64,int,int,int,int,struct HDC__ * __ptr64,int,int,int,int,struct _BLENDFUNCTION)" ?GdiAlphaBlend@WARBIRD_DELAY_LOAD@@YAHPEAUHDC__@@HHHH0HHHHU_BLENDFUNCTION@@@Z
0x18000E8A8: "__cdecl _imp_GetTraceLoggerHandle" __imp_GetTraceLoggerHandle
0x18000E768: api-ms-win-core-errorhandling-l1-1-0_NULL_THUNK_DATA
0x18000E8B8: "__cdecl _imp_GetTraceEnableLevel" __imp_GetTraceEnableLevel
0x18000CBF0: "struct HDC__ * __ptr64 __cdecl WARBIRD_DELAY_LOAD::CreateCompatibleDC(struct HDC__ * __ptr64)" ?CreateCompatibleDC@WARBIRD_DELAY_LOAD@@YAPEAUHDC__@@PEAU2@@Z
0x18000E7F8: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x1800131A0: "unsigned __int64 `WarbirdUmGetDecryptionKey'::`2'::nDecryptionKey" ?nDecryptionKey@?1??WarbirdUmGetDecryptionKey@@9@4_KA
0x180013920: "__cdecl _native_startup_lock" __native_startup_lock
0x1800010B8: DllMain
0x18000CBF0: "unsigned __int64 __cdecl WARBIRD_DELAY_LOAD::GetTickCount64(void)" ?GetTickCount64@WARBIRD_DELAY_LOAD@@YA_KXZ
0x180013250: "unsigned __int64 `WarbirdUmGetEncryptionKey'::`2'::nEncryptionKey" ?nEncryptionKey@?1??WarbirdUmGetEncryptionKey@@9@4_KA
0x18000D6B0: "__cdecl _GSHandlerCheck_SEH" __GSHandlerCheck_SEH
0x18000E8F8: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x18000E930: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x18000E7E0: api-ms-win-core-libraryloader-l1-2-0_NULL_THUNK_DATA
0x18000E888: api-ms-win-core-threadpool-private-l1-1-0_NULL_THUNK_DATA
0x18000C15C: InitializeKaMeasurements
0x18000E758: "__cdecl _imp_GetLastError" __imp_GetLastError
0x180013904: g_WarbirdSecureFunctionsLock
0x180013180: "__cdecl _native_dllmain_reason" __native_dllmain_reason
0x18000D628: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x180010D30: "unsigned short const * const `private: static long __cdecl CUxDisplayStringsT<class CEmptyType>::GetFontsForLCIDIndex(unsigned int,struct _LANG_FONT_NAMES * __ptr64)'::`2'::wszFontArray" ?wszFontArray@?1??GetFontsForLCIDIndex@?$CUxDisplayStringsT@VCEmptyType@@@@CAJIPEAU_LANG_FONT_NAMES@@@Z@4QBGB
0x18000CB58: UtillibFreeGuidListHelperTemplate
0x18000E700: "__cdecl _imp_RpcBindingCreateW" __imp_RpcBindingCreateW
0x18000E7E8: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x18000E830: "__cdecl _imp_WaitForSingleObject" __imp_WaitForSingleObject
0x18000CBF0: "int __cdecl WARBIRD_DELAY_LOAD::GetUserObjectInformationW(void * __ptr64,int,void * __ptr64,unsigned long,unsigned long * __ptr64)" ?GetUserObjectInformationW@WARBIRD_DELAY_LOAD@@YAHPEAXH0KPEAK@Z
0x18000D330: "__cdecl ValidateImageBase" _ValidateImageBase
0x18000CB9C: "long __cdecl StringCchCopyW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64)" ?StringCchCopyW@@YAJPEAG_KPEBG@Z
0x180011640: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0
0x18000CBF0: "unsigned long __cdecl WARBIRD_DELAY_LOAD::SleepEx(unsigned long,int)" ?SleepEx@WARBIRD_DELAY_LOAD@@YAKKH@Z
0x180001008: WPP_SF_
0x18000E780: "__cdecl _imp_HeapAlloc" __imp_HeapAlloc
0x18000E7B8: "__cdecl _imp_FreeLibrary" __imp_FreeLibrary
0x18000E708: "__cdecl _imp_RpcBindingFree" __imp_RpcBindingFree
0x18000CF90: "__cdecl DllMainCRTStartup" _DllMainCRTStartup
0x18000E8E8: "__cdecl _imp__initterm" __imp__initterm
0x18000CBF0: "int __cdecl WARBIRD_DELAY_LOAD::DeleteDC(struct HDC__ * __ptr64)" ?DeleteDC@WARBIRD_DELAY_LOAD@@YAHPEAUHDC__@@@Z
0x18000E750: "__cdecl _imp_SetLastError" __imp_SetLastError
0x18000CBF0: "int __cdecl WARBIRD_DELAY_LOAD::GetSystemMetrics(int)" ?GetSystemMetrics@WARBIRD_DELAY_LOAD@@YAHH@Z
0x18000E7D0: "__cdecl _imp_GetModuleFileNameW" __imp_GetModuleFileNameW
0x18000CBF0: "int __cdecl WARBIRD_DELAY_LOAD::MultiByteToWideChar(unsigned int,unsigned long,char const * __ptr64,int,unsigned short * __ptr64,int)" ?MultiByteToWideChar@WARBIRD_DELAY_LOAD@@YAHIKPEBDHPEAGH@Z
0x18000EC10: "Default" ??_C@_1BA@GHOECOCL@?$AAD?$AAe?$AAf?$AAa?$AAu?$AAl?$AAt?$AA?$AA@
0x180013910: "__cdecl _onexitend" __onexitend
0x18000EC20: "unsigned char const * const `public: static long __cdecl CUxDisplayStringsT<class CEmptyType>::GetAllPreferredStrings(unsigned short * __ptr64,unsigned int,unsigned short * __ptr64 * __ptr64 * __ptr64,int * __ptr64,struct _LANG_FONT_NAMES * __ptr64)'::`2'::bEncryptedStringBuffer" ?bEncryptedStringBuffer@?1??GetAllPreferredStrings@?$CUxDisplayStringsT@VCEmptyType@@@@SAJPEAGIPEAPEAPEAGPEAHPEAU_LANG_FONT_NAMES@@@Z@4QBEB
0x18000E948: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x18000CBF0: "struct HFONT__ * __ptr64 __cdecl WARBIRD_DELAY_LOAD::CreateFontIndirectW(struct tagLOGFONTW const * __ptr64)" ?CreateFontIndirectW@WARBIRD_DELAY_LOAD@@YAPEAUHFONT__@@PEBUtagLOGFONTW@@@Z
0x18000E800: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x18000CC10: "int __cdecl WARBIRD_DELAY_LOAD::RedrawWindow(struct HWND__ * __ptr64,struct tagRECT const * __ptr64,struct HRGN__ * __ptr64,unsigned int)" ?RedrawWindow@WARBIRD_DELAY_LOAD@@YAHPEAUHWND__@@PEBUtagRECT@@PEAUHRGN__@@I@Z
0x18000CC94: "public: void __cdecl SH<void * __ptr64,class SH_HANDLE>::Reset(void) __ptr64" ?Reset@?$SH@PEAXVSH_HANDLE@@@@QEAAXXZ
0x18000E868: api-ms-win-core-sysinfo-l1-1-0_NULL_THUNK_DATA
0x18000E968: "__cdecl _xi_a" __xi_a
0x18000E818: api-ms-win-core-processthreads-l1-1-1_NULL_THUNK_DATA
0x18000E860: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x18000E8D0: api-ms-win-security-base-l1-1-0_NULL_THUNK_DATA
0x18000C4D4: UninitializeKaMeasurements
0x1800012D0: WPP_SF_DD
0x18000CBF0: "int __cdecl WARBIRD_DELAY_LOAD::GetDeviceCaps(struct HDC__ * __ptr64,int)" ?GetDeviceCaps@WARBIRD_DELAY_LOAD@@YAHPEAUHDC__@@H@Z
0x180013170: WPP_GLOBAL_Control
0x18001171C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0
0x180011744: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-1" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-1
0x18000CC10: "int __cdecl WARBIRD_DELAY_LOAD::LogicalToPhysicalPointForPerMonitorDPI(struct HWND__ * __ptr64,struct tagPOINT * __ptr64)" ?LogicalToPhysicalPointForPerMonitorDPI@WARBIRD_DELAY_LOAD@@YAHPEAUHWND__@@PEAUtagPOINT@@@Z
0x18000128C: WPP_SF_D
0x180001324: WPP_SF_d
0x180013938: "__cdecl pRawDllMain" _pRawDllMain
0x18000E730: "__cdecl _imp_I_RpcExceptionFilter" __imp_I_RpcExceptionFilter
0x18000E878: api-ms-win-core-threadpool-legacy-l1-1-0_NULL_THUNK_DATA
0x18000E880: "__cdecl _imp_RegisterWaitForSingleObjectEx" __imp_RegisterWaitForSingleObjectEx
0x180011654: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-l1-1-0
0x18000CBF0: "unsigned long __cdecl WARBIRD_DELAY_LOAD::SetTextColor(struct HDC__ * __ptr64,unsigned long)" ?SetTextColor@WARBIRD_DELAY_LOAD@@YAKPEAUHDC__@@K@Z
0x18000D230: "__cdecl _security_check_cookie" __security_check_cookie
0x18000CC2C: "public: void __cdecl SP<unsigned char,class SP_HLOCAL<unsigned char> >::Reset(void) __ptr64" ?Reset@?$SP@EV?$SP_HLOCAL@E@@@@QEAAXXZ
0x18000E960: "__cdecl _xc_z" __xc_z
0x180011758: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0
0x18000E808: api-ms-win-core-processthreads-l1-1-0_NULL_THUNK_DATA
0x18000E7C8: "__cdecl _imp_GetProcAddress" __imp_GetProcAddress
0x18000CBF0: "int __cdecl WARBIRD_DELAY_LOAD::GetLocaleInfoEx(unsigned short const * __ptr64,unsigned long,unsigned short * __ptr64,int)" ?GetLocaleInfoEx@WARBIRD_DELAY_LOAD@@YAHPEBGKPEAGH@Z
0x180013260: "unsigned char * `WarbirdUmGetDecryptionCipher'::`2'::DecryptionCipher" ?DecryptionCipher@?1??WarbirdUmGetDecryptionCipher@@9@4PAEA
0x1800116A4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-threadpool-private-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-threadpool-private-l1-1-0
0x18000E858: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x18000CBF0: "struct HDESK__ * __ptr64 __cdecl WARBIRD_DELAY_LOAD::GetThreadDesktop(unsigned long)" ?GetThreadDesktop@WARBIRD_DELAY_LOAD@@YAPEAUHDESK__@@K@Z
0x18000E7A0: "__cdecl _imp_LocalAlloc" __imp_LocalAlloc
0x18000E790: "__cdecl _imp_GetProcessHeap" __imp_GetProcessHeap
0x18000D7A0: "__cdecl _chkstk" __chkstk
0x18000EA30: WPP_3809f1f540c83077711777eb2b09b665_Traceguids
0x18000CBF0: "int __cdecl WARBIRD_DELAY_LOAD::SystemParametersInfoW(unsigned int,unsigned int,void * __ptr64,unsigned int)" ?SystemParametersInfoW@WARBIRD_DELAY_LOAD@@YAHIIPEAXI@Z
0x1800108C0: "unsigned long const * const `public: static long __cdecl CUxDisplayStringsT<class CEmptyType>::GetAllPreferredStrings(unsigned short * __ptr64,unsigned int,unsigned short * __ptr64 * __ptr64 * __ptr64,int * __ptr64,struct _LANG_FONT_NAMES * __ptr64)'::`2'::uLanguageArray" ?uLanguageArray@?1??GetAllPreferredStrings@?$CUxDisplayStringsT@VCEmptyType@@@@SAJPEAGIPEAPEAPEAGPEAHPEAU_LANG_FONT_NAMES@@@Z@4QBKB
0x18000C130: midl_kapi_free
0x18000E6F8: "__cdecl _imp_RpcBindingSetOption" __imp_RpcBindingSetOption
0x18000E828: api-ms-win-core-profile-l1-1-0_NULL_THUNK_DATA
0x180013890: "union _NOTIFICATION_INFORMATION g_WarbirdNotificationInformation" ?g_WarbirdNotificationInformation@@3T_NOTIFICATION_INFORMATION@@A
0x18000E980: "__cdecl _guard_fids_table" __guard_fids_table
0x18000E8C8: "__cdecl _imp_CreateWellKnownSid" __imp_CreateWellKnownSid
0x18000E920: msvcrt_NULL_THUNK_DATA
0x18000E5E0: "__cdecl load_config_used" _load_config_used
0x18000E870: "__cdecl _imp_UnregisterWaitEx" __imp_UnregisterWaitEx
0x180010960: ?LangFontIndexMapping@?1??GetFontsForLCIDIndex@?$CUxDisplayStringsT@VCEmptyType@@@@CAJIPEAU_LANG_FONT_NAMES@@@Z@4QBU_LANG_FONT_INDEX_INFO@?1??12@CAJI0@Z@B
0x18000E6E8: "__cdecl _imp_Ndr64AsyncClientCall" __imp_Ndr64AsyncClientCall
0x18000E9E0: WPP_ThisDir_CTLGUID_KAProvider
0x18000CBF0: "unsigned long __cdecl WARBIRD_DELAY_LOAD::LocaleNameToLCID(unsigned short const * __ptr64,unsigned long)" ?LocaleNameToLCID@WARBIRD_DELAY_LOAD@@YAKPEBGK@Z
0x18000E908: "__cdecl _imp__amsg_exit" __imp__amsg_exit
0x18000E7D8: "__cdecl _imp_DisableThreadLibraryCalls" __imp_DisableThreadLibraryCalls
0x18000E928: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x18000E820: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x18000C130: FREE
0x18000E9F0: "NcbServiceLicense-NcbMobileCore" ??_C@_1EA@FOFBHKE@?$AAN?$AAc?$AAb?$AAS?$AAe?$AAr?$AAv?$AAi?$AAc?$AAe?$AAL?$AAi?$AAc?$AAe?$AAn?$AAs?$AAe?$AA?9?$AAN?$AAc?$AAb?$AAM?$AAo?$AAb?$AAi?$AAl?$AAe?$AAC?$AAo?$AAr?$AAe?$AA?$AA@
0x18000E938: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x18000D450: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x18000B930: KAMSS_RegisterProvider
0x18000BFB0: KAMSS_MeasurementUpdateCallback
0x1800116E0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0
0x18000E6F0: "__cdecl _imp_RpcBindingBind" __imp_RpcBindingBind
0x18000E8C0: api-ms-win-eventing-classicprovider-l1-1-0_NULL_THUNK_DATA
0x180013900: g_WarbirdSecureFunctionsRefCount
0x18000E910: "__cdecl _imp__XcptFilter" __imp__XcptFilter
0x18000E940: ntdll_NULL_THUNK_DATA
0x18000E8E0: "__cdecl _imp_memcpy" __imp_memcpy
0x18000CC10: "int __cdecl WARBIRD_DELAY_LOAD::OffsetRect(struct tagRECT * __ptr64,int,int)" ?OffsetRect@WARBIRD_DELAY_LOAD@@YAHPEAUtagRECT@@HH@Z
0x18000CC54: "public: void __cdecl SP<unsigned char,class SP_MEM<unsigned char> >::Reset(void) __ptr64" ?Reset@?$SP@EV?$SP_MEM@E@@@@QEAAXXZ
0x18000CC10: "struct HMONITOR__ * __ptr64 __cdecl WARBIRD_DELAY_LOAD::MonitorFromWindow(struct HWND__ * __ptr64,unsigned long)" ?MonitorFromWindow@WARBIRD_DELAY_LOAD@@YAPEAUHMONITOR__@@PEAUHWND__@@K@Z
0x18000E8B0: "__cdecl _imp_GetTraceEnableFlags" __imp_GetTraceEnableFlags
0x1800116CC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0
0x18000E890: "__cdecl _imp_RegisterTraceGuidsW" __imp_RegisterTraceGuidsW
0x180013188: "__cdecl _security_cookie" __security_cookie
0x18000D7A0: "__cdecl alloca_probe" _alloca_probe
0x18000E770: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x18000E7A8: "__cdecl _imp_LocalFree" __imp_LocalFree
0x180011668: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0
0x180013918: "__cdecl _onexitbegin" __onexitbegin
0x180013948: kapiservice_IfHandle
0x18000EC00: "WinSta0" ??_C@_1BA@IMLGMNLL@?$AAW?$AAi?$AAn?$AAS?$AAt?$AAa?$AA0?$AA?$AA@
0x18000CC10: "int __cdecl WARBIRD_DELAY_LOAD::GetMonitorInfoW(struct HMONITOR__ * __ptr64,struct tagMONITORINFO * __ptr64)" ?GetMonitorInfoW@WARBIRD_DELAY_LOAD@@YAHPEAUHMONITOR__@@PEAUtagMONITORINFO@@@Z
0x18000E760: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x18000CC10: "int __cdecl WARBIRD_DELAY_LOAD::SetBkMode(struct HDC__ * __ptr64,int)" ?SetBkMode@WARBIRD_DELAY_LOAD@@YAHPEAUHDC__@@H@Z
0x18000D364: "__cdecl _security_init_cookie" __security_init_cookie
0x180011604: "__cdecl _IMPORT_DESCRIPTOR_msvcrt" __IMPORT_DESCRIPTOR_msvcrt
0x18000D75E: wcscmp
0x18000CBF0: "void * __ptr64 __cdecl WARBIRD_DELAY_LOAD::GetStockObject(int)" ?GetStockObject@WARBIRD_DELAY_LOAD@@YAPEAXH@Z
0x18000CBF0: "int __cdecl WARBIRD_DELAY_LOAD::GetUserPreferredUILanguages(unsigned long,unsigned long * __ptr64,unsigned short * __ptr64,unsigned long * __ptr64)" ?GetUserPreferredUILanguages@WARBIRD_DELAY_LOAD@@YAHKPEAKPEAG0@Z
0x18000E8F0: "__cdecl _imp_malloc" __imp_malloc
0x18000CBF0: "struct HWINSTA__ * __ptr64 __cdecl WARBIRD_DELAY_LOAD::GetProcessWindowStation(void)" ?GetProcessWindowStation@WARBIRD_DELAY_LOAD@@YAPEAUHWINSTA__@@XZ
0x180011690: "__cdecl _IMPORT_DESCRIPTOR_RPCRT4" __IMPORT_DESCRIPTOR_RPCRT4
0x18000E740: RPCRT4_NULL_THUNK_DATA
0x18000D4A0: "__cdecl _report_gsfailure" __report_gsfailure
0x18000CC54: "public: void __cdecl SP<unsigned short,class SP_MEM<unsigned short> >::Reset(void) __ptr64" ?Reset@?$SP@GV?$SP_MEM@G@@@@QEAAXXZ
0x18000E720: "__cdecl _imp_RpcAsyncInitializeHandle" __imp_RpcAsyncInitializeHandle
0x180013928: "__cdecl _native_startup_state" __native_startup_state
0x18000EBE8: "ntdll.dll" ??_C@_1BE@GJOFHIHD@?$AAn?$AAt?$AAd?$AAl?$AAl?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x18000CBF0: "int __cdecl WARBIRD_DELAY_LOAD::BitBlt(struct HDC__ * __ptr64,int,int,int,int,struct HDC__ * __ptr64,int,int,unsigned long)" ?BitBlt@WARBIRD_DELAY_LOAD@@YAHPEAUHDC__@@HHHH0HHK@Z
0x18000E738: "__cdecl _imp_NdrClientCall3" __imp_NdrClientCall3
0x18000C6DC: CleanupRpcAsyncState
0x18000E810: "__cdecl _imp_GetProcessMitigationPolicy" __imp_GetProcessMitigationPolicy
0x180011708: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0
0x18000CC54: "public: void __cdecl SP<unsigned short * __ptr64,class SP_MEM<unsigned short * __ptr64> >::Reset(void) __ptr64" ?Reset@?$SP@PEAGV?$SP_MEM@PEAG@@@@QEAAXXZ
0x18000E900: "__cdecl _imp_free" __imp_free
0x18000D2D0: "__cdecl IsNonwritableInCurrentImage" _IsNonwritableInCurrentImage
0x18000E850: api-ms-win-core-synch-l1-2-0_NULL_THUNK_DATA
0x18000E840: api-ms-win-core-synch-l1-1-0_NULL_THUNK_DATA
0x1800116F4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0
0x18000CBF0: "int __cdecl WARBIRD_DELAY_LOAD::ReleaseDC(struct HWND__ * __ptr64,struct HDC__ * __ptr64)" ?ReleaseDC@WARBIRD_DELAY_LOAD@@YAHPEAUHWND__@@PEAUHDC__@@@Z
0x18000D752: memset
0x18001176C: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x180013880: "unsigned __int64 g_WarbirdPaintInitTime" ?g_WarbirdPaintInitTime@@3_KA
0x18000CBF0: "unsigned long __cdecl WARBIRD_DELAY_LOAD::GetSysColor(int)" ?GetSysColor@WARBIRD_DELAY_LOAD@@YAKH@Z

[JEB Decompiler by PNF Software]