Generated by JEB on 2019/08/01

PE: C:\Windows\System32\SrTasks.exe Base=0x140000000 SHA-256=2B6B1315F4FF6955281353024F427486F58430F2129A98FA7375C12A580BBD7F
PDB: srtasks.pdb GUID={A3744521-804E-E3B8-60E8E73ABBF3214E} Age=1

418 located named symbols:
0x14000B860: "GetRestorePointsCount" ??_C@_0BG@PIHCAMKJ@GetRestorePointsCount?$AA@
0x14000C0A8: "%s.0.%s" ??_C@_1BA@LDMIOFBC@?$AA?$CF?$AAs?$AA?4?$AA0?$AA?4?$AA?$CF?$AAs?$AA?$AA@
0x14000B560: s_cszSRRegKey
0x14000C230: CLSID_TaskScheduler
0x14000AC3C: "__cdecl _raise_securityfailure" __raise_securityfailure
0x14000A130: "public: long __cdecl CBsString::LoadStringResource(struct HINSTANCE__ * __ptr64,unsigned int) __ptr64" ?LoadStringResource@CBsString@@QEAAJPEAUHINSTANCE__@@I@Z
0x14000AA50: "__cdecl FindPESection" _FindPESection
0x14000BF58: "SxDeleteFile" ??_C@_0N@JNEKLOOJ@SxDeleteFile?$AA@
0x1400058D8: "long __cdecl GetDiffAreaInfo(unsigned short const * __ptr64,__int64 * __ptr64,__int64 * __ptr64,__int64 * __ptr64)" ?GetDiffAreaInfo@@YAJPEBGPEA_J11@Z
0x14000B480: "__cdecl _imp_CoInitializeEx" __imp_CoInitializeEx
0x14000CC20: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x140008070: WPP_SF_sdsdd
0x14000A224: "public: long __cdecl CBsString::ConvertToBSTR(unsigned short * __ptr64 * __ptr64) __ptr64" ?ConvertToBSTR@CBsString@@QEAAJPEAPEAG@Z
0x14000AA40: "__cdecl wsetargv" _wsetargv
0x14000B498: "__cdecl _imp_CoInitializeSecurity" __imp_CoInitializeSecurity
0x14000CC5C: "__cdecl _IMPORT_DESCRIPTOR_SRCORE" __IMPORT_DESCRIPTOR_SRCORE
0x14000E020: "__cdecl _security_cookie_complement" __security_cookie_complement
0x14000A288: "public: long __cdecl CBsString::ExpandEnvironmentStringsW(unsigned short const * __ptr64) __ptr64" ?ExpandEnvironmentStringsW@CBsString@@QEAAJPEBG@Z
0x14000B3F0: "__cdecl _imp__vscwprintf" __imp__vscwprintf
0x14000B360: "__cdecl _imp___wgetmainargs" __imp___wgetmainargs
0x14000CC34: "__cdecl _IMPORT_DESCRIPTOR_SPP" __IMPORT_DESCRIPTOR_SPP
0x14000B1E0: "__cdecl _imp_DeviceIoControl" __imp_DeviceIoControl
0x140002760: "long __cdecl _CheckRecentSPPCheckpoint(void)" ?_CheckRecentSPPCheckpoint@@YAJXZ
0x14000BFF0: "SrTranslatePath" ??_C@_0BA@LHHGELEA@SrTranslatePath?$AA@
0x140004FC8: "long __cdecl SxQueryGroupPolicy(unsigned short const * __ptr64,unsigned short const * __ptr64,int * __ptr64)" ?SxQueryGroupPolicy@@YAJPEBG0PEAH@Z
0x14000B270: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x14000B300: "__cdecl _imp_SRSetRestorePointW" __imp_SRSetRestorePointW
0x140002404: WPP_SF_L
0x14000BCB8: IID_ISrDrvWuHelper
0x14000AEB0: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x14000B2D0: SHELL32_NULL_THUNK_DATA
0x14000B1E8: "__cdecl _imp_CreateFileW" __imp_CreateFileW
0x14000CCAC: "__cdecl _IMPORT_DESCRIPTOR_OLEAUT32" __IMPORT_DESCRIPTOR_OLEAUT32
0x14000BA18: "_DeletePartialSPPGroups" ??_C@_0BI@GNGANMDP@_DeletePartialSPPGroups?$AA@
0x14000B2C8: "__cdecl _imp_CommandLineToArgvW" __imp_CommandLineToArgvW
0x140005C84: "long __cdecl SxShouldCreateScopedSnapshots(unsigned char * __ptr64)" ?SxShouldCreateScopedSnapshots@@YAJPEAE@Z
0x14000C118: "%s.%d.%s" ??_C@_1BC@ELIACAKH@?$AA?$CF?$AAs?$AA?4?$AA?$CF?$AAd?$AA?4?$AA?$CF?$AAs?$AA?$AA@
0x14000E058: "__cdecl commode" _commode
0x140008890: "long __cdecl SxGet0XLogFileCount(unsigned short const * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64)" ?SxGet0XLogFileCount@@YAJPEBGPEAK11@Z
0x14000B760: c_wszScopeSnapshots
0x14000CCC0: "__cdecl _IMPORT_DESCRIPTOR_VSSAPI" __IMPORT_DESCRIPTOR_VSSAPI
0x14000C048: WPP_37d9a2896bad3495ee15cb8430de76ce_Traceguids
0x14000BB58: "GetAndEnsureTracingDirectory" ??_C@_0BN@DPDABMHM@GetAndEnsureTracingDirectory?$AA@
0x14000B8B0: "GetRegistryKeySettings" ??_C@_0BH@OINBCNCI@GetRegistryKeySettings?$AA@
0x14000BC88: CLSID_SrControl
0x14000B4A0: ole32_NULL_THUNK_DATA
0x14000B248: "__cdecl _imp_HeapSetInformation" __imp_HeapSetInformation
0x14000A920: "long __cdecl __CxxUnhandledExceptionFilter(struct _EXCEPTION_POINTERS * __ptr64)" ?__CxxUnhandledExceptionFilter@@YAJPEAU_EXCEPTION_POINTERS@@@Z
0x14000B4B0: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x14000E5E8: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxuyzhvUhgliUhcUfgrohUlyquivUznwGEUfgrohsOlyq@exutils" __@@_PchSym_@00@KxulyqvxgPillgKxuyzhvUhgliUhcUfgrohUlyquivUznwGEUfgrohsOlyq@exutils
0x14000E064: "__cdecl fmode" _fmode
0x14000BF90: "SxSetFileAttributes" ??_C@_0BE@IIHJLHHB@SxSetFileAttributes?$AA@
0x14000B3C8: "__cdecl _imp__wcsnicmp" __imp__wcsnicmp
0x140006EE8: "long __cdecl SrConvertSppGroupToSrRpProp(enum _SR_RESTORE_SOURCE,struct _SPP_GROUP_PROP const * __ptr64,struct _SR_RP_PROP * __ptr64)" ?SrConvertSppGroupToSrRpProp@@YAJW4_SR_RESTORE_SOURCE@@PEBU_SPP_GROUP_PROP@@PEAU_SR_RP_PROP@@@Z
0x14000A97E: "__cdecl XcptFilter" _XcptFilter
0x14000B4B8: "__cdecl _xc_a" __xc_a
0x14000B2E8: "__cdecl _imp_SppFreeGroupPropArray" __imp_SppFreeGroupPropArray
0x14000B720: c_wszTaskPathSafeDocs
0x14000B290: "__cdecl _imp_FindClose" __imp_FindClose
0x1400025D4: WPP_SF__guid_i
0x14000B658: s_cszDisableSR
0x14000C148: "SxRotateLogs" ??_C@_0N@CAGPNDHA@SxRotateLogs?$AA@
0x140001A10: "long __cdecl GetBootVolumeSizeStats(unsigned long * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64)" ?GetBootVolumeSizeStats@@YAJPEAK000@Z
0x14000B160: "__cdecl _imp_SetSecurityDescriptorOwner" __imp_SetSecurityDescriptorOwner
0x14000A90C: "__cdecl callnewh" _callnewh
0x14000B218: "__cdecl _imp_DeleteFileW" __imp_DeleteFileW
0x14000BD50: "::GetVolumePathName( strPath, ST" ??_C@_0EA@DOABPAFE@?3?3GetVolumePathName?$CI?5strPath?0?5ST@
0x14000AE8D: memcpy
0x14000BCE8: "SxRegReadULONGLONG" ??_C@_0BD@IOJKFFFM@SxRegReadULONGLONG?$AA@
0x14000C0E8: "SxCheckWBDiagSession" ??_C@_0BF@HDMBOFDB@SxCheckWBDiagSession?$AA@
0x14000B3D8: "__cdecl _imp_memset" __imp_memset
0x14000AC0F: "__cdecl initterm" _initterm
0x14000B118: "__cdecl _imp_TraceMessage" __imp_TraceMessage
0x14000E618: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x14000B228: "__cdecl _imp_Sleep" __imp_Sleep
0x14000A0DC: "public: void __cdecl CBsString::Transfer(class CBsString * __ptr64) __ptr64" ?Transfer@CBsString@@QEAAXPEAV1@@Z
0x14000B4E8: "__cdecl _xi_z" __xi_z
0x14000BE88: "GetDiffAreaInfo" ??_C@_0BA@PDHBLMBN@GetDiffAreaInfo?$AA@
0x14000B200: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x14000B240: "__cdecl _imp_GetCommandLineW" __imp_GetCommandLineW
0x14000AC1B: "__cdecl _C_specific_handler" __C_specific_handler
0x14000B318: SRCORE_NULL_THUNK_DATA
0x14000C0D0: "SxCompressLogFile" ??_C@_0BC@BHHOIPNF@SxCompressLogFile?$AA@
0x140008614: "private: void __cdecl CSxFunctionTracer::_LogCommon(unsigned short const * __ptr64,unsigned long,unsigned short,unsigned short const * __ptr64,char * __ptr64)const __ptr64" ?_LogCommon@CSxFunctionTracer@@AEBAXPEBGKG0PEAD@Z
0x14000A900: malloc
0x14000B3C0: "__cdecl _imp__wtol" __imp__wtol
0x14000BB9C: "dwErr" ??_C@_05HABMCAIK@dwErr?$AA@
0x140009870: "long __cdecl SxStopTracing(unsigned short const * __ptr64)" ?SxStopTracing@@YAJPEBG@Z
0x14000B128: "__cdecl _imp_RegCloseKey" __imp_RegCloseKey
0x14000AE2C: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x1400045B8: "long __cdecl GetAndEnsureTracingDirectory(class CBsString * __ptr64)" ?GetAndEnsureTracingDirectory@@YAJPEAVCBsString@@@Z
0x14000BF08: "SxInitializeCOMSecurityForSPP" ??_C@_0BO@BMEAANNJ@SxInitializeCOMSecurityForSPP?$AA@
0x14000C030: "FAILED[TRACK]" ??_C@_0O@HMCJKGCN@FAILED?$FLTRACK?$FN?$AA@
0x14000B670: c_wszWaitForRestorePointToAppear
0x14000B180: "__cdecl _imp_RegSetValueExW" __imp_RegSetValueExW
0x14000AA33: "__cdecl amsg_exit" _amsg_exit
0x14000B348: "__cdecl _imp__callnewh" __imp__callnewh
0x140004DDC: "long __cdecl SxRegReadULONGLONG(struct HKEY__ * __ptr64,unsigned short const * __ptr64,unsigned __int64 * __ptr64,int)" ?SxRegReadULONGLONG@@YAJPEAUHKEY__@@PEBGPEA_KH@Z
0x14000BA78: "IsSafeDocsTaskRunning" ??_C@_0BG@CNEFMENE@IsSafeDocsTaskRunning?$AA@
0x140007DEC: ?Release@?$CSxArrayBuilder@PEAG$1?Free_String@@YAXPEAPEAG@Z$1??$SxDefaultInit@PEAG@@YAX0@Z$1??$SxDefaultTransfer@PEAG@@YAX00@Z@@QEAAKXZ
0x14000B7B8: c_wszSRLastMainenanceTaskRun
0x14000B370: "__cdecl _imp_exit" __imp_exit
0x14000B510: GUID_NULL
0x14000B960: "O:BAG:BAD:P(A;OICI;GA;;;BA)(A;OI" ??_C@_1FI@FBKBIMIL@?$AAO?$AA?3?$AAB?$AAA?$AAG?$AA?3?$AAB?$AAA?$AAD?$AA?3?$AAP?$AA?$CI?$AAA?$AA?$DL?$AAO?$AAI?$AAC?$AAI?$AA?$DL?$AAG?$AAA?$AA?$DL?$AA?$DL?$AA?$DL?$AAB?$AAA?$AA?$CJ?$AA?$CI?$AAA?$AA?$DL?$AAO?$AAI@
0x14000B310: "__cdecl _imp_SrFreeRpPropArray" __imp_SrFreeRpPropArray
0x14000B2C0: OLEAUT32_NULL_THUNK_DATA
0x14000B608: c_wszRestorePointTimeToLive
0x14000B9F8: "_CheckRecentSPPCheckpoint" ??_C@_0BK@MFJNFDFL@_CheckRecentSPPCheckpoint?$AA@
0x14000BE98: "SxIsShadowCopyScoped" ??_C@_0BF@FDBBBOPI@SxIsShadowCopyScoped?$AA@
0x1400043C8: "long __cdecl ExecuteScopeRestorePoint(void)" ?ExecuteScopeRestorePoint@@YAJXZ
0x14000878C: "long __cdecl SxAllocateEventTraceProp(struct _EVENT_TRACE_PROPERTIES * __ptr64 * __ptr64)" ?SxAllocateEventTraceProp@@YAJPEAPEAU_EVENT_TRACE_PROPERTIES@@@Z
0x14000B488: "__cdecl _imp_CoUninitialize" __imp_CoUninitialize
0x14000B538: "struct _GUID const c_guidSrCoreTracingControlGuid" ?c_guidSrCoreTracingControlGuid@@3U_GUID@@B
0x14000B340: VSSAPI_NULL_THUNK_DATA
0x140009798: "long __cdecl SxEnableTraceCustom(unsigned __int64,struct _GUID,unsigned long,unsigned long)" ?SxEnableTraceCustom@@YAJ_KU_GUID@@KK@Z
0x14000B458: "__cdecl _imp_NtQueryInformationFile" __imp_NtQueryInformationFile
0x14000B1F8: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x14000C0B8: "%s.0.?.%s" ??_C@_1BE@NEDGFOOO@?$AA?$CF?$AAs?$AA?4?$AA0?$AA?4?$AA?$DP?$AA?4?$AA?$CF?$AAs?$AA?$AA@
0x14000B5E8: c_wszTaskNameSafeDocs
0x14000BA90: "ExecuteScheduledSPPCreation" ??_C@_0BM@EFFACKBJ@ExecuteScheduledSPPCreation?$AA@
0x14000BFB8: "SrConvertSppGroupToSrRpProp" ??_C@_0BM@EPMMOJFJ@SrConvertSppGroupToSrRpProp?$AA@
0x14000E608: "__cdecl _native_startup_lock" __native_startup_lock
0x14000C1F0: "private: static unsigned short const * const CBsString::s_wszEmpty" ?s_wszEmpty@CBsString@@0QBGB
0x14000E5F0: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUhgliUhcUyhhgirmtUlyquivUznwGEUhgwzucOlyq@bsstring" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUhgliUhcUyhhgirmtUlyquivUznwGEUhgwzucOlyq@bsstring
0x14000A960: "__cdecl _CxxSetUnhandledExceptionFilter" __CxxSetUnhandledExceptionFilter
0x14000B3E8: "__cdecl _imp__wcsicmp" __imp__wcsicmp
0x14000A478: "long __cdecl SxLogEvent(unsigned short const * __ptr64,unsigned long,unsigned short,unsigned short,unsigned short const * __ptr64 * __ptr64 const,struct SX_EVENT_LOG_BINARY_DATA const * __ptr64)" ?SxLogEvent@@YAJPEBGKGGQEAPEBGPEBUSX_EVENT_LOG_BINARY_DATA@@@Z
0x1400013BC: "long __cdecl GetSnapshotsCount(unsigned long * __ptr64,unsigned long * __ptr64)" ?GetSnapshotsCount@@YAJPEAK0@Z
0x14000B398: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x140004C94: "long __cdecl SxRegReadDWORD(struct HKEY__ * __ptr64,unsigned short const * __ptr64,unsigned long * __ptr64,int)" ?SxRegReadDWORD@@YAJPEAUHKEY__@@PEBGPEAKH@Z
0x14000B420: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x14000B2A0: KERNEL32_NULL_THUNK_DATA
0x14000B250: "__cdecl _imp_GetLastError" __imp_GetLastError
0x14000A554: "void * __ptr64 __cdecl operator new(unsigned __int64)" ??2@YAPEAX_K@Z
0x14000B528: "struct _GUID const c_guidUdfdTracingControlGuid" ?c_guidUdfdTracingControlGuid@@3U_GUID@@B
0x14000BAD0: "GetRestorePointIndexToWaitFor" ??_C@_0BO@ENFJNBCI@GetRestorePointIndexToWaitFor?$AA@
0x140008B68: "long __cdecl SxCompressLogFile(unsigned short const * __ptr64)" ?SxCompressLogFile@@YAJPEBG@Z
0x14000AE08: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x14000B440: "__cdecl _imp_EtwTraceMessage" __imp_EtwTraceMessage
0x140005F94: GetLastFailureAsHRESULT
0x140004820: "long __cdecl SrPropStartTracing(unsigned short * __ptr64 * __ptr64,int)" ?SrPropStartTracing@@YAJPEAPEAGH@Z
0x14000B3A8: "__cdecl _imp__commode" __imp__commode
0x140009E74: "public: long __cdecl CBsString::Format(unsigned short const * __ptr64,...) __ptr64" ?Format@CBsString@@QEAAJPEBGZZ
0x14000B388: "__cdecl _imp___setusermatherr" __imp___setusermatherr
0x14000B400: "__cdecl _imp_strchr" __imp_strchr
0x14000CBE4: "__cdecl _IMPORT_DESCRIPTOR_ADVAPI32" __IMPORT_DESCRIPTOR_ADVAPI32
0x14000B908: "NULL" ??_C@_19CIJIHAKK@?$AAN?$AAU?$AAL?$AAL?$AA?$AA@
0x14000BEF0: "GetWMIBackupTask" ??_C@_0BB@OCPKEEOD@GetWMIBackupTask?$AA@
0x14000B278: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x14000B828: "CheckSREnabled" ??_C@_0P@NJJPACEB@CheckSREnabled?$AA@
0x14000A018: "private: long __cdecl CBsString::_Append(unsigned long,unsigned long,unsigned long * __ptr64 const,unsigned short const * __ptr64 * __ptr64 const) __ptr64" ?_Append@CBsString@@AEAAJKKQEAKQEAPEBG@Z
0x14000AB00: "__cdecl ValidateImageBase" _ValidateImageBase
0x14000E5E0: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxuyzhvUhgliUhcUhiUhigzhphUlyquivUznwGEUhigzhphsOlyq@srtasks" __@@_PchSym_@00@KxulyqvxgPillgKxuyzhvUhgliUhcUhiUhigzhphUlyquivUznwGEUhigzhphsOlyq@srtasks
0x140008EBC: "long __cdecl SxMergeExtraLogs(unsigned short const * __ptr64,unsigned long)" ?SxMergeExtraLogs@@YAJPEBGK@Z
0x14000B520: "\" ??_C@_13FPGAJAPJ@?$AA?2?$AA?$AA@
0x140001008: WPP_SF_
0x14000B1D0: "__cdecl _imp_GetVolumeNameForVolumeMountPointW" __imp_GetVolumeNameForVolumeMountPointW
0x14000C090: "SxGet0XLogFileCount" ??_C@_0BE@KHNIIEO@SxGet0XLogFileCount?$AA@
0x14000CC84: "__cdecl _IMPORT_DESCRIPTOR_ole32" __IMPORT_DESCRIPTOR_ole32
0x14000E060: "__cdecl newmode" _newmode
0x14000B548: "struct _GUID const c_guidSppTracingControlGuid" ?c_guidSppTracingControlGuid@@3U_GUID@@B
0x14000B5D8: "struct _GUID const c_guidAsrTracingControlGuid" ?c_guidAsrTracingControlGuid@@3U_GUID@@B
0x14000B390: "__cdecl _imp__initterm" __imp__initterm
0x14000B268: "__cdecl _imp_GetDiskFreeSpaceExW" __imp_GetDiskFreeSpaceExW
0x14000B920: "%SystemRoot%\Logs\SystemRestore" ??_C@_1EA@LPINFNCF@?$AA?$CF?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAo?$AAo?$AAt?$AA?$CF?$AA?2?$AAL?$AAo?$AAg?$AAs?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAe?$AAs?$AAt?$AAo?$AAr?$AAe?$AA?$AA@
0x14000B2F0: "__cdecl _imp_SxTracerDebuggerBreak" __imp_SxTracerDebuggerBreak
0x14000B368: "__cdecl _imp___set_app_type" __imp___set_app_type
0x14000B168: "__cdecl _imp_SetEntriesInAclW" __imp_SetEntriesInAclW
0x140007728: "long __cdecl SrValidateRestorePoint(struct _SR_RP_PROP const * __ptr64,int)" ?SrValidateRestorePoint@@YAJPEBU_SR_RP_PROP@@H@Z
0x140001700: "long __cdecl IsRpScoped(struct _SR_RP_PROP * __ptr64)" ?IsRpScoped@@YAJPEAU_SR_RP_PROP@@@Z
0x140006D24: "void __cdecl Free_SPP_CLIENT_PROP(struct _SPP_CLIENT_PROP * __ptr64)" ?Free_SPP_CLIENT_PROP@@YAXPEAU_SPP_CLIENT_PROP@@@Z
0x140007E80: WPP_SF_Ssddd
0x14000E5EC: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUhgliUhcUgizxrmtUlyquivUznwGEUhgwzucOlyq@tracing" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUhgliUhcUgizxrmtUlyquivUznwGEUhgwzucOlyq@tracing
0x140004F0C: "long __cdecl SxRegWriteULONGLONG(struct HKEY__ * __ptr64,unsigned short const * __ptr64,unsigned __int64)" ?SxRegWriteULONGLONG@@YAJPEAUHKEY__@@PEBG_K@Z
0x14000C130: "%s.0.%d.%s" ??_C@_1BG@NNKOBMJN@?$AA?$CF?$AAs?$AA?4?$AA0?$AA?4?$AA?$CF?$AAd?$AA?4?$AA?$CF?$AAs?$AA?$AA@
0x1400093E0: "long __cdecl SxStartTracing(unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned long,unsigned __int64 * __ptr64,unsigned short * __ptr64 * __ptr64)" ?SxStartTracing@@YAJPEBG0KPEA_KPEAPEAG@Z
0x14000B298: "__cdecl _imp_MoveFileExW" __imp_MoveFileExW
0x140009F6C: "public: long __cdecl CBsString::Append(unsigned short const * __ptr64,unsigned short const * __ptr64) __ptr64" ?Append@CBsString@@QEAAJPEBG0@Z
0x14000B170: "__cdecl _imp_InitializeSecurityDescriptor" __imp_InitializeSecurityDescriptor
0x14000B2D8: "__cdecl _imp_SxTracerShouldTrackFailure" __imp_SxTracerShouldTrackFailure
0x14000B8F8: WPP_ed7bfdac0bdb370687e9c72e67b674df_Traceguids
0x14000E5F8: "__cdecl _onexitend" __onexitend
0x14000B378: "__cdecl _imp__exit" __imp__exit
0x14000B4A8: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x140009EA8: "public: long __cdecl CBsString::Append(unsigned short const * __ptr64,unsigned long) __ptr64" ?Append@CBsString@@QEAAJPEBGK@Z
0x140005EF4: "long __cdecl SxCopyString(unsigned short const * __ptr64,unsigned short * __ptr64 * __ptr64)" ?SxCopyString@@YAJPEBGPEAPEAG@Z
0x14000B1B8: "__cdecl _imp_FindFirstFileW" __imp_FindFirstFileW
0x14000B914: "NULL" ??_C@_04HIBGFPH@NULL?$AA@
0x14000B1F0: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x14000B328: USER32_NULL_THUNK_DATA
0x14000C040: "FAILED" ??_C@_06OHCJKBJM@FAILED?$AA@
0x140005E68: HRESULTFromNTSTATUS
0x14000B190: "__cdecl _imp_RegisterEventSourceW" __imp_RegisterEventSourceW
0x140006DA4: "void __cdecl Free_SR_ENVIRONMENT_PROP(struct _SR_ENVIRONMENT_PROP * __ptr64)" ?Free_SR_ENVIRONMENT_PROP@@YAXPEAU_SR_ENVIRONMENT_PROP@@@Z
0x140001110: "long __cdecl CheckSREnabled(struct ISharedProtectionPoints * __ptr64,int * __ptr64,unsigned long * __ptr64)" ?CheckSREnabled@@YAJPEAUISharedProtectionPoints@@PEAHPEAK@Z
0x14000B448: "__cdecl _imp_RtlNtStatusToDosError" __imp_RtlNtStatusToDosError
0x14000A1F8: "public: void __cdecl CBsString::UnTrailing(unsigned short) __ptr64" ?UnTrailing@CBsString@@QEAAXG@Z
0x14000B4D0: "__cdecl _xi_a" __xi_a
0x14000C168: "%s.0.1.%s" ??_C@_1BE@MKPPGOFN@?$AA?$CF?$AAs?$AA?4?$AA0?$AA?4?$AA1?$AA?4?$AA?$CF?$AAs?$AA?$AA@
0x14000B208: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x1400099C8: "private: static long __cdecl CBsString::_AllocateData(unsigned long,unsigned short * __ptr64 * __ptr64,unsigned long * __ptr64)" ?_AllocateData@CBsString@@CAJKPEAPEAGPEAK@Z
0x140007CF8: ?Append@?$CSxArrayBuilder@PEAG$1?Free_String@@YAXPEAPEAG@Z$1??$SxDefaultInit@PEAG@@YAX0@Z$1??$SxDefaultTransfer@PEAG@@YAX00@Z@@QEAAJPEAPEAG@Z
0x14000AA40: "__cdecl matherr" _matherr
0x14000BE78: WPP_245ca6ba484f3b877d348a92c59d10f2_Traceguids
0x1400026F4: wmain
0x14000C240: IID_ITaskService
0x14000C058: "SxAllocateEventTraceProp" ??_C@_0BJ@GNNHEIAE@SxAllocateEventTraceProp?$AA@
0x140004BE8: "long __cdecl SrPropStopTracing(unsigned short const * __ptr64,unsigned char)" ?SrPropStopTracing@@YAJPEBGE@Z
0x14000B468: "__cdecl _imp_CoTaskMemFree" __imp_CoTaskMemFree
0x14000BEE0: WPP_fe0b416e53013f034f3eec1b5711a87b_Traceguids
0x14000B818: "struct _GUID const c_guidSrPropTracingControlGuid" ?c_guidSrPropTracingControlGuid@@3U_GUID@@B
0x140001068: WPP_SF_dd
0x14000B8C8: "PublishMaintenanceTasksSQM" ??_C@_0BL@MFDFJLHA@PublishMaintenanceTasksSQM?$AA@
0x1400084DC: "public: long __cdecl CSxFunctionTracer::LogEvent(unsigned short const * __ptr64,unsigned long,unsigned short,unsigned long,unsigned short,unsigned short const * __ptr64 * __ptr64 const)const __ptr64" ?LogEvent@CSxFunctionTracer@@QEBAJPEBGKGKGQEAPEBG@Z
0x14000BDF0: "::GetVolumeNameForVolumeMountPoi" ??_C@_0EH@IPBHDHIB@?3?3GetVolumeNameForVolumeMountPoi@
0x14000E000: WPP_GLOBAL_Control
0x14000B850: "IsRpScoped" ??_C@_0L@HHHKMGDE@IsRpScoped?$AA@
0x14000BBD4: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x14000B878: "GetBootVolumeSizeStats" ??_C@_0BH@BDFLDOKF@GetBootVolumeSizeStats?$AA@
0x14000102C: WPP_SF_D
0x14000102C: WPP_SF_d
0x14000C000: "__cdecl GUID_adcf3f49_521f_48a6_babc_8e20d5d3e861" _GUID_adcf3f49_521f_48a6_babc_8e20d5d3e861
0x14000B410: "__cdecl _imp_WinSqmAddToStreamEx" __imp_WinSqmAddToStreamEx
0x14000A548: "void __cdecl operator delete(void * __ptr64)" ??3@YAXPEAX@Z
0x140006CB4: "void __cdecl Free_StringArray(unsigned long * __ptr64,unsigned short * __ptr64 * __ptr64 * __ptr64)" ?Free_StringArray@@YAXPEAKPEAPEAPEAG@Z
0x14000A8D0: "__cdecl _security_check_cookie" __security_check_cookie
0x14000C100: "SxMergeExtraLogs" ??_C@_0BB@OODJBCN@SxMergeExtraLogs?$AA@
0x140006020: "long __cdecl GetWMIBackupTask(struct ITaskService * __ptr64,unsigned short const * __ptr64,struct IRegisteredTask * __ptr64 * __ptr64)" ?GetWMIBackupTask@@YAJPEAUITaskService@@PEBGPEAPEAUIRegisteredTask@@@Z
0x14000B4C8: "__cdecl _xc_z" __xc_z
0x14000BD90: "::GetVolumeNameForVolumeMountPoi" ??_C@_0FB@HOKIJDAC@?3?3GetVolumeNameForVolumeMountPoi@
0x1400096D4: "long __cdecl SxEnableTraceDefault(unsigned __int64,struct _GUID,unsigned long)" ?SxEnableTraceDefault@@YAJ_KU_GUID@@K@Z
0x14000182C: "long __cdecl GetRestorePointsCount(unsigned long * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64)" ?GetRestorePointsCount@@YAJPEAK00@Z
0x14000B780: s_cszSRTracingFlags
0x14000B3B0: "__cdecl _imp_?terminate@@YAXXZ" __imp_?terminate@@YAXXZ
0x14000B470: "__cdecl _imp_CoCreateInstance" __imp_CoCreateInstance
0x14000B260: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x14000B330: "__cdecl _imp_VssFreeSnapshotPropertiesInternal" __imp_VssFreeSnapshotPropertiesInternal
0x14000B198: "__cdecl _imp_ReportEventW" __imp_ReportEventW
0x14000297C: "long __cdecl _DeletePartialSPPGroups(struct ISharedProtectionPoints * __ptr64)" ?_DeletePartialSPPGroups@@YAJPEAUISharedProtectionPoints@@@Z
0x1400085E4: "public: void __cdecl CSxFunctionTracer::LogInfo(unsigned short const * __ptr64,unsigned long,unsigned short const * __ptr64,...)const __ptr64" ?LogInfo@CSxFunctionTracer@@QEBAXPEBGK0ZZ
0x14000B1B0: "__cdecl _imp_FindNextFileW" __imp_FindNextFileW
0x14000BB38: "ExecuteScopeRestorePoint" ??_C@_0BJ@FKMLPKIL@ExecuteScopeRestorePoint?$AA@
0x14000BC98: IID_ISrControl
0x14000BF28: WPP_3ecb873398023dec90d509ecbea0c42b_Traceguids
0x14000527C: "long __cdecl SxGetUniqueVolumeForPath(unsigned short const * __ptr64,unsigned short * __ptr64,unsigned long)" ?SxGetUniqueVolumeForPath@@YAJPEBGPEAGK@Z
0x14000B838: "GetSnapshotsCount" ??_C@_0BC@HEDDCBJA@GetSnapshotsCount?$AA@
0x14000BEB0: "SxShouldCreateScopedSnapshots" ??_C@_0BO@DKIGMBBP@SxShouldCreateScopedSnapshots?$AA@
0x140009A80: "private: long __cdecl CBsString::_CombinePathImpl(unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64) __ptr64" ?_CombinePathImpl@CBsString@@AEAAJPEBG000000000@Z
0x14000B1D8: "__cdecl _imp_GetVolumePathNameW" __imp_GetVolumePathNameW
0x14000B648: "struct _GUID const c_guidGuiTracingControlGuid" ?c_guidGuiTracingControlGuid@@3U_GUID@@B
0x14000B210: "__cdecl _imp_CreateDirectoryW" __imp_CreateDirectoryW
0x14000BCC8: IID_ISharedProtectionPoints
0x14000BB18: "WaitForRestorePointToAppear" ??_C@_0BM@PMCLCOBH@WaitForRestorePointToAppear?$AA@
0x14000BCA8: CLSID_SrDrvWuHelper
0x14000B538: "struct _GUID const c_guidSrClientTracingControlGuid" ?c_guidSrClientTracingControlGuid@@3U_GUID@@B
0x14000BF68: "_GetFileAttributesTag" ??_C@_0BG@OMCHLOLL@_GetFileAttributesTag?$AA@
0x14000B4F0: "__cdecl _guard_fids_table" __guard_fids_table
0x14000B178: "__cdecl _imp_CreateWellKnownSid" __imp_CreateWellKnownSid
0x14000B408: msvcrt_NULL_THUNK_DATA
0x14000B010: "__cdecl load_config_used" _load_config_used
0x140002BFC: "long __cdecl _DeleteOldSPPGroups(struct ISharedProtectionPoints * __ptr64)" ?_DeleteOldSPPGroups@@YAJPEAUISharedProtectionPoints@@@Z
0x14000E5E4: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUhgliUhcUfgrohUlyquivUznwGEUfgrohsOlyq@utils" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUhgliUhcUfgrohUlyquivUznwGEUfgrohsOlyq@utils
0x1400085B4: "public: void __cdecl CSxFunctionTracer::LogFailure(unsigned short const * __ptr64,unsigned long,unsigned short const * __ptr64,...)const __ptr64" ?LogFailure@CSxFunctionTracer@@QEBAXPEBGK0ZZ
0x14000BFD8: "SrValidateRestorePoint" ??_C@_0BH@BDIEIPNH@SrValidateRestorePoint?$AA@
0x14000B2F8: SPP_NULL_THUNK_DATA
0x14000679C: "long __cdecl SxDeleteFile(unsigned short const * __ptr64)" ?SxDeleteFile@@YAJPEBG@Z
0x14000BBC0: "SrPropStopTracing" ??_C@_0BC@BMNBAACE@SrPropStopTracing?$AA@
0x140005770: "long __cdecl SxGetBootVolume(unsigned short * __ptr64,unsigned long)" ?SxGetBootVolume@@YAJPEAGK@Z
0x14000B418: "__cdecl _imp_NtSetInformationProcess" __imp_NtSetInformationProcess
0x14000CC70: "__cdecl _IMPORT_DESCRIPTOR_USER32" __IMPORT_DESCRIPTOR_USER32
0x140009D50: "public: long __cdecl CBsString::FormatV(unsigned short const * __ptr64,char * __ptr64) __ptr64" ?FormatV@CBsString@@QEAAJPEBGPEAD@Z
0x14000BCD8: "SxRegReadDWORD" ??_C@_0P@CADLPMOB@SxRegReadDWORD?$AA@
0x14000B358: "__cdecl _imp__amsg_exit" __imp__amsg_exit
0x14000BD30: "SxGetUniqueVolumeForPath" ??_C@_0BJ@CLLECMMB@SxGetUniqueVolumeForPath?$AA@
0x140002448: WPP_SF_L_guid_I
0x14000BB78: "::DeleteFile( strTracingDirector" ??_C@_0CE@KDBLBOAH@?3?3DeleteFile?$CI?5strTracingDirector@
0x14000B320: "__cdecl _imp_LoadStringW" __imp_LoadStringW
0x14000B428: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x14000B280: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x14000BF38: "SxClearDifficultAttributes" ??_C@_0BL@KCBBCC@SxClearDifficultAttributes?$AA@
0x14000E05C: "__cdecl dowildcard" _dowildcard
0x140003B2C: "long __cdecl _ExecuteScopeRestorePoint(void)" ?_ExecuteScopeRestorePoint@@YAJXZ
0x140005AB8: "long __cdecl SxIsShadowCopyScoped(unsigned short const * __ptr64,unsigned char * __ptr64)" ?SxIsShadowCopyScoped@@YAJPEBGPEAE@Z
0x140002598: WPP_SF__guid_
0x14000A8F4: free
0x140007FE0: WPP_SF_sdd
0x14000B9B8: "BuiltInSrTasksTracing" ??_C@_1CM@PGFHANAP@?$AAB?$AAu?$AAi?$AAl?$AAt?$AAI?$AAn?$AAS?$AAr?$AAT?$AAa?$AAs?$AAk?$AAs?$AAT?$AAr?$AAa?$AAc?$AAi?$AAn?$AAg?$AA?$AA@
0x14000B1A0: "__cdecl _imp_DeregisterEventSource" __imp_DeregisterEventSource
0x1400061F4: "long __cdecl SxInitializeCOMSecurityForSPP(void)" ?SxInitializeCOMSecurityForSPP@@YAJXZ
0x140006694: "long __cdecl SxClearDifficultAttributes(unsigned short const * __ptr64,unsigned long * __ptr64)" ?SxClearDifficultAttributes@@YAJPEBGPEAK@Z
0x14000403C: "long __cdecl WaitForRestorePointToAppear(unsigned long,unsigned char * __ptr64)" ?WaitForRestorePointToAppear@@YAJKPEAE@Z
0x14000B158: "__cdecl _imp_SetSecurityDescriptorGroup" __imp_SetSecurityDescriptorGroup
0x1400020BC: "long __cdecl PublishMaintenanceTasksSQM(struct ISharedProtectionPoints * __ptr64)" ?PublishMaintenanceTasksSQM@@YAJPEAUISharedProtectionPoints@@@Z
0x140002624: WPP_SF_sSd
0x14000B438: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x140008158: "public: __cdecl CSxFunctionTracer::CSxFunctionTracer(char const * __ptr64,unsigned short,unsigned short) __ptr64" ??0CSxFunctionTracer@@QEAA@PEBDGG@Z
0x14000AC30: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x14000B1C8: "__cdecl _imp_ExpandEnvironmentStringsW" __imp_ExpandEnvironmentStringsW
0x14000A98C: RtlpImageNtHeader
0x14000B338: "__cdecl _imp_CreateVssBackupComponentsInternal" __imp_CreateVssBackupComponentsInternal
0x14000B130: "__cdecl _imp_ConvertStringSecurityDescriptorToSecurityDescriptorW" __imp_ConvertStringSecurityDescriptorToSecurityDescriptorW
0x140003E78: "unsigned long __cdecl GetRestorePointIndexToWaitFor(void)" ?GetRestorePointIndexToWaitFor@@YAKXZ
0x14000B258: "__cdecl _imp_GetModuleHandleW" __imp_GetModuleHandleW
0x14000B148: "__cdecl _imp_ControlTraceW" __imp_ControlTraceW
0x14000B478: "__cdecl _imp_CoTaskMemAlloc" __imp_CoTaskMemAlloc
0x14000BE68: "SxGetBootVolume" ??_C@_0BA@MPONBCFN@SxGetBootVolume?$AA@
0x14000BD00: "SxRegWriteULONGLONG" ??_C@_0BE@LCOMAGLB@SxRegWriteULONGLONG?$AA@
0x14000B2B8: "__cdecl _imp_SysStringLen" __imp_SysStringLen
0x14000BBA8: "SrPropStartTracing" ??_C@_0BD@DOIAOGDH@SrPropStartTracing?$AA@
0x14000B3E0: "__cdecl _imp__XcptFilter" __imp__XcptFilter
0x140009D14: "public: void __cdecl CBsString::BoundUpdateLength(unsigned long) __ptr64" ?BoundUpdateLength@CBsString@@QEAAXK@Z
0x14000BD18: "SxQueryGroupPolicy" ??_C@_0BD@IJEPMCPH@SxQueryGroupPolicy?$AA@
0x14000B460: ntdll_NULL_THUNK_DATA
0x140009A44: "private: void __cdecl CBsString::_Release(void) __ptr64" ?_Release@CBsString@@AEAAXXZ
0x14000B3F8: "__cdecl _imp_memcpy" __imp_memcpy
0x140006DDC: "void __cdecl Free_SR_RP_PROP(struct _SR_RP_PROP * __ptr64)" ?Free_SR_RP_PROP@@YAXPEAU_SR_RP_PROP@@@Z
0x140006D60: "void __cdecl Free_SR_VOLUME_PROP(struct _SR_VOLUME_PROP * __ptr64)" ?Free_SR_VOLUME_PROP@@YAXPEAU_SR_VOLUME_PROP@@@Z
0x140005E08: WPP_SF_Ddd
0x1400010B0: WPP_SF_ddd
0x14000C1D8: WPP_b8d9f9f0d7d03dc277d47c4b31e28c25_Traceguids
0x140007954: "long __cdecl SrTranslatePath(struct _SR_RP_PROP const * __ptr64,unsigned short const * __ptr64,class CBsString * __ptr64,class CBsString * __ptr64,class CBsString * __ptr64,class CBsString * __ptr64,unsigned long * __ptr64)" ?SrTranslatePath@@YAJPEBU_SR_RP_PROP@@PEBGPEAVCBsString@@222PEAK@Z
0x140006A7C: "long __cdecl SxSetFileAttributes(unsigned short const * __ptr64,unsigned long)" ?SxSetFileAttributes@@YAJPEBGK@Z
0x14000B7F8: c_wszEventSourceSystemRestore
0x140005588: "long __cdecl SxIsBootVolume(unsigned short const * __ptr64)" ?SxIsBootVolume@@YAJPEBG@Z
0x140009FDC: "public: long __cdecl CBsString::SetPath(unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64) __ptr64" ?SetPath@CBsString@@QEAAJPEBG000000000@Z
0x14000E018: "__cdecl _security_cookie" __security_cookie
0x14000B188: "__cdecl _imp_RegQueryValueExW" __imp_RegQueryValueExW
0x14000392C: "long __cdecl ExecuteScheduledSPPCreation(void)" ?ExecuteScheduledSPPCreation@@YAJXZ
0x14000B1C0: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x14000B138: "__cdecl _imp_EnableTraceEx2" __imp_EnableTraceEx2
0x14000C190: "SxEnableTraceDefault" ??_C@_0BF@EGPFLLK@SxEnableTraceDefault?$AA@
0x14000A1B4: "public: long __cdecl CBsString::Trailing(unsigned short) __ptr64" ?Trailing@CBsString@@QEAAJG@Z
0x14000B238: "__cdecl _imp_LocalFree" __imp_LocalFree
0x14000E010: "__cdecl _defaultmatherr" __defaultmatherr
0x14000B220: "__cdecl _imp_GetFileAttributesW" __imp_GetFileAttributesW
0x14000B450: "__cdecl _imp_RtlGetLastNtStatus" __imp_RtlGetLastNtStatus
0x14000B2A8: "__cdecl _imp_SysAllocString" __imp_SysAllocString
0x14000BA48: "_ExecuteScheduledSPPCreation" ??_C@_0BN@GCLHOHBL@_ExecuteScheduledSPPCreation?$AA@
0x14000BC78: WPP_73bac971349c35e76ca1a96ba970997b_Traceguids
0x14000E600: "__cdecl _onexitbegin" __onexitbegin
0x140002FE8: "long __cdecl _ExecuteScheduledSPPCreation(void)" ?_ExecuteScheduledSPPCreation@@YAJXZ
0x140009C60: "public: long __cdecl CBsString::ExtendBuffer(unsigned long) __ptr64" ?ExtendBuffer@CBsString@@QEAAJK@Z
0x14000B3D0: "__cdecl _imp__vsnwprintf" __imp__vsnwprintf
0x1400051A4: WPP_SF_qD
0x14000B890: "GetMainenanceTaskFrequency" ??_C@_0BL@PAJHEKBC@GetMainenanceTaskFrequency?$AA@
0x14000B288: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x140009F18: "public: long __cdecl CBsString::Append(unsigned short const * __ptr64) __ptr64" ?Append@CBsString@@QEAAJPEBG@Z
0x14000CBF8: "__cdecl _IMPORT_DESCRIPTOR_KERNEL32" __IMPORT_DESCRIPTOR_KERNEL32
0x14000B120: "__cdecl _imp_RegOpenKeyExW" __imp_RegOpenKeyExW
0x140008CB8: "long __cdecl SxCheckWBDiagSession(void)" ?SxCheckWBDiagSession@@YAJXZ
0x14000AB34: "__cdecl _security_init_cookie" __security_init_cookie
0x140001ED8: "long __cdecl GetRegistryKeySettings(unsigned char * __ptr64,unsigned long * __ptr64,unsigned char * __ptr64,unsigned long * __ptr64)" ?GetRegistryKeySettings@@YAJPEAEPEAK01@Z
0x14000BED0: WPP_f9c0a6e740bd3b44cc85582c3042fc62_Traceguids
0x14000B380: "__cdecl _imp__cexit" __imp__cexit
0x140007BE0: ?Append@?$CSxArrayBuilder@U_SR_VOLUME_PROP@@$1?Free_SR_VOLUME_PROP@@YAXPEAU1@@Z$1??$SxDefaultInit@U_SR_VOLUME_PROP@@@@YAX0@Z$1??$SxDefaultTransfer@U_SR_VOLUME_PROP@@@@YAX00@Z@@QEAAJPEAU_SR_VOLUME_PROP@@@Z
0x14000A9E8: "__cdecl get_image_app_type" _get_image_app_type
0x14000BA68: "0x%08x" ??_C@_1O@MNMPKDNM@?$AA0?$AAx?$AA?$CF?$AA0?$AA8?$AAx?$AA?$AA@
0x14000B150: "__cdecl _imp_SetSecurityDescriptorDacl" __imp_SetSecurityDescriptorDacl
0x14000CC48: "__cdecl _IMPORT_DESCRIPTOR_SRCLIENT" __IMPORT_DESCRIPTOR_SRCLIENT
0x14000CC0C: "__cdecl _IMPORT_DESCRIPTOR_msvcrt" __IMPORT_DESCRIPTOR_msvcrt
0x14000C180: "SxStopTracing" ??_C@_0O@NJPCLMKN@SxStopTracing?$AA@
0x14000B9E8: "SrTasks" ??_C@_1BA@MBOKNHHB@?$AAS?$AAr?$AAT?$AAa?$AAs?$AAk?$AAs?$AA?$AA@
0x140008268: "public: __cdecl CSxFunctionTracer::~CSxFunctionTracer(void) __ptr64" ??1CSxFunctionTracer@@QEAA@XZ
0x14000B490: "__cdecl _imp_CoTaskMemRealloc" __imp_CoTaskMemRealloc
0x14000A8A0: wmainCRTStartup
0x14000B548: CLSID_SPP
0x14000B350: "__cdecl _imp_malloc" __imp_malloc
0x14000B560: c_wszRegistryKey
0x14000B1A8: ADVAPI32_NULL_THUNK_DATA
0x14000BFA8: WPP_2e3e846db9fc3d2626ab6421027a8f10_Traceguids
0x14000C078: "SxQueryTraceSession" ??_C@_0BE@MKELCBLB@SxQueryTraceSession?$AA@
0x14000B308: SRCLIENT_NULL_THUNK_DATA
0x14000B230: "__cdecl _imp_GetTickCount64" __imp_GetTickCount64
0x14000C158: "SxStartTracing" ??_C@_0P@KKCBPOAP@SxStartTracing?$AA@
0x14000B430: "__cdecl _imp_NtSetInformationFile" __imp_NtSetInformationFile
0x14000C010: WPP_546d7c1786a234790e4aa592d8f1e5c5_Traceguids
0x140009150: "long __cdecl SxRotateLogs(unsigned short const * __ptr64,unsigned long)" ?SxRotateLogs@@YAJPEBGK@Z
0x14000AC80: "__cdecl _report_gsfailure" __report_gsfailure
0x14000BA30: "_DeleteOldSPPGroups" ??_C@_0BE@CNLIHMGE@_DeleteOldSPPGroups?$AA@
0x14000BE38: "SxIsBootVolume" ??_C@_0P@ODDLFFNK@SxIsBootVolume?$AA@
0x14000BAF0: "GetTimeToWaitForRestorePointToAp" ??_C@_0CF@LCGDNLCF@GetTimeToWaitForRestorePointToAp@
0x14000B140: "__cdecl _imp_StartTraceW" __imp_StartTraceW
0x14000E610: "__cdecl _native_startup_state" __native_startup_state
0x14000BE48: "%SystemDrive%\" ??_C@_1BO@FNBCDJKF@?$AA?$CF?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAD?$AAr?$AAi?$AAv?$AAe?$AA?$CF?$AA?2?$AA?$AA@
0x14000CC98: "__cdecl _IMPORT_DESCRIPTOR_SHELL32" __IMPORT_DESCRIPTOR_SHELL32
0x14000B3A0: "__cdecl _imp__fmode" __imp__fmode
0x14000B6B0: s_cszGroupPolicy
0x140001CEC: "long __cdecl GetMainenanceTaskFrequency(unsigned long * __ptr64)" ?GetMainenanceTaskFrequency@@YAJPEAK@Z
0x14000B2B0: "__cdecl _imp_SysFreeString" __imp_SysFreeString
0x14000BF80: "sh.IsValid()" ??_C@_0N@DFEAELIA@sh?4IsValid?$CI?$CJ?$AA@
0x14000BAB0: "_ExecuteScopeRestorePoint" ??_C@_0BK@PPIKCAPH@_ExecuteScopeRestorePoint?$AA@
0x140005204: WPP_SF_sd
0x14000251C: WPP_SF_SD
0x14000B3B8: "__cdecl _imp_free" __imp_free
0x14000AAA0: "__cdecl IsNonwritableInCurrentImage" _IsNonwritableInCurrentImage
0x140007F7C: WPP_SF_s
0x1400024B4: WPP_SF_S
0x14000AE99: memset
0x14000CCD4: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x14000B2E0: "__cdecl _imp_SxTracerGetThreadContextRetail" __imp_SxTracerGetThreadContextRetail
0x14000C1A8: "SxEnableTraceCustom" ??_C@_0BE@OCAJIOAO@SxEnableTraceCustom?$AA@

[JEB Decompiler by PNF Software]