Generated by JEB on 2019/08/01

PE: C:\Windows\System32\drivers\CEA.sys Base=0x1C0000000 SHA-256=2D4FCF60C929721BAB9500FB73E61BE141B4238ADF28EF4203180B891670F73B
PDB: CEA.pdb GUID={8DC8532D-08FF-0127-9036321CD368E44C} Age=1

322 located named symbols:
0x1C0011070: "__cdecl _imp_RtlInitUnicodeStringEx" __imp_RtlInitUnicodeStringEx
0x1C000BE78: "EventInfo" ??_C@_09BEELENHA@EventInfo?$AA@
0x1C0008BAC: EapQueryAggregatedEventTrigger
0x1C000A040: WppClassicProviderCallback
0x1C0012630: DllUnload
0x1C0005FF0: EapAggregatedEventConditionParamsNextChild
0x1C0005F90: EaDeleteAggregatedEvent
0x1C00110D0: "__cdecl _imp_RtlFreeUnicodeString" __imp_RtlFreeUnicodeString
0x1C00110F0: "__cdecl _imp_KeSetTimer" __imp_KeSetTimer
0x1C000F0B0: BrokerInternalClientInitOnce
0x1C00044E0: EaiFreeAggregationConditionVisitNode
0x1C0007A10: BriSignalBrokeredEvent
0x1C0002944: EaiSignalAggregateCallback
0x1C000F048: "__cdecl _security_cookie_complement" __security_cookie_complement
0x1C0012340: WppTraceCallback
0x1C000708C: BripCreateRpcBindingHandle
0x1C00012D0: "__cdecl TlgDefineProvider_annotation__TlgghEventAggregationProviderProv" _TlgDefineProvider_annotation__TlgghEventAggregationProviderProv
0x1C000118C: WPP_SF_L
0x1C00110C8: "__cdecl _imp_ZwEnumerateValueKey" __imp_ZwEnumerateValueKey
0x1C0011058: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x1C000A1F0: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x1C0009B00: EaQueryAggregatedEventParameters
0x1C0011098: "__cdecl _imp_RtlGetNextEntryHashTable" __imp_RtlGetNextEntryHashTable
0x1C00110E8: "__cdecl _imp_RtlInsertEntryHashTable" __imp_RtlInsertEntryHashTable
0x1C0012738: EaLibReleaseLockExclusive
0x1C000D0B8: "__cdecl TraceLoggingMetadata" _TraceLoggingMetadata
0x1C00126D8: EaLibGetCurrentThreadId
0x1C0011080: "__cdecl _imp_ZwEnumerateKey" __imp_ZwEnumerateKey
0x1C000C958: "WmiTraceMessage" ??_C@_1CA@OFIBBPKJ@?$AAW?$AAm?$AAi?$AAT?$AAr?$AAa?$AAc?$AAe?$AAM?$AAe?$AAs?$AAs?$AAa?$AAg?$AAe?$AA?$AA@
0x1C000F0B8: BrokeredEventTable
0x1C0005FF0: EapStoreAggregatedEventConditionNextChild
0x1C00019E0: EaiSetAggregationConditionVisitNode
0x1C000BFB8: "EaiDisableAggregateEvent" ??_C@_0BJ@EHMACGLH@EaiDisableAggregateEvent?$AA@
0x1C001275C: EaLibAcquireLockShared
0x1C000740C: BripFindBindingContextByBrokerId
0x1C0008100: EapQueryBuffer
0x1C0001008: "__cdecl TlgWrite" _TlgWrite
0x1C00111E8: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x1C000BF08: "Invalid callback type" ??_C@_0BG@LEGMCDDA@Invalid?5callback?5type?$AA@
0x1C0011110: "__cdecl _imp_ExQueueWorkItem" __imp_ExQueueWorkItem
0x1C00097C8: EapQueryAggregatedEventOwnerAppName
0x1C0009F60: EaDeleteAggregatedEventParametersPostVisitNode
0x1C0011168: "__cdecl _imp_ExAcquirePushLockSharedEx" __imp_ExAcquirePushLockSharedEx
0x1C0009890: EaStoreAggregatedEventParameters
0x1C0011158: "__cdecl _imp_MmGetSystemRoutineAddress" __imp_MmGetSystemRoutineAddress
0x1C000BF50: "Failed to allocate WNF state buf" ??_C@_0CE@MBKHCMBL@Failed?5to?5allocate?5WNF?5state?5buf@
0x1C000C240: "Failed to enable Aggregate Event" ??_C@_0CB@FFHFNOLK@Failed?5to?5enable?5Aggregate?5Event@
0x1C000F120: BrokerBindingTableLock
0x1C0002FC8: EaiSetAggregateConditionsEnabledState
0x1C000BF20: "EaiSignalAggregateEvent" ??_C@_0BI@OBMACIOF@EaiSignalAggregateEvent?$AA@
0x1C0005E40: EapDeleteAggregatedEventConditionVisitNode
0x1C000131C: CleanupLibrary
0x1C000BDB0: "Invalid Param. Pointer to condit" ??_C@_0FL@DHFCBKCF@Invalid?5Param?4?5Pointer?5to?5condit@
0x1C0005D48: EaiHandleTimeLimitReached
0x1C000C7F0: EA_STORE_AGGRERATED_EVENT_FIELD_START_BOUNDARY
0x1C00091F0: EapQueryAggregatedEventCondition
0x1C000C178: "EventHandle == NULL" ??_C@_0BE@PLHBLMKG@EventHandle?5?$DN?$DN?5NULL?$AA@
0x1C000C8B8: EA_STORE_AGGRERATED_EVENT_FIELD_DELAY_IN_SECONDS
0x1C000A200: memcpy
0x1C0011190: "__cdecl _imp_PsGetCurrentThreadId" __imp_PsGetCurrentThreadId
0x1C000C120: "Failed to add new Aggregate Even" ??_C@_0DG@OJPPFKID@Failed?5to?5add?5new?5Aggregate?5Even@
0x1C0012B50: EaLibClearAndReleaseTimer
0x1C0011018: "__cdecl _imp_UuidEqual" __imp_UuidEqual
0x1C00110F8: "__cdecl _imp_KeInitializeDpc" __imp_KeInitializeDpc
0x1C0009F90: EaDeleteAggregatedEventParameters
0x1C00111A8: "__cdecl _imp_RtlRemoveEntryHashTable" __imp_RtlRemoveEntryHashTable
0x1C000C858: EA_STORE_AGGRERATED_EVENT_FIELD_TRIGGER
0x1C000C268: "EaDisableAggregatedEvent" ??_C@_0BJ@MCCLIOGL@EaDisableAggregatedEvent?$AA@
0x1C00111C8: "__cdecl _imp_ZwSetValueKey" __imp_ZwSetValueKey
0x1C000F080: pfnWppGetVersion
0x1C0008F00: EapQueryAggregatedEventConditionCloseChild
0x1C0012C60: MIDL_user_free
0x1C001298C: EaLibQueryWnfStateData
0x1C0006560: EaCreateAggregatedEvent
0x1C00058A0: EaDisableAggregatedEvent
0x1C00129BC: EaLibSubscribeWnfStateChangeNotification
0x1C000C228: "EaEnableAggregatedEvent" ??_C@_0BI@ONGMJHEO@EaEnableAggregatedEvent?$AA@
0x1C000BFA8: "Failed Status" ??_C@_0O@PAPBEDEN@Failed?5Status?$AA@
0x1C000C440: RpcErrMap
0x1C000A200: memmove
0x1C000C868: EA_STORE_AGGRERATED_EVENT_FIELD_TIME_LIMIT
0x1C000A17C: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x1C0004810: EaiDuplicateAggregateRuntime
0x1C000C898: EA_STORE_AGGRERATED_EVENT_FIELD_OWNER_APP_NAME
0x1C0008CE8: EapStoreAggregatedEventTrigger
0x1C0005650: EaGetAggregation
0x1C000F0E0: WPP_MAIN_CB
0x1C0007564: BripFreeBindingContext
0x1C00073F0: BriFreeRpcBuffer
0x1C0007FA0: EapExpandValueQueryBuffer
0x1C0006630: BriAllocateRpcBuffer
0x1C00120D0: EaDecodeBrokeredEvent
0x1C0011100: "__cdecl _imp_EtwSetInformation" __imp_EtwSetInformation
0x1C000C1C0: "Failed to acquire Aggregate Even" ??_C@_0CP@EGFLGDGK@Failed?5to?5acquire?5Aggregate?5Even@
0x1C000C810: EA_STORE_PREDICATE_AND_STRING
0x1C000C288: "Failed to disable Event" ??_C@_0BI@NHGKOOIK@Failed?5to?5disable?5Event?$AA@
0x1C0011160: "__cdecl _imp_ExAllocatePoolWithTag" __imp_ExAllocatePoolWithTag
0x1C000BE88: "EaiProcessNotification" ??_C@_0BH@KAPMJJHH@EaiProcessNotification?$AA@
0x1C0004520: EaiFreeEaAggregateEvent
0x1C000F090: pfnWppQueryTraceInformation
0x1C000F140: AggregateEventListLock
0x1C000C080: "EaiCreateAggregation" ??_C@_0BF@FIKIOMKC@EaiCreateAggregation?$AA@
0x1C00111B0: "__cdecl _imp_EtwWriteTransfer" __imp_EtwWriteTransfer
0x1C000C2A0: "Failed to disable Aggregate Even" ??_C@_0CC@MMIMAKAA@Failed?5to?5disable?5Aggregate?5Even@
0x1C00081D4: EapQueryValue
0x1C0001870: EapAggregatedEventConditionNextChild
0x1C0008E10: EapQueryAggregatedEventConditionNextChild
0x1C000C428: g_SmsRouterBrokerId
0x1C00012E0: EaiRunOnceCallback
0x1C0012A38: EaLibCreateAndSetLimitTimer
0x1C000C890: EA_STORE_PREDICATE_OR_STRING
0x1C001279C: EaLibConvertLockSharedToExclusive
0x1C0007E98: EapCreateAggregatedEventNode
0x1C0008AA0: EapFreeAggregatedEventConditionPostVisitNode
0x1C00111B8: "__cdecl _imp_RtlCreateHashTable" __imp_RtlCreateHashTable
0x1C000A158: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x1C000C030: "Failed to allocate new Aggregate" ??_C@_0CH@FFJHKDNA@Failed?5to?5allocate?5new?5Aggregate@
0x1C000C010: "Invalid Param. pEventID is null" ??_C@_0CA@DCNAOGJA@Invalid?5Param?4?5pEventID?5is?5null?$AA@
0x1C000C938: "PsGetVersion" ??_C@_1BK@DHLDGJM@?$AAP?$AAs?$AAG?$AAe?$AAt?$AAV?$AAe?$AAr?$AAs?$AAi?$AAo?$AAn?$AA?$AA@
0x1C0011020: "__cdecl _imp_RpcBindingCreateW" __imp_RpcBindingCreateW
0x1C0007DDC: EapOpenAggregatedEventNode
0x1C000F068: pfnEtwRegisterClassicProvider
0x1C0011030: msrpc_NULL_THUNK_DATA
0x1C00069E0: BriCreateBrokeredEventEx
0x1C0006990: BriCreateBrokeredEvent
0x1C0011140: "__cdecl _imp_ExReleasePushLockSharedEx" __imp_ExReleasePushLockSharedEx
0x1C0012810: AggregateEventWnfCallback
0x1C00082EC: EapSetValue
0x1C0008254: EapQueryStringValue
0x1C0009420: EapStoreAggregatedEventConditionPreVisitNode
0x1C0009640: EapStoreAggregatedEventCondition
0x1C0007844: BripMapRpcStatus
0x1C000BEA0: "Event is Disabled" ??_C@_0BC@LLOAHHHF@Event?5is?5Disabled?$AA@
0x1C00010B0: WPP_SF_
0x1C000C058: "Failed to enable new Aggregate E" ??_C@_0CF@LKLGDOPK@Failed?5to?5enable?5new?5Aggregate?5E@
0x1C000C2E8: WPP_ThisDir_CTLGUID_EventAggregation
0x1C0011008: "__cdecl _imp_RpcBindingFree" __imp_RpcBindingFree
0x1C000F098: pfnEtwUnregister
0x1C001277C: EaLibReleaseLockShared
0x1C000C2C8: "EaiHandleTimeLimitReached" ??_C@_0BK@PFOJHFAH@EaiHandleTimeLimitReached?$AA@
0x1C0002C98: EaiSignalAggregateEvent
0x1C000BFF8: "EACreateAggregateEvent" ??_C@_0BH@OICECFID@EACreateAggregateEvent?$AA@
0x1C000637C: EapCreateAggregatedEvent
0x1C000F0A8: BrokerInternalClientInitialized
0x1C0011188: "__cdecl _imp_ExQueryWnfStateData" __imp_ExQueryWnfStateData
0x1C000C098: "EventHandle == NULL) or (Aggrega" ??_C@_0DD@HIDMBCGL@EventHandle?5?$DN?$DN?5NULL?$CJ?5or?5?$CIAggrega@
0x1C0012A1C: EaLibUnsubscribeWnfStateChangeNotification
0x1C000625C: EapCreateAggregatedEventCondition
0x1C0012708: EaLibAcquireLockExclusive
0x1C000CA08: WPP_42a965e6f0da3e90abab54604268a600_Traceguids
0x1C0015120: GsDriverEntry
0x1C00111E0: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x1C0003608: EaiDisableAggregateEvent
0x1C0007888: BripQueryValue
0x1C0007290: BriDeleteBrokeredEvent
0x1C0008024: EapEnumerateKey
0x1C000C158: "EaiExtractEventAggregation" ??_C@_0BL@CEEHFLGH@EaiExtractEventAggregation?$AA@
0x1C0011038: "__cdecl _imp_RtlNtStatusToDosError" __imp_RtlNtStatusToDosError
0x1C00049D0: EaCreateAggregation
0x1C000674C: BripCleanupBindingTable
0x1C00089D8: EapFreeSimpleEventParameters
0x1C00111A0: "__cdecl _imp_RtlInitEnumerationHashTable" __imp_RtlInitEnumerationHashTable
0x1C000BF78: "Cannot access Level Event value" ??_C@_0CA@EFBCDABD@Cannot?5access?5Level?5Event?5value?$AA@
0x1C0011068: "__cdecl _imp_RtlRunOnceExecuteOnce" __imp_RtlRunOnceExecuteOnce
0x1C000BEF0: "EaiSignalCallback" ??_C@_0BC@OHGJALBM@EaiSignalCallback?$AA@
0x1C0012C74: BrpDecodeBrokeredEvent_V1
0x1C0005C68: EaiFreeTriggerPayload
0x1C000F038: WPP_GLOBAL_Control
0x1C0011090: "__cdecl _imp_ZwQueryValueKey" __imp_ZwQueryValueKey
0x1C0012180: "__cdecl TlgEnableCallback" _TlgEnableCallback
0x1C00010E4: WPP_SF_D
0x1C00011DC: WPP_SF_d
0x1C000BE10: "Invalid Param. Both CallBack and" ??_C@_0DH@IMNJMDEF@Invalid?5Param?4?5Both?5CallBack?5and@
0x1C000C190: "Failed to find Event" ??_C@_0BF@COPNMOAB@Failed?5to?5find?5Event?$AA@
0x1C0005CA0: EaiResetTriggerPayload
0x1C00110B8: "__cdecl _imp_RtlCompareUnicodeString" __imp_RtlCompareUnicodeString
0x1C000A100: "__cdecl _security_check_cookie" __security_check_cookie
0x1C0005E94: EapDeleteAggregatedEventCondition
0x1C000BED0: "EaiSignalAggregateCallback" ??_C@_0BL@BEIGOOIB@EaiSignalAggregateCallback?$AA@
0x1C000C7B8: EA_STORE_AGGRERATED_EVENT_FIELD_IS_RANDOM
0x1C00111F0: "__cdecl _IMPORT_DESCRIPTOR_ntoskrnl" __IMPORT_DESCRIPTOR_ntoskrnl
0x1C00037F0: EACreateAggregateEvent
0x1C000E244: "__cdecl TraceLoggingMetadataEnd" _TraceLoggingMetadataEnd
0x1C000C900: EA_STORE_AGGRERATED_EVENT_FIELD_REPETITION_INTERVAL
0x1C00127E8: EaLibInitializeWnfSerialization
0x1C000C7D0: EA_STORE_AGGRERATED_EVENT_FIELD_OWNER_USER_SID
0x1C000C3F8: "AvailabilityStateName" ??_C@_1CM@GHANNOJL@?$AAA?$AAv?$AAa?$AAi?$AAl?$AAa?$AAb?$AAi?$AAl?$AAi?$AAt?$AAy?$AAS?$AAt?$AAa?$AAt?$AAe?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x1C0011204: "__cdecl _IMPORT_DESCRIPTOR_msrpc" __IMPORT_DESCRIPTOR_msrpc
0x1C0013298: BrpEncodeBrokeredEvent_V1
0x1C0008AE0: EaFreeAggregatedEventParameters
0x1C00079A0: BriResolveBrokerIdByEventId
0x1C0001AC8: WnfEventCallback
0x1C0005EF8: EapDeleteAggregatedEvent
0x1C0008870: EapStoreSimpleEventParameters
0x1C000C8E8: EA_STORE_AGGRERATED_EVENT_FIELD_END_BOUNDARY
0x1C0001A20: EaiEvaluateConditions
0x1C000C830: EA_STORE_AGGRERATED_EVENT_FIELD_NUMBER_OF_REPETITIONS
0x1C0003EA0: EADeleteAggregateEvent
0x1C000762C: BripQueryBindingContextProperties
0x1C000BD18: "Invalid Param. Allowed Flags are" ??_C@_0CJ@FIEHEEPH@Invalid?5Param?4?5Allowed?5Flags?5are@
0x1C00044D0: EaQueryAggregatedEvent
0x1C0011088: "__cdecl _imp_RtlComputeCrc32" __imp_RtlComputeCrc32
0x1C0008F30: EapQueryAggregatedEventConditionPostVisitNode
0x1C0001870: EaiAggregationConditionNextChild
0x1C0011138: "__cdecl _imp_EtwUnregister" __imp_EtwUnregister
0x1C0016000: "__cdecl _guard_fids_table" __guard_fids_table
0x1C0009E70: EaDeleteAggregatedEventParametersNextChild
0x1C000BBF0: "__cdecl load_config_used" _load_config_used
0x1C000BD00: "EaiValidateParameters" ??_C@_0BG@ECKEKMPA@EaiValidateParameters?$AA@
0x1C000C818: EA_STORE_AGGRERATED_EVENT_FIELD_CONDITION
0x1C00110A0: "__cdecl _imp_ZwClose" __imp_ZwClose
0x1C0011128: "__cdecl _imp_ExReleasePushLockExclusiveEx" __imp_ExReleasePushLockExclusiveEx
0x1C0012BC0: EaLibTimeLimitCallbackWorker
0x1C0004AD8: EaiCreateAggregation
0x1C0011048: "__cdecl _imp_RtlDeleteHashTable" __imp_RtlDeleteHashTable
0x1C0011198: "__cdecl _imp_wcsnlen" __imp_wcsnlen
0x1C0002E64: EaiFindAndAcquireAggregateEvent
0x1C0011130: "__cdecl _imp_ExSubscribeWnfStateChange" __imp_ExSubscribeWnfStateChange
0x1C0006650: BriIsBrokerRegistered
0x1C0007B60: EaFreeBuffer
0x1C0011108: "__cdecl _imp_ZwQueryWnfStateData" __imp_ZwQueryWnfStateData
0x1C000BE48: "WnfEventCallback" ??_C@_0BB@NDOGNILF@WnfEventCallback?$AA@
0x1C000C978: "WmiQueryTraceInformation" ??_C@_1DC@DOCOAJH@?$AAW?$AAm?$AAi?$AAQ?$AAu?$AAe?$AAr?$AAy?$AAT?$AAr?$AAa?$AAc?$AAe?$AAI?$AAn?$AAf?$AAo?$AAr?$AAm?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x1C0011050: "__cdecl _imp_RtlValidSid" __imp_RtlValidSid
0x1C000C9E8: "EtwUnregister" ??_C@_1BM@CJMKDOJH@?$AAE?$AAt?$AAw?$AAU?$AAn?$AAr?$AAe?$AAg?$AAi?$AAs?$AAt?$AAe?$AAr?$AA?$AA@
0x1C0007790: BrpInitOnceRunOnceCallback
0x1C000BF38: "EaiEnableAggregateEvent" ??_C@_0BI@PDLNEGIJ@EaiEnableAggregateEvent?$AA@
0x1C000C1A8: "EaDeleteAggregation" ??_C@_0BE@LDOBFKEI@EaDeleteAggregation?$AA@
0x1C0005310: EaDeleteAggregation
0x1C00030BC: EaiEnableAggregateEvent
0x1C0012C40: MIDL_user_allocate
0x1C000A140: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x1C00111D0: "__cdecl _imp_RtlEnumerateEntryHashTable" __imp_RtlEnumerateEntryHashTable
0x1C00110C0: "__cdecl _imp_RtlGUIDFromString" __imp_RtlGUIDFromString
0x1C000F130: BrokeredEventTableLock
0x1C00040C0: EAQueryAggregateEventData
0x1C0012200: WppLoadTracingSupport
0x1C0011180: "__cdecl _imp_IoWMIRegistrationControl" __imp_IoWMIRegistrationControl
0x1C0006020: EapCreateAggregatedEventConditionVisitNode
0x1C0011010: "__cdecl _imp_RpcBindingBind" __imp_RpcBindingBind
0x1C000C3D8: "ServerPrincipal" ??_C@_1CA@MNMMPMHI@?$AAS?$AAe?$AAr?$AAv?$AAe?$AAr?$AAP?$AAr?$AAi?$AAn?$AAc?$AAi?$AAp?$AAa?$AAl?$AA?$AA@
0x1C0003F20: EAEnumerateAggregateEvents
0x1C0007B60: EaLibFree
0x1C0001128: WPP_SF_DDD
0x1C0001224: WPP_SF_ddd
0x1C000BFD8: "Event set to be disabled" ??_C@_0BJ@ELNKIKHO@Event?5set?5to?5be?5disabled?$AA@
0x1C00110E0: "__cdecl _imp_ZwDeleteKey" __imp_ZwDeleteKey
0x1C000F040: "__cdecl _security_cookie" __security_cookie
0x1C0011150: "__cdecl _imp_KeCancelTimer" __imp_KeCancelTimer
0x1C0006DEC: BripCreateBindingContext
0x1C000C2F8: WPP_c3fa72ab62343567ce2c56b1499dbae5_Traceguids
0x1C0007014: BriDeleteEventImpl
0x1C00110B0: "__cdecl _imp_RtlCompareMemory" __imp_RtlCompareMemory
0x1C00075B8: BripGetEventContextData
0x1C000C9B0: "EtwRegisterClassicProvider" ??_C@_1DG@PFOPAIND@?$AAE?$AAt?$AAw?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAe?$AAr?$AAC?$AAl?$AAa?$AAs?$AAs?$AAi?$AAc?$AAP?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AA?$AA@
0x1C000BF98: "OnEnable Event" ??_C@_0P@BFJEKIOA@OnEnable?5Event?$AA@
0x1C000683C: BripCleanupEventTable
0x1C0002F50: EaiSetConditionsEnabledStateVisitNode
0x1C0002EF0: EaiReleaseAggregateEvent
0x1C0006CF4: BripCreateEventContext
0x1C0011148: "__cdecl _imp_ExUnsubscribeWnfStateChange" __imp_ExUnsubscribeWnfStateChange
0x1C0011118: "__cdecl _imp_KeInitializeTimer" __imp_KeInitializeTimer
0x1C0015020: DllInitialize
0x1C00126F4: EaLibLockInitialize
0x1C000BD80: "Invalid Param. No trigger and no" ??_C@_0CL@BMINNCGJ@Invalid?5Param?4?5No?5trigger?5and?5no@
0x1C0011078: "__cdecl _imp_RtlStringFromGUID" __imp_RtlStringFromGUID
0x1C00050C0: EaiExtractEventAggregation
0x1C000BD48: "Invalid Param. Number of conditi" ??_C@_0DC@DNOIOCFD@Invalid?5Param?4?5Number?5of?5conditi@
0x1C0015154: "__cdecl _security_init_cookie" __security_init_cookie
0x1C0001288: WPP_SF_q
0x1C0011170: "__cdecl _imp_EtwRegister" __imp_EtwRegister
0x1C0008354: EapQuerySimpleEventParameters
0x1C000F088: WPPTraceSuite
0x1C00042B0: EaSignalAggregatedEvent
0x1C0005FF0: EapFreeAggregatedEventConditionNextChild
0x1C0009600: EapStoreAggregatedEventConditionPostVisitNode
0x1C000A074: EaLibAllocate
0x1C0001494: EaiValidateParameters
0x1C0005B90: EaQueryAggregateEventConditionState
0x1C0011120: "__cdecl _imp_ExAcquirePushLockExclusiveEx" __imp_ExAcquirePushLockExclusiveEx
0x1C0011060: "__cdecl _imp_RtlLengthSid" __imp_RtlLengthSid
0x1C000F078: AggregateInitOnce
0x1C0002A8C: EaiSignalCallback
0x1C0012C60: EaRtlFreeStringRoutine
0x1C000C3C0: "ServerAuth" ??_C@_1BG@HCDEBCJD@?$AAS?$AAe?$AAr?$AAv?$AAe?$AAr?$AAA?$AAu?$AAt?$AAh?$AA?$AA@
0x1C000A130: "__cdecl _report_gsfailure" __report_gsfailure
0x1C0006AB0: BripCreateBrokeredEvent
0x1C000A0B0: EaLibTimeLimitCallback
0x1C00110D8: "__cdecl _imp_ZwCreateKey" __imp_ZwCreateKey
0x1C000BE60: "WNF event is deleted" ??_C@_0BF@CKLJKECG@WNF?5event?5is?5deleted?$AA@
0x1C000BEB8: "No matching condition" ??_C@_0BG@GPHOGGMF@No?5matching?5condition?$AA@
0x1C000C310: "\Registry\Machine\Software\Micro" ??_C@_1KO@LILNALMB@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x1C00111D8: ntoskrnl_NULL_THUNK_DATA
0x1C0011178: "__cdecl _imp_ExFreePoolWithTag" __imp_ExFreePoolWithTag
0x1C0005670: EaEnableAggregatedEvent
0x1C0006720: BriCleanup
0x1C0011028: "__cdecl _imp_NdrClientCall3" __imp_NdrClientCall3
0x1C00111C0: "__cdecl _imp_RtlEndEnumerationHashTable" __imp_RtlEndEnumerationHashTable
0x1C0011000: "__cdecl _imp_UuidCreate" __imp_UuidCreate
0x1C000C0D0: "(AggregatedRuntime->Trigger == N" ??_C@_0FA@KOEGCJHB@?$CIAggregatedRuntime?9?$DOTrigger?5?$DN?$DN?5N@
0x1C0007B80: EapTreeTraverse
0x1C00020C8: EaiProcessNotification
0x1C0008F00: EaDeleteAggregatedEventParametersCloseChild
0x1C0015008: DriverEntry
0x1C00045D0: EaiDuplicateConditionsVisitNode
0x1C000C1F0: "Failed to disable Aggregate Even" ??_C@_0DC@LFEIPDNN@Failed?5to?5disable?5Aggregate?5Even@
0x1C0012010: EaEncodeBrokeredEvent
0x1C0011040: "__cdecl _imp_RtlLookupEntryHashTable" __imp_RtlLookupEntryHashTable
0x1C000F070: pfnWppTraceMessage
0x1C00074B4: BripFindEventContextByEventId
0x1C00110A8: "__cdecl _imp_ZwOpenKey" __imp_ZwOpenKey
0x1C0012594: WppInitKm
0x1C000F0A0: BrokerBindingTable
0x1C000A540: memset
0x1C0011218: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x1C00018A0: EaiEvaluateAggregationConditionVisitNode

[JEB Decompiler by PNF Software]