Generated by JEB on 2019/08/01

PE: C:\Windows\WinSxS\amd64_windows-defender-management-v1_31bf3856ad364e35_10.0.17763.1_none_0b6b7c5b60730a9e\AMMonitoringProvider.dll Base=0x180000000 SHA-256=2F37D478C79CF049C4AD237CF1B7A02E109DB487971D13A8A0DE532859F52D1C
PDB: AMMonitoringProvider.pdb GUID={527AA29A-EE24-D4FC-87A11BDB65A83520} Age=1

2066 located named symbols:
0x18000F314: MpManagerOpen
0x180020DB0: WINTRUST_NULL_THUNK_DATA
0x180022160: "__cdecl GUID_00000001_0000_0000_c000_000000000046" _GUID_00000001_0000_0000_c000_000000000046
0x18000A780: "protected: virtual void * __ptr64 __cdecl CommonUtil::CRefObject::`vector deleting destructor'(unsigned int) __ptr64" ??_ECRefObject@CommonUtil@@MEAAPEAXI@Z
0x18001001C: "long __cdecl CommonUtil::HrFromStdException(class exception const & __ptr64)" ?HrFromStdException@CommonUtil@@YAJAEBVexception@@@Z
0x180014700: "protected: virtual int __cdecl MorroCommon::CWin32::PostMessageImpl(struct HWND__ * __ptr64,unsigned int,unsigned __int64,__int64) __ptr64" ?PostMessageImpl@CWin32@MorroCommon@@MEAAHPEAUHWND__@@I_K_J@Z
0x180020968: "__cdecl _imp_LockResource" __imp_LockResource
0x1800207C0: "__cdecl _imp_UnregisterTraceGuids" __imp_UnregisterTraceGuids
0x18000FD00: "public: __cdecl CommonUtil::CGenericAutoLock<struct CommonUtil::CMpCriticalSectionFunctor>::~CGenericAutoLock<struct CommonUtil::CMpCriticalSectionFunctor>(void) __ptr64" ??1?$CGenericAutoLock@UCMpCriticalSectionFunctor@CommonUtil@@@CommonUtil@@QEAA@XZ
0x180021CC8: "illegal byte sequence" ??_C@_0BG@CDNPAGJK@illegal?5byte?5sequence?$AA@
0x1800087F8: "public: class MorroCommon::CFileUtils * __ptr64 __cdecl MorroCommon::TSingletonWithProxy<class MorroCommon::CFileUtils>::operator->(void) __ptr64" ??C?$TSingletonWithProxy@VCFileUtils@MorroCommon@@@MorroCommon@@QEAAPEAVCFileUtils@1@XZ
0x18001B708: "__cdecl _raise_securityfailure" __raise_securityfailure
0x180015030: "protected: virtual int __cdecl MorroCommon::CWin32::SetEventImpl(void * __ptr64) __ptr64" ?SetEventImpl@CWin32@MorroCommon@@MEAAHPEAX@Z
0x180022078: "Enter to" ??_C@_08JKDBNODE@Enter?5to?$AA@
0x18001ADF4: "public: __cdecl std::out_of_range::out_of_range(char const * __ptr64) __ptr64" ??0out_of_range@std@@QEAA@PEBD@Z
0x180020DE8: mpclient_NULL_THUNK_DATA
0x1800217B0: "function not supported" ??_C@_0BH@KEFGLDAF@function?5not?5supported?$AA@
0x180020908: "__cdecl _imp_GetThreadLocale" __imp_GetThreadLocale
0x18001BB80: "__cdecl FindPESection" _FindPESection
0x180007C70: "public: virtual __cdecl std::bad_alloc::~bad_alloc(void) __ptr64" ??1bad_alloc@std@@UEAA@XZ
0x1800218F8: "connection_aborted" ??_C@_0BD@OJMJDIGI@connection_aborted?$AA@
0x180002930: "public: virtual long __cdecl ATL::IWbemInstProviderImpl::CreateClassEnumAsync(unsigned short * __ptr64 const,long,struct IWbemContext * __ptr64,struct IWbemObjectSink * __ptr64) __ptr64" ?CreateClassEnumAsync@IWbemInstProviderImpl@ATL@@UEAAJQEAGJPEAUIWbemContext@@PEAUIWbemObjectSink@@@Z
0x180010FA0: "long __cdecl CommonUtil::NewVSprintfW(unsigned short * __ptr64 * __ptr64,unsigned short const * __ptr64,char * __ptr64)" ?NewVSprintfW@CommonUtil@@YAJPEAPEAGPEBGPEAD@Z
0x18000FDD0: "protected: virtual void * __ptr64 __cdecl CommonUtil::CHResultException::`scalar deleting destructor'(unsigned int) __ptr64" ??_GCHResultException@CommonUtil@@MEAAPEAXI@Z
0x180020840: "__cdecl _imp_AllocateAndInitializeSid" __imp_AllocateAndInitializeSid
0x180020F90: "__cdecl _imp_CoCreateGuid" __imp_CoCreateGuid
0x180015210: ?SHGetSpecialFolderLocationImpl@CWin32@MorroCommon@@MEAAJPEAUHWND__@@HPEAPEFAU_ITEMIDLIST@@@Z
0x180015FD0: "protected: virtual class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > const & __ptr64 __cdecl MorroCommon::CPathUtils::GetCurrentModulePathImpl(void) __ptr64" ?GetCurrentModulePathImpl@CPathUtils@MorroCommon@@MEAAAEBV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@XZ
0x1800091CC: "public: static class CommonUtil::AutoRef<class Microsoft::SecurityClient::CMalwareProviderEventLogger> __cdecl Microsoft::SecurityClient::CMalwareProviderEventLogger::CreateInstance(void)" ?CreateInstance@CMalwareProviderEventLogger@SecurityClient@Microsoft@@SA?AV?$AutoRef@VCMalwareProviderEventLogger@SecurityClient@Microsoft@@@CommonUtil@@XZ
0x1800153B0: "protected: virtual int __cdecl MorroCommon::CWin32::WTSQueryUserTokenImpl(unsigned long,void * __ptr64 * __ptr64) __ptr64" ?WTSQueryUserTokenImpl@CWin32@MorroCommon@@MEAAHKPEAPEAX@Z
0x180023518: WPP_da4900b5adbf31a20bb2b78f4b9ed990_Traceguids
0x18002D910: "private: static class MorroCommon::CPathUtils * __ptr64 __ptr64 MorroCommon::TSingletonWithProxy<class MorroCommon::CPathUtils>::mts_proxy" ?mts_proxy@?$TSingletonWithProxy@VCPathUtils@MorroCommon@@@MorroCommon@@0PEAVCPathUtils@2@EA
0x180006DA4: "public: __cdecl CommonUtil::CStdVector<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> >,class std::allocator<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > > >::~CStdVector<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> >,class std::allocator<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > > >(void) __ptr64" ??1?$CStdVector@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$allocator@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@@std@@@CommonUtil@@QEAA@XZ
0x180020E90: "__cdecl _imp_??1exception@@UEAA@XZ" __imp_??1exception@@UEAA@XZ
0x1800148E0: "protected: virtual int __cdecl MorroCommon::CWin32::DuplicateTokenExImpl(void * __ptr64,unsigned long,struct _SECURITY_ATTRIBUTES * __ptr64,enum _SECURITY_IMPERSONATION_LEVEL,enum _TOKEN_TYPE,void * __ptr64 * __ptr64) __ptr64" ?DuplicateTokenExImpl@CWin32@MorroCommon@@MEAAHPEAXKPEAU_SECURITY_ATTRIBUTES@@W4_SECURITY_IMPERSONATION_LEVEL@@W4_TOKEN_TYPE@@PEAPEAX@Z
0x180029F18: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x180020E70: "__cdecl _imp_??0exception@@QEAA@XZ" __imp_??0exception@@QEAA@XZ
0x180021FA8: "too many files open in system" ??_C@_0BO@HACHBEKI@too?5many?5files?5open?5in?5system?$AA@
0x180024FF8: "__vectorcall ??_R1A@?0A@EA@?$CAtlValidateModuleConfiguration@$00VCMalwareProviderDllModule@@@ATL" ??_R1A@?0A@EA@?$CAtlValidateModuleConfiguration@$00VCMalwareProviderDllModule@@@ATL@@8
0x180021C98: "host unreachable" ??_C@_0BB@DHFDFGDM@host?5unreachable?$AA@
0x180002930: "public: virtual long __cdecl ATL::IWbemInstProviderImpl::OpenNamespace(unsigned short * __ptr64 const,long,struct IWbemContext * __ptr64,struct IWbemServices * __ptr64 * __ptr64,struct IWbemCallResult * __ptr64 * __ptr64) __ptr64" ?OpenNamespace@IWbemInstProviderImpl@ATL@@UEAAJQEAGJPEAUIWbemContext@@PEAPEAUIWbemServices@@PEAPEAUIWbemCallResult@@@Z
0x1800127B0: "protected: virtual long __cdecl MorroCommon::CFileUtils::DeleteFolderImpl(class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > const & __ptr64) __ptr64" ?DeleteFolderImpl@CFileUtils@MorroCommon@@MEAAJAEBV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@@Z
0x1800143D0: "protected: virtual long __cdecl MorroCommon::CWin32::RegCloseKeyImpl(struct HKEY__ * __ptr64) __ptr64" ?RegCloseKeyImpl@CWin32@MorroCommon@@MEAAJPEAUHKEY__@@@Z
0x18002C420: "__vectorcall ??_R0?AU_ATL_MODULE70@ATL@" ??_R0?AU_ATL_MODULE70@ATL@@@8
0x180026018: "__vectorcall ??_R2CPtrObjectProcessHeap@CommonUtil" ??_R2CPtrObjectProcessHeap@CommonUtil@@8
0x180025F68: "__vectorcall ??_R3CPtrObjectProcessHeap@CommonUtil" ??_R3CPtrObjectProcessHeap@CommonUtil@@8
0x180002920: "[thunk]:public: virtual unsigned long __cdecl ATL::CComObject<class CMalwareProvider>::Release`adjustor{8}' (void) __ptr64" ?Release@?$CComObject@VCMalwareProvider@@@ATL@@W7EAAKXZ
0x180025A08: "const Microsoft::SecurityClient::CMalwareProviderConfiguration::`RTTI Complete Object Locator'" ??_R4CMalwareProviderConfiguration@SecurityClient@Microsoft@@6B@
0x1800114C0: "long __cdecl CommonUtil::UtilLoadSystemLibrary(struct HINSTANCE__ * __ptr64 * __ptr64,unsigned short const * __ptr64)" ?UtilLoadSystemLibrary@CommonUtil@@YAJPEAPEAUHINSTANCE__@@PEBG@Z
0x1800031C8: "long __cdecl ATL::AtlHresultFromLastError(void)" ?AtlHresultFromLastError@ATL@@YAJXZ
0x18001FDD0: "const Microsoft::SecurityClient::CMalwareProviderEventLogger::`vftable'{for `CommonUtil::CRefObject'}" ??_7CMalwareProviderEventLogger@SecurityClient@Microsoft@@6BCRefObject@CommonUtil@@@
0x1800254D0: "__vectorcall ??_R1A@?0A@EA@CRegObject@ATL" ??_R1A@?0A@EA@CRegObject@ATL@@8
0x180015470: "protected: virtual void __cdecl MorroCommon::CWin32::GetLocalTimeImpl(struct _SYSTEMTIME * __ptr64) __ptr64" ?GetLocalTimeImpl@CWin32@MorroCommon@@MEAAXPEAU_SYSTEMTIME@@@Z
0x180020B00: "__cdecl _imp_IsWow64Process" __imp_IsWow64Process
0x180021B58: "already connected" ??_C@_0BC@DFIBIBIL@already?5connected?$AA@
0x180009B48: "protected: void __cdecl std::vector<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> >,class std::allocator<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > > >::_Reallocate(unsigned __int64) __ptr64" ?_Reallocate@?$vector@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$allocator@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@@std@@@std@@IEAAX_K@Z
0x180021EC0: "operation would block" ??_C@_0BG@OEMDKMEE@operation?5would?5block?$AA@
0x18002CEB0: "__cdecl _security_cookie_complement" __security_cookie_complement
0x180020AA0: "__cdecl _imp_RaiseException" __imp_RaiseException
0x180007468: "public: __cdecl ATL::CSimpleStringT<unsigned short,0>::operator unsigned short const * __ptr64(void)const __ptr64" ??B?$CSimpleStringT@G$0A@@ATL@@QEBAPEBGXZ
0x180020EC8: "__cdecl _imp_wcsncpy_s" __imp_wcsncpy_s
0x180020F10: "__cdecl _imp__vscwprintf" __imp__vscwprintf
0x180001FC0: "public: static long __cdecl CMalwareProvider::UpdateRegistry(int)" ?UpdateRegistry@CMalwareProvider@@SAJH@Z
0x18000B540: WPP_SF_LL
0x18001FA80: "const std::_System_error_category::`vftable'" ??_7_System_error_category@std@@6B@
0x180022C60: "PackedXml" ??_C@_1BE@NFEFJPBP@?$AAP?$AAa?$AAc?$AAk?$AAe?$AAd?$AAX?$AAm?$AAl?$AA?$AA@
0x180020A88: "__cdecl _imp_HeapDestroy" __imp_HeapDestroy
0x180024E68: "__vectorcall ??_R17?0A@EC@IUnknown" ??_R17?0A@EC@IUnknown@@8
0x180025D70: "__vectorcall ??_R1A@?0A@EA@ILockedCertCheck@MorroCommon" ??_R1A@?0A@EA@ILockedCertCheck@MorroCommon@@8
0x18000B634: WPP_SF_LS
0x1800206D8: "__cdecl tls_used" _tls_used
0x180022394: "B" ??_C@_13OPKGLAFF@?$AAB?$AA?$AA@
0x180022090: "ForceRemove" ??_C@_1BI@JFAIJMHL@?$AAF?$AAo?$AAr?$AAc?$AAe?$AAR?$AAe?$AAm?$AAo?$AAv?$AAe?$AA?$AA@
0x180015290: "protected: virtual int __cdecl MorroCommon::CWin32::DestroyEnvironmentBlockImpl(void * __ptr64) __ptr64" ?DestroyEnvironmentBlockImpl@CWin32@MorroCommon@@MEAAHPEAX@Z
0x180006E38: "public: class std::_Tree_iterator<class std::_Tree_val<struct std::_Tree_simple_types<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> > > > > __cdecl std::_Tree<class std::_Tmap_traits<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> >,class CommonUtil::AutoRef<struct IWbemClassObject>,struct std::less<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > >,class std::allocator<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> > >,0> >::erase(class std::_Tree_const_iterator<class std::_Tree_val<struct std::_Tree_simple_types<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> > > > >) __ptr64" ?erase@?$_Tree@V?$_Tmap_traits@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@U?$less@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@@std@@V?$allocator@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@@5@$0A@@std@@@std@@QEAA?AV?$_Tree_iterator@V?$_Tree_val@U?$_Tree_simple_types@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@@std@@@std@@@2@V?$_Tree_const_iterator@V?$_Tree_val@U?$_Tree_simple_types@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@@std@@@std@@@2@@Z
0x180002680: "public: virtual unsigned long __cdecl ATL::CComObjectCached<class ATL::CComClassFactory>::AddRef(void) __ptr64" ?AddRef@?$CComObjectCached@VCComClassFactory@ATL@@@ATL@@UEAAKXZ
0x18001AF9C: "__cdecl CRT_INIT" _CRT_INIT
0x180020E68: "__cdecl _imp_??0exception@@QEAA@AEBQEBD@Z" __imp_??0exception@@QEAA@AEBQEBD@Z
0x18000B408: "public: class std::basic_string<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > & __ptr64 __cdecl std::basic_string<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> >::assign(unsigned short const * __ptr64) __ptr64" ?assign@?$basic_string@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@std@@QEAAAEAV12@PEBG@Z
0x180021FC8: "too many links" ??_C@_0P@HCOMKFCC@too?5many?5links?$AA@
0x1800233F8: "GetSystemTimePreciseAsFileTime" ??_C@_0BP@FPNJPEJC@GetSystemTimePreciseAsFileTime?$AA@
0x180023748: "__cdecl _real@408f400000000000" __real@408f400000000000
0x180020880: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x1800217C8: "no lock available" ??_C@_0BC@NJECKMKE@no?5lock?5available?$AA@
0x180021830: "operation canceled" ??_C@_0BD@MOLBPMEA@operation?5canceled?$AA@
0x180002AA0: "public: virtual long __cdecl ATL::CAtlModule::Lock(void) __ptr64" ?Lock@CAtlModule@ATL@@UEAAJXZ
0x180010134: "class CommonUtil::CStdMoveable<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> >,struct CommonUtil::CStdMoveableDefaultPolicy<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > > > __cdecl CommonUtil::StringPrintfW(unsigned short const * __ptr64,...)" ?StringPrintfW@CommonUtil@@YA?AV?$CStdMoveable@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@U?$CStdMoveableDefaultPolicy@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@@2@@1@PEBGZZ
0x180025718: "__vectorcall ??_R1A@?0A@EA@CFileUtils@MorroCommon" ??_R1A@?0A@EA@CFileUtils@MorroCommon@@8
0x18002C640: "__vectorcall ??_R0?AV?$CAtlModuleT@VCMalwareProviderDllModule@@@ATL@" ??_R0?AV?$CAtlModuleT@VCMalwareProviderDllModule@@@ATL@@@8
0x180014270: "protected: virtual int __cdecl MorroCommon::CWin32::PathIsDirectoryImpl(unsigned short const * __ptr64) __ptr64" ?PathIsDirectoryImpl@CWin32@MorroCommon@@MEAAHPEBG@Z
0x18000DA08: "public: __cdecl std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> >,class CommonUtil::AutoRef<struct IWbemClassObject> >::~pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> >,class CommonUtil::AutoRef<struct IWbemClassObject> >(void) __ptr64" ??1?$pair@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@QEAA@XZ
0x18001B476: "__cdecl _CxxFrameHandler3" __CxxFrameHandler3
0x180022560: "Malware" ??_C@_1BA@EKDMNKOA@?$AAM?$AAa?$AAl?$AAw?$AAa?$AAr?$AAe?$AA?$AA@
0x180002930: "public: virtual long __cdecl ATL::IWbemInstProviderImpl::DeleteClass(unsigned short * __ptr64 const,long,struct IWbemContext * __ptr64,struct IWbemCallResult * __ptr64 * __ptr64) __ptr64" ?DeleteClass@IWbemInstProviderImpl@ATL@@UEAAJQEAGJPEAUIWbemContext@@PEAPEAUIWbemCallResult@@@Z
0x180025EC0: "__vectorcall ??_R3CMpUtilsLibrary@CommonUtil" ??_R3CMpUtilsLibrary@CommonUtil@@8
0x180002BB8: "public: static long __cdecl ATL::CComObjectRootBase::InternalQueryInterface(void * __ptr64,struct ATL::_ATL_INTMAP_ENTRY const * __ptr64,struct _GUID const & __ptr64,void * __ptr64 * __ptr64)" ?InternalQueryInterface@CComObjectRootBase@ATL@@SAJPEAXPEBU_ATL_INTMAP_ENTRY@2@AEBU_GUID@@PEAPEAX@Z
0x180007C30: "public: __cdecl std::bad_alloc::bad_alloc(void) __ptr64" ??0bad_alloc@std@@QEAA@XZ
0x180025E40: "__vectorcall ??_R2CMpUtilsLibrary@CommonUtil" ??_R2CMpUtilsLibrary@CommonUtil@@8
0x180014A00: "protected: virtual void * __ptr64 __cdecl MorroCommon::CWin32::LoadResourceImpl(struct HINSTANCE__ * __ptr64,struct HRSRC__ * __ptr64) __ptr64" ?LoadResourceImpl@CWin32@MorroCommon@@MEAAPEAXPEAUHINSTANCE__@@PEAUHRSRC__@@@Z
0x18000F47C: MpManagerStatusQuery
0x180011704: "long __cdecl CommonUtil::UtilRawGetLoadedProcAddress(__int64 (__cdecl* * __ptr64)(void),unsigned short const * __ptr64,char const * __ptr64,bool)" ?UtilRawGetLoadedProcAddress@CommonUtil@@YAJPEAP6A_JXZPEBGPEBD_N@Z
0x1800020A0: WppControlCallback
0x18001BF90: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x180020C38: SHELL32_NULL_THUNK_DATA
0x18001A268: "public: __cdecl CommonUtil::XListHash<struct CommonUtil::CMpGlobalVarsTable::XHashElementInfo,struct CommonUtil::XListHashDefaultNonThrowingAllocator>::~XListHash<struct CommonUtil::CMpGlobalVarsTable::XHashElementInfo,struct CommonUtil::XListHashDefaultNonThrowingAllocator>(void) __ptr64" ??1?$XListHash@UXHashElementInfo@CMpGlobalVarsTable@CommonUtil@@UXListHashDefaultNonThrowingAllocator@3@@CommonUtil@@QEAA@XZ
0x180009CB8: "protected: class std::_Tree_iterator<class std::_Tree_val<struct std::_Tree_simple_types<struct std::pair<long const,bool> > > > __cdecl std::_Tree<class std::_Tmap_traits<long,bool,struct std::less<long>,class std::allocator<struct std::pair<long const,bool> >,0> >::_Insert_hint<struct std::pair<long const,bool> & __ptr64,struct std::_Tree_node<struct std::pair<long const,bool>,void * __ptr64> * __ptr64>(class std::_Tree_const_iterator<class std::_Tree_val<struct std::_Tree_simple_types<struct std::pair<long const,bool> > > >,struct std::pair<long const,bool> & __ptr64,struct std::_Tree_node<struct std::pair<long const,bool>,void * __ptr64> * __ptr64) __ptr64" ??$_Insert_hint@AEAU?$pair@$$CBJ_N@std@@PEAU?$_Tree_node@U?$pair@$$CBJ_N@std@@PEAX@2@@?$_Tree@V?$_Tmap_traits@J_NU?$less@J@std@@V?$allocator@U?$pair@$$CBJ_N@std@@@2@$0A@@std@@@std@@IEAA?AV?$_Tree_iterator@V?$_Tree_val@U?$_Tree_simple_types@U?$pair@$$CBJ_N@std@@@std@@@std@@@1@V?$_Tree_const_iterator@V?$_Tree_val@U?$_Tree_simple_types@U?$pair@$$CBJ_N@std@@@std@@@std@@@1@AEAU?$pair@$$CBJ_N@1@PEAU?$_Tree_node@U?$pair@$$CBJ_N@std@@PEAX@1@@Z
0x1800225B8: "__cdecl GUID_00000000_0000_0000_c000_000000000046" _GUID_00000000_0000_0000_c000_000000000046
0x1800209D8: "__cdecl _imp_CreateFileW" __imp_CreateFileW
0x18002C760: "__vectorcall ??_R0?AV?$CComObjectRootEx@VCComMultiThreadModel@ATL@@@ATL@" ??_R0?AV?$CComObjectRootEx@VCComMultiThreadModel@ATL@@@ATL@@@8
0x180029B60: "__cdecl CTA1?AVCAtlException@ATL@@" _CTA1?AVCAtlException@ATL@@
0x18000FFF4: "public: __cdecl CommonUtil::CHResultException::CHResultException(class CommonUtil::CHResultException const & __ptr64) __ptr64" ??0CHResultException@CommonUtil@@QEAA@AEBV01@@Z
0x18002C2D0: "__vectorcall ??_R0?AVlogic_error@std@" ??_R0?AVlogic_error@std@@@8
0x180020390: "const CommonUtil::CMpUtilsLibrary::`vftable'" ??_7CMpUtilsLibrary@CommonUtil@@6B@
0x1800146B0: "protected: virtual int __cdecl MorroCommon::CWin32::IsWow64ProcessImpl(void * __ptr64,int * __ptr64) __ptr64" ?IsWow64ProcessImpl@CWin32@MorroCommon@@MEAAHPEAXPEAH@Z
0x180001940: "public: virtual bool __cdecl std::error_category::equivalent(int,class std::error_condition const & __ptr64)const __ptr64" ?equivalent@error_category@std@@UEBA_NHAEBVerror_condition@2@@Z
0x180001BE0: "public: class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > & __ptr64 __cdecl std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >::assign(char const * __ptr64,unsigned __int64) __ptr64" ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAAEAV12@PEBD_K@Z
0x18002D930: ?instance@?1??Instance@CWPPTrace@MorroCommon@@SAAEAV23@XZ@4V23@A
0x180020C08: "__cdecl _imp_VarUI4FromStr" __imp_VarUI4FromStr
0x180026420: "__cdecl Init_thread_epoch" _Init_thread_epoch
0x180029EC8: "__cdecl _IMPORT_DESCRIPTOR_OLEAUT32" __IMPORT_DESCRIPTOR_OLEAUT32
0x1800150A0: "protected: virtual unsigned long __cdecl MorroCommon::CWin32::GetCurrentThreadIdImpl(void) __ptr64" ?GetCurrentThreadIdImpl@CWin32@MorroCommon@@MEAAKXZ
0x1800229D0: "Path" ??_C@_19NHABCBNP@?$AAP?$AAa?$AAt?$AAh?$AA?$AA@
0x18002CD48: "__vectorcall ??_R0?AUILockedCertCheck@MorroCommon@" ??_R0?AUILockedCertCheck@MorroCommon@@@8
0x18001A0AC: "long __cdecl MpUtilsExports::MpUtilsInitializeImpl(void)" ?MpUtilsInitializeImpl@MpUtilsExports@@YAJXZ
0x18000DFA0: "protected: void __cdecl std::_Tree<class std::_Tmap_traits<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> >,class CommonUtil::AutoRef<struct IWbemClassObject>,struct std::less<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > >,class std::allocator<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> > >,0> >::_Destroy_if_not_nil(struct std::_Tree_node<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> >,void * __ptr64> * __ptr64) __ptr64" ?_Destroy_if_not_nil@?$_Tree@V?$_Tmap_traits@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@U?$less@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@@std@@V?$allocator@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@@5@$0A@@std@@@std@@IEAAXPEAU?$_Tree_node@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@PEAX@2@@Z
0x18000B310: "public: virtual struct ATL::IAtlStringMgr * __ptr64 __cdecl ATL::CAtlStringMgr::Clone(void) __ptr64" ?Clone@CAtlStringMgr@ATL@@UEAAPEAUIAtlStringMgr@2@XZ
0x180021960: "bad_address" ??_C@_0M@IJGMGFGP@bad_address?$AA@
0x180002930: "public: virtual long __cdecl ATL::IWbemInstProviderImpl::GetObjectW(unsigned short * __ptr64 const,long,struct IWbemContext * __ptr64,struct IWbemClassObject * __ptr64 * __ptr64,struct IWbemCallResult * __ptr64 * __ptr64) __ptr64" ?GetObjectW@IWbemInstProviderImpl@ATL@@UEAAJQEAGJPEAUIWbemContext@@PEAPEAUIWbemClassObject@@PEAPEAUIWbemCallResult@@@Z
0x180020D70: "__cdecl _imp_CryptCATAdminEnumCatalogFromHash" __imp_CryptCATAdminEnumCatalogFromHash
0x180020C20: "__cdecl _imp_SHGetFolderPathW" __imp_SHGetFolderPathW
0x18001FDF0: "const Microsoft::SecurityClient::CMalwareProviderConfiguration::`vftable'" ??_7CMalwareProviderConfiguration@SecurityClient@Microsoft@@6B@
0x18001A4C4: "public: static long __cdecl CommonUtil::CSingletonFacilityRefPolicy2<class CommonUtil::CMpUtilsLibrary,1,0>::CreateInstance(class CommonUtil::CMpUtilsLibrary * __ptr64 * __ptr64)" ?CreateInstance@?$CSingletonFacilityRefPolicy2@VCMpUtilsLibrary@CommonUtil@@$00$0A@@CommonUtil@@SAJPEAPEAVCMpUtilsLibrary@2@@Z
0x1800088BC: "public: __cdecl ATL::CSimpleStringT<unsigned short,0>::~CSimpleStringT<unsigned short,0>(void) __ptr64" ??1?$CSimpleStringT@G$0A@@ATL@@QEAA@XZ
0x18000DAD4: "public: bool __cdecl std::less<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > >::operator()(class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const & __ptr64,class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const & __ptr64)const __ptr64" ??R?$less@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@@std@@QEBA_NAEBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@0@Z
0x1800209B8: "__cdecl _imp_RemoveDirectoryW" __imp_RemoveDirectoryW
0x18001ADCC: "public: __cdecl std::out_of_range::out_of_range(class std::out_of_range const & __ptr64) __ptr64" ??0out_of_range@std@@QEAA@AEBV01@@Z
0x180021F48: "result out of range" ??_C@_0BE@GOIPJJHG@result?5out?5of?5range?$AA@
0x180025118: "__vectorcall ??_R1A@?0A@EA@?$CComObjectCached@VCComClassFactory@ATL@@@ATL" ??_R1A@?0A@EA@?$CComObjectCached@VCComClassFactory@ATL@@@ATL@@8
0x180022758: "Microsoft Security Client" ??_C@_1DE@CIIAGCCJ@?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?5?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?5?$AAC?$AAl?$AAi?$AAe?$AAn?$AAt?$AA?$AA@
0x180021910: "connection_refused" ??_C@_0BD@NGKCIFEP@connection_refused?$AA@
0x18002D4D0: "private: static class MorroCommon::TSingletonWithProxy<class MorroCommon::CFileUtils> MorroCommon::CFileUtils::m_instance" ?m_instance@CFileUtils@MorroCommon@@0V?$TSingletonWithProxy@VCFileUtils@MorroCommon@@@2@A
0x180022360: "HKEY_CURRENT_CONFIG" ??_C@_1CI@BBJOACGG@?$AAH?$AAK?$AAE?$AAY?$AA_?$AAC?$AAU?$AAR?$AAR?$AAE?$AAN?$AAT?$AA_?$AAC?$AAO?$AAN?$AAF?$AAI?$AAG?$AA?$AA@
0x18001FBC0: "const ATL::CComClassFactory::`vftable'" ??_7CComClassFactory@ATL@@6B@
0x180012A90: "public: __cdecl MorroCommon::SFolderItem::~SFolderItem(void) __ptr64" ??1SFolderItem@MorroCommon@@QEAA@XZ
0x180014680: "protected: virtual int __cdecl MorroCommon::CWin32::VerQueryValueImpl(void const * __ptr64,unsigned short const * __ptr64,void * __ptr64 * __ptr64,unsigned int * __ptr64) __ptr64" ?VerQueryValueImpl@CWin32@MorroCommon@@MEAAHPEBXPEBGPEAPEAXPEAI@Z
0x18000B31C: "public: __cdecl CommonUtil::CUniqueHandle<struct CommonUtil::CAutoUniqueArrayPtrDelete2<unsigned short * __ptr64> >::~CUniqueHandle<struct CommonUtil::CAutoUniqueArrayPtrDelete2<unsigned short * __ptr64> >(void) __ptr64" ??1?$CUniqueHandle@U?$CAutoUniqueArrayPtrDelete2@PEAG@CommonUtil@@@CommonUtil@@QEAA@XZ
0x180017D48: "long __cdecl MorroCommon::HrCStringFormatV(class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > & __ptr64,unsigned short const * __ptr64,char * __ptr64)" ?HrCStringFormatV@MorroCommon@@YAJAEAV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@PEBGPEAD@Z
0x180022388: "S" ??_C@_13HADIAKP@?$AAS?$AA?$AA@
0x180009EE0: "public: class std::_Tree_const_iterator<class std::_Tree_val<struct std::_Tree_simple_types<struct std::pair<long const,bool> > > > & __ptr64 __cdecl std::_Tree_const_iterator<class std::_Tree_val<struct std::_Tree_simple_types<struct std::pair<long const,bool> > > >::operator--(void) __ptr64" ??F?$_Tree_const_iterator@V?$_Tree_val@U?$_Tree_simple_types@U?$pair@$$CBJ_N@std@@@std@@@std@@@std@@QEAAAEAV01@XZ
0x1800018F0: "public: virtual void * __ptr64 __cdecl std::error_category::`vector deleting destructor'(unsigned int) __ptr64" ??_Eerror_category@std@@UEAAPEAXI@Z
0x18002C7E0: "__vectorcall ??_R0?AVCRegObject@ATL@" ??_R0?AVCRegObject@ATL@@@8
0x180003B3C: "public: __cdecl MorroCommon::EHresultException::EHresultException(long) __ptr64" ??0EHresultException@MorroCommon@@QEAA@J@Z
0x180021A68: "no_protocol_option" ??_C@_0BD@JHIHCGKP@no_protocol_option?$AA@
0x180020730: "__cdecl _imp_RegDeleteKeyW" __imp_RegDeleteKeyW
0x180009AF0: "protected: void __cdecl std::_Tree<class std::_Tmap_traits<long,bool,struct std::less<long>,class std::allocator<struct std::pair<long const,bool> >,0> >::_Erase(struct std::_Tree_node<struct std::pair<long const,bool>,void * __ptr64> * __ptr64) __ptr64" ?_Erase@?$_Tree@V?$_Tmap_traits@J_NU?$less@J@std@@V?$allocator@U?$pair@$$CBJ_N@std@@@2@$0A@@std@@@std@@IEAAXPEAU?$_Tree_node@U?$pair@$$CBJ_N@std@@PEAX@2@@Z
0x1800074B0: DllGetClassObject
0x180014AA0: "protected: virtual int __cdecl MorroCommon::CWin32::DeleteFileImpl(unsigned short const * __ptr64) __ptr64" ?DeleteFileImpl@CWin32@MorroCommon@@MEAAHPEBG@Z
0x180020E78: "__cdecl _imp_memmove_s" __imp_memmove_s
0x1800145B0: "protected: virtual int __cdecl MorroCommon::CWin32::CloseHandleImpl(void * __ptr64) __ptr64" ?CloseHandleImpl@CWin32@MorroCommon@@MEAAHPEAX@Z
0x180006CFC: "public: __cdecl CommonUtil::AutoRef<struct IWbemContext>::~AutoRef<struct IWbemContext>(void) __ptr64" ??1?$AutoRef@UIWbemContext@@@CommonUtil@@QEAA@XZ
0x180020718: "__cdecl _imp_EnableTrace" __imp_EnableTrace
0x1800236A8: "GetFileVersionInfoSizeW" ??_C@_0BI@EGKIMOGO@GetFileVersionInfoSizeW?$AA@
0x180021C00: "connection already in progress" ??_C@_0BP@KAIHPOGN@connection?5already?5in?5progress?$AA@
0x180019580: "public: virtual void * __ptr64 __cdecl MpCommonEx::CEventLoggerBase::`vector deleting destructor'(unsigned int) __ptr64" ??_ECEventLoggerBase@MpCommonEx@@UEAAPEAXI@Z
0x180003200: "void __cdecl ATL::_AtlRaiseException(unsigned long,unsigned long)" ?_AtlRaiseException@ATL@@YAXKK@Z
0x1800122E0: "public: virtual void __cdecl ATL::CAtlStringMgr::Free(struct ATL::CStringData * __ptr64) __ptr64" ?Free@CAtlStringMgr@ATL@@UEAAXPEAUCStringData@2@@Z
0x1800192E0: "public: class ATL::CComVariant __cdecl Microsoft::SecurityClient::CWbemClassObjectHelper::Get(unsigned short const * __ptr64,long)const __ptr64" ?Get@CWbemClassObjectHelper@SecurityClient@Microsoft@@QEBA?AVCComVariant@ATL@@PEBGJ@Z
0x180020D60: VERSION_NULL_THUNK_DATA
0x1800151A0: "protected: virtual unsigned short __cdecl MorroCommon::CWin32::GetUserDefaultUILanguageImpl(void) __ptr64" ?GetUserDefaultUILanguageImpl@CWin32@MorroCommon@@MEAAGXZ
0x180024F58: "__vectorcall ??_R1A@?0A@EA@?$CComCoClass@VCMalwareProvider@@$1?CLSID_MalwareProvider@@3U_GUID@@B@ATL" ??_R1A@?0A@EA@?$CComCoClass@VCMalwareProvider@@$1?CLSID_MalwareProvider@@3U_GUID@@B@ATL@@8
0x180009C40: "public: struct std::_Tree_node<struct std::pair<long const,bool>,void * __ptr64> * __ptr64 __cdecl std::_Tree_alloc<0,struct std::_Tree_base_types<struct std::pair<long const,bool>,class std::allocator<struct std::pair<long const,bool> > > >::_Buyheadnode(void) __ptr64" ?_Buyheadnode@?$_Tree_alloc@$0A@U?$_Tree_base_types@U?$pair@$$CBJ_N@std@@V?$allocator@U?$pair@$$CBJ_N@std@@@2@@std@@@std@@QEAAPEAU?$_Tree_node@U?$pair@$$CBJ_N@std@@PEAX@2@XZ
0x18000D030: "public: bool __cdecl Microsoft::SecurityClient::CMalwareInstanceFactory::CreateInstance(struct tagMPTHREAT_INFO * __ptr64 const,struct tagMPVERSION_INFO * __ptr64 const,struct tagMPSTATUS_INFO * __ptr64 const) __ptr64" ?CreateInstance@CMalwareInstanceFactory@SecurityClient@Microsoft@@QEAA_NQEAUtagMPTHREAT_INFO@@QEAUtagMPVERSION_INFO@@QEAUtagMPSTATUS_INFO@@@Z
0x1800088F0: "public: __cdecl ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > >::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > >(unsigned short const * __ptr64) __ptr64" ??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAA@PEBG@Z
0x180015250: "protected: virtual void __cdecl MorroCommon::CWin32::SetLastErrorImpl(unsigned long) __ptr64" ?SetLastErrorImpl@CWin32@MorroCommon@@MEAAXK@Z
0x180011E2C: HrGetLastFailure
0x180025070: "__vectorcall ??_R17?0A@EA@_ATL_MODULE70@ATL" ??_R17?0A@EA@_ATL_MODULE70@ATL@@8
0x180029DA0: "__cdecl _pobjMapEntryLast" __pobjMapEntryLast
0x180022488: "TypeLib" ??_C@_1BA@JIHHIEDE@?$AAT?$AAy?$AAp?$AAe?$AAL?$AAi?$AAb?$AA?$AA@
0x180014400: "protected: virtual long __cdecl MorroCommon::CWin32::RegDeleteValueImpl(struct HKEY__ * __ptr64,unsigned short const * __ptr64) __ptr64" ?RegDeleteValueImpl@CWin32@MorroCommon@@MEAAJPEAUHKEY__@@PEBG@Z
0x180029CA8: "__cdecl CTA2PEAVEHresultException@MorroCommon@@" _CTA2PEAVEHresultException@MorroCommon@@
0x1800216D0: "permission denied" ??_C@_0BC@CIJDGCDI@permission?5denied?$AA@
0x1800251D0: "__vectorcall ??_R3?$CAtlDllModuleT@VCMalwareProviderDllModule@@@ATL" ??_R3?$CAtlDllModuleT@VCMalwareProviderDllModule@@@ATL@@8
0x180024D08: "__vectorcall ??_R2?$CAtlDllModuleT@VCMalwareProviderDllModule@@@ATL" ??_R2?$CAtlDllModuleT@VCMalwareProviderDllModule@@@ATL@@8
0x180015280: "protected: virtual void __cdecl MorroCommon::CWin32::WTSFreeMemoryImpl(void * __ptr64) __ptr64" ?WTSFreeMemoryImpl@CWin32@MorroCommon@@MEAAXPEAX@Z
0x180020E28: "__cdecl _imp_wcschr" __imp_wcschr
0x180029CC0: "__stdcall CT??_R0PEAVEHresultException@MorroCommon@@" _CT??_R0PEAVEHresultException@MorroCommon@@@88
0x180003E40: "long __cdecl ATL::AtlHresultFromWin32(unsigned long)" ?AtlHresultFromWin32@ATL@@YAJK@Z
0x180020A00: "__cdecl _imp_SetEvent" __imp_SetEvent
0x180025B18: "__vectorcall ??_R3CHResultExceptionImpl@CommonUtil" ??_R3CHResultExceptionImpl@CommonUtil@@8
0x1800087F8: "public: static class MorroCommon::CFileUtils * __ptr64 __cdecl MorroCommon::TSingletonWithProxy<class MorroCommon::CFileUtils>::GetInstance(void)" ?GetInstance@?$TSingletonWithProxy@VCFileUtils@MorroCommon@@@MorroCommon@@SAPEAVCFileUtils@2@XZ
0x180008734: "public: static class MorroCommon::CPathUtils * __ptr64 __cdecl MorroCommon::TSingletonWithProxy<class MorroCommon::CPathUtils>::GetInstance(void)" ?GetInstance@?$TSingletonWithProxy@VCPathUtils@MorroCommon@@@MorroCommon@@SAPEAVCPathUtils@2@XZ
0x180025B48: "__vectorcall ??_R2CHResultExceptionImpl@CommonUtil" ??_R2CHResultExceptionImpl@CommonUtil@@8
0x180012F00: "protected: virtual long __cdecl MorroCommon::CFileUtils::SafeLoadLibraryImpl(class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > const & __ptr64,struct HINSTANCE__ * __ptr64 * __ptr64) __ptr64" ?SafeLoadLibraryImpl@CFileUtils@MorroCommon@@MEAAJAEBV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@PEAPEAUHINSTANCE__@@@Z
0x180022590: "vector<T> too long" ??_C@_0BD@OLBABOEK@vector?$DMT?$DO?5too?5long?$AA@
0x180003174: "public: __cdecl ATL::CTempBuffer<unsigned short,256,class ATL::CCRTAllocator>::~CTempBuffer<unsigned short,256,class ATL::CCRTAllocator>(void) __ptr64" ??1?$CTempBuffer@G$0BAA@VCCRTAllocator@ATL@@@ATL@@QEAA@XZ
0x180020790: "__cdecl _imp_PrivilegeCheck" __imp_PrivilegeCheck
0x180003174: "public: __cdecl ATL::CTempBuffer<unsigned short,1024,class ATL::CCRTAllocator>::~CTempBuffer<unsigned short,1024,class ATL::CCRTAllocator>(void) __ptr64" ??1?$CTempBuffer@G$0EAA@VCCRTAllocator@ATL@@@ATL@@QEAA@XZ
0x180001AC0: "public: virtual class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > __cdecl std::_System_error_category::message(int)const __ptr64" ?message@_System_error_category@std@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@H@Z
0x180020F98: ole32_NULL_THUNK_DATA
0x180020DD0: "__cdecl _imp_WTSQuerySessionInformationW" __imp_WTSQuerySessionInformationW
0x180023758: "__cdecl _real@40f5180000000000" __real@40f5180000000000
0x1800224A0: "API-MS-Win-Core-LocalRegistry-L1" ??_C@_1FC@DBDBPMB@?$AAA?$AAP?$AAI?$AA?9?$AAM?$AAS?$AA?9?$AAW?$AAi?$AAn?$AA?9?$AAC?$AAo?$AAr?$AAe?$AA?9?$AAL?$AAo?$AAc?$AAa?$AAl?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?9?$AAL?$AA1@
0x18001B4C0: "void __cdecl `eh vector destructor iterator'(void * __ptr64,unsigned __int64,int,void (__cdecl*)(void * __ptr64))" ??_M@YAXPEAX_KHP6AX0@Z@Z
0x180020A50: "__cdecl _imp_GetLocalTime" __imp_GetLocalTime
0x180024E18: "__vectorcall ??_R1BA@?0A@EA@?$CComObjectRootEx@VCComMultiThreadModel@ATL@@@ATL" ??_R1BA@?0A@EA@?$CComObjectRootEx@VCComMultiThreadModel@ATL@@@ATL@@8
0x180020FA8: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x180023084: "." ??_C@_13JOFGPIOO@?$AA?4?$AA?$AA@
0x180008978: "private: bool __cdecl ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > >::CheckImplicitLoad(void const * __ptr64) __ptr64" ?CheckImplicitLoad@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@AEAA_NPEBX@Z
0x18000BA54: "private: void __cdecl Microsoft::SecurityClient::CMalwareInstanceFactory::FillActionTimeProperty(struct IWbemClassObject & __ptr64,class Microsoft::SecurityClient::CWbemClassObjectHelper & __ptr64)const __ptr64" ?FillActionTimeProperty@CMalwareInstanceFactory@SecurityClient@Microsoft@@AEBAXAEAUIWbemClassObject@@AEAVCWbemClassObjectHelper@23@@Z
0x180020F58: "__cdecl _imp_CoImpersonateClient" __imp_CoImpersonateClient
0x180020B98: "__cdecl _imp_GetSystemDefaultUILanguage" __imp_GetSystemDefaultUILanguage
0x18002D988: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxuznxlivUzmgrnzodzivUhlfixvUzkkozbviUxlnnlmUzkkozbvixlnnlmUoryUlyquivUznwGEUhgwzucOlyq@MorroCommon" __@@_PchSym_@00@KxulyqvxgPillgKxuznxlivUzmgrnzodzivUhlfixvUzkkozbviUxlnnlmUzkkozbvixlnnlmUoryUlyquivUznwGEUhgwzucOlyq@MorroCommon
0x18001F9B8: "__cdecl _imp__recalloc" __imp__recalloc
0x1800047A0: "public: long __cdecl ATL::CRegParser::RegisterBuffer(unsigned short * __ptr64,int) __ptr64" ?RegisterBuffer@CRegParser@ATL@@QEAAJPEAGH@Z
0x180015580: "protected: virtual unsigned short __cdecl MorroCommon::CWin32::GlobalFindAtomImpl(unsigned short const * __ptr64) __ptr64" ?GlobalFindAtomImpl@CWin32@MorroCommon@@MEAAGPEBG@Z
0x18000FDD0: "public: virtual void * __ptr64 __cdecl CommonUtil::CHResultExceptionImpl::`vector deleting destructor'(unsigned int) __ptr64" ??_ECHResultExceptionImpl@CommonUtil@@UEAAPEAXI@Z
0x180011E5C: MpDebugPrintfA
0x180006E28: "public: void __cdecl std::_Wrap_alloc<class std::allocator<struct MorroCommon::SFolderItem> >::deallocate(struct MorroCommon::SFolderItem * __ptr64,unsigned __int64) __ptr64" ?deallocate@?$_Wrap_alloc@V?$allocator@USFolderItem@MorroCommon@@@std@@@std@@QEAAXPEAUSFolderItem@MorroCommon@@_K@Z
0x180020C58: "__cdecl _imp_PathIsRelativeW" __imp_PathIsRelativeW
0x180025770: "const MorroCommon::CPathUtils::`RTTI Complete Object Locator'" ??_R4CPathUtils@MorroCommon@@6B@
0x1800226A8: "ExcludeSystemProperties" ??_C@_1DA@JKGMPCBD@?$AAE?$AAx?$AAc?$AAl?$AAu?$AAd?$AAe?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAP?$AAr?$AAo?$AAp?$AAe?$AAr?$AAt?$AAi?$AAe?$AAs?$AA?$AA@
0x180020918: "__cdecl _imp_InitializeCriticalSection" __imp_InitializeCriticalSection
0x180003B48: "void __cdecl ATL::AtlThrowImpl(long)" ?AtlThrowImpl@ATL@@YAXJ@Z
0x180015230: ?SHGetPathFromIDListImpl@CWin32@MorroCommon@@MEAAHPEFBU_ITEMIDLIST@@PEAG@Z
0x18000A780: "protected: virtual void * __ptr64 __cdecl CommonUtil::CRefObject::`scalar deleting destructor'(unsigned int) __ptr64" ??_GCRefObject@CommonUtil@@MEAAPEAXI@Z
0x180020938: "__cdecl _imp_DecodePointer" __imp_DecodePointer
0x180023438: CLSID_WbemContext
0x180003194: "private: void __cdecl ATL::CTempBuffer<unsigned short,256,class ATL::CCRTAllocator>::AllocateHeap(unsigned __int64) __ptr64" ?AllocateHeap@?$CTempBuffer@G$0BAA@VCCRTAllocator@ATL@@@ATL@@AEAAX_K@Z
0x180003194: "private: void __cdecl ATL::CTempBuffer<unsigned char,256,class ATL::CCRTAllocator>::AllocateHeap(unsigned __int64) __ptr64" ?AllocateHeap@?$CTempBuffer@E$0BAA@VCCRTAllocator@ATL@@@ATL@@AEAAX_K@Z
0x1800251E8: "__vectorcall ??_R3?$CAtlValidateModuleConfiguration@$00VCMalwareProviderDllModule@@@ATL" ??_R3?$CAtlValidateModuleConfiguration@$00VCMalwareProviderDllModule@@@ATL@@8
0x180024D38: "__vectorcall ??_R2?$CAtlValidateModuleConfiguration@$00VCMalwareProviderDllModule@@@ATL" ??_R2?$CAtlValidateModuleConfiguration@$00VCMalwareProviderDllModule@@@ATL@@8
0x180029D48: "__stdcall CT??_R0PEAVEUnknownError@MorroCommon@@" _CT??_R0PEAVEUnknownError@MorroCommon@@@88
0x18000E6DC: "private: class CommonUtil::CReturnHandle<class CommonUtil::CUniqueHandle<struct CommonUtil::CAutoUniqueArrayPtrDelete2<unsigned short * __ptr64> > > __cdecl Microsoft::SecurityClient::CAmEventConsumer::BuildWqlQuery(void)const __ptr64" ?BuildWqlQuery@CAmEventConsumer@SecurityClient@Microsoft@@AEBA?AV?$CReturnHandle@V?$CUniqueHandle@U?$CAutoUniqueArrayPtrDelete2@PEAG@CommonUtil@@@CommonUtil@@@CommonUtil@@XZ
0x180021B88: "argument out of domain" ??_C@_0BH@CGIMPKIM@argument?5out?5of?5domain?$AA@
0x180014FF0: "protected: virtual void * __ptr64 __cdecl MorroCommon::CWin32::CreateThreadImpl(struct _SECURITY_ATTRIBUTES * __ptr64,unsigned __int64,unsigned long (__cdecl*)(void * __ptr64),void * __ptr64,unsigned long,unsigned long * __ptr64) __ptr64" ?CreateThreadImpl@CWin32@MorroCommon@@MEAAPEAXPEAU_SECURITY_ATTRIBUTES@@_KP6AKPEAX@Z2KPEAK@Z
0x180021790: "no such file or directory" ??_C@_0BK@NDOCBPGE@no?5such?5file?5or?5directory?$AA@
0x18001B530: "void __cdecl __ArrayUnwind(void * __ptr64,unsigned __int64,int,void (__cdecl*)(void * __ptr64))" ?__ArrayUnwind@@YAXPEAX_KHP6AX0@Z@Z
0x180021BE8: "connection aborted" ??_C@_0BD@MGNDDEGM@connection?5aborted?$AA@
0x180020EE0: "__cdecl _imp__wchmod" __imp__wchmod
0x180029C68: "__cdecl TI3?AVCHResultExceptionImpl@CommonUtil@@" _TI3?AVCHResultExceptionImpl@CommonUtil@@
0x1800123C0: "public: virtual struct ATL::CStringData * __ptr64 __cdecl ATL::CAtlStringMgr::GetNilString(void) __ptr64" ?GetNilString@CAtlStringMgr@ATL@@UEAAPEAUCStringData@2@XZ
0x180021C88: "file too large" ??_C@_0P@DNAJLBJK@file?5too?5large?$AA@
0x18001FDC0: "const Microsoft::SecurityClient::CMalwareProviderEventLogger::`vftable'{for `MpCommonEx::CEventLoggerBase'}" ??_7CMalwareProviderEventLogger@SecurityClient@Microsoft@@6BCEventLoggerBase@MpCommonEx@@@
0x180003D84: "public: long __cdecl ATL::CRegKey::DeleteSubKey(unsigned short const * __ptr64) __ptr64" ?DeleteSubKey@CRegKey@ATL@@QEAAJPEBG@Z
0x1800207A0: "__cdecl _imp_QueryServiceStatus" __imp_QueryServiceStatus
0x18002CBB8: "__vectorcall ??_R0?AVinvalid_argument@std@" ??_R0?AVinvalid_argument@std@@@8
0x180021D70: "no buffer space" ??_C@_0BA@PFFCAOFK@no?5buffer?5space?$AA@
0x180003218: "public: int __cdecl ATL::CRegParser::CParseBuffer::Append(unsigned short const * __ptr64,int) __ptr64" ?Append@CParseBuffer@CRegParser@ATL@@QEAAHPEBGH@Z
0x180026424: "__cdecl tls_end" _tls_end
0x18002D998: ?instance@?1??GetInstance@?$TSingletonWithProxy@VCCertCheckFactory@MorroCommon@@@MorroCommon@@SAPEAVCCertCheckFactory@3@XZ@4V43@A
0x18000FDD0: "protected: virtual void * __ptr64 __cdecl CommonUtil::CHResultException::`vector deleting destructor'(unsigned int) __ptr64" ??_ECHResultException@CommonUtil@@MEAAPEAXI@Z
0x1800082D4: "public: static class CommonUtil::CReturnHandle<class CommonUtil::CAutoBSTR> __cdecl Microsoft::SecurityClient::CWmiObjectSerializer::SerializeToXml(struct IWbemClassObject * __ptr64,unsigned long)" ?SerializeToXml@CWmiObjectSerializer@SecurityClient@Microsoft@@SA?AV?$CReturnHandle@VCAutoBSTR@CommonUtil@@@CommonUtil@@PEAUIWbemClassObject@@K@Z
0x180020D98: "__cdecl _imp_CryptCATCatalogInfoFromContext" __imp_CryptCATCatalogInfoFromContext
0x18002C4F0: "__vectorcall ??_R0?AV?$CComCoClass@VCMalwareProvider@@$1?CLSID_MalwareProvider@@3U_GUID@@B@ATL@" ??_R0?AV?$CComCoClass@VCMalwareProvider@@$1?CLSID_MalwareProvider@@3U_GUID@@B@ATL@@@8
0x18001BB60: "__cdecl XcptFilter" _XcptFilter
0x180020DB8: "__cdecl _imp_WTSQueryUserToken" __imp_WTSQueryUserToken
0x180021E58: "not connected" ??_C@_0O@GLMIBBEG@not?5connected?$AA@
0x180002930: "public: virtual long __cdecl ATL::IWbemInstProviderImpl::CancelAsyncCall(struct IWbemObjectSink * __ptr64) __ptr64" ?CancelAsyncCall@IWbemInstProviderImpl@ATL@@UEAAJPEAUIWbemObjectSink@@@Z
0x180020FB0: "__cdecl _xc_a" __xc_a
0x180020B38: "__cdecl _imp_FreeResource" __imp_FreeResource
0x180020A28: "__cdecl _imp_CreateProcessW" __imp_CreateProcessW
0x180022508: "advapi32.dll" ??_C@_1BK@JHLNAEJL@?$AAa?$AAd?$AAv?$AAa?$AAp?$AAi?$AA3?$AA2?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x180025F40: "const CommonUtil::CPredefinedMpHeapsHolder::`RTTI Complete Object Locator'" ??_R4CPredefinedMpHeapsHolder@CommonUtil@@6B@
0x1800176AC: "private: static long __cdecl MorroCommon::CCertCheck::MicrosoftCatalogCertCheck(unsigned short const * __ptr64,unsigned long,void * __ptr64)" ?MicrosoftCatalogCertCheck@CCertCheck@MorroCommon@@CAJPEBGKPEAX@Z
0x180020D50: "__cdecl _imp_GetFileVersionInfoSizeW" __imp_GetFileVersionInfoSizeW
0x18002C590: "__vectorcall ??_R0?AV?$CAtlDllModuleT@VCMalwareProviderDllModule@@@ATL@" ??_R0?AV?$CAtlDllModuleT@VCMalwareProviderDllModule@@@ATL@@@8
0x18000FDB0: "private: static long __cdecl CommonUtil::CGenericGlobalAtStartup<struct CommonUtil::CGenericAtStartupPolicy2nd<class CommonUtil::CMpCriticalSection> >::OnInitializeCallback(void * __ptr64)" ?OnInitializeCallback@?$CGenericGlobalAtStartup@U?$CGenericAtStartupPolicy2nd@VCMpCriticalSection@CommonUtil@@@CommonUtil@@@CommonUtil@@CAJPEAX@Z
0x180014800: "protected: virtual int __cdecl MorroCommon::CWin32::GetSystemMetricsImpl(int) __ptr64" ?GetSystemMetricsImpl@CWin32@MorroCommon@@MEAAHH@Z
0x180014E60: "protected: virtual int __cdecl MorroCommon::CWin32::GetFileSizeExImpl(void * __ptr64,union _LARGE_INTEGER * __ptr64) __ptr64" ?GetFileSizeExImpl@CWin32@MorroCommon@@MEAAHPEAXPEAT_LARGE_INTEGER@@@Z
0x180025840: "__vectorcall ??_R1A@?0A@EA@CEventLoggerBase@MpCommonEx" ??_R1A@?0A@EA@CEventLoggerBase@MpCommonEx@@8
0x180013B04: "public: class ATL::CStringT<char,class ATL::StrTraitATL<char,class ATL::ChTraitsCRT<char> > > & __ptr64 __cdecl ATL::CStringT<char,class ATL::StrTraitATL<char,class ATL::ChTraitsCRT<char> > >::operator=(char const * __ptr64) __ptr64" ??4?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@ATL@@QEAAAEAV01@PEBD@Z
0x1800209C8: "__cdecl _imp_FindClose" __imp_FindClose
0x180021A20: "network_down" ??_C@_0N@FCPALPJK@network_down?$AA@
0x180002370: ?GetObjectDescription@?$CComCoClass@VCMalwareProvider@@$1?CLSID_MalwareProvider@@3U_GUID@@B@ATL@@SAPEBGXZ
0x180021DE0: "no stream resources" ??_C@_0BE@MKFDAFMP@no?5stream?5resources?$AA@
0x180020900: "__cdecl _imp_SetThreadLocale" __imp_SetThreadLocale
0x180002AD4: "public: long __cdecl ATL::CComCriticalSection::Init(void) __ptr64" ?Init@CComCriticalSection@ATL@@QEAAJXZ
0x180007430: "public: __cdecl std::basic_string<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> >::~basic_string<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> >(void) __ptr64" ??1?$basic_string@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@std@@QEAA@XZ
0x1800219F8: "message_size" ??_C@_0N@HPMLKHPL@message_size?$AA@
0x1800233E8: WPP_af44aed7928d36b3a845cf895c8b8d6e_Traceguids
0x180020B18: "__cdecl _imp_CreateToolhelp32Snapshot" __imp_CreateToolhelp32Snapshot
0x180014920: "protected: virtual void * __ptr64 __cdecl MorroCommon::CWin32::CreateToolhelp32SnapshotImpl(unsigned long,unsigned long) __ptr64" ?CreateToolhelp32SnapshotImpl@CWin32@MorroCommon@@MEAAPEAXKK@Z
0x180014460: "protected: virtual struct HINSTANCE__ * __ptr64 __cdecl MorroCommon::CWin32::LoadLibraryImpl(unsigned short const * __ptr64) __ptr64" ?LoadLibraryImpl@CWin32@MorroCommon@@MEAAPEAUHINSTANCE__@@PEBG@Z
0x18001BD4B: "__cdecl lock" _lock
0x180020C60: "__cdecl _imp_PathRemoveFileSpecW" __imp_PathRemoveFileSpecW
0x18002CB90: "__vectorcall ??_R0?AVout_of_range@std@" ??_R0?AVout_of_range@std@@@8
0x18000B2E0: "public: virtual unsigned long __cdecl Microsoft::SecurityClient::CMalwareProviderConfiguration::GetMaxNumOfInstances(void)const __ptr64" ?GetMaxNumOfInstances@CMalwareProviderConfiguration@SecurityClient@Microsoft@@UEBAKXZ
0x180022F70: "MpConfigGetValue" ??_C@_0BB@PDIDAFAI@MpConfigGetValue?$AA@
0x1800218E0: "bad_file_descriptor" ??_C@_0BE@DLHHIBGN@bad_file_descriptor?$AA@
0x1800156E0: "protected: virtual long __cdecl MorroCommon::CPathUtils::CombineWithModuleDirImpl(struct HINSTANCE__ * __ptr64,unsigned short const * __ptr64,class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > & __ptr64) __ptr64" ?CombineWithModuleDirImpl@CPathUtils@MorroCommon@@MEAAJPEAUHINSTANCE__@@PEBGAEAV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@@Z
0x180020BD0: "__cdecl _imp_SysStringByteLen" __imp_SysStringByteLen
0x180016F00: "public: void __cdecl ATL::CSimpleStringT<unsigned short,0>::Append(unsigned short const * __ptr64,int) __ptr64" ?Append@?$CSimpleStringT@G$0A@@ATL@@QEAAXPEBGH@Z
0x180025390: "__vectorcall ??_R2?$CComObjectRootEx@VCComMultiThreadModel@ATL@@@ATL" ??_R2?$CComObjectRootEx@VCComMultiThreadModel@ATL@@@ATL@@8
0x180011BB8: "long __cdecl CommonUtil::HrGetFileAttributes(unsigned long * __ptr64,unsigned short const * __ptr64)" ?HrGetFileAttributes@CommonUtil@@YAJPEAKPEBG@Z
0x180014550: "protected: virtual unsigned long __cdecl MorroCommon::CWin32::WaitForSingleObjectImpl(void * __ptr64,unsigned long) __ptr64" ?WaitForSingleObjectImpl@CWin32@MorroCommon@@MEAAKPEAXK@Z
0x1800253A8: "__vectorcall ??_R3?$CComObjectRootEx@VCComMultiThreadModel@ATL@@@ATL" ??_R3?$CComObjectRootEx@VCComMultiThreadModel@ATL@@@ATL@@8
0x180002CE0: "public: virtual long __cdecl ATL::CRegObject::QueryInterface(struct _GUID const & __ptr64,void * __ptr64 * __ptr64) __ptr64" ?QueryInterface@CRegObject@ATL@@UEAAJAEBU_GUID@@PEAPEAX@Z
0x18002C958: "__vectorcall ??_R0?AVCFileUtils@MorroCommon@" ??_R0?AVCFileUtils@MorroCommon@@@8
0x18002C078: "public: static class std::_System_error_category std::_Error_objects<int>::_System_object" ?_System_object@?$_Error_objects@H@std@@2V_System_error_category@2@A
0x180026000: "__vectorcall ??_R3CPredefinedMpHeapsHolder@CommonUtil" ??_R3CPredefinedMpHeapsHolder@CommonUtil@@8
0x180025F80: "__vectorcall ??_R2CPredefinedMpHeapsHolder@CommonUtil" ??_R2CPredefinedMpHeapsHolder@CommonUtil@@8
0x180020B90: "__cdecl _imp_WritePrivateProfileStringW" __imp_WritePrivateProfileStringW
0x18001FAB8: "const ATL::CComObject<class CMalwareProvider>::`vftable'{for `IWbemProviderInit'}" ??_7?$CComObject@VCMalwareProvider@@@ATL@@6BIWbemProviderInit@@@
0x180020A08: "__cdecl _imp_DeleteFileW" __imp_DeleteFileW
0x180002D94: "public: long __cdecl ATL::CExpansionVector::ClearReplacements(void) __ptr64" ?ClearReplacements@CExpansionVector@ATL@@QEAAJXZ
0x1800068C8: "public: __cdecl Microsoft::SecurityClient::CMalwareInstanceFactory::~CMalwareInstanceFactory(void) __ptr64" ??1CMalwareInstanceFactory@SecurityClient@Microsoft@@QEAA@XZ
0x1800216BC: "__cdecl _guard_iat_table" __guard_iat_table
0x180011C38: "long __cdecl CommonUtil::HrDuplicateStringW(unsigned short * __ptr64 * __ptr64,unsigned short const * __ptr64)" ?HrDuplicateStringW@CommonUtil@@YAJPEAPEAGPEBG@Z
0x18002CC68: "__vectorcall ??_R0PEAVEUnknownError@MorroCommon@" ??_R0PEAVEUnknownError@MorroCommon@@@8
0x180019C2C: "public: static long __cdecl MpCommonEx::CFileUtilsEx::SafeLoadLibrary(struct HINSTANCE__ * __ptr64 * __ptr64,unsigned short const * __ptr64)" ?SafeLoadLibrary@CFileUtilsEx@MpCommonEx@@SAJPEAPEAUHINSTANCE__@@PEBG@Z
0x18001BB48: memcpy
0x18001AECC: "void __cdecl std::_Xout_of_range(char const * __ptr64)" ?_Xout_of_range@std@@YAXPEBD@Z
0x180021988: "operation_in_progress" ??_C@_0BG@DJGBJIIK@operation_in_progress?$AA@
0x18002C088: "public: static class std::_Generic_error_category std::_Error_objects<int>::_Generic_object" ?_Generic_object@?$_Error_objects@H@std@@2V_Generic_error_category@2@A
0x180020C90: "__cdecl _imp_MessageBoxW" __imp_MessageBoxW
0x180020AB8: "__cdecl _imp_LoadLibraryExW" __imp_LoadLibraryExW
0x180014C00: "protected: virtual int __cdecl MorroCommon::CWin32::CheckTokenMembershipImpl(void * __ptr64,void * __ptr64,int * __ptr64) __ptr64" ?CheckTokenMembershipImpl@CWin32@MorroCommon@@MEAAHPEAX0PEAH@Z
0x18001BEF0: "__cdecl _GSHandlerCheck_EH" __GSHandlerCheck_EH
0x180023050: "kernelbase.dll" ??_C@_1BO@MFOKJHPK@?$AAk?$AAe?$AAr?$AAn?$AAe?$AAl?$AAb?$AAa?$AAs?$AAe?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x180024B28: "__vectorcall ??_R3error_category@std" ??_R3error_category@std@@8
0x180024AD8: "__vectorcall ??_R2error_category@std" ??_R2error_category@std@@8
0x180020AD8: "__cdecl _imp_GetTempFileNameW" __imp_GetTempFileNameW
0x180020F30: "__cdecl _imp_memset" __imp_memset
0x18001AB70: "private: static void __cdecl CommonUtil::CGenericGlobalAtStartup<struct CommonUtil::CGenericAtStartupPolicy<class CommonUtil::CMpVersionDllWrapper> >::OnDestroy(struct tagMP_AT_STARTUP_TYPE * __ptr64)" ?OnDestroy@?$CGenericGlobalAtStartup@U?$CGenericAtStartupPolicy@VCMpVersionDllWrapper@CommonUtil@@@CommonUtil@@@CommonUtil@@CAXPEAUtagMP_AT_STARTUP_TYPE@@@Z
0x180014AE0: "protected: virtual void * __ptr64 __cdecl MorroCommon::CWin32::GetProcessHeapImpl(void) __ptr64" ?GetProcessHeapImpl@CWin32@MorroCommon@@MEAAPEAXXZ
0x180014CD0: "protected: virtual int __cdecl MorroCommon::CWin32::ReadFileImpl(void * __ptr64,void * __ptr64,unsigned long,unsigned long * __ptr64,struct _OVERLAPPED * __ptr64) __ptr64" ?ReadFileImpl@CWin32@MorroCommon@@MEAAHPEAX0KPEAKPEAU_OVERLAPPED@@@Z
0x1800209F8: "__cdecl _imp_CreateEventW" __imp_CreateEventW
0x18000B2A0: "public: virtual class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const & __ptr64 __cdecl Microsoft::SecurityClient::CMalwareProviderConfiguration::EventLogName(void)const __ptr64" ?EventLogName@CMalwareProviderConfiguration@SecurityClient@Microsoft@@UEBAAEBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@XZ
0x18001BD3F: "__cdecl initterm" _initterm
0x18000E440: "public: __cdecl Microsoft::SecurityClient::CAmEventConsumer::CAmEventConsumer(class Microsoft::SecurityClient::IMalwareProviderConfiguration const & __ptr64) __ptr64" ??0CAmEventConsumer@SecurityClient@Microsoft@@QEAA@AEBVIMalwareProviderConfiguration@12@@Z
0x1800207E8: "__cdecl _imp_TraceMessage" __imp_TraceMessage
0x180014B30: "protected: virtual int __cdecl MorroCommon::CWin32::_wchmodImpl(unsigned short const * __ptr64,int) __ptr64" ?_wchmodImpl@CWin32@MorroCommon@@MEAAHPEBGH@Z
0x1800217F8: "resource unavailable try again" ??_C@_0BP@LKNGHENJ@resource?5unavailable?5try?5again?$AA@
0x180001A10: "public: virtual char const * __ptr64 __cdecl std::_Iostream_error_category::name(void)const __ptr64" ?name@_Iostream_error_category@std@@UEBAPEBDXZ
0x18000CD94: "public: class CommonUtil::CStdMoveable<class CommonUtil::CStdVector<struct IWbemClassObject * __ptr64,class std::allocator<struct IWbemClassObject * __ptr64> >,struct CommonUtil::CStdMoveableDefaultPolicy<class CommonUtil::CStdVector<struct IWbemClassObject * __ptr64,class std::allocator<struct IWbemClassObject * __ptr64> > > > __cdecl Microsoft::SecurityClient::CMalwareInstanceFactory::GetInstances(void)const __ptr64" ?GetInstances@CMalwareInstanceFactory@SecurityClient@Microsoft@@QEBA?AV?$CStdMoveable@V?$CStdVector@PEAUIWbemClassObject@@V?$allocator@PEAUIWbemClassObject@@@std@@@CommonUtil@@U?$CStdMoveableDefaultPolicy@V?$CStdVector@PEAUIWbemClassObject@@V?$allocator@PEAUIWbemClassObject@@@std@@@CommonUtil@@@2@@CommonUtil@@XZ
0x180021D08: "invalid seek" ??_C@_0N@OHAFKDEK@invalid?5seek?$AA@
0x180007D0C: "public: __cdecl std::bad_alloc::bad_alloc(class std::bad_alloc const & __ptr64) __ptr64" ??0bad_alloc@std@@QEAA@AEBV01@@Z
0x180025DC8: "const MorroCommon::CLockedCertCheckImpl::`RTTI Complete Object Locator'" ??_R4CLockedCertCheckImpl@MorroCommon@@6B@
0x180014280: "protected: virtual unsigned long __cdecl MorroCommon::CWin32::GetTempPathImpl(unsigned long,unsigned short * __ptr64) __ptr64" ?GetTempPathImpl@CWin32@MorroCommon@@MEAAKKPEAG@Z
0x180002930: "public: virtual long __cdecl ATL::IWbemInstProviderImpl::ExecQuery(unsigned short * __ptr64 const,unsigned short * __ptr64 const,long,struct IWbemContext * __ptr64,struct IEnumWbemClassObject * __ptr64 * __ptr64) __ptr64" ?ExecQuery@IWbemInstProviderImpl@ATL@@UEAAJQEAG0JPEAUIWbemContext@@PEAPEAUIEnumWbemClassObject@@@Z
0x180021D98: "no link" ??_C@_07PLECNNKG@no?5link?$AA@
0x1800150D0: "protected: virtual int __cdecl MorroCommon::CWin32::GetExitCodeThreadImpl(void * __ptr64,unsigned long * __ptr64) __ptr64" ?GetExitCodeThreadImpl@CWin32@MorroCommon@@MEAAHPEAXPEAK@Z
0x180014D70: "protected: virtual struct SC_HANDLE__ * __ptr64 __cdecl MorroCommon::CWin32::OpenServiceImpl(struct SC_HANDLE__ * __ptr64,unsigned short const * __ptr64,unsigned long) __ptr64" ?OpenServiceImpl@CWin32@MorroCommon@@MEAAPEAUSC_HANDLE__@@PEAU3@PEBGK@Z
0x18002DA80: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x1800221C8: "__cdecl GUID_9556dc99_828c_11cf_a37e_00aa003240c7" _GUID_9556dc99_828c_11cf_a37e_00aa003240c7
0x180020910: "__cdecl _imp_Sleep" __imp_Sleep
0x180020CC8: "__cdecl _imp_GetSystemMetrics" __imp_GetSystemMetrics
0x180029A40: "__cdecl CT??_R0?AVlogic_error@std@@@8??0logic_error@std@@QEAA@AEBV01@@Z24" _CT??_R0?AVlogic_error@std@@@8??0logic_error@std@@QEAA@AEBV01@@Z24
0x180006E28: "public: void __cdecl std::_Wrap_alloc<class std::allocator<struct std::_Tree_node<struct std::pair<long const,bool>,void * __ptr64> > >::deallocate(struct std::_Tree_node<struct std::pair<long const,bool>,void * __ptr64> * __ptr64,unsigned __int64) __ptr64" ?deallocate@?$_Wrap_alloc@V?$allocator@U?$_Tree_node@U?$pair@$$CBJ_N@std@@PEAX@std@@@std@@@std@@QEAAXPEAU?$_Tree_node@U?$pair@$$CBJ_N@std@@PEAX@2@_K@Z
0x180024DF0: "__vectorcall ??_R1BA@?0A@EA@CComObjectRootBase@ATL" ??_R1BA@?0A@EA@CComObjectRootBase@ATL@@8
0x180023760: "__cdecl _real@43e0000000000000" __real@43e0000000000000
0x18002D980: ?instance@?1??GetInstance@?$TSingletonWithProxy@VCWin32@MorroCommon@@@MorroCommon@@SAPEAVCWin32@3@XZ@4V43@A
0x18002D900: ?instance@?1??GetInstance@?$TSingletonWithProxy@VCFileUtils@MorroCommon@@@MorroCommon@@SAPEAVCFileUtils@3@XZ@4V43@A
0x18002D918: ?instance@?1??GetInstance@?$TSingletonWithProxy@VCPathUtils@MorroCommon@@@MorroCommon@@SAPEAVCPathUtils@3@XZ@4V43@A
0x180022218: "HKCR" ??_C@_19NCHLBIN@?$AAH?$AAK?$AAC?$AAR?$AA?$AA@
0x180021068: "__cdecl _xi_z" __xi_z
0x18001FE40: "const CommonUtil::CHResultException::`vftable'" ??_7CHResultException@CommonUtil@@6B@
0x180002380: "public: virtual long __cdecl ATL::CAtlModuleT<class CMalwareProviderDllModule>::AddCommonRGSReplacements(struct IRegistrarBase * __ptr64) __ptr64" ?AddCommonRGSReplacements@?$CAtlModuleT@VCMalwareProviderDllModule@@@ATL@@UEAAJPEAUIRegistrarBase@@@Z
0x180014C60: "protected: virtual int __cdecl MorroCommon::CWin32::VerifyVersionInfoImpl(struct _OSVERSIONINFOEXW * __ptr64,unsigned long,unsigned __int64) __ptr64" ?VerifyVersionInfoImpl@CWin32@MorroCommon@@MEAAHPEAU_OSVERSIONINFOEXW@@K_K@Z
0x1800208D0: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x1800018F0: "public: virtual void * __ptr64 __cdecl std::error_category::`scalar deleting destructor'(unsigned int) __ptr64" ??_Gerror_category@std@@UEAAPEAXI@Z
0x18001ABF0: "private: static long __cdecl CommonUtil::CGenericGlobalAtStartup<struct CommonUtil::CGenericAtStartupPolicy<class CommonUtil::CMpVersionDllWrapper> >::OnInitialize(struct tagMP_AT_STARTUP_TYPE * __ptr64)" ?OnInitialize@?$CGenericGlobalAtStartup@U?$CGenericAtStartupPolicy@VCMpVersionDllWrapper@CommonUtil@@@CommonUtil@@@CommonUtil@@CAJPEAUtagMP_AT_STARTUP_TYPE@@@Z
0x18002D8F0: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUznxlivUzmgrnzodzivUhlfixvUzkkozbviUxlnnlmUdnrsvokvioryUhixUlyquivUznwGEUhgwzucOlyq@WmiHelperLib" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUznxlivUzmgrnzodzivUhlfixvUzkkozbviUxlnnlmUdnrsvokvioryUhixUlyquivUznwGEUhgwzucOlyq@WmiHelperLib
0x180020D40: USERENV_NULL_THUNK_DATA
0x180007770: "long __cdecl ATL::AtlRegisterClassCategoriesHelper(struct _GUID const & __ptr64,struct ATL::_ATL_CATMAP_ENTRY const * __ptr64,int)" ?AtlRegisterClassCategoriesHelper@ATL@@YAJAEBU_GUID@@PEBU_ATL_CATMAP_ENTRY@1@H@Z
0x180029A68: "__cdecl TI3?AVlength_error@std@@" _TI3?AVlength_error@std@@
0x180021E38: "not a socket" ??_C@_0N@POEIPGGF@not?5a?5socket?$AA@
0x180006E28: "public: void __cdecl std::_Tree_buy<struct std::pair<long const,bool>,class std::allocator<struct std::pair<long const,bool> > >::_Freenode0(struct std::_Tree_node<struct std::pair<long const,bool>,void * __ptr64> * __ptr64) __ptr64" ?_Freenode0@?$_Tree_buy@U?$pair@$$CBJ_N@std@@V?$allocator@U?$pair@$$CBJ_N@std@@@2@@std@@QEAAXPEAU?$_Tree_node@U?$pair@$$CBJ_N@std@@PEAX@2@@Z
0x18001B696: "__cdecl _C_specific_handler" __C_specific_handler
0x180014EA0: "protected: virtual unsigned __int64 __cdecl MorroCommon::CWin32::SetTimerImpl(struct HWND__ * __ptr64,unsigned __int64,unsigned int,void (__cdecl*)(struct HWND__ * __ptr64,unsigned int,unsigned __int64,unsigned long)) __ptr64" ?SetTimerImpl@CWin32@MorroCommon@@MEAA_KPEAUHWND__@@_KIP6AX0I1K@Z@Z
0x180008018: "public: __cdecl Microsoft::SecurityClient::CEnsureImpersonationLevel::CEnsureImpersonationLevel(unsigned long) __ptr64" ??0CEnsureImpersonationLevel@SecurityClient@Microsoft@@QEAA@K@Z
0x1800208B0: "__cdecl _imp_ReleaseSRWLockExclusive" __imp_ReleaseSRWLockExclusive
0x180014B50: "protected: virtual unsigned long __cdecl MorroCommon::CWin32::GetModuleFileNameExImpl(void * __ptr64,struct HINSTANCE__ * __ptr64,unsigned short * __ptr64,unsigned long) __ptr64" ?GetModuleFileNameExImpl@CWin32@MorroCommon@@MEAAKPEAXPEAUHINSTANCE__@@PEAGK@Z
0x180016DF0: "protected: virtual long __cdecl MorroCommon::CPathUtils::GetDriveFolderFromPathImpl(unsigned short const * __ptr64,class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > & __ptr64) __ptr64" ?GetDriveFolderFromPathImpl@CPathUtils@MorroCommon@@MEAAJPEBGAEAV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@@Z
0x18002D9A4: "long volatile `public: static class MorroCommon::CCertCheckFactory * __ptr64 __cdecl MorroCommon::TSingletonWithProxy<class MorroCommon::CCertCheckFactory>::GetInstance(void)'::`2'::ts_staticInstanceGuard" ?ts_staticInstanceGuard@?1??GetInstance@?$TSingletonWithProxy@VCCertCheckFactory@MorroCommon@@@MorroCommon@@SAPEAVCCertCheckFactory@3@XZ@4JC
0x1800174E8: "private: static long __cdecl MorroCommon::CCertCheck::MicrosoftSelfCertCheck(unsigned short const * __ptr64,unsigned long,void * __ptr64)" ?MicrosoftSelfCertCheck@CCertCheck@MorroCommon@@CAJPEBGKPEAX@Z
0x180022A00: "CleaningAction" ??_C@_1BO@NJCIBIKA@?$AAC?$AAl?$AAe?$AAa?$AAn?$AAi?$AAn?$AAg?$AAA?$AAc?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x180020C48: "__cdecl _imp_PathAppendW" __imp_PathAppendW
0x180001B20: "public: virtual class std::error_condition __cdecl std::_System_error_category::default_error_condition(int)const __ptr64" ?default_error_condition@_System_error_category@std@@UEBA?AVerror_condition@2@H@Z
0x180019580: "public: virtual void * __ptr64 __cdecl MpCommonEx::CEventLoggerBase::`scalar deleting destructor'(unsigned int) __ptr64" ??_GCEventLoggerBase@MpCommonEx@@UEAAPEAXI@Z
0x1800257F0: "__vectorcall ??_R1BA@?0A@EA@CEventLoggerBase@MpCommonEx" ??_R1BA@?0A@EA@CEventLoggerBase@MpCommonEx@@8
0x180020E10: "__cdecl _imp__onexit" __imp__onexit
0x1800225A8: WPP_a077b9bb931237fbfb120848152c93d6_Traceguids
0x180014A30: "protected: virtual int __cdecl MorroCommon::CWin32::FreeResourceImpl(void * __ptr64) __ptr64" ?FreeResourceImpl@CWin32@MorroCommon@@MEAAHPEAX@Z
0x180023728: "__cdecl _real@3ff3c0c1fc8f3238" __real@3ff3c0c1fc8f3238
0x180023080: "*" ??_C@_13BBDEGPLJ@?$AA?$CK?$AA?$AA@
0x180021F28: "resource deadlock would occur" ??_C@_0BO@BJBOMOEJ@resource?5deadlock?5would?5occur?$AA@
0x18001BB54: memmove
0x18002D5D9: "struct CommonUtil::CCommonThrowWinErr CommonUtil::tWinErr" ?tWinErr@CommonUtil@@3UCCommonThrowWinErr@1@A
0x180020A70: "__cdecl _imp_HeapFree" __imp_HeapFree
0x180005150: "public: static void __cdecl CAutoMpClose::Release(struct tagMPCONTEXT * __ptr64)" ?Release@CAutoMpClose@@SAXPEAUtagMPCONTEXT@@@Z
0x180017180: "private: static long __cdecl MorroCommon::CCertCheck::MicrosoftCertChainCheck(void * __ptr64,unsigned long)" ?MicrosoftCertChainCheck@CCertCheck@MorroCommon@@CAJPEAXK@Z
0x18000A90C: WPP_SF_Sll
0x18002C388: "__vectorcall ??_R0?AV_Generic_error_category@std@" ??_R0?AV_Generic_error_category@std@@@8
0x18002D4C8: WPP_REGISTRATION_GUIDS
0x180015654: "public: class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > & __ptr64 __cdecl ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > >::operator=(class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > const & __ptr64) __ptr64" ??4?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAAEAV01@AEBV01@@Z
0x180021D28: "message size" ??_C@_0N@IFLPBIOP@message?5size?$AA@
0x180022E80: "%programfiles%\Windows Defender" ??_C@_1EA@HEALEMPM@?$AA?$CF?$AAp?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAf?$AAi?$AAl?$AAe?$AAs?$AA?$CF?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAD?$AAe?$AAf?$AAe?$AAn?$AAd?$AAe?$AAr?$AA?$AA@
0x18001FD08: "const MorroCommon::CPathUtils::`vftable'" ??_7CPathUtils@MorroCommon@@6B@
0x180001A20: "public: virtual class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > __cdecl std::_Iostream_error_category::message(int)const __ptr64" ?message@_Iostream_error_category@std@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@H@Z
0x1800256E0: "__vectorcall ??_R2CFileUtils@MorroCommon" ??_R2CFileUtils@MorroCommon@@8
0x180025758: "__vectorcall ??_R3CFileUtils@MorroCommon" ??_R3CFileUtils@MorroCommon@@8
0x1800229E0: "ExecutionStatus" ??_C@_1CA@CIMPKAAA@?$AAE?$AAx?$AAe?$AAc?$AAu?$AAt?$AAi?$AAo?$AAn?$AAS?$AAt?$AAa?$AAt?$AAu?$AAs?$AA?$AA@
0x180020D08: "__cdecl _imp_DestroyWindow" __imp_DestroyWindow
0x180020380: "const MpCommonEx::CEventLoggerBase::`vftable'" ??_7CEventLoggerBase@MpCommonEx@@6B@
0x180020828: "__cdecl _imp_OpenServiceW" __imp_OpenServiceW
0x180020D90: "__cdecl _imp_WTHelperProvDataFromStateData" __imp_WTHelperProvDataFromStateData
0x180008AC4: "public: void __cdecl ATL::CSimpleStringT<unsigned short,0>::SetString(unsigned short const * __ptr64,int) __ptr64" ?SetString@?$CSimpleStringT@G$0A@@ATL@@QEAAXPEBGH@Z
0x180020978: "__cdecl _imp_InitializeCriticalSectionAndSpinCount" __imp_InitializeCriticalSectionAndSpinCount
0x1800221E8: "Module_Raw" ??_C@_1BG@JBACFMF@?$AAM?$AAo?$AAd?$AAu?$AAl?$AAe?$AA_?$AAR?$AAa?$AAw?$AA?$AA@
0x180020EF0: "__cdecl _imp_iswalpha" __imp_iswalpha
0x18002CCD8: "__vectorcall ??_R0?AVCLockEntireFile@MorroCommon@" ??_R0?AVCLockEntireFile@MorroCommon@@@8
0x180003174: "public: __cdecl ATL::CTempBuffer<unsigned char,256,class ATL::CCRTAllocator>::~CTempBuffer<unsigned char,256,class ATL::CCRTAllocator>(void) __ptr64" ??1?$CTempBuffer@E$0BAA@VCCRTAllocator@ATL@@@ATL@@QEAA@XZ
0x180020820: "__cdecl _imp_RegCloseKey" __imp_RegCloseKey
0x180021C20: "connection refused" ??_C@_0BD@PJLIIJEL@connection?5refused?$AA@
0x180006E28: "public: void __cdecl std::_Wrap_alloc<class std::allocator<struct IWbemClassObject * __ptr64> >::deallocate(struct IWbemClassObject * __ptr64 * __ptr64,unsigned __int64) __ptr64" ?deallocate@?$_Wrap_alloc@V?$allocator@PEAUIWbemClassObject@@@std@@@std@@QEAAXPEAPEAUIWbemClassObject@@_K@Z
0x180022D80: "AmMonitoringEventLogSource" ??_C@_1DG@LIKDKHAH@?$AAA?$AAm?$AAM?$AAo?$AAn?$AAi?$AAt?$AAo?$AAr?$AAi?$AAn?$AAg?$AAE?$AAv?$AAe?$AAn?$AAt?$AAL?$AAo?$AAg?$AAS?$AAo?$AAu?$AAr?$AAc?$AAe?$AA?$AA@
0x18001BE8C: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x180023478: "GetProductInfo" ??_C@_0P@FOMLLNOL@GetProductInfo?$AA@
0x180029F40: "__cdecl _IMPORT_DESCRIPTOR_VERSION" __IMPORT_DESCRIPTOR_VERSION
0x180015070: "protected: virtual void * __ptr64 __cdecl MorroCommon::CWin32::CreateEventImpl(struct _SECURITY_ATTRIBUTES * __ptr64,int,int,unsigned short const * __ptr64) __ptr64" ?CreateEventImpl@CWin32@MorroCommon@@MEAAPEAXPEAU_SECURITY_ATTRIBUTES@@HHPEBG@Z
0x180022668: "IncludeQualifiers" ??_C@_1CE@HDJBFMCI@?$AAI?$AAn?$AAc?$AAl?$AAu?$AAd?$AAe?$AAQ?$AAu?$AAa?$AAl?$AAi?$AAf?$AAi?$AAe?$AAr?$AAs?$AA?$AA@
0x18001FE60: "const CommonUtil::CHResultExceptionImpl::`vftable'" ??_7CHResultExceptionImpl@CommonUtil@@6B@
0x180016560: "protected: virtual class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > __cdecl MorroCommon::CPathUtils::GetProgramFilesX86Impl(void) __ptr64" ?GetProgramFilesX86Impl@CPathUtils@MorroCommon@@MEAA?AV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@XZ
0x180022658: GUID_ATLVer70
0x180008680: "public: static void __cdecl Microsoft::SecurityClient::MpCommonEx::CSimpleLogCreator::Stop(bool)" ?Stop@CSimpleLogCreator@MpCommonEx@SecurityClient@Microsoft@@SAX_N@Z
0x180012450: "public: virtual void * __ptr64 __cdecl ATL::CWin32Heap::Reallocate(void * __ptr64,unsigned __int64) __ptr64" ?Reallocate@CWin32Heap@ATL@@UEAAPEAXPEAX_K@Z
0x18000FDD0: "public: virtual void * __ptr64 __cdecl CommonUtil::CHResultExceptionImpl::`scalar deleting destructor'(unsigned int) __ptr64" ??_GCHResultExceptionImpl@CommonUtil@@UEAAPEAXI@Z
0x180001F14: "public: class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > & __ptr64 __cdecl std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >::erase(unsigned __int64,unsigned __int64) __ptr64" ?erase@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAAEAV12@_K0@Z
0x180002370: "public: static struct ATL::_ATL_CATMAP_ENTRY const * __ptr64 __cdecl ATL::CComObjectRootBase::GetCategoryMap(void)" ?GetCategoryMap@CComObjectRootBase@ATL@@SAPEBU_ATL_CATMAP_ENTRY@2@XZ
0x180007480: DllCanUnloadNow
0x180025170: "__vectorcall ??_R3IWbemProviderInit" ??_R3IWbemProviderInit@@8
0x180024C90: "__vectorcall ??_R2IWbemProviderInit" ??_R2IWbemProviderInit@@8
0x180023660: CLSID_SWbemDateTime
0x180020810: "__cdecl _imp_RegEnumKeyExW" __imp_RegEnumKeyExW
0x180022058: CLSID_StdComponentCategoriesMgr
0x1800256D0: "__vectorcall ??_R2CPathUtils@MorroCommon" ??_R2CPathUtils@MorroCommon@@8
0x1800069B4: "public: __cdecl CommonUtil::CStdVector<struct IWbemClassObject * __ptr64,class std::allocator<struct IWbemClassObject * __ptr64> >::~CStdVector<struct IWbemClassObject * __ptr64,class std::allocator<struct IWbemClassObject * __ptr64> >(void) __ptr64" ??1?$CStdVector@PEAUIWbemClassObject@@V?$allocator@PEAUIWbemClassObject@@@std@@@CommonUtil@@QEAA@XZ
0x180025740: "__vectorcall ??_R3CPathUtils@MorroCommon" ??_R3CPathUtils@MorroCommon@@8
0x180008DBC: "private: void __cdecl ATL::CSimpleStringT<unsigned short,0>::Reallocate(int) __ptr64" ?Reallocate@?$CSimpleStringT@G$0A@@ATL@@AEAAXH@Z
0x180014FD0: "protected: virtual int __cdecl MorroCommon::CWin32::MoveFileImpl(unsigned short const * __ptr64,unsigned short const * __ptr64) __ptr64" ?MoveFileImpl@CWin32@MorroCommon@@MEAAHPEBG0@Z
0x180014D00: "protected: virtual int __cdecl MorroCommon::CWin32::WriteFileImpl(void * __ptr64,void const * __ptr64,unsigned long,unsigned long * __ptr64,struct _OVERLAPPED * __ptr64) __ptr64" ?WriteFileImpl@CWin32@MorroCommon@@MEAAHPEAXPEBXKPEAKPEAU_OVERLAPPED@@@Z
0x180014220: "protected: virtual int __cdecl MorroCommon::CWin32::DestroyWindowImpl(struct HWND__ * __ptr64) __ptr64" ?DestroyWindowImpl@CWin32@MorroCommon@@MEAAHPEAUHWND__@@@Z
0x180002760: "public: virtual unsigned long __cdecl ATL::CComObject<class CMalwareProvider>::AddRef(void) __ptr64" ?AddRef@?$CComObject@VCMalwareProvider@@@ATL@@UEAAKXZ
0x180025460: "__vectorcall ??_R2CComClassFactory@ATL" ??_R2CComClassFactory@ATL@@8
0x18000FA34: MpDetectionEnumerate
0x180025490: "__vectorcall ??_R3CComClassFactory@ATL" ??_R3CComClassFactory@ATL@@8
0x180014000: "struct MorroCommon::SFolderItem * __ptr64 __cdecl std::_Uninit_move<struct MorroCommon::SFolderItem * __ptr64,struct MorroCommon::SFolderItem * __ptr64,class std::allocator<struct MorroCommon::SFolderItem>,struct MorroCommon::SFolderItem>(struct MorroCommon::SFolderItem * __ptr64,struct MorroCommon::SFolderItem * __ptr64,struct MorroCommon::SFolderItem * __ptr64,struct std::_Wrap_alloc<class std::allocator<struct MorroCommon::SFolderItem> > & __ptr64,struct MorroCommon::SFolderItem * __ptr64,struct std::_Nonscalar_ptr_iterator_tag)" ??$_Uninit_move@PEAUSFolderItem@MorroCommon@@PEAU12@V?$allocator@USFolderItem@MorroCommon@@@std@@U12@@std@@YAPEAUSFolderItem@MorroCommon@@PEAU12@00AEAU?$_Wrap_alloc@V?$allocator@USFolderItem@MorroCommon@@@std@@@0@0U_Nonscalar_ptr_iterator_tag@0@@Z
0x180022460: "SYSTEM" ??_C@_1O@GBFINDKL@?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?$AA@
0x180026080: "__vectorcall ??_R3CPtrObject@CommonUtil" ??_R3CPtrObject@CommonUtil@@8
0x180025FF0: "__vectorcall ??_R2CPtrObject@CommonUtil" ??_R2CPtrObject@CommonUtil@@8
0x180023508: WPP_62bc956533203bbc022dd1ecb69c4649_Traceguids
0x1800228B0: "DetectionTime" ??_C@_1BM@CPCKAAIO@?$AAD?$AAe?$AAt?$AAe?$AAc?$AAt?$AAi?$AAo?$AAn?$AAT?$AAi?$AAm?$AAe?$AA?$AA@
0x18002D4A0: WPP_MAIN_CB
0x180008A34: "private: static struct ATL::CStringData * __ptr64 __cdecl ATL::CSimpleStringT<unsigned short,0>::CloneData(struct ATL::CStringData * __ptr64)" ?CloneData@?$CSimpleStringT@G$0A@@ATL@@CAPEAUCStringData@2@PEAU32@@Z
0x1800226D8: "IncludeClassOrigin" ??_C@_1CG@BNGPLHPD@?$AAI?$AAn?$AAc?$AAl?$AAu?$AAd?$AAe?$AAC?$AAl?$AAa?$AAs?$AAs?$AAO?$AAr?$AAi?$AAg?$AAi?$AAn?$AA?$AA@
0x18002D9B0: "public: static class std::locale::id std::num_put<char,class std::back_insert_iterator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >::id" ?id@?$num_put@DV?$back_insert_iterator@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@std@@@std@@2V0locale@2@A
0x180017CD8: "long __cdecl MorroCommon::HrCComBSTRAssign(class ATL::CComBSTR & __ptr64,unsigned short const * __ptr64)" ?HrCComBSTRAssign@MorroCommon@@YAJAEAVCComBSTR@ATL@@PEBG@Z
0x180002D10: "public: virtual void * __ptr64 __cdecl ATL::CRegObject::`scalar deleting destructor'(unsigned int) __ptr64" ??_GCRegObject@ATL@@UEAAPEAXI@Z
0x180012AD0: "private: long __cdecl MorroCommon::CFileUtils::CheckParams(class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > const & __ptr64) __ptr64" ?CheckParams@CFileUtils@MorroCommon@@AEAAJAEBV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@@Z
0x180020B88: "__cdecl _imp_GetPrivateProfileIntW" __imp_GetPrivateProfileIntW
0x1800148B0: "protected: virtual unsigned long __cdecl MorroCommon::CWin32::GetWindowThreadProcessIdImpl(struct HWND__ * __ptr64,unsigned long * __ptr64) __ptr64" ?GetWindowThreadProcessIdImpl@CWin32@MorroCommon@@MEAAKPEAUHWND__@@PEAK@Z
0x18000E000: "protected: class std::_Tree_iterator<class std::_Tree_val<struct std::_Tree_simple_types<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> > > > > __cdecl std::_Tree<class std::_Tmap_traits<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> >,class CommonUtil::AutoRef<struct IWbemClassObject>,struct std::less<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > >,class std::allocator<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> > >,0> >::_Insert_at<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> > & __ptr64,struct std::_Tree_node<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> >,void * __ptr64> * __ptr64>(bool,struct std::_Tree_node<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> >,void * __ptr64> * __ptr64,struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> > & __ptr64,struct std::_Tree_node<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> >,void * __ptr64> * __ptr64) __ptr64" ??$_Insert_at@AEAU?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@PEAU?$_Tree_node@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@PEAX@2@@?$_Tree@V?$_Tmap_traits@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@U?$less@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@@std@@V?$allocator@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@@5@$0A@@std@@@std@@IEAA?AV?$_Tree_iterator@V?$_Tree_val@U?$_Tree_simple_types@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@@std@@@std@@@1@_NPEAU?$_Tree_node@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@PEAX@1@AEAU?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@1@1@Z
0x180023740: "__stdcall _real" __real@4038000000000000
0x180020800: "__cdecl _imp_RegSetValueExW" __imp_RegSetValueExW
0x18002CEC8: "public: static class std::locale::id std::num_put<wchar_t,class std::back_insert_iterator<class std::basic_string<wchar_t,struct std::char_traits<wchar_t>,class std::allocator<wchar_t> > > >::id" ?id@?$num_put@_WV?$back_insert_iterator@V?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@@std@@@std@@2V0locale@2@A
0x18001BB6C: "__cdecl amsg_exit" _amsg_exit
0x180023488: WPP_0c5188e3415a3eacbef14bfb20a61e24_Traceguids
0x180022528: "RegDeleteKeyW" ??_C@_0O@BJCLIAAA@RegDeleteKeyW?$AA@
0x180025C50: "__vectorcall ??_R1A@?0A@EA@CCertCheckFactory@MorroCommon" ??_R1A@?0A@EA@CCertCheckFactory@MorroCommon@@8
0x180025AF0: "__vectorcall ??_R1A@?0A@EA@CHResultExceptionImpl@CommonUtil" ??_R1A@?0A@EA@CHResultExceptionImpl@CommonUtil@@8
0x180012FA0: "protected: virtual long __cdecl MorroCommon::CFileUtils::GetAvailableSpaceImpl(unsigned short const * __ptr64,union _ULARGE_INTEGER * __ptr64) __ptr64" ?GetAvailableSpaceImpl@CFileUtils@MorroCommon@@MEAAJPEBGPEAT_ULARGE_INTEGER@@@Z
0x180011DD4: MpUtilsOnDllMain
0x18001AE40: "public: virtual void * __ptr64 __cdecl std::out_of_range::`vector deleting destructor'(unsigned int) __ptr64" ??_Eout_of_range@std@@UEAAPEAXI@Z
0x180021BD8: "broken pipe" ??_C@_0M@KPHOFDBE@broken?5pipe?$AA@
0x180018550: "public: class CommonUtil::CReturnHandle<class CommonUtil::CUniqueHandle<struct CommonUtil::CAutoUniqueArrayPtrDelete2<unsigned short * __ptr64> > > __cdecl Microsoft::SecurityClient::CDateTimeFormatter::ToRoundTrip(void)const __ptr64" ?ToRoundTrip@CDateTimeFormatter@SecurityClient@Microsoft@@QEBA?AV?$CReturnHandle@V?$CUniqueHandle@U?$CAutoUniqueArrayPtrDelete2@PEAG@CommonUtil@@@CommonUtil@@@CommonUtil@@XZ
0x180015450: "protected: virtual int __cdecl MorroCommon::CWin32::SystemTimeToFileTimeImpl(struct _SYSTEMTIME const * __ptr64,struct _FILETIME * __ptr64) __ptr64" ?SystemTimeToFileTimeImpl@CWin32@MorroCommon@@MEAAHPEBU_SYSTEMTIME@@PEAU_FILETIME@@@Z
0x180011ADC: "long __cdecl CommonUtil::MpIsWow64Process(bool * __ptr64)" ?MpIsWow64Process@CommonUtil@@YAJPEA_N@Z
0x180021A80: "not_connected" ??_C@_0O@GBCLHHD@not_connected?$AA@
0x180007430: "public: __cdecl CommonUtil::CStdMoveable<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> >,struct CommonUtil::CStdMoveableDefaultPolicy<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > > >::~CStdMoveable<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> >,struct CommonUtil::CStdMoveableDefaultPolicy<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > > >(void) __ptr64" ??1?$CStdMoveable@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@U?$CStdMoveableDefaultPolicy@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@@2@@CommonUtil@@QEAA@XZ
0x180023448: CLSID_WbemAdministrativeLocator
0x180022EF8: "MpManagerVersionQuery" ??_C@_0BG@BPEBJMPE@MpManagerVersionQuery?$AA@
0x180017F20: "public: virtual void * __ptr64 __cdecl MorroCommon::ILockedCertCheck::`vector deleting destructor'(unsigned int) __ptr64" ??_EILockedCertCheck@MorroCommon@@UEAAPEAXI@Z
0x180021AE8: "timed_out" ??_C@_09NCHNLHPG@timed_out?$AA@
0x180018110: "protected: virtual struct MorroCommon::ILockedCertCheck * __ptr64 __cdecl MorroCommon::CCertCheckFactory::CreateCertCheckImpl(void) __ptr64" ?CreateCertCheckImpl@CCertCheckFactory@MorroCommon@@MEAAPEAUILockedCertCheck@2@XZ
0x180029D08: "__cdecl CTA2PEAVEUnknownError@MorroCommon@@" _CTA2PEAVEUnknownError@MorroCommon@@
0x1800225D8: "\Required Categories" ??_C@_1CK@IFBKBFAA@?$AA?2?$AAR?$AAe?$AAq?$AAu?$AAi?$AAr?$AAe?$AAd?$AA?5?$AAC?$AAa?$AAt?$AAe?$AAg?$AAo?$AAr?$AAi?$AAe?$AAs?$AA?$AA@
0x18002238C: "M" ??_C@_13LHMFKAAD@?$AAM?$AA?$AA@
0x180022A80: "WQL" ??_C@_17NDCOOGJO@?$AAW?$AAQ?$AAL?$AA?$AA@
0x180025438: "__vectorcall ??_R17?0A@EA@CComObjectRootBase@ATL" ??_R17?0A@EA@CComObjectRootBase@ATL@@8
0x1800159C0: "protected: virtual long __cdecl MorroCommon::CPathUtils::GetTempPathImpl(class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > & __ptr64) __ptr64" ?GetTempPathImpl@CPathUtils@MorroCommon@@MEAAJAEAV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@@Z
0x180021EF8: "protocol not supported" ??_C@_0BH@JPPPLHJB@protocol?5not?5supported?$AA@
0x180001BC8: "public: void __cdecl std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >::_Xran(void)const __ptr64" ?_Xran@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBAXXZ
0x180023730: "__stdcall _real" __real@4024000000000000
0x180012240: "public: virtual struct ATL::CStringData * __ptr64 __cdecl ATL::CAtlStringMgr::Allocate(int,int) __ptr64" ?Allocate@CAtlStringMgr@ATL@@UEAAPEAUCStringData@2@HH@Z
0x18002D964: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxuznxlivUzmgrnzodzivUhlfixvUzkkozbviUxlnnlmUnkxlnnlmvcUoryUlyquivUznwGEUhgwzucOlyq@MpCommonEx" __@@_PchSym_@00@KxulyqvxgPillgKxuznxlivUzmgrnzodzivUhlfixvUzkkozbviUxlnnlmUnkxlnnlmvcUoryUlyquivUznwGEUhgwzucOlyq@MpCommonEx
0x18000A230: "protected: struct std::pair<class std::_Tree_iterator<class std::_Tree_val<struct std::_Tree_simple_types<struct std::pair<long const,bool> > > >,bool> __cdecl std::_Tree<class std::_Tmap_traits<long,bool,struct std::less<long>,class std::allocator<struct std::pair<long const,bool> >,0> >::_Insert_nohint<struct std::pair<long const,bool> & __ptr64,struct std::_Tree_node<struct std::pair<long const,bool>,void * __ptr64> * __ptr64>(bool,struct std::pair<long const,bool> & __ptr64,struct std::_Tree_node<struct std::pair<long const,bool>,void * __ptr64> * __ptr64) __ptr64" ??$_Insert_nohint@AEAU?$pair@$$CBJ_N@std@@PEAU?$_Tree_node@U?$pair@$$CBJ_N@std@@PEAX@2@@?$_Tree@V?$_Tmap_traits@J_NU?$less@J@std@@V?$allocator@U?$pair@$$CBJ_N@std@@@2@$0A@@std@@@std@@IEAA?AU?$pair@V?$_Tree_iterator@V?$_Tree_val@U?$_Tree_simple_types@U?$pair@$$CBJ_N@std@@@std@@@std@@@std@@_N@1@_NAEAU?$pair@$$CBJ_N@1@PEAU?$_Tree_node@U?$pair@$$CBJ_N@std@@PEAX@1@@Z
0x180022068: GUID_NULL
0x180011840: "long __cdecl CommonUtil::HrExpandEnvironmentStrings(unsigned short const * __ptr64,unsigned __int64 * __ptr64,unsigned short * __ptr64)" ?HrExpandEnvironmentStrings@CommonUtil@@YAJPEBGPEA_KPEAG@Z
0x180001BC8: "public: void __cdecl std::basic_string<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> >::_Xran(void)const __ptr64" ?_Xran@?$basic_string@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@std@@QEBAXXZ
0x180020AA8: "__cdecl _imp_lstrcmpiW" __imp_lstrcmpiW
0x180021B40: "address not available" ??_C@_0BG@DHPCNBJB@address?5not?5available?$AA@
0x180020F00: "__cdecl _imp__lock" __imp__lock
0x180001FD0: "public: virtual void * __ptr64 __cdecl CMalwareProviderDllModule::`scalar deleting destructor'(unsigned int) __ptr64" ??_GCMalwareProviderDllModule@@UEAAPEAXI@Z
0x180023628: WPP_f3e3aaa1d7ab3100d8ae3cb75d7e43b9_Traceguids
0x180020C18: OLEAUT32_NULL_THUNK_DATA
0x180025B68: "__vectorcall ??_R1A@?0A@EA@CHResultException@CommonUtil" ??_R1A@?0A@EA@CHResultException@CommonUtil@@8
0x180006BB8: "private: bool __cdecl CMalwareProvider::CreateMalwareInstance(class Microsoft::SecurityClient::CMalwareInstanceFactory & __ptr64,struct tagMPTHREAT_INFO * __ptr64 const,struct tagMPVERSION_INFO * __ptr64 const,struct tagMPSTATUS_INFO * __ptr64 const) __ptr64" ?CreateMalwareInstance@CMalwareProvider@@AEAA_NAEAVCMalwareInstanceFactory@SecurityClient@Microsoft@@QEAUtagMPTHREAT_INFO@@QEAUtagMPVERSION_INFO@@QEAUtagMPSTATUS_INFO@@@Z
0x18001B61C: atexit
0x180025C30: "__vectorcall ??_R2CCertCheckFactory@MorroCommon" ??_R2CCertCheckFactory@MorroCommon@@8
0x180025CA0: "__vectorcall ??_R3CCertCheckFactory@MorroCommon" ??_R3CCertCheckFactory@MorroCommon@@8
0x180014F70: "protected: virtual int __cdecl MorroCommon::CWin32::InitiateSystemShutdownExImpl(unsigned short * __ptr64,unsigned short * __ptr64,unsigned long,int,int,unsigned long) __ptr64" ?InitiateSystemShutdownExImpl@CWin32@MorroCommon@@MEAAHPEAG0KHHK@Z
0x180015B90: "protected: virtual class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > __cdecl MorroCommon::CPathUtils::GetModuleNameByFullPathImpl(class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > const & __ptr64) __ptr64" ?GetModuleNameByFullPathImpl@CPathUtils@MorroCommon@@MEAA?AV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@AEBV34@@Z
0x180022648: "bad allocation" ??_C@_0P@GHFPNOJB@bad?5allocation?$AA@
0x1800018E0: "public: __cdecl ATL::CComBSTR::~CComBSTR(void) __ptr64" ??1CComBSTR@ATL@@QEAA@XZ
0x180029A88: "__cdecl CTA3?AVlength_error@std@@" _CTA3?AVlength_error@std@@
0x18002D530: "class ATL::CAtlBaseModule ATL::_AtlBaseModule" ?_AtlBaseModule@ATL@@3VCAtlBaseModule@1@A
0x18001071C: "long __cdecl CommonUtil::UtilRegGetValueDword(struct HKEY__ * __ptr64,unsigned short const * __ptr64,unsigned long * __ptr64)" ?UtilRegGetValueDword@CommonUtil@@YAJPEAUHKEY__@@PEBGPEAK@Z
0x180002930: "public: virtual long __cdecl ATL::IWbemInstProviderImpl::DeleteClassAsync(unsigned short * __ptr64 const,long,struct IWbemContext * __ptr64,struct IWbemObjectSink * __ptr64) __ptr64" ?DeleteClassAsync@IWbemInstProviderImpl@ATL@@UEAAJQEAGJPEAUIWbemContext@@PEAUIWbemObjectSink@@@Z
0x1800164B0: "protected: virtual class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > __cdecl MorroCommon::CPathUtils::GetProgramFilesImpl(void) __ptr64" ?GetProgramFilesImpl@CPathUtils@MorroCommon@@MEAA?AV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@XZ
0x180016C70: "protected: virtual long __cdecl MorroCommon::CPathUtils::GetProcessExecutableFullPathImpl(unsigned long,class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > & __ptr64) __ptr64" ?GetProcessExecutableFullPathImpl@CPathUtils@MorroCommon@@MEAAJKAEAV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@@Z
0x180024AE8: "const std::error_category::`RTTI Complete Object Locator'" ??_R4error_category@std@@6B@
0x18001AC40: "private: static long __cdecl CommonUtil::CGenericGlobalAtStartup<struct CommonUtil::CGenericAtStartupPolicy<class CommonUtil::CMpVersionDllWrapper> >::OnInitializeCallback(void * __ptr64)" ?OnInitializeCallback@?$CGenericGlobalAtStartup@U?$CGenericAtStartupPolicy@VCMpVersionDllWrapper@CommonUtil@@@CommonUtil@@@CommonUtil@@CAJPEAX@Z
0x1800208F8: "__cdecl _imp_EnterCriticalSection" __imp_EnterCriticalSection
0x180003194: "private: void __cdecl ATL::CTempBuffer<unsigned short,1024,class ATL::CCRTAllocator>::AllocateHeap(unsigned __int64) __ptr64" ?AllocateHeap@?$CTempBuffer@G$0EAA@VCCRTAllocator@ATL@@@ATL@@AEAAX_K@Z
0x18001FBF0: "const ATL::CComObjectCached<class ATL::CComClassFactory>::`vftable'" ??_7?$CComObjectCached@VCComClassFactory@ATL@@@ATL@@6B@
0x180021A08: "filename_too_long" ??_C@_0BC@LEEIKBAL@filename_too_long?$AA@
0x180020DC0: "__cdecl _imp_WTSEnumerateSessionsW" __imp_WTSEnumerateSessionsW
0x180022570: "invalid map/set<T> iterator" ??_C@_0BM@PAPJHAGI@invalid?5map?1set?$DMT?$DO?5iterator?$AA@
0x180021738: "io error" ??_C@_08GLNPIFBN@io?5error?$AA@
0x180022F88: "MpThreatOpen" ??_C@_0N@NLOFEOJC@MpThreatOpen?$AA@
0x1800207E0: "__cdecl _imp_GetTraceLoggerHandle" __imp_GetTraceLoggerHandle
0x180022020: "Invalid parameter passed to C ru" ??_C@_0DB@OPDBMGNG@Invalid?5parameter?5passed?5to?5C?5ru@
0x18002C2A0: "class ATL::CAtlStringMgr ATL::g_strmgr" ?g_strmgr@ATL@@3VCAtlStringMgr@1@A
0x180009990: "public: void __cdecl std::vector<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> >,class std::allocator<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > > >::push_back(class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const & __ptr64) __ptr64" ?push_back@?$vector@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$allocator@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@@std@@@std@@QEAAXAEBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@@Z
0x1800054F0: "public: __cdecl CMalwareProvider::~CMalwareProvider(void) __ptr64" ??1CMalwareProvider@@QEAA@XZ
0x180017C88: "long __cdecl MorroCommon::HrCStringAssign(class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > & __ptr64,unsigned short const * __ptr64)" ?HrCStringAssign@MorroCommon@@YAJAEAV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@PEBG@Z
0x180011F38: "unsigned __int64 __cdecl CommonUtil::UtilGetSystemTimeAsUlong64(void)" ?UtilGetSystemTimeAsUlong64@CommonUtil@@YA_KXZ
0x1800250C8: "__vectorcall ??_R1A@?0A@EA@CAtlModule@ATL" ??_R1A@?0A@EA@CAtlModule@ATL@@8
0x180021ED8: "owner dead" ??_C@_0L@BLPOFLNJ@owner?5dead?$AA@
0x180020D48: "__cdecl _imp_GetFileVersionInfoW" __imp_GetFileVersionInfoW
0x1800207D8: "__cdecl _imp_GetTraceEnableLevel" __imp_GetTraceEnableLevel
0x180015200: "protected: virtual int __cdecl MorroCommon::CWin32::PathRemoveFileSpecImpl(unsigned short * __ptr64) __ptr64" ?PathRemoveFileSpecImpl@CWin32@MorroCommon@@MEAAHPEAG@Z
0x18002C898: "__vectorcall ??_R0?AVEUnknownError@MorroCommon@" ??_R0?AVEUnknownError@MorroCommon@@@8
0x18001BB30: "public: __cdecl exception::exception(char const * __ptr64 const & __ptr64) __ptr64" ??0exception@@QEAA@AEBQEBD@Z
0x18001AF28: "char const * __ptr64 __cdecl std::_Winerror_map(int)" ?_Winerror_map@std@@YAPEBDH@Z
0x180029B38: "__stdcall CT??_R0?AVCAtlException@ATL@@" _CT??_R0?AVCAtlException@ATL@@@84
0x180029D98: "__cdecl _pobjMap_CMalwareProvider" __pobjMap_CMalwareProvider
0x180008664: "public: static long __cdecl Microsoft::SecurityClient::MpCommonEx::CSimpleLogCreator::Start(bool,struct _GUID const * __ptr64 const,unsigned long,unsigned short const * __ptr64,unsigned long)" ?Start@CSimpleLogCreator@MpCommonEx@SecurityClient@Microsoft@@SAJ_NQEBU_GUID@@KPEBGK@Z
0x180021860: "permission_denied" ??_C@_0BC@FNODOBAE@permission_denied?$AA@
0x1800208C0: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x1800235D8: "__cdecl GUID_5e97458a_cf77_11d3_b38f_00105a1f473a" _GUID_5e97458a_cf77_11d3_b38f_00105a1f473a
0x180022960: "ThreatName" ??_C@_1BG@EHILGFDL@?$AAT?$AAh?$AAr?$AAe?$AAa?$AAt?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x18001BD63: "__cdecl _dllonexit" __dllonexit
0x1800251B8: "__vectorcall ??_R3?$CComObject@VCMalwareProvider@@@ATL" ??_R3?$CComObject@VCMalwareProvider@@@ATL@@8
0x180024BB0: "__vectorcall ??_R2?$CComObject@VCMalwareProvider@@@ATL" ??_R2?$CComObject@VCMalwareProvider@@@ATL@@8
0x180013010: "private: long __cdecl MorroCommon::CFileUtils::GetFolderItems(class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > const & __ptr64,class std::vector<struct MorroCommon::SFolderItem,class std::allocator<struct MorroCommon::SFolderItem> > & __ptr64) __ptr64" ?GetFolderItems@CFileUtils@MorroCommon@@AEAAJAEBV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@AEAV?$vector@USFolderItem@MorroCommon@@V?$allocator@USFolderItem@MorroCommon@@@std@@@std@@@Z
0x180022F10: "MpHandleClose" ??_C@_0O@KNNLILAN@MpHandleClose?$AA@
0x180025920: "__vectorcall ??_R3CRefObject@CommonUtil" ??_R3CRefObject@CommonUtil@@8
0x180022280: "HKEY_CLASSES_ROOT" ??_C@_1CE@PACHPJFI@?$AAH?$AAK?$AAE?$AAY?$AA_?$AAC?$AAL?$AAA?$AAS?$AAS?$AAE?$AAS?$AA_?$AAR?$AAO?$AAO?$AAT?$AA?$AA@
0x180025910: "__vectorcall ??_R2CRefObject@CommonUtil" ??_R2CRefObject@CommonUtil@@8
0x1800141B0: "protected: virtual int __cdecl MorroCommon::CWin32::CreateDirectoryImpl(unsigned short const * __ptr64,struct _SECURITY_ATTRIBUTES * __ptr64) __ptr64" ?CreateDirectoryImpl@CWin32@MorroCommon@@MEAAHPEBGPEAU_SECURITY_ATTRIBUTES@@@Z
0x1800069F0: "public: virtual long __cdecl CMalwareProvider::ExecQueryAsync(unsigned short * __ptr64 const,unsigned short * __ptr64 const,long,struct IWbemContext * __ptr64,struct IWbemObjectSink * __ptr64) __ptr64" ?ExecQueryAsync@CMalwareProvider@@UEAAJQEAG0JPEAUIWbemContext@@PEAUIWbemObjectSink@@@Z
0x180005620: "public: virtual long __cdecl CMalwareProvider::Initialize(unsigned short * __ptr64,long,unsigned short * __ptr64,unsigned short * __ptr64,struct IWbemServices * __ptr64,struct IWbemContext * __ptr64,struct IWbemProviderInitSink * __ptr64) __ptr64" ?Initialize@CMalwareProvider@@UEAAJPEAGJ00PEAUIWbemServices@@PEAUIWbemContext@@PEAUIWbemProviderInitSink@@@Z
0x180019134: "public: void __cdecl Microsoft::SecurityClient::CWbemClassObjectHelper::Put(unsigned short const * __ptr64,long) __ptr64" ?Put@CWbemClassObjectHelper@SecurityClient@Microsoft@@QEAAXPEBGJ@Z
0x180006864: "public: __cdecl Microsoft::SecurityClient::CMalwareProviderConfiguration::~CMalwareProviderConfiguration(void) __ptr64" ??1CMalwareProviderConfiguration@SecurityClient@Microsoft@@QEAA@XZ
0x18002DA60: "__cdecl _native_startup_lock" __native_startup_lock
0x180024DA0: "__vectorcall ??_R1A@?0A@EA@?$CComObject@VCMalwareProvider@@@ATL" ??_R1A@?0A@EA@?$CComObject@VCMalwareProvider@@@ATL@@8
0x18000DC40: "public: struct std::_Tree_node<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> >,void * __ptr64> * __ptr64 __cdecl std::_Tree_buy<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> >,class std::allocator<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> > > >::_Buynode<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> >,class CommonUtil::AutoRef<struct IWbemClassObject> > >(struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> >,class CommonUtil::AutoRef<struct IWbemClassObject> > &&) __ptr64" ??$_Buynode@U?$pair@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@@?$_Tree_buy@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@V?$allocator@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@@2@@std@@QEAAPEAU?$_Tree_node@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@PEAX@1@$$QEAU?$pair@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@1@@Z
0x1800229C0: "Process" ??_C@_1BA@NMDNJJOO@?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AA?$AA@
0x180014630: "protected: virtual long __cdecl MorroCommon::CWin32::GetFileVersionInfoSizeImpl(unsigned short const * __ptr64,unsigned long * __ptr64) __ptr64" ?GetFileVersionInfoSizeImpl@CWin32@MorroCommon@@MEAAJPEBGPEAK@Z
0x180016A70: "protected: virtual long __cdecl MorroCommon::CPathUtils::GetTempFolderPathImpl(class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > & __ptr64) __ptr64" ?GetTempFolderPathImpl@CPathUtils@MorroCommon@@MEAAJAEAV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@@Z
0x180007D50: DllMain
0x1800218C0: "connection_already_in_progress" ??_C@_0BP@FOJJHMCC@connection_already_in_progress?$AA@
0x180022850: "%02d/%02d/%02d %02d:%02d:%02d UT" ??_C@_1EE@FOKABGAA@?$AA?$CF?$AA0?$AA2?$AAd?$AA?1?$AA?$CF?$AA0?$AA2?$AAd?$AA?1?$AA?$CF?$AA0?$AA2?$AAd?$AA?5?$AA?$CF?$AA0?$AA2?$AAd?$AA?3?$AA?$CF?$AA0?$AA2?$AAd?$AA?3?$AA?$CF?$AA0?$AA2?$AAd?$AA?5?$AAU?$AAT@
0x180011C9C: "class CommonUtil::CReturnHandle<class CommonUtil::CUniqueHandle<struct CommonUtil::CAutoUniqueArrayPtrDelete2<unsigned short * __ptr64> > > __cdecl CommonUtil::TrDuplicateStringW(unsigned short const * __ptr64)" ?TrDuplicateStringW@CommonUtil@@YA?AV?$CReturnHandle@V?$CUniqueHandle@U?$CAutoUniqueArrayPtrDelete2@PEAG@CommonUtil@@@CommonUtil@@@1@PEBG@Z
0x180025140: "__vectorcall ??_R3CMalwareProvider" ??_R3CMalwareProvider@@8
0x180024C10: "__vectorcall ??_R2CMalwareProvider" ??_R2CMalwareProvider@@8
0x18000AA68: "public: __cdecl Microsoft::SecurityClient::CMalwareProviderConfiguration::CMalwareProviderConfiguration(void) __ptr64" ??0CMalwareProviderConfiguration@SecurityClient@Microsoft@@QEAA@XZ
0x180020EA0: "__cdecl _imp_wcscat_s" __imp_wcscat_s
0x180014650: "protected: virtual int __cdecl MorroCommon::CWin32::GetFileVersionInfoImpl(unsigned short const * __ptr64,unsigned long,unsigned long,void * __ptr64) __ptr64" ?GetFileVersionInfoImpl@CWin32@MorroCommon@@MEAAHPEBGKKPEAX@Z
0x180010E74: "long __cdecl CommonUtil::MpNewBuffer<unsigned short>(unsigned short * __ptr64 * __ptr64,unsigned __int64)" ??$MpNewBuffer@G@CommonUtil@@YAJPEAPEAG_K@Z
0x180020DF8: "__cdecl _imp_realloc" __imp_realloc
0x180020ED0: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x18002CCA0: "__vectorcall ??_R0?AVCCertCheckFactory@MorroCommon@" ??_R0?AVCCertCheckFactory@MorroCommon@@@8
0x180014ED0: "protected: virtual int __cdecl MorroCommon::CWin32::KillTimerImpl(struct HWND__ * __ptr64,unsigned __int64) __ptr64" ?KillTimerImpl@CWin32@MorroCommon@@MEAAHPEAUHWND__@@_K@Z
0x1800153D0: "protected: virtual int __cdecl MorroCommon::CWin32::WTSQuerySessionInformationImpl(void * __ptr64,unsigned long,enum _WTS_INFO_CLASS,unsigned short * __ptr64 * __ptr64,unsigned long * __ptr64) __ptr64" ?WTSQuerySessionInformationImpl@CWin32@MorroCommon@@MEAAHPEAXKW4_WTS_INFO_CLASS@@PEAPEAGPEAK@Z
0x180020E38: "__cdecl _imp__wcstoui64" __imp__wcstoui64
0x1800208E8: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x180024D48: "__vectorcall ??_R2?$CAtlModuleT@VCMalwareProviderDllModule@@@ATL" ??_R2?$CAtlModuleT@VCMalwareProviderDllModule@@@ATL@@8
0x18002C688: "__vectorcall ??_R0?AVCMalwareProviderDllModule@" ??_R0?AVCMalwareProviderDllModule@@@8
0x180025200: "__vectorcall ??_R3?$CAtlModuleT@VCMalwareProviderDllModule@@@ATL" ??_R3?$CAtlModuleT@VCMalwareProviderDllModule@@@ATL@@8
0x180025798: "const MorroCommon::CFileUtils::`RTTI Complete Object Locator'" ??_R4CFileUtils@MorroCommon@@6B@
0x18001AEF8: "char const * __ptr64 __cdecl std::_Syserror_map(int)" ?_Syserror_map@std@@YAPEBDH@Z
0x1800216E8: "file exists" ??_C@_0M@MIDIAGJP@file?5exists?$AA@
0x180021CE0: "inappropriate io control operati" ??_C@_0CD@BNPLBMNA@inappropriate?5io?5control?5operati@
0x180017E5C: "public: void __cdecl ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > >::FormatV(unsigned short const * __ptr64,char * __ptr64) __ptr64" ?FormatV@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAXPEBGPEAD@Z
0x180022920: "ProductVersion" ??_C@_1BO@OKEPMKJE@?$AAP?$AAr?$AAo?$AAd?$AAu?$AAc?$AAt?$AAV?$AAe?$AAr?$AAs?$AAi?$AAo?$AAn?$AA?$AA@
0x180022A20: "ErrorCode" ??_C@_1BE@ILMBBNLH@?$AAE?$AAr?$AAr?$AAo?$AAr?$AAC?$AAo?$AAd?$AAe?$AA?$AA@
0x180020BC8: KERNEL32_NULL_THUNK_DATA
0x180002B00: "public: static void __cdecl ATL::CComObjectRootBase::ObjectMain(bool)" ?ObjectMain@CComObjectRootBase@ATL@@SAX_N@Z
0x180020B08: "__cdecl _imp_GetWindowsDirectoryW" __imp_GetWindowsDirectoryW
0x180021848: "too many files open" ??_C@_0BE@GHAFMPAH@too?5many?5files?5open?$AA@
0x180022978: "ThreatID" ??_C@_1BC@NMNONBBO@?$AAT?$AAh?$AAr?$AAe?$AAa?$AAt?$AAI?$AAD?$AA?$AA@
0x180020778: "__cdecl _imp_LookupPrivilegeNameW" __imp_LookupPrivilegeNameW
0x180022CE0: "AmMonitoringTestMode" ??_C@_1CK@FOAJBEJM@?$AAA?$AAm?$AAM?$AAo?$AAn?$AAi?$AAt?$AAo?$AAr?$AAi?$AAn?$AAg?$AAT?$AAe?$AAs?$AAt?$AAM?$AAo?$AAd?$AAe?$AA?$AA@
0x180014580: "protected: virtual int __cdecl MorroCommon::CWin32::ConvertStringSecurityDescriptorToSecurityDescriptorImpl(unsigned short const * __ptr64,unsigned long,void * __ptr64 * __ptr64,unsigned long * __ptr64) __ptr64" ?ConvertStringSecurityDescriptorToSecurityDescriptorImpl@CWin32@MorroCommon@@MEAAHPEBGKPEAPEAXPEAK@Z
0x18002C708: "__vectorcall ??_R0?AVCComClassFactory@ATL@" ??_R0?AVCComClassFactory@ATL@@@8
0x180020898: "__cdecl _imp_SleepConditionVariableSRW" __imp_SleepConditionVariableSRW
0x180020AC8: "__cdecl _imp_GetLastError" __imp_GetLastError
0x180007D34: "void * __ptr64 __cdecl operator new(unsigned __int64)" ??2@YAPEAX_K@Z
0x18002D968: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxuznxlivUzmgrnzodzivUhlfixvUzkkozbviUxlnklmvmghUnzmztvnvmgUdnrUznUnlmrglirmtUnzodzivkilerwvioryUlyquivUznwGEUhgwzucOlyq@MalwareProviderLib" __@@_PchSym_@00@KxulyqvxgPillgKxuznxlivUzmgrnzodzivUhlfixvUzkkozbviUxlnklmvmghUnzmztvnvmgUdnrUznUnlmrglirmtUnzodzivkilerwvioryUlyquivUznwGEUhgwzucOlyq@MalwareProviderLib
0x18001AE78: "void __cdecl std::_Xbad_alloc(void)" ?_Xbad_alloc@std@@YAXXZ
0x18001AE2C: "public: virtual __cdecl std::length_error::~length_error(void) __ptr64" ??1length_error@std@@UEAA@XZ
0x1800235F8: "%I64d" ??_C@_1M@OBKMGAH@?$AA?$CF?$AAI?$AA6?$AA4?$AAd?$AA?$AA@
0x180021A58: "no_buffer_space" ??_C@_0BA@FDIJKJCL@no_buffer_space?$AA@
0x18001BD6F: "__cdecl errno" _errno
0x180014940: "protected: virtual int __cdecl MorroCommon::CWin32::Process32FirstImpl(void * __ptr64,struct tagPROCESSENTRY32W * __ptr64) __ptr64" ?Process32FirstImpl@CWin32@MorroCommon@@MEAAHPEAXPEAUtagPROCESSENTRY32W@@@Z
0x18002CEA4: "__cdecl _native_dllmain_reason" __native_dllmain_reason
0x18001BE68: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x180024E40: "__vectorcall ??_R1A@?0A@EA@CMalwareProvider" ??_R1A@?0A@EA@CMalwareProvider@@8
0x18002D470: "__cdecl tls_index" _tls_index
0x180022150: "__cdecl GUID_00000146_0000_0000_c000_000000000046" _GUID_00000146_0000_0000_c000_000000000046
0x1800227A0: "map/set<T> too long" ??_C@_0BE@JONHPENG@map?1set?$DMT?$DO?5too?5long?$AA@
0x180002930: "public: virtual long __cdecl ATL::IWbemInstProviderImpl::ExecNotificationQueryAsync(unsigned short * __ptr64 const,unsigned short * __ptr64 const,long,struct IWbemContext * __ptr64,struct IWbemObjectSink * __ptr64) __ptr64" ?ExecNotificationQueryAsync@IWbemInstProviderImpl@ATL@@UEAAJQEAG0JPEAUIWbemContext@@PEAUIWbemObjectSink@@@Z
0x180021C38: "connection reset" ??_C@_0BB@IECNJNOI@connection?5reset?$AA@
0x180010224: "long __cdecl CommonUtil::UtilRegOpenKey(struct HKEY__ * __ptr64 * __ptr64,struct HKEY__ * __ptr64,unsigned short const * __ptr64,unsigned long)" ?UtilRegOpenKey@CommonUtil@@YAJPEAPEAUHKEY__@@PEAU2@PEBGK@Z
0x18002CBE8: "__vectorcall ??_R0?AVCWin32@MorroCommon@" ??_R0?AVCWin32@MorroCommon@@@8
0x180003B3C: "public: __cdecl ATL::CAtlException::CAtlException(long) __ptr64" ??0CAtlException@ATL@@QEAA@J@Z
0x18002C7B0: "__vectorcall ??_R0?AVCComObjectRootBase@ATL@" ??_R0?AVCComObjectRootBase@ATL@@@8
0x1800249F0: "const std::_Generic_error_category::`RTTI Complete Object Locator'" ??_R4_Generic_error_category@std@@6B@
0x180012B70: "protected: virtual long __cdecl MorroCommon::CFileUtils::ReadRtfFromFileImpl(class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > const & __ptr64,class ATL::CStringT<char,class ATL::StrTraitATL<char,class ATL::ChTraitsCRT<char> > > & __ptr64) __ptr64" ?ReadRtfFromFileImpl@CFileUtils@MorroCommon@@MEAAJAEBV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@AEAV?$CStringT@DV?$StrTraitATL@DV?$ChTraitsCRT@D@ATL@@@ATL@@@4@@Z
0x18002CE58: "__vectorcall ??_R0?AVCPredefinedMpHeapsHolder@CommonUtil@" ??_R0?AVCPredefinedMpHeapsHolder@CommonUtil@@@8
0x180020C50: "__cdecl _imp_PathCombineW" __imp_PathCombineW
0x180021DA0: "no message available" ??_C@_0BF@PBGGPKKE@no?5message?5available?$AA@
0x18000B290: "public: virtual double __cdecl Microsoft::SecurityClient::CMalwareProviderConfiguration::TimeWindowDays(void)const __ptr64" ?TimeWindowDays@CMalwareProviderConfiguration@SecurityClient@Microsoft@@UEBANXZ
0x180014520: "protected: virtual int __cdecl MorroCommon::CWin32::FreeLibraryImpl(struct HINSTANCE__ * __ptr64) __ptr64" ?FreeLibraryImpl@CWin32@MorroCommon@@MEAAHPEAUHINSTANCE__@@@Z
0x180013D8C: "protected: void __cdecl std::vector<struct MorroCommon::SFolderItem,class std::allocator<struct MorroCommon::SFolderItem> >::_Reallocate(unsigned __int64) __ptr64" ?_Reallocate@?$vector@USFolderItem@MorroCommon@@V?$allocator@USFolderItem@MorroCommon@@@std@@@std@@IEAAX_K@Z
0x180022DE8: "AmMonitoringMaxSizeOfInstance" ??_C@_1DM@FPHOPAKP@?$AAA?$AAm?$AAM?$AAo?$AAn?$AAi?$AAt?$AAo?$AAr?$AAi?$AAn?$AAg?$AAM?$AAa?$AAx?$AAS?$AAi?$AAz?$AAe?$AAO?$AAf?$AAI?$AAn?$AAs?$AAt?$AAa?$AAn?$AAc?$AAe?$AA?$AA@
0x180029F54: "__cdecl _IMPORT_DESCRIPTOR_SHLWAPI" __IMPORT_DESCRIPTOR_SHLWAPI
0x18002C320: "__vectorcall ??_R0?AVerror_category@std@" ??_R0?AVerror_category@std@@@8
0x18002641C: "__cdecl tls_start" _tls_start
0x180002930: "public: virtual long __cdecl ATL::IWbemInstProviderImpl::QueryObjectSink(long,struct IWbemObjectSink * __ptr64 * __ptr64) __ptr64" ?QueryObjectSink@IWbemInstProviderImpl@ATL@@UEAAJJPEAPEAUIWbemObjectSink@@@Z
0x180002D10: "public: virtual void * __ptr64 __cdecl ATL::CRegObject::`vector deleting destructor'(unsigned int) __ptr64" ??_ECRegObject@ATL@@UEAAPEAXI@Z
0x180022738: WPP_293d76f92c0f3b94aeb3cef6d67d60b3_Traceguids
0x180001980: "public: virtual bool __cdecl std::error_category::equivalent(class std::error_code const & __ptr64,int)const __ptr64" ?equivalent@error_category@std@@UEBA_NAEBVerror_code@2@H@Z
0x180021078: "__cdecl _xl_z" __xl_z
0x180020870: "__cdecl _imp_OutputDebugStringA" __imp_OutputDebugStringA
0x180024CA8: "__vectorcall ??_R2IWbemServices" ??_R2IWbemServices@@8
0x180029EA0: "__cdecl _IMPORT_DESCRIPTOR_ADVAPI32" __IMPORT_DESCRIPTOR_ADVAPI32
0x180025188: "__vectorcall ??_R3IWbemServices" ??_R3IWbemServices@@8
0x180015570: "protected: virtual unsigned int __cdecl MorroCommon::CWin32::GetDriveTypeImpl(unsigned short const * __ptr64) __ptr64" ?GetDriveTypeImpl@CWin32@MorroCommon@@MEAAIPEBG@Z
0x180014300: "protected: virtual int __cdecl MorroCommon::CWin32::CopyFileImpl(unsigned short const * __ptr64,unsigned short const * __ptr64,int) __ptr64" ?CopyFileImpl@CWin32@MorroCommon@@MEAAHPEBG0H@Z
0x18001AE40: "public: virtual void * __ptr64 __cdecl std::out_of_range::`scalar deleting destructor'(unsigned int) __ptr64" ??_Gout_of_range@std@@UEAAPEAXI@Z
0x180022548: "NULL" ??_C@_19CIJIHAKK@?$AAN?$AAU?$AAL?$AAL?$AA?$AA@
0x1800220C0: "Delete" ??_C@_1O@JDLOHAN@?$AAD?$AAe?$AAl?$AAe?$AAt?$AAe?$AA?$AA@
0x18001F000: "const std::out_of_range::`vftable'" ??_7out_of_range@std@@6B@
0x18002C738: "__vectorcall ??_R0?AUIClassFactory@" ??_R0?AUIClassFactory@@@8
0x180020888: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x1800026C0: "public: virtual long __cdecl ATL::CComObject<class CMalwareProvider>::QueryInterface(struct _GUID const & __ptr64,void * __ptr64 * __ptr64) __ptr64" ?QueryInterface@?$CComObject@VCMalwareProvider@@@ATL@@UEAAJAEBU_GUID@@PEAPEAX@Z
0x1800209D0: "__cdecl _imp_WaitForSingleObject" __imp_WaitForSingleObject
0x180020860: "__cdecl _imp_CertVerifyCertificateChainPolicy" __imp_CertVerifyCertificateChainPolicy
0x1800220A8: "NoRemove" ??_C@_1BC@GCKHIPE@?$AAN?$AAo?$AAR?$AAe?$AAm?$AAo?$AAv?$AAe?$AA?$AA@
0x180020B60: "__cdecl _imp_GetLongPathNameW" __imp_GetLongPathNameW
0x180021A30: "network_reset" ??_C@_0O@EHNDLHIG@network_reset?$AA@
0x1800220D8: "unknown error" ??_C@_0O@BFJCFAAK@unknown?5error?$AA@
0x180019818: "public: static long __cdecl MpCommonEx::CPathUtilsEx::CombinePath(unsigned short * __ptr64 * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64)" ?CombinePath@CPathUtilsEx@MpCommonEx@@SAJPEAPEAGPEBG1@Z
0x180024F80: "__vectorcall ??_R1A@?0A@EA@CMalwareProviderDllModule" ??_R1A@?0A@EA@CMalwareProviderDllModule@@8
0x180019044: "public: void __cdecl Microsoft::SecurityClient::CWbemClassObjectHelper::Put(unsigned short const * __ptr64,unsigned int) __ptr64" ?Put@CWbemClassObjectHelper@SecurityClient@Microsoft@@QEAAXPEBGI@Z
0x18000F018: "long __cdecl Microsoft::SecurityClient::InitializeMpClientApi(void)" ?InitializeMpClientApi@SecurityClient@Microsoft@@YAJXZ
0x1800119F8: "long __cdecl CommonUtil::UtilRawGetLoadedKernel32ProcAddress(__int64 (__cdecl* * __ptr64)(void),char const * __ptr64,bool)" ?UtilRawGetLoadedKernel32ProcAddress@CommonUtil@@YAJPEAP6A_JXZPEBD_N@Z
0x180006A40: "public: virtual long __cdecl CMalwareProvider::ExecMethodAsync(unsigned short * __ptr64 const,unsigned short * __ptr64 const,long,struct IWbemContext * __ptr64,struct IWbemClassObject * __ptr64,struct IWbemObjectSink * __ptr64) __ptr64" ?ExecMethodAsync@CMalwareProvider@@UEAAJQEAG0JPEAUIWbemContext@@PEAUIWbemClassObject@@PEAUIWbemObjectSink@@@Z
0x180002340: "public: static long __cdecl ATL::CComCreator2<class ATL::CComCreator<class ATL::CComObject<class CMalwareProvider> >,class ATL::CComFailCreator<-2147221232> >::CreateInstance(void * __ptr64,struct _GUID const & __ptr64,void * __ptr64 * __ptr64)" ?CreateInstance@?$CComCreator2@V?$CComCreator@V?$CComObject@VCMalwareProvider@@@ATL@@@ATL@@V?$CComFailCreator@$0?HPPLPOPA@@2@@ATL@@SAJPEAXAEBU_GUID@@PEAPEAX@Z
0x180014A90: "protected: virtual int __cdecl MorroCommon::CWin32::RemoveDirectoryImpl(unsigned short const * __ptr64) __ptr64" ?RemoveDirectoryImpl@CWin32@MorroCommon@@MEAAHPEBG@Z
0x1800258C0: "const Microsoft::SecurityClient::CMalwareProviderEventLogger::`RTTI Complete Object Locator'{for `CommonUtil::CRefObject'}" ??_R4CMalwareProviderEventLogger@SecurityClient@Microsoft@@6BCRefObject@CommonUtil@@@
0x180025960: "__vectorcall ??_R2CMalwareProviderConfiguration@SecurityClient@Microsoft" ??_R2CMalwareProviderConfiguration@SecurityClient@Microsoft@@8
0x1800259D8: "__vectorcall ??_R3CMalwareProviderConfiguration@SecurityClient@Microsoft" ??_R3CMalwareProviderConfiguration@SecurityClient@Microsoft@@8
0x180011008: "long __cdecl CommonUtil::NewSprintfW(unsigned short * __ptr64 * __ptr64,unsigned short const * __ptr64,...)" ?NewSprintfW@CommonUtil@@YAJPEAPEAGPEBGZZ
0x180003120: "public: virtual long __cdecl ATL::CRegObject::AddReplacement(unsigned short const * __ptr64,unsigned short const * __ptr64) __ptr64" ?AddReplacement@CRegObject@ATL@@UEAAJPEBG0@Z
0x180017F20: "public: virtual void * __ptr64 __cdecl MorroCommon::ILockedCertCheck::`scalar deleting destructor'(unsigned int) __ptr64" ??_GILockedCertCheck@MorroCommon@@UEAAPEAXI@Z
0x18001FEA8: "const ATL::CWin32Heap::`vftable'" ??_7CWin32Heap@ATL@@6B@
0x180020D20: "__cdecl _imp_LoadIconW" __imp_LoadIconW
0x180020F40: "__cdecl _imp_RtlGetVersion" __imp_RtlGetVersion
0x1800207F0: "__cdecl _imp_RegDeleteValueW" __imp_RegDeleteValueW
0x18002C3F8: "__vectorcall ??_R0?AVCAtlModule@ATL@" ??_R0?AVCAtlModule@ATL@@@8
0x180020360: "const MorroCommon::ILockedCertCheck::`vftable'" ??_7ILockedCertCheck@MorroCommon@@6B@
0x180020F60: "__cdecl _imp_CoRevertToSelf" __imp_CoRevertToSelf
0x180020BC0: "__cdecl _imp_GlobalFindAtomW" __imp_GlobalFindAtomW
0x180022728: "__cdecl GUID_44aca674_e8fc_11d0_a07c_00c04fb68820" _GUID_44aca674_e8fc_11d0_a07c_00c04fb68820
0x18001BC30: "__cdecl ValidateImageBase" _ValidateImageBase
0x180024AA0: "__vectorcall ??_R3_Generic_error_category@std" ??_R3_Generic_error_category@std@@8
0x180024B10: "__vectorcall ??_R2_Generic_error_category@std" ??_R2_Generic_error_category@std@@8
0x180025CD0: "const MorroCommon::CCertCheckFactory::`RTTI Complete Object Locator'" ??_R4CCertCheckFactory@MorroCommon@@6B@
0x18001A678: "long __cdecl CommonUtil::CreateNewRefObject<class CommonUtil::CMpGlobalVarsTable>(class CommonUtil::CMpGlobalVarsTable * __ptr64 * __ptr64)" ??$CreateNewRefObject@VCMpGlobalVarsTable@CommonUtil@@@CommonUtil@@YAJPEAPEAVCMpGlobalVarsTable@0@@Z
0x18002C8C8: "__vectorcall ??_R0?AVEHresultException@MorroCommon@" ??_R0?AVEHresultException@MorroCommon@@@8
0x180022A58: WPP_50ecdaa19c3f33d4c6217cb1354afd50_Traceguids
0x180020A90: "__cdecl _imp_SizeofResource" __imp_SizeofResource
0x18001BB18: "public: __cdecl exception::exception(class exception const & __ptr64) __ptr64" ??0exception@@QEAA@AEBV0@@Z
0x180004E74: "long __cdecl MpSmartConfigInitialize(struct MpConfigLibraryType * __ptr64 * __ptr64)" ?MpSmartConfigInitialize@@YAJPEAPEAUMpConfigLibraryType@@@Z
0x180021F88: "text file busy" ??_C@_0P@IPFDMIFL@text?5file?5busy?$AA@
0x180006CFC: "public: __cdecl CommonUtil::AutoRef<struct IWbemClassObject>::~AutoRef<struct IWbemClassObject>(void) __ptr64" ??1?$AutoRef@UIWbemClassObject@@@CommonUtil@@QEAA@XZ
0x180022A68: "root\cimv2" ??_C@_1BG@GIKPMPCO@?$AAr?$AAo?$AAo?$AAt?$AA?2?$AAc?$AAi?$AAm?$AAv?$AA2?$AA?$AA@
0x180022A90: "SELECT * FROM Win32_NTLogEvent W" ??_C@_1BDI@KCCCPPFO@?$AAS?$AAE?$AAL?$AAE?$AAC?$AAT?$AA?5?$AA?$CK?$AA?5?$AAF?$AAR?$AAO?$AAM?$AA?5?$AAW?$AAi?$AAn?$AA3?$AA2?$AA_?$AAN?$AAT?$AAL?$AAo?$AAg?$AAE?$AAv?$AAe?$AAn?$AAt?$AA?5?$AAW@
0x180022958: "%ls" ??_C@_17CNPHIMPH@?$AA?$CF?$AAl?$AAs?$AA?$AA@
0x180014D90: "protected: virtual int __cdecl MorroCommon::CWin32::ChangeServiceConfigImpl(struct SC_HANDLE__ * __ptr64,unsigned long,unsigned long,unsigned long,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned long * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64) __ptr64" ?ChangeServiceConfigImpl@CWin32@MorroCommon@@MEAAHPEAUSC_HANDLE__@@KKKPEBG1PEAK1111@Z
0x180001FD0: "public: virtual void * __ptr64 __cdecl CMalwareProviderDllModule::`vector deleting destructor'(unsigned int) __ptr64" ??_ECMalwareProviderDllModule@@UEAAPEAXI@Z
0x1800207B8: "__cdecl _imp_DuplicateTokenEx" __imp_DuplicateTokenEx
0x180006CFC: "public: __cdecl CommonUtil::AutoRef<struct IWbemLocator>::~AutoRef<struct IWbemLocator>(void) __ptr64" ??1?$AutoRef@UIWbemLocator@@@CommonUtil@@QEAA@XZ
0x180022130: "string too long" ??_C@_0BA@JFNIOLAK@string?5too?5long?$AA@
0x180023608: WPP_96c2db06e5a03b9c99a3d5391a49746a_Traceguids
0x180021BB0: "bad file descriptor" ??_C@_0BE@MPJPGCEO@bad?5file?5descriptor?$AA@
0x18000D8D4: "public: class CommonUtil::AutoRef<struct IWbemClassObject> & __ptr64 __cdecl std::map<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> >,class CommonUtil::AutoRef<struct IWbemClassObject>,struct std::less<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > >,class std::allocator<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> > > >::operator[](class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const & __ptr64) __ptr64" ??A?$map@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@U?$less@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@@std@@V?$allocator@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@@5@@std@@QEAAAEAV?$AutoRef@UIWbemClassObject@@@CommonUtil@@AEBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@3@@Z
0x180022238: "HKLM" ??_C@_19PEALEEJB@?$AAH?$AAK?$AAL?$AAM?$AA?$AA@
0x180025340: "__vectorcall ??_R1A@?0A@EA@IClassFactory" ??_R1A@?0A@EA@IClassFactory@@8
0x180025ED8: "const CommonUtil::CMpUtilsLibrary::`RTTI Complete Object Locator'" ??_R4CMpUtilsLibrary@CommonUtil@@6B@
0x180029EF0: "__cdecl _IMPORT_DESCRIPTOR_WTSAPI32" __IMPORT_DESCRIPTOR_WTSAPI32
0x180020CE8: "__cdecl _imp_PostMessageW" __imp_PostMessageW
0x180014980: "protected: virtual int __cdecl MorroCommon::CWin32::TerminateProcessImpl(void * __ptr64,unsigned int) __ptr64" ?TerminateProcessImpl@CWin32@MorroCommon@@MEAAHPEAXI@Z
0x1800173D4: "public: static long __cdecl MorroCommon::CCertCheck::IsMicrosoftCert(unsigned short const * __ptr64,void * __ptr64)" ?IsMicrosoftCert@CCertCheck@MorroCommon@@SAJPEBGPEAX@Z
0x180022830: "0" ??_C@_13COJANIEC@?$AA0?$AA?$AA@
0x180022C80: "SOFTWARE\Microsoft\Microsoft Sec" ??_C@_1FK@OKJMJONP@?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?5?$AAS?$AAe?$AAc@
0x1800209C0: "__cdecl _imp_GetTempPathW" __imp_GetTempPathW
0x1800253E8: "__vectorcall ??_R1A@?0A@EA@CComObjectRootBase@ATL" ??_R1A@?0A@EA@CComObjectRootBase@ATL@@8
0x1800052B8: WPP_SF_
0x180012400: "public: virtual void * __ptr64 __cdecl ATL::CWin32Heap::Allocate(unsigned __int64) __ptr64" ?Allocate@CWin32Heap@ATL@@UEAAPEAX_K@Z
0x180029F04: "__cdecl _IMPORT_DESCRIPTOR_USERENV" __IMPORT_DESCRIPTOR_USERENV
0x180022118: "invalid string position" ??_C@_0BI@CFPLBAOH@invalid?5string?5position?$AA@
0x1800073A8: "protected: void __cdecl std::vector<struct IWbemClassObject * __ptr64,class std::allocator<struct IWbemClassObject * __ptr64> >::_Xlen(void)const __ptr64" ?_Xlen@?$vector@PEAUIWbemClassObject@@V?$allocator@PEAUIWbemClassObject@@@std@@@std@@IEBAXXZ
0x180020A78: "__cdecl _imp_HeapAlloc" __imp_HeapAlloc
0x1800092B8: "public: void __cdecl Microsoft::SecurityClient::CMalwareProviderEventLogger::LogSizeOfInstanceExceeded(unsigned long,unsigned long) __ptr64" ?LogSizeOfInstanceExceeded@CMalwareProviderEventLogger@SecurityClient@Microsoft@@QEAAXKK@Z
0x180006E28: "protected: void __cdecl std::_Tree<class std::_Tmap_traits<long,bool,struct std::less<long>,class std::allocator<struct std::pair<long const,bool> >,0> >::_Destroy_if_not_nil(struct std::_Tree_node<struct std::pair<long const,bool>,void * __ptr64> * __ptr64) __ptr64" ?_Destroy_if_not_nil@?$_Tree@V?$_Tmap_traits@J_NU?$less@J@std@@V?$allocator@U?$pair@$$CBJ_N@std@@@2@$0A@@std@@@std@@IEAAXPEAU?$_Tree_node@U?$pair@$$CBJ_N@std@@PEAX@2@@Z
0x180013EEC: "private: void __cdecl ATL::CSimpleStringT<char,0>::Reallocate(int) __ptr64" ?Reallocate@?$CSimpleStringT@D$0A@@ATL@@AEAAXH@Z
0x180029EB4: "__cdecl _IMPORT_DESCRIPTOR_ole32" __IMPORT_DESCRIPTOR_ole32
0x180015410: "protected: virtual __int64 (__cdecl*__cdecl MorroCommon::CWin32::GetProcAddressImpl(struct HINSTANCE__ * __ptr64,char const * __ptr64) __ptr64)(void)" ?GetProcAddressImpl@CWin32@MorroCommon@@MEAAP6A_JXZPEAUHINSTANCE__@@PEBD@Z
0x180020AD0: "__cdecl _imp_FreeLibrary" __imp_FreeLibrary
0x180021EA8: "operation not supported" ??_C@_0BI@LNEGIFLN@operation?5not?5supported?$AA@
0x180022748: WPP_cc33a21dc7b8337d8ea502ecc58ea06a_Traceguids
0x18001704C: "private: long __cdecl MorroCommon::CWPPTrace::SetTracingEnabled(bool) __ptr64" ?SetTracingEnabled@CWPPTrace@MorroCommon@@AEAAJ_N@Z
0x1800208A8: "__cdecl _imp_AcquireSRWLockExclusive" __imp_AcquireSRWLockExclusive
0x180020BA8: "__cdecl _imp_ProcessIdToSessionId" __imp_ProcessIdToSessionId
0x1800236F0: "VerQueryValueW" ??_C@_0P@BMNOKKJF@VerQueryValueW?$AA@
0x18002C850: "__vectorcall ??_R0?AVCAtlException@ATL@" ??_R0?AVCAtlException@ATL@@@8
0x180024AB8: "__vectorcall ??_R2_Iostream_error_category@std" ??_R2_Iostream_error_category@std@@8
0x180024A68: "__vectorcall ??_R3_Iostream_error_category@std" ??_R3_Iostream_error_category@std@@8
0x1800195B8: "public: virtual __cdecl MpCommonEx::CEventLoggerBase::~CEventLoggerBase(void) __ptr64" ??1CEventLoggerBase@MpCommonEx@@UEAA@XZ
0x18002C080: "public: static class std::_Iostream_error_category std::_Error_objects<int>::_Iostream_object" ?_Iostream_object@?$_Error_objects@H@std@@2V_Iostream_error_category@2@A
0x1800209F0: "__cdecl _imp_OpenProcess" __imp_OpenProcess
0x1800208A0: "__cdecl _imp_WakeAllConditionVariable" __imp_WakeAllConditionVariable
0x18001BB24: "public: __cdecl exception::exception(void) __ptr64" ??0exception@@QEAA@XZ
0x180021E28: "not a directory" ??_C@_0BA@DOCPFFJG@not?5a?5directory?$AA@
0x18001FAE0: "const ATL::CComObject<class CMalwareProvider>::`vftable'{for `IWbemServices'}" ??_7?$CComObject@VCMalwareProvider@@@ATL@@6BIWbemServices@@@
0x1800147E0: "protected: virtual int __cdecl MorroCommon::CWin32::SetWindowTextImpl(struct HWND__ * __ptr64,unsigned short const * __ptr64) __ptr64" ?SetWindowTextImpl@CWin32@MorroCommon@@MEAAHPEAUHWND__@@PEBG@Z
0x1800121AC: MpUtilsUninitialize
0x180013C40: "public: class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > __cdecl ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > >::Left(int)const __ptr64" ?Left@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEBA?AV12@H@Z
0x180020848: "__cdecl _imp_GetSidSubAuthority" __imp_GetSidSubAuthority
0x18001B1E0: "__cdecl DllMainCRTStartup" _DllMainCRTStartup
0x180025938: "const CommonUtil::CRefObject::`RTTI Complete Object Locator'" ??_R4CRefObject@CommonUtil@@6B@
0x1800168B0: "protected: virtual long __cdecl MorroCommon::CPathUtils::GetWindowsSystem32FilePathImpl(unsigned short const * __ptr64,class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > & __ptr64) __ptr64" ?GetWindowsSystem32FilePathImpl@CPathUtils@MorroCommon@@MEAAJPEBGAEAV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@@Z
0x1800124A0: "public: virtual unsigned __int64 __cdecl ATL::CWin32Heap::GetSize(void * __ptr64) __ptr64" ?GetSize@CWin32Heap@ATL@@UEAA_KPEAX@Z
0x180024B80: "__vectorcall ??_R1A@?0A@EA@error_category@std" ??_R1A@?0A@EA@error_category@std@@8
0x180020F28: "__cdecl _imp__initterm" __imp__initterm
0x180020B10: "__cdecl _imp_GetDiskFreeSpaceExW" __imp_GetDiskFreeSpaceExW
0x180022790: "0x%x" ??_C@_19PCNJIDGC@?$AA0?$AAx?$AA?$CF?$AAx?$AA?$AA@
0x18002D978: ?$TSS0@?1??GetInstance@?$TSingletonWithProxy@VCWin32@MorroCommon@@@MorroCommon@@SAPEAVCWin32@3@XZ@4HA
0x18002D908: ?$TSS0@?1??GetInstance@?$TSingletonWithProxy@VCFileUtils@MorroCommon@@@MorroCommon@@SAPEAVCFileUtils@3@XZ@4HA
0x18002D920: ?$TSS0@?1??GetInstance@?$TSingletonWithProxy@VCPathUtils@MorroCommon@@@MorroCommon@@SAPEAVCPathUtils@3@XZ@4HA
0x1800019B0: "public: virtual class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > __cdecl std::_Generic_error_category::message(int)const __ptr64" ?message@_Generic_error_category@std@@UEBA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@2@H@Z
0x180018854: "public: struct _SYSTEMTIME __cdecl Microsoft::SecurityClient::CDateTimeFormatter::ToSystemTime(void)const __ptr64" ?ToSystemTime@CDateTimeFormatter@SecurityClient@Microsoft@@QEBA?AU_SYSTEMTIME@@XZ
0x180020B68: "__cdecl _imp_MoveFileW" __imp_MoveFileW
0x180002930: "public: virtual long __cdecl ATL::IWbemInstProviderImpl::CreateClassEnum(unsigned short * __ptr64 const,long,struct IWbemContext * __ptr64,struct IEnumWbemClassObject * __ptr64 * __ptr64) __ptr64" ?CreateClassEnum@IWbemInstProviderImpl@ATL@@UEAAJQEAGJPEAUIWbemContext@@PEAPEAUIEnumWbemClassObject@@@Z
0x18002D9A0: ?$TSS0@?1??GetInstance@?$TSingletonWithProxy@VCCertCheckFactory@MorroCommon@@@MorroCommon@@SAPEAVCCertCheckFactory@3@XZ@4HA
0x180003610: "protected: long __cdecl ATL::CRegParser::AddValue(class ATL::CRegKey & __ptr64,unsigned short const * __ptr64,unsigned short * __ptr64) __ptr64" ?AddValue@CRegParser@ATL@@IEAAJAEAVCRegKey@2@PEBGPEAG@Z
0x180020C30: "__cdecl _imp_SHGetSpecialFolderLocation" __imp_SHGetSpecialFolderLocation
0x1800252E8: "__vectorcall ??_R1A@?0A@EA@CComClassFactory@ATL" ??_R1A@?0A@EA@CComClassFactory@ATL@@8
0x18002CB20: "__vectorcall ??_R0?AVCHResultExceptionImpl@CommonUtil@" ??_R0?AVCHResultExceptionImpl@CommonUtil@@@8
0x1800163A0: "protected: virtual class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > const & __ptr64 __cdecl MorroCommon::CPathUtils::GetCurrentModuleNameImpl(void) __ptr64" ?GetCurrentModuleNameImpl@CPathUtils@MorroCommon@@MEAAAEBV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@XZ
0x18002D9C8: "public: static class std::locale::id std::num_put<unsigned short,class std::back_insert_iterator<class std::basic_string<unsigned short,struct std::char_traits<unsigned short>,class std::allocator<unsigned short> > > >::id" ?id@?$num_put@GV?$back_insert_iterator@V?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@@std@@@std@@2V0locale@2@A
0x180020F68: "__cdecl _imp_StringFromGUID2" __imp_StringFromGUID2
0x18000FEEC: "public: virtual __cdecl CommonUtil::CHResultExceptionImpl::~CHResultExceptionImpl(void) __ptr64" ??1CHResultExceptionImpl@CommonUtil@@UEAA@XZ
0x1800069B4: "public: __cdecl CommonUtil::CStdMoveable<class CommonUtil::CStdVector<struct IWbemClassObject * __ptr64,class std::allocator<struct IWbemClassObject * __ptr64> >,struct CommonUtil::CStdMoveableDefaultPolicy<class CommonUtil::CStdVector<struct IWbemClassObject * __ptr64,class std::allocator<struct IWbemClassObject * __ptr64> > > >::~CStdMoveable<class CommonUtil::CStdVector<struct IWbemClassObject * __ptr64,class std::allocator<struct IWbemClassObject * __ptr64> >,struct CommonUtil::CStdMoveableDefaultPolicy<class CommonUtil::CStdVector<struct IWbemClassObject * __ptr64,class std::allocator<struct IWbemClassObject * __ptr64> > > >(void) __ptr64" ??1?$CStdMoveable@V?$CStdVector@PEAUIWbemClassObject@@V?$allocator@PEAUIWbemClassObject@@@std@@@CommonUtil@@U?$CStdMoveableDefaultPolicy@V?$CStdVector@PEAUIWbemClassObject@@V?$allocator@PEAUIWbemClassObject@@@std@@@CommonUtil@@@2@@CommonUtil@@QEAA@XZ
0x180020970: "__cdecl _imp_SetLastError" __imp_SetLastError
0x1800142E0: "protected: virtual unsigned long __cdecl MorroCommon::CWin32::GetModuleFileNameImpl(struct HINSTANCE__ * __ptr64,unsigned short * __ptr64,unsigned long) __ptr64" ?GetModuleFileNameImpl@CWin32@MorroCommon@@MEAAKPEAUHINSTANCE__@@PEAGK@Z
0x180003B70: "protected: long __cdecl ATL::CRegParser::SkipAssignment(unsigned short * __ptr64) __ptr64" ?SkipAssignment@CRegParser@ATL@@IEAAJPEAG@Z
0x180022FF0: WPP_d39b67cfd2de3a126bf0d63b9c5e92c2_Traceguids
0x18002D6B8: "private: static class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > MorroCommon::CPathUtils::m_antimalwareServiceLogLocation" ?m_antimalwareServiceLogLocation@CPathUtils@MorroCommon@@0V?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@A
0x18001DF20: "void __cdecl `public: static class CWPPTrace::Instance & __ptr64 __cdecl MorroCommon::CWPPTrace::Instance(void)'::`2'::Finstance::`dynamic atexit destructor for '(void)" ??__Finstance@?1??Instance@CWPPTrace@MorroCommon@@SAAEAV12@XZ@YAXXZ
0x1800069B4: "public: __cdecl std::vector<struct IWbemClassObject * __ptr64,class std::allocator<struct IWbemClassObject * __ptr64> >::~vector<struct IWbemClassObject * __ptr64,class std::allocator<struct IWbemClassObject * __ptr64> >(void) __ptr64" ??1?$vector@PEAUIWbemClassObject@@V?$allocator@PEAUIWbemClassObject@@@std@@@std@@QEAA@XZ
0x180009690: "public: void __cdecl Microsoft::SecurityClient::CMalwareProviderEventLogger::LogGenericError(long) __ptr64" ?LogGenericError@CMalwareProviderEventLogger@SecurityClient@Microsoft@@QEAAXJ@Z
0x180022DB8: "AmMonitoringNISFilter" ??_C@_1CM@CBEIHMJP@?$AAA?$AAm?$AAM?$AAo?$AAn?$AAi?$AAt?$AAo?$AAr?$AAi?$AAn?$AAg?$AAN?$AAI?$AAS?$AAF?$AAi?$AAl?$AAt?$AAe?$AAr?$AA?$AA@
0x180025328: "__vectorcall ??_R3IClassFactory" ??_R3IClassFactory@@8
0x180025310: "__vectorcall ??_R2IClassFactory" ??_R2IClassFactory@@8
0x180029BA8: "__cdecl TI2?AVbad_alloc@std@@" _TI2?AVbad_alloc@std@@
0x180003C1C: "public: long __cdecl ATL::CRegKey::RecurseDeleteKey(unsigned short const * __ptr64) __ptr64" ?RecurseDeleteKey@CRegKey@ATL@@QEAAJPEBG@Z
0x18001B6B0: "__cdecl recalloc" _recalloc
0x180020F20: "__cdecl _imp_swscanf_s" __imp_swscanf_s
0x180008234: "public: __cdecl CommonUtil::CAutoUniquePtr<class ATL::CImpersonateClientHelper,void>::~CAutoUniquePtr<class ATL::CImpersonateClientHelper,void>(void) __ptr64" ??1?$CAutoUniquePtr@VCImpersonateClientHelper@ATL@@X@CommonUtil@@QEAA@XZ
0x1800223B8: "Component Categories" ??_C@_1CK@OEKPKBNA@?$AAC?$AAo?$AAm?$AAp?$AAo?$AAn?$AAe?$AAn?$AAt?$AA?5?$AAC?$AAa?$AAt?$AAe?$AAg?$AAo?$AAr?$AAi?$AAe?$AAs?$AA?$AA@
0x180020928: "__cdecl _imp_GetModuleFileNameW" __imp_GetModuleFileNameW
0x180022F20: "MpConfigInitialize" ??_C@_0BD@BNECPIGO@MpConfigInitialize?$AA@
0x18001BB0C: "public: virtual __cdecl exception::~exception(void) __ptr64" ??1exception@@UEAA@XZ
0x180002910: "[thunk]:public: virtual long __cdecl ATL::CComObject<class CMalwareProvider>::QueryInterface`adjustor{8}' (struct _GUID const & __ptr64,void * __ptr64 * __ptr64) __ptr64" ?QueryInterface@?$CComObject@VCMalwareProvider@@@ATL@@W7EAAJAEBU_GUID@@PEAPEAX@Z
0x1800235E8: WPP_ae6ddf61721e377a51c0488cf434dc50_Traceguids
0x180020BB0: "__cdecl _imp_GetVersionExW" __imp_GetVersionExW
0x1800227C0: WPP_ee9dbc0820663635a3aecadeadf9ddf0_Traceguids
0x180020320: "const MorroCommon::CCertCheckFactory::`vftable'" ??_7CCertCheckFactory@MorroCommon@@6B@
0x180025B90: "const CommonUtil::CHResultException::`RTTI Complete Object Locator'" ??_R4CHResultException@CommonUtil@@6B@
0x180008ED4: "struct ATL::ATLSTRINGRESOURCEIMAGE const * __ptr64 __cdecl ATL::_AtlGetStringResourceImage(struct HINSTANCE__ * __ptr64,struct HRSRC__ * __ptr64,unsigned int)" ?_AtlGetStringResourceImage@ATL@@YAPEBUATLSTRINGRESOURCEIMAGE@1@PEAUHINSTANCE__@@PEAUHRSRC__@@I@Z
0x180021818: "cross device link" ??_C@_0BC@PPHBOELF@cross?5device?5link?$AA@
0x180029BC8: "__cdecl CT??_R0?AVexception@@@8??0exception@@QEAA@AEBV0@@Z24" _CT??_R0?AVexception@@@8??0exception@@QEAA@AEBV0@@Z24
0x18000EA9C: "public: __cdecl Microsoft::SecurityClient::CMpClientApi::CMpClientApi(void) __ptr64" ??0CMpClientApi@SecurityClient@Microsoft@@QEAA@XZ
0x180020868: CRYPT32_NULL_THUNK_DATA
0x1800073C0: "public: void __cdecl std::basic_string<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> >::_Tidy(bool,unsigned __int64) __ptr64" ?_Tidy@?$basic_string@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@std@@QEAAX_N_K@Z
0x180002A40: "public: virtual long __cdecl ATL::CComClassFactory::LockServer(int) __ptr64" ?LockServer@CComClassFactory@ATL@@UEAAJH@Z
0x1800085D4: "public: static class MorroCommon::CWPPTrace & __ptr64 __cdecl MorroCommon::CWPPTrace::Instance(void)" ?Instance@CWPPTrace@MorroCommon@@SAAEAV12@XZ
0x180023638: WPP_197294aab8103b8a0631898ae3d03ea3_Traceguids
0x180023010: "forwarders\%ws" ??_C@_1BO@GFOANKMI@?$AAf?$AAo?$AAr?$AAw?$AAa?$AAr?$AAd?$AAe?$AAr?$AAs?$AA?2?$AA?$CF?$AAw?$AAs?$AA?$AA@
0x180016140: "protected: virtual class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > const & __ptr64 __cdecl MorroCommon::CPathUtils::GetCurrentModuleParnetDirectoryImpl(void) __ptr64" ?GetCurrentModuleParnetDirectoryImpl@CPathUtils@MorroCommon@@MEAAAEBV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@XZ
0x180022440: "SAM" ??_C@_17OMAOINJK@?$AAS?$AAA?$AAM?$AA?$AA@
0x180020C80: SHLWAPI_NULL_THUNK_DATA
0x180015380: "protected: virtual int __cdecl MorroCommon::CWin32::WTSEnumerateSessionsImpl(void * __ptr64,unsigned long,unsigned long,struct _WTS_SESSION_INFOW * __ptr64 * __ptr64,unsigned long * __ptr64) __ptr64" ?WTSEnumerateSessionsImpl@CWin32@MorroCommon@@MEAAHPEAXKKPEAPEAU_WTS_SESSION_INFOW@@PEAK@Z
0x180014790: "protected: virtual unsigned int __cdecl MorroCommon::CWin32::GetSystemDirectoryImpl(unsigned short * __ptr64,unsigned int) __ptr64" ?GetSystemDirectoryImpl@CWin32@MorroCommon@@MEAAIPEAGI@Z
0x18002DA70: "__cdecl _onexitend" __onexitend
0x180020B70: "__cdecl _imp_CreateThread" __imp_CreateThread
0x180020788: "__cdecl _imp_AdjustTokenPrivileges" __imp_AdjustTokenPrivileges
0x180022250: "HKPD" ??_C@_19PNBHMJPL@?$AAH?$AAK?$AAP?$AAD?$AA?$AA@
0x180025DB0: "__vectorcall ??_R3ILockedCertCheck@MorroCommon" ??_R3ILockedCertCheck@MorroCommon@@8
0x180002930: "public: virtual long __cdecl ATL::IWbemInstProviderImpl::ExecMethod(unsigned short * __ptr64 const,unsigned short * __ptr64 const,long,struct IWbemContext * __ptr64,struct IWbemClassObject * __ptr64,struct IWbemClassObject * __ptr64 * __ptr64,struct IWbemCallResult * __ptr64 * __ptr64) __ptr64" ?ExecMethod@IWbemInstProviderImpl@ATL@@UEAAJQEAG0JPEAUIWbemContext@@PEAUIWbemClassObject@@PEAPEAU4@PEAPEAUIWbemCallResult@@@Z
0x180025D38: "__vectorcall ??_R2ILockedCertCheck@MorroCommon" ??_R2ILockedCertCheck@MorroCommon@@8
0x180002AC0: "public: virtual long __cdecl ATL::CAtlModule::Unlock(void) __ptr64" ?Unlock@CAtlModule@ATL@@UEAAJXZ
0x18002CC18: "__vectorcall ??_R0PEAVEHresultException@MorroCommon@" ??_R0PEAVEHresultException@MorroCommon@@@8
0x180021C70: "executable format error" ??_C@_0BI@BNCLIGPB@executable?5format?5error?$AA@
0x18001BD57: "__cdecl unlock" _unlock
0x180022188: WPP_7bf0b3ad37093301306178083e28c40d_Traceguids
0x180003E54: "protected: long __cdecl ATL::CRegParser::NextToken(unsigned short * __ptr64) __ptr64" ?NextToken@CRegParser@ATL@@IEAAJPEAG@Z
0x180020C70: "__cdecl _imp_PathIsDirectoryW" __imp_PathIsDirectoryW
0x18001FC20: "const CMalwareProviderDllModule::`vftable'" ??_7CMalwareProviderDllModule@@6B@
0x180020FA0: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x18000D3F0: "private: bool __cdecl Microsoft::SecurityClient::CMalwareInstanceFactory::FillEventParametersFromThreatInfo(struct tagMPTHREAT_INFO * __ptr64 const,struct tagMPVERSION_INFO * __ptr64 const,struct tagMPSTATUS_INFO * __ptr64 const,class Microsoft::SecurityClient::CWbemClassObjectHelper & __ptr64,unsigned short * __ptr64 * __ptr64)const __ptr64" ?FillEventParametersFromThreatInfo@CMalwareInstanceFactory@SecurityClient@Microsoft@@AEBA_NQEAUtagMPTHREAT_INFO@@QEAUtagMPVERSION_INFO@@QEAUtagMPSTATUS_INFO@@AEAVCWbemClassObjectHelper@23@PEAPEAG@Z
0x18002C448: "__vectorcall ??_R0?AVCMalwareProvider@" ??_R0?AVCMalwareProvider@@@8
0x180015490: "protected: virtual int __cdecl MorroCommon::CWin32::GetProductInfoImpl(unsigned long * __ptr64) __ptr64" ?GetProductInfoImpl@CWin32@MorroCommon@@MEAAHPEAK@Z
0x180020CB0: "__cdecl _imp_IsDialogMessageW" __imp_IsDialogMessageW
0x180014770: "protected: virtual unsigned int __cdecl MorroCommon::CWin32::GetWindowsDirectoryImpl(unsigned short * __ptr64,unsigned int) __ptr64" ?GetWindowsDirectoryImpl@CWin32@MorroCommon@@MEAAIPEAGI@Z
0x180020E60: "__cdecl _imp__CxxThrowException" __imp__CxxThrowException
0x18002CB58: "__vectorcall ??_R0?AVCHResultException@CommonUtil@" ??_R0?AVCHResultException@CommonUtil@@@8
0x18001B660: "public: virtual void * __ptr64 __cdecl type_info::`vector deleting destructor'(unsigned int) __ptr64" ??_Etype_info@@UEAAPEAXI@Z
0x180020C28: "__cdecl _imp_SHGetPathFromIDListW" __imp_SHGetPathFromIDListW
0x180024DC8: "__vectorcall ??_R1EI@?0A@EA@?$CComCoClass@VCMalwareProvider@@$1?CLSID_MalwareProvider@@3U_GUID@@B@ATL" ??_R1EI@?0A@EA@?$CComCoClass@VCMalwareProvider@@$1?CLSID_MalwareProvider@@3U_GUID@@B@ATL@@8
0x180020990: "__cdecl _imp_FindFirstFileW" __imp_FindFirstFileW
0x180022554: "NULL" ??_C@_04HIBGFPH@NULL?$AA@
0x180020B30: "__cdecl _imp_FindResourceW" __imp_FindResourceW
0x1800208B8: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x180021E68: "not supported" ??_C@_0O@NHEDABJP@not?5supported?$AA@
0x180019F8C: "long __cdecl CommonUtil::MpSetWindowsVersionInfoImpl(void)" ?MpSetWindowsVersionInfoImpl@CommonUtil@@YAJXZ
0x1800203C0: "const CommonUtil::CPtrObjectProcessHeap::`vftable'" ??_7CPtrObjectProcessHeap@CommonUtil@@6B@
0x180006984: "public: __cdecl Microsoft::SecurityClient::CAmEventConsumer::~CAmEventConsumer(void) __ptr64" ??1CAmEventConsumer@SecurityClient@Microsoft@@QEAA@XZ
0x18000A7B0: "protected: virtual __cdecl CommonUtil::CRefObject::~CRefObject(void) __ptr64" ??1CRefObject@CommonUtil@@MEAA@XZ
0x180020D28: USER32_NULL_THUNK_DATA
0x18000B310: "public: __cdecl CommonUtil::CUniqueHandle<struct CommonUtil::CAutoUniqueArrayPtrDelete2<unsigned short * __ptr64> >::operator unsigned short * __ptr64 const & __ptr64(void)const __ptr64" ??B?$CUniqueHandle@U?$CAutoUniqueArrayPtrDelete2@PEAG@CommonUtil@@@CommonUtil@@QEBAAEBQEAGXZ
0x180005A60: "public: virtual long __cdecl CMalwareProvider::DeleteInstanceAsync(unsigned short * __ptr64 const,long,struct IWbemContext * __ptr64,struct IWbemObjectSink * __ptr64) __ptr64" ?DeleteInstanceAsync@CMalwareProvider@@UEAAJQEAGJPEAUIWbemContext@@PEAUIWbemObjectSink@@@Z
0x180009100: "public: virtual void * __ptr64 __cdecl Microsoft::SecurityClient::CMalwareProviderEventLogger::`scalar deleting destructor'(unsigned int) __ptr64" ??_GCMalwareProviderEventLogger@SecurityClient@Microsoft@@UEAAPEAXI@Z
0x180022F38: "MpConfigUninitialize" ??_C@_0BF@DIIDBCDO@MpConfigUninitialize?$AA@
0x180020710: "__cdecl _imp_RegisterEventSourceW" __imp_RegisterEventSourceW
0x180021C50: "destination address required" ??_C@_0BN@KDMIFEIP@destination?5address?5required?$AA@
0x1800221B8: "__cdecl GUID_1be41572_91dd_11d1_aeb2_00c04fb68820" _GUID_1be41572_91dd_11d1_aeb2_00c04fb68820
0x180002930: "public: virtual long __cdecl ATL::IWbemInstProviderImpl::PutClass(struct IWbemClassObject * __ptr64,long,struct IWbemContext * __ptr64,struct IWbemCallResult * __ptr64 * __ptr64) __ptr64" ?PutClass@IWbemInstProviderImpl@ATL@@UEAAJPEAUIWbemClassObject@@JPEAUIWbemContext@@PEAPEAUIWbemCallResult@@@Z
0x180009FA0: "protected: class std::_Tree_iterator<class std::_Tree_val<struct std::_Tree_simple_types<struct std::pair<long const,bool> > > > __cdecl std::_Tree<class std::_Tmap_traits<long,bool,struct std::less<long>,class std::allocator<struct std::pair<long const,bool> >,0> >::_Insert_at<struct std::pair<long const,bool> & __ptr64,struct std::_Tree_node<struct std::pair<long const,bool>,void * __ptr64> * __ptr64>(bool,struct std::_Tree_node<struct std::pair<long const,bool>,void * __ptr64> * __ptr64,struct std::pair<long const,bool> & __ptr64,struct std::_Tree_node<struct std::pair<long const,bool>,void * __ptr64> * __ptr64) __ptr64" ??$_Insert_at@AEAU?$pair@$$CBJ_N@std@@PEAU?$_Tree_node@U?$pair@$$CBJ_N@std@@PEAX@2@@?$_Tree@V?$_Tmap_traits@J_NU?$less@J@std@@V?$allocator@U?$pair@$$CBJ_N@std@@@2@$0A@@std@@@std@@IEAA?AV?$_Tree_iterator@V?$_Tree_val@U?$_Tree_simple_types@U?$pair@$$CBJ_N@std@@@std@@@std@@@1@_NPEAU?$_Tree_node@U?$pair@$$CBJ_N@std@@PEAX@1@AEAU?$pair@$$CBJ_N@1@1@Z
0x180020748: "__cdecl _imp_GetTokenInformation" __imp_GetTokenInformation
0x180020B80: "__cdecl _imp_GetPrivateProfileStringW" __imp_GetPrivateProfileStringW
0x180020D38: "__cdecl _imp_CreateEnvironmentBlock" __imp_CreateEnvironmentBlock
0x180021720: "device or resource busy" ??_C@_0BI@NGCEHDD@device?5or?5resource?5busy?$AA@
0x18001F9D8: "const std::error_category::`vftable'" ??_7error_category@std@@6B@
0x18000DA6C: "public: class std::_Tree_iterator<class std::_Tree_val<struct std::_Tree_simple_types<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> > > > > __cdecl std::_Tree<class std::_Tmap_traits<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> >,class CommonUtil::AutoRef<struct IWbemClassObject>,struct std::less<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > >,class std::allocator<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> > >,0> >::lower_bound(class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const & __ptr64) __ptr64" ?lower_bound@?$_Tree@V?$_Tmap_traits@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@U?$less@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@@std@@V?$allocator@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@@5@$0A@@std@@@std@@QEAA?AV?$_Tree_iterator@V?$_Tree_val@U?$_Tree_simple_types@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@@std@@@std@@@2@AEBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@@Z
0x180020F48: "__cdecl _imp_RtlNtStatusToDosError" __imp_RtlNtStatusToDosError
0x18002D8F8: "private: static class MorroCommon::CFileUtils * __ptr64 __ptr64 MorroCommon::TSingletonWithProxy<class MorroCommon::CFileUtils>::mts_proxy" ?mts_proxy@?$TSingletonWithProxy@VCFileUtils@MorroCommon@@@MorroCommon@@0PEAVCFileUtils@2@EA
0x180002600: "public: virtual unsigned long __cdecl ATL::CComObjectCached<class ATL::CComClassFactory>::Release(void) __ptr64" ?Release@?$CComObjectCached@VCComClassFactory@ATL@@@ATL@@UEAAKXZ
0x180022EE0: "MpManagerStatusQuery" ??_C@_0BF@NGGLNLB@MpManagerStatusQuery?$AA@
0x180014730: "protected: virtual void * __ptr64 __cdecl MorroCommon::CWin32::LocalFreeImpl(void * __ptr64) __ptr64" ?LocalFreeImpl@CWin32@MorroCommon@@MEAAPEAXPEAX@Z
0x1800148D0: "protected: virtual unsigned long __cdecl MorroCommon::CWin32::GetCurrentProcessIdImpl(void) __ptr64" ?GetCurrentProcessIdImpl@CWin32@MorroCommon@@MEAAKXZ
0x18002CEA0: "__cdecl Init_global_epoch" _Init_global_epoch
0x1800134A0: "protected: virtual long __cdecl MorroCommon::CFileUtils::LoadResourceRawImpl(unsigned int,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned char * __ptr64 * __ptr64,unsigned __int64 * __ptr64) __ptr64" ?LoadResourceRawImpl@CFileUtils@MorroCommon@@MEAAJIPEBG0PEAPEAEPEA_K@Z
0x180021AA0: "operation_not_supported" ??_C@_0BI@ICEIDKLJ@operation_not_supported?$AA@
0x180021058: "__cdecl _xi_a" __xi_a
0x180016FBC: "public: long __cdecl MorroCommon::CWPPTrace::StopLog(void) __ptr64" ?StopLog@CWPPTrace@MorroCommon@@QEAAJXZ
0x180015270: "protected: virtual void __cdecl MorroCommon::CWin32::GetNativeSystemInfoImpl(struct _SYSTEM_INFO * __ptr64) __ptr64" ?GetNativeSystemInfoImpl@CWin32@MorroCommon@@MEAAXPEAU_SYSTEM_INFO@@@Z
0x180019E90: "public: virtual void * __ptr64 __cdecl CommonUtil::CMpUtilsLibrary::`vector deleting destructor'(unsigned int) __ptr64" ??_ECMpUtilsLibrary@CommonUtil@@UEAAPEAXI@Z
0x1800218A0: "address_family_not_supported" ??_C@_0BN@LCBDHODA@address_family_not_supported?$AA@
0x180020A10: "__cdecl _imp_GetNativeSystemInfo" __imp_GetNativeSystemInfo
0x1800143E0: "protected: virtual long __cdecl MorroCommon::CWin32::RegDeleteKeyImpl(struct HKEY__ * __ptr64,unsigned short const * __ptr64) __ptr64" ?RegDeleteKeyImpl@CWin32@MorroCommon@@MEAAJPEAUHKEY__@@PEBG@Z
0x1800149A0: "protected: virtual int __cdecl MorroCommon::CWin32::MessageBoxImpl(struct HWND__ * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned int) __ptr64" ?MessageBoxImpl@CWin32@MorroCommon@@MEAAHPEAUHWND__@@PEBG1I@Z
0x180022340: "HKEY_DYN_DATA" ??_C@_1BM@HAGMMHIA@?$AAH?$AAK?$AAE?$AAY?$AA_?$AAD?$AAY?$AAN?$AA_?$AAD?$AAA?$AAT?$AAA?$AA?$AA@
0x180020B40: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x180020BD8: "__cdecl _imp_SysAllocStringLen" __imp_SysAllocStringLen
0x18002D4E0: "class CMalwareProviderDllModule _AtlModule" ?_AtlModule@@3VCMalwareProviderDllModule@@A
0x180025E18: "const MpCommonEx::CEventLoggerBase::`RTTI Complete Object Locator'" ??_R4CEventLoggerBase@MpCommonEx@@6B@
0x1800029D0: "public: virtual long __cdecl ATL::CComClassFactory::CreateInstance(struct IUnknown * __ptr64,struct _GUID const & __ptr64,void * __ptr64 * __ptr64) __ptr64" ?CreateInstance@CComClassFactory@ATL@@UEAAJPEAUIUnknown@@AEBU_GUID@@PEAPEAX@Z
0x1800118F4: "long __cdecl CommonUtil::UtilExpandEnvironmentStrings(unsigned short * __ptr64 * __ptr64,unsigned short const * __ptr64)" ?UtilExpandEnvironmentStrings@CommonUtil@@YAJPEAPEAGPEBG@Z
0x18001FED8: "const MorroCommon::CWin32::`vftable'" ??_7CWin32@MorroCommon@@6B@
0x180020E20: "__cdecl _imp__unlock" __imp__unlock
0x1800120DC: MpInvokeExitDestruction
0x18002D480: "long (__cdecl* __ptr64 ATL::_pPerfRegFunc)(struct HINSTANCE__ * __ptr64)" ?_pPerfRegFunc@ATL@@3P6AJPEAUHINSTANCE__@@@ZEA
0x18000DCF0: "protected: class std::_Tree_iterator<class std::_Tree_val<struct std::_Tree_simple_types<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> > > > > __cdecl std::_Tree<class std::_Tmap_traits<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> >,class CommonUtil::AutoRef<struct IWbemClassObject>,struct std::less<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > >,class std::allocator<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> > >,0> >::_Insert_hint<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> > & __ptr64,struct std::_Tree_node<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> >,void * __ptr64> * __ptr64>(class std::_Tree_const_iterator<class std::_Tree_val<struct std::_Tree_simple_types<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> > > > >,struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> > & __ptr64,struct std::_Tree_node<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> >,void * __ptr64> * __ptr64) __ptr64" ??$_Insert_hint@AEAU?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@PEAU?$_Tree_node@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@PEAX@2@@?$_Tree@V?$_Tmap_traits@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@U?$less@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@@std@@V?$allocator@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@@5@$0A@@std@@@std@@IEAA?AV?$_Tree_iterator@V?$_Tree_val@U?$_Tree_simple_types@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@@std@@@std@@@1@V?$_Tree_const_iterator@V?$_Tree_val@U?$_Tree_simple_types@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@@std@@@std@@@1@AEAU?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@1@PEAU?$_Tree_node@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@PEAX@1@@Z
0x180022390: "D" ??_C@_13MKMNOPIJ@?$AAD?$AA?$AA@
0x180012CE0: "protected: virtual long __cdecl MorroCommon::CFileUtils::SafeLoadSystemLibraryImpl(unsigned short const * __ptr64,struct HINSTANCE__ * __ptr64 & __ptr64) __ptr64" ?SafeLoadSystemLibraryImpl@CFileUtils@MorroCommon@@MEAAJPEBGAEAPEAUHINSTANCE__@@@Z
0x180022430: "Mime" ??_C@_19HLLLM@?$AAM?$AAi?$AAm?$AAe?$AA?$AA@
0x1800222D0: "HKEY_LOCAL_MACHINE" ??_C@_1CG@GFBEANJL@?$AAH?$AAK?$AAE?$AAY?$AA_?$AAL?$AAO?$AAC?$AAA?$AAL?$AA_?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?$AA@
0x180001B68: "public: void __cdecl std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >::_Tidy(bool,unsigned __int64) __ptr64" ?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAX_N_K@Z
0x180020F88: "__cdecl _imp_CoTaskMemFree" __imp_CoTaskMemFree
0x180020BF0: "__cdecl _imp_VarBstrCat" __imp_VarBstrCat
0x180010424: "long __cdecl CommonUtil::UtilRegGetValue(struct HKEY__ * __ptr64,unsigned short const * __ptr64,unsigned long * __ptr64,unsigned __int64 * __ptr64,void * __ptr64)" ?UtilRegGetValue@CommonUtil@@YAJPEAUHKEY__@@PEBGPEAKPEA_KPEAX@Z
0x18000B540: WPP_SF_DL
0x180007C90: "public: virtual void * __ptr64 __cdecl std::bad_alloc::`scalar deleting destructor'(unsigned int) __ptr64" ??_Gbad_alloc@std@@UEAAPEAXI@Z
0x1800236C0: "GetFileVersionInfoW" ??_C@_0BE@IEOIIDEN@GetFileVersionInfoW?$AA@
0x180029BF0: "__cdecl CT??_R0?AVbad_alloc@std@@@8??0bad_alloc@std@@QEAA@AEBV01@@Z24" _CT??_R0?AVbad_alloc@std@@@8??0bad_alloc@std@@QEAA@AEBV01@@Z24
0x180020CE0: "__cdecl _imp_UnregisterClassA" __imp_UnregisterClassA
0x18000A84C: WPP_SF_Dg
0x1800052DC: WPP_SF_Dd
0x1800052DC: WPP_SF_dd
0x1800052DC: WPP_SF_DD
0x180025230: "__vectorcall ??_R3?$CComObjectCached@VCComClassFactory@ATL@@@ATL" ??_R3?$CComObjectCached@VCComClassFactory@ATL@@@ATL@@8
0x180024D68: "__vectorcall ??_R2?$CComObjectCached@VCComClassFactory@ATL@@@ATL" ??_R2?$CComObjectCached@VCComClassFactory@ATL@@@ATL@@8
0x180020C98: "__cdecl _imp_SetForegroundWindow" __imp_SetForegroundWindow
0x180025528: "__vectorcall ??_R1A@?0A@EA@IRegistrarBase" ??_R1A@?0A@EA@IRegistrarBase@@8
0x1800234C8: "%c:\" ??_C@_19MPFPGMJE@?$AA?$CF?$AAc?$AA?3?$AA?2?$AA?$AA@
0x180017110: "private: static long __cdecl MorroCommon::CCertCheck::HrWinVerifyTrust(struct HWND__ * __ptr64,struct _GUID * __ptr64,struct _WINTRUST_DATA * __ptr64)" ?HrWinVerifyTrust@CCertCheck@MorroCommon@@CAJPEAUHWND__@@PEAU_GUID@@PEAU_WINTRUST_DATA@@@Z
0x180020768: "__cdecl _imp_CloseServiceHandle" __imp_CloseServiceHandle
0x18000A7C4: WPP_SF_DS
0x180007E48: WPP_SF_dS
0x18001BD88: "__cdecl invoke_watson" _invoke_watson
0x180006D20: "public: __cdecl CommonUtil::CUniqueHandle<struct Microsoft::SecurityClient::CAutoFreeMpClientApi>::~CUniqueHandle<struct Microsoft::SecurityClient::CAutoFreeMpClientApi>(void) __ptr64" ??1?$CUniqueHandle@UCAutoFreeMpClientApi@SecurityClient@Microsoft@@@CommonUtil@@QEAA@XZ
0x1800025E0: "public: virtual long __cdecl ATL::CComObjectCached<class ATL::CComClassFactory>::QueryInterface(struct _GUID const & __ptr64,void * __ptr64 * __ptr64) __ptr64" ?QueryInterface@?$CComObjectCached@VCComClassFactory@ATL@@@ATL@@UEAAJAEBU_GUID@@PEAPEAX@Z
0x180022198: WPP_ThisDir_CTLGUID_AMMonitoringProvider
0x1800249C8: "const std::_System_error_category::`RTTI Complete Object Locator'" ??_R4_System_error_category@std@@6B@
0x18002C070: WPP_GLOBAL_Control
0x180022F50: "MpConfigOpen" ??_C@_0N@MMCCAMHH@MpConfigOpen?$AA@
0x1800150B0: "protected: virtual int __cdecl MorroCommon::CWin32::PostThreadMessageImpl(unsigned long,unsigned int,unsigned __int64,__int64) __ptr64" ?PostThreadMessageImpl@CWin32@MorroCommon@@MEAAHKI_K_J@Z
0x180009EE0: "public: class std::_Tree_const_iterator<class std::_Tree_val<struct std::_Tree_simple_types<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> > > > > & __ptr64 __cdecl std::_Tree_const_iterator<class std::_Tree_val<struct std::_Tree_simple_types<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> > > > >::operator--(void) __ptr64" ??F?$_Tree_const_iterator@V?$_Tree_val@U?$_Tree_simple_types@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@@std@@@std@@@std@@QEAAAEAV01@XZ
0x180022170: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x180020C40: "__cdecl _imp_PathMatchSpecW" __imp_PathMatchSpecW
0x180002880: "public: virtual void * __ptr64 __cdecl ATL::CComObject<class CMalwareProvider>::`scalar deleting destructor'(unsigned int) __ptr64" ??_G?$CComObject@VCMalwareProvider@@@ATL@@UEAAPEAXI@Z
0x18001AEA0: "void __cdecl std::_Xlength_error(char const * __ptr64)" ?_Xlength_error@std@@YAXPEBD@Z
0x18002D8D8: "public: static struct _GUID ATL::CAtlModule::m_libid" ?m_libid@CAtlModule@ATL@@2U_GUID@@A
0x180022608: "CLSID\" ??_C@_1O@FHBGLCIO@?$AAC?$AAL?$AAS?$AAI?$AAD?$AA?2?$AA?$AA@
0x1800257E0: "__vectorcall ??_R2CEventLoggerBase@MpCommonEx" ??_R2CEventLoggerBase@MpCommonEx@@8
0x180025868: "__vectorcall ??_R3CEventLoggerBase@MpCommonEx" ??_R3CEventLoggerBase@MpCommonEx@@8
0x180002058: WPP_SF_D
0x180002058: WPP_SF_d
0x180020930: "__cdecl _imp_FindResourceExW" __imp_FindResourceExW
0x18001B8C8: "__cdecl _report_rangecheckfailure" __report_rangecheckfailure
0x18002DA88: "__cdecl pRawDllMain" _pRawDllMain
0x180014750: "protected: virtual int __cdecl MorroCommon::CWin32::GetExitCodeProcessImpl(void * __ptr64,unsigned long * __ptr64) __ptr64" ?GetExitCodeProcessImpl@CWin32@MorroCommon@@MEAAHPEAXPEAK@Z
0x18002C808: "__vectorcall ??_R0?AUIRegistrarBase@" ??_R0?AUIRegistrarBase@@@8
0x18000B2A0: "public: virtual char const * __ptr64 __cdecl CommonUtil::CHResultExceptionImpl::what(void)const __ptr64" ?what@CHResultExceptionImpl@CommonUtil@@UEBAPEBDXZ
0x180009C80: "public: struct std::_Tree_node<struct std::pair<long const,bool>,void * __ptr64> * __ptr64 __cdecl std::_Tree_buy<struct std::pair<long const,bool>,class std::allocator<struct std::pair<long const,bool> > >::_Buynode<struct std::pair<long,bool> >(struct std::pair<long,bool> &&) __ptr64" ??$_Buynode@U?$pair@J_N@std@@@?$_Tree_buy@U?$pair@$$CBJ_N@std@@V?$allocator@U?$pair@$$CBJ_N@std@@@2@@std@@QEAAPEAU?$_Tree_node@U?$pair@$$CBJ_N@std@@PEAX@1@$$QEAU?$pair@J_N@1@@Z
0x180020E08: "__cdecl _imp_??1type_info@@UEAA@XZ" __imp_??1type_info@@UEAA@XZ
0x180023088: ".." ??_C@_15DDHGOCBH@?$AA?4?$AA?4?$AA?$AA@
0x180014A60: "protected: virtual int __cdecl MorroCommon::CWin32::FindNextFileImpl(void * __ptr64,struct _WIN32_FIND_DATAW * __ptr64) __ptr64" ?FindNextFileImpl@CWin32@MorroCommon@@MEAAHPEAXPEAU_WIN32_FIND_DATAW@@@Z
0x180021760: "invalid argument" ??_C@_0BB@FCMFBGOM@invalid?5argument?$AA@
0x18002C5E0: "__vectorcall ??_R0?AU?$CAtlValidateModuleConfiguration@$00VCMalwareProviderDllModule@@@ATL@" ??_R0?AU?$CAtlValidateModuleConfiguration@$00VCMalwareProviderDllModule@@@ATL@@@8
0x18000F8C4: MpThreatOpen
0x18000F76C: MpConfigUninitialize
0x1800035E0: "public: __cdecl ATL::_ATL_SAFE_ALLOCA_IMPL::CAtlSafeAllocBufferManager<class ATL::CCRTAllocator>::~CAtlSafeAllocBufferManager<class ATL::CCRTAllocator>(void) __ptr64" ??1?$CAtlSafeAllocBufferManager@VCCRTAllocator@ATL@@@_ATL_SAFE_ALLOCA_IMPL@ATL@@QEAA@XZ
0x180014850: "protected: virtual int __cdecl MorroCommon::CWin32::GetTokenInformationImpl(void * __ptr64,enum _TOKEN_INFORMATION_CLASS,void * __ptr64,unsigned long,unsigned long * __ptr64) __ptr64" ?GetTokenInformationImpl@CWin32@MorroCommon@@MEAAHPEAXW4_TOKEN_INFORMATION_CLASS@@0KPEAK@Z
0x1800076B0: DllUnregisterServer
0x180020BB8: "__cdecl _imp_GetDriveTypeW" __imp_GetDriveTypeW
0x180025E58: "const CommonUtil::CMpGlobalVarsTable::`RTTI Complete Object Locator'" ??_R4CMpGlobalVarsTable@CommonUtil@@6B@
0x180012420: "public: virtual void __cdecl ATL::CWin32Heap::Free(void * __ptr64) __ptr64" ?Free@CWin32Heap@ATL@@UEAAXPEAX@Z
0x180020E18: "__cdecl _imp___dllonexit" __imp___dllonexit
0x180020BE0: "__cdecl _imp_VariantClear" __imp_VariantClear
0x18002D590: "class ATL::CAtlWinModule ATL::_AtlWinModule" ?_AtlWinModule@ATL@@3VCAtlWinModule@1@A
0x180008264: "public: __cdecl Microsoft::SecurityClient::CEnsureImpersonationLevel::~CEnsureImpersonationLevel(void) __ptr64" ??1CEnsureImpersonationLevel@SecurityClient@Microsoft@@QEAA@XZ
0x180014AC0: "protected: virtual void * __ptr64 __cdecl MorroCommon::CWin32::HeapAllocImpl(void * __ptr64,unsigned long,unsigned __int64) __ptr64" ?HeapAllocImpl@CWin32@MorroCommon@@MEAAPEAXPEAXK_K@Z
0x180017DA4: "long __cdecl MorroCommon::HrCreateGuid(class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > & __ptr64)" ?HrCreateGuid@MorroCommon@@YAJAEAV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@@Z
0x18001A7B0: "protected: virtual void * __ptr64 __cdecl CommonUtil::CPtrObjectProcessHeap::`vector deleting destructor'(unsigned int) __ptr64" ??_ECPtrObjectProcessHeap@CommonUtil@@MEAAPEAXI@Z
0x180002E40: "public: virtual long __cdecl ATL::CRegObject::ClearReplacements(void) __ptr64" ?ClearReplacements@CRegObject@ATL@@UEAAJXZ
0x180024E90: "__vectorcall ??_R17?0A@EA@IWbemProviderInit" ??_R17?0A@EA@IWbemProviderInit@@8
0x180020AF0: "__cdecl _imp_CreateMutexW" __imp_CreateMutexW
0x180013F40: "private: void __cdecl ATL::CSimpleStringT<char,0>::Fork(int) __ptr64" ?Fork@?$CSimpleStringT@D$0A@@ATL@@AEAAXH@Z
0x18000A410: "[thunk]:public: virtual void * __ptr64 __cdecl Microsoft::SecurityClient::CMalwareProviderEventLogger::`vector deleting destructor'`adjustor{16}' (unsigned int) __ptr64" ??_ECMalwareProviderEventLogger@SecurityClient@Microsoft@@WBA@EAAPEAXI@Z
0x180007D40: "void __cdecl operator delete(void * __ptr64)" ??3@YAXPEAX@Z
0x18002CD10: "__vectorcall ??_R0?AVCLockedCertCheckImpl@MorroCommon@" ??_R0?AVCLockedCertCheckImpl@MorroCommon@@@8
0x18001AE40: "public: virtual void * __ptr64 __cdecl std::logic_error::`vector deleting destructor'(unsigned int) __ptr64" ??_Elogic_error@std@@UEAAPEAXI@Z
0x1800147B0: "protected: virtual int __cdecl MorroCommon::CWin32::GetDiskFreeSpaceExImpl(unsigned short const * __ptr64,union _ULARGE_INTEGER * __ptr64,union _ULARGE_INTEGER * __ptr64,union _ULARGE_INTEGER * __ptr64) __ptr64" ?GetDiskFreeSpaceExImpl@CWin32@MorroCommon@@MEAAHPEBGPEAT_ULARGE_INTEGER@@11@Z
0x180002B00: "public: __cdecl ATL::CComCriticalSection::~CComCriticalSection(void) __ptr64" ??1CComCriticalSection@ATL@@QEAA@XZ
0x180022FD0: "hr=0x%08X" ??_C@_09PANKGPKN@hr?$DN0x?$CF08X?$AA@
0x180020F18: "__cdecl _imp_vswprintf_s" __imp_vswprintf_s
0x180020940: "__cdecl _imp_EncodePointer" __imp_EncodePointer
0x180025158: "__vectorcall ??_R3IWbemInstProviderImpl@ATL" ??_R3IWbemInstProviderImpl@ATL@@8
0x180024C60: "__vectorcall ??_R2IWbemInstProviderImpl@ATL" ??_R2IWbemInstProviderImpl@ATL@@8
0x18001FDE0: "const CommonUtil::CRefObject::`vftable'" ??_7CRefObject@CommonUtil@@6B@
0x18000B2EC: "public: __cdecl CommonUtil::CUniqueHandle<struct CommonUtil::CAutoCloseRegistryKey>::~CUniqueHandle<struct CommonUtil::CAutoCloseRegistryKey>(void) __ptr64" ??1?$CUniqueHandle@UCAutoCloseRegistryKey@CommonUtil@@@CommonUtil@@QEAA@XZ
0x180026058: "__vectorcall ??_R17?0A@EA@CPtrObject@CommonUtil" ??_R17?0A@EA@CPtrObject@CommonUtil@@8
0x18001F9B0: "const type_info::`vftable'" ??_7type_info@@6B@
0x180020D58: "__cdecl _imp_VerQueryValueW" __imp_VerQueryValueW
0x180029C88: "__cdecl CTA3?AVCHResultExceptionImpl@CommonUtil@@" _CTA3?AVCHResultExceptionImpl@CommonUtil@@
0x18002D9C0: "public: static class std::locale::id std::numpunct<unsigned short>::id" ?id@?$numpunct@G@std@@2V0locale@2@A
0x180020920: "__cdecl _imp_DeleteCriticalSection" __imp_DeleteCriticalSection
0x180020DF0: "__cdecl _imp__vsnprintf" __imp__vsnprintf
0x180024A40: "__vectorcall ??_R1A@?0A@EA@_Generic_error_category@std" ??_R1A@?0A@EA@_Generic_error_category@std@@8
0x18001B490: "__cdecl _security_check_cookie" __security_check_cookie
0x18002D8EC: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUvmwfhviUexPyrmzirvhUhixUzgoHBUzgohUivgzroUlyquivUznwGEUhgwzucOlyq@atls" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUvmwfhviUexPyrmzirvhUhixUzgoHBUzgohUivgzroUlyquivUznwGEUhgwzucOlyq@atls
0x180021050: "__cdecl _xc_z" __xc_z
0x1800151B0: "protected: virtual long __cdecl MorroCommon::CWin32::ProcessIdToSessionIdImpl(unsigned long,unsigned long * __ptr64) __ptr64" ?ProcessIdToSessionIdImpl@CWin32@MorroCommon@@MEAAJKPEAK@Z
0x180014830: "protected: virtual int __cdecl MorroCommon::CWin32::OpenProcessTokenImpl(void * __ptr64,unsigned long,void * __ptr64 * __ptr64) __ptr64" ?OpenProcessTokenImpl@CWin32@MorroCommon@@MEAAHPEAXKPEAPEAX@Z
0x180022FE0: WPP_d9331a28cdf9347a3f7ce0b108860eb4_Traceguids
0x180023070: "IsWow64Process" ??_C@_0P@LKABJJMO@IsWow64Process?$AA@
0x18000C3F0: "public: bool __cdecl Microsoft::SecurityClient::CMalwareInstanceFactory::CreateInstance(struct IWbemClassObject & __ptr64) __ptr64" ?CreateInstance@CMalwareInstanceFactory@SecurityClient@Microsoft@@QEAA_NAEAUIWbemClassObject@@@Z
0x180020AC0: "__cdecl _imp_GetProcAddress" __imp_GetProcAddress
0x180020770: "__cdecl _imp_CreateProcessAsUserW" __imp_CreateProcessAsUserW
0x1800194F4: WPP_SF_qdhdd
0x180024A18: "const std::_Iostream_error_category::`RTTI Complete Object Locator'" ??_R4_Iostream_error_category@std@@6B@
0x1800142A0: "protected: virtual unsigned int __cdecl MorroCommon::CWin32::GetTempFileNameImpl(unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned int,unsigned short * __ptr64) __ptr64" ?GetTempFileNameImpl@CWin32@MorroCommon@@MEAAIPEBG0IPEAG@Z
0x180014320: "protected: virtual long __cdecl MorroCommon::CWin32::RegCreateKeyExImpl(struct HKEY__ * __ptr64,unsigned short const * __ptr64,unsigned long,unsigned short * __ptr64,unsigned long,unsigned long,struct _SECURITY_ATTRIBUTES * __ptr64 const,struct HKEY__ * __ptr64 * __ptr64,unsigned long * __ptr64) __ptr64" ?RegCreateKeyExImpl@CWin32@MorroCommon@@MEAAJPEAUHKEY__@@PEBGKPEAGKKQEAU_SECURITY_ATTRIBUTES@@PEAPEAU3@PEAK@Z
0x180029AD0: "__cdecl TI3?AVout_of_range@std@@" _TI3?AVout_of_range@std@@
0x18001814C: "public: __cdecl Microsoft::SecurityClient::CDateTimeFormatter::CDateTimeFormatter(unsigned short const * __ptr64,enum Microsoft::SecurityClient::CDateTimeFormatter::DATETIME_FORMATTER_STRINGTYPE) __ptr64" ??0CDateTimeFormatter@SecurityClient@Microsoft@@QEAA@PEBGW4DATETIME_FORMATTER_STRINGTYPE@012@@Z
0x1800254F8: "__vectorcall ??_R2IRegistrarBase" ??_R2IRegistrarBase@@8
0x180025510: "__vectorcall ??_R3IRegistrarBase" ??_R3IRegistrarBase@@8
0x1800149E0: "protected: virtual struct HRSRC__ * __ptr64 __cdecl MorroCommon::CWin32::FindResourceImpl(struct HINSTANCE__ * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64) __ptr64" ?FindResourceImpl@CWin32@MorroCommon@@MEAAPEAUHRSRC__@@PEAUHINSTANCE__@@PEBG1@Z
0x180025630: "__vectorcall ??_R1A@?0A@EA@bad_alloc@std" ??_R1A@?0A@EA@bad_alloc@std@@8
0x180020D68: "__cdecl _imp_CryptCATAdminReleaseCatalogContext" __imp_CryptCATAdminReleaseCatalogContext
0x180008CD4: "public: void __cdecl ATL::CSimpleStringT<unsigned short,0>::Empty(void) __ptr64" ?Empty@?$CSimpleStringT@G$0A@@ATL@@QEAAXXZ
0x180001E1C: "public: void __cdecl std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >::_Copy(unsigned __int64,unsigned __int64) __ptr64" ?_Copy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAX_K0@Z
0x180021DC8: "no protocol option" ??_C@_0BD@EAMBFIDF@no?5protocol?5option?$AA@
0x180002774: "public: __cdecl ATL::CComObject<class CMalwareProvider>::CComObject<class CMalwareProvider>(void * __ptr64) __ptr64" ??0?$CComObject@VCMalwareProvider@@@ATL@@QEAA@PEAX@Z
0x18001AA64: "public: void __cdecl ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > >::Format(unsigned short const * __ptr64,...) __ptr64" ?Format@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAXPEBGZZ
0x18000DF5C: "public: struct std::_Tree_node<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> >,void * __ptr64> * __ptr64 __cdecl std::_Tree_buy<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> >,class std::allocator<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> > > >::_Buynode0(void) __ptr64" ?_Buynode0@?$_Tree_buy@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@V?$allocator@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@@2@@std@@QEAAPEAU?$_Tree_node@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@PEAX@2@XZ
0x180025DF0: "const MorroCommon::ILockedCertCheck::`RTTI Complete Object Locator'" ??_R4ILockedCertCheck@MorroCommon@@6B@
0x18001BB3C: "__cdecl CxxThrowException" _CxxThrowException
0x1800203D0: ?_entries@?1??_GetEntries@CComClassFactory@ATL@@SAPEBU_ATL_INTMAP_ENTRY@3@XZ@4QBU43@B
0x1800227B4: "%u" ??_C@_15EFLNJKHH@?$AA?$CF?$AAu?$AA?$AA@
0x180020E30: "__cdecl _imp_?terminate@@YAXXZ" __imp_?terminate@@YAXXZ
0x180023580: "%04u-%02u-%02uT%02u:%02u:%02u.%0" ??_C@_1EI@DJAEAGOL@?$AA?$CF?$AA0?$AA4?$AAu?$AA?9?$AA?$CF?$AA0?$AA2?$AAu?$AA?9?$AA?$CF?$AA0?$AA2?$AAu?$AAT?$AA?$CF?$AA0?$AA2?$AAu?$AA?3?$AA?$CF?$AA0?$AA2?$AAu?$AA?3?$AA?$CF?$AA0?$AA2?$AAu?$AA?4?$AA?$CF?$AA0@
0x180025A58: "__vectorcall ??_R3CMpClientApi@SecurityClient@Microsoft" ??_R3CMpClientApi@SecurityClient@Microsoft@@8
0x18002D4D1: "private: static class MorroCommon::TSingletonWithProxy<class MorroCommon::CPathUtils> MorroCommon::CPathUtils::m_instance" ?m_instance@CPathUtils@MorroCommon@@0V?$TSingletonWithProxy@VCPathUtils@MorroCommon@@@2@A
0x18000FD60: "private: static long __cdecl CommonUtil::CGenericGlobalAtStartup<struct CommonUtil::CGenericAtStartupPolicy2nd<class CommonUtil::CMpCriticalSection> >::OnInitialize(struct tagMP_AT_STARTUP_TYPE * __ptr64)" ?OnInitialize@?$CGenericGlobalAtStartup@U?$CGenericAtStartupPolicy2nd@VCMpCriticalSection@CommonUtil@@@CommonUtil@@@CommonUtil@@CAJPEAUtagMP_AT_STARTUP_TYPE@@@Z
0x180025A70: "__vectorcall ??_R2CMpClientApi@SecurityClient@Microsoft" ??_R2CMpClientApi@SecurityClient@Microsoft@@8
0x1800234B8: "*.scr" ??_C@_1M@EKDBLKPK@?$AA?$CK?$AA?4?$AAs?$AAc?$AAr?$AA?$AA@
0x1800018F0: "public: virtual void * __ptr64 __cdecl std::_Generic_error_category::`scalar deleting destructor'(unsigned int) __ptr64" ??_G_Generic_error_category@std@@UEAAPEAXI@Z
0x180021F10: "read only file system" ??_C@_0BG@EICBIHDP@read?5only?5file?5system?$AA@
0x1800227E0: "Microsoft Antimalware" ??_C@_1CM@PPBNFOJN@?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?5?$AAA?$AAn?$AAt?$AAi?$AAm?$AAa?$AAl?$AAw?$AAa?$AAr?$AAe?$AA?$AA@
0x18002C988: "__vectorcall ??_R0?AVCEventLoggerBase@MpCommonEx@" ??_R0?AVCEventLoggerBase@MpCommonEx@@@8
0x18000E9D8: WPP_SF_qdd
0x180020F70: "__cdecl _imp_CoCreateInstance" __imp_CoCreateInstance
0x180020878: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x180022F60: "MpConfigClose" ??_C@_0O@HPLGDDMO@MpConfigClose?$AA@
0x180020A68: "__cdecl _imp_HeapReAlloc" __imp_HeapReAlloc
0x180015430: "protected: virtual int __cdecl MorroCommon::CWin32::AdjustWindowRectImpl(struct tagRECT * __ptr64,unsigned long,int) __ptr64" ?AdjustWindowRectImpl@CWin32@MorroCommon@@MEAAHPEAUtagRECT@@KH@Z
0x180020780: "__cdecl _imp_InitiateSystemShutdownExW" __imp_InitiateSystemShutdownExW
0x180025420: "__vectorcall ??_R3CComObjectRootBase@ATL" ??_R3CComObjectRootBase@ATL@@8
0x180025410: "__vectorcall ??_R2CComObjectRootBase@ATL" ??_R2CComObjectRootBase@ATL@@8
0x180022270: "HKCC" ??_C@_19OFICIBHH@?$AAH?$AAK?$AAC?$AAC?$AA?$AA@
0x18002C900: "__vectorcall ??_R0?AVbad_alloc@std@" ??_R0?AVbad_alloc@std@@@8
0x18000FF04: "void __cdecl CommonUtil::CommonThrowHr(long)" ?CommonThrowHr@CommonUtil@@YAXJ@Z
0x180014260: "protected: virtual int __cdecl MorroCommon::CWin32::PathFileExistsImpl(unsigned short const * __ptr64) __ptr64" ?PathFileExistsImpl@CWin32@MorroCommon@@MEAAHPEBG@Z
0x1800255D8: "const ATL::CRegObject::`RTTI Complete Object Locator'" ??_R4CRegObject@ATL@@6B@
0x180020330: "const MorroCommon::CLockEntireFile::`vftable'" ??_7CLockEntireFile@MorroCommon@@6B@
0x1800222A8: "HKEY_CURRENT_USER" ??_C@_1CE@HLHNCBPM@?$AAH?$AAK?$AAE?$AAY?$AA_?$AAC?$AAU?$AAR?$AAR?$AAE?$AAN?$AAT?$AA_?$AAU?$AAS?$AAE?$AAR?$AA?$AA@
0x180015040: "protected: virtual int __cdecl MorroCommon::CWin32::IsDialogMessageImpl(struct HWND__ * __ptr64,struct tagMSG * __ptr64) __ptr64" ?IsDialogMessageImpl@CWin32@MorroCommon@@MEAAHPEAUHWND__@@PEAUtagMSG@@@Z
0x18001FA10: "const std::_Generic_error_category::`vftable'" ??_7_Generic_error_category@std@@6B@
0x180025D48: "__vectorcall ??_R1A@?0A@EA@CLockedCertCheckImpl@MorroCommon" ??_R1A@?0A@EA@CLockedCertCheckImpl@MorroCommon@@8
0x180020700: "__cdecl _imp_ReportEventW" __imp_ReportEventW
0x180006D58: "public: __cdecl CommonUtil::AutoRef<class Microsoft::SecurityClient::CMalwareProviderEventLogger>::~AutoRef<class Microsoft::SecurityClient::CMalwareProviderEventLogger>(void) __ptr64" ??1?$AutoRef@VCMalwareProviderEventLogger@SecurityClient@Microsoft@@@CommonUtil@@QEAA@XZ
0x180020A80: "__cdecl _imp_GetProcessHeap" __imp_GetProcessHeap
0x180015590: "public: class MorroCommon::CWin32 * __ptr64 __cdecl MorroCommon::TSingletonWithProxy<class MorroCommon::CWin32>::operator->(void) __ptr64" ??C?$TSingletonWithProxy@VCWin32@MorroCommon@@@MorroCommon@@QEAAPEAVCWin32@1@XZ
0x18001BFB0: "__cdecl _chkstk" __chkstk
0x180021F78: "stream timeout" ??_C@_0P@DIIFGFCG@stream?5timeout?$AA@
0x1800170E0: "public: virtual void * __ptr64 __cdecl MorroCommon::CLockEntireFile::`scalar deleting destructor'(unsigned int) __ptr64" ??_GCLockEntireFile@MorroCommon@@UEAAPEAXI@Z
0x180011EC8: "long __cdecl CommonUtil::UtilCoCreateInstanceImpl(void * __ptr64 * __ptr64,struct _GUID const & __ptr64,struct _GUID const & __ptr64,unsigned long,struct IUnknown * __ptr64)" ?UtilCoCreateInstanceImpl@CommonUtil@@YAJPEAPEAXAEBU_GUID@@1KPEAUIUnknown@@@Z
0x180022A38: "PendingActions" ??_C@_1BO@LPIIFKOK@?$AAP?$AAe?$AAn?$AAd?$AAi?$AAn?$AAg?$AAA?$AAc?$AAt?$AAi?$AAo?$AAn?$AAs?$AA?$AA@
0x1800209A0: "__cdecl _imp_FindNextFileW" __imp_FindNextFileW
0x180025B30: "__vectorcall ??_R2CHResultException@CommonUtil" ??_R2CHResultException@CommonUtil@@8
0x180025AD8: "__vectorcall ??_R3CHResultException@CommonUtil" ??_R3CHResultException@CommonUtil@@8
0x1800145F0: "protected: virtual long __cdecl MorroCommon::CWin32::RegQueryValueExImpl(struct HKEY__ * __ptr64,unsigned short const * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64,unsigned char * __ptr64,unsigned long * __ptr64) __ptr64" ?RegQueryValueExImpl@CWin32@MorroCommon@@MEAAJPEAUHKEY__@@PEBGPEAK2PEAE2@Z
0x1800018F0: "public: virtual void * __ptr64 __cdecl std::_System_error_category::`vector deleting destructor'(unsigned int) __ptr64" ??_E_System_error_category@std@@UEAAPEAXI@Z
0x180025298: "const CMalwareProviderDllModule::`RTTI Complete Object Locator'" ??_R4CMalwareProviderDllModule@@6B@
0x180004FF4: MPTHREAT_INFO_FREE
0x1800180D0: "public: virtual void __cdecl MorroCommon::CLockedCertCheckImpl::Unlock(void) __ptr64" ?Unlock@CLockedCertCheckImpl@MorroCommon@@UEAAXXZ
0x180022418: "Hardware" ??_C@_1BC@MAICEHGI@?$AAH?$AAa?$AAr?$AAd?$AAw?$AAa?$AAr?$AAe?$AA?$AA@
0x180002E74: "public: int __cdecl ATL::CExpansionVector::Add(unsigned short const * __ptr64,unsigned short const * __ptr64) __ptr64" ?Add@CExpansionVector@ATL@@QEAAHPEBG0@Z
0x18001B660: "public: virtual void * __ptr64 __cdecl type_info::`scalar deleting destructor'(unsigned int) __ptr64" ??_Gtype_info@@UEAAPEAXI@Z
0x180021E78: "operation in progress" ??_C@_0BG@KDKHOPCO@operation?5in?5progress?$AA@
0x180020DA0: "__cdecl _imp_CryptCATAdminReleaseContext" __imp_CryptCATAdminReleaseContext
0x180020E00: "__cdecl _imp__errno" __imp__errno
0x180020B28: "__cdecl _imp_Process32NextW" __imp_Process32NextW
0x180029C18: "__cdecl CT??_R0?AVCHResultExceptionImpl@CommonUtil@@@8??0CHResultExceptionImpl@CommonUtil@@QEAA@AEBV01@@Z48" _CT??_R0?AVCHResultExceptionImpl@CommonUtil@@@8??0CHResultExceptionImpl@CommonUtil@@QEAA@AEBV01@@Z48
0x180020A60: "__cdecl _imp_HeapSize" __imp_HeapSize
0x18000FFA0: "public: __cdecl CommonUtil::CHResultExceptionImpl::CHResultExceptionImpl(class CommonUtil::CHResultExceptionImpl const & __ptr64) __ptr64" ??0CHResultExceptionImpl@CommonUtil@@QEAA@AEBV01@@Z
0x180014E80: "protected: virtual unsigned long __cdecl MorroCommon::CWin32::GetLongPathNameImpl(unsigned short const * __ptr64,unsigned short * __ptr64,unsigned long) __ptr64" ?GetLongPathNameImpl@CWin32@MorroCommon@@MEAAKPEBGPEAGK@Z
0x18001077C: "long __cdecl CommonUtil::UtilRegGetValueString(struct HKEY__ * __ptr64,unsigned short const * __ptr64,unsigned short * __ptr64 * __ptr64,enum CommonUtil::UTIL_REG_EXPAND_STRING,unsigned long * __ptr64)" ?UtilRegGetValueString@CommonUtil@@YAJPEAUHKEY__@@PEBGPEAPEAGW4UTIL_REG_EXPAND_STRING@1@PEAK@Z
0x180019A64: "public: static long __cdecl MpCommonEx::CPathUtilsEx::GetAntimalwareClientFullPath(unsigned short * __ptr64 * __ptr64)" ?GetAntimalwareClientFullPath@CPathUtilsEx@MpCommonEx@@SAJPEAPEAG@Z
0x180009100: "public: virtual void * __ptr64 __cdecl Microsoft::SecurityClient::CMalwareProviderEventLogger::`vector deleting destructor'(unsigned int) __ptr64" ??_ECMalwareProviderEventLogger@SecurityClient@Microsoft@@UEAAPEAXI@Z
0x180022818: "off" ??_C@_17FDPGNGBJ@?$AAo?$AAf?$AAf?$AA?$AA@
0x180014EF0: "protected: virtual int __cdecl MorroCommon::CWin32::LookupPrivilegeValueImpl(unsigned short const * __ptr64,unsigned short const * __ptr64,struct _LUID * __ptr64) __ptr64" ?LookupPrivilegeValueImpl@CWin32@MorroCommon@@MEAAHPEBG0PEAU_LUID@@@Z
0x180021BA0: "bad address" ??_C@_0M@KGHGGJGL@bad?5address?$AA@
0x180008E10: "private: void __cdecl ATL::CSimpleStringT<unsigned short,0>::Fork(int) __ptr64" ?Fork@?$CSimpleStringT@G$0A@@ATL@@AEAAXH@Z
0x180017F90: "public: virtual long __cdecl MorroCommon::CLockedCertCheckImpl::LockAndCheck(unsigned short const * __ptr64) __ptr64" ?LockAndCheck@CLockedCertCheckImpl@MorroCommon@@UEAAJPEBG@Z
0x180024FA8: "__vectorcall ??_R1EI@?0A@EN@?$CAtlValidateModuleConfiguration@$00VCMalwareProviderDllModule@@@ATL" ??_R1EI@?0A@EN@?$CAtlValidateModuleConfiguration@$00VCMalwareProviderDllModule@@@ATL@@8
0x18001ADF4: "public: __cdecl std::length_error::length_error(char const * __ptr64) __ptr64" ??0length_error@std@@QEAA@PEBD@Z
0x18001BD7C: "__cdecl invalid_parameter" _invalid_parameter
0x180020B78: "__cdecl _imp_GetExitCodeThread" __imp_GetExitCodeThread
0x180029AA8: "__cdecl CT??_R0?AVlength_error@std@@@8??0length_error@std@@QEAA@AEBV01@@Z24" _CT??_R0?AVlength_error@std@@@8??0length_error@std@@QEAA@AEBV01@@Z24
0x180022C28: "InsertionStrings" ??_C@_1CC@KCLBGNFE@?$AAI?$AAn?$AAs?$AAe?$AAr?$AAt?$AAi?$AAo?$AAn?$AAS?$AAt?$AAr?$AAi?$AAn?$AAg?$AAs?$AA?$AA@
0x18001BE51: realloc
0x180015C70: "protected: virtual class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > __cdecl MorroCommon::CPathUtils::GetModulePathByFullPathImpl(class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > const & __ptr64) __ptr64" ?GetModulePathByFullPathImpl@CPathUtils@MorroCommon@@MEAA?AV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@AEBV34@@Z
0x1800228D0: "DetectionSource" ??_C@_1CA@IDFDLMLC@?$AAD?$AAe?$AAt?$AAe?$AAc?$AAt?$AAi?$AAo?$AAn?$AAS?$AAo?$AAu?$AAr?$AAc?$AAe?$AA?$AA@
0x180014A40: "protected: virtual void * __ptr64 __cdecl MorroCommon::CWin32::FindFirstFileImpl(unsigned short const * __ptr64,struct _WIN32_FIND_DATAW * __ptr64) __ptr64" ?FindFirstFileImpl@CWin32@MorroCommon@@MEAAPEAXPEBGPEAU_WIN32_FIND_DATAW@@@Z
0x180002930: "public: virtual long __cdecl ATL::IWbemInstProviderImpl::CreateInstanceEnum(unsigned short * __ptr64 const,long,struct IWbemContext * __ptr64,struct IEnumWbemClassObject * __ptr64 * __ptr64) __ptr64" ?CreateInstanceEnum@IWbemInstProviderImpl@ATL@@UEAAJQEAGJPEAUIWbemContext@@PEAPEAUIEnumWbemClassObject@@@Z
0x18002D9B8: "public: static class std::locale::id std::numpunct<char>::id" ?id@?$numpunct@D@std@@2V0locale@2@A
0x180022448: "SECURITY" ??_C@_1BC@IBECJAAI@?$AAS?$AAE?$AAC?$AAU?$AAR?$AAI?$AAT?$AAY?$AA?$AA@
0x180016610: "protected: virtual long __cdecl MorroCommon::CPathUtils::GetAppDataPathImpl(class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > & __ptr64) __ptr64" ?GetAppDataPathImpl@CPathUtils@MorroCommon@@MEAAJAEAV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@@Z
0x180020980: "__cdecl _imp_CreateDirectoryW" __imp_CreateDirectoryW
0x180023650: WPP_b1dbba6d8a4631462108586c09fc156c_Traceguids
0x18002D5E0: "class ATL::CAtlComModule ATL::_AtlComModule" ?_AtlComModule@ATL@@3VCAtlComModule@1@A
0x180002B0C: "public: void __cdecl ATL::CAtlModule::Term(void) __ptr64" ?Term@CAtlModule@ATL@@QEAAXXZ
0x180022D10: "AmMonitoringTimeWindowSec" ??_C@_1DE@KOGEMFJG@?$AAA?$AAm?$AAM?$AAo?$AAn?$AAi?$AAt?$AAo?$AAr?$AAi?$AAn?$AAg?$AAT?$AAi?$AAm?$AAe?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAS?$AAe?$AAc?$AA?$AA@
0x1800235C8: "0.0.0.0" ??_C@_1BA@OJFOBGOM@?$AA0?$AA?4?$AA0?$AA?4?$AA0?$AA?4?$AA0?$AA?$AA@
0x180021CB0: "identifier removed" ??_C@_0BD@JPHBMONG@identifier?5removed?$AA@
0x180020D18: "__cdecl _imp_CreateDialogParamW" __imp_CreateDialogParamW
0x1800254A8: "const ATL::CComClassFactory::`RTTI Complete Object Locator'" ??_R4CComClassFactory@ATL@@6B@
0x180020A58: "__cdecl _imp_SystemTimeToFileTime" __imp_SystemTimeToFileTime
0x180013E88: "private: void __cdecl ATL::CSimpleStringT<char,0>::PrepareWrite2(int) __ptr64" ?PrepareWrite2@?$CSimpleStringT@D$0A@@ATL@@AEAAXH@Z
0x18002D990: "private: static class MorroCommon::CCertCheckFactory * __ptr64 __ptr64 MorroCommon::TSingletonWithProxy<class MorroCommon::CCertCheckFactory>::mts_proxy" ?mts_proxy@?$TSingletonWithProxy@VCCertCheckFactory@MorroCommon@@@MorroCommon@@0PEAVCCertCheckFactory@2@EA
0x1800219C8: "already_connected" ??_C@_0BC@FIFLCHLO@already_connected?$AA@
0x180019E90: "public: virtual void * __ptr64 __cdecl CommonUtil::CMpUtilsLibrary::`scalar deleting destructor'(unsigned int) __ptr64" ??_GCMpUtilsLibrary@CommonUtil@@UEAAPEAXI@Z
0x180022260: "HKDD" ??_C@_19GFFAIJHG@?$AAH?$AAK?$AAD?$AAD?$AA?$AA@
0x1800029C0: "public: virtual long __cdecl ATL::CAtlModule::GetLockCount(void) __ptr64" ?GetLockCount@CAtlModule@ATL@@UEAAJXZ
0x180008D58: "private: void __cdecl ATL::CSimpleStringT<unsigned short,0>::PrepareWrite2(int) __ptr64" ?PrepareWrite2@?$CSimpleStringT@G$0A@@ATL@@AEAAXH@Z
0x180022FC0: "MpFreeMemory" ??_C@_0N@LKFEIFBJ@MpFreeMemory?$AA@
0x180014B80: "protected: virtual int __cdecl MorroCommon::CWin32::AllocateAndInitializeSidImpl(struct _SID_IDENTIFIER_AUTHORITY * __ptr64,unsigned char,unsigned long,unsigned long,unsigned long,unsigned long,unsigned long,unsigned long,unsigned long,unsigned long,void * __ptr64 * __ptr64) __ptr64" ?AllocateAndInitializeSidImpl@CWin32@MorroCommon@@MEAAHPEAU_SID_IDENTIFIER_AUTHORITY@@EKKKKKKKKPEAPEAX@Z
0x180025C78: "__vectorcall ??_R1A@?0A@EA@CLockEntireFile@MorroCommon" ??_R1A@?0A@EA@CLockEntireFile@MorroCommon@@8
0x180025600: "__vectorcall ??_R3exception" ??_R3exception@@8
0x180025658: "__vectorcall ??_R2exception" ??_R2exception@@8
0x180020A98: "__cdecl _imp_MultiByteToWideChar" __imp_MultiByteToWideChar
0x180002930: "public: virtual long __cdecl ATL::IWbemInstProviderImpl::PutClassAsync(struct IWbemClassObject * __ptr64,long,struct IWbemContext * __ptr64,struct IWbemObjectSink * __ptr64) __ptr64" ?PutClassAsync@IWbemInstProviderImpl@ATL@@UEAAJPEAUIWbemClassObject@@JPEAUIWbemContext@@PEAUIWbemObjectSink@@@Z
0x1800152A0: "protected: virtual int __cdecl MorroCommon::CWin32::LookupPrivilegeNameImpl(unsigned short const * __ptr64,struct _LUID * __ptr64,unsigned short * __ptr64,unsigned long * __ptr64) __ptr64" ?LookupPrivilegeNameImpl@CWin32@MorroCommon@@MEAAHPEBGPEAU_LUID@@PEAGPEAK@Z
0x18000B310: "public: __cdecl CommonUtil::CUniqueHandle<struct CommonUtil::CAutoSysFreeString>::operator unsigned short * __ptr64 const & __ptr64(void)const __ptr64" ??B?$CUniqueHandle@UCAutoSysFreeString@CommonUtil@@@CommonUtil@@QEBAAEBQEAGXZ
0x180018F4C: "public: void __cdecl Microsoft::SecurityClient::CWbemClassObjectHelper::Put(unsigned short const * __ptr64,unsigned char) __ptr64" ?Put@CWbemClassObjectHelper@SecurityClient@Microsoft@@QEAAXPEBGE@Z
0x180020AE0: "__cdecl _imp_CopyFileW" __imp_CopyFileW
0x1800220F8: "iostream stream error" ??_C@_0BG@PADBLCHM@iostream?5stream?5error?$AA@
0x180021080: "__cdecl _guard_fids_table" __guard_fids_table
0x18000F228: "void __cdecl Microsoft::SecurityClient::UninitializeMpClientApi(void)" ?UninitializeMpClientApi@SecurityClient@Microsoft@@YAXXZ
0x180020EA8: "__cdecl _imp_wcscpy_s" __imp_wcscpy_s
0x180006CFC: "public: __cdecl CommonUtil::AutoRef<struct ISWbemDateTime>::~AutoRef<struct ISWbemDateTime>(void) __ptr64" ??1?$AutoRef@UISWbemDateTime@@@CommonUtil@@QEAA@XZ
0x180017308: "private: static void __cdecl MorroCommon::CCertCheck::CloseWinVerifyTrust(struct _WINTRUST_DATA * __ptr64)" ?CloseWinVerifyTrust@CCertCheck@MorroCommon@@CAXPEAU_WINTRUST_DATA@@@Z
0x18002C4A0: "__vectorcall ??_R0?AUIWbemProviderInit@" ??_R0?AUIWbemProviderInit@@@8
0x180022F98: "MpDetectionEnumerate" ??_C@_0BF@FOFOBIMG@MpDetectionEnumerate?$AA@
0x1800088BC: "public: __cdecl ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > >::~CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > >(void) __ptr64" ??1?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAA@XZ
0x18002D698: "class ATL::CWin32Heap ATL::g_strheap" ?g_strheap@ATL@@3VCWin32Heap@1@A
0x180020CD8: "__cdecl _imp_CharNextW" __imp_CharNextW
0x18001B4B4: "void __cdecl `eh vector destructor iterator'(void * __ptr64,unsigned __int64,unsigned __int64,void (__cdecl*)(void * __ptr64))" ??_M@YAXPEAX_K1P6AX0@Z@Z
0x18000DC00: "public: struct std::_Tree_node<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> >,void * __ptr64> * __ptr64 __cdecl std::_Tree_alloc<0,struct std::_Tree_base_types<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> >,class std::allocator<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> > > > >::_Buyheadnode(void) __ptr64" ?_Buyheadnode@?$_Tree_alloc@$0A@U?$_Tree_base_types@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@V?$allocator@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@@2@@std@@@std@@QEAAPEAU?$_Tree_node@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@PEAX@2@XZ
0x180023418: WPP_029b443b08043c19b345765ef007d4c5_Traceguids
0x180020F38: msvcrt_NULL_THUNK_DATA
0x180021D38: "network down" ??_C@_0N@KIIEAAIO@network?5down?$AA@
0x180014960: "protected: virtual int __cdecl MorroCommon::CWin32::Process32NextImpl(void * __ptr64,struct tagPROCESSENTRY32W * __ptr64) __ptr64" ?Process32NextImpl@CWin32@MorroCommon@@MEAAHPEAXPEAUtagPROCESSENTRY32W@@@Z
0x1800205D0: "__cdecl load_config_used" _load_config_used
0x18002C2F8: "__vectorcall ??_R0?AVlength_error@std@" ??_R0?AVlength_error@std@@@8
0x1800137B0: "protected: virtual long __cdecl MorroCommon::CFileUtils::ReadBufferImpl(unsigned char * __ptr64,unsigned __int64,class ATL::CComBSTR & __ptr64) __ptr64" ?ReadBufferImpl@CFileUtils@MorroCommon@@MEAAJPEAE_KAEAVCComBSTR@ATL@@@Z
0x180007310: "protected: void __cdecl std::_Tree<class std::_Tmap_traits<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> >,class CommonUtil::AutoRef<struct IWbemClassObject>,struct std::less<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > >,class std::allocator<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> > >,0> >::_Erase(struct std::_Tree_node<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> >,void * __ptr64> * __ptr64) __ptr64" ?_Erase@?$_Tree@V?$_Tmap_traits@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@U?$less@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@@std@@V?$allocator@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@@5@$0A@@std@@@std@@IEAAXPEAU?$_Tree_node@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@PEAX@2@@Z
0x180022C08: "TimeGenerated" ??_C@_1BM@OJDMBHCO@?$AAT?$AAi?$AAm?$AAe?$AAG?$AAe?$AAn?$AAe?$AAr?$AAa?$AAt?$AAe?$AAd?$AA?$AA@
0x180020E88: "__cdecl _imp_??0exception@@QEAA@AEBQEBDH@Z" __imp_??0exception@@QEAA@AEBQEBDH@Z
0x180025020: "__vectorcall ??_R1A@?0A@EA@_ATL_MODULE70@ATL" ??_R1A@?0A@EA@_ATL_MODULE70@ATL@@8
0x180022ED0: "MpManagerOpen" ??_C@_0O@JIOHGFBI@MpManagerOpen?$AA@
0x180014200: "protected: virtual struct HICON__ * __ptr64 __cdecl MorroCommon::CWin32::LoadIconImpl(struct HINSTANCE__ * __ptr64,unsigned short const * __ptr64) __ptr64" ?LoadIconImpl@CWin32@MorroCommon@@MEAAPEAUHICON__@@PEAUHINSTANCE__@@PEBG@Z
0x180029B70: "__cdecl TI1?AVCAtlException@ATL@@" _TI1?AVCAtlException@ATL@@
0x180007C90: "public: virtual void * __ptr64 __cdecl std::bad_alloc::`vector deleting destructor'(unsigned int) __ptr64" ??_Ebad_alloc@std@@UEAAPEAXI@Z
0x180020AF8: "__cdecl _imp_ReleaseMutex" __imp_ReleaseMutex
0x180014740: "protected: virtual void __cdecl MorroCommon::CWin32::SleepImpl(unsigned long) __ptr64" ?SleepImpl@CWin32@MorroCommon@@MEAAXK@Z
0x180001CEC: "public: void __cdecl std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >::_Xlen(void)const __ptr64" ?_Xlen@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEBAXXZ
0x180022E28: "AmMonitoringMaxNumOfInstances" ??_C@_1DM@GGJAPFMJ@?$AAA?$AAm?$AAM?$AAo?$AAn?$AAi?$AAt?$AAo?$AAr?$AAi?$AAn?$AAg?$AAM?$AAa?$AAx?$AAN?$AAu?$AAm?$AAO?$AAf?$AAI?$AAn?$AAs?$AAt?$AAa?$AAn?$AAc?$AAe?$AAs?$AA?$AA@
0x1800258E8: "__vectorcall ??_R1A@?0A@EA@CRefObject@CommonUtil" ??_R1A@?0A@EA@CRefObject@CommonUtil@@8
0x180021A40: "network_unreachable" ??_C@_0BE@JFNJIDNF@network_unreachable?$AA@
0x180015DF0: "protected: virtual class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > const & __ptr64 __cdecl MorroCommon::CPathUtils::GetCurrentModuleDirectoryImpl(void) __ptr64" ?GetCurrentModuleDirectoryImpl@CPathUtils@MorroCommon@@MEAAAEBV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@XZ
0x180022BE8: "EventIdentifier" ??_C@_1CA@HDBOCCPE@?$AAE?$AAv?$AAe?$AAn?$AAt?$AAI?$AAd?$AAe?$AAn?$AAt?$AAi?$AAf?$AAi?$AAe?$AAr?$AA?$AA@
0x18001A324: "public: long __cdecl CommonUtil::XListHash<struct CommonUtil::CMpGlobalVarsTable::XHashElementInfo,struct CommonUtil::XListHashDefaultNonThrowingAllocator>::Initialize(unsigned __int64,unsigned __int64,struct CommonUtil::XListHashDefaultNonThrowingAllocator) __ptr64" ?Initialize@?$XListHash@UXHashElementInfo@CMpGlobalVarsTable@CommonUtil@@UXListHashDefaultNonThrowingAllocator@3@@CommonUtil@@QEAAJ_K0UXListHashDefaultNonThrowingAllocator@2@@Z
0x180020CA8: "__cdecl _imp_KillTimer" __imp_KillTimer
0x180020C88: "__cdecl _imp_GetWindowThreadProcessId" __imp_GetWindowThreadProcessId
0x1800207B0: "__cdecl _imp_ChangeServiceConfigW" __imp_ChangeServiceConfigW
0x180011FA4: MpRegisterForInitializationAtStartup
0x180001CEC: "public: void __cdecl std::basic_string<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> >::_Xlen(void)const __ptr64" ?_Xlen@?$basic_string@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@std@@QEBAXXZ
0x180019224: "public: void __cdecl Microsoft::SecurityClient::CWbemClassObjectHelper::Put(unsigned short const * __ptr64,__int64) __ptr64" ?Put@CWbemClassObjectHelper@SecurityClient@Microsoft@@QEAAXPEBG_J@Z
0x180022700: "LocalOnly" ??_C@_1BE@OIICCNIH@?$AAL?$AAo?$AAc?$AAa?$AAl?$AAO?$AAn?$AAl?$AAy?$AA?$AA@
0x180002D00: "public: virtual unsigned long __cdecl ATL::CRegObject::AddRef(void) __ptr64" ?AddRef@CRegObject@ATL@@UEAAKXZ
0x180018D34: "public: void __cdecl Microsoft::SecurityClient::CWbemClassObjectHelper::Put(unsigned short const * __ptr64,bool) __ptr64" ?Put@CWbemClassObjectHelper@SecurityClient@Microsoft@@QEAAXPEBG_N@Z
0x180018A24: "public: __cdecl MorroCommon::PRODUCTVERSION::~PRODUCTVERSION(void) __ptr64" ??1PRODUCTVERSION@MorroCommon@@QEAA@XZ
0x180029F68: "__cdecl _IMPORT_DESCRIPTOR_CRYPT32" __IMPORT_DESCRIPTOR_CRYPT32
0x180002880: "public: virtual void * __ptr64 __cdecl ATL::CComObject<class CMalwareProvider>::`vector deleting destructor'(unsigned int) __ptr64" ??_E?$CComObject@VCMalwareProvider@@@ATL@@UEAAPEAXI@Z
0x1800224F8: "RegDeleteKeyExW" ??_C@_0BA@LILAPHGE@RegDeleteKeyExW?$AA@
0x180015190: "protected: virtual unsigned short __cdecl MorroCommon::CWin32::GetSystemDefaultUILanguageImpl(void) __ptr64" ?GetSystemDefaultUILanguageImpl@CWin32@MorroCommon@@MEAAGXZ
0x180029D20: "__stdcall CT??_R0PEAX" _CT??_R0PEAX@88
0x180021748: "directory not empty" ??_C@_0BE@JIDOCPHM@directory?5not?5empty?$AA@
0x180022E68: WPP_8ece11a1b6a13b3fe4cea85edd8f0a45_Traceguids
0x180023688: "GetFileVersionInfoSizeExW" ??_C@_0BK@NCKKICFJ@GetFileVersionInfoSizeExW?$AA@
0x180018A64: "public: static void __cdecl Microsoft::SecurityClient::CPropertyFormatter::SeparateDomainAndUser(unsigned short const * __ptr64 const,unsigned short * __ptr64 * __ptr64,unsigned short * __ptr64 * __ptr64)" ?SeparateDomainAndUser@CPropertyFormatter@SecurityClient@Microsoft@@SAXQEBGPEAPEAG1@Z
0x1800141D0: "protected: virtual struct HWND__ * __ptr64 __cdecl MorroCommon::CWin32::CreateDialogParamImpl(struct HINSTANCE__ * __ptr64,unsigned short const * __ptr64,struct HWND__ * __ptr64,__int64 (__cdecl*)(struct HWND__ * __ptr64,unsigned int,unsigned __int64,__int64),__int64) __ptr64" ?CreateDialogParamImpl@CWin32@MorroCommon@@MEAAPEAUHWND__@@PEAUHINSTANCE__@@PEBGPEAU3@P6A_J2I_K_J@Z4@Z
0x180020A40: "__cdecl _imp_VirtualLock" __imp_VirtualLock
0x180029E8C: "__cdecl _IMPORT_DESCRIPTOR_USER32" __IMPORT_DESCRIPTOR_USER32
0x180020CD0: "__cdecl _imp_SetWindowTextW" __imp_SetWindowTextW
0x18002D490: "public: static bool ATL::CAtlBaseModule::m_bInitFailed" ?m_bInitFailed@CAtlBaseModule@ATL@@2_NA
0x180014C20: "protected: virtual void * __ptr64 __cdecl MorroCommon::CWin32::FreeSidImpl(void * __ptr64) __ptr64" ?FreeSidImpl@CWin32@MorroCommon@@MEAAPEAXPEAX@Z
0x180022228: "HKCU" ??_C@_19JAPAIJDE@?$AAH?$AAK?$AAC?$AAU?$AA?$AA@
0x180023428: CLSID_WbemObjectTextSrc
0x18002CC50: "void * __ptr64 `RTTI Type Descriptor'" ??_R0PEAX@8
0x18001A7B0: "protected: virtual void * __ptr64 __cdecl CommonUtil::CPtrObjectProcessHeap::`scalar deleting destructor'(unsigned int) __ptr64" ??_GCPtrObjectProcessHeap@CommonUtil@@MEAAPEAXI@Z
0x180002A70: "public: __cdecl ATL::CComObjectRootEx<class ATL::CComMultiThreadModel>::~CComObjectRootEx<class ATL::CComMultiThreadModel>(void) __ptr64" ??1?$CComObjectRootEx@VCComMultiThreadModel@ATL@@@ATL@@QEAA@XZ
0x180025898: "const Microsoft::SecurityClient::CMalwareProviderEventLogger::`RTTI Complete Object Locator'{for `MpCommonEx::CEventLoggerBase'}" ??_R4CMalwareProviderEventLogger@SecurityClient@Microsoft@@6BCEventLoggerBase@MpCommonEx@@@
0x180015830: "protected: virtual long __cdecl MorroCommon::CPathUtils::CombineWithApplicationDirImpl(unsigned short const * __ptr64,class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > & __ptr64) __ptr64" ?CombineWithApplicationDirImpl@CPathUtils@MorroCommon@@MEAAJPEBGAEAV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@@Z
0x1800250F0: "__vectorcall ??_R1A@?0A@EA@?$CAtlModuleT@VCMalwareProviderDllModule@@@ATL" ??_R1A@?0A@EA@?$CAtlModuleT@VCMalwareProviderDllModule@@@ATL@@8
0x180020E40: "__cdecl _imp__amsg_exit" __imp__amsg_exit
0x18002CA10: "__vectorcall ??_R0?AVCRefObject@CommonUtil@" ??_R0?AVCRefObject@CommonUtil@@@8
0x180006E28: "public: void __cdecl std::_Wrap_alloc<class std::allocator<struct std::_Tree_node<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> >,void * __ptr64> > >::deallocate(struct std::_Tree_node<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> >,void * __ptr64> * __ptr64,unsigned __int64) __ptr64" ?deallocate@?$_Wrap_alloc@V?$allocator@U?$_Tree_node@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@PEAX@std@@@std@@@std@@QEAAXPEAU?$_Tree_node@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@PEAX@2@_K@Z
0x18001BB00: "public: virtual char const * __ptr64 __cdecl exception::what(void)const __ptr64" ?what@exception@@UEBAPEBDXZ
0x18002C3C0: "__vectorcall ??_R0?AV_Iostream_error_category@std@" ??_R0?AV_Iostream_error_category@std@@@8
0x18001AE40: "public: virtual void * __ptr64 __cdecl std::logic_error::`scalar deleting destructor'(unsigned int) __ptr64" ??_Glogic_error@std@@UEAAPEAXI@Z
0x180025C08: "const MorroCommon::CWin32::`RTTI Complete Object Locator'" ??_R4CWin32@MorroCommon@@6B@
0x180022178: "APPID" ??_C@_1M@PPPPCDEP@?$AAA?$AAP?$AAP?$AAI?$AAD?$AA?$AA@
0x180025368: "__vectorcall ??_R1A@?0A@EA@?$CComObjectRootEx@VCComMultiThreadModel@ATL@@@ATL" ??_R1A@?0A@EA@?$CComObjectRootEx@VCComMultiThreadModel@ATL@@@ATL@@8
0x1800146D0: "protected: virtual int __cdecl MorroCommon::CWin32::LoadStringImpl(struct HINSTANCE__ * __ptr64,unsigned int,unsigned short * __ptr64,int) __ptr64" ?LoadStringImpl@CWin32@MorroCommon@@MEAAHPEAUHINSTANCE__@@IPEAGH@Z
0x18000FBA4: MpFreeMemory
0x180020A38: "__cdecl _imp_DisableThreadLibraryCalls" __imp_DisableThreadLibraryCalls
0x180014D50: "protected: virtual struct SC_HANDLE__ * __ptr64 __cdecl MorroCommon::CWin32::OpenSCManagerImpl(unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned long) __ptr64" ?OpenSCManagerImpl@CWin32@MorroCommon@@MEAAPEAUSC_HANDLE__@@PEBG0K@Z
0x180003164: "private: void __cdecl ATL::CTempBuffer<unsigned short,256,class ATL::CCRTAllocator>::FreeHeap(void) __ptr64" ?FreeHeap@?$CTempBuffer@G$0BAA@VCCRTAllocator@ATL@@@ATL@@AEAAXXZ
0x18000FE14: "long __cdecl StringCchPrintfA(char * __ptr64,unsigned __int64,char const * __ptr64,...)" ?StringCchPrintfA@@YAJPEAD_KPEBDZZ
0x180003164: "private: void __cdecl ATL::CTempBuffer<unsigned char,256,class ATL::CCRTAllocator>::FreeHeap(void) __ptr64" ?FreeHeap@?$CTempBuffer@E$0BAA@VCCRTAllocator@ATL@@@ATL@@AEAAXXZ
0x18002D97C: "long volatile `public: static class MorroCommon::CWin32 * __ptr64 __cdecl MorroCommon::TSingletonWithProxy<class MorroCommon::CWin32>::GetInstance(void)'::`2'::ts_staticInstanceGuard" ?ts_staticInstanceGuard@?1??GetInstance@?$TSingletonWithProxy@VCWin32@MorroCommon@@@MorroCommon@@SAPEAVCWin32@3@XZ@4JC
0x18002D90C: "long volatile `public: static class MorroCommon::CFileUtils * __ptr64 __cdecl MorroCommon::TSingletonWithProxy<class MorroCommon::CFileUtils>::GetInstance(void)'::`2'::ts_staticInstanceGuard" ?ts_staticInstanceGuard@?1??GetInstance@?$TSingletonWithProxy@VCFileUtils@MorroCommon@@@MorroCommon@@SAPEAVCFileUtils@3@XZ@4JC
0x18002D924: "long volatile `public: static class MorroCommon::CPathUtils * __ptr64 __cdecl MorroCommon::TSingletonWithProxy<class MorroCommon::CPathUtils>::GetInstance(void)'::`2'::ts_staticInstanceGuard" ?ts_staticInstanceGuard@?1??GetInstance@?$TSingletonWithProxy@VCPathUtils@MorroCommon@@@MorroCommon@@SAPEAVCPathUtils@3@XZ@4JC
0x1800227D0: "System" ??_C@_1O@GINMMDNN@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?$AA@
0x180022EC0: "%ls\%ls" ??_C@_1BA@JPNMJFGG@?$AA?$CF?$AAl?$AAs?$AA?2?$AA?$CF?$AAl?$AAs?$AA?$AA@
0x180025EA8: "__vectorcall ??_R2CMpGlobalVarsTable@CommonUtil" ??_R2CMpGlobalVarsTable@CommonUtil@@8
0x180015060: "protected: virtual int __cdecl MorroCommon::CWin32::ResetEventImpl(void * __ptr64) __ptr64" ?ResetEventImpl@CWin32@MorroCommon@@MEAAHPEAX@Z
0x180025F00: "__vectorcall ??_R3CMpGlobalVarsTable@CommonUtil" ??_R3CMpGlobalVarsTable@CommonUtil@@8
0x180020CF0: "__cdecl _imp_LoadStringW" __imp_LoadStringW
0x180029B10: "__cdecl CT??_R0?AVout_of_range@std@@@8??0out_of_range@std@@QEAA@AEBV01@@Z24" _CT??_R0?AVout_of_range@std@@@8??0out_of_range@std@@QEAA@AEBV01@@Z24
0x18001ADCC: "public: __cdecl std::length_error::length_error(class std::length_error const & __ptr64) __ptr64" ??0length_error@std@@QEAA@AEBV01@@Z
0x180020A48: "__cdecl _imp_FileTimeToSystemTime" __imp_FileTimeToSystemTime
0x180023648: "%f" ??_C@_02NJPGOMH@?$CFf?$AA@
0x18000400C: "protected: long __cdecl ATL::CRegParser::RegisterSubkeys(unsigned short * __ptr64,struct HKEY__ * __ptr64,int,int) __ptr64" ?RegisterSubkeys@CRegParser@ATL@@IEAAJPEAGPEAUHKEY__@@HH@Z
0x180015130: "protected: virtual unsigned int __cdecl MorroCommon::CWin32::GetPrivateProfileIntImpl(unsigned short const * __ptr64,unsigned short const * __ptr64,int,unsigned short const * __ptr64) __ptr64" ?GetPrivateProfileIntImpl@CWin32@MorroCommon@@MEAAIPEBG0H0@Z
0x1800208E0: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x18001B9C8: "__cdecl Init_thread_abort" _Init_thread_abort
0x180020890: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x1800019A0: "public: virtual char const * __ptr64 __cdecl std::_Generic_error_category::name(void)const __ptr64" ?name@_Generic_error_category@std@@UEBAPEBDXZ
0x180021928: "connection_reset" ??_C@_0BB@JOANDNCK@connection_reset?$AA@
0x18001A3DC: "public: __cdecl CommonUtil::XListHash<struct CommonUtil::CMpGlobalVarsTable::XHashElementInfo,struct CommonUtil::XListHashDefaultNonThrowingAllocator>::XListHash<struct CommonUtil::CMpGlobalVarsTable::XHashElementInfo,struct CommonUtil::XListHashDefaultNonThrowingAllocator>(unsigned __int64,unsigned __int64,struct CommonUtil::XListHashDefaultNonThrowingAllocator) __ptr64" ??0?$XListHash@UXHashElementInfo@CMpGlobalVarsTable@CommonUtil@@UXListHashDefaultNonThrowingAllocator@3@@CommonUtil@@QEAA@_K0UXListHashDefaultNonThrowingAllocator@1@@Z
0x180024F08: "__vectorcall ??_R1A@?0A@EA@IWbemProviderInit" ??_R1A@?0A@EA@IWbemProviderInit@@8
0x180023030: "kernel32.dll" ??_C@_1BK@MGMFAEKH@?$AAk?$AAe?$AAr?$AAn?$AAe?$AAl?$AA3?$AA2?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x180022110: "system" ??_C@_06FHFOAHML@system?$AA@
0x18002C6C0: "__vectorcall ??_R0?AV?$CComObjectCached@VCComClassFactory@ATL@@@ATL@" ??_R0?AV?$CComObjectCached@VCComClassFactory@ATL@@@ATL@@@8
0x18001F000: "const std::logic_error::`vftable'" ??_7logic_error@std@@6B@
0x180015400: "protected: virtual unsigned short * __ptr64 __cdecl MorroCommon::CWin32::PathFindFileNameImpl(unsigned short const * __ptr64) __ptr64" ?PathFindFileNameImpl@CWin32@MorroCommon@@MEAAPEAGPEBG@Z
0x18000FE90: "public: __cdecl CommonUtil::CHResultExceptionImpl::CHResultExceptionImpl(long) __ptr64" ??0CHResultExceptionImpl@CommonUtil@@QEAA@J@Z
0x18002D4D2: "private: static class MorroCommon::TSingletonWithProxy<class MorroCommon::CWin32> MorroCommon::CWin32::m_instance" ?m_instance@CWin32@MorroCommon@@0V?$TSingletonWithProxy@VCWin32@MorroCommon@@@2@A
0x180024FD0: "__vectorcall ??_R1A@?0A@EA@?$CAtlDllModuleT@VCMalwareProviderDllModule@@@ATL" ??_R1A@?0A@EA@?$CAtlDllModuleT@VCMalwareProviderDllModule@@@ATL@@8
0x180010EB4: "public: static long __cdecl CommonUtil::CSprintfAllocWideCharPolicy::StringFormat(unsigned short * __ptr64,unsigned __int64,unsigned __int64 * __ptr64,unsigned short const * __ptr64,char * __ptr64)" ?StringFormat@CSprintfAllocWideCharPolicy@CommonUtil@@SAJPEAG_KPEA_KPEBGPEAD@Z
0x18000B2D0: "public: virtual unsigned long __cdecl Microsoft::SecurityClient::CMalwareProviderConfiguration::GetMaxSizeOfInstance(void)const __ptr64" ?GetMaxSizeOfInstance@CMalwareProviderConfiguration@SecurityClient@Microsoft@@UEBAKXZ
0x180020E80: "__cdecl _imp_??0exception@@QEAA@AEBV0@@Z" __imp_??0exception@@QEAA@AEBV0@@Z
0x180021878: "address_in_use" ??_C@_0P@LNDJPBFK@address_in_use?$AA@
0x180022898: "ActionTime" ??_C@_1BG@PAAEHGAG@?$AAA?$AAc?$AAt?$AAi?$AAo?$AAn?$AAT?$AAi?$AAm?$AAe?$AA?$AA@
0x18001FC90: "const std::bad_alloc::`vftable'" ??_7bad_alloc@std@@6B@
0x1800018F0: "public: virtual void * __ptr64 __cdecl std::_Generic_error_category::`vector deleting destructor'(unsigned int) __ptr64" ??_E_Generic_error_category@std@@UEAAPEAXI@Z
0x18000B590: WPP_SF_DdS
0x18000A90C: WPP_SF_Sdd
0x18000A90C: WPP_SF_SDd
0x180020708: "__cdecl _imp_DeregisterEventSource" __imp_DeregisterEventSource
0x1800249A0: "__vectorcall ??_R1A@?0A@EA@_Iostream_error_category@std" ??_R1A@?0A@EA@_Iostream_error_category@std@@8
0x1800073A8: "protected: void __cdecl std::vector<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> >,class std::allocator<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > > >::_Xlen(void)const __ptr64" ?_Xlen@?$vector@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$allocator@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@@std@@@std@@IEBAXXZ
0x180018CB8: WPP_SF_Sld
0x18000A99C: WPP_SF_SSd
0x1800188C8: "public: class CommonUtil::CReturnHandle<class CommonUtil::CUniqueHandle<struct CommonUtil::CAutoUniqueArrayPtrDelete2<unsigned short * __ptr64> > > __cdecl Microsoft::SecurityClient::CVersionFormatter::ToString(void)const __ptr64" ?ToString@CVersionFormatter@SecurityClient@Microsoft@@QEBA?AV?$CReturnHandle@V?$CUniqueHandle@U?$CAutoUniqueArrayPtrDelete2@PEAG@CommonUtil@@@CommonUtil@@@CommonUtil@@XZ
0x180020B20: "__cdecl _imp_Process32FirstW" __imp_Process32FirstW
0x180016BA0: "protected: virtual long __cdecl MorroCommon::CPathUtils::GetSpecialFolderPathImpl(int,class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > & __ptr64) __ptr64" ?GetSpecialFolderPathImpl@CPathUtils@MorroCommon@@MEAAJHAEAV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@@Z
0x180025218: "__vectorcall ??_R3CMalwareProviderDllModule" ??_R3CMalwareProviderDllModule@@8
0x180024CD0: "__vectorcall ??_R2CMalwareProviderDllModule" ??_R2CMalwareProviderDllModule@@8
0x1800208D8: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x18001B640: "__cdecl purecall" _purecall
0x180020818: "__cdecl _imp_RegQueryInfoKeyW" __imp_RegQueryInfoKeyW
0x180020998: "__cdecl _imp_GetFileSizeEx" __imp_GetFileSizeEx
0x1800207A8: "__cdecl _imp_ControlService" __imp_ControlService
0x18001B64C: "__cdecl _std_terminate" __std_terminate
0x180014C40: "protected: virtual int __cdecl MorroCommon::CWin32::StringFromGUID2Impl(struct _GUID const & __ptr64,unsigned short * __ptr64,int) __ptr64" ?StringFromGUID2Impl@CWin32@MorroCommon@@MEAAHAEBU_GUID@@PEAGH@Z
0x18002D970: "private: static class MorroCommon::CWin32 * __ptr64 __ptr64 MorroCommon::TSingletonWithProxy<class MorroCommon::CWin32>::mts_proxy" ?mts_proxy@?$TSingletonWithProxy@VCWin32@MorroCommon@@@MorroCommon@@0PEAVCWin32@2@EA
0x180023090: WPP_1c3e52e25d5b302f2ece2a7df877a490_Traceguids
0x180020740: "__cdecl _imp_GetUserNameW" __imp_GetUserNameW
0x180025A30: "const Microsoft::SecurityClient::CMpClientApi::`RTTI Complete Object Locator'" ??_R4CMpClientApi@SecurityClient@Microsoft@@6B@
0x180022470: "Software" ??_C@_1BC@EAHCMADO@?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?$AA@
0x180002B00: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x1800209B0: "__cdecl _imp_ExpandEnvironmentStringsW" __imp_ExpandEnvironmentStringsW
0x1800170E0: "public: virtual void * __ptr64 __cdecl MorroCommon::CLockEntireFile::`vector deleting destructor'(unsigned int) __ptr64" ??_ECLockEntireFile@MorroCommon@@UEAAPEAXI@Z
0x18000A5F8: "public: class std::basic_string<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > & __ptr64 __cdecl std::basic_string<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> >::assign(class std::basic_string<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const & __ptr64,unsigned __int64,unsigned __int64) __ptr64" ?assign@?$basic_string@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@std@@QEAAAEAV12@AEBV12@_K1@Z
0x1800209E8: "__cdecl _imp_GetSystemDirectoryW" __imp_GetSystemDirectoryW
0x18000E3F8: WPP_SF_g
0x180021DB8: "no message" ??_C@_0L@EDOLMPAK@no?5message?$AA@
0x180020EE8: "__cdecl _imp_wcsrchr" __imp_wcsrchr
0x180014A80: "protected: virtual int __cdecl MorroCommon::CWin32::FindCloseImpl(void * __ptr64) __ptr64" ?FindCloseImpl@CWin32@MorroCommon@@MEAAHPEAX@Z
0x1800023B0: "public: static long __cdecl ATL::CComCreator<class ATL::CComObjectCached<class ATL::CComClassFactory> >::CreateInstance(void * __ptr64,struct _GUID const & __ptr64,void * __ptr64 * __ptr64)" ?CreateInstance@?$CComCreator@V?$CComObjectCached@VCComClassFactory@ATL@@@ATL@@@ATL@@SAJPEAXAEBU_GUID@@PEAPEAX@Z
0x1800186BC: "public: class CommonUtil::CReturnHandle<class CommonUtil::CUniqueHandle<struct CommonUtil::CAutoUniqueArrayPtrDelete2<unsigned short * __ptr64> > > __cdecl Microsoft::SecurityClient::CDateTimeFormatter::ToCimDateTime(void)const __ptr64" ?ToCimDateTime@CDateTimeFormatter@SecurityClient@Microsoft@@QEBA?AV?$CReturnHandle@V?$CUniqueHandle@U?$CAutoUniqueArrayPtrDelete2@PEAG@CommonUtil@@@CommonUtil@@@CommonUtil@@XZ
0x1800018F0: "public: virtual void * __ptr64 __cdecl std::_System_error_category::`scalar deleting destructor'(unsigned int) __ptr64" ??_G_System_error_category@std@@UEAAPEAXI@Z
0x180021BC8: "bad message" ??_C@_0M@PMMIEFCP@bad?5message?$AA@
0x1800225C8: "__cdecl GUID_0002e012_0000_0000_c000_000000000046" _GUID_0002e012_0000_0000_c000_000000000046
0x180022990: "SeverityID" ??_C@_1BG@EDPDMIGB@?$AAS?$AAe?$AAv?$AAe?$AAr?$AAi?$AAt?$AAy?$AAI?$AAD?$AA?$AA@
0x1800024E8: "public: static long __cdecl ATL::CComCreator<class ATL::CComObject<class CMalwareProvider> >::CreateInstance(void * __ptr64,struct _GUID const & __ptr64,void * __ptr64 * __ptr64)" ?CreateInstance@?$CComCreator@V?$CComObject@VCMalwareProvider@@@ATL@@@ATL@@SAJPEAXAEBU_GUID@@PEAPEAX@Z
0x180029EDC: "__cdecl _IMPORT_DESCRIPTOR_mpclient" __IMPORT_DESCRIPTOR_mpclient
0x180009F5C: "public: struct std::_Tree_node<struct std::pair<long const,bool>,void * __ptr64> * __ptr64 __cdecl std::_Tree_buy<struct std::pair<long const,bool>,class std::allocator<struct std::pair<long const,bool> > >::_Buynode0(void) __ptr64" ?_Buynode0@?$_Tree_buy@U?$pair@$$CBJ_N@std@@V?$allocator@U?$pair@$$CBJ_N@std@@@2@@std@@QEAAPEAU?$_Tree_node@U?$pair@$$CBJ_N@std@@PEAX@2@XZ
0x180025E80: "__vectorcall ??_R1A@?0A@EA@CMpUtilsLibrary@CommonUtil" ??_R1A@?0A@EA@CMpUtilsLibrary@CommonUtil@@8
0x180015260: "protected: virtual int __cdecl MorroCommon::CWin32::PathIsRelativeImpl(unsigned short const * __ptr64) __ptr64" ?PathIsRelativeImpl@CWin32@MorroCommon@@MEAAHPEBG@Z
0x180012310: "public: virtual struct ATL::CStringData * __ptr64 __cdecl ATL::CAtlStringMgr::Reallocate(struct ATL::CStringData * __ptr64,int,int) __ptr64" ?Reallocate@CAtlStringMgr@ATL@@UEAAPEAUCStringData@2@PEAU32@HH@Z
0x180011664: "long __cdecl CommonUtil::UtilRawGetProcAddress(__int64 (__cdecl* * __ptr64)(void),struct HINSTANCE__ * __ptr64,char const * __ptr64,bool)" ?UtilRawGetProcAddress@CommonUtil@@YAJPEAP6A_JXZPEAUHINSTANCE__@@PEBD_N@Z
0x18000CB68: "private: class ATL::CComVariant __cdecl Microsoft::SecurityClient::CMalwareInstanceFactory::GetEventProperties(struct IWbemClassObject & __ptr64,unsigned short const * __ptr64 const,long)const __ptr64" ?GetEventProperties@CMalwareInstanceFactory@SecurityClient@Microsoft@@AEBA?AVCComVariant@ATL@@AEAUIWbemClassObject@@QEBGJ@Z
0x18001A800: "public: virtual void * __ptr64 __cdecl CommonUtil::CPredefinedMpHeapsHolder::`scalar deleting destructor'(unsigned int) __ptr64" ??_GCPredefinedMpHeapsHolder@CommonUtil@@UEAAPEAXI@Z
0x18001AE2C: "public: virtual __cdecl std::out_of_range::~out_of_range(void) __ptr64" ??1out_of_range@std@@UEAA@XZ
0x18000DB48: "protected: void __cdecl std::vector<struct IWbemClassObject * __ptr64,class std::allocator<struct IWbemClassObject * __ptr64> >::_Reallocate(unsigned __int64) __ptr64" ?_Reallocate@?$vector@PEAUIWbemClassObject@@V?$allocator@PEAUIWbemClassObject@@@std@@@std@@IEAAX_K@Z
0x180025FC8: "__vectorcall ??_R1A@?0A@EA@CPredefinedMpHeapsHolder@CommonUtil" ??_R1A@?0A@EA@CPredefinedMpHeapsHolder@CommonUtil@@8
0x180020850: "__cdecl _imp_ConvertStringSecurityDescriptorToSecurityDescriptorW" __imp_ConvertStringSecurityDescriptorToSecurityDescriptorW
0x180013A84: "public: __cdecl std::vector<struct MorroCommon::SFolderItem,class std::allocator<struct MorroCommon::SFolderItem> >::~vector<struct MorroCommon::SFolderItem,class std::allocator<struct MorroCommon::SFolderItem> >(void) __ptr64" ??1?$vector@USFolderItem@MorroCommon@@V?$allocator@USFolderItem@MorroCommon@@@std@@@std@@QEAA@XZ
0x180021FF8: "value too large" ??_C@_0BA@KGKGOOJA@value?5too?5large?$AA@
0x180021708: "filename too long" ??_C@_0BC@EJHOMAAK@filename?5too?5long?$AA@
0x180021AB8: "protocol_not_supported" ??_C@_0BH@KAPBAIJF@protocol_not_supported?$AA@
0x1800085A4: "public: __cdecl CommonUtil::CAutoBSTR::~CAutoBSTR(void) __ptr64" ??1CAutoBSTR@CommonUtil@@QEAA@XZ
0x18000C2A0: "private: void __cdecl Microsoft::SecurityClient::CMalwareInstanceFactory::PutMalwareProperty(class Microsoft::SecurityClient::CWbemClassObjectHelper & __ptr64,unsigned short const * __ptr64,unsigned short * __ptr64 const,long)const __ptr64" ?PutMalwareProperty@CMalwareInstanceFactory@SecurityClient@Microsoft@@AEBAXAEAVCWbemClassObjectHelper@23@PEBGQEAGJ@Z
0x18002D4D3: "private: static class MorroCommon::TSingletonWithProxy<class MorroCommon::CProductUtils> MorroCommon::CProductUtils::m_instance" ?m_instance@CProductUtils@MorroCommon@@0V?$TSingletonWithProxy@VCProductUtils@MorroCommon@@@2@A
0x18001AE40: "public: virtual void * __ptr64 __cdecl std::length_error::`vector deleting destructor'(unsigned int) __ptr64" ??_Elength_error@std@@UEAAPEAXI@Z
0x180024B58: "__vectorcall ??_R1A@?0A@EA@_System_error_category@std" ??_R1A@?0A@EA@_System_error_category@std@@8
0x180021940: "destination_address_required" ??_C@_0BN@JLJNLKLK@destination_address_required?$AA@
0x180020AB0: "__cdecl _imp_GetModuleHandleW" __imp_GetModuleHandleW
0x1800203B0: "const CommonUtil::CPredefinedMpHeapsHolder::`vftable'" ??_7CPredefinedMpHeapsHolder@CommonUtil@@6B@
0x1800073A8: "protected: void __cdecl std::vector<struct MorroCommon::SFolderItem,class std::allocator<struct MorroCommon::SFolderItem> >::_Xlen(void)const __ptr64" ?_Xlen@?$vector@USFolderItem@MorroCommon@@V?$allocator@USFolderItem@MorroCommon@@@std@@@std@@IEBAXXZ
0x180021D18: "is a directory" ??_C@_0P@FLLDBIDK@is?5a?5directory?$AA@
0x180020B50: "__cdecl _imp_VerifyVersionInfoW" __imp_VerifyVersionInfoW
0x18002C550: "__vectorcall ??_R0?AV?$CComObject@VCMalwareProvider@@@ATL@" ??_R0?AV?$CComObject@VCMalwareProvider@@@ATL@@@8
0x180003164: "private: void __cdecl ATL::CTempBuffer<unsigned short,1024,class ATL::CCRTAllocator>::FreeHeap(void) __ptr64" ?FreeHeap@?$CTempBuffer@G$0EAA@VCCRTAllocator@ATL@@@ATL@@AEAAXXZ
0x1800250B0: "__vectorcall ??_R3CAtlModule@ATL" ??_R3CAtlModule@ATL@@8
0x18002D488: "long (__cdecl* __ptr64 ATL::_pPerfUnRegFunc)(void)" ?_pPerfUnRegFunc@ATL@@3P6AJXZEA
0x180025098: "__vectorcall ??_R2CAtlModule@ATL" ??_R2CAtlModule@ATL@@8
0x180025690: "__vectorcall ??_R3bad_alloc@std" ??_R3bad_alloc@std@@8
0x180025618: "__vectorcall ??_R2bad_alloc@std" ??_R2bad_alloc@std@@8
0x180001D04: "public: class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > & __ptr64 __cdecl std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> >::assign(class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > const & __ptr64,unsigned __int64,unsigned __int64) __ptr64" ?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QEAAAEAV12@AEBV12@_K1@Z
0x180020CF8: "__cdecl _imp_ShowWindow" __imp_ShowWindow
0x180022BC8: "__cdecl GUID_dc12a687_737f_11cf_884d_00aa004b2e24" _GUID_dc12a687_737f_11cf_884d_00aa004b2e24
0x180021D58: "network unreachable" ??_C@_0BE@IFNCKGE@network?5unreachable?$AA@
0x1800221A8: "__cdecl GUID_daca056e_216a_4fd1_84a6_c306a017ecec" _GUID_daca056e_216a_4fd1_84a6_c306a017ecec
0x180014F30: "protected: virtual int __cdecl MorroCommon::CWin32::AdjustTokenPrivilegesImpl(void * __ptr64,int,struct _TOKEN_PRIVILEGES * __ptr64,unsigned long,struct _TOKEN_PRIVILEGES * __ptr64,unsigned long * __ptr64) __ptr64" ?AdjustTokenPrivilegesImpl@CWin32@MorroCommon@@MEAAHPEAXHPEAU_TOKEN_PRIVILEGES@@K1PEAK@Z
0x180020720: "__cdecl _imp_ControlTraceW" __imp_ControlTraceW
0x1800219E0: "too_many_files_open" ??_C@_0BE@GJJJJDDA@too_many_files_open?$AA@
0x180011030: "class CommonUtil::CReturnHandle<class CommonUtil::CUniqueHandle<struct CommonUtil::CAutoUniqueArrayPtrDelete2<unsigned short * __ptr64> > > __cdecl CommonUtil::TrNewSprintfW(unsigned short const * __ptr64,...)" ?TrNewSprintfW@CommonUtil@@YA?AV?$CReturnHandle@V?$CUniqueHandle@U?$CAutoUniqueArrayPtrDelete2@PEAG@CommonUtil@@@CommonUtil@@@1@PEBGZZ
0x1800108AC: "int __cdecl MpUtilsExports::UtilRegIsValidValueImpl(unsigned long,unsigned __int64,void const * __ptr64)" ?UtilRegIsValidValueImpl@MpUtilsExports@@YAHK_KPEBX@Z
0x180020F78: "__cdecl _imp_CoTaskMemAlloc" __imp_CoTaskMemAlloc
0x180024EE0: "__vectorcall ??_R1A@?0A@EA@IWbemInstProviderImpl@ATL" ??_R1A@?0A@EA@IWbemInstProviderImpl@ATL@@8
0x18000EF50: "public: virtual void * __ptr64 __cdecl Microsoft::SecurityClient::CMpClientApi::`scalar deleting destructor'(unsigned int) __ptr64" ??_GCMpClientApi@SecurityClient@Microsoft@@UEAAPEAXI@Z
0x180002940: "public: virtual long __cdecl ATL::CAtlModule::GetGITPtr(struct IGlobalInterfaceTable * __ptr64 * __ptr64) __ptr64" ?GetGITPtr@CAtlModule@ATL@@UEAAJPEAPEAUIGlobalInterfaceTable@@@Z
0x1800234E8: "MpClient.dll" ??_C@_1BK@JDCFPJCO@?$AAM?$AAp?$AAC?$AAl?$AAi?$AAe?$AAn?$AAt?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x180018E10: "public: void __cdecl Microsoft::SecurityClient::CWbemClassObjectHelper::Put(unsigned short const * __ptr64,unsigned short * __ptr64) __ptr64" ?Put@CWbemClassObjectHelper@SecurityClient@Microsoft@@QEAAXPEBGPEAG@Z
0x180020BE8: "__cdecl _imp_SysStringLen" __imp_SysStringLen
0x180014440: "protected: virtual struct HINSTANCE__ * __ptr64 __cdecl MorroCommon::CWin32::LoadLibraryExImpl(unsigned short const * __ptr64,void * __ptr64,unsigned long) __ptr64" ?LoadLibraryExImpl@CWin32@MorroCommon@@MEAAPEAUHINSTANCE__@@PEBGPEAXK@Z
0x180014AB0: "protected: virtual void * __ptr64 __cdecl MorroCommon::CWin32::GetCurrentProcessImpl(void) __ptr64" ?GetCurrentProcessImpl@CWin32@MorroCommon@@MEAAPEAXXZ
0x180021B10: "address family not supported" ??_C@_0BN@LKKBCCDB@address?5family?5not?5supported?$AA@
0x180020E48: "__cdecl _imp__XcptFilter" __imp__XcptFilter
0x1800126B0: "protected: virtual long __cdecl MorroCommon::CFileUtils::CreateFolderImpl(class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > const & __ptr64) __ptr64" ?CreateFolderImpl@CFileUtils@MorroCommon@@MEAAJAEBV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@@Z
0x180020D00: "__cdecl _imp_SendMessageW" __imp_SendMessageW
0x1800259F0: "__vectorcall ??_R3IMalwareProviderConfiguration@SecurityClient@Microsoft" ??_R3IMalwareProviderConfiguration@SecurityClient@Microsoft@@8
0x18000CB38: "public: __cdecl Microsoft::SecurityClient::CWbemClassObjectHelper::~CWbemClassObjectHelper(void) __ptr64" ??1CWbemClassObjectHelper@SecurityClient@Microsoft@@QEAA@XZ
0x180025978: "__vectorcall ??_R2IMalwareProviderConfiguration@SecurityClient@Microsoft" ??_R2IMalwareProviderConfiguration@SecurityClient@Microsoft@@8
0x180021B30: "address in use" ??_C@_0P@LDMLAFHI@address?5in?5use?$AA@
0x1800152D0: "protected: virtual int __cdecl MorroCommon::CWin32::CreateEnvironmentBlockImpl(void * __ptr64 * __ptr64,void * __ptr64,int) __ptr64" ?CreateEnvironmentBlockImpl@CWin32@MorroCommon@@MEAAHPEAPEAXPEAXH@Z
0x180020F50: ntdll_NULL_THUNK_DATA
0x180020E58: "__cdecl _imp_memcpy" __imp_memcpy
0x18002C878: "__vectorcall ??_R0?AVexception@" ??_R0?AVexception@@@8
0x180021970: "host_unreachable" ??_C@_0BB@KKNHPPIN@host_unreachable?$AA@
0x1800234A8: "*.com" ??_C@_1M@EJDCAMGD@?$AA?$CK?$AA?4?$AAc?$AAo?$AAm?$AA?$AA@
0x180002930: "public: virtual long __cdecl ATL::IWbemInstProviderImpl::PutInstance(struct IWbemClassObject * __ptr64,long,struct IWbemContext * __ptr64,struct IWbemCallResult * __ptr64 * __ptr64) __ptr64" ?PutInstance@IWbemInstProviderImpl@ATL@@UEAAJPEAUIWbemClassObject@@JPEAUIWbemContext@@PEAPEAUIWbemCallResult@@@Z
0x18001BA08: "__cdecl Init_thread_footer" _Init_thread_footer
0x180029AF0: "__cdecl CTA3?AVout_of_range@std@@" _CTA3?AVout_of_range@std@@
0x180025048: "__vectorcall ??_R2_ATL_MODULE70@ATL" ??_R2_ATL_MODULE70@ATL@@8
0x180025058: "__vectorcall ??_R3_ATL_MODULE70@ATL" ??_R3_ATL_MODULE70@ATL@@8
0x180026030: "__vectorcall ??_R1A@?0A@EA@CPtrObject@CommonUtil" ??_R1A@?0A@EA@CPtrObject@CommonUtil@@8
0x180008F74: WPP_SF_DDd
0x180007EDC: WPP_SF_ddd
0x180014B10: "protected: virtual unsigned long * __ptr64 __cdecl MorroCommon::CWin32::GetSidSubAuthorityImpl(void * __ptr64,unsigned long) __ptr64" ?GetSidSubAuthorityImpl@CWin32@MorroCommon@@MEAAPEAKPEAXK@Z
0x18001FE78: "const ATL::CAtlStringMgr::`vftable'" ??_7CAtlStringMgr@ATL@@6B@
0x18002CDF0: "__vectorcall ??_R0?AVCPtrObjectProcessHeap@CommonUtil@" ??_R0?AVCPtrObjectProcessHeap@CommonUtil@@@8
0x180020D10: "__cdecl _imp_FindWindowW" __imp_FindWindowW
0x18002CD80: "__vectorcall ??_R0?AVCMpGlobalVarsTable@CommonUtil@" ??_R0?AVCMpGlobalVarsTable@CommonUtil@@@8
0x18001FCA8: "const MorroCommon::CFileUtils::`vftable'" ??_7CFileUtils@MorroCommon@@6B@
0x180021E90: "operation not permitted" ??_C@_0BI@OHIEJAAB@operation?5not?5permitted?$AA@
0x18002C9C0: "__vectorcall ??_R0?AVCMalwareProviderEventLogger@SecurityClient@Microsoft@" ??_R0?AVCMalwareProviderEventLogger@SecurityClient@Microsoft@@@8
0x180023498: "*.exe" ??_C@_1M@FEDKBPCI@?$AA?$CK?$AA?4?$AAe?$AAx?$AAe?$AA?$AA@
0x180014AF0: "protected: virtual int __cdecl MorroCommon::CWin32::HeapFreeImpl(void * __ptr64,unsigned long,void * __ptr64) __ptr64" ?HeapFreeImpl@CWin32@MorroCommon@@MEAAHPEAXK0@Z
0x180002930: "public: virtual long __cdecl ATL::IWbemInstProviderImpl::DeleteInstance(unsigned short * __ptr64 const,long,struct IWbemContext * __ptr64,struct IWbemCallResult * __ptr64 * __ptr64) __ptr64" ?DeleteInstance@IWbemInstProviderImpl@ATL@@UEAAJQEAGJPEAUIWbemContext@@PEAPEAUIWbemCallResult@@@Z
0x180020760: "__cdecl _imp_FreeSid" __imp_FreeSid
0x180020758: "__cdecl _imp_GetSidSubAuthorityCount" __imp_GetSidSubAuthorityCount
0x18001108C: "public: static long __cdecl CommonUtil::CSprintfAlloc<struct CommonUtil::CNewSprintfPolicy<unsigned short>,260>::DoFormating(unsigned __int64 * __ptr64,unsigned short * __ptr64 * __ptr64,unsigned short const * __ptr64,char * __ptr64,unsigned __int64)" ?DoFormating@?$CSprintfAlloc@U?$CNewSprintfPolicy@G@CommonUtil@@$0BAE@@CommonUtil@@SAJPEA_KPEAPEAGPEBGPEAD_K@Z
0x180025F18: "__vectorcall ??_R1A@?0A@EA@CMpGlobalVarsTable@CommonUtil" ??_R1A@?0A@EA@CMpGlobalVarsTable@CommonUtil@@8
0x1800207D0: "__cdecl _imp_GetTraceEnableFlags" __imp_GetTraceEnableFlags
0x18000B6C8: WPP_SF_SSSS
0x180003D5C: "public: __cdecl ATL::CRegKey::~CRegKey(void) __ptr64" ??1CRegKey@ATL@@QEAA@XZ
0x18000B33C: "class CommonUtil::CStdMoveable<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> >,struct CommonUtil::CStdMoveableDefaultPolicy<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > > > __cdecl CommonUtil::CStringCopyW(unsigned short const * __ptr64)" ?CStringCopyW@CommonUtil@@YA?AV?$CStdMoveable@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@U?$CStdMoveableDefaultPolicy@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@@2@@1@PEBG@Z
0x180021E18: "no such process" ??_C@_0BA@ENLPPKBN@no?5such?5process?$AA@
0x18002C830: "__vectorcall ??_R0?AUIUnknown@" ??_R0?AUIUnknown@@@8
0x180005324: WPP_SF_P
0x180020EF8: "__cdecl _imp___CxxFrameHandler3" __imp___CxxFrameHandler3
0x1800207C8: "__cdecl _imp_RegisterTraceGuidsW" __imp_RegisterTraceGuidsW
0x18002CEA8: "__cdecl _security_cookie" __security_cookie
0x1800236D8: "GetFileVersionInfoExW" ??_C@_0BG@GEGOAKFF@GetFileVersionInfoExW?$AA@
0x18000B280: "public: virtual bool __cdecl Microsoft::SecurityClient::CMalwareProviderConfiguration::IsTestMode(void)const __ptr64" ?IsTestMode@CMalwareProviderConfiguration@SecurityClient@Microsoft@@UEBA_NXZ
0x180020738: "__cdecl _imp_RegQueryValueExW" __imp_RegQueryValueExW
0x180021EE8: "protocol error" ??_C@_0P@FNPOCJBE@protocol?5error?$AA@
0x18002D960: ?$TSS0@?1??Instance@CWPPTrace@MorroCommon@@SAAEAV23@XZ@4HA
0x18001BFB0: "__cdecl alloca_probe" _alloca_probe
0x180017D74: "long __cdecl MorroCommon::HrCStringFormat(class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > & __ptr64,unsigned short const * __ptr64,...)" ?HrCStringFormat@MorroCommon@@YAJAEAV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@PEBGZZ
0x180020A30: "__cdecl _imp_GetExitCodeProcess" __imp_GetExitCodeProcess
0x180011400: "long __cdecl CommonUtil::UtilLoadLibraryEx(struct HINSTANCE__ * __ptr64 * __ptr64,unsigned short const * __ptr64,unsigned long)" ?UtilLoadLibraryEx@CommonUtil@@YAJPEAPEAUHINSTANCE__@@PEBGK@Z
0x18001054C: "long __cdecl CommonUtil::UtilRegGetValueAlloc(struct HKEY__ * __ptr64,unsigned short const * __ptr64,unsigned long,unsigned long * __ptr64,unsigned __int64 * __ptr64,unsigned char * __ptr64 * __ptr64,unsigned __int64)" ?UtilRegGetValueAlloc@CommonUtil@@YAJPEAUHKEY__@@PEBGKPEAKPEA_KPEAPEAE_K@Z
0x180021F60: "state not recoverable" ??_C@_0BG@MPLKFPAE@state?5not?5recoverable?$AA@
0x180013CD8: "public: __cdecl ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > >::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > >(unsigned short const * __ptr64,int,struct ATL::IAtlStringMgr * __ptr64) __ptr64" ??0?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAA@PEBGHPEAUIAtlStringMgr@1@@Z
0x180020838: "__cdecl _imp_CheckTokenMembership" __imp_CheckTokenMembership
0x180020CA0: "__cdecl _imp_SetTimer" __imp_SetTimer
0x1800098B8: "public: void __cdecl Microsoft::SecurityClient::CMalwareProviderEventLogger::Reset(void) __ptr64" ?Reset@CMalwareProviderEventLogger@SecurityClient@Microsoft@@QEAAXXZ
0x180014530: "protected: virtual void * __ptr64 __cdecl MorroCommon::CWin32::CreateMutexImpl(struct _SECURITY_ATTRIBUTES * __ptr64,int,unsigned short const * __ptr64) __ptr64" ?CreateMutexImpl@CWin32@MorroCommon@@MEAAPEAXPEAU_SECURITY_ATTRIBUTES@@HPEBG@Z
0x180025BF0: "__vectorcall ??_R3CWin32@MorroCommon" ??_R3CWin32@MorroCommon@@8
0x180025BE0: "__vectorcall ??_R2CWin32@MorroCommon" ??_R2CWin32@MorroCommon@@8
0x180020A18: "__cdecl _imp_ResetEvent" __imp_ResetEvent
0x180020DA8: "__cdecl _imp_WinVerifyTrust" __imp_WinVerifyTrust
0x180020958: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x180020DC8: "__cdecl _imp_WTSFreeMemory" __imp_WTSFreeMemory
0x180014E20: "protected: virtual int __cdecl MorroCommon::CWin32::ControlServiceImpl(struct SC_HANDLE__ * __ptr64,unsigned long,struct _SERVICE_STATUS * __ptr64) __ptr64" ?ControlServiceImpl@CWin32@MorroCommon@@MEAAHPEAUSC_HANDLE__@@KPEAU_SERVICE_STATUS@@@Z
0x180025CB8: "__vectorcall ??_R3CLockEntireFile@MorroCommon" ??_R3CLockEntireFile@MorroCommon@@8
0x180025C40: "__vectorcall ??_R2CLockEntireFile@MorroCommon" ??_R2CLockEntireFile@MorroCommon@@8
0x180020A20: "__cdecl _imp_LocalFree" __imp_LocalFree
0x1800217E0: "not enough memory" ??_C@_0BC@ENOOLCNF@not?5enough?5memory?$AA@
0x180005AB0: "public: virtual long __cdecl CMalwareProvider::CreateInstanceEnumAsync(unsigned short * __ptr64 const,long,struct IWbemContext * __ptr64,struct IWbemObjectSink * __ptr64) __ptr64" ?CreateInstanceEnumAsync@CMalwareProvider@@UEAAJQEAGJPEAUIWbemContext@@PEAUIWbemObjectSink@@@Z
0x1800219A0: "interrupted" ??_C@_0M@EGEKIIMP@interrupted?$AA@
0x180015900: "protected: virtual long __cdecl MorroCommon::CPathUtils::GetModulePathImpl(struct HINSTANCE__ * __ptr64,unsigned short * __ptr64,unsigned long) __ptr64" ?GetModulePathImpl@CPathUtils@MorroCommon@@MEAAJPEAUHINSTANCE__@@PEAGK@Z
0x180021D80: "no child process" ??_C@_0BB@IEPBLJHK@no?5child?5process?$AA@
0x1800150F0: "protected: virtual unsigned long __cdecl MorroCommon::CWin32::GetPrivateProfileStringImpl(unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short * __ptr64,unsigned long,unsigned short const * __ptr64) __ptr64" ?GetPrivateProfileStringImpl@CWin32@MorroCommon@@MEAAKPEBG00PEAGK0@Z
0x180020C00: "__cdecl _imp_VariantInit" __imp_VariantInit
0x180021070: "__cdecl _xl_a" __xl_a
0x1800031EC: "public: __cdecl ATL::CRegParser::CParseBuffer::~CParseBuffer(void) __ptr64" ??1CParseBuffer@CRegParser@ATL@@QEAA@XZ
0x180029C40: "__cdecl CT??_R0?AVCHResultException@CommonUtil@@@8??0CHResultException@CommonUtil@@QEAA@AEBV01@@Z24" _CT??_R0?AVCHResultException@CommonUtil@@@8??0CHResultException@CommonUtil@@QEAA@AEBV01@@Z24
0x1800209E0: "__cdecl _imp_GetFileAttributesW" __imp_GetFileAttributesW
0x1800117D4: "long __cdecl CommonUtil::UtilIsFileExists(unsigned short const * __ptr64)" ?UtilIsFileExists@CommonUtil@@YAJPEBG@Z
0x180014570: "protected: virtual int __cdecl MorroCommon::CWin32::ReleaseMutexImpl(void * __ptr64) __ptr64" ?ReleaseMutexImpl@CWin32@MorroCommon@@MEAAHPEAX@Z
0x180007468: "public: __cdecl ATL::CComBSTR::operator unsigned short * __ptr64(void)const __ptr64" ??BCComBSTR@ATL@@QEBAPEAGXZ
0x180029CE8: "__cdecl TI2PEAVEHresultException@MorroCommon@@" _TI2PEAVEHresultException@MorroCommon@@
0x180021F98: "timed out" ??_C@_09KJPPMAOI@timed?5out?$AA@
0x180014A20: "protected: virtual void * __ptr64 __cdecl MorroCommon::CWin32::LockResourceImpl(void * __ptr64) __ptr64" ?LockResourceImpl@CWin32@MorroCommon@@MEAAPEAXPEAX@Z
0x180021D48: "network reset" ??_C@_0O@FNPDBHEE@network?5reset?$AA@
0x180020C10: "__cdecl _imp_SysAllocString" __imp_SysAllocString
0x180016EA0: "protected: virtual bool __cdecl MorroCommon::CPathUtils::IsPathExecutableImpl(unsigned short const * __ptr64) __ptr64" ?IsPathExecutableImpl@CPathUtils@MorroCommon@@MEAA_NPEBG@Z
0x180012514: "public: static long __cdecl MorroCommon::CFileUtils::ReadBuffer(unsigned char * __ptr64,unsigned __int64,class ATL::CComBSTR & __ptr64)" ?ReadBuffer@CFileUtils@MorroCommon@@SAJPEAE_KAEAVCComBSTR@ATL@@@Z
0x1800207F8: "__cdecl _imp_RegCreateKeyExW" __imp_RegCreateKeyExW
0x180008CBC: "protected: static void __cdecl ATL::CSimpleStringT<unsigned short,0>::ThrowMemoryException(void)" ?ThrowMemoryException@?$CSimpleStringT@G$0A@@ATL@@KAXXZ
0x180022940: "DetectionID" ??_C@_1BI@BHLPCECP@?$AAD?$AAe?$AAt?$AAe?$AAc?$AAt?$AAi?$AAo?$AAn?$AAI?$AAD?$AA?$AA@
0x18000A34C: "class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > * __ptr64 __cdecl std::_Uninit_move<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > * __ptr64,class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > * __ptr64,class std::allocator<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > >,class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > >(class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > * __ptr64,class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > * __ptr64,class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > * __ptr64,struct std::_Wrap_alloc<class std::allocator<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > > > & __ptr64,class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > * __ptr64,struct std::_Nonscalar_ptr_iterator_tag)" ??$_Uninit_move@PEAV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@PEAV12@V?$allocator@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@@std@@V12@@std@@YAPEAV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@PEAV12@00AEAU?$_Wrap_alloc@V?$allocator@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@@std@@@0@0U_Nonscalar_ptr_iterator_tag@0@@Z
0x18002CAE0: "__vectorcall ??_R0?AVCMpClientApi@SecurityClient@Microsoft@" ??_R0?AVCMpClientApi@SecurityClient@Microsoft@@@8
0x18002DA78: "__cdecl _onexitbegin" __onexitbegin
0x180025D20: "__vectorcall ??_R2CLockedCertCheckImpl@MorroCommon" ??_R2CLockedCertCheckImpl@MorroCommon@@8
0x180021B70: "argument list too long" ??_C@_0BH@CAKOHOMI@argument?5list?5too?5long?$AA@
0x1800222F8: "HKEY_USERS" ??_C@_1BG@BGODANIO@?$AAH?$AAK?$AAE?$AAY?$AA_?$AAU?$AAS?$AAE?$AAR?$AAS?$AA?$AA@
0x180025D98: "__vectorcall ??_R3CLockedCertCheckImpl@MorroCommon" ??_R3CLockedCertCheckImpl@MorroCommon@@8
0x180025A88: "__vectorcall ??_R1A@?0A@EA@CMpClientApi@SecurityClient@Microsoft" ??_R1A@?0A@EA@CMpClientApi@SecurityClient@Microsoft@@8
0x180014880: "protected: virtual unsigned char * __ptr64 __cdecl MorroCommon::CWin32::GetSidSubAuthorityCountImpl(void * __ptr64) __ptr64" ?GetSidSubAuthorityCountImpl@CWin32@MorroCommon@@MEAAPEAEPEAX@Z
0x180015D6C: "public: static class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > __cdecl MorroCommon::CPathUtils::CombinePath(unsigned short const * __ptr64 const,unsigned short const * __ptr64 const)" ?CombinePath@CPathUtils@MorroCommon@@SA?AV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEBG0@Z
0x1800018F0: "public: virtual void * __ptr64 __cdecl std::_Iostream_error_category::`vector deleting destructor'(unsigned int) __ptr64" ??_E_Iostream_error_category@std@@UEAAPEAXI@Z
0x180017F50: "public: virtual void * __ptr64 __cdecl MorroCommon::CLockedCertCheckImpl::`scalar deleting destructor'(unsigned int) __ptr64" ??_GCLockedCertCheckImpl@MorroCommon@@UEAAPEAXI@Z
0x180020C68: "__cdecl _imp_PathFileExistsW" __imp_PathFileExistsW
0x180006CFC: "public: __cdecl CommonUtil::AutoRef<struct IWbemServices>::~AutoRef<struct IWbemServices>(void) __ptr64" ??1?$AutoRef@UIWbemServices@@@CommonUtil@@QEAA@XZ
0x1800221D8: "Module" ??_C@_1O@MNLDABAF@?$AAM?$AAo?$AAd?$AAu?$AAl?$AAe?$AA?$AA@
0x180020340: "const MorroCommon::CLockedCertCheckImpl::`vftable'" ??_7CLockedCertCheckImpl@MorroCommon@@6B@
0x180020960: "__cdecl _imp_SwitchToThread" __imp_SwitchToThread
0x1800256A8: "__vectorcall ??_R1A@?0A@EA@exception" ??_R1A@?0A@EA@exception@@8
0x1800123D0: "public: virtual void * __ptr64 __cdecl ATL::CAtlStringMgr::`vector deleting destructor'(unsigned int) __ptr64" ??_ECAtlStringMgr@ATL@@UEAAPEAXI@Z
0x18001993C: "public: static long __cdecl MpCommonEx::CPathUtilsEx::GetClientInstallPath(unsigned short * __ptr64 * __ptr64)" ?GetClientInstallPath@CPathUtilsEx@MpCommonEx@@SAJPEAPEAG@Z
0x18000B2B0: "public: virtual class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const & __ptr64 __cdecl Microsoft::SecurityClient::CMalwareProviderConfiguration::EventLogSource(void)const __ptr64" ?EventLogSource@CMalwareProviderConfiguration@SecurityClient@Microsoft@@UEBAAEBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@XZ
0x18000A420: "public: void __cdecl std::basic_string<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> >::_Swap_bx(class std::basic_string<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > & __ptr64) __ptr64" ?_Swap_bx@?$basic_string@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@std@@QEAAXAEAV12@@Z
0x180012570: "protected: virtual long __cdecl MorroCommon::CFileUtils::CopyFileImpl(class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > const & __ptr64,class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > const & __ptr64,bool) __ptr64" ?CopyFileImpl@CFileUtils@MorroCommon@@MEAAJAEBV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@0_N@Z
0x1800085C4: "public: __cdecl ATL::CComVariant::~CComVariant(void) __ptr64" ??1CComVariant@ATL@@QEAA@XZ
0x180022900: "ActionSuccess" ??_C@_1BM@KDMLDKFK@?$AAA?$AAc?$AAt?$AAi?$AAo?$AAn?$AAS?$AAu?$AAc?$AAc?$AAe?$AAs?$AAs?$AA?$AA@
0x180022398: "AppID" ??_C@_1M@EJNEECMJ@?$AAA?$AAp?$AAp?$AAI?$AAD?$AA?$AA@
0x180019E40: "public: virtual void * __ptr64 __cdecl CommonUtil::CMpGlobalVarsTable::`scalar deleting destructor'(unsigned int) __ptr64" ??_GCMpGlobalVarsTable@CommonUtil@@UEAAPEAXI@Z
0x1800145C0: "protected: virtual long __cdecl MorroCommon::CWin32::RegOpenKeyExImpl(struct HKEY__ * __ptr64,unsigned short const * __ptr64,unsigned long,unsigned long,struct HKEY__ * __ptr64 * __ptr64) __ptr64" ?RegOpenKeyExImpl@CWin32@MorroCommon@@MEAAJPEAUHKEY__@@PEBGKKPEAPEAU3@@Z
0x180020F08: "__cdecl _imp__vsnwprintf" __imp__vsnwprintf
0x180020E98: "__cdecl _imp_?what@exception@@UEBAPEBDXZ" __imp_?what@exception@@UEBAPEBDXZ
0x18001949C: WPP_SF_qd
0x180021E48: "not a stream" ??_C@_0N@LGAPMMPI@not?5a?5stream?$AA@
0x18002D5DA: "struct CommonUtil::CCommonThrowHR CommonUtil::tHR" ?tHR@CommonUtil@@3UCCommonThrowHR@1@A
0x1800208C8: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x180020950: "__cdecl _imp_GetCurrentThread" __imp_GetCurrentThread
0x180025CF8: "const MorroCommon::CLockEntireFile::`RTTI Complete Object Locator'" ??_R4CLockEntireFile@MorroCommon@@6B@
0x180004B4C: "public: long __cdecl ATL::CAtlModule::UpdateRegistryFromResourceS(unsigned int,int,struct ATL::_ATL_REGMAP_ENTRY * __ptr64) __ptr64" ?UpdateRegistryFromResourceS@CAtlModule@ATL@@QEAAJIHPEAU_ATL_REGMAP_ENTRY@2@@Z
0x180020D30: "__cdecl _imp_DestroyEnvironmentBlock" __imp_DestroyEnvironmentBlock
0x18000EA48: WPP_SF_qq
0x1800223E8: "FileType" ??_C@_1BC@NKMMNMGL@?$AAF?$AAi?$AAl?$AAe?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x18001966C: "protected: void __cdecl MpCommonEx::CEventLoggerBase::LogEvent(enum MpCommonEx::EventSeverity,unsigned long,class CommonUtil::CStdVector<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> >,class std::allocator<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > > > const & __ptr64,unsigned short) __ptr64" ?LogEvent@CEventLoggerBase@MpCommonEx@@IEAAXW4EventSeverity@2@KAEBV?$CStdVector@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$allocator@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@@std@@@CommonUtil@@G@Z
0x180008BA0: "public: int __cdecl ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > >::LoadStringW(struct HINSTANCE__ * __ptr64,unsigned int) __ptr64" ?LoadStringW@?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@QEAAHPEAUHINSTANCE__@@I@Z
0x18001BA78: "__cdecl Init_thread_header" _Init_thread_header
0x180029E78: "__cdecl _IMPORT_DESCRIPTOR_KERNEL32" __IMPORT_DESCRIPTOR_KERNEL32
0x180025248: "const ATL::CComObject<class CMalwareProvider>::`RTTI Complete Object Locator'{for `IWbemProviderInit'}" ??_R4?$CComObject@VCMalwareProvider@@@ATL@@6BIWbemProviderInit@@@
0x180025FA0: "__vectorcall ??_R1A@?0A@EA@CPtrObjectProcessHeap@CommonUtil" ??_R1A@?0A@EA@CPtrObjectProcessHeap@CommonUtil@@8
0x1800216F8: "no such device" ??_C@_0P@FDINDDOK@no?5such?5device?$AA@
0x18000BBC0: "private: void __cdecl Microsoft::SecurityClient::CMalwareInstanceFactory::FillActionTimePropertyTestMode(struct IWbemClassObject & __ptr64,class Microsoft::SecurityClient::CWbemClassObjectHelper & __ptr64)const __ptr64" ?FillActionTimePropertyTestMode@CMalwareInstanceFactory@SecurityClient@Microsoft@@AEBAXAEAUIWbemClassObject@@AEAVCWbemClassObjectHelper@23@@Z
0x180020808: "__cdecl _imp_RegOpenKeyExW" __imp_RegOpenKeyExW
0x180022820: WPP_2bd3bb6ab88e34143b9560b3b327f212_Traceguids
0x1800124C0: "public: virtual void * __ptr64 __cdecl ATL::CWin32Heap::`scalar deleting destructor'(unsigned int) __ptr64" ??_GCWin32Heap@ATL@@UEAAPEAXI@Z
0x180022140: CLSID_StdGlobalInterfaceTable
0x180025BB8: "__vectorcall ??_R1A@?0A@EA@CWin32@MorroCommon" ??_R1A@?0A@EA@CWin32@MorroCommon@@8
0x180008FD4: "private: __cdecl Microsoft::SecurityClient::CMalwareProviderEventLogger::CMalwareProviderEventLogger(void) __ptr64" ??0CMalwareProviderEventLogger@SecurityClient@Microsoft@@AEAA@XZ
0x18002C928: "__vectorcall ??_R0?AVCPathUtils@MorroCommon@" ??_R0?AVCPathUtils@MorroCommon@@@8
0x180022C50: "Data" ??_C@_19IEEMEPMH@?$AAD?$AAa?$AAt?$AAa?$AA?$AA@
0x18001BC64: "__cdecl _security_init_cookie" __security_init_cookie
0x180007DD8: "public: struct HINSTANCE__ * __ptr64 __cdecl ATL::CAtlBaseModule::GetHInstanceAt(int) __ptr64" ?GetHInstanceAt@CAtlBaseModule@ATL@@QEAAPEAUHINSTANCE__@@H@Z
0x180005324: WPP_SF_q
0x18000BDA8: "private: bool __cdecl Microsoft::SecurityClient::CMalwareInstanceFactory::FillEventParameters(struct IWbemClassObject & __ptr64,class Microsoft::SecurityClient::CWbemClassObjectHelper & __ptr64,int)const __ptr64" ?FillEventParameters@CMalwareInstanceFactory@SecurityClient@Microsoft@@AEBA_NAEAUIWbemClassObject@@AEAVCWbemClassObjectHelper@23@H@Z
0x18000F5F4: MpManagerVersionQuery
0x1800228F0: "User" ??_C@_19PIJILKAI@?$AAU?$AAs?$AAe?$AAr?$AA?$AA@
0x180020BA0: "__cdecl _imp_GetUserDefaultUILanguage" __imp_GetUserDefaultUILanguage
0x180015870: "protected: virtual long __cdecl MorroCommon::CPathUtils::GetModulePathImpl(struct HINSTANCE__ * __ptr64,class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > & __ptr64) __ptr64" ?GetModulePathImpl@CPathUtils@MorroCommon@@MEAAJPEAUHINSTANCE__@@AEAV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@@Z
0x180022618: "\Implemented Categories" ??_C@_1DA@BIHALFED@?$AA?2?$AAI?$AAm?$AAp?$AAl?$AAe?$AAm?$AAe?$AAn?$AAt?$AAe?$AAd?$AA?5?$AAC?$AAa?$AAt?$AAe?$AAg?$AAo?$AAr?$AAi?$AAe?$AAs?$AA?$AA@
0x180025668: "const std::bad_alloc::`RTTI Complete Object Locator'" ??_R4bad_alloc@std@@6B@
0x180014420: "protected: virtual int __cdecl MorroCommon::CWin32::ShowWindowImpl(struct HWND__ * __ptr64,int) __ptr64" ?ShowWindowImpl@CWin32@MorroCommon@@MEAAHPEAUHWND__@@H@Z
0x18002D6B0: "private: static class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > MorroCommon::CPathUtils::m_logLocation" ?m_logLocation@CPathUtils@MorroCommon@@0V?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@A
0x180014F10: "protected: virtual int __cdecl MorroCommon::CWin32::PrivilegeCheckImpl(void * __ptr64,struct _PRIVILEGE_SET * __ptr64,int * __ptr64) __ptr64" ?PrivilegeCheckImpl@CWin32@MorroCommon@@MEAAHPEAXPEAU_PRIVILEGE_SET@@PEAH@Z
0x180020D78: "__cdecl _imp_CryptCATAdminAcquireContext" __imp_CryptCATAdminAcquireContext
0x180021778: "no space on device" ??_C@_0BD@IJDJKDEA@no?5space?5on?5device?$AA@
0x18001A800: "public: virtual void * __ptr64 __cdecl CommonUtil::CPredefinedMpHeapsHolder::`vector deleting destructor'(unsigned int) __ptr64" ??_ECPredefinedMpHeapsHolder@CommonUtil@@UEAAPEAXI@Z
0x1800144A0: "protected: virtual int __cdecl MorroCommon::CWin32::CreateProcessImpl(unsigned short const * __ptr64,unsigned short * __ptr64,struct _SECURITY_ATTRIBUTES * __ptr64,struct _SECURITY_ATTRIBUTES * __ptr64,int,unsigned long,void * __ptr64,unsigned short const * __ptr64,struct _STARTUPINFOW * __ptr64,struct _PROCESS_INFORMATION * __ptr64) __ptr64" ?CreateProcessImpl@CWin32@MorroCommon@@MEAAHPEBGPEAGPEAU_SECURITY_ATTRIBUTES@@2HKPEAX0PEAU_STARTUPINFOW@@PEAU_PROCESS_INFORMATION@@@Z
0x180002900: "[thunk]:public: virtual unsigned long __cdecl ATL::CComObject<class CMalwareProvider>::AddRef`adjustor{8}' (void) __ptr64" ?AddRef@?$CComObject@VCMalwareProvider@@@ATL@@W7EAAKXZ
0x180007F44: "void __cdecl Microsoft::SecurityClient::TraceUserName(enum Microsoft::SecurityClient::ClientImpersonationSteps)" ?TraceUserName@SecurityClient@Microsoft@@YAXW4ClientImpersonationSteps@12@@Z
0x18001A8AC: "long __cdecl CommonUtil::CreateNewPtrObject<class CommonUtil::CPredefinedMpHeapsHolder>(class CommonUtil::CPredefinedMpHeapsHolder * __ptr64 * __ptr64)" ??$CreateNewPtrObject@VCPredefinedMpHeapsHolder@CommonUtil@@@CommonUtil@@YAJPEAPEAVCPredefinedMpHeapsHolder@0@@Z
0x180029E64: "__cdecl _IMPORT_DESCRIPTOR_msvcrt" __IMPORT_DESCRIPTOR_msvcrt
0x180020E50: "__cdecl _imp_memmove" __imp_memmove
0x180022008: "wrong protocol type" ??_C@_0BE@MIEJDDNH@wrong?5protocol?5type?$AA@
0x18000E8D8: "public: class CommonUtil::AutoRef<struct IWbemClassObject> __cdecl Microsoft::SecurityClient::CAmEventConsumer::GetNextEvent(void) __ptr64" ?GetNextEvent@CAmEventConsumer@SecurityClient@Microsoft@@QEAA?AV?$AutoRef@UIWbemClassObject@@@CommonUtil@@XZ
0x180026098: "const CommonUtil::CPtrObjectProcessHeap::`RTTI Complete Object Locator'" ??_R4CPtrObjectProcessHeap@CommonUtil@@6B@
0x18001F000: "const std::length_error::`vftable'" ??_7length_error@std@@6B@
0x18001A988: MpUtilsDllMainInitialize
0x1800134CC: "private: static long __cdecl MorroCommon::CFileUtils::LoadResourceInner(unsigned int,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned char * __ptr64 * __ptr64,unsigned __int64 * __ptr64)" ?LoadResourceInner@CFileUtils@MorroCommon@@CAJIPEBG0PEAPEAEPEA_K@Z
0x18001AE40: "public: virtual void * __ptr64 __cdecl std::length_error::`scalar deleting destructor'(unsigned int) __ptr64" ??_Glength_error@std@@UEAAPEAXI@Z
0x1800152F0: "protected: virtual int __cdecl MorroCommon::CWin32::CreateProcessAsUserImpl(void * __ptr64,unsigned short const * __ptr64,unsigned short * __ptr64,struct _SECURITY_ATTRIBUTES * __ptr64,struct _SECURITY_ATTRIBUTES * __ptr64,int,unsigned long,void * __ptr64,unsigned short const * __ptr64,struct _STARTUPINFOW * __ptr64,struct _PROCESS_INFORMATION * __ptr64) __ptr64" ?CreateProcessAsUserImpl@CWin32@MorroCommon@@MEAAHPEAXPEBGPEAGPEAU_SECURITY_ATTRIBUTES@@3HK01PEAU_STARTUPINFOW@@PEAU_PROCESS_INFORMATION@@@Z
0x180020530: ?map@?1??VTFromRegType@CRegParser@ATL@@KAHPEBGAEAG@Z@4QBUtypemap@?1??123@KAH01@Z@B
0x180020F80: "__cdecl _imp_CoTaskMemRealloc" __imp_CoTaskMemRealloc
0x1800220E8: "iostream" ??_C@_08LLGCOLLL@iostream?$AA@
0x18000FCE0: "public: __cdecl CommonUtil::CUniqueHandle<struct CommonUtil::CAutoFreeLibrary>::~CUniqueHandle<struct CommonUtil::CAutoFreeLibrary>(void) __ptr64" ??1?$CUniqueHandle@UCAutoFreeLibrary@CommonUtil@@@CommonUtil@@QEAA@XZ
0x180022400: "Interface" ??_C@_1BE@EKPAFMCP@?$AAI?$AAn?$AAt?$AAe?$AAr?$AAf?$AAa?$AAc?$AAe?$AA?$AA@
0x180022718: "__cdecl GUID_bfbf883a_cad7_11d3_a11b_00105a1f515a" _GUID_bfbf883a_cad7_11d3_a11b_00105a1f515a
0x180014230: "protected: virtual __int64 __cdecl MorroCommon::CWin32::SendMessageImpl(struct HWND__ * __ptr64,unsigned int,unsigned __int64,__int64) __ptr64" ?SendMessageImpl@CWin32@MorroCommon@@MEAA_JPEAUHWND__@@I_K_J@Z
0x180001920: "public: virtual class std::error_condition __cdecl std::error_category::default_error_condition(int)const __ptr64" ?default_error_condition@error_category@std@@UEBA?AVerror_condition@2@H@Z
0x180020CB8: "__cdecl _imp_PostThreadMessageW" __imp_PostThreadMessageW
0x1800229A8: "CategoryID" ??_C@_1BG@KBAPIFFM@?$AAC?$AAa?$AAt?$AAe?$AAg?$AAo?$AAr?$AAy?$AAI?$AAD?$AA?$AA@
0x18000EF50: "public: virtual void * __ptr64 __cdecl Microsoft::SecurityClient::CMpClientApi::`vector deleting destructor'(unsigned int) __ptr64" ??_ECMpClientApi@SecurityClient@Microsoft@@UEAAPEAXI@Z
0x18000B8F4: "public: __cdecl Microsoft::SecurityClient::CMalwareInstanceFactory::CMalwareInstanceFactory(class CommonUtil::AutoRef<struct IWbemClassObject>,class Microsoft::SecurityClient::IMalwareProviderConfiguration const & __ptr64) __ptr64" ??0CMalwareInstanceFactory@SecurityClient@Microsoft@@QEAA@V?$AutoRef@UIWbemClassObject@@@CommonUtil@@AEBVIMalwareProviderConfiguration@12@@Z
0x180017A48: "public: __cdecl MorroCommon::CAutoLockedCertCheck::~CAutoLockedCertCheck(void) __ptr64" ??1CAutoLockedCertCheck@MorroCommon@@QEAA@XZ
0x1800026E0: "public: virtual unsigned long __cdecl ATL::CComObject<class CMalwareProvider>::Release(void) __ptr64" ?Release@?$CComObject@VCMalwareProvider@@@ATL@@UEAAKXZ
0x180020EC0: "__cdecl _imp_malloc" __imp_malloc
0x180020ED8: "__cdecl _imp__purecall" __imp__purecall
0x180020858: ADVAPI32_NULL_THUNK_DATA
0x18000AFCC: "private: unsigned long __cdecl Microsoft::SecurityClient::CMalwareProviderConfiguration::ReadDwordValue(struct HKEY__ * __ptr64,unsigned short const * __ptr64,unsigned long) __ptr64" ?ReadDwordValue@CMalwareProviderConfiguration@SecurityClient@Microsoft@@AEAAKPEAUHKEY__@@PEBGK@Z
0x18002280C: "on" ??_C@_15GMGGGDOD@?$AAo?$AAn?$AA?$AA@
0x180008CBC: "protected: static void __cdecl ATL::CSimpleStringT<char,0>::ThrowMemoryException(void)" ?ThrowMemoryException@?$CSimpleStringT@D$0A@@ATL@@KAXXZ
0x180014890: "protected: virtual struct HWND__ * __ptr64 __cdecl MorroCommon::CWin32::FindWindowImpl(unsigned short const * __ptr64,unsigned short const * __ptr64) __ptr64" ?FindWindowImpl@CWin32@MorroCommon@@MEAAPEAUHWND__@@PEBG0@Z
0x180023738: "__cdecl _real@402c000000000000" __real@402c000000000000
0x1800209A8: "__cdecl _imp_WriteFile" __imp_WriteFile
0x180020AE8: "__cdecl _imp_GetLocaleInfoW" __imp_GetLocaleInfoW
0x180006E28: "public: void __cdecl std::_Wrap_alloc<class std::allocator<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > > >::deallocate(class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > * __ptr64,unsigned __int64) __ptr64" ?deallocate@?$_Wrap_alloc@V?$allocator@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@@std@@@std@@QEAAXPEAV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@_K@Z
0x180014E40: "protected: virtual int __cdecl MorroCommon::CWin32::QueryServiceStatusImpl(struct SC_HANDLE__ * __ptr64,struct _SERVICE_STATUS * __ptr64) __ptr64" ?QueryServiceStatusImpl@CWin32@MorroCommon@@MEAAHPEAUSC_HANDLE__@@PEAU_SERVICE_STATUS@@@Z
0x18002CED0: "public: static class std::locale::id std::numpunct<wchar_t>::id" ?id@?$numpunct@_W@std@@2V0locale@2@A
0x180029D70: "__cdecl TI2PEAVEUnknownError@MorroCommon@@" _TI2PEAVEUnknownError@MorroCommon@@
0x180020D80: "__cdecl _imp_CryptCATAdminCalcHashFromFileHandle" __imp_CryptCATAdminCalcHashFromFileHandle
0x180020B58: "__cdecl _imp_GetFileSize" __imp_GetFileSize
0x1800149D0: "protected: virtual int __cdecl MorroCommon::CWin32::SetForegroundWindowImpl(struct HWND__ * __ptr64) __ptr64" ?SetForegroundWindowImpl@CWin32@MorroCommon@@MEAAHPEAUHWND__@@@Z
0x180010050: "void __cdecl CommonUtil::StringVPrintfW(class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > * __ptr64,bool,unsigned short const * __ptr64,char * __ptr64)" ?StringVPrintfW@CommonUtil@@YAXPEAV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@1@_NPEBGPEAD@Z
0x1800203A0: "const CommonUtil::CMpGlobalVarsTable::`vftable'" ??_7CMpGlobalVarsTable@CommonUtil@@6B@
0x180006D3C: "public: __cdecl CommonUtil::CUniqueHandle<struct CAutoMpSmartConfigUninitialize>::~CUniqueHandle<struct CAutoMpSmartConfigUninitialize>(void) __ptr64" ??1?$CUniqueHandle@UCAutoMpSmartConfigUninitialize@@@CommonUtil@@QEAA@XZ
0x18000333C: "public: long __cdecl ATL::CRegParser::PreProcessBuffer(unsigned short * __ptr64,unsigned short * __ptr64 * __ptr64) __ptr64" ?PreProcessBuffer@CRegParser@ATL@@QEAAJPEAGPEAPEAG@Z
0x180020798: "__cdecl _imp_LookupPrivilegeValueW" __imp_LookupPrivilegeValueW
0x18001B750: "__cdecl _report_gsfailure" __report_gsfailure
0x180022FB0: "MpAllocMemory" ??_C@_0O@FDBECPNN@MpAllocMemory?$AA@
0x1800252C0: "const ATL::CComObjectCached<class ATL::CComClassFactory>::`RTTI Complete Object Locator'" ??_R4?$CComObjectCached@VCComClassFactory@ATL@@@ATL@@6B@
0x180022690: "PathLevel" ??_C@_1BE@NIAPAEHB@?$AAP?$AAa?$AAt?$AAh?$AAL?$AAe?$AAv?$AAe?$AAl?$AA?$AA@
0x1800151F0: "protected: virtual int __cdecl MorroCommon::CWin32::CloseServiceHandleImpl(struct SC_HANDLE__ * __ptr64) __ptr64" ?CloseServiceHandleImpl@CWin32@MorroCommon@@MEAAHPEAUSC_HANDLE__@@@Z
0x180024A80: "__vectorcall ??_R2_System_error_category@std" ??_R2_System_error_category@std@@8
0x180024B40: "__vectorcall ??_R3_System_error_category@std" ??_R3_System_error_category@std@@8
0x180023458: "Kernel32.dll" ??_C@_1BK@EJBALEBG@?$AAK?$AAe?$AAr?$AAn?$AAe?$AAl?$AA3?$AA2?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x18002D474: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxuznxlivUzmgrnzodzivUhlfixvUzkkozbviUxlnklmvmghUnzmztvnvmgUdnrUznUnlmrglirmtUnzodzivkilerwviwooUlyquivUznwGEUhgwzucOlyq@AMMonitoringProvider" __@@_PchSym_@00@KxulyqvxgPillgKxuznxlivUzmgrnzodzivUhlfixvUzkkozbviUxlnklmvmghUnzmztvnvmgUdnrUznUnlmrglirmtUnzodzivkilerwviwooUlyquivUznwGEUhgwzucOlyq@AMMonitoringProvider
0x1800208F0: "__cdecl _imp_LeaveCriticalSection" __imp_LeaveCriticalSection
0x1800142D0: "protected: virtual unsigned long __cdecl MorroCommon::CWin32::GetLastErrorImpl(void) __ptr64" ?GetLastErrorImpl@CWin32@MorroCommon@@MEAAKXZ
0x180015160: "protected: virtual int __cdecl MorroCommon::CWin32::WritePrivateProfileStringImpl(unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64) __ptr64" ?WritePrivateProfileStringImpl@CWin32@MorroCommon@@MEAAHPEBG000@Z
0x18001B588: "__cdecl onexit" _onexit
0x180022200: "REGISTRY" ??_C@_1BC@KAILKFFG@?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?$AA@
0x180002930: "public: virtual long __cdecl ATL::IWbemInstProviderImpl::ExecNotificationQuery(unsigned short * __ptr64 const,unsigned short * __ptr64 const,long,struct IWbemContext * __ptr64,struct IEnumWbemClassObject * __ptr64 * __ptr64) __ptr64" ?ExecNotificationQuery@IWbemInstProviderImpl@ATL@@UEAAJQEAG0JPEAUIWbemContext@@PEAPEAUIEnumWbemClassObject@@@Z
0x18002C350: "__vectorcall ??_R0?AV_System_error_category@std@" ??_R0?AV_System_error_category@std@@@8
0x180022BD8: WPP_15992e6c6a5e3e907ea73feba115436f_Traceguids
0x180006CFC: "public: __cdecl CommonUtil::AutoRef<struct IWbemObjectTextSrc>::~AutoRef<struct IWbemObjectTextSrc>(void) __ptr64" ??1?$AutoRef@UIWbemObjectTextSrc@@@CommonUtil@@QEAA@XZ
0x1800259B0: "__vectorcall ??_R1A@?0A@EA@IMalwareProviderConfiguration@SecurityClient@Microsoft" ??_R1A@?0A@EA@IMalwareProviderConfiguration@SecurityClient@Microsoft@@8
0x180021DF8: "no such device or address" ??_C@_0BK@IMCPHCBI@no?5such?5device?5or?5address?$AA@
0x18002DA68: "__cdecl _native_startup_state" __native_startup_state
0x1800021E0: HrDllMain
0x180017AA0: "public: long __cdecl MorroCommon::CAutoLockedCertCheck::LockAndCheck(unsigned short const * __ptr64) __ptr64" ?LockAndCheck@CAutoLockedCertCheck@MorroCommon@@QEAAJPEBG@Z
0x1800133E0: "protected: virtual long __cdecl MorroCommon::CFileUtils::LoadResourceImpl(unsigned int,unsigned short const * __ptr64,unsigned short const * __ptr64,class ATL::CComBSTR & __ptr64) __ptr64" ?LoadResourceImpl@CFileUtils@MorroCommon@@MEAAJIPEBG0AEAVCComBSTR@ATL@@@Z
0x18000E290: "protected: struct std::pair<class std::_Tree_iterator<class std::_Tree_val<struct std::_Tree_simple_types<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> > > > >,bool> __cdecl std::_Tree<class std::_Tmap_traits<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> >,class CommonUtil::AutoRef<struct IWbemClassObject>,struct std::less<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > >,class std::allocator<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> > >,0> >::_Insert_nohint<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> > & __ptr64,struct std::_Tree_node<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> >,void * __ptr64> * __ptr64>(bool,struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> > & __ptr64,struct std::_Tree_node<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> >,void * __ptr64> * __ptr64) __ptr64" ??$_Insert_nohint@AEAU?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@PEAU?$_Tree_node@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@PEAX@2@@?$_Tree@V?$_Tmap_traits@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@U?$less@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@@std@@V?$allocator@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@@5@$0A@@std@@@std@@IEAA?AU?$pair@V?$_Tree_iterator@V?$_Tree_val@U?$_Tree_simple_types@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@@std@@@std@@@std@@_N@1@_NAEAU?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@1@PEAU?$_Tree_node@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@PEAX@1@@Z
0x18000FEE0: "public: virtual long __cdecl CommonUtil::CHResultExceptionImpl::GetErrorCode(void)const __ptr64" ?GetErrorCode@CHResultExceptionImpl@CommonUtil@@UEBAJXZ
0x180016990: "protected: virtual class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > __cdecl MorroCommon::CPathUtils::RemoveTrailingSlashInPathImpl(class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > const & __ptr64) __ptr64" ?RemoveTrailingSlashInPathImpl@CPathUtils@MorroCommon@@MEAA?AV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@AEBV34@@Z
0x180023618: WPP_db61690a89973da19d491352a7a7c212_Traceguids
0x18000A4DC: "public: void __cdecl std::basic_string<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> >::_Copy(unsigned __int64,unsigned __int64) __ptr64" ?_Copy@?$basic_string@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@std@@QEAAX_K0@Z
0x18002D478: "class ATL::CAtlModule * __ptr64 __ptr64 ATL::_pAtlModule" ?_pAtlModule@ATL@@3PEAVCAtlModule@1@EA
0x1800059C0: "public: virtual long __cdecl CMalwareProvider::GetObjectAsync(unsigned short * __ptr64 const,long,struct IWbemContext * __ptr64,struct IWbemObjectSink * __ptr64) __ptr64" ?GetObjectAsync@CMalwareProvider@@UEAAJQEAGJPEAUIWbemContext@@PEAUIWbemObjectSink@@@Z
0x18002C470: "__vectorcall ??_R0?AVIWbemInstProviderImpl@ATL@" ??_R0?AVIWbemInstProviderImpl@ATL@@@8
0x18001FC58: "const ATL::CRegObject::`vftable'" ??_7CRegObject@ATL@@6B@
0x1800219B0: "invalid_argument" ??_C@_0BB@FFIHMIPJ@invalid_argument?$AA@
0x180001AB0: "public: virtual char const * __ptr64 __cdecl std::_System_error_category::name(void)const __ptr64" ?name@_System_error_category@std@@UEBAPEBDXZ
0x180022838: "Domain" ??_C@_1O@OAMNPMOM@?$AAD?$AAo?$AAm?$AAa?$AAi?$AAn?$AA?$AA@
0x180020D88: "__cdecl _imp_WTHelperGetProvSignerFromChain" __imp_WTHelperGetProvSignerFromChain
0x180022248: "HKU" ??_C@_17PJOJPMPB@?$AAH?$AAK?$AAU?$AA?$AA@
0x18001A714: "long __cdecl CommonUtil::CreateNewRefObject<class CommonUtil::CMpUtilsLibrary>(class CommonUtil::CMpUtilsLibrary * __ptr64 * __ptr64)" ??$CreateNewRefObject@VCMpUtilsLibrary@CommonUtil@@@CommonUtil@@YAJPEAPEAVCMpUtilsLibrary@0@@Z
0x180020948: "__cdecl _imp_LoadResource" __imp_LoadResource
0x180014C80: "protected: virtual void * __ptr64 __cdecl MorroCommon::CWin32::CreateFileImpl(unsigned short const * __ptr64,unsigned long,unsigned long,struct _SECURITY_ATTRIBUTES * __ptr64,unsigned long,unsigned long,void * __ptr64) __ptr64" ?CreateFileImpl@CWin32@MorroCommon@@MEAAPEAXPEBGKKPEAU_SECURITY_ATTRIBUTES@@KKPEAX@Z
0x180029F7C: "__cdecl _IMPORT_DESCRIPTOR_WINTRUST" __IMPORT_DESCRIPTOR_WINTRUST
0x180014D30: "protected: virtual unsigned long __cdecl MorroCommon::CWin32::GetFileSizeImpl(void * __ptr64,unsigned long * __ptr64) __ptr64" ?GetFileSizeImpl@CWin32@MorroCommon@@MEAAKPEAXPEAK@Z
0x180025818: "__vectorcall ??_R1A@?0A@EA@CMalwareProviderEventLogger@SecurityClient@Microsoft" ??_R1A@?0A@EA@CMalwareProviderEventLogger@SecurityClient@Microsoft@@8
0x180021888: "address_not_available" ??_C@_0BG@IPMGOJF@address_not_available?$AA@
0x18002CA90: "__vectorcall ??_R0?AVIMalwareProviderConfiguration@SecurityClient@Microsoft@" ??_R0?AVIMalwareProviderConfiguration@SecurityClient@Microsoft@@@8
0x180020830: "__cdecl _imp_OpenSCManagerW" __imp_OpenSCManagerW
0x18002CE28: "__vectorcall ??_R0?AVCPtrObject@CommonUtil@" ??_R0?AVCPtrObject@CommonUtil@@@8
0x1800234D8: WPP_186f0747e154398220c668ad71302e02_Traceguids
0x18002CA40: "__vectorcall ??_R0?AVCMalwareProviderConfiguration@SecurityClient@Microsoft@" ??_R0?AVCMalwareProviderConfiguration@SecurityClient@Microsoft@@@8
0x180006E28: "public: void __cdecl std::_Tree_buy<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> >,class std::allocator<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> > > >::_Freenode0(struct std::_Tree_node<struct std::pair<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > const,class CommonUtil::AutoRef<struct IWbemClassObject> >,void * __ptr64> * __ptr64) __ptr64" ?_Freenode0@?$_Tree_buy@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@V?$allocator@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@@2@@std@@QEAAXPEAU?$_Tree_node@U?$pair@$$CBV?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@V?$AutoRef@UIWbemClassObject@@@2@@std@@PEAX@2@@Z
0x180016760: "protected: virtual long __cdecl MorroCommon::CPathUtils::GetWindowsSystem32PathImpl(class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > & __ptr64) __ptr64" ?GetWindowsSystem32PathImpl@CPathUtils@MorroCommon@@MEAAJAEAV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@@Z
0x180024CC0: "__vectorcall ??_R2?$CComCoClass@VCMalwareProvider@@$1?CLSID_MalwareProvider@@3U_GUID@@B@ATL" ??_R2?$CComCoClass@VCMalwareProvider@@$1?CLSID_MalwareProvider@@3U_GUID@@B@ATL@@8
0x1800251A0: "__vectorcall ??_R3?$CComCoClass@VCMalwareProvider@@$1?CLSID_MalwareProvider@@3U_GUID@@B@ATL" ??_R3?$CComCoClass@VCMalwareProvider@@$1?CLSID_MalwareProvider@@3U_GUID@@B@ATL@@8
0x180002370: "public: virtual unsigned long __cdecl ATL::CRegObject::Release(void) __ptr64" ?Release@CRegObject@ATL@@UEAAKXZ
0x180022310: "HKEY_PERFORMANCE_DATA" ??_C@_1CM@KHNNAOIC@?$AAH?$AAK?$AAE?$AAY?$AA_?$AAP?$AAE?$AAR?$AAF?$AAO?$AAR?$AAM?$AAA?$AAN?$AAC?$AAE?$AA_?$AAD?$AAA?$AAT?$AAA?$AA?$AA@
0x180007430: "public: __cdecl CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> >::~CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> >(void) __ptr64" ??1?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@QEAA@XZ
0x1800220D0: "generic" ??_C@_07DCLBNMLN@generic?$AA@
0x180020400: ?_entries@?1??_GetEntries@CMalwareProvider@@SAPEBU_ATL_INTMAP_ENTRY@ATL@@XZ@4QBU34@B
0x180024EB8: "__vectorcall ??_R1A@?0A@EC@IUnknown" ??_R1A@?0A@EC@IUnknown@@8
0x180025578: "__vectorcall ??_R1A@?0A@EA@IUnknown" ??_R1A@?0A@EA@IUnknown@@8
0x180022088: "Val" ??_C@_17LLMMEOJD@?$AAV?$AAa?$AAl?$AA?$AA@
0x180029F2C: "__cdecl _IMPORT_DESCRIPTOR_SHELL32" __IMPORT_DESCRIPTOR_SHELL32
0x18002C4C8: "__vectorcall ??_R0?AUIWbemServices@" ??_R0?AUIWbemServices@@@8
0x18000FD20: "private: static void __cdecl CommonUtil::CGenericGlobalAtStartup<struct CommonUtil::CGenericAtStartupPolicy2nd<class CommonUtil::CMpCriticalSection> >::OnDestroy(struct tagMP_AT_STARTUP_TYPE * __ptr64)" ?OnDestroy@?$CGenericGlobalAtStartup@U?$CGenericAtStartupPolicy2nd@VCMpCriticalSection@CommonUtil@@@CommonUtil@@@CommonUtil@@CAXPEAUtagMP_AT_STARTUP_TYPE@@@Z
0x1800257C0: "__vectorcall ??_R2CMalwareProviderEventLogger@SecurityClient@Microsoft" ??_R2CMalwareProviderEventLogger@SecurityClient@Microsoft@@8
0x180025880: "__vectorcall ??_R3CMalwareProviderEventLogger@SecurityClient@Microsoft" ??_R3CMalwareProviderEventLogger@SecurityClient@Microsoft@@8
0x180014390: "protected: virtual long __cdecl MorroCommon::CWin32::RegSetValueExImpl(struct HKEY__ * __ptr64,unsigned short const * __ptr64,unsigned long,unsigned long,unsigned char const * __ptr64,unsigned long) __ptr64" ?RegSetValueExImpl@CWin32@MorroCommon@@MEAAJPEAUHKEY__@@PEBGKKPEBEK@Z
0x180020750: "__cdecl _imp_OpenThreadToken" __imp_OpenThreadToken
0x1800223A8: "CLSID" ??_C@_1M@KANJNLFF@?$AAC?$AAL?$AAS?$AAI?$AAD?$AA?$AA@
0x18001FE30: "const Microsoft::SecurityClient::CMpClientApi::`vftable'" ??_7CMpClientApi@SecurityClient@Microsoft@@6B@
0x180020CC0: "__cdecl _imp_AdjustWindowRectEx" __imp_AdjustWindowRectEx
0x180006CFC: "public: __cdecl CommonUtil::AutoRef<struct IEnumWbemClassObject>::~AutoRef<struct IEnumWbemClassObject>(void) __ptr64" ??1?$AutoRef@UIEnumWbemClassObject@@@CommonUtil@@QEAA@XZ
0x1800075E0: DllRegisterServer
0x180023000: "%ws\%ws" ??_C@_1BA@NPEHGALP@?$AA?$CF?$AAw?$AAs?$AA?2?$AA?$CF?$AAw?$AAs?$AA?$AA@
0x180005A10: "public: virtual long __cdecl CMalwareProvider::PutInstanceAsync(struct IWbemClassObject * __ptr64,long,struct IWbemContext * __ptr64,struct IWbemObjectSink * __ptr64) __ptr64" ?PutInstanceAsync@CMalwareProvider@@UEAAJPEAUIWbemClassObject@@JPEAUIWbemContext@@PEAUIWbemObjectSink@@@Z
0x18000C1A0: "private: unsigned __int64 __cdecl Microsoft::SecurityClient::CMalwareInstanceFactory::GetNumberFromString(unsigned short * __ptr64 const,unsigned __int64)const __ptr64" ?GetNumberFromString@CMalwareInstanceFactory@SecurityClient@Microsoft@@AEBA_KQEAG_K@Z
0x18002CDB8: "__vectorcall ??_R0?AVCMpUtilsLibrary@CommonUtil@" ??_R0?AVCMpUtilsLibrary@CommonUtil@@@8
0x180002E50: "public: __cdecl ATL::CAutoVectorPtr<unsigned short>::~CAutoVectorPtr<unsigned short>(void) __ptr64" ??1?$CAutoVectorPtr@G@ATL@@QEAA@XZ
0x180004960: "protected: long __cdecl ATL::CRegObject::RegisterFromResource(unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,int) __ptr64" ?RegisterFromResource@CRegObject@ATL@@IEAAJPEBG00H@Z
0x180020DD8: WTSAPI32_NULL_THUNK_DATA
0x1800256F0: "__vectorcall ??_R1A@?0A@EA@CPathUtils@MorroCommon" ??_R1A@?0A@EA@CPathUtils@MorroCommon@@8
0x180023750: "__cdecl _real@40ac200000000000" __real@40ac200000000000
0x180020BF8: "__cdecl _imp_SysFreeString" __imp_SysFreeString
0x18001406C: "public: long __cdecl ATL::CComBSTR::Append(char const * __ptr64) __ptr64" ?Append@CComBSTR@ATL@@QEAAJPEBD@Z
0x1800018F0: "public: virtual void * __ptr64 __cdecl std::_Iostream_error_category::`scalar deleting destructor'(unsigned int) __ptr64" ??_G_Iostream_error_category@std@@UEAAPEAXI@Z
0x180017F50: "public: virtual void * __ptr64 __cdecl MorroCommon::CLockedCertCheckImpl::`vector deleting destructor'(unsigned int) __ptr64" ??_ECLockedCertCheckImpl@MorroCommon@@UEAAPEAXI@Z
0x180029B90: "__cdecl CTA2?AVbad_alloc@std@@" _CTA2?AVbad_alloc@std@@
0x180023670: "%d.%d.%d.%d" ??_C@_1BI@FCMLLAGN@?$AA?$CF?$AAd?$AA?4?$AA?$CF?$AAd?$AA?4?$AA?$CF?$AAd?$AA?4?$AA?$CF?$AAd?$AA?$AA@
0x18001FA48: "const std::_Iostream_error_category::`vftable'" ??_7_Iostream_error_category@std@@6B@
0x180020570: "protected: static unsigned short const * __ptr64 const * const ATL::CRegParser::rgszNeverDelete" ?rgszNeverDelete@CRegParser@ATL@@1QBQEBGB
0x180011E7C: WPP_SF__guid_d
0x1800123D0: "public: virtual void * __ptr64 __cdecl ATL::CAtlStringMgr::`scalar deleting destructor'(unsigned int) __ptr64" ??_GCAtlStringMgr@ATL@@UEAAPEAXI@Z
0x180021AF8: "operation_would_block" ??_C@_0BG@GDGHKFDH@operation_would_block?$AA@
0x180020450: ?map@?1??HKeyFromString@CRegParser@ATL@@KAPEAUHKEY__@@PEAG@Z@4QBUkeymap@?1??123@KAPEAU4@0@Z@B
0x180020DE0: "__cdecl _imp_MpClientUtilExportFunctions" __imp_MpClientUtilExportFunctions
0x180025270: "const ATL::CComObject<class CMalwareProvider>::`RTTI Complete Object Locator'{for `IWbemServices'}" ??_R4?$CComObject@VCMalwareProvider@@@ATL@@6BIWbemServices@@@
0x180006A84: "private: bool __cdecl CMalwareProvider::CreateMalwareInstance(class Microsoft::SecurityClient::CMalwareInstanceFactory & __ptr64,struct IWbemClassObject & __ptr64) __ptr64" ?CreateMalwareInstance@CMalwareProvider@@AEAA_NAEAVCMalwareInstanceFactory@SecurityClient@Microsoft@@AEAUIWbemClassObject@@@Z
0x180022538: LIBID_MalwareProviderDllLib
0x180025AB0: "const CommonUtil::CHResultExceptionImpl::`RTTI Complete Object Locator'" ??_R4CHResultExceptionImpl@CommonUtil@@6B@
0x180015480: "protected: virtual int __cdecl MorroCommon::CWin32::GetVersionExImpl(struct _OSVERSIONINFOW * __ptr64) __ptr64" ?GetVersionExImpl@CWin32@MorroCommon@@MEAAHPEAU_OSVERSIONINFOW@@@Z
0x180021AD0: "wrong_protocol_type" ??_C@_0BE@GAOJJFPC@wrong_protocol_type?$AA@
0x180014480: "protected: virtual int __cdecl MorroCommon::CWin32::GetLocaleInfoImpl(unsigned long,unsigned long,unsigned short * __ptr64,int) __ptr64" ?GetLocaleInfoImpl@CWin32@MorroCommon@@MEAAHKKPEAGH@Z
0x18000B7E8: WPP_SF_Si
0x18000B2C0: "public: virtual bool __cdecl Microsoft::SecurityClient::CMalwareProviderConfiguration::IsNISFiltered(void)const __ptr64" ?IsNISFiltered@CMalwareProviderConfiguration@SecurityClient@Microsoft@@UEBA_NXZ
0x180019E40: "public: virtual void * __ptr64 __cdecl CommonUtil::CMpGlobalVarsTable::`vector deleting destructor'(unsigned int) __ptr64" ??_ECMpGlobalVarsTable@CommonUtil@@UEAAPEAXI@Z
0x180018C48: WPP_SF_Sl
0x180029D90: "__cdecl _pobjMapEntryFirst" __pobjMapEntryFirst
0x18000B0C4: "private: class CommonUtil::CStdMoveable<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> >,struct CommonUtil::CStdMoveableDefaultPolicy<class CommonUtil::CStdBasicString<unsigned short,struct CommonUtil::mp_char_traits<unsigned short>,class std::allocator<unsigned short> > > > __cdecl Microsoft::SecurityClient::CMalwareProviderConfiguration::ReadStringValue(struct HKEY__ * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64) __ptr64" ?ReadStringValue@CMalwareProviderConfiguration@SecurityClient@Microsoft@@AEAA?AV?$CStdMoveable@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@U?$CStdMoveableDefaultPolicy@V?$CStdBasicString@GU?$mp_char_traits@G@CommonUtil@@V?$allocator@G@std@@@CommonUtil@@@2@@CommonUtil@@PEAUHKEY__@@PEBG1@Z
0x180011238: WPP_SF_sd
0x180005418: WPP_SF_SD
0x180005418: WPP_SF_Sd
0x180025550: "__vectorcall ??_R2IUnknown" ??_R2IUnknown@@8
0x180025560: "__vectorcall ??_R3IUnknown" ??_R3IUnknown@@8
0x180020EB8: "__cdecl _imp_free" __imp_free
0x18002C000: "struct ATL::_ATL_OBJMAP_ENTRY30 __objMap_CMalwareProvider" ?__objMap_CMalwareProvider@@3U_ATL_OBJMAP_ENTRY30@ATL@@A
0x180025988: "__vectorcall ??_R1A@?0A@EA@CMalwareProviderConfiguration@SecurityClient@Microsoft" ??_R1A@?0A@EA@CMalwareProviderConfiguration@SecurityClient@Microsoft@@8
0x1800255C0: "__vectorcall ??_R3CRegObject@ATL" ??_R3CRegObject@ATL@@8
0x1800255A0: "__vectorcall ??_R2CRegObject@ATL" ??_R2CRegObject@ATL@@8
0x18001BBD0: "__cdecl IsNonwritableInCurrentImage" _IsNonwritableInCurrentImage
0x18001942C: WPP_SF_Sq
0x180005494: WPP_SF_sq
0x180005360: WPP_SF_SS
0x180012008: MpInvokeStartupInitialization
0x180014810: "protected: virtual void * __ptr64 __cdecl MorroCommon::CWin32::OpenProcessImpl(unsigned long,int,unsigned long) __ptr64" ?OpenProcessImpl@CWin32@MorroCommon@@MEAAPEAXKHK@Z
0x180020EB0: "__cdecl _imp_memcpy_s" __imp_memcpy_s
0x180014C30: "protected: virtual long __cdecl MorroCommon::CWin32::CoCreateGuidImpl(struct _GUID * __ptr64) __ptr64" ?CoCreateGuidImpl@CWin32@MorroCommon@@MEAAJPEAU_GUID@@@Z
0x18001ADCC: "public: __cdecl std::logic_error::logic_error(class std::logic_error const & __ptr64) __ptr64" ??0logic_error@std@@QEAA@AEBV01@@Z
0x180020728: "__cdecl _imp_OpenProcessToken" __imp_OpenProcessToken
0x180024F30: "__vectorcall ??_R1A@?0A@EA@IWbemServices" ??_R1A@?0A@EA@IWbemServices@@8
0x1800253C0: "__vectorcall ??_R17?0A@EA@?$CComObjectRootEx@VCComMultiThreadModel@ATL@@@ATL" ??_R17?0A@EA@?$CComObjectRootEx@VCComMultiThreadModel@ATL@@@ATL@@8
0x180012140: "long __cdecl CommonUtil::OnInitializeAtStartupNoThrow(long (__cdecl*)(void * __ptr64),void * __ptr64)" ?OnInitializeAtStartupNoThrow@CommonUtil@@YAJP6AJPEAX@Z0@Z
0x180020B48: "__cdecl _imp_K32GetModuleFileNameExW" __imp_K32GetModuleFileNameExW
0x180021FD8: "too many symbolic link levels" ??_C@_0BO@EFGOJEF@too?5many?5symbolic?5link?5levels?$AA@
0x1800124C0: "public: virtual void * __ptr64 __cdecl ATL::CWin32Heap::`vector deleting destructor'(unsigned int) __ptr64" ??_ECWin32Heap@ATL@@UEAAPEAXI@Z
0x18000A8A4: WPP_SF_S
0x180022D48: "AmMonitoringEventLogName" ??_C@_1DC@HPMPBDJK@?$AAA?$AAm?$AAM?$AAo?$AAn?$AAi?$AAt?$AAo?$AAr?$AAi?$AAn?$AAg?$AAE?$AAv?$AAe?$AAn?$AAt?$AAL?$AAo?$AAg?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x180021A90: "not_a_socket" ??_C@_0N@IMHKKLEM@not_a_socket?$AA@
0x18001BF76: memset
0x180029F90: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x180009518: "public: void __cdecl Microsoft::SecurityClient::CMalwareProviderEventLogger::LogNumOfInstancesExceeded(unsigned long) __ptr64" ?LogNumOfInstancesExceeded@CMalwareProviderEventLogger@SecurityClient@Microsoft@@QEAAXK@Z
0x180012DD0: "protected: virtual long __cdecl MorroCommon::CFileUtils::DeleteFileIfSizeExceededImpl(class ATL::CStringT<unsigned short,class ATL::StrTraitATL<unsigned short,class ATL::ChTraitsCRT<unsigned short> > > const & __ptr64,__int64) __ptr64" ?DeleteFileIfSizeExceededImpl@CFileUtils@MorroCommon@@MEAAJAEBV?$CStringT@GV?$StrTraitATL@GV?$ChTraitsCRT@G@ATL@@@ATL@@@ATL@@_J@Z
0x180020988: "__cdecl _imp_ReadFile" __imp_ReadFile
0x180023530: "%04u%02u%02u%02u%02u%02u.%06u-00" ??_C@_1EE@BLCEBEPO@?$AA?$CF?$AA0?$AA4?$AAu?$AA?$CF?$AA0?$AA2?$AAu?$AA?$CF?$AA0?$AA2?$AAu?$AA?$CF?$AA0?$AA2?$AAu?$AA?$CF?$AA0?$AA2?$AAu?$AA?$CF?$AA0?$AA2?$AAu?$AA?4?$AA?$CF?$AA0?$AA6?$AAu?$AA?9?$AA0?$AA0@
0x180020C78: "__cdecl _imp_PathFindFileNameW" __imp_PathFindFileNameW

[JEB Decompiler by PNF Software]