Generated by JEB on 2019/08/01

PE: C:\Windows\System32\wshelper.dll Base=0x180000000 SHA-256=358FCBD301E377BD9FE97D80D1A5A1E9041BDE74812341466C9BA7A0206EB87D
PDB: wshelper.pdb GUID={D39C6A30-AF7B-34FF-BF0CDC49880B3862} Age=1

233 located named symbols:
0x1800033CC: "__cdecl _raise_securityfailure" __raise_securityfailure
0x1800031E0: "__cdecl FindPESection" _FindPESection
0x180004160: "__cdecl _imp_PrintError" __imp_PrintError
0x1800041C0: "__cdecl _imp_StringFromCLSID" __imp_StringFromCLSID
0x1800043B8: "__cdecl _imp_EvtNext" __imp_EvtNext
0x180004E78: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-com-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-com-l1-1-0
0x1800061B0: "__cdecl _security_cookie_complement" __security_cookie_complement
0x180004178: "__cdecl _imp_WSCGetProviderPath32" __imp_WSCGetProviderPath32
0x180004858: "Catalog_Entries" ??_C@_0BA@BKEABJML@Catalog_Entries?$AA@
0x180002CBC: "__cdecl CRT_INIT" _CRT_INIT
0x180004228: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x180003670: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x1800044F0: "remove" ??_C@_1O@GJOFDOPC@?$AAr?$AAe?$AAm?$AAo?$AAv?$AAe?$AA?$AA@
0x1800043A0: "__cdecl _imp_EvtCreateRenderContext" __imp_EvtCreateRenderContext
0x180004368: "__cdecl _imp_wcstoul" __imp_wcstoul
0x1800042B0: "__cdecl _imp_RegDeleteKeyA" __imp_RegDeleteKeyA
0x1800044B8: "provider" ??_C@_1BC@PICIFKEO@?$AAp?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AA?$AA@
0x180004790: "Current_Protocol_Catalog" ??_C@_0BJ@FAAMJNHO@Current_Protocol_Catalog?$AA@
0x1800043D8: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x180004810: "Num_Catalog_Entries64" ??_C@_0BG@DIAJLNIG@Num_Catalog_Entries64?$AA@
0x1800031C4: "__cdecl XcptFilter" _XcptFilter
0x180004290: "__cdecl _imp_RegSetValueExA" __imp_RegSetValueExA
0x1800043E0: "__cdecl _xc_a" __xc_a
0x180004350: "__cdecl _imp_wcsstr" __imp_wcsstr
0x180004E64: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-timezone-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-timezone-l1-1-0
0x180004828: "Next_Catalog_Entry_ID" ??_C@_0BG@GBONGHHJ@Next_Catalog_Entry_ID?$AA@
0x18000269C: StringCchCopyW
0x180004180: "__cdecl _imp_WSCGetProviderPath" __imp_WSCGetProviderPath
0x180004630: "%ws " ??_C@_19PBJPFIJP@?$AA?$CF?$AAw?$AAs?$AA?6?$AA?$AA@
0x180004210: api-ms-win-core-heap-l1-1-0_NULL_THUNK_DATA
0x180004668: "type" ??_C@_19FHBCDCCA@?$AAt?$AAy?$AAp?$AAe?$AA?$AA@
0x18000444C: "__cdecl _guard_iat_table" __guard_iat_table
0x180004840: "Serial_Access_Num" ??_C@_0BC@FNNGBCF@Serial_Access_Num?$AA@
0x180004380: "__cdecl _imp_memset" __imp_memset
0x18000339F: "__cdecl initterm" _initterm
0x180004EDC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0
0x180006770: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x1800042E8: "__cdecl _imp_Sleep" __imp_Sleep
0x180004400: "__cdecl _xi_z" __xi_z
0x180004370: "__cdecl _imp___iob_func" __imp___iob_func
0x180004578: "Winsock-WS2HELP" ??_C@_1CA@LBPIEKMC@?$AAW?$AAi?$AAn?$AAs?$AAo?$AAc?$AAk?$AA?9?$AAW?$AAS?$AA2?$AAH?$AAE?$AAL?$AAP?$AA?$AA@
0x1800041E8: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x180001EA0: WsHandleShowAutotuning
0x1800033AB: "__cdecl _C_specific_handler" __C_specific_handler
0x180004598: "*" ??_C@_13BBDEGPLJ@?$AA?$CK?$AA?$AA@
0x1800041F8: "__cdecl _imp_HeapFree" __imp_HeapFree
0x180006050: g_WsRemoveTable
0x180002320: IfutlParse
0x180004260: "__cdecl _imp_RegCloseKey" __imp_RegCloseKey
0x1800035EC: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x180004270: "__cdecl _imp_RegEnumKeyExA" __imp_RegEnumKeyExA
0x1800017A8: WsGetNameSpaceEntries
0x180004140: "__cdecl _imp_MakeString" __imp_MakeString
0x1800045F0: "%.2d/%.2d/%.2d %.2d:%.2d:%.2d " ??_C@_1DO@KPFBOFCI@?$AA?$CF?$AA?4?$AA2?$AAd?$AA?1?$AA?$CF?$AA?4?$AA2?$AAd?$AA?1?$AA?$CF?$AA?4?$AA2?$AAd?$AA?5?$AA?$CF?$AA?4?$AA2?$AAd?$AA?3?$AA?$CF?$AA?4?$AA2?$AAd?$AA?3?$AA?$CF?$AA?4?$AA2?$AAd?$AA?5?$AA?$AA@
0x180004128: "__cdecl _imp_PrintMessageFromModule" __imp_PrintMessageFromModule
0x18000194C: WsShowTransportEntry
0x180004278: "__cdecl _imp_RegSetValueExW" __imp_RegSetValueExW
0x1800031D0: "__cdecl amsg_exit" _amsg_exit
0x1800047D8: "WinSock" ??_C@_07DJIACIAO@WinSock?$AA@
0x180004480: "catalog" ??_C@_1BA@NDGBPBIE@?$AAc?$AAa?$AAt?$AAa?$AAl?$AAo?$AAg?$AA?$AA@
0x180004650: "lsp" ??_C@_17PLBAEKJB@?$AAl?$AAs?$AAp?$AA?$AA@
0x180001BC0: WsHandleShowCatalog
0x180004518: "winsock" ??_C@_1BA@KEMBLBMD@?$AAw?$AAi?$AAn?$AAs?$AAo?$AAc?$AAk?$AA?$AA@
0x1800042A8: api-ms-win-core-registry-l1-1-0_NULL_THUNK_DATA
0x1800041F0: api-ms-win-core-errorhandling-l1-1-0_NULL_THUNK_DATA
0x180002B10: CleanProtoCatalog
0x180004230: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x180006740: g_ulInitCount
0x180006100: g_WsCmdGroups
0x180006760: "__cdecl _native_startup_lock" __native_startup_lock
0x180002724: WinsockResetCatalog
0x180001008: DllMain
0x180004320: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x1800042D0: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x180004220: api-ms-win-core-libraryloader-l1-2-0_NULL_THUNK_DATA
0x180004868: "Catalog_Entries64" ??_C@_0BC@NHKJNGNA@Catalog_Entries64?$AA@
0x1800041D8: "__cdecl _imp_GetLastError" __imp_GetLastError
0x1800061A0: "__cdecl _native_dllmain_reason" __native_dllmain_reason
0x1800035C8: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x180006788: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxumvgUhlxpvghUdrmhlxpCUmvghsUlyquivUznwGEUkivxlnkOlyq@wshelper" __@@_PchSym_@00@KxulyqvxgPillgKxumvgUhlxpvghUdrmhlxpCUmvghsUlyquivUznwGEUkivxlnkOlyq@wshelper
0x1800042C0: api-ms-win-core-registry-l2-1-0_NULL_THUNK_DATA
0x180004148: "__cdecl _imp_FreeString" __imp_FreeString
0x180004238: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x1800045A0: "Event/System/TimeCreated/@System" ??_C@_1EK@GPLMPFG@?$AAE?$AAv?$AAe?$AAn?$AAt?$AA?1?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?1?$AAT?$AAi?$AAm?$AAe?$AAC?$AAr?$AAe?$AAa?$AAt?$AAe?$AAd?$AA?1?$AA?$EA?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm@
0x180003290: "__cdecl ValidateImageBase" _ValidateImageBase
0x180004658: "bsp" ??_C@_17OOJKFIKD@?$AAb?$AAs?$AAp?$AA?$AA@
0x180004E14: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0
0x180004208: "__cdecl _imp_HeapAlloc" __imp_HeapAlloc
0x180001200: WsHandleShowAuditLog
0x180002F00: "__cdecl DllMainCRTStartup" _DllMainCRTStartup
0x180003598: "__cdecl _acrt_iob_func" __acrt_iob_func
0x180004328: "__cdecl _imp__initterm" __imp__initterm
0x1800020F8: IfutlGetTagToken
0x180004680: "System\CurrentControlSet\Service" ??_C@_1GC@HLHDGCM@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA?2?$AAS?$AAe?$AAr?$AAv?$AAi?$AAc?$AAe@
0x180001880: WsGetProviderPath
0x180004E8C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0
0x1800044E0: "audit" ??_C@_1M@LILKJADD@?$AAa?$AAu?$AAd?$AAi?$AAt?$AA?$AA@
0x180004F2C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-registry-l2-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-registry-l2-1-0
0x180006750: "__cdecl _onexitend" __onexitend
0x1800043D0: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x180006028: g_WsSetTable
0x180004240: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x180004308: api-ms-win-core-sysinfo-l1-1-0_NULL_THUNK_DATA
0x1800043F0: "__cdecl _xi_a" __xi_a
0x180004300: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x1800043C8: wevtapi_NULL_THUNK_DATA
0x180004150: "__cdecl _imp_MatchEnumTag" __imp_MatchEnumTag
0x1800041C8: "__cdecl _imp_CoTaskMemFree" __imp_CoTaskMemFree
0x180004390: "__cdecl _imp_EvtFormatMessage" __imp_EvtFormatMessage
0x180004EC8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0
0x180006778: "__cdecl pRawDllMain" _pRawDllMain
0x180004E50: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-l1-1-0
0x1800031A0: "__cdecl _security_check_cookie" __security_check_cookie
0x1800043E8: "__cdecl _xc_z" __xc_z
0x180004F40: "__cdecl _IMPORT_DESCRIPTOR_MSWSOCK" __IMPORT_DESCRIPTOR_MSWSOCK
0x180004248: api-ms-win-core-processthreads-l1-1-0_NULL_THUNK_DATA
0x1800043B0: "__cdecl _imp_EvtQuery" __imp_EvtQuery
0x180004130: "__cdecl _imp_RegisterContext" __imp_RegisterContext
0x180001FA0: WsHandleSetAutotuning
0x180004188: "__cdecl _imp_WSCDeinstallProvider" __imp_WSCDeinstallProvider
0x1800042F8: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x180004200: "__cdecl _imp_GetProcessHeap" __imp_GetProcessHeap
0x180004740: "off" ??_C@_17FDPGNGBJ@?$AAo?$AAf?$AAf?$AA?$AA@
0x1800043A8: "__cdecl _imp_EvtOpenPublisherMetadata" __imp_EvtOpenPublisherMetadata
0x180004780: "Setup Migration" ??_C@_0BA@HONOPFLM@Setup?5Migration?$AA@
0x180004490: "autotuning" ??_C@_1BG@EIKDFNHG@?$AAa?$AAu?$AAt?$AAo?$AAt?$AAu?$AAn?$AAi?$AAn?$AAg?$AA?$AA@
0x1800042E0: api-ms-win-core-rtlsupport-l1-1-0_NULL_THUNK_DATA
0x1800047E0: "Winsock2\Parameters" ??_C@_0BE@KEBECCPC@Winsock2?2Parameters?$AA@
0x180004170: "__cdecl _imp_WSAEnumNameSpaceProvidersW" __imp_WSAEnumNameSpaceProvidersW
0x180004EF0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0
0x180004258: api-ms-win-core-profile-l1-1-0_NULL_THUNK_DATA
0x180004408: "__cdecl _guard_fids_table" __guard_fids_table
0x180004640: "full" ??_C@_19CKPKPLNA@?$AAf?$AAu?$AAl?$AAl?$AA?$AA@
0x180004388: msvcrt_NULL_THUNK_DATA
0x180004010: "__cdecl load_config_used" _load_config_used
0x180004500: "set" ??_C@_17EGGBPMH@?$AAs?$AAe?$AAt?$AA?$AA@
0x1800010E0: WsStartHelper
0x180004168: NETSH_NULL_THUNK_DATA
0x180004760: "Protocol_Catalog_Before_Reset" ??_C@_0BO@NAMOICPN@Protocol_Catalog_Before_Reset?$AA@
0x1800046E8: "RegOpenKeyEx failed: %d " ??_C@_0BJ@NABCBGFM@RegOpenKeyEx?5failed?3?5?$CFd?6?$AA@
0x180004470: g_WsGuid
0x180004280: "__cdecl _imp_RegQueryValueExA" __imp_RegQueryValueExA
0x1800047B0: "System\CurrentControlSet\Service" ??_C@_0CC@BIGIMOGP@System?2CurrentControlSet?2Service@
0x1800060A0: g_WsShowCmdTable
0x180004340: "__cdecl _imp__amsg_exit" __imp__amsg_exit
0x180004158: "__cdecl _imp_MatchToken" __imp_MatchToken
0x180004218: "__cdecl _imp_DisableThreadLibraryCalls" __imp_DisableThreadLibraryCalls
0x180004310: "__cdecl _imp_FileTimeToSystemTime" __imp_FileTimeToSystemTime
0x180004F18: "__cdecl _IMPORT_DESCRIPTOR_wevtapi" __IMPORT_DESCRIPTOR_wevtapi
0x1800042D8: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x180004250: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x180006748: g_hResourceModule
0x180004708: "DynamicSendBufferDisable" ??_C@_1DC@KEHDJLF@?$AAD?$AAy?$AAn?$AAa?$AAm?$AAi?$AAc?$AAS?$AAe?$AAn?$AAd?$AAB?$AAu?$AAf?$AAf?$AAe?$AAr?$AAD?$AAi?$AAs?$AAa?$AAb?$AAl?$AAe?$AA?$AA@
0x1800042C8: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x180004530: "Microsoft-Windows-Winsock-WS2HEL" ??_C@_1EE@NMAPCILJ@?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?9?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?9?$AAW?$AAi?$AAn?$AAs?$AAo?$AAc?$AAk?$AA?9?$AAW?$AAS?$AA2?$AAH?$AAE?$AAL@
0x1800033C0: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x180001B08: WsShowNameSpaceEntry
0x180004F04: "__cdecl _IMPORT_DESCRIPTOR_NETSH" __IMPORT_DESCRIPTOR_NETSH
0x180004360: "__cdecl _imp_fprintf" __imp_fprintf
0x180004348: "__cdecl _imp__XcptFilter" __imp__XcptFilter
0x180004138: "__cdecl _imp_RegisterHelper" __imp_RegisterHelper
0x180004E28: "__cdecl _IMPORT_DESCRIPTOR_WS2_32" __IMPORT_DESCRIPTOR_WS2_32
0x1800035BC: "__cdecl _iob_func" __iob_func
0x18000475C: "=" ??_C@_13NMPKAAJP@?$AA?$DN?$AA?$AA@
0x1800061A8: "__cdecl _security_cookie" __security_cookie
0x180004268: "__cdecl _imp_RegQueryValueExW" __imp_RegQueryValueExW
0x180006078: g_WsAuditTable
0x1800041B8: WS2_32_NULL_THUNK_DATA
0x180002A3C: ReadString
0x180004E3C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0
0x1800041D0: api-ms-win-core-com-l1-1-0_NULL_THUNK_DATA
0x180004288: "__cdecl _imp_RegCreateKeyExA" __imp_RegCreateKeyExA
0x180001030: InitHelperDll
0x180006758: "__cdecl _onexitbegin" __onexitbegin
0x180004660: "nsp" ??_C@_17LJDFENOM@?$AAn?$AAs?$AAp?$AA?$AA@
0x1800011B0: WsHandleReset
0x1800041E0: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x1800044A8: "trail" ??_C@_1M@BDJAGALC@?$AAt?$AAr?$AAa?$AAi?$AAl?$AA?$AA@
0x180004298: "__cdecl _imp_RegOpenKeyExA" __imp_RegOpenKeyExA
0x1800042A0: "__cdecl _imp_RegOpenKeyExW" __imp_RegOpenKeyExW
0x1800032C4: "__cdecl _security_init_cookie" __security_init_cookie
0x180006780: g_hModule
0x1800044D0: "show" ??_C@_19NEPDHLG@?$AAs?$AAh?$AAo?$AAw?$AA?$AA@
0x180004198: "__cdecl _imp_WSCEnumProtocols32" __imp_WSCEnumProtocols32
0x180004E00: "__cdecl _IMPORT_DESCRIPTOR_msvcrt" __IMPORT_DESCRIPTOR_msvcrt
0x180001510: WsHandleLspRemove
0x180004398: "__cdecl _imp_EvtClose" __imp_EvtClose
0x180004378: "__cdecl _imp_wprintf" __imp_wprintf
0x180004330: "__cdecl _imp_malloc" __imp_malloc
0x180004748: "on" ??_C@_15GMGGGDOD@?$AAo?$AAn?$AA?$AA@
0x1800041B0: "__cdecl _imp_WSCEnumProtocols" __imp_WSCEnumProtocols
0x180004190: "__cdecl _imp_WSCEnumNameSpaceProviders32" __imp_WSCEnumNameSpaceProviders32
0x1800041A8: "__cdecl _imp_WahWriteLSPEvent" __imp_WahWriteLSPEvent
0x180003410: "__cdecl _report_gsfailure" __report_gsfailure
0x180004318: api-ms-win-core-timezone-l1-1-0_NULL_THUNK_DATA
0x180004750: "failed: %d " ??_C@_0M@OELFPNBG@failed?3?5?$CFd?6?$AA@
0x180002920: RecursivelyDeleteRegistryTree
0x180006768: "__cdecl _native_startup_state" __native_startup_state
0x180004508: "reset" ??_C@_1M@OFCONGJO@?$AAr?$AAe?$AAs?$AAe?$AAt?$AA?$AA@
0x1800043C0: "__cdecl _imp_EvtRender" __imp_EvtRender
0x180004358: "__cdecl _imp_wcstok" __imp_wcstok
0x1800016D0: WsGetTransportEntries
0x180004EB4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0
0x1800042B8: "__cdecl _imp_RegCopyTreeA" __imp_RegCopyTreeA
0x180004338: "__cdecl _imp_free" __imp_free
0x180003230: "__cdecl IsNonwritableInCurrentImage" _IsNonwritableInCurrentImage
0x1800042F0: api-ms-win-core-synch-l1-2-0_NULL_THUNK_DATA
0x1800047F8: "Num_Catalog_Entries" ??_C@_0BE@LJPMGAJ@Num_Catalog_Entries?$AA@
0x180004120: MSWSOCK_NULL_THUNK_DATA
0x1800011A0: WsStopHelper
0x180004EA0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0
0x1800041A0: "__cdecl _imp_WSAStartup" __imp_WSAStartup
0x180004118: "__cdecl _imp_MigrateWinsockConfiguration" __imp_MigrateWinsockConfiguration
0x18000364D: memset
0x180004F54: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR

[JEB Decompiler by PNF Software]