Generated by JEB on 2019/08/01

PE: C:\Windows\System32\drivers\fastfat.sys Base=0x1C0000000 SHA-256=3C261831EA0D7EFA49AEFE5EBEDBC6964B60B19AAB25BA5AA935ACBAA0B1E71B
PDB: fastfat.pdb GUID={88E5896C-D070-8868-986A5EF88D216D9F} Age=1

1373 located named symbols:
0x1C001C208: Fat30Milliseconds
0x1C0020548: "__cdecl _imp_IoRaiseHardError" __imp_IoRaiseHardError
0x1C005BDA4: EEL_GetUserSidStringForToken
0x1C00022D0: FatSingleSyncCompletionRoutine
0x1C0005BC8: FatCheckForDismount
0x1C00207E0: "__cdecl _imp_IoAllocateIrp" __imp_IoAllocateIrp
0x1C004743C: FatEvaluateNameCase
0x1C0047DD4: FatPostStackOverflowRead
0x1C00208C0: "__cdecl _imp_ExAcquireFastMutexUnsafe" __imp_ExAcquireFastMutexUnsafe
0x1C0047A88: FatPnpRemove
0x1C00207E8: "__cdecl _imp_FsRtlBalanceReads" __imp_FsRtlBalanceReads
0x1C0010E48: ".appx_" ??_C@_06MLJFIGJP@?4appx_?$AA@
0x1C00203B0: "__cdecl _imp_PsGetThreadProcess" __imp_PsGetThreadProcess
0x1C0009A8C: EfspConstructNewPfileHeader
0x1C00202B0: "__cdecl _imp_KeExpandKernelStackAndCalloutEx" __imp_KeExpandKernelStackAndCalloutEx
0x1C001C340: FatEResourceLookasideList
0x1C0020A18: "__cdecl _imp_SeCaptureSubjectContext" __imp_SeCaptureSubjectContext
0x1C00209B8: "__cdecl _imp_ExAcquireFastMutex" __imp_ExAcquireFastMutex
0x1C004C7A8: FatPerformVerify
0x1C00350AC: FatLocateVolumeLabel
0x1C0020158: "__cdecl _imp_CcMapData" __imp_CcMapData
0x1C0014A80: T4
0x1C0014F80: U4
0x1C0010838: "\Fat" ??_C@_19HHFKNBBB@?$AA?2?$AAF?$AAa?$AAt?$AA?$AA@
0x1C0020530: "__cdecl _imp_KeAreAllApcsDisabled" __imp_KeAreAllApcsDisabled
0x1C00207B8: "__cdecl _imp_RtlFreeUnicodeString" __imp_RtlFreeUnicodeString
0x1C00201B8: "__cdecl _imp_KeSetTimer" __imp_KeSetTimer
0x1C000E21F: "__cdecl local_unwind" _local_unwind
0x1C0027864: FatReadDirectoryFile
0x1C003C9E0: FatFsdSetInformation
0x1C0010A38: "%d" ??_C@_15KNBIKKIN@?$AA?$CF?$AAd?$AA?$AA@
0x1C0020730: "__cdecl _imp_ExAcquireSharedWaitForExclusive" __imp_ExAcquireSharedWaitForExclusive
0x1C00202F0: "__cdecl _imp_FsRtlIsFatDbcsLegal" __imp_FsRtlIsFatDbcsLegal
0x1C00591C8: EfspLocateStreamTransitionMetadata
0x1C001C1E8: "__cdecl _security_cookie_complement" __security_cookie_complement
0x1C00094B0: EfsAesEnc_RSA32K
0x1C0020930: "__cdecl _imp_ObfDereferenceObject" __imp_ObfDereferenceObject
0x1C0009740: EfsInitAes
0x1C000296C: EfsFileSystemControlCallback
0x1C001C980: FatNoAsync
0x1C0037ADC: FatCreateEa
0x1C0055494: EfsSetEncrypt
0x1C002FCFC: FatSetFullNameInFcb
0x1C0038054: FatGetEaFile
0x1C00014F0: FatAutoUnlock
0x1C0020908: "__cdecl _imp_RtlFindClearBits" __imp_RtlFindClearBits
0x1C000A48C: EnterpriseContextLibMemAllocPaged
0x1C00264CC: FatSetFatEntry
0x1C0020700: "__cdecl _imp_FsRtlPostStackOverflow" __imp_FsRtlPostStackOverflow
0x1C0020798: "__cdecl _imp_FsRtlInitializeOplock" __imp_FsRtlInitializeOplock
0x1C0039D18: FatUnpinEaRange
0x1C0040720: FatForceCacheMiss
0x1C00204F8: "__cdecl _imp_FsRtlResetLargeMcb" __imp_FsRtlResetLargeMcb
0x1C00206E8: "__cdecl _imp_RtlGenerate8dot3Name" __imp_RtlGenerate8dot3Name
0x1C0029650: FatCloseWorker
0x1C00205D8: "__cdecl _imp_ExInitializeNPagedLookasideList" __imp_ExInitializeNPagedLookasideList
0x1C00202D8: "__cdecl _imp_RtlOemStringToCountedUnicodeString" __imp_RtlOemStringToCountedUnicodeString
0x1C00491B0: FatReleaseForCcFlush
0x1C0020298: "__cdecl _imp_ExGetSharedWaiterCount" __imp_ExGetSharedWaiterCount
0x1C00204F0: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x1C0024250: FatSetupAllocationSupport
0x1C0006860: FatPrePostIrp
0x1C000E320: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x1C0013900: rcon
0x1C0020200: "__cdecl _imp_MmPrefetchPages" __imp_MmPrefetchPages
0x1C0058538: EfspGetFilePathExtension
0x1C0043AB4: FatPerformVerifyDiskRead
0x1C0020660: "__cdecl _imp_FsRtlVolumeDeviceToCorrelationId" __imp_FsRtlVolumeDeviceToCorrelationId
0x1C0020640: "__cdecl _imp_FsRtlLookupLargeMcbEntry" __imp_FsRtlLookupLargeMcbEntry
0x1C00114F0: Sel
0x1C00206F8: "__cdecl _imp_FsRtlPostPagingFileStackOverflow" __imp_FsRtlPostPagingFileStackOverflow
0x1C005BE28: EEL_GetProcessInfo
0x1C0002D40: EfsFirstWriteEncryptOnCloseFileCallback
0x1C005A984: EdpEnforcementLog_FileRequiresEncryption
0x1C000C2D0: des
0x1C00074EC: EfspHasPrivilege
0x1C0055AE8: EfsCreateEmptyOrRemoveStreamTransitionMetadata
0x1C0020488: "__cdecl _imp_FsRtlDeleteKeyFromTunnelCache" __imp_FsRtlDeleteKeyFromTunnelCache
0x1C0010808: "$EFS" ??_C@_19DLAHLBJH@?$AA$?$AAE?$AAF?$AAS?$AA?$AA@
0x1C0015838: "__cdecl TraceLoggingMetadata" _TraceLoggingMetadata
0x1C0020830: "__cdecl _imp_ExAcquireSharedStarveExclusive" __imp_ExAcquireSharedStarveExclusive
0x1C0020258: "__cdecl _imp_IoGetRequestorProcess" __imp_IoGetRequestorProcess
0x1C00209D0: "__cdecl _imp_PsTerminateSystemThread" __imp_PsTerminateSystemThread
0x1C0031DB0: FatQueryDirectory
0x1C00204B8: "__cdecl _imp_FsRtlGetNextLargeMcbEntry" __imp_FsRtlGetNextLargeMcbEntry
0x1C004C40C: FatResetFcb
0x1C0003D80: NtOfsQueryLength
0x1C00205C8: "__cdecl _imp_KeQueryActiveProcessorCount" __imp_KeQueryActiveProcessorCount
0x1C0020948: "__cdecl _imp_SeAccessCheck" __imp_SeAccessCheck
0x1C00208A8: "__cdecl _imp_RtlSetBits" __imp_RtlSetBits
0x1C004B51C: FatEnsureStringBufferEnough
0x1C0020750: "__cdecl _imp_ExpInterlockedPushEntrySList" __imp_ExpInterlockedPushEntrySList
0x1C0004BF8: FatLookupMcbEntry
0x1C0020568: "__cdecl _imp_IoCreateDevice" __imp_IoCreateDevice
0x1C0013980: S5
0x1C0020980: "__cdecl _imp_ZwUpdateWnfStateData" __imp_ZwUpdateWnfStateData
0x1C00201E0: "__cdecl _imp_CcMdlReadComplete" __imp_CcMdlReadComplete
0x1C0014680: T5
0x1C001C2C8: FatDiskAccountingEnabled
0x1C00387C0: FatDeleteEaSet
0x1C005C054: EEL_GetExtension
0x1C00209F0: "__cdecl _imp_SeQueryInformationToken" __imp_SeQueryInformationToken
0x1C0027F2C: FatUnpinRepinnedBcbs
0x1C0020718: "__cdecl _imp_CcSetReadAheadGranularity" __imp_CcSetReadAheadGranularity
0x1C0020678: "__cdecl _imp_FsRtlOplockIsSharedRequest" __imp_FsRtlOplockIsSharedRequest
0x1C00201C8: "__cdecl _imp_IoSetHardErrorOrVerifyDevice" __imp_IoSetHardErrorOrVerifyDevice
0x1C00206F0: "__cdecl _imp_RtlUnicodeStringToCountedOemString" __imp_RtlUnicodeStringToCountedOemString
0x1C0010960: "\Registry\Machine\Hardware\DESCR" ??_C@_1FM@BEHDMNGF@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAH?$AAa?$AAr?$AAd?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAD?$AAE?$AAS?$AAC?$AAR@
0x1C0009E30: IsExcludedExtension
0x1C00203E8: "__cdecl _imp_IoGetFsZeroingOffset" __imp_IoGetFsZeroingOffset
0x1C0020AC8: "__cdecl _imp_ExAllocateTimer" __imp_ExAllocateTimer
0x1C0006A30: FatFsdWrite
0x1C001CC40: FatCoalescingRegistration
0x1C00200C0: "__cdecl _imp_BCryptDestroyKey" __imp_BCryptDestroyKey
0x1C0020410: "__cdecl _imp_MmProbeAndLockPages" __imp_MmProbeAndLockPages
0x1C004D370: FatOplockComplete
0x1C0020710: "__cdecl _imp_IoSetFsZeroingOffset" __imp_IoSetFsZeroingOffset
0x1C0020030: "__cdecl _imp_XboxCryptoFree" __imp_XboxCryptoFree
0x1C0030054: FatPostProcessEfsCreate
0x1C004150C: FatHijackIrpAndFlushDevice
0x1C0020260: "__cdecl _imp_IoRemoveShareAccess" __imp_IoRemoveShareAccess
0x1C002EB60: FatCreateNewFile
0x1C0020208: "__cdecl _imp_IofCompleteRequest" __imp_IofCompleteRequest
0x1C001CC60: FatReserveEvent
0x1C00201D8: "__cdecl _imp_CcZeroData" __imp_CcZeroData
0x1C0009620: EfsXtsAesEnc
0x1C000E0C0: ext_ms_win_ntos_clipsp_l1_1_0_ClipSpInitialize
0x1C00518A0: EfsOpenFile
0x1C00416C0: FatAddMcbEntry
0x1C0020BAC: "__cdecl _IMPORT_DESCRIPTOR_HAL" __IMPORT_DESCRIPTOR_HAL
0x1C002C254: FatOpenVolume
0x1C0047588: FatUnicodeRestoreShortNameCase
0x1C002FEA0: FatCheckShareAccess
0x1C003D5AC: FatQueryEaInfo
0x1C00535C0: EfsSetStreamTransition
0x1C001CEC0: FatMaxDelayedCloseCount
0x1C0020458: "__cdecl _imp_ExConvertExclusiveToSharedLite" __imp_ExConvertExclusiveToSharedLite
0x1C00107F8: "EA DATA. SF" ??_C@_0M@BHLMPOKL@EA?5DATA?4?5SF?$AA@
0x1C00203F0: "__cdecl _imp_MmBuildMdlForNonPagedPool" __imp_MmBuildMdlForNonPagedPool
0x1C00207F0: "__cdecl _imp_RtlEqualString" __imp_RtlEqualString
0x1C0031D64: FatCommonDirectoryControl
0x1C00208D0: "__cdecl _imp_FsRtlTruncateLargeMcb" __imp_FsRtlTruncateLargeMcb
0x1C0020898: "__cdecl _imp_RtlClearBits" __imp_RtlClearBits
0x1C0001008: "__cdecl TlgWrite" _TlgWrite
0x1C0020498: "__cdecl _imp_FsRtlAreNamesEqual" __imp_FsRtlAreNamesEqual
0x1C0006300: FatCleanVolumeDpc
0x1C00201F0: "__cdecl _imp_CcPinMappedData" __imp_CcPinMappedData
0x1C0020B40: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x1C00096A0: EfsXtsAesDec
0x1C0020588: "__cdecl _imp_FsRtlMdlReadDev" __imp_FsRtlMdlReadDev
0x1C002841C: FatPrefetchPages
0x1C00209A8: "__cdecl _imp_ExDeletePagedLookasideList" __imp_ExDeletePagedLookasideList
0x1C0001288: FatCloseFileHeader
0x1C0007C2C: DplWrapDeriveKey
0x1C0020438: "__cdecl _imp_ExQueueWorkItem" __imp_ExQueueWorkItem
0x1C0020670: "__cdecl _imp_IoGetStackLimits" __imp_IoGetStackLimits
0x1C0051110: EfsFileRequiresEncryption
0x1C00206C0: "__cdecl _imp_FsRtlFastUnlockSingle" __imp_FsRtlFastUnlockSingle
0x1C00207C8: "__cdecl _imp_RtlSplay" __imp_RtlSplay
0x1C0020B18: "__cdecl _imp_ExAcquirePushLockSharedEx" __imp_ExAcquirePushLockSharedEx
0x1C00091E0: EfsDesXEnc
0x1C004C640: FatQuickVerifyVcb
0x1C00492F0: FatFsdShutdown
0x1C00201D0: "__cdecl _imp_FsRtlNormalizeNtstatus" __imp_FsRtlNormalizeNtstatus
0x1C004B940: FatCompareNames
0x1C0024008: FatCheckFileAccess
0x1C00205B8: "__cdecl _imp_KeInitializeSpinLock" __imp_KeInitializeSpinLock
0x1C00468C0: FatFastUnlockAllByKey
0x1C0012500: T6
0x1C004AC3C: FatDeleteCcb
0x1C0020A00: "__cdecl _imp_PsGetCurrentThreadTeb" __imp_PsGetCurrentThreadTeb
0x1C000E0C0: ext_ms_win_crypto_xbox_l1_1_0_XboxCryptoFree
0x1C005A424: EfsGenerateDirEfsClient
0x1C0020600: "__cdecl _imp_IoRegisterDriverReinitialization" __imp_IoRegisterDriverReinitialization
0x1C0049240: FatNoOpAcquire
0x1C0010A50: FatSqmEventProvider
0x1C00209C0: "__cdecl _imp_ZwCreateEvent" __imp_ZwCreateEvent
0x1C00209F8: "__cdecl _imp_ZwQueryInformationToken" __imp_ZwQueryInformationToken
0x1C0049394: FatCommonShutdown
0x1C00400D0: FatSetValidDataLengthInfo
0x1C0058B3C: EdppIsExcludedName
0x1C0020060: "__cdecl _imp_BCryptCreateHash" __imp_BCryptCreateHash
0x1C0006BF8: FatUninitializeSqm
0x1C0020120: "__cdecl _imp_KeWaitForSingleObject" __imp_KeWaitForSingleObject
0x1C0020390: "__cdecl _imp_RtlAppendUnicodeStringToString" __imp_RtlAppendUnicodeStringToString
0x1C0010D90: "AES" ??_C@_17PJMHNJHG@?$AAA?$AAE?$AAS?$AA?$AA@
0x1C0020808: "__cdecl _imp_CcDeferWrite" __imp_CcDeferWrite
0x1C000154C: FatQueueClose
0x1C004C2B4: FatCheckDirtyBit
0x1C00544DC: EfspPostCreateGetUserInformation
0x1C00201A0: "__cdecl _imp_KeReleaseSpinLock" __imp_KeReleaseSpinLock
0x1C0020978: "__cdecl _imp_ZwWaitForSingleObject" __imp_ZwWaitForSingleObject
0x1C0009F20: IsRegistryOverrideSet
0x1C005C980: TlgUnregisterAggregateProvider
0x1C0020380: "__cdecl _imp_IoCancelFileOpen" __imp_IoCancelFileOpen
0x1C0010D98: "ChainingModeCBC" ??_C@_1CA@NDPDKCGP@?$AAC?$AAh?$AAa?$AAi?$AAn?$AAi?$AAn?$AAg?$AAM?$AAo?$AAd?$AAe?$AAC?$AAB?$AAC?$AA?$AA@
0x1C0009150: EfsDesDec
0x1C0059CA8: EfsReleaseRpcHandle
0x1C0059710: EfspClipSpFree
0x1C001CB08: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUhvxfirgbUvwkvmulixvnvmgoltUporyUlyquivUznwGEUkivxlnkOlyq@EdpEnforcementLogK" __@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUhvxfirgbUvwkvmulixvnvmgoltUporyUlyquivUznwGEUkivxlnkOlyq@EdpEnforcementLogK
0x1C0046A24: FatCommonLockControl
0x1C002D954: FatOpenExistingFile
0x1C0046E20: FatGetUnicodeNameFromFcb
0x1C0020790: "__cdecl _imp_FsRtlDeleteTunnelCache" __imp_FsRtlDeleteTunnelCache
0x1C0024C20: FatAddFileAllocation
0x1C002FF28: FatSearchRemainderOfDirectoryForCollisions
0x1C0020330: "__cdecl _imp_FsRtlOplockFsctrl" __imp_FsRtlOplockFsctrl
0x1C0020B98: "__cdecl _IMPORT_DESCRIPTOR_ext-ms-win-crypto-xbox-l1-1-0" __IMPORT_DESCRIPTOR_ext-ms-win-crypto-xbox-l1-1-0
0x1C0010798: "__cdecl _guard_iat_table" __guard_iat_table
0x1C0036790: FatSetFileSizeInDirentNoRaise
0x1C000ABA4: CopyEnterpriseId
0x1C000E340: memcpy
0x1C00355A8: FatDeleteEfsAttributeOnDirectory
0x1C0049290: FatFilterCallbackAcquireForCreateSection
0x1C00208E0: "__cdecl _imp_FsRtlInitializeLargeMcb" __imp_FsRtlInitializeLargeMcb
0x1C0020090: "__cdecl _imp_BCryptDecrypt" __imp_BCryptDecrypt
0x1C0051FA0: EfsFileControl
0x1C00209E8: "__cdecl _imp_RtlConvertSidToUnicodeString" __imp_RtlConvertSidToUnicodeString
0x1C0011D00: Spbox
0x1C0020A60: "__cdecl _imp_KdDebuggerNotPresent" __imp_KdDebuggerNotPresent
0x1C0002114: FatPagingFileErrorHandler
0x1C0020680: "__cdecl _imp_FsRtlCheckLockForOplockRequest" __imp_FsRtlCheckLockForOplockRequest
0x1C0009270: EfsDesXDec
0x1C001CAED: g_RpcBindingHandleBound
0x1C001CB38: FatDiskFileSystemDeviceObject
0x1C0048FB0: FatAcquireFcbForLazyWrite
0x1C0020778: "__cdecl _imp_KeInitializeDpc" __imp_KeInitializeDpc
0x1C0020180: "__cdecl _imp_CcPurgeCacheSection" __imp_CcPurgeCacheSection
0x1C0020290: "__cdecl _imp_IoGetCurrentProcess" __imp_IoGetCurrentProcess
0x1C0005FB8: FatFlushAndCleanAllVolumes
0x1C001CB20: g_RpcBindingEvent
0x1C0025ACC: FatDeallocateDiskSpace
0x1C004720C: FatSelectNames
0x1C004B5CC: FatScanForDataTrack
0x1C0013500: T7
0x1C0052F88: EfspReleaseFsCtlData
0x1C0020168: "__cdecl _imp_CcSetDirtyPinnedData" __imp_CcSetDirtyPinnedData
0x1C0020570: "__cdecl _imp_IoDeleteDevice" __imp_IoDeleteDevice
0x1C001CEC4: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUuhUuzhguzgUlyquivUznwGEUuzgkilxhOlyq@fastfat" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUuhUuzhguzgUlyquivUznwGEUuzgkilxhOlyq@fastfat
0x1C0004AA0: FatWriteRawExceptionFilter
0x1C000E0AD: "__cdecl _C_specific_handler" __C_specific_handler
0x1C004B32C: FatCheckFreeDirentBitmap
0x1C0020118: "__cdecl _imp_IofCallDriver" __imp_IofCallDriver
0x1C005A518: EfsNotifyEnterpriseFileWriteClient
0x1C005A810: MIDL_user_free
0x1C0059D2C: EfsRpcTryToReconnect
0x1C004AE78: FatGetNextFcbBottomUp
0x1C00200E8: "__cdecl _imp_RpcBindingUnbind" __imp_RpcBindingUnbind
0x1C00203F8: "__cdecl _imp_KeFlushIoBuffers" __imp_KeFlushIoBuffers
0x1C0020178: "__cdecl _imp_CcFlushCache" __imp_CcFlushCache
0x1C0052FDC: EfspValidateAndParseFsctl
0x1C000E340: memmove
0x1C00078D8: EfspPostCreateActionNeedsData
0x1C003E1A4: FatSetRenameInfo
0x1C003C3D0: FatFastQueryBasicInfo
0x1C003C920: FatFsdQueryInformation
0x1C0044084: FatGetRetrievalPointers
0x1C00202E8: "__cdecl _imp_RtlCopyUnicodeString" __imp_RtlCopyUnicodeString
0x1C0050CF0: EfspCheckEfsPolicy
0x1C0003DFC: NtOfsSetLength
0x1C0010680: EEL_EmptyUnicodeString
0x1C0005AFC: FatSwapVpb
0x1C000E12C: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x1C00108A0: "FatDisableCodePageInvariance" ??_C@_1DK@GKMOGOOI@?$AAF?$AAa?$AAt?$AAD?$AAi?$AAs?$AAa?$AAb?$AAl?$AAe?$AAC?$AAo?$AAd?$AAe?$AAP?$AAa?$AAg?$AAe?$AAI?$AAn?$AAv?$AAa?$AAr?$AAi?$AAa?$AAn?$AAc?$AAe?$AA?$AA@
0x1C0020AA8: "__cdecl _imp_KeIsExecutingDpc" __imp_KeIsExecutingDpc
0x1C00205E8: "__cdecl _imp_IoRegisterFileSystem" __imp_IoRegisterFileSystem
0x1C00209A0: "__cdecl _imp_IoGetDeviceObjectPointer" __imp_IoGetDeviceObjectPointer
0x1C0020470: "__cdecl _imp_RtlxOemStringToUnicodeSize" __imp_RtlxOemStringToUnicodeSize
0x1C0020398: "__cdecl _imp_IoIsOperationSynchronous" __imp_IoIsOperationSynchronous
0x1C0020A10: "__cdecl _imp_IoSetFsTrackOffsetState" __imp_IoSetFsTrackOffsetState
0x1C00201C0: "__cdecl _imp_CcGetFileObjectFromBcb" __imp_CcGetFileObjectFromBcb
0x1C0010E28: "KeyDataBlob" ??_C@_1BI@NNGJONND@?$AAK?$AAe?$AAy?$AAD?$AAa?$AAt?$AAa?$AAB?$AAl?$AAo?$AAb?$AA?$AA@
0x1C0010880: "Win31FileSystem" ??_C@_1CA@NOHNDOFJ@?$AAW?$AAi?$AAn?$AA3?$AA1?$AAF?$AAi?$AAl?$AAe?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?$AA@
0x1C0051EA8: EfpsPerformAccessCheck
0x1C00016A0: FatMarkVolumeCompletionRoutine
0x1C00063B4: FatMarkVolume
0x1C00438A0: FatLockVolume
0x1C0020448: "__cdecl _imp_IoBuildDeviceIoControlRequest" __imp_IoBuildDeviceIoControlRequest
0x1C005C7DC: TlgRegisterAggregateProvider
0x1C0040954: FatCommonFlushBuffers
0x1C000D6C0: "void __cdecl TlgAggregateInternalFlushTimerCallbackKernelMode(struct _EX_TIMER * __ptr64,void * __ptr64)" ?TlgAggregateInternalFlushTimerCallbackKernelMode@@YAXPEAU_EX_TIMER@@PEAX@Z
0x1C00202A0: "__cdecl _imp_ExGetExclusiveWaiterCount" __imp_ExGetExclusiveWaiterCount
0x1C003D70C: FatQueryNetworkInfo
0x1C0020740: "__cdecl _imp_IoUnregisterFileSystem" __imp_IoUnregisterFileSystem
0x1C0020610: "__cdecl _imp_ExDeleteResourceLite" __imp_ExDeleteResourceLite
0x1C004F228: FatSqmVolumeInfo
0x1C0020A60: KdDebuggerNotPresent
0x1C0020558: "__cdecl _imp_FsRtlFastCheckLockForWrite" __imp_FsRtlFastCheckLockForWrite
0x1C004B6B0: FatInsertName
0x1C0020308: "__cdecl _imp_FsRtlAreVolumeStartupApplicationsComplete" __imp_FsRtlAreVolumeStartupApplicationsComplete
0x1C00204E8: "__cdecl _imp_ObfReferenceObject" __imp_ObfReferenceObject
0x1C0014E80: S
0x1C0058C04: EdppGetExtensionLocation
0x1C003FC10: FatSetEndOfFileInfo
0x1C0006940: FatAddToWorkque
0x1C0010DF0: "XTS-AES" ??_C@_1BA@EPFFOHL@?$AAX?$AAT?$AAS?$AA?9?$AAA?$AAE?$AAS?$AA?$AA@
0x1C000A0DC: EfsKRpcNotifyEnterpriseFileWrite
0x1C0055150: EfsSameAesKeyBlob
0x1C00415EC: FatFlushFatEntries
0x1C0046FB8: FatSetFullFileNameInFcb
0x1C0028590: FatFsdCleanup
0x1C0035010: FatLocateSimpleOemDirent
0x1C0020028: "__cdecl _imp_XboxCryptoCreateEfsKey" __imp_XboxCryptoCreateEfsKey
0x1C00203B8: "__cdecl _imp_FsRtlUpdateDiskCounters" __imp_FsRtlUpdateDiskCounters
0x1C00202A8: "__cdecl _imp_IoQueueWorkItem" __imp_IoQueueWorkItem
0x1C0009880: EfsInitXtsAes
0x1C005865C: EdppAddExclusionsList
0x1C0020988: "__cdecl _imp_ExReleaseFastMutex" __imp_ExReleaseFastMutex
0x1C0020238: "__cdecl _imp_FsRtlIsNtstatusExpected" __imp_FsRtlIsNtstatusExpected
0x1C004CA10: FatFsdQueryVolumeInformation
0x1C0020468: "__cdecl _imp_FsRtlDoesNameContainWildCards" __imp_FsRtlDoesNameContainWildCards
0x1C0047168: FatUnicodeToUpcaseOem
0x1C0028348: FatSyncUninitializeCacheMap
0x1C00208B8: "__cdecl _imp_ExReleaseFastMutexUnsafe" __imp_ExReleaseFastMutexUnsafe
0x1C0027960: FatPrepareWriteDirectoryFile
0x1C0020928: "__cdecl _imp_CcSetFileSizes" __imp_CcSetFileSizes
0x1C0020858: "__cdecl _imp_EtwSetInformation" __imp_EtwSetInformation
0x1C005B4E0: EdpEnforcementLog_FileAccessDenied
0x1C00204D8: NlsOemLeadByteInfo
0x1C0020218: "__cdecl _imp_IoSetTopLevelIrp" __imp_IoSetTopLevelIrp
0x1C0020480: "__cdecl _imp_ExLocalTimeToSystemTime" __imp_ExLocalTimeToSystemTime
0x1C00203D8: "__cdecl _imp_IoIsSystemThread" __imp_IoIsSystemThread
0x1C00059E0: FatOverflowPagingFileRead
0x1C004B4DC: FatPreallocateCloseContext
0x1C00203E0: "__cdecl _imp_IoGetTopLevelIrp" __imp_IoGetTopLevelIrp
0x1C00078E8: EfspCanOffloadCrypto
0x1C003C570: FatFastQueryStdInfo
0x1C0020150: "__cdecl _imp_CcSetAdditionalCacheAttributesEx" __imp_CcSetAdditionalCacheAttributesEx
0x1C0050BBC: EfsInitFips
0x1C0020918: "__cdecl _imp_ExAllocatePoolWithTag" __imp_ExAllocatePoolWithTag
0x1C0049100: FatAcquireForCcFlush
0x1C0010820: FatMaxLarge
0x1C000B840: rijndaelEncrypt256
0x1C00204D0: "__cdecl _imp_NlsMbOemCodePageTag" __imp_NlsMbOemCodePageTag
0x1C000A0B8: IsNoOffloadRegistryOverrideSet
0x1C0020B28: "__cdecl _imp__local_unwind" __imp__local_unwind
0x1C004CB84: FatCommonQueryVolumeInfo
0x1C00016A0: FatPnpCompletionRoutine
0x1C0020138: "__cdecl _imp_CcRepinBcb" __imp_CcRepinBcb
0x1C0020738: "__cdecl _imp_ExIsResourceAcquiredSharedLite" __imp_ExIsResourceAcquiredSharedLite
0x1C0058E20: EdppNotifyEnterpriseFileCleanup
0x1C003BC04: FatUpdateFileHeader
0x1C001C230: AttrName
0x1C0010848: "\FatCdrom" ??_C@_1BE@GHFDHLLB@?$AA?2?$AAF?$AAa?$AAt?$AAC?$AAd?$AAr?$AAo?$AAm?$AA?$AA@
0x1C00207F8: "__cdecl _imp_IoVerifyVolume" __imp_IoVerifyVolume
0x1C00203C0: "__cdecl _imp_IoBuildPartialMdl" __imp_IoBuildPartialMdl
0x1C004399C: FatIsVolumeDirty
0x1C0020788: "__cdecl _imp_FsRtlNotifyUninitializeSync" __imp_FsRtlNotifyUninitializeSync
0x1C0007ED0: DplWrapProtect
0x1C0020430: "__cdecl _imp_FsRtlIsTotalDeviceFailure" __imp_FsRtlIsTotalDeviceFailure
0x1C0020890: "__cdecl _imp_RtlAreBitsClear" __imp_RtlAreBitsClear
0x1C0010B48: "\EFSInitEvent" ??_C@_1BM@POMANDGO@?$AA?2?$AAE?$AAF?$AAS?$AAI?$AAn?$AAi?$AAt?$AAE?$AAv?$AAe?$AAn?$AAt?$AA?$AA@
0x1C0010DD8: "BlockLength" ??_C@_1BI@JJDKEEML@?$AAB?$AAl?$AAo?$AAc?$AAk?$AAL?$AAe?$AAn?$AAg?$AAt?$AAh?$AA?$AA@
0x1C0010A10: "FAT32" ??_C@_1M@CDKMPPAL@?$AAF?$AAA?$AAT?$AA3?$AA2?$AA?$AA@
0x1C0012900: T1
0x1C0015380: U1
0x1C004C4B4: FatDetermineAndMarkFcbCondition
0x1C0056A08: SetEfsData
0x1C0020800: "__cdecl _imp_FsRtlGetSectorSizeInformation" __imp_FsRtlGetSectorSizeInformation
0x1C000A730: QueryAttributes
0x1C0020020: "__cdecl _imp_XboxCryptoGetKeySize" __imp_XboxCryptoGetKeySize
0x1C00310D8: FatNonCachedNonAlignedRead
0x1C00406A0: FatPurgeReferencedFileObjects
0x1C0020860: "__cdecl _imp_EtwWriteTransfer" __imp_EtwWriteTransfer
0x1C0020048: ext-ms-win-ntos-clipsp-l1-1-0_NULL_THUNK_DATA
0x1C000E0C0: ext_ms_win_crypto_xbox_l1_1_0_XboxCryptoXtsAesDecrypt
0x1C0020960: "__cdecl _imp_SePrivilegeCheck" __imp_SePrivilegeCheck
0x1C0020068: "__cdecl _imp_BCryptHashData" __imp_BCryptHashData
0x1C0020A68: "__cdecl _imp_RtlUpcaseUnicodeChar" __imp_RtlUpcaseUnicodeChar
0x1C000A138: EfsKRpcNotifyEnterpriseFileCleanup
0x1C00017C4: FatPagingFileIo
0x1C0043BF0: FatQueryRetrievalPointers
0x1C0020AA0: "__cdecl _imp_ZwOpenThreadTokenEx" __imp_ZwOpenThreadTokenEx
0x1C0057834: EfspCheckBarePFileHeader
0x1C0031CB0: FatFsdDirectoryControl
0x1C00027D8: EfsPostCreateCallback
0x1C0050F9C: AllocateAndSetContextDataBlock
0x1C00205C0: "__cdecl _imp_MmQuerySystemSize" __imp_MmQuerySystemSize
0x1C000E194: "__cdecl _GSHandlerCheck_SEH" __GSHandlerCheck_SEH
0x1C0010A20: "FAT" ??_C@_17PFEEKKMA@?$AAF?$AAA?$AAT?$AA?$AA@
0x1C0020B20: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x1C0033ECC: FatLfnDirentExists
0x1C0020690: "__cdecl _imp_CcWaitForCurrentLazyWriterActivity" __imp_CcWaitForCurrentLazyWriterActivity
0x1C0059624: EfsDecryptFek
0x1C0010C78: "EdpExcludedExtensions" ??_C@_1CM@OIKJCCKM@?$AAE?$AAd?$AAp?$AAE?$AAx?$AAc?$AAl?$AAu?$AAd?$AAe?$AAd?$AAE?$AAx?$AAt?$AAe?$AAn?$AAs?$AAi?$AAo?$AAn?$AAs?$AA?$AA@
0x1C0053410: EfsGetStreamTransition
0x1C00208D8: "__cdecl _imp_FsRtlUninitializeLargeMcb" __imp_FsRtlUninitializeLargeMcb
0x1C002514C: FatAllocateDiskSpace
0x1C0020728: "__cdecl _imp_CcMdlRead" __imp_CcMdlRead
0x1C00205A0: "__cdecl _imp_FsRtlMdlWriteCompleteDev" __imp_FsRtlMdlWriteCompleteDev
0x1C0020220: "__cdecl _imp_KeLeaveCriticalRegion" __imp_KeLeaveCriticalRegion
0x1C0020128: "__cdecl _imp_MmUnmapLockedPages" __imp_MmUnmapLockedPages
0x1C00108E0: "\Registry\Machine\System\Current" ??_C@_1HM@IHPPCBKD@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1C0020A38: "__cdecl _imp_PsReferenceImpersonationToken" __imp_PsReferenceImpersonationToken
0x1C00206B0: "__cdecl _imp_CcCanIWrite" __imp_CcCanIWrite
0x1C000A2FC: SrpCreateEnterpriseId
0x1C004ADD4: FatDeleteIrpContext_Real
0x1C000E108: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x1C0020848: "__cdecl _imp__snwprintf_s" __imp__snwprintf_s
0x1C001C210: FatJanOne1980
0x1C00334A4: FatCreateNewDirent
0x1C0031A0C: FatWaitSync
0x1C0037990: FatGetNeedEaCount
0x1C0020300: "__cdecl _imp_IoAllocateMdl" __imp_IoAllocateMdl
0x1C0036F1C: FatDefragDirectory
0x1C00201F8: "__cdecl _imp_IoRetrievePriorityInfo" __imp_IoRetrievePriorityInfo
0x1C00208F8: "__cdecl _imp_ExRaiseStatus" __imp_ExRaiseStatus
0x1C0020720: "__cdecl _imp_CcCopyReadEx" __imp_CcCopyReadEx
0x1C0058378: EfspGetRequestorProcessName
0x1C004D394: FatCommonWrite
0x1C0002EDC: NtOfsReleaseMap
0x1C00200F0: "__cdecl _imp_RpcBindingCreateW" __imp_RpcBindingCreateW
0x1C0006C28: "__cdecl TlgDefineProvider_annotation__TlgTlgAggregateInternalProviderProv" _TlgDefineProvider_annotation__TlgTlgAggregateInternalProviderProv
0x1C0020440: "__cdecl _imp_ExAllocatePoolWithQuotaTag" __imp_ExAllocatePoolWithQuotaTag
0x1C0038E38: FatAddEaSet
0x1C0044614: FatMoveFile
0x1C00593B8: EfspIsCryptoOffloadTurnedOffByOverride
0x1C0020748: "__cdecl _imp_ExpInterlockedPopEntrySList" __imp_ExpInterlockedPopEntrySList
0x1C0020A80: "__cdecl _imp_ExUuidCreate" __imp_ExUuidCreate
0x1C0057AB0: EfspValidatePFileHeaderLicense
0x1C0020938: "__cdecl _imp_SeExports" __imp_SeExports
0x1C004BBA0: FatFatDateToNtTime
0x1C0020140: "__cdecl _imp_CcUnpinRepinnedBcb" __imp_CcUnpinRepinnedBcb
0x1C000E0D0: ext_ms_win_crypto_xbox_l1_1_0_XboxCryptoGetKeySize
0x1C005A700: EfsKRpcGenerateKey
0x1C0020998: "__cdecl _imp_PsCreateSystemThread" __imp_PsCreateSystemThread
0x1C0063958: FatIsFujitsuFMR
0x1C0010A28: "(null)" ??_C@_1O@CEDCILHN@?$AA?$CI?$AAn?$AAu?$AAl?$AAl?$AA?$CJ?$AA?$AA@
0x1C0013E80: T2
0x1C00418E0: FatFsdFileSystemControl
0x1C00200B8: "__cdecl _imp_BCryptCloseAlgorithmProvider" __imp_BCryptCloseAlgorithmProvider
0x1C0014280: U2
0x1C0020010: "__cdecl _imp_XboxCryptoXtsAesDecrypt" __imp_XboxCryptoXtsAesDecrypt
0x1C00205F8: "__cdecl _imp_PoRegisterCoalescingCallback" __imp_PoRegisterCoalescingCallback
0x1C004CE54: FatCommonSetVolumeInfo
0x1C001CB40: FatCdromFileSystemDeviceObject
0x1C0020100: msrpc_NULL_THUNK_DATA
0x1C000A5A0: QueryFlags
0x1C000ACE0: desxkey
0x1C0010860: "FatEnableEfs" ??_C@_1BK@IDHNMOLB@?$AAF?$AAa?$AAt?$AAE?$AAn?$AAa?$AAb?$AAl?$AAe?$AAE?$AAf?$AAs?$AA?$AA@
0x1C000B490: rijndaelKeySched
0x1C0001340: FatSetDirtyBcb
0x1C0049270: FatNoOpRelease
0x1C0050304: GetKeyBlobBufferEx
0x1C0005DF8: FatMarkDevForVerifyIfVcbMounted
0x1C004170C: FatLookupLastMcbEntry
0x1C0046370: FatFsdLockControl
0x1C00099CC: CanCallerAccessCacheEntry
0x1C0002CBC: EfsOpenEncryptOnCloseFileCallback
0x1C0020B10: "__cdecl _imp_ExReleasePushLockSharedEx" __imp_ExReleasePushLockSharedEx
0x1C0020818: "__cdecl _imp_FsRtlCheckLockForWriteAccess" __imp_FsRtlCheckLockForWriteAccess
0x1C00057C0: FatFsdRead
0x1C0020828: "__cdecl _imp_CcPrepareMdlWrite" __imp_CcPrepareMdlWrite
0x1C004FA8C: EfsInitialization
0x1C0043588: FatOplockRequest
0x1C0007928: EfsInitFekProtection
0x1C005BFDC: EEL_FreeProcessInfo
0x1C0059BFC: EfsAcquireRpcHandle
0x1C0037834: FatGetEaLength
0x1C00107E8: ".PFILE" ??_C@_1O@GFOGDNFF@?$AA?4?$AAP?$AAF?$AAI?$AAL?$AAE?$AA?$AA@
0x1C0020228: "__cdecl _imp_FsRtlNotifyFullChangeDirectory" __imp_FsRtlNotifyFullChangeDirectory
0x1C0020550: "__cdecl _imp_FsRtlFastCheckLockForRead" __imp_FsRtlFastCheckLockForRead
0x1C0048D74: FatAcquireExclusiveFcb
0x1C005A680: EfsKRpcDecryptFek
0x1C0020910: "__cdecl _imp_RtlInitializeBitMap" __imp_RtlInitializeBitMap
0x1C0020340: "__cdecl _imp_FsRtlCurrentBatchOplock" __imp_FsRtlCurrentBatchOplock
0x1C0001E70: FatMultiSyncCompletionRoutine
0x1C000A4C4: GetEnterpriseContext
0x1C0048E48: FatAcquireSharedFcb
0x1C00021C0: FatPagingFileCompletionRoutineCatch
0x1C0001130: FatInitializeCacheMap
0x1C00016A0: FatHijackCompletionRoutine
0x1C005C0D0: "void __cdecl TlgAggregateInternalFlushWorkItemRoutineKernelMode(void * __ptr64)" ?TlgAggregateInternalFlushWorkItemRoutineKernelMode@@YAXPEAX@Z
0x1C0010A04: "\" ??_C@_13FPGAJAPJ@?$AA?2?$AA?$AA@
0x1C0048D2C: FatAcquireSharedVcb
0x1C0004BC0: FatFlushCompletionRoutine
0x1C0050F34: EfsTriggerServiceStart
0x1C0040DA4: FatFlushDirectory
0x1C004B7AC: FatRemoveNames
0x1C0036CA4: FatRescanDirectory
0x1C000A39C: SrpDeleteEnterpriseContext
0x1C000AD20: desexpand128to192
0x1C0020538: "__cdecl _imp_IoGetDeviceToVerify" __imp_IoGetDeviceToVerify
0x1C00200E0: "__cdecl _imp_RpcBindingFree" __imp_RpcBindingFree
0x1C0024748: FatTearDownAllocationSupport
0x1C0020370: "__cdecl _imp_MmDoesFileHaveUserWritableReferences" __imp_MmDoesFileHaveUserWritableReferences
0x1C0020540: "__cdecl _imp_IoSetDeviceToVerify" __imp_IoSetDeviceToVerify
0x1C003DE7C: FatSetDispositionInfo
0x1C00203C8: "__cdecl _imp_IoMakeAssociatedIrp" __imp_IoMakeAssociatedIrp
0x1C00050B0: FatDismountVolume
0x1C0031744: FatSingleAsync
0x1C0001D0C: FatUpdateDiskStats
0x1C0049CBC: FatDeleteVcb
0x1C0012D00: T3
0x1C0013100: U3
0x1C004A924: FatDeleteFcb
0x1C0057B90: EfspGetSetPFileInfo
0x1C000E0C0: ext_ms_win_crypto_xbox_l1_1_0_XboxCryptoCreateEfsKey
0x1C00490C0: FatReleaseFcbFromReadAhead
0x1C002D4C8: FatOpenTargetDirectory
0x1C000B720: rijndaelKeyEncToDec
0x1C0046760: FatFastUnlockAll
0x1C003551C: FatFileExtensionIsPfile
0x1C0010CCC: "NA" ??_C@_15FIMHAKBI@?$AAN?$AAA?$AA?$AA@
0x1C00247B8: FatLookupFileAllocation
0x1C0020108: "__cdecl _imp_KeClearEvent" __imp_KeClearEvent
0x1C0024050: FatCheckManageVolumeAccess
0x1C00203A0: "__cdecl _imp_IoIs32bitProcess" __imp_IoIs32bitProcess
0x1C004B478: FatIsHandleCountZero
0x1C0020A58: "__cdecl _imp_RtlEqualUnicodeString" __imp_RtlEqualUnicodeString
0x1C0035260: FatIsDirectoryEmpty
0x1C00202B8: "__cdecl _imp_FsRtlDissectName" __imp_FsRtlDissectName
0x1C0036240: FatConstructDirent
0x1C0010AF0: "MaximumBlob" ??_C@_1BI@MFFIBPCB@?$AAM?$AAa?$AAx?$AAi?$AAm?$AAu?$AAm?$AAB?$AAl?$AAo?$AAb?$AA?$AA@
0x1C001CB0C: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUuhUvuhUikxUxorvmgPpnUlyquivUznwGEUkivxlnkOlyq@efsrpc_c_km" __@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUuhUvuhUikxUxorvmgPpnUlyquivUznwGEUkivxlnkOlyq@efsrpc_c_km
0x1C0039AAC: FatPinEaRange
0x1C0006C28: "__cdecl TlgDefineProvider_annotation__Tlgg_hEfsRpcTelemetryProviderProv" _TlgDefineProvider_annotation__Tlgg_hEfsRpcTelemetryProviderProv
0x1C00250D4: FatLookupFileAllocationSize
0x1C0020950: "__cdecl _imp_SeReleaseSubjectContext" __imp_SeReleaseSubjectContext
0x1C0047D28: FatPnpCancelRemove
0x1C0009450: EfsAesDec
0x1C0046C70: Fat8dot3ToString
0x1C0010830: FatTimeJanOne1980
0x1C0020450: "__cdecl _imp_MmMdlPageContentsState" __imp_MmMdlPageContentsState
0x1C0007460: EfsPreOffloadingCrypto
0x1C0049080: FatAcquireFcbForReadAhead
0x1C000AC18: InitSubjectByTokenPointer
0x1C00204C8: "__cdecl _imp_RtlCompareString" __imp_RtlCompareString
0x1C00209E0: "__cdecl _imp_ZwDeviceIoControlFile" __imp_ZwDeviceIoControlFile
0x1C005113C: EfspFileRequiresEncryption
0x1C0020420: "__cdecl _imp_ExInterlockedAddUlong" __imp_ExInterlockedAddUlong
0x1C0020058: "__cdecl _imp_BCryptSetProperty" __imp_BCryptSetProperty
0x1C0063B20: GsDriverEntry
0x1C0020B38: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x1C0029B14: FatCommonClose
0x1C0053FD4: EfspPostCreate
0x1C0037770: FatFsdSetEa
0x1C0045E44: FatVerifyLookupFatEntry
0x1C00268A0: FatSetFatRun
0x1C0020098: "__cdecl _imp_BCryptGetProperty" __imp_BCryptGetProperty
0x1C003C894: FatPopUpFileCorrupt
0x1C002FE44: FatCheckSystemSecurityAccess
0x1C00200A8: "__cdecl _imp_BCryptEncrypt" __imp_BCryptEncrypt
0x1C0052AF0: EfsCleanup
0x1C0020768: "__cdecl _imp_FsRtlNotifyInitializeSync" __imp_FsRtlNotifyInitializeSync
0x1C00405A8: FatDecodeFileObject
0x1C001C3C0: FatNonPagedFcbLookasideList
0x1C0043144: FatUserFsCtrl
0x1C005531C: EfsSameContext
0x1C003AE94: FatWriteRawEncrypted
0x1C003B9F4: FatGetEfsInfoFromHeaderOnDisk
0x1C00206A0: "__cdecl _imp_ObReferenceObjectByHandle" __imp_ObReferenceObjectByHandle
0x1C0006C28: "__cdecl TlgDefineProvider_annotation__Tlgg_hEfsLibTraceLoggingProviderProv" _TlgDefineProvider_annotation__Tlgg_hEfsLibTraceLoggingProviderProv
0x1C0027BEC: FatOpenDirectoryFile
0x1C00204E0: "__cdecl _imp_CcCopyWrite" __imp_CcCopyWrite
0x1C0010DB8: "ChainingMode" ??_C@_1BK@BCJKEJJO@?$AAC?$AAh?$AAa?$AAi?$AAn?$AAi?$AAn?$AAg?$AAM?$AAo?$AAd?$AAe?$AA?$AA@
0x1C0002AF4: EfsBeforeWriteProcessCallback
0x1C00413BC: FatFlushVolume
0x1C0015790: "Unlocked" ??_C@_1BC@FGDBBGFP@?$AAU?$AAn?$AAl?$AAo?$AAc?$AAk?$AAe?$AAd?$AA?$AA@
0x1C0020070: "__cdecl _imp_BCryptDestroyHash" __imp_BCryptDestroyHash
0x1C00403D8: FatDeleteFile
0x1C0039C98: FatMarkEaRangeDirty
0x1C0020708: "__cdecl _imp_FsRtlCheckLockForReadAccess" __imp_FsRtlCheckLockForReadAccess
0x1C0059E04: EfsDecryptFekClient
0x1C0026250: FatInterpretClusterType
0x1C003C6C0: FatFastQueryNetworkOpenInfo
0x1C0020148: "__cdecl _imp_CcInitializeCacheMap" __imp_CcInitializeCacheMap
0x1C0020230: "__cdecl _imp_FsRtlNotifyCleanup" __imp_FsRtlNotifyCleanup
0x1C001C4C0: EfsData
0x1C00550DC: EfsDeleteEfsData
0x1C0010C38: "EfsOptions" ??_C@_1BG@FMCCNKAB@?$AAE?$AAf?$AAs?$AAO?$AAp?$AAt?$AAi?$AAo?$AAn?$AAs?$AA?$AA@
0x1C00207B0: "__cdecl _imp_FsRtlUninitializeFileLock" __imp_FsRtlUninitializeFileLock
0x1C0007590: EfsResetStreamTransition
0x1C0020348: "__cdecl _imp_MmFlushImageSection" __imp_MmFlushImageSection
0x1C0052820: EfsOpenEncryptOnCloseFile
0x1C0020160: "__cdecl _imp_CcPinRead" __imp_CcPinRead
0x1C004026C: FatRenameEAs
0x1C005C760: "void __cdecl TlgAggregateInternalRegisteredProviderEtwCallback(struct _GUID const * __ptr64,unsigned long,unsigned char,unsigned __int64,unsigned __int64,struct _EVENT_FILTER_DESCRIPTOR * __ptr64,void * __ptr64)" ?TlgAggregateInternalRegisteredProviderEtwCallback@@YAXPEBU_GUID@@KE_K1PEAU_EVENT_FILTER_DESCRIPTOR@@PEAX@Z
0x1C000A698: QueryEnterpriseIds
0x1C000A39C: SrpDeleteEnterpriseId
0x1C004B9C4: FatNtTimeToFatTime
0x1C0020110: "__cdecl _imp_IoBuildSynchronousFsdRequest" __imp_IoBuildSynchronousFsdRequest
0x1C0058C6C: EdppQueueWorkItem
0x1C0004AB0: FatLoadAddOns
0x1C00087F0: DplWrapUnprotect
0x1C0010C58: WNF_EFS_SOFTWARE_HIVE_AVAILABLE
0x1C0010EF0: "\Registry\Machine\Software\Micro" ??_C@_1JK@MEEOLNOJ@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x1C0058E5C: EdppCreateContextBlock
0x1C0031B54: FatMapUserBuffer
0x1C004C014: FatVerifyFcb
0x1C0020278: "__cdecl _imp_FsRtlNotifyVolumeEvent" __imp_FsRtlNotifyVolumeEvent
0x1C004BE7C: FatVerifyVcb
0x1C001C300: FatCloseContextSList
0x1C0058014: EfspGetSetEfsInfo
0x1C0020620: "__cdecl _imp_ZwQueryValueKey" __imp_ZwQueryValueKey
0x1C0010C70: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x1C0010E70: "EFSSTRFT" ??_C@_08PMHBCIAA@EFSSTRFT?$AA@
0x1C001081C: ExtendedEncryptedDataInfoSignature
0x1C004F970: "__cdecl TlgEnableCallback" _TlgEnableCallback
0x1C0002ABC: EfsAfterReadProcessCallback
0x1C00399D8: FatLocateEaByName
0x1C00555F8: EfsEncryptOrDecryptStreamWithKeyblob
0x1C0020A20: "__cdecl _imp_PsRevertToSelf" __imp_PsRevertToSelf
0x1C005619C: EfsEncryptDir
0x1C003653C: FatConstructLabelDirent
0x1C000E0A0: "__cdecl _report_rangecheckfailure" __report_rangecheckfailure
0x1C00562A4: EfsModifyEfsState
0x1C00200D0: "__cdecl _imp_I_RpcExceptionFilter" __imp_I_RpcExceptionFilter
0x1C0020A28: "__cdecl _imp_FsRtlGetEcpListFromIrp" __imp_FsRtlGetEcpListFromIrp
0x1C004ABF0: FatDeallocateCcbStrings
0x1C00074C0: EfsPostOffloadingCrypto
0x1C0004AD4: FatExceptionFilter
0x1C00351DC: FatGetDirentFromFcbOrDcb
0x1C0020940: "__cdecl _imp_IoGetFileObjectGenericMapping" __imp_IoGetFileObjectGenericMapping
0x1C0010CA8: "EdpExcludedPaths" ??_C@_1CC@LJBAIEIH@?$AAE?$AAd?$AAp?$AAE?$AAx?$AAc?$AAl?$AAu?$AAd?$AAe?$AAd?$AAP?$AAa?$AAt?$AAh?$AAs?$AA?$AA@
0x1C0020418: "__cdecl _imp_MmUnlockPages" __imp_MmUnlockPages
0x1C00200A0: "__cdecl _imp_BCryptKeyDerivation" __imp_BCryptKeyDerivation
0x1C002D660: FatOpenExistingDirectory
0x1C0020990: "__cdecl _imp_ExInitializePagedLookasideList" __imp_ExInitializePagedLookasideList
0x1C001C1F0: Fat8QMdot3QM
0x1C00204D8: "__cdecl _imp_NlsOemLeadByteInfo" __imp_NlsOemLeadByteInfo
0x1C0053D60: EfsFilePostCreate
0x1C0047BDC: FatPnpSurpriseRemove
0x1C0052E68: EfspHasTCBPrivilege
0x1C000AE60: deskey
0x1C0058750: EdppReadExclusions
0x1C00202E0: "__cdecl _imp_RtlCompareUnicodeString" __imp_RtlCompareUnicodeString
0x1C000C100: aeskey
0x1C0047884: FatPnpQueryRemove
0x1C0020920: "__cdecl _imp_SeFilterToken" __imp_SeFilterToken
0x1C0002C08: EfsSetEfsInfoCallback
0x1C000E060: "__cdecl _security_check_cookie" __security_check_cookie
0x1C00502B4: EfsWaitForServiceReady
0x1C0020050: "__cdecl _imp_BCryptExportKey" __imp_BCryptExportKey
0x1C0010E40: ".pfile" ??_C@_06PPCIPIED@?4pfile?$AA@
0x1C0020A90: "__cdecl _imp_ZwQuerySecurityAttributesToken" __imp_ZwQuerySecurityAttributesToken
0x1C00579AC: EfspGetSetEfsStreamTransitionMetadata
0x1C0020880: "__cdecl _imp_FsRtlNumberOfRunsInLargeMcb" __imp_FsRtlNumberOfRunsInLargeMcb
0x1C001CAEC: g_RpcReconnecting
0x1C0020490: "__cdecl _imp_FsRtlAddToTunnelCache" __imp_FsRtlAddToTunnelCache
0x1C000A974: GetPointersOfAttributesValues
0x1C0027E18: FatCloseEaFile
0x1C0029FA0: FatFsdCreate
0x1C000A2B4: SrpGetEnterpriseContextToken
0x1C0020170: "__cdecl _imp_IoCreateStreamFileObject" __imp_IoCreateStreamFileObject
0x1C0020B48: "__cdecl _IMPORT_DESCRIPTOR_ntoskrnl" __IMPORT_DESCRIPTOR_ntoskrnl
0x1C000A168: SrpCreateEnterpriseContext
0x1C0020A50: "__cdecl _imp_KdDebuggerEnabled" __imp_KdDebuggerEnabled
0x1C0052A30: EfsDeleteContextOnError
0x1C004D018: FatSetFsLabelInfo
0x1C00454A0: FatComputeMoveFileSplicePoints
0x1C0047EE0: FatStackOverflowRead
0x1C00090D0: EfsDesEnc
0x1C004AEF8: FatGetNextFcbTopDown
0x1C0020288: "__cdecl _imp_IoReleaseVpbSpinLock" __imp_IoReleaseVpbSpinLock
0x1C00206D0: "__cdecl _imp_FsRtlAreThereWaitingFileLocks" __imp_FsRtlAreThereWaitingFileLocks
0x1C00170C2: "__cdecl TraceLoggingMetadataEnd" _TraceLoggingMetadataEnd
0x1C0010814: "$EFS" ??_C@_04EENHNGMM@$EFS?$AA@
0x1C00305C0: FatFsdDeviceControl
0x1C0020358: "__cdecl _imp_CcPreparePinWrite" __imp_CcPreparePinWrite
0x1C0004A64: FatReadRawExceptionFilter
0x1C0005E60: FatAdjustAllCleanVolumeTimers
0x1C0027E9C: FatRepinBcb
0x1C004B568: FatFreeStringBuffer
0x1C0020B84: "__cdecl _IMPORT_DESCRIPTOR_ext-ms-win-ntos-clipsp-l1-1-0" __IMPORT_DESCRIPTOR_ext-ms-win-ntos-clipsp-l1-1-0
0x1C0020B5C: "__cdecl _IMPORT_DESCRIPTOR_msrpc" __IMPORT_DESCRIPTOR_msrpc
0x1C0047670: FatFsdPnp
0x1C004A214: FatCreateFcb
0x1C0020040: "__cdecl _imp_ClipSpInitialize" __imp_ClipSpInitialize
0x1C00052E8: FatInvalidateVolumes
0x1C00408A0: FatFsdFlushBuffers
0x1C005A0FC: EfsGenerateKeyClient
0x1C0020328: "__cdecl _imp_FsRtlOplockBreakH" __imp_FsRtlOplockBreakH
0x1C0020320: "__cdecl _imp_IoSetShareAccess" __imp_IoSetShareAccess
0x1C003A084: FatSetEncryption
0x1C00107D8: ".. " ??_C@_0M@JBDBKIFA@?4?4?5?5?5?5?5?5?5?5?5?$AA@
0x1C0006E40: EfsWrite
0x1C0052B10: EfsGetEfsStreamInfo
0x1C00203D0: "__cdecl _imp_KeDelayExecutionThread" __imp_KeDelayExecutionThread
0x1C0020638: "__cdecl _imp_FsRtlCurrentOplockH" __imp_FsRtlCurrentOplockH
0x1C0004E7C: FatLockVolumeInternal
0x1C0033C4C: FatDeleteDirent
0x1C005A610: EfsNotifyEnterpriseFileCleanupClient
0x1C0009390: EfsDes3Dec
0x1C0059AD4: EfsRpcInit
0x1C0035448: FatConvertQueryStringTo8dot3
0x1C0020560: "__cdecl _imp_IoRaiseInformationalHardError" __imp_IoRaiseInformationalHardError
0x1C002A190: FatCommonCreateCallout
0x1C004F9F0: TraceLoggingRegisterEx
0x1C005AF64: EdpEnforcementLog_AutomaticEncryption
0x1C0020A98: "__cdecl _imp_SeQuerySecurityAttributesTokenAccessInformation" __imp_SeQuerySecurityAttributesTokenAccessInformation
0x1C0020AF0: "__cdecl _imp_ExReleaseSpinLockShared" __imp_ExReleaseSpinLockShared
0x1C0027D54: FatOpenEaFile
0x1C0020970: "__cdecl _imp_ZwOpenEvent" __imp_ZwOpenEvent
0x1C0005A18: FatAllocateResource
0x1C0001178: FatOpenFileHeader
0x1C00588AC: EdppBuildExclusionsList
0x1C0031A58: FatLockUserBuffer
0x1C001CAF0: g_RpcBindingHandle
0x1C00107C0: FatSecurityPrivilege
0x1C0006C28: "__cdecl TlgDefineProvider_annotation__Tlgg_hEelProviderProv" _TlgDefineProvider_annotation__Tlgg_hEelProviderProv
0x1C003BD08: FatProcessException
0x1C00419F0: FatCommonFileSystemControl
0x1C0042728: FatVerifyVolume
0x1C000A3C0: SrpGetEnterpriseContext
0x1C0043080: FatIsMediaWriteProtected
0x1C0057504: EfsRefreshCache
0x1C0020508: "__cdecl _imp_ProbeForWrite" __imp_ProbeForWrite
0x1C00282AC: FatCompleteMdl
0x1C0020A88: "__cdecl _imp_SeQuerySecurityAttributesToken" __imp_SeQuerySecurityAttributesToken
0x1C0020840: "__cdecl _imp_EtwUnregister" __imp_EtwUnregister
0x1C001C0A8: $EFS
0x1C0020038: ext-ms-win-crypto-xbox-l1-1-0_NULL_THUNK_DATA
0x1C0064000: "__cdecl _guard_fids_table" __guard_fids_table
0x1C0059794: EfspCreateFileLicenseHeaderAndKey
0x1C00208A0: "__cdecl _imp_ExAcquireResourceExclusiveLite" __imp_ExAcquireResourceExclusiveLite
0x1C0010B28: "\Device\KsecDD" ??_C@_1BO@BAEMGIAB@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAK?$AAs?$AAe?$AAc?$AAD?$AAD?$AA?$AA@
0x1C0049030: FatReleaseFcbFromLazyWrite
0x1C00202F8: "__cdecl _imp_FsRtlLegalAnsiCharacterArray" __imp_FsRtlLegalAnsiCharacterArray
0x1C0010690: "__cdecl load_config_used" _load_config_used
0x1C0020AC0: "__cdecl _imp_ExDeleteTimer" __imp_ExDeleteTimer
0x1C00203A8: "__cdecl _imp_PsUpdateDiskCounters" __imp_PsUpdateDiskCounters
0x1C00303C8: FatCreateEncryptOnCloseProcessing
0x1C0020A70: "__cdecl _imp_ZwQueryInformationProcess" __imp_ZwQueryInformationProcess
0x1C00204D0: NlsMbOemCodePageTag
0x1C00205A8: "__cdecl _imp_FsRtlRegisterFileSystemFilterCallbacks" __imp_FsRtlRegisterFileSystemFilterCallbacks
0x1C003D53C: FatQueryInternalInfo
0x1C00157A8: "Invalid value for Dpl State" ??_C@_1DI@IBDEAEKF@?$AAI?$AAn?$AAv?$AAa?$AAl?$AAi?$AAd?$AA?5?$AAv?$AAa?$AAl?$AAu?$AAe?$AA?5?$AAf?$AAo?$AAr?$AA?5?$AAD?$AAp?$AAl?$AA?5?$AAS?$AAt?$AAa?$AAt?$AAe?$AA?$AA@
0x1C00209D8: "__cdecl _imp_ZwOpenProcessTokenEx" __imp_ZwOpenProcessTokenEx
0x1C0002DB8: NtOfsMapAttribute
0x1C0020968: "__cdecl _imp_RtlUpperString" __imp_RtlUpperString
0x1C0027750: FatReadVolumeFile
0x1C003C270: FatFastIoCheckIfPossible
0x1C0005A88: FatFreeResource
0x1C0010E80: "Override flag is set" ??_C@_1CK@JNIEMAOO@?$AAO?$AAv?$AAe?$AAr?$AAr?$AAi?$AAd?$AAe?$AA?5?$AAf?$AAl?$AAa?$AAg?$AA?5?$AAi?$AAs?$AA?5?$AAs?$AAe?$AAt?$AA?$AA@
0x1C0046BDC: FatStringTo8dot3
0x1C0020628: "__cdecl _imp_ZwClose" __imp_ZwClose
0x1C00207C0: "__cdecl _imp_RtlDelete" __imp_RtlDelete
0x1C0033940: FatInitializeDirectoryDirent
0x1C0020AE8: "__cdecl _imp_ExReleasePushLockExclusiveEx" __imp_ExReleasePushLockExclusiveEx
0x1C00293B0: FatFsdClose
0x1C000AC94: DeinitSubjectWithTokenPointer
0x1C0020760: "__cdecl _imp_FsRtlInitializeTunnelCache" __imp_FsRtlInitializeTunnelCache
0x1C0010B68: "\Registry\Machine\Software" ??_C@_1DG@NGKIBMLA@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?$AA@
0x1C0058D70: EdppNotifyEnterpriseFileWrite
0x1C0009330: EfsDes3Enc
0x1C0055EF0: EfsSetStreamEncryptionStatus
0x1C0020A48: "__cdecl _imp_PsDereferenceImpersonationToken" __imp_PsDereferenceImpersonationToken
0x1C0006C34: FatInitializePerVolumeTelemetry
0x1C0031BB8: FatPerformDevIoCtrl
0x1C002612C: FatMergeAllocation
0x1C0020958: "__cdecl _imp_SeLockSubjectContext" __imp_SeLockSubjectContext
0x1C0020088: "__cdecl _imp_BCryptOpenAlgorithmProvider" __imp_BCryptOpenAlgorithmProvider
0x1C00458DC: FatMarkHandle
0x1C0010A60: "\Registry\Machine\System\Current" ??_C@_1JA@JIDNFDKA@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1C001C218: FatDecThirtyOne1979
0x1C00206A8: IoFileObjectType
0x1C00209B0: "__cdecl _imp_NtClose" __imp_NtClose
0x1C0015780: "Locked" ??_C@_1O@EEOCOOLO@?$AAL?$AAo?$AAc?$AAk?$AAe?$AAd?$AA?$AA@
0x1C0020878: "__cdecl _imp_KeInitializeEvent" __imp_KeInitializeEvent
0x1C0020A78: "__cdecl _imp_ObOpenObjectByPointer" __imp_ObOpenObjectByPointer
0x1C0020AB8: "__cdecl _imp_ExReleaseSpinLockExclusive" __imp_ExReleaseSpinLockExclusive
0x1C004B8A0: FatFindFcb
0x1C005C6F0: "void __cdecl TlgAggregateInternalProviderCallback(struct _GUID const * __ptr64,unsigned long,unsigned char,unsigned __int64,unsigned __int64,struct _EVENT_FILTER_DESCRIPTOR * __ptr64,void * __ptr64)" ?TlgAggregateInternalProviderCallback@@YAXPEBU_GUID@@KE_K1PEAU_EVENT_FILTER_DESCRIPTOR@@PEAX@Z
0x1C0020AD0: "__cdecl _imp_ExTryAcquirePushLockExclusiveEx" __imp_ExTryAcquirePushLockExclusiveEx
0x1C0041438: FatFlushFile
0x1C001C990: g_kernelCallbacks
0x1C0020080: "__cdecl _imp_BCryptGenRandom" __imp_BCryptGenRandom
0x1C00200B0: "__cdecl _imp_BCryptGenerateSymmetricKey" __imp_BCryptGenerateSymmetricKey
0x1C0001F30: FatMultiAsyncCompletionRoutine
0x1C0006290: FatCoalescingCallback
0x1C0057948: EfspGetEfsStreamForWrite
0x1C003C1C0: FatCompleteRequest_Real
0x1C00201E8: "__cdecl _imp_CcMdlWriteComplete" __imp_CcMdlWriteComplete
0x1C0031464: FatMultipleAsync
0x1C0006D60: EfsRead
0x1C0020A40: "__cdecl _imp_RtlEqualSid" __imp_RtlEqualSid
0x1C0059540: EfspTraceLogAssert
0x1C00200C8: ksecdd_NULL_THUNK_DATA
0x1C0010D00: "ObjectLength" ??_C@_1BK@GPNIFMAA@?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAL?$AAe?$AAn?$AAg?$AAt?$AAh?$AA?$AA@
0x1C00024E0: FatToggleMediaEjectDisable
0x1C0011CF0: double_shift
0x1C003A5F4: FatReadRawEncrypted
0x1C000A414: SrpGetEvaluationFlags
0x1C0003144: NtOfsCreateAttributeEx
0x1C0057B1C: EfspValidatePFileHeaderMetadata
0x1C0045F3C: FatScanForDismountedVcb
0x1C0020338: "__cdecl _imp_IoUpdateShareAccess" __imp_IoUpdateShareAccess
0x1C00205E0: "__cdecl _imp_InitializeSListHead" __imp_InitializeSListHead
0x1C00204A0: "__cdecl _imp_FsRtlIsNameInExpression" __imp_FsRtlIsNameInExpression
0x1C0020408: "__cdecl _imp_IoFreeIrp" __imp_IoFreeIrp
0x1C0009570: EfsAesDec_RSA32K
0x1C00206C8: "__cdecl _imp_FsRtlFastUnlockAllByKey" __imp_FsRtlFastUnlockAllByKey
0x1C004A5CC: FatCreateDcb
0x1C0005DD0: FatRemovePfileExtension
0x1C0020608: "__cdecl _imp_ExDeleteNPagedLookasideList" __imp_ExDeleteNPagedLookasideList
0x1C0010D58: "DplWrap-Enc-AES-CBC" ??_C@_0BE@FNNADDIP@DplWrap?9Enc?9AES?9CBC?$AA@
0x1C001C0B8: $EFS_SHORT
0x1C00398A8: FatAppendPackedEa
0x1C00465F0: FatFastUnlockSingle
0x1C00637C8: FatGetCompatibilityModeValue
0x1C0002F18: NtOfsPutData
0x1C0039DB4: FatEncryptionFsctl
0x1C0006BC0: FatDeferredFlushDpc
0x1C0010EB0: "Override flag is not set" ??_C@_1DC@BKEMIHGK@?$AAO?$AAv?$AAe?$AAr?$AAr?$AAi?$AAd?$AAe?$AA?5?$AAf?$AAl?$AAa?$AAg?$AA?5?$AAi?$AAs?$AA?5?$AAn?$AAo?$AAt?$AA?5?$AAs?$AAe?$AAt?$AA?$AA@
0x1C004F150: FatDeferredFlush
0x1C004F7EC: FatTelemetryPeriodicVolume
0x1C0020B00: "__cdecl _imp_ExAcquireSpinLockSharedAtDpcLevel" __imp_ExAcquireSpinLockSharedAtDpcLevel
0x1C005A7E0: MIDL_user_allocate
0x1C000E0F0: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x1C000E240: memcmp
0x1C0020A08: "__cdecl _imp_wcsrchr" __imp_wcsrchr
0x1C00202C8: "__cdecl _imp_RtlDowncaseUnicodeString" __imp_RtlDowncaseUnicodeString
0x1C00204C0: "__cdecl _imp_MmMapLockedPagesSpecifyCache" __imp_MmMapLockedPagesSpecifyCache
0x1C0026028: FatSplitAllocation
0x1C00539A0: EfsKeyControl
0x1C0020018: "__cdecl _imp_XboxCryptoSupported" __imp_XboxCryptoSupported
0x1C002866C: FatCommonCleanup
0x1C0006C28: "__cdecl TlgDefineProvider_annotation__TlgFatTelemetryProviderProv" _TlgDefineProvider_annotation__TlgFatTelemetryProviderProv
0x1C0057720: EfspGetHeaderType
0x1C00262B4: FatLookupFatEntry
0x1C001C440: FatIrpContextLookasideList
0x1C001C000: EFSCallBackTable
0x1C004AC70: FatCreateIrpContext
0x1C0005618: FatSetZeroOnDeallocate
0x1C0002C50: EfsFileRequiresEncryptionCallback
0x1C003D3D4: FatQueryBasicInfo
0x1C001C2C0: FatLargeZero
0x1C0010828: FatOneDay
0x1C004BC40: FatFatTimeToNtTime
0x1C0020510: "__cdecl _imp_IoGetRelatedDeviceObject" __imp_IoGetRelatedDeviceObject
0x1C005983C: EfspClipSpDecryptFek
0x1C0020B70: "__cdecl _IMPORT_DESCRIPTOR_ksecdd" __IMPORT_DESCRIPTOR_ksecdd
0x1C0058A2C: EdppIsExcludedPath
0x1C0002D7C: EfsLastCloseEncryptOnCloseFileCallback
0x1C0010F90: "NoCryptoOffload" ??_C@_1CA@PPNMPPIJ@?$AAN?$AAo?$AAC?$AAr?$AAy?$AAp?$AAt?$AAo?$AAO?$AAf?$AAf?$AAl?$AAo?$AAa?$AAd?$AA?$AA@
0x1C0006C60: EfspDevCryptoSetup
0x1C004C160: FatDeferredCleanVolume
0x1C0013A80: T8
0x1C00200D8: "__cdecl _imp_RpcBindingBind" __imp_RpcBindingBind
0x1C0020598: "__cdecl _imp_FsRtlPrepareMdlWriteDev" __imp_FsRtlPrepareMdlWriteDev
0x1C0010CD8: "SP800_108_CTR_HMAC" ??_C@_1CG@GKFGHMMK@?$AAS?$AAP?$AA8?$AA0?$AA0?$AA_?$AA1?$AA0?$AA8?$AA_?$AAC?$AAT?$AAR?$AA_?$AAH?$AAM?$AAA?$AAC?$AA?$AA@
0x1C0004A04: NtOfsFlushAttribute
0x1C00206B8: "__cdecl _imp_FsRtlPrivateLock" __imp_FsRtlPrivateLock
0x1C00208C8: "__cdecl _imp_ExAcquireResourceSharedLite" __imp_ExAcquireResourceSharedLite
0x1C001CAE8: g_RpcBindingHandleReference
0x1C003D4B8: FatQueryStandardInfo
0x1C0046000: FatFspDispatch
0x1C0020368: "__cdecl _imp_SeSinglePrivilegeCheck" __imp_SeSinglePrivilegeCheck
0x1C002CB84: FatOpenExistingFcb
0x1C0005024: FatUnlockVolumeInternal
0x1C004CAD0: FatFsdSetVolumeInformation
0x1C0041A78: FatMountVolume
0x1C00208F0: "__cdecl _imp_KeBugCheckEx" __imp_KeBugCheckEx
0x1C0020520: "__cdecl _imp_CcSetFileSizesEx" __imp_CcSetFileSizesEx
0x1C00207A8: "__cdecl _imp_FsRtlUninitializeOplock" __imp_FsRtlUninitializeOplock
0x1C0057408: EfsFindInCache
0x1C00093E0: EfsAesEnc
0x1C0005D1C: FatAppendPfileExtension
0x1C00457B4: FatGetBootAreaInfo
0x1C0010A40: SQM_ADD_STREAMROW_EX
0x1C0020190: "__cdecl _imp_CcSetAdditionalCacheAttributes" __imp_CcSetAdditionalCacheAttributes
0x1C004AFB0: FatConstructNamesInFcb
0x1C0045D30: FatSearchBufferForLabel
0x1C0020AB0: "__cdecl _imp_ExSetTimer" __imp_ExSetTimer
0x1C004BD50: FatMarkFcbCondition
0x1C0055FC8: EfsDecryptFile
0x1C003D5BC: FatQueryNameInfo
0x1C00016D0: FatDeviceControlCompletionRoutine
0x1C00207D0: "__cdecl _imp_RtlTimeToTimeFields" __imp_RtlTimeToTimeFields
0x1C004ABA0: FatCreateCcb
0x1C001C2D0: FatReserveMdl
0x1C0020198: "__cdecl _imp_KeAcquireSpinLockRaiseToDpc" __imp_KeAcquireSpinLockRaiseToDpc
0x1C0020000: "__cdecl _imp_KeQueryPerformanceCounter" __imp_KeQueryPerformanceCounter
0x1C0020648: "__cdecl _imp_FsRtlLookupLastLargeMcbEntryAndIndex" __imp_FsRtlLookupLastLargeMcbEntryAndIndex
0x1C0002270: FatPagingFileCompletionRoutine
0x1C0020688: "__cdecl _imp_ExIsResourceAcquiredExclusiveLite" __imp_ExIsResourceAcquiredExclusiveLite
0x1C0020360: "__cdecl _imp_MmCanFileBeTruncated" __imp_MmCanFileBeTruncated
0x1C0047FD0: FatCommonRead
0x1C0020668: "__cdecl _imp_IoVolumeDeviceToGuidPath" __imp_IoVolumeDeviceToGuidPath
0x1C00208B0: "__cdecl _imp_ExReleaseResourceLite" __imp_ExReleaseResourceLite
0x1C0020318: "__cdecl _imp_IoCheckShareAccess" __imp_IoCheckShareAccess
0x1C0020870: "__cdecl _imp_SeUnlockSubjectContext" __imp_SeUnlockSubjectContext
0x1C0033A80: FatTunnelFcbOrDcb
0x1C0020780: "__cdecl _imp_FsRtlTeardownPerStreamContexts" __imp_FsRtlTeardownPerStreamContexts
0x1C001C1E0: "__cdecl _security_cookie" __security_cookie
0x1C005A780: EfsKRpcGenerateDirEfs
0x1C0010C60: SupportedAlgIds
0x1C0020A50: KdDebuggerEnabled
0x1C00201A8: "__cdecl _imp_KeCancelTimer" __imp_KeCancelTimer
0x1C0009EBC: EfspIsStreamNameInStreamTransitionMetadata
0x1C003096C: FatNonCachedIo
0x1C0031894: FatSingleNonAlignedSync
0x1C0054CE0: EfsReadEfsData
0x1C0010C50: WNF_EFS_SERVICE_START
0x1C0020630: "__cdecl _imp_RtlCompareMemory" __imp_RtlCompareMemory
0x1C0006908: FatFsdPostRequest
0x1C0009984: EfspIsAesKeyValid
0x1C00205F0: "__cdecl _imp_PsIsDiskCountersEnabled" __imp_PsIsDiskCountersEnabled
0x1C0010A08: "\" ??_C@_01KICIPPFI@?2?$AA@
0x1C00240C0: FatExplicitDeviceAccessGranted
0x1C0020280: "__cdecl _imp_IoAcquireVpbSpinLock" __imp_IoAcquireVpbSpinLock
0x1C0020578: "__cdecl _imp_FsRtlCopyRead" __imp_FsRtlCopyRead
0x1C0002BC0: EfsGetEfsInfoCallback
0x1C0020248: "__cdecl _imp_FsRtlNotifyFullReportChange" __imp_FsRtlNotifyFullReportChange
0x1C000CDF0: TransformMD5
0x1C0002630: FatBuildZeroMdl
0x1C0020188: "__cdecl _imp_CcUninitializeCacheMap" __imp_CcUninitializeCacheMap
0x1C0045C3C: FatSetPurgeFailureMode
0x1C0059078: EfspCreateStreamTransitionMetadata
0x1C00202C0: "__cdecl _imp_RtlUpcaseUnicodeStringToCountedOemString" __imp_RtlUpcaseUnicodeStringToCountedOemString
0x1C005A840: EEL_EtwEventHandler
0x1C0010E60: "EFSSTRAN" ??_C@_08EJBDMEFO@EFSSTRAN?$AA@
0x1C0020770: "__cdecl _imp_KeInitializeTimer" __imp_KeInitializeTimer
0x1C004CF3C: FatQueryFsAttributeInfo
0x1C004B4B8: FatAllocateCloseContext
0x1C0020820: "__cdecl _imp_CcCopyWriteEx" __imp_CcCopyWriteEx
0x1C003CA94: FatCommonQueryInformation
0x1C0026F90: FatExamineFatEntries
0x1C0033F80: FatLocateDirent
0x1C0020500: "__cdecl _imp_ProbeForRead" __imp_ProbeForRead
0x1C0010D70: "DplWrap-Auth-HMAC-SHA256" ??_C@_0BJ@KCJHGFHN@DplWrap?9Auth?9HMAC?9SHA256?$AA@
0x1C0020460: "__cdecl _imp_RtlFreeOemString" __imp_RtlFreeOemString
0x1C000AB44: CalcEnterpriseIdsBufferSize
0x1C00107C8: ". " ??_C@_0M@MDEHIDFG@?4?5?5?5?5?5?5?5?5?5?5?$AA@
0x1C0020850: "__cdecl _imp_EtwWrite" __imp_EtwWrite
0x1C0020270: "__cdecl _imp_FsRtlOplockIsFastIoPossible" __imp_FsRtlOplockIsFastIoPossible
0x1C002C5B8: FatOpenRootDcb
0x1C00010B0: FatSelectBestWindow
0x1C0020130: "__cdecl _imp_IoFreeMdl" __imp_IoFreeMdl
0x1C005102C: FreeContextDataBlock
0x1C0055BF8: EfsEncryptFile
0x1C0035774: FatSetPfileExtensionOnDisk
0x1C0002340: FatSingleAsyncCompletionRoutine
0x1C0004CF4: FatIsBootSectorFat
0x1C0020428: "__cdecl _imp_ExReleaseResourceForThreadLite" __imp_ExReleaseResourceForThreadLite
0x1C0063B54: "__cdecl _security_init_cookie" __security_init_cookie
0x1C0010D30: "HashDigestLength" ??_C@_1CC@DMMMEHOM@?$AAH?$AAa?$AAs?$AAh?$AAD?$AAi?$AAg?$AAe?$AAs?$AAt?$AAL?$AAe?$AAn?$AAg?$AAt?$AAh?$AA?$AA@
0x1C002E0C8: FatCreateNewDirectory
0x1C0010E50: "part" ??_C@_19FEMKCJDF@?$AAp?$AAa?$AAr?$AAt?$AA?$AA@
0x1C004F38C: FatSqmAddToStreamEx
0x1C00367AC: FatUpdateDirentFromFcb
0x1C003F94C: FatSetAllocationInfo
0x1C0020078: "__cdecl _imp_BCryptFinishHash" __imp_BCryptFinishHash
0x1C0052C50: EfsSetEfsStreamInfo
0x1C0020868: "__cdecl _imp_KeQueryTimeIncrement" __imp_KeQueryTimeIncrement
0x1C00202F8: FsRtlLegalAnsiCharacterArray
0x1C0020838: "__cdecl _imp_EtwRegister" __imp_EtwRegister
0x1C0005768: FatPnpAdjustVpbRefCount
0x1C00205B0: "__cdecl _imp_IoAllocateWorkItem" __imp_IoAllocateWorkItem
0x1C00202D0: "__cdecl _imp_RtlUpcaseUnicodeString" __imp_RtlUpcaseUnicodeString
0x1C00277C8: FatPrepareWriteVolumeFile
0x1C000BCA0: rijndaelDecrypt256
0x1C00206D8: "__cdecl _imp_FsRtlProcessFileLock" __imp_FsRtlProcessFileLock
0x1C0020378: "__cdecl _imp_KeSetEvent" __imp_KeSetEvent
0x1C0050870: SetKeyTable
0x1C00022A0: FatSpecialSyncCompletionRoutine
0x1C0006780: FatFspMarkVolumeDirtyWithRecover
0x1C0059270: EfspValidateStreamTransitionMetadata
0x1C00208E8: "__cdecl _imp_CcUnpinData" __imp_CcUnpinData
0x1C0020240: "__cdecl _imp_FsRtlCheckOplockEx" __imp_FsRtlCheckOplockEx
0x1C00109F8: "EA DATA SF" ??_C@_0M@KIIMEAMK@EA?5DATA?5?5SF?$AA@
0x1C00529B0: EfsFirstWriteEncryptOnCloseFile
0x1C0043DD8: FatGetVolumeBitmap
0x1C0037F78: FatDeleteEa
0x1C0010BA0: "\Registry\Machine\Software\Polic" ??_C@_1JI@PKHHOJBM@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAP?$AAo?$AAl?$AAi?$AAc@
0x1C0049BEC: FatTearDownVcb
0x1C00207D8: "__cdecl _imp_RtlTimeFieldsToTime" __imp_RtlTimeFieldsToTime
0x1C003325C: FatGetDirTimes
0x1C00039D8: NtOfsCloseAttribute
0x1C0028218: FatZeroData
0x1C0048CD0: FatAcquireExclusiveVcb_Real
0x1C003C234: FatIsIrpTopLevel
0x1C0020AE0: "__cdecl _imp_ExAcquirePushLockExclusiveEx" __imp_ExAcquirePushLockExclusiveEx
0x1C002C6F4: FatOpenExistingDcb
0x1C0020AD8: "__cdecl _imp_ExReleaseSpinLockSharedFromDpcLevel" __imp_ExReleaseSpinLockSharedFromDpcLevel
0x1C004F640: FatTelemetryMount
0x1C0020250: "__cdecl _imp_FsRtlFastUnlockAll" __imp_FsRtlFastUnlockAll
0x1C000173C: FatLowLevelReadWrite
0x1C0020650: "__cdecl _imp_FsRtlRemoveLargeMcbEntry" __imp_FsRtlRemoveLargeMcbEntry
0x1C0048F1C: FatAcquireSharedFcbWaitForEx
0x1C0045B34: FatFlushAndCleanVolume
0x1C0002750: EfsFileCreateCallback
0x1C00548B4: EfspPostCreatePrepareAndSendFsctl
0x1C004C39C: FatVerifyOperationIsLegal
0x1C00545AC: EfspPostCreateImpersonateAndGetData
0x1C00385B8: FatReadEaSet
0x1C00056D0: FatRemoveOverflowEntry
0x1C000E090: "__cdecl _report_gsfailure" __report_gsfailure
0x1C0020AF8: "__cdecl _imp_ExAcquireSpinLockShared" __imp_ExAcquireSpinLockShared
0x1C0037770: FatFsdQueryEa
0x1C000CD00: MD5Final
0x1C004188C: FatRemoveMcbEntry
0x1C0040550: FatSetFileObject
0x1C00109C0: "Identifier" ??_C@_1BG@IEICLFFJ@?$AAI?$AAd?$AAe?$AAn?$AAt?$AAi?$AAf?$AAi?$AAe?$AAr?$AA?$AA@
0x1C0020268: "__cdecl _imp_FsRtlCheckOplock" __imp_FsRtlCheckOplock
0x1C0029688: FatFspClose
0x1C0047738: FatCommonPnp
0x1C00529D0: EfsCloseEncryptOnCloseFile
0x1C0020528: "__cdecl _imp_CcMdlWriteAbort" __imp_CcMdlWriteAbort
0x1C0006FF0: EfsGenerateEncryptionContext
0x1C0020758: "__cdecl _imp_ExQueryDepthSList" __imp_ExQueryDepthSList
0x1C0046430: FatFastLock
0x1C002F838: FatSupersedeOrOverwriteFile
0x1C00206A8: "__cdecl _imp_IoFileObjectType" __imp_IoFileObjectType
0x1C0036668: FatSetFileSizeInDirent
0x1C0020590: "__cdecl _imp_FsRtlMdlReadCompleteDev" __imp_FsRtlMdlReadCompleteDev
0x1C0001710: FatLowLevelReadWriteCallout
0x1C00283B0: FatPinMappedData
0x1C00566F8: EfspCopyAesKeyBlob
0x1C00205D0: "__cdecl _imp_ExInitializeResourceLite" __imp_ExInitializeResourceLite
0x1C0003B38: NtOfsDeleteAttribute
0x1C000E0E0: ext_ms_win_crypto_xbox_l1_1_0_XboxCryptoSupported
0x1C0010D20: "SHA256" ??_C@_1O@HECGKAIN@?$AAS?$AAH?$AAA?$AA2?$AA5?$AA6?$AA?$AA@
0x1C0002B8C: EfsCleanUpCallback
0x1C00201B0: "__cdecl _imp_KeRemoveQueueDpc" __imp_KeRemoveQueueDpc
0x1C0049F0C: FatCreateRootDcb
0x1C0020888: "__cdecl _imp_RtlFindLongestRunClear" __imp_RtlFindLongestRunClear
0x1C00109D8: "FUJITSU FMR-" ??_C@_1BK@HNDGIDCO@?$AAF?$AAU?$AAJ?$AAI?$AAT?$AAS?$AAU?$AA?5?$AAF?$AAM?$AAR?$AA?9?$AA?$AA@
0x1C0020B30: ntoskrnl_NULL_THUNK_DATA
0x1C00207A0: "__cdecl _imp_FsRtlInitializeFileLock" __imp_FsRtlInitializeFileLock
0x1C0049654: FatInitializeVcb
0x1C0020900: "__cdecl _imp_ExFreePoolWithTag" __imp_ExFreePoolWithTag
0x1C004532C: FatComputeMoveFileParameter
0x1C000DF00: "__cdecl TlgWriteAgg" _TlgWriteAgg
0x1C0020698: "__cdecl _imp_FsRtlDismountComplete" __imp_FsRtlDismountComplete
0x1C0020210: "__cdecl _imp_KeEnterCriticalRegion" __imp_KeEnterCriticalRegion
0x1C00209C8: "__cdecl _imp_ZwOpenFile" __imp_ZwOpenFile
0x1C00200F8: "__cdecl _imp_NdrClientCall3" __imp_NdrClientCall3
0x1C002A1C4: FatCommonCreate
0x1C003CEA0: FatCommonSetInformation
0x1C0010E00: "MessageBlockLength" ??_C@_1CG@ONBEMBCH@?$AAM?$AAe?$AAs?$AAs?$AAa?$AAg?$AAe?$AAB?$AAl?$AAo?$AAc?$AAk?$AAL?$AAe?$AAn?$AAg?$AAt?$AAh?$AA?$AA@
0x1C0020310: "__cdecl _imp_CcIsThereDirtyData" __imp_CcIsThereDirtyData
0x1C00417D4: FatGetNextMcbEntry
0x1C0059DA4: EfspRpcReconnect
0x1C0020A30: "__cdecl _imp_PsImpersonateClient" __imp_PsImpersonateClient
0x1C0063008: DriverEntry
0x1C000CB10: MD5Update
0x1C00577F8: EfspAquirePFileStream
0x1C001CCC0: FatData
0x1C001CC80: FatCloseQueueMutex
0x1C00298BC: FatRemoveClose
0x1C003D82C: FatSetBasicInfo
0x1C00456AC: FatGetRetrievalPointerBase
0x1C0020350: "__cdecl _imp_FsRtlFindInTunnelCache" __imp_FsRtlFindInTunnelCache
0x1C0024EF0: FatTruncateFileAllocation
0x1C0010B08: "EFSKCACHEPERIOD" ??_C@_1CA@LLJHHLAE@?$AAE?$AAF?$AAS?$AAK?$AAC?$AAA?$AAC?$AAH?$AAE?$AAP?$AAE?$AAR?$AAI?$AAO?$AAD?$AA?$AA@
0x1C0020618: "__cdecl _imp_ZwOpenKey" __imp_ZwOpenKey
0x1C00206E0: "__cdecl _imp_FsRtlIsDbcsInExpression" __imp_FsRtlIsDbcsInExpression
0x1C0020580: "__cdecl _imp_FsRtlCopyWrite" __imp_FsRtlCopyWrite
0x1C00016A0: FatCallSelfCompletionRoutine
0x1C0020478: "__cdecl _imp_RtlOemToUnicodeN" __imp_RtlOemToUnicodeN
0x1C0020658: "__cdecl _imp_IoVolumeDeviceToGuid" __imp_IoVolumeDeviceToGuid
0x1C0020400: "__cdecl _imp_ExSetResourceOwnerPointer" __imp_ExSetResourceOwnerPointer
0x1C00204B0: "__cdecl _imp_FsRtlAddLargeMcbEntry" __imp_FsRtlAddLargeMcbEntry
0x1C0020008: HAL_NULL_THUNK_DATA
0x1C00204A8: "__cdecl _imp_ExSystemTimeToLocalTime" __imp_ExSystemTimeToLocalTime
0x1C0033358: FatNotifyChangeDirectory
0x1C0030674: FatCommonDeviceControl
0x1C0020388: "__cdecl _imp_RtlOemStringToUnicodeString" __imp_RtlOemStringToUnicodeString
0x1C001CB60: FatFastIoDispatch
0x1C000E680: memset
0x1C0020BC0: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x1C0020810: "__cdecl _imp_CcCoherencyFlushAndPurgeCache" __imp_CcCoherencyFlushAndPurgeCache
0x1C0020518: "__cdecl _imp_IoBuildAsynchronousFsdRequest" __imp_IoBuildAsynchronousFsdRequest
0x1C004112C: FatFlushFat
0x1C0020B08: "__cdecl _imp_ExAcquireSpinLockExclusive" __imp_ExAcquireSpinLockExclusive

[JEB Decompiler by PNF Software]