Generated by JEB on 2019/08/01

PE: C:\Windows\System32\NcaSvc.dll Base=0x180000000 SHA-256=3F6735182A14DCE4D6DAD4374F1F39BC8C7B9E7DB58F0FF7D781B304DB50403B
PDB: NcaSvc.pdb GUID={D5FFDAA9-06F4-92F0-C6CA5355B46CFBDC} Age=1

1285 located named symbols:
0x180021E08: WPP_ThisDir_CTLGUID_NcaSvc
0x180022480: "NcaNetworkClose" ??_C@_1CA@FHDHHIHD@?$AAN?$AAc?$AAa?$AAN?$AAe?$AAt?$AAw?$AAo?$AAr?$AAk?$AAC?$AAl?$AAo?$AAs?$AAe?$AA?$AA@
0x18001B1A4: NcaRegQueryNumKeys
0x18001FB88: "__cdecl _imp_NotifyUnicastIpAddressChange" __imp_NotifyUnicastIpAddressChange
0x1800201D8: "__cdecl _imp_EventSetInformation" __imp_EventSetInformation
0x180021350: "IPsec Quick Mode SA's (Get-NetIP" ??_C@_1GA@OADEGGFM@?$AAI?$AAP?$AAs?$AAe?$AAc?$AA?5?$AAQ?$AAu?$AAi?$AAc?$AAk?$AA?5?$AAM?$AAo?$AAd?$AAe?$AA?5?$AAS?$AAA?$AA?8?$AAs?$AA?5?$AA?$CI?$AAG?$AAe?$AAt?$AA?9?$AAN?$AAe?$AAt?$AAI?$AAP@
0x1800202F8: "__cdecl _imp_ProxyHelperProviderRegisterForEventNotification" __imp_ProxyHelperProviderRegisterForEventNotification
0x1800228E0: WPP_a372f38423cf3170029832c5365d2fcc_Traceguids
0x18000F530: "void __cdecl NcaEvCollInsideOutsideCollect(void * __ptr64,void * __ptr64,void * __ptr64,void * __ptr64)" ?NcaEvCollInsideOutsideCollect@@YAXPEAX000@Z
0x180018410: "int __cdecl NcaUserStoreEnumeratorNext(struct _LIST_ENTRY * __ptr64 * __ptr64,struct NCA_USER_ * __ptr64 * __ptr64)" ?NcaUserStoreEnumeratorNext@@YAHPEAPEAU_LIST_ENTRY@@PEAPEAUNCA_USER_@@@Z
0x18001AB4C: NcaRegIsKeyPresent
0x180021E58: "Group Policy" ??_C@_1BK@HHOBNCAL@?$AAG?$AAr?$AAo?$AAu?$AAp?$AA?5?$AAP?$AAo?$AAl?$AAi?$AAc?$AAy?$AA?$AA@
0x180021F20: "SELECT * FROM MSFT_DASiteTableEn" ??_C@_1EI@KNNBEEFE@?$AAS?$AAE?$AAL?$AAE?$AAC?$AAT?$AA?5?$AA?$CK?$AA?5?$AAF?$AAR?$AAO?$AAM?$AA?5?$AAM?$AAS?$AAF?$AAT?$AA_?$AAD?$AAA?$AAS?$AAi?$AAt?$AAe?$AAT?$AAa?$AAb?$AAl?$AAe?$AAE?$AAn@
0x180020198: "__cdecl _imp_UnregisterTraceGuids" __imp_UnregisterTraceGuids
0x180021BE8: ModuleShutdownStart
0x1800017A4: "__cdecl _raise_securityfailure" __raise_securityfailure
0x18000B144: "void __cdecl NcaNlmTriggerConnectionStateUnadviceRelease(struct NCA_NLM_CONN_POINT_STATE * __ptr64)" ?NcaNlmTriggerConnectionStateUnadviceRelease@@YAXPEAUNCA_NLM_CONN_POINT_STATE@@@Z
0x180020170: "__cdecl _imp_CreateThreadpoolWork" __imp_CreateThreadpoolWork
0x180011A7C: "unsigned long __cdecl NcaEvCollProbesInnerCreate(struct NCA_EVCOLL_USER_PROBES_ * __ptr64,unsigned long)" ?NcaEvCollProbesInnerCreate@@YAKPEAUNCA_EVCOLL_USER_PROBES_@@K@Z
0x1800207D0: CLSID_NetFwPolicy2
0x180020420: "__cdecl _imp_vDbgPrintEx" __imp_vDbgPrintEx
0x180023020: "FALSE" ??_C@_05MAJJAKPI@FALSE?$AA@
0x18001FE90: api-ms-win-core-file-l1-1-0_NULL_THUNK_DATA
0x180023B20: "ExpandEnvironmentStringsW" ??_C@_0BK@MIHKMAHC@ExpandEnvironmentStringsW?$AA@
0x180022180: "SYSTEM\CurrentControlSet\Control" ??_C@_1JI@BBGOMGAA@?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA?2?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl@
0x1800201E0: "__cdecl _imp_EventRegister" __imp_EventRegister
0x180020890: "ipConfig" ??_C@_1BC@GPPEHOJC@?$AAi?$AAp?$AAC?$AAo?$AAn?$AAf?$AAi?$AAg?$AA?$AA@
0x18001C120: Rpc_NcaGetEvidenceCollectorResult
0x18001FD90: "__cdecl _imp_WinHttpSendRequest" __imp_WinHttpSendRequest
0x180003030: "void __cdecl NcaSqmTimerCallback(struct _TP_CALLBACK_INSTANCE * __ptr64,void * __ptr64,struct _TP_TIMER * __ptr64)" ?NcaSqmTimerCallback@@YAXPEAU_TP_CALLBACK_INSTANCE@@PEAXPEAU_TP_TIMER@@@Z
0x180001A70: "__cdecl FindPESection" _FindPESection
0x18001AE38: NcaRegNotifyDestroy
0x180006144: "unsigned long __cdecl NcaApiSrvImplNotifySubscriptions(struct NCA_STATUS_EVENT_ * __ptr64,struct NCA_DAP_USER_EVSNPSHT_ * __ptr64)" ?NcaApiSrvImplNotifySubscriptions@@YAKPEAUNCA_STATUS_EVENT_@@PEAUNCA_DAP_USER_EVSNPSHT_@@@Z
0x180023A48: WPP_c76e41f6770633f63e98d23934f93e7f_Traceguids
0x18000B780: "public: virtual long __cdecl CNlmTriggerProfileEventSink::NetworkPropertyChanged(struct _GUID,enum NLM_NETWORK_PROPERTY_CHANGE) __ptr64" ?NetworkPropertyChanged@CNlmTriggerProfileEventSink@@UEAAJU_GUID@@W4NLM_NETWORK_PROPERTY_CHANGE@@@Z
0x1800222F0: "O:SYG:SYD:(A;;RCWD;;;BA)(A;;RCWD" ??_C@_1EO@IAJGMGHI@?$AAO?$AA?3?$AAS?$AAY?$AAG?$AA?3?$AAS?$AAY?$AAD?$AA?3?$AA?$CI?$AAA?$AA?$DL?$AA?$DL?$AAR?$AAC?$AAW?$AAD?$AA?$DL?$AA?$DL?$AA?$DL?$AAB?$AAA?$AA?$CJ?$AA?$CI?$AAA?$AA?$DL?$AA?$DL?$AAR?$AAC?$AAW?$AAD@
0x180020AB0: "proxy" ??_C@_1M@KKFBDPGM@?$AAp?$AAr?$AAo?$AAx?$AAy?$AA?$AA@
0x18001FE18: "__cdecl _imp_CoInitializeEx" __imp_CoInitializeEx
0x180014D10: "void __cdecl NcaEvCollProxyShutdown(void)" ?NcaEvCollProxyShutdown@@YAXXZ
0x18001FF70: "__cdecl _imp_SetThreadToken" __imp_SetThreadToken
0x18001BAB4: "void __cdecl NcaRpcAPIsShutdownSecurityMode(unsigned long)" ?NcaRpcAPIsShutdownSecurityMode@@YAXK@Z
0x180025AF8: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x180008180: "unsigned long __cdecl NcaScriptLogsFinishProcess(void * __ptr64,struct NCA_COMMAND_ENVIROMENT_ * __ptr64,unsigned long,void * __ptr64)" ?NcaScriptLogsFinishProcess@@YAKPEAXPEAUNCA_COMMAND_ENVIROMENT_@@K0@Z
0x1800258F0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-com-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-com-l1-1-0
0x18000B950: "public: virtual unsigned long __cdecl CNlmTriggerProfileEventSink::Release(void) __ptr64" ?Release@CNlmTriggerProfileEventSink@@UEAAKXZ
0x180023AE0: WPP_222b883fcab63deb7fedc4d469ecfbf7_Traceguids
0x180010A10: "unsigned long __cdecl NcaEvCollHttpProbeCollectWinHttpSessionInit(struct NCA_EVCOLL_PROBE_ * __ptr64)" ?NcaEvCollHttpProbeCollectWinHttpSessionInit@@YAKPEAUNCA_EVCOLL_PROBE_@@@Z
0x180028A40: "unsigned long gNcaEtwPerfTrackSessionID" ?gNcaEtwPerfTrackSessionID@@3KA
0x180022158: "ShowUI" ??_C@_1O@GHFGDLAP@?$AAS?$AAh?$AAo?$AAw?$AAU?$AAI?$AA?$AA@
0x180029290: "struct NCA_WFP_TRIGGER_COMP_ gNcaWfpTriggerComp" ?gNcaWfpTriggerComp@@3UNCA_WFP_TRIGGER_COMP_@@A
0x18000AC2C: "enum NCA_PROFILE_CATEGORY_ __cdecl GetProfileForINetwork(struct INetwork * __ptr64)" ?GetProfileForINetwork@@YA?AW4NCA_PROFILE_CATEGORY_@@PEAUINetwork@@@Z
0x180020300: "__cdecl _imp_ProxyHelperProviderConnectToServer" __imp_ProxyHelperProviderConnectToServer
0x180006618: "unsigned long __cdecl SvrImpl_NcaEngineOpen(void * __ptr64,void * __ptr64 * __ptr64)" ?SvrImpl_NcaEngineOpen@@YAKPEAXPEAPEAX@Z
0x180028380: "__cdecl _security_cookie_complement" __security_cookie_complement
0x180023AB0: "UserStorePhase2" ??_C@_1CA@BGNNDANC@?$AAU?$AAs?$AAe?$AAr?$AAS?$AAt?$AAo?$AAr?$AAe?$AAP?$AAh?$AAa?$AAs?$AAe?$AA2?$AA?$AA@
0x180022418: "SY" ??_C@_15HCCCGECN@?$AAS?$AAY?$AA?$AA@
0x1800202E8: "__cdecl _imp_ProxyHelperProviderDisconnectFromServer" __imp_ProxyHelperProviderDisconnectFromServer
0x180023EE0: "__cdecl _midl_frag35" __midl_frag35
0x18001F850: "__cdecl _midl_frag34" __midl_frag34
0x180023EE4: "__cdecl _midl_frag37" __midl_frag37
0x180023EB0: "__cdecl _midl_frag31" __midl_frag31
0x18001F800: "__cdecl _midl_frag30" __midl_frag30
0x180020CB0: "Get-NetTeredoState | Out-Default" ??_C@_1EC@LNBAINPK@?$AAG?$AAe?$AAt?$AA?9?$AAN?$AAe?$AAt?$AAT?$AAe?$AAr?$AAe?$AAd?$AAo?$AAS?$AAt?$AAa?$AAt?$AAe?$AA?5?$AA?$HM?$AA?5?$AAO?$AAu?$AAt?$AA?9?$AAD?$AAe?$AAf?$AAa?$AAu?$AAl?$AAt@
0x180023EC8: "__cdecl _midl_frag32" __midl_frag32
0x18001F8A0: "__cdecl _midl_frag39" __midl_frag39
0x1800214F8: "route" ??_C@_1M@BEEMKOBE@?$AAr?$AAo?$AAu?$AAt?$AAe?$AA?$AA@
0x18000BE10: NcaNlmTriggerInitialize
0x180023E48: "ncalrpc" ??_C@_1BA@EONDGCCM@?$AAn?$AAc?$AAa?$AAl?$AAr?$AAp?$AAc?$AA?$AA@
0x180024400: "%s: Unexpected ALPC message type" ??_C@_0CH@CBMMEDDH@?$CFs?3?5Unexpected?5ALPC?5message?5type@
0x18001F118: "__cdecl tls_used" _tls_used
0x180021A50: MS_NCASVC_ETW_PROVIDER_ID
0x1800174DC: LoopbackAuthAndImpersonate
0x18000DA30: NcaWtsSessionChangeTriggerRegisterWait
0x180005000: "long __cdecl NcaProbeConstruct(void * __ptr64,struct HKEY__ * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,void * __ptr64,int * __ptr64)" ?NcaProbeConstruct@@YAJPEAXPEAUHKEY__@@PEBG20PEAH@Z
0x180009740: "unsigned long __cdecl NcaScriptLogsWriteHeader(void * __ptr64,struct NCA_USER_ * __ptr64)" ?NcaScriptLogsWriteHeader@@YAKPEAXPEAUNCA_USER_@@@Z
0x180029978: "unsigned short * __ptr64 * wszNcaScriptLogHtmlHeader" ?wszNcaScriptLogHtmlHeader@@3PAPEAGA
0x180015EB8: "void __cdecl NcaDAPEvidenceSnapshotGetCopy(struct NCA_EVIDENCE_ * __ptr64,struct NCA_DAP_USER_EVSNPSHT_ * __ptr64)" ?NcaDAPEvidenceSnapshotGetCopy@@YAXPEAUNCA_EVIDENCE_@@PEAUNCA_DAP_USER_EVSNPSHT_@@@Z
0x18000118C: "__cdecl CRT_INIT" _CRT_INIT
0x1800203F0: "__cdecl _imp_TpWaitForAlpcCompletion" __imp_TpWaitForAlpcCompletion
0x1800106FC: "void __cdecl NcaEvCollHttpProbeCollectUpdateEvidence(struct NCA_EVCOLL_PROBE_ * __ptr64,int,enum NCA_PROBE_TEST_TYPE_,enum NCA_EVCOLL_PROBE_PRV_RESULT_,int)" ?NcaEvCollHttpProbeCollectUpdateEvidence@@YAXPEAUNCA_EVCOLL_PROBE_@@HW4NCA_PROBE_TEST_TYPE_@@W4NCA_EVCOLL_PROBE_PRV_RESULT_@@H@Z
0x180023B78: "PathCanonicalize" ??_C@_0BB@DAIHMEEM@PathCanonicalize?$AA@
0x18001FF58: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x180020150: "__cdecl _imp_CloseThreadpoolWait" __imp_CloseThreadpoolWait
0x18001FC68: "__cdecl _imp_NdrServerCallAll" __imp_NdrServerCallAll
0x18001CF18: NcaRpcAPIsInterfaceSecurityCallback
0x180020400: "__cdecl _imp_AlpcGetMessageAttribute" __imp_AlpcGetMessageAttribute
0x18001FCF8: "__cdecl _imp_RpcAsyncCompleteCall" __imp_RpcAsyncCompleteCall
0x18001B4E0: NcaRegSetDWord
0x1800203B0: "__cdecl _imp_TpAllocAlpcCompletion" __imp_TpAllocAlpcCompletion
0x18001FD80: "__cdecl _imp_RegisterGPNotification" __imp_RegisterGPNotification
0x1800202B0: "__cdecl _imp_BCryptGetFipsAlgorithmMode" __imp_BCryptGetFipsAlgorithmMode
0x18001FC90: "__cdecl _imp_RpcServerRegisterIfEx" __imp_RpcServerRegisterIfEx
0x18001A7F0: NcaRegDeleteValue
0x180003904: WPP_SF_L
0x180029A48: "unsigned short * __ptr64 * wszNcaProbeOrigin" ?wszNcaProbeOrigin@@3PAPEAGA
0x180020430: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x1800039B0: WppControlCallback
0x180001DD0: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x18001F3E0: NCA_StubDesc
0x18001FCC0: "__cdecl _imp_RpcEpUnregister" __imp_RpcEpUnregister
0x18001FC58: "__cdecl _imp_RpcServerRegisterAuthInfoW" __imp_RpcServerRegisterAuthInfoW
0x180020010: "__cdecl _imp_PathCanonicalizeW" __imp_PathCanonicalizeW
0x18001FE60: "__cdecl _imp_CreateFileW" __imp_CreateFileW
0x180020930: "Get-NetIPConfiguration -All -Det" ??_C@_1GI@DFNPCLKH@?$AAG?$AAe?$AAt?$AA?9?$AAN?$AAe?$AAt?$AAI?$AAP?$AAC?$AAo?$AAn?$AAf?$AAi?$AAg?$AAu?$AAr?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?5?$AA?9?$AAA?$AAl?$AAl?$AA?5?$AA?9?$AAD?$AAe?$AAt@
0x180023708: "NCA_EVCOLLECTOR_NATIVEV6_DOWN" ??_C@_1DM@MPAPGHOM@?$AAN?$AAC?$AAA?$AA_?$AAE?$AAV?$AAC?$AAO?$AAL?$AAL?$AAE?$AAC?$AAT?$AAO?$AAR?$AA_?$AAN?$AAA?$AAT?$AAI?$AAV?$AAE?$AAV?$AA6?$AA_?$AAD?$AAO?$AAW?$AAN?$AA?$AA@
0x180013438: "int __cdecl NcaEvCollStrongAuthIsUserUsingSmartcard(void * __ptr64)" ?NcaEvCollStrongAuthIsUserUsingSmartcard@@YAHPEAX@Z
0x180011260: "void __cdecl NcaEvCollProbeCollect(void * __ptr64,void * __ptr64,void * __ptr64,void * __ptr64)" ?NcaEvCollProbeCollect@@YAXPEAX000@Z
0x180004660: "void __cdecl NcaConfigMgrMultisiteUpdate(void * __ptr64,void * __ptr64,void * __ptr64,void * __ptr64)" ?NcaConfigMgrMultisiteUpdate@@YAXPEAX000@Z
0x1800248BC: "__cdecl Init_thread_epoch" _Init_thread_epoch
0x1800258DC: "__cdecl _IMPORT_DESCRIPTOR_OLEAUT32" __IMPORT_DESCRIPTOR_OLEAUT32
0x180003874: WPP_INIT_CONTROL_ARRAY
0x180021940: "__cdecl TraceLoggingMetadata" _TraceLoggingMetadata
0x18000A354: NcaSyncedListCreate
0x180023320: "NCA_EVCOLLECTOR_INVALID" ??_C@_1DA@LDIBCCNI@?$AAN?$AAC?$AAA?$AA_?$AAE?$AAV?$AAC?$AAO?$AAL?$AAL?$AAE?$AAC?$AAT?$AAO?$AAR?$AA_?$AAI?$AAN?$AAV?$AAA?$AAL?$AAI?$AAD?$AA?$AA@
0x180021D88: "RegisterStopCallback" ??_C@_0BF@FLOIGAGO@RegisterStopCallback?$AA@
0x1800232B0: "NCA_EVCOLLECTOR_USER_IDLE:%d (SE" ??_C@_0CP@ECPFCFOO@NCA_EVCOLLECTOR_USER_IDLE?3?$CFd?5?$CISE@
0x180021B90: ProbeStart
0x180020140: "__cdecl _imp_CreateThreadpoolWait" __imp_CreateThreadpoolWait
0x180013980: NcaEvCollStrongAuthInitialize
0x180003AD8: "unsigned long __cdecl NcaConfigMgrGetProbeObjectCopy(unsigned long,struct NCA_PROBE_LIST_ * __ptr64,struct NCA_PROBE_ * __ptr64)" ?NcaConfigMgrGetProbeObjectCopy@@YAKKPEAUNCA_PROBE_LIST_@@PEAUNCA_PROBE_@@@Z
0x180005760: NcaConfigMgrPolUpdateInitialize
0x180020138: "__cdecl _imp_SetThreadpoolWait" __imp_SetThreadpoolWait
0x180007A10: "void __cdecl SvrImpl_NcaStatusEventUnsubscribeCore(struct NCA_INTSERVER_EVENTS_HANDLE_ * __ptr64)" ?SvrImpl_NcaStatusEventUnsubscribeCore@@YAXPEAUNCA_INTSERVER_EVENTS_HANDLE_@@@Z
0x180019190: NcaEtwInitialize
0x18000F810: NcaEvCollInsideOutsideShutdown
0x180028E90: "struct NCA_USER_STORE_COMPONENT_ gNcaUserStore" ?gNcaUserStore@@3UNCA_USER_STORE_COMPONENT_@@A
0x180020130: "__cdecl _imp_WaitForThreadpoolWaitCallbacks" __imp_WaitForThreadpoolWaitCallbacks
0x1800238C0: "NCA_EVCOLLECTOR_FORCE_TUNNELING_" ??_C@_1FA@GHJFEJI@?$AAN?$AAC?$AAA?$AA_?$AAE?$AAV?$AAC?$AAO?$AAL?$AAL?$AAE?$AAC?$AAT?$AAO?$AAR?$AA_?$AAF?$AAO?$AAR?$AAC?$AAE?$AA_?$AAT?$AAU?$AAN?$AAN?$AAE?$AAL?$AAI?$AAN?$AAG?$AA_@
0x1800200A0: "__cdecl _imp_AcquireSRWLockShared" __imp_AcquireSRWLockShared
0x180023158: WPP_11d85ad1cfc630203be5693001deac09_Traceguids
0x180002840: "long __cdecl NcaServiceChangeState(unsigned long)" ?NcaServiceChangeState@@YAJK@Z
0x180013DC0: "void __cdecl NcaEvCollHealthCollect(void * __ptr64,void * __ptr64,void * __ptr64,void * __ptr64)" ?NcaEvCollHealthCollect@@YAXPEAX000@Z
0x180020D90: "Get-NetIPHttpsConfiguration | Ou" ??_C@_1FE@EAIBGFL@?$AAG?$AAe?$AAt?$AA?9?$AAN?$AAe?$AAt?$AAI?$AAP?$AAH?$AAt?$AAt?$AAp?$AAs?$AAC?$AAo?$AAn?$AAf?$AAi?$AAg?$AAu?$AAr?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?5?$AA?$HM?$AA?5?$AAO?$AAu@
0x180025990: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-2-0
0x1800229D0: WPP_e9942d1048e93b2645d2305d9bb7b0e8_Traceguids
0x18000CB70: NcaIPTriggerShutdown
0x18001FF98: "__cdecl _imp_RegEnumValueW" __imp_RegEnumValueW
0x18002597C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-1-0
0x18000DFE8: NcaTimerTriggerRegisterWait
0x1800202B8: bcrypt_NULL_THUNK_DATA
0x180025814: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-eventing-classicprovider-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-eventing-classicprovider-l1-1-0
0x18001F7B0: "__cdecl _midl_frag27" __midl_frag27
0x180023EA8: "__cdecl _midl_frag20" __midl_frag20
0x180023EAC: "__cdecl _midl_frag28" __midl_frag28
0x180020F50: "nrptPolicy" ??_C@_1BG@PIGDDAJB@?$AAn?$AAr?$AAp?$AAt?$AAP?$AAo?$AAl?$AAi?$AAc?$AAy?$AA?$AA@
0x180029200: Microsoft_Windows_NcasvcEnableBits
0x18001FEE8: api-ms-win-core-heap-l2-1-0_NULL_THUNK_DATA
0x18001F680: "__cdecl _midl_frag2" __midl_frag2
0x180028390: "unsigned long * NcaScriptLogHtmlHeaderIds" ?NcaScriptLogHtmlHeaderIds@@3PAKA
0x180021C48: "NcaServiceAsyncStartupRoutine" ??_C@_0BO@HNANDMBA@NcaServiceAsyncStartupRoutine?$AA@
0x180021BF8: ModuleInitializeStart
0x18001FCA8: "__cdecl _imp_Ndr64AsyncServerCallAll" __imp_Ndr64AsyncServerCallAll
0x180028C90: "struct NCA_NLM_TRIGGER_COMP_ gNcaNlmTriggerComp" ?gNcaNlmTriggerComp@@3UNCA_NLM_TRIGGER_COMP_@@A
0x1800283B0: "unsigned long * NcaScriptLogMultisiteStatusIds" ?NcaScriptLogMultisiteStatusIds@@3PAKA
0x180023180: "SYSTEM\CurrentControlSet\Service" ??_C@_1JO@GIEELDIG@?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA?2?$AAS?$AAe?$AAr?$AAv?$AAi?$AAc?$AAe@
0x18001FDD8: "__cdecl _imp_GetAddrInfoW" __imp_GetAddrInfoW
0x180020340: "__cdecl _imp_wcschr" __imp_wcschr
0x18001FBC0: "__cdecl _imp_Icmp6CreateFile" __imp_Icmp6CreateFile
0x180008A04: "void __cdecl NcaScriptLogsLoadStrings(void)" ?NcaScriptLogsLoadStrings@@YAXXZ
0x180003A48: WppInitUm
0x180029BA4: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxumvgUmxzUfgrohUlyquivUznwGEUkivxlnkOlyq@NcaUtil" __@@_PchSym_@00@KxulyqvxgPillgKxumvgUmxzUfgrohUlyquivUznwGEUkivxlnkOlyq@NcaUtil
0x180020048: "__cdecl _imp_SetEvent" __imp_SetEvent
0x180021C28: ModuleInitializeEnd
0x180023870: "NCA_EVCOLLECTOR_NCA_PROPERLY_CON" ??_C@_1EE@KKGPGCOF@?$AAN?$AAC?$AAA?$AA_?$AAE?$AAV?$AAC?$AAO?$AAL?$AAL?$AAE?$AAC?$AAT?$AAO?$AAR?$AA_?$AAN?$AAC?$AAA?$AA_?$AAP?$AAR?$AAO?$AAP?$AAE?$AAR?$AAL?$AAY?$AA_?$AAC?$AAO?$AAN@
0x180023380: "NCA_EVCOLLECTOR_PROBES_PING" ??_C@_1DI@DFNIEHDO@?$AAN?$AAC?$AAA?$AA_?$AAE?$AAV?$AAC?$AAO?$AAL?$AAL?$AAE?$AAC?$AAT?$AAO?$AAR?$AA_?$AAP?$AAR?$AAO?$AAB?$AAE?$AAS?$AA_?$AAP?$AAI?$AAN?$AAG?$AA?$AA@
0x180028B20: "struct NCA_MAIN_COMPONENT_ gNcaMain" ?gNcaMain@@3UNCA_MAIN_COMPONENT_@@A
0x180017434: "__cdecl TlgWrite" _TlgWrite
0x1800299B8: "unsigned short * __ptr64 * wszNcaScriptLogMultisiteStatus" ?wszNcaScriptLogMultisiteStatus@@3PAPEAGA
0x1800223B0: "O:SYG:SYD:(A;;RCWD;;;BA)(A;;RCWD" ??_C@_1GG@PCBNAOCK@?$AAO?$AA?3?$AAS?$AAY?$AAG?$AA?3?$AAS?$AAY?$AAD?$AA?3?$AA?$CI?$AAA?$AA?$DL?$AA?$DL?$AAR?$AAC?$AAW?$AAD?$AA?$DL?$AA?$DL?$AA?$DL?$AAB?$AAA?$AA?$CJ?$AA?$CI?$AAA?$AA?$DL?$AA?$DL?$AAR?$AAC?$AAW?$AAD@
0x180020448: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x18001AF3C: NcaRegOpenKey
0x1800294A0: "struct NCA_EVCOLL_STRONGAUTH_COMPONENT_ gNcaEvCollStrongAuth" ?gNcaEvCollStrongAuth@@3UNCA_EVCOLL_STRONGAUTH_COMPONENT_@@A
0x18000F910: "void __cdecl NcaEvCollInternetConnectivityCollect(void * __ptr64,void * __ptr64,void * __ptr64,void * __ptr64)" ?NcaEvCollInternetConnectivityCollect@@YAXPEAX000@Z
0x1800228A8: "Nca Bfe Session" ??_C@_1CA@INGGADOK@?$AAN?$AAc?$AAa?$AA?5?$AAB?$AAf?$AAe?$AA?5?$AAS?$AAe?$AAs?$AAs?$AAi?$AAo?$AAn?$AA?$AA@
0x180022DC0: "EvCollInsideOutside" ??_C@_1CI@NLKPNMOA@?$AAE?$AAv?$AAC?$AAo?$AAl?$AAl?$AAI?$AAn?$AAs?$AAi?$AAd?$AAe?$AAO?$AAu?$AAt?$AAs?$AAi?$AAd?$AAe?$AA?$AA@
0x180022858: "MibAddInstance" ??_C@_0P@BGOJOGNI@MibAddInstance?$AA@
0x180023278: "__cdecl GUID_98325047_c671_4174_8d81_defcd3f03186" _GUID_98325047_c671_4174_8d81_defcd3f03186
0x180018B3C: "void __cdecl NcaEtwPerfTrackScenarioPublishStartEvent(enum NCA_ETW_PERFTRACK_SCENARIO_TYPE_)" ?NcaEtwPerfTrackScenarioPublishStartEvent@@YAXW4NCA_ETW_PERFTRACK_SCENARIO_TYPE_@@@Z
0x180022630: WPP_d7fa4a57286f3da713d1052cf716e1d9_Traceguids
0x18001FCB8: "__cdecl _imp_RpcEpRegisterW" __imp_RpcEpRegisterW
0x180020360: "__cdecl _imp__wcsnicmp" __imp__wcsnicmp
0x180019F4C: NcaLoadMuiStringTable
0x180020220: "__cdecl _imp_RevertToSelf" __imp_RevertToSelf
0x180021EE8: "DTEs" ??_C@_19HMFHFJMC@?$AAD?$AAT?$AAE?$AAs?$AA?$AA@
0x180020E10: "IP-HTTPs State (Get-NetIPHttpsSt" ??_C@_1EK@OEMJMFEP@?$AAI?$AAP?$AA?9?$AAH?$AAT?$AAT?$AAP?$AAs?$AA?5?$AAS?$AAt?$AAa?$AAt?$AAe?$AA?5?$AA?$CI?$AAG?$AAe?$AAt?$AA?9?$AAN?$AAe?$AAt?$AAI?$AAP?$AAH?$AAt?$AAt?$AAp?$AAs?$AAS?$AAt@
0x180012A34: NcaEvCollProbesDelete
0x180003100: NcaComponentsInitialize
0x18001FE88: "__cdecl _imp_SetFilePointer" __imp_SetFilePointer
0x1800295E0: "struct NCA_EVCOLL_IPHTTPS_CERT_COMPONENT_ gNcaEvCollIphttpsCert" ?gNcaEvCollIphttpsCert@@3UNCA_EVCOLL_IPHTTPS_CERT_COMPONENT_@@A
0x180013C20: NcaEvCollStrongAuthShutdown
0x1800228C8: "WfpTrigger" ??_C@_1BG@OBHBAFJO@?$AAW?$AAf?$AAp?$AAT?$AAr?$AAi?$AAg?$AAg?$AAe?$AAr?$AA?$AA@
0x180023AD0: WPP_00622af4a69d325ca11acb35260caabf_Traceguids
0x180022228: WPP_1d497c400fe838fd72ed5fc6ceae7606_Traceguids
0x180021B80: Microsoft_Windows_NcasvcKeywords
0x1800248C0: "__cdecl tls_end" _tls_end
0x18001BD70: NcaRpcAPIsSecurityCallback
0x180020270: "__cdecl _imp_RegisterServiceCtrlHandlerExW" __imp_RegisterServiceCtrlHandlerExW
0x180001A55: "__cdecl XcptFilter" _XcptFilter
0x180023C70: "NcaRegOpenKey" ??_C@_0O@BFKMLGOF@NcaRegOpenKey?$AA@
0x180020450: "__cdecl _xc_a" __xc_a
0x180020760: IID_IConnectionPointContainer
0x18001FF28: "__cdecl _imp_CreateProcessW" __imp_CreateProcessW
0x18001F358: "const NcaMultisiteEventSink::`vftable'" ??_7NcaMultisiteEventSink@@6B@
0x18001740C: "__cdecl TlgKeywordOn" _TlgKeywordOn
0x180023D60: "NcaRegDeleteValue" ??_C@_0BC@KKGLIIBL@NcaRegDeleteValue?$AA@
0x180025B5C: "__cdecl _IMPORT_DESCRIPTOR_FirewallAPI" __IMPORT_DESCRIPTOR_FirewallAPI
0x1800227F8: "ServicesActive" ??_C@_1BO@JHOJBCBI@?$AAS?$AAe?$AAr?$AAv?$AAi?$AAc?$AAe?$AAs?$AAA?$AAc?$AAt?$AAi?$AAv?$AAe?$AA?$AA@
0x1800142C0: "unsigned long __cdecl NcaEvCollNamePrefReadNrptRelevantPolicy(unsigned long * __ptr64)" ?NcaEvCollNamePrefReadNrptRelevantPolicy@@YAKPEAK@Z
0x180022F20: "EvCollProbes" ??_C@_1BK@PHALGDPN@?$AAE?$AAv?$AAC?$AAo?$AAl?$AAl?$AAP?$AAr?$AAo?$AAb?$AAe?$AAs?$AA?$AA@
0x1800157F0: "void __cdecl NcaEvCollIdlePdcChange(void * __ptr64,void * __ptr64,void * __ptr64,void * __ptr64)" ?NcaEvCollIdlePdcChange@@YAXPEAX000@Z
0x18001A1B8: NcaSizeTMultiply
0x1800194B0: NcaEtwShutdown
0x18000F610: NcaEvCollInsideOutsideInitialize
0x180023A00: "%s %s %d/%d/%d %d:%d:%d (UTC) " ??_C@_1EG@CHOMAAID@?$AA?$CF?$AAs?$AA?5?$AA?$CF?$AAs?$AA?$AN?$AA?6?$AA?$CF?$AAd?$AA?1?$AA?$CF?$AAd?$AA?1?$AA?$CF?$AAd?$AA?5?$AA?$CF?$AAd?$AA?3?$AA?$CF?$AAd?$AA?3?$AA?$CF?$AAd?$AA?5?$AA?$CI?$AAU?$AAT?$AAC?$AA?$CJ?$AA?$AN?$AA?6@
0x18000A3C0: NcaTriggerRearm
0x180020250: "__cdecl _imp_ConvertStringSidToSidW" __imp_ConvertStringSidToSidW
0x180020110: "__cdecl _imp_GetComputerNameExW" __imp_GetComputerNameExW
0x18000E720: "long __cdecl NotificationCallback(void * __ptr64,unsigned long)" ?NotificationCallback@@YAJPEAXK@Z
0x180006260: "void __cdecl NcaApiSrvImplShutdown(void)" ?NcaApiSrvImplShutdown@@YAXXZ
0x180018C24: "void __cdecl NcaEtwPerfTrackScenarioPublishStopEvent(enum NCA_ETW_PERFTRACK_SCENARIO_TYPE_,enum NCA_STATUS_EVENT_TYPE_,enum NCA_STATUS_EVENT_SUBTYPE_)" ?NcaEtwPerfTrackScenarioPublishStopEvent@@YAXW4NCA_ETW_PERFTRACK_SCENARIO_TYPE_@@W4NCA_STATUS_EVENT_TYPE_@@W4NCA_STATUS_EVENT_SUBTYPE_@@@Z
0x180020A60: "Get-Net6to4Configuration | Out-D" ??_C@_1EO@NPHMJKLK@?$AAG?$AAe?$AAt?$AA?9?$AAN?$AAe?$AAt?$AA6?$AAt?$AAo?$AA4?$AAC?$AAo?$AAn?$AAf?$AAi?$AAg?$AAu?$AAr?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?5?$AA?$HM?$AA?5?$AAO?$AAu?$AAt?$AA?9?$AAD@
0x18000B740: "void __cdecl NcaNlmTriggerSvcNotify(void * __ptr64)" ?NcaNlmTriggerSvcNotify@@YAXPEAX@Z
0x1800021C0: "unsigned long __cdecl NcaCreateCancelableLock(struct _tag_NCA_CANCELABLE_LOCK * __ptr64)" ?NcaCreateCancelableLock@@YAKPEAU_tag_NCA_CANCELABLE_LOCK@@@Z
0x180023EA0: "__cdecl _midl_frag15" __midl_frag15
0x18001F760: "__cdecl _midl_frag17" __midl_frag17
0x1800236C0: "NCA_EVCOLLECTOR_IPHTTPS_CERT_NEE" ??_C@_1EI@EFCNPEIG@?$AAN?$AAC?$AAA?$AA_?$AAE?$AAV?$AAC?$AAO?$AAL?$AAL?$AAE?$AAC?$AAT?$AAO?$AAR?$AA_?$AAI?$AAP?$AAH?$AAT?$AAT?$AAP?$AAS?$AA_?$AAC?$AAE?$AAR?$AAT?$AA_?$AAN?$AAE?$AAE@
0x18001F700: "__cdecl _midl_frag10" __midl_frag10
0x180023E98: "__cdecl _midl_frag13" __midl_frag13
0x180023C10: "NcaCriticalSectionCreate" ??_C@_0BJ@LIAKJAPI@NcaCriticalSectionCreate?$AA@
0x180025AE4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-shlwapi-legacy-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-shlwapi-legacy-l1-1-0
0x180023EA4: "__cdecl _midl_frag18" __midl_frag18
0x1800202F0: "__cdecl _imp_ProxyHelperProviderUnregisterEventNotification" __imp_ProxyHelperProviderUnregisterEventNotification
0x18001FB68: "__cdecl _imp_FWChangeNotificationCreate" __imp_FWChangeNotificationCreate
0x18001FED0: api-ms-win-core-heap-l1-1-0_NULL_THUNK_DATA
0x18001C908: NcaRpcAPIsGetAccessTokenFromClientBinding
0x180022420: "NcaEngineOpen" ??_C@_1BM@BIOGEOLH@?$AAN?$AAc?$AAa?$AAE?$AAn?$AAg?$AAi?$AAn?$AAe?$AAO?$AAp?$AAe?$AAn?$AA?$AA@
0x1800291C0: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxumvgUmxzUhexUlyquivUznwGEUkivxlnkOlyq@NcaSvc" __@@_PchSym_@00@KxulyqvxgPillgKxumvgUmxzUhexUlyquivUznwGEUkivxlnkOlyq@NcaSvc
0x180005BB0: NcaCustomCommandEmpty
0x180028D40: "struct NCA_WTS_TRIGGER_COMP_ gNcaWtsTriggerComp" ?gNcaWtsTriggerComp@@3UNCA_WTS_TRIGGER_COMP_@@A
0x180020A00: "6to4 Configuration (Get-Net6to4C" ??_C@_1FM@PHLBHBKI@?$AA6?$AAt?$AAo?$AA4?$AA?5?$AAC?$AAo?$AAn?$AAf?$AAi?$AAg?$AAu?$AAr?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?5?$AA?$CI?$AAG?$AAe?$AAt?$AA?9?$AAN?$AAe?$AAt?$AA6?$AAt?$AAo?$AA4?$AAC@
0x18001C6BC: "long __cdecl NcaRpcAPIsRegisterAuthInfo(void)" ?NcaRpcAPIsRegisterAuthInfo@@YAJXZ
0x180006318: "void __cdecl NcaApiSrvImplShutdownAbortSubscriptions(void)" ?NcaApiSrvImplShutdownAbortSubscriptions@@YAXXZ
0x180022930: "WtsSessionChange" ??_C@_1CC@ONGCALBM@?$AAW?$AAt?$AAs?$AAS?$AAe?$AAs?$AAs?$AAi?$AAo?$AAn?$AAC?$AAh?$AAa?$AAn?$AAg?$AAe?$AA?$AA@
0x1800202A0: "__cdecl _imp_NotifyServiceStatusChangeW" __imp_NotifyServiceStatusChangeW
0x180003360: ServiceMain
0x18001FDE8: "__cdecl _imp_WSACleanup" __imp_WSACleanup
0x18001FBE0: "__cdecl _imp_UnregisterWait" __imp_UnregisterWait
0x18002074C: "__cdecl _guard_iat_table" __guard_iat_table
0x18001FF10: api-ms-win-core-processenvironment-l1-1-0_NULL_THUNK_DATA
0x180001D96: memcpy
0x180029400: "struct NCA_EVCOLL_IPV6_COMPONENT_ gNcaEvCollIPv6" ?gNcaEvCollIPv6@@3UNCA_EVCOLL_IPV6_COMPONENT_@@A
0x18000C0C4: "unsigned long __cdecl NcaIPTriggerGetAddresses(void)" ?NcaIPTriggerGetAddresses@@YAKXZ
0x18001FD18: "__cdecl _imp_ImpersonateSecurityContext" __imp_ImpersonateSecurityContext
0x1800151F0: "long __cdecl NcaEvCollFirewallInitialize(void)" ?NcaEvCollFirewallInitialize@@YAJXZ
0x180023660: "NCA_EVCOLLECTOR_IPHTTPS_PROXY_CR" ??_C@_1FG@JOENIEGC@?$AAN?$AAC?$AAA?$AA_?$AAE?$AAV?$AAC?$AAO?$AAL?$AAL?$AAE?$AAC?$AAT?$AAO?$AAR?$AA_?$AAI?$AAP?$AAH?$AAT?$AAT?$AAP?$AAS?$AA_?$AAP?$AAR?$AAO?$AAX?$AAY?$AA_?$AAC?$AAR@
0x180022818: "NetProfm" ??_C@_1BC@FLHCEALD@?$AAN?$AAe?$AAt?$AAP?$AAr?$AAo?$AAf?$AAm?$AA?$AA@
0x18001FDD0: "__cdecl _imp_InetPtonW" __imp_InetPtonW
0x18001FA70: NCA_ServerInfo
0x1800237F8: "NCA_EVCOLLECTOR_DTE_SAS" ??_C@_1DA@MIKJMGON@?$AAN?$AAC?$AAA?$AA_?$AAE?$AAV?$AAC?$AAO?$AAL?$AAL?$AAE?$AAC?$AAT?$AAO?$AAR?$AA_?$AAD?$AAT?$AAE?$AA_?$AAS?$AAA?$AAS?$AA?$AA@
0x1800201E8: "__cdecl _imp_EventWriteTransfer" __imp_EventWriteTransfer
0x18000E1C0: "void __cdecl NcaProxyProviderEventCallback(void * __ptr64,enum _PROXYMGR_PROVIDER_EVENT)" ?NcaProxyProviderEventCallback@@YAXPEAXW4_PROXYMGR_PROVIDER_EVENT@@@Z
0x1800022C8: "int __cdecl NcaIsPolicyPresent(void)" ?NcaIsPolicyPresent@@YAHXZ
0x18001FE68: "__cdecl _imp_GetTempFileNameW" __imp_GetTempFileNameW
0x180020368: "__cdecl _imp_memset" __imp_memset
0x180020070: "__cdecl _imp_WaitForSingleObjectEx" __imp_WaitForSingleObjectEx
0x180022D80: "Force_Tunneling" ??_C@_1CA@BDHBBFAK@?$AAF?$AAo?$AAr?$AAc?$AAe?$AA_?$AAT?$AAu?$AAn?$AAn?$AAe?$AAl?$AAi?$AAn?$AAg?$AA?$AA@
0x180019C64: NcaGetLongPathName
0x180020090: "__cdecl _imp_CreateEventW" __imp_CreateEventW
0x18001FEA0: api-ms-win-core-file-l1-2-0_NULL_THUNK_DATA
0x180001C2F: "__cdecl initterm" _initterm
0x18000AAD0: "public: virtual long __cdecl CNlmTriggerInetConnEventSink::ConnectivityChanged(enum NLM_CONNECTIVITY) __ptr64" ?ConnectivityChanged@CNlmTriggerInetConnEventSink@@UEAAJW4NLM_CONNECTIVITY@@@Z
0x18001FD00: "__cdecl _imp_UuidEqual" __imp_UuidEqual
0x1800201B8: "__cdecl _imp_TraceMessage" __imp_TraceMessage
0x180028A44: "unsigned long gNcaEtwPerfTrackDeploymentID" ?gNcaEtwPerfTrackDeploymentID@@3KA
0x180001120: "long __cdecl NcaApiSrvImplPhase2Initialize(void)" ?NcaApiSrvImplPhase2Initialize@@YAJXZ
0x180021808: "certMy" ??_C@_1O@BBFOALLJ@?$AAc?$AAe?$AAr?$AAt?$AAM?$AAy?$AA?$AA@
0x18001FC50: "__cdecl _imp_RpcServerInqDefaultPrincNameW" __imp_RpcServerInqDefaultPrincNameW
0x18000EAAC: "long __cdecl NcaMultisiteRegisterWMINotification(void)" ?NcaMultisiteRegisterWMINotification@@YAJXZ
0x180025A30: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0
0x180028A28: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x1800200C8: "__cdecl _imp_Sleep" __imp_Sleep
0x1800184B8: "unsigned long __cdecl NcaUserStoreGetUsername(struct NCA_USER_ * __ptr64,unsigned long,unsigned short * __ptr64,unsigned long * __ptr64)" ?NcaUserStoreGetUsername@@YAKPEAUNCA_USER_@@KPEAGPEAK@Z
0x180021AC0: NcaSvc_PerfTrack_NAPRequired_DAConnected_Start
0x180020480: "__cdecl _xi_z" __xi_z
0x180020108: "__cdecl _imp_GetSystemTime" __imp_GetSystemTime
0x180021F70: "State" ??_C@_1M@LAGHHMEN@?$AAS?$AAt?$AAa?$AAt?$AAe?$AA?$AA@
0x18000EE10: "public: virtual long __cdecl NcaMultisiteEventSink::QueryInterface(struct _GUID const & __ptr64,void * __ptr64 * __ptr64) __ptr64" ?QueryInterface@NcaMultisiteEventSink@@UEAAJAEBU_GUID@@PEAPEAX@Z
0x18001185C: "void __cdecl NcaEvCollProbeStop(struct NCA_EVCOLL_PROBE_ * __ptr64)" ?NcaEvCollProbeStop@@YAXPEAUNCA_EVCOLL_PROBE_@@@Z
0x180021DD0: "CreateThread" ??_C@_0N@OGAMMJPI@CreateThread?$AA@
0x1800207E0: "NcaSvc" ??_C@_1O@OKMOLHOL@?$AAN?$AAc?$AAa?$AAS?$AAv?$AAc?$AA?$AA@
0x180023548: "NCA_EVCOLLECTOR_RESOLVE_NAMES" ??_C@_1DM@PHBLGAJF@?$AAN?$AAC?$AAA?$AA_?$AAE?$AAV?$AAC?$AAO?$AAL?$AAL?$AAE?$AAC?$AAT?$AAO?$AAR?$AA_?$AAR?$AAE?$AAS?$AAO?$AAL?$AAV?$AAE?$AA_?$AAN?$AAA?$AAM?$AAE?$AAS?$AA?$AA@
0x18001FE48: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x180022898: WPP_471d032596d03d2d67180357ec197cd0_Traceguids
0x180020380: "__cdecl _imp_wcscmp" __imp_wcscmp
0x18001FD88: USERENV_NULL_THUNK_DATA
0x180004F60: "long __cdecl NcaCustomCommandConstruct(void * __ptr64,struct HKEY__ * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,void * __ptr64,int * __ptr64)" ?NcaCustomCommandConstruct@@YAJPEAXPEAUHKEY__@@PEBG20PEAH@Z
0x180001C3B: "__cdecl _C_specific_handler" __C_specific_handler
0x180029450: "struct NCA_EVCOLL_PROBES_COMPONENT_ gNcaEvCollProbes" ?gNcaEvCollProbes@@3UNCA_EVCOLL_PROBES_COMPONENT_@@A
0x1800202D0: "__cdecl _imp_FwpmNetEventUnsubscribe0" __imp_FwpmNetEventUnsubscribe0
0x180020B80: "Teredo Configuration (Get-NetTer" ??_C@_1GE@JFMNPHLF@?$AAT?$AAe?$AAr?$AAe?$AAd?$AAo?$AA?5?$AAC?$AAo?$AAn?$AAf?$AAi?$AAg?$AAu?$AAr?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?5?$AA?$CI?$AAG?$AAe?$AAt?$AA?9?$AAN?$AAe?$AAt?$AAT?$AAe?$AAr@
0x180020078: "__cdecl _imp_ReleaseSRWLockExclusive" __imp_ReleaseSRWLockExclusive
0x1800235C0: "NCA_EVCOLLECTOR_IPHTTPS_DOWN" ??_C@_1DK@JIANBIJG@?$AAN?$AAC?$AAA?$AA_?$AAE?$AAV?$AAC?$AAO?$AAL?$AAL?$AAE?$AAC?$AAT?$AAO?$AAR?$AA_?$AAI?$AAP?$AAH?$AAT?$AAT?$AAP?$AAS?$AA_?$AAD?$AAO?$AAW?$AAN?$AA?$AA@
0x18000B09C: "long __cdecl NcaNlmTriggerConnectionStateAdvice(struct NCA_NLM_CONN_POINT_STATE * __ptr64)" ?NcaNlmTriggerConnectionStateAdvice@@YAJPEAUNCA_NLM_CONN_POINT_STATE@@@Z
0x18001F478: RundownRoutines
0x18001D8E0: PdcPortClose
0x1800161A0: "void __cdecl NcaDAPEvidenceUserSnapshotDestroy(struct NCA_DAP_USER_EVSNPSHT_ * __ptr64)" ?NcaDAPEvidenceUserSnapshotDestroy@@YAXPEAUNCA_DAP_USER_EVSNPSHT_@@@Z
0x18001BF10: Rpc_NcaExecuteAndCaptureLogs
0x18001A374: NcaStringCopy
0x18001FBE8: "__cdecl _imp_TerminateJobObject" __imp_TerminateJobObject
0x18001FEB8: "__cdecl _imp_HeapFree" __imp_HeapFree
0x180021FC0: "SOFTWARE\Policies\Microsoft\Wind" ??_C@_1IC@ODJPFAEO@?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAP?$AAo?$AAl?$AAi?$AAc?$AAi?$AAe?$AAs?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd@
0x18001E034: PdcpProcessMessageInternal
0x180028BF0: WPP_REGISTRATION_GUIDS
0x180004C20: "void __cdecl NcaConfigMgrUpdate(void * __ptr64,void * __ptr64,void * __ptr64,void * __ptr64)" ?NcaConfigMgrUpdate@@YAXPEAX000@Z
0x18001A588: WPP_SF_ssL
0x180021AA0: ProbeCallback
0x180002AA0: "void __cdecl NcaServiceOnShutdownCallback(void * __ptr64,unsigned char)" ?NcaServiceOnShutdownCallback@@YAXPEAXE@Z
0x180020288: "__cdecl _imp_OpenServiceW" __imp_OpenServiceW
0x180007FEC: "unsigned long __cdecl NcaScriptLogsCreateTempFile(void * __ptr64 * __ptr64)" ?NcaScriptLogsCreateTempFile@@YAKPEAPEAX@Z
0x18000230C: "void __cdecl NcaReleaseCancelableLock(struct _tag_NCA_CANCELABLE_LOCK * __ptr64)" ?NcaReleaseCancelableLock@@YAXPEAU_tag_NCA_CANCELABLE_LOCK@@@Z
0x180024448: CLSID_WbemLocator
0x18001FEB0: api-ms-win-core-handle-l1-1-0_NULL_THUNK_DATA
0x180020030: "__cdecl _imp_InitializeCriticalSectionAndSpinCount" __imp_InitializeCriticalSectionAndSpinCount
0x180022DA0: "Enabled" ??_C@_1BA@NPJPKIM@?$AAE?$AAn?$AAa?$AAb?$AAl?$AAe?$AAd?$AA?$AA@
0x18001E1A8: SymCryptMarvin32
0x180010AF4: "unsigned long __cdecl NcaEvCollHttpProbeSessionInit(struct NCA_EVCOLL_PROBE_ * __ptr64)" ?NcaEvCollHttpProbeSessionInit@@YAKPEAUNCA_EVCOLL_PROBE_@@@Z
0x180022C60: "MultisiteTrigger" ??_C@_1CC@HPKMCEMH@?$AAM?$AAu?$AAl?$AAt?$AAi?$AAs?$AAi?$AAt?$AAe?$AAT?$AAr?$AAi?$AAg?$AAg?$AAe?$AAr?$AA?$AA@
0x18001FFC0: "__cdecl _imp_RegCloseKey" __imp_RegCloseKey
0x180014BD0: "long __cdecl NcaEvCollProxyInitialize(void)" ?NcaEvCollProxyInitialize@@YAJXZ
0x1800202E0: fwpuclnt_NULL_THUNK_DATA
0x180022440: "NcaEngineClose" ??_C@_1BO@CAAIGKFF@?$AAN?$AAc?$AAa?$AAE?$AAn?$AAg?$AAi?$AAn?$AAe?$AAC?$AAl?$AAo?$AAs?$AAe?$AA?$AA@
0x180001D34: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x180006250: "void __cdecl NcaApiSrvImplPhase2Shutdown(void)" ?NcaApiSrvImplPhase2Shutdown@@YAXXZ
0x1800055E0: NcaConfigMgrInitialize
0x18001FD30: "__cdecl _imp_AcquireCredentialsHandleW" __imp_AcquireCredentialsHandleW
0x180023B10: "NcaStringBuild" ??_C@_0P@NFLPNNLK@NcaStringBuild?$AA@
0x180008AF0: "unsigned long __cdecl NcaScriptLogsOpenLogFile(unsigned short const * __ptr64,void * __ptr64 * __ptr64)" ?NcaScriptLogsOpenLogFile@@YAKPEBGPEAPEAX@Z
0x180010DE8: "void __cdecl NcaEvCollPingProbeCollect(struct NCA_EVCOLL_PROBE_ * __ptr64,struct NCA_EVCOLL_USER_PROBES_ * __ptr64)" ?NcaEvCollPingProbeCollect@@YAXPEAUNCA_EVCOLL_PROBE_@@PEAUNCA_EVCOLL_USER_PROBES_@@@Z
0x180020EC0: "Certificate Store (root) (certut" ??_C@_1GA@PPFEEHOH@?$AAC?$AAe?$AAr?$AAt?$AAi?$AAf?$AAi?$AAc?$AAa?$AAt?$AAe?$AA?5?$AAS?$AAt?$AAo?$AAr?$AAe?$AA?5?$AA?$CI?$AAr?$AAo?$AAo?$AAt?$AA?$CJ?$AA?5?$AA?$CI?$AAc?$AAe?$AAr?$AAt?$AAu?$AAt@
0x1800171C4: NcaDAPEvidenceUserSnapshotRemove
0x1800078D8: "unsigned long __cdecl SvrImpl_NcaStatusEventUnsubscribe(void * __ptr64,void * __ptr64,void * __ptr64 * __ptr64)" ?SvrImpl_NcaStatusEventUnsubscribe@@YAKPEAX0PEAPEAX@Z
0x18000BC5C: NcaNlmTriggerGetInternetConnectivity
0x18001BFD0: Rpc_NcaGetConfig
0x180022E80: "SYSTEM\CurrentControlSet\Service" ??_C@_1GK@MGNNPNHB@?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA?2?$AAS?$AAe?$AAr?$AAv?$AAi?$AAc?$AAe@
0x180020410: "__cdecl _imp_RtlAllocateHeap" __imp_RtlAllocateHeap
0x180022558: "NcaGetConfig" ??_C@_1BK@MALHNDOI@?$AAN?$AAc?$AAa?$AAG?$AAe?$AAt?$AAC?$AAo?$AAn?$AAf?$AAi?$AAg?$AA?$AA@
0x18001FBC8: "__cdecl _imp_FreeMibTable" __imp_FreeMibTable
0x180020028: api-ms-win-core-string-l1-1-0_NULL_THUNK_DATA
0x180028BC8: WPP_MAIN_CB
0x180020F70: "NRPT Policy (Get-DnsClientNrptPo" ??_C@_1EM@NOEJPIGA@?$AAN?$AAR?$AAP?$AAT?$AA?5?$AAP?$AAo?$AAl?$AAi?$AAc?$AAy?$AA?5?$AA?$CI?$AAG?$AAe?$AAt?$AA?9?$AAD?$AAn?$AAs?$AAC?$AAl?$AAi?$AAe?$AAn?$AAt?$AAN?$AAr?$AAp?$AAt?$AAP?$AAo@
0x1800203F8: "__cdecl _imp_AlpcInitializeMessageAttribute" __imp_AlpcInitializeMessageAttribute
0x180006D94: "unsigned long __cdecl SvrImpl_NcaGetEvidenceCollectorResult(void * __ptr64,void * __ptr64,enum NCA_EVCOLLECTOR_,unsigned long,unsigned long,int * __ptr64)" ?SvrImpl_NcaGetEvidenceCollectorResult@@YAKPEAX0W4NCA_EVCOLLECTOR_@@KKPEAH@Z
0x180025954: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0
0x18001FFA0: "__cdecl _imp_RegSetValueExW" __imp_RegSetValueExW
0x180001A61: "__cdecl amsg_exit" _amsg_exit
0x1800203D0: "__cdecl _imp_ZwAlpcQueryInformation" __imp_ZwAlpcQueryInformation
0x18000B810: "public: virtual long __cdecl CNlmTriggerInetConnEventSink::QueryInterface(struct _GUID const & __ptr64,void * __ptr64 * __ptr64) __ptr64" ?QueryInterface@CNlmTriggerInetConnEventSink@@UEAAJAEBU_GUID@@PEAPEAX@Z
0x180023B00: "NcaAlloc" ??_C@_08JIGOGMIK@NcaAlloc?$AA@
0x180015FF4: "void __cdecl NcaDAPEvidenceSnapshotTrace(struct NCA_EVIDENCE_ * __ptr64)" ?NcaDAPEvidenceSnapshotTrace@@YAXPEAUNCA_EVIDENCE_@@@Z
0x180022B60: "PROXYMGR_PROVIDER_EVENT_PROXY_SE" ??_C@_1GC@HDPIAGEA@?$AAP?$AAR?$AAO?$AAX?$AAY?$AAM?$AAG?$AAR?$AA_?$AAP?$AAR?$AAO?$AAV?$AAI?$AAD?$AAE?$AAR?$AA_?$AAE?$AAV?$AAE?$AAN?$AAT?$AA_?$AAP?$AAR?$AAO?$AAX?$AAY?$AA_?$AAS?$AAE@
0x180021BC8: ApiActivityStart
0x180029B9C: "unsigned long gNcaSQMLogUIStatesValue" ?gNcaSQMLogUIStatesValue@@3KA
0x180020B58: "teredoConfig" ??_C@_1BK@GHNGOOG@?$AAt?$AAe?$AAr?$AAe?$AAd?$AAo?$AAC?$AAo?$AAn?$AAf?$AAi?$AAg?$AA?$AA@
0x180023588: "NCA_EVCOLLECTOR_TEREDO_DOWN" ??_C@_1DI@HEJNACJA@?$AAN?$AAC?$AAA?$AA_?$AAE?$AAV?$AAC?$AAO?$AAL?$AAL?$AAE?$AAC?$AAT?$AAO?$AAR?$AA_?$AAT?$AAE?$AAR?$AAE?$AAD?$AAO?$AA_?$AAD?$AAO?$AAW?$AAN?$AA?$AA@
0x1800200E8: "__cdecl _imp_CreateWaitableTimerW" __imp_CreateWaitableTimerW
0x180024458: CLSID_WbemAdministrativeLocator
0x1800225B8: "NcaExecuteAndCaptureLogs" ??_C@_1DC@EJCPGEJC@?$AAN?$AAc?$AAa?$AAE?$AAx?$AAe?$AAc?$AAu?$AAt?$AAe?$AAA?$AAn?$AAd?$AAC?$AAa?$AAp?$AAt?$AAu?$AAr?$AAe?$AAL?$AAo?$AAg?$AAs?$AA?$AA@
0x18001FB60: DNSAPI_NULL_THUNK_DATA
0x180020230: "__cdecl _imp_AccessCheck" __imp_AccessCheck
0x180021F68: "WQL" ??_C@_17NDCOOGJO@?$AAW?$AAQ?$AAL?$AA?$AA@
0x180029B98: "int gNcaEtwEventsInitialized" ?gNcaEtwEventsInitialized@@3HA
0x180023D40: "NcaRegEnumValueNameAndValueData" ??_C@_0CA@GAHKGDOC@NcaRegEnumValueNameAndValueData?$AA@
0x180014120: "void __cdecl NcaEvCollNamePrefGroupPolicyChange(void * __ptr64,void * __ptr64,void * __ptr64,void * __ptr64)" ?NcaEvCollNamePrefGroupPolicyChange@@YAXPEAX000@Z
0x18000F0F0: "void __cdecl NcaEvCollPolicyPresenceCollect(void * __ptr64,void * __ptr64,void * __ptr64,void * __ptr64)" ?NcaEvCollPolicyPresenceCollect@@YAXPEAX000@Z
0x180025ABC: "__cdecl _IMPORT_DESCRIPTOR_bcrypt" __IMPORT_DESCRIPTOR_bcrypt
0x1800242D0: "unsigned long * AccessCheckAccessRights" ?AccessCheckAccessRights@@3PAKA
0x180023A58: "Kerberos" ??_C@_1BC@KFNANHG@?$AAK?$AAe?$AAr?$AAb?$AAe?$AAr?$AAo?$AAs?$AA?$AA@
0x18000E454: "long __cdecl NcaProxyTriggerInitializeProvider(void)" ?NcaProxyTriggerInitializeProvider@@YAJXZ
0x18000C1E4: "void __cdecl NotifyCallback(void * __ptr64,enum _MIB_NOTIFICATION_TYPE)" ?NotifyCallback@@YAXPEAXW4_MIB_NOTIFICATION_TYPE@@@Z
0x18000A864: NcaGPTriggerRegisterWait
0x1800200B0: "__cdecl _imp_SleepConditionVariableCS" __imp_SleepConditionVariableCS
0x1800162B0: "void __cdecl NcaDAPProcessRequest(void * __ptr64,void * __ptr64,void * __ptr64,void * __ptr64)" ?NcaDAPProcessRequest@@YAXPEAX000@Z
0x18000EEB0: NcaMultisiteTriggerInitialize
0x180003780: SvchostPushServiceGlobals
0x18000D2C0: NcaWfpTriggerInitialize
0x1800293C0: "struct NCA_EVCOLL_INTERNET_COMPONENT_ gNcaEvCollInet" ?gNcaEvCollInet@@3UNCA_EVCOLL_INTERNET_COMPONENT_@@A
0x180020188: "__cdecl _imp_CloseThreadpoolTimer" __imp_CloseThreadpoolTimer
0x18001C410: Rpc_NcaStatusEventSubscriptionGetLastEvent
0x180008DC0: "unsigned long __cdecl NcaScriptLogsStartProcess(unsigned short * __ptr64,unsigned short * __ptr64,void * __ptr64,struct NCA_PROCESS_ENVIRONMENT_ * __ptr64)" ?NcaScriptLogsStartProcess@@YAKPEAG0PEAXPEAUNCA_PROCESS_ENVIRONMENT_@@@Z
0x180029AA8: "unsigned short * __ptr64 * wszNcaLogStatusEventTypes" ?wszNcaLogStatusEventTypes@@3PAPEAGA
0x1800283E0: "unsigned long * NcaProbeResultIds" ?NcaProbeResultIds@@3PAKA
0x1800215F0: "Get-DAEntryPointTableItem | Out-" ??_C@_1FA@DDIAFEAP@?$AAG?$AAe?$AAt?$AA?9?$AAD?$AAA?$AAE?$AAn?$AAt?$AAr?$AAy?$AAP?$AAo?$AAi?$AAn?$AAt?$AAT?$AAa?$AAb?$AAl?$AAe?$AAI?$AAt?$AAe?$AAm?$AA?5?$AA?$HM?$AA?5?$AAO?$AAu?$AAt?$AA?9@
0x18001FC48: OLEAUT32_NULL_THUNK_DATA
0x180023C80: "RegQueryInfoKeyW" ??_C@_0BB@BILFPGMA@RegQueryInfoKeyW?$AA@
0x180022DB0: WPP_90e03f77129537b7d576e0fd271b26be_Traceguids
0x180015C10: NcaEvCollIdleShutdown
0x1800207A0: CLSID_NetworkListManager
0x180021010: "winsock" ??_C@_1BA@KEMBLBMD@?$AAw?$AAi?$AAn?$AAs?$AAo?$AAc?$AAk?$AA?$AA@
0x180023BE8: "InitializeCriticalSectionAndSpin" ??_C@_0CG@PKBDLMEO@InitializeCriticalSectionAndSpin@
0x180002C3C: "void __cdecl NcaServiceShutdown(void)" ?NcaServiceShutdown@@YAXXZ
0x18001FDB8: "__cdecl _imp_WinHttpOpen" __imp_WinHttpOpen
0x18001FE08: "__cdecl _imp_CoUninitialize" __imp_CoUninitialize
0x180020278: api-ms-win-service-core-l1-1-0_NULL_THUNK_DATA
0x180007C40: MIDL_nca_allocate
0x180001120: "public: virtual long __cdecl NcaMultisiteEventSink::SetStatus(long,long,unsigned short * __ptr64,struct IWbemClassObject * __ptr64) __ptr64" ?SetStatus@NcaMultisiteEventSink@@UEAAJJJPEAGPEAUIWbemClassObject@@@Z
0x180018F30: "void __cdecl NcaEtwPerfTrackStopScenarios(void)" ?NcaEtwPerfTrackStopScenarios@@YAXXZ
0x180022AA0: "PROXYMGR_PROVIDER_EVENT_NO_PROXY" ??_C@_1FE@BIPCDNJB@?$AAP?$AAR?$AAO?$AAX?$AAY?$AAM?$AAG?$AAR?$AA_?$AAP?$AAR?$AAO?$AAV?$AAI?$AAD?$AAE?$AAR?$AA_?$AAE?$AAV?$AAE?$AAN?$AAT?$AA_?$AAN?$AAO?$AA_?$AAP?$AAR?$AAO?$AAX?$AAY@
0x180020050: "__cdecl _imp_EnterCriticalSection" __imp_EnterCriticalSection
0x18001B6E0: NcaArrayCreateFromRegistry
0x180020088: "__cdecl _imp_ReleaseSRWLockShared" __imp_ReleaseSRWLockShared
0x1800218F8: "Groups (whoami /all)" ??_C@_1CK@HOMFNFHK@?$AAG?$AAr?$AAo?$AAu?$AAp?$AAs?$AA?5?$AA?$CI?$AAw?$AAh?$AAo?$AAa?$AAm?$AAi?$AA?5?$AA?1?$AAa?$AAl?$AAl?$AA?$CJ?$AA?$AA@
0x18001FFE0: api-ms-win-core-registry-l1-1-0_NULL_THUNK_DATA
0x1800201B0: "__cdecl _imp_GetTraceLoggerHandle" __imp_GetTraceLoggerHandle
0x1800217C0: "Get-NetPrefixPolicy | Out-Defaul" ??_C@_1EE@PNONPEDH@?$AAG?$AAe?$AAt?$AA?9?$AAN?$AAe?$AAt?$AAP?$AAr?$AAe?$AAf?$AAi?$AAx?$AAP?$AAo?$AAl?$AAi?$AAc?$AAy?$AA?5?$AA?$HM?$AA?5?$AAO?$AAu?$AAt?$AA?9?$AAD?$AAe?$AAf?$AAa?$AAu?$AAl@
0x180004758: "void __cdecl NcaConfigMgrPolicyEmpty(struct NCA_POLICY_ * __ptr64)" ?NcaConfigMgrPolicyEmpty@@YAXPEAUNCA_POLICY_@@@Z
0x180021BB0: ProbeEnd
0x18001FE58: api-ms-win-core-errorhandling-l1-1-0_NULL_THUNK_DATA
0x1800201C0: "__cdecl _imp_GetTraceEnableLevel" __imp_GetTraceEnableLevel
0x180022E30: WPP_84c58bc6017d39770cd44905612634ba_Traceguids
0x180028080: "struct NCA_COMMAND_ENVIROMENT_ * gScriptLogAdminCommands" ?gScriptLogAdminCommands@@3PAUNCA_COMMAND_ENVIROMENT_@@A
0x18001FDA0: "__cdecl _imp_WinHttpCloseHandle" __imp_WinHttpCloseHandle
0x18000E5F0: "void __cdecl NcaProxyTriggerShutdown(void)" ?NcaProxyTriggerShutdown@@YAXXZ
0x180013760: "void __cdecl NcaEvCollStrongAuthLockUnlockCollect(void * __ptr64,void * __ptr64,void * __ptr64,void * __ptr64)" ?NcaEvCollStrongAuthLockUnlockCollect@@YAXPEAX000@Z
0x18001DCDC: PdcPortSendMessage
0x18002839C: "unsigned long * NcaScriptLogProbeStatusIds" ?NcaScriptLogProbeStatusIds@@3PAKA
0x18000AC84: "long __cdecl NcaNlmTriggerConnectionPointInitialize(void)" ?NcaNlmTriggerConnectionPointInitialize@@YAJXZ
0x180023038: "EvCollHealth" ??_C@_1BK@JOLBGGPF@?$AAE?$AAv?$AAC?$AAo?$AAl?$AAl?$AAH?$AAe?$AAa?$AAl?$AAt?$AAh?$AA?$AA@
0x180029210: "struct NCA_API_SRV_IMPL_COMPONENT_ gNcaApiSrvImpl" ?gNcaApiSrvImpl@@3UNCA_API_SRV_IMPL_COMPONENT_@@A
0x18001BC20: NcaRpcAPIsSecModeAccessCheckForClient
0x18001FF18: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x180009AFC: "unsigned long __cdecl NcaScriptsAppendChars(unsigned short const * __ptr64,unsigned long,unsigned short * __ptr64,unsigned long * __ptr64)" ?NcaScriptsAppendChars@@YAKPEBGKPEAGPEAK@Z
0x180025B0C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-lsalookup-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-lsalookup-l1-1-0
0x1800208B0: "IP Configuration (Get-NetIPConfi" ??_C@_1HC@JABDFNCC@?$AAI?$AAP?$AA?5?$AAC?$AAo?$AAn?$AAf?$AAi?$AAg?$AAu?$AAr?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?5?$AA?$CI?$AAG?$AAe?$AAt?$AA?9?$AAN?$AAe?$AAt?$AAI?$AAP?$AAC?$AAo?$AAn?$AAf?$AAi@
0x18001F320: "const CNlmTriggerProfileEventSink::`vftable'" ??_7CNlmTriggerProfileEventSink@@6B@
0x180028A18: "__cdecl _native_startup_lock" __native_startup_lock
0x18001FDB0: "__cdecl _imp_WinHttpOpenRequest" __imp_WinHttpOpenRequest
0x18001FD38: "__cdecl _imp_GetUserNameExW" __imp_GetUserNameExW
0x180001C78: DllMain
0x180023130: WPP_6fec6c1ad8a8303f14ca16bc8d5fe9a7_Traceguids
0x1800190DC: McTemplateU0qqqq
0x180021160: "ipsec" ??_C@_1M@JEONLKOG@?$AAi?$AAp?$AAs?$AAe?$AAc?$AA?$AA@
0x180017AA0: "unsigned long __cdecl NcaGetThreadToken(void * __ptr64,void * __ptr64 * __ptr64)" ?NcaGetThreadToken@@YAKPEAXPEAPEAX@Z
0x180020790: IID_INetworkEvents
0x18000E300: "long __cdecl NcaProxyTriggerInitialize(void)" ?NcaProxyTriggerInitialize@@YAJXZ
0x18000ADFC: "long __cdecl NcaNlmTriggerConnectionPointObjectsRefresh(struct NCA_NLM_CONN_POINT_STATE * __ptr64,struct NCA_NLM_CONN_POINT_STATE * __ptr64)" ?NcaNlmTriggerConnectionPointObjectsRefresh@@YAJPEAUNCA_NLM_CONN_POINT_STATE@@0@Z
0x18001F9F0: "__cdecl _midl_frag61" __midl_frag61
0x180020B20: "netsh winhttp show proxy" ??_C@_1DC@MECDBBJE@?$AAn?$AAe?$AAt?$AAs?$AAh?$AA?5?$AAw?$AAi?$AAn?$AAh?$AAt?$AAt?$AAp?$AA?5?$AAs?$AAh?$AAo?$AAw?$AA?5?$AAp?$AAr?$AAo?$AAx?$AAy?$AA?$AA@
0x180023F60: "__cdecl _midl_frag63" __midl_frag63
0x180023F58: "__cdecl _midl_frag62" __midl_frag62
0x180023A70: "host/" ??_C@_1M@MAKFBKFH@?$AAh?$AAo?$AAs?$AAt?$AA?1?$AA?$AA@
0x180023140: "EvCollProxy" ??_C@_1BI@IOPCIJHM@?$AAE?$AAv?$AAC?$AAo?$AAl?$AAl?$AAP?$AAr?$AAo?$AAx?$AAy?$AA?$AA@
0x180021BA0: NcaSvc_PerfTrack_SmartcardEntered_DAConnected_Stop
0x180023F78: "__cdecl _midl_frag68" __midl_frag68
0x18001FC98: "__cdecl _imp_RpcServerInqBindings" __imp_RpcServerInqBindings
0x180005E80: "void __cdecl NcaApiSrvImplInvalidateSubscriptionHandle(struct NCA_INTSERVER_NETWORK_HANDLE_ * __ptr64)" ?NcaApiSrvImplInvalidateSubscriptionHandle@@YAXPEAUNCA_INTSERVER_NETWORK_HANDLE_@@@Z
0x1800259B8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-string-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-string-l1-1-0
0x180021EC8: "FILE:" ??_C@_1M@IHOKFDFC@?$AAF?$AAI?$AAL?$AAE?$AA?3?$AA?$AA@
0x18001F6C0: "__cdecl _midl_frag6" __midl_frag6
0x180020348: "__cdecl _imp__wcsicmp" __imp__wcsicmp
0x1800200D0: "__cdecl _imp_InitializeConditionVariable" __imp_InitializeConditionVariable
0x180012830: McTemplateU0qzq
0x180020310: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x180022F40: "%s%s<br> " ??_C@_1BG@EPCLCDIM@?$AA?$CF?$AAs?$AA?$CF?$AAs?$AA?$DM?$AAb?$AAr?$AA?$DO?$AA?$AN?$AA?6?$AA?$AA@
0x1800226D8: " }"" ??_C@_17NOCMDLGK@?$AA?5?$AA?$HN?$AA?$CC?$AA?$AA@
0x180023C60: "RegOpenKeyExW" ??_C@_0O@COHOBMLB@RegOpenKeyExW?$AA@
0x18001FF20: "__cdecl _imp_ResumeThread" __imp_ResumeThread
0x18001FFE8: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x180029680: "struct NCA_EVCOLL_IDLE_COMPONENT_ gNcaEvCollIdle" ?gNcaEvCollIdle@@3UNCA_EVCOLL_IDLE_COMPONENT_@@A
0x18000FBB0: NcaEvCollInternetConnectivityShutdown
0x18001FF00: api-ms-win-core-libraryloader-l1-2-0_NULL_THUNK_DATA
0x180028A48: "unsigned long gNcaEtwPerfTrackMachineID" ?gNcaEtwPerfTrackMachineID@@3KA
0x180023C40: "RegCreateKeyExW" ??_C@_0BA@MPOFGLLA@RegCreateKeyExW?$AA@
0x180025878: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-eventing-provider-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-eventing-provider-l1-1-0
0x180020EA8: "certRoot" ??_C@_1BC@FDCJNGFE@?$AAc?$AAe?$AAr?$AAt?$AAR?$AAo?$AAo?$AAt?$AA?$AA@
0x18000D84C: McTemplateU0zz
0x180023168: "ErrorCode" ??_C@_1BE@ILMBBNLH@?$AAE?$AAr?$AAr?$AAo?$AAr?$AAC?$AAo?$AAd?$AAe?$AA?$AA@
0x180021738: "prefixPolicy" ??_C@_1BK@DPDDFIFF@?$AAp?$AAr?$AAe?$AAf?$AAi?$AAx?$AAP?$AAo?$AAl?$AAi?$AAc?$AAy?$AA?$AA@
0x18001FC20: KERNEL32_NULL_THUNK_DATA
0x180023C98: "NcaRegQueryNumValues" ??_C@_0BF@MIFKEACC@NcaRegQueryNumValues?$AA@
0x180029540: "struct NCA_EVCOLL_NAMEPREF_COMPONENT_ gNcaEvCollNamePref" ?gNcaEvCollNamePref@@3UNCA_EVCOLL_NAMEPREF_COMPONENT_@@A
0x180012794: McTemplateU0qz
0x1800200C0: "__cdecl _imp_SleepConditionVariableSRW" __imp_SleepConditionVariableSRW
0x18001FE38: "__cdecl _imp_GetLastError" __imp_GetLastError
0x180022880: "IPTrigger" ??_C@_1BE@HLMIOACP@?$AAI?$AAP?$AAT?$AAr?$AAi?$AAg?$AAg?$AAe?$AAr?$AA?$AA@
0x1800201F0: api-ms-win-eventing-provider-l1-1-0_NULL_THUNK_DATA
0x1800234B0: "NCA_EVCOLLECTOR_INET_CONNECTIVIT" ??_C@_1EE@BONDJNFD@?$AAN?$AAC?$AAA?$AA_?$AAE?$AAV?$AAC?$AAO?$AAL?$AAL?$AAE?$AAC?$AAT?$AAO?$AAR?$AA_?$AAI?$AAN?$AAE?$AAT?$AA_?$AAC?$AAO?$AAN?$AAN?$AAE?$AAC?$AAT?$AAI?$AAV?$AAI?$AAT@
0x180024080: rpcncaengine__MIDL_ProcFormatString
0x180028374: "__cdecl _native_dllmain_reason" __native_dllmain_reason
0x18001CE44: NcaRpcAPIsInterfaceDestroy
0x180001D10: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x180020C48: "teredoState" ??_C@_1BI@JOEIKNLH@?$AAt?$AAe?$AAr?$AAe?$AAd?$AAo?$AAS?$AAt?$AAa?$AAt?$AAe?$AA?$AA@
0x180028A00: "__cdecl tls_index" _tls_index
0x1800111B4: "unsigned long __cdecl NcaEvCollPingProbeSessionShutdown(struct NCA_EVCOLL_PROBE_ * __ptr64)" ?NcaEvCollPingProbeSessionShutdown@@YAKPEAUNCA_EVCOLL_PROBE_@@@Z
0x180023430: "NCA_EVCOLLECTOR_SMARTCARD_NEEDED" ??_C@_1EC@NLCFMMBH@?$AAN?$AAC?$AAA?$AA_?$AAE?$AAV?$AAC?$AAO?$AAL?$AAL?$AAE?$AAC?$AAT?$AAO?$AAR?$AA_?$AAS?$AAM?$AAA?$AAR?$AAT?$AAC?$AAA?$AAR?$AAD?$AA_?$AAN?$AAE?$AAE?$AAD?$AAE?$AAD@
0x180020398: "__cdecl _imp_EtwTraceMessage" __imp_EtwTraceMessage
0x180023000: "S-1-5-65-1" ??_C@_1BG@NBPGGBBH@?$AAS?$AA?9?$AA1?$AA?9?$AA5?$AA?9?$AA6?$AA5?$AA?9?$AA1?$AA?$AA@
0x180001130: "public: virtual unsigned long __cdecl CNlmTriggerInetConnEventSink::AddRef(void) __ptr64" ?AddRef@CNlmTriggerInetConnEventSink@@UEAAKXZ
0x180023C50: "NcaRegCreateKey" ??_C@_0BA@NMGGPCHL@NcaRegCreateKey?$AA@
0x18000CDF0: "void __cdecl NcaWfpNetEventCallback(void * __ptr64,struct FWPM_NET_EVENT5_ const * __ptr64)" ?NcaWfpNetEventCallback@@YAXPEAXPEBUFWPM_NET_EVENT5_@@@Z
0x1800248B8: "__cdecl tls_start" _tls_start
0x1800218A0: "certutil -silent -store -user my" ??_C@_1EC@MIFNPKIL@?$AAc?$AAe?$AAr?$AAt?$AAu?$AAt?$AAi?$AAl?$AA?5?$AA?9?$AAs?$AAi?$AAl?$AAe?$AAn?$AAt?$AA?5?$AA?9?$AAs?$AAt?$AAo?$AAr?$AAe?$AA?5?$AA?9?$AAu?$AAs?$AAe?$AAr?$AA?5?$AAm?$AAy@
0x180020358: "__cdecl _imp_strchr" __imp_strchr
0x180020490: "__cdecl _xl_z" __xl_z
0x18001FE28: "__cdecl _imp_OutputDebugStringA" __imp_OutputDebugStringA
0x18000C664: NcaIPTriggerFindTunnelAddresses
0x1800145C0: NcaEvCollNamePrefInitialize
0x180006FD4: "unsigned long __cdecl SvrImpl_NcaNetworkClose(void * __ptr64,void * __ptr64,void * __ptr64 * __ptr64)" ?SvrImpl_NcaNetworkClose@@YAKPEAX0PEAPEAX@Z
0x180028A50: gNcaThisModuleHandle
0x180005B90: NcaConfigMgrUpdateVanUI
0x180020228: "__cdecl _imp_EqualSid" __imp_EqualSid
0x180022218: "NULL" ??_C@_19CIJIHAKK@?$AAN?$AAU?$AAL?$AAL?$AA?$AA@
0x18001FF68: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x180022F80: "%s<br>" ??_C@_1O@ICEICFKB@?$AA?$CF?$AAs?$AA?$DM?$AAb?$AAr?$AA?$DO?$AA?$AA@
0x180029500: "struct NCA_EVCOLL_HEALTH_COMPONENT_ gNcaEvCollHealth" ?gNcaEvCollHealth@@3UNCA_EVCOLL_HEALTH_COMPONENT_@@A
0x180020038: "__cdecl _imp_WaitForSingleObject" __imp_WaitForSingleObject
0x18001FBB0: "__cdecl _imp_CreateSortedAddressPairs" __imp_CreateSortedAddressPairs
0x18001FE70: "__cdecl _imp_GetLongPathNameW" __imp_GetLongPathNameW
0x1800200B8: "__cdecl _imp_WakeConditionVariable" __imp_WakeConditionVariable
0x180024380: "%s: ALPC message id=%x required " ??_C@_0EK@FKGLCLNP@?$CFs?3?5ALPC?5message?5id?$DN?$CFx?5required?5@
0x180029A78: "unsigned short * __ptr64 * wszNcaProbeType" ?wszNcaProbeType@@3PAPEAGA
0x180023298: "EvCollIdle" ??_C@_1BG@LEOAGOPM@?$AAE?$AAv?$AAC?$AAo?$AAl?$AAl?$AAI?$AAd?$AAl?$AAe?$AA?$AA@
0x180021E8C: "IP" ??_C@_15KNGHAKFK@?$AAI?$AAP?$AA?$AA@
0x180020018: api-ms-win-core-shlwapi-legacy-l1-1-0_NULL_THUNK_DATA
0x18001FFB8: "__cdecl _imp_RegDeleteValueW" __imp_RegDeleteValueW
0x1800232E0: "NCA_EVCOLLECTOR_USER_IDLE:%d (PD" ??_C@_0CL@OOIIMFCH@NCA_EVCOLLECTOR_USER_IDLE?3?$CFd?5?$CIPD@
0x18000546C: NcaConfigMgrGetBool
0x180001B20: "__cdecl ValidateImageBase" _ValidateImageBase
0x180022FD8: "EvCollStrongAuth" ??_C@_1CC@JMDFEEGN@?$AAE?$AAv?$AAC?$AAo?$AAl?$AAl?$AAS?$AAt?$AAr?$AAo?$AAn?$AAg?$AAA?$AAu?$AAt?$AAh?$AA?$AA@
0x180023F50: "__cdecl _midl_frag57" __midl_frag57
0x18001F9A0: "__cdecl _midl_frag56" __midl_frag56
0x18001F960: "__cdecl _midl_frag53" __midl_frag53
0x180023F54: "__cdecl _midl_frag59" __midl_frag59
0x1800207B0: IID_IUnknown
0x180024300: "\PdcPort" ??_C@_1BC@LPLMDA@?$AA?2?$AAP?$AAd?$AAc?$AAP?$AAo?$AAr?$AAt?$AA?$AA@
0x18001FCF0: "__cdecl _imp_RpcAsyncAbortCall" __imp_RpcAsyncAbortCall
0x18001FD98: "__cdecl _imp_WinHttpSetStatusCallback" __imp_WinHttpSetStatusCallback
0x180011C58: "void __cdecl NcaEvCollProbesInnerDelete(struct NCA_EVCOLL_USER_PROBES_ * __ptr64)" ?NcaEvCollProbesInnerDelete@@YAXPEAUNCA_EVCOLL_USER_PROBES_@@@Z
0x1800220F0: "PassiveMode" ??_C@_1BI@KIIBCOID@?$AAP?$AAa?$AAs?$AAs?$AAi?$AAv?$AAe?$AAM?$AAo?$AAd?$AAe?$AA?$AA@
0x180011A54: "struct NCA_EVCOLL_USER_PROBES_ * __ptr64 __cdecl NcaEvCollProbesFind(unsigned long)" ?NcaEvCollProbesFind@@YAPEAUNCA_EVCOLL_USER_PROBES_@@K@Z
0x180022F00: "enum TUNNEL_TYPE * TunnelTypeForIpv6SubEvcoll" ?TunnelTypeForIpv6SubEvcoll@@3PAW4TUNNEL_TYPE@@A
0x1800158D0: "void __cdecl NcaEvCollIdleSessionChange(void * __ptr64,void * __ptr64,void * __ptr64,void * __ptr64)" ?NcaEvCollIdleSessionChange@@YAXPEAX000@Z
0x180020418: "__cdecl _imp_RtlFreeHeap" __imp_RtlFreeHeap
0x180020200: "__cdecl _imp_DuplicateTokenEx" __imp_DuplicateTokenEx
0x1800045A0: "long __cdecl NcaConfigMgrLoadProbeList(struct HKEY__ * __ptr64,struct NCA_PROBE_LIST_ * __ptr64)" ?NcaConfigMgrLoadProbeList@@YAJPEAUHKEY__@@PEAUNCA_PROBE_LIST_@@@Z
0x180021928: "whoami /all" ??_C@_1BI@MMLHALHO@?$AAw?$AAh?$AAo?$AAa?$AAm?$AAi?$AA?5?$AA?1?$AAa?$AAl?$AAl?$AA?$AA@
0x18001F490: "unsigned short * __ptr64 * wszNCA_EVCOLLECTOR" ?wszNCA_EVCOLLECTOR@@3PAPEAGA
0x1800211F0: "Show-NetIPsecRule -PolicyStore A" ??_C@_1HC@DKMMIBCG@?$AAS?$AAh?$AAo?$AAw?$AA?9?$AAN?$AAe?$AAt?$AAI?$AAP?$AAs?$AAe?$AAc?$AAR?$AAu?$AAl?$AAe?$AA?5?$AA?9?$AAP?$AAo?$AAl?$AAi?$AAc?$AAy?$AAS?$AAt?$AAo?$AAr?$AAe?$AA?5?$AAA@
0x18000B780: "public: virtual long __cdecl CNlmTriggerProfileEventSink::NetworkAdded(struct _GUID) __ptr64" ?NetworkAdded@CNlmTriggerProfileEventSink@@UEAAJU_GUID@@@Z
0x18001FC08: "__cdecl _imp_CloseThreadpool" __imp_CloseThreadpool
0x1800258C8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0
0x1800290D0: "struct NCA_IP_TRIGGER_COMP_ gNcaIpTriggerComp" ?gNcaIpTriggerComp@@3UNCA_IP_TRIGGER_COMP_@@A
0x180019538: "long __cdecl StringCbCatW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64)" ?StringCbCatW@@YAJPEAG_KPEBG@Z
0x18001550C: "long __cdecl QueryFirewallEnabled(int * __ptr64)" ?QueryFirewallEnabled@@YAJPEAH@Z
0x180018438: "struct NCA_USER_ * __ptr64 __cdecl NcaUserStoreFind(unsigned long)" ?NcaUserStoreFind@@YAPEAUNCA_USER_@@K@Z
0x180021DE0: "CreateThreadpoolTimer" ??_C@_0BG@OGFAJCKC@CreateThreadpoolTimer?$AA@
0x180005FB0: "unsigned long __cdecl NcaApiSrvImplIsNetworkReferenced(struct NCA_INTSERVER_NETWORK_HANDLE_ * __ptr64)" ?NcaApiSrvImplIsNetworkReferenced@@YAKPEAUNCA_INTSERVER_NETWORK_HANDLE_@@@Z
0x18000D908: NcaWtsSessionChangeIndicate
0x18001088C: "unsigned long __cdecl NcaEvCollHttpProbeCollectWinHttpRequestInit(struct NCA_EVCOLL_PROBE_ * __ptr64)" ?NcaEvCollHttpProbeCollectWinHttpRequestInit@@YAKPEAUNCA_EVCOLL_PROBE_@@@Z
0x1800225F0: "NcaGetEvidenceCollectorResult" ??_C@_1DM@HBDBFICH@?$AAN?$AAc?$AAa?$AAG?$AAe?$AAt?$AAE?$AAv?$AAi?$AAd?$AAe?$AAn?$AAc?$AAe?$AAC?$AAo?$AAl?$AAl?$AAe?$AAc?$AAt?$AAo?$AAr?$AAR?$AAe?$AAs?$AAu?$AAl?$AAt?$AA?$AA@
0x180011EA8: "void __cdecl NcaEvCollSMBProbeCollect(struct NCA_EVCOLL_PROBE_ * __ptr64,struct NCA_EVCOLL_USER_PROBES_ * __ptr64)" ?NcaEvCollSMBProbeCollect@@YAXPEAUNCA_EVCOLL_PROBE_@@PEAUNCA_EVCOLL_USER_PROBES_@@@Z
0x18001FE98: "__cdecl _imp_GetTempPathW" __imp_GetTempPathW
0x180003898: WPP_SF_
0x1800259A4: "__cdecl _IMPORT_DESCRIPTOR_USERENV" __IMPORT_DESCRIPTOR_USERENV
0x18001FEC0: "__cdecl _imp_HeapAlloc" __imp_HeapAlloc
0x18001FB90: "__cdecl _imp_IcmpCloseHandle" __imp_IcmpCloseHandle
0x180021DA0: "CreateEventW" ??_C@_0N@PFDOPFFB@CreateEventW?$AA@
0x18001FAB0: NCA_v1_0_DispatchTable
0x180020080: "__cdecl _imp_AcquireSRWLockExclusive" __imp_AcquireSRWLockExclusive
0x180023C30: WPP_f538e3dc944c310e96edfc86655d00ff_Traceguids
0x180019DD8: NcaLoadMuiString
0x180023AF0: "NcaStringCopy" ??_C@_0O@LDMFBLMD@NcaStringCopy?$AA@
0x1800085E0: "unsigned long __cdecl NcaScriptLogsGetMultisiteStatus(unsigned long,unsigned short * __ptr64,unsigned long * __ptr64)" ?NcaScriptLogsGetMultisiteStatus@@YAKKPEAGPEAK@Z
0x1800113CC: "unsigned long __cdecl NcaEvCollProbeStart(unsigned long,enum NCA_EVCOLL_PROBE_ORIGIN_,struct NCA_EVCOLL_USER_PROBES_ * __ptr64,struct NCA_EVCOLL_PROBE_ * __ptr64)" ?NcaEvCollProbeStart@@YAKKW4NCA_EVCOLL_PROBE_ORIGIN_@@PEAUNCA_EVCOLL_USER_PROBES_@@PEAUNCA_EVCOLL_PROBE_@@@Z
0x1800202C8: "__cdecl _imp_FwpmEngineOpen0" __imp_FwpmEngineOpen0
0x1800200D8: "__cdecl _imp_WakeAllConditionVariable" __imp_WakeAllConditionVariable
0x180002B44: "long __cdecl NcaServiceSetStatus(void)" ?NcaServiceSetStatus@@YAJXZ
0x180020E60: "Get-NetIPHttpsState | Out-Defaul" ??_C@_1EE@HIHAJHJH@?$AAG?$AAe?$AAt?$AA?9?$AAN?$AAe?$AAt?$AAI?$AAP?$AAH?$AAt?$AAt?$AAp?$AAs?$AAS?$AAt?$AAa?$AAt?$AAe?$AA?5?$AA?$HM?$AA?5?$AAO?$AAu?$AAt?$AA?9?$AAD?$AAe?$AAf?$AAa?$AAu?$AAl@
0x1800202D8: "__cdecl _imp_FwpmEngineClose0" __imp_FwpmEngineClose0
0x180025B20: "__cdecl _IMPORT_DESCRIPTOR_httpprxp" __IMPORT_DESCRIPTOR_httpprxp
0x1800105C0: "void __cdecl NcaEvCollHttpProbeCollectAsyncComplete(struct NCA_EVCOLL_PROBE_ * __ptr64,unsigned long)" ?NcaEvCollHttpProbeCollectAsyncComplete@@YAXPEAUNCA_EVCOLL_PROBE_@@K@Z
0x180009B4C: "unsigned long __cdecl NcaScriptsLogsGetProbesStatus(struct NCA_USER_ * __ptr64,unsigned long,unsigned short * __ptr64,unsigned long * __ptr64)" ?NcaScriptsLogsGetProbesStatus@@YAKPEAUNCA_USER_@@KPEAGPEAK@Z
0x1800013D0: "__cdecl DllMainCRTStartup" _DllMainCRTStartup
0x180021820: "Certificate Store (my) (certutil" ??_C@_1HE@JHDKLCN@?$AAC?$AAe?$AAr?$AAt?$AAi?$AAf?$AAi?$AAc?$AAa?$AAt?$AAe?$AA?5?$AAS?$AAt?$AAo?$AAr?$AAe?$AA?5?$AA?$CI?$AAm?$AAy?$AA?$CJ?$AA?5?$AA?$CI?$AAc?$AAe?$AAr?$AAt?$AAu?$AAt?$AAi?$AAl@
0x180020370: "__cdecl _imp__initterm" __imp__initterm
0x180025AA8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-debug-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-debug-l1-1-0
0x180019610: NcaCriticalSectionCreate
0x1800226B8: " ; [char]30 ; " ??_C@_1BO@FFKGLBHC@?$AA?5?$AA?$DL?$AA?5?$AA?$FL?$AAc?$AAh?$AAa?$AAr?$AA?$FN?$AA3?$AA0?$AA?5?$AA?$DL?$AA?5?$AA?$AA@
0x1800233C0: "NCA_EVCOLLECTOR_NAME_PREF_LOCAL" ??_C@_1EA@DGCNNGFH@?$AAN?$AAC?$AAA?$AA_?$AAE?$AAV?$AAC?$AAO?$AAL?$AAL?$AAE?$AAC?$AAT?$AAO?$AAR?$AA_?$AAN?$AAA?$AAM?$AAE?$AA_?$AAP?$AAR?$AAE?$AAF?$AA_?$AAL?$AAO?$AAC?$AAA?$AAL?$AA?$AA@
0x180023478: "NCA_EVCOLLECTOR_UNHEALHTY" ??_C@_1DE@EKBDEMAI@?$AAN?$AAC?$AAA?$AA_?$AAE?$AAV?$AAC?$AAO?$AAL?$AAL?$AAE?$AAC?$AAT?$AAO?$AAR?$AA_?$AAU?$AAN?$AAH?$AAE?$AAA?$AAL?$AAH?$AAT?$AAY?$AA?$AA@
0x18001FC80: "__cdecl _imp_RpcImpersonateClient" __imp_RpcImpersonateClient
0x18000FE80: NcaEvCollIPv6Initialize
0x18001FE50: "__cdecl _imp_SetLastError" __imp_SetLastError
0x180021268: "ipsecMain" ??_C@_1BE@MMOBEHBD@?$AAi?$AAp?$AAs?$AAe?$AAc?$AAM?$AAa?$AAi?$AAn?$AA?$AA@
0x1800220D0: "SupportEmail" ??_C@_1BK@NDEIIPKJ@?$AAS?$AAu?$AAp?$AAp?$AAo?$AAr?$AAt?$AAE?$AAm?$AAa?$AAi?$AAl?$AA?$AA@
0x180014DF0: "long __cdecl NcaEvCollIPHTTPsCertInitialize(void)" ?NcaEvCollIPHTTPsCertInitialize@@YAJXZ
0x1800283D8: "unsigned long * NcaProbeOriginIds" ?NcaProbeOriginIds@@3PAKA
0x180022CC8: WPP_3578f31270733276cc8bdd5859d2a734_Traceguids
0x180018A84: "int __cdecl NcaUserStoreTransferOwnership(struct NCA_USER_ * __ptr64)" ?NcaUserStoreTransferOwnership@@YAHPEAUNCA_USER_@@@Z
0x180023E40: "Test" ??_C@_04OFFCAMCD@Test?$AA@
0x180023018: "TRUE" ??_C@_04HCDDPBNL@TRUE?$AA@
0x18001FBA0: "__cdecl _imp_NotifyIpInterfaceChange" __imp_NotifyIpInterfaceChange
0x1800203E0: "__cdecl _imp_RtlWaitOnAddress" __imp_RtlWaitOnAddress
0x18001FD48: "__cdecl _imp_FreeContextBuffer" __imp_FreeContextBuffer
0x180007CD0: NCA_EVENT_SUBSCRIPTION_HANDLE_rundown
0x180022C88: "NcaMultisiteNotifyWMICallback" ??_C@_1DM@GGJKEPPI@?$AAN?$AAc?$AAa?$AAM?$AAu?$AAl?$AAt?$AAi?$AAs?$AAi?$AAt?$AAe?$AAN?$AAo?$AAt?$AAi?$AAf?$AAy?$AAW?$AAM?$AAI?$AAC?$AAa?$AAl?$AAl?$AAb?$AAa?$AAc?$AAk?$AA?$AA@
0x1800239B0: "DAPEvidenceSnapshot" ??_C@_1CI@MOPHILDC@?$AAD?$AAA?$AAP?$AAE?$AAv?$AAi?$AAd?$AAe?$AAn?$AAc?$AAe?$AAS?$AAn?$AAa?$AAp?$AAs?$AAh?$AAo?$AAt?$AA?$AA@
0x180023F28: "__cdecl _midl_frag45" __midl_frag45
0x180025918: "__cdecl _IMPORT_DESCRIPTOR_IPHLPAPI" __IMPORT_DESCRIPTOR_IPHLPAPI
0x180023F00: "__cdecl _midl_frag44" __midl_frag44
0x180023F38: "__cdecl _midl_frag47" __midl_frag47
0x180023EE8: "__cdecl _midl_frag41" __midl_frag41
0x180025A80: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0
0x18001F940: "__cdecl _midl_frag43" __midl_frag43
0x180003CC4: "long __cdecl NcaConfigMgrLoadCustomCommandList(struct HKEY__ * __ptr64,struct NCA_CUSTOM_COMMAND_LIST_ * __ptr64)" ?NcaConfigMgrLoadCustomCommandList@@YAJPEAUHKEY__@@PEAUNCA_CUSTOM_COMMAND_LIST_@@@Z
0x18001F930: "__cdecl _midl_frag42" __midl_frag42
0x18000DCB0: NcaWtsTriggerInitialize
0x180012708: McTemplateU0qxx
0x180023E8C: "__cdecl _midl_frag4" __midl_frag4
0x18001C5A0: Rpc_NcaToggleNamePreferenceState
0x1800203A8: "__cdecl _imp_RtlWakeAddressAll" __imp_RtlWakeAddressAll
0x18000EE70: "public: virtual unsigned long __cdecl NcaMultisiteEventSink::Release(void) __ptr64" ?Release@NcaMultisiteEventSink@@UEAAKXZ
0x180015D1C: "void __cdecl NcaDAP(struct NCA_EVIDENCE_ const * __ptr64,struct NCA_STATUS_EVENT_ * __ptr64)" ?NcaDAP@@YAXPEBUNCA_EVIDENCE_@@PEAUNCA_STATUS_EVENT_@@@Z
0x180014404: "unsigned long __cdecl NcaEvCollNamePrefSetNrptRelevantPolicy(unsigned long)" ?NcaEvCollNamePrefSetNrptRelevantPolicy@@YAKK@Z
0x18000EFE0: NcaMultisiteTriggerShutdown
0x180028A08: "__cdecl _onexitend" __onexitend
0x18001FF60: "__cdecl _imp_CreateThread" __imp_CreateThread
0x180021590: "DA Multisite (Get-DAEntryPointTa" ??_C@_1FC@BAEAEMCN@?$AAD?$AAA?$AA?5?$AAM?$AAu?$AAl?$AAt?$AAi?$AAs?$AAi?$AAt?$AAe?$AA?5?$AA?$CI?$AAG?$AAe?$AAt?$AA?9?$AAD?$AAA?$AAE?$AAn?$AAt?$AAr?$AAy?$AAP?$AAo?$AAi?$AAn?$AAt?$AAT?$AAa@
0x1800051B8: McTemplateU0zx
0x180020440: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x18000DBDC: NcaWtsSessionChangeTriggerUnregisterWait
0x18000B988: NcaNlmTriggerGetCurrentProfiles
0x180021AD0: NcaSvc_PerfTrack_SmartcardEntered_DAConnected_Start
0x180016558: "void __cdecl NcaTelemetryEventWriteDirectAccessDiag(struct NCA_DAP_USER_EVSNPSHT_ * __ptr64 const,struct NCA_STATUS_EVENT_ const * __ptr64,unsigned long)" ?NcaTelemetryEventWriteDirectAccessDiag@@YAXQEAUNCA_DAP_USER_EVSNPSHT_@@PEBUNCA_STATUS_EVENT_@@K@Z
0x18001FD50: "__cdecl _imp_QuerySecurityPackageInfoW" __imp_QuerySecurityPackageInfoW
0x18001B950: NcaDebugPrintf
0x180007C50: MIDL_nca_free
0x180014AB0: "void __cdecl NcaEvCollProxyChanged(void * __ptr64,void * __ptr64,void * __ptr64,void * __ptr64)" ?NcaEvCollProxyChanged@@YAXPEAX000@Z
0x1800229A8: "WTS_SESSION_LOGOFF" ??_C@_1CG@KJLPCBBB@?$AAW?$AAT?$AAS?$AA_?$AAS?$AAE?$AAS?$AAS?$AAI?$AAO?$AAN?$AA_?$AAL?$AAO?$AAG?$AAO?$AAF?$AAF?$AA?$AA@
0x180022840: "NULL" ??_C@_04HIBGFPH@NULL?$AA@
0x18001FF50: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x180020160: "__cdecl _imp_CreateThreadpoolTimer" __imp_CreateThreadpoolTimer
0x1800242E0: WPP_e5a20f5dad90385975c866257caf5ce3_Traceguids
0x180022F10: WPP_53b07d360c1a3e753bfe4661c75aff79_Traceguids
0x180011CC0: "void __cdecl NcaEvCollProbesUpdateEvidenceSummary(enum NCA_PROBE_TEST_TYPE_,int,unsigned long,struct NCA_EVCOLL_USER_PROBES_ * __ptr64)" ?NcaEvCollProbesUpdateEvidenceSummary@@YAXW4NCA_PROBE_TEST_TYPE_@@HKPEAUNCA_EVCOLL_USER_PROBES_@@@Z
0x1800210C0: "WFP Netevents (netsh wfp show ne" ??_C@_1GA@KCAFHIGM@?$AAW?$AAF?$AAP?$AA?5?$AAN?$AAe?$AAt?$AAe?$AAv?$AAe?$AAn?$AAt?$AAs?$AA?5?$AA?$CI?$AAn?$AAe?$AAt?$AAs?$AAh?$AA?5?$AAw?$AAf?$AAp?$AA?5?$AAs?$AAh?$AAo?$AAw?$AA?5?$AAn?$AAe@
0x180022868: "MibDeleteInstance" ??_C@_0BC@LPNHCLEO@MibDeleteInstance?$AA@
0x1800201F8: "__cdecl _imp_GetTokenInformation" __imp_GetTokenInformation
0x18001FD70: "__cdecl _imp_CreateEnvironmentBlock" __imp_CreateEnvironmentBlock
0x180022248: "O:SYG:SYD:(A;;RC;;;AU)" ??_C@_1CO@CDIPGJM@?$AAO?$AA?3?$AAS?$AAY?$AAG?$AA?3?$AAS?$AAY?$AAD?$AA?3?$AA?$CI?$AAA?$AA?$DL?$AA?$DL?$AAR?$AAC?$AA?$DL?$AA?$DL?$AA?$DL?$AAA?$AAU?$AA?$CJ?$AA?$AA@
0x18001FD40: "__cdecl _imp_FreeCredentialsHandle" __imp_FreeCredentialsHandle
0x180009FCC: NcaSrcLnkdTriggerRearm
0x180012E0C: NcaEvCollProbesRestart
0x1800296D0: "struct NCA_DAP_EVSNPSHT_COMPONENT_ gNcaDapEvSnpshot" ?gNcaDapEvSnpshot@@3UNCA_DAP_EVSNPSHT_COMPONENT_@@A
0x18001FD20: "__cdecl _imp_AcceptSecurityContext" __imp_AcceptSecurityContext
0x180021DB0: "SvchostRegisterStopCallback" ??_C@_0BM@HAHFPJPE@SvchostRegisterStopCallback?$AA@
0x1800237C0: "NCA_EVCOLLECTOR_PING_DTE" ??_C@_1DC@PFIOADOG@?$AAN?$AAC?$AAA?$AA_?$AAE?$AAV?$AAC?$AAO?$AAL?$AAL?$AAE?$AAC?$AAT?$AAO?$AAR?$AA_?$AAP?$AAI?$AAN?$AAG?$AA_?$AAD?$AAT?$AAE?$AA?$AA@
0x180020F20: "certutil -store root" ??_C@_1CK@ILFCKOOD@?$AAc?$AAe?$AAr?$AAt?$AAu?$AAt?$AAi?$AAl?$AA?5?$AA?9?$AAs?$AAt?$AAo?$AAr?$AAe?$AA?5?$AAr?$AAo?$AAo?$AAt?$AA?$AA@
0x1800202C0: "__cdecl _imp_FwpmNetEventSubscribe4" __imp_FwpmNetEventSubscribe4
0x180022F58: "%s%s %s %s<br> " ??_C@_1CE@BPBFOHJI@?$AA?$CF?$AAs?$AA?$CF?$AAs?$AA?5?$AA?5?$AA?$CF?$AAs?$AA?5?$AA?$CF?$AAs?$AA?$DM?$AAb?$AAr?$AA?$DO?$AA?$AN?$AA?6?$AA?$AA@
0x180022D10: "SOFTWARE\Policies\Microsoft\Wind" ??_C@_1GO@FDDADFB@?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAP?$AAo?$AAl?$AAi?$AAc?$AAi?$AAe?$AAs?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd@
0x180028370: "__cdecl Init_global_epoch" _Init_global_epoch
0x180020128: api-ms-win-core-sysinfo-l1-1-0_NULL_THUNK_DATA
0x180020470: "__cdecl _xi_a" __xi_a
0x180021640: "daConfig" ??_C@_1BC@NEBABOHG@?$AAd?$AAa?$AAC?$AAo?$AAn?$AAf?$AAi?$AAg?$AA?$AA@
0x1800032A8: NcaServiceAcceptWtsSessionChange
0x180023BC0: "NcaGetExpandedCanonicalLongPathN" ??_C@_0CE@IMFIEJIK@NcaGetExpandedCanonicalLongPathN@
0x180008820: "unsigned long __cdecl NcaScriptLogsGetUserStatus(struct NCA_USER_ * __ptr64,unsigned long,unsigned short * __ptr64,unsigned long * __ptr64)" ?NcaScriptLogsGetUserStatus@@YAKPEAUNCA_USER_@@KPEAGPEAK@Z
0x180020100: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x18001FE30: api-ms-win-core-debug-l1-1-0_NULL_THUNK_DATA
0x1800187B0: "long __cdecl NcaUserStorePhrase2Initialize(void)" ?NcaUserStorePhrase2Initialize@@YAJXZ
0x180003B80: "void __cdecl NcaConfigMgrIPUpdate(void * __ptr64,void * __ptr64,void * __ptr64,void * __ptr64)" ?NcaConfigMgrIPUpdate@@YAXPEAX000@Z
0x180021D28: "NcaServiceSetStatus" ??_C@_0BE@PFMGOOMO@NcaServiceSetStatus?$AA@
0x18000AB20: "long __cdecl GetConnectionPoints(struct INetworkListManager * __ptr64,struct _GUID const & __ptr64,struct IConnectionPoint * __ptr64 * __ptr64)" ?GetConnectionPoints@@YAJPEAUINetworkListManager@@AEBU_GUID@@PEAPEAUIConnectionPoint@@@Z
0x180022908: "WTS_SESSION_LOCK" ??_C@_1CC@FNJAKKOG@?$AAW?$AAT?$AAS?$AA_?$AAS?$AAE?$AAS?$AAS?$AAI?$AAO?$AAN?$AA_?$AAL?$AAO?$AAC?$AAK?$AA?$AA@
0x180023B60: "NcaGetCanonicalPathName" ??_C@_0BI@PKNAODNF@NcaGetCanonicalPathName?$AA@
0x180023E3C: "Nca" ??_C@_03JDAHCAHC@Nca?$AA@
0x180020238: api-ms-win-security-base-l1-1-0_NULL_THUNK_DATA
0x18001C4F0: Rpc_NcaStatusEventUnsubscribe
0x18001FBD0: IPHLPAPI_NULL_THUNK_DATA
0x180018900: "void __cdecl NcaUserStoreRemove(struct NCA_USER_ * __ptr64)" ?NcaUserStoreRemove@@YAXPEAUNCA_USER_@@@Z
0x18001FC88: "__cdecl _imp_RpcServerUseProtseqW" __imp_RpcServerUseProtseqW
0x180004814: "void __cdecl NcaConfigMgrProbeListEmpty(struct NCA_PROBE_LIST_ * __ptr64)" ?NcaConfigMgrProbeListEmpty@@YAXPEAUNCA_PROBE_LIST_@@@Z
0x180023310: WPP_e079a5808a7a30224e8923e8632460ed_Traceguids
0x180020290: "__cdecl _imp_CloseServiceHandle" __imp_CloseServiceHandle
0x180018860: "void __cdecl NcaUserStorePhrase2Shutdown(void)" ?NcaUserStorePhrase2Shutdown@@YAXXZ
0x180015730: NcaEvCollOnFirewallChange
0x180013D2C: WPP_SF_ds
0x18000E758: NcaPDCTriggerRearm
0x180020BF0: "Get-NetTeredoConfiguration | Out" ??_C@_1FC@JLHLLDFK@?$AAG?$AAe?$AAt?$AA?9?$AAN?$AAe?$AAt?$AAT?$AAe?$AAr?$AAe?$AAd?$AAo?$AAC?$AAo?$AAn?$AAf?$AAi?$AAg?$AAu?$AAr?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?5?$AA?$HM?$AA?5?$AAO?$AAu?$AAt@
0x1800213B0: "Get-NetIPsecQuickModeSA | Out-De" ??_C@_1EM@EEIGNNFD@?$AAG?$AAe?$AAt?$AA?9?$AAN?$AAe?$AAt?$AAI?$AAP?$AAs?$AAe?$AAc?$AAQ?$AAu?$AAi?$AAc?$AAk?$AAM?$AAo?$AAd?$AAe?$AAS?$AAA?$AA?5?$AA?$HM?$AA?5?$AAO?$AAu?$AAt?$AA?9?$AAD?$AAe@
0x1800060B0: "unsigned long __cdecl NcaApiSrvImplIsSubscriptionsValid(struct NCA_INTSERVER_EVENTS_HANDLE_ * __ptr64)" ?NcaApiSrvImplIsSubscriptionsValid@@YAKPEAUNCA_INTSERVER_EVENTS_HANDLE_@@@Z
0x18001B604: NcaAlloc
0x18000303C: McGenEventWrite
0x180028000: WPP_GLOBAL_Control
0x18000B190: "unsigned long __cdecl NcaNlmTriggerNotifySinkProc(void * __ptr64)" ?NcaNlmTriggerNotifySinkProc@@YAKPEAX@Z
0x180015400: "void __cdecl NcaEvCollFirewallShutdown(void)" ?NcaEvCollFirewallShutdown@@YAXXZ
0x1800299E0: "unsigned short * __ptr64 * wszNcaScriptLogUserStatus" ?wszNcaScriptLogUserStatus@@3PAPEAGA
0x18001FDC0: "__cdecl _imp_WinHttpConnect" __imp_WinHttpConnect
0x180022FC4: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x1800258B4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0
0x18001C7B0: NcaAPIsIsAccessGranted
0x1800010E0: "__cdecl TlgEnableCallback" _TlgEnableCallback
0x180022A10: "PROXYMGR_PROVIDER_EVENT_NO_PROXY" ??_C@_1EO@DACCMBHI@?$AAP?$AAR?$AAO?$AAX?$AAY?$AAM?$AAG?$AAR?$AA_?$AAP?$AAR?$AAO?$AAV?$AAI?$AAD?$AAE?$AAR?$AA_?$AAE?$AAV?$AAE?$AAN?$AAT?$AA_?$AAN?$AAO?$AA_?$AAP?$AAR?$AAO?$AAX?$AAY@
0x180016BC0: NcaDAPEvidenceSnapshotSetUserState
0x1800038C4: WPP_SF_D
0x1800038C4: WPP_SF_d
0x180023350: "NCA_EVCOLLECTOR_PROBES" ??_C@_1CO@PIKHFNKM@?$AAN?$AAC?$AAA?$AA_?$AAE?$AAV?$AAC?$AAO?$AAL?$AAL?$AAE?$AAC?$AAT?$AAO?$AAR?$AA_?$AAP?$AAR?$AAO?$AAB?$AAE?$AAS?$AA?$AA@
0x180001958: "__cdecl _report_rangecheckfailure" __report_rangecheckfailure
0x180028A30: "__cdecl pRawDllMain" _pRawDllMain
0x180023400: "NCA_EVCOLLECTOR_INSIDE" ??_C@_1CO@OHIHJICL@?$AAN?$AAC?$AAA?$AA_?$AAE?$AAV?$AAC?$AAO?$AAL?$AAL?$AAE?$AAC?$AAT?$AAO?$AAR?$AA_?$AAI?$AAN?$AAS?$AAI?$AAD?$AAE?$AA?$AA@
0x180019274: NcaEtwPerfTrackGetHashId
0x180029B78: "int * gNcaEtwPerfTrackScenarioState" ?gNcaEtwPerfTrackScenarioState@@3PAHA
0x180021E78: "Multisite" ??_C@_1BE@MINLMOAD@?$AAM?$AAu?$AAl?$AAt?$AAi?$AAs?$AAi?$AAt?$AAe?$AA?$AA@
0x18000E588: "unsigned long __cdecl NcaProxyTriggerRegisterWait(struct NCA_TRIGGER_OBJECT_ * __ptr64,void (__cdecl*)(struct _TP_CALLBACK_INSTANCE * __ptr64,void * __ptr64,struct _TP_WAIT * __ptr64,long),void * __ptr64,struct NCA_SRCLNKD_TRIGGER_OBJECT_ * __ptr64 * __ptr64)" ?NcaProxyTriggerRegisterWait@@YAKPEAUNCA_TRIGGER_OBJECT_@@P6AXPEAU_TP_CALLBACK_INSTANCE@@PEAXPEAU_TP_WAIT@@J@Z2PEAPEAUNCA_SRCLNKD_TRIGGER_OBJECT_@@@Z
0x1800259E0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-service-management-l2-1-0" __IMPORT_DESCRIPTOR_api-ms-win-service-management-l2-1-0
0x18001623C: "void __cdecl NcaDAPLastEventTrace(struct NCA_DAP_USER_EVSNPSHT_ * __ptr64)" ?NcaDAPLastEventTrace@@YAXPEAUNCA_DAP_USER_EVSNPSHT_@@@Z
0x18001FC40: "__cdecl _imp_VariantClear" __imp_VariantClear
0x180024438: IID_IWbemObjectSink
0x180008B84: "unsigned long __cdecl NcaScriptLogsRunCommands(struct NCA_COMMAND_ENVIROMENT_ * __ptr64,unsigned long,void * __ptr64,struct NCA_PROCESS_ENVIRONMENT_ * __ptr64)" ?NcaScriptLogsRunCommands@@YAKPEAUNCA_COMMAND_ENVIROMENT_@@KPEAXPEAUNCA_PROCESS_ENVIRONMENT_@@@Z
0x180023E58: "ncacn_ip_tcp" ??_C@_1BK@BPGFLIHL@?$AAn?$AAc?$AAa?$AAc?$AAn?$AA_?$AAi?$AAp?$AA_?$AAt?$AAc?$AAp?$AA?$AA@
0x180022C10: "SELECT * FROM MSFT_DASettingsInd" ??_C@_1FA@PDJBGAAF@?$AAS?$AAE?$AAL?$AAE?$AAC?$AAT?$AA?5?$AA?$CK?$AA?5?$AAF?$AAR?$AAO?$AAM?$AA?5?$AAM?$AAS?$AAF?$AAT?$AA_?$AAD?$AAA?$AAS?$AAe?$AAt?$AAt?$AAi?$AAn?$AAg?$AAs?$AAI?$AAn?$AAd@
0x1800229F0: "ProxyTrigger" ??_C@_1BK@GPHAIHMH@?$AAP?$AAr?$AAo?$AAx?$AAy?$AAT?$AAr?$AAi?$AAg?$AAg?$AAe?$AAr?$AA?$AA@
0x18000E804: NcaPDCTriggerRegisterWait
0x180013014: NcaEvcollProbesProbesStatus
0x1800054AC: NcaConfigMgrGetCustomCommandCopy
0x180028C00: "struct NCA_CONFIG_MGR_COMPONENT_ gNcaConfigMgr" ?gNcaConfigMgr@@3UNCA_CONFIG_MGR_COMPONENT_@@A
0x180023BA8: "GetLongPathNameW" ??_C@_0BB@PPFKPLJJ@GetLongPathNameW?$AA@
0x18001FBA8: "__cdecl _imp_NotifyRouteChange2" __imp_NotifyRouteChange2
0x18001FD60: SspiCli_NULL_THUNK_DATA
0x180016778: McTemplateU0qttx
0x18001D6C0: PdcpNotificationClientCallback
0x1800210B8: "wfp" ??_C@_17IJNKPEME@?$AAw?$AAf?$AAp?$AA?$AA@
0x180025A94: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-l1-1-0
0x1800041D8: "long __cdecl NcaConfigMgrLoadPolicy(struct NCA_POLICY_ * __ptr64)" ?NcaConfigMgrLoadPolicy@@YAJPEAUNCA_POLICY_@@@Z
0x180007C60: NCA_ENGINE_HANDLE_rundown
0x1800203C0: "__cdecl _imp_ZwAlpcSendWaitReceivePort" __imp_ZwAlpcSendWaitReceivePort
0x180005D00: "long __cdecl NcaApiSrvImplInitialize(void)" ?NcaApiSrvImplInitialize@@YAJXZ
0x180020040: "__cdecl _imp_DeleteCriticalSection" __imp_DeleteCriticalSection
0x180021AF0: NcaSvc_PerfTrack_NAPRequired_DAConnected_Stop
0x18001BB10: NcaRpcAPIsInitialize
0x180001670: "__cdecl _security_check_cookie" __security_check_cookie
0x18000A9E0: NcaGPTriggerUnregisterWait
0x180020468: "__cdecl _xc_z" __xc_z
0x180005A80: NcaConfigMgrShutdown
0x180025940: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0
0x180016814: NcaDAPEvidenceSnapshotGetGlobalState
0x18001FF80: api-ms-win-core-processthreads-l1-1-0_NULL_THUNK_DATA
0x1800031F4: NcaComponentsShutdown
0x18001FB80: "__cdecl _imp_GetAdaptersAddresses" __imp_GetAdaptersAddresses
0x180029B94: "int gNcaEtwPerfTrackInitialized" ?gNcaEtwPerfTrackInitialized@@3HA
0x18001B01C: NcaRegQueryDWord
0x180005254: NcaConfigMgrDisableVanUI
0x18001FF40: "__cdecl _imp_CreateProcessAsUserW" __imp_CreateProcessAsUserW
0x1800239E8: "FALSE" ??_C@_1M@HCOOECOK@?$AAF?$AAA?$AAL?$AAS?$AAE?$AA?$AA@
0x18001B8E4: NcaArrayDestroy
0x180012EC0: NcaEvCollProbesShutdown
0x18001D44C: PdcNotificationClientRegister
0x180009168: "unsigned long __cdecl NcaScriptLogsWriteBody(void * __ptr64,struct NCA_USER_ * __ptr64)" ?NcaScriptLogsWriteBody@@YAKPEAXPEAUNCA_USER_@@@Z
0x180021A40: ApiActivityEnd
0x1800164CC: "void __cdecl NcaTelemetryEventWriteDirectAccessCensus(void)" ?NcaTelemetryEventWriteDirectAccessCensus@@YAXXZ
0x18001D318: NcaRpcAPIsIsAccessGranted
0x180025B48: "__cdecl _IMPORT_DESCRIPTOR_fwpuclnt" __IMPORT_DESCRIPTOR_fwpuclnt
0x180021E18: "ConfigMgr" ??_C@_1BE@PGIMJDHM@?$AAC?$AAo?$AAn?$AAf?$AAi?$AAg?$AAM?$AAg?$AAr?$AA?$AA@
0x180021C08: ConfigUpdateStart
0x180003950: WppCleanupUm
0x180019DB4: NcaHResultToWindowsError
0x18000A078: NcaSrcLnkdTriggerRegisterWait
0x180023058: WPP_eb1a0b95a3bc3a3413ac9693d26475f6_Traceguids
0x18000C400: "void __cdecl NotifyRouteCallback(void * __ptr64,struct _MIB_IPFORWARD_ROW2 * __ptr64,enum _MIB_NOTIFICATION_TYPE)" ?NotifyRouteCallback@@YAXPEAXPEAU_MIB_IPFORWARD_ROW2@@W4_MIB_NOTIFICATION_TYPE@@@Z
0x180002350: "unsigned long __cdecl NcaServiceAsyncStartupRoutine(void * __ptr64)" ?NcaServiceAsyncStartupRoutine@@YAKPEAX@Z
0x18000601C: "unsigned long __cdecl NcaApiSrvImplIsNetworkValid(struct NCA_INTSERVER_NETWORK_HANDLE_ * __ptr64)" ?NcaApiSrvImplIsNetworkValid@@YAKPEAUNCA_INTSERVER_NETWORK_HANDLE_@@@Z
0x180022848: "1s Mark" ??_C@_07PLBDLODJ@1s?5Mark?$AA@
0x180021A38: "__cdecl TraceLoggingMetadataEnd" _TraceLoggingMetadataEnd
0x18001FE10: "__cdecl _imp_CoCreateInstance" __imp_CoCreateInstance
0x180020118: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x180023A90: "UserStorePhase1" ??_C@_1CA@EGIJPDM@?$AAU?$AAs?$AAe?$AAr?$AAS?$AAt?$AAo?$AAr?$AAe?$AAP?$AAh?$AAa?$AAs?$AAe?$AA1?$AA?$AA@
0x18001AEB0: NcaRegNotifyOnChange
0x180022BE8: WPP_61c903364b7d331f2b9904545b8f42b8_Traceguids
0x180021AB0: DapStateChanged
0x180021508: "Route (Get-NetRoute)" ??_C@_1CK@EHGMCNKH@?$AAR?$AAo?$AAu?$AAt?$AAe?$AA?5?$AA?$CI?$AAG?$AAe?$AAt?$AA?9?$AAN?$AAe?$AAt?$AAR?$AAo?$AAu?$AAt?$AAe?$AA?$CJ?$AA?$AA@
0x180021A60: NcaSvc_PerfTrack_SmartcardRequired_SmartcardEntered_Stop
0x18001FED8: "__cdecl _imp_LocalAlloc" __imp_LocalAlloc
0x180024428: IID_IWbemLocator
0x180023E20: "NcaArrayCreateFromRegistry" ??_C@_0BL@LOPEKKIB@NcaArrayCreateFromRegistry?$AA@
0x180020248: api-ms-win-security-lsalookup-l1-1-0_NULL_THUNK_DATA
0x18001FD28: "__cdecl _imp_InitializeSecurityContextW" __imp_InitializeSecurityContextW
0x180020390: "__cdecl _imp_WinSqmIsOptedIn" __imp_WinSqmIsOptedIn
0x180021B60: NCA_NETWORK_DIRECTACCESS
0x180006A08: "unsigned long __cdecl SvrImpl_NcaGetConfig(void * __ptr64,void * __ptr64,enum NCA_CONFIG_,unsigned char * __ptr64,unsigned long * __ptr64)" ?SvrImpl_NcaGetConfig@@YAKPEAX0W4NCA_CONFIG_@@PEAEPEAK@Z
0x180023CC8: "NcaRegQueryDWord" ??_C@_0BB@ELDHPCAL@NcaRegQueryDWord?$AA@
0x18001FEC8: "__cdecl _imp_GetProcessHeap" __imp_GetProcessHeap
0x180001DF0: "__cdecl _chkstk" __chkstk
0x180021C38: ConfigUpdateEnd
0x180005C10: NcaEventLogInitialize
0x18001FDE0: "__cdecl _imp_FreeAddrInfoW" __imp_FreeAddrInfoW
0x180002940: "unsigned long __cdecl NcaServiceHandlerEx(unsigned long,unsigned long,void * __ptr64,void * __ptr64)" ?NcaServiceHandlerEx@@YAKKKPEAX0@Z
0x18000B780: "public: virtual long __cdecl CNlmTriggerProfileEventSink::NetworkDeleted(struct _GUID) __ptr64" ?NetworkDeleted@CNlmTriggerProfileEventSink@@UEAAJU_GUID@@@Z
0x180020240: "__cdecl _imp_LookupAccountSidLocalW" __imp_LookupAccountSidLocalW
0x180021F80: "EntryPointName" ??_C@_1BO@ONMOEGNC@?$AAE?$AAn?$AAt?$AAr?$AAy?$AAP?$AAo?$AAi?$AAn?$AAt?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x180021EF8: "root\StandardCimv2" ??_C@_1CG@CNBMEKBG@?$AAr?$AAo?$AAo?$AAt?$AA?2?$AAS?$AAt?$AAa?$AAn?$AAd?$AAa?$AAr?$AAd?$AAC?$AAi?$AAm?$AAv?$AA2?$AA?$AA@
0x180020268: "__cdecl _imp_SetServiceStatus" __imp_SetServiceStatus
0x180020168: "__cdecl _imp_CloseThreadpoolWork" __imp_CloseThreadpoolWork
0x1800259CC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-service-management-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-service-management-l1-1-0
0x18001DFB0: PdcpAlpcReleaseResources
0x180020780: IID_INetworkListManagerEvents
0x180012AC0: NcaEvCollProbesInitialize
0x180020338: "__cdecl _imp__vsnprintf_s" __imp__vsnprintf_s
0x180005970: NcaConfigMgrPolUpdateShutdown
0x18000B7A0: "public: virtual long __cdecl CNlmTriggerProfileEventSink::NetworkConnectivityChanged(struct _GUID,enum NLM_CONNECTIVITY) __ptr64" ?NetworkConnectivityChanged@CNlmTriggerProfileEventSink@@UEAAJU_GUID@@W4NLM_CONNECTIVITY@@@Z
0x18001FFB0: "__cdecl _imp_RegNotifyChangeKeyValue" __imp_RegNotifyChangeKeyValue
0x1800037CC: TraceLoggingRegisterEx
0x180022BC8: "ChangeTriggered" ??_C@_1CA@DDGOFJOJ@?$AAC?$AAh?$AAa?$AAn?$AAg?$AAe?$AAT?$AAr?$AAi?$AAg?$AAg?$AAe?$AAr?$AAe?$AAd?$AA?$AA@
0x1800203E8: "__cdecl _imp_ZwAlpcConnectPort" __imp_ZwAlpcConnectPort
0x180021E98: "UDP:" ??_C@_19HNIHAGKA@?$AAU?$AAD?$AAP?$AA?3?$AA?$AA@
0x18001FC70: "__cdecl _imp_RpcStringBindingParseW" __imp_RpcStringBindingParseW
0x180005F1C: "unsigned long __cdecl NcaApiSrvImplIsEngineValid(struct NCA_INTSERVER_ENGINE_HANDLE_ * __ptr64)" ?NcaApiSrvImplIsEngineValid@@YAKPEAUNCA_INTSERVER_ENGINE_HANDLE_@@@Z
0x1800067E4: "unsigned long __cdecl SvrImpl_NcaExecuteAndCaptureLogs(void * __ptr64,void * __ptr64,unsigned short const * __ptr64 const)" ?SvrImpl_NcaExecuteAndCaptureLogs@@YAKPEAX0QEBG@Z
0x18000C340: "void __cdecl NotifyIpInterfaceCallback(void * __ptr64,struct _MIB_IPFORWARD_ROW2 * __ptr64,enum _MIB_NOTIFICATION_TYPE)" ?NotifyIpInterfaceCallback@@YAXPEAXPEAU_MIB_IPFORWARD_ROW2@@W4_MIB_NOTIFICATION_TYPE@@@Z
0x180021B50: NcaSvc_PerfTrack_InternetConnected_DAConnected_Start
0x180020008: api-ms-win-core-rtlsupport-l1-1-0_NULL_THUNK_DATA
0x180020190: api-ms-win-core-threadpool-l1-2-0_NULL_THUNK_DATA
0x18000A4D0: NcaTriggerRegisterWait
0x180023788: "NCA_EVCOLLECTOR_DTE_EXISTS" ??_C@_1DG@MJBDCLEO@?$AAN?$AAC?$AAA?$AA_?$AAE?$AAV?$AAC?$AAO?$AAL?$AAL?$AAE?$AAC?$AAT?$AAO?$AAR?$AA_?$AAD?$AAT?$AAE?$AA_?$AAE?$AAX?$AAI?$AAS?$AAT?$AAS?$AA?$AA@
0x18001B270: NcaRegQueryNumValues
0x180023258: "EvCollFirewall" ??_C@_1BO@NEEALFGI@?$AAE?$AAv?$AAC?$AAo?$AAl?$AAl?$AAF?$AAi?$AAr?$AAe?$AAw?$AAa?$AAl?$AAl?$AA?$AA@
0x180023910: "NCA_EVCOLLECTOR_FIREWALL_DOWN" ??_C@_1DM@IGFFEEME@?$AAN?$AAC?$AAA?$AA_?$AAE?$AAV?$AAC?$AAO?$AAL?$AAL?$AAE?$AAC?$AAT?$AAO?$AAR?$AA_?$AAF?$AAI?$AAR?$AAE?$AAW?$AAA?$AAL?$AAL?$AA_?$AAD?$AAO?$AAW?$AAN?$AA?$AA@
0x180023DC0: "NcaRegNotifyCreateKey" ??_C@_0BG@HNKOLBGN@NcaRegNotifyCreateKey?$AA@
0x1800242F0: WPP_60a529cda91939f7629d8692f775f55a_Traceguids
0x180021B10: NcaSvc_PerfTrack_SmartcardRequired_SmartcardEntered_Start
0x18001B33C: NcaRegQueryString
0x180022EF0: "enum NCA_EVCOLLECTOR_ * NcaEvCollectorIDForIpv6SubEvcoll" ?NcaEvCollectorIDForIpv6SubEvcoll@@3PAW4NCA_EVCOLLECTOR_@@A
0x18001FBD8: "__cdecl _imp_CreateJobObjectW" __imp_CreateJobObjectW
0x180020020: "__cdecl _imp_MultiByteToWideChar" __imp_MultiByteToWideChar
0x180021400: "ipAddress" ??_C@_1BE@EOECFGJK@?$AAi?$AAp?$AAA?$AAd?$AAd?$AAr?$AAe?$AAs?$AAs?$AA?$AA@
0x180025A08: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0
0x180016870: NcaDAPEvidenceSnapshotGetUserState
0x180020298: api-ms-win-service-management-l1-1-0_NULL_THUNK_DATA
0x1800202A8: api-ms-win-service-management-l2-1-0_NULL_THUNK_DATA
0x180004864: "long __cdecl NcaConfigMgrSortDteList(struct NCA_POLICY_ * __ptr64)" ?NcaConfigMgrSortDteList@@YAJPEAUNCA_POLICY_@@@Z
0x180021A80: NcaSvc_PerfTrack_InternetConnected_DAConnected_Stop
0x18001FF90: api-ms-win-core-profile-l1-1-0_NULL_THUNK_DATA
0x180023CF8: "NcaRegSetDWord" ??_C@_0P@OCNFOOE@NcaRegSetDWord?$AA@
0x180020498: "__cdecl _guard_fids_table" __guard_fids_table
0x180005C80: NcaEventLogShutdown
0x1800229E0: WPP_3af2e629995d3629ccc96387b724eda4_Traceguids
0x1800209B0: "System Info (systeminfo)" ??_C@_1DC@MBOKGAPA@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?5?$AAI?$AAn?$AAf?$AAo?$AA?5?$AA?$CI?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AAi?$AAn?$AAf?$AAo?$AA?$CJ?$AA?$AA@
0x180021AE0: ModuleShutdownEnd
0x180020388: msvcrt_NULL_THUNK_DATA
0x18001FBF8: "__cdecl _imp_AssignProcessToJobObject" __imp_AssignProcessToJobObject
0x18001F010: "__cdecl load_config_used" _load_config_used
0x180029BA8: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxumvgUmxzUzkrUhvieviUlyquivUznwGEUkivxlnkOlyq@NcaApiServer" __@@_PchSym_@00@KxulyqvxgPillgKxumvgUmxzUzkrUhvieviUlyquivUznwGEUkivxlnkOlyq@NcaApiServer
0x18001FC18: "__cdecl _imp_UnregisterWaitEx" __imp_UnregisterWaitEx
0x180017124: NcaDAPEvidenceUserSnapshotRelease
0x18001BD80: NcaRpcAPIsShutdown
0x18001CA80: NcaRpcAPIsInterfaceCreate
0x18002592C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-sddl-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-sddl-l1-1-0
0x180021660: "DA Settings (Get-DAClientExperie" ??_C@_1GE@MKPGCIDE@?$AAD?$AAA?$AA?5?$AAS?$AAe?$AAt?$AAt?$AAi?$AAn?$AAg?$AAs?$AA?5?$AA?$CI?$AAG?$AAe?$AAt?$AA?9?$AAD?$AAA?$AAC?$AAl?$AAi?$AAe?$AAn?$AAt?$AAE?$AAx?$AAp?$AAe?$AAr?$AAi?$AAe@
0x18001FF48: "__cdecl _imp_QueueUserAPC" __imp_QueueUserAPC
0x1800207F0: "Unable to load string message" ??_C@_1DM@EMDKHCFL@?$AAU?$AAn?$AAa?$AAb?$AAl?$AAe?$AA?5?$AAt?$AAo?$AA?5?$AAl?$AAo?$AAa?$AAd?$AA?5?$AAs?$AAt?$AAr?$AAi?$AAn?$AAg?$AA?5?$AAm?$AAe?$AAs?$AAs?$AAa?$AAg?$AAe?$AA?$AA@
0x18000CB08: NcaIPTriggerRegisterWait
0x180023288: WPP_850635ee9b8332c4a67d4561df683d90_Traceguids
0x1800224A0: "NcaStatusEventSubscribe" ??_C@_1DA@JFGIPFCF@?$AAN?$AAc?$AAa?$AAS?$AAt?$AAa?$AAt?$AAu?$AAs?$AAE?$AAv?$AAe?$AAn?$AAt?$AAS?$AAu?$AAb?$AAs?$AAc?$AAr?$AAi?$AAb?$AAe?$AA?$AA@
0x180022A60: "NcaProxyProviderEventCallback" ??_C@_1DM@NINMPHKN@?$AAN?$AAc?$AAa?$AAP?$AAr?$AAo?$AAx?$AAy?$AAP?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AAE?$AAv?$AAe?$AAn?$AAt?$AAC?$AAa?$AAl?$AAl?$AAb?$AAa?$AAc?$AAk?$AA?$AA@
0x180001130: "public: virtual unsigned long __cdecl NcaMultisiteEventSink::AddRef(void) __ptr64" ?AddRef@NcaMultisiteEventSink@@UEAAKXZ
0x1800190A8: McGenEventUnregister
0x18001F300: "const CNlmTriggerInetConnEventSink::`vftable'" ??_7CNlmTriggerInetConnEventSink@@6B@
0x18001AC44: NcaRegNotifyCreate
0x180020408: "__cdecl _imp_ZwClose" __imp_ZwClose
0x180023DF8: "RegNotifyChangeKeyValue" ??_C@_0BI@ILHBFDHH@RegNotifyChangeKeyValue?$AA@
0x1800110CC: "unsigned long __cdecl NcaEvCollPingProbeSessionInit(struct NCA_EVCOLL_PROBE_ * __ptr64)" ?NcaEvCollPingProbeSessionInit@@YAKPEAUNCA_EVCOLL_PROBE_@@@Z
0x18001FB70: "__cdecl _imp_FWChangeNotificationDestroy" __imp_FWChangeNotificationDestroy
0x180010978: "void __cdecl NcaEvCollHttpProbeCollectWinHttpSessionClose(struct NCA_EVCOLL_PROBE_ * __ptr64)" ?NcaEvCollHttpProbeCollectWinHttpSessionClose@@YAXPEAUNCA_EVCOLL_PROBE_@@@Z
0x180020D20: "IP-HTTPs Configuration (Get-NetI" ??_C@_1GK@DCPOBGJF@?$AAI?$AAP?$AA?9?$AAH?$AAT?$AAT?$AAP?$AAs?$AA?5?$AAC?$AAo?$AAn?$AAf?$AAi?$AAg?$AAu?$AAr?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?5?$AA?$CI?$AAG?$AAe?$AAt?$AA?9?$AAN?$AAe?$AAt?$AAI@
0x18000EA70: "public: virtual long __cdecl NcaMultisiteEventSink::Indicate(long,struct IWbemClassObject * __ptr64 * __ptr64) __ptr64" ?Indicate@NcaMultisiteEventSink@@UEAAJJPEAPEAUIWbemClassObject@@@Z
0x18000C070: "unsigned long __cdecl NVNWorkerThread(void * __ptr64)" ?NVNWorkerThread@@YAKPEAX@Z
0x180025A6C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processenvironment-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processenvironment-l1-1-0
0x18000D1CC: NcaWfpNetEventTriggerUnregisterWait
0x1800109C4: "void __cdecl NcaEvCollHttpProbeCollectWinHttpSessionCloseUnderLock(struct NCA_EVCOLL_PROBE_ * __ptr64)" ?NcaEvCollHttpProbeCollectWinHttpSessionCloseUnderLock@@YAXPEAUNCA_EVCOLL_PROBE_@@@Z
0x18001FE00: "__cdecl _imp_CoSetProxyBlanket" __imp_CoSetProxyBlanket
0x180009F0C: "void __cdecl NcaSrcLnkdTriggerUnregisterFromSource(struct NCA_SYNCED_LIST_HEAD_ * __ptr64,struct _LIST_ENTRY * __ptr64)" ?NcaSrcLnkdTriggerUnregisterFromSource@@YAXPEAUNCA_SYNCED_LIST_HEAD_@@PEAU_LIST_ENTRY@@@Z
0x18001DA30: PdcPortOpen
0x180022BF8: WPP_f74f972af20b3cee80caf4f330cbf87e_Traceguids
0x180020148: "__cdecl _imp_LeaveCriticalSectionWhenCallbackReturns" __imp_LeaveCriticalSectionWhenCallbackReturns
0x180022578: "NcaToggleNamePreferenceState" ??_C@_1DK@KDJNELJN@?$AAN?$AAc?$AAa?$AAT?$AAo?$AAg?$AAg?$AAl?$AAe?$AAN?$AAa?$AAm?$AAe?$AAP?$AAr?$AAe?$AAf?$AAe?$AAr?$AAe?$AAn?$AAc?$AAe?$AAS?$AAt?$AAa?$AAt?$AAe?$AA?$AA@
0x180023500: "NCA_EVCOLLECTOR_CORP_CONNECTIVIT" ??_C@_1EE@OPCOCCHM@?$AAN?$AAC?$AAA?$AA_?$AAE?$AAV?$AAC?$AAO?$AAL?$AAL?$AAE?$AAC?$AAT?$AAO?$AAR?$AA_?$AAC?$AAO?$AAR?$AAP?$AA_?$AAC?$AAO?$AAN?$AAN?$AAE?$AAC?$AAT?$AAI?$AAV?$AAI?$AAT@
0x180022758: "unsigned long * NcaScriptLogUserCommandsIds" ?NcaScriptLogUserCommandsIds@@3PAKA
0x18001B658: NcaAllocCheckSize
0x18001FC78: "__cdecl _imp_RpcBindingToStringBindingW" __imp_RpcBindingToStringBindingW
0x180023220: "EvCollIPHTTPsCert" ??_C@_1CE@ICNCCCJD@?$AAE?$AAv?$AAC?$AAo?$AAl?$AAl?$AAI?$AAP?$AAH?$AAT?$AAT?$AAP?$AAs?$AAC?$AAe?$AAr?$AAt?$AA?$AA@
0x180021D78: "ServiceMain" ??_C@_0M@CNALKNPF@ServiceMain?$AA@
0x180022FC8: WPP_6c0517c5ba2f35a3e81c6063da4de26c_Traceguids
0x180021BC0: Microsoft_Windows_NcasvcLevels
0x18001C290: Rpc_NcaNetworkOpen
0x180020328: "__cdecl _imp__amsg_exit" __imp__amsg_exit
0x1800144D8: "long __cdecl NcaEvCollNamePrefValidateNrptRelevantPolicyConfig(void)" ?NcaEvCollNamePrefValidateNrptRelevantPolicyConfig@@YAJXZ
0x1800239D8: "TRUE" ??_C@_19ELAAHEEL@?$AAT?$AAR?$AAU?$AAE?$AA?$AA@
0x180007D20: NCA_NETWORK_HANDLE_rundown
0x180007A78: "unsigned long __cdecl SvrImpl_NcaToggleNamePreferenceState(void * __ptr64,void * __ptr64)" ?SvrImpl_NcaToggleNamePreferenceState@@YAKPEAX0@Z
0x180023CB0: "NcaRegQueryNumKeys" ??_C@_0BD@HPNCFAMC@NcaRegQueryNumKeys?$AA@
0x180013270: "void __cdecl NcaEvCollStrongAuthCollect(void * __ptr64,void * __ptr64,void * __ptr64,void * __ptr64)" ?NcaEvCollStrongAuthCollect@@YAXPEAX000@Z
0x1800209E8: "6to4" ??_C@_19NHGJCIOF@?$AA6?$AAt?$AAo?$AA4?$AA?$AA@
0x18000C710: NcaIPTriggerInitialize
0x18000B910: "public: virtual unsigned long __cdecl CNlmTriggerInetConnEventSink::Release(void) __ptr64" ?Release@CNlmTriggerInetConnEventSink@@UEAAKXZ
0x18001FEF8: "__cdecl _imp_DisableThreadLibraryCalls" __imp_DisableThreadLibraryCalls
0x18001FCB0: "__cdecl _imp_RpcBindingInqAuthClientW" __imp_RpcBindingInqAuthClientW
0x18000C470: "void __cdecl RouteChangeNotifierAPC(unsigned __int64)" ?RouteChangeNotifierAPC@@YAX_K@Z
0x18001FEF0: "__cdecl _imp_LoadStringW" __imp_LoadStringW
0x18001667C: "long __cdecl StringCchPrintfW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64,...)" ?StringCchPrintfW@@YAJPEAG_KPEBGZZ
0x180028330: "struct _tag_NCA_RPC_INTF_CONTROL_INFO gNcaRpcAPIsControlStruct" ?gNcaRpcAPIsControlStruct@@3U_tag_NCA_RPC_INTF_CONTROL_INFO@@A
0x1800063B8: "unsigned long __cdecl NcaIsNonSystemUser(void * __ptr64,int * __ptr64)" ?NcaIsNonSystemUser@@YAKPEAXPEAH@Z
0x18001FFF0: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x180018630: "long __cdecl NcaUserStorePhrase1Initialize(void)" ?NcaUserStorePhrase1Initialize@@YAJXZ
0x18001FF88: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x1800200F0: "__cdecl _imp_WaitForMultipleObjects" __imp_WaitForMultipleObjects
0x180022760: "unsigned long * NcaScriptLogAdminCommandsIds" ?NcaScriptLogAdminCommandsIds@@3PAKA
0x180023988: "NCA_EVCOLLECTOR_MAX" ??_C@_1CI@JKDEEBOD@?$AAN?$AAC?$AAA?$AA_?$AAE?$AAV?$AAC?$AAO?$AAL?$AAL?$AAE?$AAC?$AAT?$AAO?$AAR?$AA_?$AAM?$AAA?$AAX?$AA?$AA@
0x180021570: "multisite" ??_C@_1BE@NCCHJOAI@?$AAm?$AAu?$AAl?$AAt?$AAi?$AAs?$AAi?$AAt?$AAe?$AA?$AA@
0x1800150B0: "void __cdecl NcaEvCollIphttpsCertChanged(void * __ptr64,long)" ?NcaEvCollIphttpsCertChanged@@YAXPEAXJ@Z
0x180023D78: "RegDeleteValueW" ??_C@_0BA@GJPNJIAM@RegDeleteValueW?$AA@
0x180021E30: "ConfigMgrPolUpdate" ??_C@_1CG@DPCFHFAD@?$AAC?$AAo?$AAn?$AAf?$AAi?$AAg?$AAM?$AAg?$AAr?$AAP?$AAo?$AAl?$AAU?$AAp?$AAd?$AAa?$AAt?$AAe?$AA?$AA@
0x180028E30: "struct NCA_MULTISITE_TRIGGER_COMP_ gNcaMultisiteTriggerComp" ?gNcaMultisiteTriggerComp@@3UNCA_MULTISITE_TRIGGER_COMP_@@A
0x180021BD8: NcaSvc_PerfTrack_InternetConnected_ResolveName_Start
0x180020178: "__cdecl _imp_SubmitThreadpoolWork" __imp_SubmitThreadpoolWork
0x18001DD90: PdcpAlpcCallback
0x180020068: "__cdecl _imp_InitializeSRWLock" __imp_InitializeSRWLock
0x180023CE0: "RegQueryValueExW" ??_C@_0BB@GLNAEDBD@RegQueryValueExW?$AA@
0x1800203C8: "__cdecl _imp_TpReleaseAlpcCompletion" __imp_TpReleaseAlpcCompletion
0x180022108: "NamePreferenceAllowed" ??_C@_1CM@OLEJKNMP@?$AAN?$AAa?$AAm?$AAe?$AAP?$AAr?$AAe?$AAf?$AAe?$AAr?$AAe?$AAn?$AAc?$AAe?$AAA?$AAl?$AAl?$AAo?$AAw?$AAe?$AAd?$AA?$AA@
0x1800228F0: "WtsTrigger" ??_C@_1BG@CBPPAFFF@?$AAW?$AAt?$AAs?$AAT?$AAr?$AAi?$AAg?$AAg?$AAe?$AAr?$AA?$AA@
0x180028048: "struct NCA_COMMAND_ENVIROMENT_ * gScriptLogUserCommands" ?gScriptLogUserCommands@@3PAUNCA_COMMAND_ENVIROMENT_@@A
0x180019790: NcaExpandEnvironmentStrings
0x18001FB58: "__cdecl _imp_DnsGetPolicyTableInfo" __imp_DnsGetPolicyTableInfo
0x1800131A8: WPP_SF_SSd
0x1800193BC: NcaEtwPerfTrackUpdate
0x180023E90: "__cdecl _midl_frag8" __midl_frag8
0x180010748: "void __cdecl NcaEvCollHttpProbeCollectUpdateEvidenceAfterNameResolution(struct NCA_EVCOLL_PROBE_ * __ptr64,int,enum NCA_PROBE_TEST_TYPE_,int)" ?NcaEvCollHttpProbeCollectUpdateEvidenceAfterNameResolution@@YAXPEAUNCA_EVCOLL_PROBE_@@HW4NCA_PROBE_TEST_TYPE_@@H@Z
0x180018720: "void __cdecl NcaUserStorePhrase1Shutdown(void)" ?NcaUserStorePhrase1Shutdown@@YAXXZ
0x18000FDF0: "int __cdecl NcaEvCollIPv6IsDisabled(void)" ?NcaEvCollIPv6IsDisabled@@YAHXZ
0x1800104E0: "void __cdecl NcaEvCollHttpProbeCollectAsyncCallback(void * __ptr64,unsigned __int64,unsigned long,void * __ptr64,unsigned long)" ?NcaEvCollHttpProbeCollectAsyncCallback@@YAXPEAX_KK0K@Z
0x18001FC60: "__cdecl _imp_RpcStringFreeW" __imp_RpcStringFreeW
0x180020000: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x18001A70C: NcaRegCreateKey
0x18001FFD8: "__cdecl _imp_RegQueryInfoKeyW" __imp_RegQueryInfoKeyW
0x180023248: WPP_871cc87e7db4372ec0143faf09cb2146_Traceguids
0x180016A8C: NcaDAPEvidenceSnapshotSetGlobalState
0x18001FCD0: "__cdecl _imp_NdrAsyncServerCall" __imp_NdrAsyncServerCall
0x180021A90: NcaSvc_PerfTrack_InternetConnected_ResolveName_Stop
0x180022980: "WTS_SESSION_LOGON" ??_C@_1CE@FKDHCAOO@?$AAW?$AAT?$AAS?$AA_?$AAS?$AAE?$AAS?$AAS?$AAI?$AAO?$AAN?$AA_?$AAL?$AAO?$AAG?$AAO?$AAN?$AA?$AA@
0x180023D88: "NcaRegNotifyCreate" ??_C@_0BD@JKCNJAPA@NcaRegNotifyCreate?$AA@
0x18001C1F0: Rpc_NcaNetworkClose
0x180001C50: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x18001FF08: "__cdecl _imp_ExpandEnvironmentStringsW" __imp_ExpandEnvironmentStringsW
0x180020FC0: "Get-DnsClientNrptPolicy | Out-De" ??_C@_1EM@HAMENGFB@?$AAG?$AAe?$AAt?$AA?9?$AAD?$AAn?$AAs?$AAC?$AAl?$AAi?$AAe?$AAn?$AAt?$AAN?$AAr?$AAp?$AAt?$AAP?$AAo?$AAl?$AAi?$AAc?$AAy?$AA?5?$AA?$HM?$AA?5?$AAO?$AAu?$AAt?$AA?9?$AAD?$AAe@
0x180012158: "void __cdecl NcaEvcollProbeStatePrintf(int,int,unsigned short * __ptr64,unsigned __int64,unsigned short * __ptr64 * __ptr64,unsigned __int64 * __ptr64,struct NCA_EVCOLL_PROBE_ * __ptr64)" ?NcaEvcollProbeStatePrintf@@YAXHHPEAG_KPEAPEAGPEA_KPEAUNCA_EVCOLL_PROBE_@@@Z
0x1800073B8: "unsigned long __cdecl SvrImpl_NcaStatusEventSubscribe(void * __ptr64,void * __ptr64,void * __ptr64 * __ptr64)" ?SvrImpl_NcaStatusEventSubscribe@@YAKPEAX0PEAPEAX@Z
0x1800065D0: "void __cdecl SvrImpl_NcaEngineCloseCore(struct NCA_INTSERVER_ENGINE_HANDLE_ * __ptr64)" ?SvrImpl_NcaEngineCloseCore@@YAXPEAUNCA_INTSERVER_ENGINE_HANDLE_@@@Z
0x18001FB98: "__cdecl _imp_Icmp6SendEcho2" __imp_Icmp6SendEcho2
0x18000BF70: NcaNlmTriggerShutdown
0x180005308: NcaConfigMgrEnableVanUI
0x180009C14: NcaScriptLogsGenerateLogsAndCaptureFile
0x180019A18: NcaGetCanonicalPathName
0x1800227C0: WPP_6cb3d90c6f9438b6550600ea18f69f53_Traceguids
0x180021120: "netsh wfp show netevents file=-" ??_C@_1EA@JEKJMLKE@?$AAn?$AAe?$AAt?$AAs?$AAh?$AA?5?$AAw?$AAf?$AAp?$AA?5?$AAs?$AAh?$AAo?$AAw?$AA?5?$AAn?$AAe?$AAt?$AAe?$AAv?$AAe?$AAn?$AAt?$AAs?$AA?5?$AAf?$AAi?$AAl?$AAe?$AA?$DN?$AA?9?$AA?$AA@
0x18000D7AC: "void __cdecl NcaWtsTriggerCleanup(void)" ?NcaWtsTriggerCleanup@@YAXXZ
0x180023D08: "RegSetValueExW" ??_C@_0P@LIPJIDOO@RegSetValueExW?$AA@
0x18001FD10: "__cdecl _imp_RevertSecurityContext" __imp_RevertSecurityContext
0x180021B30: NcaSvc_PerfTrack_InternetConnected_ActionableState_Stop
0x18001FD78: "__cdecl _imp_UnregisterGPNotification" __imp_UnregisterGPNotification
0x180022650: " -Command "& { $global:FormatEnu" ??_C@_1GG@MGPBCJCC@?$AA?5?$AA?9?$AAC?$AAo?$AAm?$AAm?$AAa?$AAn?$AAd?$AA?5?$AA?$CC?$AA?$CG?$AA?5?$AA?$HL?$AA?5?$AA$?$AAg?$AAl?$AAo?$AAb?$AAa?$AAl?$AA?3?$AAF?$AAo?$AAr?$AAm?$AAa?$AAt?$AAE?$AAn?$AAu@
0x18000FFF0: NcaEvCollIPv6Shutdown
0x180017BE0: "void __cdecl NcaUserStoreCloseCallback(struct _TP_CALLBACK_INSTANCE * __ptr64,void * __ptr64,struct _TP_WORK * __ptr64)" ?NcaUserStoreCloseCallback@@YAXPEAU_TP_CALLBACK_INSTANCE@@PEAXPEAU_TP_WORK@@@Z
0x18000C3A0: "void __cdecl NotifyIpUnicastAddrCallback(void * __ptr64,struct _MIB_IPFORWARD_ROW2 * __ptr64,enum _MIB_NOTIFICATION_TYPE)" ?NotifyIpUnicastAddrCallback@@YAXPEAXPEAU_MIB_IPFORWARD_ROW2@@W4_MIB_NOTIFICATION_TYPE@@@Z
0x1800226E0: "%systemroot%\system32\WindowsPow" ??_C@_1HI@NKIMLECN@?$AA?$CF?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AAr?$AAo?$AAo?$AAt?$AA?$CF?$AA?2?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AAP?$AAo?$AAw@
0x180020258: "__cdecl _imp_ConvertStringSecurityDescriptorToSecurityDescriptorW" __imp_ConvertStringSecurityDescriptorToSecurityDescriptorW
0x180021B70: NcaSvc_PerfTrack_InternetConnected_DTESucceeded_Start
0x18001FCE8: "__cdecl _imp_RpcServerUnregisterIfEx" __imp_RpcServerUnregisterIfEx
0x18001B6A4: NcaFree
0x180025850: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0
0x180019970: NcaFreeMuiStringTable
0x180020428: "__cdecl _imp_RtlIpv6AddressToStringW" __imp_RtlIpv6AddressToStringW
0x18000F2B0: NcaEvCollPolicyPresenceInitialize
0x180021EB8: "HTTP:" ??_C@_1M@EAMODDKC@?$AAH?$AAT?$AAT?$AAP?$AA?3?$AA?$AA@
0x1800141D0: "void __cdecl NcaEvCollNamePrefProfileChange(void * __ptr64,void * __ptr64,void * __ptr64,void * __ptr64)" ?NcaEvCollNamePrefProfileChange@@YAXPEAX000@Z
0x180024318: "PdcpAlpcProcessMessage" ??_C@_0BH@NNNJKHIK@PdcpAlpcProcessMessage?$AA@
0x18001FBF0: "__cdecl _imp_RegisterWaitForSingleObject" __imp_RegisterWaitForSingleObject
0x180021B20: NcaSvc_PerfTrack_InternetConnected_ActionableState_Start
0x180022FA0: "Client NCA" ??_C@_1BG@LNCGHJPF@?$AAC?$AAl?$AAi?$AAe?$AAn?$AAt?$AA?5?$AAN?$AAC?$AAA?$AA?$AA@
0x180010854: "void __cdecl NcaEvCollHttpProbeCollectWinHttpRequestCloseUnderLock(struct NCA_EVCOLL_PROBE_ * __ptr64)" ?NcaEvCollHttpProbeCollectWinHttpRequestCloseUnderLock@@YAXPEAUNCA_EVCOLL_PROBE_@@@Z
0x18001FCE0: "__cdecl _imp_RpcBindingVectorFree" __imp_RpcBindingVectorFree
0x180028260: MS_NCASVC_ETW_PROVIDER_ID_Context
0x180020AC0: "Proxy Configuration (netsh winht" ??_C@_1FO@LJEHFPJG@?$AAP?$AAr?$AAo?$AAx?$AAy?$AA?5?$AAC?$AAo?$AAn?$AAf?$AAi?$AAg?$AAu?$AAr?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?5?$AA?$CI?$AAn?$AAe?$AAt?$AAs?$AAh?$AA?5?$AAw?$AAi?$AAn?$AAh?$AAt@
0x1800201C8: api-ms-win-eventing-classicprovider-l1-1-0_NULL_THUNK_DATA
0x18000A25C: NcaSrcLnkdTriggerUnregisterWait
0x180021ED8: "Probes" ??_C@_1O@FCKPDLGO@?$AAP?$AAr?$AAo?$AAb?$AAe?$AAs?$AA?$AA@
0x180028420: "unsigned long * NcaLogStatusEventSubtypeIds" ?NcaLogStatusEventSubtypeIds@@3PAKA
0x180010808: "void __cdecl NcaEvCollHttpProbeCollectWinHttpRequestClose(struct NCA_EVCOLL_PROBE_ * __ptr64)" ?NcaEvCollHttpProbeCollectWinHttpRequestClose@@YAXPEAUNCA_EVCOLL_PROBE_@@@Z
0x180025A1C: "__cdecl _IMPORT_DESCRIPTOR_WINHTTP" __IMPORT_DESCRIPTOR_WINHTTP
0x1800168E0: NcaDAPEvidenceSnapshotInitialize
0x1800075D4: "void __cdecl SvrImpl_NcaStatusEventSubscriptionGetLastEvent(struct _RPC_ASYNC_STATE * __ptr64,void * __ptr64,void * __ptr64,struct NCA_STATUS_EVENT_ * __ptr64)" ?SvrImpl_NcaStatusEventSubscriptionGetLastEvent@@YAXPEAU_RPC_ASYNC_STATE@@PEAX1PEAUNCA_STATUS_EVENT_@@@Z
0x180029910: "struct NCA_RPC_APIS_COMPONENT_ gNcaRpcAPIs" ?gNcaRpcAPIs@@3UNCA_RPC_APIS_COMPONENT_@@A
0x180021FA0: "CustomCommands" ??_C@_1BO@EFMELPNL@?$AAC?$AAu?$AAs?$AAt?$AAo?$AAm?$AAC?$AAo?$AAm?$AAm?$AAa?$AAn?$AAd?$AAs?$AA?$AA@
0x180023A80: WPP_3763270b5ef73b7953ea04f094ad4c3c_Traceguids
0x180020330: "__cdecl _imp__XcptFilter" __imp__XcptFilter
0x180008520: "void __cdecl NcaScriptLogsFreeStrings(void)" ?NcaScriptLogsFreeStrings@@YAXXZ
0x180025A44: "__cdecl _IMPORT_DESCRIPTOR_DNSAPI" __IMPORT_DESCRIPTOR_DNSAPI
0x180013E90: NcaEvCollHealthInitialize
0x1800128DC: NcaEvCollProbesCreate
0x180024330: "%s: Error receiving message from" ??_C@_0CI@ONNGEIAO@?$CFs?3?5Error?5receiving?5message?5from@
0x180020438: ntdll_NULL_THUNK_DATA
0x180020378: "__cdecl _imp_memcpy" __imp_memcpy
0x1800016B4: "__cdecl Init_thread_footer" _Init_thread_footer
0x180025A58: "__cdecl _IMPORT_DESCRIPTOR_SspiCli" __IMPORT_DESCRIPTOR_SspiCli
0x1800283A0: "unsigned long * NcaScriptLogProcessStatusIds" ?NcaScriptLogProcessStatusIds@@3PAKA
0x180029A58: "unsigned short * __ptr64 * wszNcaProbeResult" ?wszNcaProbeResult@@3PAPEAGA
0x180021D58: "RegisterServiceCtrlHandlerEx" ??_C@_0BN@PFAJKLFD@RegisterServiceCtrlHandlerEx?$AA@
0x18001E170: PdcPrint
0x180025904: "__cdecl _IMPORT_DESCRIPTOR_WS2_32" __IMPORT_DESCRIPTOR_WS2_32
0x180003D3C: "long __cdecl NcaConfigMgrLoadDteList(struct HKEY__ * __ptr64,struct NCA_PROBE_LIST_ * __ptr64)" ?NcaConfigMgrLoadDteList@@YAJPEAUHKEY__@@PEAUNCA_PROBE_LIST_@@@Z
0x180022830: WPP_a4fec3a3c94030a207946759d8e20f3d_Traceguids
0x18001FC00: "__cdecl _imp_GetComputerNameW" __imp_GetComputerNameW
0x180022F90: "20000" ??_C@_1M@GFFHLPEC@?$AA2?$AA0?$AA0?$AA0?$AA0?$AA?$AA@
0x1800207C0: FWPM_CONDITION_NET_EVENT_TYPE
0x180029998: "unsigned short * __ptr64 * wszNcaScriptLogProcessStatus" ?wszNcaScriptLogProcessStatus@@3PAPEAGA
0x18001DDFC: PdcpAlpcProcessMessage
0x180016124: "void __cdecl NcaDAPEvidenceUserSnapshotAddRef(struct NCA_DAP_USER_EVSNPSHT_ * __ptr64)" ?NcaDAPEvidenceUserSnapshotAddRef@@YAXPEAUNCA_DAP_USER_EVSNPSHT_@@@Z
0x180021170: "IPsec Rules (Show-NetIPsecRule -" ??_C@_1HC@PGMJDACJ@?$AAI?$AAP?$AAs?$AAe?$AAc?$AA?5?$AAR?$AAu?$AAl?$AAe?$AAs?$AA?5?$AA?$CI?$AAS?$AAh?$AAo?$AAw?$AA?9?$AAN?$AAe?$AAt?$AAI?$AAP?$AAs?$AAe?$AAc?$AAR?$AAu?$AAl?$AAe?$AA?5?$AA?9@
0x1800201A0: "__cdecl _imp_GetTraceEnableFlags" __imp_GetTraceEnableFlags
0x180025828: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0
0x180019718: NcaExcludeShareLockLeave
0x180021B40: StatusChanged
0x18001A1EC: NcaStringBuild
0x180020158: "__cdecl _imp_SetThreadpoolTimer" __imp_SetThreadpoolTimer
0x180020998: "systeminfo" ??_C@_1BG@HBLHACOB@?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AAi?$AAn?$AAf?$AAo?$AA?$AA@
0x18000DEA0: NcaWtsTriggerShutdown
0x180021DF8: WPP_ea69e65453b43016a6f30e313b5815b1_Traceguids
0x1800201A8: "__cdecl _imp_RegisterTraceGuidsW" __imp_RegisterTraceGuidsW
0x180028378: "__cdecl _security_cookie" __security_cookie
0x18001FFA8: "__cdecl _imp_RegQueryValueExW" __imp_RegQueryValueExW
0x18000E990: NcaPDCTriggerUnregisterWait
0x180001DF0: "__cdecl alloca_probe" _alloca_probe
0x1800100D0: "void __cdecl NcaEvCollHttpProbeCollect(struct NCA_EVCOLL_PROBE_ * __ptr64,struct NCA_EVCOLL_USER_PROBES_ * __ptr64)" ?NcaEvCollHttpProbeCollect@@YAXPEAUNCA_EVCOLL_PROBE_@@PEAUNCA_EVCOLL_USER_PROBES_@@@Z
0x180018130: "unsigned long __cdecl NcaUserStoreCreateEvColls(struct NCA_USER_ * __ptr64)" ?NcaUserStoreCreateEvColls@@YAKPEAUNCA_USER_@@@Z
0x180023950: "NCA_EVCOLLECTOR_USER_IDLE" ??_C@_1DE@DMMLIDDG@?$AAN?$AAC?$AAA?$AA_?$AAE?$AAV?$AAC?$AAO?$AAL?$AAL?$AAE?$AAC?$AAT?$AAO?$AAR?$AA_?$AAU?$AAS?$AAE?$AAR?$AA_?$AAI?$AAD?$AAL?$AAE?$AA?$AA@
0x180022FB8: "HEAD" ??_C@_19CABHAKPH@?$AAH?$AAE?$AAA?$AAD?$AA?$AA@
0x18001FDF8: WS2_32_NULL_THUNK_DATA
0x180023D18: "NcaRegQueryString" ??_C@_0BC@IMJLMALJ@NcaRegQueryString?$AA@
0x18000A6B0: NcaTriggerUnregisterWait
0x180020218: "__cdecl _imp_CheckTokenMembership" __imp_CheckTokenMembership
0x1800147F0: NcaEvCollNamePrefShutdown
0x18001FB40: "char * __ptr64 * PolicyObjectName" ?PolicyObjectName@@3PAPEADA
0x180020180: "__cdecl _imp_WaitForThreadpoolTimerCallbacks" __imp_WaitForThreadpoolTimerCallbacks
0x180022E40: "EvCollIPv6" ??_C@_1BG@MOJCLCMK@?$AAE?$AAv?$AAC?$AAo?$AAl?$AAl?$AAI?$AAP?$AAv?$AA6?$AA?$AA@
0x180021C18: Trigger
0x18001BE70: Rpc_NcaEngineOpen
0x180020098: "__cdecl _imp_ResetEvent" __imp_ResetEvent
0x180021760: "Prefix Policy Table (Get-NetPref" ??_C@_1FE@BBHEMHON@?$AAP?$AAr?$AAe?$AAf?$AAi?$AAx?$AA?5?$AAP?$AAo?$AAl?$AAi?$AAc?$AAy?$AA?5?$AAT?$AAa?$AAb?$AAl?$AAe?$AA?5?$AA?$CI?$AAG?$AAe?$AAt?$AA?9?$AAN?$AAe?$AAt?$AAP?$AAr?$AAe?$AAf@
0x18001FEA8: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x1800203D8: "__cdecl _imp_WinSqmSetDWORD" __imp_WinSqmSetDWORD
0x18001FFF8: "__cdecl _imp_RtlCompareMemory" __imp_RtlCompareMemory
0x18001FEE0: "__cdecl _imp_LocalFree" __imp_LocalFree
0x180020208: "__cdecl _imp_GetLengthSid" __imp_GetLengthSid
0x1800283C8: "unsigned long * NcaScriptLogUserStatusIds" ?NcaScriptLogUserStatusIds@@3PAKA
0x180021D40: "NcaComponentsInitialize" ??_C@_0BI@PKPPMMME@NcaComponentsInitialize?$AA@
0x180029630: "struct NCA_EVCOLL_FIREWALL_COMPONENT_ gNcaEvCollFirewall" ?gNcaEvCollFirewall@@3UNCA_EVCOLL_FIREWALL_COMPONENT_@@A
0x1800258A0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0
0x180018F60: McGenControlCallbackV2
0x18001FE20: api-ms-win-core-com-l1-1-0_NULL_THUNK_DATA
0x18001FC38: "__cdecl _imp_VariantInit" __imp_VariantInit
0x180021A70: EvCollUpdate
0x180020488: "__cdecl _xl_a" __xl_a
0x180020210: "__cdecl _imp_CopySid" __imp_CopySid
0x18001FC30: "__cdecl _imp_SysAllocString" __imp_SysAllocString
0x180009E4C: "void __cdecl NcaSrcLnkdTriggerRegisterForSource(struct NCA_SYNCED_LIST_HEAD_ * __ptr64,struct _LIST_ENTRY * __ptr64)" ?NcaSrcLnkdTriggerRegisterForSource@@YAXPEAUNCA_SYNCED_LIST_HEAD_@@PEAU_LIST_ENTRY@@@Z
0x18001FFD0: "__cdecl _imp_RegCreateKeyExW" __imp_RegCreateKeyExW
0x180028A10: "__cdecl _onexitbegin" __onexitbegin
0x18001FDC8: WINHTTP_NULL_THUNK_DATA
0x180022CD8: "EvCollPolicyPresence" ??_C@_1CK@FKAAOKLD@?$AAE?$AAv?$AAC?$AAo?$AAl?$AAl?$AAP?$AAo?$AAl?$AAi?$AAc?$AAy?$AAP?$AAr?$AAe?$AAs?$AAe?$AAn?$AAc?$AAe?$AA?$AA@
0x18001FCD8: "__cdecl _imp_I_RpcBindingIsClientLocal" __imp_I_RpcBindingIsClientLocal
0x1800123F8: "long __cdecl StringCchPrintfExW(unsigned short * __ptr64,unsigned __int64,unsigned short * __ptr64 * __ptr64,unsigned __int64 * __ptr64,unsigned long,unsigned short const * __ptr64,...)" ?StringCchPrintfExW@@YAJPEAG_KPEAPEAGPEA_KKPEBGZZ
0x180020350: "__cdecl _imp__vsnwprintf" __imp__vsnwprintf
0x180014FC0: "void __cdecl NcaEvCollIPHTTPsCertShutdown(void)" ?NcaEvCollIPHTTPsCertShutdown@@YAXXZ
0x180020DE8: "iphttpsState" ??_C@_1BK@MLBBGCPH@?$AAi?$AAp?$AAh?$AAt?$AAt?$AAp?$AAs?$AAS?$AAt?$AAa?$AAt?$AAe?$AA?$AA@
0x18001BDD0: Rpc_NcaEngineClose
0x180028EF0: "struct NCA_COMMAND_ENVIROMENT_ * gScriptLogCustomCommands" ?gScriptLogCustomCommands@@3PAUNCA_COMMAND_ENVIROMENT_@@A
0x18001FCC8: "__cdecl _imp_RpcRevertToSelf" __imp_RpcRevertToSelf
0x18000A7B8: NcaGPTriggerRearm
0x18001FE40: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x18001FF38: "__cdecl _imp_GetCurrentThread" __imp_GetCurrentThread
0x18001FD68: "__cdecl _imp_DestroyEnvironmentBlock" __imp_DestroyEnvironmentBlock
0x18000FC90: "void __cdecl NcaEvCollIPv6Collect(void * __ptr64,void * __ptr64,void * __ptr64,void * __ptr64)" ?NcaEvCollIPv6Collect@@YAXPEAX000@Z
0x18000E110: NcaTimerTriggerUnregisterWait
0x18000ED70: "long __cdecl NcaMultisiteUnregisterWMINotification(void)" ?NcaMultisiteUnregisterWMINotification@@YAJXZ
0x180001724: "__cdecl Init_thread_header" _Init_thread_header
0x180025B34: "__cdecl _IMPORT_DESCRIPTOR_KERNEL32" __IMPORT_DESCRIPTOR_KERNEL32
0x180020770: IID_INetworkListManager
0x180023FA0: rpcncaengine__MIDL_TypeFormatString
0x18001FFC8: "__cdecl _imp_RegOpenKeyExW" __imp_RegOpenKeyExW
0x180024358: "PdcpProcessMessageInternal" ??_C@_0BL@NLEMLGCG@PdcpProcessMessageInternal?$AA@
0x180023600: "NCA_EVCOLLECTOR_IPHTTPS_PROXY_CO" ??_C@_1FI@FOLLNAEI@?$AAN?$AAC?$AAA?$AA_?$AAE?$AAV?$AAC?$AAO?$AAL?$AAL?$AAE?$AAC?$AAT?$AAO?$AAR?$AA_?$AAI?$AAP?$AAH?$AAT?$AAT?$AAP?$AAS?$AA_?$AAP?$AAR?$AAO?$AAX?$AAY?$AA_?$AAC?$AAO@
0x18001A644: "long __cdecl NcaRegNotifyRegisterForChanges(struct NCA_REG_NOTIFY_ * __ptr64)" ?NcaRegNotifyRegisterForChanges@@YAJPEAUNCA_REG_NOTIFY_@@@Z
0x180001B54: "__cdecl _security_init_cookie" __security_init_cookie
0x180003C60: "long __cdecl NcaConfigMgrLoadBool(struct HKEY__ * __ptr64,unsigned short const * __ptr64,int,int * __ptr64)" ?NcaConfigMgrLoadBool@@YAJPEAUHKEY__@@PEBGHPEAH@Z
0x180022E58: "DisabledComponents" ??_C@_1CG@OOFOGOIN@?$AAD?$AAi?$AAs?$AAa?$AAb?$AAl?$AAe?$AAd?$AAC?$AAo?$AAm?$AAp?$AAo?$AAn?$AAe?$AAn?$AAt?$AAs?$AA?$AA@
0x180023090: "SYSTEM\CurrentControlSet\Service" ??_C@_1GM@BCNGHFAL@?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA?2?$AAS?$AAe?$AAr?$AAv?$AAi?$AAc?$AAe@
0x18000553C: NcaConfigMgrGetString
0x18002588C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-service-core-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-service-core-l1-1-0
0x180022850: "2s Mark" ??_C@_07HFJMLJNK@2s?5Mark?$AA@
0x180003E08: "long __cdecl NcaConfigMgrLoadMultisite(struct NCA_POLICY_ * __ptr64)" ?NcaConfigMgrLoadMultisite@@YAJPEAUNCA_POLICY_@@@Z
0x180023D30: "RegEnumValueW" ??_C@_0O@GLENPJE@RegEnumValueW?$AA@
0x180028DA0: "struct NCA_PROXY_TRIGGER_COMPONENT_ gNcaProxyTriggerComponent" ?gNcaProxyTriggerComponent@@3UNCA_PROXY_TRIGGER_COMPONENT_@@A
0x180017050: NcaDAPEvidenceUserSnapshotFind
0x180022168: "Active" ??_C@_1O@EMLLFJNI@?$AAA?$AAc?$AAt?$AAi?$AAv?$AAe?$AA?$AA@
0x180025800: "__cdecl _IMPORT_DESCRIPTOR_msvcrt" __IMPORT_DESCRIPTOR_msvcrt
0x180001DAE: wcscmp
0x180020260: api-ms-win-security-sddl-l1-1-0_NULL_THUNK_DATA
0x180012CE4: NcaEvCollProbesMultisiteUpdate
0x180005BE0: NcaProbeEmpty
0x1800224D0: "NcaStatusEventSubscriptionGetLas" ??_C@_1EO@EMJJIBML@?$AAN?$AAc?$AAa?$AAS?$AAt?$AAa?$AAt?$AAu?$AAs?$AAE?$AAv?$AAe?$AAn?$AAt?$AAS?$AAu?$AAb?$AAs?$AAc?$AAr?$AAi?$AAp?$AAt?$AAi?$AAo?$AAn?$AAG?$AAe?$AAt?$AAL?$AAa?$AAs@
0x1800283F0: "unsigned long * NcaProbeTypeIds" ?NcaProbeTypeIds@@3PAKA
0x1800148E8: NcaEvCollNamePrefToggle
0x1800050AC: "enum NCA_PROBE_TYPE_ __cdecl NcaProbeGetType(unsigned short const * __ptr64,unsigned short const * __ptr64 * __ptr64)" ?NcaProbeGetType@@YA?AW4NCA_PROBE_TYPE_@@PEBGPEAPEBG@Z
0x180028408: "unsigned long * NcaLogStatusEventTypeIds" ?NcaLogStatusEventTypeIds@@3PAKA
0x180019068: McGenEventRegister
0x180020058: "__cdecl _imp_SetWaitableTimer" __imp_SetWaitableTimer
0x1800138A4: "void __cdecl NcaEvCollStrongAuthLoopbackImpersonateCheck(int * __ptr64)" ?NcaEvCollStrongAuthLoopbackImpersonateCheck@@YAXPEAH@Z
0x1800243D0: "%s: Unable to cancel ALPC messag" ??_C@_0CJ@HGJOHFDH@?$CFs?3?5Unable?5to?5cancel?5ALPC?5messag@
0x18001A128: NcaSQMSubmit
0x180020318: "__cdecl _imp_malloc" __imp_malloc
0x180022520: "NcaStatusEventUnsubscribe" ??_C@_1DE@PLBLHCKF@?$AAN?$AAc?$AAa?$AAS?$AAt?$AAa?$AAt?$AAu?$AAs?$AAE?$AAv?$AAe?$AAn?$AAt?$AAU?$AAn?$AAs?$AAu?$AAb?$AAs?$AAc?$AAr?$AAi?$AAb?$AAe?$AA?$AA@
0x180023068: "EvCollNamePref" ??_C@_1BO@JHCDJDHM@?$AAE?$AAv?$AAC?$AAo?$AAl?$AAl?$AAN?$AAa?$AAm?$AAe?$AAP?$AAr?$AAe?$AAf?$AA?$AA@
0x180023828: "NCA_EVCOLLECTOR_PASSIVE_TEST" ??_C@_1DK@LEBPFAEN@?$AAN?$AAC?$AAA?$AA_?$AAE?$AAV?$AAC?$AAO?$AAL?$AAL?$AAE?$AAC?$AAT?$AAO?$AAR?$AA_?$AAP?$AAA?$AAS?$AAS?$AAI?$AAV?$AAE?$AA_?$AAT?$AAE?$AAS?$AAT?$AA?$AA@
0x1800201D0: "__cdecl _imp_EventUnregister" __imp_EventUnregister
0x18001FE80: "__cdecl _imp_WriteFile" __imp_WriteFile
0x180018D30: "void __cdecl NcaEtwPerfTrackScenarioUpdate(enum NCA_ETW_PERFTRACK_SCENARIO_TYPE_,struct NCA_EVIDENCE_ const * __ptr64,struct NCA_STATUS_EVENT_)" ?NcaEtwPerfTrackScenarioUpdate@@YAXW4NCA_ETW_PERFTRACK_SCENARIO_TYPE_@@PEBUNCA_EVIDENCE_@@UNCA_STATUS_EVENT_@@@Z
0x1800203A0: "__cdecl _imp_ZwAlpcCancelMessage" __imp_ZwAlpcCancelMessage
0x1800216D0: "Get-DAClientExperienceConfigurat" ??_C@_1GE@HGECAMMO@?$AAG?$AAe?$AAt?$AA?9?$AAD?$AAA?$AAC?$AAl?$AAi?$AAe?$AAn?$AAt?$AAE?$AAx?$AAp?$AAe?$AAr?$AAi?$AAe?$AAn?$AAc?$AAe?$AAC?$AAo?$AAn?$AAf?$AAi?$AAg?$AAu?$AAr?$AAa?$AAt@
0x180025968: "__cdecl _IMPORT_DESCRIPTOR_RPCRT4" __IMPORT_DESCRIPTOR_RPCRT4
0x18001A010: NcaReportErrorAsWinError
0x180020120: "__cdecl _imp_GetTickCount64" __imp_GetTickCount64
0x18000A1F4: NcaSrcLnkdTriggerSignalTriggersInList
0x18000FA20: NcaEvCollInternetConnectivityInitialize
0x1800181EC: "unsigned long __cdecl NcaUserStoreCreateHelper(struct _TOKEN_USER * __ptr64,void * __ptr64,int,struct NCA_USER_ * __ptr64 * __ptr64,int * __ptr64)" ?NcaUserStoreCreateHelper@@YAKPEAU_TOKEN_USER@@PEAXHPEAPEAUNCA_USER_@@PEAH@Z
0x1800203B8: "__cdecl _imp_ZwAlpcDisconnectPort" __imp_ZwAlpcDisconnectPort
0x180021280: "IPsec Main Mode SA's (Get-NetIPs" ??_C@_1FM@BGIEBEMN@?$AAI?$AAP?$AAs?$AAe?$AAc?$AA?5?$AAM?$AAa?$AAi?$AAn?$AA?5?$AAM?$AAo?$AAd?$AAe?$AA?5?$AAS?$AAA?$AA?8?$AAs?$AA?5?$AA?$CI?$AAG?$AAe?$AAt?$AA?9?$AAN?$AAe?$AAt?$AAI?$AAP?$AAs@
0x180019B50: NcaGetExpandedCanonicalLongPathName
0x1800227E0: "NlmTrigger" ??_C@_1BG@GMPADONC@?$AAN?$AAl?$AAm?$AAT?$AAr?$AAi?$AAg?$AAg?$AAe?$AAr?$AA?$AA@
0x180020C60: "Teredo State (Get-NetTeredoState" ??_C@_1EE@EDJOJKJP@?$AAT?$AAe?$AAr?$AAe?$AAd?$AAo?$AA?5?$AAS?$AAt?$AAa?$AAt?$AAe?$AA?5?$AA?$CI?$AAG?$AAe?$AAt?$AA?9?$AAN?$AAe?$AAt?$AAT?$AAe?$AAr?$AAe?$AAd?$AAo?$AAS?$AAt?$AAa?$AAt?$AAe@
0x18001B9DC: "long __cdecl NcaRpcAPIsInitSecurityMode(unsigned long)" ?NcaRpcAPIsInitSecurityMode@@YAJK@Z
0x18001FD08: RPCRT4_NULL_THUNK_DATA
0x180021460: "Get-NetIPAddress | where{$_.Addr" ??_C@_1JC@FLBDFPD@?$AAG?$AAe?$AAt?$AA?9?$AAN?$AAe?$AAt?$AAI?$AAP?$AAA?$AAd?$AAd?$AAr?$AAe?$AAs?$AAs?$AA?5?$AA?$HM?$AA?5?$AAw?$AAh?$AAe?$AAr?$AAe?$AA?$HL?$AA$?$AA_?$AA?4?$AAA?$AAd?$AAd?$AAr@
0x180002258: "void __cdecl NcaDestroyCancelableLock(struct _tag_NCA_CANCELABLE_LOCK * __ptr64)" ?NcaDestroyCancelableLock@@YAXPEAU_tag_NCA_CANCELABLE_LOCK@@@Z
0x180021EA8: "PING:" ??_C@_1M@GLCCLNDI@?$AAP?$AAI?$AAN?$AAG?$AA?3?$AA?$AA@
0x180006448: "unsigned long __cdecl SvrImpl_NcaEngineClose(void * __ptr64,void * __ptr64 * __ptr64)" ?SvrImpl_NcaEngineClose@@YAKPEAXPEAPEAX@Z
0x180021C70: "SOFTWARE\Policies\Microsoft\Wind" ??_C@_1IC@KOINJPMG@?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAP?$AAo?$AAl?$AAi?$AAc?$AAi?$AAe?$AAs?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd@
0x18001137C: "void __cdecl NcaEvCollProbeRearm(struct NCA_EVCOLL_PROBE_ * __ptr64)" ?NcaEvCollProbeRearm@@YAXPEAUNCA_EVCOLL_PROBE_@@@Z
0x180029990: "unsigned short * __ptr64 * wszNcaScriptLogProbeStatus" ?wszNcaScriptLogProbeStatus@@3PAPEAGA
0x18001FB50: "__cdecl _imp_DnsFreePolicyConfig" __imp_DnsFreePolicyConfig
0x1800017E0: "__cdecl _report_gsfailure" __report_gsfailure
0x180022138: "FriendlyName" ??_C@_1BK@BFIEKNFP@?$AAF?$AAr?$AAi?$AAe?$AAn?$AAd?$AAl?$AAy?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x18001FC10: "__cdecl _imp_CreateThreadpool" __imp_CreateThreadpool
0x180022340: "O:SYG:SYD:(A;;RCWD;;;BA)(A;;RCWD" ??_C@_1GG@MHPKMJCM@?$AAO?$AA?3?$AAS?$AAY?$AAG?$AA?3?$AAS?$AAY?$AAD?$AA?3?$AA?$CI?$AAA?$AA?$DL?$AA?$DL?$AAR?$AAC?$AAW?$AAD?$AA?$DL?$AA?$DL?$AA?$DL?$AAB?$AAA?$AA?$CJ?$AA?$CI?$AAA?$AA?$DL?$AA?$DL?$AAR?$AAC?$AAW?$AAD@
0x180020060: "__cdecl _imp_LeaveCriticalSection" __imp_LeaveCriticalSection
0x180001130: "public: virtual unsigned long __cdecl CNlmTriggerProfileEventSink::AddRef(void) __ptr64" ?AddRef@CNlmTriggerProfileEventSink@@UEAAKXZ
0x18002583C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-1" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-1
0x180023100: "DirectAccessPreferLocal" ??_C@_1DA@KKIEKPBH@?$AAD?$AAi?$AAr?$AAe?$AAc?$AAt?$AAA?$AAc?$AAc?$AAe?$AAs?$AAs?$AAP?$AAr?$AAe?$AAf?$AAe?$AAr?$AAL?$AAo?$AAc?$AAa?$AAl?$AA?$AA@
0x18001D5C4: PdcNotificationClientUnregister
0x180016700: McTemplateU0qq
0x180028A20: "__cdecl _native_startup_state" __native_startup_state
0x180004618: "long __cdecl NcaConfigMgrLoadString(struct HKEY__ * __ptr64,unsigned short const * __ptr64,int,unsigned short * __ptr64 * __ptr64)" ?NcaConfigMgrLoadString@@YAJPEAUHKEY__@@PEBGHPEAPEAG@Z
0x18001FDA8: "__cdecl _imp_WinHttpCrackUrl" __imp_WinHttpCrackUrl
0x1800122F0: "int __cdecl ResolveName(unsigned short const * __ptr64,struct sockaddr_in6 * __ptr64)" ?ResolveName@@YAHPEBGPEAUsockaddr_in6@@@Z
0x180021538: "Get-NetRoute | Out-Default" ??_C@_1DG@NODNMHHP@?$AAG?$AAe?$AAt?$AA?9?$AAN?$AAe?$AAt?$AAR?$AAo?$AAu?$AAt?$AAe?$AA?5?$AA?$HM?$AA?5?$AAO?$AAu?$AAt?$AA?9?$AAD?$AAe?$AAf?$AAa?$AAu?$AAl?$AAt?$AA?$AA@
0x18001C350: Rpc_NcaStatusEventSubscribe
0x180022460: "NcaNetworkOpen" ??_C@_1BO@OCJEILBF@?$AAN?$AAc?$AAa?$AAN?$AAe?$AAt?$AAw?$AAo?$AAr?$AAk?$AAO?$AAp?$AAe?$AAn?$AA?$AA@
0x180022B00: "PROXYMGR_PROVIDER_EVENT_PROXY_CR" ??_C@_1FM@DOAKACAE@?$AAP?$AAR?$AAO?$AAX?$AAY?$AAM?$AAG?$AAR?$AA_?$AAP?$AAR?$AAO?$AAV?$AAI?$AAD?$AAE?$AAR?$AA_?$AAE?$AAV?$AAE?$AAN?$AAT?$AA_?$AAP?$AAR?$AAO?$AAX?$AAY?$AA_?$AAC?$AAR@
0x180010D28: "unsigned long __cdecl NcaEvCollHttpProbeSessionShutdown(struct NCA_EVCOLL_PROBE_ * __ptr64)" ?NcaEvCollHttpProbeSessionShutdown@@YAKPEAUNCA_EVCOLL_PROBE_@@@Z
0x180023E10: WPP_7989db582612321e6bdc4d6d9f99f818_Traceguids
0x180022280: "O:SYG:SYD:(A;;RCWD;;;BA)(A;;RCWD" ??_C@_1GK@LGFDBJLM@?$AAO?$AA?3?$AAS?$AAY?$AAG?$AA?3?$AAS?$AAY?$AAD?$AA?3?$AA?$CI?$AAA?$AA?$DL?$AA?$DL?$AAR?$AAC?$AAW?$AAD?$AA?$DL?$AA?$DL?$AA?$DL?$AAB?$AAA?$AA?$CJ?$AA?$CI?$AAA?$AA?$DL?$AA?$DL?$AAR?$AAC?$AAW?$AAD@
0x1800282B0: "struct NCA_PROBE_TYPE_PREFIX_ * g_NcaProbeTypePrefixTable" ?g_NcaProbeTypePrefixTable@@3PAUNCA_PROBE_TYPE_PREFIX_@@A
0x18001FD58: "__cdecl _imp_DeleteSecurityContext" __imp_DeleteSecurityContext
0x180029330: "struct NCA_EVCOLL_POL_COMPONENT_ gNcaEvCollPol" ?gNcaEvCollPol@@3UNCA_EVCOLL_POL_COMPONENT_@@A
0x18000CF2C: NcaWfpNetEventTriggerRegisterWait
0x180023B90: "NcaGetLongPathName" ??_C@_0BD@LGFGNMHF@NcaGetLongPathName?$AA@
0x180022958: "WTS_SESSION_UNLOCK" ??_C@_1CG@KALJBMML@?$AAW?$AAT?$AAS?$AA_?$AAS?$AAE?$AAS?$AAS?$AAI?$AAO?$AAN?$AA_?$AAU?$AAN?$AAL?$AAO?$AAC?$AAK?$AA?$AA@
0x1800196BC: NcaCriticalSectionDestroy
0x180022050: "SOFTWARE\Policies\Microsoft\Dire" ??_C@_1HM@CFJLJOF@?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAP?$AAo?$AAl?$AAi?$AAc?$AAi?$AAe?$AAs?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAD?$AAi?$AAr?$AAe@
0x180020280: "__cdecl _imp_OpenSCManagerW" __imp_OpenSCManagerW
0x180023DA0: "RegisterWaitForSingleObject" ??_C@_0BM@ONKCFHFK@RegisterWaitForSingleObject?$AA@
0x180005EB0: "unsigned long __cdecl NcaApiSrvImplIsEngineReferenced(struct NCA_INTSERVER_ENGINE_HANDLE_ * __ptr64)" ?NcaApiSrvImplIsEngineReferenced@@YAKPEAUNCA_INTSERVER_ENGINE_HANDLE_@@@Z
0x180023DD8: "NcaRegNotifyRegisterForChanges" ??_C@_0BP@LJMLEABJ@NcaRegNotifyRegisterForChanges?$AA@
0x180022DE8: WPP_703941b86341348a204a214be1f9d57d_Traceguids
0x180020CF8: "iphttpsConfig" ??_C@_1BM@PNNPKLJL@?$AAi?$AAp?$AAh?$AAt?$AAt?$AAp?$AAs?$AAC?$AAo?$AAn?$AAf?$AAi?$AAg?$AA?$AA@
0x18001A90C: NcaRegEnumValueNameAndValueData
0x1800119D0: "void __cdecl NcaEvCollProbeVerifySubTypeChange(struct NCA_EVCOLL_PROBE_ * __ptr64)" ?NcaEvCollProbeVerifySubTypeChange@@YAXPEAUNCA_EVCOLL_PROBE_@@@Z
0x180021418: "IP Address (Get-NetIPAddress)" ??_C@_1DM@JGLBOIEB@?$AAI?$AAP?$AA?5?$AAA?$AAd?$AAd?$AAr?$AAe?$AAs?$AAs?$AA?5?$AA?$CI?$AAG?$AAe?$AAt?$AA?9?$AAN?$AAe?$AAt?$AAI?$AAP?$AAA?$AAd?$AAd?$AAr?$AAe?$AAs?$AAs?$AA?$CJ?$AA?$AA@
0x180022238: WPP_addd7e32e8b43cd7c74cb9c1872557a1_Traceguids
0x18001A0AC: NcaReportReturnError
0x18001FF78: "__cdecl _imp_OpenThreadToken" __imp_OpenThreadToken
0x18000F450: NcaEvCollPolicyPresenceShutdown
0x180020308: httpprxp_NULL_THUNK_DATA
0x180007D88: "unsigned long __cdecl NcaScriptLogsCopyOutput(void * __ptr64,void * __ptr64)" ?NcaScriptLogsCopyOutput@@YAKPEAX0@Z
0x180029BA0: "unsigned long gNcaSQMLogSettingsValue" ?gNcaSQMLogSettingsValue@@3KA
0x180016DD0: NcaDAPEvidenceUserSnapshotCreate
0x18000B890: "public: virtual long __cdecl CNlmTriggerProfileEventSink::QueryInterface(struct _GUID const & __ptr64,void * __ptr64 * __ptr64) __ptr64" ?QueryInterface@CNlmTriggerProfileEventSink@@UEAAJAEBU_GUID@@PEAPEAX@Z
0x18001725C: NcaDAPGetLastEvent
0x1800218E8: "groups" ??_C@_1O@LJNBHOAA@?$AAg?$AAr?$AAo?$AAu?$AAp?$AAs?$AA?$AA@
0x18001FC28: "__cdecl _imp_SysFreeString" __imp_SysFreeString
0x180021080: "netsh winsock show catalog" ??_C@_1DG@POMGEFOO@?$AAn?$AAe?$AAt?$AAs?$AAh?$AA?5?$AAw?$AAi?$AAn?$AAs?$AAo?$AAc?$AAk?$AA?5?$AAs?$AAh?$AAo?$AAw?$AA?5?$AAc?$AAa?$AAt?$AAa?$AAl?$AAo?$AAg?$AA?$AA@
0x180023E78: "Nca APIs" ??_C@_1BC@FHKNBFAH@?$AAN?$AAc?$AAa?$AA?5?$AAA?$AAP?$AAI?$AAs?$AA?$AA@
0x180021330: "ipsecQuick" ??_C@_1BG@POLJLLHD@?$AAi?$AAp?$AAs?$AAe?$AAc?$AAQ?$AAu?$AAi?$AAc?$AAk?$AA?$AA@
0x180025AD0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0
0x180016CB0: NcaDAPEvidenceSnapshotShutdown
0x18000AFB8: "void __cdecl NcaNlmTriggerConnectionPointShutdown(void)" ?NcaNlmTriggerConnectionPointShutdown@@YAXXZ
0x18001FCA0: "__cdecl _imp_NdrServerCall2" __imp_NdrServerCall2
0x180022640: "NCA" ??_C@_17MKOLHND@?$AAN?$AAC?$AAA?$AA?$AA@
0x180021020: "Winsock Catalog (netsh winsock s" ??_C@_1FK@JBKOOPDO@?$AAW?$AAi?$AAn?$AAs?$AAo?$AAc?$AAk?$AA?5?$AAC?$AAa?$AAt?$AAa?$AAl?$AAo?$AAg?$AA?5?$AA?$CI?$AAn?$AAe?$AAt?$AAs?$AAh?$AA?5?$AAw?$AAi?$AAn?$AAs?$AAo?$AAc?$AAk?$AA?5?$AAs@
0x18000718C: "unsigned long __cdecl SvrImpl_NcaNetworkOpen(void * __ptr64,void * __ptr64,struct _GUID const * __ptr64,void * __ptr64 * __ptr64)" ?SvrImpl_NcaNetworkOpen@@YAKPEAX0PEBU_GUID@@PEAPEAX@Z
0x1800159D0: NcaEvCollIdleInitialize
0x180023028: WPP_a5e2f82ae5dc32ae1b66063911b87e7e_Traceguids
0x18001A504: WPP_SF_sD
0x18000CD70: WPP_SF_sd
0x180017C60: "unsigned long __cdecl NcaUserStoreCreate(void * __ptr64,struct NCA_USER_ * __ptr64 * __ptr64)" ?NcaUserStoreCreate@@YAKPEAXPEAPEAUNCA_USER_@@@Z
0x180020320: "__cdecl _imp_free" __imp_free
0x180001AC0: "__cdecl IsNonwritableInCurrentImage" _IsNonwritableInCurrentImage
0x1800200E0: api-ms-win-core-synch-l1-2-0_NULL_THUNK_DATA
0x18001FBB8: "__cdecl _imp_CancelMibChangeNotify2" __imp_CancelMibChangeNotify2
0x1800200F8: api-ms-win-core-synch-l1-2-1_NULL_THUNK_DATA
0x180017358: WPP_SF_SS
0x1800227D0: WPP_4e8f7b6c19db3464e69a3c2e96374f48_Traceguids
0x180021B00: NcaSvc_PerfTrack_InternetConnected_DTESucceeded_Stop
0x180025864: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-threadpool-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-threadpool-l1-2-0
0x180021D10: "SetServiceStatus" ??_C@_0BB@DCELCPIA@SetServiceStatus?$AA@
0x18001FF30: "__cdecl _imp_OpenProcessToken" __imp_OpenProcessToken
0x180015150: "int __cdecl NcaEvCollIphttpsIsCertError(void)" ?NcaEvCollIphttpsIsCertError@@YAHXZ
0x180021CF8: "NcaServiceChangeState" ??_C@_0BG@FLGOMDDE@NcaServiceChangeState?$AA@
0x18000DFA0: "void __cdecl TimerCallback(struct _TP_CALLBACK_INSTANCE * __ptr64,void * __ptr64,struct _TP_TIMER * __ptr64)" ?TimerCallback@@YAXPEAU_TP_CALLBACK_INSTANCE@@PEAXPEAU_TP_TIMER@@@Z
0x18001FB78: FirewallAPI_NULL_THUNK_DATA
0x1800053DC: NcaConfigMgrGetActiveSite
0x180003ACC: "__cdecl TlgDefineProvider_annotation__Tlgg_hNcaProv" _TlgDefineProvider_annotation__Tlgg_hNcaProv
0x1800227B0: WPP_76590fa6bcbf3118d3c5509c5d3db454_Traceguids
0x1800200A8: api-ms-win-core-synch-l1-1-0_NULL_THUNK_DATA
0x1800112A8: "enum NCA_PROBE_TEST_TYPE_ __cdecl NcaEvCollProbeGetTestType(unsigned long,int * __ptr64)" ?NcaEvCollProbeGetTestType@@YA?AW4NCA_PROBE_TEST_TYPE_@@KPEAH@Z
0x180029370: "struct NCA_EVCOLL_INOUT_COMPONENT_ gNcaEvCollInOut" ?gNcaEvCollInOut@@3UNCA_EVCOLL_INOUT_COMPONENT_@@A
0x180029590: "struct NCA_EVCOLL_PROXY_COMPONENT_ gNcaEvCollProxy" ?gNcaEvCollProxy@@3UNCA_EVCOLL_PROXY_COMPONENT_@@A
0x1800259F4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0
0x180001694: "__cdecl DllMainCRTStartupForGS2" _DllMainCRTStartupForGS2
0x180029AE0: "unsigned short * __ptr64 * wszNcaLogStatusEventSubtypes" ?wszNcaLogStatusEventSubtypes@@3PAPEAGA
0x18000309C: McTemplateU0q
0x18001FDF0: "__cdecl _imp_WSAStartup" __imp_WSAStartup
0x180017B84: "void __cdecl NcaUserStoreClose(struct NCA_USER_ * __ptr64)" ?NcaUserStoreClose@@YAXPEAUNCA_USER_@@@Z
0x18001C650: WPP_SF_s
0x18001A49C: WPP_SF_S
0x180005138: McTemplateU0z
0x180001DA2: memset
0x180025B70: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x180014040: NcaEvCollHealthShutdown
0x1800212E0: "Get-NetIPsecMainModeSA | Out-Def" ??_C@_1EK@NCJDILND@?$AAG?$AAe?$AAt?$AA?9?$AAN?$AAe?$AAt?$AAI?$AAP?$AAs?$AAe?$AAc?$AAM?$AAa?$AAi?$AAn?$AAM?$AAo?$AAd?$AAe?$AAS?$AAA?$AA?5?$AA?$HM?$AA?5?$AAO?$AAu?$AAt?$AA?9?$AAD?$AAe?$AAf@
0x180023748: "NCA_EVCOLLECTOR_IPV6_DISABLED" ??_C@_1DM@FIIIKPBN@?$AAN?$AAC?$AAA?$AA_?$AAE?$AAV?$AAC?$AAO?$AAL?$AAL?$AAE?$AAC?$AAT?$AAO?$AAR?$AA_?$AAI?$AAP?$AAV?$AA6?$AA_?$AAD?$AAI?$AAS?$AAA?$AAB?$AAL?$AAE?$AAD?$AA?$AA@
0x180023B40: "NcaExpandEnvironmentStrings" ??_C@_0BM@FFIBEPJM@NcaExpandEnvironmentStrings?$AA@
0x18001FE78: "__cdecl _imp_ReadFile" __imp_ReadFile
0x180022DF8: "EvCollInternetConnectivity" ??_C@_1DG@NPAEGLNA@?$AAE?$AAv?$AAC?$AAo?$AAl?$AAl?$AAI?$AAn?$AAt?$AAe?$AAr?$AAn?$AAe?$AAt?$AAC?$AAo?$AAn?$AAn?$AAe?$AAc?$AAt?$AAi?$AAv?$AAi?$AAt?$AAy?$AA?$AA@
0x18000D670: NcaWfpTriggerShutdown

[JEB Decompiler by PNF Software]