Generated by JEB on 2019/08/01

PE: C:\Windows\System32\drivers\luafv.sys Base=0x1C0000000 SHA-256=47EDEFE5548467580DD3EEA0D53500893219F2FC6BE9BA38F5C6FF665AC45E38
PDB: luafv.pdb GUID={22DBFA0A-4DD6-0B04-D7A9E2211E2EA0C8} Age=1

807 located named symbols:
0x1C0021000: QueryBuffer
0x1C0004120: "\System32\Speech" ??_C@_1CC@KJDOIMJF@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAS?$AAp?$AAe?$AAe?$AAc?$AAh?$AA?$AA@
0x1C000B050: "__cdecl _imp_FltAllocateExtraCreateParameter" __imp_FltAllocateExtraCreateParameter
0x1C0003D90: "\System32\icsxml" ??_C@_1CC@NDDPAOME@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAi?$AAc?$AAs?$AAx?$AAm?$AAl?$AA?$AA@
0x1C000B110: "__cdecl _imp_FltSetCallbackDataDirty" __imp_FltSetCallbackDataDirty
0x1C000B2E8: "__cdecl _imp_RtlDeleteNoSplay" __imp_RtlDeleteNoSplay
0x1C000B490: "__cdecl _imp_SeCaptureSubjectContext" __imp_SeCaptureSubjectContext
0x1C0021018: DefaultExcludedExtensions
0x1C0021038: LuafvSettingsKeyName
0x1C000B2A0: "__cdecl _imp_RtlFreeUnicodeString" __imp_RtlFreeUnicodeString
0x1C0005E70: LuafvSelectFileFailed
0x1C0003800: "\IME" ??_C@_19JGIDJJDE@?$AA?2?$AAI?$AAM?$AAE?$AA?$AA@
0x1C0003668: "\ADAM" ??_C@_1M@MMIONHLN@?$AA?2?$AAA?$AAD?$AAA?$AAM?$AA?$AA@
0x1C0004F30: "\SysWOW64\IAS" ??_C@_1BM@DJEKCKJC@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAI?$AAA?$AAS?$AA?$AA@
0x1C000B0E0: "__cdecl _imp_FltGetFileNameInformation" __imp_FltGetFileNameInformation
0x1C00080A8: "__cdecl _security_cookie_complement" __security_cookie_complement
0x1C00059F0: "EnableExtensionBasedExclusion" ??_C@_1DM@DJLPPMHK@?$AAE?$AAn?$AAa?$AAb?$AAl?$AAe?$AAE?$AAx?$AAt?$AAe?$AAn?$AAs?$AAi?$AAo?$AAn?$AAB?$AAa?$AAs?$AAe?$AAd?$AAE?$AAx?$AAc?$AAl?$AAu?$AAs?$AAi?$AAo?$AAn?$AA?$AA@
0x1C000B4E0: "__cdecl _imp_ObfDereferenceObject" __imp_ObfDereferenceObject
0x1C001A01C: LuafvCheckExcludedName
0x1C00053C0: "\SysWOW64\tssesdir" ??_C@_1CG@HLFGOAJB@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAt?$AAs?$AAs?$AAe?$AAs?$AAd?$AAi?$AAr?$AA?$AA@
0x1C0005948: "Parameters" ??_C@_1BG@PGIGMDPA@?$AAP?$AAa?$AAr?$AAa?$AAm?$AAe?$AAt?$AAe?$AAr?$AAs?$AA?$AA@
0x1C001D010: HiveListKey
0x1C0003F38: "\System32\msmq" ??_C@_1BO@OLJEDGDL@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAm?$AAs?$AAm?$AAq?$AA?$AA@
0x1C0010040: LuafvFreePool
0x1C0003E20: "\System32\Licensing" ??_C@_1CI@PMMCKEPK@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAL?$AAi?$AAc?$AAe?$AAn?$AAs?$AAi?$AAn?$AAg?$AA?$AA@
0x1C0008B9A: RunFileTableAlgorithm
0x1C0001658: LuafvCalculateHash
0x1C00210C8: LuafvEnableVirtValueName
0x1C000B2F8: "__cdecl _imp_ObfDereferenceObjectWithTag" __imp_ObfDereferenceObjectWithTag
0x1C000D510: LuafvPreCleanup
0x1C0001180: LuafvPreRedirectWithCallback
0x1C000B4D8: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x1C000B508: "__cdecl _imp_RtlCopySidAndAttributesArray" __imp_RtlCopySidAndAttributesArray
0x1C0001880: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x1C0009140: ScavengerWorkItem
0x1C001022C: GetFileInformation
0x1C0010E64: LuafvInitializeSdTable
0x1C0008038: LuafvDeviceNamePrefix
0x1C0021170: RegistryKeyNames
0x1C000B0D8: "__cdecl _imp_FltGetFileNameInformationUnsafe" __imp_FltGetFileNameInformationUnsafe
0x1C0005C90: "__cdecl TraceLoggingMetadata" _TraceLoggingMetadata
0x1C0004F10: "\SysWOW64\hcs" ??_C@_1BM@OGMAEDFJ@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAh?$AAc?$AAs?$AA?$AA@
0x1C0004AE8: "\Microsoft\Search" ??_C@_1CE@JJAOONCA@?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAS?$AAe?$AAa?$AAr?$AAc?$AAh?$AA?$AA@
0x1C0011C30: UsnThread
0x1C000B158: "__cdecl _imp_FltWriteFile" __imp_FltWriteFile
0x1C000B350: "__cdecl _imp_PsTerminateSystemThread" __imp_PsTerminateSystemThread
0x1C000B428: "__cdecl _imp_ZwEnumerateKey" __imp_ZwEnumerateKey
0x1C000B1F0: "__cdecl _imp_ExpInterlockedPushEntrySList" __imp_ExpInterlockedPushEntrySList
0x1C001E19C: LuafvInitializeFileTable
0x1C000B2F0: "__cdecl _imp_RtlRealSuccessor" __imp_RtlRealSuccessor
0x1C0018D00: LuafvPostSetInformationSafe
0x1C000B478: "__cdecl _imp_SeCreateClientSecurityFromSubjectContext" __imp_SeCreateClientSecurityFromSubjectContext
0x1C0003D70: "\System32\IAS" ??_C@_1BM@KNOJHOKO@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAI?$AAA?$AAS?$AA?$AA@
0x1C000B3B8: "__cdecl _imp_SeQueryInformationToken" __imp_SeQueryInformationToken
0x1C0004228: "\System32\wbem" ??_C@_1BO@JNJFHMOF@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAw?$AAb?$AAe?$AAm?$AA?$AA@
0x1C0008CB0: ScavengerCount
0x1C001AAB8: LuafvFreeStoreFile
0x1C00034F8: LuafvDelayedSwitchFailed
0x1C0010CCC: IsExcludedExtension
0x1C0004478: "\cmak" ??_C@_1M@ODOKIIPJ@?$AA?2?$AAc?$AAm?$AAa?$AAk?$AA?$AA@
0x1C0021088: LuafvEnableExtensionBasedExclusionValueName
0x1C0004078: "\System32\rms" ??_C@_1BM@KFBCFLPG@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAr?$AAm?$AAs?$AA?$AA@
0x1C000B1C0: "__cdecl _imp_IoRemoveShareAccess" __imp_IoRemoveShareAccess
0x1C001C140: LuafvTerminateUserStoresForVolume
0x1C00039B0: "\Registration" ??_C@_1BM@DLJOFKMC@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x1C0003AF0: "\System32\CatRoot2" ??_C@_1CG@KLPGJEKP@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAC?$AAa?$AAt?$AAR?$AAo?$AAo?$AAt?$AA2?$AA?$AA@
0x1C0021068: LuafvLogControlValueName
0x1C000B248: "__cdecl _imp_RtlCreateSecurityDescriptor" __imp_RtlCreateSecurityDescriptor
0x1C0004778: "\Windows Calendar" ??_C@_1CE@NLAJEHBB@?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAC?$AAa?$AAl?$AAe?$AAn?$AAd?$AAa?$AAr?$AA?$AA@
0x1C000B390: "__cdecl _imp_ExInitializeRundownProtection" __imp_ExInitializeRundownProtection
0x1C000B0F0: "__cdecl _imp_FltAllocateContext" __imp_FltAllocateContext
0x1C0004C88: "\SysWOW64\CatRoot" ??_C@_1CE@PIDBLIAG@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAC?$AAa?$AAt?$AAR?$AAo?$AAo?$AAt?$AA?$AA@
0x1C0014FA4: LuafvCopyDirectoryEntry
0x1C000DBD0: LuafvPreLockControl
0x1C000B180: "__cdecl _imp_FltQuerySecurityObject" __imp_FltQuerySecurityObject
0x1C0002174: "__cdecl TlgWrite" _TlgWrite
0x1C000B030: "__cdecl _imp_FltGetRequestorSessionId" __imp_FltGetRequestorSessionId
0x1C000B540: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x1C0005F00: LuafvInstanceSetupFailed
0x1C000B1A8: "__cdecl _imp_FltCreateFileEx2" __imp_FltCreateFileEx2
0x1C001A2B0: LuafvCreateStoreRootPathWorker
0x1C0006040: "\Registry\Machine\System\Current" ??_C@_1HI@JBNMHJEN@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1C000E0BC: LuafvGetVolumeProperties
0x1C000B200: "__cdecl _imp_ExDeletePagedLookasideList" __imp_ExDeletePagedLookasideList
0x1C000B228: "__cdecl _imp_ExQueueWorkItem" __imp_ExQueueWorkItem
0x1C000B4F8: "__cdecl _imp_RtlGetOwnerSecurityDescriptor" __imp_RtlGetOwnerSecurityDescriptor
0x1C0004F50: "\SysWOW64\icsxml" ??_C@_1CC@MINAAGNO@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAi?$AAc?$AAs?$AAx?$AAm?$AAl?$AA?$AA@
0x1C00048F0: "\SpeechEngines" ??_C@_1BO@EENJOOP@?$AA?2?$AAS?$AAp?$AAe?$AAe?$AAc?$AAh?$AAE?$AAn?$AAg?$AAi?$AAn?$AAe?$AAs?$AA?$AA@
0x1C0003FC0: "\System32\Printing_Admin_Scripts" ??_C@_1EC@KMPOBPAL@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAP?$AAr?$AAi?$AAn?$AAt?$AAi?$AAn?$AAg?$AA_?$AAA?$AAd?$AAm?$AAi?$AAn?$AA_?$AAS?$AAc?$AAr?$AAi?$AAp?$AAt?$AAs@
0x1C0005ED0: LuafvCreateStreamHandleContextFailed
0x1C0008BA0: NextUserTime
0x1C0004098: "\System32\RpcProxy" ??_C@_1CG@CEILMMHF@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAR?$AAp?$AAc?$AAP?$AAr?$AAo?$AAx?$AAy?$AA?$AA@
0x1C0004200: "\System32\tssesdir" ??_C@_1CG@BJGCCABN@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAt?$AAs?$AAs?$AAe?$AAs?$AAd?$AAi?$AAr?$AA?$AA@
0x1C000B2D8: "__cdecl _imp_RtlSplay" __imp_RtlSplay
0x1C000B078: "__cdecl _imp_FltDoCompletionProcessingWhenSafe" __imp_FltDoCompletionProcessingWhenSafe
0x1C0004978: "\Microsoft\DRM" ??_C@_1BO@DHICCCAI@?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAD?$AAR?$AAM?$AA?$AA@
0x1C0010FE8: LuafvInitializeUsn
0x1C0004FE0: "\SysWOW64\Licensing" ??_C@_1CI@PAJANDDJ@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAL?$AAi?$AAc?$AAe?$AAn?$AAs?$AAi?$AAn?$AAg?$AA?$AA@
0x1C0005E80: LuafvCreateVirtualPathFailed
0x1C00100F8: LuafvAllocatePool
0x1C00050B0: "\SysWOW64\migwiz" ??_C@_1CC@CCMNBIMP@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAm?$AAi?$AAg?$AAw?$AAi?$AAz?$AA?$AA@
0x1C001BA2C: GetLocalAppDataStorePath
0x1C000B208: "__cdecl _imp_KeInitializeSpinLock" __imp_KeInitializeSpinLock
0x1C0002140: "__cdecl TlgKeywordOn" _TlgKeywordOn
0x1C0008CC0: LuafvDvfcbHashTable
0x1C0010E20: LuafvPreNetworkQueryOpen
0x1C0001614: ExAllocateFromPagedLookasideList
0x1C00082F8: PoolLock
0x1C000B220: "__cdecl _imp_KeWaitForSingleObject" __imp_KeWaitForSingleObject
0x1C000B410: "__cdecl _imp_RtlAppendUnicodeStringToString" __imp_RtlAppendUnicodeStringToString
0x1C0011E00: LuafvScavengeUserList
0x1C00050D8: "\SysWOW64\MSDTC" ??_C@_1CA@DPJNCKDE@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAM?$AAS?$AAD?$AAT?$AAC?$AA?$AA@
0x1C000B0E8: "__cdecl _imp_FltSetInstanceContext" __imp_FltSetInstanceContext
0x1C00108F0: LuafvUpdateFileTableForChangeRecord
0x1C000B218: "__cdecl _imp_KeReleaseSpinLock" __imp_KeReleaseSpinLock
0x1C0004D70: "\SysWOW64\CodeIntegrity" ??_C@_1DA@GPOCIKFI@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAC?$AAo?$AAd?$AAe?$AAI?$AAn?$AAt?$AAe?$AAg?$AAr?$AAi?$AAt?$AAy?$AA?$AA@
0x1C0003898: "\Microsoft.NET" ??_C@_1BO@GHDMEBFD@?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?4?$AAN?$AAE?$AAT?$AA?$AA@
0x1C00082C0: LookasideLists
0x1C0003708: "\Cluster" ??_C@_1BC@KBCPJICH@?$AA?2?$AAC?$AAl?$AAu?$AAs?$AAt?$AAe?$AAr?$AA?$AA@
0x1C0017F50: LuafvNormalizeNameComponentEx
0x1C0003E48: "\System32\LogFiles" ??_C@_1CG@HFJAJK@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAL?$AAo?$AAg?$AAF?$AAi?$AAl?$AAe?$AAs?$AA?$AA@
0x1C000B038: "__cdecl _imp_FltFreeExtraCreateParameter" __imp_FltFreeExtraCreateParameter
0x1C0004950: "\Microsoft\Crypto" ??_C@_1CE@HCGEBJME@?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAC?$AAr?$AAy?$AAp?$AAt?$AAo?$AA?$AA@
0x1C00038F8: "\Offline Web Pages" ??_C@_1CG@NJJOPMML@?$AA?2?$AAO?$AAf?$AAf?$AAl?$AAi?$AAn?$AAe?$AA?5?$AAW?$AAe?$AAb?$AA?5?$AAP?$AAa?$AAg?$AAe?$AAs?$AA?$AA@
0x1C0005030: "\SysWOW64\lserver" ??_C@_1CE@NJNMKIHJ@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAl?$AAs?$AAe?$AAr?$AAv?$AAe?$AAr?$AA?$AA@
0x1C0003978: "\prefetch" ??_C@_1BE@MHLLIKHC@?$AA?2?$AAp?$AAr?$AAe?$AAf?$AAe?$AAt?$AAc?$AAh?$AA?$AA@
0x1C0005598: "\SystemRoot" ??_C@_1BI@OMNCDEIM@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAo?$AAo?$AAt?$AA?$AA@
0x1C00049F0: "\Microsoft\IdentityCRL" ??_C@_1CO@GIGLNJIF@?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAI?$AAd?$AAe?$AAn?$AAt?$AAi?$AAt?$AAy?$AAC?$AAR?$AAL?$AA?$AA@
0x1C0005118: "\SysWOW64\MUI" ??_C@_1BM@BKODNDBO@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAM?$AAU?$AAI?$AA?$AA@
0x1C00018C0: memcpy
0x1C0004758: "\RSS Explorer" ??_C@_1BM@FKCCFNLA@?$AA?2?$AAR?$AAS?$AAS?$AA?5?$AAE?$AAx?$AAp?$AAl?$AAo?$AAr?$AAe?$AAr?$AA?$AA@
0x1C0004A70: "\Microsoft\Network" ??_C@_1CG@MPAFEKLG@?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAN?$AAe?$AAt?$AAw?$AAo?$AAr?$AAk?$AA?$AA@
0x1C0001E40: AllocateDataBuffer
0x1C000B518: "__cdecl _imp_RtlConvertSidToUnicodeString" __imp_RtlConvertSidToUnicodeString
0x1C0002220: LuafvPostDirectoryControl
0x1C0003C00: "\System32\config" ??_C@_1CC@PDPDHFII@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAc?$AAo?$AAn?$AAf?$AAi?$AAg?$AA?$AA@
0x1C0003F98: "\System32\OOBE" ??_C@_1BO@PLONHLPB@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAO?$AAO?$AAB?$AAE?$AA?$AA@
0x1C0004360: "\System32\wins" ??_C@_1BO@BKPOLANM@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAw?$AAi?$AAn?$AAs?$AA?$AA@
0x1C0003920: "\Performance" ??_C@_1BK@IOPJALGI@?$AA?2?$AAP?$AAe?$AAr?$AAf?$AAo?$AAr?$AAm?$AAa?$AAn?$AAc?$AAe?$AA?$AA@
0x1C0004248: "\System32\WDI" ??_C@_1BM@KLLBHLPP@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAW?$AAD?$AAI?$AA?$AA@
0x1C0004A20: "\Microsoft\Media Index" ??_C@_1CO@DLOMGHNG@?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAM?$AAe?$AAd?$AAi?$AAa?$AA?5?$AAI?$AAn?$AAd?$AAe?$AAx?$AA?$AA@
0x1C000B280: "__cdecl _imp_RtlSubAuthoritySid" __imp_RtlSubAuthoritySid
0x1C000B118: "__cdecl _imp_FltGetStreamHandleContext" __imp_FltGetStreamHandleContext
0x1C0004410: "\Twain_32" ??_C@_1BE@HEPGEKPO@?$AA?2?$AAT?$AAw?$AAa?$AAi?$AAn?$AA_?$AA3?$AA2?$AA?$AA@
0x1C000B468: "__cdecl _imp_SeTokenType" __imp_SeTokenType
0x1C001F4B4: QueryStringValue
0x1C0014F38: LuafvCompareDirectoryEntryName
0x1C0003768: "\Downloaded Program Files" ??_C@_1DE@NKNHNDIA@?$AA?2?$AAD?$AAo?$AAw?$AAn?$AAl?$AAo?$AAa?$AAd?$AAe?$AAd?$AA?5?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AA?5?$AAF?$AAi?$AAl?$AAe?$AAs?$AA?$AA@
0x1C0005EF0: LuafvAdminAccessCheckFailed
0x1C0004CF8: "\SysWOW64\ccmsetup" ??_C@_1CG@JEOGGDGM@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAc?$AAc?$AAm?$AAs?$AAe?$AAt?$AAu?$AAp?$AA?$AA@
0x1C000172D: "__cdecl _C_specific_handler" __C_specific_handler
0x1C0004E08: "\SysWOW64\dns" ??_C@_1BM@NPBEFMI@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAd?$AAn?$AAs?$AA?$AA@
0x1C0018F74: LuafvRemoveEcp
0x1C00191D0: LuafvSetEcp
0x1C0010BF0: FindNodeOrParent
0x1C0004DA0: "\SysWOW64\Com" ??_C@_1BM@IFNINNIO@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAC?$AAo?$AAm?$AA?$AA@
0x1C00018C0: memmove
0x1C0005F20: LuafvReadFileListFailed
0x1C000B178: "__cdecl _imp_FltSetSecurityObject" __imp_FltSetSecurityObject
0x1C000B270: "__cdecl _imp_RtlLengthRequiredSid" __imp_RtlLengthRequiredSid
0x1C0004E28: "\SysWOW64\Drivers" ??_C@_1CE@HIEFCDEI@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAD?$AAr?$AAi?$AAv?$AAe?$AAr?$AAs?$AA?$AA@
0x1C0011DA0: InitializeFileTableForVolumePreWorker
0x1C000B430: "__cdecl _imp_RtlCopyUnicodeString" __imp_RtlCopyUnicodeString
0x1C000B258: "__cdecl _imp_RtlCreateAcl" __imp_RtlCreateAcl
0x1C0004028: "\System32\RemInst" ??_C@_1CE@OBGFJOBI@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAR?$AAe?$AAm?$AAI?$AAn?$AAs?$AAt?$AA?$AA@
0x1C0004340: "\System32\winrm" ??_C@_1CA@OEPMNPBK@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAw?$AAi?$AAn?$AAr?$AAm?$AA?$AA@
0x1C0003730: "\Cursors" ??_C@_1BC@JKONMKLP@?$AA?2?$AAC?$AAu?$AAr?$AAs?$AAo?$AAr?$AAs?$AA?$AA@
0x1C0005540: "\SysWOW64\WMI Config" ??_C@_1CK@KJCJNELM@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAW?$AAM?$AAI?$AA?5?$AAC?$AAo?$AAn?$AAf?$AAi?$AAg?$AA?$AA@
0x1C000B340: "__cdecl _imp_KeReadStateEvent" __imp_KeReadStateEvent
0x1C000B068: "__cdecl _imp_FltLockUserBuffer" __imp_FltLockUserBuffer
0x1C001FED4: QueryExcludeValue
0x1C000DE9C: LuafvInitializeTable
0x1C000177C: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x1C000B108: "__cdecl _imp_FltRegisterFilter" __imp_FltRegisterFilter
0x1C0005730: "`string'" ??_C@_1CAI@EDFHFDFO@?$AAa?$AAc?$AAm?$AA?$AA?$AAa?$AAs?$AAa?$AA?$AA?$AAa?$AAs?$AAp?$AA?$AA?$AAa?$AAs?$AAp?$AAx?$AA?$AA?$AAa?$AAx?$AA?$AA?$AAb?$AAa?$AAt?$AA?$AA?$AAc?$AAe?$AAr?$AA?$AA?$AAc?$AAh?$AAm?$AA?$AA@
0x1C000B0C8: "__cdecl _imp_FltReleaseFileNameInformation" __imp_FltReleaseFileNameInformation
0x1C000E7A0: LuafvBuildTableNodeName
0x1C000B000: "__cdecl _imp_FltCancelIo" __imp_FltCancelIo
0x1C00039E8: "\SchCache" ??_C@_1BE@OIGECMMK@?$AA?2?$AAS?$AAc?$AAh?$AAC?$AAa?$AAc?$AAh?$AAe?$AA?$AA@
0x1C000B190: "__cdecl _imp_FltClose" __imp_FltClose
0x1C0002130: CountPermanentNodesPreWorker
0x1C0003CC0: "\System32\FxsTmp" ??_C@_1CC@IBFDBECG@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAF?$AAx?$AAs?$AAT?$AAm?$AAp?$AA?$AA@
0x1C00040C0: "\System32\Setup" ??_C@_1CA@LHPKENAK@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAS?$AAe?$AAt?$AAu?$AAp?$AA?$AA@
0x1C0008B20: StaticEntryRoots
0x1C00043D8: "\TAPI" ??_C@_1M@CABNFBM@?$AA?2?$AAT?$AAA?$AAP?$AAI?$AA?$AA@
0x1C000D140: UserLogoffCallback
0x1C0005F50: "\device" ??_C@_1BA@OPNEIAKG@?$AA?2?$AAd?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?$AA@
0x1C0004458: "\WinFX" ??_C@_1O@FEHCDMAE@?$AA?2?$AAW?$AAi?$AAn?$AAF?$AAX?$AA?$AA@
0x1C0005F30: LuafvDelayedOnlyEvent
0x1C00034A0: LuafvEcpType
0x1C0004840: "\Windows NT" ??_C@_1BI@GDGCLPMA@?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAN?$AAT?$AA?$AA@
0x1C0004580: "\Microsoft Games\Minesweeper" ??_C@_1DK@GLPOBHGA@?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?5?$AAG?$AAa?$AAm?$AAe?$AAs?$AA?2?$AAM?$AAi?$AAn?$AAe?$AAs?$AAw?$AAe?$AAe?$AAp?$AAe?$AAr?$AA?$AA@
0x1C00047C8: "\Windows Journal" ??_C@_1CC@MOEBEGAB@?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAJ?$AAo?$AAu?$AAr?$AAn?$AAa?$AAl?$AA?$AA@
0x1C0004518: "\Microsoft Games\Hearts" ??_C@_1DA@DKNKCNMI@?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?5?$AAG?$AAa?$AAm?$AAe?$AAs?$AA?2?$AAH?$AAe?$AAa?$AAr?$AAt?$AAs?$AA?$AA@
0x1C0004C08: "\Outlook Express" ??_C@_1CC@KKDGDDHO@?$AA?2?$AAO?$AAu?$AAt?$AAl?$AAo?$AAo?$AAk?$AA?5?$AAE?$AAx?$AAp?$AAr?$AAe?$AAs?$AAs?$AA?$AA@
0x1C000B148: "__cdecl _imp_FltAcquirePushLockExclusiveEx" __imp_FltAcquirePushLockExclusiveEx
0x1C00033D0: LuafvContextRegistration
0x1C000B008: "__cdecl _imp_FltPerformAsynchronousIo" __imp_FltPerformAsynchronousIo
0x1C00059A0: "LogControl" ??_C@_1BG@KIBNBKCK@?$AAL?$AAo?$AAg?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AA?$AA@
0x1C000B3E8: "__cdecl _imp_FsRtlDoesNameContainWildCards" __imp_FsRtlDoesNameContainWildCards
0x1C0005358: "\SysWOW64\srm" ??_C@_1BM@LPFNJPLG@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAs?$AAr?$AAm?$AA?$AA@
0x1C0004920: "\Microsoft\Assistance" ??_C@_1CM@BPKICNAK@?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAA?$AAs?$AAs?$AAi?$AAs?$AAt?$AAa?$AAn?$AAc?$AAe?$AA?$AA@
0x1C001B690: LuafvSplitRootPathLeft
0x1C0005EA0: LuafvCopyFileFailed
0x1C0016CC8: LuafvLogExclusion
0x1C0005B88: LuafvUserTimeout
0x1C000B380: "__cdecl _imp_EtwSetInformation" __imp_EtwSetInformation
0x1C0005938: "\??\" ??_C@_19JHEHLFPM@?$AA?2?$AA?$DP?$AA?$DP?$AA?2?$AA?$AA@
0x1C000B3C8: "__cdecl _imp_ZwQueryInformationFile" __imp_ZwQueryInformationFile
0x1C0008078: LuafvPathSeparator
0x1C000E758: CreateChildTable
0x1C0004E50: "\SysWOW64\DriverStore" ??_C@_1CM@DGFACNHO@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAD?$AAr?$AAi?$AAv?$AAe?$AAr?$AAS?$AAt?$AAo?$AAr?$AAe?$AA?$AA@
0x1C000B2B8: "__cdecl _imp_SeExamineSacl" __imp_SeExamineSacl
0x1C000B288: "__cdecl _imp_IoGetTopLevelIrp" __imp_IoGetTopLevelIrp
0x1C000B510: "__cdecl _imp_RtlSidHashInitialize" __imp_RtlSidHashInitialize
0x1C0021008: QueryBufferLength
0x1C0003838: "\L2Schemas" ??_C@_1BG@LIADOFIO@?$AA?2?$AAL?$AA2?$AAS?$AAc?$AAh?$AAe?$AAm?$AAa?$AAs?$AA?$AA@
0x1C000B3A0: "__cdecl _imp_RtlPrefixUnicodeString" __imp_RtlPrefixUnicodeString
0x1C0004198: "\System32\srm" ??_C@_1BM@CLPOMLIK@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAs?$AAr?$AAm?$AA?$AA@
0x1C0004F78: "\SysWOW64\ime" ??_C@_1BM@GFBCCKPE@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAi?$AAm?$AAe?$AA?$AA@
0x1C000B4F0: "__cdecl _imp_ExAllocatePoolWithTag" __imp_ExAllocatePoolWithTag
0x1C0003EF0: "\System32\migwiz" ??_C@_1CC@DJCCBANF@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAm?$AAi?$AAg?$AAw?$AAi?$AAz?$AA?$AA@
0x1C0009180: StoreFileLookaside
0x1C000B2A8: "__cdecl _imp_SeAccessCheckFromState" __imp_SeAccessCheckFromState
0x1C0016BEC: LuafvExtractFileNameFromPath
0x1C0005008: "\SysWOW64\LogFiles" ??_C@_1CG@GCEBFABG@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAL?$AAo?$AAg?$AAF?$AAi?$AAl?$AAe?$AAs?$AA?$AA@
0x1C000F370: LuafvReadAndCacheSecurityDescriptor
0x1C0003A88: "\System32\AdvancedInstallers" ??_C@_1DK@FGEENKLA@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAA?$AAd?$AAv?$AAa?$AAn?$AAc?$AAe?$AAd?$AAI?$AAn?$AAs?$AAt?$AAa?$AAl?$AAl?$AAe?$AAr?$AAs?$AA?$AA@
0x1C001A4D0: LuafvCreateUserStorePath
0x1C00180C8: LuafvPerformRename
0x1C0003DD8: "\System32\Inetsrv" ??_C@_1CE@PELPAHE@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAI?$AAn?$AAe?$AAt?$AAs?$AAr?$AAv?$AA?$AA@
0x1C0008B99: InactiveJournalsOnly
0x1C0003650: "ProgramData" ??_C@_1BI@PCFBINBH@?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAD?$AAa?$AAt?$AAa?$AA?$AA@
0x1C0004268: "\System32\wfp" ??_C@_1BM@JFIAAKLP@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAw?$AAf?$AAp?$AA?$AA@
0x1C0004D48: "\SysWOW64\Clients" ??_C@_1CE@GPDPHHHB@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAC?$AAl?$AAi?$AAe?$AAn?$AAt?$AAs?$AA?$AA@
0x1C0003A30: "\ShellNew" ??_C@_1BE@LOODEDFI@?$AA?2?$AAS?$AAh?$AAe?$AAl?$AAl?$AAN?$AAe?$AAw?$AA?$AA@
0x1C0005378: "\SysWOW64\sysprep" ??_C@_1CE@KKLFHFBG@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAs?$AAy?$AAs?$AAp?$AAr?$AAe?$AAp?$AA?$AA@
0x1C0003D18: "\System32\GroupPolicyUsers" ??_C@_1DG@KNNPPFAG@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAG?$AAr?$AAo?$AAu?$AAp?$AAP?$AAo?$AAl?$AAi?$AAc?$AAy?$AAU?$AAs?$AAe?$AAr?$AAs?$AA?$AA@
0x1C000B398: "__cdecl _imp_EtwWriteTransfer" __imp_EtwWriteTransfer
0x1C0011B78: LuafvOpenKey
0x1C0004D20: "\SysWOW64\certsrv" ??_C@_1CE@GFIJGHLN@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAc?$AAe?$AAr?$AAt?$AAs?$AAr?$AAv?$AA?$AA@
0x1C000B438: "__cdecl _imp_RtlUpcaseUnicodeChar" __imp_RtlUpcaseUnicodeChar
0x1C000B1B0: FLTMGR_NULL_THUNK_DATA
0x1C000B3C0: "__cdecl _imp_SeLocateProcessImageName" __imp_SeLocateProcessImageName
0x1C0003F78: "\System32\ndf" ??_C@_1BM@MOMOIJPH@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAn?$AAd?$AAf?$AA?$AA@
0x1C000B440: "__cdecl _imp_FsRtlTeardownPerFileContexts" __imp_FsRtlTeardownPerFileContexts
0x1C00017E4: "__cdecl _GSHandlerCheck_SEH" __GSHandlerCheck_SEH
0x1C001A444: LuafvCreateStoreRootSecurityDescriptor
0x1C000B500: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x1C0019300: LuafvStreamHandleCleanup
0x1C0005E40: LuafvSetStreamHandleContextFailed
0x1C001E51C: LuafvInitializeSecurity
0x1C00036D8: "\AppPatch" ??_C@_1BE@MMECJMEH@?$AA?2?$AAA?$AAp?$AAp?$AAP?$AAa?$AAt?$AAc?$AAh?$AA?$AA@
0x1C000B098: "__cdecl _imp_FltCancelFileOpen" __imp_FltCancelFileOpen
0x1C0011BC8: LuafvSplitPathLeft
0x1C0001758: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x1C000B088: "__cdecl _imp_FltPerformSynchronousIo" __imp_FltPerformSynchronousIo
0x1C000B2D0: "__cdecl _imp_RtlSetOwnerSecurityDescriptor" __imp_RtlSetOwnerSecurityDescriptor
0x1C000B060: "__cdecl _imp_FltAllocateExtraCreateParameterList" __imp_FltAllocateExtraCreateParameterList
0x1C00037A0: "\ehome" ??_C@_1O@OACCCKLG@?$AA?2?$AAe?$AAh?$AAo?$AAm?$AAe?$AA?$AA@
0x1C0003DB8: "\System32\ime" ??_C@_1BM@PBLBHOMI@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAi?$AAm?$AAe?$AA?$AA@
0x1C00048D8: "\Services" ??_C@_1BE@FJMBLJKE@?$AA?2?$AAS?$AAe?$AAr?$AAv?$AAi?$AAc?$AAe?$AAs?$AA?$AA@
0x1C0003748: "\DigitalLocker" ??_C@_1BO@MBBJEGIL@?$AA?2?$AAD?$AAi?$AAg?$AAi?$AAt?$AAa?$AAl?$AAL?$AAo?$AAc?$AAk?$AAe?$AAr?$AA?$AA@
0x1C000B260: "__cdecl _imp_RtlAddAccessAllowedAce" __imp_RtlAddAccessAllowedAce
0x1C00176E4: LuafvSupplyFullPath
0x1C000B1E8: "__cdecl _imp_ExpInterlockedPopEntrySList" __imp_ExpInterlockedPopEntrySList
0x1C00106D0: ProcessUsnData
0x1C001ABCC: LuafvQueryStoreFile
0x1C0004B10: "\Microsoft\User Account Pictures" ??_C@_1EC@PAHKBFFN@?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAU?$AAs?$AAe?$AAr?$AA?5?$AAA?$AAc?$AAc?$AAo?$AAu?$AAn?$AAt?$AA?5?$AAP?$AAi?$AAc?$AAt?$AAu?$AAr?$AAe?$AAs@
0x1C000B250: "__cdecl _imp_SeExports" __imp_SeExports
0x1C000B330: "__cdecl _imp_PsCreateSystemThread" __imp_PsCreateSystemThread
0x1C00166CC: LuafvFindTableNodeEx
0x1C0003AC8: "\System32\CatRoot" ??_C@_1CE@EGMHNBAA@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAC?$AAa?$AAt?$AAR?$AAo?$AAo?$AAt?$AA?$AA@
0x1C001E078: LuafvInitializePool
0x1C001B61C: LuafvSplitPathRight
0x1C00040E0: "\System32\SPPUI" ??_C@_1CA@MOJDNKMH@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAS?$AAP?$AAP?$AAU?$AAI?$AA?$AA@
0x1C0005500: "\SysWOW64\winrm" ??_C@_1CA@EHPMKGBI@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAw?$AAi?$AAn?$AAr?$AAm?$AA?$AA@
0x1C00037F0: "\idmu" ??_C@_1M@CMIDODMM@?$AA?2?$AAi?$AAd?$AAm?$AAu?$AA?$AA@
0x1C0004548: "\Microsoft Games\Mahjong" ??_C@_1DC@LELBGBOL@?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?5?$AAG?$AAa?$AAm?$AAe?$AAs?$AA?2?$AAM?$AAa?$AAh?$AAj?$AAo?$AAn?$AAg?$AA?$AA@
0x1C0021048: LuafvAccessDeniedMaskValueName
0x1C00052E0: "\SysWOW64\Speech" ??_C@_1CC@LCNBIEIP@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAS?$AAp?$AAe?$AAe?$AAc?$AAh?$AA?$AA@
0x1C0003A00: "\schemas" ??_C@_1BC@POHNHLPM@?$AA?2?$AAs?$AAc?$AAh?$AAe?$AAm?$AAa?$AAs?$AA?$AA@
0x1C000B128: "__cdecl _imp_FltGetInstanceContext" __imp_FltGetInstanceContext
0x1C0013DE0: LuafvCopyFile
0x1C00080E0: UserListLock
0x1C0005180: "\SysWOW64\Printing_Admin_Scripts" ??_C@_1EC@NFJLPIAG@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAP?$AAr?$AAi?$AAn?$AAt?$AAi?$AAn?$AAg?$AA_?$AAA?$AAd?$AAm?$AAi?$AAn?$AA_?$AAS?$AAc?$AAr?$AAi?$AAp?$AAt?$AAs@
0x1C0005988: "CallControl" ??_C@_1BI@PFBMEPNA@?$AAC?$AAa?$AAl?$AAl?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AA?$AA@
0x1C000F830: LuafvFindTableNode
0x1C0017C48: LuafvGetNameFileObject
0x1C001A0CC: LuafvCompleteStoreFileDetails
0x1C0003940: "\PLA" ??_C@_19LBEJPHMG@?$AA?2?$AAP?$AAL?$AAA?$AA?$AA@
0x1C000D300: LuafvPreClose
0x1C0009200: DisableVirt
0x1C0016960: LuafvTerminateFileTableForVolume
0x1C0009208: ScavengerThreadTerminationEvent
0x1C000E32C: LuafvScavengeFileTable
0x1C00038E8: "\nap" ??_C@_19NCKLDPKF@?$AA?2?$AAn?$AAa?$AAp?$AA?$AA@
0x1C0004468: "\WinSxS" ??_C@_1BA@KBEMHHME@?$AA?2?$AAW?$AAi?$AAn?$AAS?$AAx?$AAS?$AA?$AA@
0x1C0004FC0: "\SysWOW64\Ipmi" ??_C@_1BO@KJPFJFLD@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAI?$AAp?$AAm?$AAi?$AA?$AA@
0x1C0004488: "\Internet Explorer" ??_C@_1CG@CANDMHAC@?$AA?2?$AAI?$AAn?$AAt?$AAe?$AAr?$AAn?$AAe?$AAt?$AA?5?$AAE?$AAx?$AAp?$AAl?$AAo?$AAr?$AAe?$AAr?$AA?$AA@
0x1C0005A78: "PoolAllocationLimit" ??_C@_1CI@JKBPFDDG@?$AAP?$AAo?$AAo?$AAl?$AAA?$AAl?$AAl?$AAo?$AAc?$AAa?$AAt?$AAi?$AAo?$AAn?$AAL?$AAi?$AAm?$AAi?$AAt?$AA?$AA@
0x1C0008E40: StringLookaside
0x1C000B120: "__cdecl _imp_FltReleaseContext" __imp_FltReleaseContext
0x1C00039D0: "\Resources" ??_C@_1BG@NACJOPCH@?$AA?2?$AAR?$AAe?$AAs?$AAo?$AAu?$AAr?$AAc?$AAe?$AAs?$AA?$AA@
0x1C0015890: LuafvQueryDirectoryIfNeeded
0x1C0014E1C: LuafvCopyStreamData
0x1C001FC70: AllocateTraversalNode
0x1C00034C0: "\" ??_C@_13FPGAJAPJ@?$AA?2?$AA?$AA@
0x1C001C204: AcknowledgePauseRequest
0x1C0004DE8: "\SysWOW64\dhcp" ??_C@_1BO@KLBDEOCI@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAd?$AAh?$AAc?$AAp?$AA?$AA@
0x1C00013A8: LuafvRunScavenger
0x1C0017960: LuafvCleanUpEcp
0x1C0003C48: "\System32\dns" ??_C@_1BM@JJFCBBPE@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAd?$AAn?$AAs?$AA?$AA@
0x1C0008940: LuafvDriverData
0x1C00035F0: "ProgramFilesDir (x86)" ??_C@_1CM@LPGAILIM@?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAF?$AAi?$AAl?$AAe?$AAs?$AAD?$AAi?$AAr?$AA?5?$AA?$CI?$AAx?$AA8?$AA6?$AA?$CJ?$AA?$AA@
0x1C0005570: "\SysWOW64\XPSViewer" ??_C@_1CI@MJOLCHFL@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAX?$AAP?$AAS?$AAV?$AAi?$AAe?$AAw?$AAe?$AAr?$AA?$AA@
0x1C000E148: LuafvLookupElementTableFull
0x1C0005E30: LuafvFilterRegistrationFailed
0x1C0008300: LuafvOperationRegistration
0x1C0021200: RegistryStaticRootsCurrentVersion
0x1C000B0A0: "__cdecl _imp_FltSetStreamHandleContext" __imp_FltSetStreamHandleContext
0x1C0005960: "AccessDeniedMask" ??_C@_1CC@DKHAGDJM@?$AAA?$AAc?$AAc?$AAe?$AAs?$AAs?$AAD?$AAe?$AAn?$AAi?$AAe?$AAd?$AAM?$AAa?$AAs?$AAk?$AA?$AA@
0x1C000B170: "__cdecl _imp_FltAcquirePushLockSharedEx" __imp_FltAcquirePushLockSharedEx
0x1C0004F98: "\SysWOW64\Inetsrv" ??_C@_1CE@LBLNJJHC@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAI?$AAn?$AAe?$AAt?$AAs?$AAr?$AAv?$AA?$AA@
0x1C0003BE0: "\System32\Com" ??_C@_1BM@BBHLIJLC@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAC?$AAo?$AAm?$AA?$AA@
0x1C000B338: "__cdecl _imp_KeClearEvent" __imp_KeClearEvent
0x1C0016B4C: ResolveTableNodeConflict
0x1C00056F0: "ExcludedExtensionsRemove" ??_C@_1DC@NOEJIHBO@?$AAE?$AAx?$AAc?$AAl?$AAu?$AAd?$AAe?$AAd?$AAE?$AAx?$AAt?$AAe?$AAn?$AAs?$AAi?$AAo?$AAn?$AAs?$AAR?$AAe?$AAm?$AAo?$AAv?$AAe?$AA?$AA@
0x1C0005328: "\SysWOW64\sr-Latn-CS" ??_C@_1CK@HFLLHNPD@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAs?$AAr?$AA?9?$AAL?$AAa?$AAt?$AAn?$AA?9?$AAC?$AAS?$AA?$AA@
0x1C0008140: SdTable
0x1C000B4C8: "__cdecl _imp_RtlEqualUnicodeString" __imp_RtlEqualUnicodeString
0x1C000E188: RemoveTableNode
0x1C00210D8: LuafvSystemPolicyKeyPath
0x1C001F588: AddExtensionsList
0x1C000B480: "__cdecl _imp_SeReleaseSubjectContext" __imp_SeReleaseSubjectContext
0x1C0003678: "\addins" ??_C@_1BA@BKGFOIOM@?$AA?2?$AAa?$AAd?$AAd?$AAi?$AAn?$AAs?$AA?$AA@
0x1C000B138: "__cdecl _imp_FltInitializePushLock" __imp_FltInitializePushLock
0x1C0005FA8: "Security" ??_C@_1BC@FCJNIDNL@?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?$AA@
0x1C001B568: LuafvRemoveExtraStreamName
0x1C001BDA8: LuafvFindUserStore
0x1C0003508: LuafvWRPAccessDeniedEvent
0x1C001FDE8: ProcessKey
0x1C0004318: "\System32\winevt" ??_C@_1CC@FNHDCMMD@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAw?$AAi?$AAn?$AAe?$AAv?$AAt?$AA?$AA@
0x1C000D590: LuafvPreSetInformation
0x1C00020E0: LuafvMarkVirtualDirectoryEntries
0x1C0015B40: DereferenceDvfcb
0x1C0005308: "\SysWOW64\Spool" ??_C@_1CA@EMCOJKAD@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAS?$AAp?$AAo?$AAo?$AAl?$AA?$AA@
0x1C001E010: GsDriverEntry
0x1C000B538: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x1C0005E10: LuafvQueryInformationFailed
0x1C001BCF4: LuafvDereferenceUser
0x1C0003B38: "\System32\ccmsetup" ??_C@_1CG@PGNCKDOA@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAc?$AAc?$AAm?$AAs?$AAe?$AAt?$AAu?$AAp?$AA?$AA@
0x1C0021260: StaticEntries
0x1C0021118: ExcludedExtensionsAddValueName
0x1C0003A58: "\SYSMSI" ??_C@_1BA@KDKKGEE@?$AA?2?$AAS?$AAY?$AAS?$AAM?$AAS?$AAI?$AA?$AA@
0x1C000B3D0: "__cdecl _imp_ZwQueryDirectoryFile" __imp_ZwQueryDirectoryFile
0x1C0005448: "\SysWOW64\windows media" ??_C@_1DA@IJCMKEEK@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAw?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAm?$AAe?$AAd?$AAi?$AAa?$AA?$AA@
0x1C0003A18: "\security" ??_C@_1BE@GBBNFJPD@?$AA?2?$AAs?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?$AA@
0x1C000B418: "__cdecl _imp_RtlAppendUnicodeToString" __imp_RtlAppendUnicodeToString
0x1C0005630: "\REGISTRY\MACHINE\SYSTEM\Current" ??_C@_1IK@INBMLABA@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1C0021128: ExcludedExtensionsRemoveValueName
0x1C000B4B0: "__cdecl _imp_ObReferenceObjectByHandle" __imp_ObReferenceObjectByHandle
0x1C0004BB8: "\Microsoft\Windows NT" ??_C@_1CM@HAAPJAON@?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAN?$AAT?$AA?$AA@
0x1C000DC10: SynchronousFsControl
0x1C00041B8: "\System32\sysprep" ??_C@_1CE@BEEDBMBA@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAs?$AAy?$AAs?$AAp?$AAr?$AAe?$AAp?$AA?$AA@
0x1C000EEA4: LuafvIsExcludedName
0x1C001BD60: LuafvDereferenceUserStore
0x1C0004C48: "\SysWOW64\AdvancedInstallers" ??_C@_1DK@OGAOGHOI@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAA?$AAd?$AAv?$AAa?$AAn?$AAc?$AAe?$AAd?$AAI?$AAn?$AAs?$AAt?$AAa?$AAl?$AAl?$AAe?$AAr?$AAs?$AA?$AA@
0x1C000B2C0: "__cdecl _imp_SeSetAuditParameter" __imp_SeSetAuditParameter
0x1C002100C: LuafvDefaultPoolAllocationLimit
0x1C0018E18: LuafvQueryShortNameFromGlobal
0x1C00011F8: LuafvResumeUsn
0x1C0004A50: "\Microsoft\MF" ??_C@_1BM@KBIEFALG@?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAM?$AAF?$AA?$AA@
0x1C0004288: "\System32\windows media" ??_C@_1DA@NAHMEOMG@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAw?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAm?$AAe?$AAd?$AAi?$AAa?$AA?$AA@
0x1C0005520: "\SysWOW64\wins" ??_C@_1BO@FALMIGN@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAw?$AAi?$AAn?$AAs?$AA?$AA@
0x1C001751C: LuafvLogVirtualCreate
0x1C0019EC8: LuafvBuildSecurityDescriptor
0x1C0008BB0: ScavengerInitialized
0x1C000B150: "__cdecl _imp_FltQueryDirectoryFile" __imp_FltQueryDirectoryFile
0x1C000B2C8: "__cdecl _imp_SeReportSecurityEventWithSubCategory" __imp_SeReportSecurityEventWithSubCategory
0x1C00048B0: "\Microsoft Shared" ??_C@_1CE@ODGKNALK@?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?5?$AAS?$AAh?$AAa?$AAr?$AAe?$AAd?$AA?$AA@
0x1C00011D0: AsyncIoCompletion
0x1C0016E1C: LuafvLogFileEvent
0x1C001546C: LuafvMergeStoreDirectory
0x1C0018CB0: LuafvPostFileSystemControl
0x1C0005158: "\SysWOW64\OOBE" ??_C@_1BO@OEBIADEA@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAO?$AAO?$AAB?$AAE?$AA?$AA@
0x1C0004AC8: "\Microsoft\RAC" ??_C@_1BO@OIMLBNKC@?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAR?$AAA?$AAC?$AA?$AA@
0x1C000B230: "__cdecl _imp_IoSetThreadHardErrorMode" __imp_IoSetThreadHardErrorMode
0x1C000DEC0: LuafvInstanceSetup
0x1C000B408: "__cdecl _imp_ZwQueryValueKey" __imp_ZwQueryValueKey
0x1C0005944: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x1C000D1D0: "__cdecl TlgEnableCallback" _TlgEnableCallback
0x1C000B450: "__cdecl _imp_PsRevertToSelf" __imp_PsRevertToSelf
0x1C0021098: LuafvDisableStaticInclusionValueName
0x1C0018FEC: LuafvReparse
0x1C0016218: LuafvPrepareDelayedVirtualization
0x1C0004BE8: "\Microsoft\WPD" ??_C@_1BO@PFHGPKEB@?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAP?$AAD?$AA?$AA@
0x1C000B048: "__cdecl _imp_FltInsertExtraCreateParameter" __imp_FltInsertExtraCreateParameter
0x1C000D210: LuafvGenerateFileName
0x1C0011760: GetVolumeRootFileId
0x1C00046A8: "\MSBuild" ??_C@_1BC@KEIDEMHD@?$AA?2?$AAM?$AAS?$AAB?$AAu?$AAi?$AAl?$AAd?$AA?$AA@
0x1C000B308: "__cdecl _imp_SeUnregisterLogonSessionTerminatedRoutineEx" __imp_SeUnregisterLogonSessionTerminatedRoutineEx
0x1C0003620: "CommonFilesDir (x86)" ??_C@_1CK@FONJNPCI@?$AAC?$AAo?$AAm?$AAm?$AAo?$AAn?$AAF?$AAi?$AAl?$AAe?$AAs?$AAD?$AAi?$AAr?$AA?5?$AA?$CI?$AAx?$AA8?$AA6?$AA?$CJ?$AA?$AA@
0x1C000B2B0: "__cdecl _imp_IoGetFileObjectGenericMapping" __imp_IoGetFileObjectGenericMapping
0x1C001E2C8: LuafvInitializeScavenger
0x1C000B100: "__cdecl _imp_FltStartFiltering" __imp_FltStartFiltering
0x1C000B1E0: "__cdecl _imp_ExInitializePagedLookasideList" __imp_ExInitializePagedLookasideList
0x1C0003528: LuafvQueryVirtualizationFailed
0x1C0004438: "\WindowsMobile" ??_C@_1BO@DJPFCCJK@?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AAM?$AAo?$AAb?$AAi?$AAl?$AAe?$AA?$AA@
0x1C000B020: "__cdecl _imp_FltAllocateGenericWorkItem" __imp_FltAllocateGenericWorkItem
0x1C0021108: SystemRootLinkName
0x1C000F280: LuafvDereferenceCachedSecurityDescriptor
0x1C000B090: "__cdecl _imp_FltAllocateCallbackData" __imp_FltAllocateCallbackData
0x1C001FD24: EnumerateKey
0x1C0005088: "\SysWOW64\migration" ??_C@_1CI@HOFJHKHI@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAm?$AAi?$AAg?$AAr?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x1C000B4B8: "__cdecl _imp_RtlCompareUnicodeString" __imp_RtlCompareUnicodeString
0x1C0004CD8: "\SysWOW64\CCM" ??_C@_1BM@FFIELHPN@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAC?$AAC?$AAM?$AA?$AA@
0x1C000B298: "__cdecl _imp_RtlCreateUnicodeString" __imp_RtlCreateUnicodeString
0x1C00016F0: "__cdecl _security_check_cookie" __security_check_cookie
0x1C001E910: LuafvSkipDriverLoad
0x1C000B310: "__cdecl _imp_SeQueryServerSiloToken" __imp_SeQueryServerSiloToken
0x1C0014B1C: LuafvCopyShortName
0x1C0003950: "\PolicyDefinitions" ??_C@_1CG@CBNGNALG@?$AA?2?$AAP?$AAo?$AAl?$AAi?$AAc?$AAy?$AAD?$AAe?$AAf?$AAi?$AAn?$AAi?$AAt?$AAi?$AAo?$AAn?$AAs?$AA?$AA@
0x1C000D9B0: LuafvPreAcquireForSectionSynchronization
0x1C001B740: FindUser
0x1C000B55C: "__cdecl _IMPORT_DESCRIPTOR_FLTMGR" __IMPORT_DESCRIPTOR_FLTMGR
0x1C0008068: LuafvDataAttribute
0x1C000251C: LuafvTerminateScavenger
0x1C000B548: "__cdecl _IMPORT_DESCRIPTOR_ntoskrnl" __IMPORT_DESCRIPTOR_ntoskrnl
0x1C0005DFC: "__cdecl TraceLoggingMetadataEnd" _TraceLoggingMetadataEnd
0x1C0002434: LuafvUpdateFileTableForFileObject
0x1C00059B8: "EnableDelayedVirtualization" ??_C@_1DI@KEJKNPPO@?$AAE?$AAn?$AAa?$AAb?$AAl?$AAe?$AAD?$AAe?$AAl?$AAa?$AAy?$AAe?$AAd?$AAV?$AAi?$AAr?$AAt?$AAu?$AAa?$AAl?$AAi?$AAz?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x1C00035A0: LuafvUserScavengeInterval
0x1C00014F0: LuafvIsFileWRP
0x1C0005238: "\SysWOW64\rms" ??_C@_1BM@DBLBAPMK@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAr?$AAm?$AAs?$AA?$AA@
0x1C00035A8: LuafvFileTableScavengeInterval
0x1C000B070: "__cdecl _imp_FltGetVolumeProperties" __imp_FltGetVolumeProperties
0x1C00114E4: LuafvInitializeFileTableForVolume
0x1C0010634: LuafvInsertElementTableFull
0x1C00042C0: "\System32\Windows System Resourc" ??_C@_1FE@DFMICBHG@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?5?$AAR?$AAe?$AAs?$AAo?$AAu?$AAr?$AAc@
0x1C000D8F0: LuafvPreFileSystemControl
0x1C0005E90: LuafvStartFilteringFailed
0x1C000B368: "__cdecl _imp_KeDelayExecutionThread" __imp_KeDelayExecutionThread
0x1C00036F0: "\Branding" ??_C@_1BE@ECKLLAHA@?$AA?2?$AAB?$AAr?$AAa?$AAn?$AAd?$AAi?$AAn?$AAg?$AA?$AA@
0x1C0004E80: "\SysWOW64\FxsTmp" ??_C@_1CC@JKLMBMDM@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAF?$AAx?$AAs?$AAT?$AAm?$AAp?$AA?$AA@
0x1C0011A60: TraceLoggingRegisterEx
0x1C0005A60: "FileList" ??_C@_1BC@PMDPGOAI@?$AAF?$AAi?$AAl?$AAe?$AAL?$AAi?$AAs?$AAt?$AA?$AA@
0x1C000B2E0: "__cdecl _imp_RtlRealPredecessor" __imp_RtlRealPredecessor
0x1C0005AB8: "EnableVirtualization" ??_C@_1CK@KFCEJEJF@?$AAE?$AAn?$AAa?$AAb?$AAl?$AAe?$AAV?$AAi?$AAr?$AAt?$AAu?$AAa?$AAl?$AAi?$AAz?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x1C0003490: GUID_ECP_PREFETCH_OPEN
0x1C0004858: "\Windows Photo Gallery" ??_C@_1CO@CNAKKNID@?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAP?$AAh?$AAo?$AAt?$AAo?$AA?5?$AAG?$AAa?$AAl?$AAl?$AAe?$AAr?$AAy?$AA?$AA@
0x1C00179D0: LuafvDelayOrVirtualizeFile
0x1C0005AA0: "EnableLUA" ??_C@_1BE@PBGLAGDD@?$AAE?$AAn?$AAa?$AAb?$AAl?$AAe?$AAL?$AAU?$AAA?$AA?$AA@
0x1C00118D8: InitializeUsn
0x1C0003E70: "\System32\lserver" ??_C@_1CE@GHCKMBHP@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAl?$AAs?$AAe?$AAr?$AAv?$AAe?$AAr?$AA?$AA@
0x1C0004B80: "\Microsoft\Windows Defender" ??_C@_1DI@IFBOMJAM@?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAD?$AAe?$AAf?$AAe?$AAn?$AAd?$AAe?$AAr?$AA?$AA@
0x1C000B140: "__cdecl _imp_FltReferenceContext" __imp_FltReferenceContext
0x1C001F450: QuerySymbolicLink
0x1C000B360: "__cdecl _imp_EtwUnregister" __imp_EtwUnregister
0x1C0005F40: "Exclude" ??_C@_1BA@HBGPLNLK@?$AAE?$AAx?$AAc?$AAl?$AAu?$AAd?$AAe?$AA?$AA@
0x1C0005408: "\SysWOW64\WDI" ??_C@_1BM@DPBCCPMD@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAW?$AAD?$AAI?$AA?$AA@
0x1C0023000: "__cdecl _guard_fids_table" __guard_fids_table
0x1C0005EC0: LuafvIsTargetWRPFailed
0x1C001EF14: GetStaticEntryRoots
0x1C0003C68: "\System32\Drivers" ??_C@_1CE@MGLDEKEO@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAD?$AAr?$AAi?$AAv?$AAe?$AAr?$AAs?$AA?$AA@
0x1C0004CB0: "\SysWOW64\CatRoot2" ??_C@_1CG@MJMCFECD@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAC?$AAa?$AAt?$AAR?$AAo?$AAo?$AAt?$AA2?$AA?$AA@
0x1C0005E00: LuafvQueryDirectoryFailed
0x1C00032C0: "__cdecl load_config_used" _load_config_used
0x1C0003C28: "\System32\dhcp" ??_C@_1BO@LEOGDGJJ@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAd?$AAh?$AAc?$AAp?$AA?$AA@
0x1C000B040: "__cdecl _imp_FltRemoveExtraCreateParameter" __imp_FltRemoveExtraCreateParameter
0x1C000B320: "__cdecl _imp_RtlCopySid" __imp_RtlCopySid
0x1C000B460: "__cdecl _imp_PsDereferencePrimaryToken" __imp_PsDereferencePrimaryToken
0x1C000B0B8: "__cdecl _imp_FltFindExtraCreateParameter" __imp_FltFindExtraCreateParameter
0x1C00049C0: "\Microsoft\Event Viewer" ??_C@_1DA@KBEBOMKE@?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAE?$AAv?$AAe?$AAn?$AAt?$AA?5?$AAV?$AAi?$AAe?$AAw?$AAe?$AAr?$AA?$AA@
0x1C0004DC0: "\SysWOW64\config" ??_C@_1CC@OIBMHNJC@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAc?$AAo?$AAn?$AAf?$AAi?$AAg?$AA?$AA@
0x1C000E068: LuafvIsIncludedVolume
0x1C00053A0: "\SysWOW64\Tasks" ??_C@_1CA@EICFLIOB@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAT?$AAa?$AAs?$AAk?$AAs?$AA?$AA@
0x1C00080D0: UserList
0x1C000B130: "__cdecl _imp_FltGetRequestorProcess" __imp_FltGetRequestorProcess
0x1C000B448: "__cdecl _imp_ZwClose" __imp_ZwClose
0x1C0003518: LuafvDeleteFileAccessDeniedEvent
0x1C000B3E0: "__cdecl _imp_ExAcquireRundownProtection" __imp_ExAcquireRundownProtection
0x1C0021010: LuafvMinimumPoolAllocationLimit
0x1C0005F60: "*** *** LUAFV stalling unload du" ??_C@_0EB@JPHDNNKB@?$CK?$CK?$CK?6?$CK?$CK?$CK?5LUAFV?5stalling?5unload?5du@
0x1C000D850: LuafvPreDirectoryControl
0x1C000FEAC: LuafvIsTargetWRP
0x1C0005E20: LuafvExclusionEvent
0x1C0005A30: "DisableStaticInclusion" ??_C@_1CO@JFBJKGOK@?$AAD?$AAi?$AAs?$AAa?$AAb?$AAl?$AAe?$AAS?$AAt?$AAa?$AAt?$AAi?$AAc?$AAI?$AAn?$AAc?$AAl?$AAu?$AAs?$AAi?$AAo?$AAn?$AA?$AA@
0x1C00047A0: "\Windows Defender" ??_C@_1CE@KHLAJJHP@?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAD?$AAe?$AAf?$AAe?$AAn?$AAd?$AAe?$AAr?$AA?$AA@
0x1C00190DC: LuafvSelectFile
0x1C0016574: LuafvUnlinkFsContextFromDvfcb
0x1C0015E74: LuafvPerformDelayedVirtualization
0x1C0017694: LuafvSetFileCreateEvent
0x1C001A8D8: LuafvCreateVirtualPath
0x1C000B458: "__cdecl _imp_PsDereferenceImpersonationToken" __imp_PsDereferenceImpersonationToken
0x1C0004EA8: "\SysWOW64\GroupPolicy" ??_C@_1CM@IBOPBBBL@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAG?$AAr?$AAo?$AAu?$AAp?$AAP?$AAo?$AAl?$AAi?$AAc?$AAy?$AA?$AA@
0x1C0017984: LuafvCreateStreamHandleContext
0x1C0003878: "\Logs" ??_C@_1M@FMGNELLE@?$AA?2?$AAL?$AAo?$AAg?$AAs?$AA?$AA@
0x1C000B4A8: IoFileObjectType
0x1C0005EB0: LuafvVirtualRenameEvent
0x1C000B498: "__cdecl _imp_KeInitializeEvent" __imp_KeInitializeEvent
0x1C00105E0: LuafvInsertElementTable
0x1C0005480: "\SysWOW64\Windows System Resourc" ??_C@_1FE@BMKOJDGC@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?5?$AAR?$AAe?$AAs?$AAo?$AAu?$AAr?$AAc@
0x1C000B4D0: "__cdecl _imp_RtlGetSaclSecurityDescriptor" __imp_RtlGetSaclSecurityDescriptor
0x1C00175B8: LuafvLogVirtualRename
0x1C0002510: "__cdecl TlgDefineProvider_annotation__TlgLUAFV_INSTRUMENTATION_PROVIDERProv" _TlgDefineProvider_annotation__TlgLUAFV_INSTRUMENTATION_PROVIDERProv
0x1C000B290: "__cdecl _imp_RtlEqualSid" __imp_RtlEqualSid
0x1C00055B0: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1HI@NCNNFNFM@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x1C0004380: "\System32\WMI Config" ??_C@_1CK@IHJPLIPM@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAW?$AAM?$AAI?$AA?5?$AAC?$AAo?$AAn?$AAf?$AAi?$AAg?$AA?$AA@
0x1C0005FE0: ":$DATA" ??_C@_1O@IKEDOIIA@?$AA?3?$AA$?$AAD?$AAA?$AAT?$AAA?$AA?$AA@
0x1C001F6A0: CheckExtensionsList
0x1C0010EC4: LuafvCreateTrustedInstallerSid
0x1C0004100: "\System32\SMI" ??_C@_1BM@IPECEMN@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAS?$AAM?$AAI?$AA?$AA@
0x1C0008B9B: ScavengerRunning
0x1C0015BFC: FindOrCreateDvfcb
0x1C000B010: "__cdecl _imp_FltFreeGenericWorkItem" __imp_FltFreeGenericWorkItem
0x1C000B080: "__cdecl _imp_FltFreeCallbackData" __imp_FltFreeCallbackData
0x1C00169F0: LuafvUpdateFileTableForFileChange
0x1C0004008: "\System32\RAS" ??_C@_1BM@IMDIFDND@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAR?$AAA?$AAS?$AA?$AA@
0x1C0009201: SkipDriverLoad
0x1C0004640: "\Microsoft Games\SpiderSolitaire" ??_C@_1EC@EEBJDKOE@?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?5?$AAG?$AAa?$AAm?$AAe?$AAs?$AA?2?$AAS?$AAp?$AAi?$AAd?$AAe?$AAr?$AAS?$AAo?$AAl?$AAi?$AAt?$AAa?$AAi?$AAr?$AAe@
0x1C000B1D0: "__cdecl _imp_FsRtlChangeBackingFileObject" __imp_FsRtlChangeBackingFileObject
0x1C00052A0: "\SysWOW64\SPPUI" ??_C@_1CA@GNJDKDMF@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAS?$AAP?$AAP?$AAU?$AAI?$AA?$AA@
0x1C0001740: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x1C00046C0: "\MSN" ??_C@_19PMBEHDCE@?$AA?2?$AAM?$AAS?$AAN?$AA?$AA@
0x1C00037E0: "\Help" ??_C@_1M@LMDEKICL@?$AA?2?$AAH?$AAe?$AAl?$AAp?$AA?$AA@
0x1C000B4C0: "__cdecl _imp_MmMapLockedPagesSpecifyCache" __imp_MmMapLockedPagesSpecifyCache
0x1C0005AF0: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1JI@CHHHPNIA@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x1C000E2EC: LuafvDeleteElementTable
0x1C0017E60: LuafvInstanceCleanup
0x1C0003990: "\provisioning" ??_C@_1BM@ENNECMCB@?$AA?2?$AAp?$AAr?$AAo?$AAv?$AAi?$AAs?$AAi?$AAo?$AAn?$AAi?$AAn?$AAg?$AA?$AA@
0x1C0004910: "\System" ??_C@_1BA@DKKHOKOD@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?$AA@
0x1C000B400: "__cdecl _imp_ZwQuerySymbolicLinkObject" __imp_ZwQuerySymbolicLinkObject
0x1C00194E4: LuafvTerminatePool
0x1C001E7E8: CreateStaticEntry
0x1C0001EC0: LuafvCopySaclWithAudit
0x1C0003850: "\LiveKernelReports" ??_C@_1CG@HPCEOOHP@?$AA?2?$AAL?$AAi?$AAv?$AAe?$AAK?$AAe?$AAr?$AAn?$AAe?$AAl?$AAR?$AAe?$AAp?$AAo?$AAr?$AAt?$AAs?$AA?$AA@
0x1C001E27C: LuafvInitializeUserList
0x1C0003690: "\Application Compatibility Scrip" ??_C@_1EG@CPDHCEPC@?$AA?2?$AAA?$AAp?$AAp?$AAl?$AAi?$AAc?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?5?$AAC?$AAo?$AAm?$AAp?$AAa?$AAt?$AAi?$AAb?$AAi?$AAl?$AAi?$AAt?$AAy?$AA?5?$AAS?$AAc?$AAr?$AAi?$AAp@
0x1C000B160: "__cdecl _imp_FltReadFile" __imp_FltReadFile
0x1C00047F0: "\Windows Mail" ??_C@_1BM@EDCOJONP@?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAM?$AAa?$AAi?$AAl?$AA?$AA@
0x1C0021078: LuafvEnableDelayedVirtualizationValueName
0x1C001F254: TranslatePath
0x1C0003B88: "\System32\Clients" ??_C@_1CE@NBMJBOHH@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAC?$AAl?$AAi?$AAe?$AAn?$AAt?$AAs?$AA?$AA@
0x1C00170F8: LuafvLogUtcEvent
0x1C0009160: ScavengerSpinLock
0x1C0003D50: "\System32\hcs" ??_C@_1BM@HCGDBHGF@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAh?$AAc?$AAs?$AA?$AA@
0x1C001C398: AslPathGetFileNamePart_UStr
0x1C0001370: RemoveMruListNode
0x1C00044E0: "\Microsoft Games\FreeCell" ??_C@_1DE@GDFFJOAA@?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?5?$AAG?$AAa?$AAm?$AAe?$AAs?$AA?2?$AAF?$AAr?$AAe?$AAe?$AAC?$AAe?$AAl?$AAl?$AA?$AA@
0x1C0005FF0: ":$INDEX_ALLOCATION" ??_C@_1CG@MOHGCAD@?$AA?3?$AA$?$AAI?$AAN?$AAD?$AAE?$AAX?$AA_?$AAA?$AAL?$AAL?$AAO?$AAC?$AAA?$AAT?$AAI?$AAO?$AAN?$AA?$AA@
0x1C0008B90: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxuyzhvUzkkxlnkzgUofzueUwireviUlyquivUznwGEUofzueOlyq@luafv" __@@_PchSym_@00@KxulyqvxgPillgKxuyzhvUzkkxlnkzgUofzueUwireviUlyquivUznwGEUofzueOlyq@luafv
0x1C0003000: LuafvOperationRegistrationOverrides
0x1C000B0D0: "__cdecl _imp_FltCheckAndGrowNameControl" __imp_FltCheckAndGrowNameControl
0x1C001C2A4: LuafvTerminateUsn
0x1C001E9B0: LuafvReadSettings
0x1C000B470: "__cdecl _imp_SeImpersonateClientEx" __imp_SeImpersonateClientEx
0x1C000B300: "__cdecl _imp_SeRegisterLogonSessionTerminatedRoutineEx" __imp_SeRegisterLogonSessionTerminatedRoutineEx
0x1C00210F8: ExcludeValueName
0x1C000B210: "__cdecl _imp_KeAcquireSpinLockRaiseToDpc" __imp_KeAcquireSpinLockRaiseToDpc
0x1C00043F8: "\Tracing" ??_C@_1BC@NFNGBDNP@?$AA?2?$AAT?$AAr?$AAa?$AAc?$AAi?$AAn?$AAg?$AA?$AA@
0x1C0004C30: "\MSAgent64" ??_C@_1BG@LPCFLMEN@?$AA?2?$AAM?$AAS?$AAA?$AAg?$AAe?$AAn?$AAt?$AA6?$AA4?$AA?$AA@
0x1C001E69C: LuafvReadFileTable
0x1C001A698: LuafvCreateVirtualFile
0x1C000B3F0: "__cdecl _imp_IoCreateFileEx" __imp_IoCreateFileEx
0x1C00051E8: "\SysWOW64\RemInst" ??_C@_1CE@FPJDPHBO@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAR?$AAe?$AAm?$AAI?$AAn?$AAs?$AAt?$AA?$AA@
0x1C000B4A0: "__cdecl _imp_IoCheckShareAccess" __imp_IoCheckShareAccess
0x1C001E624: GrowQueryBuffer
0x1C000B1B8: "__cdecl _imp_FsRtlTeardownPerStreamContexts" __imp_FsRtlTeardownPerStreamContexts
0x1C00080A0: "__cdecl _security_cookie" __security_cookie
0x1C0016600: ClearFileTablePostWorker
0x1C000B328: "__cdecl _imp_SeMarkLogonSessionForTerminationNotificationEx" __imp_SeMarkLogonSessionForTerminationNotificationEx
0x1C001A608: LuafvCreateUserStoreSecurityDescriptor
0x1C0005258: "\SysWOW64\RpcProxy" ??_C@_1CG@EGLPAMPJ@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAR?$AAp?$AAc?$AAP?$AAr?$AAo?$AAx?$AAy?$AA?$AA@
0x1C0003598: LuafvFileTableTimeout
0x1C000B0B0: "__cdecl _imp_FltIsEcpFromUserMode" __imp_FltIsEcpFromUserMode
0x1C0008100: LuafvInteractiveDescriptor
0x1C0005E50: LuafvQueryStoreFileFailed
0x1C0004600: "\Microsoft Games\Solitaire" ??_C@_1DG@OCODLPGD@?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?5?$AAG?$AAa?$AAm?$AAe?$AAs?$AA?2?$AAS?$AAo?$AAl?$AAi?$AAt?$AAa?$AAi?$AAr?$AAe?$AA?$AA@
0x1C0005EE0: LuafvInitializeSecurityFailed
0x1C0005F10: LuafvVirtualCreateEvent
0x1C00210E8: LuafvFileListKeyName
0x1C000B240: "__cdecl _imp_RtlCompareMemory" __imp_RtlCompareMemory
0x1C0003B60: "\System32\certsrv" ??_C@_1CE@NLHPAOLL@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAc?$AAe?$AAr?$AAt?$AAs?$AAr?$AAv?$AA?$AA@
0x1C0021190: LuafvFilterRegistration
0x1C001D000: MicrosoftWindows
0x1C0003A68: "\SysMsiCache" ??_C@_1BK@DHEJKKDK@?$AA?2?$AAS?$AAy?$AAs?$AAM?$AAs?$AAi?$AAC?$AAa?$AAc?$AAh?$AAe?$AA?$AA@
0x1C0003CE8: "\System32\GroupPolicy" ??_C@_1CM@DFJCFNNL@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAG?$AAr?$AAo?$AAu?$AAp?$AAP?$AAo?$AAl?$AAi?$AAc?$AAy?$AA?$AA@
0x1C000D790: LuafvPreQueryInformation
0x1C00034B0: "windows" ??_C@_1BA@GMFJBEKP@?$AAw?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?$AA@
0x1C000D0E0: FreeTableNode
0x1C000B1A0: "__cdecl _imp_FltQueryInformationFile" __imp_FltQueryInformationFile
0x1C0005138: "\SysWOW64\ndf" ??_C@_1BM@FKGNNNML@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAn?$AAd?$AAf?$AA?$AA@
0x1C00053E8: "\SysWOW64\wbem" ??_C@_1BO@ICGAAEFE@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAw?$AAb?$AAe?$AAm?$AA?$AA@
0x1C0003720: "\CSC" ??_C@_19BLPELJML@?$AA?2?$AAC?$AAS?$AAC?$AA?$AA@
0x1C0003B18: "\System32\CCM" ??_C@_1BM@MBCHODMB@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAC?$AAC?$AAM?$AA?$AA@
0x1C00044B0: "\Microsoft Games\Chess" ??_C@_1CO@JOMOGALL@?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?5?$AAG?$AAa?$AAm?$AAe?$AAs?$AA?2?$AAC?$AAh?$AAe?$AAs?$AAs?$AA?$AA@
0x1C00060B8: "\Registry\User\" ??_C@_1CA@DOEFBOAB@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAU?$AAs?$AAe?$AAr?$AA?2?$AA?$AA@
0x1C000B0C0: "__cdecl _imp_FltGetEcpListFromCallbackData" __imp_FltGetEcpListFromCallbackData
0x1C0003A48: "\SUA" ??_C@_19BLBPKDHG@?$AA?2?$AAS?$AAU?$AAA?$AA?$AA@
0x1C0001140: LuafvPreRedirect
0x1C0005210: "\SysWOW64\restore" ??_C@_1CE@NPNLFIMI@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAr?$AAe?$AAs?$AAt?$AAo?$AAr?$AAe?$AA?$AA@
0x1C0001290: ScavengerThreadRoutine
0x1C0005280: "\SysWOW64\Setup" ??_C@_1CA@BEPKDEAI@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAS?$AAe?$AAt?$AAu?$AAp?$AA?$AA@
0x1C00023D0: LuafvPostSetInformation
0x1C000B3A8: "__cdecl _imp_EtwWrite" __imp_EtwWrite
0x1C0017EC0: LuafvIsVirtualFileObject
0x1C000B0F8: "__cdecl _imp_FltUnregisterFilter" __imp_FltUnregisterFilter
0x1C00187A0: LuafvPostCreate
0x1C00080C0: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUzkkxlnkzgUhszivwUorypUlyquivUznwGEUxlnkzghszivwxlivkOlyq@compatsharedcorek" __@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUzkkxlnkzgUhszivwUorypUlyquivUznwGEUxlnkzghszivwxlivkOlyq@compatsharedcorek
0x1C000F30C: LuafvIsWrpFileDescriptor
0x1C0005428: "\SysWOW64\wfp" ??_C@_1BM@BCDFOID@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAw?$AAf?$AAp?$AA?$AA@
0x1C0008088: LuafvStoreRoot
0x1C00159BC: LuafvQueryStoreDirectory
0x1C0004428: "\Web" ??_C@_19CJKIKKPB@?$AA?2?$AAW?$AAe?$AAb?$AA?$AA@
0x1C000B370: "__cdecl _imp_DbgPrint" __imp_DbgPrint
0x1C000E290: RemoveFileIdTableNode
0x1C0004050: "\System32\restore" ??_C@_1CE@GBCNDBMO@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAr?$AAe?$AAs?$AAt?$AAo?$AAr?$AAe?$AA?$AA@
0x1C0011668: UpdateTableNode
0x1C001ECA8: BuildExcludedExtensionsList
0x1C00035B0: "ProgramFilesDir" ??_C@_1CA@BENHECIP@?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAF?$AAi?$AAl?$AAe?$AAs?$AAD?$AAi?$AAr?$AA?$AA@
0x1C0005FC0: "\VirtualStore\" ??_C@_1BO@ELGJKAI@?$AA?2?$AAV?$AAi?$AAr?$AAt?$AAu?$AAa?$AAl?$AAS?$AAt?$AAo?$AAr?$AAe?$AA?2?$AA?$AA@
0x1C0021138: RegistryStaticRoots
0x1C000D010: LuafvPreReleaseForSectionSynchronization
0x1C00043B0: "\System32\XPSViewer" ??_C@_1CI@MFLJFAJI@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAX?$AAP?$AAS?$AAV?$AAi?$AAe?$AAw?$AAe?$AAr?$AA?$AA@
0x1C00043E8: "\Tasks" ??_C@_1O@BLIELECN@?$AA?2?$AAT?$AAa?$AAs?$AAk?$AAs?$AA?$AA@
0x1C0003820: "\Installer" ??_C@_1BG@IBCFLJIE@?$AA?2?$AAI?$AAn?$AAs?$AAt?$AAa?$AAl?$AAl?$AAe?$AAr?$AA?$AA@
0x1C000B058: "__cdecl _imp_FltSetEcpListIntoCallbackData" __imp_FltSetEcpListIntoCallbackData
0x1C0004688: "\Movie Maker" ??_C@_1BK@JNKNPPJJ@?$AA?2?$AAM?$AAo?$AAv?$AAi?$AAe?$AA?5?$AAM?$AAa?$AAk?$AAe?$AAr?$AA?$AA@
0x1C001E044: "__cdecl _security_init_cookie" __security_init_cookie
0x1C0004ED8: "\SysWOW64\GroupPolicyUsers" ??_C@_1DG@OKJOEEG@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAG?$AAr?$AAo?$AAu?$AAp?$AAP?$AAo?$AAl?$AAi?$AAc?$AAy?$AAU?$AAs?$AAe?$AAr?$AAs?$AA?$AA@
0x1C00037C0: "\Globalization" ??_C@_1BO@JIOACFGN@?$AA?2?$AAG?$AAl?$AAo?$AAb?$AAa?$AAl?$AAi?$AAz?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x1C0019DE4: LuafvAllocateAndBuildString
0x1C000E5B0: LuafvDereferenceTableNodeEx
0x1C001A1D4: LuafvCreateStoreRootPath
0x1C00034D8: LuafvPrepareDelayedFailed
0x1C00054D8: "\SysWOW64\winevt" ??_C@_1CC@EGJMCENJ@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAw?$AAi?$AAn?$AAe?$AAv?$AAt?$AA?$AA@
0x1C0021058: LuafvCallControlValueName
0x1C0003480: LuafvEventProviderId
0x1C000B3F8: "__cdecl _imp_ExInitializePushLock" __imp_ExInitializePushLock
0x1C000B388: "__cdecl _imp_EtwRegister" __imp_EtwRegister
0x1C000B238: "__cdecl _imp_KeSetEvent" __imp_KeSetEvent
0x1C00034C8: LuafvPerformDelayedFailed
0x1C0003810: "\inf" ??_C@_19FMEKIMCK@?$AA?2?$AAi?$AAn?$AAf?$AA?$AA@
0x1C0003F58: "\System32\MUI" ??_C@_1BM@IOEAIHCC@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAM?$AAU?$AAI?$AA?$AA@
0x1C00199A8: LuafvCheckAdminAccess
0x1C00210B8: LuafvEnableLUAValueName
0x1C000B0A8: "__cdecl _imp_FltDeleteContext" __imp_FltDeleteContext
0x1C0018C20: LuafvPostDirectoryControlSafe
0x1C0003EC8: "\System32\migration" ??_C@_1CI@HCALANLL@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAm?$AAi?$AAg?$AAr?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x1C00050F8: "\SysWOW64\msmq" ??_C@_1BO@PEGBEOIK@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAm?$AAs?$AAm?$AAq?$AA?$AA@
0x1C0003BB0: "\System32\CodeIntegrity" ??_C@_1DA@DGLCGANE@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAC?$AAo?$AAd?$AAe?$AAI?$AAn?$AAt?$AAe?$AAg?$AAr?$AAi?$AAt?$AAy?$AA?$AA@
0x1C001B6EC: LuafvReplaceElementTable
0x1C0004148: "\System32\Spool" ??_C@_1CA@OPCOODAB@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAS?$AAp?$AAo?$AAo?$AAl?$AA?$AA@
0x1C0004810: "\Windows Media Player" ??_C@_1CM@EKOGIGEF@?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAM?$AAe?$AAd?$AAi?$AAa?$AA?5?$AAP?$AAl?$AAa?$AAy?$AAe?$AAr?$AA?$AA@
0x1C0019574: LuafvBuildAdminInformation
0x1C0010E30: LuafvPrePnp
0x1C00210A8: LuafvPoolAllocationLimitValueName
0x1C0010558: InsertFileIdTableNode
0x1C0021158: RegistryStaticRootsParameters
0x1C001D020: HiveListValuePrefix
0x1C000B3D8: "__cdecl _imp_ExReleaseRundownProtection" __imp_ExReleaseRundownProtection
0x1C000B520: "__cdecl _imp_RtlAddAccessAllowedAceEx" __imp_RtlAddAccessAllowedAceEx
0x1C00038D0: "\MSAgent" ??_C@_1BC@LKDICMIN@?$AA?2?$AAM?$AAS?$AAA?$AAg?$AAe?$AAn?$AAt?$AA?$AA@
0x1C0008048: LuafvAuditSource
0x1C000B3B0: "__cdecl _imp_RtlLengthSid" __imp_RtlLengthSid
0x1C000B028: "__cdecl _imp_FltGetRequestorProcessId" __imp_FltGetRequestorProcessId
0x1C000EF40: LuafvPreCreate
0x1C00060D8: "_Classes" ??_C@_1BC@PGMOPNLK@?$AA_?$AAC?$AAl?$AAa?$AAs?$AAs?$AAe?$AAs?$AA?$AA@
0x1C001D030: HiveListValueSuffix
0x1C0003C90: "\System32\DriverStore" ??_C@_1CM@ICCNGBLO@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAD?$AAr?$AAi?$AAv?$AAe?$AAr?$AAS?$AAt?$AAo?$AAr?$AAe?$AA?$AA@
0x1C0008BA8: NextFileTableTime
0x1C0003888: "\Media" ??_C@_1O@ECHIMFBH@?$AA?2?$AAM?$AAe?$AAd?$AAi?$AAa?$AA?$AA@
0x1C0004B58: "\Microsoft\Windows" ??_C@_1CG@DBHKDKGO@?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?$AA@
0x1C0001720: "__cdecl _report_gsfailure" __report_gsfailure
0x1C0003E98: "\System32\manifeststore" ??_C@_1DA@BJDEECDM@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAm?$AAa?$AAn?$AAi?$AAf?$AAe?$AAs?$AAt?$AAs?$AAt?$AAo?$AAr?$AAe?$AA?$AA@
0x1C0005058: "\SysWOW64\manifeststore" ??_C@_1DA@EAGEKILA@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAm?$AAa?$AAn?$AAi?$AAf?$AAe?$AAs?$AAt?$AAs?$AAt?$AAo?$AAr?$AAe?$AA?$AA@
0x1C0004A98: "\Microsoft\Provisioning" ??_C@_1DA@PHKFLOJK@?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAP?$AAr?$AAo?$AAv?$AAi?$AAs?$AAi?$AAo?$AAn?$AAi?$AAn?$AAg?$AA?$AA@
0x1C000B018: "__cdecl _imp_FltQueueGenericWorkItem" __imp_FltQueueGenericWorkItem
0x1C000B318: "__cdecl _imp_ObfReferenceObjectWithTag" __imp_ObfReferenceObjectWithTag
0x1C0005E60: LuafvReadSettingsFailed
0x1C0016C50: LuafvLogDelayedOnly
0x1C000B348: "__cdecl _imp_KeWaitForMultipleObjects" __imp_KeWaitForMultipleObjects
0x1C0011208: LuafvEnumerateFileTable
0x1C00037B0: "\Fonts" ??_C@_1O@PAFAGDEJ@?$AA?2?$AAF?$AAo?$AAn?$AAt?$AAs?$AA?$AA@
0x1C00025AC: LuafvPauseUsn
0x1C0019320: LuafvUnload
0x1C000DE80: LuafvPostCleanup
0x1C000B1F8: "__cdecl _imp_ExQueryDepthSList" __imp_ExQueryDepthSList
0x1C0004700: "\Reference Assemblies\Microsoft\" ??_C@_1FE@DJIAAEDB@?$AA?2?$AAR?$AAe?$AAf?$AAe?$AAr?$AAe?$AAn?$AAc?$AAe?$AA?5?$AAA?$AAs?$AAs?$AAe?$AAm?$AAb?$AAl?$AAi?$AAe?$AAs?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2@
0x1C0021028: GlobalRoot
0x1C00034E8: LuafvVirtualDeleteEvent
0x1C0006018: "\Microsoft\Windows\" ??_C@_1CI@LMKJBOPL@?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?2?$AA?$AA@
0x1C00051C8: "\SysWOW64\RAS" ??_C@_1BM@BIJLAHOP@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAR?$AAA?$AAS?$AA?$AA@
0x1C00045C0: "\Microsoft Games\Purble Place" ??_C@_1DM@DAIMMFIL@?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?5?$AAG?$AAa?$AAm?$AAe?$AAs?$AA?2?$AAP?$AAu?$AAr?$AAb?$AAl?$AAe?$AA?5?$AAP?$AAl?$AAa?$AAc?$AAe?$AA?$AA@
0x1C000B4A8: "__cdecl _imp_IoFileObjectType" __imp_IoFileObjectType
0x1C0001010: LuafvPreWrite
0x1C0008058: LuafvIndexAllocationAttribute
0x1C00052C0: "\SysWOW64\SMI" ??_C@_1BM@JMFHHAPB@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?2?$AAS?$AAM?$AAI?$AA?$AA@
0x1C000B530: ntoskrnl_NULL_THUNK_DATA
0x1C000B4E8: "__cdecl _imp_ExFreePoolWithTag" __imp_ExFreePoolWithTag
0x1C0004168: "\System32\sr-Latn-CS" ??_C@_1CK@FLANBBLD@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAs?$AAr?$AA?9?$AAL?$AAa?$AAt?$AAn?$AA?9?$AAC?$AAS?$AA?$AA@
0x1C00038B8: "\ModemLogs" ??_C@_1BG@PBFFHABB@?$AA?2?$AAM?$AAo?$AAd?$AAe?$AAm?$AAL?$AAo?$AAg?$AAs?$AA?$AA@
0x1C0016DA4: LuafvLogFileError
0x1C000B358: "__cdecl _imp_IoGetTransactionParameterBlock" __imp_IoGetTransactionParameterBlock
0x1C0008920: LuafvActiveDvfcbCount
0x1C001A06C: LuafvCompleteStoreFile
0x1C00090C0: TableNodeLookaside
0x1C000B168: "__cdecl _imp_FltReleasePushLockEx" __imp_FltReleasePushLockEx
0x1C0002370: LuafvPostReadWrite
0x1C000B278: "__cdecl _imp_RtlInitializeSid" __imp_RtlInitializeSid
0x1C000B188: "__cdecl _imp_FltSetInformationFile" __imp_FltSetInformationFile
0x1C001FF94: RemoveExtensionsList
0x1C00056C0: "ExcludedExtensionsAdd" ??_C@_1CM@FMOCGMDO@?$AAE?$AAx?$AAc?$AAl?$AAu?$AAd?$AAe?$AAd?$AAE?$AAx?$AAt?$AAe?$AAn?$AAs?$AAi?$AAo?$AAn?$AAs?$AAA?$AAd?$AAd?$AA?$AA@
0x1C00150A4: LuafvCopyNextDirectoryEntry
0x1C000B198: "__cdecl _imp_FltQueryEaFile" __imp_FltQueryEaFile
0x1C0002300: LuafvPostQueryInformation
0x1C000B268: "__cdecl _imp_RtlSetDaclSecurityDescriptor" __imp_RtlSetDaclSecurityDescriptor
0x1C0008B98: RunUserAlgorithm
0x1C000D6C4: LuafvQueryVirtualizationCaller
0x1C000EA38: CreateTableNode
0x1C000B420: "__cdecl _imp_ZwOpenSymbolicLinkObject" __imp_ZwOpenSymbolicLinkObject
0x1C001E314: DriverEntry
0x1C00041E0: "\System32\Tasks" ??_C@_1CA@OLCFMBOD@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAT?$AAa?$AAs?$AAk?$AAs?$AA?$AA@
0x1C0004998: "\Microsoft\eHome" ??_C@_1CC@PPKMBNIP@?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAe?$AAH?$AAo?$AAm?$AAe?$AA?$AA@
0x1C00046D0: "\Packaged Programs" ??_C@_1CG@DJMBLFJJ@?$AA?2?$AAP?$AAa?$AAc?$AAk?$AAa?$AAg?$AAe?$AAd?$AA?5?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAs?$AA?$AA@
0x1C0018D80: LuafvPreQueryOpen
0x1C0003F18: "\System32\MSDTC" ??_C@_1CA@JMJNFDDG@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAM?$AAS?$AAD?$AAT?$AAC?$AA?$AA@
0x1C0011AFC: LuafvReadDwordValue
0x1C000B378: "__cdecl _imp_ExWaitForRundownProtectionRelease" __imp_ExWaitForRundownProtectionRelease
0x1C0004888: "\Windows Sidebar" ??_C@_1CC@LIHJDDBG@?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAS?$AAi?$AAd?$AAe?$AAb?$AAa?$AAr?$AA?$AA@
0x1C000B488: "__cdecl _imp_SeQueryAuthenticationIdToken" __imp_SeQueryAuthenticationIdToken
0x1C0015734: LuafvOpenDirectory
0x1C000B1D8: "__cdecl _imp_ZwOpenKey" __imp_ZwOpenKey
0x1C0003E00: "\System32\Ipmi" ??_C@_1BO@LGAAONAC@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAI?$AAp?$AAm?$AAi?$AA?$AA@
0x1C0019B4C: LuafvReportAuditVirtualizationEvent
0x1C000B1C8: "__cdecl _imp_ZwCreateSection" __imp_ZwCreateSection
0x1C0001C00: memset
0x1C000B570: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x1C00035D0: "CommonFilesDir" ??_C@_1BO@HALHHILJ@?$AAC?$AAo?$AAm?$AAm?$AAo?$AAn?$AAF?$AAi?$AAl?$AAe?$AAs?$AAD?$AAi?$AAr?$AA?$AA@
0x1C000B528: "__cdecl _imp_RtlCopyLuidAndAttributesArray" __imp_RtlCopyLuidAndAttributesArray

[JEB Decompiler by PNF Software]