Generated by JEB on 2019/08/01

PE: C:\Windows\System32\pcadm.dll Base=0x180000000 SHA-256=4F22B64BB625B4518DDD02BB69183697BC65BDC918FD0755FCA3C337D5511268
PDB: pcadm.pdb GUID={8B26A80A-AC43-FB49-697AC1CD1543BC79} Age=1

536 located named symbols:
0x18000C498: "__cdecl _imp_RtlInitUnicodeStringEx" __imp_RtlInitUnicodeStringEx
0x18000DF74: "PRINT" ??_C@_05ECKPOFCN@PRINT?$AA@
0x18000243C: "__cdecl _raise_securityfailure" __raise_securityfailure
0x18000D678: "PcaDiagnoseRegisterScenario" ??_C@_0BM@KIFHIMOB@PcaDiagnoseRegisterScenario?$AA@
0x18000CD20: "RtlStringCchLengthA failed [%x]" ??_C@_0CA@JMEKPAGN@RtlStringCchLengthA?5failed?5?$FL?$CFx?$FN?$AA@
0x18000C328: api-ms-win-core-file-l1-1-0_NULL_THUNK_DATA
0x18000C218: "__cdecl _imp_EventRegister" __imp_EventRegister
0x18000D2B8: "%systemroot%\system32" ??_C@_1CM@JBIGCHCD@?$AA?$CF?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AAr?$AAo?$AAo?$AAt?$AA?$CF?$AA?2?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?$AA@
0x180002250: "__cdecl FindPESection" _FindPESection
0x18000DC78: "PcaDiagnoseExecuteTroubleshoot f" ??_C@_0CL@JLJAALAF@PcaDiagnoseExecuteTroubleshoot?5f@
0x18000CE10: "AslEnvVarQuery failed [%x]" ??_C@_0BL@JLFODMA@AslEnvVarQuery?5failed?5?$FL?$CFx?$FN?$AA@
0x1800088A8: RtlStringCchCatW
0x1800073C0: "__cdecl TlgCreateSz" _TlgCreateSz
0x18000C540: "__cdecl _imp_?PcaIsPcaDisabled@@YAHXZ" __imp_?PcaIsPcaDisabled@@YAHXZ
0x1800053BC: "long __cdecl RtlStringCchPrintfA(char * __ptr64,unsigned __int64,char const * __ptr64,...)" ?RtlStringCchPrintfA@@YAJPEAD_KPEBDZZ
0x180004D50: "long __cdecl StringCchCatW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64)" ?StringCchCatW@@YAJPEAG_KPEBG@Z
0x18000EED8: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x18000DE18: "Failed to get system directory" ??_C@_0BP@NHBELIAI@Failed?5to?5get?5system?5directory?$AA@
0x18000831C: RtlStringCchCopyW
0x1800057D4: AslLogDebugVPrintf
0x180009938: RtlStringCchCopyA
0x180010180: "__cdecl _security_cookie_complement" __security_cookie_complement
0x18000DB80: "Failed to send to service (it ma" ??_C@_0DH@FJKCGONM@Failed?5to?5send?5to?5service?5?$CIit?5ma@
0x18000D068: "Failed to open reg key [%x]" ??_C@_0BM@PIJDJEI@Failed?5to?5open?5reg?5key?5?$FL?$CFx?$FN?$AA@
0x180001020: "long __cdecl WdiHandleInstance(void * __ptr64,enum WDI_DIAGNOSTIC_MODULE_REQUEST)" ?WdiHandleInstance@@YAJPEAXW4WDI_DIAGNOSTIC_MODULE_REQUEST@@@Z
0x18000C1A0: "__cdecl tls_used" _tls_used
0x18000DBE0: "PcapWdiTroubleshootCallback" ??_C@_0BM@PNFLHLNE@PcapWdiTroubleshootCallback?$AA@
0x18000266E: CloseHandle
0x18000C9C8: "AslRegistryOpenKey passed bad Pa" ??_C@_0CI@FAHCLLPP@AslRegistryOpenKey?5passed?5bad?5Pa@
0x180001C7C: "__cdecl CRT_INIT" _CRT_INIT
0x18000C2A0: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x18000C488: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x180002760: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x18000D728: "Scenario %d failed troubleshoot " ??_C@_0CF@HGDMCHFA@Scenario?5?$CFd?5failed?5troubleshoot?5@
0x18000C318: "__cdecl _imp_CreateFileW" __imp_CreateFileW
0x18000C640: "PCADiagnosticModule" ??_C@_0BE@GLELJIFC@PCADiagnosticModule?$AA@
0x18000E438: "__cdecl Init_thread_epoch" _Init_thread_epoch
0x18000D4E8: "__cdecl TraceLoggingMetadata" _TraceLoggingMetadata
0x180003EA8: "long __cdecl PcapWdiTroubleshootCallback(void * __ptr64,unsigned __int64,int)" ?PcapWdiTroubleshootCallback@@YAJPEAX_KH@Z
0x18000C7F0: "Failed to scenario data [%d]" ??_C@_0BN@EPEBGNFE@Failed?5to?5scenario?5data?5?$FL?$CFd?$FN?$AA@
0x18000C848: "" ??_C@_00CNPNBAHC@?$AA@
0x180005588: AslLogCreate
0x18000C730: "DM_ProblemDetect" ??_C@_0BB@DFHCNDOO@DM_ProblemDetect?$AA@
0x180006438: AslTelemetryFlush
0x18000C3D8: "__cdecl _imp_sprintf_s" __imp_sprintf_s
0x18000EF64: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-1-0
0x18000DDD0: "Failed to get system directory [" ??_C@_0CE@KCKIJBMF@Failed?5to?5get?5system?5directory?5?$FL@
0x18000B1B4: AslEnvVarQuery
0x18000ACEC: AslEnvExpandStrings
0x18000C6B8: AE_LOG
0x180004E9C: "long __cdecl AslLogpAppendLog(unsigned short const * __ptr64,char const * __ptr64,unsigned __int64,unsigned char)" ?AslLogpAppendLog@@YAJPEBGPEBD_KE@Z
0x180004248: "unsigned long __cdecl PcaTokenPack(void * __ptr64 * __ptr64,unsigned __int64 * __ptr64,unsigned __int64)" ?PcaTokenPack@@YAKPEAPEAXPEA_K_K@Z
0x18000C3E0: "__cdecl _imp_wcschr" __imp_wcschr
0x18000DC00: "WdiGetDiagnosticModuleId failed " ??_C@_0CF@DGDEIAFH@WdiGetDiagnosticModuleId?5failed?5@
0x18000DDF8: "PcaUtilityGetSystemLibraryApi" ??_C@_0BO@IAMKNAMF@PcaUtilityGetSystemLibraryApi?$AA@
0x18000EF14: "__cdecl _IMPORT_DESCRIPTOR_pcacli" __IMPORT_DESCRIPTOR_pcacli
0x18000C470: "__cdecl _imp_RtlEqualString" __imp_RtlEqualString
0x18000C4E8: "__cdecl _imp_RtlEnterCriticalSection" __imp_RtlEnterCriticalSection
0x18000748C: "__cdecl TlgWrite" _TlgWrite
0x18000C5A8: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x18000D348: "%systemdrive%\Program Files" ??_C@_1DI@GAAGMOFG@?$AA?$CF?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AAd?$AAr?$AAi?$AAv?$AAe?$AA?$CF?$AA?2?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AA?5?$AAF?$AAi?$AAl?$AAe?$AAs?$AA?$AA@
0x1800037C4: "void __cdecl PcaDmRegisterScenarios(unsigned __int64)" ?PcaDmRegisterScenarios@@YAX_K@Z
0x18000C3B8: "__cdecl _imp__wcsnicmp" __imp__wcsnicmp
0x18000CCE0: "RtlStringCchCopyW failed [%x]" ??_C@_0BO@LFCDCAJH@RtlStringCchCopyW?5failed?5?$FL?$CFx?$FN?$AA@
0x18000C258: "__cdecl _imp_GetModuleHandleExW" __imp_GetModuleHandleExW
0x18000CAA0: "AslRegistryGetString" ??_C@_0BF@BEDJKLON@AslRegistryGetString?$AA@
0x18000DCA8: "DM_Resolve" ??_C@_0L@FFBJONHI@DM_Resolve?$AA@
0x18000777C: AslRegistryGetString
0x18000CAB8: "Out of memory [%x]" ??_C@_0BD@PKOKAJCB@Out?5of?5memory?5?$FL?$CFx?$FN?$AA@
0x1800050A0: "void __cdecl AslLogpWriteEtw(struct _ASL_LOG * __ptr64,enum ASL_LOG_LEVEL,char const * __ptr64)" ?AslLogpWriteEtw@@YAXPEAU_ASL_LOG@@W4ASL_LOG_LEVEL@@PEBD@Z
0x18000DFB0: "Message too long!" ??_C@_0BC@CHJNCCME@Message?5too?5long?$CB?$AA@
0x18000E43C: "__cdecl tls_end" _tls_end
0x18000C9C0: "%d" ??_C@_02DPKJAMEF@?$CFd?$AA@
0x18000D090: "\Registry\Machine\Software\Micro" ??_C@_1JG@LOBJJIBH@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x180002235: "__cdecl XcptFilter" _XcptFilter
0x18000C2F8: "__cdecl _imp_WTSQueryUserToken" __imp_WTSQueryUserToken
0x18000C828: "Parameters too long" ??_C@_0BE@GJGACAOI@Parameters?5too?5long?$AA@
0x180006C20: AslTelemetryTrackError
0x18000C5B0: "__cdecl _xc_a" __xc_a
0x18000CEA0: "AslpEnvResolveVars failed [%x]" ??_C@_0BP@FBDBOKFK@AslpEnvResolveVars?5failed?5?$FL?$CFx?$FN?$AA@
0x18000C3B0: "__cdecl _imp_wcsstr" __imp_wcsstr
0x18000DA10: "PCA_TOKEN_DATA" ??_C@_1BO@GAMHBNM@?$AAP?$AAC?$AAA?$AA_?$AAT?$AAO?$AAK?$AAE?$AAN?$AA_?$AAD?$AAA?$AAT?$AAA?$AA?$AA@
0x18000C700: "pcadm" ??_C@_05IHJKLIHA@pcadm?$AA@
0x1800041F8: "void __cdecl PcaTokenDelete(unsigned __int64)" ?PcaTokenDelete@@YAX_K@Z
0x1800107A8: "unsigned __int64 g_DiagnoseHandle" ?g_DiagnoseHandle@@3_KA
0x18000C4A8: "__cdecl _imp_RtlAppendUnicodeStringToString" __imp_RtlAppendUnicodeStringToString
0x18000D838: "Redirector_Detect" ??_C@_0BC@MFCJMMJJ@Redirector_Detect?$AA@
0x180005998: AslLogDelete
0x18000C6D8: AE_PCA_ETW_LOG
0x18000DFD8: "ERROR#%s#%d" ??_C@_0M@DNCHPEGO@ERROR?$CD?$CFs?$CD?$CFd?$AA@
0x18000715C: AslpTelemetryCleanString
0x1800025F7: "__cdecl lock" _lock
0x18000D6D0: "Failed to create token [%d]" ??_C@_0BM@CDDHDBEP@Failed?5to?5create?5token?5?$FL?$CFd?$FN?$AA@
0x18000DFC4: "%s#%s" ??_C@_05CPDNPOCI@?$CFs?$CD?$CFs?$AA@
0x180004FE0: "void __cdecl AslLogpRollStream(struct _RTL_MEMORY_STREAM * __ptr64,unsigned __int64)" ?AslLogpRollStream@@YAXPEAU_RTL_MEMORY_STREAM@@_K@Z
0x18000C638: "__cdecl _guard_iat_table" __guard_iat_table
0x18000CAF8: "AslRegistryGetStringExpand" ??_C@_0BL@PDPDPHAO@AslRegistryGetStringExpand?$AA@
0x18000264A: GetLastError
0x18000CA48: "Invalid value type" ??_C@_0BD@BBKBCNOK@Invalid?5value?5type?$AA@
0x18000272D: memcpy
0x18000DF7C: "ERROR" ??_C@_05MBDEGLCK@ERROR?$AA@
0x18000C2D8: "__cdecl _imp_LoadLibraryExW" __imp_LoadLibraryExW
0x18000C210: "__cdecl _imp_EventWriteTransfer" __imp_EventWriteTransfer
0x18000C450: "__cdecl _imp_memset" __imp_memset
0x18000CEC0: "AslEnvExpandStrings failed [%x]" ??_C@_0CA@IDIOIIBO@AslEnvExpandStrings?5failed?5?$FL?$CFx?$FN?$AA@
0x18000B3D8: AslpEnvResolveVars
0x18000240F: "__cdecl initterm" _initterm
0x18000C768: "Failed to get event data [%d]" ??_C@_0BO@IELGGOCM@Failed?5to?5get?5event?5data?5?$FL?$CFd?$FN?$AA@
0x1800095D8: AslStringDuplicate
0x18000471C: "void * __ptr64 __cdecl PcaStreamAlloc(class RtlMemoryStream & __ptr64)" ?PcaStreamAlloc@@YAPEAXAEAVRtlMemoryStream@@@Z
0x18000CC78: "FileVersion" ??_C@_1BI@HCCAONKE@?$AAF?$AAi?$AAl?$AAe?$AAV?$AAe?$AAr?$AAs?$AAi?$AAo?$AAn?$AA?$AA@
0x18000C570: "__cdecl _imp_WdiGetParameterDataLength" __imp_WdiGetParameterDataLength
0x18000EF78: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0
0x180010748: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x18000D3A0: "CommonProgramFiles" ??_C@_1CG@HMNDLOFD@?$AAC?$AAo?$AAm?$AAm?$AAo?$AAn?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAF?$AAi?$AAl?$AAe?$AAs?$AA?$AA@
0x18000C288: "__cdecl _imp_Sleep" __imp_Sleep
0x180010790: "class AslLogGlobalLogger g_AslLogger" ?g_AslLogger@@3VAslLogGlobalLogger@@A
0x18000CE48: "AslpEnvResolveVars failed to fai" ??_C@_0DL@ECPNLKFD@AslpEnvResolveVars?5failed?5to?5fai@
0x18000C5D8: "__cdecl _xi_z" __xi_z
0x180003DC8: "long __cdecl PcapWdiTokenSave(void * __ptr64,unsigned __int64)" ?PcapWdiTokenSave@@YAJPEAX_K@Z
0x18000C2B8: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x18000DD78: AE_MARK_EVENT
0x18000976C: AslStringDuplicateA
0x18000241B: "__cdecl _C_specific_handler" __C_specific_handler
0x18000C510: "__cdecl _imp_RtlDoesFileExists_U" __imp_RtlDoesFileExists_U
0x180001110: "long __cdecl PcaDiagnoseExecuteDetect(unsigned __int64,struct _EVENT_RECORD * __ptr64,unsigned __int64,void * __ptr64,long (__cdecl*)(void * __ptr64,unsigned __int64,int,int))" ?PcaDiagnoseExecuteDetect@@YAJ_KPEAU_EVENT_RECORD@@0PEAXP6AJ20HH@Z@Z
0x18000C400: "__cdecl _imp__onexit" __imp__onexit
0x180002739: memmove
0x18000C260: "__cdecl _imp_HeapFree" __imp_HeapFree
0x18000B0D0: AslEnvGetProcessWowInfo
0x18000C338: api-ms-win-core-handle-l1-1-0_NULL_THUNK_DATA
0x18000C560: "__cdecl _imp_WdiAddParameter" __imp_WdiAddParameter
0x18000DA58: "PcapWdiTokenLoad" ??_C@_0BB@OKAGKMHI@PcapWdiTokenLoad?$AA@
0x18000CEE0: "%systemroot%" ??_C@_1BK@JEOALCGP@?$AA?$CF?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AAr?$AAo?$AAo?$AAt?$AA?$CF?$AA?$AA@
0x18000CFC8: "SystemRoot=" ??_C@_1BI@KJNLBMHH@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAo?$AAo?$AAt?$AA?$DN?$AA?$AA@
0x1800026C0: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x180001B40: "public: __cdecl AslLogGlobalLogger::AslLogGlobalLogger(char const * __ptr64,unsigned int) __ptr64" ??0AslLogGlobalLogger@@QEAA@PEBDI@Z
0x18000C6A0: "%s,%04d,%04d,%s,%s " ??_C@_0BF@IIGEMOJO@?$CFs?0?$CF04d?0?$CF04d?0?$CFs?0?$CFs?$AN?6?$AA@
0x18000CC18: "NtOpenKey failed for %ws [%x]" ??_C@_0BO@KHIHGBEI@NtOpenKey?5failed?5for?5?$CFws?5?$FL?$CFx?$FN?$AA@
0x18000DBB8: "Failed to get active session id " ??_C@_0CF@EOCGAJFI@Failed?5to?5get?5active?5session?5id?5@
0x18000D750: "PcaDiagnoseExecuteTroubleshoot" ??_C@_0BP@JCJIKMNA@PcaDiagnoseExecuteTroubleshoot?$AA@
0x18000C500: "__cdecl _imp_RtlAllocateHeap" __imp_RtlAllocateHeap
0x1800034D4: "long __cdecl PcaDiagnoseExecuteTroubleshoot(unsigned __int64,unsigned __int64,void * __ptr64,long (__cdecl*)(void * __ptr64,unsigned __int64,int))" ?PcaDiagnoseExecuteTroubleshoot@@YAJ_K0PEAXP6AJ10H@Z@Z
0x18000EF50: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0
0x18000CE30: "AslEnvExpandStrings" ??_C@_0BE@MJPLEBLE@AslEnvExpandStrings?$AA@
0x180002241: "__cdecl amsg_exit" _amsg_exit
0x180005A30: "public: long __cdecl PiiFilter::EmbeddedPathsExecute(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64) __ptr64" ?EmbeddedPathsExecute@PiiFilter@@QEAAJPEAG_KPEBG@Z
0x18000C810: "PcaTokenSetScenarioData" ??_C@_0BI@KIKIGML@PcaTokenSetScenarioData?$AA@
0x18000C250: "__cdecl _imp_DebugBreak" __imp_DebugBreak
0x180007190: AslpTelemetryProcessError
0x18000EF00: "__cdecl _IMPORT_DESCRIPTOR_wdi" __IMPORT_DESCRIPTOR_wdi
0x18000C990: "EventSetInformation" ??_C@_0BE@BJEEGHGK@EventSetInformation?$AA@
0x18000C658: "Event claimed, ScenarioID, %Iu, " ??_C@_0DL@KCMHFGFP@Event?5claimed?0?5ScenarioID?0?5?$CFIu?0?5@
0x18000C418: "__cdecl _imp__lock" __imp__lock
0x180009164: PiiFilterEmbeddedPathsExecute
0x180002218: atexit
0x18000C4E0: "__cdecl _imp_RtlInitializeCriticalSection" __imp_RtlInitializeCriticalSection
0x18000CF40: "Invalid combination of Host/Curr" ??_C@_0HA@EFIDDFNE@Invalid?5combination?5of?5Host?1Curr@
0x1800107D0: "unsigned __int64 g_PcaTelemetry" ?g_PcaTelemetry@@3_KA
0x18000CFB0: "AslEnvBuildBasic" ??_C@_0BB@OHEKBGFD@AslEnvBuildBasic?$AA@
0x18000912C: PiiFilterDelete
0x18000C2E8: "__cdecl _imp_WTSEnumerateSessionsW" __imp_WTSEnumerateSessionsW
0x18000D1B0: "RtlGetNtSystemRoot" ??_C@_0BD@FEHADEKB@RtlGetNtSystemRoot?$AA@
0x18000C310: api-ms-win-core-errorhandling-l1-1-0_NULL_THUNK_DATA
0x18000C598: wdi_NULL_THUNK_DATA
0x18000D4C0: "ProgramData" ??_C@_1BI@PCFBINBH@?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAD?$AAa?$AAt?$AAa?$AA?$AA@
0x18000DE38: "Failed to create path" ??_C@_0BG@EJGLIBDO@Failed?5to?5create?5path?$AA@
0x18000C2C8: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x18000260F: "__cdecl _dllonexit" __dllonexit
0x18000C844: ";" ??_C@_13PJJBFPED@?$AA?$DL?$AA?$AA@
0x18000794C: AslRegistryGetStringExpand
0x18000D9C8: "Failed to open UI Dll %S [%d]" ??_C@_0BO@DAGGNPOP@Failed?5to?5open?5UI?5Dll?5?$CFS?5?$FL?$CFd?$FN?$AA@
0x180010728: "__cdecl _native_startup_lock" __native_startup_lock
0x18000CA28: "AslRegistryGetUInt32_UStr" ??_C@_0BK@GEIFCLB@AslRegistryGetUInt32_UStr?$AA@
0x18000C580: "__cdecl _imp_WdiGetEvent" __imp_WdiGetEvent
0x18000C4C0: "__cdecl _imp_RtlUpcaseUnicodeChar" __imp_RtlUpcaseUnicodeChar
0x180002690: DllMain
0x18000D930: "ResolverDialog_Resolve" ??_C@_0BH@FOCPFCFK@ResolverDialog_Resolve?$AA@
0x18000DEB0: "PcaUtilityGetActiveUserSessionSi" ??_C@_0CC@CJMMBJFF@PcaUtilityGetActiveUserSessionSi@
0x18000CC58: "StringFileInfo" ??_C@_1BO@PBBNDBNF@?$AAS?$AAt?$AAr?$AAi?$AAn?$AAg?$AAF?$AAi?$AAl?$AAe?$AAI?$AAn?$AAf?$AAo?$AA?$AA@
0x18000CC90: "JanFebMarAprMayJunJulAugSepOctNo" ??_C@_1EK@KKCLMHNJ@?$AAJ?$AAa?$AAn?$AAF?$AAe?$AAb?$AAM?$AAa?$AAr?$AAA?$AAp?$AAr?$AAM?$AAa?$AAy?$AAJ?$AAu?$AAn?$AAJ?$AAu?$AAl?$AAA?$AAu?$AAg?$AAS?$AAe?$AAp?$AAO?$AAc?$AAt?$AAN?$AAo@
0x18000C398: "__cdecl _imp__wcsicmp" __imp__wcsicmp
0x18000C3A8: "__cdecl _imp_wcscat_s" __imp_wcscat_s
0x18000C420: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x18000D248: "\SysWOW64" ??_C@_1BE@MJECBGNO@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?$AA@
0x180007D8C: RtlGetVersionResource
0x18000C518: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x180008EE4: "long __cdecl PiiFilterpAddItemSorted(struct _PII_FILTER * __ptr64,unsigned short * __ptr64,unsigned short * __ptr64)" ?PiiFilterpAddItemSorted@@YAJPEAU_PII_FILTER@@PEAG1@Z
0x18000D158: "AslEnvGetProcessWowInfo" ??_C@_0BI@EDMELJOD@AslEnvGetProcessWowInfo?$AA@
0x18000C348: api-ms-win-core-libraryloader-l1-2-0_NULL_THUNK_DATA
0x18000C358: api-ms-win-core-libraryloader-l1-2-1_NULL_THUNK_DATA
0x18000CC38: "VS_VERSION_INFO" ??_C@_1CA@FOECMPGO@?$AAV?$AAS?$AA_?$AAV?$AAE?$AAR?$AAS?$AAI?$AAO?$AAN?$AA_?$AAI?$AAN?$AAF?$AAO?$AA?$AA@
0x18000C2E0: KERNEL32_NULL_THUNK_DATA
0x18000D2A0: "%system32%" ??_C@_1BG@IBFJLDBC@?$AA?$CF?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?$CF?$AA?$AA@
0x1800098E4: AslStringUpper
0x18000267A: GetProcAddress
0x18000C308: "__cdecl _imp_GetLastError" __imp_GetLastError
0x180001850: "long __cdecl PcapWdiDetectCallback(void * __ptr64,unsigned __int64,int,int)" ?PcapWdiDetectCallback@@YAJPEAX_KHH@Z
0x180010170: "__cdecl _native_dllmain_reason" __native_dllmain_reason
0x18000269C: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x180010720: "__cdecl tls_index" _tls_index
0x18000D878: "Forwarder_Detect" ??_C@_0BB@CNCADPIK@Forwarder_Detect?$AA@
0x18000C3E8: "__cdecl _imp_memcmp" __imp_memcmp
0x180005414: "long __cdecl RtlStringCchPrintfW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64,...)" ?RtlStringCchPrintfW@@YAJPEAG_KPEBGZZ
0x18000D6B0: "PcaDiagnoseExecuteDetect" ??_C@_0BJ@JBPADNGP@PcaDiagnoseExecuteDetect?$AA@
0x18000CF18: "RtlStringCchCatW failed [%x]" ??_C@_0BN@IGBCHOAA@RtlStringCchCatW?5failed?5?$FL?$CFx?$FN?$AA@
0x18000E434: "__cdecl tls_start" _tls_start
0x18000C3D0: "__cdecl _imp_strchr" __imp_strchr
0x18000C5E8: "__cdecl _xl_z" __xl_z
0x18000C240: "__cdecl _imp_OutputDebugStringA" __imp_OutputDebugStringA
0x18000EFC8: "__cdecl _IMPORT_DESCRIPTOR_ADVAPI32" __IMPORT_DESCRIPTOR_ADVAPI32
0x18000DED8: "Failed to get user token informa" ??_C@_0DK@GDNBLPFG@Failed?5to?5get?5user?5token?5informa@
0x18000C298: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x18000CD58: "SIZE_T arithmetic failed [%x]" ??_C@_0BO@JIGJHMGC@SIZE_T?5arithmetic?5failed?5?$FL?$CFx?$FN?$AA@
0x18000D7E8: "Scenario %d resolve callback fai" ??_C@_0CJ@JEEMJNLG@Scenario?5?$CFd?5resolve?5callback?5fai@
0x18000C930: "api-ms-win-eventing-provider-l1-" ??_C@_1EI@JCOINDP@?$AAa?$AAp?$AAi?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAe?$AAv?$AAe?$AAn?$AAt?$AAi?$AAn?$AAg?$AA?9?$AAp?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AA?9?$AAl?$AA1?$AA?9@
0x18000DA70: "WdiGetParameterDataLength failed" ??_C@_0CG@MDFNBMIB@WdiGetParameterDataLength?5failed@
0x180002300: "__cdecl ValidateImageBase" _ValidateImageBase
0x180004194: "unsigned long __cdecl PcaTokenCreate(unsigned __int64 * __ptr64)" ?PcaTokenCreate@@YAKPEA_K@Z
0x180004778: "long __cdecl StringCchCopyW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64)" ?StringCchCopyW@@YAJPEAG_KPEBG@Z
0x18000D708: "WdiDetectCallback failed [%d]" ??_C@_0BO@IGFBPMDH@WdiDetectCallback?5failed?5?$FL?$CFd?$FN?$AA@
0x18000C9F0: "AslRegistryOpenKey" ??_C@_0BD@JLBNOBM@AslRegistryOpenKey?$AA@
0x18000C508: "__cdecl _imp_RtlFreeHeap" __imp_RtlFreeHeap
0x18000EF3C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0
0x18000EFB4: "__cdecl _IMPORT_DESCRIPTOR_WTSAPI32" __IMPORT_DESCRIPTOR_WTSAPI32
0x18000DD98: "Failed to copy EXE path" ??_C@_0BI@KNGPCNIH@Failed?5to?5copy?5EXE?5path?$AA@
0x180005A90: "public: long __cdecl RtlArray<struct _ASL_TELEMETRY_EVENT>::Initialize(void * __ptr64,unsigned __int64,unsigned __int64,int) __ptr64" ?Initialize@?$RtlArray@U_ASL_TELEMETRY_EVENT@@@@QEAAJPEAX_K1H@Z
0x18000D274: "Simple" ??_C@_06MIPDDPP@Simple?$AA@
0x18000C6E8: "\" ??_C@_13FPGAJAPJ@?$AA?2?$AA?$AA@
0x18000C6C8: AE_PCA_TRACE_EVENT
0x180003830: "unsigned long __cdecl ResolverDialog_Resolve(unsigned __int64)" ?ResolverDialog_Resolve@@YAK_K@Z
0x18000C278: "__cdecl _imp_HeapAlloc" __imp_HeapAlloc
0x18000C280: "__cdecl _imp_FreeLibrary" __imp_FreeLibrary
0x180004878: "public: unsigned short const * __ptr64 __cdecl RtlNameValueArray::GetValue(unsigned __int64)const __ptr64" ?GetValue@RtlNameValueArray@@QEBAPEBG_K@Z
0x180003B90: "public: static void __cdecl AslLogGlobalLogger::LogVPrintf(enum ASL_LOG_LEVEL,char const * __ptr64,unsigned __int64,char const * __ptr64,char * __ptr64)" ?LogVPrintf@AslLogGlobalLogger@@SAXW4ASL_LOG_LEVEL@@PEBD_K1PEAD@Z
0x18000D468: "ProgramFilesDir (x86)" ??_C@_1CM@LPGAILIM@?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAF?$AAi?$AAl?$AAe?$AAs?$AAD?$AAi?$AAr?$AA?5?$AA?$CI?$AAx?$AA8?$AA6?$AA?$CJ?$AA?$AA@
0x180008FB0: "long __cdecl RtlStringCchCatW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64)" ?RtlStringCchCatW@@YAJPEAG_KPEBG@Z
0x180001BF0: "public: __cdecl AslLogGlobalLogger::~AslLogGlobalLogger(void) __ptr64" ??1AslLogGlobalLogger@@QEAA@XZ
0x18000C8E8: "%s\Temp\AslLog_%S_%s_%d.txt" ??_C@_1DI@NMOMNJAN@?$AA?$CF?$AAs?$AA?2?$AAT?$AAe?$AAm?$AAp?$AA?2?$AAA?$AAs?$AAl?$AAL?$AAo?$AAg?$AA_?$AA?$CF?$AAS?$AA_?$AA?$CF?$AAs?$AA_?$AA?$CF?$AAd?$AA?4?$AAt?$AAx?$AAt?$AA?$AA@
0x180007C0C: AslRegistryGetUInt32_UStr
0x180001EC0: "__cdecl DllMainCRTStartup" _DllMainCRTStartup
0x18000C428: "__cdecl _imp__initterm" __imp__initterm
0x18000D318: "%programfilesnative%" ??_C@_1CK@KKONAJDD@?$AA?$CF?$AAp?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAf?$AAi?$AAl?$AAe?$AAs?$AAn?$AAa?$AAt?$AAi?$AAv?$AAe?$AA?$CF?$AA?$AA@
0x18000C238: "__cdecl _imp_SetLastError" __imp_SetLastError
0x18000C4C8: "__cdecl _imp_RtlGetNativeSystemInformation" __imp_RtlGetNativeSystemInformation
0x18000C9BC: ";" ??_C@_01ICJEACDI@?$DL?$AA@
0x18000C248: "__cdecl _imp_GetModuleFileNameW" __imp_GetModuleFileNameW
0x18000DF40: "Insufficent space for User SID s" ??_C@_0DB@HKIMJEOC@Insufficent?5space?5for?5User?5SID?5s@
0x18000D910: "Failed to unpack dialog [%d]" ??_C@_0BN@JPKJOFKJ@Failed?5to?5unpack?5dialog?5?$FL?$CFd?$FN?$AA@
0x18000D8C0: "Failed to allocate memory." ??_C@_0BL@LHPMPAKG@Failed?5to?5allocate?5memory?4?$AA@
0x18000DD48: "PcaTokenUnpack" ??_C@_0P@HGGMCEON@PcaTokenUnpack?$AA@
0x180007678: AslRegistryGetKey
0x18000D8E0: "Failed to add scenario data to t" ??_C@_0CK@BMLBBCHI@Failed?5to?5add?5scenario?5data?5to?5t@
0x180010738: "__cdecl _onexitend" __onexitend
0x180002603: "__cdecl unlock" _unlock
0x18000EFA0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-1" __IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-1
0x18000C5A0: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x18000C708: "Ignoring event since PCA is disa" ??_C@_0CF@DMAEHGH@Ignoring?5event?5since?5PCA?5is?5disa@
0x18000D948: "Failed to retrieve executable pa" ??_C@_0CI@KKGMHIGH@Failed?5to?5retrieve?5executable?5pa@
0x180004E20: "unsigned int __cdecl AslLogGetDefaultFlags(void)" ?AslLogGetDefaultFlags@@YAIXZ
0x18000C2D0: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x18000C4B0: "__cdecl _imp_RtlAppendUnicodeToString" __imp_RtlAppendUnicodeToString
0x1800094B8: AslAnsiStringDuplicate
0x18000C378: "__cdecl _imp_GetTokenInformation" __imp_GetTokenInformation
0x18000C460: "__cdecl _imp_EtwEventRegister" __imp_EtwEventRegister
0x1800048DC: "unsigned long __cdecl PcaUtilityGetActiveUserSessionSid(unsigned long * __ptr64,unsigned char * __ptr64)" ?PcaUtilityGetActiveUserSessionSid@@YAKPEAKPEAE@Z
0x1800107C0: "unsigned __int64 g_PcapLogTrace" ?g_PcapLogTrace@@3_KA
0x18000C368: api-ms-win-core-sysinfo-l1-1-0_NULL_THUNK_DATA
0x18000C5C8: "__cdecl _xi_a" __xi_a
0x180002656: WriteFile
0x1800073F8: "__cdecl TlgDefineProvider_annotation__TlgASL_UTC_PROVIDERProv" _TlgDefineProvider_annotation__TlgASL_UTC_PROVIDERProv
0x18000C2B0: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x18000C410: "__cdecl _imp__unlock" __imp__unlock
0x18000CA60: "RtlInitUnicodeStringEx failed [%" ??_C@_0CD@LDGCFCIP@RtlInitUnicodeStringEx?5failed?5?$FL?$CF@
0x180002632: GetCurrentProcessId
0x180010760: g_AslLogPfnVPrintf
0x18000D610: "PCA diagnostic module initialize" ??_C@_0CC@JMPPOLP@PCA?5diagnostic?5module?5initialize@
0x18000C380: api-ms-win-security-base-l1-1-0_NULL_THUNK_DATA
0x180010778: "public: static class AslLogGlobalLogger * __ptr64 __ptr64 AslLogGlobalLogger::Instance" ?Instance@AslLogGlobalLogger@@2PEAV1@EA
0x18000D9E8: "Failed to display user interface" ??_C@_0CG@GDDPDNPG@Failed?5to?5display?5user?5interface@
0x18000C548: "__cdecl _imp_?PcaSendToService@@YAKPEAX_K@Z" __imp_?PcaSendToService@@YAKPEAX_K@Z
0x1800062E0: AslTelemetryDelete
0x18000DF90: "%s,%s,%d," ??_C@_09CHPHCLBL@?$CFs?0?$CFs?0?$CFd?0?$AA@
0x18000D27C: "Metric" ??_C@_06NLMEEMAC@Metric?$AA@
0x18000DC48: "DM_Troubleshoot" ??_C@_0BA@BPFJPNKO@DM_Troubleshoot?$AA@
0x18000DB38: "PcapWdiDetectCallback" ??_C@_0BG@FPHNFADI@PcapWdiDetectCallback?$AA@
0x18000C6F0: "Out of memory" ??_C@_0O@NALGGDJF@Out?5of?5memory?$AA@
0x18000C4A0: "__cdecl _imp_ZwQueryValueKey" __imp_ZwQueryValueKey
0x18000DFCC: "%s#%d" ??_C@_05CKLOHKLO@?$CFs?$CD?$CFd?$AA@
0x1800033E0: "long __cdecl PcaDiagnoseExecuteResolve(unsigned __int64,unsigned __int64)" ?PcaDiagnoseExecuteResolve@@YAJ_K0@Z
0x18000C920: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x180007410: "__cdecl TlgEnableCallback" _TlgEnableCallback
0x180001390: "void __cdecl PcaTracePrintf(char const * __ptr64,unsigned int,unsigned long,char const * __ptr64,...)" ?PcaTracePrintf@@YAXPEBDIK0ZZ
0x18000D290: "Activity" ??_C@_08CEBOFODC@Activity?$AA@
0x180010750: "__cdecl pRawDllMain" _pRawDllMain
0x180005E9C: "public: long __cdecl RtlMemoryStream::WriteStringA(char const * __ptr64,char const * __ptr64) __ptr64" ?WriteStringA@RtlMemoryStream@@QEAAJPEBD0@Z
0x18000D4D8: "Public" ??_C@_1O@OBJINMIH@?$AAP?$AAu?$AAb?$AAl?$AAi?$AAc?$AA?$AA@
0x18000C920: "" ??_C@_01LOCGONAA@?$AA?$AA@
0x18000D798: "Resolve was specified, but no ca" ??_C@_0DA@FOHHKAOI@Resolve?5was?5specified?0?5but?5no?5ca@
0x18000D3C8: "CommonFilesDir (x86)" ??_C@_1CK@FONJNPCI@?$AAC?$AAo?$AAm?$AAm?$AAo?$AAn?$AAF?$AAi?$AAl?$AAe?$AAs?$AAD?$AAi?$AAr?$AA?5?$AA?$CI?$AAx?$AA8?$AA6?$AA?$CJ?$AA?$AA@
0x18000C978: "advapi32" ??_C@_1BC@DNHGCMLG@?$AAa?$AAd?$AAv?$AAa?$AAp?$AAi?$AA3?$AA2?$AA?$AA@
0x18000C408: "__cdecl _imp___dllonexit" __imp___dllonexit
0x180007CF0: AslRegistryOpenKey
0x18000D498: "ProgramFiles(x86)" ??_C@_1CE@EAPHGJBI@?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAF?$AAi?$AAl?$AAe?$AAs?$AA?$CI?$AAx?$AA8?$AA6?$AA?$CJ?$AA?$AA@
0x18000DB50: "WdiSetProblemDetectionResult fai" ??_C@_0CJ@JOEJEEPO@WdiSetProblemDetectionResult?5fai@
0x18000C388: "__cdecl _imp__vsnprintf" __imp__vsnprintf
0x180002160: "__cdecl _security_check_cookie" __security_check_cookie
0x18000C5C0: "__cdecl _xc_z" __xc_z
0x18000D770: "WdiTroubleshootCallback failed [" ??_C@_0CE@LFEPAMIG@WdiTroubleshootCallback?5failed?5?$FL@
0x18000D170: "ZwQuerySystemInformation failed " ??_C@_0CF@MHINMGAF@ZwQuerySystemInformation?5failed?5@
0x18000C8D0: "LogFlags" ??_C@_1BC@EJEJANH@?$AAL?$AAo?$AAg?$AAF?$AAl?$AAa?$AAg?$AAs?$AA?$AA@
0x18000C340: "__cdecl _imp_GetProcAddress" __imp_GetProcAddress
0x180008D38: "long __cdecl PiiFilterpAddEnvironment(struct _PII_FILTER * __ptr64)" ?PiiFilterpAddEnvironment@@YAJPEAU_PII_FILTER@@@Z
0x18000CFF0: "\Registry\Machine\Software\Micro" ??_C@_1HI@BHMKBIMG@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x18000CB80: "Failed to allocate %d bytes for " ??_C@_0DA@BGOMJCLG@Failed?5to?5allocate?5?$CFd?5bytes?5for?5@
0x18000C7B0: "PcaTokenCreate" ??_C@_0P@CJJMMPHA@PcaTokenCreate?$AA@
0x18000D850: "Failed to write event header [%d" ??_C@_0CC@GOMPIPJD@Failed?5to?5write?5event?5header?5?$FL?$CFd@
0x18000D5CC: "__cdecl TraceLoggingMetadataEnd" _TraceLoggingMetadataEnd
0x18000C2A8: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x18000D658: "Failed to add listener [%d]" ??_C@_0BM@DCJBHFNM@Failed?5to?5add?5listener?5?$FL?$CFd?$FN?$AA@
0x18000C270: "__cdecl _imp_HeapReAlloc" __imp_HeapReAlloc
0x18000C558: "__cdecl _imp_WdiSetResolution" __imp_WdiSetResolution
0x18000CD40: "AslStringDuplicateA" ??_C@_0BE@MAGCEBKC@AslStringDuplicateA?$AA@
0x18000AEBC: AslEnvExpandStrings2
0x18000D300: "%windir%" ??_C@_1BC@CGIBIBCK@?$AA?$CF?$AAw?$AAi?$AAn?$AAd?$AAi?$AAr?$AA?$CF?$AA?$AA@
0x18000C230: "__cdecl _imp_GetProcessHeap" __imp_GetProcessHeap
0x180009050: PiiFilterCreate
0x18000C478: "__cdecl _imp_RtlInitAnsiString" __imp_RtlInitAnsiString
0x18000D260: "\SysARM32" ??_C@_1BE@GAOKLHBG@?$AA?2?$AAS?$AAy?$AAs?$AAA?$AAR?$AAM?$AA3?$AA2?$AA?$AA@
0x18000CBD0: "AslRegistryBuildMachinePath fail" ??_C@_0DA@HFFCFNMM@AslRegistryBuildMachinePath?5fail@
0x18000536C: "long __cdecl RtlStringCchCopyW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64)" ?RtlStringCchCopyW@@YAJPEAG_KPEBG@Z
0x18000D818: "Failed to unpack token [%d]" ??_C@_0BM@OEEGFJGK@Failed?5to?5unpack?5token?5?$FL?$CFd?$FN?$AA@
0x18000D230: "\System32" ??_C@_1BE@JPDJANBF@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?$AA@
0x18000CD98: "AslStringDuplicate" ??_C@_0BD@NJPGHOHJ@AslStringDuplicate?$AA@
0x18000DE68: "Failed to find %S!%s [%d]" ??_C@_0BK@EJCPFBLN@Failed?5to?5find?5?$CFS?$CB?$CFs?5?$FL?$CFd?$FN?$AA@
0x18000C578: "__cdecl _imp_WdiGetDiagnosticModuleId" __imp_WdiGetDiagnosticModuleId
0x18000DAF8: "PcapWdiTokenSave" ??_C@_0BB@OIBLFPKM@PcapWdiTokenSave?$AA@
0x180004DF0: AslLogCallPrintf
0x18000DF8C: " " ??_C@_02PCIJFNDE@?$AN?6?$AA@
0x18000D6F0: "Detect returned [%d]" ??_C@_0BF@MDFEOMPF@Detect?5returned?5?$FL?$CFd?$FN?$AA@
0x18000610C: AslTelemetryCreate
0x18000C5F0: "__cdecl _guard_fids_table" __guard_fids_table
0x18000C3A0: "__cdecl _imp_wcscpy_s" __imp_wcscpy_s
0x18000D2E8: "%sysnative%" ??_C@_1BI@CLEAEAIO@?$AA?$CF?$AAs?$AAy?$AAs?$AAn?$AAa?$AAt?$AAi?$AAv?$AAe?$AA?$CF?$AA?$AA@
0x180009580: AslAnsiStringFree
0x180010110: "struct _PCA_SCENARIO * g_PcaScenarios" ?g_PcaScenarios@@3PAU_PCA_SCENARIO@@A
0x18000C458: msvcrt_NULL_THUNK_DATA
0x180003C4C: "long __cdecl PcapWdiTokenLoad(void * __ptr64,unsigned __int64)" ?PcapWdiTokenLoad@@YAJPEAX_K@Z
0x18000C010: "__cdecl load_config_used" _load_config_used
0x18000D128: "RtlGetNativeSystemInformation fa" ??_C@_0CK@HFBOFPOI@RtlGetNativeSystemInformation?5fa@
0x180003608: "unsigned long __cdecl PcaDiagnoseRegisterScenario(unsigned __int64,unsigned int,unsigned long (__cdecl*)(int * __ptr64,int * __ptr64,int * __ptr64,unsigned __int64,struct _EVENT_RECORD * __ptr64,unsigned __int64),unsigned long (__cdecl*)(int * __ptr64,unsigned __int64),unsigned long (__cdecl*)(unsigned __int64))" ?PcaDiagnoseRegisterScenario@@YAK_KIP6AKPEAH110PEAU_EVENT_RECORD@@0@ZP6AK10@ZP6AK0@Z@Z
0x180005124: "void __cdecl AslLogpWriteLog(struct _ASL_LOG * __ptr64,char const * __ptr64,unsigned __int64)" ?AslLogpWriteLog@@YAXPEAU_ASL_LOG@@PEBD_K@Z
0x18000DE50: "Failed to load %S [%d]" ??_C@_0BH@GLBNPFIA@Failed?5to?5load?5?$CFS?5?$FL?$CFd?$FN?$AA@
0x18000C468: "__cdecl _imp_ZwClose" __imp_ZwClose
0x18000DC58: "PcapWdiTokenLoad failed [%d]" ??_C@_0BN@HBHDBAHE@PcapWdiTokenLoad?5failed?5?$FL?$CFd?$FN?$AA@
0x180003374: "void __cdecl PcaDiagnoseDelete(unsigned __int64)" ?PcaDiagnoseDelete@@YAX_K@Z
0x18000DF84: "MARK" ??_C@_04MGKDMHFC@MARK?$AA@
0x180002626: FreeLibrary
0x180005C10: "public: long __cdecl RtlMemoryStream::WriteString(unsigned short const * __ptr64,unsigned short const * __ptr64) __ptr64" ?WriteString@RtlMemoryStream@@QEAAJPEBG0@Z
0x18000403C: "public: unsigned long __cdecl RtlMemoryStream::InitializeFromBuffer(void * __ptr64 const,unsigned __int64) __ptr64" ?InitializeFromBuffer@RtlMemoryStream@@QEAAKQEAX_K@Z
0x18000C440: "__cdecl _imp__amsg_exit" __imp__amsg_exit
0x18000CBB0: "AslRegistryBuildMachinePath" ??_C@_0BM@HODODFBC@AslRegistryBuildMachinePath?$AA@
0x18000DE88: "Failed to enumerate sessions [%d" ??_C@_0CC@DCAKMMMO@Failed?5to?5enumerate?5sessions?5?$FL?$CFd@
0x18000DAB8: "Failed to load token [%d]" ??_C@_0BK@GGCFFNLN@Failed?5to?5load?5token?5?$FL?$CFd?$FN?$AA@
0x1800047C8: "public: void __cdecl RtlNameValueArray::Clear(void) __ptr64" ?Clear@RtlNameValueArray@@QEAAXXZ
0x18000DA30: "WdiGetParameterByName failed [%d" ??_C@_0CC@OOGNICDA@WdiGetParameterByName?5failed?5?$FL?$CFd@
0x18000CA08: "Failed to query key value [%x]" ??_C@_0BP@PMIDEKOL@Failed?5to?5query?5key?5value?5?$FL?$CFx?$FN?$AA@
0x18000D7C8: "PcaDiagnoseExecuteResolve" ??_C@_0BK@HDJAMHJL@PcaDiagnoseExecuteResolve?$AA@
0x180002690: "unsigned long __cdecl WdiGetDiagnosticModuleInterfaceVersion(void)" ?WdiGetDiagnosticModuleInterfaceVersion@@YAKXZ
0x18000C520: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x18000C290: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x1800107C8: "unsigned __int64 g_PcapLogDebug" ?g_PcapLogDebug@@3_KA
0x18000C694: "TRACE" ??_C@_05EHILDPJH@TRACE?$AA@
0x18000C480: "__cdecl _imp_RtlMultiByteToUnicodeN" __imp_RtlMultiByteToUnicodeN
0x18000C4D8: "__cdecl _imp_RtlLeaveCriticalSection" __imp_RtlLeaveCriticalSection
0x180003150: "public: unsigned long __cdecl RtlArray<struct _PCA_DIAGNOSE_SCENARIO>::Initialize(void * __ptr64,unsigned __int64,unsigned __int64,int) __ptr64" ?Initialize@?$RtlArray@U_PCA_DIAGNOSE_SCENARIO@@@@QEAAKPEAX_K1H@Z
0x18000C528: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x18000C748: "Failed to extract event [%d]" ??_C@_0BN@IIANNFJC@Failed?5to?5extract?5event?5?$FL?$CFd?$FN?$AA@
0x18000CD00: "SystemDrive=" ??_C@_1BK@NFBPFMLB@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAD?$AAr?$AAi?$AAv?$AAe?$AA?$DN?$AA?$AA@
0x180009408: AslAnsiStringCreate
0x18000DD00: "WdiDiagnosticModuleMain" ??_C@_0BI@LAPAKNOF@WdiDiagnosticModuleMain?$AA@
0x180002430: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x180002721: memcmp
0x18000C360: "__cdecl _imp_GetSystemDirectoryW" __imp_GetSystemDirectoryW
0x180010758: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUzkkxlnkzgUhszivwUoryfUlyquivUznwGEUxlnkzghszivwxlivkOlyq@compatsharedcore" __@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUzkkxlnkzgUhszivwUoryfUlyquivUznwGEUxlnkzghszivwxlivkOlyq@compatsharedcore
0x18000DDB0: "PcaDialogGetAppInformation" ??_C@_0BL@JPBFCDEC@PcaDialogGetAppInformation?$AA@
0x18000C3C0: "__cdecl _imp_wcsrchr" __imp_wcsrchr
0x18000C840: "" ??_C@_13NOLLCAOD@?$AA?$AA?$AA?$AA@
0x180007B90: AslRegistryGetUInt32
0x18000CB58: "\Registry\Machine" ??_C@_1CE@NMBJJGCH@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?$AA@
0x18000DFA0: "ASL_LOG FAIL: " ??_C@_0P@ECHOIEKI@ASL_LOG?5FAIL?3?5?$AA@
0x18000D890: "Failed to write userdata from ev" ??_C@_0CJ@EAOFGIML@Failed?5to?5write?5userdata?5from?5ev@
0x18000CE88: "AslEnvExpandStrings2" ??_C@_0BF@CBLFNIKF@AslEnvExpandStrings2?$AA@
0x18000EF8C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0
0x18000DCB8: "PcaDiagnoseExecuteResolve failed" ??_C@_0CG@JHAONMNL@PcaDiagnoseExecuteResolve?5failed@
0x18000C4F8: "__cdecl _imp_EtwEventWriteNoRegistration" __imp_EtwEventWriteNoRegistration
0x18000D9B0: "pcaui.dll" ??_C@_1BE@HFEIKHGH@?$AAp?$AAc?$AAa?$AAu?$AAi?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x18000CDF8: "systemroot" ??_C@_1BG@MCEEPJDG@?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AAr?$AAo?$AAo?$AAt?$AA?$AA@
0x18000D5E8: "Failed to initialize listeners [" ??_C@_0CE@CKNDABJP@Failed?5to?5initialize?5listeners?5?$FL@
0x1800039DC: "long __cdecl DM_Resolve(void * __ptr64)" ?DM_Resolve@@YAJPEAX@Z
0x18000C4D0: "__cdecl _imp_ZwQuerySystemInformation" __imp_ZwQuerySystemInformation
0x180005328: "long __cdecl RtlStringCchCopyA(char * __ptr64,unsigned __int64,char const * __ptr64)" ?RtlStringCchCopyA@@YAJPEAD_KPEBD@Z
0x18000C448: "__cdecl _imp__XcptFilter" __imp__XcptFilter
0x180004AE8: "unsigned long __cdecl PcaUtilityGetSystemLibraryApi(struct HINSTANCE__ * __ptr64 * __ptr64,__int64 (__cdecl* * __ptr64)(void),unsigned short const * __ptr64,char const * __ptr64)" ?PcaUtilityGetSystemLibraryApi@@YAKPEAPEAUHINSTANCE__@@PEAP6A_JXZPEBGPEBD@Z
0x18000C538: ntdll_NULL_THUNK_DATA
0x18000C3F0: "__cdecl _imp_memcpy" __imp_memcpy
0x18000D970: "Dialog not shown: %S does not ex" ??_C@_0CE@LAEBBFI@Dialog?5not?5shown?3?5?$CFS?5does?5not?5ex@
0x18000CD1C: "%" ??_C@_13EJFHHPOP@?$AA?$CF?$AA?$AA@
0x18000C530: "__cdecl _imp_EtwEventUnregister" __imp_EtwEventUnregister
0x18000C83C: "=" ??_C@_13NMPKAAJP@?$AA?$DN?$AA?$AA@
0x18000DF18: "Failed to get token information " ??_C@_0CF@IDCJIHOM@Failed?5to?5get?5token?5information?5@
0x180004520: "unsigned long __cdecl PcaTokenUnpack(unsigned __int64,void * __ptr64,unsigned __int64)" ?PcaTokenUnpack@@YAK_KPEAX0@Z
0x18000CD78: "RtlStringCchLengthW failed [%x]" ??_C@_0CA@CDKIHLH@RtlStringCchLengthW?5failed?5?$FL?$CFx?$FN?$AA@
0x180001590: "unsigned long __cdecl Forwarder_Detect(int * __ptr64,int * __ptr64,int * __ptr64,unsigned __int64,struct _EVENT_RECORD * __ptr64,unsigned __int64)" ?Forwarder_Detect@@YAKPEAH00_KPEAU_EVENT_RECORD@@1@Z
0x180010178: "__cdecl _security_cookie" __security_cookie
0x18000CB18: "AslEnvExpandStrings2 failed to e" ??_C@_0DL@NEFCFCEC@AslEnvExpandStrings2?5failed?5to?5e@
0x18000C390: "__cdecl _imp_strcpy_s" __imp_strcpy_s
0x18000D448: "ProgramFiles" ??_C@_1BK@CECDDAML@?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAF?$AAi?$AAl?$AAe?$AAs?$AA?$AA@
0x18000C850: "\Software\Microsoft\Windows NT\C" ??_C@_1HK@FCHHNOGK@?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAN?$AAT?$AA?2?$AAC@
0x18000C788: "PcaDiagnoseExecuteDetect failed " ??_C@_0CF@HOMOJLEF@PcaDiagnoseExecuteDetect?5failed?5@
0x18000C330: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x18000C2F0: "__cdecl _imp_WTSFreeMemory" __imp_WTSFreeMemory
0x18000D288: "Message" ??_C@_07BEIHKDLJ@Message?$AA@
0x18000C370: "__cdecl _imp_GetLengthSid" __imp_GetLengthSid
0x18000EF28: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0
0x18000C9A8: "AslTelemetryCreate" ??_C@_0BD@NIOMDNK@AslTelemetryCreate?$AA@
0x18000C5E0: "__cdecl _xl_a" __xl_a
0x18000C350: "__cdecl _imp_LoadLibraryW" __imp_LoadLibraryW
0x180010740: "__cdecl _onexitbegin" __onexitbegin
0x18000DAD8: "Failed to save token [%d]" ??_C@_0BK@DNHCFDEF@Failed?5to?5save?5token?5?$FL?$CFd?$FN?$AA@
0x18000CFE0: "WinDir=" ??_C@_1BA@NJFCNLDI@?$AAW?$AAi?$AAn?$AAD?$AAi?$AAr?$AA?$DN?$AA?$AA@
0x18000CDE0: "AslAnsiStringCreate" ??_C@_0BE@IKJKFOPD@AslAnsiStringCreate?$AA@
0x18000D998: "PcaShowDialog" ??_C@_0O@CMIIJKMM@PcaShowDialog?$AA@
0x18000C3C8: "__cdecl _imp__vsnwprintf" __imp__vsnwprintf
0x180003FD0: "long __cdecl WdiDiagnosticModuleMain(void * __ptr64,enum WDI_DIAGNOSTIC_MODULE_REQUEST)" ?WdiDiagnosticModuleMain@@YAJPEAXW4WDI_DIAGNOSTIC_MODULE_REQUEST@@@Z
0x18000C2C0: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x18000D428: "ProgramFilesDir" ??_C@_1CA@BENHECIP@?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAF?$AAi?$AAl?$AAe?$AAs?$AAD?$AAi?$AAr?$AA?$AA@
0x18000EEEC: "__cdecl _IMPORT_DESCRIPTOR_KERNEL32" __IMPORT_DESCRIPTOR_KERNEL32
0x18000C590: "__cdecl _imp_WdiGetParameterData" __imp_WdiGetParameterData
0x1800075B8: AslRegistryBuildMachinePath
0x180002334: "__cdecl _security_init_cookie" __security_init_cookie
0x18000CAD0: "AslEnvGetProcessWowInfo failed [" ??_C@_0CE@JCOOOONA@AslEnvGetProcessWowInfo?5failed?5?$FL@
0x1800032B4: "unsigned long __cdecl PcaDiagnoseCreate(unsigned __int64 * __ptr64)" ?PcaDiagnoseCreate@@YAKPEA_K@Z
0x18000DA98: "WdiGetParameterData failed [%d]" ??_C@_0CA@ELBBKDAO@WdiGetParameterData?5failed?5?$FL?$CFd?$FN?$AA@
0x18000EEC4: "__cdecl _IMPORT_DESCRIPTOR_msvcrt" __IMPORT_DESCRIPTOR_msvcrt
0x18000D5D0: "PcaDiagnoseCreate" ??_C@_0BC@IPGHKDGK@PcaDiagnoseCreate?$AA@
0x18000C3F8: "__cdecl _imp_memmove" __imp_memmove
0x18000D638: "PCA diagnostic module unloaded" ??_C@_0BP@DLHCIAHL@PCA?5diagnostic?5module?5unloaded?$AA@
0x18000263E: GetCurrentThreadId
0x18000C7E0: "PcaTokenPack" ??_C@_0N@BFFCDIHG@PcaTokenPack?$AA@
0x180002662: CreateFileW
0x18000C430: "__cdecl _imp_malloc" __imp_malloc
0x18000C228: ADVAPI32_NULL_THUNK_DATA
0x18000C220: "__cdecl _imp_EventUnregister" __imp_EventUnregister
0x18000C320: "__cdecl _imp_WriteFile" __imp_WriteFile
0x18000C268: "__cdecl _imp_GetTickCount64" __imp_GetTickCount64
0x1800107D8: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUzkkxlnkzgUxzxsvUrmgviuzxvUoryUlyquivUznwGEUxlnkzgxzxsvkOlyq@compatcache" __@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUzkkxlnkzgUxzxsvUrmgviuzxvUoryUlyquivUznwGEUxlnkzgxzxsvkOlyq@compatcache
0x180005494: "long __cdecl RtlStringCchVPrintfA(char * __ptr64,unsigned __int64,char const * __ptr64,char * __ptr64)" ?RtlStringCchVPrintfA@@YAJPEAD_KPEBD0@Z
0x18000C4F0: "__cdecl _imp_RtlDeleteCriticalSection" __imp_RtlDeleteCriticalSection
0x18000DD18: "Failed to create stream from buf" ??_C@_0CJ@FANJDGCC@Failed?5to?5create?5stream?5from?5buf@
0x18000C7C0: "Failed to write token [%d]" ??_C@_0BL@OLEEODAL@Failed?5to?5write?5token?5?$FL?$CFd?$FN?$AA@
0x180002480: "__cdecl _report_gsfailure" __report_gsfailure
0x18000C4B8: "__cdecl _imp_EtwEventWrite" __imp_EtwEventWrite
0x180003AB0: "long __cdecl DM_Troubleshoot(void * __ptr64)" ?DM_Troubleshoot@@YAJPEAX@Z
0x180002184: "__cdecl onexit" _onexit
0x180001AE0: "unsigned long __cdecl Redirector_Detect(int * __ptr64,int * __ptr64,int * __ptr64,unsigned __int64,struct _EVENT_RECORD * __ptr64,unsigned __int64)" ?Redirector_Detect@@YAKPEAH00_KPEAU_EVENT_RECORD@@1@Z
0x180010730: "__cdecl _native_startup_state" __native_startup_state
0x18000D198: "ntdll.dll" ??_C@_1BE@GJOFHIHD@?$AAn?$AAt?$AAd?$AAl?$AAl?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x1800089B8: "public: void __cdecl RtlNameValueArray::Free(void) __ptr64" ?Free@RtlNameValueArray@@QEAAXXZ
0x18000DB10: "Failed to add Wdi parameter [%d]" ??_C@_0CB@KDJBILFK@Failed?5to?5add?5Wdi?5parameter?5?$FL?$CFd?$FN@
0x180004F34: "void __cdecl AslLogpFinalizeBuffer(char * __ptr64,unsigned __int64)" ?AslLogpFinalizeBuffer@@YAXPEAD_K@Z
0x180001530: AslLogPrintf
0x18000C550: pcacli_NULL_THUNK_DATA
0x18000C568: "__cdecl _imp_WdiSetProblemDetectionResult" __imp_WdiSetProblemDetectionResult
0x180008A04: "public: long __cdecl RtlNameValueArray::Insert(unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned __int64) __ptr64" ?Insert@RtlNameValueArray@@QEAAJPEBG00_K@Z
0x18000DCE0: "Failed to create Diagnose [%d]" ??_C@_0BP@BPFDMANF@Failed?5to?5create?5Diagnose?5?$FL?$CFd?$FN?$AA@
0x1800099B8: AslEnvBuildBasic
0x18000CA88: "AslRegistryGetUInt32" ??_C@_0BF@GLMGGLJH@AslRegistryGetUInt32?$AA@
0x18000CC00: "AslRegistryGetKey" ??_C@_0BC@FAHHPEFC@AslRegistryGetKey?$AA@
0x18000C300: WTSAPI32_NULL_THUNK_DATA
0x18000CF00: "AslpEnvResolveVars" ??_C@_0BD@FJEPFPIH@AslpEnvResolveVars?$AA@
0x18000C588: "__cdecl _imp_WdiGetParameterByName" __imp_WdiGetParameterByName
0x180006DC0: AslpTelemetryAppend
0x1800037A0: "long __cdecl ULongLongMult(unsigned __int64,unsigned __int64,unsigned __int64 * __ptr64)" ?ULongLongMult@@YAJ_K0PEA_K@Z
0x18000752C: AslFileGetLongVersionForCurrentModule
0x18000C438: "__cdecl _imp_free" __imp_free
0x18000CDB0: "AslStringDuplicate failed with "" ??_C@_0CJ@BMHBNALG@AslStringDuplicate?5failed?5with?5?$CC@
0x180007310: TraceLoggingSetInformation
0x18000D3F8: "CommonProgramFiles(x86)" ??_C@_1DA@NDENMJEC@?$AAC?$AAo?$AAm?$AAm?$AAo?$AAn?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAF?$AAi?$AAl?$AAe?$AAs?$AA?$CI?$AAx?$AA8?$AA6?$AA?$CJ?$AA?$AA@
0x1800022A0: "__cdecl IsNonwritableInCurrentImage" _IsNonwritableInCurrentImage
0x18000DC28: "WdiSetResolution failed [%d]" ??_C@_0BN@PAKBBEMG@WdiSetResolution?5failed?5?$FL?$CFd?$FN?$AA@
0x18000DD88: AE_DEBUG_EVENT
0x18000C490: "__cdecl _imp_ZwOpenKey" __imp_ZwOpenKey
0x180002745: memset
0x18000EFDC: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x18000DD58: "Failed to read stream [%d]" ??_C@_0BL@OJHIFGGO@Failed?5to?5read?5stream?5?$FL?$CFd?$FN?$AA@
0x18000D380: "CommonFilesDir" ??_C@_1BO@HALHHILJ@?$AAC?$AAo?$AAm?$AAm?$AAo?$AAn?$AAF?$AAi?$AAl?$AAe?$AAs?$AAD?$AAi?$AAr?$AA?$AA@
0x18000D698: "Bad event size [%d]" ??_C@_0BE@NNFPNKGC@Bad?5event?5size?5?$FL?$CFd?$FN?$AA@

[JEB Decompiler by PNF Software]