Generated by JEB on 2019/08/01

PE: C:\Windows\System32\drivers\SleepStudyHelper.sys Base=0x1C0000000 SHA-256=5053D5C1EC624F7399AC7B9AB90F934110A07B119C2B60AED348D08714470E4C
PDB: SleepStudyHelper.pdb GUID={8E660F12-CBB9-99C5-1DEF5B03B9D26FD3} Age=1

247 located named symbols:
0x1C0001B8C: WPP_RECORDER_SF_qII
0x1C00032A0: SleepstudyHelper_AcquireComponentLock
0x1C0004420: WppClassicProviderCallback
0x1C0004520: DllUnload
0x1C0001ABC: WPP_RECORDER_SF_qI
0x1C0006098: "__cdecl _security_cookie_complement" __security_cookie_complement
0x1C00091D0: WppTraceCallback
0x1C0008058: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x1C0004630: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x1C0008098: "__cdecl _imp_PoRegisterPowerSettingCallback" __imp_PoRegisterPowerSettingCallback
0x1C0005338: "__cdecl TraceLoggingMetadata" _TraceLoggingMetadata
0x1C0002950: SleepstudyHelper_RegisterPdoWithParentHandle
0x1C0005228: "WmiTraceMessage" ??_C@_1CA@OFIBBPKJ@?$AAW?$AAm?$AAi?$AAT?$AAr?$AAa?$AAc?$AAe?$AAM?$AAe?$AAs?$AAs?$AAa?$AAg?$AAe?$AA?$AA@
0x1C00080D0: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x1C0003DF0: "long __cdecl SleepstudyHelper_IdleResiliencySettingCallback(struct _GUID const * __ptr64,void * __ptr64,unsigned long,void * __ptr64)" ?SleepstudyHelper_IdleResiliencySettingCallback@@YAJPEBU_GUID@@PEAXK1@Z
0x1C0008020: WppRecorder_NULL_THUNK_DATA
0x1C0008088: "__cdecl _imp_MmGetSystemRoutineAddress" __imp_MmGetSystemRoutineAddress
0x1C0008028: "__cdecl _imp_KeInitializeSpinLock" __imp_KeInitializeSpinLock
0x1C0001C7C: WPP_RECORDER_SF_q_guid__guid_q
0x1C0003574: "void __cdecl SleepstudyHelper_CsStateChange(void * __ptr64,unsigned char,unsigned char)" ?SleepstudyHelper_CsStateChange@@YAXPEAXEE@Z
0x1C00034E0: SleepstudyHelper_ResetComponentsStartTime
0x1C0008038: "__cdecl _imp_KeReleaseSpinLock" __imp_KeReleaseSpinLock
0x1C0004640: memcpy
0x1C00017D4: WPP_RECORDER_SF__guid_
0x1C0001FA8: WPP_RECORDER_SF_qqqq
0x1C00051F0: WNF_PO_SCENARIO_CHANGE
0x1C00060D0: pfnWppGetVersion
0x1C0003190: SleepstudyHelper_ComponentActiveLocked
0x1C0004640: memmove
0x1C00045BC: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x1C0005170: SLEEPSTUDY_EVT_SCENARIO_BLOCKER
0x1C0006120: WPP_MAIN_CB
0x1C00031E0: SleepstudyHelper_ComponentInactive
0x1C0006000: SLEEPSTUDY_ETW_PROVIDER_Context
0x1C00080A0: "__cdecl _imp_EtwSetInformation" __imp_EtwSetInformation
0x1C00080B0: "__cdecl _imp_ExAllocatePoolWithTag" __imp_ExAllocatePoolWithTag
0x1C00012A8: McTemplateK0ujqzr2jx
0x1C00060E8: pfnWppQueryTraceInformation
0x1C0001D98: WPP_RECORDER_SF_q_guid_qq
0x1C00051B0: WPP_e2180e320b0a3d3b35faa2802b270d0c_Traceguids
0x1C00080EC: "__cdecl _IMPORT_DESCRIPTOR_WppRecorder" __IMPORT_DESCRIPTOR_WppRecorder
0x1C0008030: "__cdecl _imp_EtwWriteTransfer" __imp_EtwWriteTransfer
0x1C0005124: "" ??_C@_13BLAPAIAM@?$AA?$AI?$AA?$AA@
0x1C0005168: Microsoft_Windows_SleepStudyLevels
0x1C0004598: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x1C0005208: "PsGetVersion" ??_C@_1BK@DHLDGJM@?$AAP?$AAs?$AAG?$AAe?$AAt?$AAV?$AAe?$AAr?$AAs?$AAi?$AAo?$AAn?$AA?$AA@
0x1C000415C: "public: void __cdecl _SleepstudyInitContext::ReleaseRefAndUnlock(unsigned char) __ptr64" ?ReleaseRefAndUnlock@_SleepstudyInitContext@@QEAAXE@Z
0x1C0004150: "__cdecl TlgDefineProvider_annotation__TlgSleepStudyHelperTraceHandleProv" _TlgDefineProvider_annotation__TlgSleepStudyHelperTraceHandleProv
0x1C0005118: "NULL" ??_C@_19CIJIHAKK@?$AAN?$AAU?$AAL?$AAL?$AA?$AA@
0x1C00060C0: pfnEtwRegisterClassicProvider
0x1C0002540: SleepstudyHelper_Uninitialize
0x1C00014A0: "public: void __cdecl _CS_CONTEXT::ReleaseRef(void) __ptr64" ?ReleaseRef@_CS_CONTEXT@@QEAAXXZ
0x1C00032F0: SleepstudyHelper_ReleaseComponentLock
0x1C0005130: "%wZ (%wZ)" ??_C@_1BE@HJGHEGOE@?$AA?$CF?$AAw?$AAZ?$AA?5?$AA?$CI?$AA?$CF?$AAw?$AAZ?$AA?$CJ?$AA?$AA@
0x1C0002C40: SleepstudyHelper_RegisterComponentEx
0x1C0006108: pfnEtwUnregister
0x1C0008080: "__cdecl _imp_ExQueryWnfStateData" __imp_ExQueryWnfStateData
0x1C000B010: GsDriverEntry
0x1C00080C8: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x1C0001EB8: WPP_RECORDER_SF_qqI
0x1C0001FA8: WPP_RECORDER_SF_qqII
0x1C0001ABC: WPP_RECORDER_SF_qq
0x1C0002AD0: SleepstudyHelper_RegisterPdoWithParentGuid
0x1C0001008: "long __cdecl RtlUnicodeStringPrintf(struct _UNICODE_STRING * __ptr64,unsigned short const * __ptr64,...)" ?RtlUnicodeStringPrintf@@YAJPEAU_UNICODE_STRING@@PEBGZZ
0x1C00020C0: SleepstudyHelper_Initialize
0x1C00042B8: "void __cdecl SleepstudyHelper_UpdateDeviceActiveTime(struct _CS_CONTEXT * __ptr64,unsigned __int64,unsigned __int64)" ?SleepstudyHelper_UpdateDeviceActiveTime@@YAXPEAU_CS_CONTEXT@@_K1@Z
0x1C00011CC: McGenEventWrite
0x1C0006048: WPP_GLOBAL_Control
0x1C0005110: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x1C0009010: "__cdecl TlgEnableCallback" _TlgEnableCallback
0x1C0001550: WPP_RECORDER_SF_
0x1C0001690: WPP_RECORDER_SF_Z
0x1C0004540: "__cdecl _security_check_cookie" __security_check_cookie
0x1C000193C: WPP_RECORDER_SF_q
0x1C00015E4: WPP_RECORDER_SF_I
0x1C0001884: WPP_RECORDER_SF_d
0x1C00080D8: "__cdecl _IMPORT_DESCRIPTOR_ntoskrnl" __IMPORT_DESCRIPTOR_ntoskrnl
0x1C0005493: "__cdecl TraceLoggingMetadataEnd" _TraceLoggingMetadataEnd
0x1C0005148: WPP_ThisDir_CTLGUID_SLEEPSTUDYHELPER
0x1C0002F00: SleepstudyHelper_UnregisterComponent
0x1C0008000: "__cdecl _imp_WppAutoLogStart" __imp_WppAutoLogStart
0x1C00094DC: WppCleanupKm
0x1C0008010: "__cdecl _imp_WppAutoLogStop" __imp_WppAutoLogStop
0x1C0005128: "%wZ" ??_C@_17JJNMJOBL@?$AA?$CF?$AAw?$AAZ?$AA?$AA@
0x1C0008048: "__cdecl _imp_EtwUnregister" __imp_EtwUnregister
0x1C000C000: "__cdecl _guard_fids_table" __guard_fids_table
0x1C0006110: "unsigned __int64 gSleepstudySpinLock" ?gSleepstudySpinLock@@3_KA
0x1C0005000: "__cdecl load_config_used" _load_config_used
0x1C00051A0: WPP_6c0bee8072ac3bd3e144d64a8545df88_Traceguids
0x1C0001274: McGenEventUnregister
0x1C0008070: "__cdecl _imp_ExSubscribeWnfStateChange" __imp_ExSubscribeWnfStateChange
0x1C00030F0: SleepstudyHelper_ComponentActive
0x1C0005248: "WmiQueryTraceInformation" ??_C@_1DC@DOCOAJH@?$AAW?$AAm?$AAi?$AAQ?$AAu?$AAe?$AAr?$AAy?$AAT?$AAr?$AAa?$AAc?$AAe?$AAI?$AAn?$AAf?$AAo?$AAr?$AAm?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x1C00060E0: "struct _SleepstudyGlobalContext * __ptr64 __ptr64 gContext" ?gContext@@3PEAU_SleepstudyGlobalContext@@EA
0x1C00052B8: "EtwUnregister" ??_C@_1BM@CJMKDOJH@?$AAE?$AAt?$AAw?$AAU?$AAn?$AAr?$AAe?$AAg?$AAi?$AAs?$AAt?$AAe?$AAr?$AA?$AA@
0x1C0004580: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x1C0005180: SLEEPSTUDY_ETW_PROVIDER
0x1C0009090: WppLoadTracingSupport
0x1C0008090: "__cdecl _imp_IoWMIRegistrationControl" __imp_IoWMIRegistrationControl
0x1C0008018: "__cdecl _imp_imp_WppRecorderReplay" __imp_imp_WppRecorderReplay
0x1C0003330: SleepstudyHelper_UpdateFriendlyName
0x1C00080A8: "__cdecl _imp_KeAcquireSpinLockRaiseToDpc" __imp_KeAcquireSpinLockRaiseToDpc
0x1C0005190: Microsoft_Windows_SleepStudyKeywords
0x1C0006090: "__cdecl _security_cookie" __security_cookie
0x1C0005158: GUID_PDC_IDLE_RESILIENCY_ENGAGED
0x1C0003914: "void __cdecl SleepstudyHelper_EventWriteSleepStudyBlocker(struct _CS_CONTEXT * __ptr64,unsigned __int64,unsigned char)" ?SleepstudyHelper_EventWriteSleepStudyBlocker@@YAXPEAU_CS_CONTEXT@@_KE@Z
0x1C0003C1C: SleepstudyHelper_GetDeviceStringProperty
0x1C00019E8: WPP_RECORDER_SF_qD
0x1C00019E8: WPP_RECORDER_SF_qd
0x1C00010C0: McGenControlCallbackV2
0x1C0005280: "EtwRegisterClassicProvider" ??_C@_1DG@PFOPAIND@?$AAE?$AAt?$AAw?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAe?$AAr?$AAC?$AAl?$AAa?$AAs?$AAs?$AAi?$AAc?$AAP?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AA?$AA@
0x1C0003FE0: SleepstudyHelper_GetPdoFriendlyName
0x1C0008078: "__cdecl _imp_ExUnsubscribeWnfStateChange" __imp_ExUnsubscribeWnfStateChange
0x1C0004490: DllInitialize
0x1C0001358: "public: void __cdecl _SleepstudyGlobalContext::ReleaseRefAndUnlock(unsigned char) __ptr64" ?ReleaseRefAndUnlock@_SleepstudyGlobalContext@@QEAAXE@Z
0x1C00080B8: "__cdecl _imp__vsnwprintf" __imp__vsnwprintf
0x1C000B044: "__cdecl _security_init_cookie" __security_init_cookie
0x1C00051C0: "unsigned __int64 * SleepstudyHelperAccountingBucketLimits" ?SleepstudyHelperAccountingBucketLimits@@3PA_KA
0x1C0008060: "__cdecl _imp_EtwRegister" __imp_EtwRegister
0x1C00026A0: SleepstudyHelper_GenerateGuid
0x1C00060D8: WPPTraceSuite
0x1C0001234: McGenEventRegister
0x1C0004360: "long __cdecl SleepstudyHelper_WnfPdcCallback(struct _EX_WNF_SUBSCRIPTION * __ptr64,struct _WNF_STATE_NAME const * __ptr64,unsigned long,unsigned long,struct _WNF_TYPE_ID const * __ptr64,void * __ptr64)" ?SleepstudyHelper_WnfPdcCallback@@YAJPEAU_EX_WNF_SUBSCRIPTION@@PEBU_WNF_STATE_NAME@@KKPEBU_WNF_TYPE_ID@@PEAX@Z
0x1C00051F8: GUID_SPM_LOW_POWER_CS
0x1C0004570: "__cdecl _report_gsfailure" __report_gsfailure
0x1C0008008: "__cdecl _imp_WppAutoLogTrace" __imp_WppAutoLogTrace
0x1C00080C0: ntoskrnl_NULL_THUNK_DATA
0x1C0008068: "__cdecl _imp_ExFreePoolWithTag" __imp_ExFreePoolWithTag
0x1C0006100: Microsoft_Windows_SleepStudyEnableBits
0x1C000447C: DriverEntry
0x1C0008040: "__cdecl _imp_PoUnregisterPowerSettingCallback" __imp_PoUnregisterPowerSettingCallback
0x1C00027C0: SleepstudyHelper_RegisterPdoWithParentPdo
0x1C0004248: "long __cdecl SleepstudyHelper_InitializeComponentPdo(struct SS_COMPONENT__ * __ptr64,struct _DEVICE_OBJECT * __ptr64)" ?SleepstudyHelper_InitializeComponentPdo@@YAJPEAUSS_COMPONENT__@@PEAU_DEVICE_OBJECT@@@Z
0x1C00060C8: pfnWppTraceMessage
0x1C0009424: WppInitKm
0x1C0004980: memset
0x1C0008100: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x1C0008050: "__cdecl _imp_IoGetDeviceProperty" __imp_IoGetDeviceProperty

[JEB Decompiler by PNF Software]