Generated by JEB on 2019/08/01

PE: C:\Windows\System32\RemoveDeviceElevated.dll Base=0x180000000 SHA-256=54963728B389F1E254EFD9E9C58968AFFC6DEED6619DEC4A8067EF51609AA899
PDB: RemoveDeviceElevated.pdb GUID={2B76A7AA-70DA-501C-3DF3960D8E96EA0F} Age=1

180 located named symbols:
0x1800018EC: "__cdecl _raise_securityfailure" __raise_securityfailure
0x180001700: "__cdecl FindPESection" _FindPESection
0x1800025C8: "__cdecl _imp_IUnknown_Release_Proxy" __imp_IUnknown_Release_Proxy
0x180004010: "__cdecl _security_cookie_complement" __security_cookie_complement
0x1800025A0: "__cdecl _imp_IUnknown_QueryInterface_Proxy" __imp_IUnknown_QueryInterface_Proxy
0x1800011DC: "__cdecl CRT_INIT" _CRT_INIT
0x180002688: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x180001CC0: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x180001AF0: ObjectStublessClient3
0x180001C40: HICON_UserFree
0x180001070: DllGetClassObject
0x1800025F0: "__cdecl _imp_IUnknown_AddRef_Proxy" __imp_IUnknown_AddRef_Proxy
0x180002798: "__cdecl _imp_HWND_UserUnmarshal64" __imp_HWND_UserUnmarshal64
0x180002020: removedeviceelevated_ProxyFileInfo
0x1800025D8: "__cdecl _imp_NdrOleFree" __imp_NdrOleFree
0x1800027A8: ole32_NULL_THUNK_DATA
0x1800027B8: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x180001B30: CStdStubBuffer_CountRefs
0x1800025B0: "__cdecl _imp_CStdStubBuffer_DebugServerRelease" __imp_CStdStubBuffer_DebugServerRelease
0x1800016E4: "__cdecl XcptFilter" _XcptFilter
0x1800027C0: "__cdecl _xc_a" __xc_a
0x1800045A0: gPFactory
0x180001BA0: CStdStubBuffer_Connect
0x180002608: "__cdecl _imp_NdrDllGetClassObject" __imp_NdrDllGetClassObject
0x180001B70: CStdStubBuffer_Disconnect
0x180002768: "__cdecl _imp_HWND_UserSize" __imp_HWND_UserSize
0x180001C20: HWND_UserSize64
0x180002778: "__cdecl _imp_HICON_UserSize64" __imp_HICON_UserSize64
0x1800018BF: "__cdecl initterm" _initterm
0x180001BB0: HICON_UserUnmarshal
0x180002ED8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0
0x1800045E8: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x1800026C8: "__cdecl _imp_Sleep" __imp_Sleep
0x1800027E0: "__cdecl _xi_z" __xi_z
0x180002650: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x1800018CB: "__cdecl _C_specific_handler" __C_specific_handler
0x1800010C0: DllCanUnloadNow
0x1800028C0: IID_IRemoveDeviceElevatedHandler
0x1800016F0: "__cdecl amsg_exit" _amsg_exit
0x180002480: "__cdecl removedeviceelevated_ProxyVtblList" _removedeviceelevated_ProxyVtblList
0x1800028D0: "IRemoveDeviceElevatedHandler" ??_C@_0BN@LHLFCOCI@IRemoveDeviceElevatedHandler?$AA@
0x180001C30: HWND_UserSize
0x180001AD0: IUnknown_AddRef_Proxy
0x180001010: "__cdecl removedeviceelevated_IID_Lookup" _removedeviceelevated_IID_Lookup
0x1800025C0: "__cdecl _imp_CStdStubBuffer_CountRefs" __imp_CStdStubBuffer_CountRefs
0x180002658: api-ms-win-core-errorhandling-l1-1-0_NULL_THUNK_DATA
0x180002680: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x180002730: "__cdecl _imp_HWND_UserUnmarshal" __imp_HWND_UserUnmarshal
0x1800045D8: "__cdecl _native_startup_lock" __native_startup_lock
0x1800010F4: DllMain
0x180002200: "__cdecl IRemoveDeviceElevatedHandlerProxyVtbl" _IRemoveDeviceElevatedHandlerProxyVtbl
0x180002600: "__cdecl _imp_NdrDllRegisterProxy" __imp_NdrDllRegisterProxy
0x180002610: "__cdecl _imp_NdrDllCanUnloadNow" __imp_NdrDllCanUnloadNow
0x1800026F0: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x1800026A8: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x180002668: api-ms-win-core-libraryloader-l1-2-0_NULL_THUNK_DATA
0x1800010E0: CStdStubBuffer_Release
0x180002638: "__cdecl _imp_ObjectStublessClient3" __imp_ObjectStublessClient3
0x180004000: "__cdecl _native_dllmain_reason" __native_dllmain_reason
0x180002750: "__cdecl _imp_HWND_UserFree64" __imp_HWND_UserFree64
0x180002640: api-ms-win-core-com-midlproxystub-l1-1-0_NULL_THUNK_DATA
0x180002E88: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-com-midlproxystub-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-com-midlproxystub-l1-1-0
0x180002678: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x180002738: "__cdecl _imp_HICON_UserMarshal64" __imp_HICON_UserMarshal64
0x1800017B0: "__cdecl ValidateImageBase" _ValidateImageBase
0x180001B60: CStdStubBuffer_DebugServerRelease
0x180002E60: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0
0x180001B80: IUnknown_QueryInterface_Proxy
0x180002F14: "__cdecl _IMPORT_DESCRIPTOR_ole32" __IMPORT_DESCRIPTOR_ole32
0x180002780: "__cdecl _imp_HICON_UserSize" __imp_HICON_UserSize
0x180002350: "__cdecl removedeviceelevated_InterfaceNamesList" _removedeviceelevated_InterfaceNamesList
0x1800025A8: "__cdecl _imp_CStdStubBuffer_Disconnect" __imp_CStdStubBuffer_Disconnect
0x180001420: "__cdecl DllMainCRTStartup" _DllMainCRTStartup
0x1800026F8: "__cdecl _imp__initterm" __imp__initterm
0x180001B50: NdrOleAllocate
0x1800023E0: "__cdecl removedeviceelevated_StubVtblList" _removedeviceelevated_StubVtblList
0x180001CA0: HICON_UserFree64
0x1800045C8: "__cdecl _onexitend" __onexitend
0x1800027B0: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x180002670: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x1800025B8: "__cdecl _imp_CStdStubBuffer_QueryInterface" __imp_CStdStubBuffer_QueryInterface
0x1800025F8: "__cdecl _imp_NdrDllUnregisterProxy" __imp_NdrDllUnregisterProxy
0x1800026E8: api-ms-win-core-sysinfo-l1-1-0_NULL_THUNK_DATA
0x1800027D0: "__cdecl _xi_a" __xi_a
0x180002010: aProxyFileList
0x1800026D8: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x180002618: "__cdecl _imp_NdrCStdStubBuffer_Release" __imp_NdrCStdStubBuffer_Release
0x180002740: "__cdecl _imp_HWND_UserFree" __imp_HWND_UserFree
0x180002EC4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0
0x180001B90: CStdStubBuffer_IsIIDSupported
0x1800045F0: "__cdecl pRawDllMain" _pRawDllMain
0x180001C60: HICON_UserSize
0x180002748: "__cdecl _imp_HICON_UserMarshal" __imp_HICON_UserMarshal
0x180001160: DllUnregisterServer
0x180002190: "__cdecl IRemoveDeviceElevatedHandlerStubVtbl" _IRemoveDeviceElevatedHandlerStubVtbl
0x1800016C0: "__cdecl _security_check_cookie" __security_check_cookie
0x180001BC0: HWND_UserUnmarshal
0x1800027C8: "__cdecl _xc_z" __xc_z
0x180002690: api-ms-win-core-processthreads-l1-1-0_NULL_THUNK_DATA
0x1800026E0: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x180001AE0: CStdStubBuffer_DebugServerQueryInterface
0x1800026C0: api-ms-win-core-rtlsupport-l1-1-0_NULL_THUNK_DATA
0x1800025D0: "__cdecl _imp_CStdStubBuffer_AddRef" __imp_CStdStubBuffer_AddRef
0x180002598: "__cdecl _imp_NdrOleAllocate" __imp_NdrOleAllocate
0x180002EEC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0
0x1800026A0: api-ms-win-core-profile-l1-1-0_NULL_THUNK_DATA
0x1800027E8: "__cdecl _guard_fids_table" __guard_fids_table
0x180002720: msvcrt_NULL_THUNK_DATA
0x180002490: "__cdecl load_config_used" _load_config_used
0x180002788: "__cdecl _imp_HWND_UserMarshal" __imp_HWND_UserMarshal
0x180001AC0: CStdStubBuffer_Invoke
0x180002710: "__cdecl _imp__amsg_exit" __imp__amsg_exit
0x180001BD0: HICON_UserMarshal64
0x180002660: "__cdecl _imp_DisableThreadLibraryCalls" __imp_DisableThreadLibraryCalls
0x1800026B0: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x180002698: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x180002758: "__cdecl _imp_HICON_UserUnmarshal64" __imp_HICON_UserUnmarshal64
0x180001C00: HWND_UserFree64
0x180001C80: HWND_UserMarshal64
0x1800026B8: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x1800027A0: "__cdecl _imp_HICON_UserFree64" __imp_HICON_UserFree64
0x1800018E0: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x180001040: GetProxyDllInfo
0x180002760: "__cdecl _imp_HWND_UserSize64" __imp_HWND_UserSize64
0x180002790: "__cdecl _imp_HWND_UserMarshal64" __imp_HWND_UserMarshal64
0x180002718: "__cdecl _imp__XcptFilter" __imp__XcptFilter
0x1800045C0: hProxyDll
0x180001B40: CStdStubBuffer_QueryInterface
0x180001C10: HICON_UserUnmarshal64
0x180001B20: IUnknown_Release_Proxy
0x180004008: "__cdecl _security_cookie" __security_cookie
0x180001B10: CStdStubBuffer_AddRef
0x180002628: "__cdecl _imp_CStdStubBuffer_IsIIDSupported" __imp_CStdStubBuffer_IsIIDSupported
0x180001BF0: HICON_UserMarshal
0x180002F00: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0
0x1800025E8: "__cdecl _imp_CStdStubBuffer_DebugServerQueryInterface" __imp_CStdStubBuffer_DebugServerQueryInterface
0x1800045D0: "__cdecl _onexitbegin" __onexitbegin
0x180001BE0: HWND_UserFree
0x180002648: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x180002728: "__cdecl _imp_HICON_UserUnmarshal" __imp_HICON_UserUnmarshal
0x1800017E4: "__cdecl _security_init_cookie" __security_init_cookie
0x180001C50: HICON_UserSize64
0x180002E4C: "__cdecl _IMPORT_DESCRIPTOR_msvcrt" __IMPORT_DESCRIPTOR_msvcrt
0x180002700: "__cdecl _imp_malloc" __imp_malloc
0x180002E74: "__cdecl _IMPORT_DESCRIPTOR_RPCRT4" __IMPORT_DESCRIPTOR_RPCRT4
0x180002630: RPCRT4_NULL_THUNK_DATA
0x180001930: "__cdecl _report_gsfailure" __report_gsfailure
0x1800045E0: "__cdecl _native_startup_state" __native_startup_state
0x180002620: "__cdecl _imp_CStdStubBuffer_Invoke" __imp_CStdStubBuffer_Invoke
0x1800025E0: "__cdecl _imp_CStdStubBuffer_Connect" __imp_CStdStubBuffer_Connect
0x180001120: DllRegisterServer
0x180002EB0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0
0x180001C90: HWND_UserUnmarshal64
0x180001C70: HWND_UserMarshal
0x180002708: "__cdecl _imp_free" __imp_free
0x180001750: "__cdecl IsNonwritableInCurrentImage" _IsNonwritableInCurrentImage
0x1800026D0: api-ms-win-core-synch-l1-2-0_NULL_THUNK_DATA
0x180001B00: NdrOleFree
0x180002E9C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0
0x180002F28: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x180002770: "__cdecl _imp_HICON_UserFree" __imp_HICON_UserFree

[JEB Decompiler by PNF Software]