Generated by JEB on 2019/08/01

PE: C:\Windows\System32\fthsvc.dll Base=0x180000000 SHA-256=5566F88561FBA836E6A3748EE7FC78C88E86F77E1F4E83826332A0160231D512
PDB: fthsvc.pdb GUID={42351501-F7B5-C5F0-8A895F7963DBCEDC} Age=1

702 located named symbols:
0x18000B750: "FthServerTalkToClient" ??_C@_0BG@GLAFFDPJ@FthServerTalkToClient?$AA@
0x18000CA00: "IsListEmpty(&(Application->Bucke" ??_C@_0CI@CNCNKCMB@IsListEmpty?$CI?$CG?$CIApplication?9?$DOBucke@
0x18000E288: "FthServer.Heap != NULL" ??_C@_0BH@CIJGKBLE@FthServer?4Heap?5?$CB?$DN?5NULL?$AA@
0x180005260: FthApplicationCreateAndTrack
0x18000C6A0: "Failed to convert ModVer descrip" ??_C@_0CK@NILJDIOC@Failed?5to?5convert?5ModVer?5descrip@
0x18000DA08: "CrashWindowInMinutes" ??_C@_1CK@GLDBFPK@?$AAC?$AAr?$AAa?$AAs?$AAh?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAI?$AAn?$AAM?$AAi?$AAn?$AAu?$AAt?$AAe?$AAs?$AA?$AA@
0x180008F90: "__cdecl _raise_securityfailure" __raise_securityfailure
0x18000A4B8: "__cdecl _imp_EvtSubscribe" __imp_EvtSubscribe
0x18000CB30: "Maximum reached before creating " ??_C@_0EK@BLKAONE@Maximum?5reached?5before?5creating?5@
0x18000D268: "FthApplicationTableHash" ??_C@_0BI@KGBLHDFD@FthApplicationTableHash?$AA@
0x18000A408: "__cdecl _imp_EtwUnregisterTraceGuids" __imp_EtwUnregisterTraceGuids
0x180009160: "__cdecl FindPESection" _FindPESection
0x18000A790: "Overlapped != NULL && Overlapped" ??_C@_0DB@BKMJGGIP@Overlapped?5?$CB?$DN?5NULL?5?$CG?$CG?5Overlapped@
0x18000D798: "Failed to save checkpoint (open)" ??_C@_0CC@BJDAHKIK@Failed?5to?5save?5checkpoint?5?$CIopen?$CJ@
0x18000BCD0: "SQM: DP: FTH_CLIENT_STATS: [%ws]" ??_C@_0CB@IONPMJIE@SQM?3?5DP?3?5FTH_CLIENT_STATS?3?5?$FL?$CFws?$FN@
0x18000E4B0: "fthempty.txt" ??_C@_1BK@OODNDOLC@?$AAf?$AAt?$AAh?$AAe?$AAm?$AAp?$AAt?$AAy?$AA?4?$AAt?$AAx?$AAt?$AA?$AA@
0x18000C5F8: "Failed to convert AppStamp descr" ??_C@_0CM@JLHAICBL@Failed?5to?5convert?5AppStamp?5descr@
0x180008A00: "__cdecl _delayLoadHelper2" __delayLoadHelper2
0x18000F1BC: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x18000CBE0: "FthApplicationUpdateTicket" ??_C@_0BL@KIILDEOE@FthApplicationUpdateTicket?$AA@
0x180011240: FthCounter
0x18000CF48: "No or invalid ticket from Watson" ??_C@_0CH@HPMCFIOB@No?5or?5invalid?5ticket?5from?5Watson@
0x180010E20: FthErrorHistory
0x180010020: "__cdecl _security_cookie_complement" __security_cookie_complement
0x18000A2A8: "__cdecl _imp_GetNamedPipeClientProcessId" __imp_GetNamedPipeClientProcessId
0x18000D6E0: "FthRegistryWriteRecord" ??_C@_0BH@HHPGKOLK@FthRegistryWriteRecord?$AA@
0x18000BAB0: "Failed to impersonate client pro" ??_C@_0CG@HCJIKMDK@Failed?5to?5impersonate?5client?5pro@
0x18000A1F0: "__cdecl _imp_HeapDestroy" __imp_HeapDestroy
0x180013000: "__cdecl _imp_SetPermLayerState" __imp_SetPermLayerState
0x18000AF00: " Tracked applications: %u" ??_C@_0BN@PLFDAPOG@?5?5?5?5Tracked?5applications?3?5?$CFu?$AA@
0x18000C310: "FTH_APPLICATION_GET_STATE(Applic" ??_C@_0ED@DHCCLPMO@FTH_APPLICATION_GET_STATE?$CIApplic@
0x180008884: FthTraceEnter
0x18000B140: "main thread: received die soon s" ??_C@_0CH@HNLPHPEO@main?5thread?3?5received?5die?5soon?5s@
0x180008A7C: "__cdecl CRT_INIT" _CRT_INIT
0x18000B0A0: "FthServerMainThreadFunction" ??_C@_0BM@FIONMOCP@FthServerMainThreadFunction?$AA@
0x18000E488: "Failed to create temp directory." ??_C@_0CB@NAJMMEEG@Failed?5to?5create?5temp?5directory?4@
0x18000A2B8: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x18000A7F0: "Pipe read message timed out. " ??_C@_0BO@KOHOIHMO@Pipe?5read?5message?5timed?5out?4?6?$AA@
0x18000ADE8: "FthServerDump" ??_C@_0O@KABCHBOE@FthServerDump?$AA@
0x18000DC10: "Server failed to read persisted " ??_C@_0EA@NBCCDCGO@Server?5failed?5to?5read?5persisted?5@
0x18000D2C8: "Table->NumberOfEntries == 0" ??_C@_0BM@CFGLGCGH@Table?9?$DONumberOfEntries?5?$DN?$DN?50?$AA@
0x18000A418: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x18000D460: "Will keep the server running. Ap" ??_C@_0EH@MJPCENNN@Will?5keep?5the?5server?5running?4?5Ap@
0x18000E598: WPP_c1f5139257cf30be1c732954e7e4193e_Traceguids
0x180001010: WppControlCallback
0x18000D568: "Forgetting tracking application " ??_C@_0DI@GGBOFEPG@Forgetting?5tracking?5application?5@
0x180009500: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x18000D9C8: "Failed to read registry value." ??_C@_0BP@MPNLOPB@Failed?5to?5read?5registry?5value?4?$AA@
0x1800050CC: FthApplicationCreate
0x18000D258: "Name != NULL" ??_C@_0N@OPPAFMNA@Name?5?$CB?$DN?5NULL?$AA@
0x18000ABE0: "PartiallyInitialized == TRUE" ??_C@_0BN@MFLFHODE@PartiallyInitialized?5?$DN?$DN?5TRUE?$AA@
0x18000CC38: "FTH_APPLICATION_IS_REFERENCED(Ap" ??_C@_0DE@OOAPDJLM@FTH_APPLICATION_IS_REFERENCED?$CIAp@
0x18000A170: "__cdecl _imp_CreateFileW" __imp_CreateFileW
0x18000BA18: "Tracking denied: system memory p" ??_C@_0CJ@KKFMOCDG@Tracking?5denied?3?5system?5memory?5p@
0x18000A4B0: "__cdecl _imp_EvtCreateRenderContext" __imp_EvtCreateRenderContext
0x18000BDD8: "Process->Application != NULL" ??_C@_0BN@HKJFBHAN@Process?9?$DOApplication?5?$CB?$DN?5NULL?$AA@
0x180003A78: FthTrackedProcessMarkDead
0x18000A150: "__cdecl _imp_GetProcessTimes" __imp_GetProcessTimes
0x18000B7D0: "Server disconnected from pipe." ??_C@_0BP@CMNCJEBL@Server?5disconnected?5from?5pipe?4?$AA@
0x18000CF90: "Deleting temporary directory: %w" ??_C@_0CC@KIHFOKLG@Deleting?5temporary?5directory?3?5?$CFw@
0x18000CEB0: "Failed to setup callback: %x:%x" ??_C@_0CA@DCOGCIIC@Failed?5to?5setup?5callback?3?5?$CFx?3?$CFx?$AA@
0x180005ACC: FthApplicationIsFthCandidate
0x18000A1A8: "__cdecl _imp_RemoveDirectoryW" __imp_RemoveDirectoryW
0x180005F58: FthApplicationTableCreate
0x18000A3A8: "__cdecl _imp_wcstoul" __imp_wcstoul
0x18000DB20: "MaximumDelayFreeOverheadInMBs" ??_C@_1DM@EIKGGKAM@?$AAM?$AAa?$AAx?$AAi?$AAm?$AAu?$AAm?$AAD?$AAe?$AAl?$AAa?$AAy?$AAF?$AAr?$AAe?$AAe?$AAO?$AAv?$AAe?$AAr?$AAh?$AAe?$AAa?$AAd?$AAI?$AAn?$AAM?$AAB?$AAs?$AA?$AA@
0x18000AC78: "Server->DieSoonEvent" ??_C@_0BF@LIBJIKMK@Server?9?$DODieSoonEvent?$AA@
0x18000D5A0: "Software\Microsoft\FTH" ??_C@_1CO@DNIHMEME@?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAF?$AAT?$AAH?$AA?$AA@
0x18000A3F8: "__cdecl _imp_EtwGetTraceLoggerHandle" __imp_EtwGetTraceLoggerHandle
0x18000E6A8: "__cdecl _pfnDliFailureHook2" __pfnDliFailureHook2
0x18000DD78: "FthServerRegistryReadRuleList" ??_C@_0BO@EAFBEINK@FthServerRegistryReadRuleList?$AA@
0x18000A318: "__cdecl _imp_RegDeleteKeyExW" __imp_RegDeleteKeyExW
0x18000D610: "FthRegistryDeleteKey" ??_C@_0BF@PKMHHLCI@FthRegistryDeleteKey?$AA@
0x1800053C0: FthApplicationFind
0x18000CB80: "Failed to create tracking struct" ??_C@_0DL@GECIHBPA@Failed?5to?5create?5tracking?5struct@
0x18000E5D0: "FthEventLogOpen" ??_C@_0BA@GHPLGLAC@FthEventLogOpen?$AA@
0x18000A380: "__cdecl _imp_sprintf_s" __imp_sprintf_s
0x18000E370: "FTH: ASSERT: %s(%u): %s" ??_C@_0BI@KDFJMCKL@FTH?3?5ASSERT?3?5?$CFs?$CI?$CFu?$CJ?3?5?$CFs?$AA@
0x18000A2F8: "__cdecl _imp_RegEnumValueW" __imp_RegEnumValueW
0x18000C4A8: "FthBucketCreate" ??_C@_0BA@EINLHHEE@FthBucketCreate?$AA@
0x18000A280: "__cdecl _imp_CancelIo" __imp_CancelIo
0x18000C4B8: "PropertyCount == 1" ??_C@_0BD@MOGOBAFL@PropertyCount?5?$DN?$DN?51?$AA@
0x18000A210: "__cdecl _imp_SetEvent" __imp_SetEvent
0x1800105C0: "__cdecl _hmod__wdi_dll" __hmod__wdi_dll
0x18000A6E0: "request: resolve" ??_C@_0BB@HPBBPOIG@request?3?5resolve?$AA@
0x18000AEA8: " MaximumFreeOverhead: %u" ??_C@_0BM@LFCGHDFN@?5?5?5?5MaximumFreeOverhead?3?5?$CFu?$AA@
0x18000B030: "Failed to create NT native pipe:" ??_C@_0CM@FFPJHAKD@Failed?5to?5create?5NT?5native?5pipe?3@
0x18000A4D8: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x180011410: FthInitialized
0x18000CA70: " References: %u" ??_C@_0BD@HPDPNIKL@?5?5?5?5References?3?5?$CFu?$AA@
0x1800014A8: FthServerStartup
0x18000BED0: "IsListEmpty(&(Process->Link))" ??_C@_0BO@DMDBIAKP@IsListEmpty?$CI?$CG?$CIProcess?9?$DOLink?$CJ?$CJ?$AA@
0x18000846C: FthCreateEmptyFile
0x18000A260: "__cdecl _imp_InitializeCriticalSection" __imp_InitializeCriticalSection
0x18000BF40: "FthTrackedProcessFindApplication" ??_C@_0CB@IKABAFAB@FthTrackedProcessFindApplication@
0x18000A3C0: "__cdecl _imp__wcsnicmp" __imp__wcsnicmp
0x18000A330: "__cdecl _imp_RevertToSelf" __imp_RevertToSelf
0x18000B930: "Logging process with FTH enabled" ??_C@_0CP@BFODGMFK@Logging?5process?5with?5FTH?5enabled@
0x18000CED0: "Failed to submit report: %x:%x" ??_C@_0BP@DONPGPMI@Failed?5to?5submit?5report?3?5?$CFx?3?$CFx?$AA@
0x18000E5A8: "Event register failed with error" ??_C@_0CE@HNEIBNPL@Event?5register?5failed?5with?5error@
0x18000D3B0: "FthApplicationTableFindCandidate" ??_C@_0CC@IAGJGOHB@FthApplicationTableFindCandidate@
0x18000D5F8: "FthRegistryOpenKey" ??_C@_0BD@NBKJHIPM@FthRegistryOpenKey?$AA@
0x18000A398: "__cdecl _imp_vsprintf_s" __imp_vsprintf_s
0x18000C998: "FTH_APPLICATION_IS_REFERENCED(Ap" ??_C@_0DE@KEPLIINJ@FTH_APPLICATION_IS_REFERENCED?$CIAp@
0x18000D038: "Watson Ticket Value is [%X]" ??_C@_0BM@JOHEOPNI@Watson?5Ticket?5Value?5is?5?$FL?$CFX?$FN?$AA@
0x180006140: FthApplicationTableDump
0x18000C888: "[???]" ??_C@_1M@MAJNDNPB@?$AA?$FL?$AA?$DP?$AA?$DP?$AA?$DP?$AA?$FN?$AA?$AA@
0x18000CBC0: "val > 0" ??_C@_07JECLOAHE@val?5?$DO?50?$AA@
0x18000BA78: "FthServerFlushTerminationQueue" ??_C@_0BP@MDPMMEFE@FthServerFlushTerminationQueue?$AA@
0x18000C2D0: "Dropped bucket could not create " ??_C@_0DK@FJNAMDFI@Dropped?5bucket?5could?5not?5create?5@
0x18000BA98: "FthTrackedProcessCreate" ??_C@_0BI@HLPFCBFG@FthTrackedProcessCreate?$AA@
0x180009147: "__cdecl XcptFilter" _XcptFilter
0x18000E3A8: "FthSplitMultiString" ??_C@_0BE@BOOFCENI@FthSplitMultiString?$AA@
0x18000A4E0: "__cdecl _xc_a" __xc_a
0x18000AF88: " *** TRACKED APPLICATIONS ***" ??_C@_0CB@EGFMAIHM@?5?5?5?5?$CK?$CK?$CK?5TRACKED?5APPLICATIONS?5?$CK?$CK?$CK@
0x18000A3A0: "__cdecl _imp_wcsstr" __imp_wcsstr
0x18000CA48: "FthApplicationDump" ??_C@_0BD@KLNLNKHB@FthApplicationDump?$AA@
0x18000B0C0: "Server->DieSoonEvent != NULL" ??_C@_0BN@IEAHLCBP@Server?9?$DODieSoonEvent?5?$CB?$DN?5NULL?$AA@
0x18000BC98: "%s, %u.%u.%u.%u, %d, %d " ??_C@_1DC@GKJCOGF@?$AA?$CF?$AAs?$AA?0?$AA?5?$AA?$CF?$AAu?$AA?4?$AA?$CF?$AAu?$AA?4?$AA?$CF?$AAu?$AA?4?$AA?$CF?$AAu?$AA?0?$AA?5?$AA?$CF?$AAd?$AA?0?$AA?5?$AA?$CF?$AAd?$AA?6?$AA?$AA@
0x180001A30: FthServerShutdown
0x180004408: FthServerDispatchPendingBuckets
0x18000B560: "Server failed to disconnect from" ??_C@_0EN@KFCMNGBA@Server?5failed?5to?5disconnect?5from@
0x18000A6C8: "request: troubleshoot" ??_C@_0BG@MLIJHGHD@request?3?5troubleshoot?$AA@
0x18000C1A8: "Dropped bucket for excluded appl" ??_C@_0CP@GMKGHMPL@Dropped?5bucket?5for?5excluded?5appl@
0x18000B340: "FTH server tracking thread is sh" ??_C@_0CN@JDFDKMIG@FTH?5server?5tracking?5thread?5is?5sh@
0x18000A940: "Server is disabled (after regist" ??_C@_0DE@DDGILLPM@Server?5is?5disabled?5?$CIafter?5regist@
0x180004938: StringCchCopyW
0x18000A8F0: "Failed to open event log." ??_C@_0BK@HPMNKBGO@Failed?5to?5open?5event?5log?4?$AA@
0x18000C390: "Application->TicketMaximum == Se" ??_C@_0DC@PKGEAIOK@Application?9?$DOTicketMaximum?5?$DN?$DN?5Se@
0x18000B538: "FTH client connection detected." ??_C@_0CA@GCJNFKLK@FTH?5client?5connection?5detected?4?$AA@
0x18000DDF8: "Failed to enable FTH shim layer." ??_C@_0CB@ENMKEHMI@Failed?5to?5enable?5FTH?5shim?5layer?4@
0x18000C490: "FthServerFindCandidates" ??_C@_0BI@MADENDFN@FthServerFindCandidates?$AA@
0x18000A1A0: "__cdecl _imp_DeleteFileW" __imp_DeleteFileW
0x18000E558: "FthServer.Heap == NULL" ??_C@_0BH@DICIFNA@FthServer?4Heap?5?$DN?$DN?5NULL?$AA@
0x18000A554: "__cdecl _guard_iat_table" __guard_iat_table
0x18000D0B8: "FthApplicationEnableFth" ??_C@_0BI@EJIKBBJF@FthApplicationEnableFth?$AA@
0x18000A388: "__cdecl _imp__get_errno" __imp__get_errno
0x18000A9E0: "O:LSG:LSD:P(A;;FA;;;LS)(A;;FRFW;" ??_C@_1GK@OPAGKEML@?$AAO?$AA?3?$AAL?$AAS?$AAG?$AA?3?$AAL?$AAS?$AAD?$AA?3?$AAP?$AA?$CI?$AAA?$AA?$DL?$AA?$DL?$AAF?$AAA?$AA?$DL?$AA?$DL?$AA?$DL?$AAL?$AAS?$AA?$CJ?$AA?$CI?$AAA?$AA?$DL?$AA?$DL?$AAF?$AAR?$AAF?$AAW?$AA?$DL@
0x18000C9D0: "FthApplicationCreate" ??_C@_0BF@BLCHPCMF@FthApplicationCreate?$AA@
0x18000B218: "Starting forget cycle for applic" ??_C@_0CL@MIDBCIHE@Starting?5forget?5cycle?5for?5applic@
0x18000C748: "Failed to get excode field from " ??_C@_0DI@EDKACAOD@Failed?5to?5get?5excode?5field?5from?5@
0x18000A158: "__cdecl _imp_GetTempFileNameW" __imp_GetTempFileNameW
0x18000A3D0: "__cdecl _imp_memset" __imp_memset
0x18000A220: "__cdecl _imp_CreateEventW" __imp_CreateEventW
0x18000931F: "__cdecl initterm" _initterm
0x18000733C: FthApplicationIsShimEnabled
0x1800105F8: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x18000A148: "__cdecl _imp_Sleep" __imp_Sleep
0x18000CD08: "Failed to get WER Report consent" ??_C@_0CH@JHGINCFG@Failed?5to?5get?5WER?5Report?5consent@
0x18000A500: "__cdecl _xi_z" __xi_z
0x18000A1D0: "__cdecl _imp_GetSystemTime" __imp_GetSystemTime
0x18000DF48: "State" ??_C@_1M@LAGHHMEN@?$AAS?$AAt?$AAa?$AAt?$AAe?$AA?$AA@
0x18000C4D0: "Properties[0].Type == (EVT_VARIA" ??_C@_0EC@NMBIFOAD@Properties?$FL0?$FN?4Type?5?$DN?$DN?5?$CIEVT_VARIA@
0x18000A140: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x18000A3E8: "__cdecl _imp_EtwRegisterTraceGuidsW" __imp_EtwRegisterTraceGuidsW
0x180008F84: "__cdecl _C_specific_handler" __C_specific_handler
0x18000B528: "Wait failed." ??_C@_0N@GBBCOAJN@Wait?5failed?4?$AA@
0x18000C3C8: "Dropped bucket for disabled appl" ??_C@_0CP@MLEOCIKE@Dropped?5bucket?5for?5disabled?5appl@
0x1800036B0: FthTrackedProcessCreate
0x18000B980: "FTH_APPLICATION_IS_REFERENCED(Tr" ??_C@_0DC@OMHDPKFH@FTH_APPLICATION_IS_REFERENCED?$CITr@
0x18000E408: "FthCreateEmptyFile" ??_C@_0BD@FDJBOKFO@FthCreateEmptyFile?$AA@
0x18000A5E8: "Failed to get diagnostic module " ??_C@_0CM@MECHCKAP@Failed?5to?5get?5diagnostic?5module?5@
0x1800072EC: FthApplicationDisableShim
0x18000D738: "FthServerLoadApplicationsState" ??_C@_0BP@OAAGNAM@FthServerLoadApplicationsState?$AA@
0x18000A188: "__cdecl _imp_HeapFree" __imp_HeapFree
0x18000AEC8: " MaximumWatsonOverhead: %u" ??_C@_0BO@BNINOBKC@?5?5?5?5MaximumWatsonOverhead?3?5?$CFu?$AA@
0x180011408: WPP_REGISTRATION_GUIDS
0x18000AC90: "Server->MainThread" ??_C@_0BD@HGFMENJN@Server?9?$DOMainThread?$AA@
0x18000E4E0: "Failed to create the empty file " ??_C@_0CN@JPPJMOIG@Failed?5to?5create?5the?5empty?5file?5@
0x18000B840: "Process 0x%X(%u) trying to conne" ??_C@_0EA@OEIEPBEH@Process?50x?$CFX?$CI?$CFu?$CJ?5trying?5to?5conne@
0x18000B730: "Unexpected wait return value." ??_C@_0BO@MGMBNKDO@Unexpected?5wait?5return?5value?4?$AA@
0x18000D940: "Enabled" ??_C@_1BA@NPJPKIM@?$AAE?$AAn?$AAa?$AAb?$AAl?$AAe?$AAd?$AA?$AA@
0x18000B5B0: "Tracking thread was signalled to" ??_C@_0CG@HLEKAIMP@Tracking?5thread?5was?5signalled?5to@
0x18000A1D8: "__cdecl _imp_GlobalMemoryStatusEx" __imp_GlobalMemoryStatusEx
0x18000CAA0: " Maximum ticket: %u" ??_C@_0BH@PKBBJOEN@?5?5?5?5Maximum?5ticket?3?5?$CFu?$AA@
0x18000A320: "__cdecl _imp_RegCloseKey" __imp_RegCloseKey
0x180009480: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x1800013B0: WdiHandleInstance
0x18000C6D0: "Failed to get ModStamp field fro" ??_C@_0DK@CGNEANKO@Failed?5to?5get?5ModStamp?5field?5fro@
0x18000A810: "FthPipeWriteMessage" ??_C@_0BE@HANPDDNI@FthPipeWriteMessage?$AA@
0x18000A580: "process attach" ??_C@_0P@IKJEDDFB@process?5attach?$AA@
0x18000BAD8: "Failed to open FTH client PID %u" ??_C@_0CM@DLMOKBAM@Failed?5to?5open?5FTH?5client?5PID?5?$CFu@
0x18000D2F8: "FthApplicationTableSize" ??_C@_0BI@MOOALION@FthApplicationTableSize?$AA@
0x18000BB08: "Failed to duplicate remote memor" ??_C@_0DE@IMMOKIGF@Failed?5to?5duplicate?5remote?5memor@
0x18000D190: "FthApplicationDisableFth" ??_C@_0BJ@LMKMLAKH@FthApplicationDisableFth?$AA@
0x1800021F4: FthServerDump
0x1800113E0: WPP_MAIN_CB
0x18000A9A8: "Failed to allocate a process tra" ??_C@_0DB@JIBLCJJM@Failed?5to?5allocate?5a?5process?5tra@
0x18000C7B0: "Failed to get offset field from " ??_C@_0DI@GCOLGBHI@Failed?5to?5get?5offset?5field?5from?5@
0x18000F248: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0
0x180005E3C: FthApplicationDisableFth
0x18000A308: "__cdecl _imp_RegSetValueExW" __imp_RegSetValueExW
0x180009153: "__cdecl amsg_exit" _amsg_exit
0x18000E678: "GetProcessTimes failed with erro" ??_C@_0CF@NEBMMOMM@GetProcessTimes?5failed?5with?5erro@
0x1800088C4: FthTraceExit
0x18000D3D8: "FthApplicationTableForgetApplica" ??_C@_0CG@ONDCHBCF@FthApplicationTableForgetApplica@
0x18000D390: " windir: %ws" ??_C@_0BA@FFHNJMHI@?5?5?5?5windir?3?5?$CFws?$AA@
0x18000BDB0: "Process->InformationHandle != NU" ??_C@_0CD@EICNPOJO@Process?9?$DOInformationHandle?5?$CB?$DN?5NU@
0x18000E6A0: "__cdecl _DefaultResolveDelayLoadedAPIFlags" __DefaultResolveDelayLoadedAPIFlags
0x18000B2A0: "FthServerTrackingThreadFunction" ??_C@_0CA@EEOMMFDK@FthServerTrackingThreadFunction?$AA@
0x18000A6F8: FTH_EVENT_STOP_SUCCESS_EVENT
0x18000AF68: " *** PENDING BUCKETS ***" ??_C@_0BM@KEGAODKJ@?5?5?5?5?$CK?$CK?$CK?5PENDING?5BUCKETS?5?$CK?$CK?$CK?$AA@
0x18000D868: "Failed to forget checkpoint (del" ??_C@_0CG@FCJHGJGN@Failed?5to?5forget?5checkpoint?5?$CIdel@
0x18000B1F0: "CurrentTime >= Server->CheckPoin" ??_C@_0CG@IDLDDCJE@CurrentTime?5?$DO?$DN?5Server?9?$DOCheckPoin@
0x18000BFF8: "Failed to render event: error %u" ??_C@_0CC@IEFOGHFJ@Failed?5to?5render?5event?3?5error?5?$CFu@
0x18000B8C8: "Server failed to write 'permissi" ??_C@_0DJ@HCCDNFIN@Server?5failed?5to?5write?5?8permissi@
0x18000CC88: "FthApplicationGetWatsonParameter" ??_C@_0CC@OKCCCGCI@FthApplicationGetWatsonParameter@
0x18000AD60: "FthCounter[FTH_SERVER_HEAP_ALLOC" ??_C@_0EI@EICNHPBG@FthCounter?$FLFTH_SERVER_HEAP_ALLOC@
0x18000A420: "__cdecl _imp_NtCreateNamedPipeFile" __imp_NtCreateNamedPipeFile
0x18000C668: "Failed to get ModVer field from " ??_C@_0DI@OBGBJBPL@Failed?5to?5get?5ModVer?5field?5from?5@
0x18000E388: "Strings[StringsIndex] == NULL" ??_C@_0BO@FAALIIIB@Strings?$FLStringsIndex?$FN?5?$DN?$DN?5NULL?$AA@
0x18000DC98: "Failed to read FTH server exclus" ??_C@_0DA@NGPKMIJB@Failed?5to?5read?5FTH?5server?5exclus@
0x18000E2B0: "Heap allocation for %u bytes fai" ??_C@_0DC@JPGCCLGJ@Heap?5allocation?5for?5?$CFu?5bytes?5fai@
0x18000E5E0: "Event unregister failed with err" ??_C@_0CG@JKLAJLGM@Event?5unregister?5failed?5with?5err@
0x18000CF70: "Deleting temporary file: %ws" ??_C@_0BN@FGNEKOKD@Deleting?5temporary?5file?3?5?$CFws?$AA@
0x18000B248: "New server checkpoint time saved" ??_C@_0CC@FNPHKJKI@New?5server?5checkpoint?5time?5saved@
0x18000BE98: "FTH_APPLICATION_IS_REFERENCED(Pr" ??_C@_0DE@LIPBOBNF@FTH_APPLICATION_IS_REFERENCED?$CIPr@
0x18000A3B8: "__cdecl _imp_towlower" __imp_towlower
0x18000A978: "Failed to allocate wait handles " ??_C@_0CL@JBHFDDCN@Failed?5to?5allocate?5wait?5handles?5@
0x18000A250: "__cdecl _imp_EnterCriticalSection" __imp_EnterCriticalSection
0x18000A328: api-ms-win-core-registry-l1-1-0_NULL_THUNK_DATA
0x18000C8A0: " bucket: [%ws] %ws, %u.%u.%u." ??_C@_0FB@HIKONAPF@?5?5?5?5bucket?3?5?$FL?$CFws?$FN?5?$CFws?0?5?$CFu?4?$CFu?4?$CFu?4@
0x18000E160: "{6bba3851-2c7e-4dea-8f54-31e5afd" ??_C@_1FC@IPCHNAAI@?$AA?$HL?$AA6?$AAb?$AAb?$AAa?$AA3?$AA8?$AA5?$AA1?$AA?9?$AA2?$AAc?$AA7?$AAe?$AA?9?$AA4?$AAd?$AAe?$AAa?$AA?9?$AA8?$AAf?$AA5?$AA4?$AA?9?$AA3?$AA1?$AAe?$AA5?$AAa?$AAf?$AAd@
0x18000B000: "Failed to create FTH pipe securi" ??_C@_0CP@LLBGOOGF@Failed?5to?5create?5FTH?5pipe?5securi@
0x18000A290: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x18000C868: "FthBucketDestroy" ??_C@_0BB@HCMLBEGG@FthBucketDestroy?$AA@
0x18000CEF0: "Watson Report Submitted: GLE: [%" ??_C@_0DE@CMDEFMAC@Watson?5Report?5Submitted?3?5GLE?3?5?$FL?$CF@
0x1800105E8: "__cdecl _native_startup_lock" __native_startup_lock
0x180001098: DllMain
0x18000A7C8: "Failed to read message from the " ??_C@_0CH@BKCAEFIN@Failed?5to?5read?5message?5from?5the?5@
0x18000A640: "FTH server started." ??_C@_0BE@HECFBECA@FTH?5server?5started?4?$AA@
0x18000DD60: "RuleList" ??_C@_1BC@JIDBAIEA@?$AAR?$AAu?$AAl?$AAe?$AAL?$AAi?$AAs?$AAt?$AA?$AA@
0x180002460: FthServerCreateNtNativePipe
0x180009346: "__cdecl _imp_load_WdiGetDiagnosticModuleId" __imp_load_WdiGetDiagnosticModuleId
0x18000F20C: "__cdecl _IMPORT_DESCRIPTOR_wer" __IMPORT_DESCRIPTOR_wer
0x18000BF68: "Event/EventData/Data" ??_C@_1CK@CMMNCFGG@?$AAE?$AAv?$AAe?$AAn?$AAt?$AA?1?$AAE?$AAv?$AAe?$AAn?$AAt?$AAD?$AAa?$AAt?$AAa?$AA?1?$AAD?$AAa?$AAt?$AAa?$AA?$AA@
0x18000B798: "Server failed to disconnect from" ??_C@_0DB@KJNDPKPM@Server?5failed?5to?5disconnect?5from@
0x18000AC50: "SQM: DP: FTH_SERVER_INFO: FAILED" ??_C@_0CH@FHAJAODN@SQM?3?5DP?3?5FTH_SERVER_INFO?3?5FAILED@
0x18000A3B0: "__cdecl _imp__wcsicmp" __imp__wcsicmp
0x18000CFD8: "Watson Ticket Value string [%S]" ??_C@_0CA@ELCIKNFM@Watson?5Ticket?5Value?5string?5?$FL?$CFS?$FN?$AA@
0x18000A350: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x18000E4D0: "%s\%s" ??_C@_1M@DFKENGJN@?$AA?$CF?$AAs?$AA?2?$AA?$CF?$AAs?$AA?$AA@
0x18000A2C0: "__cdecl _imp_ResumeThread" __imp_ResumeThread
0x18000A450: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x18000A2D0: KERNEL32_NULL_THUNK_DATA
0x18000D5D0: "Registry operation failed with e" ??_C@_0CI@NLKCJPDL@Registry?5operation?5failed?5with?5e@
0x18000BFC0: "Failed to create reder context f" ??_C@_0DE@ELDKKKJK@Failed?5to?5create?5reder?5context?5f@
0x180006974: FthServerSaveCheckPoint
0x18000A198: "__cdecl _imp_GetWindowsDirectoryW" __imp_GetWindowsDirectoryW
0x18000D950: "Server disabled in the registry " ??_C@_0DP@FKIPHJFN@Server?5disabled?5in?5the?5registry?5@
0x18000A410: "__cdecl _imp_WinSqmAddToStream" __imp_WinSqmAddToStream
0x180004230: FthServerEventSubscriptionCallback
0x18000A218: "__cdecl _imp_GetLastError" __imp_GetLastError
0x18000A240: "__cdecl _imp_DuplicateHandle" __imp_DuplicateHandle
0x180011420: FthLock
0x180010010: "__cdecl _native_dllmain_reason" __native_dllmain_reason
0x18000945C: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x180002620: FthServerMainThreadFunction
0x180011220: FthErrorHistoryIndex
0x18000B3A8: "FthServerWaitForConnections" ??_C@_0BM@GGHMGDJN@FthServerWaitForConnections?$AA@
0x1800093D1: "__cdecl _imp_load_SetPermLayerState" __imp_load_SetPermLayerState
0x18000A6B0: "request: detect problem" ??_C@_0BI@HKBOPDME@request?3?5detect?5problem?$AA@
0x18000A430: "__cdecl _imp_EtwTraceMessage" __imp_EtwTraceMessage
0x18000ACA8: "Server->TrackingThread" ??_C@_0BH@GCBJDBPH@Server?9?$DOTrackingThread?$AA@
0x18000BD40: "%u.%u.%u.%u" ??_C@_1BI@IEJCOLMP@?$AA?$CF?$AAu?$AA?4?$AA?$CF?$AAu?$AA?4?$AA?$CF?$AAu?$AA?4?$AA?$CF?$AAu?$AA?$AA@
0x1800080BC: FthSplitMultiString
0x18000A468: "__cdecl _imp_WerpGetReportConsent" __imp_WerpGetReportConsent
0x18000B1D0: "Server->CheckPointTime > 0" ??_C@_0BL@EKAAECGP@Server?9?$DOCheckPointTime?5?$DO?50?$AA@
0x18000B168: "main thread: received work queue" ??_C@_0CK@OFOAKMPG@main?5thread?3?5received?5work?5queue@
0x1800077FC: FthApplicationForgetTicket
0x18000A180: "__cdecl _imp_OutputDebugStringA" __imp_OutputDebugStringA
0x18000A898: "(null)" ??_C@_1O@CEDCILHN@?$AA?$CI?$AAn?$AAu?$AAl?$AAl?$AA?$CJ?$AA?$AA@
0x18000A120: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x18000D330: " *** APPLICATION TABLE (#buck" ??_C@_0EG@CCNNNGPO@?5?5?5?5?$CK?$CK?$CK?5APPLICATION?5TABLE?5?$CI?$CDbuck@
0x18000DEC0: "SOFTWARE\Microsoft\Windows NT\Cu" ??_C@_1IG@JCJPDGOE@?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAN?$AAT?$AA?2?$AAC?$AAu@
0x18000A2B0: "__cdecl _imp_WaitForSingleObject" __imp_WaitForSingleObject
0x18000C8F8: "FthBucketDump" ??_C@_0O@GCJIHKNC@FthBucketDump?$AA@
0x18000E2F0: "*RealBlock == FTH_SERVER_MAGIC_M" ??_C@_0CG@CAICD@?$CKRealBlock?5?$DN?$DN?5FTH_SERVER_MAGIC_M@
0x18000E360: " " ??_C@_01EEMJAFIK@?6?$AA@
0x18000D0F0: "FthApplicationIsShimEnabled(Appl" ??_C@_0DI@FCIKDPGP@FthApplicationIsShimEnabled?$CIAppl@
0x18000EFEC: "__cdecl _DELAY_IMPORT_DESCRIPTOR_wdi_dll" __DELAY_IMPORT_DESCRIPTOR_wdi_dll
0x180004120: FthTrackedProcessDestroy
0x18000A2E8: "__cdecl _imp_RegDeleteValueW" __imp_RegDeleteValueW
0x18000E6A0: "__cdecl _ResolveDelayLoadedAPIFlags" __ResolveDelayLoadedAPIFlags
0x180009210: "__cdecl ValidateImageBase" _ValidateImageBase
0x18000D8E0: "Server disabled because DevOverr" ??_C@_0FP@BLAEPPDH@Server?5disabled?5because?5DevOverr@
0x18000AF20: " Exclude string: %ws" ??_C@_0BI@NPMJKCCB@?5?5?5?5Exclude?5string?3?5?$CFws?$AA@
0x180005018: FthRuleDump
0x18000E348: "FTH: ERROR: %s(%u): " ??_C@_0BF@EGBMOION@FTH?3?5ERROR?3?5?$CFs?$CI?$CFu?$CJ?3?5?$AA@
0x18000A118: "__cdecl _imp_TerminateThread" __imp_TerminateThread
0x18000DAA0: "MaximumMemoryPressurePercentage" ??_C@_1EA@JODMHDEF@?$AAM?$AAa?$AAx?$AAi?$AAm?$AAu?$AAm?$AAM?$AAe?$AAm?$AAo?$AAr?$AAy?$AAP?$AAr?$AAe?$AAs?$AAs?$AAu?$AAr?$AAe?$AAP?$AAe?$AAr?$AAc?$AAe?$AAn?$AAt?$AAa?$AAg?$AAe?$AA?$AA@
0x18000E080: "Keyword" ??_C@_1BA@DJIMNDKE@?$AAK?$AAe?$AAy?$AAw?$AAo?$AAr?$AAd?$AA?$AA@
0x180010A20: FthMessageHistory
0x18000F068: wdi_NULL_THUNK_DATA_DLN
0x18000A598: "process detach" ??_C@_0P@BACGMNMI@process?5detach?$AA@
0x18000D280: "IsListEmpty(&(Table->Bucket[Inde" ??_C@_0CF@NEHMPFLN@IsListEmpty?$CI?$CG?$CITable?9?$DOBucket?$FLInde@
0x18000C518: "Failed to allocate bucket object" ??_C@_0CB@PHGGANGL@Failed?5to?5allocate?5bucket?5object@
0x18000BB40: "Section" ??_C@_1BA@LHDKDEEN@?$AAS?$AAe?$AAc?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x180002EC0: FthServerTalkToClient
0x18000A390: "__cdecl _imp__set_errno" __imp__set_errno
0x18000A178: "__cdecl _imp_GetTempPathW" __imp_GetTempPathW
0x18000A480: "__cdecl _imp_WerReportCloseHandle" __imp_WerReportCloseHandle
0x18000D628: "FthRegistryDeleteValue" ??_C@_0BH@PNDFNJKI@FthRegistryDeleteValue?$AA@
0x18000A168: "__cdecl _imp_HeapAlloc" __imp_HeapAlloc
0x1800086A0: FthSysprepSpecialize
0x1800062F4: FthApplicationTableForgetApplications
0x18000CC00: "DeadProcess->State == FTH_TRACKE" ??_C@_0DF@EGKNIPOJ@DeadProcess?9?$DOState?5?$DN?$DN?5FTH_TRACKE@
0x18000F02C: "__cdecl _NULL_DELAY_IMPORT_DESCRIPTOR" __NULL_DELAY_IMPORT_DESCRIPTOR
0x18000ADA8: "FTH server has successfully shut" ??_C@_0CH@JEOCOKGI@FTH?5server?5has?5successfully?5shut@
0x18000A228: "__cdecl _imp_OpenProcess" __imp_OpenProcess
0x18000DC70: "FthServerRegistryReadExclusionLi" ??_C@_0CD@JMPFMGFE@FthServerRegistryReadExclusionLi@
0x18000D310: "FthApplicationTableFind" ??_C@_0BI@GENEJKPC@FthApplicationTableFind?$AA@
0x18000C428: "Inserted bucket for newly tracke" ??_C@_0DF@CGGCJNGG@Inserted?5bucket?5for?5newly?5tracke@
0x18000A8A8: "FthServerStartup" ??_C@_0BB@CPCFAFDI@FthServerStartup?$AA@
0x180008CC0: "__cdecl DllMainCRTStartup" _DllMainCRTStartup
0x18000A358: "__cdecl _imp__initterm" __imp__initterm
0x18000B6E0: "Server failed to disconnect from" ??_C@_0EO@PDDHLLMK@Server?5failed?5to?5disconnect?5from@
0x18000D640: "FthRegistryReadNumber" ??_C@_0BG@JKEPNNDK@FthRegistryReadNumber?$AA@
0x18000D6F8: "Software\Microsoft\FTH\State" ??_C@_1DK@KAMGJGAN@?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAF?$AAT?$AAH?$AA?2?$AAS?$AAt?$AAa?$AAt?$AAe?$AA?$AA@
0x18000C080: "*[System/Level=2 and System/Even" ??_C@_1LG@LONNBDD@?$AA?$CK?$AA?$FL?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?1?$AAL?$AAe?$AAv?$AAe?$AAl?$AA?$DN?$AA2?$AA?5?$AAa?$AAn?$AAd?$AA?5?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?1?$AAE?$AAv?$AAe?$AAn@
0x18000C250: "Inserted bucket for tracked appl" ??_C@_0CP@KKGPNHLB@Inserted?5bucket?5for?5tracked?5appl@
0x180004F5C: FthBucketDump
0x18000A470: "__cdecl _imp_WerReportCreate" __imp_WerReportCreate
0x180011260: FthServer
0x18000AC30: "SQM: DP: FTH_SERVER_INFO: [%ws]" ??_C@_0CA@PEIHHKBC@SQM?3?5DP?3?5FTH_SERVER_INFO?3?5?$FL?$CFws?$FN?$AA@
0x18000C87C: "[]" ??_C@_15BBBDHBBH@?$AA?$FL?$AA?$FN?$AA?$AA@
0x1800093DD: "__cdecl _tailMerge_apphelp_dll" __tailMerge_apphelp_dll
0x18000A658: "Attempting to shutdown FTH serve" ??_C@_0CG@BEBKMDKG@Attempting?5to?5shutdown?5FTH?5serve@
0x18000E2A0: "FthAlloc" ??_C@_08MAFALDHD@FthAlloc?$AA@
0x18000F220: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0
0x18000A8C0: "Failed to create private server " ??_C@_0DA@DCOMJLFJ@Failed?5to?5create?5private?5server?5@
0x1800088FC: FthLogAppEnabledEvent
0x18000D070: "FthApplicationIsFthCandidate" ??_C@_0BN@DALPPKBN@FthApplicationIsFthCandidate?$AA@
0x18000CE70: "TempFileName: %ws" ??_C@_0BC@HFNDGGMB@TempFileName?3?5?$CFws?$AA@
0x18000B3C8: "Server connected to pipe." ??_C@_0BK@BPABBLJN@Server?5connected?5to?5pipe?4?$AA@
0x180001428: StringCchPrintfW
0x18000AAE0: "Failed to create tracking thread" ??_C@_0CC@DLOKNCEN@Failed?5to?5create?5tracking?5thread@
0x18000F058: apphelp_NULL_THUNK_DATA_DLN
0x1800105D8: "__cdecl _onexitend" __onexitend
0x18000A200: "__cdecl _imp_CreateThread" __imp_CreateThread
0x180007934: FthDeleteWdiStartEventKey
0x18000A4D0: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x18000AE08: " allocs/frees: %u %u" ??_C@_0BI@GEGKJKAK@?5?5?5?5allocs?1frees?3?5?$CFu?5?$CFu?$AA@
0x18000CDF8: "Application TimeStamp" ??_C@_1CM@DAEBFPIP@?$AAA?$AAp?$AAp?$AAl?$AAi?$AAc?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?5?$AAT?$AAi?$AAm?$AAe?$AAS?$AAt?$AAa?$AAm?$AAp?$AA?$AA@
0x18000D7D8: "CheckPointTime" ??_C@_1BO@LGPPGMAM@?$AAC?$AAh?$AAe?$AAc?$AAk?$AAP?$AAo?$AAi?$AAn?$AAt?$AAT?$AAi?$AAm?$AAe?$AA?$AA@
0x18000E27C: "NULL" ??_C@_04HIBGFPH@NULL?$AA@
0x18000A130: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x18000D378: "FthApplicationTableDump" ??_C@_0BI@CIDDEILJ@FthApplicationTableDump?$AA@
0x18000A680: "FTH server shut down." ??_C@_0BG@BBNCHPFI@FTH?5server?5shut?5down?4?$AA@
0x18000E468: "Failed to delete temp file." ??_C@_0BM@HKGDIKK@Failed?5to?5delete?5temp?5file?4?$AA@
0x180005C98: FthApplicationEnableFth
0x18000A458: "__cdecl _imp_EtwEventRegister" __imp_EtwEventRegister
0x1800039B0: FthTrackedProcessMarkAlive
0x18000AE88: " MaximumAllocOverhead: %u" ??_C@_0BN@IBDJJBLF@?5?5?5?5MaximumAllocOverhead?3?5?$CFu?$AA@
0x18000CD30: "Bucket AppVer Bogus" ??_C@_0BE@BAEIFNLH@Bucket?5AppVer?5Bogus?$AA@
0x18000DEA0: "FthApplicationDisableShim" ??_C@_0BK@CLFABFPD@FthApplicationDisableShim?$AA@
0x18000BDF8: "*** dead process: %ws" ??_C@_0BG@EIFMFOFL@?$CK?$CK?$CK?5dead?5process?3?5?$CFws?$AA@
0x18000A4F0: "__cdecl _xi_a" __xi_a
0x18000C210: "Dropped bucket for already enabl" ??_C@_0DP@OBBCBMDH@Dropped?5bucket?5for?5already?5enabl@
0x18000A238: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x18000A1C0: "__cdecl _imp_ResolveDelayLoadedAPI" __imp_ResolveDelayLoadedAPI
0x18000A590: "DllMain" ??_C@_07JLKLLPCJ@DllMain?$AA@
0x18000A4C8: wevtapi_NULL_THUNK_DATA
0x18000B9C8: "FthServerShouldAllowTracking" ??_C@_0BN@MPPFILNL@FthServerShouldAllowTracking?$AA@
0x18000E258: "DevOverrideEnable" ??_C@_1CE@KAIDKDBK@?$AAD?$AAe?$AAv?$AAO?$AAv?$AAe?$AAr?$AAr?$AAi?$AAd?$AAe?$AAE?$AAn?$AAa?$AAb?$AAl?$AAe?$AA?$AA@
0x18000CB00: "FthApplicationFind(Server, Path," ??_C@_0DA@JPLKBPLI@FthApplicationFind?$CIServer?0?5Path?0@
0x18000E318: "Corrupted block encountered duri" ??_C@_0CJ@MINLDKBH@Corrupted?5block?5encountered?5duri@
0x1800070F8: FthServerRegistryReadRuleList
0x1800081FC: FthParseVersionString
0x18000A338: api-ms-win-security-base-l1-1-0_NULL_THUNK_DATA
0x18000B768: "Server failed to get client PID:" ??_C@_0CL@EOCGNDDM@Server?5failed?5to?5get?5client?5PID?3@
0x1800051A4: FthApplicationDestroy
0x18000BD58: "FthTrackedProcessTermination" ??_C@_0BN@NIIKMHMF@FthTrackedProcessTermination?$AA@
0x18000BA48: "(Server)->MainThreadId == GetCur" ??_C@_0CP@FLLPCHPO@?$CIServer?$CJ?9?$DOMainThreadId?5?$DN?$DN?5GetCur@
0x18000A738: FTH_EVENT_START_SUCCESS_EVENT
0x18000D400: "Forgetting disabled application:" ??_C@_0CH@EAHGGJAO@Forgetting?5disabled?5application?3@
0x18000DF60: "SYSTEM\CurrentControlSet\Control" ??_C@_1BBO@BONHFCJK@?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA?2?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl@
0x18000B880: "Server->MaximumAllocOverhead > 0" ??_C@_0CB@LMDMBFDM@Server?9?$DOMaximumAllocOverhead?5?$DO?50@
0x18000A718: FTH_EVENT_PROVIDER
0x180013008: apphelp_NULL_THUNK_DATA_DLA
0x18000747C: FthServerForgetAllShimSettings
0x18000BC10: "FthTrackedProcessMarkAlive" ??_C@_0BL@CHIMKPJE@FthTrackedProcessMarkAlive?$AA@
0x18000A728: WPP_ThisDir_CTLGUID_FthWppGuid
0x18000A2E0: api-ms-win-core-namedpipe-l1-1-0_NULL_THUNK_DATA
0x180010000: WPP_GLOBAL_Control
0x180007B7C: FthServerError
0x18000BB50: "Object type is not 'section': %w" ??_C@_0CD@HMFAGCBK@Object?5type?5is?5not?5?8section?8?3?5?$CFw@
0x18000A288: "__cdecl _imp_HeapCreate" __imp_HeapCreate
0x1800105C8: "__cdecl _hmod__apphelp_dll" __hmod__apphelp_dll
0x18000CE88: "Failed to add file to report: %x" ??_C@_0CF@CIHNFCKL@Failed?5to?5add?5file?5to?5report?3?5?$CFx@
0x180010600: "__cdecl pRawDllMain" _pRawDllMain
0x18000A230: "__cdecl _imp_DisconnectNamedPipe" __imp_DisconnectNamedPipe
0x18000D510: "Will keep the server running. Ap" ??_C@_0FB@OECHPMPA@Will?5keep?5the?5server?5running?4?5Ap@
0x18000DA38: "MaximumTrackedProcesses" ??_C@_1DA@FCGMJJGI@?$AAM?$AAa?$AAx?$AAi?$AAm?$AAu?$AAm?$AAT?$AAr?$AAa?$AAc?$AAk?$AAe?$AAd?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AAe?$AAs?$AA?$AA@
0x18000CAE0: "FthApplicationCreateAndTrack" ??_C@_0BN@OEEAJCLI@FthApplicationCreateAndTrack?$AA@
0x18000DE78: "Failed to disable FTH shim layer" ??_C@_0CC@NEDDJDHC@Failed?5to?5disable?5FTH?5shim?5layer@
0x18000C168: "FthServerSubscribeToEvents" ??_C@_0BL@EOHCCFBC@FthServerSubscribeToEvents?$AA@
0x180004F00: FthBucketDestroy
0x180002A20: FthServerTrackingThreadFunction
0x18000C7E8: "Failed to convert modofs descrip" ??_C@_0CK@DICALGNG@Failed?5to?5convert?5modofs?5descrip@
0x18000A270: "__cdecl _imp_DeleteCriticalSection" __imp_DeleteCriticalSection
0x18000D1E8: "Failed to delete the FTH shim ap" ??_C@_0DB@MCDLDBAC@Failed?5to?5delete?5the?5FTH?5shim?5ap@
0x180008F60: "__cdecl _security_check_cookie" __security_check_cookie
0x18000A4E8: "__cdecl _xc_z" __xc_z
0x18000A490: "__cdecl _imp_WerReportSetParameter" __imp_WerReportSetParameter
0x18000D428: "Failed to forget state for appli" ??_C@_0CO@PPELAIOK@Failed?5to?5forget?5state?5for?5appli@
0x180007884: FthCreateWdiStartEventKey
0x18000B270: "FTH server main thread is shutti" ??_C@_0CJ@BGCNALMK@FTH?5server?5main?5thread?5is?5shutti@
0x18000BEF0: "FthTrackedProcessDestroy" ??_C@_0BJ@IBEBELHI@FthTrackedProcessDestroy?$AA@
0x18000B2E8: "Tracking thread got signal it mu" ??_C@_0CI@EAFLGCFC@Tracking?5thread?5got?5signal?5it?5mu@
0x18000E3C0: "Invalid rule descriptor." ??_C@_0BJ@GPNGHOAA@Invalid?5rule?5descriptor?4?$AA@
0x18000A2C8: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x18000E3F8: "Invalid input." ??_C@_0P@CENMEOPL@Invalid?5input?4?$AA@
0x18000C540: "Failed to get AppName field from" ??_C@_0DJ@CMKAFCKF@Failed?5to?5get?5AppName?5field?5from@
0x18000D2A8: "FthApplicationTableDestroy" ??_C@_0BL@JKDNBOPM@FthApplicationTableDestroy?$AA@
0x18000A3F0: "__cdecl _imp_EtwGetTraceEnableLevel" __imp_EtwGetTraceEnableLevel
0x18000A1B8: "__cdecl _imp_DelayLoadFailureHook" __imp_DelayLoadFailureHook
0x180003B80: FthTrackedProcessReportToSQM
0x180013018: wdi_NULL_THUNK_DATA_DLA
0x18000A160: "__cdecl _imp_GetProcessHeap" __imp_GetProcessHeap
0x18000BC58: "FthTrackedProcessMarkDead" ??_C@_0BK@HADJEKDH@FthTrackedProcessMarkDead?$AA@
0x18000DCC8: "Failed to allocate read buffer f" ??_C@_0DD@CDBCNOOE@Failed?5to?5allocate?5read?5buffer?5f@
0x180009520: "__cdecl _chkstk" __chkstk
0x18000C020: "Failed to create a bucket based " ??_C@_0DP@GMHMLELO@Failed?5to?5create?5a?5bucket?5based?5@
0x180001230: WdiDiagnosticModuleMain
0x18000B690: "FTH client process (handle %u) t" ??_C@_0EG@OIGPKMGB@FTH?5client?5process?5?$CIhandle?5?$CFu?$CJ?5t@
0x180007AC4: FthFree
0x180011224: FthMessageHistoryIndex
0x18000A248: "__cdecl _imp_UnmapViewOfFile" __imp_UnmapViewOfFile
0x18000D220: "FTH disabled (ticket %u) for app" ??_C@_0DB@LFIBHCBN@FTH?5disabled?5?$CIticket?5?$CFu?$CJ?5for?5app@
0x18000E3E0: "FthParseRuleString" ??_C@_0BD@BAONPKGH@FthParseRuleString?$AA@
0x18000B960: "Failed to Log AppEnable Event" ??_C@_0BO@KOCCFGII@Failed?5to?5Log?5AppEnable?5Event?$AA@
0x18000D0D0: "Application->Path != NULL" ??_C@_0BK@HJBGCMIJ@Application?9?$DOPath?5?$CB?$DN?5NULL?$AA@
0x18000C628: "Failed to get ModName field from" ??_C@_0DJ@DJDMILNM@Failed?5to?5get?5ModName?5field?5from@
0x18000CE28: "ffffbaad" ??_C@_1BC@BGEMGFLA@?$AAf?$AAf?$AAf?$AAf?$AAb?$AAa?$AAa?$AAd?$AA?$AA@
0x18000B370: "(Server)->ListeningThreadId == G" ??_C@_0DE@IOCHFILD@?$CIServer?$CJ?9?$DOListeningThreadId?5?$DN?$DN?5G@
0x18000D058: "No ticket from Watson" ??_C@_0BG@GCAFANED@No?5ticket?5from?5Watson?$AA@
0x18000E448: "Failed to get temp file." ??_C@_0BJ@BHGNPGOH@Failed?5to?5get?5temp?5file?4?$AA@
0x18000A190: "__cdecl _imp_CreateDirectoryW" __imp_CreateDirectoryW
0x18000CD50: "0.0.0.0" ??_C@_1BA@OJFOBGOM@?$AA0?$AA?4?$AA0?$AA?4?$AA0?$AA?4?$AA0?$AA?$AA@
0x180013010: "__cdecl _imp_WdiGetDiagnosticModuleId" __imp_WdiGetDiagnosticModuleId
0x18000AEE8: " Ticket value: %u" ??_C@_0BF@EBINKMNL@?5?5?5?5Ticket?5value?3?5?$CFu?$AA@
0x18000AAC0: "Failed to create server pipe." ??_C@_0BO@GAPAJKBN@Failed?5to?5create?5server?5pipe?4?$AA@
0x180003D44: FthTrackedProcessTermination
0x18000A1E0: "__cdecl _imp_SystemTimeToFileTime" __imp_SystemTimeToFileTime
0x18000E608: "FthEventLogClose" ??_C@_0BB@FPHCGPBK@FthEventLogClose?$AA@
0x180002AE4: FthServerWaitForConnections
0x18000E620: "Event write failed with error %u" ??_C@_0CB@GMDGJAFF@Event?5write?5failed?5with?5error?5?$CFu@
0x18000ADD0: "*** FTH SERVER DUMP ***" ??_C@_0BI@BIGLNBMD@?$CK?$CK?$CK?5FTH?5SERVER?5DUMP?5?$CK?$CK?$CK?$AA@
0x18000BF10: "FTH_APPLICATION_IS_REFERENCED(Ap" ??_C@_0CL@LAMBDHGO@FTH_APPLICATION_IS_REFERENCED?$CIAp@
0x18000DBC8: "Creating rule object for rule [%" ??_C@_0CF@IIHJBNFN@Creating?5rule?5object?5for?5rule?5?$FL?$CF@
0x18000C280: "Maximum apps reached before crea" ??_C@_0EP@KACIMPJF@Maximum?5apps?5reached?5before?5crea@
0x18000C5B8: "Failed to get AppStamp field fro" ??_C@_0DK@PBIFIOP@Failed?5to?5get?5AppStamp?5field?5fro@
0x18000C988: "FthRuleDump" ??_C@_0M@OFCGIPKL@FthRuleDump?$AA@
0x18000AE20: " MaximumTrackedApplications: " ??_C@_0CD@GMCGAAD@?5?5?5?5MaximumTrackedApplications?3?5@
0x18000AB80: "FTH server startup was successfu" ??_C@_0CD@LOHKNCIA@FTH?5server?5startup?5was?5successfu@
0x18000A508: "__cdecl _guard_fids_table" __guard_fids_table
0x1800066CC: FthRegistryReadNumber
0x18000DBF0: "Rule creation failed." ??_C@_0BG@BCGJKNDJ@Rule?5creation?5failed?4?$AA@
0x18000AA50: "\Device\NamedPipe\ProtectedPrefi" ??_C@_1GO@PFMCBDPG@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAN?$AAa?$AAm?$AAe?$AAd?$AAP?$AAi?$AAp?$AAe?$AA?2?$AAP?$AAr?$AAo?$AAt?$AAe?$AAc?$AAt?$AAe?$AAd?$AAP?$AAr?$AAe?$AAf?$AAi@
0x18000A3D8: msvcrt_NULL_THUNK_DATA
0x18000A010: "__cdecl load_config_used" _load_config_used
0x18000F1D0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-sddl-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-sddl-l1-1-0
0x18000CC70: " Invalid Parameter" ??_C@_0BD@OFMANGKL@?5Invalid?5Parameter?$AA@
0x18000B5E0: "Server failed to disconnect from" ??_C@_0EL@CIJKHJGL@Server?5failed?5to?5disconnect?5from@
0x18000E420: "Failed to get temp path." ??_C@_0BJ@GPOHLAID@Failed?5to?5get?5temp?5path?4?$AA@
0x18000ADF8: " Enabled: %u" ??_C@_0BA@POLEOEIN@?5?5?5?5Enabled?3?5?$CFu?$AA@
0x18000E510: "Failed to open results file." ??_C@_0BN@GNLLGKAK@Failed?5to?5open?5results?5file?4?$AA@
0x18000CA88: " Current ticket: %u" ??_C@_0BH@BACGKOIL@?5?5?5?5Current?5ticket?3?5?$CFu?$AA@
0x18000F0A8: wdi_NULL_THUNK_DATA_DLB
0x18000D6C8: "FthRegistryReadString" ??_C@_0BG@FJELHNDG@FthRegistryReadString?$AA@
0x18000ACC0: "Waiting for the main thread and " ??_C@_0DI@JGNBBPPK@Waiting?5for?5the?5main?5thread?5and?5@
0x18000BC30: "*** TRACKING CLIENT: 0x%X 0x%X 0" ??_C@_0CE@EFHPLDMI@?$CK?$CK?$CK?5TRACKING?5CLIENT?3?50x?$CFX?50x?$CFX?50@
0x18000B908: "Server denied tracking to client" ??_C@_0CC@IKLIMPOO@Server?5denied?5tracking?5to?5client@
0x18000A698: "WdiHandleInstance" ??_C@_0BC@HIABMACD@WdiHandleInstance?$AA@
0x18000CD60: "%08X" ??_C@_19NGFMKOON@?$AA?$CF?$AA0?$AA8?$AAX?$AA?$AA@
0x18000C3F8: "Dropped bucket for enabled appli" ??_C@_0CO@BKNEOJHC@Dropped?5bucket?5for?5enabled?5appli@
0x18000A370: "__cdecl _imp__amsg_exit" __imp__amsg_exit
0x18000C1D8: "Dropped bucket not matching any " ??_C@_0DC@KNNBIGEB@Dropped?5bucket?5not?5matching?5any?5@
0x180007FD4: FthSplitString
0x18000D990: "Server enabled in the registry." ??_C@_0CA@MAMNKLAF@Server?5enabled?5in?5the?5registry?4?$AA@
0x18000CA60: " State: %u" ??_C@_0O@EKKNICPN@?5?5?5?5State?3?5?$CFu?$AA@
0x18000A268: "__cdecl _imp_DisableThreadLibraryCalls" __imp_DisableThreadLibraryCalls
0x1800035E4: FthServerShouldAllowTracking
0x18000D848: "FthServerForgetCheckPoint" ??_C@_0BK@EGAOCBKM@FthServerForgetCheckPoint?$AA@
0x180011230: FthErrorCounter
0x18000DD00: "Failed to read FTH server value." ??_C@_0CB@PHPENMAP@Failed?5to?5read?5FTH?5server?5value?4@
0x18000AB08: "Failed to create main thread." ??_C@_0BO@NAGIOLIN@Failed?5to?5create?5main?5thread?4?$AA@
0x18000F1F8: "__cdecl _IMPORT_DESCRIPTOR_wevtapi" __IMPORT_DESCRIPTOR_wevtapi
0x18000A448: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x18000A128: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x18000A2A0: "__cdecl _imp_WaitForMultipleObjects" __imp_WaitForMultipleObjects
0x18000A778: "FthPipeReadMessage" ??_C@_0BD@OHIDAILF@FthPipeReadMessage?$AA@
0x1800059B0: FthWerCallback
0x18000BC78: "Signalling work queued event." ??_C@_0BO@BJANNMAF@Signalling?5work?5queued?5event?4?$AA@
0x180006770: FthServerLoadApplicationsState
0x18000F234: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-namedpipe-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-namedpipe-l1-1-0
0x18000A400: "__cdecl _imp_EtwGetTraceEnableFlags" __imp_EtwGetTraceEnableFlags
0x18000B818: "Server read an unexpected messag" ??_C@_0CI@DNAPCCEL@Server?5read?5an?5unexpected?5messag@
0x18000DB88: "The `RuleList' or `ExcludeList' " ??_C@_0DK@MPADAMLE@The?5?$GARuleList?8?5or?5?$GAExcludeList?8?5@
0x18000A1B0: "__cdecl _imp_ConnectNamedPipe" __imp_ConnectNamedPipe
0x18000A618: "Attempting to startup FTH server" ??_C@_0CF@NNHNBGLA@Attempting?5to?5startup?5FTH?5server@
0x18000A3E0: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x18000A850: "Pipe write message timed out. " ??_C@_0BP@MJECMHGK@Pipe?5write?5message?5timed?5out?4?6?$AA@
0x18000F0B8: apphelp_NULL_THUNK_DATA_DLB
0x18000601C: FthApplicationTableInsert
0x18000E6A8: "__cdecl _pfnDefaultDliFailureHook2" __pfnDefaultDliFailureHook2
0x180008800: FthSysprepSpecializeOffline
0x18000CFB8: "DC.FTHControl" ??_C@_1BM@LFOFOGNG@?$AAD?$AAC?$AA?4?$AAF?$AAT?$AAH?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AA?$AA@
0x1800049C0: StringCchCopyNW
0x18000A888: "FthTimeCurrent" ??_C@_0P@JIEPJMBB@FthTimeCurrent?$AA@
0x18000D7C0: "FthServerSaveCheckPoint" ??_C@_0BI@NDIPHFOO@FthServerSaveCheckPoint?$AA@
0x18000CF28: "Watson Sent Valid Ticket: [%d]" ??_C@_0BP@PPIDHMHI@Watson?5Sent?5Valid?5Ticket?3?5?$FL?$CFd?$FN?$AA@
0x18000A5D0: "WdiDiagnosticModuleMain" ??_C@_0BI@LAPAKNOF@WdiDiagnosticModuleMain?$AA@
0x18000C710: "Failed to convert ModStamp field" ??_C@_0DC@HGMANO@Failed?5to?5convert?5ModStamp?5field@
0x180009330: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x18000BB78: "Failed to get type of object for" ??_C@_0DL@KOJOOJNH@Failed?5to?5get?5type?5of?5object?5for@
0x18000D6A8: "FthRegistryWrite64BitNumber" ??_C@_0BM@DCMALHML@FthRegistryWrite64BitNumber?$AA@
0x18000D160: "FTH enabled (ticket %u) for appl" ??_C@_0DA@PLBHGLHL@FTH?5enabled?5?$CIticket?5?$CFu?$CJ?5for?5appl@
0x180006F04: FthServerRegistryReadExclusionList
0x18000C780: "Failed to convert exncode descri" ??_C@_0CL@MKFBGAFE@Failed?5to?5convert?5exncode?5descri@
0x18000DAE0: "MaximumAllocationOverheadInMBs" ??_C@_1DO@JINFOBLL@?$AAM?$AAa?$AAx?$AAi?$AAm?$AAu?$AAm?$AAA?$AAl?$AAl?$AAo?$AAc?$AAa?$AAt?$AAi?$AAo?$AAn?$AAO?$AAv?$AAe?$AAr?$AAh?$AAe?$AAa?$AAd?$AAI?$AAn?$AAM?$AAB?$AAs?$AA?$AA@
0x18000B670: "FoundProcess != NULL" ??_C@_0BF@NFCGAHFG@FoundProcess?5?$CB?$DN?5NULL?$AA@
0x18000AC00: "%d, %d, %d, %d, %d, %d " ??_C@_1DA@NFJJABPN@?$AA?$CF?$AAd?$AA?0?$AA?5?$AA?$CF?$AAd?$AA?0?$AA?5?$AA?$CF?$AAd?$AA?0?$AA?5?$AA?$CF?$AAd?$AA?0?$AA?5?$AA?$CF?$AAd?$AA?0?$AA?5?$AA?$CF?$AAd?$AA?6?$AA?$AA@
0x18000CCB0: "FaultTolerantHeap" ??_C@_1CE@GIPCGGHN@?$AAF?$AAa?$AAu?$AAl?$AAt?$AAT?$AAo?$AAl?$AAe?$AAr?$AAa?$AAn?$AAt?$AAH?$AAe?$AAa?$AAp?$AA?$AA@
0x18000A478: "__cdecl _imp_WerReportSubmit" __imp_WerReportSubmit
0x18000D3A0: " bucket: %04u," ??_C@_0BA@MJNMHDPK@?5?5bucket?3?5?$CF04u?0?$AA@
0x180011228: FthAssertHistoryIndex
0x18000A428: "__cdecl _imp_NtQueryObject" __imp_NtQueryObject
0x18000A340: "__cdecl _imp_ConvertStringSecurityDescriptorToSecurityDescriptorW" __imp_ConvertStringSecurityDescriptorToSecurityDescriptorW
0x18000C930: "FthRuleCreate" ??_C@_0O@HLPBDENG@FthRuleCreate?$AA@
0x180004A58: FthBucketCreate
0x18000D090: "Checking buckets for application" ??_C@_0CI@FBLCDJGK@Checking?5buckets?5for?5application@
0x18000DA68: "MaximumTrackedApplications" ??_C@_1DG@CDHDLFFL@?$AAM?$AAa?$AAx?$AAi?$AAm?$AAu?$AAm?$AAT?$AAr?$AAa?$AAc?$AAk?$AAe?$AAd?$AAA?$AAp?$AAp?$AAl?$AAi?$AAc?$AAa?$AAt?$AAi?$AAo?$AAn?$AAs?$AA?$AA@
0x18000CDA8: "Application Name" ??_C@_1CC@PJFKMFOK@?$AAA?$AAp?$AAp?$AAl?$AAi?$AAc?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?5?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x18000DD28: "Failed to split FTH server exclu" ??_C@_0DI@KEJDOPDG@Failed?5to?5split?5FTH?5server?5exclu@
0x18000C818: "Failed to get field from bucket " ??_C@_0DB@DMBHLHLD@Failed?5to?5get?5field?5from?5bucket?5@
0x18000AE48: " MaximumTrackedProcesses: %u" ??_C@_0CA@JHOCLELN@?5?5?5?5MaximumTrackedProcesses?3?5?$CFu?$AA@
0x18000A560: "__cdecl _sz_wdi_dll" __sz_wdi_dll
0x18000DE20: "FthApplicationEnableShim" ??_C@_0BJ@ODHCGCNC@FthApplicationEnableShim?$AA@
0x18000A488: "__cdecl _imp_WerReportAddFile" __imp_WerReportAddFile
0x18000A378: "__cdecl _imp__XcptFilter" __imp__XcptFilter
0x18000AF38: " Rule string: %ws" ??_C@_0BF@PNJBBFJK@?5?5?5?5Rule?5string?3?5?$CFws?$AA@
0x18000A870: "FinalTime.HighPart == 0" ??_C@_0BI@MCNFNBCB@FinalTime?4HighPart?5?$DN?$DN?50?$AA@
0x18000C9E8: "FthApplicationDestroy" ??_C@_0BG@OICHFLFF@FthApplicationDestroy?$AA@
0x18000A460: ntdll_NULL_THUNK_DATA
0x18000C580: "Failed to get AppVer field from " ??_C@_0DI@KHJFKBKG@Failed?5to?5get?5AppVer?5field?5from?5@
0x18000CE40: "Error Types Mitigated" ??_C@_1CM@FPOJLEHG@?$AAE?$AAr?$AAr?$AAo?$AAr?$AA?5?$AAT?$AAy?$AAp?$AAe?$AAs?$AA?5?$AAM?$AAi?$AAt?$AAi?$AAg?$AAa?$AAt?$AAe?$AAd?$AA?$AA@
0x18000CDD0: "Application Version" ??_C@_1CI@LNNENDBB@?$AAA?$AAp?$AAp?$AAl?$AAi?$AAc?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?5?$AAV?$AAe?$AAr?$AAs?$AAi?$AAo?$AAn?$AA?$AA@
0x18000B310: "Tracking thread encountered wait" ??_C@_0CJ@GHOKEOAP@Tracking?5thread?5encountered?5wait@
0x18000B8A8: "Server->MaximumFreeOverhead > 0" ??_C@_0CA@CLLJIDMH@Server?9?$DOMaximumFreeOverhead?5?$DO?50?$AA@
0x18000A438: "__cdecl _imp_EtwEventUnregister" __imp_EtwEventUnregister
0x18000CCD8: "Failed to create WER Report to c" ??_C@_0CM@MPOIIJLB@Failed?5to?5create?5WER?5Report?5to?5c@
0x18000AF50: " *** RULES ***" ??_C@_0BC@KFNDAGGM@?5?5?5?5?$CK?$CK?$CK?5RULES?5?$CK?$CK?$CK?$AA@
0x18000B2C0: "Tracking thread finished wait cy" ??_C@_0CF@LFBNKNI@Tracking?5thread?5finished?5wait?5cy@
0x18000D4A8: "Forgetting enabled application w" ??_C@_0DD@EAKEFEHM@Forgetting?5enabled?5application?5w@
0x18000ABC8: "FthServerShutdown" ??_C@_0BC@OHIEJCOK@FthServerShutdown?$AA@
0x18000A748: "Pipe != NULL && Pipe != INVALID_" ??_C@_0CN@OIGBPDEH@Pipe?5?$CB?$DN?5NULL?5?$CG?$CG?5Pipe?5?$CB?$DN?5INVALID_@
0x18000E530: "Failed to close empty file handl" ??_C@_0CF@FCFGENAK@Failed?5to?5close?5empty?5file?5handl@
0x180010018: "__cdecl _security_cookie" __security_cookie
0x18000D820: "Failed to forget checkpoint (ope" ??_C@_0CE@DKGHFCBE@Failed?5to?5forget?5checkpoint?5?$CIope@
0x18000CD90: "00000000" ??_C@_1BC@LMIJMNIA@?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA?$AA@
0x18000A300: "__cdecl _imp_RegQueryValueExW" __imp_RegQueryValueExW
0x18000B100: "main thread: wait failed." ??_C@_0BK@BOGNJIAG@main?5thread?3?5wait?5failed?4?$AA@
0x18000F00C: "__cdecl _DELAY_IMPORT_DESCRIPTOR_apphelp_dll" __DELAY_IMPORT_DESCRIPTOR_apphelp_dll
0x18000AE68: " MaximumMemoryPercentage: %u" ??_C@_0CA@MIGAIBPK@?5?5?5?5MaximumMemoryPercentage?3?5?$CFu?$AA@
0x18000C460: "All pending buckets have been di" ??_C@_0CK@LFMIBAFC@All?5pending?5buckets?5have?5been?5di@
0x180009520: "__cdecl alloca_probe" _alloca_probe
0x18000A910: "Failed to create application tra" ??_C@_0CN@HAKDIBPN@Failed?5to?5create?5application?5tra@
0x18000BCF8: "FthTrackedProcessReportToSQM" ??_C@_0BN@LDIGODNA@FthTrackedProcessReportToSQM?$AA@
0x18000E588: WPP_92c327df918f3d19b69e2a1282859c91_Traceguids
0x18000D008: "Error Converting Watson Ticket V" ??_C@_0CM@JOMCEOGK@Error?5Converting?5Watson?5Ticket?5V@
0x18000A1F8: "__cdecl _imp_ResetEvent" __imp_ResetEvent
0x18000B470: "Waiting on process handle: %u" ??_C@_0BO@DDBNLGMK@Waiting?5on?5process?5handle?3?5?$CFu?$AA@
0x18000A208: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x18000C138: "Failed to subscribe to crash not" ??_C@_0CM@IHGDJACG@Failed?5to?5subscribe?5to?5crash?5not@
0x18000BF98: "FthServerEventSubscriptionCallba" ??_C@_0CD@DLEDOKJC@FthServerEventSubscriptionCallba@
0x18000A1E8: "__cdecl _imp_LocalFree" __imp_LocalFree
0x18000C850: "Invalid Parameter" ??_C@_0BC@HOFHKGJN@Invalid?5Parameter?$AA@
0x18000A828: "Failed to write message to the p" ??_C@_0CG@HKMFDBIF@Failed?5to?5write?5message?5to?5the?5p@
0x18000AFB0: "Creating NT native pipe [%ws] wi" ??_C@_0CO@BJDMDDHD@Creating?5NT?5native?5pipe?5?$FL?$CFws?$FN?5wi@
0x18000A310: "__cdecl _imp_RegCreateKeyExW" __imp_RegCreateKeyExW
0x1800105E0: "__cdecl _onexitbegin" __onexitbegin
0x18000A570: "__cdecl _sz_apphelp_dll" __sz_apphelp_dll
0x18000B630: "FTH client process terminated." ??_C@_0BP@GAIEJCOH@FTH?5client?5process?5terminated?4?$AA@
0x18000D128: "Failed to create the FTH shim ap" ??_C@_0DB@DHBJOJKL@Failed?5to?5create?5the?5FTH?5shim?5ap@
0x180007CBC: FthServerMessage
0x18000A3C8: "__cdecl _imp__vsnwprintf" __imp__vsnwprintf
0x180007DF4: FthServerAssert
0x18000D1B0: "FthApplicationIsShimEnabled(Appl" ??_C@_0DI@BIHOIOAK@FthApplicationIsShimEnabled?$CIAppl@
0x18000A138: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x18000BE10: "Failed to map a view of the Wats" ??_C@_0DD@MAALEKAB@Failed?5to?5map?5a?5view?5of?5the?5Wats@
0x18000E1C0: "SOFTWARE\Microsoft\Windows NT\Cu" ??_C@_1JE@NKIDFBLD@?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAN?$AAT?$AA?2?$AAC?$AAu@
0x18000F1E4: "__cdecl _IMPORT_DESCRIPTOR_KERNEL32" __IMPORT_DESCRIPTOR_KERNEL32
0x18000DB60: "CheckPointPeriod" ??_C@_1CC@GKHHLGFM@?$AAC?$AAh?$AAe?$AAc?$AAk?$AAP?$AAo?$AAi?$AAn?$AAt?$AAP?$AAe?$AAr?$AAi?$AAo?$AAd?$AA?$AA@
0x18000A2F0: "__cdecl _imp_RegOpenKeyExW" __imp_RegOpenKeyExW
0x18000CA28: " ***APPLICATION***: [%ws]" ??_C@_0BN@HPNNHCMI@?5?5?5?5?$CK?$CK?$CKAPPLICATION?$CK?$CK?$CK?3?5?$FL?$CFws?$FN?$AA@
0x180005514: FthApplicationGetWatsonParameters
0x180009244: "__cdecl _security_init_cookie" __security_init_cookie
0x18000B490: "Server will wait for a pipe conn" ??_C@_0EJ@CGOHJIGP@Server?5will?5wait?5for?5a?5pipe?5conn@
0x18000B060: "FTH NT native pipe already opene" ??_C@_0CD@KNHDCFGK@FTH?5NT?5native?5pipe?5already?5opene@
0x1800082DC: FthParseRuleString
0x18000DE40: "Failed to create WDI start event" ??_C@_0DG@KKCLNLHB@Failed?5to?5create?5WDI?5start?5event@
0x18000E440: "FTH" ??_C@_17LMJANBMP@?$AAF?$AAT?$AAH?$AA?$AA@
0x18000E364: "FTH: " ??_C@_05LIHHOKBA@FTH?3?5?$AA@
0x18000E2E8: "FthFree" ??_C@_07MJLMMBCE@FthFree?$AA@
0x18000F1A8: "__cdecl _IMPORT_DESCRIPTOR_msvcrt" __IMPORT_DESCRIPTOR_msvcrt
0x18000B9B8: "val >= 0" ??_C@_08DGOPIEAE@val?5?$DO?$DN?50?$AA@
0x18000A348: api-ms-win-security-sddl-l1-1-0_NULL_THUNK_DATA
0x18000C940: " RULE: %ws|%u.%u.%u.%u|%u.%u." ??_C@_0EH@HHBFGDKN@?5?5?5?5RULE?3?5?$CFws?$HM?$CFu?4?$CFu?4?$CFu?4?$CFu?$HM?$CFu?4?$CFu?4@
0x18000D758: "Failed in initialize to create a" ??_C@_0DN@DGPNGHAI@Failed?5in?5initialize?5to?5create?5a@
0x18000D9B0: "TicketValue" ??_C@_1BI@JHGPAJPP@?$AAT?$AAi?$AAc?$AAk?$AAe?$AAt?$AAV?$AAa?$AAl?$AAu?$AAe?$AA?$AA@
0x1800105D0: FthServerDebug
0x18000B7F0: "Server failed to read from the p" ??_C@_0CF@EABKBGMO@Server?5failed?5to?5read?5from?5the?5p@
0x18000E648: "FthEventLogSimpleEvent" ??_C@_0BH@LFOKMGIN@FthEventLogSimpleEvent?$AA@
0x18000A4A8: "__cdecl _imp_EvtClose" __imp_EvtClose
0x18000E570: "FthSysprepSpecialize" ??_C@_0BF@DBOJGEFP@FthSysprepSpecialize?$AA@
0x180007688: FthApplicationSaveTicket
0x18000A4A0: wer_NULL_THUNK_DATA
0x18000A360: "__cdecl _imp_malloc" __imp_malloc
0x18000A298: "__cdecl _imp_WriteFile" __imp_WriteFile
0x18000D7F8: "Failed to save checkpoint (write" ??_C@_0CD@LHKNNGIH@Failed?5to?5save?5checkpoint?5?$CIwrite@
0x18000D9E8: "CrashVelocity" ??_C@_1BM@ILMDJHIF@?$AAC?$AAr?$AAa?$AAs?$AAh?$AAV?$AAe?$AAl?$AAo?$AAc?$AAi?$AAt?$AAy?$AA?$AA@
0x18000D690: "FthRegistryWriteNumber" ??_C@_0BH@JMPFDMAF@FthRegistryWriteNumber?$AA@
0x180006610: FthRegistryOpenKey
0x180009352: "__cdecl _tailMerge_wdi_dll" __tailMerge_wdi_dll
0x18000AFE0: "FthServerCreateNtNativePipe" ??_C@_0BM@LMDPBELJ@FthServerCreateNtNativePipe?$AA@
0x180008FD0: "__cdecl _report_gsfailure" __report_gsfailure
0x18000A440: "__cdecl _imp_EtwEventWrite" __imp_EtwEventWrite
0x18000C908: "Failed to parse a rule descripto" ??_C@_0CD@IEIHAGB@Failed?5to?5parse?5a?5rule?5descripto@
0x18000A258: "__cdecl _imp_LeaveCriticalSection" __imp_LeaveCriticalSection
0x18000A498: "__cdecl _imp_WerpSetCallBack" __imp_WerpSetCallBack
0x180007F04: FthAllocString
0x1800105F0: "__cdecl _native_startup_state" __native_startup_state
0x180007A1C: FthAlloc
0x18000C188: "FthServerDispatchPendingBuckets" ??_C@_0CA@KNAJJHIK@FthServerDispatchPendingBuckets?$AA@
0x18000AB28: "Failed to subscribe to crash eve" ??_C@_0CF@OPIFCGOP@Failed?5to?5subscribe?5to?5crash?5eve@
0x18000B9E8: "Tracking denied: GlobalMemorySta" ??_C@_0DA@DPBIHKAO@Tracking?5denied?3?5GlobalMemorySta@
0x18000D8B0: "Could not open the FTH server ke" ??_C@_0CD@EKNNFNIM@Could?5not?5open?5the?5FTH?5server?5ke@
0x18000BD78: "Process->State == FTH_TRACKED_PR" ??_C@_0DB@IGABLNIC@Process?9?$DOState?5?$DN?$DN?5FTH_TRACKED_PR@
0x18000D2E8: "Table != NULL" ??_C@_0O@CNIGLEOD@Table?5?$CB?$DN?5NULL?$AA@
0x18000C060: "Application" ??_C@_1BI@JBDNBBGL@?$AAA?$AAp?$AAp?$AAl?$AAi?$AAc?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x180006A48: FthServerRegistryInitialize
0x18000B088: "Created pipe: [%ws] " ??_C@_0BF@JLEEMHE@Created?5pipe?3?5?$FL?$CFws?$FN?5?$AA@
0x18000A708: FTH_EVENT_ENABLE_EVENT
0x18000A4C0: "__cdecl _imp_EvtRender" __imp_EvtRender
0x18000E090: "SYSTEM\CurrentControlSet\Control" ??_C@_1MM@GBKHHFJO@?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA?2?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl@
0x180001200: WdiGetDiagnosticModuleInterfaceVersion
0x18000D890: "FthServerRegistryInitialize" ??_C@_0BM@HCKNMAJH@FthServerRegistryInitialize?$AA@
0x18000B4E0: "Server failed to disconnect from" ??_C@_0ED@JGBIMENK@Server?5failed?5to?5disconnect?5from@
0x18000E660: "FthLogAppEnabledEvent" ??_C@_0BG@LAGMLNOC@FthLogAppEnabledEvent?$AA@
0x18000BE50: "Exception raised while transferr" ??_C@_0EE@MKMPIACH@Exception?5raised?5while?5transferr@
0x18000A1C8: "__cdecl _imp_MapViewOfFile" __imp_MapViewOfFile
0x18000BD18: "SQM: DP: FTH_CLIENT_STATS FAILED" ??_C@_0CH@HKGBAPKN@SQM?3?5DP?3?5FTH_CLIENT_STATS?5FAILED@
0x18000CFF8: "FthWerCallback" ??_C@_0P@JIEMLPKP@FthWerCallback?$AA@
0x18000B120: "main thread: periodic wake up." ??_C@_0BP@KEBCAPOG@main?5thread?3?5periodic?5wake?5up?4?$AA@
0x18000B0E0: "Server->WorkQueuedEvent != NULL" ??_C@_0CA@JPCCBKBC@Server?9?$DOWorkQueuedEvent?5?$CB?$DN?5NULL?$AA@
0x18000DDC8: "Failed to allocate read buffer f" ??_C@_0CO@HPLAFABL@Failed?5to?5allocate?5read?5buffer?5f@
0x18000DC50: "ExclusionList" ??_C@_1BM@JMLOBPAN@?$AAE?$AAx?$AAc?$AAl?$AAu?$AAs?$AAi?$AAo?$AAn?$AAL?$AAi?$AAs?$AAt?$AA?$AA@
0x18000D4E0: "Failed to disable shim for appli" ??_C@_0CO@EHNIJNJO@Failed?5to?5disable?5shim?5for?5appli@
0x18000AD00: "Shutdown memory status: allocs: " ??_C@_0FF@OOGONBOJ@Shutdown?5memory?5status?3?5allocs?3?5@
0x18000A5A8: "WdiGetDiagnosticModuleInterfaceV" ??_C@_0CH@KIEJIMEA@WdiGetDiagnosticModuleInterfaceV@
0x18000CAB8: " Name: %ws, version: %u.%u.%u" ??_C@_0CE@NGJOEABD@?5?5?5?5Name?3?5?$CFws?0?5version?3?5?$CFu?4?$CFu?4?$CFu@
0x18000DD98: "Failed to read FTH server rule l" ??_C@_0CL@OJGAAAGI@Failed?5to?5read?5FTH?5server?5rule?5l@
0x18000B650: "Signaled process handle: %u" ??_C@_0BM@JEOPLEHH@Signaled?5process?5handle?3?5?$CFu?$AA@
0x18000880C: WPP_SF_sD
0x18000A368: "__cdecl _imp_free" __imp_free
0x1800091B0: "__cdecl IsNonwritableInCurrentImage" _IsNonwritableInCurrentImage
0x18000CBC8: "FthApplicationFind" ??_C@_0BD@OHDMAIDK@FthApplicationFind?$AA@
0x18000B198: "main thread: received unexpected" ??_C@_0DC@HJGOCLPN@main?5thread?3?5received?5unexpected@
0x18000B420: "Server failed to disconnect from" ??_C@_0FA@LALNONLB@Server?5failed?5to?5disconnect?5from@
0x180010620: FthAssertHistory
0x18000D658: "Registry operation succeeded wit" ??_C@_0DF@IFGNCNOA@Registry?5operation?5succeeded?5wit@
0x18000AB50: "Failed to log start message to e" ??_C@_0CK@CFAODALD@Failed?5to?5log?5start?5message?5to?5e@
0x18000B3E8: "Server failed to connect to the " ??_C@_0DA@DOODCJCM@Server?5failed?5to?5connect?5to?5the?5@
0x18000A2D8: "__cdecl _imp_ImpersonateNamedPipeClient" __imp_ImpersonateNamedPipeClient
0x18000CD70: "Bucket AppStamp Bogus" ??_C@_0BG@CLAILNKO@Bucket?5AppStamp?5Bogus?$AA@
0x1800079C0: WPP_SF_s
0x18000ABA8: "FTH server startup failed." ??_C@_0BL@PCKKJHDH@FTH?5server?5startup?5failed?4?$AA@
0x1800094E6: memset
0x18000F25C: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x18000C358: "Application->TicketCurrent == Se" ??_C@_0DC@EIKAKMDC@Application?9?$DOTicketCurrent?5?$DN?$DN?5Se@
0x18000BBC0: "RevertToSelf failed with Win32 e" ??_C@_0EL@HELBIPAF@RevertToSelf?5failed?5with?5Win32?5e@
0x18000A278: "__cdecl _imp_ReadFile" __imp_ReadFile

[JEB Decompiler by PNF Software]