Generated by JEB on 2019/08/01

PE: C:\Windows\System32\basesrv.dll Base=0x180000000 SHA-256=5EAEC2E0162CC8A83848D8D8EA6121BD5B3FF4EEE0F458171C2DB0D78FE0F1DE
PDB: basesrv.pdb GUID={0DE0CF59-6529-CA09-B9321F5C3A8B5F2F} Age=1

518 located named symbols:
0x18000CB28: "__cdecl _imp_RtlInitUnicodeStringEx" __imp_RtlInitUnicodeStringEx
0x18000DC78: "UmAlQura" ??_C@_1BC@FOMDMLND@?$AAU?$AAm?$AAA?$AAl?$AAQ?$AAu?$AAr?$AAa?$AA?$AA@
0x180010620: NlsCacheCriticalSection
0x180008F04: BaseSrvFreeDOSRecord
0x18000D900: "1" ??_C@_13JGCMLPCH@?$AA1?$AA?$AA@
0x18000C738: sCurrency
0x180004644: "__cdecl _raise_securityfailure" __raise_securityfailure
0x18000C778: iCurrency
0x18000D1F8: "`string'" ??_C@_1BE@CFIDFAMK@?$AAI?$AAN?$AAI?$AAT?$AA?$AA?$AAI?$AAN?$AAI?$AA?$AA?$AA?$AA@
0x18000BD08: GetPolicyState
0x18000EA80: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x18000D160: "%ws\%ld\AppContainerNamedObjects" ??_C@_1EC@NJAKGLLG@?$AA?$CF?$AAw?$AAs?$AA?2?$AA?$CF?$AAl?$AAd?$AA?2?$AAA?$AAp?$AAp?$AAC?$AAo?$AAn?$AAt?$AAa?$AAi?$AAn?$AAe?$AAr?$AAN?$AAa?$AAm?$AAe?$AAd?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAs@
0x18000DA98: "BASESRV: WOW is in inconsistent " ??_C@_0DJ@LEEFMHAI@BASESRV?3?5WOW?5is?5in?5inconsistent?5@
0x18000A6D0: BaseSrvSetVDMCurDirs
0x180010058: "__cdecl _security_cookie_complement" __security_cookie_complement
0x18000CB20: "__cdecl _imp_wcsncpy_s" __imp_wcsncpy_s
0x18000CCC8: "__cdecl _imp_NtOpenProcess" __imp_NtOpenProcess
0x18000AB68: BaseSrvUpdateWOWEntry
0x18000AD50: GetConsoleRecordDosSesId
0x18000CAF0: CSRSRV_NULL_THUNK_DATA
0x18000A630: BaseSrvSetReenterCount
0x18000CAB0: "__cdecl _imp_CsrUnlockProcess" __imp_CsrUnlockProcess
0x180010A68: UserNotifyProcessCreate
0x180010950: BaseSrvpStaticServerData
0x18000CD88: "__cdecl _imp_NtEnumerateKey" __imp_NtEnumerateKey
0x18000DCC0: LongDate_buffer
0x180003C98: OpenGlobalizationUserSettingsKey
0x18000CE28: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x180004AF0: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x18000D368: "CsrBroadcastSystemMessageExW" ??_C@_0BN@OJCIOING@CsrBroadcastSystemMessageExW?$AA@
0x18000717C: BaseSrvAllocateDOSRecord
0x180010A20: BaseSrvDDDBSMCritSec
0x18000DCF0: ShortDate_buffer
0x18000C8D8: sGrouping
0x18000A420: BaseSrvRegisterWowExec
0x18000C838: s2359
0x1800045A0: BaseSrvNlsUpdateCacheCount
0x18000C8B8: sMonDecimalSep
0x18000CC50: "__cdecl _imp_LdrGetDllHandle" __imp_LdrGetDllHandle
0x18000D770: iMeasure_buffer
0x180006C88: BaseSrvAddSepWowTask
0x18000D028: "Session" ??_C@_1BA@FJPOMCMI@?$AAS?$AAe?$AAs?$AAs?$AAi?$AAo?$AAn?$AA?$AA@
0x18000C758: iFirstDayOfWeek
0x18000D918: "\GLOBAL??\%wZ" ??_C@_1BM@INKOMJJJ@?$AA?2?$AAG?$AAL?$AAO?$AAB?$AAA?$AAL?$AA?$DP?$AA?$DP?$AA?2?$AA?$CF?$AAw?$AAZ?$AA?$AA@
0x18000CD98: "__cdecl _imp_NtEnumerateValueKey" __imp_NtEnumerateValueKey
0x18000ADF4: IsClientSystem
0x1800109C8: BaseSrvLowBoxPipePrefix
0x18000C788: iCurrDigits
0x180002F40: BaseSrvCreateProcess
0x18000CB50: "__cdecl _imp_RtlCreateSecurityDescriptor" __imp_RtlCreateSecurityDescriptor
0x18000D9B8: "_UserTestTokenForInteractive" ??_C@_0BN@NHLDNEF@_UserTestTokenForInteractive?$AA@
0x18000CCB8: "__cdecl _imp_NtSetInformationThread" __imp_NtSetInformationThread
0x180010970: BaseSrvCSDNumber
0x180010010: rgBaseSrvModuleImport
0x18000CE18: "__cdecl _imp_RtlCreateTagHeap" __imp_RtlCreateTagHeap
0x18000CBB8: "__cdecl _imp_RtlEnterCriticalSection" __imp_RtlEnterCriticalSection
0x18000D6D8: sShortTime_buffer
0x18000CEA0: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x180010910: BaseSrvTag
0x180009D14: BaseSrvImportApis
0x18000CBF0: "__cdecl _imp__wcsnicmp" __imp__wcsnicmp
0x180008DB8: BaseSrvFindSharedWowRecordByConsoleHandle
0x18000CC58: "__cdecl _imp_RtlInitString" __imp_RtlInitString
0x180006760: CheckForGlobalDriveLetter
0x18000C1E0: UnexpandedSystemRootString
0x18000D4E8: "InteractiveUserSeparation" ??_C@_1DE@IMDDGHHD@?$AAI?$AAn?$AAt?$AAe?$AAr?$AAa?$AAc?$AAt?$AAi?$AAv?$AAe?$AAU?$AAs?$AAe?$AAr?$AAS?$AAe?$AAp?$AAa?$AAr?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x18000C908: sList
0x180009C94: BaseSrvGetWOWTaskId
0x18000C848: s1159
0x180001714: ReadSettingsCache
0x18000CAE8: "__cdecl _imp_CsrValidateMessageBuffer" __imp_CsrValidateMessageBuffer
0x180010980: BaseSrvRestrictedObjectDirectory
0x180004540: BaseSrvRegisterSxS
0x18000CC48: "__cdecl _imp_RtlAcquireSRWLockExclusive" __imp_RtlAcquireSRWLockExclusive
0x18000CDC0: "__cdecl _imp_LdrDisableThreadCalloutsForDll" __imp_LdrDisableThreadCalloutsForDll
0x18000CB98: "__cdecl _imp_RtlAppendUnicodeStringToString" __imp_RtlAppendUnicodeStringToString
0x18000DA00: "\RunDll32.exe" ??_C@_1BM@KMMDEAKP@?$AA?2?$AAR?$AAu?$AAn?$AAD?$AAl?$AAl?$AA3?$AA2?$AA?4?$AAe?$AAx?$AAe?$AA?$AA@
0x18000DCD8: GregorianKey_buffer
0x18000C8F8: sDecimal
0x180010AD8: UserTestTokenForInteractive
0x18000D858: iFirstWeekOfYear_buffer
0x180010618: BaseSrvMappingTargetHead
0x180003FB0: BaseSrvFreeAndRemoveBatRecord
0x18000DB30: "\Registry\Machine\System\Current" ??_C@_1JG@EEECFNPB@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x18000D8B8: ExplicitSettingsKey_buffer
0x18000B240: BaseSrvFreeFileMapping
0x180004ABB: memcpy
0x18000A51C: BaseSrvRemoveConsoleRecord
0x180010030: rgUser32ApiImport
0x1800048B4: "__cdecl _security_init_cookie_ex" __security_init_cookie_ex
0x18000D8F8: "yes" ??_C@_17IHBDLLG@?$AAy?$AAe?$AAs?$AA?$AA@
0x18000CE88: "__cdecl _imp_memset" __imp_memset
0x18000CD20: "__cdecl _imp_NtWaitForSingleObject" __imp_NtWaitForSingleObject
0x18000917C: BaseSrvGetBatRecord
0x18000D820: iNegCurr_buffer
0x18000D150: "win.ini" ??_C@_1BA@DINDGOOJ@?$AAw?$AAi?$AAn?$AA?4?$AAi?$AAn?$AAi?$AA?$AA@
0x18000D620: sMonDecimalSep_buffer
0x18000BC54: QueryStringValue
0x18000CCA8: "__cdecl _imp_NtOpenProcessToken" __imp_NtOpenProcessToken
0x180004982: RtlUnhandledExceptionFilter
0x18000C8E8: sThousand
0x18000CE50: "__cdecl _imp_RtlIsMultiSessionSku" __imp_RtlIsMultiSessionSku
0x180004946: "__cdecl _C_specific_handler" __C_specific_handler
0x1800106C0: BaseSrvVDMNTVDMCplCriticalSection
0x18000495E: RtlCaptureContext
0x180004570: BaseSrvGetProcessShutdownParam
0x180004AC7: memmove
0x18000CC60: "__cdecl _imp_LdrGetProcedureAddress" __imp_LdrGetProcedureAddress
0x18000CCE0: "__cdecl _imp_RtlCopyUnicodeString" __imp_RtlCopyUnicodeString
0x18000CC08: "__cdecl _imp_RtlCreateAcl" __imp_RtlCreateAcl
0x18000D270: "\Registry\Machine\System\Current" ??_C@_1IG@FLEJHJI@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1800076C0: BaseSrvCheckVDM
0x18000C8A8: sMonThousandSep
0x18000D2F8: "Control Panel\International" ??_C@_1DI@HFDNKLGP@?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AA?5?$AAP?$AAa?$AAn?$AAe?$AAl?$AA?2?$AAI?$AAn?$AAt?$AAe?$AAr?$AAn?$AAa?$AAt?$AAi?$AAo?$AAn?$AAa?$AAl?$AA?$AA@
0x18000D530: "Local" ??_C@_1M@HNJDKPAA@?$AAL?$AAo?$AAc?$AAa?$AAl?$AA?$AA@
0x18000C858: sShortTime
0x180003D34: GetThreadAuthenticationId
0x18000CC80: "__cdecl _imp_NtQueryInformationToken" __imp_NtQueryInformationToken
0x1800049CC: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x18000CD50: "__cdecl _imp_NtCreateEvent" __imp_NtCreateEvent
0x180008878: BaseSrvExitDOSTask
0x18000C878: sNegativeSign
0x180002550: BaseSrvSaveIniFileMapping
0x180010940: BaseSrvWindowsSystemDirectory
0x18000D728: sYearMonth_buffer
0x18000CC18: "__cdecl _imp_NtMakePermanentObject" __imp_NtMakePermanentObject
0x180006E28: BaseSrvAddSharedWowRecord
0x18000CB08: "__cdecl _imp_RtlAllocateHeap" __imp_RtlAllocateHeap
0x18000D978: "WINSTA.DLL" ??_C@_1BG@BOLJCHLL@?$AAW?$AAI?$AAN?$AAS?$AAT?$AAA?$AA?4?$AAD?$AAL?$AAL?$AA?$AA@
0x18000CAB8: "__cdecl _imp_CsrCreateThread" __imp_CsrCreateThread
0x18000D088: "USR:" ??_C@_19EGDBJPJJ@?$AAU?$AAS?$AAR?$AA?3?$AA?$AA@
0x180009F7C: BaseSrvLaunchCPL
0x18000CC68: "__cdecl _imp_RtlReleaseSRWLockExclusive" __imp_RtlReleaseSRWLockExclusive
0x180009AA0: BaseSrvGetVDMCurDirs
0x180004150: BaseSrvDeferredCreateProcess
0x180010A70: BatRecordHead
0x18000B068: StringCchCopyA
0x18000CDC8: "__cdecl _imp_NtTerminateProcess" __imp_NtTerminateProcess
0x18000D228: "`string'" ??_C@_1CC@HBLFFKMG@?$AAT?$AAM?$AAP?$AA?$AA?$AAV?$AAD?$AAM?$AA?$AA?$AAS?$AAX?$AAS?$AA?$AA?$AAA?$AAP?$AAP?$AA?$AA?$AA?$AA@
0x18000ACEC: BaseSrvVDMTerminated
0x18000CE60: "__cdecl _imp_RtlOpenCurrentUser" __imp_RtlOpenCurrentUser
0x1800106E8: gWowHead
0x18000D6C0: sTimeFormat_buffer
0x18000D9F0: "\??\" ??_C@_19JHEHLFPM@?$AA?2?$AA?$DP?$AA?$DP?$AA?2?$AA?$AA@
0x180010920: BaseSrvSharedTag
0x180004510: BaseGetProcessCrtlRoutine
0x18000C1F0: BaseServerApiDispatchTable
0x18000CE10: "__cdecl _imp_RtlInitializeCriticalSection" __imp_RtlInitializeCriticalSection
0x18000CC78: "__cdecl _imp_RtlPrefixUnicodeString" __imp_RtlPrefixUnicodeString
0x180008A24: BaseSrvExitWOWTask
0x180010650: NlsChangeBuffer
0x18000D950: "user32.dll" ??_C@_1BG@OILDLIOJ@?$AAu?$AAs?$AAe?$AAr?$AA3?$AA2?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x18000DAD8: "BASESRV: DOS is in inconsistent " ??_C@_0DJ@PDOPGPDC@BASESRV?3?5DOS?5is?5in?5inconsistent?5@
0x18000D8D0: "DefaultSeparateVDM" ??_C@_1CG@JPMLIKFI@?$AAD?$AAe?$AAf?$AAa?$AAu?$AAl?$AAt?$AAS?$AAe?$AAp?$AAa?$AAr?$AAa?$AAt?$AAe?$AAV?$AAD?$AAM?$AA?$AA@
0x18000D9D8: "ResolveDesktopForWOW" ??_C@_0BF@OGGMALF@ResolveDesktopForWOW?$AA@
0x18000D898: iCalendarType_buffer
0x18000D388: "user32" ??_C@_1O@BCCLBEOE@?$AAu?$AAs?$AAe?$AAr?$AA3?$AA2?$AA?$AA@
0x18000CAC0: "__cdecl _imp_CsrLockProcessByClientId" __imp_CsrLockProcessByClientId
0x18000CA90: Currencies
0x18000DA94: """ ??_C@_13NEIAEHFG@?$AA?$CC?$AA?$AA@
0x180007C2C: BaseSrvCloseStandardHandles
0x18000DBC8: "RedirectedKey" ??_C@_1BM@GGIHPLEN@?$AAR?$AAe?$AAd?$AAi?$AAr?$AAe?$AAc?$AAt?$AAe?$AAd?$AAK?$AAe?$AAy?$AA?$AA@
0x18000CBC0: "__cdecl _imp_RtlUpcaseUnicodeChar" __imp_RtlUpcaseUnicodeChar
0x180008E48: BaseSrvFindSharedWowRecordByTaskId
0x180004A30: "__cdecl _GSHandlerCheck_SEH" __GSHandlerCheck_SEH
0x180004550: BaseSetProcessCreateNotify
0x18000CB40: "__cdecl _imp__wcsicmp" __imp__wcsicmp
0x18000CDF8: "__cdecl _imp_wcscat_s" __imp_wcscat_s
0x18000C798: NumShape
0x18000CE40: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x180010930: BaseSrvWindowsDirectory
0x18000CDD0: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x18000CB18: "__cdecl _imp_RtlQueryRegistryValuesEx" __imp_RtlQueryRegistryValuesEx
0x180010AB8: BSM_Request_Queue
0x18000DA20: " shell32.dll,Control_RunDLL ntv" ??_C@_1HE@MBEKLJDC@?$AA?5?$AA?5?$AAs?$AAh?$AAe?$AAl?$AAl?$AA3?$AA2?$AA?4?$AAd?$AAl?$AAl?$AA?0?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AA_?$AAR?$AAu?$AAn?$AAD?$AAL?$AAL?$AA?5?$AAn?$AAt?$AAv@
0x180005870: BaseSrvBSMThread
0x180008164: BaseSrvCreatePairWaitHandles
0x1800049A8: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x18000CBC8: "__cdecl _imp__snwprintf_s" __imp__snwprintf_s
0x1800017C0: ServerDllInitialization
0x18000C818: sYearMonth
0x18000CAD0: "__cdecl _imp_CsrIsClientSandboxed" __imp_CsrIsClientSandboxed
0x18000D680: sPositiveSign_buffer
0x180005744: AddBSMRequest
0x18000CFC0: "\Device\NamedPipe" ??_C@_1CE@NKNMNDKL@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAN?$AAa?$AAm?$AAe?$AAd?$AAP?$AAi?$AAp?$AAe?$AA?$AA@
0x18000B508: BaseSrvSaveMappingTarget
0x18000CC10: "__cdecl _imp_RtlAddAccessAllowedAce" __imp_RtlAddAccessAllowedAce
0x180001010: BaseSrvNlsLogon
0x18000BE18: IsNTVDMInstalled
0x18000D908: "\??\%wZ" ??_C@_1BA@EHOJCOHK@?$AA?2?$AA?$DP?$AA?$DP?$AA?2?$AA?$CF?$AAw?$AAZ?$AA?$AA@
0x18000AD84: GetNextDosSesId
0x180003ED0: BaseSrvBatNotification
0x1800109A0: BaseSrvDosDeviceCritSec
0x18000CAE0: "__cdecl _imp_CsrImpersonateClient" __imp_CsrImpersonateClient
0x180010A60: ProtectionMode
0x18000CAF8: "__cdecl _imp_swprintf_s" __imp_swprintf_s
0x180008CC0: BaseSrvFindSharedWow
0x180010990: BaseSrvUserObjectDirectory
0x180010A50: ServiceSessionId
0x180009B90: BaseSrvGetVDMExitCode
0x18000CE30: "__cdecl _imp_RtlGetAce" __imp_RtlGetAce
0x18000D7A0: iDigits_buffer
0x18000CBA8: "__cdecl _imp_RtlFreeHeap" __imp_RtlFreeHeap
0x18000C8C8: sNativeDigits
0x18000B2C0: BaseSrvRefreshIniFileMapping
0x18000D250: "ProtectionMode" ??_C@_1BO@JFJHGLBJ@?$AAP?$AAr?$AAo?$AAt?$AAe?$AAc?$AAt?$AAi?$AAo?$AAn?$AAM?$AAo?$AAd?$AAe?$AA?$AA@
0x180009124: BaseSrvFreeWOWRecord
0x18000D758: iCountry_buffer
0x18000D590: sCountry_buffer
0x18000D210: "BASESRV!" ??_C@_1BC@NDHIIINN@?$AAB?$AAA?$AAS?$AAE?$AAS?$AAR?$AAV?$AA?$CB?$AA?$AA@
0x18000D968: "\??\X:" ??_C@_1O@KBDNNIJO@?$AA?2?$AA?$DP?$AA?$DP?$AA?2?$AAX?$AA?3?$AA?$AA@
0x18000DCA8: Currencies_buffer
0x18000D000: "\Sessions\BNOLINKS" ??_C@_1CG@IAKMGCPL@?$AA?2?$AAS?$AAe?$AAs?$AAs?$AAi?$AAo?$AAn?$AAs?$AA?2?$AAB?$AAN?$AAO?$AAL?$AAI?$AAN?$AAK?$AAS?$AA?$AA@
0x18000CAA8: "__cdecl _imp_CsrLockThreadByClientId" __imp_CsrLockThreadByClientId
0x18000D540: "AppContainerNamedObjects" ??_C@_1DC@JGKFLOCH@?$AAA?$AAp?$AAp?$AAC?$AAo?$AAn?$AAt?$AAa?$AAi?$AAn?$AAe?$AAr?$AAN?$AAa?$AAm?$AAe?$AAd?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAs?$AA?$AA@
0x18000B930: FirstSoundSentry
0x18000CD90: "__cdecl _imp_RtlEqualUnicodeString" __imp_RtlEqualUnicodeString
0x1800041E0: BaseSrvSetProcessShutdownParam
0x18000C808: sLongDate
0x18000C9B0: Calendar
0x18000A7F8: BaseSrvUpdateDOSEntry
0x180009EB0: BaseSrvIsVdmAllowed
0x1800045E0: "__cdecl DllMainCRTStartupForGS" _DllMainCRTStartupForGS
0x180004010: BaseClientConnectRoutine
0x18000C898: sMonGrouping
0x180010A58: sxsFunctions
0x18000CBA0: "__cdecl _imp_NtCreateFile" __imp_NtCreateFile
0x180010958: SessionId
0x18000CE98: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x18000496A: RtlLookupFunctionEntry
0x180006B6C: BasepImpersonateClientProcess
0x1800068A8: GetCallerLuid
0x180007268: BaseSrvAllocateWOWRecord
0x18000CD00: "__cdecl _imp_NtCreateUserProcess" __imp_NtCreateUserProcess
0x180010A48: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUyzhvhvieviUlyquivUznwGEUyzhvhieOlyq@basesrv" __@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUyzhvhvieviUlyquivUznwGEUyzhvhieOlyq@basesrv
0x18000C7D8: iPaperSize
0x18000CB90: "__cdecl _imp_RtlAppendUnicodeToString" __imp_RtlAppendUnicodeToString
0x180010078: wszUser32ModName
0x18000CD40: "__cdecl _imp_NtCompareTokens" __imp_NtCompareTokens
0x180010648: pNlsRegUserInfo
0x180004952: NtTerminateProcess
0x18000CCD0: "__cdecl _imp_NtOpenThread" __imp_NtOpenThread
0x18000D600: sNativeDigits_buffer
0x18000A184: BaseSrvLaunchProcess
0x180007CE0: BaseSrvCopyCommand
0x1800109E0: SysInfo
0x18000D420: "CSDVersion" ??_C@_1BG@MEBEMGBM@?$AAC?$AAS?$AAD?$AAV?$AAe?$AAr?$AAs?$AAi?$AAo?$AAn?$AA?$AA@
0x180010088: WOWTaskIdNext
0x180010A98: DOSHead
0x18000CDB8: "__cdecl _imp_RtlCheckTokenMembershipEx" __imp_RtlCheckTokenMembershipEx
0x180006A9C: SendWinStationBSM
0x18000CE20: "__cdecl _imp_RtlGetCurrentServiceSessionId" __imp_RtlGetCurrentServiceSessionId
0x18000CD48: "__cdecl _imp_NtOpenThreadToken" __imp_NtOpenThreadToken
0x18000CB70: "__cdecl _imp_NtSetInformationObject" __imp_NtSetInformationObject
0x18000CFE8: "Restricted" ??_C@_1BG@HGEFIHHK@?$AAR?$AAe?$AAs?$AAt?$AAr?$AAi?$AAc?$AAt?$AAe?$AAd?$AA?$AA@
0x18000A5AC: BaseSrvRemoveWOWRecordByTaskId
0x18000B7B0: BaseSrvSetTermsrvAppInstallMode
0x18000C888: sPositiveSign
0x18000C868: sTimeFormat
0x1800072E4: BaseSrvCheckDOS
0x180003F3C: BaseSrvAllocateAndAddBatRecord
0x180007880: BaseSrvCheckWOW
0x18000CE58: "__cdecl _imp_ZwQueryValueKey" __imp_ZwQueryValueKey
0x18000CF84: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x18000CC98: "__cdecl _imp_LdrLoadDll" __imp_LdrLoadDll
0x18000D578: LocaleName_buffer
0x1800047C0: "__cdecl _report_rangecheckfailure" __report_rangecheckfailure
0x18000DC58: "Hebrew" ??_C@_1O@HJODDAIL@?$AAH?$AAe?$AAb?$AAr?$AAe?$AAw?$AA?$AA@
0x18000C768: iNegCurr
0x180010AD0: BaseSrvUserResolveDesktopForWow
0x18000B6AC: BaseSrvSaveVarNameMapping
0x18000CC00: "__cdecl _imp_RtlFreeSid" __imp_RtlFreeSid
0x18000C7B8: iLZero
0x18000CD38: "__cdecl _imp_NtResetEvent" __imp_NtResetEvent
0x180004460: BaseSrvNlsUpdateRegistryCache
0x18000BCD4: GetEffectivePolicyState
0x18000C748: iFirstWeekOfYear
0x18001008C: fIsFirstVDM
0x18000CD18: "__cdecl _imp_NtResumeThread" __imp_NtResumeThread
0x18000D5B8: sDecimal_buffer
0x18000CB88: "__cdecl _imp_RtlInitializeCriticalSectionAndSpinCount" __imp_RtlInitializeCriticalSectionAndSpinCount
0x18000C9A0: GregorianKey
0x18000CCF0: "__cdecl _imp_RtlCompareUnicodeString" __imp_RtlCompareUnicodeString
0x18000D740: sLongDate_buffer
0x18000C7A8: iNegNumber
0x18000CB38: "__cdecl _imp_NtQueryValueKey" __imp_NtQueryValueKey
0x18000CE00: "__cdecl _imp_RtlCreateUnicodeString" __imp_RtlCreateUnicodeString
0x180004620: "__cdecl _security_check_cookie" __security_check_cookie
0x18000D400: "%SystemRoot%" ??_C@_1BK@HCAHJHON@?$AA?$CF?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAo?$AAo?$AAt?$AA?$CF?$AA?$AA@
0x18000CDA0: "__cdecl _imp_RtlLockHeap" __imp_RtlLockHeap
0x18000CCB0: "__cdecl _imp_NtDuplicateToken" __imp_NtDuplicateToken
0x180010A88: PBROADCASTSYSTEMMESSAGEEXW
0x180006E9C: BaseSrvAddSharedWowTask
0x180010A90: AppcontainerUserNameSpaceSeparation
0x18000CD68: "__cdecl _imp_NtVdmControl" __imp_NtVdmControl
0x18000AF6C: OkToRunInSharedWOW
0x180010610: BaseSrvIniFileMapping
0x18000A9F0: BaseSrvUpdateVDMSequenceNumber
0x18000C828: sShortDate
0x18000DC00: "Japanese" ??_C@_1BC@CIDGOICL@?$AAJ?$AAa?$AAp?$AAa?$AAn?$AAe?$AAs?$AAe?$AA?$AA@
0x180007038: BaseSrvAddWOWRecord
0x18000CD28: "__cdecl _imp_RtlInitAnsiString" __imp_RtlInitAnsiString
0x18000B1F8: BaseSrvFreeAppNameMapping
0x180001230: NlsUpdateCacheInfo
0x180010A94: InteractiveUserNameSpaceSeparation
0x18000D520: "Global" ??_C@_1O@CHBCJGPP@?$AAG?$AAl?$AAo?$AAb?$AAa?$AAl?$AA?$AA@
0x18000C7C8: iDigits
0x18000D788: iPaperSize_buffer
0x180009C5C: BaseSrvGetVdmSequence
0x18000C9C0: CalendarNames
0x18000D1A8: "\system32" ??_C@_1BE@MCHPLFCF@?$AA?2?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?$AA@
0x18000CBE8: "__cdecl _imp_NtMakeTemporaryObject" __imp_NtMakeTemporaryObject
0x180008FF4: BaseSrvFreeVDMInfo
0x18000DC48: "Thai" ??_C@_19CKACGOMD@?$AAT?$AAh?$AAa?$AAi?$AA?$AA@
0x180008E88: BaseSrvFreeConsoleRecord
0x18000B900: BaseSrvSoundSentryNotification
0x18000712C: BaseSrvAllocateConsoleRecord
0x18000CEA8: "__cdecl _guard_fids_table" __guard_fids_table
0x18000CC70: "__cdecl _imp_wcscpy_s" __imp_wcscpy_s
0x18000CAC8: "__cdecl _imp_CsrCreateProcess" __imp_CsrCreateProcess
0x18000C300: "__cdecl load_config_used" _load_config_used
0x1800099F0: BaseSrvGetUserToken
0x180006938: IsGlobalSymbolicLink
0x18000A564: BaseSrvRemoveDOSRecord
0x18000CD80: "__cdecl _imp_RtlCopySid" __imp_RtlCopySid
0x18000CF70: "\Sessions" ??_C@_1BE@GBAFMKEO@?$AA?2?$AAS?$AAe?$AAs?$AAs?$AAi?$AAo?$AAn?$AAs?$AA?$AA@
0x18000A9A0: BaseSrvUpdateVDMEntry
0x18000CF88: "%ws\%ld\BaseNamedObjects" ??_C@_1DC@BGGFLPH@?$AA?$CF?$AAw?$AAs?$AA?2?$AA?$CF?$AAl?$AAd?$AA?2?$AAB?$AAa?$AAs?$AAe?$AAN?$AAa?$AAm?$AAe?$AAd?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAs?$AA?$AA@
0x180008DE4: BaseSrvFindSharedWowRecordByDesktop
0x18000CE68: "__cdecl _imp_ZwClose" __imp_ZwClose
0x18000C928: LocaleName
0x180005940: BaseSrvDefineDosDevice
0x18000D040: "Session Manager\NamespaceSeparat" ??_C@_1EI@LJIHGMEF@?$AAS?$AAe?$AAs?$AAs?$AAi?$AAo?$AAn?$AA?5?$AAM?$AAa?$AAn?$AAa?$AAg?$AAe?$AAr?$AA?2?$AAN?$AAa?$AAm?$AAe?$AAs?$AAp?$AAa?$AAc?$AAe?$AAS?$AAe?$AAp?$AAa?$AAr?$AAa?$AAt@
0x18000C7E8: iMeasure
0x18000CCC0: "__cdecl _imp_NtSetInformationProcess" __imp_NtSetInformationProcess
0x18000CBD8: "__cdecl _imp_wcsnlen" __imp_wcsnlen
0x18000D330: "HKCU" ??_C@_19JAPAIJDE@?$AAH?$AAK?$AAC?$AAU?$AA?$AA@
0x18000CC88: "__cdecl _imp_RtlCreateUserThread" __imp_RtlCreateUserThread
0x18000CB80: "__cdecl _imp_NtQueryInformationProcess" __imp_NtQueryInformationProcess
0x18000D7B0: iLZero_buffer
0x18000CB48: "__cdecl _imp_NtClose" __imp_NtClose
0x18000CA80: LongDate
0x18000D340: "\BaseNamedObjects" ??_C@_1CE@NPBNEBGN@?$AA?2?$AAB?$AAa?$AAs?$AAe?$AAN?$AAa?$AAm?$AAe?$AAd?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAs?$AA?$AA@
0x18000CDD8: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x1800071CC: BaseSrvAllocateSharedWowRecord
0x18000D7C0: iNegNumber_buffer
0x18000CD08: "__cdecl _imp_RtlDestroyProcessParameters" __imp_RtlDestroyProcessParameters
0x18000CC20: "__cdecl _imp_RtlCopyLuid" __imp_RtlCopyLuid
0x18000CD60: "__cdecl _imp_RtlEqualSid" __imp_RtlEqualSid
0x1800089B0: BaseSrvExitVDMWorker
0x180006C54: BaseSrvAddDOSRecord
0x18000CD30: "__cdecl _imp_RtlAnsiStringToUnicodeString" __imp_RtlAnsiStringToUnicodeString
0x18000919C: BaseSrvGetConsoleRecord
0x180008F58: BaseSrvFreeSharedWowRecord
0x18000CC28: "__cdecl _imp_RtlLeaveCriticalSection" __imp_RtlLeaveCriticalSection
0x180008248: BaseSrvDupStandardHandles
0x180010700: wszDesktopName
0x180010908: BaseSrvHeap
0x18000CDE0: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x18000C728: iCalendarType
0x1800087AC: BaseSrvEnumWowTask
0x180010988: BaseSrvLowBoxObjectDirectory
0x18000DBE8: "Gregorian" ??_C@_1BE@DNKNKJMH@?$AAG?$AAr?$AAe?$AAg?$AAo?$AAr?$AAi?$AAa?$AAn?$AA?$AA@
0x18000DC28: "Korean" ??_C@_1O@IOFBOOI@?$AAK?$AAo?$AAr?$AAe?$AAa?$AAn?$AA?$AA@
0x18000D710: sShortDate_buffer
0x180004990: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x180008568: BaseSrvEnumWowProcess
0x180009E20: BaseSrvIsFirstVDM
0x180010960: BaseSrvCSDString
0x180003280: BaseSrvSaveAppNameMapping
0x18000DC90: Calendar_buffer
0x180010AA8: BaseSrvpBSMThreadCount
0x18000CE38: "__cdecl _imp_NtQueryObject" __imp_NtQueryObject
0x1800091CC: BaseSrvGetConsoleRecordByPid
0x1800045D0: FailSoundSentry
0x180010AB0: BSM_Request_Queue_End
0x18000CB68: "__cdecl _imp_NtCreateDirectoryObject" __imp_NtCreateDirectoryObject
0x18000D660: sMonGrouping_buffer
0x18000CDE8: "__cdecl _imp_RtlUnhandledExceptionFilter" __imp_RtlUnhandledExceptionFilter
0x18000CAD8: "__cdecl _imp_CsrRevertToSelf" __imp_CsrRevertToSelf
0x18000CE90: ntdll_NULL_THUNK_DATA
0x180009200: BaseSrvGetNextVDMCommand
0x18000CE80: "__cdecl _imp_memcpy" __imp_memcpy
0x18000C040: BnoRegistryConfigurationTable
0x18000C918: sCountry
0x18000CC40: "__cdecl _imp_RtlAddMandatoryAce" __imp_RtlAddMandatoryAce
0x18000EA94: "__cdecl _IMPORT_DESCRIPTOR_CSRSRV" __IMPORT_DESCRIPTOR_CSRSRV
0x180010060: bCacheDirty
0x180002C70: BaseSrvInitializeIniFileMappings
0x18000C7F8: iCountry
0x18000CCA0: "__cdecl _imp_LdrUnloadDll" __imp_LdrUnloadDll
0x18000D5A8: sList_buffer
0x18000DC38: "Hijri" ??_C@_1M@NOFIHPBE@?$AAH?$AAi?$AAj?$AAr?$AAi?$AA?$AA@
0x18000D6F0: s1159_buffer
0x180010680: BaseSrvVDMCriticalSection
0x18000DC18: "Taiwan" ??_C@_1O@DACCAJCF@?$AAT?$AAa?$AAi?$AAw?$AAa?$AAn?$AA?$AA@
0x180010050: "__cdecl _security_cookie" __security_cookie
0x180010068: hCPanelIntlKeyRead
0x18000CC90: "__cdecl _imp_RtlExitUserThread" __imp_RtlExitUserThread
0x18000D440: "\Registry\Machine\System\Current" ??_C@_1GO@JKPDFJJL@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x18000C170: BaseServerRegistryConfigurationTable1
0x180004040: BaseSrvRegisterThread
0x180007060: BaseSrvAddWowTask
0x18000C100: BaseServerRegistryConfigurationTable
0x18000D1E0: "BASESHR!" ??_C@_1BC@KFJCOHCI@?$AAB?$AAA?$AAS?$AAE?$AAS?$AAH?$AAR?$AA?$CB?$AA?$AA@
0x18000CCF8: "__cdecl _imp_RtlCreateProcessParametersEx" __imp_RtlCreateProcessParametersEx
0x18000D6A0: sNegativeSign_buffer
0x18000D990: "WinStationBroadcastSystemMessage" ??_C@_0CB@KDBMEJIP@WinStationBroadcastSystemMessage@
0x180004560: BaseSrvDeadEntry
0x18000D7F0: iCurrDigits_buffer
0x18000CBE0: "__cdecl _imp_NtQuerySymbolicLinkObject" __imp_NtQuerySymbolicLinkObject
0x18000CBF8: "__cdecl _imp_RtlAllocateAndInitializeSid" __imp_RtlAllocateAndInitializeSid
0x18000CB00: "__cdecl _imp__vsnwprintf" __imp__vsnwprintf
0x18000D4B0: "AppcontainerUserSeparation" ??_C@_1DG@LEAFODHN@?$AAA?$AAp?$AAp?$AAc?$AAo?$AAn?$AAt?$AAa?$AAi?$AAn?$AAe?$AAr?$AAU?$AAs?$AAe?$AAr?$AAS?$AAe?$AAp?$AAa?$AAr?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x18000CD58: "__cdecl _imp_DbgPrint" __imp_DbgPrint
0x180010000: "__cdecl UserSoundSentry" _UserSoundSentry
0x180008418: BaseSrvEnumSepWow
0x180010978: BaseSrvNamedObjectDirectory
0x18000D1C0: BaseServerApiServerValidTable
0x18000CB78: "__cdecl _imp_NtCreateSymbolicLinkObject" __imp_NtCreateSymbolicLinkObject
0x18000D5D0: sThousand_buffer
0x1800065D0: BroadcastDriveLetterChange
0x18000BBF8: CalendarIdFromString
0x18000CDA8: "__cdecl _imp_RtlUnlockHeap" __imp_RtlUnlockHeap
0x180003E40: BaseClientDisconnectRoutine
0x180004868: "__cdecl _security_init_cookie" __security_init_cookie
0x180004220: BaseSrvSetTermsrvClientTimeZone
0x18000CE78: "__cdecl _imp_NtQueryMultipleValueKey" __imp_NtQueryMultipleValueKey
0x18000CB10: "__cdecl _imp_NtQuerySystemInformation" __imp_NtQuerySystemInformation
0x18000B12C: BaseSrvEqualFileMappings
0x18000D938: "\GLOBAL??\" ??_C@_1BG@KEFMGHOI@?$AA?2?$AAG?$AAL?$AAO?$AAB?$AAA?$AAL?$AA?$DP?$AA?$DP?$AA?2?$AA?$AA@
0x18000D7D8: NumShape_buffer
0x18000DC68: "Persian" ??_C@_1BA@NBJJFLCF@?$AAP?$AAe?$AAr?$AAs?$AAi?$AAa?$AAn?$AA?$AA@
0x18000CAA0: "__cdecl _imp_CsrUnlockThread" __imp_CsrUnlockThread
0x18000CBD0: "__cdecl _imp_NtOpenSymbolicLinkObject" __imp_NtOpenSymbolicLinkObject
0x180010918: BaseSrvSharedHeap
0x180007BC0: BaseSrvClosePairWaitHandles
0x18000CDF0: "__cdecl _imp_memmove" __imp_memmove
0x18000B0B0: BaseSrvEqualAppNameMappings
0x18000CD10: "__cdecl _imp_RtlAppendStringToString" __imp_RtlAppendStringToString
0x18000CB30: "__cdecl _imp_NtOpenKey" __imp_NtOpenKey
0x180010660: IoStatusBlock
0x180004976: RtlVirtualUnwind
0x18000CC38: "__cdecl _imp_RtlAddAccessAllowedAceEx" __imp_RtlAddAccessAllowedAceEx
0x1800081EC: BaseSrvDeleteSharedWowRecord
0x18000D880: sCurrency_buffer
0x1800033C0: CreateBaseAcls
0x18000D838: iFirstDayOfWeek_buffer
0x18000CC30: "__cdecl _imp_RtlLengthSid" __imp_RtlLengthSid
0x18000D808: iCurrency_buffer
0x18000CBB0: "__cdecl _imp_RtlDeleteCriticalSection" __imp_RtlDeleteCriticalSection
0x18000B840: IsCallerAdminsOrSystem
0x180001170: BaseSrvNlsGetUserInfo
0x180004670: "__cdecl _report_gsfailure" __report_gsfailure
0x18000C410: OverrideDetails
0x18000CE08: "__cdecl _imp_RtlExpandEnvironmentStrings_U" __imp_RtlExpandEnvironmentStrings_U
0x18000CD78: "__cdecl _imp_NtNotifyChangeKey" __imp_NtNotifyChangeKey
0x18000CE48: "__cdecl _imp_ZwCreateKey" __imp_ZwCreateKey
0x1800099C0: BaseSrvGetSharedWowRecordByPid
0x18000B280: BaseSrvFreeVarNameMapping
0x18000D0B0: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1JM@DKEOAECH@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x18000C2E0: ExplicitSettingsKey
0x180003338: BaseSrvSaveFileNameMapping
0x18000D640: sMonThousandSep_buffer
0x180008AA8: BaseSrvFillPifInfo
0x18000B18C: BaseSrvEqualVarNameMappings
0x18000CD70: "__cdecl _imp_NtCreateKey" __imp_NtCreateKey
0x18000CB60: "__cdecl _imp_RtlSetSaclSecurityDescriptor" __imp_RtlSetSaclSecurityDescriptor
0x18000DB18: "SoundSentry" ??_C@_0M@PNFAIEJM@SoundSentry?$AA@
0x180008960: BaseSrvExitVDM
0x18000CB58: "__cdecl _imp_RtlSetDaclSecurityDescriptor" __imp_RtlSetDaclSecurityDescriptor
0x18000CDB0: "__cdecl _imp_RtlInitializeSidEx" __imp_RtlInitializeSidEx
0x18000CCD8: "__cdecl _imp_NtDuplicateObject" __imp_NtDuplicateObject
0x18000C990: ShortDate
0x18000D5E8: sGrouping_buffer
0x18000D700: s2359_buffer
0x180007614: BaseSrvCheckProcessAccess
0x1800084C4: BaseSrvEnumSharedWow
0x18000CCE8: "__cdecl _imp_NtSetEvent" __imp_NtSetEvent
0x1800041B0: BaseSrvCreateActivationContext
0x18000CE70: "__cdecl _imp_ZwOpenKey" __imp_ZwOpenKey
0x18000D098: "SYS:" ??_C@_19BBLDCALD@?$AAS?$AAY?$AAS?$AA?3?$AA?$AA@
0x180004AD3: memset
0x18000EAA8: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x1800047DC: "__cdecl _report_securityfailure" __report_securityfailure
0x180003C1C: RtlStringCchPrintfW
0x180006848: CreateBSMThread

[JEB Decompiler by PNF Software]