Generated by JEB on 2019/08/01

PE: C:\Windows\System32\fsutilext.dll Base=0x180000000 SHA-256=60643E57B82645F58EC429DD40DB6E7C453D4A7A9B3408B7C607DCCAA62774B5
PDB: fsutilext.pdb GUID={604A5E35-F336-D7BC-7F6B5CDA081FE6FD} Age=1

329 located named symbols:
0x180004894: "__cdecl _raise_securityfailure" __raise_securityfailure
0x1800061F0: api-ms-win-core-file-l1-1-0_NULL_THUNK_DATA
0x180004B60: "__cdecl FindPESection" _FindPESection
0x1800011F8: StringCchCatW
0x1800062A8: "__cdecl _imp_SetThreadToken" __imp_SetThreadToken
0x180004010: "__cdecl _delayLoadHelper2" __delayLoadHelper2
0x180006390: "__cdecl _imp_RtlFreeUnicodeString" __imp_RtlFreeUnicodeString
0x18000785C: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x180002048: WPP_SF_DdDDD
0x180009020: "__cdecl _security_cookie_complement" __security_cookie_complement
0x180006248: "__cdecl _imp_DeviceIoControl" __imp_DeviceIoControl
0x18000438C: "__cdecl CRT_INIT" _CRT_INIT
0x180001940: "unsigned char __cdecl CheckSonyMSWorker(long * __ptr64,void * __ptr64,unsigned char * __ptr64)" ?CheckSonyMSWorker@@YAEPEAJPEAXPEAE@Z
0x180006168: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x180004ED0: "__cdecl _tailMerge_cfgmgr32_dll" __tailMerge_cfgmgr32_dll
0x1800063D0: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x180005120: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x1800061E8: "__cdecl _imp_CreateFileW" __imp_CreateFileW
0x1800065F8: "FveGetStatusBasicW" ??_C@_0BD@NGJFDCEJ@FveGetStatusBasicW?$AA@
0x180006628: "FveDisableAuthenticationW" ??_C@_0BK@DMCBIGBO@FveDisableAuthenticationW?$AA@
0x1800065C0: WPP_248f098777b138134d820c9c5ab7a153_Traceguids
0x180001640: "unsigned char __cdecl GetDeviceInstanceWorker(unsigned short const * __ptr64,unsigned long * __ptr64)" ?GetDeviceInstanceWorker@@YAEPEBGPEAK@Z
0x180006880: "CacheDisable" ??_C@_1BK@KBMDKACK@?$AAC?$AAa?$AAc?$AAh?$AAe?$AAD?$AAi?$AAs?$AAa?$AAb?$AAl?$AAe?$AA?$AA@
0x180004F73: "__cdecl _imp_load_CM_Get_Parent_Ex" __imp_load_CM_Get_Parent_Ex
0x1800069B0: "__cdecl _pfnDliFailureHook2" __pfnDliFailureHook2
0x180007910: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-1-0
0x180006238: api-ms-win-core-heap-l2-1-0_NULL_THUNK_DATA
0x180006178: "__cdecl _imp_FindVolumeMountPointClose" __imp_FindVolumeMountPointClose
0x180006448: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x180002E8C: FveDetectVolumeEx
0x180004F85: "__cdecl _imp_load_CM_Get_DevNode_Custom_PropertyW" __imp_load_CM_Get_DevNode_Custom_PropertyW
0x1800066E8: "FveGetSecureBootBindingState" ??_C@_0BN@BEJFNBJC@FveGetSecureBootBindingState?$AA@
0x1800065B8: "%d" ??_C@_02DPKJAMEF@?$CFd?$AA@
0x180004B45: "__cdecl XcptFilter" _XcptFilter
0x180006450: "__cdecl _xc_a" __xc_a
0x180006500: "__cdecl _sz_CFGMGR32_dll" __sz_CFGMGR32_dll
0x180001170: StringCchCopyW
0x180001030: "void * __ptr64 __cdecl FindFirstVolumeMountPointWStub(unsigned short const * __ptr64,unsigned short * __ptr64,unsigned long)" ?FindFirstVolumeMountPointWStub@@YAPEAXPEBGPEAGK@Z
0x180006550: "MEMORYSTICK-MG" ??_C@_1BO@PKJECPMG@?$AAM?$AAE?$AAM?$AAO?$AAR?$AAY?$AAS?$AAT?$AAI?$AAC?$AAK?$AA?9?$AAM?$AAG?$AA?$AA@
0x180006858: "bitlocker " ??_C@_0CB@INNHGIKN@bitlocker?5?5?5?5?5?5?5?5?5?5?5?5?5?5?5?5?5?5?5?5?5?5?5@
0x180006220: api-ms-win-core-heap-l1-1-0_NULL_THUNK_DATA
0x180007368: CFGMGR32_NULL_THUNK_DATA_DLN
0x180007590: CFGMGR32_NULL_THUNK_DATA_DLB
0x18000B058: CFGMGR32_NULL_THUNK_DATA_DLA
0x180006648: "FveEnableAuthenticationW" ??_C@_0BJ@FJJEGOKG@FveEnableAuthenticationW?$AA@
0x1800064D8: "__cdecl _guard_iat_table" __guard_iat_table
0x1800050E9: memcpy
0x1800026B8: "public: static unsigned char __cdecl IFS_SYSTEM::DismountVolume(class WSTRING const * __ptr64)" ?DismountVolume@IFS_SYSTEM@@SAEPEBVWSTRING@@@Z
0x180006268: "__cdecl _imp_LoadLibraryExW" __imp_LoadLibraryExW
0x1800064F0: "__cdecl _sz_USER32_dll" __sz_USER32_dll
0x180003C94: FvepIsVolumeEncryptedCached
0x180006910: "%02X" ??_C@_19HHMHINIL@?$AA?$CF?$AA0?$AA2?$AAX?$AA?$AA@
0x180006380: "__cdecl _imp_memset" __imp_memset
0x1800073A0: USER32_NULL_THUNK_DATA_DLN
0x180004E27: "__cdecl _imp_load_LsaClose" __imp_load_LsaClose
0x18000B090: USER32_NULL_THUNK_DATA_DLA
0x180004D2C: "__cdecl initterm" _initterm
0x18000B020: "__cdecl _imp_TraceMessage" __imp_TraceMessage
0x180007580: USER32_NULL_THUNK_DATA_DLB
0x1800078FC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0
0x180009610: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x180006240: "__cdecl _imp_GetOverlappedResult" __imp_GetOverlappedResult
0x1800061A0: "__cdecl _imp_Sleep" __imp_Sleep
0x180006470: "__cdecl _xi_z" __xi_z
0x180006148: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x180004D38: "__cdecl _C_specific_handler" __C_specific_handler
0x180003820: FvepConvertVolumeNameToCacheValueName
0x180006170: "__cdecl _imp_FindFirstVolumeMountPointW" __imp_FindFirstVolumeMountPointW
0x1800069E8: FveVolSig
0x1800050F5: memmove
0x180006210: "__cdecl _imp_HeapFree" __imp_HeapFree
0x1800012D0: "unsigned char __cdecl GetDeviceIDDiskFromDeviceIDVolumeWorker(unsigned long,unsigned short * __ptr64,unsigned long)" ?GetDeviceIDDiskFromDeviceIDVolumeWorker@@YAEKPEAGK@Z
0x180006200: api-ms-win-core-handle-l1-1-0_NULL_THUNK_DATA
0x180006198: "__cdecl _imp_RegCloseKey" __imp_RegCloseKey
0x1800069B8: EOW_INFORMATION_OFFSET_GUID
0x18000507C: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x180001BF0: "unsigned char __cdecl GetWidgetWorker(void * __ptr64 * __ptr64,unsigned long * __ptr64)" ?GetWidgetWorker@@YAEPEAPEAXPEAK@Z
0x180003170: FvepCheckForVolumeControlFiles
0x180004F61: "__cdecl _imp_load_CM_Get_DevNode_Registry_Property_ExW" __imp_load_CM_Get_DevNode_Registry_Property_ExW
0x1800063D8: "__cdecl _imp_RtlAllocateHeap" __imp_RtlAllocateHeap
0x1800063F8: "__cdecl _imp_?DisplayMsg@MESSAGE@@QEAAEKPEBDZZ" __imp_?DisplayMsg@MESSAGE@@QEAAEKPEBDZZ
0x180006698: "FveGetAuthMethodInformation" ??_C@_0BM@CMICKKDM@FveGetAuthMethodInformation?$AA@
0x180007938: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0
0x1800062C8: "__cdecl _imp_RegSetValueExW" __imp_RegSetValueExW
0x180004B51: "__cdecl amsg_exit" _amsg_exit
0x180003464: FvepIsBandBitLockerManaged
0x1800069AC: "__cdecl _DefaultResolveDelayLoadedAPIFlags" __DefaultResolveDelayLoadedAPIFlags
0x180003790: FvepIsNonDriverEncryptionStatusCachingAllowed
0x180006408: "__cdecl _imp_?DisplayMsg@MESSAGE@@QEAAEK@Z" __imp_?DisplayMsg@MESSAGE@@QEAAEK@Z
0x180006708: "\\?\GLOBALROOT" ??_C@_1BO@NLDNEEHD@?$AA?2?$AA?2?$AA?$DP?$AA?2?$AAG?$AAL?$AAO?$AAB?$AAA?$AAL?$AAR?$AAO?$AAO?$AAT?$AA?$AA@
0x180004E39: "__cdecl _imp_load_SystemParametersInfoW" __imp_load_SystemParametersInfoW
0x18000358C: FvepIsVolumeEncryptedNoDriverTest
0x1800062D0: api-ms-win-core-registry-l1-1-0_NULL_THUNK_DATA
0x1800062E8: "__cdecl _imp_CreateEventA" __imp_CreateEventA
0x1800061D0: api-ms-win-core-errorhandling-l1-1-0_NULL_THUNK_DATA
0x1800064E0: "__cdecl _sz_ADVAPI32_dll" __sz_ADVAPI32_dll
0x180006280: "__cdecl _imp_VirtualFree" __imp_VirtualFree
0x180006128: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x1800023C0: "unsigned char __cdecl WaitForUnitAndReportProgressWorker(void * __ptr64,class MESSAGE * __ptr64)" ?WaitForUnitAndReportProgressWorker@@YAEPEAXPEAVMESSAGE@@@Z
0x180009600: "__cdecl _native_startup_lock" __native_startup_lock
0x180006580: "FVEAPI" ??_C@_06GBCDLJLF@FVEAPI?$AA@
0x180004D20: DllMain
0x180002130: "unsigned char __cdecl SendWithSenseParseWorker(void * __ptr64,union _CDB * __ptr64,unsigned char,void * __ptr64,unsigned long * __ptr64,unsigned char,unsigned long)" ?SendWithSenseParseWorker@@YAEPEAXPEAT_CDB@@E0PEAKEK@Z
0x180006370: "__cdecl _imp__wcsicmp" __imp__wcsicmp
0x180006338: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x1800061A8: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x180006270: api-ms-win-core-libraryloader-l1-2-0_NULL_THUNK_DATA
0x1800061C0: KERNEL32_NULL_THUNK_DATA
0x180007338: ADVAPI32_NULL_THUNK_DATA_DLN
0x1800063F0: "__cdecl _imp_?Initialize@WSTRING@@QEAAEPEBV1@KK@Z" __imp_?Initialize@WSTRING@@QEAAEPEBV1@KK@Z
0x180007550: ADVAPI32_NULL_THUNK_DATA_DLB
0x18000B028: ADVAPI32_NULL_THUNK_DATA_DLA
0x180006190: "__cdecl _imp_GetLastError" __imp_GetLastError
0x180009010: "__cdecl _native_dllmain_reason" __native_dllmain_reason
0x180005058: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x180006320: "__cdecl _imp_memcmp" __imp_memcmp
0x18000B060: "__cdecl _imp_SetupDiDestroyDeviceInfoList" __imp_SetupDiDestroyDeviceInfoList
0x180004F97: "__cdecl _imp_load_SetupDiCreateDeviceInfoList" __imp_load_SetupDiCreateDeviceInfoList
0x1800063C0: "__cdecl _imp_NtDeviceIoControlFile" __imp_NtDeviceIoControlFile
0x180006520: "DeviceGroup" ??_C@_1BI@NJDOFMLD@?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAG?$AAr?$AAo?$AAu?$AAp?$AA?$AA@
0x1800061B8: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x1800069AC: "__cdecl _ResolveDelayLoadedAPIFlags" __ResolveDelayLoadedAPIFlags
0x180004C10: "__cdecl ValidateImageBase" _ValidateImageBase
0x18000B010: "__cdecl _imp_LsaQueryInformationPolicy" __imp_LsaQueryInformationPolicy
0x1800063B0: "__cdecl _imp_RtlFreeHeap" __imp_RtlFreeHeap
0x180006310: "__cdecl _imp_DuplicateTokenEx" __imp_DuplicateTokenEx
0x1800078D4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0
0x1800095D8: "__cdecl _hmod__SETUPAPI_dll" __hmod__SETUPAPI_dll
0x180001060: WPP_SF_
0x180006218: "__cdecl _imp_HeapAlloc" __imp_HeapAlloc
0x180006258: "__cdecl _imp_FreeLibrary" __imp_FreeLibrary
0x180006398: "__cdecl _imp_RtlDosPathNameToNtPathName_U" __imp_RtlDosPathNameToNtPathName_U
0x1800072EC: "__cdecl _NULL_DELAY_IMPORT_DESCRIPTOR" __NULL_DELAY_IMPORT_DESCRIPTOR
0x18000B050: "__cdecl _imp_CM_Get_Parent_Ex" __imp_CM_Get_Parent_Ex
0x180006510: "__cdecl _sz_SETUPAPI_dll" __sz_SETUPAPI_dll
0x1800067C0: "\System Volume Information\FVE2." ??_C@_1JC@ODMJENGO@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?5?$AAV?$AAo?$AAl?$AAu?$AAm?$AAe?$AA?5?$AAI?$AAn?$AAf?$AAo?$AAr?$AAm?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?2?$AAF?$AAV?$AAE?$AA2?$AA?4@
0x1800045D0: "__cdecl DllMainCRTStartup" _DllMainCRTStartup
0x180003F4C: StringCchCatNW
0x180006340: "__cdecl _imp__initterm" __imp__initterm
0x180004E03: "__cdecl _imp_load_LsaQueryInformationPolicy" __imp_load_LsaQueryInformationPolicy
0x180006730: "\System Volume Information\FVE.{" ??_C@_1JA@MPDPDJMC@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?5?$AAV?$AAo?$AAl?$AAu?$AAm?$AAe?$AA?5?$AAI?$AAn?$AAf?$AAo?$AAr?$AAm?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?2?$AAF?$AAV?$AAE?$AA?4?$AA?$HL@
0x1800061C8: "__cdecl _imp_SetLastError" __imp_SetLastError
0x1800075C0: SETUPAPI_NULL_THUNK_DATA_DLB
0x18000B080: SETUPAPI_NULL_THUNK_DATA_DLA
0x180007390: SETUPAPI_NULL_THUNK_DATA_DLN
0x180004098: FveFindGuidRecognition
0x180007848: "__cdecl _IMPORT_DESCRIPTOR_ulib" __IMPORT_DESCRIPTOR_ulib
0x180007960: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0
0x1800095C8: "__cdecl _hmod__USER32_dll" __hmod__USER32_dll
0x1800095F0: "__cdecl _onexitend" __onexitend
0x180006308: "__cdecl _imp_AdjustTokenPrivileges" __imp_AdjustTokenPrivileges
0x180006440: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x180004D72: "__cdecl _tailMerge_advapi32_dll" __tailMerge_advapi32_dll
0x180006120: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x1800068A0: "SOFTWARE\Microsoft\Windows NT\Cu" ??_C@_1GO@MJHNPMJJ@?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAN?$AAT?$AA?2?$AAC?$AAu@
0x1800069D8: RefsVolSig
0x180005022: "__cdecl _imp_load_SetupDiOpenDeviceInterfaceW" __imp_load_SetupDiOpenDeviceInterfaceW
0x180006300: api-ms-win-core-sysinfo-l1-1-0_NULL_THUNK_DATA
0x180006460: "__cdecl _xi_a" __xi_a
0x180005034: "__cdecl _imp_load_SetupDiGetDeviceInterfaceDetailW" __imp_load_SetupDiGetDeviceInterfaceDetailW
0x180006158: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x180006138: "__cdecl _imp_ResolveDelayLoadedAPI" __imp_ResolveDelayLoadedAPI
0x180001010: "int __cdecl FindVolumeMountPointCloseStub(void * __ptr64)" ?FindVolumeMountPointCloseStub@@YAHPEAX@Z
0x1800072CC: "__cdecl _DELAY_IMPORT_DESCRIPTOR_SETUPAPI_dll" __DELAY_IMPORT_DESCRIPTOR_SETUPAPI_dll
0x1800063E8: "__cdecl _imp_?QueryWSTR@WSTRING@@QEBAPEAGKKPEAGKE@Z" __imp_?QueryWSTR@WSTRING@@QEBAPEAGKKPEAGKE@Z
0x180006318: api-ms-win-security-base-l1-1-0_NULL_THUNK_DATA
0x1800095C0: "__cdecl _hmod__ADVAPI32_dll" __hmod__ADVAPI32_dll
0x18000111C: WPP_SF_dd
0x180004E45: "__cdecl _tailMerge_user32_dll" __tailMerge_user32_dll
0x180009000: WPP_GLOBAL_Control
0x180007924: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0
0x180006288: api-ms-win-core-memory-l1-1-0_NULL_THUNK_DATA
0x180001084: WPP_SF_D
0x180001084: WPP_SF_d
0x180004A48: "__cdecl _report_rangecheckfailure" __report_rangecheckfailure
0x180009618: "__cdecl pRawDllMain" _pRawDllMain
0x1800065A8: "FveCloseVolume" ??_C@_0P@EMKHMBJF@FveCloseVolume?$AA@
0x180006A08: NtfsVolSig
0x1800069C8: INFORMATION_OFFSET_GUID
0x18000B088: "__cdecl _imp_SystemParametersInfoW" __imp_SystemParametersInfoW
0x1800078E8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-l1-1-0
0x18000B018: "__cdecl _imp_LsaFreeMemory" __imp_LsaFreeMemory
0x180004870: "__cdecl _security_check_cookie" __security_check_cookie
0x180006458: "__cdecl _xc_z" __xc_z
0x1800029F8: SptpSaferDeviceIoControl
0x180007898: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0
0x1800062B0: api-ms-win-core-processthreads-l1-1-0_NULL_THUNK_DATA
0x180006260: "__cdecl _imp_GetProcAddress" __imp_GetProcAddress
0x1800065E0: "\FVEAPI.DLL" ??_C@_1BI@FGJLBPOB@?$AA?2?$AAF?$AAV?$AAE?$AAA?$AAP?$AAI?$AA?4?$AAD?$AAL?$AAL?$AA?$AA@
0x180004FA3: "__cdecl _tailMerge_setupapi_dll" __tailMerge_setupapi_dll
0x1800066D0: "FveCommitChanges" ??_C@_0BB@JOGJBFML@FveCommitChanges?$AA@
0x180003D8C: FvepSetVolumeEncryptedCached
0x180006250: api-ms-win-core-io-l1-1-0_NULL_THUNK_DATA
0x180006160: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x18000728C: "__cdecl _DELAY_IMPORT_DESCRIPTOR_USER32_dll" __DELAY_IMPORT_DESCRIPTOR_USER32_dll
0x180001020: "int __cdecl FindNextVolumeMountPointWStub(void * __ptr64,unsigned short * __ptr64,unsigned long)" ?FindNextVolumeMountPointWStub@@YAHPEAXPEAGK@Z
0x180005046: "__cdecl _imp_load_SetupDiDestroyDeviceInfoList" __imp_load_SetupDiDestroyDeviceInfoList
0x180006228: "__cdecl _imp_LocalAlloc" __imp_LocalAlloc
0x180006140: "__cdecl _imp_DelayLoadFailureHook" __imp_DelayLoadFailureHook
0x180006610: "FveSetFipsAllowDisabled" ??_C@_0BI@CKKFOLCK@FveSetFipsAllowDisabled?$AA@
0x180006208: "__cdecl _imp_GetProcessHeap" __imp_GetProcessHeap
0x1800062E0: api-ms-win-core-rtlsupport-l1-1-0_NULL_THUNK_DATA
0x180004D66: "__cdecl _imp_load_TraceMessage" __imp_load_TraceMessage
0x1800066B8: "FveDeleteAuthMethod" ??_C@_0BE@GLFFNIOJ@FveDeleteAuthMethod?$AA@
0x180007974: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0
0x18000B000: "__cdecl _imp_LsaClose" __imp_LsaClose
0x180006478: "__cdecl _guard_fids_table" __guard_fids_table
0x180006388: msvcrt_NULL_THUNK_DATA
0x18000B030: "__cdecl _imp_CM_Get_Device_Interface_List_Size_ExW" __imp_CM_Get_Device_Interface_List_Size_ExW
0x180006010: "__cdecl load_config_used" _load_config_used
0x180009624: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUmthxyUxlimvihglmvUuevwvgvxgUlyquivUznwGEUkivxlnkOlyq@fvedetect" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUmthxyUxlimvihglmvUuevwvgvxgUlyquivUznwGEUkivxlnkOlyq@fvedetect
0x180007884: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-io-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-io-l1-1-0
0x180006378: "__cdecl _imp_wcsnlen" __imp_wcsnlen
0x180006358: "__cdecl _imp__amsg_exit" __imp__amsg_exit
0x1800063B8: "__cdecl _imp_NtClose" __imp_NtClose
0x1800095E0: "class CLASS_DESCRIPTOR const * __ptr64 const __ptr64 MEDIA_TRACK_INFORMATION_cd" ?MEDIA_TRACK_INFORMATION_cd@@3PEBVCLASS_DESCRIPTOR@@EB
0x1800061B0: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x180004EC4: "__cdecl _imp_load_CM_Get_Device_Interface_List_Size_ExW" __imp_load_CM_Get_Device_Interface_List_Size_ExW
0x180006118: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x180004E15: "__cdecl _imp_load_LsaFreeMemory" __imp_load_LsaFreeMemory
0x180006278: "__cdecl _imp_VirtualAlloc" __imp_VirtualAlloc
0x180001050: "unsigned short __cdecl SetThreadUILanguageStub(unsigned short)" ?SetThreadUILanguageStub@@YAGG@Z
0x180006538: "MEMORYSTICK" ??_C@_1BI@MAOFKHDE@?$AAM?$AAE?$AAM?$AAO?$AAR?$AAY?$AAS?$AAT?$AAI?$AAC?$AAK?$AA?$AA@
0x1800063A0: "__cdecl _imp_NtFsControlFile" __imp_NtFsControlFile
0x180006150: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x180006668: "FveGetStatus" ??_C@_0N@NBDGPLHI@FveGetStatus?$AA@
0x1800069B0: "__cdecl _pfnDefaultDliFailureHook2" __pfnDefaultDliFailureHook2
0x1800072AC: "__cdecl _DELAY_IMPORT_DESCRIPTOR_CFGMGR32_dll" __DELAY_IMPORT_DESCRIPTOR_CFGMGR32_dll
0x1800095E8: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUuhUfgrohUruhfgroUhixUvcgoryUlyquivUznwGEUkxsOlyq@ifsutilext" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUuhUfgrohUruhfgroUhixUvcgoryUlyquivUznwGEUkxsOlyq@ifsutilext
0x180004D50: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x1800050DD: memcmp
0x1800062F8: "__cdecl _imp_GetSystemDirectoryW" __imp_GetSystemDirectoryW
0x180009620: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUmthxyUxlimvihglmvUuevelooryUxmtUlyquivUznwGEUkivxlnkOlyq@FveVolLibCNG" __@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUmthxyUxlimvihglmvUuevelooryUxmtUlyquivUznwGEUkivxlnkOlyq@FveVolLibCNG
0x1800078AC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0
0x18000B070: "__cdecl _imp_SetupDiCreateDeviceInfoList" __imp_SetupDiCreateDeviceInfoList
0x18000B008: "__cdecl _imp_LsaOpenPolicy" __imp_LsaOpenPolicy
0x18000404C: CompareOEMFields
0x180001040: "int __cdecl SystemParametersInfoWStub(unsigned int,unsigned int,void * __ptr64,unsigned int)" ?SystemParametersInfoWStub@@YAHIIPEAXI@Z
0x18000726C: "__cdecl _DELAY_IMPORT_DESCRIPTOR_ADVAPI32_dll" __DELAY_IMPORT_DESCRIPTOR_ADVAPI32_dll
0x180006360: "__cdecl _imp__XcptFilter" __imp__XcptFilter
0x180006180: "__cdecl _imp_SetThreadUILanguage" __imp_SetThreadUILanguage
0x180006420: "__cdecl _imp_?Initialize@WSTRING@@QEAAEPEBGK@Z" __imp_?Initialize@WSTRING@@QEAAEPEBGK@Z
0x1800063E0: ntdll_NULL_THUNK_DATA
0x180006328: "__cdecl _imp_memcpy" __imp_memcpy
0x1800069A0: "Cache" ??_C@_1M@ELMJBOIA@?$AAC?$AAa?$AAc?$AAh?$AAe?$AA?$AA@
0x1800020C8: WPP_SF_Ddd
0x1800010C0: WPP_SF_DDD
0x180002D8C: FvepDetectVolumeWithDriver
0x1800025C4: "public: static unsigned char __cdecl IFS_SYSTEM::DosDriveNameToNtDriveName(class WSTRING const * __ptr64,class WSTRING * __ptr64)" ?DosDriveNameToNtDriveName@IFS_SYSTEM@@SAEPEBVWSTRING@@PEAV2@@Z
0x1800078C0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0
0x1800027D4: SptSendCdbToDeviceEx
0x180009018: "__cdecl _security_cookie" __security_cookie
0x180003ECC: StringCbPrintfW
0x1800061F8: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x1800062D8: "__cdecl _imp_RtlCompareMemory" __imp_RtlCompareMemory
0x180004F4F: "__cdecl _imp_load_CM_Get_Device_Interface_List_ExW" __imp_load_CM_Get_Device_Interface_List_ExW
0x180006230: "__cdecl _imp_LocalFree" __imp_LocalFree
0x180007870: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0
0x1800061D8: "__cdecl _imp_GetFileAttributesW" __imp_GetFileAttributesW
0x180001CE0: "unsigned char __cdecl InvalidateFveWorker(class DSTRING * __ptr64,class MESSAGE * __ptr64,struct _FORMATEX_FN_PARAM * __ptr64)" ?InvalidateFveWorker@@YAEPEAVDSTRING@@PEAVMESSAGE@@PEAU_FORMATEX_FN_PARAM@@@Z
0x180004004: "__cdecl TlgDefineProvider_annotation__Tlgg_hFveDetectProviderProv" _TlgDefineProvider_annotation__Tlgg_hFveDetectProviderProv
0x1800062B8: "__cdecl _imp_RegCreateKeyExW" __imp_RegCreateKeyExW
0x1800095F8: "__cdecl _onexitbegin" __onexitbegin
0x180006368: "__cdecl _imp__vsnwprintf" __imp__vsnwprintf
0x180006130: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x180006290: "__cdecl _imp_GetCurrentThread" __imp_GetCurrentThread
0x180007834: "__cdecl _IMPORT_DESCRIPTOR_KERNEL32" __IMPORT_DESCRIPTOR_KERNEL32
0x180004C44: "__cdecl _security_init_cookie" __security_init_cookie
0x18000B048: "__cdecl _imp_CM_Get_DevNode_Registry_Property_ExW" __imp_CM_Get_DevNode_Registry_Property_ExW
0x1800062C0: "__cdecl _imp_RegGetValueW" __imp_RegGetValueW
0x180002FE4: FvepAcquirePrivilege
0x180006438: ulib_NULL_THUNK_DATA
0x180006410: "__cdecl _imp_?QueryLibraryEntryPoint@SYSTEM@@SAP6A_JXZPEBVWSTRING@@0PEAPEAX@Z" __imp_?QueryLibraryEntryPoint@SYSTEM@@SAP6A_JXZPEBVWSTRING@@0PEAPEAX@Z
0x180006188: "__cdecl _imp_FindNextVolumeMountPointW" __imp_FindNextVolumeMountPointW
0x180007820: "__cdecl _IMPORT_DESCRIPTOR_msvcrt" __IMPORT_DESCRIPTOR_msvcrt
0x180006330: "__cdecl _imp_memmove" __imp_memmove
0x180006678: "FveAddAuthMethodInformation" ??_C@_0BM@MHAOCFPB@FveAddAuthMethodInformation?$AA@
0x180006348: "__cdecl _imp_malloc" __imp_malloc
0x18000B040: "__cdecl _imp_CM_Get_Device_Interface_List_ExW" __imp_CM_Get_Device_Interface_List_ExW
0x1800063A8: "__cdecl _imp_RtlLengthSid" __imp_RtlLengthSid
0x180006588: "FveOpenVolumeW" ??_C@_0P@MPPKGAM@FveOpenVolumeW?$AA@
0x1800048D0: "__cdecl _report_gsfailure" __report_gsfailure
0x1800063C8: "__cdecl _imp_NtOpenFile" __imp_NtOpenFile
0x180004DF1: "__cdecl _imp_load_LsaOpenPolicy" __imp_load_LsaOpenPolicy
0x18000B078: "__cdecl _imp_SetupDiOpenDeviceInterfaceW" __imp_SetupDiOpenDeviceInterfaceW
0x180009608: "__cdecl _native_startup_state" __native_startup_state
0x180006430: "__cdecl _imp_??0DSTRING@@QEAA@XZ" __imp_??0DSTRING@@QEAA@XZ
0x1800018E0: "unsigned char __cdecl GetRemovableDeviceInstRecursWorker(unsigned long,unsigned long * __ptr64)" ?GetRemovableDeviceInstRecursWorker@@YAEKPEAK@Z
0x180006598: "FveEraseDrive" ??_C@_0O@MBDGMKLM@FveEraseDrive?$AA@
0x1800069F8: ExFatVolSig
0x180001880: "unsigned char __cdecl DeviceInstIsRemovableWorker(unsigned long,unsigned char * __ptr64)" ?DeviceInstIsRemovableWorker@@YAEKPEAE@Z
0x180006400: "__cdecl _imp_?FreeLibraryHandle@SYSTEM@@SAXPEAX@Z" __imp_?FreeLibraryHandle@SYSTEM@@SAXPEAX@Z
0x18000794C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-memory-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-memory-l1-1-0
0x180006298: "__cdecl _imp_OpenThreadToken" __imp_OpenThreadToken
0x180002AC8: FvepLoadFveAPI
0x180004118: FveCheckVolumeTypeEx
0x180006428: "__cdecl _imp_??1DSTRING@@UEAA@XZ" __imp_??1DSTRING@@UEAA@XZ
0x18000B068: "__cdecl _imp_SetupDiGetDeviceInterfaceDetailW" __imp_SetupDiGetDeviceInterfaceDetailW
0x180006418: "__cdecl _imp_?Initialize@WSTRING@@QEAAEPEBDK@Z" __imp_?Initialize@WSTRING@@QEAAEPEBDK@Z
0x1800095D0: "__cdecl _hmod__CFGMGR32_dll" __hmod__CFGMGR32_dll
0x180006350: "__cdecl _imp_free" __imp_free
0x180004BB0: "__cdecl IsNonwritableInCurrentImage" _IsNonwritableInCurrentImage
0x1800062A0: "__cdecl _imp_OpenProcessToken" __imp_OpenProcessToken
0x180006570: WPP_b4777cdaab9f3360aa142c3708269dea_Traceguids
0x1800062F0: api-ms-win-core-synch-l1-1-0_NULL_THUNK_DATA
0x1800065D0: GUID_DEVINTERFACE_DISK
0x18000B038: "__cdecl _imp_CM_Get_DevNode_Custom_PropertyW" __imp_CM_Get_DevNode_Custom_PropertyW
0x180005101: memset
0x180007988: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x1800061E0: "__cdecl _imp_ReadFile" __imp_ReadFile
0x180006920: "SOFTWARE\Microsoft\Windows NT\Cu" ??_C@_1HK@KHGBILLN@?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAN?$AAT?$AA?2?$AAC?$AAu@

[JEB Decompiler by PNF Software]