PDB Symbols - regsvc.dll (0x6228C9F0006D009E240568FDFE2AD21625EFEC5D7F55AAAE2846657709AA4F29)

Generated by JEB on 2019/08/01

PE: C:\Windows\System32\regsvc.dll Base=0x180000000 SHA-256=6228C9F0006D009E240568FDFE2AD21625EFEC5D7F55AAAE2846657709AA4F29
PDB: regsvc.pdb GUID={FEC8658A-C9EC-397C-1668309D5B107320} Age=1

963 located named symbols:
0x180021DD8: "unsigned short const * const ObjListValue" ?ObjListValue@@3QBGB
0x18001FD00: "__cdecl _imp_RtlInitUnicodeStringEx" __imp_RtlInitUnicodeStringEx
0x180015584: "long __cdecl QueryExtensibleData(struct _COLLECT_THREAD_DATA * __ptr64)" ?QueryExtensibleData@@YAJPEAU_COLLECT_THREAD_DATA@@@Z
0x18000AD88: "void __cdecl PerflibciInitDataProperties(struct _PERFLIBCI_QUERY_PROVIDER_NODE * __ptr64,struct _PERF_COUNTER_IDENTIFIER * __ptr64,struct _PERFLIBCI_DATABLOCK * __ptr64)" ?PerflibciInitDataProperties@@YAXPEAU_PERFLIBCI_QUERY_PROVIDER_NODE@@PEAU_PERF_COUNTER_IDENTIFIER@@PEAU_PERFLIBCI_DATABLOCK@@@Z
0x18001F760: "__cdecl _imp_LockResource" __imp_LockResource
0x180020040: "__cdecl _sz_SspiCli_dll" __sz_SspiCli_dll
0x1800017BC: "__cdecl _raise_securityfailure" __raise_securityfailure
0x1800283F0: CachedWow64ProcessEnvironment
0x18001FB30: "__cdecl _imp_NtOpenKeyEx" __imp_NtOpenKeyEx
0x18001F6C8: api-ms-win-core-file-l1-1-0_NULL_THUNK_DATA
0x180021F68: "NameResource" ??_C@_1BK@HBCDCHLE@?$AAN?$AAa?$AAm?$AAe?$AAR?$AAe?$AAs?$AAo?$AAu?$AAr?$AAc?$AAe?$AA?$AA@
0x180021A88: "unsigned short const * const cszSuccessfulFileData" ?cszSuccessfulFileData@@3QBGB
0x18001FC18: "__cdecl _imp_EtwUnregisterTraceGuids" __imp_EtwUnregisterTraceGuids
0x1800015D0: "__cdecl FindPESection" _FindPESection
0x1800065B0: BaseRegLoadKey
0x1800283E0: "unsigned long g_SizeSD" ?g_SizeSD@@3KA
0x18002737C: "long lPerflibConfigFlags" ?lPerflibConfigFlags@@3JA
0x180015354: "void __cdecl PerfpExceptionHandler(unsigned long)" ?PerfpExceptionHandler@@YAXK@Z
0x180022BC0: "__cdecl _real@43f0000000000000" __real@43f0000000000000
0x18001FCB8: "__cdecl _imp_RtlReleaseRelativeName" __imp_RtlReleaseRelativeName
0x180028330: "struct _EXT_OBJECT * __ptr64 __ptr64 ExtensibleObjects" ?ExtensibleObjects@@3PEAU_EXT_OBJECT@@EA
0x18000FC94: "long __cdecl StringCchCatW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64)" ?StringCchCatW@@YAJPEAG_KPEBG@Z
0x18001C240: "__cdecl _delayLoadHelper2" __delayLoadHelper2
0x18001FB78: "__cdecl _imp_RtlFreeUnicodeString" __imp_RtlFreeUnicodeString
0x180013320: "void __cdecl OpenExtensibleObjects(void)" ?OpenExtensibleObjects@@YAXXZ
0x18001F890: "__cdecl _imp_CompareStringOrdinal" __imp_CompareStringOrdinal
0x180024244: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x1800098E0: "long __cdecl StringCchCopyExW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64,unsigned short * __ptr64 * __ptr64,unsigned __int64 * __ptr64,unsigned long)" ?StringCchCopyExW@@YAJPEAG_KPEBGPEAPEAGPEA_KK@Z
0x1800243FC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-kernel32-legacy-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-kernel32-legacy-l1-1-0
0x180022660: "%d" ??_C@_15KNBIKKIN@?$AA?$CF?$AAd?$AA?$AA@
0x18000B624: "unsigned char __cdecl PerfpBoostPriority(long,long * __ptr64)" ?PerfpBoostPriority@@YAEJPEAJ@Z
0x1800270A0: "__cdecl _security_cookie_complement" __security_cookie_complement
0x18001F670: "__cdecl _imp_RaiseException" __imp_RaiseException
0x180021990: Microsoft_Windows_PerflibKeywords
0x18001AC08: "unsigned long __cdecl PerfpSaveKernelData(struct _PCW_QUERYITEM_BUFFER * __ptr64,struct _PERF_QUERY * __ptr64)" ?PerfpSaveKernelData@@YAKPEAU_PCW_QUERYITEM_BUFFER@@PEAU_PERF_QUERY@@@Z
0x180022618: "ncalrpc" ??_C@_1BA@EONDGCCM@?$AAn?$AAc?$AAa?$AAl?$AAr?$AAp?$AAc?$AA?$AA@
0x180008310: SafeBaseRegEnumKey
0x180007DA0: SafeBaseRegQueryInfoKey
0x180009BF0: PerfRegCleanup
0x1800229D0: "\REGISTRY\USER\*_Classes\Wow6432" ??_C@_1EK@BFDNIFFD@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAU?$AAS?$AAE?$AAR?$AA?2?$AA?$CK?$AA_?$AAC?$AAl?$AAa?$AAs?$AAs?$AAe?$AAs?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4?$AA3?$AA2@
0x1800010AC: "__cdecl CRT_INIT" _CRT_INIT
0x18001F830: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x18001F5D8: "__cdecl _imp_NdrServerCallAll" __imp_NdrServerCallAll
0x18001AE10: "enum _RTL_GENERIC_COMPARE_RESULTS __cdecl PerflibCompareResources(struct _RTL_AVL_TABLE * __ptr64,void * __ptr64,void * __ptr64)" ?PerflibCompareResources@@YA?AW4_RTL_GENERIC_COMPARE_RESULTS@@PEAU_RTL_AVL_TABLE@@PEAX1@Z
0x18001DA28: ClassesStringKey
0x18001FC48: "__cdecl _imp_NtEnumerateKey" __imp_NtEnumerateKey
0x18001A9B8: "unsigned long __cdecl PerfpConvertToSingleCounter(struct _PCW_QUERYITEM_BUFFER * __ptr64,void * __ptr64 * __ptr64)" ?PerfpConvertToSingleCounter@@YAKPEAU_PCW_QUERYITEM_BUFFER@@PEAPEAX@Z
0x18001FBE0: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x18000A810: WppControlCallback
0x180001D30: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x180022200: PERFLIB_INCORRECT_OBJECT_LENGTH
0x180010B60: "unsigned long __cdecl PerflibTimerFunction(unsigned long * __ptr64)" ?PerflibTimerFunction@@YAKPEAK@Z
0x18001F580: WowAmd64NodeString
0x18001F590: "__cdecl _imp_RpcServerRegisterAuthInfoW" __imp_RpcServerRegisterAuthInfoW
0x180021920: "SOFTWARE\Microsoft\Windows NT\Cu" ??_C@_1GK@EDCNPJHK@?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAN?$AAT?$AA?2?$AAC?$AAu@
0x180022360: "unsigned short const * const COUNTER_STRING" ?COUNTER_STRING@@3QBGB
0x18001F6B0: "__cdecl _imp_CreateFileW" __imp_CreateFileW
0x18001F918: "__cdecl _imp_GetSystemWindowsDirectoryW" __imp_GetSystemWindowsDirectoryW
0x180027AD0: g_hRegisteredWait
0x18001F7C8: "__cdecl _imp_PcwSendNotification" __imp_PcwSendNotification
0x1800203E0: "__cdecl TraceLoggingMetadata" _TraceLoggingMetadata
0x18001BA10: Wow64DetectMachineTypeInternal
0x1800221A0: PERFLIB_HEAP_ERROR
0x18000D86C: PerflibciOpenLocalQueryHandle
0x18000B594: "unsigned char __cdecl PerflibciWildcardInstance(unsigned short const * __ptr64)" ?PerflibciWildcardInstance@@YAEPEBG@Z
0x1800220C8: "Installing" ??_C@_1BG@IBEMJDPO@?$AAI?$AAn?$AAs?$AAt?$AAa?$AAl?$AAl?$AAi?$AAn?$AAg?$AA?$AA@
0x180005700: PerflibV2ValidateCounters
0x1800192B8: "unsigned long __cdecl PerflibciEnsurePerflibV2StringTable(unsigned long,unsigned short,unsigned char * __ptr64 * __ptr64,unsigned long * __ptr64)" ?PerflibciEnsurePerflibV2StringTable@@YAKKGPEAPEAEPEAK@Z
0x180022310: "unsigned short const * const ADDHELP_STRING" ?ADDHELP_STRING@@3QBGB
0x18001FAA0: "__cdecl _imp_NtReadFile" __imp_NtReadFile
0x18001FB58: "__cdecl _imp_LdrGetDllHandle" __imp_LdrGetDllHandle
0x180008CFC: "long __cdecl PerfRegQueryValueEx(struct HKEY__ * __ptr64,struct _UNICODE_STRING const * __ptr64,struct _UNICODE_STRING const * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64,unsigned char * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64)" ?PerfRegQueryValueEx@@YAJPEAUHKEY__@@PEBU_UNICODE_STRING@@1PEAK2PEAE22@Z
0x18001F9A8: "__cdecl _imp_wcstoul" __imp_wcstoul
0x180010660: "long __cdecl GetPerflibKeyValue(unsigned short const * __ptr64,unsigned long,unsigned long,void * __ptr64,unsigned long,void * __ptr64,struct HKEY__ * __ptr64 * __ptr64)" ?GetPerflibKeyValue@@YAJPEBGKKPEAXK1PEAPEAUHKEY__@@@Z
0x18000B694: "unsigned long __cdecl PerfpCreateProvider(struct _PERFLIBCI_QUERY_PROVIDER_NODE * __ptr64 * __ptr64,struct _PERFLIBCI_COUNTERSET_NODE * __ptr64,struct _PERF_QUERY * __ptr64)" ?PerfpCreateProvider@@YAKPEAPEAU_PERFLIBCI_QUERY_PROVIDER_NODE@@PEAU_PERFLIBCI_COUNTERSET_NODE@@PEAU_PERF_QUERY@@@Z
0x180022770: "\{FE10D39B-A7F1-412c-83BA-D00788" ??_C@_1FA@JLMFPFOH@?$AA?2?$AA?$HL?$AAF?$AAE?$AA1?$AA0?$AAD?$AA3?$AA9?$AAB?$AA?9?$AAA?$AA7?$AAF?$AA1?$AA?9?$AA4?$AA1?$AA2?$AAc?$AA?9?$AA8?$AA3?$AAB?$AAA?$AA?9?$AAD?$AA0?$AA0?$AA7?$AA8?$AA8@
0x18001FC38: "__cdecl _imp_EtwGetTraceLoggerHandle" __imp_EtwGetTraceLoggerHandle
0x180022BB0: "__cdecl _pfnDliFailureHook2" __pfnDliFailureHook2
0x18001FC88: "__cdecl _imp_NtEnumerateValueKey" __imp_NtEnumerateValueKey
0x18001A90C: "unsigned long __cdecl PerfpConvertToMultiInstances(struct _PCW_QUERYITEM_BUFFER * __ptr64,struct _PERFLIBCI_MULTI_INSTS * __ptr64 * __ptr64,unsigned long * __ptr64)" ?PerfpConvertToMultiInstances@@YAKPEAU_PCW_QUERYITEM_BUFFER@@PEAPEAU_PERFLIBCI_MULTI_INSTS@@PEAK@Z
0x180004FD0: PerflibV2EnumerateCounterSet
0x180022908: "\REGISTRY\MACHINE\SOFTWARE" ??_C@_1DG@IOMDFJHH@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?$AA@
0x180024384: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-1-0
0x1800220B0: "LoadPerf" ??_C@_1BC@MKAFMGMP@?$AAL?$AAo?$AAa?$AAd?$AAP?$AAe?$AAr?$AAf?$AA?$AA@
0x180020320: "struct _serverint_MIDL_PROC_FORMAT_STRING const serverint__MIDL_ProcFormatString" ?serverint__MIDL_ProcFormatString@@3U_serverint_MIDL_PROC_FORMAT_STRING@@B
0x1800202C0: "struct _serverint_MIDL_TYPE_FORMAT_STRING const serverint__MIDL_TypeFormatString" ?serverint__MIDL_TypeFormatString@@3U_serverint_MIDL_TYPE_FORMAT_STRING@@B
0x18000F308: "unsigned long __cdecl PerflibciLocalQueryCounterSetRegInfoEx(unsigned char,struct _GUID const * __ptr64,enum _PerfRegInfoType,unsigned long,unsigned char * __ptr64,unsigned long,unsigned long * __ptr64)" ?PerflibciLocalQueryCounterSetRegInfoEx@@YAKEPEBU_GUID@@W4_PerfRegInfoType@@KPEAEKPEAK@Z
0x18001FD60: "__cdecl _imp_RtlCreateSecurityDescriptor" __imp_RtlCreateSecurityDescriptor
0x1800219E0: "unsigned short const * const cszFailureLimit" ?cszFailureLimit@@3QBGB
0x18001FAB8: "__cdecl _imp_RtlQueryPerformanceCounter" __imp_RtlQueryPerformanceCounter
0x18001F728: api-ms-win-core-heap-l2-1-0_NULL_THUNK_DATA
0x18001FBB0: "__cdecl _imp_RtlRunOnceBeginInitialize" __imp_RtlRunOnceBeginInitialize
0x18000AF90: "void __cdecl PerflibciReindexQuery(struct _PERF_QUERY * __ptr64)" ?PerflibciReindexQuery@@YAXPEAU_PERF_QUERY@@@Z
0x180024198: api-ms-win-security-sddl-l1-1-0_NULL_THUNK_DATA_DLB
0x18001FA90: "__cdecl _imp_NtWriteFile" __imp_NtWriteFile
0x18001FD38: "__cdecl _imp_NtSetInformationThread" __imp_NtSetInformationThread
0x18001D1A0: "struct _MIDL_STUB_DESC const PerfHost_StubDesc" ?PerfHost_StubDesc@@3U_MIDL_STUB_DESC@@B
0x180021840: "\Registry\Machine\SOFTWARE\Micro" ??_C@_1IO@CBBKAEAH@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x18001F9A0: "__cdecl _imp_wcschr" __imp_wcschr
0x180006420: BaseRegDeleteKeyEx
0x18001B774: PathReplaceGreedy
0x18001D040: UserStringKey
0x18001F8D0: "__cdecl _imp_SetEvent" __imp_SetEvent
0x180022680: "\{1BD51F8C-8CFC-4708-A88D-5690DE" ??_C@_1FA@NFDDCOIJ@?$AA?2?$AA?$HL?$AA1?$AAB?$AAD?$AA5?$AA1?$AAF?$AA8?$AAC?$AA?9?$AA8?$AAC?$AAF?$AAC?$AA?9?$AA4?$AA7?$AA0?$AA8?$AA?9?$AAA?$AA8?$AA8?$AAD?$AA?9?$AA5?$AA6?$AA9?$AA0?$AAD?$AAE@
0x180022AD0: "\WOW6432Node" ??_C@_1BK@GKBHLFGI@?$AA?2?$AAW?$AAO?$AAW?$AA6?$AA4?$AA3?$AA2?$AAN?$AAo?$AAd?$AAe?$AA?$AA@
0x1800224E8: "perfc004.dat" ??_C@_1BK@INFKACJF@?$AAp?$AAe?$AAr?$AAf?$AAc?$AA0?$AA0?$AA4?$AA?4?$AAd?$AAa?$AAt?$AA?$AA@
0x180002740: BaseRegCloseKey
0x180021BE0: "unsigned short const * const OpenTimeout" ?OpenTimeout@@3QBGB
0x180011BE8: WPP_SF_diii
0x18001FD40: "__cdecl _imp_RtlQueryInformationAcl" __imp_RtlQueryInformationAcl
0x18001FA58: "__cdecl _imp_RtlEnterCriticalSection" __imp_RtlEnterCriticalSection
0x180011E6C: "__cdecl TlgWrite" _TlgWrite
0x18001FE18: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x180028340: "void * __ptr64 __ptr64 hGlobalDataMutex" ?hGlobalDataMutex@@3PEAXEA
0x1800019A0: NdrServerCall2
0x1800223A0: "Collect" ??_C@_07GOPPECED@Collect?$AA@
0x1800243E8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-file-l2-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-file-l2-1-0
0x18001F8E8: "__cdecl _imp_InitializeCriticalSection" __imp_InitializeCriticalSection
0x18001FAF8: "__cdecl _imp_RtlEnumerateGenericTableAvl" __imp_RtlEnumerateGenericTableAvl
0x1800218D8: "%TEMP%\Perflib_Perfdata_" ??_C@_1DC@JAFAHIFN@?$AA?$CF?$AAT?$AAE?$AAM?$AAP?$AA?$CF?$AA?2?$AAP?$AAe?$AAr?$AAf?$AAl?$AAi?$AAb?$AA_?$AAP?$AAe?$AAr?$AAf?$AAd?$AAa?$AAt?$AAa?$AA_?$AA?$AA@
0x180021C68: "unsigned short const * const PerfSubKey" ?PerfSubKey@@3QBGB
0x18001FD30: "__cdecl _imp_RtlGetOwnerSecurityDescriptor" __imp_RtlGetOwnerSecurityDescriptor
0x18001F9C0: "__cdecl _imp__wcsnicmp" __imp__wcsnicmp
0x180001030: BaseInitiateSystemShutdown
0x180020148: WPP_4f338d5f38b13f4b2fbcb88d1ed0d3cd_Traceguids
0x180020298: "struct _NDR64_RANGE_FORMAT const __midl_frag20" ?__midl_frag20@@3U_NDR64_RANGE_FORMAT@@B
0x180022818: "\MediaFoundation" ??_C@_1CC@FEPMIPGD@?$AA?2?$AAM?$AAe?$AAd?$AAi?$AAa?$AAF?$AAo?$AAu?$AAn?$AAd?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x18000B804: "unsigned long __cdecl PerfpSendNotification(void * __ptr64,unsigned long,void * __ptr64,unsigned long,void * __ptr64 * __ptr64,unsigned long * __ptr64)" ?PerfpSendNotification@@YAKPEAXK0KPEAPEAXPEAK@Z
0x180022390: "Open" ??_C@_04DNCDCIAE@Open?$AA@
0x18001BE08: Wow64RedirectKeyPathInternal
0x180027380: "long lEventLogLevel" ?lEventLogLevel@@3JA
0x18001FB68: "__cdecl _imp_RtlInitString" __imp_RtlInitString
0x180010118: "unsigned long __cdecl DestroyPerflibFunctionTimer(void)" ?DestroyPerflibFunctionTimer@@YAKXZ
0x180028388: "struct _PERFLIBCI_RED_BLACK_NODE * __ptr64 __ptr64 g_ObjectTree" ?g_ObjectTree@@3PEAU_PERFLIBCI_RED_BLACK_NODE@@EA
0x180022370: "unsigned short const * const FOREIGN_STRING" ?FOREIGN_STRING@@3QBGB
0x18000D12C: PerflibciLocalQueryCounterInfo
0x1800240E0: api-ms-win-security-lsalookup-l1-1-0_NULL_THUNK_DATA_DLN
0x18002A018: api-ms-win-security-lsalookup-l1-1-0_NULL_THUNK_DATA_DLA
0x18001F968: "__cdecl _imp_RegisterServiceCtrlHandlerExW" __imp_RegisterServiceCtrlHandlerExW
0x1800241B0: api-ms-win-security-lsalookup-l1-1-0_NULL_THUNK_DATA_DLB
0x1800015B4: "__cdecl XcptFilter" _XcptFilter
0x1800019AC: IsPerfRegEnumValuePresent
0x1800283E4: "long lExtCounterTestLevel" ?lExtCounterTestLevel@@3JA
0x18001FE20: "__cdecl _xc_a" __xc_a
0x180027220: AllowedExactPathsKey
0x1800279B8: WinregChange
0x180001030: OpenDynData
0x18001FDC8: "__cdecl _imp_RtlValidRelativeSecurityDescriptor" __imp_RtlValidRelativeSecurityDescriptor
0x18002A020: "__cdecl _imp_ConvertStringSidToSidW" __imp_ConvertStringSidToSidW
0x18001F6A0: "__cdecl _imp_FindClose" __imp_FindClose
0x18001FAC8: "__cdecl _imp_RtlAcquireSRWLockExclusive" __imp_RtlAcquireSRWLockExclusive
0x180013B3C: "long __cdecl StringCbCopyExA(char * __ptr64,unsigned __int64,char const * __ptr64,char * __ptr64 * __ptr64,unsigned __int64 * __ptr64,unsigned long)" ?StringCbCopyExA@@YAJPEAD_KPEBDPEAPEADPEA_KK@Z
0x18001FA88: "__cdecl _imp_RtlAppendUnicodeStringToString" __imp_RtlAppendUnicodeStringToString
0x1800227E8: "\Interface" ??_C@_1BG@GLFHKKME@?$AA?2?$AAI?$AAn?$AAt?$AAe?$AAr?$AAf?$AAa?$AAc?$AAe?$AA?$AA@
0x18001F710: api-ms-win-core-heap-l1-1-0_NULL_THUNK_DATA
0x18002A030: api-ms-win-security-sddl-l1-1-0_NULL_THUNK_DATA_DLA
0x18001B588: Wow64NtOpenKey
0x180028158: "struct _ERROR_LOG PerfpErrorLog" ?PerfpErrorLog@@3U_ERROR_LOG@@A
0x18001FB48: "__cdecl _imp_NtSetValueKey" __imp_NtSetValueKey
0x180022300: "unsigned short const * const OLD_STRING" ?OLD_STRING@@3QBGB
0x180021ED0: WPP_d9c5eeb16f5530161408911d922cfa74_Traceguids
0x180005100: PerflibV2EnumerateCounterSetInstances
0x180004634: RegSecCheckRemotePerfAccess
0x180022150: PERFLIB_OPEN_PROC_FAILURE
0x180022130: S_Perflib
0x18001F6C0: "__cdecl _imp_DeleteFileW" __imp_DeleteFileW
0x1800024A0: ServiceMain
0x1800225B8: "%ws\%ws.tmp" ??_C@_1BI@DLEDEKKD@?$AA?$CF?$AAw?$AAs?$AA?2?$AA?$CF?$AAw?$AAs?$AA?4?$AAt?$AAm?$AAp?$AA?$AA@
0x18001F9B8: "__cdecl _imp_wcsncmp" __imp_wcsncmp
0x18001FF98: "__cdecl _guard_iat_table" __guard_iat_table
0x18001F818: api-ms-win-core-processenvironment-l1-1-0_NULL_THUNK_DATA
0x18001FDC0: "__cdecl _imp_NtFlushKey" __imp_NtFlushKey
0x180010A88: "int __cdecl MonBuildPerfDataBlock(struct _PERF_DATA_BLOCK * __ptr64,void * __ptr64 * __ptr64,unsigned long,unsigned long)" ?MonBuildPerfDataBlock@@YAHPEAU_PERF_DATA_BLOCK@@PEAPEAXKK@Z
0x18000C154: PerflibciLocalQueryCounterData
0x180001030: BaseInitiateSystemShutdownEx
0x180001D00: memcpy
0x18001F758: "__cdecl _imp_LoadLibraryExW" __imp_LoadLibraryExW
0x180006C28: BaseRegQueryMultipleValues2Old
0x18000E9A4: "struct _PERFLIBCI_PROVIDER_NODE * __ptr64 __cdecl PerflibciFindProvider(struct _GUID * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,int)" ?PerflibciFindProvider@@YAPEAU_PERFLIBCI_PROVIDER_NODE@@PEAU_GUID@@PEBG1H@Z
0x1800279C0: MachineAllowedExactPaths
0x180017614: "unsigned long __cdecl ExtpAlignBuffer(char * __ptr64,char * __ptr64 * __ptr64,unsigned long)" ?ExtpAlignBuffer@@YAKPEADPEAPEADK@Z
0x18001F9E0: "__cdecl _imp_memset" __imp_memset
0x18001FCD8: "__cdecl _imp_RtlSetGroupSecurityDescriptor" __imp_RtlSetGroupSecurityDescriptor
0x180002180: PerflibSecurityCallbackFn
0x18001F8C8: "__cdecl _imp_CreateEventW" __imp_CreateEventW
0x18001F6D8: api-ms-win-core-file-l2-1-0_NULL_THUNK_DATA
0x18001FDD8: "__cdecl _imp_NtCreateMutant" __imp_NtCreateMutant
0x18000178F: "__cdecl initterm" _initterm
0x18001FC10: "__cdecl _imp_NtWaitForSingleObject" __imp_NtWaitForSingleObject
0x18001F740: "__cdecl _imp_FileTimeToDosDateTime" __imp_FileTimeToDosDateTime
0x18002430C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0
0x180027960: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x18001F8F8: "__cdecl _imp_Sleep" __imp_Sleep
0x180022BB8: "__cdecl _real@43e0000000000000" __real@43e0000000000000
0x18001FE40: "__cdecl _xi_z" __xi_z
0x18001ACC0: "void __cdecl PerfpUpdateCounterIndices(void * __ptr64,struct _PERFLIBCI_QUERY_PROVIDER_NODE * __ptr64)" ?PerfpUpdateCounterIndices@@YAXPEAXPEAU_PERFLIBCI_QUERY_PROVIDER_NODE@@@Z
0x180021DB0: "unsigned short const * const ExportValue" ?ExportValue@@3QBGB
0x18001F920: "__cdecl _imp_GetSystemTime" __imp_GetSystemTime
0x18001B694: Wow64NtQueryValueKey
0x18001F650: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x18001FA70: "__cdecl _imp_NtOpenProcessToken" __imp_NtOpenProcessToken
0x1800154F8: "long __cdecl PerfpWaitForExtObjList(void)" ?PerfpWaitForExtObjList@@YAJXZ
0x180005320: PerflibV2QueryCounterData
0x18001BBE4: Wow64SelectWowNodePathInternal
0x18001FAD0: "__cdecl _imp_RtlInsertElementGenericTableAvl" __imp_RtlInsertElementGenericTableAvl
0x1800224C8: "prfc" ??_C@_19PDHHDAFG@?$AAp?$AAr?$AAf?$AAc?$AA?$AA@
0x18001FC20: "__cdecl _imp_EtwRegisterTraceGuidsW" __imp_EtwRegisterTraceGuidsW
0x18000E5F0: "unsigned long __cdecl PerflibciEnsureCounterSetList(void)" ?PerflibciEnsureCounterSetList@@YAKXZ
0x18000179B: "__cdecl _C_specific_handler" __C_specific_handler
0x18001C230: MIDL_user_free
0x180022A70: "\REGISTRY\USER\*\SOFTWARE\Classe" ??_C@_1FM@HBIDDIMP@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAU?$AAS?$AAE?$AAR?$AA?2?$AA?$CK?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAC?$AAl?$AAa?$AAs?$AAs?$AAe@
0x1800222A0: "unsigned short const * const COSTLY_STRING" ?COSTLY_STRING@@3QBGB
0x180021AB8: "unsigned short const * const cszLibraryValidationData" ?cszLibraryValidationData@@3QBGB
0x180022528: "perfc016.dat" ??_C@_1BK@PMGOHNHM@?$AAp?$AAe?$AAr?$AAf?$AAc?$AA0?$AA1?$AA6?$AA?4?$AAd?$AAa?$AAt?$AA?$AA@
0x180021EC8: "*" ??_C@_13BBDEGPLJ@?$AA?$CK?$AA?$AA@
0x180001D0C: memmove
0x18001F708: "__cdecl _imp_HeapFree" __imp_HeapFree
0x1800281A8: WPP_REGISTRATION_GUIDS
0x18001FB50: "__cdecl _imp_LdrGetProcedureAddress" __imp_LdrGetProcedureAddress
0x180021B48: "unsigned short const * const OpenProcedureWaitTime" ?OpenProcedureWaitTime@@3QBGB
0x18001FD18: "__cdecl _imp_RtlLengthRequiredSid" __imp_RtlLengthRequiredSid
0x18001B298: Wow64NtCreateKey
0x180001A97: "__cdecl _imp_load_ConvertStringSecurityDescriptorToSecurityDescriptorW" __imp_load_ConvertStringSecurityDescriptorToSecurityDescriptorW
0x180002640: StopService
0x18001FBD0: "__cdecl _imp_RtlCopyUnicodeString" __imp_RtlCopyUnicodeString
0x18001FAE0: "__cdecl _imp_RtlAcquireSRWLockShared" __imp_RtlAcquireSRWLockShared
0x18001FD70: "__cdecl _imp_RtlCreateAcl" __imp_RtlCreateAcl
0x18001F6E8: api-ms-win-core-handle-l1-1-0_NULL_THUNK_DATA
0x18001F988: "__cdecl _imp_iswalpha" __imp_iswalpha
0x18001FBF8: "__cdecl _imp_NtQueryInformationThread" __imp_NtQueryInformationThread
0x18001F870: "__cdecl _imp_RegCloseKey" __imp_RegCloseKey
0x180002E20: BaseRegFlushKey
0x18001FA78: "__cdecl _imp_NtQueryInformationToken" __imp_NtQueryInformationToken
0x180001C04: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x180027938: "__cdecl _hmod__api_ms_win_security_lsalookup_l1_1_0_dll" __hmod__api_ms_win_security_lsalookup_l1_1_0_dll
0x1800076C0: SafeBaseRegGetKeySecurity
0x1800219B0: PERFLIB_ACCESS_DENIED
0x180021CB0: "unsigned short const * const HKLMPerflibKey" ?HKLMPerflibKey@@3QBGB
0x18001FCE8: "__cdecl _imp_NtAccessCheck" __imp_NtAccessCheck
0x18001F678: "__cdecl _imp_SetErrorMode" __imp_SetErrorMode
0x180001010: PerfRegThreadCleanup
0x18001FB00: "__cdecl _imp_RtlDeleteElementGenericTableAvl" __imp_RtlDeleteElementGenericTableAvl
0x18001FDA8: "__cdecl _imp_RtlAllocateHeap" __imp_RtlAllocateHeap
0x180028364: "unsigned long `unsigned long __cdecl PerflibciValidateCode(void)'::`2'::lValidateFlag" ?lValidateFlag@?1??PerflibciValidateCode@@YAKXZ@4KA
0x18001F898: api-ms-win-core-string-l1-1-0_NULL_THUNK_DATA
0x180022328: "unsigned short const * const ADDCOUNTER_STRING" ?ADDCOUNTER_STRING@@3QBGB
0x180022460: "prf00000.dat" ??_C@_1BK@BKMMMPBN@?$AAp?$AAr?$AAf?$AA0?$AA0?$AA0?$AA0?$AA0?$AA?4?$AAd?$AAa?$AAt?$AA?$AA@
0x180028180: WPP_MAIN_CB
0x180022000: "CounterBlock" ??_C@_1BK@DNAEGFKI@?$AAC?$AAo?$AAu?$AAn?$AAt?$AAe?$AAr?$AAB?$AAl?$AAo?$AAc?$AAk?$AA?$AA@
0x1800067E0: BaseRegReplaceKey
0x1800222B0: "unsigned short const * const GLOBAL_STRING" ?GLOBAL_STRING@@3QBGB
0x1800224B8: "perfc" ??_C@_1M@IOOFFFBH@?$AAp?$AAe?$AAr?$AAf?$AAc?$AA?$AA@
0x180024348: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0
0x18001F880: "__cdecl _imp_RegSetValueExW" __imp_RegSetValueExW
0x1800015C0: "__cdecl amsg_exit" _amsg_exit
0x180028368: "void * __ptr64 __ptr64 g_hGlobalMutex" ?g_hGlobalMutex@@3PEAXEA
0x180007800: BaseRegDeleteValue
0x180020540: "RemoteRegistry" ??_C@_1BO@DLMCLIJ@?$AAR?$AAe?$AAm?$AAo?$AAt?$AAe?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?$AA@
0x180027B00: Microsoft_Windows_PerflibEnableBits
0x180022BAC: "__cdecl _DefaultResolveDelayLoadedAPIFlags" __DefaultResolveDelayLoadedAPIFlags
0x18001FAD8: "__cdecl _imp_RtlReleaseSRWLockExclusive" __imp_RtlReleaseSRWLockExclusive
0x180024320: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-threadpool-legacy-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-threadpool-legacy-l1-1-0
0x180008060: RPC_HKEY_rundown
0x180022B88: "RtlWow64IsWowGuestMachineSupport" ??_C@_0CD@GEHPEKNJ@RtlWow64IsWowGuestMachineSupport@
0x18001FFF0: "ext-ms-win-advapi32-registry-l1-" ??_C@_1EI@LLNCKGIP@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAa?$AAd?$AAv?$AAa?$AAp?$AAi?$AA3?$AA2?$AA?9?$AAr?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?9?$AAl?$AA1?$AA?9@
0x180022110: PERFLIB_LIBRARY_DISABLED
0x180027930: "__cdecl _hmod__api_ms_win_security_sddl_l1_1_0_dll" __hmod__api_ms_win_security_sddl_l1_1_0_dll
0x1800026C0: SvchostPushServiceGlobals
0x18001FD68: "__cdecl _imp_RtlOpenCurrentUser" __imp_RtlOpenCurrentUser
0x18001FFA0: "ext-ms-win-advapi32-registry-l1-" ??_C@_1EI@DGOMBOK@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAa?$AAd?$AAv?$AAa?$AAp?$AAi?$AA3?$AA2?$AA?9?$AAr?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?9?$AAl?$AA1?$AA?9@
0x18000B544: "unsigned long __cdecl PerflibciValidateCode(void)" ?PerflibciValidateCode@@YAKXZ
0x180021DC0: "unsigned short const * const LinkageKey" ?LinkageKey@@3QBGB
0x18001A38C: "unsigned long __cdecl PerfpAddInstanceToBuffer(unsigned char * __ptr64,unsigned long,unsigned long * __ptr64,unsigned long,unsigned short const * __ptr64)" ?PerfpAddInstanceToBuffer@@YAKPEAEKPEAKKPEBG@Z
0x180010588: "long __cdecl GetPerfDllFileInfo(unsigned short const * __ptr64,struct _DLL_VALIDATION_DATA * __ptr64)" ?GetPerfDllFileInfo@@YAJPEBGPEAU_DLL_VALIDATION_DATA@@@Z
0x18001FE00: "__cdecl _imp_RtlInitializeCriticalSection" __imp_RtlInitializeCriticalSection
0x1800279D0: AllowedExactPathsChange
0x180021BA0: "unsigned short const * const EventLogLevel" ?EventLogLevel@@3QBGB
0x180022040: "Last Counter" ??_C@_1BK@KDEBHAFE@?$AAL?$AAa?$AAs?$AAt?$AA?5?$AAC?$AAo?$AAu?$AAn?$AAt?$AAe?$AAr?$AA?$AA@
0x180021F20: "ProviderName" ??_C@_1BK@IDHMMGND@?$AAP?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x18001F978: api-ms-win-service-core-l1-1-0_NULL_THUNK_DATA
0x18000EF94: "unsigned long __cdecl PerflibciLoadString(struct HINSTANCE__ * __ptr64 * __ptr64,struct _PERFLIBCI_PROVIDER_NODE * __ptr64,unsigned long,unsigned long,unsigned short * __ptr64,unsigned long * __ptr64)" ?PerflibciLoadString@@YAKPEAPEAUHINSTANCE__@@PEAU_PERFLIBCI_PROVIDER_NODE@@KKPEAGPEAK@Z
0x18001F8B0: "__cdecl _imp_EnterCriticalSection" __imp_EnterCriticalSection
0x1800202B0: "struct _NDR64_CONTEXT_HANDLE_FORMAT const __midl_frag24" ?__midl_frag24@@3U_NDR64_CONTEXT_HANDLE_FORMAT@@B
0x18001F888: api-ms-win-core-registry-l1-1-0_NULL_THUNK_DATA
0x1800019AC: IsPerfRegQueryInfoKeyPresent
0x180027AD8: RestrictedUserHandle
0x1800022B8: StartWinregRPCServer
0x180022260: PERFLIB_NOT_TRUSTED_FILE
0x180027B20: "void * __ptr64 __ptr64 hPerflibSectionMap" ?hPerflibSectionMap@@3PEAXEA
0x18001FAF0: "__cdecl _imp_RtlReleaseSRWLockShared" __imp_RtlReleaseSRWLockShared
0x180022270: PERFLIB_CLOSE_PROC_NOT_FOUND
0x18001F680: api-ms-win-core-errorhandling-l1-1-0_NULL_THUNK_DATA
0x18001F748: api-ms-win-core-kernel32-legacy-l1-1-0_NULL_THUNK_DATA
0x18001FC50: "__cdecl _imp_NtDeleteValueKey" __imp_NtDeleteValueKey
0x180027F50: "unsigned short * szPerflibSectionFile" ?szPerflibSectionFile@@3PAGA
0x18001FA98: "__cdecl _imp_NtQueryInformationFile" __imp_NtQueryInformationFile
0x18002024C: "struct _NDR64_CONFORMANT_STRING_FORMAT const __midl_frag11" ?__midl_frag11@@3U_NDR64_CONFORMANT_STRING_FORMAT@@B
0x18001F848: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x1800281E0: "unsigned long * g_RuntimeSD" ?g_RuntimeSD@@3PAKA
0x18000B1B4: "unsigned long __cdecl PerflibciSendCounterUpdateRequest(struct _PERF_QUERY * __ptr64,struct _PERFLIBCI_QUERY_PROVIDER_NODE * __ptr64,int)" ?PerflibciSendCounterUpdateRequest@@YAKPEAU_PERF_QUERY@@PEAU_PERFLIBCI_QUERY_PROVIDER_NODE@@H@Z
0x180027950: "__cdecl _native_startup_lock" __native_startup_lock
0x18002A000: "__cdecl _imp_GetUserNameExW" __imp_GetUserNameExW
0x180027B10: "unsigned char bPerflibOpen" ?bPerflibOpen@@3EA
0x18001FB60: "__cdecl _imp_RtlUpcaseUnicodeChar" __imp_RtlUpcaseUnicodeChar
0x180001BC0: DllMain
0x180028360: "unsigned long `unsigned long __cdecl PerflibciValidateCode(void)'::`2'::lValidateCode" ?lValidateCode@?1??PerflibciValidateCode@@YAKXZ@4KA
0x1800218D0: "" ??_C@_13BLAPAIAM@?$AA?$AI?$AA?$AA@
0x1800019AC: IsPerfRegEnumKeyPresent
0x18000BDA0: PerflibciLocalEnumerateCounterSetInstances
0x180022650: WPP_259a3a3e8b5835f0b5600c573fa28814_Traceguids
0x18002A008: SspiCli_NULL_THUNK_DATA_DLA
0x1800219A8: Microsoft_Windows_PerflibLevels
0x180011D28: WPP_SF_id
0x180016DB8: McTemplateU0zzq
0x180001C68: "__cdecl _GSHandlerCheck_SEH" __GSHandlerCheck_SEH
0x1800243C0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-string-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-string-l1-1-0
0x18001F9E8: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x18001147C: "unsigned long __cdecl PerfpThrottleError(unsigned long,struct HKEY__ * __ptr64,struct _ERROR_LOG * __ptr64)" ?PerfpThrottleError@@YAKKPEAUHKEY__@@PEAU_ERROR_LOG@@@Z
0x180022608: "%s\%s" ??_C@_1M@DFKENGJN@?$AA?$CF?$AAs?$AA?2?$AA?$CF?$AAs?$AA?$AA@
0x18001F800: api-ms-win-core-pcw-l1-1-0_NULL_THUNK_DATA
0x18000FEA0: PerfpInitializeInstallationMutex
0x18001FDF0: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x1800221F0: PERFLIB_OPEN_PROC_TIMEOUT
0x18001AD24: "unsigned long __cdecl PerflibAddResource(struct _GUID const * __ptr64,unsigned long,unsigned long,unsigned long,unsigned char * __ptr64)" ?PerflibAddResource@@YAKPEBU_GUID@@KKKPEAE@Z
0x18001F790: api-ms-win-core-libraryloader-l1-2-0_NULL_THUNK_DATA
0x18000DAE8: "struct _PERFLIBCI_COUNTERSET_NODE * __ptr64 __cdecl PerflibciBuildCounterSet(struct HKEY__ * __ptr64,unsigned short * __ptr64,unsigned long * __ptr64,struct _PERFLIBCI_PROVIDER_NODE * __ptr64)" ?PerflibciBuildCounterSet@@YAPEAU_PERFLIBCI_COUNTERSET_NODE@@PEAUHKEY__@@PEAGPEAKPEAU_PERFLIBCI_PROVIDER_NODE@@@Z
0x18001F560: Wowx86NodeString
0x18001FA38: "__cdecl _imp_RtlCreateBoundaryDescriptor" __imp_RtlCreateBoundaryDescriptor
0x180021DF8: "char const * const CollectValue" ?CollectValue@@3QBDB
0x180009B34: McTemplateU0zz
0x180013D90: McTemplateU0sz
0x18001F660: "__cdecl _imp_GetLastError" __imp_GetLastError
0x18000FB9C: "void __cdecl PerflibciRotateRight(struct _PERFLIBCI_RED_BLACK_NODE * __ptr64 * __ptr64,struct _PERFLIBCI_RED_BLACK_NODE * __ptr64)" ?PerflibciRotateRight@@YAXPEAPEAU_PERFLIBCI_RED_BLACK_NODE@@PEAU1@@Z
0x180027090: "__cdecl _native_dllmain_reason" __native_dllmain_reason
0x180001BE0: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x18001122C: "unsigned long __cdecl PerfpDosError(long)" ?PerfpDosError@@YAKJ@Z
0x18001FD50: "__cdecl _imp_RtlSetOwnerSecurityDescriptor" __imp_RtlSetOwnerSecurityDescriptor
0x180002F20: BaseRegOpenKey
0x180021A20: "unsigned short const * const LastCounter" ?LastCounter@@3QBGB
0x18001AFE4: ConstructKernelKeyPath
0x18001FC40: "__cdecl _imp_EtwTraceMessage" __imp_EtwTraceMessage
0x180002460: ServiceHandler
0x180021E08: "char const * const OpenValue" ?OpenValue@@3QBDB
0x18001F9C8: "__cdecl _imp_memcmp" __imp_memcmp
0x18001FB38: "__cdecl _imp_NtSetInformationKey" __imp_NtSetInformationKey
0x18001FD88: "__cdecl _imp_RtlAddAccessAllowedAce" __imp_RtlAddAccessAllowedAce
0x18001FCB0: "__cdecl _imp_NtSaveKey" __imp_NtSaveKey
0x180022800: "\Media Type" ??_C@_1BI@IHAIEPGC@?$AA?2?$AAM?$AAe?$AAd?$AAi?$AAa?$AA?5?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x1800026D0: UpdateServiceStatus
0x180021E20: "NULL" ??_C@_19CIJIHAKK@?$AAN?$AAU?$AAL?$AAL?$AA?$AA@
0x18000A898: "__cdecl TlgDefineProvider_annotation__Tlgg_hPerfLibProviderProv" _TlgDefineProvider_annotation__Tlgg_hPerfLibProviderProv
0x180024438: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-0
0x18001F838: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x1800222C0: "unsigned short const * const DisablePerformanceCounters" ?DisablePerformanceCounters@@3QBGB
0x18001F8D8: "__cdecl _imp_WaitForSingleObject" __imp_WaitForSingleObject
0x180027208: MachineValue
0x180027970: AllowedPathsChange
0x180010398: "void __cdecl DisablePerfLibrary(struct _EXT_OBJECT * __ptr64,unsigned long,unsigned long,unsigned __int64,unsigned __int64)" ?DisablePerfLibrary@@YAXPEAU_EXT_OBJECT@@KK_K1@Z
0x18001FAC0: "__cdecl _imp_RtlReAllocateHeap" __imp_RtlReAllocateHeap
0x180004758: RegSecGetPerfGateSD
0x180027998: MachineAllowedPathsCount
0x1800204A8: "RemoteRegistry Interface" ??_C@_1DC@LPJGMKFJ@?$AAR?$AAe?$AAm?$AAo?$AAt?$AAe?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?5?$AAI?$AAn?$AAt?$AAe?$AAr?$AAf?$AAa?$AAc?$AAe?$AA?$AA@
0x18001FC08: "__cdecl _imp_RtlGetVersion" __imp_RtlGetVersion
0x180022BAC: "__cdecl _ResolveDelayLoadedAPIFlags" __ResolveDelayLoadedAPIFlags
0x1800223A8: "_Perf_Library_Lock_PID_" ??_C@_1DA@MPDMDONG@?$AA_?$AAP?$AAe?$AAr?$AAf?$AA_?$AAL?$AAi?$AAb?$AAr?$AAa?$AAr?$AAy?$AA_?$AAL?$AAo?$AAc?$AAk?$AA_?$AAP?$AAI?$AAD?$AA_?$AA?$AA@
0x180001680: "__cdecl ValidateImageBase" _ValidateImageBase
0x180002210: RegSvcIdleCallback
0x1800283F4: CachedMachine
0x180024188: SspiCli_NULL_THUNK_DATA_DLB
0x180022B30: "\WowAA64Node" ??_C@_1BK@BOJDEMAO@?$AA?2?$AAW?$AAo?$AAw?$AAA?$AAA?$AA6?$AA4?$AAN?$AAo?$AAd?$AAe?$AA?$AA@
0x18001A714: "unsigned long __cdecl PerfpConvertToCounterSet(struct _PCW_QUERYITEM_BUFFER * __ptr64,struct _PERFLIBCI_MULTI_INSTS * __ptr64 * __ptr64,unsigned long * __ptr64)" ?PerfpConvertToCounterSet@@YAKPEAU_PCW_QUERYITEM_BUFFER@@PEAPEAU_PERFLIBCI_MULTI_INSTS@@PEAK@Z
0x180013EF8: WPP_SF_Zd
0x180001A18: "__cdecl _tailMerge_sspicli_dll" __tailMerge_sspicli_dll
0x18001F770: "__cdecl _imp_SizeofResource" __imp_SizeofResource
0x180028338: "unsigned short * __ptr64 __ptr64 pComputerName" ?pComputerName@@3PEAGEA
0x18000BB18: "long __cdecl StringCchCopyW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64)" ?StringCchCopyW@@YAJPEAG_KPEBG@Z
0x180028398: "struct _PERFLIBCI_RED_BLACK_NODE * __ptr64 __ptr64 g_ProviderTree" ?g_ProviderTree@@3PEAU_PERFLIBCI_RED_BLACK_NODE@@EA
0x180007000: SafeBaseRegQueryMultipleValues
0x18001F7C0: "__cdecl _imp_PcwRemoveQueryItem" __imp_PcwRemoveQueryItem
0x18001FD48: "__cdecl _imp_RtlGetAce" __imp_RtlGetAce
0x180009D10: PerfRegCloseKey
0x180007210: SafeBaseRegQueryMultipleValues2
0x18001FD78: "__cdecl _imp_RtlFreeHeap" __imp_RtlFreeHeap
0x18001FCF8: "__cdecl _imp_RtlInitializeResource" __imp_RtlInitializeResource
0x180022AF0: "\Wow6464Node" ??_C@_1BK@JDOKLMCN@?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4?$AA6?$AA4?$AAN?$AAo?$AAd?$AAe?$AA?$AA@
0x18001AED0: "struct _RESOURCE_DESCRIPTOR * __ptr64 __cdecl PerflibLookupResource(struct _GUID const * __ptr64,unsigned long,unsigned long)" ?PerflibLookupResource@@YAPEAU_RESOURCE_DESCRIPTOR@@PEBU_GUID@@KK@Z
0x1800243AC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0
0x18000A698: WPP_SF_Z
0x18001126C: "struct _ERROR_LOG * __ptr64 __cdecl PerfpFindError(unsigned long,struct _ERROR_LOG * __ptr64)" ?PerfpFindError@@YAPEAU_ERROR_LOG@@KPEAU1@@Z
0x1800270C0: PerfRemoteRegistryKey
0x18001AA4C: "unsigned long __cdecl PerfpEnumerateKernelInstances(struct _PERFLIBCI_COUNTERSET_NODE * __ptr64,struct _PERF_INSTANCE_HEADER * __ptr64,unsigned long,unsigned long * __ptr64)" ?PerfpEnumerateKernelInstances@@YAKPEAU_PERFLIBCI_COUNTERSET_NODE@@PEAU_PERF_INSTANCE_HEADER@@KPEAK@Z
0x180001050: OpenPerformanceText
0x18000F94C: "unsigned long __cdecl PerflibciOpenKey(struct HKEY__ * __ptr64,unsigned short const * __ptr64,unsigned long,struct HKEY__ * __ptr64 * __ptr64)" ?PerflibciOpenKey@@YAKPEAUHKEY__@@PEBGKPEAPEAU1@@Z
0x18001FB10: "__cdecl _imp_RtlLengthSecurityDescriptor" __imp_RtlLengthSecurityDescriptor
0x180020480: "\" ??_C@_13FPGAJAPJ@?$AA?2?$AA?$AA@
0x18000A578: WPP_SF_
0x18001FC68: "__cdecl _imp_NtReplaceKey" __imp_NtReplaceKey
0x180003DE0: RegSecCheckAllowedPaths
0x18001F6F8: "__cdecl _imp_HeapAlloc" __imp_HeapAlloc
0x18001F750: "__cdecl _imp_FreeLibrary" __imp_FreeLibrary
0x18001FA50: "__cdecl _imp_RtlUnicodeToMultiByteN" __imp_RtlUnicodeToMultiByteN
0x180002820: BaseRegCreateKey
0x18001FA28: "__cdecl _imp_NtCreatePrivateNamespace" __imp_NtCreatePrivateNamespace
0x1800240A8: "__cdecl _NULL_DELAY_IMPORT_DESCRIPTOR" __NULL_DELAY_IMPORT_DESCRIPTOR
0x18001FD08: "__cdecl _imp_RtlGetGroupSecurityDescriptor" __imp_RtlGetGroupSecurityDescriptor
0x180003850: OpenLocalMachine
0x180011F0C: "struct _EXT_OBJECT * __ptr64 __cdecl AllocateAndInitializeExtObject(struct HKEY__ * __ptr64,struct HKEY__ * __ptr64,struct _UNICODE_STRING * __ptr64)" ?AllocateAndInitializeExtObject@@YAPEAU_EXT_OBJECT@@PEAUHKEY__@@0PEAU_UNICODE_STRING@@@Z
0x18001F5C8: "__cdecl _imp_RpcBindingFree" __imp_RpcBindingFree
0x1800140AC: "void __cdecl PerfGetLangId(unsigned long,unsigned char,unsigned short * __ptr64,unsigned long)" ?PerfGetLangId@@YAXKEPEAGK@Z
0x180027980: MachineAllowedPaths
0x1800012F0: "__cdecl DllMainCRTStartup" _DllMainCRTStartup
0x180001990: NdrServerCallAll
0x180022280: PERFLIB_COLLECT_PROC_EXCEPTION
0x18001F9F0: "__cdecl _imp__initterm" __imp__initterm
0x18001F5C0: "__cdecl _imp_RpcStringBindingComposeW" __imp_RpcStringBindingComposeW
0x180006260: SafeBaseRegEnumValue
0x180022860: "\Microsoft\Windows\CurrentVersio" ??_C@_1HG@DJPIFFNN@?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAV?$AAe?$AAr?$AAs?$AAi?$AAo@
0x1800085DC: "unsigned long __cdecl PerfOpenKey(struct HKEY__ * __ptr64)" ?PerfOpenKey@@YAKPEAUHKEY__@@@Z
0x18001F5E8: "__cdecl _imp_RpcImpersonateClient" __imp_RpcImpersonateClient
0x18001F668: "__cdecl _imp_SetLastError" __imp_SetLastError
0x18001F998: "__cdecl _imp__ultow_s" __imp__ultow_s
0x180024424: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-1" __IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-1
0x18001F690: "__cdecl _imp_SetFileInformationByHandle" __imp_SetFileInformationByHandle
0x180027A20: g_regSvcIfGroup
0x18001F768: "__cdecl _imp_GetModuleFileNameW" __imp_GetModuleFileNameW
0x18001FA48: "__cdecl _imp_RtlCreateUnicodeStringFromAsciiz" __imp_RtlCreateUnicodeStringFromAsciiz
0x18001FAA8: "__cdecl _imp_RtlWaitOnAddress" __imp_RtlWaitOnAddress
0x180005F00: BaseRegEnumValueOld
0x18001F570: WowArmNodeString
0x18002426C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0
0x180022380: WPP_5e7b08e799553f534c096488c0c42f3a_Traceguids
0x18000E334: "unsigned long __cdecl PerflibciCloseKey(struct HKEY__ * __ptr64)" ?PerflibciCloseKey@@YAKPEAUHKEY__@@@Z
0x1800200D0: "Software\Microsoft\Windows NT\Cu" ??_C@_1HI@BIAOBDFB@?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAN?$AAT?$AA?2?$AAC?$AAu@
0x1800283E8: "struct _RTL_SRWLOCK PerflibResourceTableLock" ?PerflibResourceTableLock@@3U_RTL_SRWLOCK@@A
0x18001FAB0: "__cdecl _imp_RtlWakeAddressAll" __imp_RtlWakeAddressAll
0x18001F950: "__cdecl _imp_InitializeSecurityDescriptor" __imp_InitializeSecurityDescriptor
0x18001FA68: "__cdecl _imp_RtlIntegerToUnicodeString" __imp_RtlIntegerToUnicodeString
0x180022B68: "RtlWow64GetCurrentMachine" ??_C@_0BK@HIPGPEMP@RtlWow64GetCurrentMachine?$AA@
0x180028370: "unsigned __int64 g_LastRefreshTime" ?g_LastRefreshTime@@3_KA
0x180027940: "__cdecl _onexitend" __onexitend
0x18001FCA0: "__cdecl _imp_NtCreateFile" __imp_NtCreateFile
0x18001F820: "__cdecl _imp_CreateThread" __imp_CreateThread
0x1800225F8: "Perf" ??_C@_19GFMNLLAL@?$AAP?$AAe?$AAr?$AAf?$AA?$AA@
0x180003680: OpenCurrentConfig
0x18001FE10: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x1800172FC: "unsigned long __cdecl CloseExtObjectLibrary(struct _EXT_OBJECT * __ptr64,int)" ?CloseExtObjectLibrary@@YAKPEAU_EXT_OBJECT@@H@Z
0x180021A60: "unsigned short const * const cszPerflibFlags" ?cszPerflibFlags@@3QBGB
0x180003520: OpenClassesRoot
0x1800201C0: "\REGISTRY\MACHINE" ??_C@_1CE@BGEMHEPM@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?$AA@
0x18000BA98: "long __cdecl StringCbPrintfW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64,...)" ?StringCbPrintfW@@YAJPEAG_KPEBGZZ
0x1800043A0: RegSecCheckPath
0x18002243C: "NULL" ??_C@_04HIBGFPH@NULL?$AA@
0x18001F828: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x180027150: AllowedPathsKey
0x180022240: PERFLIB_BUFFER_ALIGNMENT_ERROR
0x18001FB28: "__cdecl _imp_RtlAppendUnicodeToString" __imp_RtlAppendUnicodeToString
0x18001F9B0: "__cdecl _imp__resetstkoflw" __imp__resetstkoflw
0x1800225E8: WPP_e3cc73f330eb39bc551f8ff7f089e30a_Traceguids
0x18001FBC0: "__cdecl _imp_EtwEventRegister" __imp_EtwEventRegister
0x18001AE00: "void * __ptr64 __cdecl PerflibAllocateMemory(struct _RTL_AVL_TABLE * __ptr64,unsigned long)" ?PerflibAllocateMemory@@YAPEAXPEAU_RTL_AVL_TABLE@@K@Z
0x1800055C0: PerflibV2QueryCounterSetRegistrationInfo
0x18001FDB0: "__cdecl _imp_RtlNtStatusToDosError" __imp_RtlNtStatusToDosError
0x18001FCA8: "__cdecl _imp_NtSaveKeyEx" __imp_NtSaveKeyEx
0x18001F930: api-ms-win-core-sysinfo-l1-1-0_NULL_THUNK_DATA
0x18001FE30: "__cdecl _xi_a" __xi_a
0x180021FE8: "NeutralName" ??_C@_1BI@HHOOHKAG@?$AAN?$AAe?$AAu?$AAt?$AAr?$AAa?$AAl?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x1800281B0: "struct _RTL_CRITICAL_SECTION PerfpCritSect" ?PerfpCritSect@@3U_RTL_CRITICAL_SECTION@@A
0x18001A028: "unsigned long __cdecl PerfpAddCounter(struct _PERF_QUERY * __ptr64,struct _PERFLIBCI_COUNTERSET_NODE * __ptr64,struct _PERF_COUNTER_IDENTIFIER * __ptr64)" ?PerfpAddCounter@@YAKPEAU_PERF_QUERY@@PEAU_PERFLIBCI_COUNTERSET_NODE@@PEAU_PERF_COUNTER_IDENTIFIER@@@Z
0x18001F910: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x18001F640: "__cdecl _imp_ResolveDelayLoadedAPI" __imp_ResolveDelayLoadedAPI
0x180022160: PERFLIB_BUFFER_OVERFLOW
0x180021A40: "unsigned short const * const FirstCounter" ?FirstCounter@@3QBGB
0x1800220F0: PERFLIB_CANNOT_LOAD_PERF_DLL
0x180005AA0: BaseRegSaveKey
0x180004500: RegSecCheckRemoteAccess
0x180005CD0: BaseRegSaveKeyEx
0x18001F960: api-ms-win-security-base-l1-1-0_NULL_THUNK_DATA
0x180021BC0: "unsigned short const * const CollectTimeout" ?CollectTimeout@@3QBGB
0x18001FCE0: "__cdecl _imp_NtOpenThreadToken" __imp_NtOpenThreadToken
0x180003298: InitRestrictedMachineHandle
0x180022398: "Close" ??_C@_05LGELBCGM@Close?$AA@
0x1800205E0: "\REGISTRY\MACHINE\SYSTEM\CURRENT" ??_C@_1IK@HBJLIGFJ@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?2?$AAC?$AAU?$AAR?$AAR?$AAE?$AAN?$AAT@
0x18001D300: "struct __midl_frag2_t const __midl_frag2" ?__midl_frag2@@3U__midl_frag2_t@@B
0x18001D350: "struct __midl_frag8_t const __midl_frag8" ?__midl_frag8@@3U__midl_frag8_t@@B
0x180027388: "unsigned long dwExtCtrOpenProcWaitMs" ?dwExtCtrOpenProcWaitMs@@3KA
0x18000A5D8: WPP_SF_Dd
0x18000A710: WPP_SF_dD
0x1800150F8: WPP_SF_dZ
0x18001FBB8: "__cdecl _imp_RtlRunOnceExecuteOnce" __imp_RtlRunOnceExecuteOnce
0x180011B58: WPP_SF_dS
0x180011C6C: WPP_SF_dq
0x180011144: "void __cdecl PerfpDeleteErrorLogs(struct _ERROR_LOG * __ptr64)" ?PerfpDeleteErrorLogs@@YAXPEAU_ERROR_LOG@@@Z
0x180027A00: g_status
0x180007CEC: QueryKeyInfo
0x180009AD8: McGenEventWrite
0x180028350: "unsigned short * NativeLangId" ?NativeLangId@@3PAGA
0x180027038: WPP_GLOBAL_Control
0x1800219C0: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x1800242F8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0
0x18001D3D0: "struct __midl_frag15_t const __midl_frag15" ?__midl_frag15@@3U__midl_frag15_t@@B
0x18000A8B0: "__cdecl TlgEnableCallback" _TlgEnableCallback
0x18001F7B0: api-ms-win-core-memory-l1-1-0_NULL_THUNK_DATA
0x18001FDD0: "__cdecl _imp_NtQueryKey" __imp_NtQueryKey
0x18000A59C: WPP_SF_D
0x18000A59C: WPP_SF_d
0x18001F780: "__cdecl _imp_FindResourceExW" __imp_FindResourceExW
0x180027968: "__cdecl pRawDllMain" _pRawDllMain
0x180022568: "%ws\%ws%ws%ws" ??_C@_1BM@DLCGNMPA@?$AA?$CF?$AAw?$AAs?$AA?2?$AA?$CF?$AAw?$AAs?$AA?$CF?$AAw?$AAs?$AA?$CF?$AAw?$AAs?$AA?$AA@
0x18001F5F0: "__cdecl _imp_RpcRaiseException" __imp_RpcRaiseException
0x180020080: "__cdecl _sz_api_ms_win_security_lsalookup_l1_1_0_dll" __sz_api_ms_win_security_lsalookup_l1_1_0_dll
0x180027988: MachineAllowedExactPathsCount
0x18001F940: api-ms-win-core-threadpool-legacy-l1-1-0_NULL_THUNK_DATA
0x18001FD80: "__cdecl _imp_RtlFreeSid" __imp_RtlFreeSid
0x18001F8A0: "__cdecl _imp_CreateMutexW" __imp_CreateMutexW
0x180027A38: "long volatile dwExtObjListRefCount" ?dwExtObjListRefCount@@3JC
0x18001FB70: "__cdecl _imp_RtlDeleteBoundaryDescriptor" __imp_RtlDeleteBoundaryDescriptor
0x180027B18: "void * __ptr64 __ptr64 lpPerflibSectionAddr" ?lpPerflibSectionAddr@@3PEAXEA
0x18001FD20: "__cdecl _imp_RtlAcquireResourceShared" __imp_RtlAcquireResourceShared
0x18001FD58: "__cdecl _imp_RtlCompareUnicodeString" __imp_RtlCompareUnicodeString
0x18002435C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-l1-1-0
0x18001FB80: "__cdecl _imp_NtQueryValueKey" __imp_NtQueryValueKey
0x18001F8B8: "__cdecl _imp_DeleteCriticalSection" __imp_DeleteCriticalSection
0x18001FB88: "__cdecl _imp_RtlCreateUnicodeString" __imp_RtlCreateUnicodeString
0x180009748: "int __cdecl PerflibciHeapFree(void * __ptr64)" ?PerflibciHeapFree@@YAHPEAX@Z
0x180001590: "__cdecl _security_check_cookie" __security_check_cookie
0x18001FE28: "__cdecl _xc_z" __xc_z
0x1800243D4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0
0x18001F850: api-ms-win-core-processthreads-l1-1-0_NULL_THUNK_DATA
0x18001F788: "__cdecl _imp_GetProcAddress" __imp_GetProcAddress
0x1800227C0: "\CLSID" ??_C@_1O@HEJDOEN@?$AA?2?$AAC?$AAL?$AAS?$AAI?$AAD?$AA?$AA@
0x18001F600: "__cdecl _imp_RpcServerInterfaceGroupClose" __imp_RpcServerInterfaceGroupClose
0x18000F9E4: "unsigned long __cdecl PerflibciQueryValue(struct HKEY__ * __ptr64,unsigned short const * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64,unsigned char * __ptr64)" ?PerflibciQueryValue@@YAKPEAUHKEY__@@PEBGPEAK2PEAE@Z
0x18001FB18: "__cdecl _imp_RtlMakeSelfRelativeSD" __imp_RtlMakeSelfRelativeSD
0x18000BD28: PerflibciIsLocalQueryFromHandle
0x180006400: BaseRegDeleteKey
0x180027A40: "struct _RTL_AVL_TABLE PerflibResourceTable" ?PerflibResourceTable@@3U_RTL_AVL_TABLE@@A
0x180008080: BaseRegEnumKeyOld
0x18000A7B8: WppCleanupUm
0x1800221E0: PERFLIB_INCORRECT_INSTANCE_LENGTH
0x180021C88: "unsigned short const * const HelpValue" ?HelpValue@@3QBGB
0x180004A98: RegSecReadSDFromRegistry
0x180020528: "ncacn_np" ??_C@_1BC@CCHMBIKG@?$AAn?$AAc?$AAa?$AAc?$AAn?$AA_?$AAn?$AAp?$AA?$AA@
0x180020471: "__cdecl TraceLoggingMetadataEnd" _TraceLoggingMetadataEnd
0x18001BA88: Wow64DetermineEnvironment
0x18001F908: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x18001F700: "__cdecl _imp_HeapReAlloc" __imp_HeapReAlloc
0x180011CC4: WPP_SF_dqq
0x180011E08: WPP_SF_qqd
0x1800097AC: "unsigned long __cdecl PerflibciLocalWaitForMutex(void * __ptr64)" ?PerflibciLocalWaitForMutex@@YAKPEAX@Z
0x1800221D0: PERFLIB_GUARD_PAGE_VIOLATION
0x180022170: PERFLIB_BUFFER_POINTER_MISMATCH
0x18001FD10: "__cdecl _imp_RtlReleaseResource" __imp_RtlReleaseResource
0x18000A92C: "struct _PERFLIBCI_INSTANCE_NODE * __ptr64 __cdecl PerflibciFindInstance(struct _PERFLIBCI_COUNTERSET_NODE * __ptr64,unsigned short * __ptr64,unsigned long,unsigned long,int)" ?PerflibciFindInstance@@YAPEAU_PERFLIBCI_INSTANCE_NODE@@PEAU_PERFLIBCI_COUNTERSET_NODE@@PEAGKKH@Z
0x18001F718: "__cdecl _imp_LocalAlloc" __imp_LocalAlloc
0x18001FC30: "__cdecl _imp_EtwGetTraceEnableLevel" __imp_EtwGetTraceEnableLevel
0x180027928: "__cdecl _hmod__SspiCli_dll" __hmod__SspiCli_dll
0x18001F630: "__cdecl _imp_DelayLoadFailureHook" __imp_DelayLoadFailureHook
0x18000EBDC: "unsigned long __cdecl PerflibciGuidFromString(unsigned short * __ptr64,struct _GUID * __ptr64)" ?PerflibciGuidFromString@@YAKPEAGPEAU_GUID@@@Z
0x18001F6F0: "__cdecl _imp_GetProcessHeap" __imp_GetProcessHeap
0x18001F548: WowArm64NodeString
0x18001F7D0: "__cdecl _imp_PcwCreateNotifier" __imp_PcwCreateNotifier
0x180027978: RegSecReloadLock
0x1800226D0: "\{36BBB745-0999-4FD8-A538-4D4D84" ??_C@_1FA@NMDPIOEE@?$AA?2?$AA?$HL?$AA3?$AA6?$AAB?$AAB?$AAB?$AA7?$AA4?$AA5?$AA?9?$AA0?$AA9?$AA9?$AA9?$AA?9?$AA4?$AAF?$AAD?$AA8?$AA?9?$AAA?$AA5?$AA3?$AA8?$AA?9?$AA4?$AAD?$AA4?$AAD?$AA8?$AA4@
0x18001F688: "__cdecl _imp_FindNextFileW" __imp_FindNextFileW
0x180021C00: "unsigned short const * const ExtPath" ?ExtPath@@3QBGB
0x18002A010: "__cdecl _imp_LookupAccountSidLocalW" __imp_LookupAccountSidLocalW
0x18001F970: "__cdecl _imp_SetServiceStatus" __imp_SetServiceStatus
0x18001FBF0: "__cdecl _imp_RtlGetThreadPreferredUILanguages" __imp_RtlGetThreadPreferredUILanguages
0x18001F730: "__cdecl _imp_DosDateTimeToFileTime" __imp_DosDateTimeToFileTime
0x1800202B4: "unsigned char const __midl_frag25" ?__midl_frag25@@3EB
0x180021E30: WPP_e7d234ecbfbf322e274d1e47a3a97375_Traceguids
0x180021AF0: "unsigned short const * const KeepResident" ?KeepResident@@3QBGB
0x1800048C0: RegSecReadAllowedPath
0x18001F798: "__cdecl _imp_UnmapViewOfFile" __imp_UnmapViewOfFile
0x18000A4DC: TraceLoggingRegisterEx
0x1800138A0: "int __cdecl PerflibCreateSD(unsigned long)" ?PerflibCreateSD@@YAHK@Z
0x1800058B0: BaseRegRestoreKey
0x180022180: PERFLIB_LIBRARY_TEMP_DISABLED
0x1800019AC: IsPerfRegCloseKeyPresent
0x1800224A0: "%.*ls\%ls" ??_C@_1BE@IHEFAICJ@?$AA?$CF?$AA?4?$AA?$CK?$AAl?$AAs?$AA?2?$AA?$CF?$AAl?$AAs?$AA?$AA@
0x180022210: PERFLIB_CLOSE_PROC_EXCEPTION
0x18001AB60: "struct _PERFLIBCI_RED_BLACK_NODE * __ptr64 __cdecl PerfpFindInstance(long * __ptr64,struct _PERFLIBCI_RED_BLACK_NODE * __ptr64 * __ptr64,struct _PERFLIBCI_RED_BLACK_NODE * __ptr64,unsigned short const * __ptr64,unsigned long)" ?PerfpFindInstance@@YAPEAU_PERFLIBCI_RED_BLACK_NODE@@PEAJPEAPEAU1@PEAU1@PEBGK@Z
0x180020488: "\PIPE\winreg" ??_C@_1BK@HNEMJPAC@?$AA?2?$AAP?$AAI?$AAP?$AAE?$AA?2?$AAw?$AAi?$AAn?$AAr?$AAe?$AAg?$AA?$AA@
0x18000DFD0: "struct _PERFLIBCI_PROVIDER_NODE * __ptr64 __cdecl PerflibciBuildProvider(struct HKEY__ * __ptr64,unsigned short * __ptr64,unsigned long * __ptr64)" ?PerflibciBuildProvider@@YAPEAU_PERFLIBCI_PROVIDER_NODE@@PEAUHKEY__@@PEAGPEAK@Z
0x180027384: "unsigned long dwThreadAndLibraryTimeout" ?dwThreadAndLibraryTimeout@@3KA
0x18001FB20: "__cdecl _imp_RtlValidSecurityDescriptor" __imp_RtlValidSecurityDescriptor
0x1800283A8: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUhxivtUdrmivtUkviuoryUxfiivmgUlyquivUznwGEUkviukOlyq@perflib" __@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUhxivtUdrmivtUkviuoryUxfiivmgUlyquivUznwGEUkviukOlyq@perflib
0x18001F6D0: "__cdecl _imp_CopyFileExW" __imp_CopyFileExW
0x180022350: "unsigned short const * const HELP_STRING" ?HELP_STRING@@3QBGB
0x180024334: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-apiquery-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-apiquery-l1-1-0
0x180020560: "RegisterServiceCtrlHandler faile" ??_C@_0CI@HBMJGHLG@RegisterServiceCtrlHandler?5faile@
0x18001F860: api-ms-win-core-profile-l1-1-0_NULL_THUNK_DATA
0x18001FE48: "__cdecl _guard_fids_table" __guard_fids_table
0x180022290: PERFLIB_COLLECT_PROC_FAILURE
0x18001F958: "__cdecl _imp_CreateWellKnownSid" __imp_CreateWellKnownSid
0x18001FA18: msvcrt_NULL_THUNK_DATA
0x1800283A0: "struct _PERFLIBCI_RED_BLACK_NODE * __ptr64 __ptr64 g_ProviderList" ?g_ProviderList@@3PEAU_PERFLIBCI_RED_BLACK_NODE@@EA
0x18001A5B4: "unsigned long __cdecl PerfpCollectKernelData(struct _PERF_QUERY * __ptr64)" ?PerfpCollectKernelData@@YAKPEAU_PERF_QUERY@@@Z
0x18001D090: "__cdecl load_config_used" _load_config_used
0x180020288: "struct __midl_frag17_t const __midl_frag17" ?__midl_frag17@@3U__midl_frag17_t@@B
0x18000FBF4: "void __cdecl PerflibciSetObjectsValidityState(unsigned char)" ?PerflibciSetObjectsValidityState@@YAXE@Z
0x18001F938: "__cdecl _imp_UnregisterWaitEx" __imp_UnregisterWaitEx
0x1800240D0: SspiCli_NULL_THUNK_DATA_DLN
0x18001F8E0: "__cdecl _imp_ReleaseMutex" __imp_ReleaseMutex
0x1800221C0: PERFLIB_COLLECT_PROC_NOT_FOUND
0x1800227D0: "\DirectShow" ??_C@_1BI@PJOGKDFE@?$AA?2?$AAD?$AAi?$AAr?$AAe?$AAc?$AAt?$AAS?$AAh?$AAo?$AAw?$AA?$AA@
0x180024068: "__cdecl _DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_sddl_l1_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_sddl_l1_1_0_dll
0x1800141C0: "long __cdecl PerfGetNames(unsigned long,struct _UNICODE_STRING const * __ptr64,struct _UNICODE_STRING const * __ptr64,unsigned char * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64,unsigned short const * __ptr64)" ?PerfGetNames@@YAJKPEBU_UNICODE_STRING@@0PEAEPEAK2PEBG@Z
0x180010F80: "unsigned long __cdecl PerfpCheckErrorTime(struct _ERROR_LOG * __ptr64,__int64,struct HKEY__ * __ptr64)" ?PerfpCheckErrorTime@@YAKPEAU_ERROR_LOG@@_JPEAUHKEY__@@@Z
0x180022508: "perfh004.dat" ??_C@_1BK@HAINHBPL@?$AAp?$AAe?$AAr?$AAf?$AAh?$AA0?$AA0?$AA4?$AA?4?$AAd?$AAa?$AAt?$AA?$AA@
0x18001F648: api-ms-win-core-delayload-l1-1-1_NULL_THUNK_DATA
0x18001F638: api-ms-win-core-delayload-l1-1-0_NULL_THUNK_DATA
0x180009AA8: McGenEventUnregister
0x180001060: BaseRegNotifyChangeKeyValue
0x180021910: ".dat" ??_C@_19DOLFOBJP@?$AA?4?$AAd?$AAa?$AAt?$AA?$AA@
0x180022250: PERFLIB_NO_PERFORMANCE_SUBKEY
0x18001B240: GetKeyPath
0x18000FB48: "void __cdecl PerflibciRotateLeft(struct _PERFLIBCI_RED_BLACK_NODE * __ptr64 * __ptr64,struct _PERFLIBCI_RED_BLACK_NODE * __ptr64)" ?PerflibciRotateLeft@@YAXPEAPEAU_PERFLIBCI_RED_BLACK_NODE@@PEAU1@@Z
0x18001FB08: "__cdecl _imp_RtlInitializeGenericTableAvl" __imp_RtlInitializeGenericTableAvl
0x180003970: OpenPerformanceData
0x180005860: RPC_HQUERY_rundown
0x180015264: "unsigned long __cdecl PerfpExceptionFilter(unsigned long,struct _EXCEPTION_POINTERS const * __ptr64,struct _EXT_OBJECT * __ptr64,unsigned long)" ?PerfpExceptionFilter@@YAKKPEBU_EXCEPTION_POINTERS@@PEAU_EXT_OBJECT@@K@Z
0x180024370: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processenvironment-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processenvironment-l1-1-0
0x180022190: PERFLIB_COLLECTION_HUNG
0x180027B30: "unsigned short * szUpdatingServiceName" ?szUpdatingServiceName@@3PAGA
0x1800102BC: "unsigned long __cdecl DisableLibrary(struct HKEY__ * __ptr64,unsigned short * __ptr64,unsigned long)" ?DisableLibrary@@YAKPEAUHKEY__@@PEAGK@Z
0x18001F5F8: "__cdecl _imp_RpcServerInqCallAttributesW" __imp_RpcServerInqCallAttributesW
0x18001F5B8: "__cdecl _imp_RpcBindingFromStringBindingW" __imp_RpcBindingFromStringBindingW
0x18001FC58: "__cdecl _imp_NtSetSecurityObject" __imp_NtSetSecurityObject
0x18001FA08: "__cdecl _imp__amsg_exit" __imp__amsg_exit
0x18001F608: "__cdecl _imp_RpcServerInterfaceGroupDeactivate" __imp_RpcServerInterfaceGroupDeactivate
0x18000A218: PerfRegQueryInfoKey
0x180007590: BaseRegSetKeySecurity
0x180021E40: WPP_ThisDir_CTLGUID_PerfLib
0x18001FDB8: "__cdecl _imp_NtClose" __imp_NtClose
0x180003A40: OpenUsers
0x180017780: "unsigned long __cdecl OpenExtObjectLibrary(struct _EXT_OBJECT * __ptr64)" ?OpenExtObjectLibrary@@YAKPEAU_EXT_OBJECT@@@Z
0x1800220E0: PERFLIB_OPEN_PROC_EXCEPTION
0x180015078: "long __cdecl StringCchPrintfW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64,...)" ?StringCchPrintfW@@YAJPEAG_KPEBGZZ
0x1800200B0: "DisableIdleStop" ??_C@_1CA@CEJMEOP@?$AAD?$AAi?$AAs?$AAa?$AAb?$AAl?$AAe?$AAI?$AAd?$AAl?$AAe?$AAS?$AAt?$AAo?$AAp?$AA?$AA@
0x180022230: PERFLIB_INVALID_WOW32_PERF_DLL
0x180022A20: "\REGISTRY\USER\*\SOFTWARE\Classe" ??_C@_1EE@HDBCEPHC@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAU?$AAS?$AAE?$AAR?$AA?2?$AA?$CK?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAC?$AAl?$AAa?$AAs?$AAs?$AAe@
0x180011794: "void * __ptr64 __cdecl StartPerflibFunctionTimer(struct _OPEN_PROC_WAIT_INFO * __ptr64)" ?StartPerflibFunctionTimer@@YAPEAXPEAU_OPEN_PROC_WAIT_INFO@@@Z
0x180003780: OpenCurrentUser
0x18001FDE8: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x1800224D8: "prfh" ??_C@_19CEHGLHFH@?$AAp?$AAr?$AAf?$AAh?$AA?$AA@
0x180022628: "S-1-5-19" ??_C@_1BC@OGNCNKIA@?$AAS?$AA?9?$AA1?$AA?9?$AA5?$AA?9?$AA1?$AA9?$AA?$AA@
0x1800279D8: RestrictedHandlesQuota
0x180022220: PERFLIB_INVALID_WIN64_PERF_DLL
0x18001F858: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x180027B28: "void * __ptr64 __ptr64 hPerflibSectionFile" ?hPerflibSectionFile@@3PEAXEA
0x180021C98: "unsigned short const * const CounterValue" ?CounterValue@@3QBGB
0x18001FCC8: "__cdecl _imp_RtlGetDaclSecurityDescriptor" __imp_RtlGetDaclSecurityDescriptor
0x18001FC28: "__cdecl _imp_EtwGetTraceEnableFlags" __imp_EtwGetTraceEnableFlags
0x180020244: "struct _NDR64_CONTEXT_HANDLE_FORMAT const __midl_frag4" ?__midl_frag4@@3U_NDR64_CONTEXT_HANDLE_FORMAT@@B
0x180003B5C: CleanupRemoteSecurity
0x1800104EC: "unsigned long __cdecl GetNextNumberFromList(unsigned short const * __ptr64,unsigned short const * __ptr64 * __ptr64)" ?GetNextNumberFromList@@YAKPEBGPEAPEBG@Z
0x180022668: WPP_e1718bf12a503f6f2b7f56d59ccb6631_Traceguids
0x180021EE0: "_V2Providers" ??_C@_1BK@CDNLPEJE@?$AA_?$AAV?$AA2?$AAP?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AAs?$AA?$AA@
0x180020248: "struct _NDR64_CONTEXT_HANDLE_FORMAT const __midl_frag9" ?__midl_frag9@@3U_NDR64_CONTEXT_HANDLE_FORMAT@@B
0x180001A00: ApiSetQueryApiSetPresence
0x18000977C: "unsigned long __cdecl PerflibciLocalReleaseMutex(void * __ptr64)" ?PerflibciLocalReleaseMutex@@YAKPEAX@Z
0x180001030: BaseAbortSystemShutdown
0x18001FA60: "__cdecl _imp_RtlLeaveCriticalSection" __imp_RtlLeaveCriticalSection
0x18001FCD0: "__cdecl _imp_NtQuerySecurityObject" __imp_NtQuerySecurityObject
0x1800171AC: WPP_SF_Sdd
0x180006434: BaseRegDeleteKeyExInternal
0x18001F7B8: "__cdecl _imp_PcwEnumerateInstances" __imp_PcwEnumerateInstances
0x180022588: "%ws\%ws??%ws%ws" ??_C@_1CA@OLONGMFJ@?$AA?$CF?$AAw?$AAs?$AA?2?$AA?$CF?$AAw?$AAs?$AA?$DP?$AA?$DP?$AA?$CF?$AAw?$AAs?$AA?$CF?$AAw?$AAs?$AA?$AA@
0x18001F7A0: "__cdecl _imp_CreateFileMappingW" __imp_CreateFileMappingW
0x180022548: "perfh016.dat" ??_C@_1BK@BLJAOBC@?$AAp?$AAe?$AAr?$AAf?$AAh?$AA0?$AA1?$AA6?$AA?4?$AAd?$AAa?$AAt?$AA?$AA@
0x1800184F4: WPP_SF_SSD
0x180018634: WPP_SF_Ssd
0x180021E10: "unsigned short const * const DLLValue" ?DLLValue@@3QBGB
0x18000971C: "void * __ptr64 __cdecl PerflibciHeapAlloc(unsigned __int64)" ?PerflibciHeapAlloc@@YAPEAX_K@Z
0x180022020: "First Counter" ??_C@_1BM@IBDHKGGM@?$AAF?$AAi?$AAr?$AAs?$AAt?$AA?5?$AAC?$AAo?$AAu?$AAn?$AAt?$AAe?$AAr?$AA?$AA@
0x18001F5B0: "__cdecl _imp_RpcStringFreeW" __imp_RpcStringFreeW
0x18000AED4: "void __cdecl PerflibciNotifyQuery(struct _PERF_QUERY * __ptr64)" ?PerflibciNotifyQuery@@YAXPEAU_PERF_QUERY@@@Z
0x180027AE0: RestrictedMachineHandle
0x180020258: "struct __midl_frag16_t const __midl_frag16" ?__midl_frag16@@3U__midl_frag16_t@@B
0x18001FDE0: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x180022BB0: "__cdecl _pfnDefaultDliFailureHook2" __pfnDefaultDliFailureHook2
0x180021E00: "char const * const CloseValue" ?CloseValue@@3QBDB
0x180001AA3: "__cdecl _tailMerge_api_ms_win_security_sddl_l1_1_0_dll" __tailMerge_api_ms_win_security_sddl_l1_1_0_dll
0x180019A5C: "unsigned long __cdecl PerflibciQueryV2Provider(unsigned long,unsigned short const * __ptr64,struct _EXT_OBJ_LIST * __ptr64,unsigned long,void * __ptr64 * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64)" ?PerflibciQueryV2Provider@@YAKKPEBGPEAU_EXT_OBJ_LIST@@KPEAPEAXPEAK3@Z
0x18000352C: OpenClassesRootInternal
0x1800225D0: "%ws%ws%ws" ??_C@_1BE@MFOEGDMN@?$AA?$CF?$AAw?$AAs?$AA?$CF?$AAw?$AAs?$AA?$CF?$AAw?$AAs?$AA?$AA@
0x18000BA4C: "long __cdecl StringCbCopyW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64)" ?StringCbCopyW@@YAJPEAG_KPEBG@Z
0x18000EE70: "void __cdecl PerflibciInsertRedBlackNode(struct _PERFLIBCI_RED_BLACK_NODE * __ptr64 * __ptr64,struct _PERFLIBCI_RED_BLACK_NODE * __ptr64)" ?PerflibciInsertRedBlackNode@@YAXPEAPEAU_PERFLIBCI_RED_BLACK_NODE@@PEAU1@@Z
0x18001FC78: "__cdecl _imp_NtLoadKey" __imp_NtLoadKey
0x1800204E0: "RemoteRegistry Perflib Interface" ??_C@_1EC@HLHBKCCI@?$AAR?$AAe?$AAm?$AAo?$AAt?$AAe?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?5?$AAP?$AAe?$AAr?$AAf?$AAl?$AAi?$AAb?$AA?5?$AAI?$AAn?$AAt?$AAe?$AAr?$AAf?$AAa?$AAc?$AAe@
0x18001C210: MIDL_user_allocate
0x1800017B0: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x18001F808: "__cdecl _imp_ExpandEnvironmentStringsW" __imp_ExpandEnvironmentStringsW
0x180001CF4: memcmp
0x18001F928: "__cdecl _imp_GetSystemDirectoryW" __imp_GetSystemDirectoryW
0x180022458: "unsigned short const * const DefaultLangId" ?DefaultLangId@@3QBGB
0x18001F980: "__cdecl _imp_wcsrchr" __imp_wcsrchr
0x18000FC4C: "unsigned long __cdecl PerflibciWcharToHex(unsigned short,unsigned char * __ptr64)" ?PerflibciWcharToHex@@YAKGPEAE@Z
0x1800170E0: WPP_SF_SSdd
0x180027AC8: g_hEventTerminated
0x180015228: "__int64 __cdecl GetTimeAsLongLong(void)" ?GetTimeAsLongLong@@YA_JXZ
0x180020250: "unsigned char const __midl_frag13" ?__midl_frag13@@3EB
0x180021F00: "ProviderType" ??_C@_1BK@KDOGOMCJ@?$AAP?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x180021A08: "unsigned short const * const LastHelp" ?LastHelp@@3QBGB
0x180002C38: BaseRegCreateMultipartKey
0x18002A028: "__cdecl _imp_ConvertStringSecurityDescriptorToSecurityDescriptorW" __imp_ConvertStringSecurityDescriptorToSecurityDescriptorW
0x180001040: OpenPerformanceNlsText
0x18001D060: "struct _MIDL_STUBLESS_PROXY_INFO const PerfHost_ProxyInfo" ?PerfHost_ProxyInfo@@3U_MIDL_STUBLESS_PROXY_INFO@@B
0x180027AC0: g_svcsGlobalData
0x18001A410: "unsigned long __cdecl PerfpAllocateAndEnumerateKernelInstances(struct _UNICODE_STRING const * __ptr64,struct _PCW_INSTANCE_NAMES * __ptr64 * __ptr64,unsigned long * __ptr64)" ?PerfpAllocateAndEnumerateKernelInstances@@YAKPEBU_UNICODE_STRING@@PEAPEAU_PCW_INSTANCE_NAMES@@PEAK@Z
0x1800242A8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0
0x18001F7E0: "__cdecl _imp_PcwCollectData" __imp_PcwCollectData
0x18001D3F0: "struct __midl_frag22_t const __midl_frag22" ?__midl_frag22@@3U__midl_frag22_t@@B
0x18001F7D8: "__cdecl _imp_PcwSendStatelessNotification" __imp_PcwSendStatelessNotification
0x18001FB98: "__cdecl _imp_RtlRunOnceInitialize" __imp_RtlRunOnceInitialize
0x180003334: InitSecurityAcls
0x180027990: MachineAllowedPathsBase
0x180002780: BaseRegCloseKeyInternal
0x180010EB0: "struct HKEY__ * __ptr64 __cdecl PerflibciGetKeyPerflib(void)" ?PerflibciGetKeyPerflib@@YAPEAUHKEY__@@XZ
0x180024048: "__cdecl _DELAY_IMPORT_DESCRIPTOR_SspiCli_dll" __DELAY_IMPORT_DESCRIPTOR_SspiCli_dll
0x180010988: "unsigned long __cdecl KillPerflibFunctionTimer(void * __ptr64)" ?KillPerflibFunctionTimer@@YAKPEAX@Z
0x18000791C: BaseRegQueryInfoKeyOld
0x180002F40: BaseRegOpenKeyInternal
0x18001FA10: "__cdecl _imp__XcptFilter" __imp__XcptFilter
0x18001FD28: "__cdecl _imp_RtlDeleteResource" __imp_RtlDeleteResource
0x18001FE08: ntdll_NULL_THUNK_DATA
0x18001F9D0: "__cdecl _imp_memcpy" __imp_memcpy
0x180022990: "\REGISTRY\USER\*_Classes" ??_C@_1DC@OCGJAOPP@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAU?$AAS?$AAE?$AAR?$AA?2?$AA?$CK?$AA_?$AAC?$AAl?$AAa?$AAs?$AAs?$AAe?$AAs?$AA?$AA@
0x180001B40: "__cdecl _tailMerge_api_ms_win_security_lsalookup_l1_1_0_dll" __tailMerge_api_ms_win_security_lsalookup_l1_1_0_dll
0x18000A0A4: PerfRegEnumValue
0x180027AA8: "void * __ptr64 __ptr64 PerfpCachedBinding" ?PerfpCachedBinding@@3PEAXEA
0x18001723C: WPP_SF_ddD
0x18001729C: WPP_SF_ddd
0x180002868: BaseRegCreateKeyInternal
0x18001FBE8: "__cdecl _imp_EtwEventUnregister" __imp_EtwEventUnregister
0x18001F738: "__cdecl _imp_GetComputerNameW" __imp_GetComputerNameW
0x180002244: ShutdownWinreg
0x18000E91C: "unsigned long __cdecl PerflibciExpandPath(unsigned short * __ptr64 * __ptr64)" ?PerflibciExpandPath@@YAKPEAPEAG@Z
0x180006AF0: BaseRegUnLoadKey
0x180014038: "unsigned long __cdecl GetLangIdFromSzLang(unsigned short const * __ptr64)" ?GetLangIdFromSzLang@@YAKPEBG@Z
0x180001A0C: "__cdecl _imp_load_GetUserNameExW" __imp_load_GetUserNameExW
0x18001FC00: "__cdecl _imp_EtwEventWriteTransfer" __imp_EtwEventWriteTransfer
0x180024280: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0
0x1800228D8: "\Classes\Wow6432Node" ??_C@_1CK@GDGDGMEP@?$AA?2?$AAC?$AAl?$AAa?$AAs?$AAs?$AAe?$AAs?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4?$AA3?$AA2?$AAN?$AAo?$AAd?$AAe?$AA?$AA@
0x180022480: "perf0000.dat" ??_C@_1BK@PAPEMIPA@?$AAp?$AAe?$AAr?$AAf?$AA0?$AA0?$AA0?$AA0?$AA?4?$AAd?$AAa?$AAt?$AA?$AA@
0x180021FA8: "InstanceType" ??_C@_1BK@JKJLDDIO@?$AAI?$AAn?$AAs?$AAt?$AAa?$AAn?$AAc?$AAe?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x180021DF0: "char const * const QueryValue" ?QueryValue@@3QBDB
0x18001F620: "__cdecl _imp_ApiSetQueryApiSetPresence" __imp_ApiSetQueryApiSetPresence
0x180027098: "__cdecl _security_cookie" __security_cookie
0x180028348: "long NumberOfOpens" ?NumberOfOpens@@3JA
0x180027AB0: "struct _PERFI_THREAD_QUERY * __ptr64 __ptr64 g_QueryList" ?g_QueryList@@3PEAU_PERFI_THREAD_QUERY@@EA
0x180022078: "D:(A;;GA;;;BA)(A;;GA;;;SY)" ??_C@_1DG@MBIIGLFH@?$AAD?$AA?3?$AA?$CI?$AAA?$AA?$DL?$AA?$DL?$AAG?$AAA?$AA?$DL?$AA?$DL?$AA?$DL?$AAB?$AAA?$AA?$CJ?$AA?$CI?$AAA?$AA?$DL?$AA?$DL?$AAG?$AAA?$AA?$DL?$AA?$DL?$AA?$DL?$AAS?$AAY?$AA?$CJ?$AA?$AA@
0x180006CF0: BaseRegQueryValue
0x18001F8A8: "__cdecl _imp_ResetEvent" __imp_ResetEvent
0x18001F6E0: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x18001A7B8: "unsigned long __cdecl PerfpConvertToMultiCounters(struct _PCW_QUERYITEM_BUFFER * __ptr64,void * __ptr64 * __ptr64)" ?PerfpConvertToMultiCounters@@YAKPEAU_PCW_QUERYITEM_BUFFER@@PEAPEAX@Z
0x18001F720: "__cdecl _imp_LocalFree" __imp_LocalFree
0x18001FA30: "__cdecl _imp_RtlAddSIDToBoundaryDescriptor" __imp_RtlAddSIDToBoundaryDescriptor
0x18001FC70: "__cdecl _imp_NtUnloadKey" __imp_NtUnloadKey
0x180027D40: "unsigned short * szPerflibSectionName" ?szPerflibSectionName@@3PAGA
0x18001FC80: "__cdecl _imp_NtDeleteKey" __imp_NtDeleteKey
0x180024294: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0
0x180013C50: McGenControlCallbackV2
0x18002738C: DefaultGuestMachine
0x18001F6B8: "__cdecl _imp_FindFirstFileExW" __imp_FindFirstFileExW
0x180021B20: "unsigned short const * const LibraryUnloadTime" ?LibraryUnloadTime@@3QBGB
0x18001FB90: "__cdecl _imp_NtQueryPerformanceCounter" __imp_NtQueryPerformanceCounter
0x180005230: PerflibV2OpenQueryHandle
0x1800279C8: MachineAllowedExactPathsBase
0x180027948: "__cdecl _onexitbegin" __onexitbegin
0x180005470: PerflibV2QueryCounterInfo
0x18001FD98: "__cdecl _imp_RtlAllocateAndInitializeSid" __imp_RtlAllocateAndInitializeSid
0x180022060: "\syswow64\" ??_C@_1BG@OKEANEGD@?$AA?2?$AAs?$AAy?$AAs?$AAw?$AAo?$AAw?$AA6?$AA4?$AA?2?$AA?$AA@
0x180022120: PERFLIB_INVALID_DEFINITION_BLOCK
0x18001F990: "__cdecl _imp__vsnwprintf" __imp__vsnwprintf
0x180022940: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1EO@PMMLBCDN@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x18000A76C: WPP_SF_qd
0x18001F5E0: "__cdecl _imp_RpcRevertToSelf" __imp_RpcRevertToSelf
0x18001FDF8: "__cdecl _imp_DbgPrint" __imp_DbgPrint
0x18001F7E8: "__cdecl _imp_PcwSetQueryItemUserData" __imp_PcwSetQueryItemUserData
0x18001F658: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x18001F840: "__cdecl _imp_GetCurrentThread" __imp_GetCurrentThread
0x180011DB8: WPP_SF_qq
0x1800240F8: api-ms-win-security-sddl-l1-1-0_NULL_THUNK_DATA_DLN
0x180021B78: "unsigned short const * const ExtCounterTestLevel" ?ExtCounterTestLevel@@3QBGB
0x180022B10: "\WowAA32Node" ??_C@_1BK@HFANIHID@?$AA?2?$AAW?$AAo?$AAw?$AAA?$AAA?$AA3?$AA2?$AAN?$AAo?$AAd?$AAe?$AA?$AA@
0x18001F7F0: "__cdecl _imp_PcwAddQueryItem" __imp_PcwAddQueryItem
0x180021E60: "{%08lx-%04x-%04x-%02x%02x-%02x%0" ??_C@_1GI@JHCBPFLC@?$AA?$HL?$AA?$CF?$AA0?$AA8?$AAl?$AAx?$AA?9?$AA?$CF?$AA0?$AA4?$AAx?$AA?9?$AA?$CF?$AA0?$AA4?$AAx?$AA?9?$AA?$CF?$AA0?$AA2?$AAx?$AA?$CF?$AA0?$AA2?$AAx?$AA?9?$AA?$CF?$AA0?$AA2?$AAx?$AA?$CF?$AA0@
0x18001F878: "__cdecl _imp_RegOpenKeyExW" __imp_RegOpenKeyExW
0x180001B22: "__cdecl _imp_load_ConvertStringSidToSidW" __imp_load_ConvertStringSidToSidW
0x18001FAE8: "__cdecl _imp_RtlLookupElementGenericTableAvl" __imp_RtlLookupElementGenericTableAvl
0x1800016B4: "__cdecl _security_init_cookie" __security_init_cookie
0x180011D7C: WPP_SF_q
0x1800279B0: RemoteRegistrySD
0x1800242BC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-service-core-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-service-core-l1-1-0
0x18001FC60: "__cdecl _imp_NtQueryMultipleValueKey" __imp_NtQueryMultipleValueKey
0x18001A4EC: "unsigned long __cdecl PerfpAllocateCounterSetMultiInsts(struct _PERFLIBCI_MULTI_INSTS * __ptr64 * __ptr64,unsigned __int64)" ?PerfpAllocateCounterSetMultiInsts@@YAKPEAPEAU_PERFLIBCI_MULTI_INSTS@@_K@Z
0x180007420: BaseRegGetKeySecurityOld
0x180027040: S_Perflib_Context
0x18001F868: "__cdecl _imp_RegGetValueW" __imp_RegGetValueW
0x18001FA20: "__cdecl _imp_NtOpenPrivateNamespace" __imp_NtOpenPrivateNamespace
0x18001F948: "__cdecl _imp_SetSecurityDescriptorDacl" __imp_SetSecurityDescriptorDacl
0x180004EB0: PerflibV2CloseQueryHandle
0x180022720: "\{963F9E1B-197A-4664-B7D1-BCF544" ??_C@_1FA@DCDCJLCC@?$AA?2?$AA?$HL?$AA9?$AA6?$AA3?$AAF?$AA9?$AAE?$AA1?$AAB?$AA?9?$AA1?$AA9?$AA7?$AAA?$AA?9?$AA4?$AA6?$AA6?$AA4?$AA?9?$AAB?$AA7?$AAD?$AA1?$AA?9?$AAB?$AAC?$AAF?$AA5?$AA4?$AA4@
0x180020590: "\REGISTRY\MACHINE\SOFTWARE\CLASS" ??_C@_1EG@HOBPNEJK@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAC?$AAL?$AAA?$AAS?$AAS@
0x180027378: "unsigned long dwBoostPriority" ?dwBoostPriority@@3KA
0x18000D230: PerflibciLocalValidateCounters
0x180024230: "__cdecl _IMPORT_DESCRIPTOR_msvcrt" __IMPORT_DESCRIPTOR_msvcrt
0x180002F00: BaseRegGetVersion
0x18001F9D8: "__cdecl _imp_memmove" __imp_memmove
0x18000AD4C: "void * __ptr64 __cdecl PerflibciHeapReAlloc(void * __ptr64,unsigned __int64)" ?PerflibciHeapReAlloc@@YAPEAXPEAX_K@Z
0x18001DA38: CurrentConfigStringKey
0x180021FC8: "CounterCount" ??_C@_1BK@BEAJOLDA@?$AAC?$AAo?$AAu?$AAn?$AAt?$AAe?$AAr?$AAC?$AAo?$AAu?$AAn?$AAt?$AA?$AA@
0x180021F40: "ApplicationIdentity" ??_C@_1CI@JLLFEFFG@?$AAA?$AAp?$AAp?$AAl?$AAi?$AAc?$AAa?$AAt?$AAi?$AAo?$AAn?$AAI?$AAd?$AAe?$AAn?$AAt?$AAi?$AAt?$AAy?$AA?$AA@
0x1800040F8: RegSecCheckIfAclValid
0x180007F00: BaseRegSetValue
0x180013D58: McGenEventRegister
0x18001F610: "__cdecl _imp_RpcServerInterfaceGroupCreateW" __imp_RpcServerInterfaceGroupCreateW
0x18001FBD8: "__cdecl _imp_NtOpenKey" __imp_NtOpenKey
0x18001F9F8: "__cdecl _imp_malloc" __imp_malloc
0x1800201E8: "\REGISTRY\USER" ??_C@_1BO@PBBLJICK@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAU?$AAS?$AAE?$AAR?$AA?$AA@
0x18001FC90: "__cdecl _imp_NtRestoreKey" __imp_NtRestoreKey
0x180001B34: "__cdecl _imp_load_LookupAccountSidLocalW" __imp_load_LookupAccountSidLocalW
0x180021AE8: "unsigned short const * const NULL_STRING" ?NULL_STRING@@3QBGB
0x18001FA80: "__cdecl _imp_RtlAddAccessAllowedAceEx" __imp_RtlAddAccessAllowedAceEx
0x180003CF8: InitializeRemoteSecurity
0x180024258: "__cdecl _IMPORT_DESCRIPTOR_RPCRT4" __IMPORT_DESCRIPTOR_RPCRT4
0x18001FD90: "__cdecl _imp_RtlLengthSid" __imp_RtlLengthSid
0x180021D20: "unsigned short const * const PerflibKey" ?PerflibKey@@3QBGB
0x18001F7F8: "__cdecl _imp_PcwCreateQuery" __imp_PcwCreateQuery
0x18001F698: "__cdecl _imp_GetFileSize" __imp_GetFileSize
0x18001F6A8: "__cdecl _imp_GetFileTime" __imp_GetFileTime
0x18001AF44: MapSDToRpcSD
0x180016F74: McTemplateU0zzqq
0x1800019AC: IsPerfRegQueryValuePresent
0x18001FBA8: "__cdecl _imp_RtlDeleteCriticalSection" __imp_RtlDeleteCriticalSection
0x18001F618: RPCRT4_NULL_THUNK_DATA
0x18000EDEC: "unsigned char __cdecl PerflibciInitialize(void)" ?PerflibciInitialize@@YAEXZ
0x18001A178: "unsigned long __cdecl PerfpAddInstance(struct _PERFLIBCI_MULTI_INSTS * __ptr64,struct _PCW_INSTANCE_BUFFER * __ptr64,unsigned __int64)" ?PerfpAddInstance@@YAKPEAU_PERFLIBCI_MULTI_INSTS@@PEAU_PCW_INSTANCE_BUFFER@@_K@Z
0x18001F598: "__cdecl _imp_RpcServerInterfaceGroupActivate" __imp_RpcServerInterfaceGroupActivate
0x180013E50: McTemplateU0zqq
0x180001800: "__cdecl _report_gsfailure" __report_gsfailure
0x180016CD8: McTemplateU0zzpq
0x18000FD6C: PerflibciLocalEnumerateCounterSet
0x180024088: "__cdecl _DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_lsalookup_l1_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_lsalookup_l1_1_0_dll
0x18001F628: api-ms-win-core-apiquery-l1-1-0_NULL_THUNK_DATA
0x180028178: "unsigned long ComputerNameLength" ?ComputerNameLength@@3KA
0x18001FC98: "__cdecl _imp_NtOpenFile" __imp_NtOpenFile
0x18000D9BC: "unsigned char __cdecl CleanupV2Resources(unsigned char)" ?CleanupV2Resources@@YAEE@Z
0x18001F8C0: "__cdecl _imp_LeaveCriticalSection" __imp_LeaveCriticalSection
0x180018458: McTemplateU0zq
0x18000B8D0: "unsigned long __cdecl PerfpSendStateLessNotification(struct _GUID const * __ptr64,unsigned long,void * __ptr64,unsigned long,void * __ptr64 * __ptr64,unsigned long * __ptr64)" ?PerfpSendStateLessNotification@@YAKPEBU_GUID@@KPEAXKPEAPEAXPEAK@Z
0x18001F810: "__cdecl _imp_SearchPathW" __imp_SearchPathW
0x180027958: "__cdecl _native_startup_state" __native_startup_state
0x180022B50: "ntdll.dll" ??_C@_1BE@GJOFHIHD@?$AAn?$AAt?$AAd?$AAl?$AAl?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x18001F778: "__cdecl _imp_LoadResource" __imp_LoadResource
0x18000AB70: "struct _PERFLIBCI_RED_BLACK_NODE * __ptr64 __cdecl PerflibciFindOutputInstance(struct _PERFLIBCI_MULTI_INSTS * __ptr64,struct _PERF_INSTANCE_HEADER * __ptr64,struct _PERF_COUNTER_DATA * __ptr64,unsigned long,int)" ?PerflibciFindOutputInstance@@YAPEAU_PERFLIBCI_RED_BLACK_NODE@@PEAU_PERFLIBCI_MULTI_INSTS@@PEAU_PERF_INSTANCE_HEADER@@PEAU_PERF_COUNTER_DATA@@KH@Z
0x180024410: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-pcw-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-pcw-l1-1-0
0x180022140: PERFLIB_INVALID_SIZE_RETURNED
0x180021E50: "_Total" ??_C@_1O@NKAIMMPD@?$AA_?$AAT?$AAo?$AAt?$AAa?$AAl?$AA?$AA@
0x180020050: "__cdecl _sz_api_ms_win_security_sddl_l1_1_0_dll" __sz_api_ms_win_security_sddl_l1_1_0_dll
0x1800279A0: RemoteRegistryMappings
0x180024398: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-memory-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-memory-l1-1-0
0x18001FA40: "__cdecl _imp_NtWaitForMultipleObjects" __imp_NtWaitForMultipleObjects
0x18001FCF0: "__cdecl _imp_RtlAcquireResourceExclusive" __imp_RtlAcquireResourceExclusive
0x18000BBB8: PerflibciCloseLocalQueryHandle
0x18001D030: MachineStringKey
0x180028390: "struct _PERFLIBCI_RED_BLACK_NODE * __ptr64 __ptr64 g_ObjectList" ?g_ObjectList@@3PEAU_PERFLIBCI_RED_BLACK_NODE@@EA
0x18001F5A0: "__cdecl _imp_NdrClientCall3" __imp_NdrClientCall3
0x18001F7A8: "__cdecl _imp_MapViewOfFile" __imp_MapViewOfFile
0x1800225A8: "%ws\%ws" ??_C@_1BA@NPEHGALP@?$AA?$CF?$AAw?$AAs?$AA?2?$AA?$CF?$AAw?$AAs?$AA?$AA@
0x18001FB40: "__cdecl _imp_NtCreateKey" __imp_NtCreateKey
0x18001AEC0: "void __cdecl PerflibFreeMemory(struct _RTL_AVL_TABLE * __ptr64,void * __ptr64)" ?PerflibFreeMemory@@YAXPEAU_RTL_AVL_TABLE@@PEAX@Z
0x180010804: "unsigned long __cdecl GetQueryType(unsigned short * __ptr64)" ?GetQueryType@@YAKPEAG@Z
0x18001FDA0: "__cdecl _imp_RtlSetDaclSecurityDescriptor" __imp_RtlSetDaclSecurityDescriptor
0x180028378: "void * __ptr64 * `PerfpInstallationMutexHandles'::`2'::handles" ?handles@?1??PerfpInstallationMutexHandles@@9@4PAPEAXA
0x180028328: "unsigned long NumExtensibleObjects" ?NumExtensibleObjects@@3KA
0x1800242E4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0
0x180016E8C: McTemplateU0zzqp
0x18001F5D0: "__cdecl _imp_NdrServerCall2" __imp_NdrServerCall2
0x1800186F0: WPP_SF_sd
0x18001705C: WPP_SF_SD
0x180011AE0: WPP_SF_Sd
0x1800272E0: RemoteRegistryKey
0x180021F88: "ExplainResource" ??_C@_1CA@DHKAACNH@?$AAE?$AAx?$AAp?$AAl?$AAa?$AAi?$AAn?$AAR?$AAe?$AAs?$AAo?$AAu?$AAr?$AAc?$AAe?$AA?$AA@
0x18001FA00: "__cdecl _imp_free" __imp_free
0x180001620: "__cdecl IsNonwritableInCurrentImage" _IsNonwritableInCurrentImage
0x18001F900: api-ms-win-core-synch-l1-2-0_NULL_THUNK_DATA
0x1800185B0: WPP_SF_Sq
0x180013F90: WPP_SF_sS
0x18001F5A8: "__cdecl _imp_RpcBindingSetAuthInfoExW" __imp_RpcBindingSetAuthInfoExW
0x180022448: WPP_685eceeac0e43666e40e36eb5dc162e8_Traceguids
0x18001FBC8: "__cdecl _imp_EtwEventSetInformation" __imp_EtwEventSetInformation
0x18001FBA0: "__cdecl _imp_RtlDllShutdownInProgress" __imp_RtlDllShutdownInProgress
0x18001FCC0: "__cdecl _imp_RtlDosPathNameToRelativeNtPathName_U" __imp_RtlDosPathNameToRelativeNtPathName_U
0x18001AE6C: "void __cdecl PerflibDeleteV2ResourceTable(void)" ?PerflibDeleteV2ResourceTable@@YAXXZ
0x180022840: "\Classes" ??_C@_1BC@BMEICANI@?$AA?2?$AAC?$AAl?$AAa?$AAs?$AAs?$AAe?$AAs?$AA?$AA@
0x1800221B0: PERFLIB_PROC_NAME_NOT_FOUND
0x18001F8F0: api-ms-win-core-synch-l1-1-0_NULL_THUNK_DATA
0x1800242D0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0
0x1800279E0: g_hStatus
0x180011610: "long __cdecl PrivateRegQueryValueExT(struct HKEY__ * __ptr64,void * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64,unsigned char * __ptr64,unsigned long * __ptr64,int)" ?PrivateRegQueryValueExT@@YAJPEAUHKEY__@@PEAXPEAK2PEAE2H@Z
0x18000A638: WPP_SF_S
0x180011A60: McTemplateU0z
0x180001D18: memset
0x18002444C: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x180022100: PERFLIB_OPEN_PROC_NOT_FOUND
0x180018344: McTemplateU0szzq

[JEB Decompiler by PNF Software]