Generated by JEB on 2019/08/01

PE: C:\Windows\System32\offreg.dll Base=0x180000000 SHA-256=6273A03EE4AA325672712F42BDAE1F954FD859DD74008478FF061877B72BB8ED
PDB: offreg.pdb GUID={5E62A9A9-8488-23B7-3C25A6392C6025BA} Age=1

344 located named symbols:
0x1800124F0: "RtlValidRelativeSecurityDescript" ??_C@_0CD@KNMEALEK@RtlValidRelativeSecurityDescript@
0x18000DCCC: "__cdecl _raise_securityfailure" __raise_securityfailure
0x180012178: api-ms-win-core-file-l1-1-0_NULL_THUNK_DATA
0x18000DAE0: "__cdecl FindPESection" _FindPESection
0x180003C74: ORFreeDataAttachedToValue
0x1800071AC: ORWriteSecurityCells
0x18001346C: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x18000490C: ORAllocateCell
0x180014010: "__cdecl _security_cookie_complement" __security_cookie_complement
0x18000C790: CmpFindCellInIndex
0x180012340: "__cdecl _imp_wcsncpy_s" __imp_wcsncpy_s
0x18000D5BC: "__cdecl CRT_INIT" _CRT_INIT
0x1800121A8: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x1800121C0: "__cdecl _imp_TlsGetValue" __imp_TlsGetValue
0x18000CC8C: HvMoveLayoutStats
0x18000E060: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x180012148: "__cdecl _imp_CreateFileW" __imp_CreateFileW
0x1800111AC: CmpGenerateFastLeafHintForUnicodeString
0x180003AB0: ORPopulateEnumValueParams
0x180004390: ORSetKeySecurity
0x180012648: "SymbolicLinkValue" ??_C@_0BC@HGGDPMMC@SymbolicLinkValue?$AA@
0x180012660: cpuidBitInfo
0x18000F4F4: HvpApplyIncrementalLogFile
0x1800121D8: "__cdecl _imp_TlsAlloc" __imp_TlsAlloc
0x1800027B0: OREnumKey
0x180013444: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-1-0
0x18000FA20: HvpIsMetadataArrayCoherent
0x18000D448: SymCryptDetectCpuFeaturesByCpuid
0x1800123A8: "__cdecl _imp_RtlRunOnceBeginInitialize" __imp_RtlRunOnceBeginInitialize
0x1800122D8: "__cdecl _imp_GetAce" __imp_GetAce
0x180002DF0: ORRenameKey
0x180011120: CmpHashUnicodeComponent
0x180012408: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x18000CC7C: HvAddToLayoutStats
0x1800123C0: "__cdecl _imp_RtlInitializeSRWLock" __imp_RtlInitializeSRWLock
0x180012338: "__cdecl _imp__wcsnicmp" __imp__wcsnicmp
0x180011230: CmpValidateHiveSecurityDescriptors
0x1800125B0: "SymbolicLinkValue" ??_C@_1CE@CFOIKICP@?$AAS?$AAy?$AAm?$AAb?$AAo?$AAl?$AAi?$AAc?$AAL?$AAi?$AAn?$AAk?$AAV?$AAa?$AAl?$AAu?$AAe?$AA?$AA@
0x1800122A8: "__cdecl _imp_GetSecurityDescriptorControl" __imp_GetSecurityDescriptorControl
0x18000DAC4: "__cdecl XcptFilter" _XcptFilter
0x180012290: "__cdecl _imp_MakeSelfRelativeSD" __imp_MakeSelfRelativeSD
0x1800103D4: HvpBuildMapForMemoryBackedHive
0x180012410: "__cdecl _xc_a" __xc_a
0x1800123D0: "__cdecl _imp_RtlAcquireSRWLockExclusive" __imp_RtlAcquireSRWLockExclusive
0x18000FEB4: HvpGetCellMap
0x1800122B8: "__cdecl _imp_SetSecurityDescriptorOwner" __imp_SetSecurityDescriptorOwner
0x18000E032: memcpy
0x180012390: "__cdecl _imp_memset" __imp_memset
0x18000DC9F: "__cdecl initterm" _initterm
0x1800133CC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0
0x1800145C8: HvShutdownComplete
0x180014618: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x180012248: "__cdecl _imp_Sleep" __imp_Sleep
0x180012430: "__cdecl _xi_z" __xi_z
0x180012128: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x180009274: CmpCheckKey
0x180003B70: OREnumValue
0x18000DCAB: "__cdecl _C_specific_handler" __C_specific_handler
0x1800122F8: "__cdecl _imp_AddAccessAllowedAce" __imp_AddAccessAllowedAce
0x18000E03E: memmove
0x1800042B0: ORGetKeySecurity
0x1800123B0: "__cdecl _imp_RtlFindNextForwardRunClear" __imp_RtlFindNextForwardRunClear
0x180006F28: ORCloseFile
0x180012188: api-ms-win-core-handle-l1-1-0_NULL_THUNK_DATA
0x180012230: "__cdecl _imp_InitializeCriticalSectionAndSpinCount" __imp_InitializeCriticalSectionAndSpinCount
0x18000D2D4: SymCryptMarvin32
0x18000B460: ORCreateRootIndex
0x18000F75C: HvApplyLogFileToHiveImage
0x18000DFBC: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x180010C1C: CmpAddSecurityCellToCache
0x180005548: HiveNonTlsAllocate
0x1800022F0: ORDeleteKey
0x180003F34: ORGetValueData
0x180012608: ".LOG1" ??_C@_1M@FLNLKDAJ@?$AA?4?$AAL?$AAO?$AAG?$AA1?$AA?$AA@
0x1800083C8: ORFreeTree
0x180001050: ORCreateHive
0x1800125D8: FreeListBounds
0x1800123E0: "__cdecl _imp_RtlAllocateHeap" __imp_RtlAllocateHeap
0x18000F9AC: HvpIsLogEntryHeaderCoherent
0x18000544C: HvMarkDirty
0x18000CF00: HvCheckBin
0x18001341C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0
0x18000DAD0: "__cdecl amsg_exit" _amsg_exit
0x18000FF30: HvpGetCellPaged
0x1800034B4: ORSetValueInternal
0x180002B94: ORDereferenceTreeNode
0x1800123C8: "__cdecl _imp_RtlReleaseSRWLockExclusive" __imp_RtlReleaseSRWLockExclusive
0x180008578: HvpLogEntryCheckDataChecksum
0x180006DA4: ORWriteToTempFile
0x1800052EC: ORInitializeBitMap
0x180002C80: ORGetVirtualFlags
0x180012530: SupportedVersions
0x1800100EC: HvpDelistFreeCell
0x1800024F0: ORQueryInfoKey
0x180001380: OROpenHive
0x180014630: g_SymCryptCpuid1
0x180010F50: CmpDestroySecurityCache
0x1800121E0: "__cdecl _imp_TlsSetValue" __imp_TlsSetValue
0x1800122B0: "__cdecl _imp_GetSidLengthRequired" __imp_GetSidLengthRequired
0x180012228: "__cdecl _imp_EnterCriticalSection" __imp_EnterCriticalSection
0x18000F6D0: HvpApplyLogEntryToHiveImage
0x1800145C0: HiveInitialize
0x180012270: "__cdecl _imp_GetSecurityDescriptorLength" __imp_GetSecurityDescriptorLength
0x180012140: api-ms-win-core-errorhandling-l1-1-0_NULL_THUNK_DATA
0x18000508C: ORCompareStrings
0x1800121C8: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x18000544C: HvMarkCellDirty
0x180012280: "__cdecl _imp_InitializeSid" __imp_InitializeSid
0x180014608: "__cdecl _native_startup_lock" __native_startup_lock
0x1800123D8: "__cdecl _imp_RtlUpcaseUnicodeChar" __imp_RtlUpcaseUnicodeChar
0x180001008: DllMain
0x18000FFEC: HvpEnlistFreeCell
0x180005FD0: HiveRecoverReadRoutine
0x180012370: "__cdecl _imp__wcsicmp" __imp__wcsicmp
0x180012348: "__cdecl _imp_wcscat_s" __imp_wcscat_s
0x1800122D0: "__cdecl _imp_IsValidSid" __imp_IsValidSid
0x180012328: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x180012210: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x1800121A0: api-ms-win-core-libraryloader-l1-2-0_NULL_THUNK_DATA
0x1800089EC: CmpCheckRegistry2
0x18000FFE0: HvpReleaseCellPaged
0x1800145F4: g_SymCryptCpuFeaturesPresentCheck
0x18000544C: CmpClaimGlobalQuota
0x18000CBA4: CmpCompareTwoCompressedNames
0x18000C880: CmpRemoveSubKeyCellNoCellRef
0x180012138: "__cdecl _imp_GetLastError" __imp_GetLastError
0x1800145D0: CmpMasterHive
0x180014038: g_SymCryptCpuFeaturesNotPresent
0x180002D20: ORSetVirtualFlags
0x18000CCA8: HvCheckHive
0x180014000: "__cdecl _native_dllmain_reason" __native_dllmain_reason
0x18000DF98: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x180005398: ORSetBits
0x18000FCAC: HvHiveStartMemoryBacked
0x180012388: "__cdecl _imp_memcmp" __imp_memcmp
0x18000B730: ORComputeHashKey
0x180012298: "__cdecl _imp_CreatePrivateObjectSecurityWithMultipleInheritance" __imp_CreatePrivateObjectSecurityWithMultipleInheritance
0x1800121B0: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x180008518: HvpLogEntryCheckHeaderChecksum
0x180002AA8: ORRemoveSubKey
0x1800108FC: HvpEnlistFreeCells
0x18000DB90: "__cdecl ValidateImageBase" _ValidateImageBase
0x180012170: "__cdecl _imp_GetFinalPathNameByHandleW" __imp_GetFinalPathNameByHandleW
0x1800057B8: ValidateHiveAndRecoverFromLog
0x1800123F0: "__cdecl _imp_RtlFreeHeap" __imp_RtlFreeHeap
0x180012150: "__cdecl _imp_FlushFileBuffers" __imp_FlushFileBuffers
0x180013430: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0
0x18000B7B4: RtlRbInsertNodeEx
0x1800122C0: "__cdecl _imp_GetSidSubAuthority" __imp_GetSidSubAuthority
0x1800039AC: OREnumerateValue_GetNode
0x18000D800: "__cdecl DllMainCRTStartup" _DllMainCRTStartup
0x180012310: "__cdecl _imp__initterm" __imp__initterm
0x1800079EC: ORInsertTreeNodeIntoSubkeyList
0x1800085CC: SetFailureLocation
0x1800015B4: ORSaveHiveInternal
0x18000FF10: HvpGetCellContextInitialize
0x180005460: HiveTlsAllocate
0x180010C04: HvpMapEntryGetFreeBin
0x180006ED0: ORCreateFile
0x180014028: CmKeyMapping
0x180012278: "__cdecl _imp_IsValidSecurityDescriptor" __imp_IsValidSecurityDescriptor
0x180004D74: ORIsKeyNodeValid
0x1800123A0: "__cdecl _imp_RtlRunOnceComplete" __imp_RtlRunOnceComplete
0x1800054F0: HiveTlsFree
0x180012518: "ROOT" ??_C@_19OLEIDBPB@?$AAR?$AAO?$AAO?$AAT?$AA?$AA@
0x180008664: HvpHeaderCheckSum
0x1800122A0: "__cdecl _imp_InitializeSecurityDescriptor" __imp_InitializeSecurityDescriptor
0x180001480: ORCloseHive
0x1800145F8: "__cdecl _onexitend" __onexitend
0x180005440: HvpAdjustHiveFreeDisplay
0x180012400: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x180001BB0: ORCreateKey
0x1800121D0: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x1800123E8: "__cdecl _imp_RtlNtStatusToDosError" __imp_RtlNtStatusToDosError
0x180010294: HvGetCellSize
0x180005FFC: ORStoreNameHintIndex
0x1800122E8: "__cdecl _imp_SetPrivateObjectSecurityEx" __imp_SetPrivateObjectSecurityEx
0x180012268: api-ms-win-core-sysinfo-l1-1-0_NULL_THUNK_DATA
0x180012420: "__cdecl _xi_a" __xi_a
0x180012260: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x180012308: api-ms-win-security-base-l1-1-0_NULL_THUNK_DATA
0x18000BC2C: RtlRbRemoveNode
0x1800123B8: "__cdecl _imp_RtlNumberOfSetBits" __imp_RtlNumberOfSetBits
0x180011048: CmpCheckAndFixSecurityCellsRefcount
0x1800124D0: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x1800133B8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0
0x1800060A8: ORSerializeHive
0x18000DE88: "__cdecl _report_rangecheckfailure" __report_rangecheckfailure
0x180014620: "__cdecl pRawDllMain" _pRawDllMain
0x180012618: ".LOG2" ??_C@_1M@EJGOAMOH@?$AA?4?$AAL?$AAO?$AAG?$AA2?$AA?$AA@
0x18000CAC8: CmpCompareCompressedName
0x180010BF4: HvpMapEntryGetBinAddress
0x180004DD4: ORCopyOutStringLikeAdvapi
0x180012238: "__cdecl _imp_DeleteCriticalSection" __imp_DeleteCriticalSection
0x18000DAA0: "__cdecl _security_check_cookie" __security_check_cookie
0x180012418: "__cdecl _xc_z" __xc_z
0x1800121E8: api-ms-win-core-processthreads-l1-1-0_NULL_THUNK_DATA
0x1800111F8: CmpGenerateFastLeafHintForCompressedString
0x180012198: "__cdecl _imp_GetProcAddress" __imp_GetProcAddress
0x18000FAC4: HvpGenerateLogMetadata
0x18000F7D0: HvpApplyLegacyLogFile
0x1800045E0: ORGetVersion
0x180012258: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x18000C5DC: CmpFindSubKeyByNumber
0x180001394: ORCloseHiveInternal
0x180012360: "__cdecl _imp__aligned_free" __imp__aligned_free
0x1800014B8: ORValidateSaveHiveParameters
0x18000E080: "__cdecl _chkstk" __chkstk
0x180012218: api-ms-win-core-rtlsupport-l1-1-0_NULL_THUNK_DATA
0x1800031AC: ORFreeNode
0x1800045F0: ORStart
0x180014644: BinLength
0x1800133E0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0
0x1800072FC: ORGetRelativeSecurityDescriptor
0x1800121F8: api-ms-win-core-profile-l1-1-0_NULL_THUNK_DATA
0x180012438: "__cdecl _guard_fids_table" __guard_fids_table
0x180012398: msvcrt_NULL_THUNK_DATA
0x180012020: "__cdecl load_config_used" _load_config_used
0x18000786C: ORProcessSecurityDescriptor
0x180012350: "__cdecl _imp_wcsnlen" __imp_wcsnlen
0x180007AE4: ORGetSiblingSubkey
0x1800122C8: "__cdecl _imp_DestroyPrivateObjectSecurity" __imp_DestroyPrivateObjectSecurity
0x180012378: "__cdecl _imp__amsg_exit" __imp__amsg_exit
0x180005D14: ConstructLogPaths
0x18000FBC0: HvHiveInitialize
0x180012200: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x1800121F0: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x180002704: ORPopulateEnumKeyParams
0x180002BF0: ORCloseKey
0x18000C7E0: CmpRemoveCellFromIndex
0x1800028D8: ORParseSubKey
0x180012288: "__cdecl _imp_SetSecurityDescriptorGroup" __imp_SetSecurityDescriptorGroup
0x180012208: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x180012160: "__cdecl _imp_GetFileSizeEx" __imp_GetFileSizeEx
0x18000C5B4: CmSiRWLockAcquireExclusive
0x18000DCC0: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x18000E026: memcmp
0x180004E98: ORCompareUnicodeString
0x180006F68: ORCreateSecurityDescriptorsList
0x180013458: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0
0x180001370: OROpenHiveByHandle
0x180012190: "__cdecl _imp_GetModuleHandleW" __imp_GetModuleHandleW
0x180007124: ORFreeSecurityCellList
0x180001060: ORCreateHiveEx
0x180012330: "__cdecl _imp__XcptFilter" __imp__XcptFilter
0x1800032B0: ORGetValue
0x1800123F8: ntdll_NULL_THUNK_DATA
0x180012380: "__cdecl _imp_memcpy" __imp_memcpy
0x180005564: HiveNonTlsFree
0x18000C5A0: CmSiRWLockInitialize
0x180003D40: ORDeleteValue
0x180013408: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0
0x1800102A4: HvFreeCell
0x180010148: HvIsCellAllocated
0x180014008: "__cdecl _security_cookie" __security_cookie
0x18000C690: CmpDoFindSubKeyByNumber
0x180012358: "__cdecl _imp__aligned_malloc" __imp__aligned_malloc
0x18000E080: "__cdecl alloca_probe" _alloca_probe
0x180001778: ORCreateNewHiveInternal
0x180003E64: ORFindValue
0x180012180: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x180004678: ORFreeOrNop
0x180001660: ORSaveHive
0x1800122F0: "__cdecl _imp_GetLengthSid" __imp_GetLengthSid
0x1800133F4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0
0x180010E48: CmpFindSecurityCellCacheIndex
0x180007B34: ORCreateTree
0x180008FF4: CmpCheckLeaf
0x180014600: "__cdecl _onexitbegin" __onexitbegin
0x18000FC44: HvIsInPlaceBaseBlockValid
0x18000A2CC: CmpCheckValueList
0x1800046B8: ORCreateHiveHandle
0x180006CFC: ORFreeBinMap
0x180004C68: ORValidateBinHeader
0x180012130: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x18000B2D4: CmpCheckLexicographicalOrder
0x18000167C: ORSaveHiveEx
0x180005584: ValidateHive
0x180001A70: OROpenKey
0x18000DBC4: "__cdecl _security_init_cookie" __security_init_cookie
0x1800145E0: HvSymcryptSeed
0x180012300: "__cdecl _imp_SetSecurityDescriptorDacl" __imp_SetSecurityDescriptorDacl
0x180010B64: HvpAllocateMap
0x180003990: ORSetValue
0x18001337C: "__cdecl _IMPORT_DESCRIPTOR_msvcrt" __IMPORT_DESCRIPTOR_msvcrt
0x18000F008: HvAnalyzeLogFiles
0x180008690: CmCheckRegistry
0x180012368: "__cdecl _imp_memmove" __imp_memmove
0x18000B680: ORCreateFastIndex
0x180012318: "__cdecl _imp_malloc" __imp_malloc
0x180012158: "__cdecl _imp_WriteFile" __imp_WriteFile
0x1800051F8: ORMakeSDRelative
0x18000DD10: "__cdecl _report_gsfailure" __report_gsfailure
0x180012220: "__cdecl _imp_LeaveCriticalSection" __imp_LeaveCriticalSection
0x180004CC0: ORCompressCopyName
0x180001104: OROpenHiveInternal
0x1800048CC: ORConvertAbsoluteToOffset
0x180010AFC: HvpFreeMap
0x180014610: "__cdecl _native_startup_state" __native_startup_state
0x1800124D8: "ntdll.dll" ??_C@_1BE@GJOFHIHD@?$AAn?$AAt?$AAd?$AAl?$AAl?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x180004F94: ORCompareCompressedString
0x180004B40: ORAddBin
0x180014640: BinCount
0x18000489C: ORConvertOffsetToAbsolute
0x180011000: CmpIncrementCachedSecurityRefcount
0x1800052FC: ORClearBits
0x180003108: ORAllocNode
0x1800122E0: "__cdecl _imp_InitializeAcl" __imp_InitializeAcl
0x1800133A4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0
0x180002E4C: ORRenameKeyEx
0x18000C5C8: CmSiRWLockReleaseExclusive
0x180012320: "__cdecl _imp_free" __imp_free
0x18000DB30: "__cdecl IsNonwritableInCurrentImage" _IsNonwritableInCurrentImage
0x180012250: api-ms-win-core-synch-l1-2-0_NULL_THUNK_DATA
0x1800121B8: "__cdecl _imp_TlsFree" __imp_TlsFree
0x180010698: HvpInitMap
0x180014020: TlsIndex
0x180012240: api-ms-win-core-synch-l1-1-0_NULL_THUNK_DATA
0x180013390: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0
0x1800145F0: g_SymCryptFlags
0x18000E04A: memset
0x180013480: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x180014648: ORValidRelativeSecurityDescriptor
0x180004034: ORUpdateValue
0x180012168: "__cdecl _imp_ReadFile" __imp_ReadFile

[JEB Decompiler by PNF Software]