Generated by JEB on 2019/08/01

PE: C:\Windows\WinSxS\amd64_microsoft-onecore-unifiedwritefilter_31bf3856ad364e35_10.0.17763.557_none_9e103f00e90ccfe5\uwfs.sys Base=0x1C0000000 SHA-256=64C6DFD340ACDA8BF928F14B0109D72FFA21BCDE8F72D6BFDE4FA8EE1182F534
PDB: uwfs.pdb GUID={A05BAD6C-7F61-F5CC-BE18EB75318CBD10} Age=1

235 located named symbols:
0x1C000C334: UwfsCopyFileEa
0x1C00044E8: WdfDriverGlobals
0x1C0006128: "__cdecl _imp_FltGetFileContext" __imp_FltGetFileContext
0x1C00060B8: "__cdecl _imp_FltAllocateExtraCreateParameter" __imp_FltAllocateExtraCreateParameter
0x1C0003328: "\Device\HardDiskVolume" ??_C@_1CO@BNKHGLHD@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAH?$AAa?$AAr?$AAd?$AAD?$AAi?$AAs?$AAk?$AAV?$AAo?$AAl?$AAu?$AAm?$AAe?$AA?$AA@
0x1C00060E0: "__cdecl _imp_FltSetCallbackDataDirty" __imp_FltSetCallbackDataDirty
0x1C0006170: "__cdecl _imp_ZwWriteFile" __imp_ZwWriteFile
0x1C00061B0: "__cdecl _imp_ZwSetInformationThread" __imp_ZwSetInformationThread
0x1C00061F8: "__cdecl _imp_SeCaptureSubjectContext" __imp_SeCaptureSubjectContext
0x1C0006260: "__cdecl _imp_ExAcquireFastMutex" __imp_ExAcquireFastMutex
0x1C000101C: "long __cdecl UwfsQueryAndSendVolumeBitmap(struct _FLT_RELATED_OBJECTS const * __ptr64)" ?UwfsQueryAndSendVolumeBitmap@@YAJPEBU_FLT_RELATED_OBJECTS@@@Z
0x1C0001B50: UwfsPostCreateCallback
0x1C000B9F8: UwfsOpenFileCommitFiles
0x1C00060F0: "__cdecl _imp_FltGetFileNameInformation" __imp_FltGetFileNameInformation
0x1C00041F8: "__cdecl _security_cookie_complement" __security_cookie_complement
0x1C00062B8: "__cdecl _imp_ObfDereferenceObject" __imp_ObfDereferenceObject
0x1C0006150: "__cdecl _imp_WdfVersionUnbindClass" __imp_WdfVersionUnbindClass
0x1C0006178: "__cdecl _imp_ZwReadFile" __imp_ZwReadFile
0x1C000CE38: UwfsCopyDataStreamByHandle
0x1C0004240: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUfduUfduhUlyquivUznwGEUkivxlnkOlyq@uwfs" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUfduUfduhUlyquivUznwGEUkivxlnkOlyq@uwfs
0x1C0006270: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x1C0002EC0: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x1C0006040: "__cdecl _imp_FltCancellableWaitForSingleObject" __imp_FltCancellableWaitForSingleObject
0x1C0004110: "struct _FLT_CONTEXT_REGISTRATION * ContextRegistration" ?ContextRegistration@@3PAU_FLT_CONTEXT_REGISTRATION@@A
0x1C0006100: "__cdecl _imp_FltGetFileNameInformationUnsafe" __imp_FltGetFileNameInformationUnsafe
0x1C00063AC: "__cdecl _IMPORT_DESCRIPTOR_uwfrtl" __IMPORT_DESCRIPTOR_uwfrtl
0x1C000AEB4: UwfsCreateFileContext
0x1C00062D0: "__cdecl _imp_PsTerminateSystemThread" __imp_PsTerminateSystemThread
0x1C000D090: UwfsGetRemainingOverlaySize
0x1C0002024: UwfsGetFileNameInfo
0x1C0004230: "void * __ptr64 __ptr64 __KMDF_TYPE_INIT_END" ?__KMDF_TYPE_INIT_END@@3PEAXEA
0x1C0001A68: UwfsGetVolumeName
0x1C00060C8: "__cdecl _imp_FltAllocateContext" __imp_FltAllocateContext
0x1C000D390: UwfsDeferredRunThunk
0x1C0001798: UwfsGetPersistentVolumeName
0x1C000C050: UwfsCopyFileMetadataByName
0x1C000214C: UwfsCreateFilePath
0x1C00018CC: UwfsGetUwfVolumeInfo
0x1C0006390: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x1C0006110: "__cdecl _imp_FltCreateFileEx2" __imp_FltCreateFileEx2
0x1C00063D4: "__cdecl _IMPORT_DESCRIPTOR_WDFLDR" __IMPORT_DESCRIPTOR_WDFLDR
0x1C0006330: "__cdecl _imp_UwflogCompleteEntry_UWFLOG_LEVEL_WARNING" __imp_UwflogCompleteEntry_UWFLOG_LEVEL_WARNING
0x1C0006288: "__cdecl _imp_KeInitializeMutex" __imp_KeInitializeMutex
0x1C0006368: "__cdecl _imp_UwflogNewEntry_UWFLOG_LEVEL_LOW_RESOURCES" __imp_UwflogNewEntry_UWFLOG_LEVEL_LOW_RESOURCES
0x1C0006230: "__cdecl _imp_KeWaitForSingleObject" __imp_KeWaitForSingleObject
0x1C00062C0: "__cdecl _imp_RtlAppendUnicodeStringToString" __imp_RtlAppendUnicodeStringToString
0x1C000B5D0: UwfsFileCommit
0x1C0006080: "__cdecl _imp_FltFreeExtraCreateParameter" __imp_FltFreeExtraCreateParameter
0x1C0003108: "__cdecl _guard_iat_table" __guard_iat_table
0x1C000D238: UwfsDoDeferred
0x1C00041B8: WdfBindInfo
0x1C0004000: "struct _FLT_REGISTRATION Registration" ?Registration@@3U_FLT_REGISTRATION@@A
0x1C0001464: UwfsUpdateHiveProtectionStatus
0x1C0004070: "struct _FLT_OPERATION_REGISTRATION * OperationRegistration" ?OperationRegistration@@3PAU_FLT_OPERATION_REGISTRATION@@A
0x1C0006248: "__cdecl _imp_RtlNextUnicodePrefix" __imp_RtlNextUnicodePrefix
0x1C0006348: "__cdecl _imp_UwflogNewEntry_UWFLOG_LEVEL_ERROR" __imp_UwflogNewEntry_UWFLOG_LEVEL_ERROR
0x1C0006268: "__cdecl _imp_RtlCopyUnicodeString" __imp_RtlCopyUnicodeString
0x1C0003368: UWFS_EXTRA_CREATE_PARAMETER_GUID
0x1C0001008: "bool __cdecl UwfsIsFreespacePassthroughEnabled(void)" ?UwfsIsFreespacePassthroughEnabled@@YA_NXZ
0x1C0002E4C: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x1C0006130: "__cdecl _imp_FltCreateFileEx" __imp_FltCreateFileEx
0x1C0006028: "__cdecl _imp_FltRegisterFilter" __imp_FltRegisterFilter
0x1C0006078: "__cdecl _imp_FltReleaseFileNameInformation" __imp_FltReleaseFileNameInformation
0x1C000C4FC: UwfsCopyFileAltDataStreams
0x1C00060E8: "__cdecl _imp_FltSetFileContext" __imp_FltSetFileContext
0x1C000A970: UwfsNormalizeNameComponentEx
0x1C00060C0: "__cdecl _imp_FltClose" __imp_FltClose
0x1C00032E0: "\Device\HarddiskPersistentVolume" ??_C@_1EG@BAOMHPFH@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAH?$AAa?$AAr?$AAd?$AAd?$AAi?$AAs?$AAk?$AAP?$AAe?$AAr?$AAs?$AAi?$AAs?$AAt?$AAe?$AAn?$AAt?$AAV?$AAo?$AAl?$AAu?$AAm?$AAe@
0x1C00031B0: "\Windows\system32\config\SOFTWAR" ??_C@_1EE@IIPFCLDA@?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?2?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAc?$AAo?$AAn?$AAf?$AAi?$AAg?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR@
0x1C0006038: "__cdecl _imp_FltGetVolumeName" __imp_FltGetVolumeName
0x1C0003378: "KmdfLibrary" ??_C@_1BI@BJCKEEDJ@?$AAK?$AAm?$AAd?$AAf?$AAL?$AAi?$AAb?$AAr?$AAa?$AAr?$AAy?$AA?$AA@
0x1C0006258: "__cdecl _imp_RtlInsertUnicodePrefix" __imp_RtlInsertUnicodePrefix
0x1C00061E8: "__cdecl _imp_SeTokenIsAdmin" __imp_SeTokenIsAdmin
0x1C0006328: "__cdecl _imp_UwflogNewEntry_UWFLOG_LEVEL_WARNING" __imp_UwflogNewEntry_UWFLOG_LEVEL_WARNING
0x1C0001FB0: UwfsPostCleanupCallback
0x1C0006250: "__cdecl _imp_ExReleaseFastMutex" __imp_ExReleaseFastMutex
0x1C0006160: WDFLDR_NULL_THUNK_DATA
0x1C0006298: "__cdecl _imp_ZwQueryInformationFile" __imp_ZwQueryInformationFile
0x1C000A590: UwfsPreNetworkQueryOpenCallback
0x1C00060A0: "__cdecl _imp_FltFreeExtraCreateParameterList" __imp_FltFreeExtraCreateParameterList
0x1C000CC8C: UwfsCopyDataStreamByName
0x1C0006190: "__cdecl _imp_ZwQueryEaFile" __imp_ZwQueryEaFile
0x1C0004200: "struct _MARKER_TYPE __KMDF_CLASS_BIND_START" ?__KMDF_CLASS_BIND_START@@3U_MARKER_TYPE@@A
0x1C00061C0: "__cdecl _imp_ExAllocatePoolWithTag" __imp_ExAllocatePoolWithTag
0x1C00061A8: "__cdecl _imp_NtAdjustPrivilegesToken" __imp_NtAdjustPrivilegesToken
0x1C000B160: UwfsIsFileExists
0x1C000AD50: UwfsPreCleanupCallback
0x1C00042A8: "struct _UWFRTL_UWF_CONFIG * __ptr64 __ptr64 UwfsGlobalConfigPtr" ?UwfsGlobalConfigPtr@@3PEAU_UWFRTL_UWF_CONFIG@@EA
0x1C0002BD4: FxDriverEntryWorker
0x1C0008E88: UwfsPopulatePrefixTable
0x1C0006360: "__cdecl _imp_UwflogCompleteEntry_UWFLOG_LEVEL_LOW_RESOURCES" __imp_UwflogCompleteEntry_UWFLOG_LEVEL_LOW_RESOURCES
0x1C0006000: "__cdecl _imp_FltFsControlFile" __imp_FltFsControlFile
0x1C0006188: "__cdecl _imp_ZwSetEaFile" __imp_ZwSetEaFile
0x1C00061D8: "__cdecl _imp_ZwOpenThreadTokenEx" __imp_ZwOpenThreadTokenEx
0x1C0006138: FLTMGR_NULL_THUNK_DATA
0x1C000B7B0: UwfsFileCommitDelete
0x1C0006070: "__cdecl _imp_FltCancelFileOpen" __imp_FltCancelFileOpen
0x1C00042C0: DontLoad
0x1C0003150: "\swapfile.sys" ??_C@_1BM@CACHKFIK@?$AA?2?$AAs?$AAw?$AAa?$AAp?$AAf?$AAi?$AAl?$AAe?$AA?4?$AAs?$AAy?$AAs?$AA?$AA@
0x1C0002E28: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x1C0009ED0: UwfsPreCreateCallback
0x1C0003248: "\Windows\system32\config\SAM" ??_C@_1DK@EOMEGNJG@?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?2?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAc?$AAo?$AAn?$AAf?$AAi?$AAg?$AA?2?$AAS?$AAA?$AAM?$AA?$AA@
0x1C0006098: "__cdecl _imp_FltAllocateExtraCreateParameterList" __imp_FltAllocateExtraCreateParameterList
0x1C0003358: "::$DATA" ??_C@_1BA@LCOICFNN@?$AA?3?$AA?3?$AA$?$AAD?$AAA?$AAT?$AAA?$AA?$AA@
0x1C0006240: "__cdecl _imp_RtlRemoveUnicodePrefix" __imp_RtlRemoveUnicodePrefix
0x1C00062E8: "__cdecl _imp_?UwfrtlIsProtectedVolume@@YAJPEAU_DEVICE_OBJECT@@PEAEPEAKPEAU_GUID@@@Z" __imp_?UwfrtlIsProtectedVolume@@YAJPEAU_DEVICE_OBJECT@@PEAEPEAKPEAU_GUID@@@Z
0x1C0006168: "__cdecl _imp_PsCreateSystemThread" __imp_PsCreateSystemThread
0x1C0001398: UwfsTrackSpecialVolumes
0x1C0006030: "__cdecl _imp_FltGetDiskDeviceObject" __imp_FltGetDiskDeviceObject
0x1C0006378: "__cdecl _imp_UwflogCompleteEntry_UWFLOG_LEVEL_ASSERTION" __imp_UwflogCompleteEntry_UWFLOG_LEVEL_ASSERTION
0x1C000CBBC: UwfsCopyFileTimeStamps
0x1C0002D0C: "long __cdecl FxStubBindClasses(struct _WDF_BIND_INFO * __ptr64)" ?FxStubBindClasses@@YAJPEAU_WDF_BIND_INFO@@@Z
0x1C00062F8: "__cdecl _imp_?UwfrtlIssueStateNotification@@YAXPEBUUWFRTL_STATE_NOTIFICATION@@@Z" __imp_?UwfrtlIssueStateNotification@@YAXPEBUUWFRTL_STATE_NOTIFICATION@@@Z
0x1C0006050: "__cdecl _imp_FltReleaseContext" __imp_FltReleaseContext
0x1C0006380: uwfrtl_NULL_THUNK_DATA
0x1C00022A0: UwfsIsAdminUser
0x1C0006140: "__cdecl _imp_WdfVersionUnbind" __imp_WdfVersionUnbind
0x1C000A7D0: UwfsGenerateFileName
0x1C0006228: "__cdecl _imp_KeReleaseMutex" __imp_KeReleaseMutex
0x1C00060D8: "__cdecl _imp_FltAdjustDeviceStackSizeForIoRedirection" __imp_FltAdjustDeviceStackSizeForIoRedirection
0x1C0006388: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x1C0006148: "__cdecl _imp_WdfVersionBind" __imp_WdfVersionBind
0x1C0006350: "__cdecl _imp_UwflogCompleteEntry_UWFLOG_LEVEL_CRITICAL" __imp_UwflogCompleteEntry_UWFLOG_LEVEL_CRITICAL
0x1C000AB90: UwfsDeleteFileWorkItemRoutine
0x1C00062E0: "__cdecl _imp_?UwfrtlIsReadOnlyMediaMode@@YA_NXZ" __imp_?UwfrtlIsReadOnlyMediaMode@@YA_NXZ
0x1C0006118: "__cdecl _imp_FltQueryDirectoryFile" __imp_FltQueryDirectoryFile
0x1C000230C: UwfsAdjustPrivilegesForCommit
0x1C0006300: "__cdecl _imp_UwflogCompleteEntry_UWFLOG_LEVEL_INFORMATION" __imp_UwflogCompleteEntry_UWFLOG_LEVEL_INFORMATION
0x1C00061B8: "__cdecl _imp_ZwDuplicateToken" __imp_ZwDuplicateToken
0x1C0006090: "__cdecl _imp_FltInsertExtraCreateParameter" __imp_FltInsertExtraCreateParameter
0x1C0006020: "__cdecl _imp_FltStartFiltering" __imp_FltStartFiltering
0x1C0006068: "__cdecl _imp_FltAllocateGenericWorkItem" __imp_FltAllocateGenericWorkItem
0x1C0006180: "__cdecl _imp_RtlCompareUnicodeString" __imp_RtlCompareUnicodeString
0x1C0002DD0: "__cdecl _security_check_cookie" __security_check_cookie
0x1C0006338: "__cdecl _imp_UwflogNewEntry_UWFLOG_LEVEL_ASSERTION" __imp_UwflogNewEntry_UWFLOG_LEVEL_ASSERTION
0x1C000994C: UwfsHandleNewPersistentVolume
0x1C0006278: "__cdecl _imp_RtlInitializeUnicodePrefix" __imp_RtlInitializeUnicodePrefix
0x1C00063C0: "__cdecl _IMPORT_DESCRIPTOR_FLTMGR" __IMPORT_DESCRIPTOR_FLTMGR
0x1C0006398: "__cdecl _IMPORT_DESCRIPTOR_ntoskrnl" __IMPORT_DESCRIPTOR_ntoskrnl
0x1C00095D0: UwfsHandleNewProtectedVolume
0x1C0006208: "__cdecl _imp_IoReplaceFileObjectName" __imp_IoReplaceFileObjectName
0x1C0006318: "__cdecl _imp_?UwfrtlInitialize@@YAJXZ" __imp_?UwfrtlInitialize@@YAJXZ
0x1C00061C8: "__cdecl _imp_ZwQuerySecurityObject" __imp_ZwQuerySecurityObject
0x1C0006370: "__cdecl _imp_?UwfrtlSendIoctlSynchronously@@YAJPEAU_DEVICE_OBJECT@@KPEAXK1KPEA_K_N@Z" __imp_?UwfrtlSendIoctlSynchronously@@YAJPEAU_DEVICE_OBJECT@@KPEAXK1KPEA_K_N@Z
0x1C0006008: "__cdecl _imp_FltOpenVolume" __imp_FltOpenVolume
0x1C0006290: "__cdecl _imp_ZwFsControlFile" __imp_ZwFsControlFile
0x1C0006210: "__cdecl _imp_RtlCompareUnicodeStrings" __imp_RtlCompareUnicodeStrings
0x1C000B100: UwfsFileContextCleanupCallback
0x1C0006010: "__cdecl _imp_FltGetVolumeContext" __imp_FltGetVolumeContext
0x1C0006060: "__cdecl _imp_FltReferenceContext" __imp_FltReferenceContext
0x1C000C938: UwfsCopyFileSecurityInfo
0x1C000F000: "__cdecl _guard_fids_table" __guard_fids_table
0x1C0006198: "__cdecl _imp_ZwSetSecurityObject" __imp_ZwSetSecurityObject
0x1C0003000: "__cdecl load_config_used" _load_config_used
0x1C0002B60: FxStubDriverUnload
0x1C00060A8: "__cdecl _imp_FltFindExtraCreateParameter" __imp_FltFindExtraCreateParameter
0x1C00061D0: "__cdecl _imp_ZwOpenProcessTokenEx" __imp_ZwOpenProcessTokenEx
0x1C00062A8: "__cdecl _imp_ZwClose" __imp_ZwClose
0x1C0003290: "\Windows\system32\config\SECURIT" ??_C@_1EE@JKBKGINF@?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?2?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAc?$AAo?$AAn?$AAf?$AAi?$AAg?$AA?2?$AAS?$AAE?$AAC?$AAU?$AAR?$AAI?$AAT@
0x1C0004210: "void * __ptr64 __ptr64 __KMDF_CLASS_BIND_END" ?__KMDF_CLASS_BIND_END@@3PEAXEA
0x1C0006308: "__cdecl _imp_UwflogNewEntry_UWFLOG_LEVEL_INFORMATION" __imp_UwflogNewEntry_UWFLOG_LEVEL_INFORMATION
0x1C00061F0: "__cdecl _imp_SeLockSubjectContext" __imp_SeLockSubjectContext
0x1C0006280: "__cdecl _imp_KeInitializeEvent" __imp_KeInitializeEvent
0x1C0003110: "\UWFSWAP.SYS" ??_C@_1BK@JEMIGBLE@?$AA?2?$AAU?$AAW?$AAF?$AAS?$AAW?$AAA?$AAP?$AA?4?$AAS?$AAY?$AAS?$AA?$AA@
0x1C0006310: "__cdecl _imp_?UwfrtlGetGlobalConfigPtr@@YAJPEAPEAU_UWFRTL_UWF_CONFIG@@@Z" __imp_?UwfrtlGetGlobalConfigPtr@@YAJPEAPEAU_UWFRTL_UWF_CONFIG@@@Z
0x1C0006048: "__cdecl _imp_FltFreeGenericWorkItem" __imp_FltFreeGenericWorkItem
0x1C0002E10: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x1C000B294: UwfsOpenFile
0x1C0009D00: UwfsGetNewVolumeInfo
0x1C0006340: "__cdecl _imp_UwflogCompleteEntry_UWFLOG_LEVEL_ERROR" __imp_UwflogCompleteEntry_UWFLOG_LEVEL_ERROR
0x1C0002AAC: "void __cdecl FxStubDriverUnloadCommon(void)" ?FxStubDriverUnloadCommon@@YAXXZ
0x1C00062A0: "__cdecl _imp_IoCreateFile" __imp_IoCreateFile
0x1C000B3C4: UwfsCreateFilePathWithReference
0x1C00062F0: "__cdecl _imp_?UwfrtlQueryBcdHiveFileLocation@@YAJPEAPEBG@Z" __imp_?UwfrtlQueryBcdHiveFileLocation@@YAJPEAPEBG@Z
0x1C00092C4: UwfsFreeGlobals
0x1C0003170: "\Windows\system32\config\SYSTEM" ??_C@_1EA@PNECFDGD@?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?2?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAc?$AAo?$AAn?$AAf?$AAi?$AAg?$AA?2?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?$AA@
0x1C0004220: "struct _MARKER_TYPE __KMDF_TYPE_INIT_START" ?__KMDF_TYPE_INIT_START@@3U_MARKER_TYPE@@A
0x1C0006108: "__cdecl _imp_FltCheckAndGrowNameControl" __imp_FltCheckAndGrowNameControl
0x1C000C224: UwfsCopyFileMetadataByHandle
0x1C0001E3C: UwfsGetPersistentFileName
0x1C0002BA0: FxDriverEntry
0x1C0006220: "__cdecl _imp_RtlFindUnicodePrefix" __imp_RtlFindUnicodePrefix
0x1C00061E0: "__cdecl _imp_SeUnlockSubjectContext" __imp_SeUnlockSubjectContext
0x1C0003130: "\pagefile.sys" ??_C@_1BM@KEJLEEKF@?$AA?2?$AAp?$AAa?$AAg?$AAe?$AAf?$AAi?$AAl?$AAe?$AA?4?$AAs?$AAy?$AAs?$AA?$AA@
0x1C00041F0: "__cdecl _security_cookie" __security_cookie
0x1C00029F4: RtlUnicodeStringPrintf
0x1C0001CE8: UwfsIsRedirectionRequired
0x1C00060B0: "__cdecl _imp_FltGetEcpListFromCallbackData" __imp_FltGetEcpListFromCallbackData
0x1C0006320: "__cdecl _imp_UwflogNewEntry_UWFLOG_LEVEL_TRACE" __imp_UwflogNewEntry_UWFLOG_LEVEL_TRACE
0x1C0006018: "__cdecl _imp_FltUnregisterFilter" __imp_FltUnregisterFilter
0x1C0006218: "__cdecl _imp__vsnwprintf" __imp__vsnwprintf
0x1C00091E8: UwfsCleanupPrefixTable
0x1C0006088: "__cdecl _imp_FltSetEcpListIntoCallbackData" __imp_FltSetEcpListIntoCallbackData
0x1C00026B4: UwfsGetFileCommitInfo
0x1C000E1DC: "__cdecl _security_init_cookie" __security_init_cookie
0x1C0003200: "\Windows\system32\config\COMPONE" ??_C@_1EI@DPEKOLKD@?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?2?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAc?$AAo?$AAn?$AAf?$AAi?$AAg?$AA?2?$AAC?$AAO?$AAM?$AAP?$AAO?$AAN?$AAE@
0x1C0008CB0: UwfsInitializeGlobals
0x1C0006358: "__cdecl _imp_UwflogNewEntry_UWFLOG_LEVEL_CRITICAL" __imp_UwflogNewEntry_UWFLOG_LEVEL_CRITICAL
0x1C0006238: "__cdecl _imp_KeSetEvent" __imp_KeSetEvent
0x1C00044E0: WdfFunctions_01015
0x1C00060D0: "__cdecl _imp_FltSetVolumeContext" __imp_FltSetVolumeContext
0x1C0002E00: "__cdecl _report_gsfailure" __report_gsfailure
0x1C000BCF8: UwfsSyncCommitFilesPermissions
0x1C0006058: "__cdecl _imp_FltQueueGenericWorkItem" __imp_FltQueueGenericWorkItem
0x1C00061A0: "__cdecl _imp_ZwSetInformationFile" __imp_ZwSetInformationFile
0x1C0009420: UwfsInstanceSetupCallback
0x1C00093C0: UwfsFilterUnloadCallback
0x1C0006158: "__cdecl _imp_WdfVersionBindClass" __imp_WdfVersionBindClass
0x1C00062D8: ntoskrnl_NULL_THUNK_DATA
0x1C00062B0: "__cdecl _imp_IoGetAttachedDeviceReference" __imp_IoGetAttachedDeviceReference
0x1C00062C8: "__cdecl _imp_ExFreePoolWithTag" __imp_ExFreePoolWithTag
0x1C0006200: "__cdecl _imp_IoGetTransactionParameterBlock" __imp_IoGetTransactionParameterBlock
0x1C0006120: "__cdecl _imp_FltSetInformationFile" __imp_FltSetInformationFile
0x1C0009530: UwfsInstanceTeardownStartCallback
0x1C000E008: DriverEntry
0x1C0004250: "struct UWFS_GLOBALS Globals" ?Globals@@3UUWFS_GLOBALS@@A
0x1C000ADE0: UwfsPreDeviceControlCallback
0x1C00060F8: "__cdecl _imp_FltParseFileNameInformation" __imp_FltParseFileNameInformation
0x1C0002F00: memset
0x1C00063E8: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR

[JEB Decompiler by PNF Software]