Generated by JEB on 2019/08/01
PE: C:\Windows\SysWOW64\perfhost.exe Base=0x400000 SHA-256=68654262029A6F62DEE7F9D296A69A99DD6811C7AA6056DE40CE34440D4513CE
PDB: PerfHost.pdb GUID={C1FD6754-3C26-30D5-BE025BF1077EA264} Age=1
233 located named symbols:
0x4050C4: "__stdcall _imp__CloseThreadpoolWork" __imp__CloseThreadpoolWork@4
0x401200: "__cdecl PERF_EVENT_CALL_RETURNED" _PERF_EVENT_CALL_RETURNED
0x402780: "__stdcall MIDL_user_allocate" _MIDL_user_allocate@4
0x405054: "__stdcall _imp__FreeLibrary" __imp__FreeLibrary@4
0x405134: "__stdcall _imp__EtwEventWrite" __imp__EtwEventWrite@20
0x404398: "__cdecl __onexitend" ___onexitend
0x401800: "__stdcall PerfpSetServiceState" _PerfpSetServiceState@16
0x405178: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x4050E0: "__cdecl _imp____p__fmode" __imp____p__fmode
0x405034: "__stdcall _imp__NdrServerCall2" __imp__NdrServerCall2@4
0x401470: "ncalrpc" ??_C@_1BA@EONDGCCM@?$AAn?$AAc?$AAa?$AAl?$AAr?$AAp?$AAc?$AA?$AA@
0x405004: "__stdcall _imp__RpcRevertToSelf" __imp__RpcRevertToSelf@0
0x40400C: "__cdecl __security_cookie" ___security_cookie
0x4027A0: "__stdcall MIDL_user_free" _MIDL_user_free@4
0x402EE0: "__fastcall __security_check_cookie" @__security_check_cookie@4
0x404388: "__cdecl PerfpSvcHandle" _PerfpSvcHandle
0x401480: "SOFTWARE\Microsoft\Windows NT\Cu" ??_C@_1GK@EDCNPJHK@?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAN?$AAT?$AA?2?$AAC?$AAu@
0x401AD7: "__stdcall PerfpLoadProvider" _PerfpLoadProvider@4
0x4050A0: "__stdcall _imp__InitializeSRWLock" __imp__InitializeSRWLock@4
0x402875: "__stdcall PerfpGetClientAuthId" _PerfpGetClientAuthId@4
0x40507C: "__stdcall _imp__QueryPerformanceCounter" __imp__QueryPerformanceCounter@4
0x40324D: "__cdecl _SEH_epilog4" __SEH_epilog4
0x4050A8: "__stdcall _imp__Sleep" __imp__Sleep@4
0x403000: "__cdecl _matherr" __matherr
0x402530: "__stdcall PerfReleaseProvider" _PerfReleaseProvider@4
0x403208: "__cdecl _SEH_prolog4" __SEH_prolog4
0x404008: "__cdecl __defaultmatherr" ___defaultmatherr
0x401950: "__stdcall PerfpServiceMain" _PerfpServiceMain@8
0x4026E5: "__stdcall PerfpInitializeServer" _PerfpInitializeServer@0
0x402AB0: "__stdcall PerfpReadRegString" _PerfpReadRegString@16
0x405028: "__stdcall _imp__RpcBindingToStringBindingW" __imp__RpcBindingToStringBindingW@8
0x401434: "Collect" ??_C@_07GOPPECED@Collect?$AA@
0x40266A: "__stdcall PerfpCleanupServer" _PerfpCleanupServer@0
0x4050E8: "__cdecl _imp___exit" __imp___exit
0x40141C: "Open" ??_C@_04DNCDCIAE@Open?$AA@
0x405068: "__stdcall _imp__TerminateProcess" __imp__TerminateProcess@8
0x401230: "__cdecl PERF_EVENT_RPCBLOCK" _PERF_EVENT_RPCBLOCK
0x405160: "__cdecl __guard_check_icall_fptr" ___guard_check_icall_fptr
0x4013F4: "Performance" ??_C@_1BI@JDOBPIED@?$AAP?$AAe?$AAr?$AAf?$AAo?$AAr?$AAm?$AAa?$AAn?$AAc?$AAe?$AA?$AA@
0x405050: api-ms-win-core-heap-l1-1-0_NULL_THUNK_DATA
0x4029A8: "__stdcall PerfpExpandStringInPlace" _PerfpExpandStringInPlace@8
0x405058: "__stdcall _imp__LoadLibraryExW" __imp__LoadLibraryExW@12
0x405154: "__stdcall _imp__RtlAcquireSRWLockExclusive" __imp__RtlAcquireSRWLockExclusive@4
0x401B5A: "__stdcall PerfpCloseProvider" _PerfpCloseProvider@4
0x4050B0: "__stdcall _imp__GetSystemTimeAsFileTime" __imp__GetSystemTimeAsFileTime@4
0x401270: "__cdecl PERF_EVENT_SVC_ERROR" _PERF_EVENT_SVC_ERROR
0x402B69: "__cdecl StringCbPrintfW" _StringCbPrintfW
0x405254: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0
0x405014: "__stdcall _imp__RpcServerUnregisterIf" __imp__RpcServerUnregisterIf@12
0x4050FC: "__cdecl _imp____setusermatherr" __imp____setusermatherr
0x401514: "PerfpGetClientAuthId" ??_C@_0BF@GNIOIMDK@PerfpGetClientAuthId?$AA@
0x4050E4: "__cdecl _imp___cexit" __imp___cexit
0x4050B4: "__stdcall _imp__GetTickCount" __imp__GetTickCount@0
0x405110: "__cdecl _imp__memcpy" __imp__memcpy
0x405040: "__stdcall _imp__SetUnhandledExceptionFilter" __imp__SetUnhandledExceptionFilter@4
0x401890: "__stdcall PerfpStopService" _PerfpStopService@12
0x4050EC: "__cdecl _imp___amsg_exit" __imp___amsg_exit
0x40513C: "__stdcall _imp__RtlExpandEnvironmentStrings" __imp__RtlExpandEnvironmentStrings@24
0x40502C: "__stdcall _imp__RpcBindingInqAuthClientW" __imp__RpcBindingInqAuthClientW@24
0x40509C: api-ms-win-core-string-l1-1-0_NULL_THUNK_DATA
0x405074: "__stdcall _imp__GetCurrentProcessId" __imp__GetCurrentProcessId@0
0x402E32: "__cdecl _initterm_e" __initterm_e
0x401C6B: "__stdcall PerfpOpenProvider" _PerfpOpenProvider@4
0x4050D0: "__stdcall _imp__RegisterServiceCtrlHandlerExW" __imp__RegisterServiceCtrlHandlerExW@12
0x40505C: "__stdcall _imp__GetModuleHandleW" __imp__GetModuleHandleW@4
0x402962: "__stdcall PerfpDuplicateAnsiString" _PerfpDuplicateAnsiString@8
0x40511C: "__cdecl _imp__memset" __imp__memset
0x4027BD: "__cdecl PerfpEventWrite" _PerfpEventWrite
0x4050D8: api-ms-win-service-core-l1-1-0_NULL_THUNK_DATA
0x401250: "__cdecl PERF_EVENT_CALL_OPENPROC" _PERF_EVENT_CALL_OPENPROC
0x405094: api-ms-win-core-registry-l1-1-0_NULL_THUNK_DATA
0x405048: api-ms-win-core-errorhandling-l1-1-0_NULL_THUNK_DATA
0x405144: "__stdcall _imp__EtwEventRegister" __imp__EtwEventRegister@16
0x404380: "__cdecl PerfpShuttingDown" _PerfpShuttingDown
0x405218: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-string-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-string-l1-1-0
0x4021F0: "__stdcall PerfpDereferenceProvider" _PerfpDereferenceProvider@4
0x4050F8: "__cdecl _imp___initterm" __imp___initterm
0x405064: api-ms-win-core-libraryloader-l1-2-0_NULL_THUNK_DATA
0x401A43: "__cdecl wmain" _wmain
0x4050D4: "__stdcall _imp__StartServiceCtrlDispatcherW" __imp__StartServiceCtrlDispatcherW@4
0x405060: "__stdcall _imp__GetProcAddress" __imp__GetProcAddress@8
0x4050BC: "__stdcall _imp__SubmitThreadpoolWork" __imp__SubmitThreadpoolWork@4
0x40143C: "Linkage" ??_C@_1BA@FFLPDJJG@?$AAL?$AAi?$AAn?$AAk?$AAa?$AAg?$AAe?$AA?$AA@
0x4043B0: "__cdecl PerfpEventHandle" _PerfpEventHandle
0x402F40: "__cdecl __CxxSetUnhandledExceptionFilter" ___CxxSetUnhandledExceptionFilter
0x402EF0: "long __stdcall __CxxUnhandledExceptionFilter(struct _EXCEPTION_POINTERS *)" ?__CxxUnhandledExceptionFilter@@YGJPAU_EXCEPTION_POINTERS@@@Z
0x405150: "__stdcall _imp__RtlReleaseSRWLockExclusive" __imp__RtlReleaseSRWLockExclusive@4
0x4050F0: "__cdecl _imp___controlfp" __imp___controlfp
0x4051C8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0
0x40504C: "__stdcall _imp__HeapSetInformation" __imp__HeapSetInformation@16
0x405118: "__cdecl _imp___except_handler4_common" __imp___except_handler4_common
0x4014EC: "PerfpRpcIfCallback" ??_C@_0BD@JCKHLDGG@PerfpRpcIfCallback?$AA@
0x4022A0: "__stdcall PerfGetProvider" _PerfGetProvider@12
0x404054: "__cdecl _dowildcard" __dowildcard
0x401500: "PerfpCleanupServer" ??_C@_0BD@CBKPNLEL@PerfpCleanupServer?$AA@
0x401280: "__cdecl PERF_EVENT_CALL_COLLECTPROC" _PERF_EVENT_CALL_COLLECTPROC
0x404058: "__cdecl _newmode" __newmode
0x405030: "__stdcall _imp__RpcImpersonateClient" __imp__RpcImpersonateClient@4
0x405138: "__stdcall _imp__RtlAllocateHeap" __imp__RtlAllocateHeap@12
0x405140: "__stdcall _imp__EtwEventUnregister" __imp__EtwEventUnregister@8
0x4051DC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0
0x40500C: "__stdcall _imp__RpcServerRegisterIfEx" __imp__RpcServerRegisterIfEx@24
0x403155: "__cdecl __security_init_cookie" ___security_init_cookie
0x403010: "__cdecl _FindPESection" __FindPESection
0x405108: "__cdecl _imp__exit" __imp__exit
0x4011A0: "__cdecl __xi_a" ___xi_a
0x401194: "__cdecl __xc_a" ___xc_a
0x40119C: "__cdecl __xc_z" ___xc_z
0x4011AC: "__cdecl __xi_z" ___xi_z
0x403270: "__cdecl _except_handler4" __except_handler4
0x402760: "__stdcall PPERF_REMOTE_PROVIDER_rundown" _PPERF_REMOTE_PROVIDER_rundown@4
0x4050B8: api-ms-win-core-sysinfo-l1-1-0_NULL_THUNK_DATA
0x402F4E: "__cdecl _XcptFilter" __XcptFilter
0x4050CC: "__stdcall _imp__SetServiceStatus" __imp__SetServiceStatus@8
0x40506C: "__stdcall _imp__GetCurrentProcess" __imp__GetCurrentProcess@0
0x401210: "__cdecl PERF_PERFHOST_PROVIDER" _PERF_PERFHOST_PROVIDER
0x404010: "__cdecl __security_cookie_complement" ___security_cookie_complement
0x401424: "Close" ??_C@_05LGELBCGM@Close?$AA@
0x40514C: "__stdcall _imp__RtlAcquireSRWLockShared" __imp__RtlAcquireSRWLockShared@4
0x40146C: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x4051F0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0
0x401EB7: "__stdcall PerfpAllocateProvider" _PerfpAllocateProvider@8
0x4051B4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-l1-1-0
0x405084: "__stdcall _imp__RegQueryValueExA" __imp__RegQueryValueExA@24
0x405124: "__stdcall _imp__NtClose" __imp__NtClose@4
0x405078: api-ms-win-core-processthreads-l1-1-0_NULL_THUNK_DATA
0x405098: "__stdcall _imp__CompareStringOrdinal" __imp__CompareStringOrdinal@20
0x401398: "PerfpSetServiceState" ??_C@_0BF@IHMALNFL@PerfpSetServiceState?$AA@
0x4050F4: "__cdecl _imp_?terminate@@YAXXZ" __imp_?terminate@@YAXXZ
0x4033FC: "__cdecl memset" _memset
0x4013E0: "PerfpOpenProvider" ??_C@_0BC@EGCHLKCJ@PerfpOpenProvider?$AA@
0x402ED0: "__cdecl wmainCRTStartup" _wmainCRTStartup
0x402360: "__stdcall PerfCollectData" _PerfCollectData@20
0x402B18: "__stdcall PerfpReadRegAnsiString" _PerfpReadRegAnsiString@16
0x405024: "__stdcall _imp__RpcStringBindingParseW" __imp__RpcStringBindingParseW@24
0x4050C8: api-ms-win-core-threadpool-l1-2-0_NULL_THUNK_DATA
0x401260: "__cdecl PERF_EVENT_CREATE_PROVIDER_ERROR" _PERF_EVENT_CREATE_PROVIDER_ERROR
0x401240: "__cdecl PERF_EVENT_REVERTTOSELF_ERROR" _PERF_EVENT_REVERTTOSELF_ERROR
0x4032A0: "__fastcall _guard_check_icall_nop" @_guard_check_icall_nop@4
0x40510C: "__cdecl _imp___vsnwprintf" __imp___vsnwprintf
0x405080: api-ms-win-core-profile-l1-1-0_NULL_THUNK_DATA
0x403000: "__cdecl _wsetargv" __wsetargv
0x4031EF: "__cdecl _setdefaultprecision" __setdefaultprecision
0x4043B8: "__cdecl __@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUhxivtUdrmivtUkviuslhgUlyquivUrDIGUkivxlnkOlyq@PerfHost" ___@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUhxivtUdrmivtUkviuslhgUlyquivUrDIGUkivxlnkOlyq@PerfHost
0x405120: msvcrt_NULL_THUNK_DATA
0x40405C: "__cdecl _fmode" __fmode
0x4033DD: "__cdecl _except_handler4_common" __except_handler4_common
0x404000: "__cdecl PerfpProvidersList" _PerfpProvidersList
0x403202: "__cdecl _initterm" __initterm
0x404390: "__cdecl PerfpProvidersLock" _PerfpProvidersLock
0x40439C: "__cdecl __onexitbegin" ___onexitbegin
0x4011B0: "__cdecl __guard_fids_table" ___guard_fids_table
0x401530: "SYSTEM\CurrentControlSet\Service" ??_C@_1FA@CFFJGEAA@?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA?2?$AAS?$AAe?$AAr?$AAv?$AAi?$AAc?$AAe@
0x4013D8: "wmain" ??_C@_05GFKPGDJ@wmain?$AA@
0x40512C: "__stdcall _imp__RtlNtStatusToDosError" __imp__RtlNtStatusToDosError@4
0x40503C: "__stdcall _imp__UnhandledExceptionFilter" __imp__UnhandledExceptionFilter@4
0x405088: "__stdcall _imp__RegQueryValueExW" __imp__RegQueryValueExW@24
0x404384: "__cdecl PerfpCleanupWork" _PerfpCleanupWork
0x405130: "__stdcall _imp__NtOpenThreadToken" __imp__NtOpenThreadToken@16
0x405044: "__stdcall _imp__GetLastError" __imp__GetLastError@0
0x4032CD: "__cdecl __report_gsfailure" ___report_gsfailure
0x401220: "__cdecl PERF_EVENT_CALL_CLOSEPROC" _PERF_EVENT_CALL_CLOSEPROC
0x402550: "__stdcall PerfpRpcIfCallback" _PerfpRpcIfCallback@8
0x40140C: "Library" ??_C@_1BA@MCNKKFDK@?$AAL?$AAi?$AAb?$AAr?$AAa?$AAr?$AAy?$AA?$AA@
0x405018: "__stdcall _imp__RpcBindingVectorFree" __imp__RpcBindingVectorFree@4
0x4043A0: "__cdecl __native_startup_lock" ___native_startup_lock
0x405008: "__stdcall _imp__RpcEpRegisterW" __imp__RpcEpRegisterW@16
0x401E2B: "__stdcall PerfpFreeProvider" _PerfpFreeProvider@4
0x4043A4: "__cdecl __native_startup_state" ___native_startup_state
0x40145C: "PerfCollectData" ??_C@_0BA@EJPPCHII@PerfCollectData?$AA@
0x4010F0: "__cdecl _load_config_used" __load_config_used
0x405020: "__stdcall _imp__RpcStringFreeW" __imp__RpcStringFreeW@4
0x40515C: ntdll_NULL_THUNK_DATA
0x4033F6: "__cdecl memcpy" _memcpy
0x4033F0: "__stdcall NdrServerCall2" _NdrServerCall2@4
0x405148: "__stdcall _imp__RtlReleaseSRWLockShared" __imp__RtlReleaseSRWLockShared@4
0x40144C: "Export" ??_C@_1O@JECNEECA@?$AAE?$AAx?$AAp?$AAo?$AAr?$AAt?$AA?$AA@
0x40283F: "__stdcall PerfpRevertToSelf" _PerfpRevertToSelf@8
0x404050: "__cdecl _commode" __commode
0x40522C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0
0x4051A0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0
0x4015E0: "__cdecl __safe_se_handler_table" ___safe_se_handler_table
0x40142C: "Query" ??_C@_05BNKNJDAB@Query?$AA@
0x405128: "__stdcall _imp__NtQueryInformationToken" __imp__NtQueryInformationToken@20
0x405000: "__stdcall _imp__RpcServerInqBindings" __imp__RpcServerInqBindings@4
0x405010: "__stdcall _imp__RpcServerUseProtseqW" __imp__RpcServerUseProtseqW@12
0x40527C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-service-core-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-service-core-l1-1-0
0x40508C: "__stdcall _imp__RegOpenKeyExW" __imp__RegOpenKeyExW@20
0x405114: "__cdecl _imp____wgetmainargs" __imp____wgetmainargs
0x405164: "__cdecl _IMPORT_DESCRIPTOR_msvcrt" __IMPORT_DESCRIPTOR_msvcrt
0x40438C: "__cdecl PerfpControlLock" _PerfpControlLock
0x4032A3: "__cdecl __raise_securityfailure" ___raise_securityfailure
0x404394: "__cdecl PerfpBindingVector" _PerfpBindingVector
0x402FBE: "__cdecl _get_image_app_type" __get_image_app_type
0x4043A8: "__cdecl __dyn_tls_init_callback" ___dyn_tls_init_callback
0x40518C: "__cdecl _IMPORT_DESCRIPTOR_RPCRT4" __IMPORT_DESCRIPTOR_RPCRT4
0x405038: RPCRT4_NULL_THUNK_DATA
0x402A27: "__stdcall PerfpReadRegistry" _PerfpReadRegistry@20
0x405070: "__stdcall _imp__GetCurrentThreadId" __imp__GetCurrentThreadId@0
0x402FF4: "__cdecl _amsg_exit" __amsg_exit
0x402F54: "__stdcall RtlpImageNtHeader" _RtlpImageNtHeader@4
0x403060: "__cdecl _IsNonwritableInCurrentImage" __IsNonwritableInCurrentImage
0x4050DC: "__cdecl _imp____set_app_type" __imp____set_app_type
0x405100: "__cdecl _imp___XcptFilter" __imp___XcptFilter
0x405090: "__stdcall _imp__RegCloseKey" __imp__RegCloseKey@4
0x405158: "__stdcall _imp__RtlFreeHeap" __imp__RtlFreeHeap@12
0x40501C: "__stdcall _imp__RpcEpUnregister" __imp__RpcEpUnregister@12
0x4013C4: "PerfpServiceMain" ??_C@_0BB@PGAPOFBJ@PerfpServiceMain?$AA@
0x4050C0: "__stdcall _imp__CreateThreadpoolWork" __imp__CreateThreadpoolWork@12
0x405204: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0
0x405104: "__cdecl _imp____p__commode" __imp____p__commode
0x4018D0: "__stdcall PerfpServiceControl" _PerfpServiceControl@16
0x4050AC: api-ms-win-core-synch-l1-2-0_NULL_THUNK_DATA
0x405268: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-threadpool-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-threadpool-l1-2-0
0x40290F: "__stdcall PerfpDuplicateString" _PerfpDuplicateString@8
0x403120: "__cdecl _ValidateImageBase" __ValidateImageBase
0x4050A4: api-ms-win-core-synch-l1-1-0_NULL_THUNK_DATA
0x405240: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0
0x4013B0: "PerfHost" ??_C@_1BC@GOPBEPLM@?$AAP?$AAe?$AAr?$AAf?$AAH?$AAo?$AAs?$AAt?$AA?$AA@
0x405290: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
[JEB Decompiler by PNF Software]