Generated by JEB on 2019/02/01

PE: C:\Windows\System32\drivers\npsvctrig.sys Base=0x1C0000000 SHA-256=6AACC3C38E22061A210918771D3B087903CB7024AFBD013827864C02CD75A3F9
PDB: NpSvcTrig.pdb GUID={989A391D-8CB0-F1B1-8577230950B7B492} Age=1

181 located named symbols:
0x1C0005090: "__cdecl _imp_FltSetCallbackDataDirty" __imp_FltSetCallbackDataDirty
0x1C0001CE0: WppClassicProviderCallback
0x1C00050E0: "__cdecl _imp_KeSetTimer" __imp_KeSetTimer
0x1C0003128: "__cdecl _security_cookie_complement" __security_cookie_complement
0x1C0007730: WppTraceCallback
0x1C0007E94: RtdspGetTriggerEndpoints
0x1C000686C: NptrigDeleteLock
0x1C0005108: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x1C00012A0: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x1C0005138: "__cdecl _imp_ZwEnumerateKey" __imp_ZwEnumerateKey
0x1C0002370: "`string'" ??_C@_1EK@LBCEHJEN@?$AA1?$AAf?$AA8?$AA1?$AAd?$AA1?$AA3?$AA1?$AA?9?$AA3?$AAf?$AAa?$AAc?$AA?9?$AA4?$AA5?$AA3?$AA7?$AA?9?$AA9?$AAe?$AA0?$AAc?$AA?9?$AA7?$AAe?$AA7?$AAb?$AA0?$AAc?$AA2?$AAf@
0x1C00021D0: "`string'" ??_C@_1CA@OFIBBPKJ@?$AAW?$AAm?$AAi?$AAT?$AAr?$AAa?$AAc?$AAe?$AAM?$AAe?$AAs?$AAs?$AAa?$AAg?$AAe?$AA?$AA@
0x1C0005080: "__cdecl _imp_FltAllocateContext" __imp_FltAllocateContext
0x1C0005178: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x1C00062C0: NptrigInstanceSetup
0x1C00050E8: "__cdecl _imp_MmGetSystemRoutineAddress" __imp_MmGetSystemRoutineAddress
0x1C0005018: "__cdecl _imp_FltQueueDeferredIoWorkItem" __imp_FltQueueDeferredIoWorkItem
0x1C0005150: "__cdecl _imp_KeInitializeMutex" __imp_KeInitializeMutex
0x1C0002290: NAMED_PIPE_EVENT_GUID
0x1C0001010: NptrigPostFsControlCallback
0x1C0005160: "__cdecl _imp_KeWaitForSingleObject" __imp_KeWaitForSingleObject
0x1C0005038: "__cdecl _imp_FltSetInstanceContext" __imp_FltSetInstanceContext
0x1C0001D18: RtdspInitializeLock
0x1C0002310: ServiceTriggerPerfServiceTriggered
0x1C00012C0: memcpy
0x1C0005118: "__cdecl _imp_KeInitializeDpc" __imp_KeInitializeDpc
0x1C0007140: NptrigUnlock
0x1C0003260: pfnWppGetVersion
0x1C0003140: RtdsTriggerUpdateLock
0x1C00030B0: RtdsProviderWnfState
0x1C00012C0: memmove
0x1C0001DC8: RtlUnicodeStringCatString
0x1C0003060: NPTRIG_ETW_PROVIDER_GUID_Context
0x1C000122C: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x1C0005088: "__cdecl _imp_FltRegisterFilter" __imp_FltRegisterFilter
0x1C0003200: WPP_MAIN_CB
0x1C0007D48: RtdspFreeEndpointList
0x1C0001AC0: NptrigWaitNamedPipeTimeoutCallback
0x1C000660C: NptrigAlterIoStatus
0x1C0002EB0: NptrigOperationRegistration
0x1C0005030: "__cdecl _imp_FltAcquirePushLockExclusiveEx" __imp_FltAcquirePushLockExclusiveEx
0x1C0006B74: NptrigHandleTriggerableIo
0x1C0006140: NptrigPostCreateNamedPipeCallback
0x1C00022C8: ServiceTriggerPerfServiceTimedOut
0x1C00073A0: NptrigWaitNamedPipeQueueRemove
0x1C00050D8: "__cdecl _imp_ExAllocatePoolWithTag" __imp_ExAllocatePoolWithTag
0x1C0003270: pfnWppQueryTraceInformation
0x1C0005060: "__cdecl _imp_FltCbdqInitialize" __imp_FltCbdqInitialize
0x1C00071A0: NptrigWaitNamedPipeQueueCompleteCanceled
0x1C00050A8: FLTMGR_NULL_THUNK_DATA
0x1C0001208: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x1C00021B0: "`string'" ??_C@_1BK@DHLDGJM@?$AAP?$AAs?$AAG?$AAe?$AAt?$AAV?$AAe?$AAr?$AAs?$AAi?$AAo?$AAn?$AA?$AA@
0x1C000112C: McTemplateK0zz
0x1C0006768: NptrigCreateTrigger
0x1C0006CD0: NptrigLock
0x1C0002120: "`string'" ??_C@_19CIJIHAKK@?$AAN?$AAU?$AAL?$AAL?$AA?$AA@
0x1C0003250: pfnEtwRegisterClassicProvider
0x1C00023C0: WNF_RTDS_NAMED_PIPE_TRIGGER_CHANGED
0x1C0005098: "__cdecl _imp_FltGetInstanceContext" __imp_FltGetInstanceContext
0x1C0005058: "__cdecl _imp_FltReleaseContext" __imp_FltReleaseContext
0x1C0007220: NptrigWaitNamedPipeQueueInsert
0x1C0006668: NptrigCleanupOrphanedWaitNamedPipeRequests
0x1C0003278: pfnEtwUnregister
0x1C0005020: "__cdecl _imp_FltCbdqRemoveNextIo" __imp_FltCbdqRemoveNextIo
0x1C0005110: "__cdecl _imp_RtlEqualUnicodeString" __imp_RtlEqualUnicodeString
0x1C0005048: "__cdecl _imp_FltInitializePushLock" __imp_FltInitializePushLock
0x1C0005158: "__cdecl _imp_KeReleaseMutex" __imp_KeReleaseMutex
0x1C0009010: GsDriverEntry
0x1C00022A0: SERVICE_TRIGGER_PERF_EVENT_GUID
0x1C0005170: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x1C00022F0: WPP_ThisDir_CTLGUID_NptrigTracing
0x1C0005008: "__cdecl _imp_FltAllocateDeferredIoWorkItem" __imp_FltAllocateDeferredIoWorkItem
0x1C0001D58: RtdspUnlock
0x1C0001A70: NptrigTakeRequestRef
0x1C0006010: NptrigPostCreateCallback
0x1C0002310: ClientWaiting
0x1C0007360: NptrigWaitNamedPipeQueueRelease
0x1C00022E8: Microsoft_Windows_ServiceTriggerPerfEventProviderKeywords
0x1C0003000: WPP_GLOBAL_Control
0x1C00050C8: "__cdecl _imp_ZwQueryValueKey" __imp_ZwQueryValueKey
0x1C00022E8: Microsoft_Windows_EndpointTriggerProviderKeywords
0x1C0002D80: "`string'" ??_C@_1EK@LBCEHJEN@?$AA1?$AAf?$AA8?$AA1?$AAd?$AA1?$AA3?$AA1?$AA?9?$AA3?$AAf?$AAa?$AAc?$AA?9?$AA4?$AA5?$AA3?$AA7?$AA?9?$AA9?$AAe?$AA0?$AAc?$AA?9?$AA7?$AAe?$AA7?$AAb?$AA0?$AAc?$AA2?$AAf@LBKOJDO@
0x1C0005040: "__cdecl _imp_FltStartFiltering" __imp_FltStartFiltering
0x1C0001070: "__cdecl _security_check_cookie" __security_check_cookie
0x1C0005194: "__cdecl _IMPORT_DESCRIPTOR_FLTMGR" __IMPORT_DESCRIPTOR_FLTMGR
0x1C0005180: "__cdecl _IMPORT_DESCRIPTOR_ntoskrnl" __IMPORT_DESCRIPTOR_ntoskrnl
0x1C0005010: "__cdecl _imp_FltCbdqInsertIo" __imp_FltCbdqInsertIo
0x1C0006890: NptrigDestroyFilterInstance
0x1C0007CF4: RtdspFindEndpoint
0x1C0007B40: RtdsRegisterUpdateCallback
0x1C0007510: WppCleanupKm
0x1C00050F8: "__cdecl _imp_EtwUnregister" __imp_EtwUnregister
0x1C00031C0: RtdsTriggerDbList
0x1C000A000: "__cdecl _guard_fids_table" __guard_fids_table
0x1C0002000: "__cdecl load_config_used" _load_config_used
0x1C0003010: SERVICE_TRIGGER_PERF_EVENT_GUID_Context
0x1C00019D4: McGenEventUnregister
0x1C0005070: "__cdecl _imp_FltFreeDeferredIoWorkItem" __imp_FltFreeDeferredIoWorkItem
0x1C00070F0: NptrigTriggerChangeCallback
0x1C00050B0: "__cdecl _imp_ZwClose" __imp_ZwClose
0x1C0005028: "__cdecl _imp_FltCbdqDisable" __imp_FltCbdqDisable
0x1C0005140: "__cdecl _imp_ExSubscribeWnfStateChange" __imp_ExSubscribeWnfStateChange
0x1C00023C8: WNF_RTDS_RPC_INTERFACE_TRIGGER_CHANGED
0x1C00010B0: McGenEventWriteKM
0x1C0006F6C: NptrigReleasePendingRequests
0x1C00021F0: "`string'" ??_C@_1DC@DOCOAJH@?$AAW?$AAm?$AAi?$AAQ?$AAu?$AAe?$AAr?$AAy?$AAT?$AAr?$AAa?$AAc?$AAe?$AAI?$AAn?$AAf?$AAo?$AAr?$AAm?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x1C0002260: "`string'" ??_C@_1BM@CJMKDOJH@?$AAE?$AAt?$AAw?$AAU?$AAn?$AAr?$AAe?$AAg?$AAi?$AAs?$AAt?$AAe?$AAr?$AA?$AA@
0x1C0006BD8: NptrigInitializeLock
0x1C00023D0: RTDS_TRIGGER_KEY
0x1C0002CC0: "`string'" ??_C@_1JC@JHIPFBHA@?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe@LBKOJDO@
0x1C0007970: RtdsInternalUpdateCallback
0x1C00011F0: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x1C0005050: "__cdecl _imp_FltCbdqRemoveIo" __imp_FltCbdqRemoveIo
0x1C0002DD0: NptrigContextRegistration
0x1C0007160: NptrigWaitNamedPipeQueueAcquire
0x1C00031E0: Microsoft_Windows_EndpointTriggerProviderEnableBits
0x1C0002D58: "`string'" ??_C@_1CC@PDNHGHFE@?$AAN?$AAa?$AAm?$AAe?$AAd?$AAP?$AAi?$AAp?$AAe?$AAT?$AAi?$AAm?$AAe?$AAo?$AAu?$AAt?$AA?$AA@LBKOJDO@
0x1C000761C: WppLoadTracingSupport
0x1C00050B8: "__cdecl _imp_IoWMIRegistrationControl" __imp_IoWMIRegistrationControl
0x1C00069F8: NptrigFindTrigger
0x1C0003248: Microsoft_Windows_ServiceTriggerPerfEventProviderEnableBits
0x1C0006550: DriverUnload
0x1C0003120: "__cdecl _security_cookie" __security_cookie
0x1C0007A88: RtdsReaderInitialize
0x1C00050F0: "__cdecl _imp_KeCancelTimer" __imp_KeCancelTimer
0x1C0006CE8: NptrigQueueWaitNamedPipeRequest
0x1C0001D30: RtdspLock
0x1C0005128: "__cdecl _imp_RtlCompareMemory" __imp_RtlCompareMemory
0x1C00022D8: WPP_db0463129fec38509670b9c52f4b2853_Traceguids
0x1C0002280: NPTRIG_ETW_PROVIDER_GUID
0x1C00018A0: McGenControlCallbackV2
0x1C0002228: "`string'" ??_C@_1DG@PFOPAIND@?$AAE?$AAt?$AAw?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAe?$AAr?$AAC?$AAl?$AAa?$AAs?$AAs?$AAi?$AAc?$AAP?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AA?$AA@
0x1C0002320: "`string'" ??_C@_1EK@KPHNJPMN@?$AAb?$AAc?$AA9?$AA0?$AAd?$AA1?$AA6?$AA7?$AA?9?$AA9?$AA4?$AA7?$AA0?$AA?9?$AA4?$AA1?$AA3?$AA9?$AA?9?$AAa?$AA9?$AAb?$AAa?$AA?9?$AAb?$AAe?$AA0?$AAb?$AAb?$AAb?$AAf?$AA5@
0x1C0007C4C: RtdsUnregisterUpdateCallback
0x1C0006AA8: NptrigFireTrigger
0x1C0005148: "__cdecl _imp_ExUnsubscribeWnfStateChange" __imp_ExUnsubscribeWnfStateChange
0x1C0005100: "__cdecl _imp_KeInitializeTimer" __imp_KeInitializeTimer
0x1C0005130: "__cdecl _imp_EtwWrite" __imp_EtwWrite
0x1C00050A0: "__cdecl _imp_FltUnregisterFilter" __imp_FltUnregisterFilter
0x1C0001C28: WPP_SF_qL
0x1C0001C28: WPP_SF_qd
0x1C0001C84: WPP_SF_qq
0x1C00068AC: NptrigDestroyTrigger
0x1C00073D0: NptrigWaitNamedPipeTimeoutWorkItem
0x1C00022C0: Microsoft_Windows_ServiceTriggerPerfEventProviderLevels
0x1C00022B0: RPC_INTERFACE_EVENT_GUID
0x1C00022C0: Microsoft_Windows_EndpointTriggerProviderLevels
0x1C0009044: "__cdecl _security_init_cookie" __security_init_cookie
0x1C0005068: "__cdecl _imp_FltDeletePushLock" __imp_FltDeletePushLock
0x1C0001BD8: WPP_SF_q
0x1C00050D0: "__cdecl _imp_EtwRegister" __imp_EtwRegister
0x1C0003268: WPPTraceSuite
0x1C00019AC: McGenEventRegister
0x1C0007290: NptrigWaitNamedPipeQueuePeekNext
0x1C0003240: NptrigDriverInstance
0x1C0005000: "__cdecl _imp_FltCompletePendedPostOperation" __imp_FltCompletePendedPostOperation
0x1C00010A0: "__cdecl _report_gsfailure" __report_gsfailure
0x1C0006BF0: NptrigInstanceTeardownStartCallback
0x1C00069D0: NptrigFilterUnloadCallback
0x1C0007AFC: RtdsReaderShutdown
0x1C0001A04: NptrigReleaseRequestRef
0x1C0005168: ntoskrnl_NULL_THUNK_DATA
0x1C00050C0: "__cdecl _imp_ExFreePoolWithTag" __imp_ExFreePoolWithTag
0x1C0007DB8: RtdspGenerateEndpointChangelist
0x1C0005078: "__cdecl _imp_FltReleasePushLockEx" __imp_FltReleasePushLockEx
0x1C0002E40: NptrigRegistration
0x1C0009078: DriverEntry
0x1C0002300: ServiceTriggerPerfServiceArrived
0x1C0003258: pfnWppTraceMessage
0x1C0005120: "__cdecl _imp_ZwOpenKey" __imp_ZwOpenKey
0x1C000798C: RtdsInternalUpdateCallbackWorker
0x1C000758C: WppInitKm
0x1C0001600: memset
0x1C00051A8: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR

[JEB Decompiler by PNF Software]