Generated by JEB on 2019/08/01

PE: C:\Windows\System32\klist.exe Base=0x140000000 SHA-256=6AC1BB76543C10B5294AAF286132152757F90825EFECB3C0066F5F2ACC7AA1D7
PDB: klist.pdb GUID={52E72D5A-3A4E-7E7A-75081B470C919E92} Age=1

404 located named symbols:
0x1400064C0: "__cdecl _imp_RtlInitUnicodeStringEx" __imp_RtlInitUnicodeStringEx
0x140005884: "__cdecl _raise_securityfailure" __raise_securityfailure
0x140006170: api-ms-win-core-file-l1-1-0_NULL_THUNK_DATA
0x140005C90: "__cdecl FindPESection" _FindPESection
0x140005184: LocWriteMsgIO
0x140007430: "sessions" ??_C@_1BC@FCIFBAGG@?$AAs?$AAe?$AAs?$AAs?$AAi?$AAo?$AAn?$AAs?$AA?$AA@
0x140008090: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x140006378: api-ms-win-security-provider-l1-1-0_NULL_THUNK_DATA
0x140005C80: "__cdecl wsetargv" _wsetargv
0x140007070: " %d %#x:%#x %wZ\%wZ %wZ:%ws " ??_C@_1DM@FEGHOGHF@?$AA?5?$AA?$CF?$AAd?$AA?5?$AA?$CF?$AA?$CD?$AAx?$AA?3?$AA?$CF?$AA?$CD?$AAx?$AA?5?$AA?$CF?$AAw?$AAZ?$AA?2?$AA?$CF?$AAw?$AAZ?$AA?5?$AA?$CF?$AAw?$AAZ?$AA?3?$AA?$CF?$AAw?$AAs?$AA?$AN?$AA?6?$AA?$AA@
0x140009010: "__cdecl _security_cookie_complement" __security_cookie_complement
0x1400063F0: "__cdecl _imp___wgetmainargs" __imp___wgetmainargs
0x140006EF0: "hw_authent" ??_C@_0L@FJBDFIDD@hw_authent?$AA@
0x140006230: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x140006F88: "ASC" ??_C@_17HMFBGPGP@?$AAA?$AAS?$AAC?$AA?$AA@
0x140006800: " get <SPN> [-lh <LogonId.HighPa" ??_C@_1HO@GNDNGLDA@?$AA?5?$AA?5?$AAg?$AAe?$AAt?$AA?5?$AA?$DM?$AAS?$AAP?$AAN?$AA?$DO?$AA?5?$AA?$FL?$AA?9?$AAl?$AAh?$AA?5?$AA?$DM?$AAL?$AAo?$AAg?$AAo?$AAn?$AAI?$AAd?$AA?4?$AAH?$AAi?$AAg?$AAh?$AAP?$AAa@
0x140004C88: LsaLookupAuthenticationPackage
0x140004DFC: LsaConnectUntrusted
0x1400064A8: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x140006D10: "Network" ??_C@_1BA@IFBJBPAK@?$AAN?$AAe?$AAt?$AAw?$AAo?$AAr?$AAk?$AA?$AA@
0x140005F70: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x1400069B8: "0 " ??_C@_17MMDDIAFB@?$AA0?$AA?$AN?$AA?6?$AA?$AA@
0x140001B28: "void __cdecl ShowNTError(unsigned long,long)" ?ShowNTError@@YAXKJ@Z
0x14000429C: "int __cdecl GetLogonOrUserSid(void * __ptr64,void * __ptr64 * __ptr64)" ?GetLogonOrUserSid@@YAHPEAXPEAPEAX@Z
0x140006F40: " " ??_C@_15JNBOKNOG@?$AA?$AN?$AA?6?$AA?$AA@
0x140006E58: "%hs " ??_C@_19JLILDEEC@?$AA?$CF?$AAh?$AAs?$AA?5?$AA?$AA@
0x1400072B8: "WS" ??_C@_15IGAOMGFP@?$AAW?$AAS?$AA?$AA@
0x1400074F0: "LsaGetLogonSessionData" ??_C@_0BH@FCFEOBCP@LsaGetLogonSessionData?$AA@
0x140004498: "long __cdecl GetLsaHandleAndPackageId(char const * __ptr64,void * __ptr64 * __ptr64,unsigned long * __ptr64)" ?GetLsaHandleAndPackageId@@YAJPEBDPEAPEAXPEAK@Z
0x140006430: "__cdecl _imp_wcstoul" __imp_wcstoul
0x1400095C0: "__cdecl commode" _commode
0x140006B98: "RSADSI RC4 " ??_C@_1BK@LLKLLBPK@?$AAR?$AAS?$AAA?$AAD?$AAS?$AAI?$AA?5?$AAR?$AAC?$AA4?$AA?$AN?$AA?6?$AA?$AA@
0x140006AC8: "RSADSI RC4-MD4 " ??_C@_1CC@DAAPLLPO@?$AAR?$AAS?$AAA?$AAD?$AAS?$AAI?$AA?5?$AAR?$AAC?$AA4?$AA?9?$AAM?$AAD?$AA4?$AA?$AN?$AA?6?$AA?$AA@
0x140004D4C: LsaFreeReturnBuffer
0x140006450: "__cdecl _imp_sprintf_s" __imp_sprintf_s
0x140007F28: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-1-0
0x1400071E0: "GC" ??_C@_15NFMBJDFL@?$AAG?$AAC?$AA?$AA@
0x140006F48: "PRIMARY" ??_C@_1BA@MJICFJCI@?$AAP?$AAR?$AAI?$AAM?$AAA?$AAR?$AAY?$AA?$AA@
0x1400061B8: api-ms-win-core-heap-l2-1-0_NULL_THUNK_DATA
0x1400064E0: "__cdecl _imp_NtSetInformationThread" __imp_NtSetInformationThread
0x140006A00: "TimeSkew : %c %I64d:%" ??_C@_1FA@LHLBEMMA@?$AAT?$AAi?$AAm?$AAe?$AAS?$AAk?$AAe?$AAw?$AA?5?$AA?5?$AA?5?$AA?5?$AA?5?$AA?5?$AA?5?$AA?5?$AA?5?$AA?5?$AA?5?$AA?3?$AA?5?$AA?5?$AA?$CF?$AAc?$AA?5?$AA?$CF?$AAI?$AA6?$AA4?$AAd?$AA?3?$AA?$CF@
0x1400054C0: LocWriteMsg
0x140005B60: "long __cdecl __CxxUnhandledExceptionFilter(struct _EXCEPTION_POINTERS * __ptr64)" ?__CxxUnhandledExceptionFilter@@YAJPEAU_EXCEPTION_POINTERS@@@Z
0x140006508: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x140007340: "NEGATIVE" ??_C@_1BC@BAOBGDAI@?$AAN?$AAE?$AAG?$AAA?$AAT?$AAI?$AAV?$AAE?$AA?$AA@
0x1400095CC: "__cdecl fmode" _fmode
0x1400061F8: "__cdecl _imp_FormatMessageW" __imp_FormatMessageW
0x140006EC8: "renewable" ??_C@_09JOMPCGKG@renewable?$AA@
0x140007040: " :" ??_C@_1BC@CJNJCMKK@?$AA?5?$AA?5?$AA?5?$AA?5?$AA?5?$AA?5?$AA?5?$AA?3?$AA?$AA@
0x140007058: "%02x " ??_C@_1M@OMOAGDNC@?$AA?$CF?$AA0?$AA2?$AAx?$AA?5?$AA?$AA@
0x1400064B8: "__cdecl _imp_RtlInitString" __imp_RtlInitString
0x1400073C8: "-li" ??_C@_17MBLGCALJ@?$AA?9?$AAl?$AAi?$AA?$AA@
0x1400072C0: "DS_8" ??_C@_19JIMKKOBK@?$AAD?$AAS?$AA_?$AA8?$AA?$AA@
0x1400069A8: "%#x/%d" ??_C@_1O@COMBNIMC@?$AA?$CF?$AA?$CD?$AAx?$AA?1?$AA?$CF?$AAd?$AA?$AA@
0x140003098: "long __cdecl AddKdcBindingCache(void * __ptr64,unsigned long,unsigned short * __ptr64,unsigned short * __ptr64)" ?AddKdcBindingCache@@YAJPEAXKPEAG1@Z
0x140007558: "LsaConnectUntrusted" ??_C@_0BE@EAEONKAL@LsaConnectUntrusted?$AA@
0x140006C28: "RSADSI RC4-HMAC(Old) " ??_C@_1CO@EIHABNLJ@?$AAR?$AAS?$AAA?$AAD?$AAS?$AAI?$AA?5?$AAR?$AAC?$AA4?$AA?9?$AAH?$AAM?$AAA?$AAC?$AA?$CI?$AAO?$AAl?$AAd?$AA?$CJ?$AA?$AN?$AA?6?$AA?$AA@
0x140005BBE: "__cdecl XcptFilter" _XcptFilter
0x140006510: "__cdecl _xc_a" __xc_a
0x140007498: "purge_bind" ??_C@_1BG@IKCBPBNO@?$AAp?$AAu?$AAr?$AAg?$AAe?$AA_?$AAb?$AAi?$AAn?$AAd?$AA?$AA@
0x140007F3C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-timezone-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-timezone-l1-1-0
0x14000469C: "long __cdecl GetProcessToken(void * __ptr64,void * __ptr64 * __ptr64)" ?GetProcessToken@@YAJPEAXPEAPEAX@Z
0x140006F68: "DELEGATION" ??_C@_1BG@KBECGCLK@?$AAD?$AAE?$AAL?$AAE?$AAG?$AAA?$AAT?$AAI?$AAO?$AAN?$AA?$AA@
0x1400061A0: api-ms-win-core-heap-l1-1-0_NULL_THUNK_DATA
0x140006168: "__cdecl _imp_FileTimeToLocalFileTime" __imp_FileTimeToLocalFileTime
0x1400071E8: "LDAP" ??_C@_19DKCNGKNL@?$AAL?$AAD?$AAA?$AAP?$AA?$AA@
0x140005B41: "__cdecl callnewh" _callnewh
0x140006390: "__cdecl _imp_LsaNtStatusToWinError" __imp_LsaNtStatusToWinError
0x140006218: api-ms-win-core-processenvironment-l1-1-0_NULL_THUNK_DATA
0x140005F4D: memcpy
0x140007480: "query_bind" ??_C@_1BG@ICLNINKL@?$AAq?$AAu?$AAe?$AAr?$AAy?$AA_?$AAb?$AAi?$AAn?$AAd?$AA?$AA@
0x140006DF8: "CachedRemoteInteractive" ??_C@_1DA@HKFCBDHO@?$AAC?$AAa?$AAc?$AAh?$AAe?$AAd?$AAR?$AAe?$AAm?$AAo?$AAt?$AAe?$AAI?$AAn?$AAt?$AAe?$AAr?$AAa?$AAc?$AAt?$AAi?$AAv?$AAe?$AA?$AA@
0x140007320: "LOCAL" ??_C@_1M@GMCGGEIO@?$AAL?$AAO?$AAC?$AAA?$AAL?$AA?$AA@
0x1400063A8: logoncli_NULL_THUNK_DATA
0x140002730: "long __cdecl ShowTickets3(void * __ptr64,unsigned long,struct _LUID * __ptr64,int)" ?ShowTickets3@@YAJPEAXKPEAU_LUID@@H@Z
0x1400024EC: "long __cdecl ShowTickets2(void * __ptr64,unsigned long,struct _LUID * __ptr64,int)" ?ShowTickets2@@YAJPEAXKPEAU_LUID@@H@Z
0x140006480: "__cdecl _imp_memset" __imp_memset
0x140005E59: "__cdecl initterm" _initterm
0x140006398: ext-ms-win-advapi32-lsa-l1-1-2_NULL_THUNK_DATA
0x140007FF0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0
0x140009600: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x1400062C0: "__cdecl _imp_Sleep" __imp_Sleep
0x140001B5C: "void __cdecl ShowNTError2(unsigned long,...)" ?ShowNTError2@@YAXKZZ
0x140006540: "__cdecl _xi_z" __xi_z
0x140006478: "__cdecl _imp___iob_func" __imp___iob_func
0x140006150: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x140005E65: "__cdecl _C_specific_handler" __C_specific_handler
0x140007064: " " ??_C@_13LBAGMAIH@?$AA?6?$AA?$AA@
0x140006288: api-ms-win-core-psapi-l1-1-0_NULL_THUNK_DATA
0x140007270: "NDNC" ??_C@_19INCCPAEC@?$AAN?$AAD?$AAN?$AAC?$AA?$AA@
0x140006198: "__cdecl _imp_HeapFree" __imp_HeapFree
0x140005B35: malloc
0x140008054: "__cdecl _IMPORT_DESCRIPTOR_ext-ms-win-advapi32-lsa-l1-1-2" __IMPORT_DESCRIPTOR_ext-ms-win-advapi32-lsa-l1-1-2
0x140006CE8: "%hs " ??_C@_19FEAEHLBI@?$AA?$CF?$AAh?$AAs?$AA?6?$AA?$AA@
0x140006180: api-ms-win-core-handle-l1-1-0_NULL_THUNK_DATA
0x140007508: "LsaRegisterLogonProcess" ??_C@_0BI@CELDGPFF@LsaRegisterLogonProcess?$AA@
0x1400064C8: "__cdecl _imp_NtQueryInformationToken" __imp_NtQueryInformationToken
0x140005EEC: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x140006D40: "Proxy" ??_C@_1M@LCGAOEJE@?$AAP?$AAr?$AAo?$AAx?$AAy?$AA?$AA@
0x140006D60: "NetworkCleartext" ??_C@_1CC@BKFHFPCO@?$AAN?$AAe?$AAt?$AAw?$AAo?$AAr?$AAk?$AAC?$AAl?$AAe?$AAa?$AAr?$AAt?$AAe?$AAx?$AAt?$AA?$AA@
0x140007EC4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-psapi-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-psapi-l1-1-0
0x1400062B8: api-ms-win-core-string-l1-1-0_NULL_THUNK_DATA
0x140007E9C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0
0x140005C73: "__cdecl amsg_exit" _amsg_exit
0x140006420: "__cdecl _imp__callnewh" __imp__callnewh
0x140007420: "purge" ??_C@_1M@EHHMFIIG@?$AAp?$AAu?$AAr?$AAg?$AAe?$AA?$AA@
0x140006570: " [tickets] [-lh <LogonId.HighPa" ??_C@_1HO@DHMKMKIH@?$AA?5?$AA?5?$AA?$FL?$AAt?$AAi?$AAc?$AAk?$AAe?$AAt?$AAs?$AA?$FN?$AA?5?$AA?$FL?$AA?9?$AAl?$AAh?$AA?5?$AA?$DM?$AAL?$AAo?$AAg?$AAo?$AAn?$AAI?$AAd?$AA?4?$AAH?$AAi?$AAg?$AAh?$AAP?$AAa@
0x1400074B8: "Kerberos" ??_C@_08DEIMIBAF@Kerberos?$AA@
0x140007448: "kcd_cache" ??_C@_1BE@KLCMFIKG@?$AAk?$AAc?$AAd?$AA_?$AAc?$AAa?$AAc?$AAh?$AAe?$AA?$AA@
0x140006F28: "reserved1" ??_C@_09LGGPCJCM@reserved1?$AA@
0x140006460: "__cdecl _imp_exit" __imp_exit
0x140006D20: "Batch" ??_C@_1M@DOLPECMD@?$AAB?$AAa?$AAt?$AAc?$AAh?$AA?$AA@
0x1400062B0: "__cdecl _imp_WideCharToMultiByte" __imp_WideCharToMultiByte
0x140007540: "LsaFreeReturnBuffer" ??_C@_0BE@FBEPJBPB@LsaFreeReturnBuffer?$AA@
0x1400095D0: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUwhUhvxfirgbUgllohUporhgUlyquivUznwGEUkivxlnkOlyq@klist" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUwhUhvxfirgbUgllohUporhgUlyquivUznwGEUkivxlnkOlyq@klist
0x1400072D0: "PING" ??_C@_19KACCMDJP@?$AAP?$AAI?$AAN?$AAG?$AA?$AA@
0x140006118: "__cdecl _imp_LsaEnumerateLogonSessions" __imp_LsaEnumerateLogonSessions
0x140006360: "__cdecl _imp_GetSidLengthRequired" __imp_GetSidLengthRequired
0x140006E88: "proxiable" ??_C@_09KBOEEHFI@proxiable?$AA@
0x140006EE0: "pre_authent" ??_C@_0M@CAJGDNO@pre_authent?$AA@
0x1400018D0: "void __cdecl PrintHexDump(unsigned long,unsigned char * __ptr64)" ?PrintHexDump@@YAXKPEAE@Z
0x140006158: api-ms-win-core-errorhandling-l1-1-0_NULL_THUNK_DATA
0x140007770: "Error loading resource: 0x%08x " ??_C@_1EA@KNKFBJCG@?$AAE?$AAr?$AAr?$AAo?$AAr?$AA?5?$AAl?$AAo?$AAa?$AAd?$AAi?$AAn?$AAg?$AA?5?$AAr?$AAe?$AAs?$AAo?$AAu?$AAr?$AAc?$AAe?$AA?3?$AA?5?$AA0?$AAx?$AA?$CF?$AA0?$AA8?$AAx?$AA?6?$AA?$AA@
0x140006250: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x1400016C8: "void __cdecl PrintTime(unsigned long,union _LARGE_INTEGER)" ?PrintTime@@YAXKT_LARGE_INTEGER@@@Z
0x140001424: "void __cdecl Usage(void)" ?Usage@@YAXXZ
0x1400071B0: "FORCE_REDISCOVERY" ??_C@_1CE@PIOGKFBH@?$AAF?$AAO?$AAR?$AAC?$AAE?$AA_?$AAR?$AAE?$AAD?$AAI?$AAS?$AAC?$AAO?$AAV?$AAE?$AAR?$AAY?$AA?$AA@
0x1400095F0: "__cdecl _native_startup_lock" __native_startup_lock
0x1400071F4: "DS" ??_C@_15DEMLGGK@?$AAD?$AAS?$AA?$AA@
0x140005BA0: "__cdecl _CxxSetUnhandledExceptionFilter" __CxxSetUnhandledExceptionFilter
0x140008040: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-string-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-string-l1-1-0
0x140006440: "__cdecl _imp__wcsicmp" __imp__wcsicmp
0x140006E94: "proxy" ??_C@_05BFHPMDA@proxy?$AA@
0x140006BB8: "RSADSI RC4-HMAC(NT)(Export) " ??_C@_1DM@CEKBDINA@?$AAR?$AAS?$AAA?$AAD?$AAS?$AAI?$AA?5?$AAR?$AAC?$AA4?$AA?9?$AAH?$AAM?$AAA?$AAC?$AA?$CI?$AAN?$AAT?$AA?$CJ?$AA?$CI?$AAE?$AAx?$AAp?$AAo?$AAr?$AAt?$AA?$CJ?$AA?$AN?$AA?6?$AA?$AA@
0x140006318: "__cdecl _imp_IsValidSid" __imp_IsValidSid
0x1400063C0: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x14000706C: " " ??_C@_13KDLDGPGJ@?$AA?7?$AA?$AA@
0x140006298: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x1400061E0: api-ms-win-core-libraryloader-l1-2-0_NULL_THUNK_DATA
0x1400061F0: api-ms-win-core-libraryloader-l1-2-1_NULL_THUNK_DATA
0x140006880: " [-kdcoptions <option" ??_C@_1IA@BDICPDNK@?$AA?5?$AA?5?$AA?5?$AA?5?$AA?5?$AA?5?$AA?5?$AA?5?$AA?5?$AA?5?$AA?5?$AA?5?$AA?$FL?$AA?9?$AAk?$AAd?$AAc?$AAo?$AAp?$AAt?$AAi?$AAo?$AAn?$AAs?$AA?5?$AA?$DM?$AAo?$AAp?$AAt?$AAi?$AAo?$AAn@
0x140006148: "__cdecl _imp_GetLastError" __imp_GetLastError
0x1400054E4: "void * __ptr64 __cdecl operator new(unsigned __int64)" ??2@YAPEAX_K@Z
0x140007188: "NEXTCLOSEST_SITE" ??_C@_1CC@IODCMLOO@?$AAN?$AAE?$AAX?$AAT?$AAC?$AAL?$AAO?$AAS?$AAE?$AAS?$AAT?$AA_?$AAS?$AAI?$AAT?$AAE?$AA?$AA@
0x140006600: " tgt [-lh <LogonId.HighPart>] [" ??_C@_1HC@HKGEGAIC@?$AA?5?$AA?5?$AAt?$AAg?$AAt?$AA?5?$AA?$FL?$AA?9?$AAl?$AAh?$AA?5?$AA?$DM?$AAL?$AAo?$AAg?$AAo?$AAn?$AAI?$AAd?$AA?4?$AAH?$AAi?$AAg?$AAh?$AAP?$AAa?$AAr?$AAt?$AA?$DO?$AA?$FN?$AA?5?$AA?$FL@
0x140004EAC: LsaDeregisterLogonProcess
0x140005EC8: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x140006458: "__cdecl _imp__snwprintf_s" __imp__snwprintf_s
0x140001B98: "void __cdecl PrintTicketFlags(unsigned short * __ptr64,unsigned short * __ptr64,unsigned long)" ?PrintTicketFlags@@YAXPEAG0K@Z
0x1400063B0: "__cdecl _imp__commode" __imp__commode
0x1400063D0: "__cdecl _imp___setusermatherr" __imp___setusermatherr
0x1400064B0: "__cdecl _imp_RtlAdjustPrivilege" __imp_RtlAdjustPrivilege
0x1400062F8: "__cdecl _imp_EqualSid" __imp_EqualSid
0x140006248: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x140007200: "KDC" ??_C@_17PDECEBIE@?$AAK?$AAD?$AAC?$AA?$AA@
0x140005D40: "__cdecl ValidateImageBase" _ValidateImageBase
0x1400074B0: "-h" ??_C@_15LJNJHFI@?$AA?9?$AAh?$AA?$AA@
0x140006348: "__cdecl _imp_DuplicateTokenEx" __imp_DuplicateTokenEx
0x1400050D8: LocInitializeIO
0x140007360: "Error initializing localized out" ??_C@_1FK@HGOACNEK@?$AAE?$AAr?$AAr?$AAo?$AAr?$AA?5?$AAi?$AAn?$AAi?$AAt?$AAi?$AAa?$AAl?$AAi?$AAz?$AAi?$AAn?$AAg?$AA?5?$AAl?$AAo?$AAc?$AAa?$AAl?$AAi?$AAz?$AAe?$AAd?$AA?5?$AAo?$AAu?$AAt@
0x140007F14: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0
0x140003380: "void __cdecl PrintBindingCacheDcFlags(unsigned short * __ptr64,unsigned short * __ptr64,unsigned long)" ?PrintBindingCacheDcFlags@@YAXPEAG0K@Z
0x140006188: "__cdecl _imp_HeapAlloc" __imp_HeapAlloc
0x1400061C8: "__cdecl _imp_FreeLibrary" __imp_FreeLibrary
0x140006260: "__cdecl _imp_OpenProcess" __imp_OpenProcess
0x1400095C8: "__cdecl newmode" _newmode
0x140005E98: "__cdecl _acrt_iob_func" __acrt_iob_func
0x1400063C8: "__cdecl _imp__initterm" __imp__initterm
0x1400063E8: "__cdecl _imp___set_app_type" __imp___set_app_type
0x140006E28: "CachedUnlock" ??_C@_1BK@NKBKLJFL@?$AAC?$AAa?$AAc?$AAh?$AAe?$AAd?$AAU?$AAn?$AAl?$AAo?$AAc?$AAk?$AA?$AA@
0x140006370: "__cdecl _imp_SetEntriesInAclW" __imp_SetEntriesInAclW
0x140006140: "__cdecl _imp_SetLastError" __imp_SetLastError
0x140006F10: "name_canonicalize" ??_C@_0BC@PJBPHCEP@name_canonicalize?$AA@
0x140008018: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-console-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-console-l1-1-0
0x140005058: StringCchPrintfW
0x140006338: "__cdecl _imp_InitializeSecurityDescriptor" __imp_InitializeSecurityDescriptor
0x1400075C0: "Error(%#x): failed to construct " ??_C@_1GG@LCDADNKL@?$AAE?$AAr?$AAr?$AAo?$AAr?$AA?$CI?$AA?$CF?$AA?$CD?$AAx?$AA?$CJ?$AA?3?$AA?5?$AAf?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAc?$AAo?$AAn?$AAs?$AAt?$AAr?$AAu?$AAc?$AAt?$AA?5@
0x1400095E0: "__cdecl _onexitend" __onexitend
0x1400063E0: "__cdecl _imp__exit" __imp__exit
0x140007EEC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-1" __IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-1
0x140006500: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x140007100: "PDC_REQUIRED" ??_C@_1BK@MOJIALGN@?$AAP?$AAD?$AAC?$AA_?$AAR?$AAE?$AAQ?$AAU?$AAI?$AAR?$AAE?$AAD?$AA?$AA@
0x140002C14: "long __cdecl ShowS4U2ProxyCacheForLogonSession(void * __ptr64,unsigned long,struct _LUID * __ptr64)" ?ShowS4U2ProxyCacheForLogonSession@@YAJPEAXKPEAU_LUID@@@Z
0x140007520: "LsaLookupAuthenticationPackage" ??_C@_0BP@OOIEHDKO@LsaLookupAuthenticationPackage?$AA@
0x140006240: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x140006498: netutils_NULL_THUNK_DATA
0x140006FE0: "HUB-PRIMARY" ??_C@_1BI@LMCCBFB@?$AAH?$AAU?$AAB?$AA?9?$AAP?$AAR?$AAI?$AAM?$AAA?$AAR?$AAY?$AA?$AA@
0x140006310: "__cdecl _imp_GetTokenInformation" __imp_GetTokenInformation
0x140006B38: "Kerberos DES-Plain " ??_C@_1CK@KPALDIHO@?$AAK?$AAe?$AAr?$AAb?$AAe?$AAr?$AAo?$AAs?$AA?5?$AAD?$AAE?$AAS?$AA?9?$AAP?$AAl?$AAa?$AAi?$AAn?$AA?$AN?$AA?6?$AA?$AA@
0x140006438: "__cdecl _imp_wcstol" __imp_wcstol
0x140006468: "__cdecl _imp__wsetlocale" __imp__wsetlocale
0x1400035C4: "long __cdecl QueryKdcBindingCache(void * __ptr64,unsigned long)" ?QueryKdcBindingCache@@YAJPEAXK@Z
0x140007418: "tgt" ??_C@_17EDGLLHNF@?$AAt?$AAg?$AAt?$AA?$AA@
0x140006AF0: "RSADSI RC4-PLAIN " ??_C@_1CG@IHILFAGE@?$AAR?$AAS?$AAA?$AAD?$AAS?$AAI?$AA?5?$AAR?$AAC?$AA4?$AA?9?$AAP?$AAL?$AAA?$AAI?$AAN?$AA?$AN?$AA?6?$AA?$AA@
0x140004BC4: LsaRegisterLogonProcess
0x1400075B0: ".%d" ??_C@_17JFAEKECD@?$AA?4?$AA?$CF?$AAd?$AA?$AA@
0x140006F58: "%ws " ??_C@_19DOBABHMF@?$AA?$CF?$AAw?$AAs?$AA?5?$AA?$AA@
0x1400052D8: LocWriteStringMsg
0x1400062E0: api-ms-win-core-sysinfo-l1-1-0_NULL_THUNK_DATA
0x140006528: "__cdecl _xi_a" __xi_a
0x1400095D8: "struct HINSTANCE__ * __ptr64 __ptr64 ModuleHandle" ?ModuleHandle@@3PEAUHINSTANCE__@@EA
0x140006268: api-ms-win-core-processthreads-l1-1-1_NULL_THUNK_DATA
0x1400062D8: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x140005E50: "__cdecl matherr" _matherr
0x14000151C: "long __cdecl GetDescription(unsigned long,unsigned long,unsigned short * __ptr64)" ?GetDescription@@YAJKKPEAG@Z
0x140003A50: wmain
0x140006FA8: "X509" ??_C@_19PCMCLMKK@?$AAX?$AA5?$AA0?$AA9?$AA?$AA@
0x140006368: api-ms-win-security-base-l1-1-0_NULL_THUNK_DATA
0x1400064D8: "__cdecl _imp_NtOpenThreadToken" __imp_NtOpenThreadToken
0x140006490: "__cdecl _imp_NetApiBufferFree" __imp_NetApiBufferFree
0x1400065F0: "%s" ??_C@_15GANGMFKL@?$AA?$CF?$AAs?$AA?$AA@
0x1400074C4: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x140007F8C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0
0x140007FA0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-1" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-1
0x140005A38: "__cdecl _report_rangecheckfailure" __report_rangecheckfailure
0x1400073D0: "-kdcoptions" ??_C@_1BI@CDENCHNH@?$AA?9?$AAk?$AAd?$AAc?$AAo?$AAp?$AAt?$AAi?$AAo?$AAn?$AAs?$AA?$AA@
0x140005524: "void __cdecl operator delete(void * __ptr64)" ??3@YAXPEAX@Z
0x1400069C0: "%ld/%ld/%ld %ld:%2.2ld:%2.2ld " ??_C@_1DO@BIPLMJFE@?$AA?$CF?$AAl?$AAd?$AA?1?$AA?$CF?$AAl?$AAd?$AA?1?$AA?$CF?$AAl?$AAd?$AA?5?$AA?$CF?$AAl?$AAd?$AA?3?$AA?$CF?$AA2?$AA?4?$AA2?$AAl?$AAd?$AA?3?$AA?$CF?$AA2?$AA?4?$AA2?$AAl?$AAd?$AA?5?$AA?$AA@
0x140006120: SspiCli_NULL_THUNK_DATA
0x140008004: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-l1-1-0
0x140005860: "__cdecl _security_check_cookie" __security_check_cookie
0x140006128: "__cdecl _imp_GetConsoleOutputCP" __imp_GetConsoleOutputCP
0x140006E78: "forwarded" ??_C@_09DPJPHNOP@forwarded?$AA@
0x140007468: "add_bind" ??_C@_1BC@DKJPCLOP@?$AAa?$AAd?$AAd?$AA_?$AAb?$AAi?$AAn?$AAd?$AA?$AA@
0x140006520: "__cdecl _xc_z" __xc_z
0x140007E88: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0
0x140006258: api-ms-win-core-processthreads-l1-1-0_NULL_THUNK_DATA
0x1400061D8: "__cdecl _imp_GetProcAddress" __imp_GetProcAddress
0x140008068: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-provider-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-provider-l1-1-0
0x1400064D0: "__cdecl _imp_NtDuplicateToken" __imp_NtDuplicateToken
0x140001DA0: "void __cdecl PrintS4U2ProxyCacheFlags(unsigned short * __ptr64,unsigned short * __ptr64,unsigned long)" ?PrintS4U2ProxyCacheFlags@@YAXPEAG0K@Z
0x140006350: "__cdecl _imp_GetKernelObjectSecurity" __imp_GetKernelObjectSecurity
0x140007140: "DS_8_REQUIRED" ??_C@_1BM@OGJOAGNE@?$AAD?$AAS?$AA_?$AA8?$AA_?$AAR?$AAE?$AAQ?$AAU?$AAI?$AAR?$AAE?$AAD?$AA?$AA@
0x140006400: "__cdecl _imp_?terminate@@YAXXZ" __imp_?terminate@@YAXXZ
0x140007F78: "__cdecl _IMPORT_DESCRIPTOR_netutils" __IMPORT_DESCRIPTOR_netutils
0x1400062D0: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x140006280: "__cdecl _imp_K32EnumProcesses" __imp_K32EnumProcesses
0x140006210: "__cdecl _imp_GetStdHandle" __imp_GetStdHandle
0x1400061B0: "__cdecl _imp_LocalAlloc" __imp_LocalAlloc
0x140004B04: LsaGetLogonSessionData
0x1400073C0: "-lh" ??_C@_17HJAKEHNM@?$AA?9?$AAl?$AAh?$AA?$AA@
0x140006680: " purge [-lh <LogonId.HighPart>]" ??_C@_1HG@CJHHNHJJ@?$AA?5?$AA?5?$AAp?$AAu?$AAr?$AAg?$AAe?$AA?5?$AA?$FL?$AA?9?$AAl?$AAh?$AA?5?$AA?$DM?$AAL?$AAo?$AAg?$AAo?$AAn?$AAI?$AAd?$AA?4?$AAH?$AAi?$AAg?$AAh?$AAP?$AAa?$AAr?$AAt?$AA?$DO?$AA?$FN@
0x140006190: "__cdecl _imp_GetProcessHeap" __imp_GetProcessHeap
0x1400070B0: " %d %#x:%#x %wZ\%wZ %wZ:(%d) " ??_C@_1DO@LGGNAMLA@?$AA?5?$AA?$CF?$AAd?$AA?5?$AA?$CF?$AA?$CD?$AAx?$AA?3?$AA?$CF?$AA?$CD?$AAx?$AA?5?$AA?$CF?$AAw?$AAZ?$AA?2?$AA?$CF?$AAw?$AAZ?$AA?5?$AA?$CF?$AAw?$AAZ?$AA?3?$AA?$CI?$AA?$CF?$AAd?$AA?$CJ?$AA?$AN?$AA?6?$AA?$AA@
0x140006A68: "Kerberos DES-CBC-CRC " ??_C@_1CO@OMPLEDDI@?$AAK?$AAe?$AAr?$AAb?$AAe?$AAr?$AAo?$AAs?$AA?5?$AAD?$AAE?$AAS?$AA?9?$AAC?$AAB?$AAC?$AA?9?$AAC?$AAR?$AAC?$AA?$AN?$AA?6?$AA?$AA@
0x140007028: "Negative" ??_C@_1BC@MDDOHANL@?$AAN?$AAe?$AAg?$AAa?$AAt?$AAi?$AAv?$AAe?$AA?$AA@
0x140006ED8: "initial" ??_C@_07GLCKIJBG@initial?$AA@
0x140006F00: "ok_as_delegate" ??_C@_0P@CBPMEHOM@ok_as_delegate?$AA@
0x140007720: "Error(%#x): string composition f" ??_C@_1FA@FMAOBMLA@?$AAE?$AAr?$AAr?$AAo?$AAr?$AA?$CI?$AA?$CF?$AA?$CD?$AAx?$AA?$CJ?$AA?3?$AA?5?$AAs?$AAt?$AAr?$AAi?$AAn?$AAg?$AA?5?$AAc?$AAo?$AAm?$AAp?$AAo?$AAs?$AAi?$AAt?$AAi?$AAo?$AAn?$AA?5?$AAf@
0x1400062A8: api-ms-win-core-rtlsupport-l1-1-0_NULL_THUNK_DATA
0x140006E68: "forwardable" ??_C@_0M@HOPOIJIH@forwardable?$AA@
0x140007FC8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0
0x1400072F0: "DNS_DOMAIN" ??_C@_1BG@BCCPCBEP@?$AAD?$AAN?$AAS?$AA_?$AAD?$AAO?$AAM?$AAA?$AAI?$AAN?$AA?$AA@
0x140006278: api-ms-win-core-profile-l1-1-0_NULL_THUNK_DATA
0x140002B10: "long __cdecl ShowOneLogonSession(struct _LUID * __ptr64)" ?ShowOneLogonSession@@YAJPEAU_LUID@@@Z
0x140006548: "__cdecl _guard_fids_table" __guard_fids_table
0x140006320: "__cdecl _imp_CreateWellKnownSid" __imp_CreateWellKnownSid
0x140006488: msvcrt_NULL_THUNK_DATA
0x140006010: "__cdecl load_config_used" _load_config_used
0x140006FF8: "DISABLE-TGT-DELEGATION" ??_C@_1CO@IIEGJPJG@?$AAD?$AAI?$AAS?$AAA?$AAB?$AAL?$AAE?$AA?9?$AAT?$AAG?$AAT?$AA?9?$AAD?$AAE?$AAL?$AAE?$AAG?$AAA?$AAT?$AAI?$AAO?$AAN?$AA?$AA@
0x140006D30: "Service" ??_C@_1BA@IELBACJJ@?$AAS?$AAe?$AAr?$AAv?$AAi?$AAc?$AAe?$AA?$AA@
0x140006F80: "S4U" ??_C@_17CCEMGOJI@?$AAS?$AA4?$AAU?$AA?$AA@
0x140006958: " purge_bind " ??_C@_1BO@FINDAAAJ@?$AA?5?$AA?5?$AAp?$AAu?$AAr?$AAg?$AAe?$AA_?$AAb?$AAi?$AAn?$AAd?$AA?$AN?$AA?6?$AA?$AA@
0x140007630: "Error(%#x): start of conversion " ??_C@_1HK@PLFBFLFJ@?$AAE?$AAr?$AAr?$AAo?$AAr?$AA?$CI?$AA?$CF?$AA?$CD?$AAx?$AA?$CJ?$AA?3?$AA?5?$AAs?$AAt?$AAa?$AAr?$AAt?$AA?5?$AAo?$AAf?$AA?5?$AAc?$AAo?$AAn?$AAv?$AAe?$AAr?$AAs?$AAi?$AAo?$AAn?$AA?5@
0x140006F90: "ENC-IN-SKEY" ??_C@_1BI@JHHMEJBG@?$AAE?$AAN?$AAC?$AA?9?$AAI?$AAN?$AA?9?$AAS?$AAK?$AAE?$AAY?$AA?$AA@
0x140006388: api-ms-win-security-trustee-l1-1-0_NULL_THUNK_DATA
0x14000802C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processenvironment-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processenvironment-l1-1-0
0x140006A98: "Kerberos DES-CBC-MD5 " ??_C@_1CO@EFEFPJJO@?$AAK?$AAe?$AAr?$AAb?$AAe?$AAr?$AAo?$AAs?$AA?5?$AAD?$AAE?$AAS?$AA?9?$AAC?$AAB?$AAC?$AA?9?$AAM?$AAD?$AA5?$AA?$AN?$AA?6?$AA?$AA@
0x140006FB8: "FAST" ??_C@_19KEJDMALB@?$AAF?$AAA?$AAS?$AAT?$AA?$AA@
0x140006CC8: "0123456789abcdef" ??_C@_0BB@JCEFLFJE@0123456789abcdef?$AA@
0x140006308: "__cdecl _imp_SetKernelObjectSecurity" __imp_SetKernelObjectSecurity
0x140006470: "__cdecl _imp__amsg_exit" __imp__amsg_exit
0x1400070F0: "[%d] " ??_C@_1M@CEDEBFFA@?$AA?$FL?$AA?$CF?$AAd?$AA?$FN?$AA?5?$AA?$AA@
0x1400064F0: "__cdecl _imp_NtClose" __imp_NtClose
0x1400061D0: "__cdecl _imp_LoadStringW" __imp_LoadStringW
0x1400062E8: "__cdecl _imp_FileTimeToSystemTime" __imp_FileTimeToSystemTime
0x140006D50: "Unlock" ??_C@_1O@OMNIMHMB@?$AAU?$AAn?$AAl?$AAo?$AAc?$AAk?$AA?$AA@
0x140006290: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x140006270: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x1400095C4: "__cdecl dowildcard" _dowildcard
0x140004F5C: LsaCallAuthenticationPackage
0x140001008: "long __cdecl ImpersonateSystemToken(class TImpersonation * __ptr64 * __ptr64)" ?ImpersonateSystemToken@@YAJPEAPEAVTImpersonation@@@Z
0x140005B4D: free
0x140001A80: "unsigned short * __ptr64 __cdecl LogonType2String(unsigned long)" ?LogonType2String@@YAPEAGK@Z
0x1400064E8: "__cdecl _imp_RtlIpv4StringToAddressExW" __imp_RtlIpv4StringToAddressExW
0x1400064A0: "__cdecl _imp_RtlIpv6StringToAddressExW" __imp_RtlIpv6StringToAddressExW
0x1400062A0: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x140007280: "PARTIAL_SECRET" ??_C@_1BO@OOMMOEEI@?$AAP?$AAA?$AAR?$AAT?$AAI?$AAA?$AAL?$AA_?$AAS?$AAE?$AAC?$AAR?$AAE?$AAT?$AA?$AA@
0x140007F64: "__cdecl _IMPORT_DESCRIPTOR_logoncli" __IMPORT_DESCRIPTOR_logoncli
0x140007408: "tickets" ??_C@_1BA@DNGBJEFI@?$AAt?$AAi?$AAc?$AAk?$AAe?$AAt?$AAs?$AA?$AA@
0x140005E80: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x140006208: api-ms-win-core-localization-l1-2-0_NULL_THUNK_DATA
0x140006E48: "reserved" ??_C@_08FINKBBAF@reserved?$AA@
0x140005BCC: RtlpImageNtHeader
0x140007308: "DNS_FOREST" ??_C@_1BG@DMEHKHHL@?$AAD?$AAN?$AAS?$AA_?$AAF?$AAO?$AAR?$AAE?$AAS?$AAT?$AA?$AA@
0x140007068: ":" ??_C@_13EBCNDICG@?$AA?3?$AA?$AA@
0x140006CE0: "%4.4x " ??_C@_07BNCCFNNE@?$CF4?44x?5?5?$AA@
0x1400074C8: "Winlogon" ??_C@_08GBLIGBPF@Winlogon?$AA@
0x140007ED8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0
0x1400061C0: "__cdecl _imp_GetModuleHandleW" __imp_GetModuleHandleW
0x140006380: "__cdecl _imp_BuildTrusteeWithSidW" __imp_BuildTrusteeWithSidW
0x1400063A0: "__cdecl _imp_DsGetDcNameW" __imp_DsGetDcNameW
0x140006410: "__cdecl _imp__XcptFilter" __imp__XcptFilter
0x140006200: "__cdecl _imp_SetThreadUILanguage" __imp_SetThreadUILanguage
0x140006448: "__cdecl _imp_fwprintf" __imp_fwprintf
0x140006FC8: "COMPOUND" ??_C@_1BC@PBBANECP@?$AAC?$AAO?$AAM?$AAP?$AAO?$AAU?$AAN?$AAD?$AA?$AA@
0x1400064F8: ntdll_NULL_THUNK_DATA
0x1400063F8: "__cdecl _imp_memcpy" __imp_memcpy
0x140006340: "__cdecl _imp_GetSecurityDescriptorDacl" __imp_GetSecurityDescriptorDacl
0x140007F50: "__cdecl _IMPORT_DESCRIPTOR_SspiCli" __IMPORT_DESCRIPTOR_SspiCli
0x140005EBC: "__cdecl _iob_func" __iob_func
0x1400072A0: "FULL_SECRET" ??_C@_1BI@GODIFNCB@?$AAF?$AAU?$AAL?$AAL?$AA_?$AAS?$AAE?$AAC?$AAR?$AAE?$AAT?$AA?$AA@
0x140006F38: "%#x" ??_C@_17EPILDEP@?$AA?$CF?$AA?$CD?$AAx?$AA?$AA@
0x140006358: "__cdecl _imp_GetSidSubAuthorityCount" __imp_GetSidSubAuthorityCount
0x140009008: "__cdecl _security_cookie" __security_cookie
0x140007160: "WRITABLE_REQUIRED" ??_C@_1CE@PCJFBOEL@?$AAW?$AAR?$AAI?$AAT?$AAA?$AAB?$AAL?$AAE?$AA_?$AAR?$AAE?$AAQ?$AAU?$AAI?$AAR?$AAE?$AAD?$AA?$AA@
0x140006A50: "NULL CS " ??_C@_1BE@CLNIOBLG@?$AAN?$AAU?$AAL?$AAL?$AA?5?$AAC?$AAS?$AA?$AN?$AA?6?$AA?$AA@
0x140006B18: "RSADSI RC4-LM " ??_C@_1CA@CAOBBMLH@?$AAR?$AAS?$AAA?$AAD?$AAS?$AAI?$AA?5?$AAR?$AAC?$AA4?$AA?9?$AAL?$AAM?$AA?$AN?$AA?6?$AA?$AA@
0x14000230C: "long __cdecl ShowTickets(void * __ptr64,unsigned long,struct _LUID * __ptr64,int)" ?ShowTickets@@YAJPEAXKPEAU_LUID@@H@Z
0x140006BF8: "RSADSI RC4(Export) " ??_C@_1CK@FOKIACPH@?$AAR?$AAS?$AAA?$AAD?$AAS?$AAI?$AA?5?$AAR?$AAC?$AA4?$AA?$CI?$AAE?$AAx?$AAp?$AAo?$AAr?$AAt?$AA?$CJ?$AA?$AN?$AA?6?$AA?$AA@
0x140006DD0: "CachedInteractive" ??_C@_1CE@MIDCKDKG@?$AAC?$AAa?$AAc?$AAh?$AAe?$AAd?$AAI?$AAn?$AAt?$AAe?$AAr?$AAa?$AAc?$AAt?$AAi?$AAv?$AAe?$AA?$AA@
0x140006C58: "AES-128-CTS-HMAC-SHA1-96 " ??_C@_1DG@CDMNJFHK@?$AAA?$AAE?$AAS?$AA?9?$AA1?$AA2?$AA8?$AA?9?$AAC?$AAT?$AAS?$AA?9?$AAH?$AAM?$AAA?$AAC?$AA?9?$AAS?$AAH?$AAA?$AA1?$AA?9?$AA9?$AA6?$AA?$AN?$AA?6?$AA?$AA@
0x140006178: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x140007208: "TIMESERV" ??_C@_1BC@DGJKHMOC@?$AAT?$AAI?$AAM?$AAE?$AAS?$AAE?$AAR?$AAV?$AA?$AA@
0x1400061A8: "__cdecl _imp_LocalFree" __imp_LocalFree
0x140006300: "__cdecl _imp_GetLengthSid" __imp_GetLengthSid
0x140009000: "__cdecl _defaultmatherr" __defaultmatherr
0x140007EB0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0
0x140007258: "GTIMESERV" ??_C@_1BE@IKOICOKH@?$AAG?$AAT?$AAI?$AAM?$AAE?$AAS?$AAE?$AAR?$AAV?$AA?$AA@
0x140007590: "LsaCallAuthenticationPackage" ??_C@_0BN@HFCMCMJP@LsaCallAuthenticationPackage?$AA@
0x1400061E8: "__cdecl _imp_LoadLibraryW" __imp_LoadLibraryW
0x140003984: "long __cdecl ShowTicketGrantingTicket(void * __ptr64,unsigned long,struct _LUID * __ptr64)" ?ShowTicketGrantingTicket@@YAJPEAXKPEAU_LUID@@@Z
0x140006330: "__cdecl _imp_CopySid" __imp_CopySid
0x1400095E8: "__cdecl _onexitbegin" __onexitbegin
0x1400076B0: "Error(%#x): memory allocation (%" ??_C@_1GG@IBCJBNJB@?$AAE?$AAr?$AAr?$AAo?$AAr?$AA?$CI?$AA?$CF?$AA?$CD?$AAx?$AA?$CJ?$AA?3?$AA?5?$AAm?$AAe?$AAm?$AAo?$AAr?$AAy?$AA?5?$AAa?$AAl?$AAl?$AAo?$AAc?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?5?$AA?$CI?$AA?$CF@
0x140002F10: "long __cdecl GetTicket(void * __ptr64,unsigned long,struct _LUID * __ptr64,unsigned short * __ptr64,unsigned long,unsigned long)" ?GetTicket@@YAJPEAXKPEAU_LUID@@PEAGKK@Z
0x140006408: "__cdecl _imp__vsnwprintf" __imp__vsnwprintf
0x140007570: "LsaDeregisterLogonProcess" ??_C@_0BK@IPLPBOAA@LsaDeregisterLogonProcess?$AA@
0x14000538C: VLocWriteMsg
0x140006138: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x140006238: "__cdecl _imp_GetCurrentThread" __imp_GetCurrentThread
0x140007240: "WRITABLE" ??_C@_1BC@LMBPFJHN@?$AAW?$AAR?$AAI?$AAT?$AAA?$AAB?$AAL?$AAE?$AA?$AA@
0x140006C90: "AES-256-CTS-HMAC-SHA1-96 " ??_C@_1DG@MKDLCLA@?$AAA?$AAE?$AAS?$AA?9?$AA2?$AA5?$AA6?$AA?9?$AAC?$AAT?$AAS?$AA?9?$AAH?$AAM?$AAA?$AAC?$AA?9?$AAS?$AAH?$AAA?$AA1?$AA?9?$AA9?$AA6?$AA?$AN?$AA?6?$AA?$AA@
0x140006130: api-ms-win-core-console-l1-1-0_NULL_THUNK_DATA
0x140005D74: "__cdecl _security_init_cookie" __security_init_cookie
0x1400063D8: "__cdecl _imp__cexit" __imp__cexit
0x140006938: " query_bind " ??_C@_1BO@IKPGIMLH@?$AA?5?$AA?5?$AAq?$AAu?$AAe?$AAr?$AAy?$AA_?$AAb?$AAi?$AAn?$AAd?$AA?$AN?$AA?6?$AA?$AA@
0x140005C28: "__cdecl get_image_app_type" _get_image_app_type
0x140006328: "__cdecl _imp_SetSecurityDescriptorDacl" __imp_SetSecurityDescriptorDacl
0x1400017B8: "void __cdecl PrintEType(int)" ?PrintEType@@YAXH@Z
0x140007E74: "__cdecl _IMPORT_DESCRIPTOR_msvcrt" __IMPORT_DESCRIPTOR_msvcrt
0x140001E14: "void __cdecl PrintTicket(struct _KERB_EXTERNAL_TICKET * __ptr64)" ?PrintTicket@@YAXPEAU_KERB_EXTERNAL_TICKET@@@Z
0x140007460: "get" ??_C@_17PMJHCABG@?$AAg?$AAe?$AAt?$AA?$AA@
0x140005830: wmainCRTStartup
0x140006DA8: "RemoteInteractive" ??_C@_1CE@MMIEFBLO@?$AAR?$AAe?$AAm?$AAo?$AAt?$AAe?$AAI?$AAn?$AAt?$AAe?$AAr?$AAa?$AAc?$AAt?$AAi?$AAv?$AAe?$AA?$AA@
0x140006900: " add_bind <DOMAIN> <DC> " ??_C@_1DG@BKNOHAFO@?$AA?5?$AA?5?$AAa?$AAd?$AAd?$AA_?$AAb?$AAi?$AAn?$AAd?$AA?5?$AA?$DM?$AAD?$AAO?$AAM?$AAA?$AAI?$AAN?$AA?$DO?$AA?5?$AA?$DM?$AAD?$AAC?$AA?$DO?$AA?$AN?$AA?6?$AA?$AA@
0x140006428: "__cdecl _imp_malloc" __imp_malloc
0x140006160: "__cdecl _imp_WriteFile" __imp_WriteFile
0x140004578: "long __cdecl Impersonate(void * __ptr64)" ?Impersonate@@YAJPEAX@Z
0x1400058C0: "__cdecl _report_gsfailure" __report_gsfailure
0x1400062F0: api-ms-win-core-timezone-l1-1-0_NULL_THUNK_DATA
0x140006EC0: "invalid" ??_C@_07MALOAKCI@invalid?$AA@
0x1400072E0: "DNS_DC" ??_C@_1O@GMEOPJLE@?$AAD?$AAN?$AAS?$AA_?$AAD?$AAC?$AA?$AA@
0x140006CF8: "Interactive" ??_C@_1BI@NFOKHDOD@?$AAI?$AAn?$AAt?$AAe?$AAr?$AAa?$AAc?$AAt?$AAi?$AAv?$AAe?$AA?$AA@
0x1400095F8: "__cdecl _native_startup_state" __native_startup_state
0x140006978: "ntdll.dll" ??_C@_1BE@GJOFHIHD@?$AAn?$AAt?$AAd?$AAl?$AAl?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x14000807C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-trustee-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-trustee-l1-1-0
0x140006EB0: "postdated" ??_C@_09MPPJLNDN@postdated?$AA@
0x140006B68: "RSADSI RC4-HMAC(NT) " ??_C@_1CM@FFBBMODA@?$AAR?$AAS?$AAA?$AAD?$AAS?$AAI?$AA?5?$AAR?$AAC?$AA4?$AA?9?$AAH?$AAM?$AAA?$AAC?$AA?$CI?$AAN?$AAT?$AA?$CJ?$AA?$AN?$AA?6?$AA?$AA@
0x1400063B8: "__cdecl _imp__fmode" __imp__fmode
0x1400071D8: "PDC" ??_C@_17NCJDGMPJ@?$AAP?$AAD?$AAC?$AA?$AA@
0x140006EA0: "may_postdate" ??_C@_0N@NHNCHIKP@may_postdate?$AA@
0x140006228: "__cdecl _imp_OpenThreadToken" __imp_OpenThreadToken
0x1400074D8: "secur32.dll" ??_C@_1BI@HLLGKMIP@?$AAs?$AAe?$AAc?$AAu?$AAr?$AA3?$AA2?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x140002040: "long __cdecl PurgeTicket(void * __ptr64,unsigned long,struct _LUID * __ptr64,struct _KERB_TICKET_CACHE_INFO_EX * __ptr64)" ?PurgeTicket@@YAJPEAXKPEAU_LUID@@PEAU_KERB_TICKET_CACHE_INFO_EX@@@Z
0x140006780: " kcd_cache [-lh <LogonId.HighPa" ??_C@_1HO@HNNNILFD@?$AA?5?$AA?5?$AAk?$AAc?$AAd?$AA_?$AAc?$AAa?$AAc?$AAh?$AAe?$AA?5?$AA?$FL?$AA?9?$AAl?$AAh?$AA?5?$AA?$DM?$AAL?$AAo?$AAg?$AAo?$AAn?$AAI?$AAd?$AA?4?$AAH?$AAi?$AAg?$AAh?$AAP?$AAa@
0x140006990: "%#x/%d: %ws" ??_C@_1BI@JFGDLLFJ@?$AA?$CF?$AA?$CD?$AAx?$AA?1?$AA?$CF?$AAd?$AA?3?$AA?5?$AA?$CF?$AAw?$AAs?$AA?$AA@
0x140007FDC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0
0x140006700: " sessions [-lh <LogonId.HighPar" ??_C@_1HM@HOEMNGLN@?$AA?5?$AA?5?$AAs?$AAe?$AAs?$AAs?$AAi?$AAo?$AAn?$AAs?$AA?5?$AA?$FL?$AA?9?$AAl?$AAh?$AA?5?$AA?$DM?$AAL?$AAo?$AAg?$AAo?$AAn?$AAI?$AAd?$AA?4?$AAH?$AAi?$AAg?$AAh?$AAP?$AAa?$AAr@
0x1400073E8: "-cacheoptions" ??_C@_1BM@HMAIBNGP@?$AA?9?$AAc?$AAa?$AAc?$AAh?$AAe?$AAo?$AAp?$AAt?$AAi?$AAo?$AAn?$AAs?$AA?$AA@
0x140007220: "CLOSEST_SITE" ??_C@_1BK@HIAAELF@?$AAC?$AAL?$AAO?$AAS?$AAE?$AAS?$AAT?$AA_?$AAS?$AAI?$AAT?$AAE?$AA?$AA@
0x140006418: "__cdecl _imp_free" __imp_free
0x140005CE0: "__cdecl IsNonwritableInCurrentImage" _IsNonwritableInCurrentImage
0x1400062C8: api-ms-win-core-synch-l1-2-0_NULL_THUNK_DATA
0x140006D88: "NewCredentials" ??_C@_1BO@HEHGFIAE@?$AAN?$AAe?$AAw?$AAC?$AAr?$AAe?$AAd?$AAe?$AAn?$AAt?$AAi?$AAa?$AAl?$AAs?$AA?$AA@
0x140006220: "__cdecl _imp_OpenProcessToken" __imp_OpenProcessToken
0x140007F00: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-localization-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-localization-l1-2-0
0x140007330: "NO_TCP" ??_C@_1O@DNCDFLFB@?$AAN?$AAO?$AA_?$AAT?$AAC?$AAP?$AA?$AA@
0x140007FB4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0
0x140005F59: memset
0x1400080A4: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x140007120: "DS_6_REQUIRED" ??_C@_1BM@CNCMHKFE@?$AAD?$AAS?$AA_?$AA6?$AA_?$AAR?$AAE?$AAQ?$AAU?$AAI?$AAR?$AAE?$AAD?$AA?$AA@

[JEB Decompiler by PNF Software]