Generated by JEB on 2019/08/01

PE: C:\Windows\System32\pcacli.dll Base=0x180000000 SHA-256=6B66D74756157A20D622CF4AD777BB3FBCAD9D3AFA95BB8378AFDB2B39C1CFCD
PDB: pcacli.pdb GUID={455C1571-186E-9443-04D50DAD898D1B63} Age=1

537 located named symbols:
0x18000C9D8: "__cdecl _imp_RtlInitUnicodeStringEx" __imp_RtlInitUnicodeStringEx
0x18000DB74: "PRINT" ??_C@_05ECKPOFCN@PRINT?$AA@
0x1800066F4: "int __cdecl PcapCheckEnablePca(unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned long)" ?PcapCheckEnablePca@@YAHPEBG0K@Z
0x180004390: "__cdecl _raise_securityfailure" __raise_securityfailure
0x18000DD28: "RtlStringCchLengthA failed [%x]" ??_C@_0CA@JMEKPAGN@RtlStringCchLengthA?5failed?5?$FL?$CFx?$FN?$AA@
0x18000C748: api-ms-win-core-file-l1-1-0_NULL_THUNK_DATA
0x18000C8A0: "__cdecl _imp_EventRegister" __imp_EventRegister
0x18000D8F0: "Failed to process CurrentDirecto" ??_C@_0CI@BJDPEJDN@Failed?5to?5process?5CurrentDirecto@
0x18000DED8: "%systemroot%\system32" ??_C@_1CM@JBIGCHCD@?$AA?$CF?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AAr?$AAo?$AAo?$AAt?$AA?$CF?$AA?2?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?$AA@
0x180004660: "__cdecl FindPESection" _FindPESection
0x18000DDF0: "AslEnvVarQuery failed [%x]" ??_C@_0BL@JLFODMA@AslEnvVarQuery?5failed?5?$FL?$CFx?$FN?$AA@
0x18000729C: RtlStringCchCatW
0x180008640: "__cdecl TlgCreateSz" _TlgCreateSz
0x1800076D4: "long __cdecl RtlStringCchPrintfA(char * __ptr64,unsigned __int64,char const * __ptr64,...)" ?RtlStringCchPrintfA@@YAJPEAD_KPEBDZZ
0x18000691C: "long __cdecl StringCchCatW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64)" ?StringCchCatW@@YAJPEAG_KPEBG@Z
0x18000F7EC: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x180007314: RtlStringCchCopyW
0x180007820: AslLogDebugVPrintf
0x180011160: "__cdecl _security_cookie_complement" __security_cookie_complement
0x18000E298: "Failed to open reg key [%x]" ??_C@_0BM@PIJDJEI@Failed?5to?5open?5reg?5key?5?$FL?$CFx?$FN?$AA@
0x18000CF00: "ncalrpc" ??_C@_1BA@EONDGCCM@?$AAn?$AAc?$AAa?$AAl?$AAr?$AAp?$AAc?$AA?$AA@
0x18000C808: "__cdecl _imp_GetProcessId" __imp_GetProcessId
0x18000F8B4: "__cdecl _IMPORT_DESCRIPTOR_MPR" __IMPORT_DESCRIPTOR_MPR
0x18000C5B0: "__cdecl tls_used" _tls_used
0x180004842: CloseHandle
0x18000DC30: "AslRegistryOpenKey passed bad Pa" ??_C@_0CI@FAHCLLPP@AslRegistryOpenKey?5passed?5bad?5Pa@
0x180003E7C: "__cdecl CRT_INIT" _CRT_INIT
0x18000686C: "int __cdecl PcaIsSfcProtected(unsigned short const * __ptr64)" ?PcaIsSfcProtected@@YAHPEBG@Z
0x18000C7F0: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x18000D980: "PcaLinkChildProcessToParent" ??_C@_0BM@DBBINHGP@PcaLinkChildProcessToParent?$AA@
0x18000CD98: "SfcIsFileProtected" ??_C@_0BD@JCBHAIFE@SfcIsFileProtected?$AA@
0x18000CA30: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x1800049F0: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x18000C918: "__cdecl _imp__wcslwr" __imp__wcslwr
0x18000C740: "__cdecl _imp_CreateFileW" __imp_CreateFileW
0x18000C8C0: "__cdecl _imp_StartServiceW" __imp_StartServiceW
0x18000D0F8: "Bad cpl command line [%d]" ??_C@_0BK@NDJCGMMH@Bad?5cpl?5command?5line?5?$FL?$CFd?$FN?$AA@
0x18000E80C: "__cdecl Init_thread_epoch" _Init_thread_epoch
0x18000D648: "__cdecl TraceLoggingMetadata" _TraceLoggingMetadata
0x18000C6A0: "__cdecl _imp_WNetGetConnectionW" __imp_WNetGetConnectionW
0x18000CE98: "" ??_C@_00CNPNBAHC@?$AA@
0x180002130: AslLogCreate
0x180001270: AslTelemetryFlush
0x18000C958: "__cdecl _imp_sprintf_s" __imp_sprintf_s
0x18000F954: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-1-0
0x18000B3F4: AslEnvVarQuery
0x18000AF2C: AslEnvExpandStrings
0x18000C798: api-ms-win-core-heap-l2-1-0_NULL_THUNK_DATA
0x18000CE38: AE_LOG
0x1800073FC: "long __cdecl AslLogpAppendLog(unsigned short const * __ptr64,char const * __ptr64,unsigned __int64,unsigned char)" ?AslLogpAppendLog@@YAJPEBGPEBD_KE@Z
0x18000C990: "__cdecl _imp_wcschr" __imp_wcschr
0x18000DAF8: "DEBUG,%04d,%04d,%s " ??_C@_0BF@LJHPDAKB@DEBUG?0?$CF04d?0?$CF04d?0?$CFs?$AN?6?$AA@
0x18000D0A0: "Excluded,%S,PCA disabled" ??_C@_0BJ@JIBEILKK@Excluded?0?$CFS?0PCA?5disabled?$AA@
0x18000C9F0: "__cdecl _imp_RtlEqualString" __imp_RtlEqualString
0x18000CA10: "__cdecl _imp_RtlEnterCriticalSection" __imp_RtlEnterCriticalSection
0x180008684: "__cdecl TlgWrite" _TlgWrite
0x18000CA68: "__cdecl _imp_RtlGetNtSystemRoot" __imp_RtlGetNtSystemRoot
0x18000CAA0: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x180002550: PcaMonitorProcess2
0x18000DF88: "%systemdrive%\Program Files" ??_C@_1DI@GAAGMOFG@?$AA?$CF?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AAd?$AAr?$AAi?$AAv?$AAe?$AA?$CF?$AA?2?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AA?5?$AAF?$AAi?$AAl?$AAe?$AAs?$AA?$AA@
0x18000C908: "__cdecl _imp__wcsnicmp" __imp__wcsnicmp
0x18000DB10: "RtlStringCchCopyW failed [%x]" ??_C@_0BO@LFCDCAJH@RtlStringCchCopyW?5failed?5?$FL?$CFx?$FN?$AA@
0x18000C7C0: "__cdecl _imp_GetModuleHandleExW" __imp_GetModuleHandleExW
0x18000DC70: "AslRegistryGetString" ??_C@_0BF@BEDJKLON@AslRegistryGetString?$AA@
0x18000D968: "PcaNotifyMsiInstall" ??_C@_0BE@GAACAHOB@PcaNotifyMsiInstall?$AA@
0x1800088E8: AslRegistryGetString
0x18000DC88: "Out of memory [%x]" ??_C@_0BD@PKOKAJCB@Out?5of?5memory?5?$FL?$CFx?$FN?$AA@
0x180007600: "void __cdecl AslLogpWriteEtw(struct _ASL_LOG * __ptr64,enum ASL_LOG_LEVEL,char const * __ptr64)" ?AslLogpWriteEtw@@YAXPEAU_ASL_LOG@@W4ASL_LOG_LEVEL@@PEBD@Z
0x18000DBB0: "Message too long!" ??_C@_0BC@CHJNCCME@Message?5too?5long?$CB?$AA@
0x18000E810: "__cdecl tls_end" _tls_end
0x18000DC08: "%d" ??_C@_02DPKJAMEF@?$CFd?$AA@
0x18000D7C0: "Failed to OpenService [%d]" ??_C@_0BL@JELKIKOK@Failed?5to?5OpenService?5?$FL?$CFd?$FN?$AA@
0x18000E2C0: "\Registry\Machine\Software\Micro" ??_C@_1JG@LOBJJIBH@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x180004645: "__cdecl XcptFilter" _XcptFilter
0x18000D1D8: "Parameters too long" ??_C@_0BE@GJGACAOI@Parameters?5too?5long?$AA@
0x180007F4C: AslTelemetryTrackError
0x18000CAA8: "__cdecl _xc_a" __xc_a
0x18000DE80: "AslpEnvResolveVars failed [%x]" ??_C@_0BP@FBDBOKFK@AslpEnvResolveVars?5failed?5?$FL?$CFx?$FN?$AA@
0x18000C910: "__cdecl _imp_wcsstr" __imp_wcsstr
0x18000CF10: "Excluded,%S,SFC protected" ??_C@_0BK@NCGPGPBO@Excluded?0?$CFS?0SFC?5protected?$AA@
0x180003BE0: "unsigned long __cdecl PcacpStartPCAService(void)" ?PcacpStartPCAService@@YAKXZ
0x18000C9C8: "__cdecl _imp_RtlAppendUnicodeStringToString" __imp_RtlAppendUnicodeStringToString
0x180001070: AslLogDelete
0x18000CB40: AE_PCA_ETW_LOG
0x18000C780: api-ms-win-core-heap-l1-1-0_NULL_THUNK_DATA
0x18000DC20: "ERROR#%s#%d" ??_C@_0M@DNCHPEGO@ERROR?$CD?$CFs?$CD?$CFd?$AA@
0x18000848C: AslpTelemetryCleanString
0x18000DC0C: "%s#%s" ??_C@_05CPDNPOCI@?$CFs?$CD?$CFs?$AA@
0x180007540: "void __cdecl AslLogpRollStream(struct _RTL_MEMORY_STREAM * __ptr64,unsigned __int64)" ?AslLogpRollStream@@YAXPEAU_RTL_MEMORY_STREAM@@_K@Z
0x18000C8E8: "__cdecl _imp_NotifyServiceStatusChangeW" __imp_NotifyServiceStatusChangeW
0x18000DCC8: "AslRegistryGetStringExpand" ??_C@_0BL@PDPDPHAO@AslRegistryGetStringExpand?$AA@
0x180004836: GetLastError
0x18000D248: "Invalid value type" ??_C@_0BD@BBKBCNOK@Invalid?5value?5type?$AA@
0x1800049BC: memcpy
0x18000DB7C: "ERROR" ??_C@_05MBDEGLCK@ERROR?$AA@
0x18000C7B8: "__cdecl _imp_LoadLibraryExW" __imp_LoadLibraryExW
0x18000C898: "__cdecl _imp_EventWriteTransfer" __imp_EventWriteTransfer
0x18000C998: "__cdecl _imp_memset" __imp_memset
0x18000DEA0: "AslEnvExpandStrings failed [%x]" ??_C@_0CA@IDIOIIBO@AslEnvExpandStrings?5failed?5?$FL?$CFx?$FN?$AA@
0x18000B618: AslpEnvResolveVars
0x18000481F: "__cdecl initterm" _initterm
0x180008FC0: AslStringDuplicate
0x18000F918: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0
0x180011728: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x18000E090: "CommonProgramFiles" ??_C@_1CG@HMNDLOFD@?$AAC?$AAo?$AAm?$AAm?$AAo?$AAn?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAF?$AAi?$AAl?$AAe?$AAs?$AA?$AA@
0x18000C868: "__cdecl _imp_Sleep" __imp_Sleep
0x18000DE28: "AslpEnvResolveVars failed to fai" ??_C@_0DL@ECPNLKFD@AslpEnvResolveVars?5failed?5to?5fai@
0x18000CAC8: "__cdecl _xi_z" __xi_z
0x18000709C: "long __cdecl StringCchVPrintfA(char * __ptr64,unsigned __int64,char const * __ptr64,char * __ptr64)" ?StringCchVPrintfA@@YAJPEAD_KPEBD0@Z
0x18000C710: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x18000D138: "Failed to copy NtSystemRoot" ??_C@_0BM@EGFFDHIO@Failed?5to?5copy?5NtSystemRoot?$AA@
0x18000DA48: AE_MARK_EVENT
0x18000D0E8: ".cpl" ??_C@_19GJFHEGMI@?$AA?4?$AAc?$AAp?$AAl?$AA?$AA@
0x180003A40: AslStringDuplicateA
0x180004384: "__cdecl _C_specific_handler" __C_specific_handler
0x180006A20: MIDL_user_free
0x18000DA08: "GetFileInfoFromPath,Time,%llu" ??_C@_0BO@ENGGHCMK@GetFileInfoFromPath?0Time?0?$CFllu?$AA@
0x18000D0C0: "/name " ??_C@_1O@PJBHBOPD@?$AA?1?$AAn?$AAa?$AAm?$AAe?$AA?5?$AA?$AA@
0x1800049C8: memmove
0x18000C778: "__cdecl _imp_HeapFree" __imp_HeapFree
0x18000B310: AslEnvGetProcessWowInfo
0x18000C8D8: "__cdecl _imp_OpenServiceW" __imp_OpenServiceW
0x18000C758: api-ms-win-core-handle-l1-1-0_NULL_THUNK_DATA
0x18000DF38: "%systemroot%" ??_C@_1BK@JEOALCGP@?$AA?$CF?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AAr?$AAo?$AAo?$AAt?$AA?$CF?$AA?$AA@
0x18000E1F0: "SystemRoot=" ??_C@_1BI@KJNLBMHH@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAo?$AAo?$AAt?$AA?$DN?$AA?$AA@
0x1800048CC: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x18000CF68: "PcaSvc" ??_C@_1O@EHOHNOAH@?$AAP?$AAc?$AAa?$AAS?$AAv?$AAc?$AA?$AA@
0x18000CE20: "%s,%04d,%04d,%s,%s " ??_C@_0BF@IIGEMOJO@?$CFs?0?$CF04d?0?$CF04d?0?$CFs?0?$CFs?$AN?6?$AA@
0x18000D338: "NtOpenKey failed for %ws [%x]" ??_C@_0BO@KHIHGBEI@NtOpenKey?5failed?5for?5?$CFws?5?$FL?$CFx?$FN?$AA@
0x180006DE0: "unsigned short * __ptr64 __cdecl PcaUtilityWcsIStr(unsigned short const * __ptr64,unsigned short const * __ptr64)" ?PcaUtilityWcsIStr@@YAPEAGPEBG0@Z
0x18000CA70: "__cdecl _imp_RtlAllocateHeap" __imp_RtlAllocateHeap
0x18000D158: "PcaUtilityCompareToSystemExe" ??_C@_0BN@PGMGGCKM@PcaUtilityCompareToSystemExe?$AA@
0x18000F83C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0
0x18000DE10: "AslEnvExpandStrings" ??_C@_0BE@MJPLEBLE@AslEnvExpandStrings?$AA@
0x180004651: "__cdecl amsg_exit" _amsg_exit
0x18000CDB0: "\System32\sfc_os.dll" ??_C@_1CK@NALAIEDH@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAs?$AAf?$AAc?$AA_?$AAo?$AAs?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x1800079F0: "public: long __cdecl PiiFilter::EmbeddedPathsExecute(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64) __ptr64" ?EmbeddedPathsExecute@PiiFilter@@QEAAJPEAG_KPEBG@Z
0x18000C6F8: "__cdecl _imp_DebugBreak" __imp_DebugBreak
0x18000D0D0: "Excluded,System CPL" ??_C@_0BE@NNDFPHHK@Excluded?0System?5CPL?$AA@
0x1800063F0: "unsigned long __cdecl PcaLinkChildProcessToParent(void * __ptr64,unsigned long)" ?PcaLinkChildProcessToParent@@YAKPEAXK@Z
0x1800084C0: AslpTelemetryProcessError
0x18000CB60: "EventSetInformation" ??_C@_0BE@BJEEGHGK@EventSetInformation?$AA@
0x18000995C: PiiFilterEmbeddedPathsExecute
0x18000CA08: "__cdecl _imp_RtlInitializeCriticalSection" __imp_RtlInitializeCriticalSection
0x18000D870: "Bad flags parameter" ??_C@_0BE@IHKGODMA@Bad?5flags?5parameter?$AA@
0x18000E000: "Invalid combination of Host/Curr" ??_C@_0HA@EFIDDFNE@Invalid?5combination?5of?5Host?1Curr@
0x180011758: "unsigned __int64 g_PcaTelemetry" ?g_PcaTelemetry@@3_KA
0x18000E1D8: "AslEnvBuildBasic" ??_C@_0BB@OHEKBGFD@AslEnvBuildBasic?$AA@
0x18000D888: "PcaMonitorProcess" ??_C@_0BC@PBDAFCIL@PcaMonitorProcess?$AA@
0x18000DA68: AE_PCA_ServiceStartup_Stop
0x180003230: "unsigned long __cdecl PcaExpandMappedDrive(unsigned short * __ptr64 * __ptr64,unsigned short const * __ptr64)" ?PcaExpandMappedDrive@@YAKPEAPEAGPEBG@Z
0x180009924: PiiFilterDelete
0x18000C840: api-ms-win-core-registry-l1-1-0_NULL_THUNK_DATA
0x18000CCC0: "RtlGetNtSystemRoot" ??_C@_0BD@FEHADEKB@RtlGetNtSystemRoot?$AA@
0x18000C728: api-ms-win-core-errorhandling-l1-1-0_NULL_THUNK_DATA
0x18000D8C8: "Failed to process CommandLine [%" ??_C@_0CD@CLOCKHIK@Failed?5to?5process?5CommandLine?5?$FL?$CF@
0x18000E1B0: "ProgramData" ??_C@_1BI@PCFBINBH@?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAD?$AAa?$AAt?$AAa?$AA?$AA@
0x18000C7E0: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x18000CF78: "Global\SC_AutoStartComplete" ??_C@_1DI@CLPFADAL@?$AAG?$AAl?$AAo?$AAb?$AAa?$AAl?$AA?2?$AAS?$AAC?$AA_?$AAA?$AAu?$AAt?$AAo?$AAS?$AAt?$AAa?$AAr?$AAt?$AAC?$AAo?$AAm?$AAp?$AAl?$AAe?$AAt?$AAe?$AA?$AA@
0x18000DAE4: ";" ??_C@_13PJJBFPED@?$AA?$DL?$AA?$AA@
0x180008AB8: AslRegistryGetStringExpand
0x180011718: "__cdecl _native_startup_lock" __native_startup_lock
0x18000D228: "AslRegistryGetUInt32_UStr" ??_C@_0BK@GEIFCLB@AslRegistryGetUInt32_UStr?$AA@
0x18000C9C0: "__cdecl _imp_RtlUpcaseUnicodeChar" __imp_RtlUpcaseUnicodeChar
0x180004874: DllMain
0x180004930: "__cdecl _GSHandlerCheck_SEH" __GSHandlerCheck_SEH
0x18000C928: "__cdecl _imp__wcsicmp" __imp__wcsicmp
0x18000C980: "__cdecl _imp_wcscat_s" __imp_wcscat_s
0x18000C9A0: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x18000DB48: "\SysWOW64" ??_C@_1BE@MJECBGNO@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?$AA@
0x18000CA50: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x1800096D4: "long __cdecl PiiFilterpAddItemSorted(struct _PII_FILTER * __ptr64,unsigned short * __ptr64,unsigned short * __ptr64)" ?PiiFilterpAddItemSorted@@YAJPEAU_PII_FILTER@@PEAG1@Z
0x18000E388: "AslEnvGetProcessWowInfo" ??_C@_0BI@EDMELJOD@AslEnvGetProcessWowInfo?$AA@
0x18000C7C8: api-ms-win-core-libraryloader-l1-2-0_NULL_THUNK_DATA
0x18000C7D8: api-ms-win-core-libraryloader-l1-2-1_NULL_THUNK_DATA
0x18000F92C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-eventing-provider-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-eventing-provider-l1-1-0
0x18000CEA0: "PcaCliTrace" ??_C@_0M@PELLPMFI@PcaCliTrace?$AA@
0x18000DEC0: "%system32%" ??_C@_1BG@IBFJLDBC@?$AA?$CF?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?$CF?$AA?$AA@
0x180009154: AslStringUpper
0x18000484E: GetProcAddress
0x18000C720: "__cdecl _imp_GetLastError" __imp_GetLastError
0x18000D9A0: "LinkChildToParent,Time,%llu" ??_C@_0BM@HDECEEGM@LinkChildToParent?0Time?0?$CFllu?$AA@
0x180007238: AslPathUnquoteSpaces
0x18000C8A8: api-ms-win-eventing-provider-l1-1-0_NULL_THUNK_DATA
0x180011150: "__cdecl _native_dllmain_reason" __native_dllmain_reason
0x1800048A8: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x180011700: "__cdecl tls_index" _tls_index
0x1800039C0: "long __cdecl RtlStringCchPrintfW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64,...)" ?RtlStringCchPrintfW@@YAJPEAG_KPEBGZZ
0x18000DFD8: "RtlStringCchCatW failed [%x]" ??_C@_0BN@IGBCHOAA@RtlStringCchCatW?5failed?5?$FL?$CFx?$FN?$AA@
0x18000E808: "__cdecl tls_start" _tls_start
0x18000C960: "__cdecl _imp_strchr" __imp_strchr
0x18000CAD8: "__cdecl _xl_z" __xl_z
0x18000C6F0: "__cdecl _imp_OutputDebugStringA" __imp_OutputDebugStringA
0x18000D178: "Failed to cat system32 path" ??_C@_0BM@FDFCOBEJ@Failed?5to?5cat?5system32?5path?$AA@
0x18000D760: "PcacpStartPCAService" ??_C@_0BF@DHPDMNMK@PcacpStartPCAService?$AA@
0x18000C7F8: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x18000C850: "__cdecl _imp_WaitForSingleObject" __imp_WaitForSingleObject
0x18000D198: "Failed to cat SystemExeName" ??_C@_0BM@PDKPFADL@Failed?5to?5cat?5SystemExeName?$AA@
0x18000DD60: "SIZE_T arithmetic failed [%x]" ??_C@_0BO@JIGJHMGC@SIZE_T?5arithmetic?5failed?5?$FL?$CFx?$FN?$AA@
0x18000CB80: "api-ms-win-eventing-provider-l1-" ??_C@_1EI@JCOINDP@?$AAa?$AAp?$AAi?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAe?$AAv?$AAe?$AAn?$AAt?$AAi?$AAn?$AAg?$AA?9?$AAp?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AA?9?$AAl?$AA1?$AA?9@
0x180004710: "__cdecl ValidateImageBase" _ValidateImageBase
0x180006F20: "long __cdecl StringCchCopyW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64)" ?StringCchCopyW@@YAJPEAG_KPEBG@Z
0x18000DAA8: "Failed to duplicate string [%d]" ??_C@_0CA@COKDKDOM@Failed?5to?5duplicate?5string?5?$FL?$CFd?$FN?$AA@
0x18000D9C0: "GetFileInfoFromPath ignored,PCA " ??_C@_0CJ@CKJCNGA@GetFileInfoFromPath?5ignored?0PCA?5@
0x18000C6A8: MPR_NULL_THUNK_DATA
0x18000DC58: "AslRegistryOpenKey" ??_C@_0BD@JLBNOBM@AslRegistryOpenKey?$AA@
0x18000CA78: "__cdecl _imp_RtlFreeHeap" __imp_RtlFreeHeap
0x18000F8DC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0
0x18000DBC4: "Simple" ??_C@_06MIPDDPP@Simple?$AA@
0x18000CE48: AE_PCA_TRACE_EVENT
0x18000C768: "__cdecl _imp_HeapAlloc" __imp_HeapAlloc
0x18000C7B0: "__cdecl _imp_FreeLibrary" __imp_FreeLibrary
0x180006AE0: "public: unsigned short const * __ptr64 __cdecl RtlNameValueArray::GetValue(unsigned __int64)const __ptr64" ?GetValue@RtlNameValueArray@@QEBAPEBG_K@Z
0x18000CFB0: "RpcStringBindingCompose failed [" ??_C@_0CE@IAODDIPK@RpcStringBindingCompose?5failed?5?$FL@
0x18000E158: "ProgramFilesDir (x86)" ??_C@_1CM@LPGAILIM@?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAF?$AAi?$AAl?$AAe?$AAs?$AAD?$AAi?$AAr?$AA?5?$AA?$CI?$AAx?$AA8?$AA6?$AA?$CJ?$AA?$AA@
0x1800097A0: "long __cdecl RtlStringCchCatW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64)" ?RtlStringCchCatW@@YAJPEAG_KPEBG@Z
0x18000CC88: "%s\Temp\AslLog_%S_%s_%d.txt" ??_C@_1DI@NMOMNJAN@?$AA?$CF?$AAs?$AA?2?$AAT?$AAe?$AAm?$AAp?$AA?2?$AAA?$AAs?$AAl?$AAL?$AAo?$AAg?$AA_?$AA?$CF?$AAS?$AA_?$AA?$CF?$AAs?$AA_?$AA?$CF?$AAd?$AA?4?$AAt?$AAx?$AAt?$AA?$AA@
0x180008D78: AslRegistryGetUInt32_UStr
0x18000C6B0: "__cdecl _imp_RpcBindingFree" __imp_RpcBindingFree
0x1800040C0: "__cdecl DllMainCRTStartup" _DllMainCRTStartup
0x18000D018: "Failed to create sid [%d]" ??_C@_0BK@IPFDGHPB@Failed?5to?5create?5sid?5?$FL?$CFd?$FN?$AA@
0x18000C940: "__cdecl _imp__initterm" __imp__initterm
0x18000DF58: "%programfilesnative%" ??_C@_1CK@KKONAJDD@?$AA?$CF?$AAp?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAf?$AAi?$AAl?$AAe?$AAs?$AAn?$AAa?$AAt?$AAi?$AAv?$AAe?$AA?$CF?$AA?$AA@
0x18000C6D0: "__cdecl _imp_RpcStringBindingComposeW" __imp_RpcStringBindingComposeW
0x18000DA28: AE_PCA_ServiceStartup_Start
0x18000F990: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-debug-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-debug-l1-1-0
0x18000C708: "__cdecl _imp_SetLastError" __imp_SetLastError
0x18000C9B8: "__cdecl _imp_RtlGetNativeSystemInformation" __imp_RtlGetNativeSystemInformation
0x180006BFC: "unsigned long __cdecl PcaUtilityFindFileNameInCommandLine(unsigned short * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64)" ?PcaUtilityFindFileNameInCommandLine@@YAKPEAGPEBG1@Z
0x18000DC04: ";" ??_C@_01ICJEACDI@?$DL?$AA@
0x18000CE68: "MonitorProcess,%S,Time,%llu" ??_C@_0BM@HBDABNJF@MonitorProcess?0?$CFS?0Time?0?$CFllu?$AA@
0x18000C7A8: "__cdecl _imp_GetModuleFileNameW" __imp_GetModuleFileNameW
0x18000CD10: "Software\Policies\Microsoft\Wind" ??_C@_1FM@IMGCAMMB@?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAP?$AAo?$AAl?$AAi?$AAc?$AAi?$AAe?$AAs?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd@
0x18000F828: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0
0x1800087E4: AslRegistryGetKey
0x18000D830: "Timeout while starting service" ??_C@_0BP@GKIKPBNJ@Timeout?5while?5starting?5service?$AA@
0x18000DA38: AE_PCA_NOTIFY_STATUS_ICON
0x180006FA0: "void __cdecl PcapTraceDebugCallback(enum ASL_LOG_LEVEL,char const * __ptr64,unsigned __int64,char const * __ptr64,char * __ptr64)" ?PcapTraceDebugCallback@@YAXW4ASL_LOG_LEVEL@@PEBD_K1PEAD@Z
0x180011708: "__cdecl _onexitend" __onexitend
0x18000F8C8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-1" __IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-1
0x18000CA98: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x18000CF48: "ServiceStartup,Time,%llu" ??_C@_0BJ@OLCOPIGL@ServiceStartup?0Time?0?$CFllu?$AA@
0x18000D940: "SendToService ignored,PCA disabl" ??_C@_0CD@CMNKDHCO@SendToService?5ignored?0PCA?5disabl@
0x18000C7E8: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x18000CA20: "__cdecl _imp_RtlAppendUnicodeToString" __imp_RtlAppendUnicodeToString
0x180008EF8: AslAnsiStringDuplicate
0x18000CA58: "__cdecl _imp_EtwEventRegister" __imp_EtwEventRegister
0x180011748: "unsigned __int64 g_PcapLogTrace" ?g_PcapLogTrace@@3_KA
0x18000C888: api-ms-win-core-sysinfo-l1-1-0_NULL_THUNK_DATA
0x18000CAB8: "__cdecl _xi_a" __xi_a
0x18000C820: api-ms-win-core-processthreads-l1-1-1_NULL_THUNK_DATA
0x180008678: "__cdecl TlgDefineProvider_annotation__TlgASL_UTC_PROVIDERProv" _TlgDefineProvider_annotation__TlgASL_UTC_PROVIDERProv
0x18000C880: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x18000C700: api-ms-win-core-debug-l1-1-0_NULL_THUNK_DATA
0x18000D260: "RtlInitUnicodeStringEx failed [%" ??_C@_0CD@LDGCFCIP@RtlInitUnicodeStringEx?5failed?5?$FL?$CF@
0x18000485A: GetCurrentProcessId
0x180011740: g_AslLogPfnVPrintf
0x18000C8B8: api-ms-win-security-base-l1-1-0_NULL_THUNK_DATA
0x1800117C0: Microsoft_Windows_Program_Compatibility_AssistantEnableBits
0x180001110: AslTelemetryDelete
0x18000C8D0: "__cdecl _imp_CloseServiceHandle" __imp_CloseServiceHandle
0x18000DB90: "%s,%s,%d," ??_C@_09CHPHCLBL@?$CFs?0?$CFs?0?$CFd?0?$AA@
0x1800033A0: McGenEventWrite
0x18000DBCC: "Metric" ??_C@_06NLMEEMAC@Metric?$AA@
0x18000DA78: "Out of memory" ??_C@_0O@NALGGDJF@Out?5of?5memory?$AA@
0x18000C9D0: "__cdecl _imp_ZwQueryValueKey" __imp_ZwQueryValueKey
0x18000DC14: "%s#%d" ??_C@_05CKLOHKLO@?$CFs?$CD?$CFd?$AA@
0x18000D730: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x18000F864: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0
0x18000F97C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-1" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-1
0x180001680: "__cdecl TlgEnableCallback" _TlgEnableCallback
0x180003400: "void __cdecl PcaTracePrintf(char const * __ptr64,unsigned int,unsigned long,char const * __ptr64,...)" ?PcaTracePrintf@@YAXPEBDIK0ZZ
0x180004548: "__cdecl _report_rangecheckfailure" __report_rangecheckfailure
0x18000DBE0: "Activity" ??_C@_08CEBOFODC@Activity?$AA@
0x18000D808: "NotifyServiceStatusChange failed" ??_C@_0CG@EGEDLONL@NotifyServiceStatusChange?5failed@
0x180011730: "__cdecl pRawDllMain" _pRawDllMain
0x180007CDC: "public: long __cdecl RtlMemoryStream::WriteStringA(char const * __ptr64,char const * __ptr64) __ptr64" ?WriteStringA@RtlMemoryStream@@QEAAJPEBD0@Z
0x18000E1C8: "Public" ??_C@_1O@OBJINMIH@?$AAP?$AAu?$AAb?$AAl?$AAi?$AAc?$AA?$AA@
0x18000D730: "" ??_C@_01LOCGONAA@?$AA?$AA@
0x18000C6C8: "__cdecl _imp_I_RpcExceptionFilter" __imp_I_RpcExceptionFilter
0x18000DA88: "PcaUtilityDuplicateString" ??_C@_0BK@MPCNLFID@PcaUtilityDuplicateString?$AA@
0x18000F814: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-service-management-l2-1-0" __IMPORT_DESCRIPTOR_api-ms-win-service-management-l2-1-0
0x18000E0B8: "CommonFilesDir (x86)" ??_C@_1CK@FONJNPCI@?$AAC?$AAo?$AAm?$AAm?$AAo?$AAn?$AAF?$AAi?$AAl?$AAe?$AAs?$AAD?$AAi?$AAr?$AA?5?$AA?$CI?$AAx?$AA8?$AA6?$AA?$CJ?$AA?$AA@
0x18000D1F0: "advapi32" ??_C@_1BC@DNHGCMLG@?$AAa?$AAd?$AAv?$AAa?$AAp?$AAi?$AA3?$AA2?$AA?$AA@
0x18000CCF0: "control.exe" ??_C@_1BI@DLJMFAEF@?$AAc?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AA?4?$AAe?$AAx?$AAe?$AA?$AA@
0x180008E5C: AslRegistryOpenKey
0x18000E188: "ProgramFiles(x86)" ??_C@_1CE@EAPHGJBI@?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAF?$AAi?$AAl?$AAe?$AAs?$AA?$CI?$AAx?$AA8?$AA6?$AA?$CJ?$AA?$AA@
0x18000CFD8: "PcapCreateBindingHandle" ??_C@_0BI@GCPMOID@PcapCreateBindingHandle?$AA@
0x18000F968: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-l1-1-0
0x18000C8F8: "__cdecl _imp__vsnprintf" __imp__vsnprintf
0x180004360: "__cdecl _security_check_cookie" __security_check_cookie
0x18000CAB0: "__cdecl _xc_z" __xc_z
0x18000F940: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0
0x18000E3A0: "ZwQuerySystemInformation failed " ??_C@_0CF@MHINMGAF@ZwQuerySystemInformation?5failed?5@
0x18000C810: api-ms-win-core-processthreads-l1-1-0_NULL_THUNK_DATA
0x18000CBC8: "LogFlags" ??_C@_1BC@EJEJANH@?$AAL?$AAo?$AAg?$AAF?$AAl?$AAa?$AAg?$AAs?$AA?$AA@
0x18000C7A0: "__cdecl _imp_GetProcAddress" __imp_GetProcAddress
0x18000D640: Microsoft_Windows_Program_Compatibility_AssistantLevels
0x180009528: "long __cdecl PiiFilterpAddEnvironment(struct _PII_FILTER * __ptr64)" ?PiiFilterpAddEnvironment@@YAJPEAU_PII_FILTER@@@Z
0x18000E220: "\Registry\Machine\Software\Micro" ??_C@_1HI@BHMKBIMG@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x18000D2A0: "Failed to allocate %d bytes for " ??_C@_0DA@BGOMJCLG@Failed?5to?5allocate?5?$CFd?5bytes?5for?5@
0x180003DDC: "unsigned __int64 __cdecl PcaTimeStart(void)" ?PcaTimeStart@@YA_KXZ
0x18000D72C: "__cdecl TraceLoggingMetadataEnd" _TraceLoggingMetadataEnd
0x18000C878: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x18000C770: "__cdecl _imp_HeapReAlloc" __imp_HeapReAlloc
0x18000DD48: "AslStringDuplicateA" ??_C@_0BE@MAGCEBKC@AslStringDuplicateA?$AA@
0x18000C790: "__cdecl _imp_LocalAlloc" __imp_LocalAlloc
0x18000CE00: "\system32\" ??_C@_1BG@NCCDOFIB@?$AA?2?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AA?$AA@
0x18000B0FC: AslEnvExpandStrings2
0x18000DF20: "%windir%" ??_C@_1BC@CGIBIBCK@?$AA?$CF?$AAw?$AAi?$AAn?$AAd?$AAi?$AAr?$AA?$CF?$AA?$AA@
0x18000C760: "__cdecl _imp_GetProcessHeap" __imp_GetProcessHeap
0x180009840: PiiFilterCreate
0x18000C818: "__cdecl _imp_GetThreadTimes" __imp_GetThreadTimes
0x18000C9E8: "__cdecl _imp_RtlInitAnsiString" __imp_RtlInitAnsiString
0x18000F800: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-service-management-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-service-management-l1-1-0
0x180006B44: "unsigned long __cdecl PcaUtilityDuplicateString(unsigned short * __ptr64 * __ptr64,unsigned short const * __ptr64)" ?PcaUtilityDuplicateString@@YAKPEAPEAGPEBG@Z
0x18000DB60: "\SysARM32" ??_C@_1BE@GAOKLHBG@?$AA?2?$AAS?$AAy?$AAs?$AAA?$AAR?$AAM?$AA3?$AA2?$AA?$AA@
0x18000D2F0: "AslRegistryBuildMachinePath fail" ??_C@_0DA@HFFCFNMM@AslRegistryBuildMachinePath?5fail@
0x180007684: "long __cdecl RtlStringCchCopyW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64)" ?RtlStringCchCopyW@@YAJPEAG_KPEBG@Z
0x180006D54: "unsigned long __cdecl PcaUtilityGetExecutablePath(unsigned short * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64)" ?PcaUtilityGetExecutablePath@@YAKPEAGPEBG1@Z
0x18000DB30: "\System32" ??_C@_1BE@JPDJANBF@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?$AA@
0x18000DDA0: "AslStringDuplicate" ??_C@_0BD@NJPGHOHJ@AslStringDuplicate?$AA@
0x1800070F8: AslLogCallPrintf
0x18000C8E0: api-ms-win-service-management-l1-1-0_NULL_THUNK_DATA
0x18000D038: "RpcBindingSetAuthInfoEx failed [" ??_C@_0CE@OFPHHIJB@RpcBindingSetAuthInfoEx?5failed?5?$FL@
0x18000C8F0: api-ms-win-service-management-l2-1-0_NULL_THUNK_DATA
0x180007128: AslPathQuoteSpaces
0x18000DB8C: " " ??_C@_02PCIJFNDE@?$AN?6?$AA@
0x18000C830: api-ms-win-core-profile-l1-1-0_NULL_THUNK_DATA
0x180001AF0: AslTelemetryCreate
0x18000CAE0: "__cdecl _guard_fids_table" __guard_fids_table
0x18000C988: "__cdecl _imp_wcscpy_s" __imp_wcscpy_s
0x18000DF08: "%sysnative%" ??_C@_1BI@CLEAEAIO@?$AA?$CF?$AAs?$AAy?$AAs?$AAn?$AAa?$AAt?$AAi?$AAv?$AAe?$AA?$CF?$AA?$AA@
0x180001210: AslAnsiStringFree
0x18000C8B0: "__cdecl _imp_CreateWellKnownSid" __imp_CreateWellKnownSid
0x18000C9A8: msvcrt_NULL_THUNK_DATA
0x18000C040: "__cdecl load_config_used" _load_config_used
0x18000E358: "RtlGetNativeSystemInformation fa" ??_C@_0CK@HFBOFPOI@RtlGetNativeSystemInformation?5fa@
0x18000D7E0: "Failed to start the service [%d]" ??_C@_0CB@KFOJLLJL@Failed?5to?5start?5the?5service?5?$FL?$CFd?$FN@
0x180003670: "void __cdecl AslLogpWriteLog(struct _ASL_LOG * __ptr64,char const * __ptr64,unsigned __int64)" ?AslLogpWriteLog@@YAXPEAU_ASL_LOG@@PEBD_K@Z
0x18000171C: McGenEventUnregister
0x18000CA28: "__cdecl _imp_ZwClose" __imp_ZwClose
0x18000DB84: "MARK" ??_C@_04MGKDMHFC@MARK?$AA@
0x18000CFF0: "RpcBindingFromStringBinding fail" ??_C@_0CI@DFADDIMA@RpcBindingFromStringBinding?5fail@
0x18000C848: "__cdecl _imp_OpenEventW" __imp_OpenEventW
0x180007A50: "public: long __cdecl RtlMemoryStream::WriteString(unsigned short const * __ptr64,unsigned short const * __ptr64) __ptr64" ?WriteString@RtlMemoryStream@@QEAAJPEBG0@Z
0x18000DAE8: "Bad log message" ??_C@_0BA@EPMCINFL@Bad?5log?5message?$AA@
0x18000C6D8: "__cdecl _imp_RpcBindingFromStringBindingW" __imp_RpcBindingFromStringBindingW
0x180006210: "unsigned long __cdecl PcaGetFileInfoFromPath(unsigned short * __ptr64,unsigned short * __ptr64,unsigned short * __ptr64,unsigned short * __ptr64,unsigned short * __ptr64,unsigned short * __ptr64,unsigned short * __ptr64)" ?PcaGetFileInfoFromPath@@YAKPEAG000000@Z
0x18000C970: "__cdecl _imp__amsg_exit" __imp__amsg_exit
0x18000D2D0: "AslRegistryBuildMachinePath" ??_C@_0BM@HODODFBC@AslRegistryBuildMachinePath?$AA@
0x180006A30: "public: void __cdecl RtlNameValueArray::Clear(void) __ptr64" ?Clear@RtlNameValueArray@@QEAAXXZ
0x180003820: "unsigned long __cdecl PcapCreateBindingHandle(void * __ptr64 * __ptr64)" ?PcapCreateBindingHandle@@YAKPEAPEAX@Z
0x18000D118: "PcaUtilityGetExecutablePath" ??_C@_0BM@PNODEEIJ@PcaUtilityGetExecutablePath?$AA@
0x18000D208: "Failed to query key value [%x]" ??_C@_0BP@PMIDEKOL@Failed?5to?5query?5key?5value?5?$FL?$CFx?$FN?$AA@
0x18000CA48: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x18000C828: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x180011750: "unsigned __int64 g_PcapLogDebug" ?g_PcapLogDebug@@3_KA
0x180001010: "void __cdecl PcaTraceDelete(void)" ?PcaTraceDelete@@YAXXZ
0x18000CE18: "TRACE" ??_C@_05EHILDPJH@TRACE?$AA@
0x18000CD88: "PcaClient" ??_C@_09EHNLOEJF@PcaClient?$AA@
0x18000CA88: "__cdecl _imp_RtlMultiByteToUnicodeN" __imp_RtlMultiByteToUnicodeN
0x18000CF30: "msiexec.exe" ??_C@_1BI@GBBMHCEG@?$AAm?$AAs?$AAi?$AAe?$AAx?$AAe?$AAc?$AA?4?$AAe?$AAx?$AAe?$AA?$AA@
0x18000CA00: "__cdecl _imp_RtlLeaveCriticalSection" __imp_RtlLeaveCriticalSection
0x18000C6B8: "__cdecl _imp_RpcStringFreeW" __imp_RpcStringFreeW
0x18000CA40: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x18000DDB8: "SystemDrive=" ??_C@_1BK@NFBPFMLB@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAD?$AAr?$AAi?$AAv?$AAe?$AA?$DN?$AA?$AA@
0x180006A00: MIDL_user_allocate
0x180003BD0: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x180011738: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUzkkxlnkzgUhszivwUoryfUlyquivUznwGEUxlnkzghszivwxlivkOlyq@compatsharedcore" __@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUzkkxlnkzgUhszivwUoryfUlyquivUznwGEUxlnkzghszivwxlivkOlyq@compatsharedcore
0x18000C900: "__cdecl _imp_wcsrchr" __imp_wcsrchr
0x18000DAE0: "" ??_C@_13NOLLCAOD@?$AA?$AA?$AA?$AA@
0x180008CFC: AslRegistryGetUInt32
0x18000C858: "__cdecl _imp_SleepEx" __imp_SleepEx
0x18000CC60: "\Registry\Machine" ??_C@_1CE@NMBJJGCH@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?$AA@
0x18000DBA0: "ASL_LOG FAIL: " ??_C@_0P@ECHOIEKI@ASL_LOG?5FAIL?3?5?$AA@
0x18000DE68: "AslEnvExpandStrings2" ??_C@_0BF@CBLFNIKF@AslEnvExpandStrings2?$AA@
0x18000F8A0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0
0x18000D8A0: "Failed to process ApplicationNam" ??_C@_0CH@NGDBMDJD@Failed?5to?5process?5ApplicationNam@
0x180011778: "int AutoStartServicesReady" ?AutoStartServicesReady@@3HA
0x18000CA38: "__cdecl _imp_EtwEventWriteNoRegistration" __imp_EtwEventWriteNoRegistration
0x18000DDD8: "systemroot" ??_C@_1BG@MCEEPJDG@?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AAr?$AAo?$AAo?$AAt?$AA?$AA@
0x18000D608: Microsoft_Windows_Program_Compatibility_AssistantKeywords
0x18000C9B0: "__cdecl _imp_ZwQuerySystemInformation" __imp_ZwQuerySystemInformation
0x180003B50: "long __cdecl RtlStringCchCopyA(char * __ptr64,unsigned __int64,char const * __ptr64)" ?RtlStringCchCopyA@@YAJPEAD_KPEBD@Z
0x18000D9F0: "PcaGetFileInfoFromPath" ??_C@_0BH@PAPACICK@PcaGetFileInfoFromPath?$AA@
0x18000C978: "__cdecl _imp__XcptFilter" __imp__XcptFilter
0x180006560: "unsigned long __cdecl PcaNotifyMsiInstall(unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned long,unsigned int)" ?PcaNotifyMsiInstall@@YAKPEBG00KI@Z
0x18000CA90: ntdll_NULL_THUNK_DATA
0x18000C930: "__cdecl _imp_memcpy" __imp_memcpy
0x18000DDD4: "%" ??_C@_13EJFHHPOP@?$AA?$CF?$AA?$AA@
0x18000CA60: "__cdecl _imp_EtwEventUnregister" __imp_EtwEventUnregister
0x18000DADC: "=" ??_C@_13NMPKAAJP@?$AA?$DN?$AA?$AA@
0x18000DD80: "RtlStringCchLengthW failed [%x]" ??_C@_0CA@CDKIHLH@RtlStringCchLengthW?5failed?5?$FL?$CFx?$FN?$AA@
0x18000CA80: "__cdecl _imp_EtwEventWriteTransfer" __imp_EtwEventWriteTransfer
0x18000F878: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0
0x180011158: "__cdecl _security_cookie" __security_cookie
0x18000DCE8: "AslEnvExpandStrings2 failed to e" ??_C@_0DL@NEFCFCEC@AslEnvExpandStrings2?5failed?5to?5e@
0x18000C920: "__cdecl _imp_strcpy_s" __imp_strcpy_s
0x18000E138: "ProgramFiles" ??_C@_1BK@CECDDAML@?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAF?$AAi?$AAl?$AAe?$AAs?$AA?$AA@
0x18000CBE0: "\Software\Microsoft\Windows NT\C" ??_C@_1HK@FCHHNOGK@?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAN?$AAT?$AA?2?$AAC@
0x18000C750: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x18000C788: "__cdecl _imp_LocalFree" __imp_LocalFree
0x18000DBD8: "Message" ??_C@_07BEIHKDLJ@Message?$AA@
0x18000F88C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0
0x1800015A0: McGenControlCallbackV2
0x18000DBF0: "AslTelemetryCreate" ??_C@_0BD@NIOMDNK@AslTelemetryCreate?$AA@
0x18000D778: "Auto-start services not ready [%" ??_C@_0CD@ECGINGBO@Auto?9start?5services?5not?5ready?5?$FL?$CF@
0x18000CAD0: "__cdecl _xl_a" __xl_a
0x18000C7D0: "__cdecl _imp_LoadLibraryW" __imp_LoadLibraryW
0x18000C738: "__cdecl _imp_GetFileAttributesW" __imp_GetFileAttributesW
0x180011710: "__cdecl _onexitbegin" __onexitbegin
0x18000E208: "WinDir=" ??_C@_1BA@NJFCNLDI@?$AAW?$AAi?$AAn?$AAD?$AAi?$AAr?$AA?$DN?$AA?$AA@
0x18000CEB0: "0767A036-0D22-48aa-BA69-B619480F" ??_C@_1EK@CLHDPFOB@?$AA0?$AA7?$AA6?$AA7?$AAA?$AA0?$AA3?$AA6?$AA?9?$AA0?$AAD?$AA2?$AA2?$AA?9?$AA4?$AA8?$AAa?$AAa?$AA?9?$AAB?$AAA?$AA6?$AA9?$AA?9?$AAB?$AA6?$AA1?$AA9?$AA4?$AA8?$AA0?$AAF@
0x18000D388: "AslAnsiStringCreate" ??_C@_0BE@IKJKFOPD@AslAnsiStringCreate?$AA@
0x18000D738: "Failed to get AutoStartEvent [%d" ??_C@_0CC@HKHHKOIJ@Failed?5to?5get?5AutoStartEvent?5?$FL?$CFd@
0x18000CDE0: "\syswow64\" ??_C@_1BG@OKEANEGD@?$AA?2?$AAs?$AAy?$AAs?$AAw?$AAo?$AAw?$AA6?$AA4?$AA?2?$AA?$AA@
0x18000C968: "__cdecl _imp__vsnwprintf" __imp__vsnwprintf
0x18000D918: "Failed to create binding handle " ??_C@_0CF@FAPBFLED@Failed?5to?5create?5binding?5handle?5@
0x18000C718: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x18000C800: "__cdecl _imp_GetCurrentThread" __imp_GetCurrentThread
0x1800066D0: "void __cdecl PcaNotifyStatusIcon(void)" ?PcaNotifyStatusIcon@@YAXXZ
0x18000CE58: AE_PCA_MonitorProcess_Stop
0x18000E118: "ProgramFilesDir" ??_C@_1CA@BENHECIP@?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAF?$AAi?$AAl?$AAe?$AAs?$AAD?$AAi?$AAr?$AA?$AA@
0x180008724: AslRegistryBuildMachinePath
0x180004744: "__cdecl _security_init_cookie" __security_init_cookie
0x180001DD0: "void __cdecl PcaTraceCreate(char const * __ptr64,unsigned int,char const * __ptr64,unsigned int)" ?PcaTraceCreate@@YAXPEBDI0I@Z
0x18000C838: "__cdecl _imp_RegGetValueW" __imp_RegGetValueW
0x18000DCA0: "AslEnvGetProcessWowInfo failed [" ??_C@_0CE@JCOOOONA@AslEnvGetProcessWowInfo?5failed?5?$FL@
0x180002F50: "unsigned long __cdecl PcaSendToService(void * __ptr64,unsigned __int64)" ?PcaSendToService@@YAKPEAX_K@Z
0x18000F7D8: "__cdecl _IMPORT_DESCRIPTOR_msvcrt" __IMPORT_DESCRIPTOR_msvcrt
0x18000C938: "__cdecl _imp_memmove" __imp_memmove
0x180004866: GetCurrentThreadId
0x1800016E4: McGenEventRegister
0x18000C948: "__cdecl _imp_malloc" __imp_malloc
0x18000D850: "Service failed to start [%d]" ??_C@_0BN@KDLADHHD@Service?5failed?5to?5start?5?$FL?$CFd?$FN?$AA@
0x18000C890: "__cdecl _imp_EventUnregister" __imp_EventUnregister
0x18000C730: "__cdecl _imp_WriteFile" __imp_WriteFile
0x18000D060: "Bad ApplicationName or CommandLi" ??_C@_0CI@PHOIHLHF@Bad?5ApplicationName?5or?5CommandLi@
0x18000F850: "__cdecl _IMPORT_DESCRIPTOR_RPCRT4" __IMPORT_DESCRIPTOR_RPCRT4
0x18000D1B8: "Failed to cat syswow64 path" ??_C@_0BM@MPEMOEDA@Failed?5to?5cat?5syswow64?5path?$AA@
0x180011800: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUzkkxlnkzgUxzxsvUrmgviuzxvUoryUlyquivUznwGEUxlnkzgxzxsvkOlyq@compatcache" __@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUzkkxlnkzgUxzxsvUrmgviuzxvUoryUlyquivUznwGEUxlnkzgxzxsvkOlyq@compatcache
0x18000772C: "long __cdecl RtlStringCchVPrintfA(char * __ptr64,unsigned __int64,char const * __ptr64,char * __ptr64)" ?RtlStringCchVPrintfA@@YAJPEAD_KPEBD0@Z
0x18000CA18: "__cdecl _imp_RtlDeleteCriticalSection" __imp_RtlDeleteCriticalSection
0x18000C6E8: RPCRT4_NULL_THUNK_DATA
0x1800043D0: "__cdecl _report_gsfailure" __report_gsfailure
0x18000CD70: "DisablePca" ??_C@_1BG@INLPANGA@?$AAD?$AAi?$AAs?$AAa?$AAb?$AAl?$AAe?$AAP?$AAc?$AAa?$AA?$AA@
0x18000C9F8: "__cdecl _imp_EtwEventWrite" __imp_EtwEventWrite
0x180011720: "__cdecl _native_startup_state" __native_startup_state
0x18000CCD8: "ntdll.dll" ??_C@_1BE@GJOFHIHD@?$AAn?$AAt?$AAd?$AAl?$AAl?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x1800091A8: "public: void __cdecl RtlNameValueArray::Free(void) __ptr64" ?Free@RtlNameValueArray@@QEAAXXZ
0x180007494: "void __cdecl AslLogpFinalizeBuffer(char * __ptr64,unsigned __int64)" ?AslLogpFinalizeBuffer@@YAXPEAD_K@Z
0x1800035A0: AslLogPrintf
0x180002560: "unsigned long __cdecl PcaMonitorProcess(void * __ptr64,enum PCA_PROCESS_TYPE,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned int)" ?PcaMonitorProcess@@YAKPEAXW4PCA_PROCESS_TYPE@@PEBG22I@Z
0x18000C8C8: "__cdecl _imp_OpenSCManagerW" __imp_OpenSCManagerW
0x18000D088: "PcapCheckEnablePca" ??_C@_0BD@DJPGOBBM@PcapCheckEnablePca?$AA@
0x18000D7A0: "Failed to OpenSCManager [%d]" ??_C@_0BN@GBEPMBGJ@Failed?5to?5OpenSCManager?5?$FL?$CFd?$FN?$AA@
0x1800091F4: "public: long __cdecl RtlNameValueArray::Insert(unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned __int64) __ptr64" ?Insert@RtlNameValueArray@@QEAAJPEBG00_K@Z
0x18000C6E0: "__cdecl _imp_NdrClientCall3" __imp_NdrClientCall3
0x180009C00: AslEnvBuildBasic
0x18000D288: "AslRegistryGetUInt32" ??_C@_0BF@GLMGGLJH@AslRegistryGetUInt32?$AA@
0x18000D320: "AslRegistryGetKey" ??_C@_0BC@FAHHPEFC@AslRegistryGetKey?$AA@
0x1800071D4: AslPathRemoveArgs
0x18000CB50: "PcaCliDebug" ??_C@_0M@BNIFKHPP@PcaCliDebug?$AA@
0x180001750: "int __cdecl PcaUtilityCompareToSystemExe(unsigned short const * __ptr64,unsigned short const * __ptr64)" ?PcaUtilityCompareToSystemExe@@YAHPEBG0@Z
0x18000DFC0: "AslpEnvResolveVars" ??_C@_0BD@FJEPFPIH@AslpEnvResolveVars?$AA@
0x1800080F0: AslpTelemetryAppend
0x180006F70: "long __cdecl ULongLongMult(unsigned __int64,unsigned __int64,unsigned __int64 * __ptr64)" ?ULongLongMult@@YAJ_K0PEA_K@Z
0x18000F904: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0
0x180003180: "int __cdecl PcaIsPcaDisabled(void)" ?PcaIsPcaDisabled@@YAHXZ
0x18000DAC8: "PcaUtilityWcsIStr" ??_C@_0BC@HDOFPBBL@PcaUtilityWcsIStr?$AA@
0x18000C950: "__cdecl _imp_free" __imp_free
0x18000D358: "AslStringDuplicate failed with "" ??_C@_0CJ@BMHBNALG@AslStringDuplicate?5failed?5with?5?$CC@
0x18000E0E8: "CommonProgramFiles(x86)" ??_C@_1DA@NDENMJEC@?$AAC?$AAo?$AAm?$AAm?$AAo?$AAn?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAF?$AAi?$AAl?$AAe?$AAs?$AA?$CI?$AAx?$AA8?$AA6?$AA?$CJ?$AA?$AA@
0x180003360: McTemplateU0
0x1800046B0: "__cdecl IsNonwritableInCurrentImage" _IsNonwritableInCurrentImage
0x18000C870: api-ms-win-core-synch-l1-2-0_NULL_THUNK_DATA
0x18000C6C0: "__cdecl _imp_RpcBindingSetAuthInfoExW" __imp_RpcBindingSetAuthInfoExW
0x18000DA58: AE_DEBUG_EVENT
0x18000C9E0: "__cdecl _imp_ZwOpenKey" __imp_ZwOpenKey
0x180011000: AE_PCA_ETW_LOG_Context
0x18000C860: api-ms-win-core-synch-l1-1-0_NULL_THUNK_DATA
0x18000F8F0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0
0x1800049D4: memset
0x18000F9A4: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x18000CE88: AE_PCA_MonitorProcess_Start
0x18000E070: "CommonFilesDir" ??_C@_1BO@HALHHILJ@?$AAC?$AAo?$AAm?$AAm?$AAo?$AAn?$AAF?$AAi?$AAl?$AAe?$AAs?$AAD?$AAi?$AAr?$AA?$AA@

[JEB Decompiler by PNF Software]