Generated by JEB on 2019/08/01

PE: C:\Windows\System32\shutdown.exe Base=0x140000000 SHA-256=6D262B3CBEDAC276C3EB960DF923167FE0449218721334DCC48A561E981B5790
PDB: shutdown.pdb GUID={7F2D97BE-769A-205C-C86CE470BF2A1072} Age=1

267 located named symbols:
0x140005368: "__cdecl _imp_EventSetInformation" __imp_EventSetInformation
0x140003CAC: "__cdecl _raise_securityfailure" __raise_securityfailure
0x1400051E8: api-ms-win-core-file-l1-1-0_NULL_THUNK_DATA
0x140005370: "__cdecl _imp_EventRegister" __imp_EventRegister
0x140003AC0: "__cdecl FindPESection" _FindPESection
0x1400035F0: "__cdecl _delayLoadHelper2" __delayLoadHelper2
0x1400063E8: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x140003AB0: "__cdecl wsetargv" _wsetargv
0x140007050: "__cdecl _security_cookie_complement" __security_cookie_complement
0x1400053A8: "__cdecl _imp___wgetmainargs" __imp___wgetmainargs
0x140005280: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x140004130: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x140005A38: "__cdecl TraceLoggingMetadata" _TraceLoggingMetadata
0x1400058E0: "NtInitiatePowerAction" ??_C@_0BG@CEOJBMLA@NtInitiatePowerAction?$AA@
0x140007088: "__cdecl commode" _commode
0x1400059D8: "__cdecl _pfnDliFailureHook2" __pfnDliFailureHook2
0x140003E82: "__cdecl _tailMerge_ext_ms_win_ntuser_misc_l1_1_0_dll" __tailMerge_ext_ms_win_ntuser_misc_l1_1_0_dll
0x1400051E0: "__cdecl _imp_GetFileType" __imp_GetFileType
0x14000644C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-1-0
0x1400011B0: "__cdecl TlgDefineProvider_annotation__Tlgg_hProviderProv" _TlgDefineProvider_annotation__Tlgg_hProviderProv
0x140005228: api-ms-win-core-heap-l2-1-0_NULL_THUNK_DATA
0x1400058B0: "PowerOptionEnabled" ??_C@_0BD@HCHPMAFA@PowerOptionEnabled?$AA@
0x140005308: "__cdecl _imp_InitiateShutdownW" __imp_InitiateShutdownW
0x140005208: "__cdecl _imp_HeapSetInformation" __imp_HeapSetInformation
0x140001090: "__cdecl TlgWrite" _TlgWrite
0x140003990: "long __cdecl __CxxUnhandledExceptionFilter(struct _EXCEPTION_POINTERS * __ptr64)" ?__CxxUnhandledExceptionFilter@@YAJPEAU_EXCEPTION_POINTERS@@@Z
0x140005440: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x140007094: "__cdecl fmode" _fmode
0x140005250: "__cdecl _imp_FormatMessageW" __imp_FormatMessageW
0x140005708: "-I" ??_C@_15BDBDFPAD@?$AA?9?$AAI?$AA?$AA@
0x1400063D4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-string-obsolete-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-string-obsolete-l1-1-0
0x1400039EE: "__cdecl XcptFilter" _XcptFilter
0x140005448: "__cdecl _xc_a" __xc_a
0x140005210: api-ms-win-core-heap-l1-1-0_NULL_THUNK_DATA
0x140005418: "__cdecl _imp_NtInitiatePowerAction" __imp_NtInitiatePowerAction
0x140005518: "ext-ms-win-ntuser-misc-l1-2-0" ??_C@_1DM@BDNJLNEB@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAn?$AAt?$AAu?$AAs?$AAe?$AAr?$AA?9?$AAm?$AAi?$AAs?$AAc?$AA?9?$AAl?$AA1?$AA?9?$AA2?$AA?9?$AA0?$AA?$AA@
0x140003FC0: "__cdecl _imp_load_ShutdownExRemoteDialog" __imp_load_ShutdownExRemoteDialog
0x140003E76: "__cdecl _imp_load_ExitWindowsEx" __imp_load_ExitWindowsEx
0x140005390: "__cdecl _imp_wcsncmp" __imp_wcsncmp
0x1400054AC: "__cdecl _guard_iat_table" __guard_iat_table
0x140005270: api-ms-win-core-processenvironment-l1-1-0_NULL_THUNK_DATA
0x140005200: api-ms-win-core-firmware-l1-1-0_NULL_THUNK_DATA
0x140005380: "__cdecl _imp_EventWriteTransfer" __imp_EventWriteTransfer
0x140003C7F: "__cdecl initterm" _initterm
0x1400063AC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0
0x140007A88: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x140005850: "OsIndicationsSupported" ??_C@_1CO@MENFEBKM@?$AAO?$AAs?$AAI?$AAn?$AAd?$AAi?$AAc?$AAa?$AAt?$AAi?$AAo?$AAn?$AAs?$AAS?$AAu?$AAp?$AAp?$AAo?$AAr?$AAt?$AAe?$AAd?$AA?$AA@
0x140005340: "__cdecl _imp_Sleep" __imp_Sleep
0x140005478: "__cdecl _xi_z" __xi_z
0x140007860: "unsigned short * g_lpszDefaultDomain" ?g_lpszDefaultDomain@@3PAGA
0x1400051C0: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x140003C8B: "__cdecl _C_specific_handler" __C_specific_handler
0x140005330: "__cdecl _imp_lstrlenW" __imp_lstrlenW
0x1400056D0: "GetEnvironmentVariableW" ??_C@_0BI@DPJBKKEE@GetEnvironmentVariableW?$AA@
0x1400054B0: "__cdecl _sz_ext_ms_win_ntuser_misc_l1_1_0_dll" __sz_ext_ms_win_ntuser_misc_l1_1_0_dll
0x140005710: "/I" ??_C@_15FONLPOAI@?$AA?1?$AAI?$AA?$AA@
0x1400054D8: "ext-ms-win-ntuser-misc-l1-1-0" ??_C@_1DM@JNFGLKKC@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAn?$AAt?$AAu?$AAs?$AAe?$AAr?$AA?9?$AAm?$AAi?$AAs?$AAc?$AA?9?$AAl?$AA1?$AA?9?$AA1?$AA?9?$AA0?$AA?$AA@
0x1400052B8: "__cdecl _imp_RegCloseKey" __imp_RegCloseKey
0x1400040B8: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x140005880: "AbortSystemShutdownW" ??_C@_0BF@BFAHPEIG@AbortSystemShutdownW?$AA@
0x140006334: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-firmware-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-firmware-l1-1-0
0x140009018: "__cdecl _imp_ShutdownExPrintReasons" __imp_ShutdownExPrintReasons
0x140005320: api-ms-win-core-string-l1-1-0_NULL_THUNK_DATA
0x1400051F0: "__cdecl _imp_SetFirmwareEnvironmentVariableW" __imp_SetFirmwareEnvironmentVariableW
0x140003AA3: "__cdecl amsg_exit" _amsg_exit
0x1400059D0: "__cdecl _DefaultResolveDelayLoadedAPIFlags" __DefaultResolveDelayLoadedAPIFlags
0x1400034D0: "void __cdecl ShutdownLibWriteOutput(unsigned short * __ptr64,unsigned long)" ?ShutdownLibWriteOutput@@YAXPEAGK@Z
0x140006248: ext-ms-win-ntuser-misc-l1-1-0_NULL_THUNK_DATA_DLB
0x140003F6C: IsShutdownExPrintReasonsPresent
0x140004081: "__cdecl _imp_load_ShutdownExAnnotate" __imp_load_ShutdownExAnnotate
0x140005630: "__cdecl _sz_ext_ms_win_security_shutdownext_l1_1_0_dll" __sz_ext_ms_win_security_shutdownext_l1_1_0_dll
0x140005970: "%s: %s " ??_C@_1BA@KPCKKND@?$AA?$CF?$AAs?$AA?3?$AA?5?$AA?$CF?$AAs?$AA?6?$AA?$AA@
0x1400053B8: "__cdecl _imp_exit" __imp_exit
0x1400061A0: ext-ms-win-security-shutdownext-l1-1-0_NULL_THUNK_DATA_DLN
0x140009038: ext-ms-win-security-shutdownext-l1-1-0_NULL_THUNK_DATA_DLA
0x140006258: ext-ms-win-security-shutdownext-l1-1-0_NULL_THUNK_DATA_DLB
0x140005318: "__cdecl _imp_WideCharToMultiByte" __imp_WideCharToMultiByte
0x14000406F: "__cdecl _imp_load_ShutdownExReasonCommentRequired" __imp_load_ShutdownExReasonCommentRequired
0x1400052C8: api-ms-win-core-registry-l1-1-0_NULL_THUNK_DATA
0x140005910: "InitiateSystemShutdownExW" ??_C@_0BK@GFJNBAFI@InitiateSystemShutdownExW?$AA@
0x1400051D0: api-ms-win-core-errorhandling-l1-1-0_NULL_THUNK_DATA
0x140005288: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x140001BE8: "void __cdecl usage(void)" ?usage@@YAXXZ
0x140005328: "__cdecl _imp_lstrlenA" __imp_lstrlenA
0x1400056E8: "ModuleHandle" ??_C@_0N@PNJACPOH@ModuleHandle?$AA@
0x140007A78: "__cdecl _native_startup_lock" __native_startup_lock
0x1400039D0: "__cdecl _CxxSetUnhandledExceptionFilter" __CxxSetUnhandledExceptionFilter
0x140006460: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-string-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-string-l1-1-0
0x1400053D8: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x140005828: "RegOpenKeyExW" ??_C@_0O@COHOBMLB@RegOpenKeyExW?$AA@
0x1400052D8: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x140005240: api-ms-win-core-libraryloader-l1-2-0_NULL_THUNK_DATA
0x1400055E0: "ext-ms-win-security-shutdownext-" ??_C@_1EO@GOHGDIPD@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAs?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?9?$AAs?$AAh?$AAu?$AAt?$AAd?$AAo?$AAw?$AAn?$AAe?$AAx?$AAt?$AA?9@
0x1400062D0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-eventing-provider-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-eventing-provider-l1-1-0
0x1400051C8: "__cdecl _imp_GetLastError" __imp_GetLastError
0x140005388: api-ms-win-eventing-provider-l1-1-0_NULL_THUNK_DATA
0x140001E2C: "unsigned long __cdecl SetBootToFirmware(int)" ?SetBootToFirmware@@YAKH@Z
0x140004094: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x140005700: "/i" ??_C@_15POOJFBDG@?$AA?1?$AAi?$AA?$AA@
0x1400053C8: "__cdecl _imp__commode" __imp__commode
0x1400053E8: "__cdecl _imp___setusermatherr" __imp___setusermatherr
0x140005428: "__cdecl _imp_RtlAdjustPrivilege" __imp_RtlAdjustPrivilege
0x140006410: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-0
0x140005290: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x1400059D0: "__cdecl _ResolveDelayLoadedAPIFlags" __ResolveDelayLoadedAPIFlags
0x140003B70: "__cdecl ValidateImageBase" _ValidateImageBase
0x1400051F8: "__cdecl _imp_GetFirmwareEnvironmentVariableW" __imp_GetFirmwareEnvironmentVariableW
0x14000404B: "__cdecl _imp_load_ShutdownExPrintReasons" __imp_load_ShutdownExPrintReasons
0x140005268: "__cdecl _imp_GetEnvironmentVariableW" __imp_GetEnvironmentVariableW
0x140006348: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0
0x140005300: api-ms-win-core-shutdown-l1-1-0_NULL_THUNK_DATA
0x140003FCC: "__cdecl _tailMerge_ext_ms_win_security_shutdownext_l1_1_0_dll" __tailMerge_ext_ms_win_security_shutdownext_l1_1_0_dll
0x140006144: "__cdecl _NULL_DELAY_IMPORT_DESCRIPTOR" __NULL_DELAY_IMPORT_DESCRIPTOR
0x140005338: api-ms-win-core-string-obsolete-l1-1-0_NULL_THUNK_DATA
0x140007090: "__cdecl newmode" _newmode
0x140007650: "unsigned short * g_lpszLocalComputerName" ?g_lpszLocalComputerName@@3PAGA
0x1400053E0: "__cdecl _imp__initterm" __imp__initterm
0x1400053B0: "__cdecl _imp___set_app_type" __imp___set_app_type
0x1400030E4: "void __cdecl ShutdownLibErrorWithSz(struct HINSTANCE__ * __ptr64,int,unsigned short const * __ptr64,unsigned long)" ?ShutdownLibErrorWithSz@@YAXPEAUHINSTANCE__@@HPEBGK@Z
0x140007638: "struct HINSTANCE__ * __ptr64 __ptr64 g_hDllInstance" ?g_hDllInstance@@3PEAUHINSTANCE__@@EA
0x1400063FC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-1" __IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-1
0x140009008: ext-ms-win-ntuser-misc-l1-1-0_NULL_THUNK_DATA_DLA
0x140005248: "__cdecl _imp_SetThreadPreferredUILanguages" __imp_SetThreadPreferredUILanguages
0x140003248: "unsigned short * __ptr64 __cdecl ShutdownLibLoadWString(struct HINSTANCE__ * __ptr64,unsigned int)" ?ShutdownLibLoadWString@@YAPEAGPEAUHINSTANCE__@@I@Z
0x1400062A8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0
0x140006424: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-console-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-console-l1-1-0
0x140005980: "%s(%d) " ??_C@_1BA@EENKPLBG@?$AA?$CF?$AAs?$AA?$CI?$AA?$CF?$AAd?$AA?$CJ?$AA?6?$AA?$AA@
0x140007A68: "__cdecl _onexitend" __onexitend
0x1400053F8: "__cdecl _imp__exit" __imp__exit
0x140005438: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x140005310: api-ms-win-core-shutdown-l1-1-1_NULL_THUNK_DATA
0x140001130: "long __cdecl StringCbPrintfW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64,...)" ?StringCbPrintfW@@YAJPEAG_KPEBGZZ
0x140005278: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x140005838: "ShutdownDirtyDialog" ??_C@_0BE@IFPFDAAC@ShutdownDirtyDialog?$AA@
0x140005180: "__cdecl _imp_GetConsoleMode" __imp_GetConsoleMode
0x140005410: "__cdecl _imp_RtlNtStatusToDosError" __imp_RtlNtStatusToDosError
0x140006104: "__cdecl _DELAY_IMPORT_DESCRIPTOR_ext_ms_win_ntuser_misc_l1_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_ext_ms_win_ntuser_misc_l1_1_0_dll
0x140005360: api-ms-win-core-sysinfo-l1-1-0_NULL_THUNK_DATA
0x140005460: "__cdecl _xi_a" __xi_a
0x140005350: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x1400051A8: "__cdecl _imp_ResolveDelayLoadedAPI" __imp_ResolveDelayLoadedAPI
0x140003AB0: "__cdecl matherr" _matherr
0x140007630: "__cdecl _hmod__ext_ms_win_security_shutdownext_l1_1_0_dll" __hmod__ext_ms_win_security_shutdownext_l1_1_0_dll
0x140001EC4: wmain
0x140006170: ext-ms-win-ntuser-misc-l1-1-0_NULL_THUNK_DATA_DLN
0x140009000: "__cdecl _imp_ExitWindowsEx" __imp_ExitWindowsEx
0x140006398: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0
0x140001010: "__cdecl TlgEnableCallback" _TlgEnableCallback
0x140005898: "" ??_C@_01LOCGONAA@?$AA?$AA@
0x140005178: "__cdecl _imp_WriteConsoleW" __imp_WriteConsoleW
0x1400059B8: "USERDOMAIN" ??_C@_1BG@NDPCAAIC@?$AAU?$AAS?$AAE?$AAR?$AAD?$AAO?$AAM?$AAA?$AAI?$AAN?$AA?$AA@
0x140009010: "__cdecl _imp_ShutdownExAnnotate" __imp_ShutdownExAnnotate
0x140006320: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-l1-1-0
0x1400062BC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-shutdown-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-shutdown-l1-1-0
0x140006370: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-shutdown-l1-1-1" __IMPORT_DESCRIPTOR_api-ms-win-core-shutdown-l1-1-1
0x140003960: "__cdecl _security_check_cookie" __security_check_cookie
0x140005188: "__cdecl _imp_GetConsoleOutputCP" __imp_GetConsoleOutputCP
0x1400011BC: "int __cdecl parse_reason_code(unsigned short const * __ptr64,unsigned long * __ptr64)" ?parse_reason_code@@YAHPEBGPEAK@Z
0x140005458: "__cdecl _xc_z" __xc_z
0x1400062E4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0
0x140005298: api-ms-win-core-processthreads-l1-1-0_NULL_THUNK_DATA
0x1400058A0: "ExitWindowsEx" ??_C@_0O@LLFEIFOD@ExitWindowsEx?$AA@
0x1400058F8: "InitiateShutdownW" ??_C@_0BC@PHMDFFAF@InitiateShutdownW?$AA@
0x1400053C0: "__cdecl _imp_?terminate@@YAXXZ" __imp_?terminate@@YAXXZ
0x140005C10: "__cdecl TraceLoggingMetadataEnd" _TraceLoggingMetadataEnd
0x140005358: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x1400052F8: "__cdecl _imp_InitiateSystemShutdownExW" __imp_InitiateSystemShutdownExW
0x140003F6C: IsShutdownExAnnotatePresent
0x140005260: "__cdecl _imp_GetStdHandle" __imp_GetStdHandle
0x140005220: "__cdecl _imp_LocalAlloc" __imp_LocalAlloc
0x140005198: "__cdecl _imp_DelayLoadFailureHook" __imp_DelayLoadFailureHook
0x140001348: "int __cdecl parse_options(int,unsigned short * __ptr64 * __ptr64 const,int * __ptr64,int * __ptr64,int * __ptr64,int * __ptr64,int * __ptr64,int * __ptr64,int * __ptr64,int * __ptr64,int * __ptr64,int * __ptr64,int * __ptr64,int * __ptr64,int * __ptr64,int * __ptr64,unsigned short * __ptr64 * __ptr64,unsigned short * __ptr64 * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64)" ?parse_options@@YAHHQEAPEAGPEAH1111111111111PEAPEAG2PEAK3@Z
0x140005958: "%s: %s(%d) " ??_C@_1BI@DPGCMKEE@?$AA?$CF?$AAs?$AA?3?$AA?5?$AA?$CF?$AAs?$AA?$CI?$AA?$CF?$AAd?$AA?$CJ?$AA?6?$AA?$AA@
0x140003F6C: IsShutdownExRemoteDialogPresent
0x1400052E8: api-ms-win-core-rtlsupport-l1-1-0_NULL_THUNK_DATA
0x1400063C0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0
0x140006294: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-apiquery-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-apiquery-l1-1-0
0x1400052A8: api-ms-win-core-profile-l1-1-0_NULL_THUNK_DATA
0x140005480: "__cdecl _guard_fids_table" __guard_fids_table
0x140005408: msvcrt_NULL_THUNK_DATA
0x140005060: "__cdecl load_config_used" _load_config_used
0x140005748: "/unexpected" ??_C@_1BI@NMMDIEIL@?$AA?1?$AAu?$AAn?$AAe?$AAx?$AAp?$AAe?$AAc?$AAt?$AAe?$AAd?$AA?$AA@
0x140003F04: IsExitWindowsExPresent
0x140009030: "__cdecl _imp_ShutdownExRemoteDialog" __imp_ShutdownExRemoteDialog
0x1400051B0: api-ms-win-core-delayload-l1-1-1_NULL_THUNK_DATA
0x1400051A0: api-ms-win-core-delayload-l1-1-0_NULL_THUNK_DATA
0x140003F6C: IsShutdownExDirtyDialogPresent
0x140006438: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processenvironment-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processenvironment-l1-1-0
0x140009020: "__cdecl _imp_ShutdownExDirtyDialog" __imp_ShutdownExDirtyDialog
0x1400053A0: "__cdecl _imp__amsg_exit" __imp__amsg_exit
0x140005230: "__cdecl _imp_LoadStringW" __imp_LoadStringW
0x1400052E0: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x1400052A0: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x14000708C: "__cdecl dowildcard" _dowildcard
0x140005990: "%s " ??_C@_17MJEANDKP@?$AA?$CF?$AAs?$AA?6?$AA?$AA@
0x140005810: "RegQueryValueExW" ??_C@_0BB@GLNAEDBD@RegQueryValueExW?$AA@
0x140003F60: ApiSetQueryApiSetPresence
0x1400052D0: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x1400059D8: "__cdecl _pfnDefaultDliFailureHook2" __pfnDefaultDliFailureHook2
0x140003CA0: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x140005258: api-ms-win-core-localization-l1-2-0_NULL_THUNK_DATA
0x1400039FC: RtlpImageNtHeader
0x140005238: "__cdecl _imp_GetModuleHandleW" __imp_GetModuleHandleW
0x140005398: "__cdecl _imp__XcptFilter" __imp__XcptFilter
0x140005430: ntdll_NULL_THUNK_DATA
0x140005558: "ext-ms-win-ntuser-misc-l1-5-0" ??_C@_1DM@BJBMLEFI@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAn?$AAt?$AAu?$AAs?$AAe?$AAr?$AA?9?$AAm?$AAi?$AAs?$AAc?$AA?9?$AAl?$AA1?$AA?9?$AA5?$AA?9?$AA0?$AA?$AA@
0x140005168: "__cdecl _imp_ApiSetQueryApiSetPresence" __imp_ApiSetQueryApiSetPresence
0x140007048: "__cdecl _security_cookie" __security_cookie
0x140005760: "/Unexpected" ??_C@_1BI@FEFMBGEI@?$AA?1?$AAU?$AAn?$AAe?$AAx?$AAp?$AAe?$AAc?$AAt?$AAe?$AAd?$AA?$AA@
0x1400052B0: "__cdecl _imp_RegQueryValueExW" __imp_RegQueryValueExW
0x140007640: "unsigned short * __ptr64 __ptr64 g_lpszProgramName" ?g_lpszProgramName@@3PEAGEA
0x1400056B0: "OsIndications" ??_C@_1BM@MDLAABPK@?$AAO?$AAs?$AAI?$AAn?$AAd?$AAi?$AAc?$AAa?$AAt?$AAi?$AAo?$AAn?$AAs?$AA?$AA@
0x140005218: "__cdecl _imp_LocalFree" __imp_LocalFree
0x140007040: "__cdecl _defaultmatherr" __defaultmatherr
0x140005718: "-unexpected" ??_C@_1BI@FPIEIIE@?$AA?9?$AAu?$AAn?$AAe?$AAx?$AAp?$AAe?$AAc?$AAt?$AAe?$AAd?$AA?$AA@
0x14000630C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0
0x140007A70: "__cdecl _onexitbegin" __onexitbegin
0x140005400: "__cdecl _imp__vsnwprintf" __imp__vsnwprintf
0x1400051B8: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x140006124: "__cdecl _DELAY_IMPORT_DESCRIPTOR_ext_ms_win_security_shutdownext_l1_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_ext_ms_win_security_shutdownext_l1_1_0_dll
0x140005660: "{8be4df61-93ca-11d2-aa0d-00e0980" ??_C@_1EO@EEPHHDOL@?$AA?$HL?$AA8?$AAb?$AAe?$AA4?$AAd?$AAf?$AA6?$AA1?$AA?9?$AA9?$AA3?$AAc?$AAa?$AA?9?$AA1?$AA1?$AAd?$AA2?$AA?9?$AAa?$AAa?$AA0?$AAd?$AA?9?$AA0?$AA0?$AAe?$AA0?$AA9?$AA8?$AA0@
0x140005998: "COMPUTERNAME" ??_C@_1BK@ENEDBDPA@?$AAC?$AAO?$AAM?$AAP?$AAU?$AAT?$AAE?$AAR?$AAN?$AAA?$AAM?$AAE?$AA?$AA@
0x140005780: "Software\Microsoft\Windows\Curre" ??_C@_1GM@FDMABGB@?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe@
0x1400052C0: "__cdecl _imp_RegOpenKeyExW" __imp_RegOpenKeyExW
0x140005190: api-ms-win-core-console-l1-1-0_NULL_THUNK_DATA
0x140003BA4: "__cdecl _security_init_cookie" __security_init_cookie
0x1400053F0: "__cdecl _imp__cexit" __imp__cexit
0x140003A58: "__cdecl get_image_app_type" _get_image_app_type
0x140006280: "__cdecl _IMPORT_DESCRIPTOR_msvcrt" __IMPORT_DESCRIPTOR_msvcrt
0x140009028: "__cdecl _imp_ShutdownExReasonCommentRequired" __imp_ShutdownExReasonCommentRequired
0x140003930: wmainCRTStartup
0x140005930: "Waiting forever... " ??_C@_1CI@MIFOHDEL@?$AAW?$AAa?$AAi?$AAt?$AAi?$AAn?$AAg?$AA?5?$AAf?$AAo?$AAr?$AAe?$AAv?$AAe?$AAr?$AA?4?$AA?4?$AA?4?$AA?6?$AA?$AA@
0x140005378: "__cdecl _imp_EventUnregister" __imp_EventUnregister
0x1400051D8: "__cdecl _imp_WriteFile" __imp_WriteFile
0x140003CF0: "__cdecl _report_gsfailure" __report_gsfailure
0x140005170: api-ms-win-core-apiquery-l1-1-0_NULL_THUNK_DATA
0x140003F6C: IsShutdownExReasonCommentRequiredPresent
0x140003308: "void __cdecl ShutdownLibReportError(unsigned long,unsigned short const * __ptr64)" ?ShutdownLibReportError@@YAXKPEBG@Z
0x140007A80: "__cdecl _native_startup_state" __native_startup_state
0x140007610: "__cdecl _hmod__ext_ms_win_ntuser_misc_l1_1_0_dll" __hmod__ext_ms_win_ntuser_misc_l1_1_0_dll
0x1400058C8: "POWER_OPTION_HIBERNATE" ??_C@_0BH@OODDLBBO@POWER_OPTION_HIBERNATE?$AA@
0x140001D9C: "int __cdecl PowerOptionEnabled(unsigned int)" ?PowerOptionEnabled@@YAHI@Z
0x1400057F0: "DirtyShutdown" ??_C@_1BM@HCNMCBMK@?$AAD?$AAi?$AAr?$AAt?$AAy?$AAS?$AAh?$AAu?$AAt?$AAd?$AAo?$AAw?$AAn?$AA?$AA@
0x14000405D: "__cdecl _imp_load_ShutdownExDirtyDialog" __imp_load_ShutdownExDirtyDialog
0x1400053D0: "__cdecl _imp__fmode" __imp__fmode
0x140005420: "__cdecl _imp_NtPowerInformation" __imp_NtPowerInformation
0x140005730: "-Unexpected" ??_C@_1BI@INGHNKEH@?$AA?9?$AAU?$AAn?$AAe?$AAx?$AAp?$AAe?$AAc?$AAt?$AAe?$AAd?$AA?$AA@
0x140006384: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0
0x140005598: "ext-ms-win-ntuser-misc-l1-5-1" ??_C@_1DM@KBKANDDN@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAn?$AAt?$AAu?$AAs?$AAe?$AAr?$AA?9?$AAm?$AAi?$AAs?$AAc?$AA?9?$AAl?$AA1?$AA?9?$AA5?$AA?9?$AA1?$AA?$AA@
0x1400052F0: "__cdecl _imp_AbortSystemShutdownW" __imp_AbortSystemShutdownW
0x140003B10: "__cdecl IsNonwritableInCurrentImage" _IsNonwritableInCurrentImage
0x140005348: api-ms-win-core-synch-l1-2-0_NULL_THUNK_DATA
0x1400056F8: "-i" ??_C@_15LDCBPADN@?$AA?9?$AAi?$AA?$AA@
0x14000635C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-localization-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-localization-l1-2-0
0x1400062F8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0
0x140006474: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR

[JEB Decompiler by PNF Software]