Generated by JEB on 2019/08/01

PE: C:\Windows\System32\credwiz.exe Base=0x140000000 SHA-256=6DDA8D8158BF23069B64014EEDB2C2B2AC8334E4F13DBF88D555F67DFEBDBABA
PDB: credwiz.pdb GUID={F4A38867-8C3F-B0D2-CBED73E1E79B6B94} Age=1

287 located named symbols:
0x14000447C: WlSecureDesktopCredmanBackupRequest
0x140004B74: "__cdecl _raise_securityfailure" __raise_securityfailure
0x1400068E8: "__cdecl _imp_ImpersonateLoggedOnUser" __imp_ImpersonateLoggedOnUser
0x140004E60: "__cdecl FindPESection" _FindPESection
0x1400041A4: StartKeyboardServers
0x140007B8C: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x1400073D0: "52EF130C-08FD-4388-86B3-6EDF%08X" ??_C@_1EC@GJJAFFCH@?$AA5?$AA2?$AAE?$AAF?$AA1?$AA3?$AA0?$AAC?$AA?9?$AA0?$AA8?$AAF?$AAD?$AA?9?$AA4?$AA3?$AA8?$AA8?$AA?9?$AA8?$AA6?$AAB?$AA3?$AA?9?$AA6?$AAE?$AAD?$AAF?$AA?$CF?$AA0?$AA8?$AAX@
0x140006D18: samcli_NULL_THUNK_DATA
0x140006C10: "__cdecl _imp___getmainargs" __imp___getmainargs
0x140002148: RestoreFilenameDlg_Browse
0x140009010: "__cdecl _security_cookie_complement" __security_cookie_complement
0x140006970: "__cdecl _imp_CreateFontIndirectW" __imp_CreateFontIndirectW
0x140007418: "ncalrpc" ??_C@_1BA@EONDGCCM@?$AAn?$AAc?$AAa?$AAl?$AAr?$AAp?$AAc?$AA?$AA@
0x140006B98: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x140006AA0: "__cdecl _imp_RpcAsyncCompleteCall" __imp_RpcAsyncCompleteCall
0x1400016B0: AsyncFileTransfer
0x140003E48: WinMain
0x140006B28: "__cdecl _imp_GetWindowLongPtrW" __imp_GetWindowLongPtrW
0x140006B00: "__cdecl _imp_SetFocus" __imp_SetFocus
0x140005180: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x140001430: DisablePrivilege
0x140006AE0: SHELL32_NULL_THUNK_DATA
0x140006A20: "__cdecl _imp_CreateFileW" __imp_CreateFileW
0x140004654: WlSecureDesktoppRpcClientInit
0x140006A90: "__cdecl _imp_RpcAsyncCancelCall" __imp_RpcAsyncCancelCall
0x140009690: g_StopEventWait
0x140006928: "__cdecl _imp_PropertySheetW" __imp_PropertySheetW
0x140006AD8: "__cdecl _imp_CommandLineToArgvW" __imp_CommandLineToArgvW
0x1400095C0: "__cdecl commode" _commode
0x140002340: RestoreFilenameDlg_WizNext
0x1400069D0: "__cdecl _imp_CancelIo" __imp_CancelIo
0x140004528: WlSecureDesktopCredmanRestoreRequest
0x1400069F0: "__cdecl _imp_SetEvent" __imp_SetEvent
0x140006980: "__cdecl _imp_HeapSetInformation" __imp_HeapSetInformation
0x140004D30: "long __cdecl __CxxUnhandledExceptionFilter(struct _EXCEPTION_POINTERS * __ptr64)" ?__CxxUnhandledExceptionFilter@@YAJPEAU_EXCEPTION_POINTERS@@@Z
0x140006D28: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x1400068F8: "__cdecl _imp_CredRestoreCredentials" __imp_CredRestoreCredentials
0x1400095CC: "__cdecl fmode" _fmode
0x1400069C8: "__cdecl _imp_FormatMessageW" __imp_FormatMessageW
0x1400068F0: "__cdecl _imp_RevertToSelf" __imp_RevertToSelf
0x140006900: "__cdecl _imp_CredpEncodeSecret" __imp_CredpEncodeSecret
0x140004D8E: "__cdecl XcptFilter" _XcptFilter
0x140006D30: "__cdecl _xc_a" __xc_a
0x140007AD8: "__cdecl _IMPORT_DESCRIPTOR_samcli" __IMPORT_DESCRIPTOR_samcli
0x140006B40: "__cdecl _imp_SetWindowLongPtrW" __imp_SetWindowLongPtrW
0x140006B90: "__cdecl _imp_GetStartupInfoW" __imp_GetStartupInfoW
0x140006938: "__cdecl _imp_GetOpenFileNameW" __imp_GetOpenFileNameW
0x140001008: StringCchCopyW
0x140006930: COMCTL32_NULL_THUNK_DATA
0x1400069B0: "__cdecl _imp_DeleteFileW" __imp_DeleteFileW
0x140006C18: "__cdecl _imp_wcsncmp" __imp_wcsncmp
0x140006C90: "__cdecl _imp__acmdln" __imp__acmdln
0x1400069A0: "__cdecl _imp_GetTempFileNameW" __imp_GetTempFileNameW
0x140006C80: "__cdecl _imp_memset" __imp_memset
0x140006A08: "__cdecl _imp_CreateEventW" __imp_CreateEventW
0x14000501F: "__cdecl initterm" _initterm
0x140007B78: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0
0x140009608: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x140006988: "__cdecl _imp_GetOverlappedResult" __imp_GetOverlappedResult
0x140007030: "O:SYG:SYD:(A;;0x1F0003;;;SY)" ??_C@_1DK@CEHLJIPE@?$AAO?$AA?3?$AAS?$AAY?$AAG?$AA?3?$AAS?$AAY?$AAD?$AA?3?$AA?$CI?$AAA?$AA?$DL?$AA?$DL?$AA0?$AAx?$AA1?$AAF?$AA0?$AA0?$AA0?$AA3?$AA?$DL?$AA?$DL?$AA?$DL?$AAS?$AAY?$AA?$CJ?$AA?$AA@
0x140006B08: "__cdecl _imp_SendDlgItemMessageW" __imp_SendDlgItemMessageW
0x140006BE8: "__cdecl _imp_Sleep" __imp_Sleep
0x140006D60: "__cdecl _xi_z" __xi_z
0x140006B60: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x140006CD8: "__cdecl _imp_NtOpenProcessToken" __imp_NtOpenProcessToken
0x140006A50: "__cdecl _imp_GetCommandLineW" __imp_GetCommandLineW
0x140006950: "__cdecl _imp_CryptUnprotectData" __imp_CryptUnprotectData
0x140004B32: "__cdecl _C_specific_handler" __C_specific_handler
0x140006920: "__cdecl _imp_CreatePropertySheetPageW" __imp_CreatePropertySheetPageW
0x1400069D8: "__cdecl _imp_HeapFree" __imp_HeapFree
0x140006EA8: "/usertoken=%I64u" ??_C@_1CC@GLCADMDB@?$AA?1?$AAu?$AAs?$AAe?$AAr?$AAt?$AAo?$AAk?$AAe?$AAn?$AA?$DN?$AA?$CF?$AAI?$AA6?$AA4?$AAu?$AA?$AA@
0x140006A78: MsCtfMonitor_NULL_THUNK_DATA
0x14000506C: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x140004450: WlSecureDesktop_midl_user_free
0x140004E43: "__cdecl amsg_exit" _amsg_exit
0x140001540: DoInterruptableAsyncOperation
0x140006E10: "Credential Backup Files (*.crd)" ??_C@_1HE@GAKGMGFP@?$AAC?$AAr?$AAe?$AAd?$AAe?$AAn?$AAt?$AAi?$AAa?$AAl?$AA?5?$AAB?$AAa?$AAc?$AAk?$AAu?$AAp?$AA?5?$AAF?$AAi?$AAl?$AAe?$AAs?$AA?5?$AA?$CI?$AA?$CK?$AA?4?$AAc?$AAr?$AAd?$AA?$CJ?$AA?$AA@
0x1400024C0: RestoreFilenameDlgProc
0x14000260C: SecureDesktopBackupRequest
0x140001C50: BackupRestoreDlgProc
0x140006FD0: "{DFFDE213-8CB4-46a9-90EB-3DA843A" ??_C@_1GA@KBGJFAHB@?$AA?$HL?$AAD?$AAF?$AAF?$AAD?$AAE?$AA2?$AA1?$AA3?$AA?9?$AA8?$AAC?$AAB?$AA4?$AA?9?$AA4?$AA6?$AAa?$AA9?$AA?9?$AA9?$AA0?$AAE?$AAB?$AA?9?$AA3?$AAD?$AAA?$AA8?$AA4?$AA3?$AAA@
0x140006C20: "__cdecl _imp_exit" __imp_exit
0x140006978: GDI32_NULL_THUNK_DATA
0x140006CE0: "__cdecl _imp_NtAdjustPrivilegesToken" __imp_NtAdjustPrivilegesToken
0x140001090: SetBoldFont
0x140006B70: api-ms-win-core-errorhandling-l1-1-0_NULL_THUNK_DATA
0x140007BB4: "__cdecl _IMPORT_DESCRIPTOR_COMDLG32" __IMPORT_DESCRIPTOR_COMDLG32
0x140009CF8: g_CancelEvent
0x140004314: "bool __cdecl _SetSessionEvent(void * __ptr64,void * __ptr64)" ?_SetSessionEvent@@YA_NPEAX0@Z
0x140006BA0: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x140006F00: "Global\{DFFDE213-8CB4-46a9-90EB-" ??_C@_1GK@LEBNLGEO@?$AAG?$AAl?$AAo?$AAb?$AAa?$AAl?$AA?2?$AA?$HL?$AAD?$AAF?$AAF?$AAD?$AAE?$AA2?$AA1?$AA3?$AA?9?$AA8?$AAC?$AAB?$AA4?$AA?9?$AA4?$AA6?$AAa?$AA9?$AA?9?$AA9?$AA0?$AAE?$AAB?$AA?9@
0x1400095F8: "__cdecl _native_startup_lock" __native_startup_lock
0x140004D70: "__cdecl _CxxSetUnhandledExceptionFilter" __CxxSetUnhandledExceptionFilter
0x1400050D0: "__cdecl _GSHandlerCheck_SEH" __GSHandlerCheck_SEH
0x140006C40: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x14000A0E8: g_StopEvent
0x140006BC8: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x140006B80: api-ms-win-core-libraryloader-l1-2-0_NULL_THUNK_DATA
0x140003A60: CADDlgProc
0x140006A60: KERNEL32_NULL_THUNK_DATA
0x140006A38: "__cdecl _imp_GetLastError" __imp_GetLastError
0x140006A18: "__cdecl _imp_DuplicateHandle" __imp_DuplicateHandle
0x140005048: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x1400095D0: "void * __ptr64 __ptr64 g_hSessionEventsNeedProcessing" ?g_hSessionEventsNeedProcessing@@3PEAXEA
0x140006CA0: "__cdecl _imp__commode" __imp__commode
0x140006CD0: "__cdecl _imp_TpAllocWait" __imp_TpAllocWait
0x140006DD0: "Encrypted temp backup file" ??_C@_1DG@FKBJNGL@?$AAE?$AAn?$AAc?$AAr?$AAy?$AAp?$AAt?$AAe?$AAd?$AA?5?$AAt?$AAe?$AAm?$AAp?$AA?5?$AAb?$AAa?$AAc?$AAk?$AAu?$AAp?$AA?5?$AAf?$AAi?$AAl?$AAe?$AA?$AA@
0x140006C70: "__cdecl _imp___setusermatherr" __imp___setusermatherr
0x1400096A0: g_AsyncData
0x140007A4C: "__cdecl _IMPORT_DESCRIPTOR_ADVAPI32" __IMPORT_DESCRIPTOR_ADVAPI32
0x140006B88: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x140006CF8: "__cdecl _imp_TpReleaseWait" __imp_TpReleaseWait
0x140004F10: "__cdecl ValidateImageBase" _ValidateImageBase
0x140001208: ShowInlineErrorMessage
0x140001D58: BackupFilenameDlg_Browse
0x140007B50: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0
0x140006B50: "__cdecl _imp_PostMessageW" __imp_PostMessageW
0x140006AF8: "__cdecl _imp_GetDlgItem" __imp_GetDlgItem
0x140006A30: "__cdecl _imp_GetTempPathW" __imp_GetTempPathW
0x1400069E0: "__cdecl _imp_HeapAlloc" __imp_HeapAlloc
0x140001130: StopEventCallback
0x140006A10: "__cdecl _imp_OpenProcess" __imp_OpenProcess
0x1400095C8: "__cdecl newmode" _newmode
0x140006AC0: "__cdecl _imp_RpcBindingFree" __imp_RpcBindingFree
0x140006D00: "__cdecl _imp_NtPrivilegeCheck" __imp_NtPrivilegeCheck
0x140006C78: "__cdecl _imp__initterm" __imp__initterm
0x140006A88: "__cdecl _imp_RpcStringBindingComposeW" __imp_RpcStringBindingComposeW
0x140006C60: "__cdecl _imp___set_app_type" __imp___set_app_type
0x140003BF0: ProcessArgList
0x140004E50: "__cdecl setargv" _setargv
0x140006A58: "__cdecl _imp_SetLastError" __imp_SetLastError
0x140002BB0: BackupRestoreProgressDlg_AsyncTransferComplete
0x140006960: CRYPT32_NULL_THUNK_DATA
0x1400045D4: StringCchPrintfW
0x1400095E8: "__cdecl _onexitend" __onexitend
0x1400069C0: "__cdecl _imp_CreateThread" __imp_CreateThread
0x140006C48: "__cdecl _imp__exit" __imp__exit
0x140006D10: "__cdecl _imp_NetValidatePasswordPolicy" __imp_NetValidatePasswordPolicy
0x140006D20: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x140006BA8: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x140006B58: USER32_NULL_THUNK_DATA
0x140006CB8: netutils_NULL_THUNK_DATA
0x140006C38: "__cdecl _imp_swscanf" __imp_swscanf
0x1400068D8: "__cdecl _imp_GetTokenInformation" __imp_GetTokenInformation
0x140006CC0: "__cdecl _imp_RtlNtStatusToDosError" __imp_RtlNtStatusToDosError
0x140002F90: BackupRestoreProgressDlgProc
0x140006C08: api-ms-win-core-sysinfo-l1-1-0_NULL_THUNK_DATA
0x140006D48: "__cdecl _xi_a" __xi_a
0x140006E88: "crd" ??_C@_17DGBHELFA@?$AAc?$AAr?$AAd?$AA?$AA@
0x140006BF8: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x140004E50: "__cdecl matherr" _matherr
0x140006CB0: "__cdecl _imp_NetApiBufferFree" __imp_NetApiBufferFree
0x140006DC0: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x140007B14: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0
0x140006AC8: "__cdecl _imp_I_RpcExceptionFilter" __imp_I_RpcExceptionFilter
0x1400030B8: BackupPasswordDlg_WizNext
0x140001180: BackupWizardGenerateTempFileName
0x140007BA0: "__cdecl _IMPORT_DESCRIPTOR_COMCTL32" __IMPORT_DESCRIPTOR_COMCTL32
0x140006E90: "/proceid=%u" ??_C@_1BI@NOCLNCIA@?$AA?1?$AAp?$AAr?$AAo?$AAc?$AAe?$AAi?$AAd?$AA?$DN?$AA?$CF?$AAu?$AA?$AA@
0x140004B50: "__cdecl _security_check_cookie" __security_check_cookie
0x140006D40: "__cdecl _xc_z" __xc_z
0x140006BB0: api-ms-win-core-processthreads-l1-1-0_NULL_THUNK_DATA
0x140003740: RestorePasswordDlgProc
0x140009AE0: g_StopEventContext
0x140006910: "__cdecl _imp_CredBackupCredentials" __imp_CredBackupCredentials
0x140006C88: "__cdecl _imp_?terminate@@YAXXZ" __imp_?terminate@@YAXXZ
0x140007AEC: "__cdecl _IMPORT_DESCRIPTOR_netutils" __IMPORT_DESCRIPTOR_netutils
0x140006C00: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x140006A28: "__cdecl _imp_LocalAlloc" __imp_LocalAlloc
0x140006A70: "__cdecl _imp_UninitLocalMsCtfMonitor" __imp_UninitLocalMsCtfMonitor
0x1400069E8: "__cdecl _imp_GetProcessHeap" __imp_GetProcessHeap
0x140001F50: BackupFilenameDlg_WizNext
0x1400095D8: "void * __ptr64 __ptr64 g_hStartSystemIhm" ?g_hStartSystemIhm@@3PEAXEA
0x140006AF0: "__cdecl _imp_GetParent" __imp_GetParent
0x140006BE0: api-ms-win-core-rtlsupport-l1-1-0_NULL_THUNK_DATA
0x140007B28: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0
0x140006BC0: api-ms-win-core-profile-l1-1-0_NULL_THUNK_DATA
0x140006D68: "__cdecl _guard_fids_table" __guard_fids_table
0x140006CA8: msvcrt_NULL_THUNK_DATA
0x1400067D0: "__cdecl load_config_used" _load_config_used
0x1400027A8: SecureDesktopRestoreRequest
0x140001338: PopulateWizardSheet
0x14000289C: BackupRestoreProgressDlg_SetActive
0x140007BC8: "__cdecl _IMPORT_DESCRIPTOR_MsCtfMonitor" __IMPORT_DESCRIPTOR_MsCtfMonitor
0x140007AC4: "__cdecl _IMPORT_DESCRIPTOR_CRYPT32" __IMPORT_DESCRIPTOR_CRYPT32
0x140006DC8: "CRD" ??_C@_17GIPPIDAO@?$AAC?$AAR?$AAD?$AA?$AA@
0x140006A98: "__cdecl _imp_Ndr64AsyncClientCall" __imp_Ndr64AsyncClientCall
0x140007A88: "__cdecl _IMPORT_DESCRIPTOR_USER32" __IMPORT_DESCRIPTOR_USER32
0x140006B30: "__cdecl _imp_SetWindowTextW" __imp_SetWindowTextW
0x140006AB8: "__cdecl _imp_RpcBindingFromStringBindingW" __imp_RpcBindingFromStringBindingW
0x140006C28: "__cdecl _imp__amsg_exit" __imp__amsg_exit
0x140006CF0: "__cdecl _imp_TpSetWait" __imp_TpSetWait
0x140007070: "{773F1B9A-35B9-4E95-83A0-A210F2D" ??_C@_1FG@BJPJPENJ@?$AA?$HL?$AA7?$AA7?$AA3?$AAF?$AA1?$AAB?$AA9?$AAA?$AA?9?$AA3?$AA5?$AAB?$AA9?$AA?9?$AA4?$AAE?$AA9?$AA5?$AA?9?$AA8?$AA3?$AAA?$AA0?$AA?9?$AAA?$AA2?$AA1?$AA0?$AAF?$AA2?$AAD@
0x140006CE8: "__cdecl _imp_NtClose" __imp_NtClose
0x140006B20: "__cdecl _imp_LoadStringW" __imp_LoadStringW
0x14000A0F0: g_Instance
0x140006BD0: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x140001AD4: DecryptFileGeneratedByCredBackupAndCopyToUserPath
0x140006BB8: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x140006A40: "__cdecl _imp_WaitForMultipleObjects" __imp_WaitForMultipleObjects
0x1400095C4: "__cdecl dowildcard" _dowildcard
0x140006AE8: "__cdecl _imp_EnableWindow" __imp_EnableWindow
0x140001B94: DuplicateCallingProcessHandle
0x140006AA8: "__cdecl _imp_RpcStringFreeW" __imp_RpcStringFreeW
0x140006BD8: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x1400069F8: "__cdecl _imp_GetFileSizeEx" __imp_GetFileSizeEx
0x140006948: COMDLG32_NULL_THUNK_DATA
0x140005030: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x1400013E0: RPCBackupRestoreThread
0x140004D9C: RtlpImageNtHeader
0x140006998: "__cdecl _imp_SleepEx" __imp_SleepEx
0x140006908: "__cdecl _imp_ConvertStringSecurityDescriptorToSecurityDescriptorW" __imp_ConvertStringSecurityDescriptorToSecurityDescriptorW
0x14000A0F8: g_UserImpToken
0x140006B78: "__cdecl _imp_GetModuleHandleW" __imp_GetModuleHandleW
0x140006B18: "__cdecl _imp_ShowWindow" __imp_ShowWindow
0x140003524: RestorePasswordDlg_WizNext
0x140006C30: "__cdecl _imp__XcptFilter" __imp__XcptFilter
0x140006B38: "__cdecl _imp_SendMessageW" __imp_SendMessageW
0x140006D08: ntdll_NULL_THUNK_DATA
0x140006958: "__cdecl _imp_CryptProtectData" __imp_CryptProtectData
0x140004420: WlSecureDesktop_midl_user_allocate
0x140006C68: "__cdecl _imp__ismbblead" __imp__ismbblead
0x140006B10: "__cdecl _imp_GetDlgItemTextW" __imp_GetDlgItemTextW
0x140004388: "bool __cdecl _SetSystemEvent(struct SystemEventInfo const * __ptr64)" ?_SetSystemEvent@@YA_NPEBUSystemEventInfo@@@Z
0x140009008: "__cdecl _security_cookie" __security_cookie
0x1400042BC: "void * __ptr64 __cdecl CreateSystemEvent(struct SystemEventInfo const * __ptr64)" ?CreateSystemEvent@@YAPEAXPEBUSystemEventInfo@@@Z
0x1400069B8: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x140006990: "__cdecl _imp_LocalFree" __imp_LocalFree
0x140009000: "__cdecl _defaultmatherr" __defaultmatherr
0x140007B3C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0
0x140006A00: "__cdecl _imp_GlobalFree" __imp_GlobalFree
0x1400095F0: "__cdecl _onexitbegin" __onexitbegin
0x140006C58: "__cdecl _imp__vsnwprintf" __imp__vsnwprintf
0x140006B68: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x1400048D0: WinMainCRTStartup
0x140006CC8: "__cdecl _imp_TpWaitForWait" __imp_TpWaitForWait
0x140007A60: "__cdecl _IMPORT_DESCRIPTOR_KERNEL32" __IMPORT_DESCRIPTOR_KERNEL32
0x140004F44: "__cdecl _security_init_cookie" __security_init_cookie
0x140006C50: "__cdecl _imp__cexit" __imp__cexit
0x1400033A0: BackupPasswordDlgProc
0x140006968: "__cdecl _imp_GetObjectW" __imp_GetObjectW
0x140001400: RPCBackupRestoreCallback
0x140004DF8: "__cdecl get_image_app_type" _get_image_app_type
0x140007A9C: "__cdecl _IMPORT_DESCRIPTOR_msvcrt" __IMPORT_DESCRIPTOR_msvcrt
0x140009620: g_Async
0x140006ED0: "/stopevent=%I64u" ??_C@_1CC@IDKKHFKL@?$AA?1?$AAs?$AAt?$AAo?$AAp?$AAe?$AAv?$AAe?$AAn?$AAt?$AA?$DN?$AA?$CF?$AAI?$AA6?$AA4?$AAu?$AA?$AA@
0x140006918: ADVAPI32_NULL_THUNK_DATA
0x140006A48: "__cdecl _imp_WriteFile" __imp_WriteFile
0x140007AB0: "__cdecl _IMPORT_DESCRIPTOR_RPCRT4" __IMPORT_DESCRIPTOR_RPCRT4
0x140007A74: "__cdecl _IMPORT_DESCRIPTOR_GDI32" __IMPORT_DESCRIPTOR_GDI32
0x1400068E0: "__cdecl _imp_DuplicateToken" __imp_DuplicateToken
0x140006AD0: RPCRT4_NULL_THUNK_DATA
0x140004BB0: "__cdecl _report_gsfailure" __report_gsfailure
0x140006A80: "__cdecl _imp_RpcAsyncInitializeHandle" __imp_RpcAsyncInitializeHandle
0x140009600: "__cdecl _native_startup_state" __native_startup_state
0x140002020: BackupFilenameDlgProc
0x140007BDC: "__cdecl _IMPORT_DESCRIPTOR_SHELL32" __IMPORT_DESCRIPTOR_SHELL32
0x140006A68: "__cdecl _imp_InitLocalMsCtfMonitor" __imp_InitLocalMsCtfMonitor
0x140006C98: "__cdecl _imp__fmode" __imp__fmode
0x140009D00: g_MessageText
0x1400038C4: CADDlg_SetActive
0x140007B64: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0
0x140006940: "__cdecl _imp_GetSaveFileNameW" __imp_GetSaveFileNameW
0x140004EB0: "__cdecl IsNonwritableInCurrentImage" _IsNonwritableInCurrentImage
0x140006BF0: api-ms-win-core-synch-l1-2-0_NULL_THUNK_DATA
0x140006AB0: "__cdecl _imp_RpcBindingSetAuthInfoExW" __imp_RpcBindingSetAuthInfoExW
0x140006B48: "__cdecl _imp_CheckRadioButton" __imp_CheckRadioButton
0x140007B00: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0
0x14000515C: memset
0x140007BF0: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x1400069A8: "__cdecl _imp_ReadFile" __imp_ReadFile
0x140006F70: "O:SYG:SYD:(A;;0x1F0003;;;SY)(A;;" ??_C@_1FE@IIDGLOLO@?$AAO?$AA?3?$AAS?$AAY?$AAG?$AA?3?$AAS?$AAY?$AAD?$AA?3?$AA?$CI?$AAA?$AA?$DL?$AA?$DL?$AA0?$AAx?$AA1?$AAF?$AA0?$AA0?$AA0?$AA3?$AA?$DL?$AA?$DL?$AA?$DL?$AAS?$AAY?$AA?$CJ?$AA?$CI?$AAA?$AA?$DL?$AA?$DL@

[JEB Decompiler by PNF Software]