Generated by JEB on 2019/08/01

PE: C:\Windows\System32\samsrv.dll Base=0x180000000 SHA-256=774F3FC345AD8D94ED0CB93B6801985AB24C1810F9DF11F751B46EA9941B4D9D
PDB: samsrv.pdb GUID={613A258F-8B22-4DD9-C80740FBB3C010B3} Age=1

4425 located named symbols:
0x1800A8808: "__cdecl _imp_RtlInitUnicodeStringEx" __imp_RtlInitUnicodeStringEx
0x1800D3BF0: SampComponentUpdatesWatchEvent
0x1800D2BB8: "__cdecl _hmod__WS2_32_dll" __hmod__WS2_32_dll
0x1800BB2C8: "(%lx): Failed to open key: [%ws]" ??_C@_0CB@JIHDFFI@?$CI?$CFlx?$CJ?3?5Failed?5to?5open?5key?3?5?$FL?$CFws?$FN@
0x1800AAD18: "NtQuerySystemInformation" ??_C@_0BJ@NDLOPGCH@NtQuerySystemInformation?$AA@
0x1800BA0A0: "Total time spent processing (in " ??_C@_1EI@BEEGEGCM@?$AAT?$AAo?$AAt?$AAa?$AAl?$AA?5?$AAt?$AAi?$AAm?$AAe?$AA?5?$AAs?$AAp?$AAe?$AAn?$AAt?$AA?5?$AAp?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AAi?$AAn?$AAg?$AA?5?$AA?$CI?$AAi?$AAn?$AA?5@
0x1800A8CF0: "__cdecl _imp_RtlpNtOpenKey" __imp_RtlpNtOpenKey
0x1800B67E0: "SampRegistryUpdateInteractiveLog" ??_C@_0GE@KHPFCBDO@SampRegistryUpdateInteractiveLog@
0x180074C70: SampExtSetAttributesExDs
0x1800B58A0: "SamrEnumerateDomainsInSamServer" ??_C@_0CA@FMAAJGOH@SamrEnumerateDomainsInSamServer?$AA@
0x1800BE900: "%s: Will try to find the OID: '%" ??_C@_1GI@MGBMINBB@?$AA?$CF?$AAs?$AA?3?$AA?5?$AAW?$AAi?$AAl?$AAl?$AA?5?$AAt?$AAr?$AAy?$AA?5?$AAt?$AAo?$AA?5?$AAf?$AAi?$AAn?$AAd?$AA?5?$AAt?$AAh?$AAe?$AA?5?$AAO?$AAI?$AAD?$AA?3?$AA?5?$AA?8?$AA?$CF@
0x18006D5E4: "__cdecl fgs__SAMPR_DOMAIN_DISPLAY_MACHINE_BUFFER" _fgs__SAMPR_DOMAIN_DISPLAY_MACHINE_BUFFER
0x1800BBD70: "Error re-opening excluded hive f" ??_C@_0DE@PAKJMEJI@Error?5re?9opening?5excluded?5hive?5f@
0x1800B4EB0: "WinThreshold-M3 to WinThreshold-" ??_C@_0CI@NNEPANIG@WinThreshold?9M3?5to?5WinThreshold?9@
0x1800D3708: SampFailureAccountAuditingEnabled
0x1800095B0: SampValidateSIDArray
0x18009980C: "long __cdecl StringCat(unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short * __ptr64 * __ptr64)" ?StringCat@@YAJPEBG0PEAPEAG@Z
0x1800B93F0: "\REGISTRY\MACHINE\SOFTWARE\MICRO" ??_C@_1HO@BGPGFBAF@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAI?$AAC?$AAR?$AAO@
0x1800B2C60: SampQueryInformationUserGuid
0x1800B6D68: SampObjectTypeToSidNameUseMapping
0x18001D420: SampGetDomainSidFromIndex
0x1800BF3E4: "1" ??_C@_13JGCMLPCH@?$AA1?$AA?$AA@
0x1800B8ECC: "online" ??_C@_06GNLMCJKK@online?$AA@
0x1800D07F0: DomainExtendedAttributeProperties
0x1800B2AD0: SampOpenGroupGuid
0x180031248: "__cdecl _raise_securityfailure" __raise_securityfailure
0x180069DB0: SamrAddMemberToGroup
0x180088EE0: PSAMPR_SERVER_NAME_bind
0x180086C9C: SampValidateGroupInfoBuffer
0x1800A86C0: "__cdecl _imp_ImpersonateLoggedOnUser" __imp_ImpersonateLoggedOnUser
0x1800A98C0: "FALSE" ??_C@_05MAJJAKPI@FALSE?$AA@
0x1800B2A30: SampQueryDisplayInformationGuid
0x1800A8C60: "__cdecl _imp_RtlAddAttributeActionToRXact" __imp_RtlAddAttributeActionToRXact
0x1800B4C48: "%s\*.*" ??_C@_1O@NOAPAMN@?$AA?$CF?$AAs?$AA?2?$AA?$CK?$AA?4?$AA?$CK?$AA?$AA@
0x1800A81B8: api-ms-win-core-file-l1-1-0_NULL_THUNK_DATA
0x180017950: SampSetUlongArrayAttribute
0x1800328AB: "__cdecl _tailMerge_api_ms_win_security_systemfunctions_l1_1_0_dll" __tailMerge_api_ms_win_security_systemfunctions_l1_1_0_dll
0x1800BF678: "NtEnumerateBootEntries" ??_C@_0BH@DMIODNGA@NtEnumerateBootEntries?$AA@
0x1800B9618: SclEvent_Generic_Warning
0x1800655D8: SampSetKrbTgtPassword
0x1800A8A20: "__cdecl _imp_RtlAddAuditAccessAce" __imp_RtlAddAuditAccessAce
0x1800C7FF8: "__cdecl _DELAY_IMPORT_DESCRIPTOR_NETLOGON_dll" __DELAY_IMPORT_DESCRIPTOR_NETLOGON_dll
0x180098580: RtlDecodeUtf16LE
0x18006BF60: SamIRandomizeStoredPassword
0x18007CDA8: SampCheckAccountScrilState
0x180031A30: "void __cdecl __scrt_initialize_type_info(void)" ?__scrt_initialize_type_info@@YAXXZ
0x180032BD3: "__cdecl _tailMerge_dsparse_dll" __tailMerge_dsparse_dll
0x1800BA3D0: "SclAcquireRequiredPrivileges" ??_C@_0BN@GDIAHABI@SclAcquireRequiredPrivileges?$AA@
0x1800D2BA8: "__cdecl _hmod__DNSAPI_dll" __hmod__DNSAPI_dll
0x1800743D4: SampExtGetGroupMembershipOfAccountDs
0x1800BEE50: "%s: FindExtensionByOid: pcszOid " ??_C@_1FC@GEGMKIKN@?$AA?$CF?$AAs?$AA?3?$AA?5?$AAF?$AAi?$AAn?$AAd?$AAE?$AAx?$AAt?$AAe?$AAn?$AAs?$AAi?$AAo?$AAn?$AAB?$AAy?$AAO?$AAi?$AAd?$AA?3?$AA?5?$AAp?$AAc?$AAs?$AAz?$AAO?$AAi?$AAd?$AA?5@
0x1800A8958: "__cdecl _imp_EtwUnregisterTraceGuids" __imp_EtwUnregisterTraceGuids
0x18001D790: SampGetUlongArrayAttribute
0x1800CBFE8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-2-0
0x1800744D0: SampExtGetPrimaryGroupMembersDs
0x1800B41F8: "PasswordFilterRoutine result for" ??_C@_0CM@IICODOOG@PasswordFilterRoutine?5result?5for@
0x1800B9E60: "Number of reparse points process" ??_C@_1EG@ELECLJEB@?$AAN?$AAu?$AAm?$AAb?$AAe?$AAr?$AA?5?$AAo?$AAf?$AA?5?$AAr?$AAe?$AAp?$AAa?$AAr?$AAs?$AAe?$AA?5?$AAp?$AAo?$AAi?$AAn?$AAt?$AAs?$AA?5?$AAp?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs@
0x18001B770: SampQueryUserSupplementalCredentialsRegistry
0x1800B3400: "\Aliases\" ??_C@_1BE@CFPKMFFL@?$AA?2?$AAA?$AAl?$AAi?$AAa?$AAs?$AAe?$AAs?$AA?2?$AA?$AA@
0x18007AA18: SampAddMemberRidTo18471Key
0x18000CDEC: SampValidateValidatePasswordChangeInputArg
0x1800BB060: "(%lx): Unable to get file system" ??_C@_0CN@KFINOJCF@?$CI?$CFlx?$CJ?3?5Unable?5to?5get?5file?5system@
0x1800B5710: "SampPerformWAUUpgradeIfNecessary" ??_C@_0EH@MCBIIDPA@SampPerformWAUUpgradeIfNecessary@
0x1800BC910: "FixReparsePointPath: Reparse poi" ??_C@_1JM@EALFHOMF@?$AAF?$AAi?$AAx?$AAR?$AAe?$AAp?$AAa?$AAr?$AAs?$AAe?$AAP?$AAo?$AAi?$AAn?$AAt?$AAP?$AAa?$AAt?$AAh?$AA?3?$AA?5?$AAR?$AAe?$AAp?$AAa?$AAr?$AAs?$AAe?$AA?5?$AAp?$AAo?$AAi@
0x1800A8A78: "__cdecl _imp_RtlCreateEnvironment" __imp_RtlCreateEnvironment
0x180099F3C: "public: static long __cdecl Logger::WriteRegistryFailureEventEx(unsigned long,unsigned short const * __ptr64,unsigned short const * __ptr64,...)" ?WriteRegistryFailureEventEx@Logger@@SAJKPEBG0ZZ
0x18008EA38: RtlStringCchCatW
0x180083AEC: SampAddSupplementalCredentialsToList
0x1800BC660: "(%lx): NtQueryVolumeInformationF" ??_C@_0CL@NBAKIPCA@?$CI?$CFlx?$CJ?3?5NtQueryVolumeInformationF@
0x18000A9A4: SampValidateUserPrimaryGroupInformation
0x1800B2F50: SAMMSG_REMOTE_SAM_SUPPRESSED_MESSAGE_COUNTER
0x180073BBC: StringCchCatW
0x180032F02: "__cdecl _imp_load_SystemFunction024" __imp_load_SystemFunction024
0x1800874F8: SampValidateUserNameInformation
0x1800A2FB0: SampStoreFunctionsForExtendedAttributes
0x180050670: SampRODCCacheFree
0x1800B2A90: SampGetMembersInGroupGuid
0x1800B95F8: SclEvent_ResetDiskSignatures_Start
0x1800BF630: "NtAddDriverEntry" ??_C@_0BB@OFMAPKON@NtAddDriverEntry?$AA@
0x18007813C: SampCheckRpcRemoteCallerAccess
0x180098D50: "long __cdecl StringCchCatW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64)" ?StringCchCatW@@YAJPEAG_KPEBG@Z
0x18007CF98: SampCheckForLocalProtectedAdministrators
0x18009D670: EFIDEInterpretDriverEntries
0x1800BC450: "Marking event [&SclEvent_Process" ??_C@_0DG@HCHDGNIF@Marking?5event?5?$FL?$CGSclEvent_Process@
0x18006DE10: CngRsa32Compat_MD5Final
0x1800A86F8: "__cdecl _imp_GetIdentityProviderInfoByGUID" __imp_GetIdentityProviderInfoByGUID
0x1800B6190: AdministrativeRids
0x1800D5258: EfipDeleteBootEntry
0x18001A000: GtbpAllocateLeafAndNodes
0x1800BCEC0: " *** Assertion failed: %s *** " ??_C@_0DM@NBFILLLK@?6?$CK?$CK?$CK?5Assertion?5failed?3?5?$CFs?6?$CK?$CK?$CK?5?5?5@
0x18002255C: SampUpgradeSamDatabase
0x18006D5E4: "__cdecl fgs__SAMPR_DOMAIN_DISPLAY_GROUP_BUFFER" _fgs__SAMPR_DOMAIN_DISPLAY_GROUP_BUFFER
0x1800B45B8: "Remote Interactive Logon" ??_C@_1DC@BDFPPMLA@?$AAR?$AAe?$AAm?$AAo?$AAt?$AAe?$AA?5?$AAI?$AAn?$AAt?$AAe?$AAr?$AAa?$AAc?$AAt?$AAi?$AAv?$AAe?$AA?5?$AAL?$AAo?$AAg?$AAo?$AAn?$AA?$AA@
0x18002EE30: "__cdecl _delayLoadHelper2" __delayLoadHelper2
0x1800753EC: SamIFree_DOMAIN_LOCALIZABLE_ACCOUNTS_INFO_BUFFER
0x1800A8B80: "__cdecl _imp_RtlFreeUnicodeString" __imp_RtlFreeUnicodeString
0x180006A30: SampMapGrantedAccessToAttributeAccess
0x1800CBDF4: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x180023E00: SampGetRegistryDword
0x1800D5260: EfipTranslateFilePath
0x1800B5CC0: "SamrGetUserDomainPasswordInforma" ??_C@_0CF@IADIIBNG@SamrGetUserDomainPasswordInforma@
0x1800B37D0: "krbtgt_%d" ??_C@_1BE@KAIJNBLI@?$AAk?$AAr?$AAb?$AAt?$AAg?$AAt?$AA_?$AA?$CF?$AAd?$AA?$AA@
0x18002F5E8: SampInitializeActiveEnumerationClientTable
0x1800B8D88: "Lookup" ??_C@_06JCNKMBNA@Lookup?$AA@
0x1800A85C0: "__cdecl _imp__o__execute_onexit_table" __imp__o__execute_onexit_table
0x1800BA5B0: "Successfully updated layout" ??_C@_0BM@GAHIBLJI@Successfully?5updated?5layout?$AA@
0x1800D3BE8: SampNotificationPackages
0x1800B2980: SampLookupIdsInDomainGuid
0x18002EBD0: SampInitializeObjectChangeNotification
0x180055454: SetCurrentDomain
0x1800B51F0: "SampApplyDomainUpdates: The foll" ??_C@_0EN@OOGJLABK@SampApplyDomainUpdates?3?5The?5foll@
0x18009E490: SampExtendedAttributeFunctions
0x1800B3DC8: "Setup: " ??_C@_07OODMHDOB@Setup?3?5?$AA@
0x1800BA920: "(%lx): Failed to set: %ws ! %.*w" ??_C@_0CC@CJLPINGK@?$CI?$CFlx?$CJ?3?5Failed?5to?5set?3?5?$CFws?5?$CB?5?$CF?4?$CKw@
0x1800AB4E0: "__cdecl _sz_cryptdll_dll" __sz_cryptdll_dll
0x1800267D0: SampExamineSid
0x1800D37B0: SampContextListHead
0x180076270: SampTraceControlCallBack
0x180087790: SampValidateUserLogonInformation
0x1800CBDE0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-crt-private-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-crt-private-l1-1-0
0x1800CBEBC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-kernel32-legacy-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-kernel32-legacy-l1-1-0
0x1800B60B0: "objectVersion" ??_C@_1BM@EAODEAII@?$AAo?$AAb?$AAj?$AAe?$AAc?$AAt?$AAV?$AAe?$AAr?$AAs?$AAi?$AAo?$AAn?$AA?$AA@
0x1800B8E30: "!@#$%^&*()qwertyUIOPAzxcvbnmQQQQ" ??_C@_0CP@PNPEJJMN@?$CB?$EA?$CD$?$CF?$FO?$CG?$CK?$CI?$CJqwertyUIOPAzxcvbnmQQQQ@
0x1800B3398: "\Aliases\Names" ??_C@_1BO@MNKAAKFA@?$AA?2?$AAA?$AAl?$AAi?$AAa?$AAs?$AAe?$AAs?$AA?2?$AAN?$AAa?$AAm?$AAe?$AAs?$AA?$AA@
0x1800A8280: "__cdecl _imp_VirtualProtect" __imp_VirtualProtect
0x180002D98: SampOpenAccount
0x18007ADEC: SampMatchDomainPrefix
0x18000B924: RtlStringCchCopyW
0x180055228: SampGetMessageStringsWithLanguage
0x180010B00: SampCreateSupplementalCredentials
0x180019B70: SamIMixedDomain2
0x1800327A3: "__cdecl _imp_load_RpcBindingServerFromClient" __imp_load_RpcBindingServerFromClient
0x1800DD238: "__cdecl _imp_RegReplaceKeyW" __imp_RegReplaceKeyW
0x1800BAA68: "(%lx): Failed to create full pat" ??_C@_0DC@EMECAPDN@?$CI?$CFlx?$CJ?3?5Failed?5to?5create?5full?5pat@
0x180076B04: SampCheckForceResetCanChangePassword
0x1800D3550: FlushAsync
0x1800AB780: "Not Available" ??_C@_1BM@EKKKCBGF@?$AAN?$AAo?$AAt?$AA?5?$AAA?$AAv?$AAa?$AAi?$AAl?$AAa?$AAb?$AAl?$AAe?$AA?$AA@
0x1800D2B14: "__cdecl _scrt_current_native_startup_state" __scrt_current_native_startup_state
0x1800B2B60: SampPasswordPushPdcGuid
0x1800BA258: "SystemRoot" ??_C@_1BG@FIGGICF@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAo?$AAo?$AAt?$AA?$AA@
0x1800BB410: "SclRegProcessKeySubkeys" ??_C@_0BI@GKADPCHE@SclRegProcessKeySubkeys?$AA@
0x180020A6C: SampInitializeDisplayInformation
0x1800D3BC8: SampCurrentSDDLInAction
0x1800D1C28: "__cdecl _security_cookie_complement" __security_cookie_complement
0x1800180D0: SampDsInitializeSingleDomain
0x1800BB2F0: "SclRegProcessKeyRecursiveByName" ??_C@_0CA@MFHNDMMK@SclRegProcessKeyRecursiveByName?$AA@
0x1800B6AD0: "SampRefreshRegistry: Failed to R" ??_C@_0EN@JEOIMKK@SampRefreshRegistry?3?5Failed?5to?5R@
0x18002F510: SampInitializeTrace
0x1800B6B20: "SampRefreshRegistry: Failed to R" ??_C@_0DJ@IADMCDMN@SampRefreshRegistry?3?5Failed?5to?5R@
0x18002D3FC: "public: unsigned long * __ptr64 __cdecl SP<unsigned char,class SP_HLOCAL<unsigned char> >::GetPtrAs<unsigned long>(void)const __ptr64" ??$GetPtrAs@K@?$SP@EV?$SP_HLOCAL@E@@@@QEBAPEAKXZ
0x180085AA0: SampGetNoGcLogonEnforceKerberosIpCheck
0x1800A85A8: "__cdecl _imp_wcsncpy_s" __imp_wcsncpy_s
0x18009B974: OSBOFindBootEntry
0x1800A8920: "__cdecl _imp_NtOpenProcess" __imp_NtOpenProcess
0x18001B6A0: SampPasswordChangeNotify
0x1800D1850: DsWellKnownSecurityPrincipalsToAddTillWS03
0x18000D57C: SampValidatePasswordReset
0x18001B660: SampFreeSensitiveUnicodeString
0x1800BD5F8: "pJoined" ??_C@_1BA@BIELKCO@?$AAp?$AAJ?$AAo?$AAi?$AAn?$AAe?$AAd?$AA?$AA@
0x18002073C: SampInitializeDomainObject
0x1800B2C40: SampSetInformationGroupGuid
0x1800244C8: SampCheckAccessToLogonUIInformation
0x180022410: CEventRegister
0x18004E440: SampRemoveMemberFromAliasActual
0x1800AAA68: "ncalrpc" ??_C@_1BA@EONDGCCM@?$AAn?$AAc?$AAa?$AAl?$AAr?$AAp?$AAc?$AA?$AA@
0x1800BBFF0: "(%lx): Failed to retrieve repars" ??_C@_0GD@FOJGHJIJ@?$CI?$CFlx?$CJ?3?5Failed?5to?5retrieve?5repars@
0x18001FC2C: SampAlGrowMemberDomain
0x1800A9928: "SamrValidatePassword" ??_C@_1CK@MHNJDNIP@?$AAS?$AAa?$AAm?$AAr?$AAV?$AAa?$AAl?$AAi?$AAd?$AAa?$AAt?$AAe?$AAP?$AAa?$AAs?$AAs?$AAw?$AAo?$AAr?$AAd?$AA?$AA@
0x18001E9F0: SamIGetUserLogonInformation2
0x18000E3F4: SampCheckForDuplicateSids
0x1800B42F8: WPP_8754d2f95b9038f2c86519b0ea0baf99_Traceguids
0x1800DD088: "__cdecl _imp_DnsNameCompareEx_W" __imp_DnsNameCompareEx_W
0x1800B2BD0: SampCreateGroupInDomainGuid
0x1800AA660: "RestrictAnonymous" ??_C@_0BC@CIPCHHBB@RestrictAnonymous?$AA@
0x1800AFB98: "msDS-ManagedPasswordPreviousId" ??_C@_1DO@MKICGDNO@?$AAm?$AAs?$AAD?$AAS?$AA?9?$AAM?$AAa?$AAn?$AAa?$AAg?$AAe?$AAd?$AAP?$AAa?$AAs?$AAs?$AAw?$AAo?$AAr?$AAd?$AAP?$AAr?$AAe?$AAv?$AAi?$AAo?$AAu?$AAs?$AAI?$AAd?$AA?$AA@
0x18001CB88: SampCreateAttrBlockForExtendedAttributes
0x1800B8D08: "127.0.0.1" ??_C@_1BE@KGBJBGOH@?$AA1?$AA2?$AA7?$AA?4?$AA0?$AA?4?$AA0?$AA?4?$AA1?$AA?$AA@
0x180074C04: SampExtSetAttributesDs
0x180070830: SampDeleteKeyForPostBootPromote
0x1800BE2B0: "EventWriteRegistryFailureEvent" ??_C@_1DO@GFFHNCMO@?$AAE?$AAv?$AAe?$AAn?$AAt?$AAW?$AAr?$AAi?$AAt?$AAe?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AAF?$AAa?$AAi?$AAl?$AAu?$AAr?$AAe?$AAE?$AAv?$AAe?$AAn?$AAt?$AA?$AA@
0x18006C860: SampIncreaseBadPwdCountLoopback
0x180010F90: SampRetrieveMultipleCredentials
0x1800DD068: "__cdecl _imp_SystemFunction031" __imp_SystemFunction031
0x1800DD038: "__cdecl _imp_SystemFunction030" __imp_SystemFunction030
0x1800733B8: SampAuditQueryBlankPassword
0x18001BBE0: SampGetDomainContextFromIndex
0x1800B8EB0: "SclpExecuteRequestInternal" ??_C@_0BL@CADCJOHD@SclpExecuteRequestInternal?$AA@
0x180097E38: "public: void __cdecl Windows::ErrorHandling::Rtl::CBaseFrame<class Windows::ErrorHandling::Rtl::CSimpleNtStatusCarryingFrame>::ReportErrorOrigination(struct Windows::ErrorHandling::_RTL_CALL_SITE const * __ptr64) __ptr64" ?ReportErrorOrigination@?$CBaseFrame@VCSimpleNtStatusCarryingFrame@Rtl@ErrorHandling@Windows@@@Rtl@ErrorHandling@Windows@@QEAAXPEBU_RTL_CALL_SITE@34@@Z
0x1800A82F0: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x1800D3560: SampLock
0x1800DD0F8: "__cdecl _imp_NdrServerCallAll" __imp_NdrServerCallAll
0x1800089E0: SampValidateAttributes
0x180064348: SampGetAccountNameFromRid
0x18002F6D0: SampInitContextList
0x180031EEE: "__cdecl configure_narrow_argv" _configure_narrow_argv
0x1800DD308: cryptdll_NULL_THUNK_DATA_DLA
0x180072CFC: SampAuditDomainChangeDs
0x1800C8D68: cryptdll_NULL_THUNK_DATA_DLB
0x1800DD2B8: "__cdecl _imp_SystemFunction036" __imp_SystemFunction036
0x18001DDA0: SampAlDelayedBuildAliasInformation
0x1800B4120: "SampSetLastLogonTimestampOnDcWor" ??_C@_0EN@KPJMPCL@SampSetLastLogonTimestampOnDcWor@
0x180032F78: "__cdecl _vcrt_thread_attach" __vcrt_thread_attach
0x1800C8520: cryptdll_NULL_THUNK_DATA_DLN
0x1800A82E8: "__cdecl _imp_TlsGetValue" __imp_TlsGetValue
0x1800AB5D0: "__cdecl _sz_CRYPTBASE_dll" __sz_CRYPTBASE_dll
0x1800BA2A0: "SclGenerateUniqueAccountDomainSi" ??_C@_0CC@IJMJJECA@SclGenerateUniqueAccountDomainSi@
0x1800B4ED8: "WinThreshold-Update4 to WinThres" ??_C@_0CN@PNNEFBBP@WinThreshold?9Update4?5to?5WinThres@
0x1800A8830: "__cdecl _imp_NtEnumerateKey" __imp_NtEnumerateKey
0x1800D3AD8: SampHasNeverTime
0x18007DE0C: SampForcePasswordReset
0x1800B5948: "SamrCreateUserInDomain" ??_C@_0BH@OGGJMJDA@SamrCreateUserInDomain?$AA@
0x180032F6C: "__cdecl _CxxFrameHandler3" __CxxFrameHandler3
0x1800D2550: RemoteAccessMapping
0x1800D3700: SampAdministratorsAliasSid
0x180030BCC: SampCleanup18471
0x180032D9F: "__cdecl _imp_load_SetupCloseLog" __imp_load_SetupCloseLog
0x1800B4678: "IUSR" ??_C@_19IIACPLDB@?$AAI?$AAU?$AAS?$AAR?$AA?$AA@
0x18001DC9C: SampExtInitDs
0x18009659C: GenerateRandomChars
0x1800BD790: "RegReadStringValue" ??_C@_1CG@DCGHLMCC@?$AAR?$AAe?$AAg?$AAR?$AAe?$AAa?$AAd?$AAS?$AAt?$AAr?$AAi?$AAn?$AAg?$AAV?$AAa?$AAl?$AAu?$AAe?$AA?$AA@
0x1800B2E60: SAMMSG_MEMBERSHIP_REMOVAL_SETUP_ERROR
0x1800BBBD8: "Error opening old hive key [%ws]" ??_C@_0CL@HALOGNBE@Error?5opening?5old?5hive?5key?5?$FL?$CFws?$FN@
0x18001D3E0: WPP_SF_L
0x1800BF070: "%s: %s failed with error code: 0" ??_C@_1EM@DGJIFBEG@?$AA?$CF?$AAs?$AA?3?$AA?5?$AA?$CF?$AAs?$AA?5?$AAf?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAw?$AAi?$AAt?$AAh?$AA?5?$AAe?$AAr?$AAr?$AAo?$AAr?$AA?5?$AAc?$AAo?$AAd?$AAe?$AA?3?$AA?5?$AA0@
0x1800A8D08: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x1800B4408: "Network" ??_C@_1BA@IFBJBPAK@?$AAN?$AAe?$AAt?$AAw?$AAo?$AAr?$AAk?$AA?$AA@
0x1800BEF10: "pcszOid" ??_C@_1BA@OFCDAFJD@?$AAp?$AAc?$AAs?$AAz?$AAO?$AAi?$AAd?$AA?$AA@
0x1800B4060: "At least one of PwdNotify, Delta" ??_C@_0GI@ICDGIEHF@At?5least?5one?5of?5PwdNotify?0?5Delta@
0x1800A8818: "__cdecl _imp_RtlAddAce" __imp_RtlAddAce
0x18001F0D0: SampCreateFullSid
0x1800AB3F0: "MofResource" ??_C@_1BI@BHAHBMFJ@?$AAM?$AAo?$AAf?$AAR?$AAe?$AAs?$AAo?$AAu?$AAr?$AAc?$AAe?$AA?$AA@
0x18009C3AC: EFIOSBOCreateEx
0x18001D8D0: WppControlCallback
0x18001CF80: SampGetCurrentOwnerAndPrimaryGroup
0x1800BA0E8: "TotalProcessingTimeInMS" ??_C@_1DA@KCGIOJDM@?$AAT?$AAo?$AAt?$AAa?$AAl?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AAi?$AAn?$AAg?$AAT?$AAi?$AAm?$AAe?$AAI?$AAn?$AAM?$AAS?$AA?$AA@
0x180098078: RtlHashEncodedLBlob
0x1800506E0: SampRODCCacheSearch
0x180033340: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x1800A8650: "__cdecl _imp_wcscspn" __imp_wcscspn
0x18000A9A4: SampValidateDomainStateInformation
0x180099DE0: "public: static long __cdecl Logger::TraceCritical(unsigned short const * __ptr64,...)" ?TraceCritical@Logger@@SAJPEBGZZ
0x180024730: SampQueryNetLogonChangeNumbers
0x1800A97C0: "SAM_SERVER" ??_C@_1BG@LBIONPDI@?$AAS?$AAA?$AAM?$AA_?$AAS?$AAE?$AAR?$AAV?$AAE?$AAR?$AA?$AA@
0x18006BEC4: SamIRSOScrilAccount
0x1800A7FC8: "__cdecl _imp_CertFreeCertificateContext" __imp_CertFreeCertificateContext
0x1800DD1A0: "__cdecl _imp_RpcServerRegisterAuthInfoW" __imp_RpcServerRegisterAuthInfoW
0x1800DD220: "__cdecl _imp_WSAStringToAddressA" __imp_WSAStringToAddressA
0x1800A85B8: "__cdecl _imp__o_wcstoul" __imp__o_wcstoul
0x1800BE970: "CertificateUtil::DoesExtensionWi" ??_C@_1FK@DOKCIIOJ@?$AAC?$AAe?$AAr?$AAt?$AAi?$AAf?$AAi?$AAc?$AAa?$AAt?$AAe?$AAU?$AAt?$AAi?$AAl?$AA?3?$AA?3?$AAD?$AAo?$AAe?$AAs?$AAE?$AAx?$AAt?$AAe?$AAn?$AAs?$AAi?$AAo?$AAn?$AAW?$AAi@
0x1800B5AB0: "SamrGetMembersInGroup" ??_C@_0BG@HIAMGNFB@SamrGetMembersInGroup?$AA@
0x180023FF8: "public: __cdecl JoinStatusStorage::JoinStatusRegKeyInfo::JoinStatusRegKeyInfo(void) __ptr64" ??0JoinStatusRegKeyInfo@JoinStatusStorage@@QEAA@XZ
0x1800B92C0: "Marking event [&SclEvent_Retarge" ??_C@_0CO@GDHAOMJA@Marking?5event?5?$FL?$CGSclEvent_Retarge@
0x1800AA5A0: WPP_aed78e2c85863b50d1a57b4e30ce2922_Traceguids
0x18002F2A8: SampEnableAuditPrivilege
0x1800011C0: SamIFree_SAMPR_ULONG_ARRAY
0x1800B6350: "UserId: 0x%x BadPasswordCount se" ??_C@_0CJ@BDABLIJO@UserId?3?50x?$CFx?5BadPasswordCount?5se@
0x1800A81A0: "__cdecl _imp_CreateFileW" __imp_CreateFileW
0x1800BADD8: "Value [%ws] is not registry stri" ??_C@_0CJ@JHPKMPNE@Value?5?$FL?$CFws?$FN?5is?5not?5registry?5stri@
0x1800B9298: "(%lx): Failed to process OS volu" ??_C@_0CD@OBDLPCDM@?$CI?$CFlx?$CJ?3?5Failed?5to?5process?5OS?5volu@
0x180002C60: SampGetCurrentClientSidEx
0x1800D5240: EfipQueryDriverEntryOrder
0x18009B168: "private: static long __cdecl CertificateUtil::GuidStringFromByteArray(unsigned char const * __ptr64,unsigned long,unsigned short * __ptr64 * __ptr64)" ?GuidStringFromByteArray@CertificateUtil@@CAJPEBEKPEAPEAG@Z
0x1800BDEE0: "pCertContext" ??_C@_1BK@HJABEDBP@?$AAp?$AAC?$AAe?$AAr?$AAt?$AAC?$AAo?$AAn?$AAt?$AAe?$AAx?$AAt?$AA?$AA@
0x1800A7BF0: SampTableFunctionNames
0x1800D3628: SampTransactionWithinDomainGlobal
0x18009021C: SclRegGetValue
0x1800D38B8: SampNeverDeltaTime
0x18007A8DC: SampAddAliasTo18471Key
0x18000EF30: SamINetLogonPing
0x1800BA7F0: "(%lx): Failed writing boot entry" ??_C@_0ED@GGCDJHLK@?$CI?$CFlx?$CJ?3?5Failed?5writing?5boot?5entry@
0x18001CF04: SampCopySidToSidAndAttributes
0x180099D08: "private: static long __cdecl Logger::Trace(enum _TRACE_LEVEL,unsigned short const * __ptr64,char * __ptr64)" ?Trace@Logger@@CAJW4_TRACE_LEVEL@@PEBGPEAD@Z
0x1800AA8C0: "TenantInfo" ??_C@_1BG@HPKDKHIH@?$AAT?$AAe?$AAn?$AAa?$AAn?$AAt?$AAI?$AAn?$AAf?$AAo?$AA?$AA@
0x1800605A8: SampDecodeIntoClaimsSet
0x1800AABA0: "SYSTEM\CurrentControlSet\Service" ??_C@_1EO@MKJNIFOB@?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA?2?$AAS?$AAe?$AAr?$AAv?$AAi?$AAc?$AAe@
0x180019C30: SampCompareUserNodeByName
0x180080800: SamrOemChangePasswordUser2
0x18000BDE8: SampValidateOperationObjChgInput
0x1800BF728: "NtTranslateFilePath" ??_C@_0BE@KBDFPLGP@NtTranslateFilePath?$AA@
0x180062678: SampEmptyGenericTable2
0x18000BE74: SampValidateEventHandle
0x180030DC0: "public: __cdecl JoinStatusStorage::JoinStatusRegKeyInfo::~JoinStatusRegKeyInfo(void) __ptr64" ??1JoinStatusRegKeyInfo@JoinStatusStorage@@QEAA@XZ
0x18002FFB8: SampProcessComponentUpdatesWorker
0x180027F20: SampStoreObjectExtendedAttributes
0x1800AB258: WPP_962a09af64423008570d505e25d4eb00_Traceguids
0x1800BC7A0: "SclProcessObjectSecurity" ??_C@_0BJ@KKCMIFNO@SclProcessObjectSecurity?$AA@
0x1800BC568: "The version of volume [%ws] is N" ??_C@_0CM@KHIHFJAI@The?5version?5of?5volume?5?$FL?$CFws?$FN?5is?5N@
0x180031FF4: "__cdecl vsnwprintf" _vsnwprintf
0x180032B6D: "__cdecl _imp_load_DnsValidateName_W" __imp_load_DnsValidateName_W
0x180014D30: SampAddSameDomainMemberToGlobalOrUniversalGroup
0x180032B91: "__cdecl _imp_load_QueryServiceStatus" __imp_load_QueryServiceStatus
0x1800A9910: "AdminInfo" ??_C@_1BE@IFBDHFCE@?$AAA?$AAd?$AAm?$AAi?$AAn?$AAI?$AAn?$AAf?$AAo?$AA?$AA@
0x18008E9DC: SclLogTimingEvent
0x18008458C: GetConfigParamLocalWEx
0x180051210: SampFreeOneAuthzSecurityAttribute
0x180072030: SampSetAdminPassword
0x1800BBE98: "Migrating SECURITY registry cont" ??_C@_0CE@LFCKGPM@Migrating?5SECURITY?5registry?5cont@
0x180032EF0: "__cdecl _imp_load_SystemFunction015" __imp_load_SystemFunction015
0x1800A8BC8: "__cdecl _imp_RtlpNtCreateKey" __imp_RtlpNtCreateKey
0x1800D3BD0: SampRXactContextInvalidated
0x1800BB310: "(%lx): Failed call to SclProcess" ??_C@_0DC@GDDDBDOM@?$CI?$CFlx?$CJ?3?5Failed?5call?5to?5SclProcess@
0x1800BBE30: "Migrated keys: %d, values: %d" ??_C@_0BO@OPGCCMDK@Migrated?5keys?3?5?$CFd?0?5values?3?5?$CFd?$AA@
0x180070910: SampDisableCreateUserPermissionForPowerUsers
0x18001BCE4: SampTallyTableStatistics
0x18001D6E8: SampStartDirectoryService
0x1800D33F0: SampNullNtOwfPassword
0x1800D3D70: "class LibraryInitLock g_lockObject" ?g_lockObject@@3VLibraryInitLock@@A
0x1800B5FA8: "Fix18471" ??_C@_1BC@LFNOJPIM@?$AAF?$AAi?$AAx?$AA1?$AA8?$AA4?$AA7?$AA1?$AA?$AA@
0x1800A8170: "__cdecl _imp_RemoveDirectoryW" __imp_RemoveDirectoryW
0x180052AEC: CreateUser
0x180067250: SampSetDSRMPasswordWorker
0x1800D3408: SampAccountOperatorsAliasSid
0x1800B59A0: "SamrCreateAliasInDomain" ??_C@_0BI@HHLIKMJM@SamrCreateAliasInDomain?$AA@
0x1800A8C68: "__cdecl _imp_RtlSetBits" __imp_RtlSetBits
0x18006D730: "__cdecl fgs__SAMPR_USER_ACCOUNT_INFORMATION" _fgs__SAMPR_USER_ACCOUNT_INFORMATION
0x1800B2A00: SampQueryInformationAliasGuid
0x18003238F: "__cdecl _imp_load_CDGenerateRandomBits" __imp_load_CDGenerateRandomBits
0x180019C60: SampCompareDisplayStrings
0x1800A8DF0: "__cdecl _xp_a" __xp_a
0x180086E78: SampValidatePasswordInfoArg
0x18000CDEC: SampValidateValidatePasswordResetInputArg
0x1800D3FD0: SampLogFile
0x180032E72: "__cdecl _imp_load_SystemFunction025" __imp_load_SystemFunction025
0x1800A8520: "__cdecl _imp__o__initialize_narrow_environment" __imp__o__initialize_narrow_environment
0x1800A8D50: "__cdecl _imp_LdrGetDllHandle" __imp_LdrGetDllHandle
0x180033070: "public: void __cdecl SP<unsigned short * __ptr64,class SP_MEM<unsigned short * __ptr64> >::Attach(unsigned short * __ptr64 * __ptr64) __ptr64" ?Attach@?$SP@PEAGV?$SP_MEM@PEAG@@@@QEAAXPEAPEAG@Z
0x18000C3C0: "__cdecl is_c_termination_complete" _is_c_termination_complete
0x18002DC50: SampConfigurePackageFromRegistry
0x18007AEAC: SampPerformInternalUpgradeDemotePhase2
0x18007B1E0: SampUpdateEncryption
0x1800B2F90: SAMMSG_WELL_KNOWN_ACCOUNT_RECREATED
0x1800A85B8: "__cdecl _imp_wcstoul" __imp_wcstoul
0x1800BDD60: "%s: GetWindowsDirectoryWinPE ret" ??_C@_1GI@ODFOMNMC@?$AA?$CF?$AAs?$AA?3?$AA?5?$AAG?$AAe?$AAt?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AAD?$AAi?$AAr?$AAe?$AAc?$AAt?$AAo?$AAr?$AAy?$AAW?$AAi?$AAn?$AAP?$AAE?$AA?5?$AAr?$AAe?$AAt@
0x1800B4C38: "uuub" ??_C@_19CCGFOFFL@?$AAu?$AAu?$AAu?$AAb?$AA?$AA@
0x1800B2930: SampDeleteAliasGuid
0x1800501F0: SampFreeAliasNameCache
0x1800DD070: CRYPTSP_NULL_THUNK_DATA_DLA
0x1800DD1C8: "__cdecl _imp_NdrMesTypeEncode3" __imp_NdrMesTypeEncode3
0x1800754B0: SamIFree_SAMPR_GET_GROUPS_BUFFER
0x1800B6700: "SampRegistryUpdateInteractiveLog" ??_C@_0GH@PMHICJHO@SampRegistryUpdateInteractiveLog@
0x1800A89E0: "__cdecl _imp_RtlDecompressBufferEx" __imp_RtlDecompressBufferEx
0x180024DA4: SampAddAliasToAccountMembership
0x1800A83E0: "__cdecl _imp_RegLoadKeyW" __imp_RegLoadKeyW
0x180031BF0: "__cdecl RTC_Initialize" _RTC_Initialize
0x1800D348D: SamDisableListenOnTCP
0x1800A82F8: "__cdecl _imp_TlsAlloc" __imp_TlsAlloc
0x1800B3D48: "" ??_C@_00CNPNBAHC@?$AA@
0x1800B2098: "LimitBlankPasswordUse" ??_C@_0BG@DHCNLPOD@LimitBlankPasswordUse?$AA@
0x1800A85C8: "__cdecl _imp__crt_atexit" __imp__crt_atexit
0x180083730: SamIQueryAccountSecretsCachability
0x18002F960: allocateEvntlogMap
0x18002F900: SampInitLogging
0x1800D2C18: g_ulAdditionalProbeSize
0x18000240C: SampInitUnicodeString
0x180019DA0: GtbpInsertIntoSubTree
0x1800AA4F8: "u" ??_C@_13ICFKHAEN@?$AAu?$AA?$AA@
0x180012BE0: RtlStringCbPrintfA
0x1800A8738: "__cdecl _imp_BCryptDestroyKey" __imp_BCryptDestroyKey
0x1800D3AE8: SampRXactContext
0x1800A87B8: "__cdecl _imp_EtwGetTraceLoggerHandle" __imp_EtwGetTraceLoggerHandle
0x1800BD630: "StringCchCatW" ??_C@_1BM@BELAKIKE@?$AAS?$AAt?$AAr?$AAi?$AAn?$AAg?$AAC?$AAc?$AAh?$AAC?$AAa?$AAt?$AAW?$AA?$AA@
0x1800D3F5A: RestrictRemoteSamAuditOnlyMode
0x1800B4568: "This Organization" ??_C@_1CE@CCLFDKPI@?$AAT?$AAh?$AAi?$AAs?$AA?5?$AAO?$AAr?$AAg?$AAa?$AAn?$AAi?$AAz?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x1800A8598: "__cdecl _imp__o_towupper" __imp__o_towupper
0x1800B51B8: "SampApplyNecessaryDomainUpdates:" ??_C@_0CL@PLPAMINI@SampApplyNecessaryDomainUpdates?3@
0x1800B4228: "DeltaNotificationRoutine result " ??_C@_0CP@CAJGAHF@DeltaNotificationRoutine?5result?5@
0x1800B5040: "Some SAM domain updates are miss" ??_C@_0DO@NLHDKACO@Some?5SAM?5domain?5updates?5are?5miss@
0x1800B3500: "__cdecl _pfnDliFailureHook2" __pfnDliFailureHook2
0x180032F78: "__cdecl _vcrt_thread_detach" __vcrt_thread_detach
0x1800D3FEC: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxunrmrlUhvxfirgbUorxvmhrmtUhkxzooUoryUyfrowPxorvmgPfnUlyquivUznwGEUhgwzucOlyq@spcall_client_um" __@@_PchSym_@00@KxulyqvxgPillgKxunrmrlUhvxfirgbUorxvmhrmtUhkxzooUoryUyfrowPxorvmgPfnUlyquivUznwGEUhgwzucOlyq@spcall_client_um
0x1800ABC70: InformationDebugEvent
0x1800A8AE0: "__cdecl _imp_NtEnumerateValueKey" __imp_NtEnumerateValueKey
0x18009A9B0: "public: static long __cdecl CertificateUtil::FindExtensionGuidValueByOid(char const * __ptr64,struct _CERT_CONTEXT const * __ptr64,unsigned short * __ptr64 * __ptr64)" ?FindExtensionGuidValueByOid@CertificateUtil@@SAJPEBDPEBU_CERT_CONTEXT@@PEAPEAG@Z
0x1800B2AE0: SampQueryInformationDomainGuid
0x18009B99C: OSBOGetFirstBootEntry
0x1800A89D8: "__cdecl _imp_NtCloseObjectAuditAlarm" __imp_NtCloseObjectAuditAlarm
0x1800D37C0: SampActiveContextTable
0x1800AFA40: "Primary:" ??_C@_1BC@KDJBCKFA@?$AAP?$AAr?$AAi?$AAm?$AAa?$AAr?$AAy?$AA?3?$AA?$AA@
0x1800B52F0: "SampApplyDomainUpdates: All upda" ??_C@_0EJ@BPDFIDIA@SampApplyDomainUpdates?3?5All?5upda@
0x180052118: CreateBuiltinDomain
0x180068218: SampConvertUlongArrayToAttrVal
0x18000D930: SampCheckStrongPasswordRestrictions
0x1800BF0C0: "%s: CryptDecodeObjectEx with err" ??_C@_1GA@PGIFGNIJ@?$AA?$CF?$AAs?$AA?3?$AA?5?$AAC?$AAr?$AAy?$AAp?$AAt?$AAD?$AAe?$AAc?$AAo?$AAd?$AAe?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAE?$AAx?$AA?5?$AAw?$AAi?$AAt?$AAh?$AA?5?$AAe?$AAr?$AAr@
0x1800216A4: SampCreateContext
0x1800BB5E0: "(%lx): Failed to process value [" ??_C@_0CH@NMBECJAO@?$CI?$CFlx?$CJ?3?5Failed?5to?5process?5value?5?$FL@
0x180095414: SclFileObjectExists
0x180097ACC: "long __cdecl GetLoadedHiveKeyNameInternal(wchar_t const * __ptr64,wchar_t * __ptr64,unsigned __int64)" ?GetLoadedHiveKeyNameInternal@@YAJPEB_WPEA_W_K@Z
0x1800A83C8: "__cdecl _imp_RegDeleteKeyExA" __imp_RegDeleteKeyExA
0x1800B38A8: "KrbTgt account creation complete" ??_C@_0DB@DACMAODK@KrbTgt?5account?5creation?5complete@
0x1800B4170: "UserId: 0x%x PDC forward, Passw" ??_C@_0EN@FAGIEFEF@UserId?3?50x?$CFx?5?5PDC?5forward?0?5Passw@
0x180001510: SampStackFallbackFree
0x1800D3F58: SampNT4UpgradeInProgress
0x1800B3DE8: "SysKey: " ??_C@_08KCLEHPIP@SysKey?3?5?$AA@
0x180067B08: SampCloseEnumerationOnClient
0x1800BC2B0: "\REGISTRY\MACHINE\SOFTWARE" ??_C@_1DG@IOMDFJHH@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?$AA@
0x1800BFEC0: "__cdecl _rtc_taa" __rtc_taa
0x1800D3870: SampEnumContextTtlListHead
0x1800859D0: SampGetDisableResetBadPwdCountForward
0x1800B38E0: WPP_38fa193c4f9939ee908ce3af9e0f5d99_Traceguids
0x1800A83D8: "__cdecl _imp_RegEnumValueW" __imp_RegEnumValueW
0x18006E0D0: SampEncryptDSRMPassword
0x1800B20E0: "NoLmHash" ??_C@_08CBCGDGBC@NoLmHash?$AA@
0x1800CBEF8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-1-0
0x1800B3DDC: "Init: " ??_C@_06ENPJBIBC@Init?3?5?$AA@
0x1800A8790: bcrypt_NULL_THUNK_DATA
0x1800CC04C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-eventing-classicprovider-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-eventing-classicprovider-l1-1-0
0x180028270: KEDecryptKeyWithAES
0x180074300: SampExtGetDsAttrIdByNameDs
0x1800A8D28: "__cdecl _imp_RtlUnicodeStringToAnsiString" __imp_RtlUnicodeStringToAnsiString
0x1800BA610: "SclpUefiRefreshDiskBootConfig" ??_C@_0BO@FOPDKNFF@SclpUefiRefreshDiskBootConfig?$AA@
0x180077854: SampValidatePassedSD
0x180084740: SamIReplicateAccountData
0x18001F370: SampGetAccountDomainInfo
0x1800B9860: "Number of registry values proces" ??_C@_1EI@CAOFJCPD@?$AAN?$AAu?$AAm?$AAb?$AAe?$AAr?$AA?5?$AAo?$AAf?$AA?5?$AAr?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?5?$AAv?$AAa?$AAl?$AAu?$AAe?$AAs?$AA?5?$AAp?$AAr?$AAo?$AAc?$AAe?$AAs@
0x18001C194: SampDefaultPrimaryGroup
0x180083838: SampCopyDomainAccountSettings
0x1800BA6B0: "Writing to NVRBoot file [%ws]" ??_C@_0BO@KJOODCO@Writing?5to?5NVRBoot?5file?5?$FL?$CFws?$FN?$AA@
0x18001B070: SampCommitBufferedWrites
0x18000A150: SamrOpenUser
0x1800BE890: "%s: CertOpenStore failed with er" ??_C@_1GC@HMLJBCNL@?$AA?$CF?$AAs?$AA?3?$AA?5?$AAC?$AAe?$AAr?$AAt?$AAO?$AAp?$AAe?$AAn?$AAS?$AAt?$AAo?$AAr?$AAe?$AA?5?$AAf?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAw?$AAi?$AAt?$AAh?$AA?5?$AAe?$AAr@
0x1800A8D58: "__cdecl _imp_RtlCreateSecurityDescriptor" __imp_RtlCreateSecurityDescriptor
0x1800BB290: "SclpGetVolumeDiskExtents" ??_C@_0BJ@CAHLMPHD@SclpGetVolumeDiskExtents?$AA@
0x180085B94: SampNextElementInUIList
0x18006EF34: SampAddWellKnownAccounts
0x1800B8D50: "RedirectionKey" ??_C@_1BO@BDHENMHO@?$AAR?$AAe?$AAd?$AAi?$AAr?$AAe?$AAc?$AAt?$AAi?$AAo?$AAn?$AAK?$AAe?$AAy?$AA?$AA@
0x1800BB110: "Grow partition [%ws] and its vol" ??_C@_0EA@DBICJDKL@Grow?5partition?5?$FL?$CFws?$FN?5and?5its?5vol@
0x1800A8640: "__cdecl _imp__initterm_e" __imp__initterm_e
0x1800D3D18: g_WdsNativeLibLog
0x18001C9C0: SamIRevertNullSession
0x18007B5E0: SamIChangePasswordForeignUser
0x180024B10: SamrAddMemberToAlias
0x18001DB64: SampExtGetDomainSettingsDs
0x1800AFC60: "InternetSID" ??_C@_1BI@JFOMFAGD@?$AAI?$AAn?$AAt?$AAe?$AAr?$AAn?$AAe?$AAt?$AAS?$AAI?$AAD?$AA?$AA@
0x1800B1FE0: "SamNoGcLogonEnforceNTLMCheck" ??_C@_0BN@KLHIOIEC@SamNoGcLogonEnforceNTLMCheck?$AA@
0x1800A8530: "__cdecl _imp__memicmp" __imp__memicmp
0x1800A8200: api-ms-win-core-heap-l2-1-0_NULL_THUNK_DATA
0x1800AAAD0: "System\Setup" ??_C@_1BK@DBNBIMPE@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAS?$AAe?$AAt?$AAu?$AAp?$AA?$AA@
0x1800B2040: "SampPasswordLegacyModeEnabled" ??_C@_0BO@LMKKMCIP@SampPasswordLegacyModeEnabled?$AA@
0x1800B4E00: "Win8-BETA to WinBlue-MP" ??_C@_0BI@LFPGABHL@Win8?9BETA?5to?5WinBlue?9MP?$AA@
0x1800C8D00: api-ms-win-security-sddl-l1-1-0_NULL_THUNK_DATA_DLB
0x1800BACA8: "SclRegCopyKeyRecursive" ??_C@_0BH@LFDDHIED@SclRegCopyKeyRecursive?$AA@
0x180050F60: SamIFreeAuthzSecurityAttributesInfo
0x18001BA80: SamIGetUserLogonInformation3
0x1800BDF20: "DeviceRegistrationStateApi::GetJ" ??_C@_1FO@BMFPGDJH@?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAa?$AAt?$AAi?$AAo?$AAn?$AAS?$AAt?$AAa?$AAt?$AAe?$AAA?$AAp?$AAi?$AA?3?$AA?3?$AAG?$AAe?$AAt?$AAJ@
0x1800A8AB8: "__cdecl _imp_NtWriteFile" __imp_NtWriteFile
0x1800A8D48: "__cdecl _imp_NtSetInformationThread" __imp_NtSetInformationThread
0x18001BBB0: SampGetLogLevel
0x1800B3520: "uu" ??_C@_15EJDDJCIA@?$AAu?$AAu?$AA?$AA@
0x1800A8648: api-ms-win-crt-runtime-l1-1-0_NULL_THUNK_DATA
0x1800B5110: "Sam Domain Log Update for %s fai" ??_C@_0DB@OIHOPMNG@Sam?5Domain?5Log?5Update?5for?5?$CFs?5fai@
0x1800B3438: "\Groups\" ??_C@_1BC@CCCOPPOH@?$AA?2?$AAG?$AAr?$AAo?$AAu?$AAp?$AAs?$AA?2?$AA?$AA@
0x1800B3350: "\Groups" ??_C@_1BA@CGMOCPOG@?$AA?2?$AAG?$AAr?$AAo?$AAu?$AAp?$AAs?$AA?$AA@
0x1800B48D0: "\Registry\Machine\SAM\NT5\SAM" ??_C@_1DM@DKGNBJPH@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAA?$AAM?$AA?2?$AAN?$AAT?$AA5?$AA?2?$AAS?$AAA?$AAM?$AA?$AA@
0x180031E58: "__cdecl _scrt_is_ucrt_dll_in_use" __scrt_is_ucrt_dll_in_use
0x1800B3DA8: "BranchDC: " ??_C@_0L@KAMKAKAH@BranchDC?3?5?$AA@
0x180074F00: SampExtSyncDSRMPasswordFromAccountDs
0x1800B31C0: WPP_f41726445fbd381e9bed4c1c65bdf41d_Traceguids
0x1800326AC: "__cdecl _imp_load_DnsNameCompare_W" __imp_load_DnsNameCompare_W
0x1800B2A50: SampLookupNamesInDomainGuid
0x1800BAF08: "SclRegRenameValue" ??_C@_0BC@KHOBLKJM@SclRegRenameValue?$AA@
0x1800BD0B0: "onecore\ds\security\eas\policyen" ??_C@_1HM@JABBFEKF@?$AAo?$AAn?$AAe?$AAc?$AAo?$AAr?$AAe?$AA?2?$AAd?$AAs?$AA?2?$AAs?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?2?$AAe?$AAa?$AAs?$AA?2?$AAp?$AAo?$AAl?$AAi?$AAc?$AAy?$AAe?$AAn@
0x1800DD050: "__cdecl _imp_SystemFunction021" __imp_SystemFunction021
0x180032F78: "__cdecl _vcrt_initialize" __vcrt_initialize
0x1800DD028: "__cdecl _imp_SystemFunction023" __imp_SystemFunction023
0x1800DD040: "__cdecl _imp_SystemFunction025" __imp_SystemFunction025
0x1800A8528: "__cdecl _imp__initialize_onexit_table" __imp__initialize_onexit_table
0x1800DD018: "__cdecl _imp_SystemFunction024" __imp_SystemFunction024
0x180050064: SampEvaluateRODCBuiltinRoles
0x1800DD048: "__cdecl _imp_SystemFunction027" __imp_SystemFunction027
0x1800DD060: "__cdecl _imp_SystemFunction026" __imp_SystemFunction026
0x1800DD000: "__cdecl _imp_SystemFunction029" __imp_SystemFunction029
0x1800B2E80: SAMMSG_PROMOTED_TO_PDC
0x1800D3720: SampNameDomainUsersNames
0x1800BB908: "Locating user profile hive: %ws" ??_C@_0CA@ENCCBCHF@Locating?5user?5profile?5hive?3?5?$CFws?$AA@
0x1800327C7: "__cdecl _imp_load_RpcBindingVectorFree" __imp_load_RpcBindingVectorFree
0x1800D3B00: SampSystemDefaultLCID
0x1800BF3C8: "1.2.840.113556.1.5.284.7" ??_C@_0BJ@OKBMIEFM@1?42?4840?4113556?41?45?4284?47?$AA@
0x1800D3F5B: SampPersonalSKU
0x180006B00: SampDeReferenceContext
0x18000CD8C: SampValidateValidateInputArg
0x1800AFBD8: "msDS-ManagedPasswordId" ??_C@_1CO@MDNENCHL@?$AAm?$AAs?$AAD?$AAS?$AA?9?$AAM?$AAa?$AAn?$AAa?$AAg?$AAe?$AAd?$AAP?$AAa?$AAs?$AAs?$AAw?$AAo?$AAr?$AAd?$AAI?$AAd?$AA?$AA@
0x180055494: ShouldDisableAccountByDefault
0x180053944: InitializeSecurityDescriptors
0x180085068: SampChangeOperatorAccessToUser
0x1800B4B80: "SampAddWellKnownAccounts: proces" ??_C@_0CK@EMGFODAA@SampAddWellKnownAccounts?3?5proces@
0x1800A8D78: "__cdecl _imp_RtlQueryInformationAcl" __imp_RtlQueryInformationAcl
0x1800A8CA0: "__cdecl _imp_RtlEnterCriticalSection" __imp_RtlEnterCriticalSection
0x1800B4D08: "Base update till WS03-RTM" ??_C@_0BK@CLJFKHGF@Base?5update?5till?5WS03?9RTM?$AA@
0x180069CA4: SampRetrieveGroupMembers
0x1800A84D0: "__cdecl _imp_GetLocalTime" __imp_GetLocalTime
0x18002D5C8: SampStartListeningOnRpcTransport_RPC_STATUS
0x18007267C: SampStoreDsDirsToDelete
0x1800B32D0: "LSA-Policy-DisableBuiltinGuestBy" ??_C@_1FA@BEJIDGHB@?$AAL?$AAS?$AAA?$AA?9?$AAP?$AAo?$AAl?$AAi?$AAc?$AAy?$AA?9?$AAD?$AAi?$AAs?$AAa?$AAb?$AAl?$AAe?$AAB?$AAu?$AAi?$AAl?$AAt?$AAi?$AAn?$AAG?$AAu?$AAe?$AAs?$AAt?$AAB?$AAy@
0x1800A8DA0: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x18000D9E0: SampInitializeGroupInfo
0x18008519C: SampChangeOperatorAccessToUser2
0x1800B9150: "Marking event [&SclEvent_Execute" ??_C@_0CP@HJIMFFJF@Marking?5event?5?$FL?$CGSclEvent_Execute@
0x1800326A0: NdrServerCall2
0x1800D34B8: SampClaimsSentinelSid
0x1800D38E0: SampCombinedAttributeName
0x1800D2C40: SamLogSessionArgs
0x1800C8ED8: api-ms-win-service-management-l1-1-0_NULL_THUNK_DATA_DLB
0x1800DD2E0: api-ms-win-service-management-l1-1-0_NULL_THUNK_DATA_DLA
0x1800BF440: "%s: CertificateUtil::FindAllCert" ??_C@_1NO@MKBDGJOG@?$AA?$CF?$AAs?$AA?3?$AA?5?$AAC?$AAe?$AAr?$AAt?$AAi?$AAf?$AAi?$AAc?$AAa?$AAt?$AAe?$AAU?$AAt?$AAi?$AAl?$AA?3?$AA?3?$AAF?$AAi?$AAn?$AAd?$AAA?$AAl?$AAl?$AAC?$AAe?$AAr?$AAt@
0x1800653EC: SampSetInitialGMSAPassword
0x1800C84F8: api-ms-win-service-management-l1-1-0_NULL_THUNK_DATA_DLN
0x1800D3C9C: "unsigned long g_dwRefCount" ?g_dwRefCount@@3KA
0x1800B3DD0: "ExAttr: " ??_C@_08PBJFHMNK@ExAttr?3?5?$AA@
0x1800032D0: SamrOpenDomain
0x18000D4B8: SampExtIsWriteLockHeldByDs
0x1800660D0: SamrEnumerateGroupsInDomain
0x18001CB10: SampExtReadDs
0x18000B600: SampObjectAttributeLength
0x1800D3680: SampActiveEnumerationContextTable
0x18006DAD0: SampValidatePasswordChange
0x18000339C: SampRegistryLookupNameInDomain
0x1800540D4: OpenOrCreateAliasDomainKey
0x1800BC0D0: "<path unavailable>" ??_C@_1CG@DNHAGHH@?$AA?$DM?$AAp?$AAa?$AAt?$AAh?$AA?5?$AAu?$AAn?$AAa?$AAv?$AAa?$AAi?$AAl?$AAa?$AAb?$AAl?$AAe?$AA?$DO?$AA?$AA@
0x1800A99C0: GUID_CONTROL_UpdatePasswordNotRequiredBit
0x1800A8468: "__cdecl _imp_InitializeCriticalSection" __imp_InitializeCriticalSection
0x180085AB0: SampGetNoGcLogonEnforceNTLMCheck
0x1800BA8C0: "(%lx): Unable to recursively del" ??_C@_0DB@MGODJEHD@?$CI?$CFlx?$CJ?3?5Unable?5to?5recursively?5del@
0x1800ABD40: "%s: LocalGetPersistedRegistryLoc" ??_C@_1JI@JGNINFDA@?$AA?$CF?$AAs?$AA?3?$AA?5?$AAL?$AAo?$AAc?$AAa?$AAl?$AAG?$AAe?$AAt?$AAP?$AAe?$AAr?$AAs?$AAi?$AAs?$AAt?$AAe?$AAd?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AAL?$AAo?$AAc@
0x1800A8268: "__cdecl _imp_FormatMessageW" __imp_FormatMessageW
0x18003268C: "__cdecl _imp_load_NdrServerCall2" __imp_load_NdrServerCall2
0x1800B6310: " User account control for accoun" ??_C@_0DK@JANHBBHM@?7User?5account?5control?5for?5accoun@
0x1800DD1A8: "__cdecl _imp_RpcEpRegisterW" __imp_RpcEpRegisterW
0x1800971B0: RetargetLinkReparsePointByHandle
0x1800A8D70: "__cdecl _imp_RtlGetOwnerSecurityDescriptor" __imp_RtlGetOwnerSecurityDescriptor
0x1800A8558: "__cdecl _imp__wcsnicmp" __imp__wcsnicmp
0x1800A8250: "__cdecl _imp_GetModuleHandleExW" __imp_GetModuleHandleExW
0x1800A86D8: "__cdecl _imp_RevertToSelf" __imp_RevertToSelf
0x18006148C: SampQuickEncodeClaimsBlob
0x1800D35A8: SampPrincipalSelfSid
0x1800DD200: "__cdecl _imp_MesBufferHandleReset" __imp_MesBufferHandleReset
0x180061730: SampValidateAndFilterClaimEntriesInPlace
0x18002D410: SampSecureRpcInit
0x1800A99E0: "CLEARTEXT" ??_C@_1BE@OBOOIBOI@?$AAC?$AAL?$AAE?$AAA?$AAR?$AAT?$AAE?$AAX?$AAT?$AA?$AA@
0x1800AB650: "ext-ms-win-setupapi-logging-l1-1" ??_C@_1EG@LLIKKMPB@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAs?$AAe?$AAt?$AAu?$AAp?$AAa?$AAp?$AAi?$AA?9?$AAl?$AAo?$AAg?$AAg?$AAi?$AAn?$AAg?$AA?9?$AAl?$AA1?$AA?9?$AA1@
0x1800BC300: "\REGISTRY\MACHINE\SYSTEM" ??_C@_1DC@GKOJGBFO@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?$AA@
0x180032DC3: "__cdecl _imp_load_SystemFunction006" __imp_load_SystemFunction006
0x1800BEDB0: "CertGetCertificateContextPropert" ??_C@_1EE@FPENKFMD@?$AAC?$AAe?$AAr?$AAt?$AAG?$AAe?$AAt?$AAC?$AAe?$AAr?$AAt?$AAi?$AAf?$AAi?$AAc?$AAa?$AAt?$AAe?$AAC?$AAo?$AAn?$AAt?$AAe?$AAx?$AAt?$AAP?$AAr?$AAo?$AAp?$AAe?$AAr?$AAt@
0x18002DBA0: SampInitAttrVal
0x180050FA0: SampFillOneAuthzSecurityAttribute
0x1800AA690: "PasswordLegacyMode" ??_C@_1CG@PNJEMIOI@?$AAP?$AAa?$AAs?$AAs?$AAw?$AAo?$AAr?$AAd?$AAL?$AAe?$AAg?$AAa?$AAc?$AAy?$AAM?$AAo?$AAd?$AAe?$AA?$AA@
0x1800BB220: "SclpGetMountPoints" ??_C@_0BD@MMIJAJLD@SclpGetMountPoints?$AA@
0x180032749: "__cdecl _imp_load_I_RpcMapWin32Status" __imp_load_I_RpcMapWin32Status
0x1800608FC: SampEncodeClaimsSet
0x1800AA728: "SamRestrictOwfPasswordChange" ??_C@_0BN@JNAGJBFD@SamRestrictOwfPasswordChange?$AA@
0x1800AA7C0: "RestrictRemoteSam" ??_C@_1CE@IELHHPCH@?$AAR?$AAe?$AAs?$AAt?$AAr?$AAi?$AAc?$AAt?$AAR?$AAe?$AAm?$AAo?$AAt?$AAe?$AAS?$AAa?$AAm?$AA?$AA@
0x1800BACE8: "(%lx): Failed to create destinat" ??_C@_0CP@IOLLBCKC@?$CI?$CFlx?$CJ?3?5Failed?5to?5create?5destinat@
0x18001FA30: SampSplitSid
0x18007A24C: SampUpdateEncryptionForDSRM
0x1800685DC: SampRegEnforceConsistencyInternetProviderGUID
0x180031F42: "__cdecl o__wcsnicmp" _o__wcsnicmp
0x1800B6E28: "SampCreateAccountSid failed with" ??_C@_0CH@HHEBHMEM@SampCreateAccountSid?5failed?5with@
0x1800BFEB0: "__cdecl _rtc_iaa" __rtc_iaa
0x18000E1E0: SamIValidateNewAccountName
0x18006DD80: SampValidatePasswordNotMatched
0x1800BBF98: "Ignoring unrecognized reparse ta" ??_C@_0DH@OLAAHCG@Ignoring?5unrecognized?5reparse?5ta@
0x1800B5BE8: "SamrChangePasswordUser" ??_C@_0BH@CJDOPDLN@SamrChangePasswordUser?$AA@
0x180084428: SampUserParmsAttrBlockHealthCheck
0x1800BD560: "%s - hr: 0x%08x" ??_C@_1CA@CFBFMKEH@?$AA?$CF?$AAs?$AA?5?$AA?9?$AA?5?$AAh?$AAr?$AA?3?$AA?5?$AA0?$AAx?$AA?$CF?$AA0?$AA8?$AAx?$AA?$AA@
0x18008D790: SclRetrieveSid
0x1800A8150: "__cdecl _imp_SetFilePointer" __imp_SetFilePointer
0x18009A418: "public: static long __cdecl CertificateUtil::FindAllCertificatesByOidValue(enum _CERTFICATE_LOCATION,char const * __ptr64 * __ptr64 const,unsigned short const * __ptr64 * __ptr64 const,enum _CERT_OID_VALUE_TYPE * __ptr64 const,unsigned long,struct _CERT_CONTEXT const * __ptr64 * __ptr64 const,unsigned long * __ptr64)" ?FindAllCertificatesByOidValue@CertificateUtil@@SAJW4_CERTFICATE_LOCATION@@QEAPEBDQEAPEBGQEAW4_CERT_OID_VALUE_TYPE@@KQEAPEBU_CERT_CONTEXT@@PEAK@Z
0x180032F78: "__cdecl _acrt_thread_attach" __acrt_thread_attach
0x1800AA380: "Account" ??_C@_1BA@CONNFOCD@?$AAA?$AAc?$AAc?$AAo?$AAu?$AAn?$AAt?$AA?$AA@
0x1800A8698: api-ms-win-eventing-controller-l1-1-0_NULL_THUNK_DATA
0x1800CC100: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-string-obsolete-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-string-obsolete-l1-1-0
0x1800A89B0: "__cdecl _imp_RtlInitString" __imp_RtlInitString
0x1800756FC: SampChangeConfigurationKeys
0x1800B6A40: "SampRefreshRegistry: backing out" ??_C@_0FJ@MEAFCLAL@SampRefreshRegistry?3?5backing?5out@
0x1800D2B88: "__cdecl _hmod__RPCRT4_dll" __hmod__RPCRT4_dll
0x1800B2B50: SampDeleteUserGuid
0x18007EDD0: SampRetrieveUserGroupAttribute
0x18001B740: SamIFreeClaimsBlob
0x1800BD390: "BuildCurrentLogFilePath failed" ??_C@_0BP@MKCLNJKH@BuildCurrentLogFilePath?5failed?$AA@
0x18004E54C: SampRetrieveAliasMembership
0x1800D5218: EfipEnumerateBootEntries
0x180010890: SamIHandleObjectUpdate
0x1800DD2E8: "__cdecl _imp_QueryServiceStatus" __imp_QueryServiceStatus
0x18000A95C: SampValidateRevisionInfo
0x18006C1CC: SamIRandomizeStoredPasswordOnNotify
0x1800BB238: "(%lx): Unable to query mount poi" ??_C@_0CF@NGOHGHOH@?$CI?$CFlx?$CJ?3?5Unable?5to?5query?5mount?5poi@
0x1800A8C88: "__cdecl _imp_RtlSetAllBits" __imp_RtlSetAllBits
0x1800AF980: Microsoft_Windows_User_Device_RegistrationLevels
0x1800B91E0: "Marking event [&SclEvent_Process" ??_C@_0CP@FNBPICIG@Marking?5event?5?$FL?$CGSclEvent_Process@
0x1800B2FA0: SAMMSG_RPC_INIT_FAILED
0x1800BE7C0: "system32\config\software" ??_C@_1DC@NBKOBCCN@?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAc?$AAo?$AAn?$AAf?$AAi?$AAg?$AA?2?$AAs?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?$AA@
0x180029600: SamIAccountRestrictions
0x1800AB7F0: "SampGetPasswordMustChange: Force" ??_C@_0EL@BBEFAGJ@SampGetPasswordMustChange?3?5Force@
0x18001F6C0: SampAlAddMembersToAlias
0x180022650: SamIInitialize
0x180032CC0: IsSetupOpenLogPresent
0x18002D4D0: SampStartSamRpcServer
0x1800BDDD0: "%s: Cannot load file "%s" into r" ??_C@_1KE@NAOEHPJD@?$AA?$CF?$AAs?$AA?3?$AA?5?$AAC?$AAa?$AAn?$AAn?$AAo?$AAt?$AA?5?$AAl?$AAo?$AAa?$AAd?$AA?5?$AAf?$AAi?$AAl?$AAe?$AA?5?$AA?$CC?$AA?$CF?$AAs?$AA?$CC?$AA?5?$AAi?$AAn?$AAt?$AAo?$AA?5?$AAr@
0x1800A85F0: "__cdecl _imp__o___stdio_common_vswprintf" __imp__o___stdio_common_vswprintf
0x1800A83C0: "__cdecl _imp_RegSetValueExA" __imp_RegSetValueExA
0x1800AA830: "RestrictRemoteSamEventThrottling" ??_C@_1EO@NOFEJEMA@?$AAR?$AAe?$AAs?$AAt?$AAr?$AAi?$AAc?$AAt?$AAR?$AAe?$AAm?$AAo?$AAt?$AAe?$AAS?$AAa?$AAm?$AAE?$AAv?$AAe?$AAn?$AAt?$AAT?$AAh?$AAr?$AAo?$AAt?$AAt?$AAl?$AAi?$AAn?$AAg@
0x1800A8DA8: "__cdecl _xc_a" __xc_a
0x18003218F: "__cdecl _imp_load_I_NetNotifyMachineAccount" __imp_load_I_NetNotifyMachineAccount
0x180032EBA: "__cdecl _imp_load_SystemFunction026" __imp_load_SystemFunction026
0x18002E420: SampRegConsistencyExtendedAttributes
0x1800BB568: "(%lx): Failed to open child key:" ??_C@_0CJ@JJAHLEJJ@?$CI?$CFlx?$CJ?3?5Failed?5to?5open?5child?5key?3@
0x180075760: SampEventLogSafeModeBoot
0x1800BC158: "Successfully processed reparse p" ??_C@_0DG@MFPFMJAP@Successfully?5processed?5reparse?5p@
0x1800A8608: "__cdecl _imp_wcsstr" __imp_wcsstr
0x180062570: SampDuplicateOemGroupInfo
0x1800D3420: SampRestrictRemoteSessionAccessLock
0x18000CE60: SampValidateValidatePersistedFields
0x1800AB270: "System\CurrentControlSet\Control" ??_C@_1HM@CLDMGLEG@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA?2?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl@
0x180001F10: SampEnumerateAccountNamesRegistry
0x1800BA310: "RtlConvertSidToUnicodeString ret" ??_C@_0DN@MKNOCLHK@RtlConvertSidToUnicodeString?5ret@
0x1800B2F10: SAMMSG_BOOT_TO_RESTORE_MODE
0x18007D358: SampClearForcePasswordReset
0x180075780: SampMachineNameChangeCallBack
0x18000FD20: SampCalculateLmAndNtOwfPasswords
0x1800AAC40: "InitializeSamDsExtension" ??_C@_0BJ@IEMNNAAJ@InitializeSamDsExtension?$AA@
0x1800C8F98: CRYPTSP_NULL_THUNK_DATA_DLB
0x1800761A8: SampCheckLogEventInDetailFlag
0x1800AA5C0: "SamMaxQueueLengthForPDCForward" ??_C@_1DO@LNILEGMD@?$AAS?$AAa?$AAm?$AAM?$AAa?$AAx?$AAQ?$AAu?$AAe?$AAu?$AAe?$AAL?$AAe?$AAn?$AAg?$AAt?$AAh?$AAF?$AAo?$AAr?$AAP?$AAD?$AAC?$AAF?$AAo?$AAr?$AAw?$AAa?$AAr?$AAd?$AA?$AA@
0x1800D5290: EfipAddBootEntry
0x1800993E8: "int __cdecl IsWinPEHost(void)" ?IsWinPEHost@@YAHXZ
0x1800BA1A8: "STAT: %ws = %I64u" ??_C@_0BC@COKGMIKB@STAT?3?5?$CFws?5?$DN?5?$CFI64u?$AA@
0x180097EB4: "public: void __cdecl Windows::ErrorHandling::Rtl::CBaseFrame<class Windows::ErrorHandling::Rtl::CSimpleNtStatusCarryingFrame>::SetInvalidParameter(void) __ptr64" ?SetInvalidParameter@?$CBaseFrame@VCSimpleNtStatusCarryingFrame@Rtl@ErrorHandling@Windows@@@Rtl@ErrorHandling@Windows@@QEAAXXZ
0x18003038C: SampGetAppliedWellKnownAccountUpdates
0x1800B2C80: "WDIGEST" ??_C@_1BA@FFEDMM@?$AAW?$AAD?$AAI?$AAG?$AAE?$AAS?$AAT?$AA?$AA@
0x180083320: WPP_SF_qDDDiiZZ
0x180032110: "__cdecl _tailMerge_netlogon_dll" __tailMerge_netlogon_dll
0x1800750B8: SampExtUpdateLockoutTimeExDs
0x1800D0200: SampTraceGuids
0x18003289F: "__cdecl _imp_load_SystemFunction036" __imp_load_SystemFunction036
0x1800274C4: "__cdecl SamLockStatisticsAfterAcquire" _SamLockStatisticsAfterAcquire
0x1800BA488: "Inspecting disk %u" ??_C@_0BD@LIOOLCBF@Inspecting?5disk?5?$CFu?$AA@
0x1800275C4: "__cdecl SamLockStatisticsBeforeRelease" _SamLockStatisticsBeforeRelease
0x1800A8548: "__cdecl _imp__o__ultow" __imp__o__ultow
0x18001EA50: SampGetUserLogonInformation
0x1800CBFC0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-timezone-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-timezone-l1-1-0
0x1800B3050: "SampLoadRODCRolesCache: an inval" ??_C@_0DL@BAHPNKEO@SampLoadRODCRolesCache?3?5an?5inval@
0x18007E0CC: SampGetLockoutTimeFinish
0x1800D3468: SampAuthenticatedUsersSid
0x18001F4D0: SampAlBuildMemberAliasList
0x1800A8C28: "__cdecl _imp_RtlValidRelativeSecurityDescriptor" __imp_RtlValidRelativeSecurityDescriptor
0x180075BE4: SampReplaceSidInSamHive
0x1800A8788: "__cdecl _imp_BCryptCreateHash" __imp_BCryptCreateHash
0x1800028C4: SampCreateActiveContextTableElement
0x1800AF940: Microsoft_Windows_User_Device_RegistrationKeywords
0x18007EEEC: SampSafeBoot
0x18006E524: RtlStringCbCopyNW
0x1800A8510: "__cdecl _imp_GetTimeZoneInformation" __imp_GetTimeZoneInformation
0x180009E98: SampRemoveAnonymousAccess
0x1800DD288: "__cdecl _imp_ConvertStringSidToSidW" __imp_ConvertStringSidToSidW
0x1800BB7F0: "Optional profile hive does not e" ??_C@_0DH@BNFJKBDD@Optional?5profile?5hive?5does?5not?5e@
0x1800A81B0: "__cdecl _imp_FindClose" __imp_FindClose
0x1800B5CE8: "SamrRemoveMemberFromForeignDomai" ??_C@_0CC@GEFGCGLE@SamrRemoveMemberFromForeignDomai@
0x180060E64: SampFreeSecurityAttributes
0x1800AB488: "__cdecl pDefaultRawDllMain" _pDefaultRawDllMain
0x1800A84B0: "__cdecl _imp_GetComputerNameExW" __imp_GetComputerNameExW
0x180001150: SamIFree_SAMPR_RETURNED_USTRING_ARRAY
0x1800A85D0: "__cdecl _imp__o__configure_narrow_argv" __imp__o__configure_narrow_argv
0x1800D1C40: "__cdecl _scrt_ucrt_dll_is_in_use" __scrt_ucrt_dll_is_in_use
0x1800B5620: "SampPerformWAUUpgradeIfNecessary" ??_C@_0EH@HAGHJHKL@SampPerformWAUUpgradeIfNecessary@
0x1800B4688: "Owner Rights" ??_C@_1BK@HDKGOIMK@?$AAO?$AAw?$AAn?$AAe?$AAr?$AA?5?$AAR?$AAi?$AAg?$AAh?$AAt?$AAs?$AA?$AA@
0x18008A1B8: UserPropertyAllocBlock
0x1800A8BD0: "__cdecl _imp_RtlAppendUnicodeStringToString" __imp_RtlAppendUnicodeStringToString
0x1800AACB8: "AES" ??_C@_17PJMHNJHG@?$AAA?$AAE?$AAS?$AA?$AA@
0x1800330F0: StringCchCopyW
0x1800BBE20: "$sam" ??_C@_19HCPIFBHB@?$AA$?$AAs?$AAa?$AAm?$AA?$AA@
0x1800A87C0: "__cdecl _imp_NtAllocateLocallyUniqueId" __imp_NtAllocateLocallyUniqueId
0x18000B63C: SampGetCurrentUser
0x180086620: SampStringFromGuid
0x180085910: SampGenerateRandomDomainSid
0x1800BED10: "CertificateUtil::GetCertificateT" ??_C@_1FO@DBIIDHHF@?$AAC?$AAe?$AAr?$AAt?$AAi?$AAf?$AAi?$AAc?$AAa?$AAt?$AAe?$AAU?$AAt?$AAi?$AAl?$AA?3?$AA?3?$AAG?$AAe?$AAt?$AAC?$AAe?$AAr?$AAt?$AAi?$AAf?$AAi?$AAc?$AAa?$AAt?$AAe?$AAT@
0x180085A60: SampGetHasNeverTime
0x1800AA2B8: ".etl" ??_C@_19DEKJANFJ@?$AA?4?$AAe?$AAt?$AAl?$AA?$AA@
0x180082BA0: SamrSetInformationUser2
0x18001DF78: SampIsWellKnownSid
0x1800B6630: "SamrGetDomainPasswordInformation" ??_C@_1EC@DJPPHOBD@?$AAS?$AAa?$AAm?$AAr?$AAG?$AAe?$AAt?$AAD?$AAo?$AAm?$AAa?$AAi?$AAn?$AAP?$AAa?$AAs?$AAs?$AAw?$AAo?$AAr?$AAd?$AAI?$AAn?$AAf?$AAo?$AAr?$AAm?$AAa?$AAt?$AAi?$AAo?$AAn@
0x1800AAC80: "ChainingModeCBC" ??_C@_1CA@NDPDKCGP@?$AAC?$AAh?$AAa?$AAi?$AAn?$AAi?$AAn?$AAg?$AAM?$AAo?$AAd?$AAe?$AAC?$AAB?$AAC?$AA?$AA@
0x18000E3A4: SampExtGetNextRidDs
0x180087A64: "private: void __cdecl CAutoSid::Free(void) __ptr64" ?Free@CAutoSid@@AEAAXXZ
0x18001C490: SampBuildAliasNameCache
0x18000C388: SampValidateGenericOperationType
0x1800A81E8: api-ms-win-core-heap-l1-1-0_NULL_THUNK_DATA
0x1800D2BF0: "__cdecl _hmod__ext_ms_win_setupapi_logging_l1_1_0_dll" __hmod__ext_ms_win_setupapi_logging_l1_1_0_dll
0x1800D3B9B: SampIsMachineJoinedToDomain
0x1800D3500: SampNameDomainAliases
0x1800D3BD8: SamCumulativeHoldTime
0x180080A40: SamrSetInformationUser
0x1800AA600: "EnableClaimsTransformationEcho" ??_C@_1DO@OCIFFFNF@?$AAE?$AAn?$AAa?$AAb?$AAl?$AAe?$AAC?$AAl?$AAa?$AAi?$AAm?$AAs?$AAT?$AAr?$AAa?$AAn?$AAs?$AAf?$AAo?$AAr?$AAm?$AAa?$AAt?$AAi?$AAo?$AAn?$AAE?$AAc?$AAh?$AAo?$AA?$AA@
0x1800DD2A0: api-ms-win-security-sddl-l1-1-0_NULL_THUNK_DATA_DLA
0x1800BA4A0: "SclpGptInitZeroedPartitionGuids" ??_C@_0CA@LMLIKDFC@SclpGptInitZeroedPartitionGuids?$AA@
0x1800B5B90: "SamrOpenUser" ??_C@_0N@CKHEBGH@SamrOpenUser?$AA@
0x180083228: WPP_SF_ZZD
0x1800DD188: "__cdecl _imp_RpcServerUseProtseqEpExW" __imp_RpcServerUseProtseqEpExW
0x180068580: SampRegDeleteExtendedAttributes
0x18001A554: SampAuditUserChangeDs
0x1800BB348: "SclRegProcessKeyRecursiveByHandl" ??_C@_0CC@NLPBADBH@SclRegProcessKeyRecursiveByHandl@
0x1800D3620: LastUnflushedChange
0x1800D3F47: SamDisableRSOOnPDCForward
0x180032658: "__cdecl _imp_load_RpcServerInqCallAttributesW" __imp_load_RpcServerInqCallAttributesW
0x180008BA0: SampValidateRegAttributes
0x1800A87F8: "__cdecl _imp_NtSetValueKey" __imp_NtSetValueKey
0x1800B2AC0: SampSetInformationDomainGuid
0x1800BAEC0: "Can't rename reg value [%ws] to " ??_C@_0EB@PCAGOIBM@Can?8t?5rename?5reg?5value?5?$FL?$CFws?$FN?5to?5@
0x1800A8068: "__cdecl _imp_LsarQueryDomainInformationPolicy" __imp_LsarQueryDomainInformationPolicy
0x1800B5F98: WPP_c147388fd9dd3c56dd71d0235f09001b_Traceguids
0x18001DC30: SampGetDomainObjectFromIndex
0x1800A7FF0: "__cdecl _imp_CertOpenStore" __imp_CertOpenStore
0x1800330C8: "public: void __cdecl SP<unsigned long,class SP_MEM<unsigned long> >::Reset(void) __ptr64" ?Reset@?$SP@KV?$SP_MEM@K@@@@QEAAXXZ
0x18000C41C: SampCheckPromoteEnvironment
0x1800B3418: "\Groups\Names\" ??_C@_1BO@FCAPIMPH@?$AA?2?$AAG?$AAr?$AAo?$AAu?$AAp?$AAs?$AA?2?$AAN?$AAa?$AAm?$AAe?$AAs?$AA?2?$AA?$AA@
0x1800D4000: ?g_pfnRtlErrorReportFunction@?A0x98913741@@3P6AXPEBU_RTL_CALL_SITE@ErrorHandling@Windows@@AEBU_GUID@@K@ZEA
0x180087398: SampValidateUserExtendedInformation
0x18007F738: SampValidatePresentAndStoredCombination
0x18000FCE0: SampSetAttributeAccess
0x1800DD058: "__cdecl _imp_SystemFunction013" __imp_SystemFunction013
0x1800A87E8: "__cdecl _imp_RtlNtStatusToDosErrorNoTeb" __imp_RtlNtStatusToDosErrorNoTeb
0x180004EB0: SampLookupContext
0x1800DD020: "__cdecl _imp_SystemFunction015" __imp_SystemFunction015
0x18000D22C: SampGetClientIpAddrA
0x180019028: AllocateSessionProperties
0x1800A8050: "__cdecl _imp_LsaIHealthCheck" __imp_LsaIHealthCheck
0x1800A8CE0: "__cdecl _imp_RtlGetPersistedStateLocation" __imp_RtlGetPersistedStateLocation
0x18008718C: SampValidateUserAccountInformation
0x1800D1C38: "__cdecl _memcpy_nt_iters" __memcpy_nt_iters
0x1800763C0: WPP_SF_S_sid_SS
0x1800B6900: UserExtendedAttributesInterLogonInformation
0x1800B8D78: "Skew1" ??_C@_05LBNOBMAP@Skew1?$AA@
0x18000B9A8: SampTraceRpcClientInfo
0x180067EE8: SampRefEnumerationContext
0x1800B3E38: "EAS: " ??_C@_05BBPLFANC@EAS?3?5?$AA@
0x180031ED6: "__cdecl callnewh" _callnewh
0x1800A8588: "__cdecl _imp__o_malloc" __imp__o_malloc
0x18008BE64: SclStateRecordResults
0x180073A30: SampDeleteObjectAuditAlarm
0x18000C8F0: SampCreateKeyForPostBootPromote
0x1800214E0: SampGetFixedAttributes
0x1800D3D30: SamLockQueueLength
0x1800A9E60: SampVarAttributeInfo
0x1800A8148: "__cdecl _imp_DeleteFileW" __imp_DeleteFileW
0x1800DD1D0: "__cdecl _imp_NdrMesTypeFree3" __imp_NdrMesTypeFree3
0x1800684DC: SampRegDeleteExtendedAttribute
0x1800791C4: WPP_SF__sid_SSDd
0x1800BF6E0: "NtSetBootEntryOrder" ??_C@_0BE@MBHFLLFN@NtSetBootEntryOrder?$AA@
0x1800A8A40: "__cdecl _imp_wcsncmp" __imp_wcsncmp
0x180027C80: SampSetFixedAttributes
0x1800BA1E0: "BlockOperations" ??_C@_1CA@PJKMCDLE@?$AAB?$AAl?$AAo?$AAc?$AAk?$AAO?$AAp?$AAe?$AAr?$AAa?$AAt?$AAi?$AAo?$AAn?$AAs?$AA?$AA@
0x18007B5B0: RtlUShortAdd
0x1800A9708: "__cdecl _guard_iat_table" __guard_iat_table
0x1800B2BE0: SampRemoveMemberFromGroupGuid
0x18001BB20: SamIQueryServerRole
0x18000CC7C: SampExtGetEnterpriseSidListDs
0x1800BC868: "\\?\" ??_C@_19MJCDBCKE@?$AA?2?$AA?2?$AA?$DP?$AA?2?$AA?$AA@
0x1800A82B8: api-ms-win-core-processenvironment-l1-1-0_NULL_THUNK_DATA
0x1800A8B60: "__cdecl _imp_NtFlushKey" __imp_NtFlushKey
0x180067520: SamrSetDSRMPassword
0x1800B2F30: SAMMSG_PDC_TASK_FAILURE
0x180001370: SamIFree_SAMPR_USER_INFO_BUFFER
0x180095E24: StrSubstring
0x1800D0810: ServerExtendedAttributeProperties
0x1800BC200: "\REGISTRY\USER\.DEFAULT" ??_C@_1DA@LLPBOKCG@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAU?$AAS?$AAE?$AAR?$AA?2?$AA?4?$AAD?$AAE?$AAF?$AAA?$AAU?$AAL?$AAT?$AA?$AA@
0x18003330F: memcpy
0x180076884: SampCheckForDescriptorRestrictions
0x180060380: SamIDecodeClaimsBlob
0x1800BE400: "pdwCount" ??_C@_1BC@GGFMIAJH@?$AAp?$AAd?$AAw?$AAC?$AAo?$AAu?$AAn?$AAt?$AA?$AA@
0x1800B9A50: "Number of registry security desc" ??_C@_1GE@FINMBGOE@?$AAN?$AAu?$AAm?$AAb?$AAe?$AAr?$AA?5?$AAo?$AAf?$AA?5?$AAr?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?5?$AAs?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?5?$AAd?$AAe?$AAs?$AAc@
0x180061390: SampLogNDRError
0x180099EE0: "public: static long __cdecl Logger::WriteNullOrEmptyParameterFailureEvent(unsigned short const * __ptr64,unsigned short const * __ptr64)" ?WriteNullOrEmptyParameterFailureEvent@Logger@@SAJPEBG0@Z
0x180002740: SampCheckAccessToExtendedInformation
0x1800B9490: "Old and new paths are identical " ??_C@_0EG@OHCKDOIG@Old?5and?5new?5paths?5are?5identical?5@
0x1800A8748: "__cdecl _imp_BCryptDecrypt" __imp_BCryptDecrypt
0x18001A96C: GtbpGetSubTreeOfElement
0x1800A8248: "__cdecl _imp_LoadLibraryExW" __imp_LoadLibraryExW
0x1800136A0: SampAddPasswordHistory
0x1800A8B90: "__cdecl _imp_RtlConvertSidToUnicodeString" __imp_RtlConvertSidToUnicodeString
0x18009CFD4: EfiQueryBootOptions
0x18000D6CC: SampValidateInsertPasswordInPassHash
0x1800044E0: SampBuildAccountKeyName
0x1800B2140: "7FFEF925-405B-440A-8D58-35E8CD6E" ??_C@_1EK@KKKDLOHN@?$AA7?$AAF?$AAF?$AAE?$AAF?$AA9?$AA2?$AA5?$AA?9?$AA4?$AA0?$AA5?$AAB?$AA?9?$AA4?$AA4?$AA0?$AAA?$AA?9?$AA8?$AAD?$AA5?$AA8?$AA?9?$AA3?$AA5?$AAE?$AA8?$AAC?$AAD?$AA6?$AAE@
0x1800B5A30: "SamrQueryInformationGroup" ??_C@_0BK@LDNFFKEM@SamrQueryInformationGroup?$AA@
0x18002EEA4: "public: void __cdecl SP<unsigned char,class SP_HLOCAL<unsigned char> >::Attach(unsigned char * __ptr64) __ptr64" ?Attach@?$SP@EV?$SP_HLOCAL@E@@@@QEAAXPEAE@Z
0x18009093C: SclGrowPartition
0x1800D3450: SampNameDomainUsers
0x1800B4450: "Anonymous Logon" ??_C@_1CA@LFJIGPHK@?$AAA?$AAn?$AAo?$AAn?$AAy?$AAm?$AAo?$AAu?$AAs?$AA?5?$AAL?$AAo?$AAg?$AAo?$AAn?$AA?$AA@
0x18000A9A4: SampValidateRevisionInfoV1
0x1800A86A0: "__cdecl _imp_EventWriteTransfer" __imp_EventWriteTransfer
0x180032E4E: "__cdecl _imp_load_SystemFunction007" __imp_load_SystemFunction007
0x1800B3188: "SampRODCRegistryWatch returns st" ??_C@_0DE@LHHDDPJF@SampRODCRegistryWatch?5returns?5st@
0x180089484: WxReadBootOption
0x1800B3AA0: "SampPurgeEnumerationContext: Pur" ??_C@_0DA@HCPIJLPA@SampPurgeEnumerationContext?3?5Pur@
0x1800B9830: "RegKeyRenameCount" ??_C@_1CE@JLBJAOMK@?$AAR?$AAe?$AAg?$AAK?$AAe?$AAy?$AAR?$AAe?$AAn?$AAa?$AAm?$AAe?$AAC?$AAo?$AAu?$AAn?$AAt?$AA?$AA@
0x1800A8658: "__cdecl _imp_memset" __imp_memset
0x18007B9D0: SamIOpenUserByAlternateId
0x1800329B5: "__cdecl _imp_load_LsaClose" __imp_load_LsaClose
0x18006C690: SamISetPasswordInfoOnDc
0x180030524: SampSortULONGArrayAndRemoveDuplicates
0x180032F78: "__cdecl _acrt_initialize" __acrt_initialize
0x1800A8A10: "__cdecl _imp_RtlSetGroupSecurityDescriptor" __imp_RtlSetGroupSecurityDescriptor
0x18002D2F0: SampPerformWAUUpgradeIfNecessaryHelper
0x18009D7C8: OSDriverSetFriendlyName
0x1800B9FB0: "RegProcessingTimeInMS" ??_C@_1CM@BJOLDDJB@?$AAR?$AAe?$AAg?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AAi?$AAn?$AAg?$AAT?$AAi?$AAm?$AAe?$AAI?$AAn?$AAM?$AAS?$AA?$AA@
0x18001AF00: SampAccountControlToFlags
0x1800A8460: "__cdecl _imp_CreateEventW" __imp_CreateEventW
0x1800B5B40: "SamrAddMemberToAlias" ??_C@_0BF@NCHGKPKP@SamrAddMemberToAlias?$AA@
0x1800B39A8: "NEW" ??_C@_17KPIFFMIN@?$AAN?$AAE?$AAW?$AA?$AA@
0x180031E76: "__cdecl initterm" _initterm
0x1800B9BE0: "FsSecureSDFailedUpdateCount" ??_C@_1DI@PJBOJMGD@?$AAF?$AAs?$AAS?$AAe?$AAc?$AAu?$AAr?$AAe?$AAS?$AAD?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AAU?$AAp?$AAd?$AAa?$AAt?$AAe?$AAC?$AAo?$AAu?$AAn?$AAt?$AA?$AA@
0x1800A8670: "__cdecl _imp_TraceMessage" __imp_TraceMessage
0x1800B3330: "\Users\Names" ??_C@_1BK@JMKEEDMC@?$AA?2?$AAU?$AAs?$AAe?$AAr?$AAs?$AA?2?$AAN?$AAa?$AAm?$AAe?$AAs?$AA?$AA@
0x1800A8B30: "__cdecl _imp_NtWaitForSingleObject" __imp_NtWaitForSingleObject
0x1800B9CC0: "Number of $MFT security descript" ??_C@_1FI@JKMOHMEI@?$AAN?$AAu?$AAm?$AAb?$AAe?$AAr?$AA?5?$AAo?$AAf?$AA?5?$AA$?$AAM?$AAF?$AAT?$AA?5?$AAs?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?5?$AAd?$AAe?$AAs?$AAc?$AAr?$AAi?$AAp?$AAt@
0x1800327B5: "__cdecl _imp_load_RpcBindingFree" __imp_load_RpcBindingFree
0x180025364: SampMaybeAcquireWriteLock
0x18008DA94: SclResetDiskGuids
0x1800BD6D0: "pData" ??_C@_1M@DIFJGACK@?$AAp?$AAD?$AAa?$AAt?$AAa?$AA?$AA@
0x18004F854: SampAlGrowMemberAccount
0x180032CC0: IsSetupLogErrorWPresent
0x1800A88C8: "__cdecl _imp_RtlValidateUnicodeString" __imp_RtlValidateUnicodeString
0x180031F1E: "__cdecl o__initialize_onexit_table" _o__initialize_onexit_table
0x180021558: SampBuildDomainKeyName
0x1800B4D28: "WS03-RTM to LH-IDS1" ??_C@_0BE@HDKMOKCM@WS03?9RTM?5to?5LH?9IDS1?$AA@
0x1800A8990: "__cdecl _imp_RtlValidAcl" __imp_RtlValidAcl
0x180067A80: SampActiveEnumerationClientTableCompare
0x1800CBE6C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0
0x1800D2C00: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x18002DCDC: SampLoadNotificationPackages
0x1800D2200: DsWellKnownMembershipsToAddBetween_LH_IDS1_And_LH_IDS2
0x18003276D: "__cdecl _imp_load_RpcBindingToStringBindingW" __imp_load_RpcBindingToStringBindingW
0x1800A8498: "__cdecl _imp_Sleep" __imp_Sleep
0x18006FAE8: SampApplyNecessaryDomainUpdates
0x18006E5E0: SamIDemote
0x180086960: SampValidateUserScriptInformation
0x1800BBDE0: "Migrating SAM registry content" ??_C@_0BP@OAFKJLOL@Migrating?5SAM?5registry?5content?$AA@
0x180098E28: "__cdecl resetstkoflw_static" _resetstkoflw_static
0x1800A8BB0: "__cdecl _imp_RtlSubAuthoritySid" __imp_RtlSubAuthoritySid
0x1800B33B8: "\Aliases\Members" ??_C@_1CC@NKEEDDBE@?$AA?2?$AAA?$AAl?$AAi?$AAa?$AAs?$AAe?$AAs?$AA?2?$AAM?$AAe?$AAm?$AAb?$AAe?$AAr?$AAs?$AA?$AA@
0x1800B2FD0: SAMMSG_LOCKOUT_NOT_UPDATED
0x1800C82B8: DSPARSE_NULL_THUNK_DATA_DLN
0x180032B7F: "__cdecl _imp_load_RpcBindingToStringBindingA" __imp_load_RpcBindingToStringBindingA
0x1800A8DE8: "__cdecl _xi_z" __xi_z
0x1800D3488: SampCurrentPEKID
0x180050900: SampRODCRegistryWatch
0x180032E84: "__cdecl _imp_load_SystemFunction027" __imp_load_SystemFunction027
0x180001070: SamIFreeSidAndAttributesList
0x1800BD510: "%s: Out of memory. Allocation fa" ??_C@_1EM@FLPDOEMP@?$AA?$CF?$AAs?$AA?3?$AA?5?$AAO?$AAu?$AAt?$AA?5?$AAo?$AAf?$AA?5?$AAm?$AAe?$AAm?$AAo?$AAr?$AAy?$AA?4?$AA?5?$AAA?$AAl?$AAl?$AAo?$AAc?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?5?$AAf?$AAa@
0x180079634: SampClearPreviousPEKForDSRM
0x1800BA230: "SystemDrive" ??_C@_1BI@BNLANBPC@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAD?$AAr?$AAi?$AAv?$AAe?$AA?$AA@
0x1800B96F8: SclEvent_ExecuteUpgHives_Start
0x1800B1FA0: "SamDisableRSOOnPDCForward" ??_C@_0BK@MNIJIDDE@SamDisableRSOOnPDCForward?$AA@
0x1800BC710: "FSCTL_SD_GLOBAL_CHANGE succeeded" ??_C@_0CB@OIEAOPCM@FSCTL_SD_GLOBAL_CHANGE?5succeeded@
0x1800A8120: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x1800734C0: SampAuditSidHistory
0x1800AFE90: "UserPasswordHint" ??_C@_1CC@PJLEDLDE@?$AAU?$AAs?$AAe?$AAr?$AAP?$AAa?$AAs?$AAs?$AAw?$AAo?$AAr?$AAd?$AAH?$AAi?$AAn?$AAt?$AA?$AA@
0x180062770: SampFreeUserInfo
0x1800A87C8: "__cdecl _imp_NtOpenProcessToken" __imp_NtOpenProcessToken
0x1800BCD60: "BUCL::Rtl::Multiply<TraitsT::TSi" ??_C@_0EK@ECCEJPBO@BUCL?3?3Rtl?3?3Multiply?$DMTraitsT?3?3TSi@
0x1800BD650: "%s: %s failed with win32 error c" ??_C@_1FK@DHOFDJEO@?$AA?$CF?$AAs?$AA?3?$AA?5?$AA?$CF?$AAs?$AA?5?$AAf?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAw?$AAi?$AAt?$AAh?$AA?5?$AAw?$AAi?$AAn?$AA3?$AA2?$AA?5?$AAe?$AAr?$AAr?$AAo?$AAr?$AA?5?$AAc@
0x1800B2A80: SampShutdownSamServerGuid
0x180007810: SampStackFallbackAllocate
0x180075058: SampExtUpdateLastLogonTimeStampDs
0x1800B5A90: "SamrRemoveMemberFromGroup" ??_C@_0BK@NLPOBCF@SamrRemoveMemberFromGroup?$AA@
0x1800A8A70: "__cdecl _imp_RtlSetEnvironmentVariable" __imp_RtlSetEnvironmentVariable
0x1800A8A38: "__cdecl _imp_RtlAbsoluteToSelfRelativeSD" __imp_RtlAbsoluteToSelfRelativeSD
0x180087718: SampValidateUserInternal4Information
0x1800BAE08: "SclRegGetString" ??_C@_0BA@MKLJAIPC@SclRegGetString?$AA@
0x18002F848: SampAllocateTlsIndex
0x18000A9A4: SampValidateUserInternal5Information
0x1800BCC90: "lusSanitizedFilePath.Length != 0" ??_C@_0CB@FCGJLHJG@lusSanitizedFilePath?4Length?5?$CB?$DN?50@
0x180027128: EasMergeUserPasswordSettings
0x1800A8660: "__cdecl _imp_wcscmp" __imp_wcscmp
0x1800DD078: "__cdecl _imp_DnsNameCompare_W" __imp_DnsNameCompare_W
0x180087488: SampValidateUserGeneralInformation
0x1800BB4A0: "SclCreateKey returned STATUS_INS" ??_C@_0EB@GFFMDOJF@SclCreateKey?5returned?5STATUS_INS@
0x18000A9A4: SampValidateUserInternal1Information
0x180027510: SampReleaseWriteLock
0x180022550: SamIIsSetupInProgress
0x1800A8D00: "__cdecl _imp_RtlIsMultiSessionSku" __imp_RtlIsMultiSessionSku
0x1800B3584: "ud" ??_C@_15KBJGKCHK@?$AAu?$AAd?$AA?$AA@
0x18000A9A4: SampValidateUserInternal2Information
0x180087718: SampValidateUserInternal3Information
0x1800C8078: "__cdecl _DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_sddl_ansi_l1_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_sddl_ansi_l1_1_0_dll
0x180024CE0: SampAddMemberToAliasActual
0x1800A8C18: "__cdecl _imp_RtlInsertElementGenericTableAvl" __imp_RtlInsertElementGenericTableAvl
0x1800B50A8: "Sam Domain Update %s ended with " ??_C@_0CG@JBODAKG@Sam?5Domain?5Update?5?$CFs?5ended?5with?5@
0x18001F8D8: SampAlQueryMembersOfAlias
0x1800A87D8: "__cdecl _imp_EtwRegisterTraceGuidsW" __imp_EtwRegisterTraceGuidsW
0x180031E9A: "__cdecl _C_specific_handler" __C_specific_handler
0x1800D21A0: SampShutdownEventHandle
0x1800B2E00: WPP_b733621a4959354a21e9f12ed0607a4e_Traceguids
0x1800B5D10: "SamrGetDomainPasswordInformation" ??_C@_0CB@EGMPNCCB@SamrGetDomainPasswordInformation@
0x180079CEC: SampSetBootKeyInformationInRegistrySAM
0x1800B8E60: "not present" ??_C@_0M@MPDIEKLE@not?5present?$AA@
0x1800A85E8: "__cdecl _imp___stdio_common_vswprintf_s" __imp___stdio_common_vswprintf_s
0x180028150: SampMarkFlushHiveTrueOnParentServerHandle
0x1800B31D0: "SampGetAuthzSecAttributesFromEnc" ??_C@_0FG@CPACMHPJ@SampGetAuthzSecAttributesFromEnc@
0x18001AE00: SampAuditAccountEnableDisableChange
0x180001510: MIDL_user_free
0x1800A8488: "__cdecl _imp_ReleaseSRWLockExclusive" __imp_ReleaseSRWLockExclusive
0x180007830: SampNeedUserAccountSettingsDuringQuery
0x180031F72: "__cdecl o_wcscpy_s" _o_wcscpy_s
0x18004F5B0: WPP_SF_q_sid_
0x180001590: SampActiveEnumerationClientTableAllocate
0x180030A20: SampSkuIsProAndSpecifiedBuiltInDomainRidExists
0x1800B9EA8: "ReparsePointProcessCount" ??_C@_1DC@KMBIHNDE@?$AAR?$AAe?$AAp?$AAa?$AAr?$AAs?$AAe?$AAP?$AAo?$AAi?$AAn?$AAt?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AAC?$AAo?$AAu?$AAn?$AAt?$AA?$AA@
0x1800D3540: SampPreviousPEKID
0x180032F78: "__cdecl _acrt_thread_detach" __acrt_thread_detach
0x18001B468: SampFlushDsEnumerationList
0x180070F80: SampGenerateRandomPassword
0x1800A8070: "__cdecl _imp_LsarSetInformationPolicy" __imp_LsarSetInformationPolicy
0x180074618: SampExtMaintainPrimaryGroupIdChangeDs
0x180024FD0: SampValidateNewAliasMember
0x1800A8358: api-ms-win-core-psapi-l1-1-0_NULL_THUNK_DATA
0x180032426: "__cdecl _tailMerge_api_ms_win_security_sddl_ansi_l1_1_0_dll" __tailMerge_api_ms_win_security_sddl_ansi_l1_1_0_dll
0x1800AB520: "__cdecl _sz_api_ms_win_security_lsapolicy_l1_1_0_dll" __sz_api_ms_win_security_lsapolicy_l1_1_0_dll
0x1800B2B70: SampSetPasswordUserGuid
0x1800BBE00: "SclRegProcessUpgradeRegistry" ??_C@_0BN@BIADCHCM@SclRegProcessUpgradeRegistry?$AA@
0x180004ED0: SampQueryInformationUserInternal
0x1800BC500: "(%lx): Failed to process key [%w" ??_C@_0CD@JBOMFJCH@?$CI?$CFlx?$CJ?3?5Failed?5to?5process?5key?5?$FL?$CFw@
0x18003331B: memmove
0x18007518C: SampExtValidateUndeletedAccountNamesDs
0x1800240FC: "private: unsigned short * __ptr64 __cdecl JoinStatusStorage::JoinStatusRegKeyInfo::AllocateRegistryKey(unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64) __ptr64" ?AllocateRegistryKey@JoinStatusRegKeyInfo@JoinStatusStorage@@AEAAPEAGPEBG00@Z
0x1800604F0: SamIFreeSecurityAttributesInfo
0x1800A81E0: "__cdecl _imp_HeapFree" __imp_HeapFree
0x1800D3610: SampPreviousPEK
0x1800A8088: "__cdecl _imp_LsaIAuditSamEvent" __imp_LsaIAuditSamEvent
0x180032DCF: "__cdecl _tailMerge_cryptsp_dll" __tailMerge_cryptsp_dll
0x1800B4CA8: "DSA Working Directory" ??_C@_1CM@CFFIJJCK@?$AAD?$AAS?$AAA?$AA?5?$AAW?$AAo?$AAr?$AAk?$AAi?$AAn?$AAg?$AA?5?$AAD?$AAi?$AAr?$AAe?$AAc?$AAt?$AAo?$AAr?$AAy?$AA?$AA@
0x1800B5850: "SamrSetSecurityObject" ??_C@_0BG@LCBOHMBJ@SamrSetSecurityObject?$AA@
0x1800D2CF0: WPP_REGISTRATION_GUIDS
0x1800A88B8: "__cdecl _imp_NtDelayExecution" __imp_NtDelayExecution
0x180099E48: "public: static long __cdecl Logger::TraceInformation(unsigned short const * __ptr64,...)" ?TraceInformation@Logger@@SAJPEBGZZ
0x1800A8A28: "__cdecl _imp_RtlStartRXact" __imp_RtlStartRXact
0x180086960: SampValidateUserFNameInformation
0x1800A80D8: "__cdecl _imp_SetConsoleCtrlHandler" __imp_SetConsoleCtrlHandler
0x1800B8D1C: "\\" ??_C@_15LEKKCGMK@?$AA?2?$AA?2?$AA?$AA@
0x1800A8930: "__cdecl _imp_LdrGetProcedureAddress" __imp_LdrGetProcedureAddress
0x1800D5210: PriviledgeSet
0x1800D3470: SampNameDomainGroupsNames
0x1800AB200: "PasswordChangeNotify" ??_C@_0BF@LOOEBDBH@PasswordChangeNotify?$AA@
0x1800A87F0: "__cdecl _imp_NtDeleteObjectAuditAlarm" __imp_NtDeleteObjectAuditAlarm
0x180086960: SampValidateUserANameInformation
0x1800A8CA8: "__cdecl _imp_RtlLengthRequiredSid" __imp_RtlLengthRequiredSid
0x1800DD310: "__cdecl _imp_SetupLogErrorW" __imp_SetupLogErrorW
0x1800D3E38: SampTraceRegistrationHandle
0x1800B5668: "SampPerformWAUUpgradeIfNecessary" ??_C@_0DM@NEIKEDDF@SampPerformWAUUpgradeIfNecessary@
0x1800327EB: "__cdecl _imp_load_ConvertStringSecurityDescriptorToSecurityDescriptorW" __imp_load_ConvertStringSecurityDescriptorToSecurityDescriptorW
0x180002D00: SampDeleteContext
0x1800610C8: SampLogInvalidClaims
0x1800A8CB0: "__cdecl _imp_RtlCopyUnicodeString" __imp_RtlCopyUnicodeString
0x180020C38: SampInitializeDomainDescriptors
0x180032C88: "__cdecl _imp_load_RpcBindingSetAuthInfoExW" __imp_load_RpcBindingSetAuthInfoExW
0x1800BC880: "FixReparsePointPath: Skipping th" ??_C@_1JA@IPAAONPK@?$AAF?$AAi?$AAx?$AAR?$AAe?$AAp?$AAa?$AAr?$AAs?$AAe?$AAP?$AAo?$AAi?$AAn?$AAt?$AAP?$AAa?$AAt?$AAh?$AA?3?$AA?5?$AAS?$AAk?$AAi?$AAp?$AAp?$AAi?$AAn?$AAg?$AA?5?$AAt?$AAh@
0x1800A8C38: "__cdecl _imp_NtCreateToken" __imp_NtCreateToken
0x18001C120: SampRetrieveGroupV1Fixed
0x1800B9678: SclEvent_ProcessRegistryHive_Start
0x1800BC598: "The NTFS version of volume [%ws]" ??_C@_0DD@MBLHNDCM@The?5NTFS?5version?5of?5volume?5?$FL?$CFws?$FN@
0x1800A8A18: "__cdecl _imp_RtlCreateAcl" __imp_RtlCreateAcl
0x1800318D0: "__cdecl _scrt_uninitialize_crt" __scrt_uninitialize_crt
0x180031F5A: malloc
0x1800639C0: SamILookupNamesBySid
0x18000AA98: NtQueryValueKeyWrapper
0x1800DD2C8: "__cdecl _imp_OpenServiceW" __imp_OpenServiceW
0x180086960: SampValidateDomainReplicationInformation
0x180032ABE: "__cdecl _imp_load_ControlService" __imp_load_ControlService
0x1800D3F4A: SampNoGcLogonEnforceKerberosIpCheck
0x1800A8570: "__cdecl _imp__wtoi" __imp__wtoi
0x1800A81C8: api-ms-win-core-handle-l1-1-0_NULL_THUNK_DATA
0x1800201D0: SamrEnumerateDomainsInSamServer
0x1800D3B94: SampServiceState
0x1800DD010: "__cdecl _imp_SystemFunction007" __imp_SystemFunction007
0x1800B3E40: "~%x " ??_C@_04CHLFBEAK@?$HO?$CFx?5?$AA@
0x1800DD030: "__cdecl _imp_SystemFunction006" __imp_SystemFunction006
0x180086BC4: SampValidateDomainInfoBuffer
0x18004F66C: SampAlDeleteAlias
0x1800516B4: CreateAccountDomain
0x18009CC80: EfiApiGetProcedureAddress
0x180074824: SampExtQueryDisplayInformationDs
0x1800027B0: SampSetTransactionDomain
0x1800B3F18: "Invoking RegisterMappedEntryPoin" ??_C@_0DE@GLNJALBL@Invoking?5RegisterMappedEntryPoin@
0x1800A83B0: "__cdecl _imp_RegCloseKey" __imp_RegCloseKey
0x180068424: SampRegAccountVerifiedByOwningAuthority
0x1800A8968: "__cdecl _imp_NtQueryInformationToken" __imp_NtQueryInformationToken
0x1800BD008: "::RtlIsLBlobValid(Blob)" ??_C@_0BI@HCBMPJOG@?3?3RtlIsLBlobValid?$CIBlob?$CJ?$AA@
0x1800BAB10: "(%lx): Failed to create destinat" ??_C@_0CP@PCLEDFHA@?$CI?$CFlx?$CJ?3?5Failed?5to?5create?5destinat@
0x18003319C: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x1800A88A8: "__cdecl _imp_NtCreateEvent" __imp_NtCreateEvent
0x1800B5868: "SamrQuerySecurityObject" ??_C@_0BI@NOABFCEE@SamrQuerySecurityObject?$AA@
0x180099E14: "public: static long __cdecl Logger::TraceError(unsigned short const * __ptr64,...)" ?TraceError@Logger@@SAJPEBGZZ
0x1800AB1B8: "UserParmsFree" ??_C@_0O@KHNAEHHH@UserParmsFree?$AA@
0x1800D3BA8: PreviousFlushEventTimer
0x1800B4480: "Proxy" ??_C@_1M@LCGAOEJE@?$AAP?$AAr?$AAo?$AAx?$AAy?$AA?$AA@
0x1800DD110: "__cdecl _imp_RpcSsDestroyClientContext" __imp_RpcSsDestroyClientContext
0x1800552FC: SampGetPrimaryDomainInfo
0x1800BF020: "%s: Unknown CERT_OID_VALUE_TYPE:" ??_C@_1EK@CLBIHDCG@?$AA?$CF?$AAs?$AA?3?$AA?5?$AAU?$AAn?$AAk?$AAn?$AAo?$AAw?$AAn?$AA?5?$AAC?$AAE?$AAR?$AAT?$AA_?$AAO?$AAI?$AAD?$AA_?$AAV?$AAA?$AAL?$AAU?$AAE?$AA_?$AAT?$AAY?$AAP?$AAE?$AA?3@
0x180086470: SampShutdownNotification
0x18006CA08: SampPasswordChangeNotifyDc
0x180031EA6: "__cdecl o___std_type_info_destroy_list" _o___std_type_info_destroy_list
0x1800184E0: SampCopyUserSupplementalCredentialsForDCPromo
0x18001BE0C: SampRetrieveDisplayInfoFromDisk
0x180031F66: qsort_s
0x180031804: "__cdecl _scrt_is_nonwritable_in_current_image" __scrt_is_nonwritable_in_current_image
0x180031F66: "__cdecl o_qsort_s" _o_qsort_s
0x18001C2F0: SampExtFreeCachedMembershipOperationsListDs
0x18005326C: Initialize
0x1800B29E0: SampConnectGuid
0x1800900C4: SclRegGetString
0x18006DE54: CngRsa32Compat_MD5Init
0x18006AF24: RtlStringCbCatW
0x180031EE2: "__cdecl cexit" _cexit
0x180063F60: SamINotifyRoleChange
0x1800B6508: "SamrOemChangePasswordUser2" ??_C@_1DG@IFNBJBOI@?$AAS?$AAa?$AAm?$AAr?$AAO?$AAe?$AAm?$AAC?$AAh?$AAa?$AAn?$AAg?$AAe?$AAP?$AAa?$AAs?$AAs?$AAw?$AAo?$AAr?$AAd?$AAU?$AAs?$AAe?$AAr?$AA2?$AA?$AA@
0x1800A8350: "__cdecl _imp_QueryFullProcessImageNameW" __imp_QueryFullProcessImageNameW
0x1800A8C80: "__cdecl _imp_NtAccessCheck" __imp_NtAccessCheck
0x18000C3C0: SampADDeleteExtendedAttributes
0x180003010: SampOpenDomain
0x1800A8128: "__cdecl _imp_SetErrorMode" __imp_SetErrorMode
0x1800AA650: "SamLogLevel" ??_C@_0M@OFLIKHDB@SamLogLevel?$AA@
0x180031F4E: "__cdecl o_free" _o_free
0x1800DD278: "__cdecl _imp_ConvertSidToStringSidA" __imp_ConvertSidToStringSidA
0x1800B5240: " : %#2.2X " ??_C@_0L@KIPHDPJM@?7?3?5?$CF?$CD2?42X?6?$AA@
0x1800A8700: "__cdecl _imp_EnumerateIdentityProviders" __imp_EnumerateIdentityProviders
0x1800D5208: FreeRoutine
0x180050BC0: SampGetAccessAttribute
0x1800316D4: "__cdecl _scrt_initialize_crt" __scrt_initialize_crt
0x1800B6850: "SampRegistryUpdateInteractiveLog" ??_C@_0HA@JBLOJIPM@SampRegistryUpdateInteractiveLog@
0x18002DD7C: SampConfigurePackage
0x180067C04: SampInsertEnumerationContext
0x18008F708: SclRegCopyKeyRecursive
0x18001CDD8: SampInvalidateAliasNameCache
0x1800BF690: "NtEnumerateDriverEntries" ??_C@_0BJ@HFLPFDDF@NtEnumerateDriverEntries?$AA@
0x18006426C: SampGetAccountNameFromKrbTgtId
0x180086960: SampValidateAliasAdmCommentInformation
0x1800859B0: SampGetDisableOutboundRSO
0x1800AB6A0: "__cdecl _sz_ext_ms_win_setupapi_logging_l1_1_0_dll" __sz_ext_ms_win_setupapi_logging_l1_1_0_dll
0x180082DD0: SamrUnicodeChangePasswordUser3
0x1800D2C30: SampUserSigninSupportCapabilitySid
0x180062250: SampCompareGroupNodeByName
0x1800748C4: SampExtQueryExpirePasswordsOnSmartCardOnlyAccounts
0x1800BB978: "Expanded profile hive path: NT p" ??_C@_0CM@CIFMFIAO@Expanded?5profile?5hive?5path?3?5NT?5p@
0x1800179C0: SampSetAccessAttribute
0x180002914: SampLookupElementInTable
0x1800AA9E8: "SystemSetupInProgress" ??_C@_1CM@DHJDDPJO@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAS?$AAe?$AAt?$AAu?$AAp?$AAI?$AAn?$AAP?$AAr?$AAo?$AAg?$AAr?$AAe?$AAs?$AAs?$AA?$AA@
0x180067924: SampGetDefaultAttributeValue
0x18000B240: SamrLookupNamesInDomain
0x18000CCC0: SampExtResolveSidsDs
0x1800BF120: "%s: CryptBinaryToStringW with er" ??_C@_1GC@OAKLDHLA@?$AA?$CF?$AAs?$AA?3?$AA?5?$AAC?$AAr?$AAy?$AAp?$AAt?$AAB?$AAi?$AAn?$AAa?$AAr?$AAy?$AAT?$AAo?$AAS?$AAt?$AAr?$AAi?$AAn?$AAg?$AAW?$AA?5?$AAw?$AAi?$AAt?$AAh?$AA?5?$AAe?$AAr@
0x180032F78: "__cdecl _acrt_uninitialize" __acrt_uninitialize
0x1800A8668: api-ms-win-crt-string-l1-1-0_NULL_THUNK_DATA
0x180031F06: "__cdecl o__execute_onexit_table" _o__execute_onexit_table
0x1800D2BC8: "__cdecl _hmod__CRYPTBASE_dll" __hmod__CRYPTBASE_dll
0x180078F68: WPP_SF_DDddddd
0x1800BC338: "SYSTEM" ??_C@_1O@GBFINDKL@?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?$AA@
0x1800BE610: "TargetSoftware" ??_C@_1BO@HBMEGMMI@?$AAT?$AAa?$AAr?$AAg?$AAe?$AAt?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?$AA@
0x180097730: "long __cdecl Windows::StringUtil::Rtl::EnsureRemainingBufferBytes<class Detail::StaticStringAndBufferImpl<struct _LUNICODE_STRING,255> * __ptr64,unsigned __int64>(class Detail::StaticStringAndBufferImpl<struct _LUNICODE_STRING,255> * __ptr64,unsigned __int64)" ??$EnsureRemainingBufferBytes@PEAV?$StaticStringAndBufferImpl@U_LUNICODE_STRING@@$0PP@@Detail@@_K@Rtl@StringUtil@Windows@@YAJPEAV?$StaticStringAndBufferImpl@U_LUNICODE_STRING@@$0PP@@Detail@@_K@Z
0x1800D3F00: SampRODCCacheEnabled
0x180032BC7: "__cdecl _imp_load_DsMakeSpnW" __imp_load_DsMakeSpnW
0x18007F120: SampStorePasswordExpired
0x18007D93C: SampDecryptPasswordWithSessionKeyOld
0x180031A44: "void __cdecl __scrt_uninitialize_type_info(void)" ?__scrt_uninitialize_type_info@@YAXXZ
0x18000B7B0: QueryLocalClientInfo
0x1800A8C78: "__cdecl _imp_RtlAllocateHeap" __imp_RtlAllocateHeap
0x1800B4DA0: "LH-BETA3 to LH-RC0" ??_C@_0BD@OCKDEDIE@LH?9BETA3?5to?5LH?9RC0?$AA@
0x1800A8388: "__cdecl _imp_RegUnLoadKeyW" __imp_RegUnLoadKeyW
0x180030D40: SampConvertAttrValBlockToUlongArray
0x1800B29B0: SampEnumerateGroupsInDomainGuid
0x1800B2E20: SAMMSG_REMOTE_SAM_ACCESS_DENIED
0x1800D3668: SampEnumerationCacheEntryLifetime
0x18000A4E0: SampQueryObjectExtendedAttributesEx
0x1800B3228: "Domains" ??_C@_1BA@DPEKONGI@?$AAD?$AAo?$AAm?$AAa?$AAi?$AAn?$AAs?$AA?$AA@
0x1800BB658: "(%lx): Failed to set value [%.*w" ??_C@_0CD@CICGFLEN@?$CI?$CFlx?$CJ?3?5Failed?5to?5set?5value?5?$FL?$CF?4?$CKw@
0x1800BA530: "(%lx): Unable to open handle to " ??_C@_0CH@LKMOOPMI@?$CI?$CFlx?$CJ?3?5Unable?5to?5open?5handle?5to?5@
0x180073C84: SampExtAddMembershipOperationToCacheDs
0x1800B5250: "SampApplyDomainUpdates: Failed t" ??_C@_0EE@EGOHGMBN@SampApplyDomainUpdates?3?5Failed?5t@
0x18000BB20: SamrPerformGenericOperation
0x1800CBF98: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-psapi-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-psapi-l1-1-0
0x1800A8430: api-ms-win-core-string-l1-1-0_NULL_THUNK_DATA
0x1800D2CA0: WPP_MAIN_CB
0x180071284: SampGetKrbtgtRenameWarning
0x1800A8548: "__cdecl _imp__ultow" __imp__ultow
0x18002F73C: "void * __ptr64 __cdecl MemoryAlloc(unsigned __int64)" ?MemoryAlloc@@YAPEAX_K@Z
0x180097E4C: "long __cdecl RtlStringCchCopyNW(wchar_t * __ptr64,unsigned __int64,wchar_t const * __ptr64,unsigned __int64)" ?RtlStringCchCopyNW@@YAJPEA_W_KPEB_W1@Z
0x18008CF84: SclGetOSVersion
0x1800BD470: "ResetTracingDirectory failed" ??_C@_0BN@BGDAPNGH@ResetTracingDirectory?5failed?$AA@
0x180078710: SampIsPwdSettingAttemptGranted
0x180031F42: "__cdecl wcsnicmp" _wcsnicmp
0x18006A890: SamrRemoveMemberFromGroup
0x1800D3F45: SamConnectedAccountsExist
0x1800D3F51: SampNoLmHash
0x180027428: SampCheckForcePasswordReset
0x18002F8B0: SampInitializeShutdownEvent
0x18007999C: SampPerformSyskeyAccessCheck
0x180009A98: SampDecrementActiveContextCount
0x180074E38: SampExtSetUserSupplementalCredentialsDs
0x1800B3508: "; " ??_C@_15IALCAGAM@?$AA?$DL?$AA?5?$AA?$AA@
0x1800A8C30: "__cdecl _imp_RtlEqualDomainName" __imp_RtlEqualDomainName
0x18001DDF0: SampExtendDefinedDomains
0x1800CBE08: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0
0x1800C81B8: "__cdecl _DELAY_IMPORT_DESCRIPTOR_ext_ms_win_setupapi_logging_l1_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_ext_ms_win_setupapi_logging_l1_1_0_dll
0x180085E08: SampRefreshRegistry
0x1800BD3F0: "EnableTraceEx2 failed" ??_C@_0BG@NFNMCKMK@EnableTraceEx2?5failed?$AA@
0x1800A83D0: "__cdecl _imp_RegSetValueExW" __imp_RegSetValueExW
0x18000D0B8: SampValidateAuditThisCall
0x1800B56B0: "SampPerformWAUUpgradeIfNecessary" ??_C@_0FC@CEOCGAJO@SampPerformWAUUpgradeIfNecessary@
0x1800A85E0: "__cdecl _imp__callnewh" __imp__callnewh
0x1800ABC60: "%s@%s" ??_C@_1M@BOLAPCPJ@?$AA?$CF?$AAs?$AA?$EA?$AA?$CF?$AAs?$AA?$AA@
0x1800A99F8: "Packages" ??_C@_1BC@PHCHDFFP@?$AAP?$AAa?$AAc?$AAk?$AAa?$AAg?$AAe?$AAs?$AA?$AA@
0x1800B2E70: SAMMSG_CLAIMS_BLOB_ENCODE_FAILED
0x180024874: SampInitializePEK
0x18000F300: SamIUPNFromUserHandle
0x1800BA988: "Hive does not exist: [%ws]" ??_C@_0BL@LAAOMANA@Hive?5does?5not?5exist?3?5?$FL?$CFws?$FN?$AA@
0x1800B5340: "BuiltIn" ??_C@_1BA@HBMCEMIC@?$AAB?$AAu?$AAi?$AAl?$AAt?$AAI?$AAn?$AA?$AA@
0x18000CAF0: SampValidateDomainCacheCallback
0x1800A8090: "__cdecl _imp_LsaINotifyChangeNotification" __imp_LsaINotifyChangeNotification
0x1800B5A68: "SamrAddMemberToGroup" ??_C@_0BF@MOJGGCOC@SamrAddMemberToGroup?$AA@
0x1800B96D8: SclEvent_ProcessVolumes_Stop
0x180086960: SampValidateDomainOemInformation
0x1800B6E50: "SampIsInternetAccount failed wit" ??_C@_0CI@IFECFMMG@SampIsInternetAccount?5failed?5wit@
0x1800AFA80: "PerComponentWellKnownAccountAppl" ??_C@_1FG@FFDFFGJ@?$AAP?$AAe?$AAr?$AAC?$AAo?$AAm?$AAp?$AAo?$AAn?$AAe?$AAn?$AAt?$AAW?$AAe?$AAl?$AAl?$AAK?$AAn?$AAo?$AAw?$AAn?$AAA?$AAc?$AAc?$AAo?$AAu?$AAn?$AAt?$AAA?$AAp?$AAp?$AAl@
0x180061E20: SamIStorePrimaryCredentials
0x1800013F8: "__cdecl fgs__USER_EXTENDED_INFORMATION" _fgs__USER_EXTENDED_INFORMATION
0x1800B5C00: "SamrChangePasswordComputer" ??_C@_0BL@FHHOGCOH@SamrChangePasswordComputer?$AA@
0x1800B5FD8: "RXACT" ??_C@_1M@NGDNBJPL@?$AAR?$AAX?$AAA?$AAC?$AAT?$AA?$AA@
0x18006D7D4: "__cdecl fgs__SAMPR_USER_GENERAL_INFORMATION" _fgs__SAMPR_USER_GENERAL_INFORMATION
0x1800B36E0: "SampGetSecAttributesFromEncodedB" ??_C@_0FB@EMDLOBFM@SampGetSecAttributesFromEncodedB@
0x1800B2E40: SAMMSG_WELL_KNOWN_GROUP_RECREATED
0x1800B2E10: SAMMSG_MEMBERSHIP_SETUP_ERROR
0x1800BD4CC: "__cdecl _DefaultResolveDelayLoadedAPIFlags" __DefaultResolveDelayLoadedAPIFlags
0x1800BAF68: "(%lx): Unable to get system devi" ??_C@_0DA@BHANOFOM@?$CI?$CFlx?$CJ?3?5Unable?5to?5get?5system?5devi@
0x1800BB7C0: "Required profile hive does not e" ??_C@_0CN@ICGOKDNB@Required?5profile?5hive?5does?5not?5e@
0x180086730: SampValidateAccountNameChange
0x18002F160: SampInitializeByteArray
0x180032E60: "__cdecl _imp_load_SystemFunction030" __imp_load_SystemFunction030
0x18001CE78: SampAlInvalidateMemberAliasList
0x1800BD618: "StringCat" ??_C@_1BE@EAIPAJPD@?$AAS?$AAt?$AAr?$AAi?$AAn?$AAg?$AAC?$AAa?$AAt?$AA?$AA@
0x1800641DC: SampExtractInternetDomainSidFromSid
0x1800C8540: ext-ms-win-setupapi-logging-l1-1-0_NULL_THUNK_DATA_DLN
0x1800B4C78: "Database backup path" ??_C@_1CK@DFDMLHNP@?$AAD?$AAa?$AAt?$AAa?$AAb?$AAa?$AAs?$AAe?$AA?5?$AAb?$AAa?$AAc?$AAk?$AAu?$AAp?$AA?5?$AAp?$AAa?$AAt?$AAh?$AA?$AA@
0x1800CBEA8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-lsalookup-l1-1-1" __IMPORT_DESCRIPTOR_api-ms-win-security-lsalookup-l1-1-1
0x180070FDC: SampGetAdminPasswordFromRegistry
0x1800DD328: ext-ms-win-setupapi-logging-l1-1-0_NULL_THUNK_DATA_DLA
0x18008E8EC: SclLogGenericMessage
0x1800B3CE0: "N/A" ??_C@_17HDJIHIPC@?$AAN?$AA?1?$AAA?$AA?$AA@
0x1800C8F78: ext-ms-win-setupapi-logging-l1-1-0_NULL_THUNK_DATA_DLB
0x1800A8A68: "__cdecl _imp_RtlSetThreadErrorMode" __imp_RtlSetThreadErrorMode
0x18001FE18: SampEnumerateAccountNames
0x1800B3930: "SamrSetDSRMPassword" ??_C@_1CI@LGHLAPMB@?$AAS?$AAa?$AAm?$AAr?$AAS?$AAe?$AAt?$AAD?$AAS?$AAR?$AAM?$AAP?$AAa?$AAs?$AAs?$AAw?$AAo?$AAr?$AAd?$AA?$AA@
0x1800BE1F0: "EventWriteNullOrEmptyParameterFa" ??_C@_1FG@HOBOKGA@?$AAE?$AAv?$AAe?$AAn?$AAt?$AAW?$AAr?$AAi?$AAt?$AAe?$AAN?$AAu?$AAl?$AAl?$AAO?$AAr?$AAE?$AAm?$AAp?$AAt?$AAy?$AAP?$AAa?$AAr?$AAa?$AAm?$AAe?$AAt?$AAe?$AAr?$AAF?$AAa@
0x1800834C0: SamIFreeOidList
0x1800834A0: SamICopyCurrentDomainAccountSettings
0x180005ED0: SampGetUnicodeStringAttribute
0x180068034: SampClearDirtyOnExtendedAttributes
0x1800D2BD0: "__cdecl _hmod__api_ms_win_service_management_l1_1_0_dll" __hmod__api_ms_win_service_management_l1_1_0_dll
0x1800BC1D0: "Will ignore error and continue p" ??_C@_0CK@MMDLNFI@Will?5ignore?5error?5and?5continue?5p@
0x1800BE800: "%s: Cannot open registry key "%s" ??_C@_1IK@GMAEPLME@?$AA?$CF?$AAs?$AA?3?$AA?5?$AAC?$AAa?$AAn?$AAn?$AAo?$AAt?$AA?5?$AAo?$AAp?$AAe?$AAn?$AA?5?$AAr?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?5?$AAk?$AAe?$AAy?$AA?5?$AA?$CC?$AA?$CF?$AAs@
0x1800BDA40: "%s: Successfully opened reg key " ??_C@_1IA@JGJLOEGL@?$AA?$CF?$AAs?$AA?3?$AA?5?$AAS?$AAu?$AAc?$AAc?$AAe?$AAs?$AAs?$AAf?$AAu?$AAl?$AAl?$AAy?$AA?5?$AAo?$AAp?$AAe?$AAn?$AAe?$AAd?$AA?5?$AAr?$AAe?$AAg?$AA?5?$AAk?$AAe?$AAy?$AA?5@
0x18001AA20: GtbpCoalesceChildren
0x18009CA0C: OSBESetBootVolumeName
0x1800BB4F0: "SclCreateKey failed to open chil" ??_C@_0HD@DHLOJBHM@SclCreateKey?5failed?5to?5open?5chil@
0x1800B3EB0: "HKLM\System\CurrentControlSet\Co" ??_C@_1FG@NFFBDJEL@?$AAH?$AAK?$AAL?$AAM?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA?2?$AAC?$AAo@
0x18001BA60: SampIsBuiltinDomain
0x1800B4CD8: "Database log files path" ??_C@_1DA@KKOJHCHE@?$AAD?$AAa?$AAt?$AAa?$AAb?$AAa?$AAs?$AAe?$AA?5?$AAl?$AAo?$AAg?$AA?5?$AAf?$AAi?$AAl?$AAe?$AAs?$AA?5?$AAp?$AAa?$AAt?$AAh?$AA?$AA@
0x180072A2C: SampAuditDomainChange
0x1800A8860: "__cdecl _imp_RtlUnicodeToOemN" __imp_RtlUnicodeToOemN
0x180097EB4: "public: void __cdecl Windows::ErrorHandling::Rtl::CBaseFrame<class Windows::ErrorHandling::Rtl::CSimpleNtStatusCarryingFrame>::SetInvalidParameter_NullPointer(void) __ptr64" ?SetInvalidParameter_NullPointer@?$CBaseFrame@VCSimpleNtStatusCarryingFrame@Rtl@ErrorHandling@Windows@@@Rtl@ErrorHandling@Windows@@QEAAXXZ
0x18007F194: SampUpdateSupplementalCredentialsRegistry
0x18007D2C8: SampCheckOwfPasswordChangeRestriction
0x18001CC1C: SampUpdateSearchParametersInEnumerationCache
0x180014200: SampSetUnicodeStringAttribute
0x180098C6C: "long __cdecl _myVariantClear(struct tagPROPVARIANT * __ptr64)" ?_myVariantClear@@YAJPEAUtagPROPVARIANT@@@Z
0x1800BA000: "Time spent processing volumes (i" ??_C@_1EM@FPODLLFJ@?$AAT?$AAi?$AAm?$AAe?$AA?5?$AAs?$AAp?$AAe?$AAn?$AAt?$AA?5?$AAp?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AAi?$AAn?$AAg?$AA?5?$AAv?$AAo?$AAl?$AAu?$AAm?$AAe?$AAs?$AA?5?$AA?$CI?$AAi@
0x1800329FD: "__cdecl _imp_load_SystemFunction040" __imp_load_SystemFunction040
0x1800D0850: SampDomainUpdate_Win8BETA_TO_WinBLUEMP_Parameter
0x1800BD408: "Tracing disabled via registry" ??_C@_0BO@NDCBEHAC@Tracing?5disabled?5via?5registry?$AA@
0x180062250: SampCompareMachineNodeByName
0x1800B6540: "Forwarded password change for %w" ??_C@_0CJ@CMFCPBKN@Forwarded?5password?5change?5for?5?$CFw@
0x1800D3F4E: SampLimitBlankPasswordUse
0x180032F78: "__cdecl _scrt_stub_for_acrt_thread_detach" __scrt_stub_for_acrt_thread_detach
0x18002E83C: SampMakeNullTerminateString
0x18001DBC4: SampExtEnforceCrossDomainGroupMembershipChecksDs
0x1800D3F52: SampWS03DefaultsApplied
0x18007D9A8: SampDeleteUserKeys
0x1800BF770: "NtQueryDriverEntryOrder" ??_C@_0BI@LFEBAJHC@NtQueryDriverEntryOrder?$AA@
0x1800CBF20: "__cdecl _IMPORT_DESCRIPTOR_bcrypt" __IMPORT_DESCRIPTOR_bcrypt
0x180087084: SampValidateSecureChannelBlobArg
0x18007DFAC: SampForwardUnicodeChangePasswordRoutines
0x1800B37C0: WPP_808865e9b1fd34d94f7f01902ba5afb0_Traceguids
0x1800D5228: EfipQueryBootOptions
0x18006CDAC: SampPrivatePasswordUpdate
0x1800BAFF0: "Corresponding volume is also fou" ??_C@_0CE@FJDLNPIC@Corresponding?5volume?5is?5also?5fou@
0x1800D2B80: "__cdecl _hmod__api_ms_win_security_sddl_l1_1_0_dll" __hmod__api_ms_win_security_sddl_l1_1_0_dll
0x1800BD2B0: "Null Arg" ??_C@_1BC@FPHKKBAK@?$AAN?$AAu?$AAl?$AAl?$AA?5?$AAA?$AAr?$AAg?$AA?$AA@
0x180090600: SclRegRenameValue
0x1800D3B10: LocalSystemContextTableElement
0x18001ED1C: SampGetUserLogonInformationRegistryMode
0x180074350: SampExtGetGroupMembershipListDs
0x1800AB840: "Forwarded auth succeeded for acc" ??_C@_0CK@MGINEGAM@Forwarded?5auth?5succeeded?5for?5acc@
0x180085DE0: SampPositionOfHighestBit
0x1800BAD38: "Reg value [%ws] does not exist" ??_C@_0BP@NGLKOCAF@Reg?5value?5?$FL?$CFws?$FN?5does?5not?5exist?$AA@
0x1800C80F8: "__cdecl _DELAY_IMPORT_DESCRIPTOR_WS2_32_dll" __DELAY_IMPORT_DESCRIPTOR_WS2_32_dll
0x1800A9820: "SAM_USER" ??_C@_1BC@GEPDABML@?$AAS?$AAA?$AAM?$AA_?$AAU?$AAS?$AAE?$AAR?$AA?$AA@
0x180003E90: SampCreateContextEx
0x1800B3100: "SampLoadRODCRolesCache: an inval" ??_C@_0FE@PENIAFHH@SampLoadRODCRolesCache?3?5an?5inval@
0x180001510: SAM_MIDL_user_free
0x1800A79F0: SampProtSeqNames
0x1800BD890: "%s: The registry key value "%s@%" ??_C@_1NA@JFMFBKJC@?$AA?$CF?$AAs?$AA?3?$AA?5?$AAT?$AAh?$AAe?$AA?5?$AAr?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?5?$AAk?$AAe?$AAy?$AA?5?$AAv?$AAa?$AAl?$AAu?$AAe?$AA?5?$AA?$CC?$AA?$CF?$AAs?$AA?$EA?$AA?$CF@
0x1800B4418: "Batch" ??_C@_1M@DOLPECMD@?$AAB?$AAa?$AAt?$AAc?$AAh?$AA?$AA@
0x1800BC858: "\??\" ??_C@_19JHEHLFPM@?$AA?2?$AA?$DP?$AA?$DP?$AA?2?$AA?$AA@
0x18001F928: SampAlAddAliasesToMemberAccount
0x1800BCCD0: "::RtlStringCchCopyNW(KeyNameBuff" ??_C@_0FG@FDLEBBJN@?3?3RtlStringCchCopyNW?$CIKeyNameBuff@
0x1800D1C58: SampMaxSamConnections
0x1800706B0: SampCreateDsDirsToDeleteKey
0x1800BD428: "Not allowed to log on mobile" ??_C@_0BN@FACJMNMI@Not?5allowed?5to?5log?5on?5mobile?$AA@
0x18006BFC4: SamIRandomizeStoredPasswordCheckLocalType
0x180031680: "__cdecl _scrt_dllmain_uninitialize_c" __scrt_dllmain_uninitialize_c
0x1800A8438: "__cdecl _imp_lstrcmpiW" __imp_lstrcmpiW
0x1800AB6D0: "__cdecl _sz_CRYPTSP_dll" __sz_CRYPTSP_dll
0x18006FA98: SampAddWellKnownSecurityPrincipals
0x1800646A4: SampLookupNameBySid
0x180062750: SampFreeOemGroupInfo
0x180086960: SampValidateUserParametersInformation
0x1800BBD00: "Error copying hive content from " ??_C@_0DJ@CDDKGLCI@Error?5copying?5hive?5content?5from?5@
0x1800BEA18: "LocalMachine" ??_C@_1BK@EACLAGME@?$AAL?$AAo?$AAc?$AAa?$AAl?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?$AA@
0x18000D1B8: SampGetClientIpAddrW
0x180087838: SampValidateValidateAuthenticationInputArg
0x180089264: SampSecureBind
0x1800A8300: "__cdecl _imp_TlsSetValue" __imp_TlsSetValue
0x180063C90: SamILookupSidsByName
0x180032C9A: "__cdecl _imp_load_RpcEpResolveBinding" __imp_load_RpcEpResolveBinding
0x1800B9120: "Marking event [&SclEvent_Execute" ??_C@_0DA@KNKMMDAC@Marking?5event?5?$FL?$CGSclEvent_Execute@
0x1800BC240: "\REGISTRY\MACHINE\SAM\SAM" ??_C@_1DE@BJPAGPIG@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAA?$AAM?$AA?2?$AAS?$AAA?$AAM?$AA?$AA@
0x180008484: SampClientRevisionFromHandle
0x18001B4C4: SampPurgeStaleEnumerationContexts
0x1800AB188: "CredentialUpdateFree" ??_C@_0BF@KBBAEACN@CredentialUpdateFree?$AA@
0x1800AFC90: "InternetProviderGUID" ??_C@_1CK@GJCMDHBP@?$AAI?$AAn?$AAt?$AAe?$AAr?$AAn?$AAe?$AAt?$AAP?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AAG?$AAU?$AAI?$AAD?$AA?$AA@
0x180027E40: SampNotifyUBPMOnDatabaseChange
0x18003195C: atexit
0x18008D128: SclGetTimerTimeInMS
0x180021FC4: VerifyStackAvailable
0x1800D5268: EfipAddDriverEntry
0x18002EAAC: SampApplyDomainUpdates
0x18007EFA4: SampSetGroupAttributesOfUser
0x1800C8038: "__cdecl _DELAY_IMPORT_DESCRIPTOR_RPCRT4_dll" __DELAY_IMPORT_DESCRIPTOR_RPCRT4_dll
0x1800AB750: "Getting %wZ attribute resulted i" ??_C@_0CI@JLJFBHGD@Getting?5?$CFwZ?5attribute?5resulted?5i@
0x1800BCFC8: "onecore\base\lstring\lblob.cpp" ??_C@_0BP@OEPJOLFM@onecore?2base?2lstring?2lblob?4cpp?$AA@
0x1800BB018: "Partition/Volume extension succe" ??_C@_0CG@DOEMNBAN@Partition?1Volume?5extension?5succe@
0x1800BE338: RegistryFailureEvent
0x1800D36F8: SampEnumerationCachePurgeInterval
0x1800A8948: "__cdecl _imp_RtlInitializeCriticalSection" __imp_RtlInitializeCriticalSection
0x1800D1B00: SampDomainUpdate_WinThresholdUpdate4_TO_WinThresholdUpdate5_Parameter
0x1800B9540: "[WdsNativeLib] %ws" ??_C@_0BD@NCAGBIHO@?$FLWdsNativeLib?$FN?5?$CFws?$AA@
0x1800308CC: SampRtlConvertUlongToUnicodeString
0x180031F12: "__cdecl o__initialize_narrow_environment" _o__initialize_narrow_environment
0x18007DDF4: SampDsUpdateLastLogonTimeStamp
0x1800B8ED8: "Running in [%s] mode." ??_C@_0BG@LNALEDNL@Running?5in?5?$FL?$CFs?$FN?5mode?4?$AA@
0x1800B3D90: "Lockout: " ??_C@_09FMEJCAIK@Lockout?3?5?$AA@
0x180017BCC: SampExtConvertNt4SdToNt5SdDs
0x180086960: SampValidateGroupNameInformation
0x1800157C0: SampAuditGroupMemberChange
0x1800BC760: "SclGetVolumeHandle" ??_C@_0BD@JBMLPOCK@SclGetVolumeHandle?$AA@
0x1800793E0: SamIIsRebootAfterPromotion
0x1800A8A30: "__cdecl _imp_RtlFindMessage" __imp_RtlFindMessage
0x1800DD118: "__cdecl _imp_MesHandleFree" __imp_MesHandleFree
0x180073D64: SampExtAddWellKnownSecurityPrincipalsDs
0x1800D3490: SampLocalLogonSid
0x180069370: SampChangeGroupAccountName
0x180031F8C: "__cdecl vsnprintf" _vsnprintf
0x1800D1A90: SampDomainUpdate_LHIDS2_TO_LHBETA2_Parameter
0x180050C74: SampGetAttributeBufferReadInfo
0x18007DEF4: SampForwardMachinePasswordChange
0x1800096B0: SamrRidToSid
0x1800AAC30: SAM_UTILITY_PROVIDER_GUID
0x1800BD3D8: "StartTrace failed" ??_C@_0BC@PPBLCOBE@StartTrace?5failed?$AA@
0x180069194: WPP_SF_qDd_sid_
0x1800110D0: SampRetrieveMultipleCredentialsFromList
0x1800A87E0: "__cdecl _imp_NtAdjustPrivilegesToken" __imp_NtAdjustPrivilegesToken
0x180082C10: SamrUnicodeChangePasswordUser2
0x180065B20: SamrCreateGroupInDomain
0x1800C8E88: api-ms-win-security-systemfunctions-l1-1-0_NULL_THUNK_DATA_DLB
0x1800BAB40: "Copying [%ws] -> [%ws]" ??_C@_0BH@ONABNFPL@Copying?5?$FL?$CFws?$FN?5?9?$DO?5?$FL?$CFws?$FN?$AA@
0x1800DD2C0: api-ms-win-security-systemfunctions-l1-1-0_NULL_THUNK_DATA_DLA
0x1800A8450: "__cdecl _imp_EnterCriticalSection" __imp_EnterCriticalSection
0x1800C84D8: api-ms-win-security-systemfunctions-l1-1-0_NULL_THUNK_DATA_DLN
0x1800B3380: "\Aliases" ??_C@_1BC@LOLPCCJA@?$AA?2?$AAA?$AAl?$AAi?$AAa?$AAs?$AAe?$AAs?$AA?$AA@
0x1800BD6E0: "RegQueryValueExW" ??_C@_1CC@KOJKGDIE@?$AAR?$AAe?$AAg?$AAQ?$AAu?$AAe?$AAr?$AAy?$AAV?$AAa?$AAl?$AAu?$AAe?$AAE?$AAx?$AAW?$AA?$AA@
0x1800B6458: "UserId: 0x%x Successful network " ??_C@_0DN@BFPHNBD@UserId?3?50x?$CFx?5Successful?5network?5@
0x1800BD1B0: "_ReadPolicies" ??_C@_1BM@JLGDFIBO@?$AA_?$AAR?$AAe?$AAa?$AAd?$AAP?$AAo?$AAl?$AAi?$AAc?$AAi?$AAe?$AAs?$AA?$AA@
0x1800D1C5C: SampRestrictOwfPasswordChange
0x1800B9578: SclEvent_ProcessRegistry_Start
0x1800B4C20: "uub" ??_C@_17LEKNBMJI@?$AAu?$AAu?$AAb?$AA?$AA@
0x1800682C0: SampConvertUlongToAttrValBlock
0x1800BA1C0: "SclpStateRecordStatField" ??_C@_0BJ@CFEAAAAP@SclpStateRecordStatField?$AA@
0x1800D3740: SampTransactionDomainIndexGlobal
0x1800BCBC8: "GetLoadedHiveKeyNameInternal" ??_C@_0BN@BCDGLOBL@GetLoadedHiveKeyNameInternal?$AA@
0x180021430: SampGetSidAttribute
0x18003288D: "__cdecl _imp_load_RpcServerInqBindings" __imp_load_RpcServerInqBindings
0x18003237D: "__cdecl _imp_load_MesBufferHandleReset" __imp_load_MesBufferHandleReset
0x1800A83E8: api-ms-win-core-registry-l1-1-0_NULL_THUNK_DATA
0x1800D33C0: SampLogFileCriticalSection
0x1800DD0C0: "__cdecl _imp_I_NetNotifyMachineAccount" __imp_I_NetNotifyMachineAccount
0x1800B5CA0: "SamrGetDisplayEnumerationIndex" ??_C@_0BP@OEPIPFFB@SamrGetDisplayEnumerationIndex?$AA@
0x18000E180: SampDoAliasCreationChecks
0x1800B3C50: "SampRegDeleteExtendedAttribute f" ??_C@_0EC@HEEOKGPI@SampRegDeleteExtendedAttribute?5f@
0x1800D3F59: SampDisableNetlogonNotification
0x1800A8B70: "__cdecl _imp_RtlDnsHostNameToComputerName" __imp_RtlDnsHostNameToComputerName
0x180032F78: "__cdecl _scrt_stub_for_acrt_initialize" __scrt_stub_for_acrt_initialize
0x1800026FC: SampIsClientLocal
0x180021884: NetpStartLoggerSession
0x1800A86D0: "__cdecl _imp_GetSecurityDescriptorLength" __imp_GetSecurityDescriptorLength
0x1800A8140: api-ms-win-core-errorhandling-l1-1-0_NULL_THUNK_DATA
0x1800A8228: api-ms-win-core-kernel32-legacy-l1-1-0_NULL_THUNK_DATA
0x1800D3520: SourceContext
0x1800D1C70: AliasExtendedAttributesInformation
0x18001CA00: SampADReadExtendedAttributes
0x1800BB8A8: "Found hive [%ws] already loaded " ??_C@_0CK@NGHLFMML@Found?5hive?5?$FL?$CFws?$FN?5already?5loaded?5@
0x180001590: SampGenericTable2Allocate
0x1800A8560: "__cdecl _imp__wcsupr" __imp__wcsupr
0x1800BA378: "SclRetrieveSid" ??_C@_0P@GKFLLCP@SclRetrieveSid?$AA@
0x1800526F8: CreateGroup
0x180001338: SampConvertAttrValBlockToSingleValuedFixedData
0x1800A8540: "__cdecl _imp__o__seh_filter_dll" __imp__o__seh_filter_dll
0x180015590: SampAddAccountToGroupMembers
0x1800BBDA8: "Successfully restored (by xcopy)" ??_C@_0DI@OKNBCGDO@Successfully?5restored?5?$CIby?5xcopy?$CJ@
0x1800B3E48: "%02u/%02u %02u:%02u:%02u:%03u %s" ??_C@_0CD@CBPIBMIN@?$CF02u?1?$CF02u?5?$CF02u?3?$CF02u?3?$CF02u?3?$CF03u?5?$CFs@
0x1800A8820: "__cdecl _imp_NtDeleteValueKey" __imp_NtDeleteValueKey
0x1800BA910: "<key>" ??_C@_1M@BINMMANG@?$AA?$DM?$AAk?$AAe?$AAy?$AA?$DO?$AA?$AA@
0x1800B96C8: SclEvent_ProcessUserProfiles_Start
0x1800A8420: "__cdecl _imp_CompareStringEx" __imp_CompareStringEx
0x1800C8510: api-ms-win-service-winsvc-l1-1-0_NULL_THUNK_DATA_DLN
0x1800BEF60: "CertificateUtil::FindExtensionSt" ??_C@_1FI@ODLKJNBN@?$AAC?$AAe?$AAr?$AAt?$AAi?$AAf?$AAi?$AAc?$AAa?$AAt?$AAe?$AAU?$AAt?$AAi?$AAl?$AA?3?$AA?3?$AAF?$AAi?$AAn?$AAd?$AAE?$AAx?$AAt?$AAe?$AAn?$AAs?$AAi?$AAo?$AAn?$AAS?$AAt@
0x1800A8E00: "__cdecl _xt_a" __xt_a
0x18001AEF0: SampReferenceContext
0x1800AACA0: "BlockLength" ??_C@_1BI@JJDKEEML@?$AAB?$AAl?$AAo?$AAc?$AAk?$AAL?$AAe?$AAn?$AAg?$AAt?$AAh?$AA?$AA@
0x1800BB0C8: "FAT32" ??_C@_1M@CDKMPPAL@?$AAF?$AAA?$AAT?$AA3?$AA2?$AA?$AA@
0x1800B2EA0: SAMMSG_CLAIMS_BLOB_DECODE_FAILED
0x1800B1F40: "SamDisableOutboundRSO" ??_C@_0BG@PNCPAALF@SamDisableOutboundRSO?$AA@
0x180026E80: SampUpdateComputedUserAccountControlBits
0x1800D2B70: "__cdecl _scrt_debugger_hook_flag" __scrt_debugger_hook_flag
0x18007EDB0: SampReplaceUserLogonHours
0x180032E96: "__cdecl _imp_load_SystemFunction021" __imp_load_SystemFunction021
0x18007AC00: SampCheckMemberUpgradedFor18471
0x1800D3F48: SampDisableSingleObjectRepl
0x1800B2F70: SAMMSG_WELLKNOWN_ACCOUNT_UPDATE_FAILED
0x1800AA7A0: "ExtendedSidEmulationMode" ??_C@_0BJ@DJNPLCGP@ExtendedSidEmulationMode?$AA@
0x1800B4010: "UserParms routines must come in " ??_C@_0EK@JOJJLCBF@UserParms?5routines?5must?5come?5in?5@
0x1800BBB70: "(%lx): Failed to calculate exclu" ??_C@_0CO@IDFCMEHC@?$CI?$CFlx?$CJ?3?5Failed?5to?5calculate?5exclu@
0x180070C70: SampDoAccountsUpgradeDuringPDCTransfer
0x1800A84D8: "__cdecl _imp_GetSystemInfo" __imp_GetSystemInfo
0x1800A82D0: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x1800C8EF0: api-ms-win-service-winsvc-l1-1-0_NULL_THUNK_DATA_DLB
0x1800874F8: SampValidateUserPreferencesInformation
0x1800DD2F8: api-ms-win-service-winsvc-l1-1-0_NULL_THUNK_DATA_DLA
0x1800637C0: WPP_SF_qLDDD
0x180024A88: KEGetKEEncKey
0x18006D8B8: SampValidateAuthentication
0x1800B2A40: SampEnumerateUsersInDomainGuid
0x1800B5928: "SamrEnumerateGroupsInDomain" ??_C@_0BM@PMGMIGPF@SamrEnumerateGroupsInDomain?$AA@
0x18000D3A0: SampNotifyReplicatedInChange
0x18009CB28: OSBESetOsLoaderPath
0x1800B2E50: SAMMSG_INVALID_CLAIMS_DROPPED
0x1800AB5A0: "__cdecl _sz_api_ms_win_security_systemfunctions_l1_1_0_dll" __sz_api_ms_win_security_systemfunctions_l1_1_0_dll
0x1800B4328: "NTPASSWORD" ??_C@_0L@BNJCHLNB@NTPASSWORD?$AA@
0x1800A8540: "__cdecl _imp__seh_filter_dll" __imp__seh_filter_dll
0x18000CD30: SampResolveSids
0x1800D3FC8: RestrictRemoteSamEventSuppressedEvents
0x180078C30: SamrConnect
0x180066BB0: WPP_SF_qDDDD
0x1800BAAA0: "(%lx): Failed to create full pat" ??_C@_0DH@BAJMILJD@?$CI?$CFlx?$CJ?3?5Failed?5to?5create?5full?5pat@
0x1800D3B40: SampRODCCacheRebuild
0x1800C8498: api-ms-win-security-sddl-ansi-l1-1-0_NULL_THUNK_DATA_DLN
0x1800A9710: "\Registry\Machine\Security\SAM" ??_C@_1DO@BDGINLPJ@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?2?$AAS?$AAA?$AAM?$AA?$AA@
0x180033070: "public: void __cdecl SP<unsigned long,class SP_MEM<unsigned long> >::Attach(unsigned long * __ptr64) __ptr64" ?Attach@?$SP@KV?$SP_MEM@K@@@@QEAAXPEAK@Z
0x180032EA8: "__cdecl _imp_load_SystemFunction031" __imp_load_SystemFunction031
0x1800D4008: "struct _PROVIDER_DATA gProvData" ?gProvData@@3U_PROVIDER_DATA@@A
0x1800146EC: SampEncryptSecretData
0x1800AFC28: "InternetProviderAttributes" ??_C@_1DG@KPKAMGJ@?$AAI?$AAn?$AAt?$AAe?$AAr?$AAn?$AAe?$AAt?$AAP?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AAA?$AAt?$AAt?$AAr?$AAi?$AAb?$AAu?$AAt?$AAe?$AAs?$AA?$AA@
0x18009BA00: OSDriverEntryFlush
0x1800AA880: "JoinInfo" ??_C@_1BC@HOIJDFGO@?$AAJ?$AAo?$AAi?$AAn?$AAI?$AAn?$AAf?$AAo?$AA?$AA@
0x180029A70: SamIFree_UserInternal6Information
0x180070E18: SampFindAndAddWellKnownAccountForDomain
0x18001B224: SampCopyStringListAttribute
0x180065E20: SamrCreateUserInDomain
0x180033070: "public: void __cdecl SP<unsigned char,class SP_MEM<unsigned char> >::Attach(unsigned char * __ptr64) __ptr64" ?Attach@?$SP@EV?$SP_MEM@E@@@@QEAAXPEAE@Z
0x1800167E0: SampConvertVarLengthAttributesToAttrBlock
0x1800C8D78: api-ms-win-security-sddl-ansi-l1-1-0_NULL_THUNK_DATA_DLB
0x1800AFED0: "krbtgt~" ??_C@_1BA@IBGJIDNH@?$AAk?$AAr?$AAb?$AAt?$AAg?$AAt?$AA?$HO?$AA?$AA@
0x1800B3DF8: "Context: " ??_C@_09PONKGFCG@Context?3?5?$AA@
0x1800DD280: api-ms-win-security-sddl-ansi-l1-1-0_NULL_THUNK_DATA_DLA
0x1800B2C10: SampEnumerateAliasesInDomainGuid
0x1800B29C0: SampEnumerateDomainsInSamServerGuid
0x1800DD218: RPCRT4_NULL_THUNK_DATA_DLA
0x1800C8D18: RPCRT4_NULL_THUNK_DATA_DLB
0x180002980: RtlLookupElementGenericTable2
0x1800BA6D0: "SclpGetAndWriteBootEntry" ??_C@_0BJ@IDFELNJE@SclpGetAndWriteBootEntry?$AA@
0x1800B4470: "Dialup" ??_C@_1O@EKBLEOBP@?$AAD?$AAi?$AAa?$AAl?$AAu?$AAp?$AA?$AA@
0x1800A8778: "__cdecl _imp_BCryptHashData" __imp_BCryptHashData
0x1800B2DE0: SAMMSG_COMMIT_FAILED
0x1800BF3F0: "RegistrationCertStatus::GetCerti" ??_C@_1EO@BKKFNKNB@?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAa?$AAt?$AAi?$AAo?$AAn?$AAC?$AAe?$AAr?$AAt?$AAS?$AAt?$AAa?$AAt?$AAu?$AAs?$AA?3?$AA?3?$AAG?$AAe?$AAt?$AAC?$AAe?$AAr?$AAt?$AAi@
0x180032F84: DllMain
0x1800C8430: RPCRT4_NULL_THUNK_DATA_DLN
0x18009AFA4: "public: static long __cdecl CertificateUtil::GetCertificateThumbprintBytes(struct _CERT_CONTEXT const * __ptr64,unsigned char * __ptr64 * __ptr64,unsigned long * __ptr64)" ?GetCertificateThumbprintBytes@CertificateUtil@@SAJPEBU_CERT_CONTEXT@@PEAPEAEPEAK@Z
0x18000C6F4: SampExtRegistryToDsUpgradeDs
0x1800329EB: "__cdecl _imp_load_SystemFunction041" __imp_load_SystemFunction041
0x1800B37B8: "" ??_C@_13BLAPAIAM@?$AA?$AI?$AA?$AA@
0x18007C228: SampChangePasswordUser2
0x1800D0C20: SampNonLocalMembershipsToAddBetween_LH_IDS2_And_LH_BETA2
0x1800B94F0: "Old and new SID strings are iden" ??_C@_0EL@FKHJHDKN@Old?5and?5new?5SID?5strings?5are?5iden@
0x18007C740: SampChangePasswordUser3
0x1800D0910: SampDomainUpdate_WinThresholdUpdate5_TO_WinThresholdUpdate6_Parameter
0x180064174: SampBuildNT4FullSid
0x180031EB2: "__cdecl _stdio_common_vsprintf" __stdio_common_vsprintf
0x1800B2A10: SampProcessMappedAttributesGuid
0x180032F78: "__cdecl _scrt_stub_for_acrt_thread_attach" __scrt_stub_for_acrt_thread_attach
0x1800BE360: "pcszOids" ??_C@_1BC@FDIMMHAH@?$AAp?$AAc?$AAs?$AAz?$AAO?$AAi?$AAd?$AAs?$AA?$AA@
0x1800AFF90: "private: static struct CEasPolicySettings::Setting const * const CEasPolicySettings::m_settings" ?m_settings@CEasPolicySettings@@0QBUSetting@1@B
0x1800AFB70: "ForcePasswordReset" ??_C@_1CG@DOBNEHHH@?$AAF?$AAo?$AAr?$AAc?$AAe?$AAP?$AAa?$AAs?$AAs?$AAw?$AAo?$AAr?$AAd?$AAR?$AAe?$AAs?$AAe?$AAt?$AA?$AA@
0x1800715A4: SampPrepareForDomainUpdates
0x1800278DC: SampCommitChangesEx
0x1800A988C: "V" ??_C@_13DANNHAJN@?$AAV?$AA?$AA@
0x180086910: WPP_SF_ii
0x1800D38F0: FlushImmediately
0x180088C78: WPP_SF_ZDS
0x1800AB4D0: "__cdecl _sz_RPCRT4_dll" __sz_RPCRT4_dll
0x1800B5ED0: "SAM RPC endpoint" ??_C@_1CC@GGKPEHIP@?$AAS?$AAA?$AAM?$AA?5?$AAR?$AAP?$AAC?$AA?5?$AAe?$AAn?$AAd?$AAp?$AAo?$AAi?$AAn?$AAt?$AA?$AA@
0x1800A8030: "__cdecl _imp_LsaIAdtAuditingEnabledByCategory" __imp_LsaIAdtAuditingEnabledByCategory
0x1800068F8: SampPlaceAttrBlockOntoExtendedAttributes
0x180031C34: "__cdecl RTC_Terminate" _RTC_Terminate
0x18001A4F4: SampAuditGetGroupChangeAuditId
0x1800A8800: "__cdecl _imp_RtlAddAccessDeniedAce" __imp_RtlAddAccessDeniedAce
0x1800DD1B0: "__cdecl _imp_RpcServerInqBindings" __imp_RpcServerInqBindings
0x1800BD210: "RegOpenKeyEx" ??_C@_1BK@IMJPMNJA@?$AAR?$AAe?$AAg?$AAO?$AAp?$AAe?$AAn?$AAK?$AAe?$AAy?$AAE?$AAx?$AA?$AA@
0x18009A058: McTemplateU0qzz
0x180033200: "__cdecl _GSHandlerCheck_SEH" __GSHandlerCheck_SEH
0x1800A8B58: "__cdecl _imp_RtlSubAuthorityCountSid" __imp_RtlSubAuthorityCountSid
0x18006E0F0: SampEncryptSecretDataWithAes
0x1800BB0C0: "FAT" ??_C@_17PFEEKKMA@?$AAF?$AAA?$AAT?$AA?$AA@
0x1800CBE94: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-string-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-string-l1-1-0
0x1800A8550: "__cdecl _imp__wcsicmp" __imp__wcsicmp
0x1800C8460: api-ms-win-core-registry-l2-1-0_NULL_THUNK_DATA_DLN
0x180008E50: SampUpgradeToCurrentRevision
0x1800A86C8: "__cdecl _imp_IsValidSid" __imp_IsValidSid
0x1800D35C0: SampRegistryHiveLock
0x1800D5250: EfipEnumerateDriverEntries
0x180023710: SampReadRegistryParameters
0x1800D5200: AllocRoutine
0x18006D660: "__cdecl fgs__SAMPR_DOMAIN_DISPLAY_USER_BUFFER" _fgs__SAMPR_DOMAIN_DISPLAY_USER_BUFFER
0x1800B9F60: "Time spent processing registry (" ??_C@_1EO@EPCBAIDL@?$AAT?$AAi?$AAm?$AAe?$AA?5?$AAs?$AAp?$AAe?$AAn?$AAt?$AA?5?$AAp?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AAi?$AAn?$AAg?$AA?5?$AAr?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?5?$AA?$CI@
0x1800A8610: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x18009CEA0: EfiDeleteDriverEntry
0x18000A400: SampGetExtendedAttribute
0x1800AA328: "%s\%s" ??_C@_1M@DFKENGJN@?$AA?$CF?$AAs?$AA?2?$AA?$CF?$AAs?$AA?$AA@
0x1800B6C40: "SampRefreshRegistry: Failed to R" ??_C@_0FI@INECANPB@SampRefreshRegistry?3?5Failed?5to?5R@
0x18000BFA8: SampDuplicateObjectFromProcess
0x180070610: SampComponentUpdatesRetryCallback
0x18000F0FC: SampMaybeReleaseWriteLock
0x180083D24: SampConvertUserParmsAttrBlockToDsAttrBlock
0x1800124D0: SetUserProperty
0x1800AB778: " " ??_C@_13KDLDGPGJ@?$AA?7?$AA?$AA@
0x18006ADE0: SamrSetMemberAttributesOfGroup
0x1800A83F8: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x1800D1BC0: SampDomainUpdate_LHIDS1_TO_LHIDS2_Parameter
0x1800A8260: api-ms-win-core-libraryloader-l1-2-0_NULL_THUNK_DATA
0x1800BF758: "NtQueryBootOptions" ??_C@_0BD@LOJINLDH@NtQueryBootOptions?$AA@
0x1800324B1: "__cdecl _tailMerge_api_ms_win_security_lsapolicy_l1_1_0_dll" __tailMerge_api_ms_win_security_lsapolicy_l1_1_0_dll
0x1800BD4A8: "All done logging for this caller" ??_C@_0CB@MFKEMFDI@All?5done?5logging?5for?5this?5caller@
0x180068F88: SampSetExtendedAttribute
0x180078E60: SamrShutdownSamServer
0x1800B5E88: "RpcServerRegisterIf3 failed with" ??_C@_0CG@MJHEGAFC@RpcServerRegisterIf3?5failed?5with@
0x1800D3F18: SampEventTraceFlag
0x1800BA660: "Failed to reset the friendly nam" ??_C@_0DH@ONFGCFEC@Failed?5to?5reset?5the?5friendly?5nam@
0x1800BEB40: "%s: Cannot close reg key %s. Reg" ??_C@_1JC@GHAIHKM@?$AA?$CF?$AAs?$AA?3?$AA?5?$AAC?$AAa?$AAn?$AAn?$AAo?$AAt?$AA?5?$AAc?$AAl?$AAo?$AAs?$AAe?$AA?5?$AAr?$AAe?$AAg?$AA?5?$AAk?$AAe?$AAy?$AA?5?$AA?$CF?$AAs?$AA?4?$AA?5?$AAR?$AAe?$AAg@
0x1800BD310: "RegEnumValue" ??_C@_1BK@HPEMMDLC@?$AAR?$AAe?$AAg?$AAE?$AAn?$AAu?$AAm?$AAV?$AAa?$AAl?$AAu?$AAe?$AA?$AA@
0x1800A8938: "__cdecl _imp_RtlQueryRegistryValuesEx" __imp_RtlQueryRegistryValuesEx
0x1800B9608: SclEvent_Generic_Error
0x1800A7FD8: "__cdecl _imp_CertCloseStore" __imp_CertCloseStore
0x1800CC0B0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-eventing-provider-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-eventing-provider-l1-1-0
0x1800AB238: "InitializeChangeNotify" ??_C@_0BH@NBIHJHOP@InitializeChangeNotify?$AA@
0x1800A9A0C: "%02x" ??_C@_04NOJCDH@?$CF02x?$AA@
0x1800B6498: "UserId: 0x%x Successful network " ??_C@_0DK@NLDGOFBF@UserId?3?50x?$CFx?5Successful?5network?5@
0x18009A1BC: McTemplateU0zz
0x180054EE8: SampFindMessageWrapper
0x18006C640: SamIResetBadPwdCountOnPdc
0x18007D6C0: SampDecryptPasswordWithKey
0x18002F768: SampInitializeRestrictRemoteAccess
0x1800BA8F8: "SclRegSetValue_UStr" ??_C@_0BE@GBIGLDOA@SclRegSetValue_UStr?$AA@
0x1800B4F08: "WinThreshold-Update5 to WinThres" ??_C@_0CN@DBOEKEEL@WinThreshold?9Update5?5to?5WinThres@
0x18001AC00: SampGetDomainSidFromAccountContext
0x1800ABB80: "%SYSTEMDRIVE%\" ??_C@_1BO@IAEKMPDA@?$AA?$CF?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AAD?$AAR?$AAI?$AAV?$AAE?$AA?$CF?$AA?2?$AA?$AA@
0x1800A84C8: "__cdecl _imp_GetWindowsDirectoryW" __imp_GetWindowsDirectoryW
0x18006D194: SampSetLastLogonTimestampOnDcWorker
0x18001A660: SampDeltaChangeNotify
0x18007138C: SampPerformNewServerPhase2
0x1800BBC08: "Error opening current hive key [" ??_C@_0CP@LHJMICFL@Error?5opening?5current?5hive?5key?5?$FL@
0x180050258: SampLoadRODCRolesCache
0x1800C8E98: CRYPTBASE_NULL_THUNK_DATA_DLB
0x1800868C8: WPP_SF_i
0x18000E480: SampSetUserAccountControl
0x18002D69C: SampDsaWaitUntilServiceIsRunningEx
0x1800B90F8: "(%lx): Failed to extend partitio" ??_C@_0CD@DJCFEJCA@?$CI?$CFlx?$CJ?3?5Failed?5to?5extend?5partitio@
0x1800D3B90: SampLogLevel
0x1800B3480: "\Members\" ??_C@_1BE@NGIECGPJ@?$AA?2?$AAM?$AAe?$AAm?$AAb?$AAe?$AAr?$AAs?$AA?2?$AA?$AA@
0x1800B94D8: "SclpRemoveContextNoOps" ??_C@_0BH@KHOPHLAF@SclpRemoveContextNoOps?$AA@
0x1800A8118: "__cdecl _imp_GetLastError" __imp_GetLastError
0x180018A18: SampExtGetDomainCrossRefSettingsDs
0x180032F20: "void * __ptr64 __cdecl operator new(unsigned __int64)" ??2@YAPEAX_K@Z
0x180062F10: SamrQueryDisplayInformation
0x18000BC40: SampValidateGenericOperationInput
0x18006DA64: SampValidateCopyPasswordHash
0x180017A28: SampNt4ToNt5Object
0x18000D730: SampEnforceDefaultMachinePassword
0x180027378: "void __cdecl _FreePolicies(unsigned long,struct _tagEASPolicy * __ptr64)" ?_FreePolicies@@YAXKPEAU_tagEASPolicy@@@Z
0x1800DD298: "__cdecl _imp_ConvertSidToStringSidW" __imp_ConvertSidToStringSidW
0x1800D01E0: SampMandatoryNotificationPackages
0x180097DC0: "public: long __cdecl Detail::StaticStringAndBufferImpl<struct _LUNICODE_STRING,255>::Reallocate(unsigned __int64) __ptr64" ?Reallocate@?$StaticStringAndBufferImpl@U_LUNICODE_STRING@@$0PP@@Detail@@QEAAJ_K@Z
0x180073EAC: SampExtConvertNt5SdToNt4SdDs
0x18002DBEC: SampInitAttrValBlock
0x1800BB0B0: "NTFS" ??_C@_19ENNDBEJL@?$AAN?$AAT?$AAF?$AAS?$AA?$AA@
0x1800A86A8: api-ms-win-eventing-provider-l1-1-0_NULL_THUNK_DATA
0x1800D3F4F: SampForceGuest
0x1800ABC48: "StringLen" ??_C@_1BE@DNJKOOLC@?$AAS?$AAt?$AAr?$AAi?$AAn?$AAg?$AAL?$AAe?$AAn?$AA?$AA@
0x1800D366C: SampNextEnumContextID
0x1800D34F0: SampNameDomainAliasesMembers
0x180080660: SamrGetUserDomainPasswordInformation
0x1800BDC48: "GetWindowsDirectoryWinPE" ??_C@_1DC@EJIDNDA@?$AAG?$AAe?$AAt?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AAD?$AAi?$AAr?$AAe?$AAc?$AAt?$AAo?$AAr?$AAy?$AAW?$AAi?$AAn?$AAP?$AAE?$AA?$AA@
0x18001906C: BuildCurrentLogFilePath
0x1800BDF00: "ppCertContext" ??_C@_1BM@BGACLPPE@?$AAp?$AAp?$AAC?$AAe?$AAr?$AAt?$AAC?$AAo?$AAn?$AAt?$AAe?$AAx?$AAt?$AA?$AA@
0x1800867A8: SampValidateComputerName
0x18001F258: SampGetLargeIntArrayAttribute
0x180033178: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x1800BF620: "NtAddBootEntry" ??_C@_0P@GLBOJNND@NtAddBootEntry?$AA@
0x1800AB590: "__cdecl _sz_WS2_32_dll" __sz_WS2_32_dll
0x1800A8BE8: "__cdecl _imp_RtlSetOwnerSecurityDescriptor" __imp_RtlSetOwnerSecurityDescriptor
0x180061ABC: SampFreeNGCKeyInfo
0x1800B9588: SclEvent_DeterminedPartitionName
0x180027100: SampAddDeltaTime
0x18000C3E0: SampDsServiceStateCallback
0x1800BCC40: "{bf1a281b-ad7b-4476-ac95-f476829" ??_C@_1EO@IDDEBFCC@?$AA?$HL?$AAb?$AAf?$AA1?$AAa?$AA2?$AA8?$AA1?$AAb?$AA?9?$AAa?$AAd?$AA7?$AAb?$AA?9?$AA4?$AA4?$AA7?$AA6?$AA?9?$AAa?$AAc?$AA9?$AA5?$AA?9?$AAf?$AA4?$AA7?$AA6?$AA8?$AA2?$AA9@
0x1800BC6A8: "File system type is: [%ws]" ??_C@_0BL@JDNAEKMO@File?5system?5type?5is?3?5?$FL?$CFws?$FN?$AA@
0x1800BBBA0: "Error loading old hive [%ws] int" ??_C@_0DC@CHPBPIII@Error?5loading?5old?5hive?5?$FL?$CFws?$FN?5int@
0x1800D3E20: SampComponentUpdates
0x180074728: SampExtPropagateSelectedSdChangesDs
0x1800B5BD0: "SamrSetInformationUser" ??_C@_0BH@BGNJJBDF@SamrSetInformationUser?$AA@
0x1800682F0: SampConvertUnicodeStringToAttrValBlock
0x1800A8D10: "__cdecl _imp_EtwTraceMessage" __imp_EtwTraceMessage
0x1800859F0: SampGetDomainObjectFromAccountContext
0x180050D70: SampSetLargeIntArrayAttribute
0x1800B3958: "SamrSyncDSRMPasswordFromAccount(" ??_C@_0DO@HNKCCDEB@SamrSyncDSRMPasswordFromAccount?$CI@
0x1800084B0: SampLookupNamesInDomain
0x1800BD2C8: "unsupported type" ??_C@_1CC@FKGDKBF@?$AAu?$AAn?$AAs?$AAu?$AAp?$AAp?$AAo?$AAr?$AAt?$AAe?$AAd?$AA?5?$AAt?$AAy?$AAp?$AAe?$AA?$AA@
0x180015F44: SampConvertCombinedAttributesToAttrBlock
0x1800B2EE0: SAMMSG_REFRESH_FAILED
0x1800B9D18: "FsMftSDUpdateCount" ??_C@_1CG@LGLMCMNB@?$AAF?$AAs?$AAM?$AAf?$AAt?$AAS?$AAD?$AAU?$AAp?$AAd?$AAa?$AAt?$AAe?$AAC?$AAo?$AAu?$AAn?$AAt?$AA?$AA@
0x180085A70: SampGetIgnoreGCFailures
0x1800C8448: WS2_32_NULL_THUNK_DATA_DLN
0x180031F12: "__cdecl initialize_narrow_environment" _initialize_narrow_environment
0x18008A554: KEEncryptDataWithAES
0x1800B5830: "SampConnect" ??_C@_0M@EJAFCEDP@SampConnect?$AA@
0x1800A8620: "__cdecl _imp_memcmp" __imp_memcmp
0x1800C8DE0: WS2_32_NULL_THUNK_DATA_DLB
0x1800B59B8: "SamrEnumerateAliasesInDomain" ??_C@_0BN@FPKAFGD@SamrEnumerateAliasesInDomain?$AA@
0x18002203C: CEventWrite
0x1800DD230: WS2_32_NULL_THUNK_DATA_DLA
0x1800BBE50: "Migrated keys/values below the t" ??_C@_0EF@CEJKIHGP@Migrated?5keys?1values?5below?5the?5t@
0x1800B2EF0: SAMMSG_ERROR_UPGRADE_USERPARMS
0x1800B5F70: "LsaIHealthCheck failed with 0x%x" ??_C@_0CC@BLFBONGH@LsaIHealthCheck?5failed?5with?50x?$CFx@
0x1800AFEB8: "UserTile" ??_C@_1BC@NCAENBFL@?$AAU?$AAs?$AAe?$AAr?$AAT?$AAi?$AAl?$AAe?$AA?$AA@
0x1800BE418: "%s: System is WinPE." ??_C@_1CK@PPNDDGFL@?$AA?$CF?$AAs?$AA?3?$AA?5?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?5?$AAi?$AAs?$AA?5?$AAW?$AAi?$AAn?$AAP?$AAE?$AA?4?$AA?$AA@
0x1800A8B50: "__cdecl _imp_RtlAddAccessAllowedAce" __imp_RtlAddAccessAllowedAce
0x1800D21C8: DsWellKnownMembershipsToAddBetween_LH_RC1_IDS1_And_LH_BETA3
0x1800B60D0: "\schema.ini" ??_C@_1BI@DNMDEOOM@?$AA?2?$AAs?$AAc?$AAh?$AAe?$AAm?$AAa?$AA?4?$AAi?$AAn?$AAi?$AA?$AA@
0x180083BFC: SampAppendAttrToAttrBlock
0x18000BBD8: SampPerformGenericOperation
0x1800B6570: "SamrUnicodeChangePasswordUser2" ??_C@_1DO@JCEGOPNA@?$AAS?$AAa?$AAm?$AAr?$AAU?$AAn?$AAi?$AAc?$AAo?$AAd?$AAe?$AAC?$AAh?$AAa?$AAn?$AAg?$AAe?$AAP?$AAa?$AAs?$AAs?$AAw?$AAo?$AAr?$AAd?$AAU?$AAs?$AAe?$AAr?$AA2?$AA?$AA@
0x1800B98A8: "RegValueProcessCount" ??_C@_1CK@PHGHCKIH@?$AAR?$AAe?$AAg?$AAV?$AAa?$AAl?$AAu?$AAe?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AAC?$AAo?$AAu?$AAn?$AAt?$AA?$AA@
0x1800B5580: "SampShouldPerformWAUUpgrade: SKU" ??_C@_0EH@MCAMPDIC@SampShouldPerformWAUUpgrade?3?5SKU@
0x18001D834: IsSystemUpgradeInProgress
0x1800B3450: "\Users\Names\" ??_C@_1BM@JHMCIJFI@?$AA?2?$AAU?$AAs?$AAe?$AAr?$AAs?$AA?2?$AAN?$AAa?$AAm?$AAe?$AAs?$AA?2?$AA?$AA@
0x180068C1C: SampRegEnforceConsistencyInternetUserName
0x18009D538: EFIDECreateNewDriverEntry
0x1800D38A0: LastFlushTimestamp
0x18001C3D4: SampExtLookupAccountRidDs
0x18006FDA0: SampApplyWellKnownAccountsMembershipsAndSecurityPrincipals
0x1800BD960: "SYSTEM\CurrentControlSet\Control" ??_C@_1FA@ECPGIGLB@?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA?2?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl@
0x180087D64: SamCloseHandle
0x18008BC34: SclCreateKeyEx
0x18001E5B8: SampInitializeWellKnownSids
0x1800D3510: SampFlushThreadExitDelaySeconds
0x180075470: SamIFree_SAMPR_DISPLAY_INFO_BUFFER
0x1800AFEE0: InvalidDownLevelChars
0x1800BD490: "StartSession failed" ??_C@_0BE@IMBOONGK@StartSession?5failed?$AA@
0x1800A8AC0: "__cdecl _imp_NtDeviceIoControlFile" __imp_NtDeviceIoControlFile
0x1800A82C0: "__cdecl _imp_SetThreadStackGuarantee" __imp_SetThreadStackGuarantee
0x18002E608: SampMapInformationLevel
0x18000E788: SampIsUserAccountControlValid
0x18000A9A4: SampValidateUserExpiresInformation
0x1800AFD20: "FailedInterLogonCountAtLastSucce" ??_C@_1FG@MGDNEMPA@?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AAI?$AAn?$AAt?$AAe?$AAr?$AAL?$AAo?$AAg?$AAo?$AAn?$AAC?$AAo?$AAu?$AAn?$AAt?$AAA?$AAt?$AAL?$AAa?$AAs?$AAt?$AAS?$AAu?$AAc?$AAc?$AAe@
0x1800A8558: "__cdecl _imp__o__wcsnicmp" __imp__o__wcsnicmp
0x1800262F0: SampGetReverseMembershipTransitive
0x1800A8810: "__cdecl _imp_RtlAdjustPrivilege" __imp_RtlAdjustPrivilege
0x180085A20: SampGetDomainServerRoleFromIndex
0x18009C9B0: OSBESetBootPath
0x1800BEFC0: "CertificateUtil::FindExtensionGu" ??_C@_1FK@PJPJMLCG@?$AAC?$AAe?$AAr?$AAt?$AAi?$AAf?$AAi?$AAc?$AAa?$AAt?$AAe?$AAU?$AAt?$AAi?$AAl?$AA?3?$AA?3?$AAF?$AAi?$AAn?$AAd?$AAE?$AAx?$AAt?$AAe?$AAn?$AAs?$AAi?$AAo?$AAn?$AAG?$AAu@
0x1800A8768: "__cdecl _imp_BCryptCloseAlgorithmProvider" __imp_BCryptCloseAlgorithmProvider
0x1800D1C34: "__cdecl _isa_enabled" __isa_enabled
0x18000B5B0: SampObjectAttributeAddress
0x18001BBC0: SampGetObjectTypeNameFromIndex
0x1800D19D0: SampDomainUpdate_LHBETA3_TO_LHRC0_Parameter
0x1800B5C50: "SamrPasswordPushPdc" ??_C@_0BE@FFNLCFEA@SamrPasswordPushPdc?$AA@
0x18006C610: SamIRandomizeStoredPasswordWithoutExpirationCheck
0x1800BED70: "ppbBuffer" ??_C@_1BE@HCNONKL@?$AAp?$AAp?$AAb?$AAB?$AAu?$AAf?$AAf?$AAe?$AAr?$AA?$AA@
0x1800B3E08: "RegistryTrx: " ??_C@_0O@KNOEFHPB@RegistryTrx?3?5?$AA@
0x1800A8008: "__cdecl _imp_CertFindCertificateInStore" __imp_CertFindCertificateInStore
0x1800B52A0: "SampApplyDomainUpdates: WAU trig" ??_C@_0EG@CFBHKLNL@SampApplyDomainUpdates?3?5WAU?5trig@
0x1800BAC80: "(%lx): Failed to open source key" ??_C@_0CI@EILGKHOM@?$CI?$CFlx?$CJ?3?5Failed?5to?5open?5source?5key@
0x18008680C: SampWaitForAllActiveThreads
0x1800BC2E8: "SOFTWARE" ??_C@_1BC@JDKNNDON@?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?$AA@
0x1800AFE20: "UserShellAdminObjectProperties" ??_C@_1DO@HHJACJA@?$AAU?$AAs?$AAe?$AAr?$AAS?$AAh?$AAe?$AAl?$AAl?$AAA?$AAd?$AAm?$AAi?$AAn?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAP?$AAr?$AAo?$AAp?$AAe?$AAr?$AAt?$AAi?$AAe?$AAs?$AA?$AA@
0x1800AAAF0: "NULL" ??_C@_19CIJIHAKK@?$AAN?$AAU?$AAL?$AAL?$AA?$AA@
0x1800B9730: "\REGISTRY\MACHINE\SYSTEM\Setup\S" ??_C@_1EO@OCLHGDLB@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?2?$AAS?$AAe?$AAt?$AAu?$AAp?$AA?2?$AAS@
0x18000A9A4: SampValidateUserControlInformation
0x1800D2BD8: "__cdecl _hmod__api_ms_win_service_winsvc_l1_1_0_dll" __hmod__api_ms_win_service_winsvc_l1_1_0_dll
0x1800B2AB0: SampGetDomainPasswordInformationGuid
0x1800B5C80: "SamrQueryDisplayInformation" ??_C@_0BM@GBEDOIKH@SamrQueryDisplayInformation?$AA@
0x1800A8B28: "__cdecl _imp_NtQueryDirectoryFile" __imp_NtQueryDirectoryFile
0x18007E250: SampGetPasswordMustChangeWithUF_UAC
0x1800CC0D8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-0
0x1800A82D8: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x18007E714: SampMustCheckScrilPasswordResetFeatureStatus
0x18009BA4C: SBE_MALLOC
0x180086ADC: SampValidateByteArray32K
0x1800D3FDC: SampTraceLogEventInDetail
0x1800A8448: "__cdecl _imp_WaitForSingleObject" __imp_WaitForSingleObject
0x1800B49B0: "\system32\config\SAM.SAV" ??_C@_1DC@MIIGBPLF@?$AA?2?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAc?$AAo?$AAn?$AAf?$AAi?$AAg?$AA?2?$AAS?$AAA?$AAM?$AA?4?$AAS?$AAA?$AAV?$AA?$AA@
0x1800B9718: SclEvent_ExtendPartition_Stop
0x1800A8D60: "__cdecl _imp_NtAccessCheckAndAuditAlarm" __imp_NtAccessCheckAndAuditAlarm
0x18007E734: SampOemChangePasswordUser2WithTransport
0x18000A9A4: SampValidateUserInternal5InformationNew
0x180087718: SampValidateUserInternal4InformationNew
0x180086960: SampValidateUserAdminCommentInformation
0x1800D3480: SampRemoteInteractiveSid
0x1800B9658: SclEvent_Generic_Statistic
0x1800D3F49: SampNoGcLogonEnforceNTLMCheck
0x1800B5760: "SampSkuIsProAndSpecifiedRidExist" ??_C@_0GM@OCBIJKMD@SampSkuIsProAndSpecifiedRidExist@
0x1800019C8: SampEnumerateAccountNames2
0x180018A70: SampDsSetDomainPolicy
0x180074AA8: SampExtReplicateAccountDs
0x180065274: SampReInitializeSingleDomain
0x1800BB608: "(%lx): Value info buffer contain" ??_C@_0DC@JKIGNIEI@?$CI?$CFlx?$CJ?3?5Value?5info?5buffer?5contain@
0x1800A8AF0: "__cdecl _imp_RtlReAllocateHeap" __imp_RtlReAllocateHeap
0x18001E04C: SampIsMemberOfBuiltinDomain
0x1800B2DB8: WPP_ThisDir_CTLGUID_SamSrv2
0x180062C30: SamrGetDisplayEnumerationIndex
0x1800C80D8: "__cdecl _DELAY_IMPORT_DESCRIPTOR_api_ms_win_core_registry_l2_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_api_ms_win_core_registry_l2_1_0_dll
0x1800D2560: "unsigned long * g_dwPasswordProvPolicies" ?g_dwPasswordProvPolicies@@3PAKA
0x1800B3530: "User:%ls. %d invalid claims with" ??_C@_0FC@DKNGMGGN@User?3?$CFls?4?5?$CFd?5invalid?5claims?5with@
0x1800BD580: "DeviceRegistrationStateApi::IsJo" ??_C@_1EK@NOAEDCNO@?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAa?$AAt?$AAi?$AAo?$AAn?$AAS?$AAt?$AAa?$AAt?$AAe?$AAA?$AAp?$AAi?$AA?3?$AA?3?$AAI?$AAs?$AAJ?$AAo@
0x180064420: SampGetSerialNumberDomain2
0x18009B9C0: OSBOGetNextBootEntry
0x1800B5350: "d" ??_C@_13GKPPEALH@?$AAd?$AA?$AA@
0x1800B53F0: WPP_9e457c9a8d0a3804a9f034544ee46e03_Traceguids
0x1800204E0: SampDsGetPrimaryDomainStart
0x1800B3320: "\Users" ??_C@_1O@DNHHMCGI@?$AA?2?$AAU?$AAs?$AAe?$AAr?$AAs?$AA?$AA@
0x18001B8E0: SampDecryptCredentialData
0x1800B39D0: "SampOpenEnumerationClient: (TID:" ??_C@_0EN@MHCMNFKC@SampOpenEnumerationClient?3?5?$CITID?3@
0x180068270: SampConvertUlongArrayToAttrValBlock
0x1800AB218: "RegisterMappedEntrypoints" ??_C@_0BK@HMJHCJEP@RegisterMappedEntrypoints?$AA@
0x180060EA0: SampGetSecAttributesFromEncodedBlob
0x1800C8098: "__cdecl _DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_lsapolicy_l1_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_lsapolicy_l1_1_0_dll
0x1800B9668: SclEvent_ProcessSystemRegistry_Start
0x180019320: SampDsSetBuiltinDomainPolicy
0x1800A8A60: "__cdecl _imp_RtlGetVersion" __imp_RtlGetVersion
0x180097EC4: RtlReportErrorOrigination
0x1800255F0: SamIUpdateLogonStatistics
0x1800B2DC8: WPP_ThisDir_CTLGUID_SamSrv
0x180062CB0: SamrGetDisplayEnumerationIndex2
0x1800B9AB8: "SecObjectSDProcessCount" ??_C@_1DA@CABLJHCK@?$AAS?$AAe?$AAc?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAS?$AAD?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AAC?$AAo?$AAu?$AAn?$AAt?$AA?$AA@
0x180001564: SampCurrentThreadOwnsRegistryHiveLock
0x18007EBD8: SampRemoveMembershipUser
0x180031F1E: "__cdecl initialize_onexit_table" _initialize_onexit_table
0x1800BD4CC: "__cdecl _ResolveDelayLoadedAPIFlags" __ResolveDelayLoadedAPIFlags
0x180065860: SampSetSerialNumberDomain2
0x18000A9C8: SampRegConstructInternetProviderName
0x1800D2B18: "__cdecl _scrt_native_startup_lock" __scrt_native_startup_lock
0x180095ECC: StringCbVPrintfW
0x1800D3F1C: SamTCPDisabledAtBoot
0x1800DD108: "__cdecl _imp_MesDecodeBufferHandleCreate" __imp_MesDecodeBufferHandleCreate
0x1800B47B8: "MFA Key Property" ??_C@_1CC@COGCDNFD@?$AAM?$AAF?$AAA?$AA?5?$AAK?$AAe?$AAy?$AA?5?$AAP?$AAr?$AAo?$AAp?$AAe?$AAr?$AAt?$AAy?$AA?$AA@
0x180085A40: SampGetExternalNameFromIndex
0x1800A82B0: "__cdecl _imp_GetEnvironmentVariableW" __imp_GetEnvironmentVariableW
0x1800DD260: "__cdecl _imp_LsaQueryInformationPolicy" __imp_LsaQueryInformationPolicy
0x1800C80B8: "__cdecl _DELAY_IMPORT_DESCRIPTOR_DNSAPI_dll" __DELAY_IMPORT_DESCRIPTOR_DNSAPI_dll
0x1800325C7: "__cdecl _tailMerge_api_ms_win_core_registry_l2_1_0_dll" __tailMerge_api_ms_win_core_registry_l2_1_0_dll
0x180016B70: SampConvertAttrBlockToFixedLengthAttributes
0x18008FD4C: SclRegFindLoadedHive
0x180010630: SampCheckPasswordHistory
0x180061A28: WPP_SF_Sii
0x180001290: SampConvertAttrValBlockToByteArray
0x18002F65C: SampInitializeActiveEnumerationContextTable
0x1800B3A20: "DELETING" ??_C@_1BC@LNGOOGI@?$AAD?$AAE?$AAL?$AAE?$AAT?$AAI?$AAN?$AAG?$AA?$AA@
0x18006770C: WPP_SF_ZD
0x18001C1E0: SamrOpenGroup
0x18001DD70: FilePathCompare
0x1800B8FA0: "Target OS is in a failed state f" ??_C@_0FO@FILHLHKI@Target?5OS?5is?5in?5a?5failed?5state?5f@
0x1800A85F8: "__cdecl _imp__o___stdio_common_vsprintf" __imp__o___stdio_common_vsprintf
0x1800B4D88: "LH-RC1-IDS1 to LH-BETA3" ??_C@_0BI@DLDMIKEJ@LH?9RC1?9IDS1?5to?5LH?9BETA3?$AA@
0x1800B90C8: "Marking event [&SclEvent_ExtendP" ??_C@_0CP@MCCOEAEK@Marking?5event?5?$FL?$CGSclEvent_ExtendP@
0x180085AC0: SampGetWillNeverTime
0x180087BC0: "int __cdecl IsPasswordOrComplexityEnabled(void * __ptr64)" ?IsPasswordOrComplexityEnabled@@YAHPEAX@Z
0x18002F7D8: SampPerformSyskeyUpgrade
0x1800749CC: SampExtRemoveMembershipAttributeDs
0x180083158: WPP_SF_ZZ
0x18002F92C: SampIsDownlevelDcUpgrade
0x180086100: SampRetrieveAccountCountsRegistry
0x1800BB3B8: "(%lx): Failed to process registr" ??_C@_0CH@PMKJBJFL@?$CI?$CFlx?$CJ?3?5Failed?5to?5process?5registr@
0x1800D5220: EfipApisInitialized
0x1800DD178: "__cdecl _imp_RpcServerRegisterIf3" __imp_RpcServerRegisterIf3
0x1800BA220: "SclExpandString" ??_C@_0BA@KKBKEJEL@SclExpandString?$AA@
0x1800DD1E0: "__cdecl _imp_RpcEpResolveBinding" __imp_RpcEpResolveBinding
0x1800BCC18: "Not-null check failed: KeyNameBu" ??_C@_0CF@MAEOPAHE@Not?9null?5check?5failed?3?5KeyNameBu@
0x18006AF14: SampCommitAndRetainWriteLock
0x1800D0190: UserDeviceRegistrationEventProvider_Context
0x1800330F0: "long __cdecl StringCchCopyW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64)" ?StringCchCopyW@@YAJPEAG_KPEBG@Z
0x18006AA10: SamrSetInformationGroup
0x180032335: "__cdecl _imp_load_NdrMesTypeEncode3" __imp_load_NdrMesTypeEncode3
0x1800645E0: SampLookupInternetProviderNameByGUID
0x1800B8F70: "(%lx): Failed to retrieve OS's S" ??_C@_0CO@EBCFPIJ@?$CI?$CFlx?$CJ?3?5Failed?5to?5retrieve?5OS?8s?5S@
0x1800681F0: SampConvertLargeIntegerToAttrValBlock
0x1800BC9B0: "globalroot" ??_C@_1BG@PJLLOKFB@?$AAg?$AAl?$AAo?$AAb?$AAa?$AAl?$AAr?$AAo?$AAo?$AAt?$AA?$AA@
0x180074F60: SampExtSyncServerObjectRDNDs
0x1800BE348: NullOrEmptyParameterFailureEvent
0x1800AB1E0: "PasswordFilter" ??_C@_0P@HNCGMJEN@PasswordFilter?$AA@
0x180030B30: SampFixBug18471
0x1800A84F8: "__cdecl _imp_VerSetConditionMask" __imp_VerSetConditionMask
0x1800B6B60: "SampRefreshRegistry: Failed to N" ??_C@_0DD@NJMKJBKA@SampRefreshRegistry?3?5Failed?5to?5N@
0x1800A8B88: "__cdecl _imp_RtlGetAce" __imp_RtlGetAce
0x1800BA190: "SclStateRecordResults" ??_C@_0BG@LGBKDNMG@SclStateRecordResults?$AA@
0x18001C350: SampGetSamSubsystemName
0x18008CDAC: SclCreateFakeNtPathEnvironment
0x18000EEB4: SampExtNetlogonPingDs
0x1800BF648: "NtDeleteBootEntry" ??_C@_0BC@CIAOMJDE@NtDeleteBootEntry?$AA@
0x180032274: "__cdecl _imp_load_NdrMesTypeDecode3" __imp_load_NdrMesTypeDecode3
0x180032F78: "__cdecl _vcrt_uninitialize" __vcrt_uninitialize
0x1800D2B90: "__cdecl _hmod__cryptdll_dll" __hmod__cryptdll_dll
0x1800AA678: "RestrictAnonymousSam" ??_C@_0BF@GONHKBNP@RestrictAnonymousSam?$AA@
0x1800A8C70: "__cdecl _imp_RtlFreeHeap" __imp_RtlFreeHeap
0x1800A88F0: "__cdecl _imp_RtlInitializeResource" __imp_RtlInitializeResource
0x1800B95E8: SclEvent_ProcessSystemRegistry_Stop
0x1800BB430: "SclCreateKey failed to open key " ??_C@_0GC@KJEGDDCK@SclCreateKey?5failed?5to?5open?5key?5@
0x1800A81A8: "__cdecl _imp_FlushFileBuffers" __imp_FlushFileBuffers
0x1800A89D0: "__cdecl _imp_RtlInitializeBitMap" __imp_RtlInitializeBitMap
0x1800A8328: "__cdecl _imp_IsProcessorFeaturePresent" __imp_IsProcessorFeaturePresent
0x180004B00: SamrLookupIdsInDomain
0x1800A8DD8: "__cdecl _PLEASE_LINK_WITH_legacy_stdio_wide_specifiers.lib" __PLEASE_LINK_WITH_legacy_stdio_wide_specifiers.lib
0x1800AA958: "PostPromoteBoot" ??_C@_1CA@NCNEHMLH@?$AAP?$AAo?$AAs?$AAt?$AAP?$AAr?$AAo?$AAm?$AAo?$AAt?$AAe?$AAB?$AAo?$AAo?$AAt?$AA?$AA@
0x180001590: SampActiveContextTableAllocate
0x180070790: SampDeleteDsDirsToDeleteKey
0x1800B3868: "SampSetInitialGMSAPassword for n" ??_C@_0DN@NEPHEPIE@SampSetInitialGMSAPassword?5for?5n@
0x1800B40C8: "Package load result for %wZ: 0x%" ??_C@_0CD@GCOIKMN@Package?5load?5result?5for?5?$CFwZ?3?50x?$CF@
0x1800739BC: SampAuditUserDelete
0x1800DD160: "__cdecl _imp_RpcServerUseProtseqExW" __imp_RpcServerUseProtseqExW
0x18000CED8: SampValidateValidatePasswordHash
0x1800BD2F0: "invalid type" ??_C@_1BK@BJIJFBKL@?$AAi?$AAn?$AAv?$AAa?$AAl?$AAi?$AAd?$AA?5?$AAt?$AAy?$AAp?$AAe?$AA?$AA@
0x180030414: SampComponentUpdatesReadRequestedRids
0x1800CBE80: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0
0x18007D7B0: SampDecryptPasswordWithSessionKey
0x18006A3B0: SamrGetMembersInGroup
0x18006D530: WPP_SF_Z
0x1800DD008: CRYPTBASE_NULL_THUNK_DATA_DLA
0x1800B8D28: "samr" ??_C@_19GIBGHNKE@?$AAs?$AAa?$AAm?$AAr?$AA?$AA@
0x1800B3590: "Encode" ??_C@_1O@IGLLOHKL@?$AAE?$AAn?$AAc?$AAo?$AAd?$AAe?$AA?$AA@
0x180010904: SampSetLogonHoursAttribute
0x18006E6B0: SamILoadDownlevelDatabase
0x18006D6EC: "__cdecl fgs__SAMPR_DOMAIN_GENERAL_INFORMATION" _fgs__SAMPR_DOMAIN_GENERAL_INFORMATION
0x1800AB3E0: SampControlGuid
0x1800A8BD8: "__cdecl _imp_RtlLengthSecurityDescriptor" __imp_RtlLengthSecurityDescriptor
0x180085330: SampConvertUiListToApiList
0x1800AA978: "\" ??_C@_13FPGAJAPJ@?$AA?2?$AA?$AA@
0x18002DC40: SampUsingDsData
0x180086DBC: SampValidateLastLogonTimestampArg
0x1800BED88: "pdwBufferSize" ??_C@_1BM@LAAKBAFL@?$AAp?$AAd?$AAw?$AAB?$AAu?$AAf?$AAf?$AAe?$AAr?$AAS?$AAi?$AAz?$AAe?$AA?$AA@
0x180088590: SamOpenDomain
0x18001D43C: WPP_SF_
0x18001CCD0: SampExtEnumerateAccountNamesDs
0x18007D7FC: SampDecryptPasswordWithSessionKeyNew
0x1800927C8: SclRegProcessUserProfileHives
0x1800AB1A0: "CredentialUpdateNotify" ??_C@_0BH@HPKAJBOK@CredentialUpdateNotify?$AA@
0x1800251D0: SampFlushThread
0x1800BAB68: "Copying to [%ws]" ??_C@_0BB@BIKOIPMK@Copying?5to?5?$FL?$CFws?$FN?$AA@
0x1800BE4B0: "HKEY_LOCAL_MACHINE\TargetSoftwar" ??_C@_1IE@DIFAICJB@?$AAH?$AAK?$AAE?$AAY?$AA_?$AAL?$AAO?$AAC?$AAA?$AAL?$AA_?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAT?$AAa?$AAr?$AAg?$AAe?$AAt?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr@
0x1800A98C8: "krbtgt" ??_C@_1O@CJHEGOJJ@?$AAk?$AAr?$AAb?$AAt?$AAg?$AAt?$AA?$AA@
0x1800B2E30: SAMMSG_REMOTE_SAM_AUDIT_MODE_DISABLED
0x1800A81D8: "__cdecl _imp_HeapAlloc" __imp_HeapAlloc
0x18006FA04: SampAddWellKnownAccountsAndSecurityPrincipals
0x18009B264: "private: static long __cdecl RegistrationCertStatus::GetCertificate(enum _CERTFICATE_LOCATION,char const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,enum INFO_KIND,struct _CERT_CONTEXT const * __ptr64 * __ptr64)" ?GetCertificate@RegistrationCertStatus@@CAJW4_CERTFICATE_LOCATION@@PEBDPEBG2W4INFO_KIND@@PEAPEBU_CERT_CONTEXT@@@Z
0x18000F040: SampWriteGroupType
0x180031F7E: wcsncpy_s
0x180032833: "__cdecl _imp_load_RpcServerUseProtseqEpExW" __imp_load_RpcServerUseProtseqEpExW
0x1800A8240: "__cdecl _imp_FreeLibrary" __imp_FreeLibrary
0x18004E790: SamrDeleteAlias
0x18000DCA0: SampCreateGroupInDomain
0x1800A8418: "__cdecl _imp_CompareStringW" __imp_CompareStringW
0x18000A32C: SampULongRoundUp
0x1800BA630: "Failed to initialize the boot op" ??_C@_0CP@PNCBLCGA@Failed?5to?5initialize?5the?5boot?5op@
0x18006B18C: RtlStringCchVPrintfExA
0x1800A8478: "__cdecl _imp_AcquireSRWLockExclusive" __imp_AcquireSRWLockExclusive
0x1800D3840: SampActiveEnumerationContextTableLock
0x1800C81F8: "__cdecl _NULL_DELAY_IMPORT_DESCRIPTOR" __NULL_DELAY_IMPORT_DESCRIPTOR
0x1800B4390: "Creator Owner" ??_C@_1BM@IONMOFGL@?$AAC?$AAr?$AAe?$AAa?$AAt?$AAo?$AAr?$AA?5?$AAO?$AAw?$AAn?$AAe?$AAr?$AA?$AA@
0x1800A8CD0: "__cdecl _imp_RtlpNtQueryValueKey" __imp_RtlpNtQueryValueKey
0x1800644F0: SampLookupInternetProviderGUIDByName
0x180023B7C: SampIsExtendedSidModeEmulated
0x1800680D0: SampConvertAttrValBlockToLargeInteger
0x1800BE380: "CertificateUtil::FindAllCertific" ??_C@_1FO@CMIEBPCJ@?$AAC?$AAe?$AAr?$AAt?$AAi?$AAf?$AAi?$AAc?$AAa?$AAt?$AAe?$AAU?$AAt?$AAi?$AAl?$AA?3?$AA?3?$AAF?$AAi?$AAn?$AAd?$AAA?$AAl?$AAl?$AAC?$AAe?$AAr?$AAt?$AAi?$AAf?$AAi?$AAc@
0x1800A8D40: "__cdecl _imp_RtlGetGroupSecurityDescriptor" __imp_RtlGetGroupSecurityDescriptor
0x1800BA558: "SclpGetDiskHandle" ??_C@_0BC@DOGJCCCD@SclpGetDiskHandle?$AA@
0x1800A8330: "__cdecl _imp_OpenProcess" __imp_OpenProcess
0x18006DEE8: CngRsa32Compat_rc4_key
0x1800BE358: "My" ??_C@_15OLMMKIPI@?$AAM?$AAy?$AA?$AA@
0x180031F5A: "__cdecl o_malloc" _o_malloc
0x180097778: "signed char __cdecl Windows::StringUtil::Impl::NumberOfDigits<unsigned __int64>(unsigned __int64,signed char)" ??$NumberOfDigits@_K@Impl@StringUtil@Windows@@YAC_KC@Z
0x1800A8440: api-ms-win-core-string-obsolete-l1-1-0_NULL_THUNK_DATA
0x1800AB470: "ProductType" ??_C@_1BI@JPCMFPH@?$AAP?$AAr?$AAo?$AAd?$AAu?$AAc?$AAt?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x1800AFC78: "InternetUID" ??_C@_1BI@FDIDFJOE@?$AAI?$AAn?$AAt?$AAe?$AAr?$AAn?$AAe?$AAt?$AAU?$AAI?$AAD?$AA?$AA@
0x1800315B0: "__cdecl _scrt_dllmain_before_initialize_c" __scrt_dllmain_before_initialize_c
0x1800DD150: "__cdecl _imp_RpcBindingFree" __imp_RpcBindingFree
0x180032ECC: "__cdecl _imp_load_SystemFunction013" __imp_load_SystemFunction013
0x18000DAA8: SampExtMaybeBeginDsTransactionDs
0x1800A8890: "__cdecl _imp_NtPrivilegeCheck" __imp_NtPrivilegeCheck
0x1800BC418: "Marking event [&SclEvent_Process" ??_C@_0DD@OCHLKIDO@Marking?5event?5?$FL?$CGSclEvent_Process@
0x1800311D0: "__cdecl DllMainCRTStartup" _DllMainCRTStartup
0x18007D45C: SampDecryptForPasswordChange
0x180032680: NdrServerCallAll
0x18001DE40: SampCheckSidType
0x1800D3BB8: SampRestrictRemoteSessionAccess
0x1800B6088: "SCHEMA" ??_C@_1O@EOKNKAEJ@?$AAS?$AAC?$AAH?$AAE?$AAM?$AAA?$AA?$AA@
0x18000BC90: SampPerformObjectChangeNotificationOperation
0x18000F990: SampDecrementActiveThreads
0x1800327D9: "__cdecl _imp_load_RpcServerUseProtseqExW" __imp_load_RpcServerUseProtseqExW
0x1800A8638: "__cdecl _imp__initterm" __imp__initterm
0x18000C740: SamIPromote
0x180015BC0: SampDsUpdateContextAttributes
0x1800DD210: "__cdecl _imp_RpcStringBindingComposeW" __imp_RpcStringBindingComposeW
0x1800329D9: "__cdecl _imp_load_LsaQueryInformationPolicy" __imp_load_LsaQueryInformationPolicy
0x18007490C: SampExtQueryUserSupplementalCredentialsDs
0x1800CBFFC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-debug-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-debug-l1-1-0
0x1800A8220: "__cdecl _imp_MoveFileW" __imp_MoveFileW
0x1800A97F0: "SAM_ALIAS" ??_C@_1BE@INOHJDDA@?$AAS?$AAA?$AAM?$AA_?$AAA?$AAL?$AAI?$AAA?$AAS?$AA?$AA@
0x180012C60: BuildNewPackageList
0x1800281C8: SampDetectNonRandomSaltAndRandomize
0x1800BC690: "SclpVolumeIsNtfs" ??_C@_0BB@EJGDFFCD@SclpVolumeIsNtfs?$AA@
0x1800BCCB8: "..{" ??_C@_17PHLJBDCJ@?$AA?4?$AA?4?$AA?$HL?$AA?$AA@
0x1800AB560: "__cdecl _sz_api_ms_win_core_registry_l2_1_0_dll" __sz_api_ms_win_core_registry_l2_1_0_dll
0x1800BD158: "_myVariantCopy" ??_C@_1BO@CICBNBNK@?$AA_?$AAm?$AAy?$AAV?$AAa?$AAr?$AAi?$AAa?$AAn?$AAt?$AAC?$AAo?$AAp?$AAy?$AA?$AA@
0x1800BAE20: "\REGISTRY\MACHINE\SYSTEM\CURRENT" ??_C@_1HI@PBLDOFLN@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?2?$AAC?$AAU?$AAR?$AAR?$AAE?$AAN?$AAT@
0x1800D3E10: SampSchemaAdministratorsSid
0x1800BA838: "(%lx): Failed writing boot entry" ??_C@_0DO@ELICFH@?$CI?$CFlx?$CJ?3?5Failed?5writing?5boot?5entry@
0x1800D5248: EfipDeleteDriverEntry
0x1800BE540: "%s: Cannot open registry key "%s" ??_C@_1MK@ELBHDEBE@?$AA?$CF?$AAs?$AA?3?$AA?5?$AAC?$AAa?$AAn?$AAn?$AAo?$AAt?$AA?5?$AAo?$AAp?$AAe?$AAn?$AA?5?$AAr?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?5?$AAk?$AAe?$AAy?$AA?5?$AA?$CC?$AA?$CF?$AAs@
0x1800A8C00: "__cdecl _imp_RtlInitializeRXact" __imp_RtlInitializeRXact
0x180032EDE: "__cdecl _imp_load_SystemFunction023" __imp_load_SystemFunction023
0x1800512B4: SampGetAuthzSecAttributesFromEncodedBlob
0x18002EC5C: SampInitObjectInfoAttributes
0x1800DD190: "__cdecl _imp_RpcImpersonateClient" __imp_RpcImpersonateClient
0x1800B5D78: "SampProcessMappedAttributes" ??_C@_0BM@FALDLJPI@SampProcessMappedAttributes?$AA@
0x180054284: PrepDomain
0x180086440: SampSetTransactionWithinDomain
0x18001B54C: "__cdecl fgs__SAMPR_USER_ALL_INFORMATION" _fgs__SAMPR_USER_ALL_INFORMATION
0x1800A8130: "__cdecl _imp_SetLastError" __imp_SetLastError
0x1800BD020: "RtlHashEncodedLBlob" ??_C@_0BE@FAOLDLKD@RtlHashEncodedLBlob?$AA@
0x180014410: SampSetVariableAttribute
0x180032104: "__cdecl _imp_load_I_NetNotifyRole" __imp_load_I_NetNotifyRole
0x18001BAF0: SampIsAuditingEnabled
0x180007960: SampConnect
0x1800839B0: WPP_SF_SDDDD
0x180083894: SampGetAliasMembershipAsSids
0x1800B5AC8: "SamrSetMemberAttributesOfGroup" ??_C@_0BP@DGKBOJOF@SamrSetMemberAttributesOfGroup?$AA@
0x18000F9B0: SampQueryCapabilities
0x1800B5EB0: "Remote access" ??_C@_1BM@HNPFLKJH@?$AAR?$AAe?$AAm?$AAo?$AAt?$AAe?$AA?5?$AAa?$AAc?$AAc?$AAe?$AAs?$AAs?$AA?$AA@
0x1800D22F0: SampAuditMessageTable
0x1800B2D80: "TRUE" ??_C@_04HCDDPBNL@TRUE?$AA@
0x1800CC0C4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-1" __IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-1
0x18007874C: SampMakeLowBoxRpcSD
0x1800B6DC8: "SampValidateKeyAttrStatsArg: ret" ??_C@_0CN@EFHKKBPC@SampValidateKeyAttrStatsArg?3?5ret@
0x1800A8188: "__cdecl _imp_SetFileInformationByHandle" __imp_SetFileInformationByHandle
0x180094B64: SclFsProcessVolume
0x1800638FC: RtlStringCbPrintfW
0x18001A760: GtbpDeleteFromSubTree
0x1800B9360: "\REGISTRY\MACHINE\SECURITY\POLIC" ??_C@_1FG@DBKEIDCO@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAE?$AAC?$AAU?$AAR?$AAI?$AAT?$AAY?$AA?2?$AAP?$AAO?$AAL?$AAI?$AAC@
0x1800B2C00: SampGetAliasMembershipGuid
0x180013860: SampCreateUserInDomain
0x1800D07D0: AliasExtendedAttributeProperties
0x180065684: SampSetPrivateUserData
0x1800A8230: "__cdecl _imp_GetModuleFileNameW" __imp_GetModuleFileNameW
0x1800B2A60: SampSetPasswordComputerGuid
0x1800A8858: "__cdecl _imp_RtlCreateUnicodeStringFromAsciiz" __imp_RtlCreateUnicodeStringFromAsciiz
0x1800B2D88: "%ProgramData%\LogFiles" ??_C@_1CO@JGEFBNHM@?$AA?$CF?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAD?$AAa?$AAt?$AAa?$AA?$CF?$AA?2?$AAL?$AAo?$AAg?$AAF?$AAi?$AAl?$AAe?$AAs?$AA?$AA@
0x180007130: SampLookupContextEx
0x18007F770: SamrChangePasswordUser
0x1800A80A0: "__cdecl _imp_LsaIOpenPolicyTrusted" __imp_LsaIOpenPolicyTrusted
0x1800D3BC0: SampSecretEncryptionEnabled
0x1800B3640: "SamIValidateAndFilterClaimEntrie" ??_C@_0EL@GAGCHMFH@SamIValidateAndFilterClaimEntrie@
0x18002EFB8: SampInitializeComponentRequestedUpdates
0x1800BDF80: "%s: RegistrationCertStatus::GetD" ??_C@_1MA@DFNLAAJI@?$AA?$CF?$AAs?$AA?3?$AA?5?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAa?$AAt?$AAi?$AAo?$AAn?$AAC?$AAe?$AAr?$AAt?$AAS?$AAt?$AAa?$AAt?$AAu?$AAs?$AA?3?$AA?3?$AAG?$AAe?$AAt?$AAD@
0x1800A89C0: "__cdecl _imp_RtlEqualUnicodeString" __imp_RtlEqualUnicodeString
0x18008D008: SclGetOnlineOSVolumeNtPath
0x180073E3C: SampExtCheckForSiteAffinityUpdateDs
0x1800B99C0: "Number of registry security desc" ??_C@_1GA@OLAGPOND@?$AAN?$AAu?$AAm?$AAb?$AAe?$AAr?$AA?5?$AAo?$AAf?$AA?5?$AAr?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?5?$AAs?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?5?$AAd?$AAe?$AAs?$AAc@
0x18002237C: RtlStringCchCopyNW
0x18003280F: "__cdecl _imp_load_RpcServerRegisterIf3" __imp_load_RpcServerRegisterIf3
0x18008A2D4: KEChangeKey
0x1800A84C0: "__cdecl _imp_GetVersionExW" __imp_GetVersionExW
0x180008010: SamIGetAliasMembership
0x1800286A0: SampGetPrivateUserData
0x18001C690: SampExtGetCachedObjectSDDs
0x1800028A0: SampCurrentThreadOwnsLock
0x1800B3238: "SAMSRV.DLL" ??_C@_1BG@LFAHPAKO@?$AAS?$AAA?$AAM?$AAS?$AAR?$AAV?$AA?4?$AAD?$AAL?$AAL?$AA?$AA@
0x18001FD90: SamIFree_SAMPR_ENUMERATION_BUFFER
0x1800A8078: "__cdecl _imp_LsaISamIndicatedDsStarted" __imp_LsaISamIndicatedDsStarted
0x1800D36C0: SampActiveEnumerationClientTable
0x1800BF660: "NtDeleteDriverEntry" ??_C@_0BE@JIPJEJDL@NtDeleteDriverEntry?$AA@
0x1800BE120: "%s: The specified tenant ID is e" ??_C@_1KG@PIDAKBOK@?$AA?$CF?$AAs?$AA?3?$AA?5?$AAT?$AAh?$AAe?$AA?5?$AAs?$AAp?$AAe?$AAc?$AAi?$AAf?$AAi?$AAe?$AAd?$AA?5?$AAt?$AAe?$AAn?$AAa?$AAn?$AAt?$AA?5?$AAI?$AAD?$AA?5?$AAi?$AAs?$AA?5?$AAe@
0x18004D5C0: SamIRemoveDSNameFromAlias
0x1800CBE1C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0
0x1800BC058: "Not changing symbolic link %s du" ??_C@_0DH@KOCEEHJC@Not?5changing?5symbolic?5link?5?$CFs?5du@
0x1800A80B8: "__cdecl _imp_LsaIFree_LSAPR_POLICY_INFORMATION" __imp_LsaIFree_LSAPR_POLICY_INFORMATION
0x1800CBF70: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-console-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-console-l1-1-0
0x1800A9890: "Not allowed to log on this sku" ??_C@_0BP@LCKBCPCP@Not?5allowed?5to?5log?5on?5this?5sku?$AA@
0x1800B5A50: "SamrSetInformationGroup" ??_C@_0BI@GABGBIIF@SamrSetInformationGroup?$AA@
0x18006EC70: SampAddAccountsAndApplyMemberships
0x1800D0F70: DsWellKnownAccounts
0x1800B2000: "SamNoGcLogonEnforceKerberosIpChe" ??_C@_0CD@GNLGDENF@SamNoGcLogonEnforceKerberosIpChe@
0x1800B2F20: SAMMSG_RESTRICT_REMOTE_SAM_REGISTRY_SD
0x1800BB748: "\NTUSER.DAT" ??_C@_1BI@NMJKHPNF@?$AA?2?$AAN?$AAT?$AAU?$AAS?$AAE?$AAR?$AA?4?$AAD?$AAA?$AAT?$AA?$AA@
0x180063840: WPP_SF_qLZ
0x1800B4AA0: "SAMUPGRADE" ??_C@_1BG@KFILFKOB@?$AAS?$AAA?$AAM?$AAU?$AAP?$AAG?$AAR?$AAA?$AAD?$AAE?$AA?$AA@
0x1800A85B0: "__cdecl _imp__o_wcstok" __imp__o_wcstok
0x180087244: SampValidateUserAllInformation
0x1800A8010: CRYPT32_NULL_THUNK_DATA
0x180071798: SampQueryLocalizableAccounts
0x180067D1C: SampOpenEnumerationClient
0x18009CB84: OSBESetOsLoaderVolumeName
0x1800BECB0: "CertificateUtil::GetCertificateT" ??_C@_1FE@GAHBNJNH@?$AAC?$AAe?$AAr?$AAt?$AAi?$AAf?$AAi?$AAc?$AAa?$AAt?$AAe?$AAU?$AAt?$AAi?$AAl?$AA?3?$AA?3?$AAG?$AAe?$AAt?$AAC?$AAe?$AAr?$AAt?$AAi?$AAf?$AAi?$AAc?$AAa?$AAt?$AAe?$AAT@
0x1800A85C8: "__cdecl _imp__o__crt_atexit" __imp__o__crt_atexit
0x1800D3B80: SampDefinedDomainsCount
0x180031EEE: "__cdecl o__configure_narrow_argv" _o__configure_narrow_argv
0x18006B784: SampDisableLogging
0x18002F4A0: "public: __cdecl LibraryInitLock::LibraryInitLock(void) __ptr64" ??0LibraryInitLock@@QEAA@XZ
0x180021A30: QueryRegistryTracingDisabled
0x1800694B0: SampDeleteGroupKeys
0x1800BABD8: "(%lx): Failed to create full pat" ??_C@_0DI@LHKLJEMF@?$CI?$CFlx?$CJ?3?5Failed?5to?5create?5full?5pat@
0x18002FE20: SamrGetGroupsForUser
0x1800A8BC0: "__cdecl _imp_RtlIntegerToUnicodeString" __imp_RtlIntegerToUnicodeString
0x18000C0C0: SampValidateSecurityDbObjectType
0x1800AB890: "Default" ??_C@_1BA@GHOECOCL@?$AAD?$AAe?$AAf?$AAa?$AAu?$AAl?$AAt?$AA?$AA@
0x1800BA150: "NTSTATUS" ??_C@_1BC@GGNEPBCH@?$AAN?$AAT?$AAS?$AAT?$AAA?$AAT?$AAU?$AAS?$AA?$AA@
0x1800253C0: SampAcquireWriteLock
0x1800AA4C0: "SAM" ??_C@_17OMAOINJK@?$AAS?$AAA?$AAM?$AA?$AA@
0x180031A58: "__cdecl _scrt_initialize_default_local_stdio_options" __scrt_initialize_default_local_stdio_options
0x18008A354: KEDecryptKeyWithRC4
0x180010350: SampDuplicateUnicodeString
0x1800026A0: SampRemoveEntryContextList
0x18003007C: SampProcessPerComponentWellKnownAccountUpdates
0x18007CBC0: SampChangeUserAccountName
0x180001510: SampGenericTable2Free
0x1800D3890: SampSamSubsystem
0x1800DD2A8: "__cdecl _imp_SystemFunction041" __imp_SystemFunction041
0x1800B5E40: "SampStartListeningOnRpcTransport" ??_C@_0EG@MGJKIMCP@SampStartListeningOnRpcTransport@
0x1800DD2B0: "__cdecl _imp_SystemFunction040" __imp_SystemFunction040
0x1800A88D8: "__cdecl _imp_RtlCompareString" __imp_RtlCompareString
0x180069678: SampEnforceSameDomainGroupMembershipChecks
0x1800BF618: "WINDOWS" ??_C@_07LHJOABLP@WINDOWS?$AA@
0x1800BB6B0: "SclRegProcessUserProfileHives" ??_C@_0BO@BNIMKKMK@SclRegProcessUserProfileHives?$AA@
0x1800A8AD0: "__cdecl _imp_NtCreateFile" __imp_NtCreateFile
0x1800B3D20: "SAM: StartRxact failed, status =" ??_C@_0CI@LJHIHEFC@SAM?3?5StartRxact?5failed?0?5status?5?$DN@
0x1800A8308: "__cdecl _imp_CreateThread" __imp_CreateThread
0x180030CA0: SampUpdateProductTypeCache
0x180031724: "__cdecl _scrt_initialize_onexit_tables" __scrt_initialize_onexit_tables
0x1800171B0: SampAppendFixedLengthAttributeToBuffer
0x1800A8728: "__cdecl _imp_BCryptSetProperty" __imp_BCryptSetProperty
0x1800BEEB0: "%s: FindExtensionByOid: pCertCon" ??_C@_1FM@MJJLCNFB@?$AA?$CF?$AAs?$AA?3?$AA?5?$AAF?$AAi?$AAn?$AAd?$AAE?$AAx?$AAt?$AAe?$AAn?$AAs?$AAi?$AAo?$AAn?$AAB?$AAy?$AAO?$AAi?$AAd?$AA?3?$AA?5?$AAp?$AAC?$AAe?$AAr?$AAt?$AAC?$AAo?$AAn@
0x1800A8D98: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x1800A8C48: "__cdecl _imp_RtlCreateAndSetSD" __imp_RtlCreateAndSetSD
0x1800B9000: "Marking event [&SclEvent_ResetDi" ??_C@_0DE@JEBONIIL@Marking?5event?5?$FL?$CGSclEvent_ResetDi@
0x1800B5528: "NoLmHash" ??_C@_1BC@LDFGPECO@?$AAN?$AAo?$AAL?$AAm?$AAH?$AAa?$AAs?$AAh?$AA?$AA@
0x180087034: SampValidateSD
0x1800A97D8: "SAM_DOMAIN" ??_C@_1BG@JFBAGLPO@?$AAS?$AAA?$AAM?$AA_?$AAD?$AAO?$AAM?$AAA?$AAI?$AAN?$AA?$AA@
0x18001C380: SamIGetUserLogonInformationEx
0x1800D0CD0: SampDomainUpdate_WIN7RC_TO_Win8RPM_Parameter
0x1800D21B4: MaxLogFileSize
0x180075DBC: SampSKUAllowsHiveCreation
0x1800BC148: "not performed" ??_C@_0O@PLIOEOHB@not?5performed?$AA@
0x1800BB040: "Partition [%ws] not found." ??_C@_0BL@LNIELNKO@Partition?5?$FL?$CFws?$FN?5not?5found?4?$AA@
0x1800A8740: "__cdecl _imp_BCryptGetProperty" __imp_BCryptGetProperty
0x1800D51F8: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUwhUhvxfirgbUvzhUklorxbvmtrmvUvcgmoryUlyquivUznwGEUkxsOlyq@EASExtn" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUwhUhvxfirgbUvzhUklorxbvmtrmvUvcgmoryUlyquivUznwGEUkxsOlyq@EASExtn
0x1800754F0: SamIUninitialize
0x18001B9B4: SampDoUserCreationChecks
0x1800BAE98: "\REGISTRY\MACHINE" ??_C@_1CE@BGEMHEPM@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?$AA@
0x1800103C0: SampCheckPasswordRestrictions
0x1800B95C8: SclEvent_ProcessVolumes_Start
0x1800BAC10: "(%lx): Failed to create full pat" ??_C@_0DN@HDPGOLHH@?$CI?$CFlx?$CJ?3?5Failed?5to?5create?5full?5pat@
0x180031A8C: "__cdecl _crt_debugger_hook" __crt_debugger_hook
0x18004EAF0: SamrQueryInformationAlias
0x1800869E4: SampValidateAliasGeneralInformation
0x1800BEF20: "pcszOidValue" ??_C@_1BK@HLFKCELF@?$AAp?$AAc?$AAs?$AAz?$AAO?$AAi?$AAd?$AAV?$AAa?$AAl?$AAu?$AAe?$AA?$AA@
0x18000F27C: SampExtGetResourceGroupMembershipsTransitiveDs
0x1800B5960: "SamrCreateComputerInDomain" ??_C@_0BL@JPGBNNCE@SamrCreateComputerInDomain?$AA@
0x1800D3588: SampNetworkSid
0x1800A8180: "__cdecl _imp_FindFirstFileW" __imp_FindFirstFileW
0x1800B2DD8: "NULL" ??_C@_04HIBGFPH@NULL?$AA@
0x180017EDC: SampUpgradeSecretDataToDSAndSetClassId
0x1800A8730: "__cdecl _imp_BCryptEncrypt" __imp_BCryptEncrypt
0x1800A82E0: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x1800B40F0: "SamISetPasswordInfoOnDc (%ld) fr" ??_C@_0CP@NIPPLHEM@SamISetPasswordInfoOnDc?5?$CI?$CFld?$CJ?5fr@
0x1800BDAC0: "%s: Cannot open reg key %s. Assu" ??_C@_1LM@FKCLPEOI@?$AA?$CF?$AAs?$AA?3?$AA?5?$AAC?$AAa?$AAn?$AAn?$AAo?$AAt?$AA?5?$AAo?$AAp?$AAe?$AAn?$AA?5?$AAr?$AAe?$AAg?$AA?5?$AAk?$AAe?$AAy?$AA?5?$AA?$CF?$AAs?$AA?4?$AA?5?$AAA?$AAs?$AAs?$AAu@
0x180050E34: SampUpgradeUserParms
0x18000B3D0: SampUpdatePerformanceCounters
0x180087754: SampValidateUserLogonHoursInformation
0x1800B9D40: "Number of $MFT security descript" ??_C@_1FG@OMEJDGPJ@?$AAN?$AAu?$AAm?$AAb?$AAe?$AAr?$AA?5?$AAo?$AAf?$AA?5?$AA$?$AAM?$AAF?$AAT?$AA?5?$AAs?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?5?$AAd?$AAe?$AAs?$AAc?$AAr?$AAi?$AAp?$AAt@
0x18008FFEC: SclRegGetCanonicalMountKeyPath
0x1800BB9B0: "WINDOWS.OLD\WINDOWS\SYSTEM32\CON" ??_C@_1EI@HFACLOPC@?$AAW?$AAI?$AAN?$AAD?$AAO?$AAW?$AAS?$AA?4?$AAO?$AAL?$AAD?$AA?2?$AAW?$AAI?$AAN?$AAD?$AAO?$AAW?$AAS?$AA?2?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA3?$AA2?$AA?2?$AAC?$AAO?$AAN@
0x180064BCC: SampLookupSidByName
0x1800BB948: "(%lx): Failed to expand environm" ??_C@_0CM@BFEAHFHA@?$CI?$CFlx?$CJ?3?5Failed?5to?5expand?5environm@
0x1800BCB10: "$Extend\$Reparse:$R:$INDEX_ALLOC" ??_C@_1EM@FDODICLC@?$AA$?$AAE?$AAx?$AAt?$AAe?$AAn?$AAd?$AA?2?$AA$?$AAR?$AAe?$AAp?$AAa?$AAr?$AAs?$AAe?$AA?3?$AA$?$AAR?$AA?3?$AA$?$AAI?$AAN?$AAD?$AAE?$AAX?$AA_?$AAA?$AAL?$AAL?$AAO?$AAC@
0x180073F4C: SampExtDeleteObjectAndSetDsaDs
0x180067AF0: SampActiveEnumerationContextTableCompare
0x1800B4AF0: "SampAddWellKnownAccounts: SKU da" ??_C@_0FE@JDNIKMBP@SampAddWellKnownAccounts?3?5SKU?5da@
0x18008D438: SclExtractSidSubString
0x1800A8BA8: "__cdecl _imp_RtlAppendUnicodeToString" __imp_RtlAppendUnicodeToString
0x180066F00: SampDsFreeDomainInfo
0x1800B58F0: "SamrSetInformationDomain" ??_C@_0BJ@FOCACHBB@SamrSetInformationDomain?$AA@
0x1800B9320: "(%lx): Failed to retarget links" ??_C@_0CA@PNMMPHMK@?$CI?$CFlx?$CJ?3?5Failed?5to?5retarget?5links?$AA@
0x1800DD098: "__cdecl _imp_DsMakeSpnW" __imp_DsMakeSpnW
0x1800B6418: "UserId: 0x%x Successful interact" ??_C@_0DO@IKGAKEEI@UserId?3?50x?$CFx?5Successful?5interact@
0x180001510: SamIFreeVoid
0x1800BDD08: "GetwinDirectoryWinPE" ??_C@_1CK@LCCOPFGL@?$AAG?$AAe?$AAt?$AAw?$AAi?$AAn?$AAD?$AAi?$AAr?$AAe?$AAc?$AAt?$AAo?$AAr?$AAy?$AAW?$AAi?$AAn?$AAP?$AAE?$AA?$AA@
0x18003309C: "void __cdecl MemoryFree(void * __ptr64)" ?MemoryFree@@YAXPEAX@Z
0x180085AD0: SampIncrementNetlogonChangeLogSerialNumber
0x18009D074: EfiSetBootOptions
0x1800D3B98: SampWriteLockRegistryTransactionOpened
0x18007D3C0: SampComputePasswordExpired
0x1800A8298: "__cdecl _imp_GetPrivateProfileStringW" __imp_GetPrivateProfileStringW
0x1800A8868: "__cdecl _imp_EtwEventRegister" __imp_EtwEventRegister
0x18001FAEC: SampAlCreateMemberAccount
0x1800B2FB0: SAMMSG_USER_SETUP_ERROR
0x1800B2CF8: "samss lpc" ??_C@_1BE@IHKBOFHN@?$AAs?$AAa?$AAm?$AAs?$AAs?$AA?5?$AAl?$AAp?$AAc?$AA?$AA@
0x180079810: SampClearPreviousPasswordEncryptionKey
0x180087D3C: "public: void __cdecl SH<void * __ptr64,class SH_HANDLE>::Reset(void) __ptr64" ?Reset@?$SH@PEAXVSH_HANDLE@@@@QEAAXXZ
0x1800BE040: "RegistrationCertStatus::GetDevic" ??_C@_1FK@BMMEOPFO@?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAa?$AAt?$AAi?$AAo?$AAn?$AAC?$AAe?$AAr?$AAt?$AAS?$AAt?$AAa?$AAt?$AAu?$AAs?$AA?3?$AA?3?$AAG?$AAe?$AAt?$AAD?$AAe?$AAv?$AAi?$AAc@
0x1800AAC60: "ChainingMode" ??_C@_1BK@BCJKEJJO@?$AAC?$AAh?$AAa?$AAi?$AAn?$AAi?$AAn?$AAg?$AAM?$AAo?$AAd?$AAe?$AA?$AA@
0x1800A8940: "__cdecl _imp_RtlNtStatusToDosError" __imp_RtlNtStatusToDosError
0x1800B2AA0: SampRemoveMemberFromAliasGuid
0x1800AAA20: "00000000000000000000000000000000" ??_C@_1EC@CFJJDGGP@?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0@
0x180031F2A: "__cdecl register_onexit_function" _register_onexit_function
0x1800BBD40: "Error re-opening excluded key [%" ??_C@_0CO@NFOJIGFI@Error?5re?9opening?5excluded?5key?5?$FL?$CF@
0x1800B4710: "Authentication Authority Asserte" ??_C@_1FG@FFGDBAFL@?$AAA?$AAu?$AAt?$AAh?$AAe?$AAn?$AAt?$AAi?$AAc?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?5?$AAA?$AAu?$AAt?$AAh?$AAo?$AAr?$AAi?$AAt?$AAy?$AA?5?$AAA?$AAs?$AAs?$AAe?$AAr?$AAt?$AAe@
0x1800A8770: "__cdecl _imp_BCryptDestroyHash" __imp_BCryptDestroyHash
0x180031ECA: "__cdecl o___stdio_common_vswprintf_s" _o___stdio_common_vswprintf_s
0x1800B6C00: "SampRefreshRegistry: SampReIniti" ??_C@_0EA@CFAHKIBI@SampRefreshRegistry?3?5SampReIniti@
0x180001510: SampActiveEnumerationClientTableFree
0x1800D34D0: SampNullLmOwfPassword
0x18008CF44: SclDosPathToNtPath
0x1800A8B10: "__cdecl _imp_NtSaveKeyEx" __imp_NtSaveKeyEx
0x1800960BC: BuildPath
0x1800A80E8: "__cdecl _imp_IsDebuggerPresent" __imp_IsDebuggerPresent
0x18007D3F4: SampCopyA2D2Attribute
0x1800B6988: "SAM: Thread failed to get write " ??_C@_0DG@FNEMJIKL@SAM?3?5Thread?5failed?5to?5get?5write?5@
0x180027D70: SampFlushRegistryHive
0x180077D20: SamrSetSecurityObject
0x1800A8848: "__cdecl _imp_NtOpenThread" __imp_NtOpenThread
0x1800B4FA0: "Power user creation rights are n" ??_C@_0EJ@INCECLKF@Power?5user?5creation?5rights?5are?5n@
0x1800BD5D0: "DsrIsDeviceJoined" ??_C@_1CE@CMFMFJPJ@?$AAD?$AAs?$AAr?$AAI?$AAs?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAJ?$AAo?$AAi?$AAn?$AAe?$AAd?$AA?$AA@
0x180099984: "public: static long __cdecl DeviceRegistrationStateApi::GetJoinCertificate(unsigned short const * __ptr64,enum _JOIN_TYPE,enum INFO_KIND,struct _CERT_CONTEXT const * __ptr64 * __ptr64)" ?GetJoinCertificate@DeviceRegistrationStateApi@@SAJPEBGW4_JOIN_TYPE@@W4INFO_KIND@@PEAPEBU_CERT_CONTEXT@@@Z
0x18008D9F8: OSBESetFriendlyName
0x1800B4960: "c:\windows" ??_C@_1BG@HGJKPMDM@?$AAc?$AA?3?$AA?2?$AAw?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?$AA@
0x18001D620: SamIQueryServerRole2
0x18007AFD0: SampRecordSystemSchemaVerisonInRegistry
0x1800A84F0: api-ms-win-core-sysinfo-l1-1-0_NULL_THUNK_DATA
0x1800A8DD0: "__cdecl _xi_a" __xi_a
0x1800A8500: api-ms-win-core-sysinfo-l1-2-0_NULL_THUNK_DATA
0x180090430: SclRegLoadUnloadHive
0x1800BEA40: "%s: %u total %s certificate(s) f" ??_C@_1IC@OIGGOIMN@?$AA?$CF?$AAs?$AA?3?$AA?5?$AA?$CF?$AAu?$AA?5?$AAt?$AAo?$AAt?$AAa?$AAl?$AA?5?$AA?$CF?$AAs?$AA?5?$AAc?$AAe?$AAr?$AAt?$AAi?$AAf?$AAi?$AAc?$AAa?$AAt?$AAe?$AA?$CI?$AAs?$AA?$CJ?$AA?5?$AAf@
0x1800A8338: api-ms-win-core-processthreads-l1-1-1_NULL_THUNK_DATA
0x1800BDA28: "IsWinPEHost" ??_C@_1BI@KLGDHAFN@?$AAI?$AAs?$AAW?$AAi?$AAn?$AAP?$AAE?$AAH?$AAo?$AAs?$AAt?$AA?$AA@
0x1800A84E0: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x1800B3C98: "Reading %d extended attributes r" ??_C@_0DB@NMNIHHNN@Reading?5?$CFd?5extended?5attributes?5r@
0x1800B4F40: "Power users should not have the " ??_C@_0FL@PPEDMGAB@Power?5users?5should?5not?5have?5the?5@
0x1800A80F0: api-ms-win-core-debug-l1-1-0_NULL_THUNK_DATA
0x1800315FC: "__cdecl _scrt_dllmain_crt_thread_detach" __scrt_dllmain_crt_thread_detach
0x1800A8108: "__cdecl _imp_ResolveDelayLoadedAPI" __imp_ResolveDelayLoadedAPI
0x1800D3E80: "struct _RTL_RESOURCE g_EvalLock" ?g_EvalLock@@3U_RTL_RESOURCE@@A
0x1800B59F0: "SamrLookupNamesInDomain" ??_C@_0BI@HEANEBHO@SamrLookupNamesInDomain?$AA@
0x180097A08: "struct _LUNICODE_STRING __cdecl Windows::StringUtil::Impl::TrimPrefixIfPresent<struct _LUNICODE_STRING>(struct _LUNICODE_STRING const & __ptr64,struct _LUNICODE_STRING const & __ptr64)" ??$TrimPrefixIfPresent@U_LUNICODE_STRING@@@Impl@StringUtil@Windows@@YA?AU_LUNICODE_STRING@@AEBU3@0@Z
0x18009CEE4: EfiEnumerateBootEntries
0x180021608: SampAppendUnicodeString
0x1800B8D84: "JD" ??_C@_02OJKGKEPK@JD?$AA@
0x1800AA7E8: "RestrictRemoteSamAuditOnlyMode" ??_C@_1DO@DLOCCHJO@?$AAR?$AAe?$AAs?$AAt?$AAr?$AAi?$AAc?$AAt?$AAR?$AAe?$AAm?$AAo?$AAt?$AAe?$AAS?$AAa?$AAm?$AAA?$AAu?$AAd?$AAi?$AAt?$AAO?$AAn?$AAl?$AAy?$AAM?$AAo?$AAd?$AAe?$AA?$AA@
0x1800603D0: SamIDecodeClaimsBlobIntoClaimsSet
0x1800A8AC8: "__cdecl _imp_NtQuerySystemEnvironmentValueEx" __imp_NtQuerySystemEnvironmentValueEx
0x18006C2E0: SamIRandomizeStoredPasswordProcessRequest
0x18002E710: SamIQueryRealmList
0x1800A8998: "__cdecl _imp_RtlUpcaseUnicodeStringToOemString" __imp_RtlUpcaseUnicodeStringToOemString
0x18004FB30: SampAlRemoveAccountFromAllAliases
0x1800954D8: SclGetVolumeHandle
0x180099478: "long __cdecl RegLoadKeyWinPE(struct HKEY__ * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64)" ?RegLoadKeyWinPE@@YAJPEAUHKEY__@@PEBG11@Z
0x1800BAFB0: "Inspecting disk [%u]" ??_C@_0BF@MCBKFEPE@Inspecting?5disk?5?$FL?$CFu?$FN?$AA@
0x1800B9558: "SclpWdsNativeLibLogCallback" ??_C@_0BM@HNOKJHFE@SclpWdsNativeLibLogCallback?$AA@
0x1800BA5E8: "Updating boot entries to use new" ??_C@_0CI@MPNMOBED@Updating?5boot?5entries?5to?5use?5new@
0x180007810: SamDsExtAlloc
0x180032323: "__cdecl _imp_load_MesHandleFree" __imp_load_MesHandleFree
0x1800BC6C8: "(%lx): FSCTL_SD_GLOBAL_CHANGE fa" ??_C@_0CF@JBOJPCPE@?$CI?$CFlx?$CJ?3?5FSCTL_SD_GLOBAL_CHANGE?5fa@
0x1800AA298: "%s\%s%08x.etl" ??_C@_1BM@MGCILMDJ@?$AA?$CF?$AAs?$AA?2?$AA?$CF?$AAs?$AA?$CF?$AA0?$AA8?$AAx?$AA?4?$AAe?$AAt?$AAl?$AA?$AA@
0x1800B4648: "SChannel Authentication" ??_C@_1DA@NEJMCDPJ@?$AAS?$AAC?$AAh?$AAa?$AAn?$AAn?$AAe?$AAl?$AA?5?$AAA?$AAu?$AAt?$AAh?$AAe?$AAn?$AAt?$AAi?$AAc?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x180031534: "__cdecl _scrt_acquire_startup_lock" __scrt_acquire_startup_lock
0x180085C74: SampOpenDomainsForPromotePhase2
0x1800BCF00: "onecore\base\lstring\lunicode_st" ??_C@_0CJ@OHHDMDHM@onecore?2base?2lstring?2lunicode_st@
0x1800A8D20: "__cdecl _imp_RtlCheckTokenMembershipEx" __imp_RtlCheckTokenMembershipEx
0x1800AA6B8: "EnumerationCacheEntryLifetime" ??_C@_0BO@NMMLBDCO@EnumerationCacheEntryLifetime?$AA@
0x1800A8578: "__cdecl _imp__o_bsearch_s" __imp__o_bsearch_s
0x1800AFCF0: "InternetUserName" ??_C@_1CC@JGGANOLM@?$AAI?$AAn?$AAt?$AAe?$AAr?$AAn?$AAe?$AAt?$AAU?$AAs?$AAe?$AAr?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x1800536D8: InitializeSam
0x180066FE0: SamICreateKrbTgt
0x18009ADF0: "public: static void __cdecl CertificateUtil::FreeCertificates(struct _CERT_CONTEXT const * __ptr64 * __ptr64 const,unsigned long)" ?FreeCertificates@CertificateUtil@@SAXQEAPEBU_CERT_CONTEXT@@K@Z
0x1800DD080: "__cdecl _imp_DnsValidateName_W" __imp_DnsValidateName_W
0x1800A86E8: api-ms-win-security-base-l1-1-0_NULL_THUNK_DATA
0x1800BA270: "Unable to generate new account d" ??_C@_0CK@BOEEGMFC@Unable?5to?5generate?5new?5account?5d@
0x1800B6D00: "%08x-%04x-%04x-%02x%02x-%02x%02x" ??_C@_1GC@MIJCAPDC@?$AA?$CF?$AA0?$AA8?$AAx?$AA?9?$AA?$CF?$AA0?$AA4?$AAx?$AA?9?$AA?$CF?$AA0?$AA4?$AAx?$AA?9?$AA?$CF?$AA0?$AA2?$AAx?$AA?$CF?$AA0?$AA2?$AAx?$AA?9?$AA?$CF?$AA0?$AA2?$AAx?$AA?$CF?$AA0?$AA2?$AAx@
0x1800BC230: "DEFAULT" ??_C@_1BA@KDAEEGIF@?$AAD?$AAE?$AAF?$AAA?$AAU?$AAL?$AAT?$AA?$AA@
0x1800713FC: SampPerformWAUUpgrade
0x1800AF990: SampWhichFieldToSamAttr
0x18007AB6C: SampBuild18471CleanupKey
0x1800B5360: SampDefaultKrbtgtWarningString
0x1800BD3B0: "AllocateSessionProperties failed" ??_C@_0CB@ILHMPPIE@AllocateSessionProperties?5failed@
0x18000F5FC: SampCheckPasswordComplexityAdvanced
0x180084950: SampAllocateNextCurrentRidFromIndex
0x1800A8D18: "__cdecl _imp_RtlCopySecurityDescriptor" __imp_RtlCopySecurityDescriptor
0x180031EFA: "__cdecl o__crt_atexit" _o__crt_atexit
0x18000CF10: SamrValidatePassword
0x18007BAA0: SamISetMachinePassword
0x180029E28: RtlULongLongAdd
0x18005FEBC: UpdateAliasXReference
0x18007E380: SampGetUserAccountControlComputed
0x1800AA898: "HKEY_LOCAL_MACHINE" ??_C@_1CG@GFBEANJL@?$AAH?$AAK?$AAE?$AAY?$AA_?$AAL?$AAO?$AAC?$AAA?$AAL?$AA_?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?$AA@
0x1800B5AE8: "SamrOpenAlias" ??_C@_0O@PJIHJLMA@SamrOpenAlias?$AA@
0x1800B2EB0: SAMMSG_MAPPED_GROUP_MODIFICATION_FAILED
0x18001DE30: SamINT4UpgradeInProgress
0x1800963F0: SclCanonicalizeObjectPathByHandle
0x1800BAFC8: "Partition [%ws] found in disk [%" ??_C@_0CE@JFMKINFF@Partition?5?$FL?$CFws?$FN?5found?5in?5disk?5?$FL?$CF@
0x18001D4D4: SampFreeAttributeBuffer
0x1800A8D38: "__cdecl _imp_NtOpenThreadToken" __imp_NtOpenThreadToken
0x1800B5DC8: WPP_bd059eed2561335b6b275a4df8275dcd_Traceguids
0x1800BC0F8: "(%lx): Failed to retarget repars" ??_C@_0DM@BGHIOIJL@?$CI?$CFlx?$CJ?3?5Failed?5to?5retarget?5repars@
0x1800D34C4: SampFlushThreadMaxWaitSeconds
0x1800A8C50: "__cdecl _imp_RtlClearAllBits" __imp_RtlClearAllBits
0x18008E850: SclEtwWriteGenericMessage
0x1800793FC: SampChangeKeys
0x180083104: WPP_SF_Di
0x1800D3750: SampNameDomains
0x1800DD240: "__cdecl _imp_RegSaveKeyW" __imp_RegSaveKeyW
0x180098F74: RpcpBindRpc
0x18001FE74: SampAlCreateMemberAliasList
0x18000C0F4: SampAccessCheckForGenericOperation
0x1800B44D0: "Restricted" ??_C@_1BG@HGEFIHHK@?$AAR?$AAe?$AAs?$AAt?$AAr?$AAi?$AAc?$AAt?$AAe?$AAd?$AA?$AA@
0x180001510: SampActiveEnumerationContextTableFree
0x180031EE2: "__cdecl o__cexit" _o__cexit
0x180084008: SampConvertUserParmsToDsAttrBlock
0x18001D9FC: WPP_SF_DD
0x180072850: WPP_SF_dD
0x180086874: WPP_SF_Dd
0x1800BA8A0: "SclRegDeleteKeyRecursive" ??_C@_0BJ@HOMLFHIC@SclRegDeleteKeyRecursive?$AA@
0x180083058: WPP_SF_DZ
0x1800D0E10: SampDomainUpdate_WinBLUEMP_TO_WinThresholdM2A_Parameter
0x1800B8CC8: "<unknown>" ??_C@_1BE@ELICABCK@?$AA?$DM?$AAu?$AAn?$AAk?$AAn?$AAo?$AAw?$AAn?$AA?$DO?$AA?$AA@
0x1800D0DB0: SampDomainUpdate_WinBLUEMP_TO_WinThresholdM2B_Parameter
0x1800D2F80: BackupLogFileName
0x1800A8880: "__cdecl _imp_RtlxUnicodeStringToOemSize" __imp_RtlxUnicodeStringToOemSize
0x180074FE8: SampExtThreadStateRestoreDs
0x1800DD2D8: "__cdecl _imp_CloseServiceHandle" __imp_CloseServiceHandle
0x1800A8310: "__cdecl _imp_SetProcessShutdownParameters" __imp_SetProcessShutdownParameters
0x180077250: SampGrantChangePasswordIfForcePasswordEnabled
0x180015ED0: MIDL_user_allocate_safeadd
0x1800B4D40: "LH-IDS1 to LH-IDS2" ??_C@_0BD@KPNMFFME@LH?9IDS1?5to?5LH?9IDS2?$AA@
0x18001DD10: SamIFree_SAMPR_DOMAIN_INFO_BUFFER
0x1800DD148: "__cdecl _imp_RpcBindingServerFromClient" __imp_RpcBindingServerFromClient
0x1800BD4D0: "%s: "%s" should not be null." ??_C@_1DK@HFLBNKCG@?$AA?$CF?$AAs?$AA?3?$AA?5?$AA?$CC?$AA?$CF?$AAs?$AA?$CC?$AA?5?$AAs?$AAh?$AAo?$AAu?$AAl?$AAd?$AA?5?$AAn?$AAo?$AAt?$AA?5?$AAb?$AAe?$AA?5?$AAn?$AAu?$AAl?$AAl?$AA?4?$AA?$AA@
0x1800D3BA0: SampComputerObjectDsName
0x1800DD300: "__cdecl _imp_CDGenerateRandomBits" __imp_CDGenerateRandomBits
0x1800B38F0: AccountNameEncodingTable
0x180077AB0: SamrQuerySecurityObject
0x180031F36: "__cdecl seh_filter_dll" _seh_filter_dll
0x1800239B0: SampSetExtParameters
0x1800DD320: "__cdecl _imp_SetupOpenLog" __imp_SetupOpenLog
0x18009A000: McGenEventWrite
0x180050F10: SamIDecodeClaimsBlobToAuthz
0x1800BCDF8: "Windows::StringUtil::Rtl::SubStr" ??_C@_0CP@LMCEKLIL@Windows?3?3StringUtil?3?3Rtl?3?3SubStr@
0x180097980: "struct _LUNICODE_STRING __cdecl Windows::StringUtil::TrimLongPathPrefix<struct _LUNICODE_STRING>(struct _LUNICODE_STRING const & __ptr64)" ??$TrimLongPathPrefix@U_LUNICODE_STRING@@@StringUtil@Windows@@YA?AU_LUNICODE_STRING@@AEBU2@@Z
0x1800D0170: WPP_GLOBAL_Control
0x1800147D0: SamIAddDSNameToAlias
0x1800D3BDC: SamLockTotalAquisitions
0x1800A85C0: "__cdecl _imp__execute_onexit_table" __imp__execute_onexit_table
0x180088B1C: SampFreeTlsIndex
0x1800BE3E0: "pcszOidValues" ??_C@_1BM@NMDLMKAE@?$AAp?$AAc?$AAs?$AAz?$AAO?$AAi?$AAd?$AAV?$AAa?$AAl?$AAu?$AAe?$AAs?$AA?$AA@
0x180083500: SamIGetConfigurationOidList
0x18000DB50: SampInitializeUserInfo
0x18001C7C0: SampUpgradeUserParmsActual
0x1800AB120: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x1800CBED0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0
0x180029444: KEGenerateHashWithSHA256
0x1800CBF84: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-1" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-1
0x1800BD178: "Not initialized" ??_C@_1CA@LHINCELJ@?$AAN?$AAo?$AAt?$AA?5?$AAi?$AAn?$AAi?$AAt?$AAi?$AAa?$AAl?$AAi?$AAz?$AAe?$AAd?$AA?$AA@
0x1800A8290: api-ms-win-core-memory-l1-1-0_NULL_THUNK_DATA
0x1800D3530: SampServerObjectName
0x1800B6930: WPP_2f3b47997fd83e5029cbfd8243936215_Traceguids
0x1800A8840: "__cdecl _imp_NtQueryKey" __imp_NtQueryKey
0x180074A44: SampExtRenameWellKnownSecurityPrincipalsDs
0x18001C044: SampAddDisplayAccount
0x180014768: SampGetEncryptionKeyType
0x18001D950: SampExtExistsDsTransactionDs
0x1800321A1: "__cdecl _imp_load_I_NetLogonSendToSamOnDc" __imp_load_I_NetLogonSendToSamOnDc
0x1800A9848: "Members" ??_C@_1BA@PIIKFFIB@?$AAM?$AAe?$AAm?$AAb?$AAe?$AAr?$AAs?$AA?$AA@
0x1800C8058: "__cdecl _DELAY_IMPORT_DESCRIPTOR_cryptdll_dll" __DELAY_IMPORT_DESCRIPTOR_cryptdll_dll
0x180050DD0: SampSetSidArrayAttribute
0x18001D3E0: WPP_SF_D
0x18001D3E0: WPP_SF_d
0x1800942C8: SclLinkProcessVolume
0x1800975A0: "long __cdecl Windows::StringUtil::Rtl::AppendInteger<class Windows::AutoOperatorAmpersandHelper<struct _LUNICODE_STRING,class Detail::StaticStringAndBufferImpl<struct _LUNICODE_STRING,255> >,unsigned __int64>(unsigned long,unsigned __int64,class Windows::AutoOperatorAmpersandHelper<struct _LUNICODE_STRING,class Detail::StaticStringAndBufferImpl<struct _LUNICODE_STRING,255> >)" ??$AppendInteger@V?$AutoOperatorAmpersandHelper@U_LUNICODE_STRING@@V?$StaticStringAndBufferImpl@U_LUNICODE_STRING@@$0PP@@Detail@@@Windows@@_K@Rtl@StringUtil@Windows@@YAJK_KV?$AutoOperatorAmpersandHelper@U_LUNICODE_STRING@@V?$StaticStringAndBufferImpl@U_LUNICODE_STRING@@$0PP@@Detail@@@2@@Z
0x1800A8B08: "__cdecl _imp_NtQueryVolumeInformationFile" __imp_NtQueryVolumeInformationFile
0x1800B64D8: "UserId: 0x%x Setting BadPassword" ??_C@_0CN@LOGGAOEF@UserId?3?50x?$CFx?5Setting?5BadPassword@
0x180031388: "__cdecl _report_rangecheckfailure" __report_rangecheckfailure
0x180066630: SamrSetInformationDomain
0x180019420: SampSetExtendedAttributeAccess
0x18007B4CC: SampUpgradeSupplementalCredsEncryption
0x1800AB488: "__cdecl pRawDllMain" _pRawDllMain
0x18000D788: SampValidateCheckPasswordRestrictions
0x180072570: SampStoreAppliedComponentUpdatesOnDomain
0x1800B4E88: "WinThreshold-M2B to WinThreshold" ??_C@_0CE@IIJGCFPF@WinThreshold?9M2B?5to?5WinThreshold@
0x180074080: SampExtExamineSidDs
0x1800A8598: "__cdecl _imp_towupper" __imp_towupper
0x18006E680: SamIDemoteUndo
0x1800DD0E8: "__cdecl _imp_I_RpcExceptionFilter" __imp_I_RpcExceptionFilter
0x1800BF280: "CertificateUtil::GuidStringFromB" ??_C@_1FC@BIILLLEC@?$AAC?$AAe?$AAr?$AAt?$AAi?$AAf?$AAi?$AAc?$AAa?$AAt?$AAe?$AAU?$AAt?$AAi?$AAl?$AA?3?$AA?3?$AAG?$AAu?$AAi?$AAd?$AAS?$AAt?$AAr?$AAi?$AAn?$AAg?$AAF?$AAr?$AAo?$AAm?$AAB@
0x1800D35A0: SampIUserSid
0x1800D3900: SampFixedAttributeName
0x18000B150: SampGetSidArrayAttribute
0x1800AAC20: Symbol_SamDatabaseChangeEvent
0x1800BB760: "\AppData\Local\Microsoft\Windows" ??_C@_1FM@DDDGOGOJ@?$AA?2?$AAA?$AAp?$AAp?$AAD?$AAa?$AAt?$AAa?$AA?2?$AAL?$AAo?$AAc?$AAa?$AAl?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs@
0x1800DD180: "__cdecl _imp_RpcRevertToSelfEx" __imp_RpcRevertToSelfEx
0x18000A300: SampMaybeReleaseReadLock
0x1800CBFD4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-service-management-l2-1-0" __IMPORT_DESCRIPTOR_api-ms-win-service-management-l2-1-0
0x1800B34A0: "Failed to load localized resourc" ??_C@_0FC@KBBDMPOC@Failed?5to?5load?5localized?5resourc@
0x18002F418: SamITeardownAutoLoggerSession
0x1800A98D8: "\Registry\Machine\SAM\SAM" ??_C@_1DE@PHKABCAI@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAA?$AAM?$AA?2?$AAS?$AAA?$AAM?$AA?$AA@
0x1800A8888: "__cdecl _imp_RtlFreeSid" __imp_RtlFreeSid
0x1800BCF60: "cch <= (((((SIZE_T)~((SIZE_T)0))" ??_C@_0GD@IELHNMHL@cch?5?$DM?$DN?5?$CI?$CI?$CI?$CI?$CISIZE_T?$CJ?$HO?$CI?$CISIZE_T?$CJ0?$CJ?$CJ@
0x1800B9C20: "Number of $Secure security descr" ??_C@_1GC@EOGCJLBO@?$AAN?$AAu?$AAm?$AAb?$AAe?$AAr?$AA?5?$AAo?$AAf?$AA?5?$AA$?$AAS?$AAe?$AAc?$AAu?$AAr?$AAe?$AA?5?$AAs?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?5?$AAd?$AAe?$AAs?$AAc?$AAr@
0x1800BA698: "Boot%04x" ??_C@_1BC@HAMKBGJJ@?$AAB?$AAo?$AAo?$AAt?$AA?$CF?$AA0?$AA4?$AAx?$AA?$AA@
0x180027208: "public: unsigned long __cdecl CEasPolicySettings::FindPolicySetting<unsigned long>(void * __ptr64 const,enum EEasSettingId) __ptr64" ??$FindPolicySetting@K@CEasPolicySettings@@QEAAKQEAXW4EEasSettingId@@@Z
0x1800957BC: SclProcessStringAllocating
0x1800325BB: "__cdecl _imp_load_RegSaveKeyW" __imp_load_RegSaveKeyW
0x1800D3F88: SampRODCCache
0x1800A2F60: SampObjectExtendedAttributesProperties
0x180069100: SamIIsExtendedSidMode
0x180061DC0: SamIRetrievePrimaryCredentials
0x1800B3E30: "RID: " ??_C@_05PCJGEGBG@RID?3?5?$AA@
0x180001740: SampAuditAnyEvent
0x180068A2C: SampRegEnforceConsistencyInternetSID
0x180032ACA: "__cdecl _tailMerge_api_ms_win_service_winsvc_l1_1_0_dll" __tailMerge_api_ms_win_service_winsvc_l1_1_0_dll
0x1800B2C90: "ncacn_ip_tcp" ??_C@_1BK@BPGFLIHL@?$AAn?$AAc?$AAa?$AAc?$AAn?$AA_?$AAi?$AAp?$AA_?$AAt?$AAc?$AAp?$AA?$AA@
0x1800AB5E0: "__cdecl _sz_api_ms_win_service_management_l1_1_0_dll" __sz_api_ms_win_service_management_l1_1_0_dll
0x180031C8C: "__cdecl _isa_available_init" __isa_available_init
0x18004F0D0: SamrRemoveMultipleMembersFromAlias
0x1800DD270: api-ms-win-security-lsapolicy-l1-1-0_NULL_THUNK_DATA_DLA
0x1800BB720: "PROFILEIMAGEPATH" ??_C@_1CC@NHONCKFM@?$AAP?$AAR?$AAO?$AAF?$AAI?$AAL?$AAE?$AAI?$AAM?$AAA?$AAG?$AAE?$AAP?$AAA?$AAT?$AAH?$AA?$AA@
0x1800BA778: "(%lx): Failed to create boot ent" ??_C@_0DB@MKIEFAAF@?$CI?$CFlx?$CJ?3?5Failed?5to?5create?5boot?5ent@
0x180032F14: "void __cdecl operator delete(void * __ptr64)" ??3@YAXPEAX@Z
0x1800C8D88: api-ms-win-security-lsapolicy-l1-1-0_NULL_THUNK_DATA_DLB
0x1800AFD78: "FailedInterLogonCount" ??_C@_1CM@CCMKPGAJ@?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AAI?$AAn?$AAt?$AAe?$AAr?$AAL?$AAo?$AAg?$AAo?$AAn?$AAC?$AAo?$AAu?$AAn?$AAt?$AA?$AA@
0x180078470: SampCreateUserToken
0x1800A8D68: "__cdecl _imp_RtlSetSecurityObject" __imp_RtlSetSecurityObject
0x18009931C: "__cdecl TlgDefineProvider_annotation__Tlgmtaum_hTelemetryAssertProv" _TlgDefineProvider_annotation__Tlgmtaum_hTelemetryAssertProv
0x1800D08B0: SampDomainUpdate_WIN8RPM_TO_Win8BETA_Parameter
0x1800D38A8: SampImmediatelyDeltaTime
0x1800A8CB8: "__cdecl _imp_RtlInitializeCriticalSectionAndSpinCount" __imp_RtlInitializeCriticalSectionAndSpinCount
0x1800B46A8: "Well-Known-Security-Id-System" ??_C@_1DM@FELDEONA@?$AAW?$AAe?$AAl?$AAl?$AA?9?$AAK?$AAn?$AAo?$AAw?$AAn?$AA?9?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?9?$AAI?$AAd?$AA?9?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?$AA@
0x180031E4C: "__cdecl get_startup_argv_mode" _get_startup_argv_mode
0x18001CAA0: SampFreeAttrBlock
0x1800C8488: api-ms-win-security-lsapolicy-l1-1-0_NULL_THUNK_DATA_DLN
0x1800BAA20: "(%lx): Failed to enumerate src k" ??_C@_0CF@JCEPDKCK@?$CI?$CFlx?$CJ?3?5Failed?5to?5enumerate?5src?5k@
0x1800A8908: "__cdecl _imp_RtlAcquireResourceShared" __imp_RtlAcquireResourceShared
0x1800BA2F8: "SclExtractSidSubString" ??_C@_0BH@EOFNICNC@SclExtractSidSubString?$AA@
0x1800B4D58: "LH-IDS2 to LH-BETA2" ??_C@_0BE@JBHAJMJF@LH?9IDS2?5to?5LH?9BETA2?$AA@
0x180087F44: SamConnect
0x180084CA4: SampChangeAccountOperatorAccessToMember
0x1800A89B8: "__cdecl _imp_RtlCompareUnicodeString" __imp_RtlCompareUnicodeString
0x1800CC038: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-l1-1-0
0x1800BFEB8: "__cdecl _rtc_izz" __rtc_izz
0x18000D850: SampCreateDefaultUPN
0x180090798: SclRegSetValue_UStr
0x18001DDD0: SampAlFreeMemberAliasList
0x1800DD1D8: "__cdecl _imp_MesEncodeDynBufferHandleCreate" __imp_MesEncodeDynBufferHandleCreate
0x180032262: "__cdecl _imp_load_ConvertSidToStringSidW" __imp_load_ConvertSidToStringSidW
0x1800A8C58: "__cdecl _imp_NtQueryValueKey" __imp_NtQueryValueKey
0x1800A8470: "__cdecl _imp_DeleteCriticalSection" __imp_DeleteCriticalSection
0x1800BA598: "SclpGetDiskLayout" ??_C@_0BC@IPMJHBEM@SclpGetDiskLayout?$AA@
0x1800DD250: "__cdecl _imp_LsaFreeMemory" __imp_LsaFreeMemory
0x18000CB40: SampGetDomainSidListForSam
0x1800A8970: "__cdecl _imp_RtlCreateUnicodeString" __imp_RtlCreateUnicodeString
0x180022630: SampDsIsRunning
0x180031220: "__cdecl _security_check_cookie" __security_check_cookie
0x180065C80: SamrCreateUser2InDomain
0x1800D3F4D: SampAccountLockoutTestMode
0x1800ABC10: "<NULL>" ??_C@_1O@DPFEOIGE@?$AA?$DM?$AAN?$AAU?$AAL?$AAL?$AA?$DO?$AA?$AA@
0x18001FCC4: SampAlCreateMemberDomain
0x180019960: SampNetLogonNotificationRequired
0x1800D35F0: FlushThreadCreated
0x18002EED0: "public: void __cdecl SP<unsigned char,class SP_HLOCAL<unsigned char> >::Reset(void) __ptr64" ?Reset@?$SP@EV?$SP_HLOCAL@E@@@@QEAAXXZ
0x1800BCBE8: "Not-null check failed: FullOffli" ??_C@_0CP@HGLINANA@Not?9null?5check?5failed?3?5FullOffli@
0x1800B4590: "Other Organization" ??_C@_1CG@HNJGNMNM@?$AAO?$AAt?$AAh?$AAe?$AAr?$AA?5?$AAO?$AAr?$AAg?$AAa?$AAn?$AAi?$AAz?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x1800A8DC8: "__cdecl _xc_z" __xc_z
0x1800D5278: EfipSetDriverEntryOrder
0x1800B9628: SclEvent_ExecuteUpgHives_Stop
0x18003241A: "__cdecl _imp_load_ConvertSidToStringSidA" __imp_load_ConvertSidToStringSidA
0x18001CEF0: SamIImpersonateNullSession
0x1800CBE58: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0
0x1800A8318: api-ms-win-core-processthreads-l1-1-0_NULL_THUNK_DATA
0x180016284: SampConvertFixedLengthAttributesToAttrBlock
0x180084900: SamIValidateAccountName
0x1800B2950: SampSetInformationUserGuid
0x180061EE4: SampConvertCredentialsToAttr
0x1800A8238: "__cdecl _imp_GetProcAddress" __imp_GetProcAddress
0x1800B3798: "FALSE" ??_C@_1M@HCOOECOK@?$AAF?$AAA?$AAL?$AAS?$AAE?$AA?$AA@
0x1800AA500: SAMMSG_RESTRICT_REMOTE_SAM_DEFAULT_SD
0x1800514DC: AppendAliasDomainNameToUnicodeString
0x18002E4D4: "private: void __cdecl CEasPolicySettings::InitEasPolicy(void) __ptr64" ?InitEasPolicy@CEasPolicySettings@@AEAAXXZ
0x1800AFB20: "SupplementalCredentials" ??_C@_1DA@CAMBGEFI@?$AAS?$AAu?$AAp?$AAp?$AAl?$AAe?$AAm?$AAe?$AAn?$AAt?$AAa?$AAl?$AAC?$AAr?$AAe?$AAd?$AAe?$AAn?$AAt?$AAi?$AAa?$AAl?$AAs?$AA?$AA@
0x1800D3BD4: SamCumulativeWaitTime
0x1800BBF38: "SclLinkProcessVolume" ??_C@_0BF@BDELFJLK@SclLinkProcessVolume?$AA@
0x1800AFC08: "CachedLogonInfo" ??_C@_1CA@MEFJCFFJ@?$AAC?$AAa?$AAc?$AAh?$AAe?$AAd?$AAL?$AAo?$AAg?$AAo?$AAn?$AAI?$AAn?$AAf?$AAo?$AA?$AA@
0x180011450: SampCreateSupplementalCredentialsHelper
0x18008EB10: RtlUIntToUShort
0x1800BBC58: "Error opening excluded key [%ws]" ??_C@_0CL@BMOMNHMG@Error?5opening?5excluded?5key?5?$FL?$CFws?$FN@
0x1800D1C50: g_header_init_WilInitialize_ResultMacros_DesktopOrSystem
0x1800BC528: "Volume [%ws] is not an NTFS volu" ??_C@_0CE@MPGAEDBE@Volume?5?$FL?$CFws?$FN?5is?5not?5an?5NTFS?5volu@
0x1800D3D34: SampActiveThreadCount
0x1800A8B68: "__cdecl _imp_RtlFreeAnsiString" __imp_RtlFreeAnsiString
0x1800A8BF8: "__cdecl _imp_RtlMakeSelfRelativeSD" __imp_RtlMakeSelfRelativeSD
0x1800BB090: "SclpGrowPartitionInternal" ??_C@_0BK@OPMHCONE@SclpGrowPartitionInternal?$AA@
0x180017C80: SampRegObjToDsObj
0x180001520: SampFreeAttrValBlock
0x180032F78: "__cdecl _vcrt_uninitialize_critical" __vcrt_uninitialize_critical
0x1800D3B99: SampDsInitializationFailed
0x1800B8E00: "01234567890123456789012345678901" ??_C@_0CJ@CCFLKPHK@01234567890123456789012345678901@
0x1800245C0: SampRtlWellKnownPrivilegeCheck
0x1800BF710: "NtSetDriverEntryOrder" ??_C@_0BG@MCDNBMFA@NtSetDriverEntryOrder?$AA@
0x180071A40: SampRegistryDelnode
0x1800D3FE8: SampSyskeysAreInconsistent
0x1800B2F00: SAMMSG_DATABASE_DIR_NOT_DELETED
0x1800D3AF8: SampSuccessAccountAuditingEnabled
0x180075F7C: WppCleanupUm
0x1800C8118: "__cdecl _DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_systemfunctions_l1_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_systemfunctions_l1_1_0_dll
0x18006EBF0: SamIUnLoadDownlevelDatabase
0x1800BE0A0: "%s: The returned join certificat" ??_C@_1HM@ODDLFDJN@?$AA?$CF?$AAs?$AA?3?$AA?5?$AAT?$AAh?$AAe?$AA?5?$AAr?$AAe?$AAt?$AAu?$AAr?$AAn?$AAe?$AAd?$AA?5?$AAj?$AAo?$AAi?$AAn?$AA?5?$AAc?$AAe?$AAr?$AAt?$AAi?$AAf?$AAi?$AAc?$AAa?$AAt@
0x1800B2CB0: "ncacn_np" ??_C@_1BC@CCHMBIKG@?$AAn?$AAc?$AAa?$AAc?$AAn?$AA_?$AAn?$AAp?$AA?$AA@
0x1800BC190: "(%lx): Failed to process reparse" ??_C@_0DL@GEPOEIGG@?$CI?$CFlx?$CJ?3?5Failed?5to?5process?5reparse@
0x1800C8158: "__cdecl _DELAY_IMPORT_DESCRIPTOR_api_ms_win_service_management_l1_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_api_ms_win_service_management_l1_1_0_dll
0x18001BBFC: SampCreateDisplayInformation
0x1800A98B0: WPP_442b23fcec4a37ff152c1f2254f2051e_Traceguids
0x18008FA10: SclRegDeleteKey
0x180069B00: SampRemoveUserFromGroup
0x1800D3D20: EfipHaveLock
0x18001BDE0: RtlEnumerateGenericTable2
0x1800BCF30: "RtlInitLUnicodeStringFromNullTer" ??_C@_0CO@IGKAHGPG@RtlInitLUnicodeStringFromNullTer@
0x1800B1F58: "SamConnectedAccountsExist" ??_C@_0BK@GAHKAEHL@SamConnectedAccountsExist?$AA@
0x18006EDCC: SampAddAnonymousOrAuthUsersToPreW2KCompAlias
0x180066AE0: WPP_SF_qDd
0x180066AE0: WPP_SF_qDD
0x1800D0550: UserExtendedAttributeProperties
0x1800D3730: SampBackSlash
0x18006C50C: SamIRandomizeStoredPasswordValidationChecks
0x1800AB128: "rpcss" ??_C@_1M@BAEKHECG@?$AAr?$AAp?$AAc?$AAs?$AAs?$AA?$AA@
0x1800D3AE0: SampKey
0x1800A9878: "Users" ??_C@_1M@JKOHCHHA@?$AAU?$AAs?$AAe?$AAr?$AAs?$AA?$AA@
0x18003239B: "__cdecl _tailMerge_cryptdll_dll" __tailMerge_cryptdll_dll
0x1800A84A8: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x1800ABCA0: VerboseDebugEvent
0x18007A6C0: SamrGetBootKeyInformation
0x1800AB870: WPP_9f7ee1dac4353a5c4d86ede921248b0b_Traceguids
0x1800A88E0: "__cdecl _imp_NtPrivilegedServiceAuditAlarm" __imp_NtPrivilegedServiceAuditAlarm
0x1800B4378: "Everyone" ??_C@_1BC@LHPKHALJ@?$AAE?$AAv?$AAe?$AAr?$AAy?$AAo?$AAn?$AAe?$AA?$AA@
0x1800B5180: "Sam Domain Log Update for %s fai" ??_C@_0DE@OKOBPLAA@Sam?5Domain?5Log?5Update?5for?5?$CFs?5fai@
0x18001D1C8: SampCopySid
0x18002F1A8: SampApplyDefaultSyskey
0x18009AE3C: "public: static long __cdecl CertificateUtil::GetCertificateThumbprint(struct _CERT_CONTEXT const * __ptr64,unsigned short * __ptr64 * __ptr64)" ?GetCertificateThumbprint@CertificateUtil@@SAJPEBU_CERT_CONTEXT@@PEAPEAG@Z
0x1800B3BD8: "Setting %wZ attribute resulted i" ??_C@_0CI@LPPDFHEC@Setting?5?$CFwZ?5attribute?5resulted?5i@
0x1800BC090: "(%lx): Failed to validate if we " ??_C@_0EA@CGMGNHON@?$CI?$CFlx?$CJ?3?5Failed?5to?5validate?5if?5we?5@
0x1800BB1F0: "\\.\MountPointManager" ??_C@_1CM@HDGAIJEN@?$AA?2?$AA?2?$AA?4?$AA?2?$AAM?$AAo?$AAu?$AAn?$AAt?$AAP?$AAo?$AAi?$AAn?$AAt?$AAM?$AAa?$AAn?$AAa?$AAg?$AAe?$AAr?$AA?$AA@
0x1800BD9B0: "HKEY_LOCAL_MACHINE\SYSTEM\Curren" ??_C@_1HG@MKFLDOLC@?$AAH?$AAK?$AAE?$AAY?$AA_?$AAL?$AAO?$AAC?$AAA?$AAL?$AA_?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn@
0x1800B5400: ", " ??_C@_15JOGBDECP@?$AA?0?$AA?5?$AA?$AA@
0x180060100: SamIConvertSecurityAttributesToClaimsBlob
0x1800C8DA8: api-ms-win-core-registry-l2-1-0_NULL_THUNK_DATA_DLB
0x1800AB7A0: "SampCheckForcePasswordReset fail" ??_C@_0EN@IMKDGCLN@SampCheckForcePasswordReset?5fail@
0x1800D3B20: AdministratorContextTableElement
0x18003029C: SampProcessPerComponentWellKnownAccountUpdatesForDomain
0x180066D6C: WPP_SF_qZD
0x1800010E0: SamIFreeSidArray
0x1800AADB0: "Kernel-ProductInfo" ??_C@_1CG@MNIOEOCG@?$AAK?$AAe?$AAr?$AAn?$AAe?$AAl?$AA?9?$AAP?$AAr?$AAo?$AAd?$AAu?$AAc?$AAt?$AAI?$AAn?$AAf?$AAo?$AA?$AA@
0x1800B58D0: "SamrQueryInformationDomain" ??_C@_0BL@LMELJOEH@SamrQueryInformationDomain?$AA@
0x1800D35F8: SampInteractiveSid
0x1800B31BC: "b" ??_C@_13EPJEBPGL@?$AAb?$AA?$AA@
0x1800A8900: "__cdecl _imp_RtlReleaseResource" __imp_RtlReleaseResource
0x18007A750: SamrSetBootKeyInformation
0x1800AFB50: "AccountFlagsEx" ??_C@_1BO@NMFKMNLK@?$AAA?$AAc?$AAc?$AAo?$AAu?$AAn?$AAt?$AAF?$AAl?$AAa?$AAg?$AAs?$AAE?$AAx?$AA?$AA@
0x180072348: SampSetWellKnownAccountProperties
0x1800B4978: "\system32\config\SAM.UPG" ??_C@_1DC@COMGPHPG@?$AA?2?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAc?$AAo?$AAn?$AAf?$AAi?$AAg?$AA?2?$AAS?$AAA?$AAM?$AA?4?$AAU?$AAP?$AAG?$AA?$AA@
0x18009CBE0: EfiAddBootEntry
0x1800299F0: SampRetrieveUserV1aFixed
0x180099E78: "public: static long __cdecl Logger::TraceVerbose(unsigned short const * __ptr64,...)" ?TraceVerbose@Logger@@SAJPEBGZZ
0x1800B9EE0: "Number of reparse points updated" ??_C@_1EC@CCFMBCAG@?$AAN?$AAu?$AAm?$AAb?$AAe?$AAr?$AA?5?$AAo?$AAf?$AA?5?$AAr?$AAe?$AAp?$AAa?$AAr?$AAs?$AAe?$AA?5?$AAp?$AAo?$AAi?$AAn?$AAt?$AAs?$AA?5?$AAu?$AAp?$AAd?$AAa?$AAt?$AAe?$AAd@
0x1800A81F0: "__cdecl _imp_LocalAlloc" __imp_LocalAlloc
0x1800315CC: "__cdecl _scrt_dllmain_crt_thread_attach" __scrt_dllmain_crt_thread_attach
0x1800B5F1C: "dd" ??_C@_15GJBMHDEE@?$AAd?$AAd?$AA?$AA@
0x1800A87D0: "__cdecl _imp_EtwGetTraceEnableLevel" __imp_EtwGetTraceEnableLevel
0x1800B96E8: SclEvent_ProcessRegistryHive_Stop
0x180031F36: "__cdecl o__seh_filter_dll" _o__seh_filter_dll
0x18001C700: SampCheckGroupTypeBits
0x1800A8710: api-ms-win-security-lsalookup-l1-1-1_NULL_THUNK_DATA
0x180098900: "long __cdecl _GetBuiltInProvidersPolicies(unsigned long,unsigned long,struct _tagEASPolicy * __ptr64,unsigned long * __ptr64,struct _tagEASPolicy * __ptr64 * __ptr64)" ?_GetBuiltInProvidersPolicies@@YAJKKPEAU_tagEASPolicy@@PEAKPEAPEAU1@@Z
0x1800A80F8: "__cdecl _imp_DelayLoadFailureHook" __imp_DelayLoadFailureHook
0x1800A9858: "Aliases" ??_C@_1BA@LNMIPDPK@?$AAA?$AAl?$AAi?$AAa?$AAs?$AAe?$AAs?$AA?$AA@
0x180031EA6: "__cdecl _std_type_info_destroy_list" __std_type_info_destroy_list
0x18000A720: SampReadExtendedAttributes
0x1800AB250: "Lsa" ??_C@_17OKMDBIDN@?$AAL?$AAs?$AAa?$AA?$AA@
0x1800B62A0: " User account control: Old: 0x%x" ??_C@_0CM@FLNNBDPF@?7User?5account?5control?3?5Old?3?50x?$CFx@
0x1800D3E00: SampDefaultSecurityDescriptor
0x1800AA5B0: "Names" ??_C@_1M@JAABGMB@?$AAN?$AAa?$AAm?$AAe?$AAs?$AA?$AA@
0x18007FF40: SamrDeleteUser
0x1800BA470: "SclpGptInitGuids" ??_C@_0BB@HHPPGFNB@SclpGptInitGuids?$AA@
0x180083640: SamIPurgeSecrets
0x1800A8980: "__cdecl _imp_EtwLogTraceEvent" __imp_EtwLogTraceEvent
0x1800D2BB0: "__cdecl _hmod__api_ms_win_core_registry_l2_1_0_dll" __hmod__api_ms_win_core_registry_l2_1_0_dll
0x1800A81D0: "__cdecl _imp_GetProcessHeap" __imp_GetProcessHeap
0x1800BC9D8: "<not present>" ??_C@_1BM@FGGHPLKH@?$AA?$DM?$AAn?$AAo?$AAt?$AA?5?$AAp?$AAr?$AAe?$AAs?$AAe?$AAn?$AAt?$AA?$DO?$AA?$AA@
0x18004F500: WPP_SF_qDDd
0x180066B40: WPP_SF_qDDD
0x180069124: WPP_SF_qDdD
0x1800AB640: "__cdecl _sz_DSPARSE_dll" __sz_DSPARSE_dll
0x1800332A0: "__cdecl _chkstk" __chkstk
0x1800D3800: SampContextListCritSect
0x1800BC640: "Processing volume [%ws]..." ??_C@_0BL@IGEIKGKL@Processing?5volume?5?$FL?$CFws?$FN?4?4?4?$AA@
0x1800D2D60: ObjChgNotifEventListResource
0x1800D3B9C: SampLoggedAtLeastOneSDDLEvent
0x18001C2D0: SampGetDownLevelDomainControllersPresent
0x180075020: SampExtThreadStateSaveDs
0x1800B6EA0: "EAS password policy is disabled " ??_C@_0CB@OIAPLAC@EAS?5password?5policy?5is?5disabled?6@
0x180066C28: WPP_SF_qDDL
0x1800677A4: SampAppendVarLengthAttributeToBuffer
0x1800B9210: "(%lx): Failed to process registr" ??_C@_0CC@PMBOPDHJ@?$CI?$CFlx?$CJ?3?5Failed?5to?5process?5registr@
0x1800D3F40: Microsoft_Windows_User_Device_RegistrationEnableBits
0x1800703EC: SampClearDirectory
0x1800C8220: CRYPTBASE_NULL_THUNK_DATA_DLN
0x18003054C: SampOpenDomainsForUpdate
0x1800D51F4: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUohgirmtUfnlwvUlyquivUznwGEUhgwrmxOlyq@lstring" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUohgirmtUfnlwvUlyquivUznwGEUhgwrmxOlyq@lstring
0x1800A8190: "__cdecl _imp_FindNextFileW" __imp_FindNextFileW
0x18000E978: SampAuditGroupChange
0x18007E2B0: SampGetRequestedAttributesForUser
0x1800B3360: "\Groups\Names" ??_C@_1BM@KFIFGNMD@?$AA?2?$AAG?$AAr?$AAo?$AAu?$AAp?$AAs?$AA?2?$AAN?$AAa?$AAm?$AAe?$AAs?$AA?$AA@
0x180071140: SampGetCurrentAdminPassword
0x18000A9A4: SampValidateDomainLockoutInformation
0x1800A8A58: "__cdecl _imp_RtlInitAnsiString" __imp_RtlInitAnsiString
0x18001C858: SampInitSearchParametersFromEnumerationCache
0x1800B6380: "UserId: 0x%x LastBadPasswordTime" ??_C@_0ED@PHPOLLNC@UserId?3?50x?$CFx?5LastBadPasswordTime@
0x1800BC348: "Marking event [&SclEvent_Process" ??_C@_0DE@OMDDEOJP@Marking?5event?5?$FL?$CGSclEvent_Process@
0x1800191B4: DetermineTracingDirectoryPath
0x1800BC600: "The current (host) OS is not sup" ??_C@_0DP@DOLDHPMJ@The?5current?5?$CIhost?$CJ?5OS?5is?5not?5sup@
0x1800C8138: "__cdecl _DELAY_IMPORT_DESCRIPTOR_CRYPTBASE_dll" __DELAY_IMPORT_DESCRIPTOR_CRYPTBASE_dll
0x1800B4260: "UserId: 0x%x PDC update, Passwo" ??_C@_0EM@BKOOPKGJ@UserId?3?50x?$CFx?5?5PDC?5update?0?5Passwo@
0x180066E28: WPP_SF_qZDD
0x1800D0D90: DsWellKnownSecurityPrincipalsToAddBetween_WinThresholdM2A_And_WinThresholdM3
0x180009D10: SampImpersonateClient
0x180069BBC: SampReplaceGroupMembers
0x1800627A0: SampInitializeMachineInfo
0x180032B5B: "__cdecl _imp_load_CloseServiceHandle" __imp_load_CloseServiceHandle
0x180073F98: SampExtDeleteObjectDs
0x1800B29F0: SampAddMemberToGroupGuid
0x1800B3D9C: "Set: " ??_C@_05MNNAKPBH@Set?3?5?$AA@
0x180008940: SampReleaseReadLock
0x180011AD0: SampConvertCredentialsFromListToAttr
0x1800B2990: SampSetInformationAliasGuid
0x1800B2C30: SampOpenDomainGuid
0x180066280: SamrQueryLocalizableAccountsInDomain
0x18006FFA0: SampApplyWellKnownAccountsMembershipsAndSecurityPrincipalsIfDC
0x1800AB168: "CredentialUpdateRegister" ??_C@_0BJ@KHOEDOHK@CredentialUpdateRegister?$AA@
0x1800A8708: "__cdecl _imp_ReleaseIdentityProviderEnumContext" __imp_ReleaseIdentityProviderEnumContext
0x1800A8398: "__cdecl _imp_RegNotifyChangeKeyValue" __imp_RegNotifyChangeKeyValue
0x1800B2028: "IgnoreGCFailures" ??_C@_0BB@DBCAKGCB@IgnoreGCFailures?$AA@
0x1800207E4: SampInitializeSingleDomain
0x1800D3880: SampLocalSystemSid
0x1800153D0: SampValidateDsAttributes
0x180009630: SampValidateSIDInformation
0x1800BD380: "\PIPE\" ??_C@_1O@PGAGHCON@?$AA?2?$AAP?$AAI?$AAP?$AAE?$AA?2?$AA?$AA@
0x180074E88: SampExtSuccessfulLogonSetDs
0x180024250: "long __cdecl StringLen(unsigned short const * __ptr64,unsigned __int64 * __ptr64)" ?StringLen@@YAJPEBGPEA_K@Z
0x1800D3FD8: LineCount
0x18001D988: SampExtAddMembershipAttributeDs
0x1800BAD58: "SclRegGetValue" ??_C@_0P@GONPKGDI@SclRegGetValue?$AA@
0x18000ABFC: SampCheckExtendedAttributesForReadAccess
0x1800B3CD0: WPP_8e8b4b1826473354e4890faf6397dd6e_Traceguids
0x18000C160: SamRpcIfCallbackFn
0x1800B9998: "RegDataUpdateCount" ??_C@_1CG@ECKGPKGK@?$AAR?$AAe?$AAg?$AAD?$AAa?$AAt?$AAa?$AAU?$AAp?$AAd?$AAa?$AAt?$AAe?$AAC?$AAo?$AAu?$AAn?$AAt?$AA?$AA@
0x180002A90: SamrQueryInformationUser2
0x1800855A4: SampCreatePsuedoRegistryUPN
0x1800DD140: "__cdecl _imp_RpcStringBindingParseW" __imp_RpcStringBindingParseW
0x18004E200: SampRemoveAliasFromAccountMembership
0x1800D34E0: SampDomainAdminsGroupSid
0x1800322FF: "__cdecl _imp_load_I_RpcExceptionFilter" __imp_load_I_RpcExceptionFilter
0x1800B43E0: "Authenticated Users" ??_C@_1CI@DEMONIBK@?$AAA?$AAu?$AAt?$AAh?$AAe?$AAn?$AAt?$AAi?$AAc?$AAa?$AAt?$AAe?$AAd?$AA?5?$AAU?$AAs?$AAe?$AAr?$AAs?$AA?$AA@
0x1800B45F0: "NTLM Authentication" ??_C@_1CI@HNHCLKCM@?$AAN?$AAT?$AAL?$AAM?$AA?5?$AAA?$AAu?$AAt?$AAh?$AAe?$AAn?$AAt?$AAi?$AAc?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x18001DE20: SampGetServerObjectName
0x180017450: SampConvertAttrBlockToVarLengthAttributes
0x1800A8020: "__cdecl _imp_LsaIRegisterPolicyChangeNotificationCallback" __imp_LsaIRegisterPolicyChangeNotificationCallback
0x1800A7FD0: "__cdecl _imp_CertDuplicateCertificateContext" __imp_CertDuplicateCertificateContext
0x1800B4350: "LMPASSWORDHISTORY" ??_C@_0BC@LNIDNGOK@LMPASSWORDHISTORY?$AA@
0x180002A80: SamrQueryInformationUser
0x1800B58C0: "SamrOpenDomain" ??_C@_0P@FAHONOGN@SamrOpenDomain?$AA@
0x180074104: SampExtFailedLogonSetDs
0x1800241FC: "private: unsigned char * __ptr64 __cdecl JoinStatusStorage::JoinStatusRegKeyInfo::CopyRegKey(unsigned char * __ptr64,unsigned short const * __ptr64,unsigned __int64) __ptr64" ?CopyRegKey@JoinStatusRegKeyInfo@JoinStatusStorage@@AEAAPEAEPEAEPEBG_K@Z
0x1800A85E0: "__cdecl _imp__o__callnewh" __imp__o__callnewh
0x1800AA4C8: "TracingDisabled" ??_C@_1CA@OPJGPJGD@?$AAT?$AAr?$AAa?$AAc?$AAi?$AAn?$AAg?$AAD?$AAi?$AAs?$AAa?$AAb?$AAl?$AAe?$AAd?$AA?$AA@
0x1800BAD18: "Target key [%ws] already exists" ??_C@_0CA@EOMBJGML@Target?5key?5?$FL?$CFws?$FN?5already?5exists?$AA@
0x1800BBED8: "SECURITY" ??_C@_1BC@IBECJAAI@?$AAS?$AAE?$AAC?$AAU?$AAR?$AAI?$AAT?$AAY?$AA?$AA@
0x1800A8158: "__cdecl _imp_CreateDirectoryW" __imp_CreateDirectoryW
0x18008754C: SampValidateUserInfoBuffer
0x180097434: WdsEnumVolumeReparsePointsByHandle
0x1800A8410: api-ms-win-core-rtlsupport-l1-1-0_NULL_THUNK_DATA
0x1800D3DF0: SampBuiltinDomainSid
0x1800242D4: "void * __ptr64 __cdecl SafeAlloc(unsigned __int64)" ?SafeAlloc@@YAPEAX_K@Z
0x18008A0D4: SetUserPropertyWithLength
0x1800ABC80: ErrorDebugEvent
0x180001BD0: RtlInsertElementGenericTable2
0x1800B2FC0: SAMMSG_NOTIFICATION_TCP_DISABLED
0x1800B4548: "Network Service" ??_C@_1CA@FLELLNNF@?$AAN?$AAe?$AAt?$AAw?$AAo?$AAr?$AAk?$AA?5?$AAS?$AAe?$AAr?$AAv?$AAi?$AAc?$AAe?$AA?$AA@
0x1800B9598: SclEvent_ResetDiskSignatures_Stop
0x1800A8DF8: "__cdecl _xp_z" __xp_z
0x180095CE4: StrRTrm
0x1800B35F0: "SamIValidateAndFilterClaimEntrie" ??_C@_0EG@IGJKPJLN@SamIValidateAndFilterClaimEntrie@
0x1800C82E8: NETLOGON_NULL_THUNK_DATA_DLN
0x1800D3FC0: SampAccountDomainSid
0x180075108: SampExtValidateNameDs
0x1800B62D0: " Audit user account control chan" ??_C@_0EA@DHKIMCBH@?7Audit?5user?5account?5control?5chan@
0x1800B9098: "Marking event [&SclEvent_ExtendP" ??_C@_0DA@LLHLKOFC@Marking?5event?5?$FL?$CGSclEvent_ExtendP@
0x1800B37E8: "Krbtgt allocation: Failed to cre" ??_C@_0DP@EIJJLKHD@Krbtgt?5allocation?3?5Failed?5to?5cre@
0x180019460: SampADWriteExtendedAttributes
0x180001590: SampActiveEnumerationContextTableAllocate
0x1800BA750: "(%lx): Failed to get boot entry." ??_C@_0CB@KPJMLOCI@?$CI?$CFlx?$CJ?3?5Failed?5to?5get?5boot?5entry?4@
0x1800A99D0: GUID_CONTROL_UnexpirePassword
0x1800A8018: "__cdecl _imp_LsaIRetrieveCurrentUserSid" __imp_LsaIRetrieveCurrentUserSid
0x1800DD0D0: NETLOGON_NULL_THUNK_DATA_DLA
0x1800D2D20: SampProcessingComponentUpdate
0x180062570: SampDuplicateOemUserInfo
0x1800C8CD0: NETLOGON_NULL_THUNK_DATA_DLB
0x1800B2B30: SampCreateAliasInDomainGuid
0x180075530: SampChangeConfigurationKeyToValue
0x1800DD170: "__cdecl _imp_NdrMesTypeDecode3" __imp_NdrMesTypeDecode3
0x1800AA750: "System\CurrentControlSet\Control" ??_C@_1EK@GFPFBLJC@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA?2?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl@
0x1800A7FE8: "__cdecl _imp_CryptBinaryToStringW" __imp_CryptBinaryToStringW
0x1800BBFD0: "SclpLinkProcessReparsePoint" ??_C@_0BM@DKNJJHAL@SclpLinkProcessReparsePoint?$AA@
0x180024300: SampIsSetupInProgress
0x18001D260: SamrQueryInformationDomain
0x180085A80: SampGetNextUnmodifiedRidFromIndex
0x180032857: "__cdecl _imp_load_RpcRevertToSelf" __imp_load_RpcRevertToSelf
0x18004FCE4: SampAlRemoveMembersFromAlias
0x1800CBEE4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0
0x180030D7C: SampShouldPerformWAUUpgrade
0x1800A8978: "__cdecl _imp_RtlDuplicateUnicodeString" __imp_RtlDuplicateUnicodeString
0x1800A8720: api-ms-win-service-management-l2-1-0_NULL_THUNK_DATA
0x1800B6EF0: "EAS password policy: MinPassworL" ??_C@_0IC@EOKHBJLI@EAS?5password?5policy?3?5MinPassworL@
0x18000EFD8: SampExtWriteGroupTypeDs
0x1800B9FE0: "HiveTime" ??_C@_1BC@LEJHAIHL@?$AAH?$AAi?$AAv?$AAe?$AAT?$AAi?$AAm?$AAe?$AA?$AA@
0x18001AC20: SampAlSlowQueryAliasMembership
0x180094ADC: SclRegProcessOnlineRegistry
0x180061D20: SamIRetrieveNGCKeyCredential
0x1800CC074: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-apiquery-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-apiquery-l1-1-0
0x180055374: SampInitializeRegistry
0x1800A8348: api-ms-win-core-profile-l1-1-0_NULL_THUNK_DATA
0x1800DD268: "__cdecl _imp_LsaClose" __imp_LsaClose
0x180006440: SamrCloseHandle
0x180066210: SamrQueryInformationDomain2
0x18006DF58: SampDecryptSecretDataWithRc4
0x1800B2C70: "KDCPW" ??_C@_1M@KPMMHHFG@?$AAK?$AAD?$AAC?$AAP?$AAW?$AA?$AA@
0x1800BFEC8: "__cdecl _rtc_tzz" __rtc_tzz
0x1800D38B0: SampWillNeverTime
0x1800A8E10: "__cdecl _guard_fids_table" __guard_fids_table
0x1800B69C0: "SampFlushSampKey: NtFlushKey fai" ??_C@_0HO@MLJGDNA@SampFlushSampKey?3?5NtFlushKey?5fai@
0x1800A85A0: "__cdecl _imp_wcscpy_s" __imp_wcscpy_s
0x1800BD6B0: "ppszOutBuffer" ??_C@_1BM@HNOJMDJI@?$AAp?$AAp?$AAs?$AAz?$AAO?$AAu?$AAt?$AAB?$AAu?$AAf?$AAf?$AAe?$AAr?$AA?$AA@
0x180086678: SampUnicodeToOemString
0x18009964C: "unsigned long __cdecl RegReadStringValue(struct HKEY__ * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short * __ptr64 * __ptr64)" ?RegReadStringValue@@YAKPEAUHKEY__@@PEBG1PEAPEAG@Z
0x1800A89A0: "__cdecl _imp_RtlpNtEnumerateSubKey" __imp_RtlpNtEnumerateSubKey
0x1800BC7E8: "\Device\KsecDD" ??_C@_1BO@BAEMGIAB@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAK?$AAs?$AAe?$AAc?$AAD?$AAD?$AA?$AA@
0x1800B4E60: "WinThreshold-M2 to WinThreshold-" ??_C@_0CE@DOIFNOKK@WinThreshold?9M2?5to?5WinThreshold?9@
0x18009A280: "public: static long __cdecl CertificateUtil::DoesExtensionWithValueExist(char const * __ptr64,unsigned short const * __ptr64,enum _CERT_OID_VALUE_TYPE,struct _CERT_CONTEXT const * __ptr64,int * __ptr64)" ?DoesExtensionWithValueExist@CertificateUtil@@SAJPEBDPEBGW4_CERT_OID_VALUE_TYPE@@PEBU_CERT_CONTEXT@@PEAH@Z
0x1800B2F80: SAMMSG_REMOTE_SAM_AUDIT_MODE_ENABLED
0x180032359: "__cdecl _imp_load_MesEncodeDynBufferHandleCreate" __imp_load_MesEncodeDynBufferHandleCreate
0x18001F9A8: SampAlLookupMemberDomain
0x180018FC0: StopSession
0x1800BACC0: "Source key [%ws] didn't already " ??_C@_0CG@BODNNBJP@Source?5key?5?$FL?$CFws?$FN?5didn?8t?5already?5@
0x1800B4A38: "SOFTWARE\TEMPSAM" ??_C@_1CC@NNHBIBOP@?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAT?$AAE?$AAM?$AAP?$AAS?$AAA?$AAM?$AA?$AA@
0x180098C98: "long __cdecl _myVariantCopy(struct tagPROPVARIANT * __ptr64,struct tagPROPVARIANT * __ptr64)" ?_myVariantCopy@@YAJPEAUtagPROPVARIANT@@0@Z
0x1800BB598: "(%lx): Failure during enumeratio" ??_C@_0CN@CEGAHCAN@?$CI?$CFlx?$CJ?3?5Failure?5during?5enumeratio@
0x18008D530: SclGenerateUniqueAccountDomainSid
0x1800D3410: SampNameDomainAliasesNames
0x18009E170: "__cdecl load_config_used" _load_config_used
0x1800B2C20: SampGetMembersInAliasGuid
0x1800D0C40: DsWellKnownMembershipsToRemoveBetween_LH_BETA2_And_LH_RC1_IDS1
0x180007BE0: SampGetAliasMembershipWorker
0x180075FD0: QueryRemoteClientInfo
0x180032821: "__cdecl _imp_load_RpcRevertToSelfEx" __imp_load_RpcRevertToSelfEx
0x180074164: SampExtGetAliasMembershipOfAccountDs
0x180088AD0: SampFreeHandle
0x1800D38C0: SampAnonymousSid
0x1800BC7C0: "(%lx): Failed to set security in" ??_C@_0CE@EAJBMABJ@?$CI?$CFlx?$CJ?3?5Failed?5to?5set?5security?5in@
0x1800AAAC0: "Upgrade" ??_C@_1BA@GGIBCIOH@?$AAU?$AAp?$AAg?$AAr?$AAa?$AAd?$AAe?$AA?$AA@
0x18004FE8C: SampAuditRODCCache
0x18001A454: SampAuditGroupChangeDs
0x1800BDCF0: "TargetOS" ??_C@_1BC@PPOCGNBO@?$AAT?$AAa?$AAr?$AAg?$AAe?$AAt?$AAO?$AAS?$AA?$AA@
0x1800A8CC8: "__cdecl _imp_RtlCopySid" __imp_RtlCopySid
0x1800B5540: "SampShouldPerformWAUUpgrade: Mac" ??_C@_0DO@HNBDOONK@SampShouldPerformWAUUpgrade?3?5Mac@
0x1800B2FF0: "System\CurrentControlSet\Control" ??_C@_1FO@KJNOPMOG@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA?2?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl@
0x180074540: SampExtLookupObjectByAlternateIdDs
0x1800624D0: SampDuplicateGroupInfo
0x1800A8AA0: "__cdecl _imp_RtlSetControlSecurityDescriptor" __imp_RtlSetControlSecurityDescriptor
0x1800AA2F0: "EnableTraceEx2 succeeded" ??_C@_0BJ@ONLMJKOI@EnableTraceEx2?5succeeded?$AA@
0x1800B8D90: "SkewMatrix" ??_C@_0L@GHLCLDNM@SkewMatrix?$AA@
0x1800B66E8: "OptionValue" ??_C@_1BI@CBOLNBDL@?$AAO?$AAp?$AAt?$AAi?$AAo?$AAn?$AAV?$AAa?$AAl?$AAu?$AAe?$AA?$AA@
0x18000A9A4: SampValidateDomainLogoffInformation
0x1800624D0: SampDuplicateMachineInfo
0x1800D3CA8: "void (__cdecl* __ptr64 g_pFnLog)(unsigned long,unsigned short * __ptr64)" ?g_pFnLog@@3P6AXKPEAG@ZEA
0x1800BE680: "%s: Always try unloading reg key" ??_C@_1BDE@DICAAPGO@?$AA?$CF?$AAs?$AA?3?$AA?5?$AAA?$AAl?$AAw?$AAa?$AAy?$AAs?$AA?5?$AAt?$AAr?$AAy?$AA?5?$AAu?$AAn?$AAl?$AAo?$AAa?$AAd?$AAi?$AAn?$AAg?$AA?5?$AAr?$AAe?$AAg?$AA?5?$AAk?$AAe?$AAy@
0x1800C8018: "__cdecl _DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_sddl_l1_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_sddl_l1_1_0_dll
0x1800080F0: SampLookupAccountName
0x1800D2BA0: "__cdecl _hmod__api_ms_win_security_lsapolicy_l1_1_0_dll" __hmod__api_ms_win_security_lsapolicy_l1_1_0_dll
0x1800BA388: "Call to SclAlloc failed!" ??_C@_0BJ@JFDEENDH@Call?5to?5SclAlloc?5failed?$CB?$AA@
0x18001F8A0: SampAlInfoIsValidForAlias
0x1800BA2C8: "(%lx): RtlConvertSidToUnicodeStr" ??_C@_0CM@BOGMDNOG@?$CI?$CFlx?$CJ?3?5RtlConvertSidToUnicodeStr@
0x180084B80: SampBuildDomainSubKeyName
0x1800D1B60: SampDomainUpdate_LHBETA2_TO_LHRC1_IDS1_Parameter
0x1800859E0: SampGetDisableSingleObjectRepl
0x1800DD248: api-ms-win-core-registry-l2-1-0_NULL_THUNK_DATA_DLA
0x18000D4F0: SampAcquireSamLockExclusive
0x1800B4440: "Service" ??_C@_1BA@IELBACJJ@?$AAS?$AAe?$AAr?$AAv?$AAi?$AAc?$AAe?$AA?$AA@
0x1800B2BC0: SampRemoveMemberFromForeignDomainGuid
0x1800BEAD0: "%s: CertCloseStore failed with e" ??_C@_1GE@FODMFJIJ@?$AA?$CF?$AAs?$AA?3?$AA?5?$AAC?$AAe?$AAr?$AAt?$AAC?$AAl?$AAo?$AAs?$AAe?$AAS?$AAt?$AAo?$AAr?$AAe?$AA?5?$AAf?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAw?$AAi?$AAt?$AAh?$AA?5?$AAe@
0x18008A778: KEEncryptKeyWithAES
0x1800B8CF0: "localhost" ??_C@_1BE@JDLPANCI@?$AAl?$AAo?$AAc?$AAa?$AAl?$AAh?$AAo?$AAs?$AAt?$AA?$AA@
0x18008D170: SclAcquireRequiredPrivileges
0x1800A8110: api-ms-win-core-delayload-l1-1-1_NULL_THUNK_DATA
0x1800A8100: api-ms-win-core-delayload-l1-1-0_NULL_THUNK_DATA
0x1800B3B00: "SampPurgeStaleEnumerationContext" ??_C@_0ED@NANHPCJB@SampPurgeStaleEnumerationContext@
0x1800320AC: swprintf_s
0x1800992A0: freeEvntlogMap
0x18002DAB0: SampCopyAttrValBlock
0x180086960: SampValidateDomainNameInformation
0x1800BC4E0: "ProcessOnlineRegistryHives" ??_C@_0BL@FICEJGFL@ProcessOnlineRegistryHives?$AA@
0x180074288: SampExtGetDisplayEnumerationIndexDs
0x1800D0830: DsWellKnownSecurityPrincipalsToRenameBetween_LH_IDS2_And_LH_BETA2
0x1800ABCB0: CriticalDebugEvent
0x1800C8178: "__cdecl _DELAY_IMPORT_DESCRIPTOR_api_ms_win_service_winsvc_l1_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_api_ms_win_service_winsvc_l1_1_0_dll
0x18008BD18: SclEtwWriteStringStringUll
0x1800D0C70: SampDomainUpdate_WinThresholdM2B_TO_WinThresholdM3_Parameter
0x1800A9888: "C" ??_C@_13FHBKNHDA@?$AAC?$AA?$AA@
0x1800A8DE0: "__cdecl _scrt_stdio_legacy_msvcrt_compatibility" __scrt_stdio_legacy_msvcrt_compatibility
0x1800863C4: SampSetObjectExtendedAttributes
0x18000F470: SamIScorePassword
0x1800CC0EC: "__cdecl _IMPORT_DESCRIPTOR_CRYPT32" __IMPORT_DESCRIPTOR_CRYPT32
0x1800B2BF0: SampOpenAliasGuid
0x1800AAB80: UserExtendedAttributesSecretData
0x1800BF6C8: "NtModifyDriverEntry" ??_C@_0BE@MNFBFPME@NtModifyDriverEntry?$AA@
0x180024278: "long __cdecl StringCchLengthW(unsigned short const * __ptr64,unsigned __int64,unsigned __int64 * __ptr64)" ?StringCchLengthW@@YAJPEBG_KPEA_K@Z
0x1800077D0: SampValidateContextAddress
0x180086A38: SampValidateAliasInfoBuffer
0x18001B410: SampPurgeStaleEnumerationContextsCallback
0x180060530: SamITransformClaims
0x18002FA20: SampRegistryLookupIdByKey
0x1800B9070: "(%lx): Failed to reset disk GUID" ??_C@_0CD@CCPLENME@?$CI?$CFlx?$CJ?3?5Failed?5to?5reset?5disk?5GUID@
0x18009CA68: OSBESetOsLoadOptions
0x1800A8C08: "__cdecl _imp_RtlInitializeGenericTableAvl" __imp_RtlInitializeGenericTableAvl
0x18000A890: SamrConnect5
0x18001B330: SamILoopbackConnect
0x180085830: SampFlushNetlogonChangeNumbers
0x1800B8E70: "Saw request(P): operation flags " ??_C@_0DN@OLILDKMI@Saw?5request?$CIP?$CJ?3?5operation?5flags?5@
0x1800DD0D8: "__cdecl _imp_RpcBindingSetAuthInfoW" __imp_RpcBindingSetAuthInfoW
0x1800160D0: SampCreateDsAttributes
0x1800B9180: "(%lx): Failed to execute upgrade" ??_C@_0CO@BHJLJILG@?$CI?$CFlx?$CJ?3?5Failed?5to?5execute?5upgrade@
0x180010750: SampSetPasswordUpdateOnContext
0x180062750: SampFreeOemUserInfo
0x1800D3FE0: SampTraceLoggerHandle
0x18003287B: "__cdecl _imp_load_RpcEpRegisterW" __imp_load_RpcEpRegisterW
0x1800B5500: "IgnoreGCFailures" ??_C@_1CC@BMOLHKIK@?$AAI?$AAg?$AAn?$AAo?$AAr?$AAe?$AAG?$AAC?$AAF?$AAa?$AAi?$AAl?$AAu?$AAr?$AAe?$AAs?$AA?$AA@
0x1800D31A0: SampLogFileName
0x18001DAA4: SampExtLookupObjectBySidDs
0x1800BDC80: "%s: Cannot open registry key %s." ??_C@_1GK@IJLLIFC@?$AA?$CF?$AAs?$AA?3?$AA?5?$AAC?$AAa?$AAn?$AAn?$AAo?$AAt?$AA?5?$AAo?$AAp?$AAe?$AAn?$AA?5?$AAr?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?5?$AAk?$AAe?$AAy?$AA?5?$AA?$CF?$AAs?$AA?4@
0x1800A8370: "__cdecl _imp_RegQueryValueExA" __imp_RegQueryValueExA
0x1800B5BA0: "SamrDeleteUser" ??_C@_0P@MOMFPHNG@SamrDeleteUser?$AA@
0x1800CBF34: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processenvironment-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processenvironment-l1-1-0
0x1800AB490: "__cdecl _sz_NETLOGON_dll" __sz_NETLOGON_dll
0x1800BDB80: "SOFTWARE\Microsoft\RecoveryEnvir" ??_C@_1EO@COKCKEMM@?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAR?$AAe?$AAc?$AAo?$AAv?$AAe?$AAr?$AAy?$AAE?$AAn?$AAv?$AAi?$AAr@
0x1800671B8: SampAuditSetDSRMPassword
0x1800BBC38: "Excluded key not found: [%ws]" ??_C@_0BO@INJMABLO@Excluded?5key?5not?5found?3?5?$FL?$CFws?$FN?$AA@
0x1800B4E18: "WinBlue-MP to WinThreshold-M2" ??_C@_0BO@JDGHDDGJ@WinBlue?9MP?5to?5WinThreshold?9M2?$AA@
0x180098620: RtlDecodeUtf8
0x1800A7A20: SampDomainUpdateOperations
0x1800B20F0: "6E157EDF-4E72-4052-A82A-EC3F9102" ??_C@_1EK@GNPACMA@?$AA6?$AAE?$AA1?$AA5?$AA7?$AAE?$AAD?$AAF?$AA?9?$AA4?$AAE?$AA7?$AA2?$AA?9?$AA4?$AA0?$AA5?$AA2?$AA?9?$AAA?$AA8?$AA2?$AAA?$AA?9?$AAE?$AAC?$AA3?$AAF?$AA9?$AA1?$AA0?$AA2@
0x180050A28: SampRefreshRODCCache
0x1800DD0A8: "__cdecl _imp_I_NetNotifyRole" __imp_I_NetNotifyRole
0x1800B9DD0: "Number of $MFT security descript" ??_C@_1FM@PEANKDED@?$AAN?$AAu?$AAm?$AAb?$AAe?$AAr?$AA?5?$AAo?$AAf?$AA?5?$AA$?$AAM?$AAF?$AAT?$AA?5?$AAs?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?5?$AAd?$AAe?$AAs?$AAc?$AAr?$AAi?$AAp?$AAt@
0x18009A95C: "public: static struct _CERT_EXTENSION * __ptr64 __cdecl CertificateUtil::FindExtensionByOid(char const * __ptr64,struct _CERT_CONTEXT const * __ptr64)" ?FindExtensionByOid@CertificateUtil@@SAPEAU_CERT_EXTENSION@@PEBDPEBU_CERT_CONTEXT@@@Z
0x180074D58: SampExtSetPasswordInfoOnDcWorkerDs
0x1800AA9C0: "UpgradeInProgress" ??_C@_1CE@JJEFJIBF@?$AAU?$AAp?$AAg?$AAr?$AAa?$AAd?$AAe?$AAI?$AAn?$AAP?$AAr?$AAo?$AAg?$AAr?$AAe?$AAs?$AAs?$AA?$AA@
0x180009820: SampAlQueryAliasMembership
0x1800BCD28: "Windows::StringUtil::Rtl::SubStr" ??_C@_0CP@HOHPALII@Windows?3?3StringUtil?3?3Rtl?3?3SubStr@
0x1800A8898: "__cdecl _imp_RtlDeleteSecurityObject" __imp_RtlDeleteSecurityObject
0x1800DD0F0: "__cdecl _imp_RpcServerInqCallAttributesW" __imp_RpcServerInqCallAttributesW
0x1800DD130: "__cdecl _imp_RpcBindingToStringBindingW" __imp_RpcBindingToStringBindingW
0x18004DBA0: SampRemoveAccountFromAlias
0x1800A8B78: "__cdecl _imp_RtlGetNtProductType" __imp_RtlGetNtProductType
0x1800A8428: "__cdecl _imp_GetStringTypeW" __imp_GetStringTypeW
0x1800B3E28: "GMSA: " ??_C@_06LAJKLMGD@GMSA?3?5?$AA@
0x18001A1D0: SampNotifyAuditChange
0x1800618A8: SampValidateAndFilterClaimsSetInPlace
0x18009CF84: EfiQueryBootEntryOrder
0x180027EC0: SampStoreObjectAttributes
0x1800BCFE8: "Not-null check failed: Blob" ??_C@_0BM@NOGHIDPG@Not?9null?5check?5failed?3?5Blob?$AA@
0x1800B5B18: "SamrSetInformationAlias" ??_C@_0BI@HMPGNFMI@SamrSetInformationAlias?$AA@
0x18004F928: SampAlGrowMemberAliasList
0x1800BCA00: "Updates required for link; Old S" ??_C@_1IM@ICOKKGIK@?$AAU?$AAp?$AAd?$AAa?$AAt?$AAe?$AAs?$AA?5?$AAr?$AAe?$AAq?$AAu?$AAi?$AAr?$AAe?$AAd?$AA?5?$AAf?$AAo?$AAr?$AA?5?$AAl?$AAi?$AAn?$AAk?$AA?$DL?$AA?5?$AAO?$AAl?$AAd?$AA?5?$AAS@
0x1800DD0E0: "__cdecl _imp_RpcBindingFromStringBindingW" __imp_RpcBindingFromStringBindingW
0x1800102C0: SampRestrictAndRandomizeKrbtgtPassword
0x1800BD608: "dest" ??_C@_19DFJJNFPI@?$AAd?$AAe?$AAs?$AAt?$AA?$AA@
0x18001D080: SampSetGlobalDsSids
0x180031A7C: "__cdecl _scrt_get_dyn_tls_init_callback" __scrt_get_dyn_tls_init_callback
0x180007060: SampTraceEvent
0x1800B8DA0: "GrafBlumGroup" ??_C@_0O@HKMIMEEF@GrafBlumGroup?$AA@
0x1800173A0: SampMarkPerAttributeInvalidFromWhichFields
0x1800A8A98: "__cdecl _imp_NtSetSecurityObject" __imp_NtSetSecurityObject
0x1800B55D0: "SampShouldPerformWAUUpgrade: SKU" ??_C@_0FA@PJHMDPHA@SampShouldPerformWAUUpgrade?3?5SKU@
0x1800A2FF0: SampConfigurationKeys
0x1800BA9F8: "(%lx): Failed to load hive: [%ws" ??_C@_0CC@OFIKPALK@?$CI?$CFlx?$CJ?3?5Failed?5to?5load?5hive?3?5?$FL?$CFws@
0x180062898: SampMarkDisplayInformationInvalid
0x180028BE0: SampRetrieveUserPasswords
0x180019CE0: SampIsDomainHosted
0x180023F28: SampRetrieveKeyForPostBootPromote
0x180096288: StringCchCopyNExW
0x1800B3788: "TRUE" ??_C@_19ELAAHEEL@?$AAT?$AAR?$AAU?$AAE?$AA?$AA@
0x1800B4308: WPP_9c1db97a6db335d54c4e0a36a93356bf_Traceguids
0x180086B88: SampValidateDomainGeneralInformation2
0x1800BA6F0: "(%lx): Failed to get size for bo" ??_C@_0DB@NPELNBNL@?$CI?$CFlx?$CJ?3?5Failed?5to?5get?5size?5for?5bo@
0x180095A50: SclFindAndReplaceChars
0x18000B4BC: SampRetrieveAliasMembers
0x1800D17F0: SampDomainUpdate_LHRTM_And_WIN7RC_Parameter
0x180053F30: OpenAliasMember
0x1800B47A0: "Key Trust" ??_C@_1BE@HLHCNADC@?$AAK?$AAe?$AAy?$AA?5?$AAT?$AAr?$AAu?$AAs?$AAt?$AA?$AA@
0x1800A8A80: "__cdecl _imp_RtlDestroyEnvironment" __imp_RtlDestroyEnvironment
0x1800A8750: "__cdecl _imp_BCryptOpenAlgorithmProvider" __imp_BCryptOpenAlgorithmProvider
0x180014B00: SampAddAccountToAlias
0x18004E3BC: SampRemoveAliasFromAllAccounts
0x18004FC08: SampAlRemoveAliasesFromMemberAccount
0x180086B20: SampValidateDomainGeneralInformation
0x1800A85F8: "__cdecl _imp___stdio_common_vsprintf" __imp___stdio_common_vsprintf
0x18001FF10: SamrLookupDomainInSamServer
0x1800BA570: "(%lx): Unable to get disk layout" ??_C@_0CC@EHELBEKK@?$CI?$CFlx?$CJ?3?5Unable?5to?5get?5disk?5layout@
0x1800BCB90: "onecore\base\servicing\offlinehi" ??_C@_0DF@OOJNANPE@onecore?2base?2servicing?2offlinehi@
0x1800D38D0: SampVariableAttributeName
0x18009B680: OSBODeleteBootEntry
0x1800B2F40: SAMMSG_NOTIFICATION_PACKAGE_REGISTRATION_FAILED
0x1800A8CD8: "__cdecl _imp_NtClose" __imp_NtClose
0x1800B9238: "Marking event [&SclEvent_Process" ??_C@_0CP@CHHCDILP@Marking?5event?5?$FL?$CGSclEvent_Process@
0x1800B8F10: "(%lx): Failed to acquire needed " ??_C@_0CL@FLEAIGJK@?$CI?$CFlx?$CJ?3?5Failed?5to?5acquire?5needed?5@
0x1800A8060: "__cdecl _imp_LsaIRegisterNotification" __imp_LsaIRegisterNotification
0x18001D520: SamIMixedDomain
0x18008A004: QueryUserPropertyWithLength
0x180022A74: SampInitialize
0x1800B44E8: "System" ??_C@_1O@GINMMDNN@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?$AA@
0x1800A9960: "(`~!@#$%^&*_-+=|\{}[]:;"'<>,.?)/" ??_C@_1EC@PMIAJPCB@?$AA?$CI?$AA?$GA?$AA?$HO?$AA?$CB?$AA?$EA?$AA?$CD?$AA$?$AA?$CF?$AA?$FO?$AA?$CG?$AA?$CK?$AA_?$AA?9?$AA?$CL?$AA?$DN?$AA?$HM?$AA?2?$AA?$HL?$AA?$HN?$AA?$FL?$AA?$FN?$AA?3?$AA?$DL?$AA?$CC?$AA?8?$AA?$DM?$AA?$DO?$AA?0?$AA?4?$AA?$DP?$AA?$CJ?$AA?1@
0x1800BD038: "Not-null check failed: PseudoKey" ??_C@_0CE@BGGJLBDI@Not?9null?5check?5failed?3?5PseudoKey@
0x180086D28: SampValidateKeyAttrStatsArg
0x1800DD0B8: "__cdecl _imp_I_NetLogonSendToSamOnDc" __imp_I_NetLogonSendToSamOnDc
0x1800BBEC0: "$security" ??_C@_1BE@DDAENEHJ@?$AA$?$AAs?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?$AA@
0x1800D5288: EfipModifyBootEntry
0x180075E28: SampUpgradeDsrmHive
0x1800BC6F0: "SclpFsProcessVolumeByHandle" ??_C@_0BM@BPCCCIDG@SclpFsProcessVolumeByHandle?$AA@
0x1800A8508: "__cdecl _imp_FileTimeToSystemTime" __imp_FileTimeToSystemTime
0x180076704: SampIsAttributeAccessGranted
0x1800A8530: "__cdecl _imp__o__memicmp" __imp__o__memicmp
0x180032936: "__cdecl _tailMerge_cryptbase_dll" __tailMerge_cryptbase_dll
0x1800B2078: "SamAccountLockoutTestMode" ??_C@_0BK@EDELHEON@SamAccountLockoutTestMode?$AA@
0x1800B4C28: "%ws\" ??_C@_19BPPJAIOB@?$AA?$CF?$AAw?$AAs?$AA?2?$AA?$AA@
0x1800BCCC0: "}.." ??_C@_17NAMDBIJM@?$AA?$HN?$AA?4?$AA?4?$AA?$AA@
0x1800B9950: "Number of registry values update" ??_C@_1EE@BOPLHCIG@?$AAN?$AAu?$AAm?$AAb?$AAe?$AAr?$AA?5?$AAo?$AAf?$AA?5?$AAr?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?5?$AAv?$AAa?$AAl?$AAu?$AAe?$AAs?$AA?5?$AAu?$AAp?$AAd?$AAa?$AAt?$AAe@
0x180061B08: SampInvalidateContextListKeysByObjectType
0x1800B3CE8: "Add member" ??_C@_1BG@LEALEMOF@?$AAA?$AAd?$AAd?$AA?5?$AAm?$AAe?$AAm?$AAb?$AAe?$AAr?$AA?$AA@
0x18001C670: SampGetBehaviorVersion
0x1800A8400: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x1800BA248: "windir" ??_C@_1O@GBFPGFCD@?$AAw?$AAi?$AAn?$AAd?$AAi?$AAr?$AA?$AA@
0x180062720: SampFreeGroupInfo
0x1800A8758: "__cdecl _imp_BCryptGenRandom" __imp_BCryptGenRandom
0x1800A8780: "__cdecl _imp_BCryptGenerateSymmetricKey" __imp_BCryptGenerateSymmetricKey
0x18001A0D0: GtbpSplitNode
0x1800A8D30: "__cdecl _imp_RtlValidSid" __imp_RtlValidSid
0x180016D90: SampDsMakeAttrBlock
0x1800B3E20: "DSRM: " ??_C@_06MPBIFDBN@DSRM?3?5?$AA@
0x1800B8D38: "host" ??_C@_19LOGFCJLO@?$AAh?$AAo?$AAs?$AAt?$AA?$AA@
0x18001B510: SampCopySecurityDescriptor
0x1800A8340: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x1800A8D88: "__cdecl _imp_RtlGetSaclSecurityDescriptor" __imp_RtlGetSaclSecurityDescriptor
0x1800BBEF0: "Processing links on volume [%ws]" ??_C@_0EF@BIBPGJOG@Processing?5links?5on?5volume?5?$FL?$CFws?$FN@
0x1800B2EC0: SAMMSG_RESTRICT_REMOTE_SAM_REGISTRY_SD_MALFORMED
0x180086960: SampValidateUserProfileInformation
0x1800CBDB8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-crt-string-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-crt-string-l1-1-0
0x1800B4898: "\Registry\Machine\SAM\NT5" ??_C@_1DE@ONIOCNKJ@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAA?$AAM?$AA?2?$AAN?$AAT?$AA5?$AA?$AA@
0x1800BB198: "(%lx): Unable to extend volume." ??_C@_0CA@PDNMHGPP@?$CI?$CFlx?$CJ?3?5Unable?5to?5extend?5volume?4?$AA@
0x18006B7D4: SampEnableLogging
0x1800D3F53: SampComputerObjectACLApplied
0x18000DAEC: SampExtLookupLocalKrbTgtDs
0x1800324A5: "__cdecl _imp_load_LsaFreeMemory" __imp_load_LsaFreeMemory
0x1800BBC88: "Error opening excluded hive file" ??_C@_0DB@HLBGAICN@Error?5opening?5excluded?5hive?5file@
0x1800BAB80: "(%lx): Recursive call failed." ??_C@_0BO@IDCINNJN@?$CI?$CFlx?$CJ?3?5Recursive?5call?5failed?4?$AA@
0x1800A8D80: "__cdecl _imp_RtlApplyRXactNoFlush" __imp_RtlApplyRXactNoFlush
0x18006D3CC: SampSetPasswordInfoOnDcWorker
0x1800BA4F0: "\Device\Harddisk%d\Partition0" ??_C@_1DM@FMJIKGBL@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAH?$AAa?$AAr?$AAd?$AAd?$AAi?$AAs?$AAk?$AA?$CF?$AAd?$AA?2?$AAP?$AAa?$AAr?$AAt?$AAi?$AAt?$AAi?$AAo?$AAn?$AA0?$AA?$AA@
0x18007D3F4: SampCopyAltSecIdAttribute
0x1800A8C40: "__cdecl _imp_RtlCheckTokenCapability" __imp_RtlCheckTokenCapability
0x18000C060: SampValidateProcessID
0x1800204F8: SampValidateDomainCache
0x180088B44: SampIsValidClientHandle
0x1800B9470: "SYSTEMROOT" ??_C@_1BG@NOLOJABN@?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AAR?$AAO?$AAO?$AAT?$AA?$AA@
0x1800A8CC0: "__cdecl _imp_RtlEqualSid" __imp_RtlEqualSid
0x1800835F0: SamIGetUserLogonInformation
0x1800D3BF8: SampUseDsData
0x1800A89F0: "__cdecl _imp_RtlGetDaclSecurityDescriptor" __imp_RtlGetDaclSecurityDescriptor
0x1800A8A50: "__cdecl _imp_RtlDosPathNameToNtPathName_U_WithStatus" __imp_RtlDosPathNameToNtPathName_U_WithStatus
0x180031EB2: "__cdecl o___stdio_common_vsprintf" _o___stdio_common_vsprintf
0x18001DE30: SampGetNT4UpgradeInProgress
0x1800B6940: "UserParmsConvertNotificationRout" ??_C@_0DK@DIMFPJIE@UserParmsConvertNotificationRout@
0x1800B3D50: "\debug\sam.log" ??_C@_1BO@LKLJFJCG@?$AA?2?$AAd?$AAe?$AAb?$AAu?$AAg?$AA?2?$AAs?$AAa?$AAm?$AA?4?$AAl?$AAo?$AAg?$AA?$AA@
0x1800BD198: "_LockStore" ??_C@_1BG@DLHNPHFP@?$AA_?$AAL?$AAo?$AAc?$AAk?$AAS?$AAt?$AAo?$AAr?$AAe?$AA?$AA@
0x1800B2B10: SampAddMemberToAliasGuid
0x180062288: SampDeleteDisplayAccount
0x1800A87A8: "__cdecl _imp_EtwGetTraceEnableFlags" __imp_EtwGetTraceEnableFlags
0x1800D17E0: DsWellKnownSecurityPrincipalsToAddBetween_LH_RTM_And_WIN_7RC
0x1800BBA88: "\REGISTRY\MACHINE\" ??_C@_1CG@GOLKLNMC@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AA?$AA@
0x1800AACE8: "ObjectLength" ??_C@_1BK@GPNIFMAA@?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAL?$AAe?$AAn?$AAg?$AAt?$AAh?$AA?$AA@
0x1800A89F8: "__cdecl _imp_RtlAnsiStringToUnicodeString" __imp_RtlAnsiStringToUnicodeString
0x1800C81D8: "__cdecl _DELAY_IMPORT_DESCRIPTOR_CRYPTSP_dll" __DELAY_IMPORT_DESCRIPTOR_CRYPTSP_dll
0x1800B2B90: SampOpenUserGuid
0x1800A8BF0: "__cdecl _imp_RtlGetSuiteMask" __imp_RtlGetSuiteMask
0x1800D3400: SampRestrictNullSessions
0x180032F78: "__cdecl _acrt_uninitialize_critical" __acrt_uninitialize_critical
0x1800767F0: SampIsAttributeAccessGrantedActual
0x180095FEC: AddPathN
0x1800B29A0: SampQueryInformationGroupGuid
0x180073DC4: SampExtAuditSidHistoryDs
0x1800A8B40: "__cdecl _imp_RtlRaiseStatus" __imp_RtlRaiseStatus
0x180032C64: "__cdecl _imp_load_RpcBindingSetAuthInfoW" __imp_load_RpcBindingSetAuthInfoW
0x1800A8480: "__cdecl _imp_InitializeSRWLock" __imp_InitializeSRWLock
0x1800BD7C0: "%s: The registry key value "%s@%" ??_C@_1MC@PAOOJAOI@?$AA?$CF?$AAs?$AA?3?$AA?5?$AAT?$AAh?$AAe?$AA?5?$AAr?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?5?$AAk?$AAe?$AAy?$AA?5?$AAv?$AAa?$AAl?$AAu?$AAe?$AA?5?$AA?$CC?$AA?$CF?$AAs?$AA?$EA?$AA?$CF@
0x180050ACC: SampDeleteAttributeKeys
0x1800A8278: "__cdecl _imp_VirtualAlloc" __imp_VirtualAlloc
0x1800AA6F8: "dsrmAdminLogonBehavior" ??_C@_0BH@DOCMDGNJ@dsrmAdminLogonBehavior?$AA@
0x1800A8CF8: "__cdecl _imp_RtlAddActionToRXact" __imp_RtlAddActionToRXact
0x1800BBA48: "(%lx): Failed to calculate Windo" ??_C@_0DN@KEKBLOOH@?$CI?$CFlx?$CJ?3?5Failed?5to?5calculate?5Windo@
0x180021AD0: SampWriteEventLog
0x1800628F0: SampUpdateDisplayAccount
0x18006D5A8: WPP_SF__guid_
0x1800210B0: SampBuildSamProtection
0x180032F60: ApiSetQueryApiSetPresence
0x1800A9884: "F" ??_C@_13GAMECHAC@?$AAF?$AA?$AA@
0x1800B3690: "SampGetSecAttributesFromEncodedB" ??_C@_0EC@BOOGNEE@SampGetSecAttributesFromEncodedB@
0x1800A8C98: "__cdecl _imp_RtlLeaveCriticalSection" __imp_RtlLeaveCriticalSection
0x1800A8AA8: "__cdecl _imp_NtQuerySecurityObject" __imp_NtQuerySecurityObject
0x18001B864: SampDecryptSupplementalCredentials
0x18001B194: SampExtFlushCachedMembershipOperationsListDs
0x180097798: "long __cdecl Windows::StringUtil::Rtl::SubStringByByteCount<struct _LUNICODE_STRING>(struct _LUNICODE_STRING const & __ptr64,unsigned __int64,unsigned __int64,struct _LUNICODE_STRING * __ptr64)" ??$SubStringByByteCount@U_LUNICODE_STRING@@@Rtl@StringUtil@Windows@@YAJAEBU_LUNICODE_STRING@@_K1PEAU3@@Z
0x1800AFDE0: "LastSuccessfulInterLogonTime" ??_C@_1DK@INLHAKLG@?$AAL?$AAa?$AAs?$AAt?$AAS?$AAu?$AAc?$AAc?$AAe?$AAs?$AAs?$AAf?$AAu?$AAl?$AAI?$AAn?$AAt?$AAe?$AAr?$AAL?$AAo?$AAg?$AAo?$AAn?$AAT?$AAi?$AAm?$AAe?$AA?$AA@
0x180031F4E: free
0x1800D34B0: SampNetworkServiceSid
0x1800B5DD8: WPP_be65f16c70513bc18faeef9e920deeda_Traceguids
0x1800B4338: "NTPASSWORDHISTORY" ??_C@_0BC@MOLAKAMJ@NTPASSWORDHISTORY?$AA@
0x180074798: SampExtQueryAccountSecretsCachabilityDs
0x1800A8520: "__cdecl _imp__initialize_narrow_environment" __imp__initialize_narrow_environment
0x1800B3158: "SampLoadRODCRolesCache returns s" ??_C@_0CL@KLMNAC@SampLoadRODCRolesCache?5returns?5s@
0x1800A7FE0: "__cdecl _imp_CryptDecodeObjectEx" __imp_CryptDecodeObjectEx
0x180062ACC: SampUpdateDisplayInformation
0x1800680E8: SampConvertAttrValToByteArray
0x1800A80B0: "__cdecl _imp_LsarQueryInformationPolicy" __imp_LsarQueryInformationPolicy
0x1800843C8: SampScanAttrBlockForConflict
0x18001DCE0: RtlInitializeGenericTable2
0x1800A8B00: "__cdecl _imp_NtFsControlFile" __imp_NtFsControlFile
0x1800B3A50: "SampCloseEnumerationOnClient: (T" ??_C@_0FA@LIOIKBLD@SampCloseEnumerationOnClient?3?5?$CIT@
0x1800B3F08: "uuud" ??_C@_19HAOLKIH@?$AAu?$AAu?$AAu?$AAd?$AA?$AA@
0x180089520: WxSaveSysKey
0x18006241C: SampDeleteDisplayInformation
0x18004E690: SamrAddMultipleMembersToAlias
0x1800BEE00: "CertificateUtil::FindExtensionBy" ??_C@_1EI@EOIMPOB@?$AAC?$AAe?$AAr?$AAt?$AAi?$AAf?$AAi?$AAc?$AAa?$AAt?$AAe?$AAU?$AAt?$AAi?$AAl?$AA?3?$AA?3?$AAF?$AAi?$AAn?$AAd?$AAE?$AAx?$AAt?$AAe?$AAn?$AAs?$AAi?$AAo?$AAn?$AAB?$AAy@
0x1800A8288: "__cdecl _imp_VirtualQuery" __imp_VirtualQuery
0x1800A8208: "__cdecl _imp_InitializeSListHead" __imp_InitializeSListHead
0x1800D3F4C: SampPasswordLegacyModeEnabled
0x1800B6230: "SAM: Setting undefined AccountCo" ??_C@_0EC@BHEBKKIP@SAM?3?5Setting?5undefined?5AccountCo@
0x1800C8198: "__cdecl _DELAY_IMPORT_DESCRIPTOR_DSPARSE_dll" __DELAY_IMPORT_DESCRIPTOR_DSPARSE_dll
0x1800DD138: "__cdecl _imp_RpcStringFreeW" __imp_RpcStringFreeW
0x1800B3090: "SampLoadRODCRolesCache: an inval" ??_C@_0EN@KLKGAPEF@SampLoadRODCRolesCache?3?5an?5inval@
0x18008D6E8: SclReleasePrivileges
0x1800B5490: "\Registry\Machine\System\Current" ??_C@_1GO@BNNKBEEN@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x180079AC0: SampSetBootKeyInformation
0x1800B2940: SampDeleteGroupGuid
0x1800A8408: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x1800A83B8: "__cdecl _imp_RegQueryInfoKeyW" __imp_RegQueryInfoKeyW
0x18004F7A8: SampAlDeleteMemberAccount
0x1800B8D70: "Data" ??_C@_04DICKPMGH@Data?$AA@
0x1800272F8: "long __cdecl _ReadPolicies(void * __ptr64,unsigned long * __ptr64,struct _tagEASPolicy * __ptr64 * __ptr64)" ?_ReadPolicies@@YAJPEAXPEAKPEAPEAU_tagEASPolicy@@@Z
0x1800DD2F0: "__cdecl _imp_ControlService" __imp_ControlService
0x1800B3500: "__cdecl _pfnDefaultDliFailureHook2" __pfnDefaultDliFailureHook2
0x1800B9AF0: "Number of $Secure security descr" ??_C@_1FO@OOMMFABO@?$AAN?$AAu?$AAm?$AAb?$AAe?$AAr?$AA?5?$AAo?$AAf?$AA?5?$AA$?$AAS?$AAe?$AAc?$AAu?$AAr?$AAe?$AA?5?$AAs?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?5?$AAd?$AAe?$AAs?$AAc?$AAr@
0x1800A85F0: "__cdecl _imp___stdio_common_vswprintf" __imp___stdio_common_vswprintf
0x180099328: "unsigned long __cdecl GetWindowsDirectoryWinPE(unsigned short * __ptr64 * __ptr64)" ?GetWindowsDirectoryWinPE@@YAKPEAPEAG@Z
0x180095F54: StringCchCopyNW
0x1800015A4: SampAuditLocalUserGroupQuery
0x1800321E3: "__cdecl _tailMerge_api_ms_win_security_sddl_l1_1_0_dll" __tailMerge_api_ms_win_security_sddl_l1_1_0_dll
0x180031F2A: "__cdecl o__register_onexit_function" _o__register_onexit_function
0x1800AB2F0: "System\CurrentControlSet\Control" ??_C@_1HM@HECDHJOH@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA?2?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl@
0x18006AFB0: RtlStringCbCopyW
0x1800BA080: "FileACLTime" ??_C@_1BI@JGAIMDJI@?$AAF?$AAi?$AAl?$AAe?$AAA?$AAC?$AAL?$AAT?$AAi?$AAm?$AAe?$AA?$AA@
0x1800D3548: SampWorldSid
0x180062720: SampFreeMachineInfo
0x180073B68: SampMaybeLookupContextForAudit
0x1800772A8: SampGrantChangePasswordOnSecurityDescriptor
0x1800D2580: "unsigned __int64 `__local_stdio_printf_options'::`2'::_OptionsStorage" ?_OptionsStorage@?1??__local_stdio_printf_options@@9@4_KA
0x1800AA8E0: "\Registry\Machine\System\Current" ??_C@_1HE@ECIFFCMG@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x180095D4C: StrStrNIC
0x1800B6AA0: "\Registry\Machine\SAM" ??_C@_1CM@MCIMCCII@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAA?$AAM?$AA?$AA@
0x1800A8AE8: "__cdecl _imp_NtLoadKey" __imp_NtLoadKey
0x1800B5A20: "SamrOpenGroup" ??_C@_0O@OFGHFGIN@SamrOpenGroup?$AA@
0x1800B6278: "UserId: 0x%x Manually unlocked " ??_C@_0CB@MMDJGMBM@UserId?3?50x?$CFx?5?5Manually?5unlocked?6@
0x1800D3920: SampObjectInformation
0x1800B5AF8: "SamrQueryInformationAlias" ??_C@_0BK@KPDFJHAB@SamrQueryInformationAlias?$AA@
0x180007810: MIDL_user_allocate
0x1800A87A0: "__cdecl _imp_NtRaiseHardError" __imp_NtRaiseHardError
0x18009D6EC: OSDriverSetDirPath
0x180031C80: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x1800A82A8: "__cdecl _imp_ExpandEnvironmentStringsW" __imp_ExpandEnvironmentStringsW
0x1800B3DB8: "Package: " ??_C@_09GBJGAPBG@Package?3?5?$AA@
0x1800A8270: api-ms-win-core-localization-l1-2-0_NULL_THUNK_DATA
0x180033303: memcmp
0x1800BA118: "RunTime" ??_C@_1BA@DENLLNIE@?$AAR?$AAu?$AAn?$AAT?$AAi?$AAm?$AAe?$AA?$AA@
0x1800A9788: "Security Account Manager" ??_C@_1DC@FKDBCCEP@?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?5?$AAA?$AAc?$AAc?$AAo?$AAu?$AAn?$AAt?$AA?5?$AAM?$AAa?$AAn?$AAa?$AAg?$AAe?$AAr?$AA?$AA@
0x1800A84E8: "__cdecl _imp_GetSystemDirectoryW" __imp_GetSystemDirectoryW
0x180078DE0: SamrConnect4
0x18001FBA0: SampAlLookupMemberAccount
0x1800A85A8: "__cdecl _imp__o_wcsncpy_s" __imp__o_wcsncpy_s
0x180018304: SampMergeDsAttrBlocks
0x1800BB1B8: "\Device\MountPointManager" ??_C@_1DE@MJJBHHAG@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAM?$AAo?$AAu?$AAn?$AAt?$AAP?$AAo?$AAi?$AAn?$AAt?$AAM?$AAa?$AAn?$AAa?$AAg?$AAe?$AAr?$AA?$AA@
0x1800AB710: "Context at %p is possible hijack" ??_C@_0DM@MCFNFDDJ@Context?5at?5?$CFp?5is?5possible?5hijack@
0x1800BD1D0: "_GetBuiltInProvidersPolicies" ??_C@_1DK@LDOMNLPE@?$AA_?$AAG?$AAe?$AAt?$AAB?$AAu?$AAi?$AAl?$AAt?$AAI?$AAn?$AAP?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AAs?$AAP?$AAo?$AAl?$AAi?$AAc?$AAi?$AAe?$AAs?$AA?$AA@
0x1800A8AD8: "__cdecl _imp_wcsrchr" __imp_wcsrchr
0x1800D3640: SampActiveEnumerationClientTableLock
0x1800BC550: "SclFsProcessVolume" ??_C@_0BD@KPIKJIJ@SclFsProcessVolume?$AA@
0x1800AA6D8: "EnumerationCachePurgeInterval" ??_C@_0BO@IPOLMFKM@EnumerationCachePurgeInterval?$AA@
0x1800B47E0: "Attested Key Property" ??_C@_1CM@LHICDKBB@?$AAA?$AAt?$AAt?$AAe?$AAs?$AAt?$AAe?$AAd?$AA?5?$AAK?$AAe?$AAy?$AA?5?$AAP?$AAr?$AAo?$AAp?$AAe?$AAr?$AAt?$AAy?$AA?$AA@
0x180032F78: "__cdecl _scrt_stub_for_acrt_uninitialize" __scrt_stub_for_acrt_uninitialize
0x18000C3C0: "__cdecl _scrt_stub_for_is_c_termination_complete" __scrt_stub_for_is_c_termination_complete
0x1800745A4: SampExtLookupObjectByRidDs
0x180032A2D: "__cdecl _tailMerge_api_ms_win_service_management_l1_1_0_dll" __tailMerge_api_ms_win_service_management_l1_1_0_dll
0x1800B5C38: "SamrSetPasswordComputer" ??_C@_0BI@GGHHAIPN@SamrSetPasswordComputer?$AA@
0x1800B5D38: "SamrSetBootKeyInformation" ??_C@_0BK@CMBJMDHN@SamrSetBootKeyInformation?$AA@
0x1800AABF0: "DirectoryServiceExtPt" ??_C@_1CM@ECLHNDOI@?$AAD?$AAi?$AAr?$AAe?$AAc?$AAt?$AAo?$AAr?$AAy?$AAS?$AAe?$AAr?$AAv?$AAi?$AAc?$AAe?$AAE?$AAx?$AAt?$AAP?$AAt?$AA?$AA@
0x1800B3D10: WPP_3866e9d507bf3668ca365addbfd0a9b4_Traceguids
0x1800925B8: SclRegProcessUpgradeRegistry
0x180023F00: SampIsRebootAfterPromotion
0x180002FC8: SampValidateRpcUnicodeString
0x1800B2970: SampChangePasswordComputerGuid
0x18004DA68: SampDeleteAliasMembershipKeysForAccount
0x1800B3470: "\Users\" ??_C@_1BA@FJJFMPFO@?$AA?2?$AAU?$AAs?$AAe?$AAr?$AAs?$AA?2?$AA?$AA@
0x1800D3780: SampActiveContextTableLock
0x1800663E0: SamrRemoveMemberFromForeignDomain
0x18000C2EC: SampValidateRPCProtSeq
0x1800DD208: "__cdecl _imp_NdrMesTypeAlignSize3" __imp_NdrMesTypeAlignSize3
0x180031ECA: "__cdecl _stdio_common_vswprintf_s" __stdio_common_vswprintf_s
0x1800BE9D0: "%s: Cert matching: %s" ??_C@_1CM@HBAMICBE@?$AA?$CF?$AAs?$AA?3?$AA?5?$AAC?$AAe?$AAr?$AAt?$AA?5?$AAm?$AAa?$AAt?$AAc?$AAh?$AAi?$AAn?$AAg?$AA?3?$AA?5?$AA?$CF?$AAs?$AA?$AA@
0x1800BCE28: "BUCL::Rtl::Add<TraitsT::TSize>(O" ??_C@_0DJ@FPNGAFPA@BUCL?3?3Rtl?3?3Add?$DMTraitsT?3?3TSize?$DO?$CIO@
0x1800B9B50: "FsSecureSDUpdateCount" ??_C@_1CM@IMPHNGDE@?$AAF?$AAs?$AAS?$AAe?$AAc?$AAu?$AAr?$AAe?$AAS?$AAD?$AAU?$AAp?$AAd?$AAa?$AAt?$AAe?$AAC?$AAo?$AAu?$AAn?$AAt?$AA?$AA@
0x1800A8798: "__cdecl _imp_NtQueryObject" __imp_NtQueryObject
0x1800BAF20: "(%lx): Failed to rename value [%" ??_C@_0CN@MJCICGOM@?$CI?$CFlx?$CJ?3?5Failed?5to?5rename?5value?5?$FL?$CF@
0x180054A04: SampBuildNewProtection
0x180074444: SampExtGetMembershipsDs
0x180066A60: SamrTestPrivateFunctionsDomain
0x1800A8578: "__cdecl _imp_bsearch_s" __imp_bsearch_s
0x18006BB34: SampSwitchLogFileIfNeeded
0x18006D490: SampSetPasswordInfoOnPdcByHandle
0x1800B5148: "Sam Domain Log Update for %s fai" ??_C@_0DD@IJEAJLGE@Sam?5Domain?5Log?5Update?5for?5?$CFs?5fai@
0x180099EAC: "public: static long __cdecl Logger::TraceWarning(unsigned short const * __ptr64,...)" ?TraceWarning@Logger@@SAJPEBGZZ
0x1800BA4C0: "Found and updated NULL GUID at p" ??_C@_0CM@CPBJPGKA@Found?5and?5updated?5NULL?5GUID?5at?5p@
0x18008D924: SclSecuritySetDescriptor
0x18000A240: SampRegReadExtendedAttribute
0x1800DD290: "__cdecl _imp_ConvertStringSecurityDescriptorToSecurityDescriptorW" __imp_ConvertStringSecurityDescriptorToSecurityDescriptorW
0x1800B4D70: "LH-BETA2 to LH-RC1-IDS1" ??_C@_0BI@JGACHMA@LH?9BETA2?5to?5LH?9RC1?9IDS1?$AA@
0x1800DD1F8: "__cdecl _imp_RpcStringBindingParseA" __imp_RpcStringBindingParseA
0x18003205C: "__cdecl vscwprintf" _vscwprintf
0x180086AAC: SampValidateByteArray
0x1800018D0: SamrGetMembersInAlias
0x1800746D8: SampExtPrepareToForwardDs
0x1800CC024: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-interlocked-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-interlocked-l1-1-0
0x1800B2B00: SampGetUserDomainPasswordInformationGuid
0x1800DD318: "__cdecl _imp_SetupCloseLog" __imp_SetupCloseLog
0x1800D20B0: UserExtendedToInternal6Mapping
0x18002F374: SampInitializeActiveContextTable
0x18001C6F0: SampGetSuccessAccountAuditingEnabled
0x1800B5DF0: "SampStartListeningOnRpcTransport" ??_C@_0EF@OKNFOIL@SampStartListeningOnRpcTransport@
0x1800D2C08: g_ulMaxStackAllocSize
0x1800CBF0C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0
0x1800B3250: "BLDSAM3: Error loading library -" ??_C@_0DA@HBGONHHL@BLDSAM3?3?5Error?5loading?5library?5?9@
0x18009B820: OSBODeleteDriverEntry
0x180032BB5: "__cdecl _imp_load_RpcSsDestroyClientContext" __imp_load_RpcSsDestroyClientContext
0x1800B97F0: "Number of registry keys renamed" ??_C@_1EA@HIMLDCDD@?$AAN?$AAu?$AAm?$AAb?$AAe?$AAr?$AA?5?$AAo?$AAf?$AA?5?$AAr?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?5?$AAk?$AAe?$AAy?$AAs?$AA?5?$AAr?$AAe?$AAn?$AAa?$AAm?$AAe?$AAd?$AA?$AA@
0x1800D3E08: SampDefaultDCRestrictRemoteAccessSDString
0x1800D3710: SampNullString
0x1800BB8D8: "(%lx): Failed to process user hi" ??_C@_0CJ@KIDNNJKH@?$CI?$CFlx?$CJ?3?5Failed?5to?5process?5user?5hi@
0x1800B42C0: SampSetPasswordInfoRequirements
0x1800997D4: "int __cdecl SafeFree(void * __ptr64)" ?SafeFree@@YAHPEAX@Z
0x180087C44: EasGetMinDevicePasswordComplexCharacters
0x1800BA3A8: "(%lx): Unable to enable privileg" ??_C@_0CI@NMLLCCMM@?$CI?$CFlx?$CJ?3?5Unable?5to?5enable?5privileg@
0x1800A8258: "__cdecl _imp_GetModuleHandleW" __imp_GetModuleHandleW
0x180069A40: SampRemoveSameDomainMemberFromGlobalOrUniversalGroup
0x180089170: PSAMPR_SERVER_NAME_unbind
0x180072990: SampAuditAccountNameChange
0x1800804F0: SamrGetDomainPasswordInformation
0x1800DD258: "__cdecl _imp_LsaOpenPolicy" __imp_LsaOpenPolicy
0x1800D5280: EfipModifyDriverEntry
0x1800A8028: "__cdecl _imp_LsaISetNewSyskey" __imp_LsaISetNewSyskey
0x18007495C: SampExtQueueReplicationRequestDs
0x180073FE0: SampExtDoFSMORoleChangeDs
0x1800B20C0: "SamReplicatePasswordsUrgently" ??_C@_0BO@LGNABMBH@SamReplicatePasswordsUrgently?$AA@
0x1800B8DB8: "SecureBoot" ??_C@_1BG@JEGAFCNI@?$AAS?$AAe?$AAc?$AAu?$AAr?$AAe?$AAB?$AAo?$AAo?$AAt?$AA?$AA@
0x180066AA0: SamrTestPrivateFunctionsUser
0x1800B3A38: "UPDATING" ??_C@_1BC@GGAGMCFA@?$AAU?$AAP?$AAD?$AAA?$AAT?$AAI?$AAN?$AAG?$AA?$AA@
0x1800BEBE0: "%s: Cannot unload reg key %s. Re" ??_C@_1JI@HKOPEJBB@?$AA?$CF?$AAs?$AA?3?$AA?5?$AAC?$AAa?$AAn?$AAn?$AAo?$AAt?$AA?5?$AAu?$AAn?$AAl?$AAo?$AAa?$AAd?$AA?5?$AAr?$AAe?$AAg?$AA?5?$AAk?$AAe?$AAy?$AA?5?$AA?$CF?$AAs?$AA?4?$AA?5?$AAR?$AAe@
0x1800B4948: "systemroot" ??_C@_1BG@MCEEPJDG@?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AAr?$AAo?$AAo?$AAt?$AA?$AA@
0x18007D400: SampCopyA2DFAttribute
0x1800080C0: SampIncrementActiveThreads
0x1800B95D8: SclEvent_Generic_Info
0x1800DD120: "__cdecl _imp_I_RpcMapWin32Status" __imp_I_RpcMapWin32Status
0x1800DD0A0: DSPARSE_NULL_THUNK_DATA_DLA
0x1800B3C00: "SampRegWriteExtendedAttribute fa" ??_C@_0EB@NKOJPEHG@SampRegWriteExtendedAttribute?5fa@
0x1800AA370: "Builtin" ??_C@_1BA@HGGOEJLE@?$AAB?$AAu?$AAi?$AAl?$AAt?$AAi?$AAn?$AA?$AA@
0x1800216F0: SamIInitializeWPPAndAutoLoggerSession
0x1800ABBC0: "%s: %s failed with error code: 0" ??_C@_1EO@PKKCGHHE@?$AA?$CF?$AAs?$AA?3?$AA?5?$AA?$CF?$AAs?$AA?5?$AAf?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAw?$AAi?$AAt?$AAh?$AA?5?$AAe?$AAr?$AAr?$AAo?$AAr?$AA?5?$AAc?$AAo?$AAd?$AAe?$AA?3?$AA?5?$AA0@
0x180061F9C: SampStoreCredentials
0x1800BC4C0: "Processing system hive [%ws]..." ??_C@_0CA@PECDIMEM@Processing?5system?5hive?5?$FL?$CFws?$FN?4?4?4?$AA@
0x180007810: SAM_MIDL_user_allocate
0x1800A8690: "__cdecl _imp_ControlTraceW" __imp_ControlTraceW
0x1800A8590: "__cdecl _imp__o_qsort_s" __imp__o_qsort_s
0x1800327FD: "__cdecl _imp_load_I_RpcBindingIsClientLocal" __imp_load_I_RpcBindingIsClientLocal
0x1800B1FC0: "SamDisableSingleObjectRepl" ??_C@_0BL@EIAPNLAL@SamDisableSingleObjectRepl?$AA@
0x1800D1A30: SampDomainUpdate_WinThresholdM3_TO_WinThresholdUpdate4_Parameter
0x180031E82: "__cdecl initterm_e" _initterm_e
0x1800DD158: "__cdecl _imp_RpcBindingVectorFree" __imp_RpcBindingVectorFree
0x1800B6CB0: "<Failed to convert GUID to strin" ??_C@_1EG@PCGONCMF@?$AA?$DM?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAc?$AAo?$AAn?$AAv?$AAe?$AAr?$AAt?$AA?5?$AAG?$AAU?$AAI?$AAD?$AA?5?$AAt?$AAo?$AA?5?$AAs?$AAt?$AAr?$AAi?$AAn@
0x18004FA20: SampAlRebuildMemberAliasList
0x18004DDE8: SampRemoveAccountFromAllAliases
0x1800AB83C: "," ??_C@_13DEFPDAGF@?$AA?0?$AA?$AA@
0x1800BD098: "LocalAlloc" ??_C@_1BG@CAMFAADD@?$AAL?$AAo?$AAc?$AAa?$AAl?$AAA?$AAl?$AAl?$AAo?$AAc?$AA?$AA@
0x18009D0BC: EfiTranslateFilePath
0x1800625C0: SampDuplicateUserInfo
0x180023B98: SampCheckRestrictRemoteAccess
0x180098BE0: "long __cdecl _RegValueToVariant(unsigned long,unsigned long,unsigned char const * __ptr64,struct tagPROPVARIANT * __ptr64)" ?_RegValueToVariant@@YAJKKPEBEPEAUtagPROPVARIANT@@@Z
0x1800D0ED0: DsWellKnownSecurityPrincipalsToAddBetween_LH_BETA2_And_LH_RC1_IDS1
0x1800B2B20: SampChangePasswordUserGuid
0x180060450: SamIFreeDecodedClaimsSet
0x1800A8678: api-ms-win-eventing-classicprovider-l1-1-0_NULL_THUNK_DATA
0x1800D3AFC: SampExtendedSidOptions
0x1800318A4: "__cdecl _scrt_release_startup_lock" __scrt_release_startup_lock
0x18000B1F4: SampObjectAttributeQualifier
0x1800BA128: "ExecutionSuccessful" ??_C@_1CI@GKJOPCOG@?$AAE?$AAx?$AAe?$AAc?$AAu?$AAt?$AAi?$AAo?$AAn?$AAS?$AAu?$AAc?$AAc?$AAe?$AAs?$AAs?$AAf?$AAu?$AAl?$AA?$AA@
0x1800B9F28: "ReparsePointUpdateCount" ??_C@_1DA@MDIPFNFI@?$AAR?$AAe?$AAp?$AAa?$AAr?$AAs?$AAe?$AAP?$AAo?$AAi?$AAn?$AAt?$AAU?$AAp?$AAd?$AAa?$AAt?$AAe?$AAC?$AAo?$AAu?$AAn?$AAt?$AA?$AA@
0x18008EC0C: SclRegCopyKeyHandleRecursive
0x1800AB1C8: "UserParmsConvert" ??_C@_0BB@HLOFJMGC@UserParmsConvert?$AA@
0x1800BB370: "(%lx): Failed to process reg key" ??_C@_0EC@PBDGBNAN@?$CI?$CFlx?$CJ?3?5Failed?5to?5process?5reg?5key@
0x1800B93B8: "POLICY\POLACDMS" ??_C@_1CA@PILJCOAJ@?$AAP?$AAO?$AAL?$AAI?$AAC?$AAY?$AA?2?$AAP?$AAO?$AAL?$AAA?$AAC?$AAD?$AAM?$AAS?$AA?$AA@
0x1800AFE60: "UserDontShowInLogonUI" ??_C@_1CM@FLEDJJCE@?$AAU?$AAs?$AAe?$AAr?$AAD?$AAo?$AAn?$AAt?$AAS?$AAh?$AAo?$AAw?$AAI?$AAn?$AAL?$AAo?$AAg?$AAo?$AAn?$AAU?$AAI?$AA?$AA@
0x18000AB30: SamrOpenAlias
0x18006B434: SampDebugDumpRoutine
0x18007750C: SampModifyAccountSecurity
0x1800D3E30: SampComponentUpdatesAccount
0x1800A9750: "\Registry\Machine\Security" ??_C@_1DG@MEEHFPFF@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?$AA@
0x1800905C0: SclRegRenameKey
0x1800976A8: "long __cdecl Windows::StringUtil::Rtl::AppendString<struct _LUNICODE_STRING,class Windows::AutoOperatorAmpersandHelper<struct _LUNICODE_STRING,class Detail::StaticStringAndBufferImpl<struct _LUNICODE_STRING,255> >,0>(struct _LUNICODE_STRING const & __ptr64,class Windows::AutoOperatorAmpersandHelper<struct _LUNICODE_STRING,class Detail::StaticStringAndBufferImpl<struct _LUNICODE_STRING,255> >)" ??$AppendString@U_LUNICODE_STRING@@V?$AutoOperatorAmpersandHelper@U_LUNICODE_STRING@@V?$StaticStringAndBufferImpl@U_LUNICODE_STRING@@$0PP@@Detail@@@Windows@@$0A@@Rtl@StringUtil@Windows@@YAJAEBU_LUNICODE_STRING@@V?$AutoOperatorAmpersandHelper@U_LUNICODE_STRING@@V?$StaticStringAndBufferImpl@U_LUNICODE_STRING@@$0PP@@Detail@@@2@@Z
0x1800A8570: "__cdecl _imp__o__wtoi" __imp__o__wtoi
0x180006090: SampRegReadExtendedAttributes
0x180002F40: SampMapNtStatusToClientRevision
0x1800AAB20: "SYSTEM\CurrentControlSet\Control" ??_C@_1FM@LNJAANCJ@?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA?2?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl@
0x1800AA510: "SYSTEM\CurrentControlSet\Control" ??_C@_1GC@DFINIPLB@?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA?2?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl@
0x1800A8B48: "__cdecl _imp_RtlImageNtHeader" __imp_RtlImageNtHeader
0x1800692B0: SampAddUserToGroup
0x18001D460: SampInvalidateDomainCache
0x1800A9838: "DOMAINS" ??_C@_1BA@PLKKIFMG@?$AAD?$AAO?$AAM?$AAA?$AAI?$AAN?$AAS?$AA?$AA@
0x1800BBB30: "WINDOWS\Panther\Excluded.hiv" ??_C@_1DK@JEMABNOH@?$AAW?$AAI?$AAN?$AAD?$AAO?$AAW?$AAS?$AA?2?$AAP?$AAa?$AAn?$AAt?$AAh?$AAe?$AAr?$AA?2?$AAE?$AAx?$AAc?$AAl?$AAu?$AAd?$AAe?$AAd?$AA?4?$AAh?$AAi?$AAv?$AA?$AA@
0x18004F1D0: SamrSetInformationAlias
0x180003590: SampCreateAccountContext2
0x1800B95A8: SclEvent_ExtendPartition_Start
0x1800B6680: "System\CurrentControlSet\Control" ??_C@_1GC@OPEDJIOF@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA?2?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl@
0x180018E80: StartSession
0x180009670: SampValidateRpcSID
0x18008699C: SampValidateAliasExtendedInformation
0x1800A8918: "__cdecl _imp_RtlDeleteResource" __imp_RtlDeleteResource
0x1800AA578: "CloudDomainJoinRoot" ??_C@_1CI@HGOADJBC@?$AAC?$AAl?$AAo?$AAu?$AAd?$AAD?$AAo?$AAm?$AAa?$AAi?$AAn?$AAJ?$AAo?$AAi?$AAn?$AAR?$AAo?$AAo?$AAt?$AA?$AA@
0x1800BC738: "(%lx): Failed NtOpenFile on [%ws" ??_C@_0CC@CNJAOAAK@?$CI?$CFlx?$CJ?3?5Failed?5NtOpenFile?5on?5?$FL?$CFws@
0x180026260: SampGetUserAccountSettings
0x1800254B4: SampExtSetGlobalTransactionTypeDs
0x1800316B8: "__cdecl _scrt_dllmain_uninitialize_critical" __scrt_dllmain_uninitialize_critical
0x1800DD128: "__cdecl _imp_I_RpcBindingInqLocalClientPID" __imp_I_RpcBindingInqLocalClientPID
0x18002E5A0: SampRegWriteExtendedAttributes
0x1800A8D90: ntdll_NULL_THUNK_DATA
0x180067630: SamrSyncDSRMPasswordFromAccount
0x1800A8628: "__cdecl _imp_memcpy" __imp_memcpy
0x180031ED6: "__cdecl o__callnewh" _o__callnewh
0x180074B98: SampExtRetrieveAccountCountsDs
0x1800B3FC0: "Failed to load both a credential" ??_C@_0EO@BFBKLLGA@Failed?5to?5load?5both?5a?5credential@
0x18002FF50: SamrGetAliasMembership
0x1800AFA58: "ServerDomainUpdates" ??_C@_1CI@CAECALHB@?$AAS?$AAe?$AAr?$AAv?$AAe?$AAr?$AAD?$AAo?$AAm?$AAa?$AAi?$AAn?$AAU?$AAp?$AAd?$AAa?$AAt?$AAe?$AAs?$AA?$AA@
0x1800B5410: "\Registry\Machine\System\Current" ??_C@_1HC@ECADLDKD@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1800A86B0: "__cdecl _imp_GetSecurityDescriptorDacl" __imp_GetSecurityDescriptorDacl
0x1800BCA90: "FixReparsePointPath: Ignoring re" ??_C@_1HK@LAFHPODA@?$AAF?$AAi?$AAx?$AAR?$AAe?$AAp?$AAa?$AAr?$AAs?$AAe?$AAP?$AAo?$AAi?$AAn?$AAt?$AAP?$AAa?$AAt?$AAh?$AA?3?$AA?5?$AAI?$AAg?$AAn?$AAo?$AAr?$AAi?$AAn?$AAg?$AA?5?$AAr?$AAe@
0x1800B95B8: SclEvent_DeterminedOldPath
0x1800D0D30: SampDomainUpdate_LHRC1_IDS1_TO_LHBETA3_Parameter
0x18007CE04: SampCheckAccountScrilStateByName
0x1800AA710: "MaxSamConnections" ??_C@_0BC@JCJJIFBL@MaxSamConnections?$AA@
0x18009D3BC: EFIDECreateDriverEntry
0x1800A8B98: "__cdecl _imp_RtlpNtSetValueKey" __imp_RtlpNtSetValueKey
0x1800AA390: "S-1-15-3-1024-1730716382-2949791" ??_C@_1MG@JKPADOPJ@?$AAS?$AA?9?$AA1?$AA?9?$AA1?$AA5?$AA?9?$AA3?$AA?9?$AA1?$AA0?$AA2?$AA4?$AA?9?$AA1?$AA7?$AA3?$AA0?$AA7?$AA1?$AA6?$AA3?$AA8?$AA2?$AA?9?$AA2?$AA9?$AA4?$AA9?$AA7?$AA9?$AA1@
0x1800D3600: SampTerminalServerSid
0x18000D2D0: SampObtainDomainPasswordPolicyWithDomainIndex
0x1800B59D8: "SamrGetAliasMembership" ??_C@_0BH@PABOLGIJ@SamrGetAliasMembership?$AA@
0x1800BF190: "%s: Extension was not found in t" ??_C@_1HE@NOJCBDKE@?$AA?$CF?$AAs?$AA?3?$AA?5?$AAE?$AAx?$AAt?$AAe?$AAn?$AAs?$AAi?$AAo?$AAn?$AA?5?$AAw?$AAa?$AAs?$AA?5?$AAn?$AAo?$AAt?$AA?5?$AAf?$AAo?$AAu?$AAn?$AAd?$AA?5?$AAi?$AAn?$AA?5?$AAt@
0x1800BD230: "onecore\ds\security\eas\policyen" ??_C@_1GA@IOAPFPJM@?$AAo?$AAn?$AAe?$AAc?$AAo?$AAr?$AAe?$AA?2?$AAd?$AAs?$AA?2?$AAs?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?2?$AAe?$AAa?$AAs?$AA?2?$AAp?$AAo?$AAl?$AAi?$AAc?$AAy?$AAe?$AAn@
0x18000E6A0: SampCreateAccountSid
0x1800B4E38: "WinThreshold-M2 to WinThreshold-" ??_C@_0CE@BFKIINGJ@WinThreshold?9M2?5to?5WinThreshold?9@
0x1800B44F8: "Terminal Server User" ??_C@_1CK@ILOFNHFA@?$AAT?$AAe?$AAr?$AAm?$AAi?$AAn?$AAa?$AAl?$AA?5?$AAS?$AAe?$AAr?$AAv?$AAe?$AAr?$AA?5?$AAU?$AAs?$AAe?$AAr?$AA?$AA@
0x1800762E4: WPP_SF_Ddd
0x180078E9C: WPP_SF_DDD
0x1800BA430: "Detected system firmware type = " ??_C@_0CF@PFGJIFO@Detected?5system?5firmware?5type?5?$DN?5@
0x1800A89A8: "__cdecl _imp_RtlGetProductInfo" __imp_RtlGetProductInfo
0x18001E0C0: SampPasswordChangeNotifyWorker
0x18007DB70: SampDsChangePasswordUser
0x180088D5C: IsLocalServerName
0x1800B4BE8: "SampAddWellKnownAccounts: alread" ??_C@_0DI@DEHCBPGK@SampAddWellKnownAccounts?3?5alread@
0x1800AFF80: "SamSS " ??_C@_08FMFLBJNM@SamSS?5?5?5?$AA@
0x1800BD448: "ComputeTracingDirectoryPath fail" ??_C@_0CD@NACDBACE@ComputeTracingDirectoryPath?5fail@
0x18006D01C: SampRaiseObjectChangeNotificationEvents
0x1800A8928: "__cdecl _imp_LdrUnloadDll" __imp_LdrUnloadDll
0x1800B65F0: "Forwarded secure channel passwor" ??_C@_0DP@NOGMNPPM@Forwarded?5secure?5channel?5passwor@
0x1800A8878: "__cdecl _imp_EtwEventUnregister" __imp_EtwEventUnregister
0x1800D1ED0: UserExtendedAttributesInformation
0x18006BC7C: SamICheckForUserPasswordExpiration
0x180032F78: "__cdecl _scrt_stub_for_acrt_uninitialize_critical" __scrt_stub_for_acrt_uninitialize_critical
0x18000E8C8: SampExtAuditUpdateAuditNotificationDs
0x1800A8218: "__cdecl _imp_GetComputerNameW" __imp_GetComputerNameW
0x1800A8988: "__cdecl _imp_RtlTimeToTimeFields" __imp_RtlTimeToTimeFields
0x1800A8C90: "__cdecl _imp_NtQuerySystemTime" __imp_NtQuerySystemTime
0x18001F170: SampRetrieveUserMembership
0x1800D3E70: g_SampEventProviderRegistrationHandle
0x18000F130: SamIGetResourceGroupMembershipsTransitive2
0x1800330C8: "public: void __cdecl SP<unsigned char,class SP_MEM<unsigned char> >::Reset(void) __ptr64" ?Reset@?$SP@EV?$SP_MEM@E@@@@QEAAXXZ
0x1800011F0: SampConvertAttrValBlockToUnicodeString
0x1800BA878: "(%lx): Failed to open subkey '%w" ??_C@_0CD@JIICDJCE@?$CI?$CFlx?$CJ?3?5Failed?5to?5open?5subkey?5?8?$CFw@
0x1800B2DF0: SAMMSG_NOTIFICATION_PASSWORD_LEGACY_MODE_ENABLED
0x1800A99B0: " ,. -_#" ??_C@_1BA@MDNDMIHL@?$AA?5?$AA?0?$AA?4?$AA?7?$AA?9?$AA_?$AA?$CD?$AA?$AA@
0x180032347: "__cdecl _imp_load_NdrMesTypeFree3" __imp_load_NdrMesTypeFree3
0x1800A8040: "__cdecl _imp_LsaIAuditNotifyPackageLoad" __imp_LsaIAuditNotifyPackageLoad
0x1800A80C0: LSASRV_NULL_THUNK_DATA
0x1800014A0: SampActiveContextTableCompare
0x180060040: SamIClaimIsValid
0x18006E460: CompareULONG
0x180023E50: SampCheckNullSessionAccess
0x1800A85A0: "__cdecl _imp__o_wcscpy_s" __imp__o_wcscpy_s
0x1800B3D00: "uuuud" ??_C@_1M@CDLIOCHK@?$AAu?$AAu?$AAu?$AAu?$AAd?$AA?$AA@
0x1800B57D0: "Unmapped Error" ??_C@_1BO@IDKKLMC@?$AAU?$AAn?$AAm?$AAa?$AAp?$AAp?$AAe?$AAd?$AA?5?$AAE?$AAr?$AAr?$AAo?$AAr?$AA?$AA@
0x1800BD290: "RegQueryInfoKey" ??_C@_1CA@EPOOGCJD@?$AAR?$AAe?$AAg?$AAQ?$AAu?$AAe?$AAr?$AAy?$AAI?$AAn?$AAf?$AAo?$AAK?$AAe?$AAy?$AA?$AA@
0x180097F38: "unsigned long __cdecl FsnpDowncaseChar(unsigned long)" ?FsnpDowncaseChar@@YAKK@Z
0x1800B43B0: "Creator Group" ??_C@_1BM@LIMJCFP@?$AAC?$AAr?$AAe?$AAa?$AAt?$AAo?$AAr?$AA?5?$AAG?$AAr?$AAo?$AAu?$AAp?$AA?$AA@
0x180084890: SamISetAuditingInformation
0x1800D2BF8: "__cdecl _hmod__CRYPTSP_dll" __hmod__CRYPTSP_dll
0x1800B8DB0: "Pattern" ??_C@_07NOCIGAPP@Pattern?$AA@
0x18000B2C4: SampEnumerateAccountNamesCommon
0x18009D824: OSDriverSetNtPath
0x1800CBE30: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0
0x18000B70C: SampGetCurrentClientSid
0x1800AFDA8: "LastFailedInterLogonTime" ??_C@_1DC@GBCKNEPB@?$AAL?$AAa?$AAs?$AAt?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AAI?$AAn?$AAt?$AAe?$AAr?$AAL?$AAo?$AAg?$AAo?$AAn?$AAT?$AAi?$AAm?$AAe?$AA?$AA@
0x1800A8B20: "__cdecl _imp_NtQueryAttributesFile" __imp_NtQueryAttributesFile
0x180078EFC: WPP_SF_DDDD
0x1800A8A08: "__cdecl _imp_NtImpersonateAnonymousToken" __imp_NtImpersonateAnonymousToken
0x180086E48: SampValidateLogonHours
0x180050EA0: WPP_SF_qLqi
0x1800B9698: SclEvent_DeterminedOldSid
0x1800B30E0: "RepairAdmin" ??_C@_1BI@DBKMNPPJ@?$AAR?$AAe?$AAp?$AAa?$AAi?$AAr?$AAA?$AAd?$AAm?$AAi?$AAn?$AA?$AA@
0x180078D40: SamrConnect3
0x1800B5B78: "SamrGetMembersInAlias" ??_C@_0BG@GEOMKABM@SamrGetMembersInAlias?$AA@
0x1800B5BB0: "SamrQueryInformationUser" ??_C@_0BJ@DGPKDFC@SamrQueryInformationUser?$AA@
0x1800ABC90: WarningDebugEvent
0x1800A8000: "__cdecl _imp_CertFindExtension" __imp_CertFindExtension
0x18008497C: SampBuildAccountSubKeyName
0x1800A8618: "__cdecl _imp___CxxFrameHandler3" __imp___CxxFrameHandler3
0x1800B6D90: "SampValidateLastLogonTimestampAr" ??_C@_0DD@JGANKKPE@SampValidateLastLogonTimestampAr@
0x1800D2B98: "__cdecl _hmod__api_ms_win_security_sddl_ansi_l1_1_0_dll" __hmod__api_ms_win_security_sddl_ansi_l1_1_0_dll
0x1800326BE: "__cdecl _imp_load_WSAStartup" __imp_load_WSAStartup
0x1800BB150: "Partition extension not needed." ??_C@_0CA@NGALIGNI@Partition?5extension?5not?5needed?4?$AA@
0x1800A89C8: "__cdecl _imp_RtlAreAllAccessesGranted" __imp_RtlAreAllAccessesGranted
0x1800A80C8: "__cdecl _imp_ApiSetQueryApiSetPresence" __imp_ApiSetQueryApiSetPresence
0x1800D1C20: "__cdecl _security_cookie" __security_cookie
0x180015AB0: SampFreeAttributeBlock
0x180076548: WPP_SF_S_sid_SSDd
0x1800BB3E0: "(%lx): Failure during enumeratio" ??_C@_0CO@KFMOCKEM@?$CI?$CFlx?$CJ?3?5Failure?5during?5enumeratio@
0x1800A83A8: "__cdecl _imp_RegQueryValueExW" __imp_RegQueryValueExW
0x1800889B4: SampCreateNewHandle
0x1800D2C10: g_pfnAllocate
0x1800283E8: KEDecryptDataWithAES
0x1800B63D0: "UserId: 0x%x Successful interact" ??_C@_0EB@OFBEKCE@UserId?3?50x?$CFx?5Successful?5interact@
0x1800ABCC0: "JoinStatusStorage::JoinStatusReg" ??_C@_1HM@KGIPFGEC@?$AAJ?$AAo?$AAi?$AAn?$AAS?$AAt?$AAa?$AAt?$AAu?$AAs?$AAS?$AAt?$AAo?$AAr?$AAa?$AAg?$AAe?$AA?3?$AA?3?$AAJ?$AAo?$AAi?$AAn?$AAS?$AAt?$AAa?$AAt?$AAu?$AAs?$AAR?$AAe?$AAg@
0x180029CA0: SampRetrieveUserLogonHours
0x180073CF8: SampExtAddNonLocalDomainRelativeMembershipsDs
0x1800332A0: "__cdecl alloca_probe" _alloca_probe
0x1800BABA0: "(%lx): Failed to enumerate sourc" ??_C@_0CO@BBBAMEG@?$CI?$CFlx?$CJ?3?5Failed?5to?5enumerate?5sourc@
0x1800DD1B8: "__cdecl _imp_RpcBindingToStringBindingA" __imp_RpcBindingToStringBindingA
0x1800D2B78: "__cdecl _hmod__NETLOGON_dll" __hmod__NETLOGON_dll
0x1800B2F60: SAMMSG_ERROR_SET_USERPARMS
0x180030670: SampBuildAliasMembersKeyName
0x1800B6980: InvalidDsAttributeTable
0x1800B3AE0: "NOT EMPTY" ??_C@_1BE@PGGMBCMP@?$AAN?$AAO?$AAT?$AA?5?$AAE?$AAM?$AAP?$AAT?$AAY?$AA?$AA@
0x1800A9A20: SampFixedAttributeInfo
0x180031A9C: "__cdecl _scrt_fastfail" __scrt_fastfail
0x1800A85E8: "__cdecl _imp__o___stdio_common_vswprintf_s" __imp__o___stdio_common_vswprintf_s
0x1800A86E0: "__cdecl _imp_CheckTokenMembership" __imp_CheckTokenMembership
0x180001510: SamDsExtFree
0x18000F8B0: SamIRetrieveMultiplePrimaryCredentials
0x18000A354: SampIsInternetAccount
0x1800B4DD0: "WIN7-RC to WIN8-RPM" ??_C@_0BE@FNOIGOAG@WIN7?9RC?5to?5WIN8?9RPM?$AA@
0x1800B6158: "System Schema Version" ??_C@_1CM@IENJHADH@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?5?$AAS?$AAc?$AAh?$AAe?$AAm?$AAa?$AA?5?$AAV?$AAe?$AAr?$AAs?$AAi?$AAo?$AAn?$AA?$AA@
0x18001C2B0: SampGetDnsDomainNameFromIndex
0x1800AA310: "%s\%s.etl" ??_C@_1BE@LPAGGJIB@?$AA?$CF?$AAs?$AA?2?$AA?$CF?$AAs?$AA?4?$AAe?$AAt?$AAl?$AA?$AA@
0x1800AAA78: "SamrPerformGenericOperation" ??_C@_1DI@BBNENMOJ@?$AAS?$AAa?$AAm?$AAr?$AAP?$AAe?$AAr?$AAf?$AAo?$AAr?$AAm?$AAG?$AAe?$AAn?$AAe?$AAr?$AAi?$AAc?$AAO?$AAp?$AAe?$AAr?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x1800B4DE8: "WIN8-RPM to Win8-BETA" ??_C@_0BG@OIPIBDFK@WIN8?9RPM?5to?5Win8?9BETA?$AA@
0x180061B94: SampInvalidateObjectContexts
0x18000FE70: SampDsSetPasswordUser
0x180032BA3: "__cdecl _imp_load_WSAStringToAddressA" __imp_load_WSAStringToAddressA
0x1800D0E70: SampDomainUpdate_WS03RTM_TO_LHIDS1_Parameter
0x1800B35A0: "Decode" ??_C@_1O@GKCGKCND@?$AAD?$AAe?$AAc?$AAo?$AAd?$AAe?$AA?$AA@
0x18002DB44: SampCopyAttrVal
0x18006E47C: RtlStringCbCatNW
0x1800CBDCC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-crt-runtime-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-crt-runtime-l1-1-0
0x1800BD358: "_RegValueToVariant" ??_C@_1CG@JBDAJCEO@?$AA_?$AAR?$AAe?$AAg?$AAV?$AAa?$AAl?$AAu?$AAe?$AAT?$AAo?$AAV?$AAa?$AAr?$AAi?$AAa?$AAn?$AAt?$AA?$AA@
0x1800A81C0: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x1800BBCC0: "Error saving excluded key [%ws] " ??_C@_0DN@LBCHIDJG@Error?5saving?5excluded?5key?5?$FL?$CFws?$FN?5@
0x1800A8688: "__cdecl _imp_EnableTraceEx2" __imp_EnableTraceEx2
0x180078B30: WPP_SF__sid_S
0x1800A83F0: "__cdecl _imp_RtlCompareMemory" __imp_RtlCompareMemory
0x1800859C0: SampGetDisableRSOOnPDCForward
0x1800BA200: "(%lx): Failed to expand [%ws]!" ??_C@_0BP@JMCFFPCJ@?$CI?$CFlx?$CJ?3?5Failed?5to?5expand?5?$FL?$CFws?$FN?$CB?$AA@
0x1800CC09C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-eventing-controller-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-eventing-controller-l1-1-0
0x1800AA640: "SamLogSize" ??_C@_0L@IIGBFHDB@SamLogSize?$AA@
0x1800B4FF0: "Unable to query security object " ??_C@_0CG@FOEJKPIP@Unable?5to?5query?5security?5object?5@
0x1800A81F8: "__cdecl _imp_LocalFree" __imp_LocalFree
0x1800BAC50: "(%lx): Failed to set destination" ??_C@_0CM@NJKBIBPP@?$CI?$CFlx?$CJ?3?5Failed?5to?5set?5destination@
0x1800BC5D0: "The version of the current (host" ??_C@_0DA@OBFFBFNK@The?5version?5of?5the?5current?5?$CIhost@
0x1800BD710: "%s: Cannot read registry key val" ??_C@_1IA@BNFJADID@?$AA?$CF?$AAs?$AA?3?$AA?5?$AAC?$AAa?$AAn?$AAn?$AAo?$AAt?$AA?5?$AAr?$AAe?$AAa?$AAd?$AA?5?$AAr?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?5?$AAk?$AAe?$AAy?$AA?5?$AAv?$AAa?$AAl@
0x18006A5C0: SamrQueryInformationGroup
0x1800869E4: SampValidateGroupGeneralInformation
0x1800721A0: SampSetSafeModeAdminPassword
0x1800A86B8: "__cdecl _imp_GetLengthSid" __imp_GetLengthSid
0x180018D3C: ValidateLogFilename
0x1800A8AF8: "__cdecl _imp_NtUnloadKey" __imp_NtUnloadKey
0x1800B4910: "SampIsRebootAfterPromotion: Prom" ??_C@_0DF@MOKOAMCO@SampIsRebootAfterPromotion?3?5Prom@
0x1800BE250: "Logger::WriteNullOrEmptyParamete" ??_C@_1FM@DCKPGCPK@?$AAL?$AAo?$AAg?$AAg?$AAe?$AAr?$AA?3?$AA?3?$AAW?$AAr?$AAi?$AAt?$AAe?$AAN?$AAu?$AAl?$AAl?$AAO?$AAr?$AAE?$AAm?$AAp?$AAt?$AAy?$AAP?$AAa?$AAr?$AAa?$AAm?$AAe?$AAt?$AAe@
0x180061C68: SampLocateObject
0x1800A8838: "__cdecl _imp_NtDeleteKey" __imp_NtDeleteKey
0x180032A21: "__cdecl _imp_load_OpenServiceW" __imp_load_OpenServiceW
0x1800CBE44: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0
0x1800A8210: api-ms-win-core-interlocked-l1-1-0_NULL_THUNK_DATA
0x180027184: "int __cdecl EASIsEnabled(void * __ptr64)" ?EASIsEnabled@@YAHPEAX@Z
0x1800A86F0: "__cdecl _imp_GetIdentityProviderInfoByName" __imp_GetIdentityProviderInfoByName
0x1800B4DB8: "LH-RTM to WIN7-RC" ??_C@_0BC@MDGKLJLF@LH?9RTM?5to?5WIN7?9RC?$AA@
0x1800BAF98: "SclpGrowPartition" ??_C@_0BC@PECDHCGM@SclpGrowPartition?$AA@
0x1800D5270: EfipSetBootOptions
0x180032280: "__cdecl _tailMerge_rpcrt4_dll" __tailMerge_rpcrt4_dll
0x180032D14: "__cdecl _imp_load_SetupOpenLog" __imp_load_SetupOpenLog
0x180029E48: RtlUIntAdd
0x1800B5980: "SamrEnumerateUsersInDomain" ??_C@_0BL@DCDLDLCC@SamrEnumerateUsersInDomain?$AA@
0x1800B3740: "SamIConvertSecurityAttributesToC" ??_C@_0EH@HBPCMBDA@SamIConvertSecurityAttributesToC@
0x1800BC380: "\REGISTRY\MACHINE\SOFTWARE\MICRO" ??_C@_1JG@KIFOEFMJ@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAI?$AAC?$AAR?$AAO@
0x1800150E0: SampStoreDsObjectAttributes
0x180068140: SampConvertByteArrayToAttrValBlock
0x1800A8630: api-ms-win-crt-private-l1-1-0_NULL_THUNK_DATA
0x1800A8160: "__cdecl _imp_FindFirstFileExW" __imp_FindFirstFileExW
0x1800DD0B0: "__cdecl _imp_I_NetNotifyDelta" __imp_I_NetNotifyDelta
0x1800D3E48: g_SampEventProviderRegistrationCS
0x18003292A: "__cdecl _imp_load_SystemFunction029" __imp_load_SystemFunction029
0x18000248C: SampLookupAccountRidRegistry
0x1800B3F50: "Loaded callout %Z mapped to %Z f" ??_C@_0DG@JLDFKKBJ@Loaded?5callout?5?$CFZ?5mapped?5to?5?$CFZ?5f@
0x180099A94: "public: static long __cdecl DeviceRegistrationStateApi::IsJoined(unsigned short const * __ptr64,enum _JOIN_TYPE,int * __ptr64,int * __ptr64,struct _CERT_CONTEXT const * __ptr64 * __ptr64)" ?IsJoined@DeviceRegistrationStateApi@@SAJPEBGW4_JOIN_TYPE@@PEAH2PEAPEBU_CERT_CONTEXT@@@Z
0x1800B3B50: "SampEnumerateAccountNames: ret T" ??_C@_0IE@FIADAMAM@SampEnumerateAccountNames?3?5ret?5T@
0x1800AFCC0: "InternetProviderName" ??_C@_1CK@BAANMOCJ@?$AAI?$AAn?$AAt?$AAe?$AAr?$AAn?$AAe?$AAt?$AAP?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x1800BB640: "SclRegProcessValue" ??_C@_0BD@HAGCNLLM@SclRegProcessValue?$AA@
0x1800A8B38: "__cdecl _imp_DbgPrintEx" __imp_DbgPrintEx
0x180001240: SamIFreeRealmList
0x1800188B4: SampDsGetDomainInfo
0x18000C268: SampCheckRpcCallerIsMemberOf_RPC_STATUS
0x180009C40: SampRevertToSelf
0x1800A8950: "__cdecl _imp_RtlAbortRXact" __imp_RtlAbortRXact
0x18000A9A4: SampValidateDomainModifiedInformation
0x18004D8A0: SampDeleteAliasKeys
0x1800A83A0: "__cdecl _imp_RegCreateKeyExA" __imp_RegCreateKeyExA
0x180070560: SampComponentUpdatesRegistryWatch
0x1800BB0D8: "(%lx): Unable to get file system" ??_C@_0DD@EEHKHMML@?$CI?$CFlx?$CJ?3?5Unable?5to?5get?5file?5system@
0x1800B2BB0: SampLookupDomainInSamServerGuid
0x180076C18: SampGetNewAccountSecurity
0x1800B2960: SampGetDisplayEnumerationIndexGuid
0x180032CAC: "__cdecl _imp_load_NdrClientCall3" __imp_load_NdrClientCall3
0x180026D00: SampLoadDsExtensionDll
0x1800A8378: "__cdecl _imp_RegCreateKeyExW" __imp_RegCreateKeyExW
0x1800D3F50: SampReplicatePasswordsUrgently
0x1800AA338: "%windir%\system32\LogFiles" ??_C@_1DG@DHBHCMKA@?$AA?$CF?$AAw?$AAi?$AAn?$AAd?$AAi?$AAr?$AA?$CF?$AA?2?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAL?$AAo?$AAg?$AAF?$AAi?$AAl?$AAe?$AAs?$AA?$AA@
0x180018B14: QueryAndSortOldLogFiles
0x180072FAC: SampAuditGroupDelete
0x1800D3BE0: SamLockCurrentHoldStartTime
0x1800AFAE0: "AliasShellAdminObjectProperties" ??_C@_1EA@LPOMCHEB@?$AAA?$AAl?$AAi?$AAa?$AAs?$AAS?$AAh?$AAe?$AAl?$AAl?$AAA?$AAd?$AAm?$AAi?$AAn?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAP?$AAr?$AAo?$AAp?$AAe?$AAr?$AAt?$AAi?$AAe?$AAs?$AA?$AA@
0x1800B5018: "Unable to modify security object" ??_C@_0CH@JDMBBPGL@Unable?5to?5modify?5security?5object@
0x1800DD168: "__cdecl _imp_I_RpcBindingIsClientLocal" __imp_I_RpcBindingIsClientLocal
0x180079000: WPP_SF__sid_
0x1800681C0: SampConvertGuidToAttrValBlock
0x18009D024: EfiQueryDriverEntryOrder
0x1800A8600: "__cdecl _imp__o___std_type_info_destroy_list" __imp__o___std_type_info_destroy_list
0x1800B2ED0: SAMMSG_CREDENTIAL_UPDATE_PKG_FAILED
0x1800B9038: "Marking event [&SclEvent_ResetDi" ??_C@_0DD@MICEBOHG@Marking?5event?5?$FL?$CGSclEvent_ResetDi@
0x1800BA948: "(%lx): Failed to unload key: [%w" ??_C@_0CD@GBJKJOM@?$CI?$CFlx?$CJ?3?5Failed?5to?5unload?5key?3?5?$FL?$CFw@
0x1800B6E78: "CheckIfLocalAdmin failed with 0x" ??_C@_0CE@BPLIPCO@CheckIfLocalAdmin?5failed?5with?50x@
0x1800D3F80: SampRODCRegistryWatchEvent
0x18009AB9C: "public: static long __cdecl CertificateUtil::FindExtensionStrValueByOid(char const * __ptr64,struct _CERT_CONTEXT const * __ptr64,unsigned short * __ptr64 * __ptr64)" ?FindExtensionStrValueByOid@CertificateUtil@@SAJPEBDPEBU_CERT_CONTEXT@@PEAPEAG@Z
0x1800A89E8: "__cdecl _imp_RtlGetCompressionWorkSpaceSize" __imp_RtlGetCompressionWorkSpaceSize
0x18000C500: SampRenameKrbtgtAccount
0x1800BF740: "NtQueryBootEntryOrder" ??_C@_0BG@FFOKBEJH@NtQueryBootEntryOrder?$AA@
0x180012DD0: SampEncryptCredentialData
0x180068898: SampRegEnforceConsistencyInternetProviderName
0x1800AA980: "\Registry\Machine\System\Setup" ??_C@_1DO@PGOAJPNE@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAS?$AAe?$AAt?$AAu?$AAp?$AA?$AA@
0x18008D3B0: SclDuplicateSid
0x1800B9E30: "FsMftSDProcessCount" ??_C@_1CI@GBFLGKKP@?$AAF?$AAs?$AAM?$AAf?$AAt?$AAS?$AAD?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AAC?$AAo?$AAu?$AAn?$AAt?$AA?$AA@
0x1800BEC78: "%s: reg key "%s" unloaded." ??_C@_1DG@GKOHELII@?$AA?$CF?$AAs?$AA?3?$AA?5?$AAr?$AAe?$AAg?$AA?5?$AAk?$AAe?$AAy?$AA?5?$AA?$CC?$AA?$CF?$AAs?$AA?$CC?$AA?5?$AAu?$AAn?$AAl?$AAo?$AAa?$AAd?$AAe?$AAd?$AA?4?$AA?$AA@
0x180085B80: SampIsServiceRunning
0x1800B91B0: "Marking event [&SclEvent_Process" ??_C@_0DA@CJDGBBAL@Marking?5event?5?$FL?$CGSclEvent_Process@
0x1800AB880: "WinSta0" ??_C@_1BA@IMLGMNLL@?$AAW?$AAi?$AAn?$AAS?$AAt?$AAa?$AA0?$AA?$AA@
0x1800D1C30: "__cdecl _isa_available" __isa_available
0x1800B9688: SclEvent_RetargetLinks_Start
0x1800A8048: "__cdecl _imp_LsaIChangeSecretCipherKey" __imp_LsaIChangeSecretCipherKey
0x18001C460: SampBuildAliasNameCacheCallback
0x18006E8B0: SamIReplaceDownlevelDatabase
0x1800B2FE0: SAMMSG_REMOTE_SAM_AUDIT_MODE_ENABLED_ACCESS_NOT_DENIED
0x1800D3D40: "private: static class CEasPolicySettings CEasPolicySettings::EasPolicySettings" ?EasPolicySettings@CEasPolicySettings@@0V1@A
0x1800A87B0: "__cdecl _imp_RtlAllocateAndInitializeSid" __imp_RtlAllocateAndInitializeSid
0x1800BD330: "Invalid policy id" ??_C@_1CE@KBMLBKID@?$AAI?$AAn?$AAv?$AAa?$AAl?$AAi?$AAd?$AA?5?$AAp?$AAo?$AAl?$AAi?$AAc?$AAy?$AA?5?$AAi?$AAd?$AA?$AA@
0x1800BB6D0: "(%lx): Could not allocate memory" ??_C@_0CC@NBBJDCKK@?$CI?$CFlx?$CJ?3?5Could?5not?5allocate?5memory@
0x1800B4368: "MISCCREDDATA" ??_C@_0N@ENNLCCGL@MISCCREDDATA?$AA@
0x180028B64: SampIsDataEncrypted
0x1800887F8: SamQueryInformationDomain
0x1800BB5C8: "SclRegProcessKeyValues" ??_C@_0BH@EFLILPPK@SclRegProcessKeyValues?$AA@
0x18004F564: WPP_SF_qL
0x18001C360: SampIsAccountBuiltIn
0x1800A88B0: "__cdecl _imp_RtlStringFromGUID" __imp_RtlStringFromGUID
0x180063980: SamIDoFSMORoleChange
0x1800A8098: "__cdecl _imp_LsaINoConnectedUserPolicy" __imp_LsaINoConnectedUserPolicy
0x180074CE8: SampExtSetLastLogonTimestampOnDcWorkerDs
0x180097874: "long __cdecl Windows::StringUtil::Rtl::SubStringByCharCount<struct _LUNICODE_STRING>(struct _LUNICODE_STRING const & __ptr64,unsigned __int64,unsigned __int64,struct _LUNICODE_STRING * __ptr64)" ??$SubStringByCharCount@U_LUNICODE_STRING@@@Rtl@StringUtil@Windows@@YAJAEBU_LUNICODE_STRING@@_K1PEAU3@@Z
0x18004F564: WPP_SF_qD
0x1800AFF40: SampAlEnableBuildingOfList
0x1800BAB58: "Copying [%ws]" ??_C@_0O@PHNIGGDM@Copying?5?$FL?$CFws?$FN?$AA@
0x1800D2198: SampAboutToShutdownEventHandle
0x1800DD198: "__cdecl _imp_RpcRevertToSelf" __imp_RpcRevertToSelf
0x18001F41C: SampAlBuildAliasInformation
0x1800A8A00: "__cdecl _imp_DbgPrint" __imp_DbgPrint
0x18000EA10: SampCreateAliasInDomain
0x180079324: WPP_SF_qZ
0x1800A8138: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x1800AB610: "__cdecl _sz_api_ms_win_service_winsvc_l1_1_0_dll" __sz_api_ms_win_service_winsvc_l1_1_0_dll
0x180012EC0: SampStoreUserPasswords
0x180076C60: SampGetNewAccountSecurityNt4
0x1800DD1F0: "__cdecl _imp_RpcStringFreeA" __imp_RpcStringFreeA
0x1800C84B8: api-ms-win-security-sddl-l1-1-0_NULL_THUNK_DATA_DLN
0x1800D3460: SampEnterpriseDomainControllersSid
0x1800B3AD0: "EMPTY" ??_C@_1M@DDJCIMGP@?$AAE?$AAM?$AAP?$AAT?$AAY?$AA?$AA@
0x1800D3FEB: SampHasFlushedNetlogonChangeNumbers
0x18000A9A4: SampValidateDomainServerRoleInformation
0x1800B9B80: "Number of $Secure security descr" ??_C@_1FM@HEPPJLAB@?$AAN?$AAu?$AAm?$AAb?$AAe?$AAr?$AA?5?$AAo?$AAf?$AA?5?$AA$?$AAS?$AAe?$AAc?$AAu?$AAr?$AAe?$AA?5?$AAs?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?5?$AAd?$AAe?$AAs?$AAc?$AAr@
0x180030E44: "__cdecl _local_stdio_scanf_options" __local_stdio_scanf_options
0x180086FFC: SampValidateRpcString
0x1800BEA00: "CurrentUser" ??_C@_1BI@IMBMKFIK@?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAU?$AAs?$AAe?$AAr?$AA?$AA@
0x18008BDC8: SclFreeRequest
0x1800A8380: "__cdecl _imp_RegQueryInfoKeyA" __imp_RegQueryInfoKeyA
0x1800AB4F0: "__cdecl _sz_api_ms_win_security_sddl_ansi_l1_1_0_dll" __sz_api_ms_win_security_sddl_ansi_l1_1_0_dll
0x1800B5910: "SamrCreateGroupInDomain" ??_C@_0BI@NLLOOEOK@SamrCreateGroupInDomain?$AA@
0x1800A8368: "__cdecl _imp_RegOpenKeyExA" __imp_RegOpenKeyExA
0x1800D0F10: SampDomainUpdate_WinBLUEMP_TO_WinThresholdM2_Parameter
0x18001B2B0: SampUpdateMixedModeAndFindDomain
0x1800BBA38: "SclpMigrateHive" ??_C@_0BA@OPHFIFCK@SclpMigrateHive?$AA@
0x1800B65B0: "SamrUnicodeChangePasswordUser3" ??_C@_1DO@CKPKIILF@?$AAS?$AAa?$AAm?$AAr?$AAU?$AAn?$AAi?$AAc?$AAo?$AAd?$AAe?$AAC?$AAh?$AAa?$AAn?$AAg?$AAe?$AAP?$AAa?$AAs?$AAs?$AAw?$AAo?$AAr?$AAd?$AAU?$AAs?$AAe?$AAr?$AA3?$AA?$AA@
0x18008AC60: SclRequestIsValid
0x18000BA40: QueryIsClientUsingLRPC
0x180032D20: "__cdecl _tailMerge_ext_ms_win_setupapi_logging_l1_1_0_dll" __tailMerge_ext_ms_win_setupapi_logging_l1_1_0_dll
0x1800A82A0: api-ms-win-core-privateprofile-l1-1-0_NULL_THUNK_DATA
0x180032CC0: IsSetupCloseLogPresent
0x180060B3C: SampFillOneSecurityAttribute
0x180069F30: SamrDeleteGroup
0x1800B3E80: "Loading notification package: %w" ??_C@_0CD@POCBFLJG@Loading?5notification?5package?3?5?$CFw@
0x1800A8580: "__cdecl _imp__o_free" __imp__o_free
0x1800A8390: "__cdecl _imp_RegOpenKeyExW" __imp_RegOpenKeyExW
0x1800A8528: "__cdecl _imp__o__initialize_onexit_table" __imp__o__initialize_onexit_table
0x1800B98E0: "Number of registry values rename" ??_C@_1EE@IINABKJD@?$AAN?$AAu?$AAm?$AAb?$AAe?$AAr?$AA?5?$AAo?$AAf?$AA?5?$AAr?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?5?$AAv?$AAa?$AAl?$AAu?$AAe?$AAs?$AA?5?$AAr?$AAe?$AAn?$AAa?$AAm?$AAe@
0x1800D2B74: "__cdecl _favor" __favor
0x1800321D7: "__cdecl _imp_load_ConvertStringSidToSidW" __imp_load_ConvertStringSidToSidW
0x1800A80E0: api-ms-win-core-console-l1-1-0_NULL_THUNK_DATA
0x180027C00: SampReplaceUserV1aFixed
0x18000F3D4: SampPasswordChangeFilterWorker
0x1800511D4: SampFreeAuthzSecurityAttributes
0x1800A8C10: "__cdecl _imp_RtlLookupElementGenericTableAvl" __imp_RtlLookupElementGenericTableAvl
0x1800B42B0: "Status 0x%x " ??_C@_0N@KABADPOL@Status?50x?$CFx?6?$AA@
0x180069274: RtlRestartKeyByIndexGenericTable2
0x180032C76: "__cdecl _imp_load_RpcStringBindingComposeW" __imp_load_RpcStringBindingComposeW
0x1800BA5D0: "SclpSetDiskLayout" ??_C@_0BC@PANHMCDL@SclpSetDiskLayout?$AA@
0x1800B43D0: "Self" ??_C@_19LHCGGDOD@?$AAS?$AAe?$AAl?$AAf?$AA?$AA@
0x1800B5F38: "Registry syskey state is %d, DS " ??_C@_0DE@PIBIGCEJ@Registry?5syskey?5state?5is?5?$CFd?0?5DS?5@
0x1800B9648: SclEvent_RetargetLinks_Stop
0x18001D568: SampInitAliasNameCache
0x18003197C: "__cdecl _security_init_cookie" __security_init_cookie
0x1800A8BB8: "__cdecl _imp_RtlMapGenericMask" __imp_RtlMapGenericMask
0x1800AACC0: "HashDigestLength" ??_C@_1CC@DMMMEHOM@?$AAH?$AAa?$AAs?$AAh?$AAD?$AAi?$AAg?$AAe?$AAs?$AAt?$AAL?$AAe?$AAn?$AAg?$AAt?$AAh?$AA?$AA@
0x1800B61B0: "SampQueryInformationUserInternal" ??_C@_0HC@LCPIDKAK@SampQueryInformationUserInternal@
0x1800B57F0: "CreatePolicyDatabaseOnFirstBoot" ??_C@_1EA@PDLMLMDL@?$AAC?$AAr?$AAe?$AAa?$AAt?$AAe?$AAP?$AAo?$AAl?$AAi?$AAc?$AAy?$AAD?$AAa?$AAt?$AAa?$AAb?$AAa?$AAs?$AAe?$AAO?$AAn?$AAF?$AAi?$AAr?$AAs?$AAt?$AAB?$AAo?$AAo?$AAt?$AA?$AA@
0x18004F4C4: WPP_SF_q
0x180099B60: "private: static long __cdecl Logger::FormatString(unsigned short * __ptr64 & __ptr64,unsigned short const * __ptr64,char * __ptr64)" ?FormatString@Logger@@CAJAEAPEAGPEBGPEAD@Z
0x1800BDD38: "RegLoadKeyWinPE" ??_C@_1CA@CJBIAIMJ@?$AAR?$AAe?$AAg?$AAL?$AAo?$AAa?$AAd?$AAK?$AAe?$AAy?$AAW?$AAi?$AAn?$AAP?$AAE?$AA?$AA@
0x1800B29D0: SampGetGroupsForUserGuid
0x180078CB0: SamrConnect2
0x18009E000: SampDomainUpgradeTasks
0x1800BF210: "%s: CryptDecodeObjectEx failed w" ??_C@_1GO@GEFIDLCB@?$AA?$CF?$AAs?$AA?3?$AA?5?$AAC?$AAr?$AAy?$AAp?$AAt?$AAD?$AAe?$AAc?$AAo?$AAd?$AAe?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAE?$AAx?$AA?5?$AAf?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAw@
0x1800B5840: "SamrClosehandle" ??_C@_0BA@DEJFNFOE@SamrClosehandle?$AA@
0x1800B37A8: WPP_20885b3ca1c13b3d10f7e9d80c24bece_Traceguids
0x1800B4A60: "\Registry\Machine\SAMUPGRADE" ??_C@_1DK@EOCFEMFJ@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAA?$AAM?$AAU?$AAP?$AAG?$AAR?$AAA?$AAD?$AAE?$AA?$AA@
0x1800A8760: "__cdecl _imp_BCryptFinishHash" __imp_BCryptFinishHash
0x180084660: SamIGetDefaultAdministratorName
0x18001E2E4: SampSetDomainPolicy
0x180029ED4: SampPerformWAUUpgradeIfNecessary
0x180002460: SampFreeUnicodeString
0x1800D3F44: SampDisableOutboundRSO
0x1800A85D8: "__cdecl _imp__cexit" __imp__cexit
0x1800B33E0: "\Aliases\Names\" ??_C@_1CA@NLLFMJPA@?$AA?2?$AAA?$AAl?$AAi?$AAa?$AAs?$AAe?$AAs?$AA?2?$AAN?$AAa?$AAm?$AAe?$AAs?$AA?2?$AA?$AA@
0x1800B5D98: "TraceSamEventInDetail" ??_C@_1CM@KGIMMIED@?$AAT?$AAr?$AAa?$AAc?$AAe?$AAS?$AAa?$AAm?$AAE?$AAv?$AAe?$AAn?$AAt?$AAI?$AAn?$AAD?$AAe?$AAt?$AAa?$AAi?$AAl?$AA?$AA@
0x1800A8AB0: "__cdecl _imp_NtQuerySystemInformation" __imp_NtQuerySystemInformation
0x180054FD4: SampGetDomainPolicy
0x1800B3E70: WPP_93a1ec4b3d633d382035b8b1f4043bc3_Traceguids
0x1800B93D8: "PATHNAME" ??_C@_1BC@POFMLKPE@?$AAP?$AAA?$AAT?$AAH?$AAN?$AAA?$AAM?$AAE?$AA?$AA@
0x1800BDE80: "%s: File "%s" loaded into regist" ??_C@_1FK@DDONENID@?$AA?$CF?$AAs?$AA?3?$AA?5?$AAF?$AAi?$AAl?$AAe?$AA?5?$AA?$CC?$AA?$CF?$AAs?$AA?$CC?$AA?5?$AAl?$AAo?$AAa?$AAd?$AAe?$AAd?$AA?5?$AAi?$AAn?$AAt?$AAo?$AA?5?$AAr?$AAe?$AAg?$AAi?$AAs?$AAt@
0x1800B2CE0: "\pipe\lsass" ??_C@_1BI@NNMJKFFJ@?$AA?2?$AAp?$AAi?$AAp?$AAe?$AA?2?$AAl?$AAs?$AAa?$AAs?$AAs?$AA?$AA@
0x1800A8538: "__cdecl _imp__o__register_onexit_function" __imp__o__register_onexit_function
0x1800A8360: "__cdecl _imp_RegGetValueW" __imp_RegGetValueW
0x1800A8960: "__cdecl _imp_RtlIdentifierAuthoritySid" __imp_RtlIdentifierAuthoritySid
0x1800B5A08: "SamrLookupIdsInDomain" ??_C@_0BG@HIMONNMI@SamrLookupIdsInDomain?$AA@
0x180097128: LibLog
0x1800A9808: "SAM_GROUP" ??_C@_1BE@BHCAGBGP@?$AAS?$AAA?$AAM?$AA_?$AAG?$AAR?$AAO?$AAU?$AAP?$AA?$AA@
0x1800AA2C8: "%s\%s????????.etl" ??_C@_1CE@NIBPLPIE@?$AA?$CF?$AAs?$AA?2?$AA?$CF?$AAs?$AA?$DP?$AA?$DP?$AA?$DP?$AA?$DP?$AA?$DP?$AA?$DP?$AA?$DP?$AA?$DP?$AA?4?$AAe?$AAt?$AAl?$AA?$AA@
0x180032A0F: "__cdecl _imp_load_RpcStringFreeA" __imp_load_RpcStringFreeA
0x180027FEC: SampStoreRegObjectAttributes
0x1800D3F46: SamDisableResetBadPwdCountForward
0x18008BBDC: SclCreateKey
0x1800D2C20: g_pfnFree
0x18000F7E0: SampLocalStringToken
0x1800BA970: "SclRegLoadUnloadHive" ??_C@_0BF@KDNDELHJ@SclRegLoadUnloadHive?$AA@
0x1800B5C68: "SamrGetGroupsForUser" ??_C@_0BF@IPGMKJM@SamrGetGroupsForUser?$AA@
0x1800D3F4B: SampIgnoreGCFailures
0x180074DC8: SampExtSetPasswordInfoOnPdcWorkerDs
0x1800A8550: "__cdecl _imp__o__wcsicmp" __imp__o__wcsicmp
0x180089F04: FindPackageName
0x18009BA24: SBE_FREE
0x1800AA4E8: S_SAM_PROVIDER
0x1800A8080: "__cdecl _imp_LsaIQueryInformationPolicyTrusted" __imp_LsaIQueryInformationPolicyTrusted
0x18009D120: EFIDEAddNewDriverEntry
0x1800D1C80: SampRPCFunctionProperties
0x18001C74C: SampExtGetAliasMembershipListDs
0x1800B6BA0: "SampRefreshRegistry: Failed to r" ??_C@_0FC@BFCFDFIM@SampRefreshRegistry?3?5Failed?5to?5r@
0x18003277F: "__cdecl _imp_load_RpcStringFreeW" __imp_load_RpcStringFreeW
0x18000D360: SampReleaseSamLockExclusive
0x1800D3E18: SampEnterpriseRODCSid
0x18003266A: "__cdecl _imp_load_NdrServerCallAll" __imp_load_NdrServerCallAll
0x1800BC9C8: "volume{" ??_C@_1BA@NHCLDGMD@?$AAv?$AAo?$AAl?$AAu?$AAm?$AAe?$AA?$HL?$AA?$AA@
0x1800A8850: "__cdecl _imp_RtlEqualComputerName" __imp_RtlEqualComputerName
0x1800ABC20: "StringCchLengthW" ??_C@_1CC@EHHKIIFL@?$AAS?$AAt?$AAr?$AAi?$AAn?$AAg?$AAC?$AAc?$AAh?$AAL?$AAe?$AAn?$AAg?$AAt?$AAh?$AAW?$AA?$AA@
0x1800BF6F8: "NtSetBootOptions" ??_C@_0BB@GDHPOCNN@NtSetBootOptions?$AA@
0x1800332F7: wcscmp
0x180091C90: SclRegProcessKeyRecursiveByHandle
0x180079098: WPP_SF__sid_SS
0x1800B4AB8: "SampPerformWAUUpgrade: exiting w" ??_C@_0DC@CPLIKCHJ@SampPerformWAUUpgrade?3?5exiting?5w@
0x1800B3F88: "Configured credential name %wZ f" ??_C@_0DA@CFBNEGCO@Configured?5credential?5name?5?$CFwZ?5f@
0x180023AEC: SampInitEmulationSettings
0x1800B5C20: "SamrSetPasswordUser" ??_C@_0BE@JOOEAKAM@SamrSetPasswordUser?$AA@
0x1800ABBA0: "StartSession succeeded" ??_C@_0BH@MFBFCFME@StartSession?5succeeded?$AA@
0x1800BA168: "(%lx): Failed to record perf res" ??_C@_0CF@FFLLIEDK@?$CI?$CFlx?$CJ?3?5Failed?5to?5record?5perf?5res@
0x1800B2B40: SampSetMemberAttributesOfGroupGuid
0x1800B4810: "Fresh public key identity" ??_C@_1DE@ILNDAPMG@?$AAF?$AAr?$AAe?$AAs?$AAh?$AA?5?$AAp?$AAu?$AAb?$AAl?$AAi?$AAc?$AA?5?$AAk?$AAe?$AAy?$AA?5?$AAi?$AAd?$AAe?$AAn?$AAt?$AAi?$AAt?$AAy?$AA?$AA@
0x1800A8568: "__cdecl _imp_memmove" __imp_memmove
0x1800A8168: "__cdecl _imp_CompareFileTime" __imp_CompareFileTime
0x1800BA7B0: "(%lx): Failed writing boot numbe" ??_C@_0DP@LDMLAIMG@?$CI?$CFlx?$CJ?3?5Failed?5writing?5boot?5numbe@
0x18001CD90: SampAlInvalidateAliasInformation
0x1800B9268: "Marking event [&SclEvent_Process" ??_C@_0CO@MCLOAEIO@Marking?5event?5?$FL?$CGSclEvent_Process@
0x1800B5FC0: "Fix18471\" ??_C@_1BE@HGFNFMFG@?$AAF?$AAi?$AAx?$AA1?$AA8?$AA4?$AA7?$AA1?$AA?2?$AA?$AA@
0x1800D3590: SampCurrentPEK
0x1800275F4: SampCommitChangesToRegistryEx
0x1800BCB60: "internal\onecorebase\inc\rtlstri" ??_C@_0CJ@LHKIFJOM@internal?2onecorebase?2inc?2rtlstri@
0x1800BC778: "(%lx): Failed to query object se" ??_C@_0CI@JDONCIGE@?$CI?$CFlx?$CJ?3?5Failed?5to?5query?5object?5se@
0x1800BF520: "%s: Returning certificate with U" ??_C@_1PI@EACMGOKA@?$AA?$CF?$AAs?$AA?3?$AA?5?$AAR?$AAe?$AAt?$AAu?$AAr?$AAn?$AAi?$AAn?$AAg?$AA?5?$AAc?$AAe?$AAr?$AAt?$AAi?$AAf?$AAi?$AAc?$AAa?$AAt?$AAe?$AA?5?$AAw?$AAi?$AAt?$AAh?$AA?5?$AAU@
0x180062FA0: SamrQueryDisplayInformation2
0x1800A8038: "__cdecl _imp_LsaISafeMode" __imp_LsaISafeMode
0x18000E924: SampNotifyNetlogonOfDelta
0x180086960: SampValidateAliasNameInformation
0x1800B60F0: "System\CurrentControlSet\Service" ??_C@_1GE@PGKJLDAF@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA?2?$AAS?$AAe?$AAr?$AAv?$AAi?$AAc?$AAe@
0x1800BEF40: "pbResult" ??_C@_1BC@PLFMEBLD@?$AAp?$AAb?$AAR?$AAe?$AAs?$AAu?$AAl?$AAt?$AA?$AA@
0x18002E9A0: SampApplyDomainUpdatesForAllDomains
0x180001510: SampActiveContextTableFree
0x1800D34A0: SampNameDomainGroups
0x180086960: SampValidateUserWorkstationsInformation
0x180073514: SampAuditUserChange
0x1800B68C0: "CredentialUpdateNotifyRoutine re" ??_C@_0DE@NGAGOAF@CredentialUpdateNotifyRoutine?5re@
0x18000C9B8: SampSetAdminPasswordInRegistry
0x18006D828: "__cdecl fgs__SAMPR_USER_LOGON_INFORMATION" _fgs__SAMPR_USER_LOGON_INFORMATION
0x1800BD060: "(0x%08x) %ws:%u : %ws:%ws " ??_C@_1DG@EKADEKBL@?$AA?$CI?$AA0?$AAx?$AA?$CF?$AA0?$AA8?$AAx?$AA?$CJ?$AA?5?$AA?$CF?$AAw?$AAs?$AA?3?$AA?$CF?$AAu?$AA?5?$AA?3?$AA?5?$AA?$CF?$AAw?$AAs?$AA?3?$AA?$CF?$AAw?$AAs?$AA?6?$AA?$AA@
0x1800BE450: "TargetSoftware\Microsoft\SystemC" ??_C@_1FO@JCFKNNDD@?$AAT?$AAa?$AAr?$AAg?$AAe?$AAt?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAC@
0x1800D21B0: RestrictRemoteSamEventThrottlingWindow
0x1800A8E08: "__cdecl _xt_z" __xt_z
0x1800874F8: SampValidateUserHomeInformation
0x1800B20B0: "ForceGuest" ??_C@_0L@OBKFNFKK@ForceGuest?$AA@
0x18000AC90: RtlDeleteElementGenericTable2
0x1800BB828: "Default user profile hive does n" ??_C@_0DL@HENHEOFJ@Default?5user?5profile?5hive?5does?5n@
0x1800BC488: "Marking event [&SclEvent_Process" ??_C@_0DF@MGMNBBDJ@Marking?5event?5?$FL?$CGSclEvent_Process@
0x1800BBAF0: "(%lx): Failed to calculate full " ??_C@_0DL@LNJKGPKP@?$CI?$CFlx?$CJ?3?5Failed?5to?5calculate?5full?5@
0x180095360: SclCloneString
0x1800A8828: "__cdecl _imp_NtOpenKey" __imp_NtOpenKey
0x1800B2A70: SampQuerySecurityObjectGuid
0x1800B9928: "RegValueRenameCount" ??_C@_1CI@FEJNIGHB@?$AAR?$AAe?$AAg?$AAV?$AAa?$AAl?$AAu?$AAe?$AAR?$AAe?$AAn?$AAa?$AAm?$AAe?$AAC?$AAo?$AAu?$AAn?$AAt?$AA?$AA@
0x180074FB0: SampExtThreadStateQueryDs
0x1800BE1C8: "FormatString" ??_C@_1BK@BKNEKKGL@?$AAF?$AAo?$AAr?$AAm?$AAa?$AAt?$AAS?$AAt?$AAr?$AAi?$AAn?$AAg?$AA?$AA@
0x180085AF8: SampIsProductSuiteConfigured
0x1800AAB00: WellKnownIdentifierAuthorities
0x1800B9A20: "SecObjectSDUpdateCount" ??_C@_1CO@DFHEPELN@?$AAS?$AAe?$AAc?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAS?$AAD?$AAU?$AAp?$AAd?$AAa?$AAt?$AAe?$AAC?$AAo?$AAu?$AAn?$AAt?$AA?$AA@
0x1800C8288: CRYPTSP_NULL_THUNK_DATA_DLN
0x1800BAF50: "SclGrowPartition" ??_C@_0BB@JCPAEHJA@SclGrowPartition?$AA@
0x1800B2CC8: "ncacn_http" ??_C@_1BG@FOAHFCPJ@?$AAn?$AAc?$AAa?$AAc?$AAn?$AA_?$AAh?$AAt?$AAt?$AAp?$AA?$AA@
0x1800A8588: "__cdecl _imp_malloc" __imp_malloc
0x1800BA9B0: "Saw SHARING_VIOLATION while load" ??_C@_0EG@JCGPNFKG@Saw?5SHARING_VIOLATION?5while?5load@
0x18007E98C: SampOpenUserInServer
0x18000F960: SamIQueryCapabilities
0x18007F398: SampValidateAndChangePassword
0x1800BCDB0: "BUCL::Rtl::Multiply<TraitsT::TSi" ??_C@_0EI@LMOLCGEB@BUCL?3?3Rtl?3?3Multiply?$DMTraitsT?3?3TSi@
0x18002EE70: SamIConnect
0x1800BAAD8: "(%lx): Failed to query object se" ??_C@_0DB@DFPBGKMO@?$CI?$CFlx?$CJ?3?5Failed?5to?5query?5object?5se@
0x1800B2060: "SamDisableListenOnTCP" ??_C@_0BG@JFBFEMDH@SamDisableListenOnTCP?$AA@
0x1800BB260: "(%lx): Unable to get volume disk" ??_C@_0CK@IBGEALLK@?$CI?$CFlx?$CJ?3?5Unable?5to?5get?5volume?5disk@
0x1800A8910: "__cdecl _imp_NtRestoreKey" __imp_NtRestoreKey
0x18000C3C0: SampADConsistencyExtendedAttributes
0x180010F28: SampFreeSupplementalCredentialList
0x180028600: SampDecryptSecretData
0x1800B4528: "Local Service" ??_C@_1BM@DMABOJBE@?$AAL?$AAo?$AAc?$AAa?$AAl?$AA?5?$AAS?$AAe?$AAr?$AAv?$AAi?$AAc?$AAe?$AA?$AA@
0x1800D51F0: g_NTSTATUS_to_break_on
0x1800773E0: SampIsLocalAccountLocalAdmin
0x1800A8178: "__cdecl _imp_WriteFile" __imp_WriteFile
0x1800844D0: DsUuidToStructuredStringCchW
0x18006906C: SampSetExtendedAttributeInternal
0x1800728B0: SAMPR_HANDLE_rundown
0x180031574: "__cdecl _scrt_dllmain_after_initialize_c" __scrt_dllmain_after_initialize_c
0x1800B9C88: "FsSecureSDProcessCount" ??_C@_1CO@BPDKEMEP@?$AAF?$AAs?$AAS?$AAe?$AAc?$AAu?$AAr?$AAe?$AAS?$AAD?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AAC?$AAo?$AAu?$AAn?$AAt?$AA?$AA@
0x18004EE30: SamrRemoveMemberFromAlias
0x18007BB10: SamISetPasswordForeignUser2
0x1800BA418: "SclResetDiskGuids" ??_C@_0BC@GNHHLHML@SclResetDiskGuids?$AA@
0x1800BB6F8: "(%lx): Failed to open PROFILELIS" ??_C@_0CH@KFKCONGB@?$CI?$CFlx?$CJ?3?5Failed?5to?5open?5PROFILELIS@
0x1800D3F90: SampRODCRegistryKey
0x18007BB50: SamISetPasswordForeignUser3
0x1800D3DF8: SampEnterpriseAdministratorsSid
0x1800B6EC8: "EAS password length is not defin" ??_C@_0CE@FDDIHIBO@EAS?5password?5length?5is?5not?5defin@
0x18000A9A4: SampValidateGroupAttributeInformation
0x18009B5D0: "public: static long __cdecl RegistrationCertStatus::GetDeviceCertificate(unsigned short const * __ptr64,enum INFO_KIND,struct _CERT_CONTEXT const * __ptr64 * __ptr64)" ?GetDeviceCertificate@RegistrationCertStatus@@SAJPEBGW4INFO_KIND@@PEAPEBU_CERT_CONTEXT@@@Z
0x1800A84B8: "__cdecl _imp_GetTickCount64" __imp_GetTickCount64
0x18002E8B0: SamrEnumerateUsersInDomain
0x1800741E0: SampExtGetConfigurationOidListDs
0x180053F8C: OpenOrCreateAccountRidKey
0x1800B3D70: "\debug\sam.bak" ??_C@_1BO@NPOPJFNM@?$AA?2?$AAd?$AAe?$AAb?$AAu?$AAg?$AA?2?$AAs?$AAa?$AAm?$AA?4?$AAb?$AAa?$AAk?$AA?$AA@
0x1800A8CE8: "__cdecl _imp_RtlLengthSid" __imp_RtlLengthSid
0x1800B2B80: SampCreateUserInDomainGuid
0x1800D3B9A: SampDsStopped
0x18002D950: SampGetObjectSD
0x1800B6058: "Registry sam database is success" ??_C@_0CO@ELDPIBIN@Registry?5sam?5database?5is?5success@
0x180017C3C: SampExtClassFromSamObjectTypeDs
0x1800A8198: "__cdecl _imp_GetFileSize" __imp_GetFileSize
0x1800D34C0: SampFlushThreadMinWaitSeconds
0x1800A8538: "__cdecl _imp__register_onexit_function" __imp__register_onexit_function
0x18006D510: SampSetPasswordInfoOnPdcByIndex
0x18002F890: compareLists
0x1800D3BB0: SampDsrmAdminBehavior
0x1800B9708: SclEvent_DeterminedNewPath
0x180023A3C: SampLogLevelChange
0x1800B39B0: "EXISTING" ??_C@_1BC@GMGPACDP@?$AAE?$AAX?$AAI?$AAS?$AAT?$AAI?$AAN?$AAG?$AA?$AA@
0x1800D3CA0: "int g_bInitialized" ?g_bInitialized@@3HA
0x1800B4B48: "SampAddWellKnownAccounts: skippi" ??_C@_0DF@LJEONCKC@SampAddWellKnownAccounts?3?5skippi@
0x180032C52: "__cdecl _imp_load_RpcBindingFromStringBindingW" __imp_load_RpcBindingFromStringBindingW
0x18000B050: SamrEnumerateUsersInDomain2
0x1800D3B88: SampDefinedDomains
0x18006E3F4: SampMagicConstantFromDataType
0x180029960: SampMatchworkstation
0x1800B4318: "LMPASSWORD" ??_C@_0L@JOEFGIDC@LMPASSWORD?$AA@
0x1800A8A90: "__cdecl _imp_RtlGetControlSecurityDescriptor" __imp_RtlGetControlSecurityDescriptor
0x180074688: SampExtObjectFromSidDs
0x1800BA3F0: "(%lx): Couldn't determine firmwa" ??_C@_0CI@CBGMPIND@?$CI?$CFlx?$CJ?3?5Couldn?8t?5determine?5firmwa@
0x18008AA6C: SclEtwWriteString
0x180031618: "__cdecl _scrt_dllmain_exception_filter" __scrt_dllmain_exception_filter
0x180086308: SampSetAccountDomainPolicy
0x18001DC60: SampSetComputerObjectDsName
0x1800BAD90: "Unable to allocate buffer" ??_C@_0BK@CMDAOFEF@Unable?5to?5allocate?5buffer?$AA@
0x1800BCE70: "Detail::StaticStringAndBufferImp" ??_C@_0EL@NJPPKKAA@Detail?3?3StaticStringAndBufferImp@
0x1800088B0: SampAcquireReadLock
0x1800AAABC: "-" ??_C@_13IMODFHAA@?$AA?9?$AA?$AA@
0x180074B28: SampExtResetBadPwdCountOnPdcWorkerDs
0x1800BBAB0: "(%lx): Failed to calculate load " ??_C@_0DL@KHOMBGOD@?$CI?$CFlx?$CJ?3?5Failed?5to?5calculate?5load?5@
0x1800B4618: "Digest Authentication" ??_C@_1CM@PJJCMCOL@?$AAD?$AAi?$AAg?$AAe?$AAs?$AAt?$AA?5?$AAA?$AAu?$AAt?$AAh?$AAe?$AAn?$AAt?$AAi?$AAc?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x180073A88: SampGetAuditMessageString
0x180009090: SampValidateObjectAccess2
0x180029188: SampDecryptSecretDataWithAes
0x1800B5D58: "SamrGetBootKeyInformation" ??_C@_0BK@NJEPBKDM@SamrGetBootKeyInformation?$AA@
0x1800D5230: EfipSetBootEntryOrder
0x1800312B0: "__cdecl _report_gsfailure" __report_gsfailure
0x1800BB680: "Operating on user-specific profi" ??_C@_0CM@DCLKBBND@Operating?5on?5user?9specific?5profi@
0x1800AB138: "Notification Packages" ??_C@_1CM@KONJHDLK@?$AAN?$AAo?$AAt?$AAi?$AAf?$AAi?$AAc?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?5?$AAP?$AAa?$AAc?$AAk?$AAa?$AAg?$AAe?$AAs?$AA?$AA@
0x1800198F0: SampBuildDsNameFromSid
0x1800A80D0: api-ms-win-core-apiquery-l1-1-0_NULL_THUNK_DATA
0x1800A8870: "__cdecl _imp_EtwEventWrite" __imp_EtwEventWrite
0x18002F5C4: "public: void __cdecl SP<unsigned short,class SP_MEM<unsigned short> >::Reset(void) __ptr64" ?Reset@?$SP@GV?$SP_MEM@G@@@@QEAAXXZ
0x180097FBC: RtlInitLUnicodeStringFromNullTerminatedString
0x1800A8518: api-ms-win-core-timezone-l1-1-0_NULL_THUNK_DATA
0x180031EFA: "__cdecl crt_atexit" _crt_atexit
0x1800B6DF8: "SampGetAliasMembershipWorker fai" ??_C@_0CP@GEMLBBHM@SampGetAliasMembershipWorker?5fai@
0x1800BBF50: "(%lx): Failed to enumerate repar" ??_C@_0EG@OKLHMKIK@?$CI?$CFlx?$CJ?3?5Failed?5to?5enumerate?5repar@
0x180030E34: "__cdecl _local_stdio_printf_options" __local_stdio_printf_options
0x180009B10: SamIGetResourceGroupMembershipsTransitive
0x180032646: "__cdecl _imp_load_RegReplaceKeyW" __imp_load_RegReplaceKeyW
0x1800BA458: "Found [%lu] disks" ??_C@_0BC@EBABNJFM@Found?5?$FL?$CFlu?$FN?5disks?$AA@
0x18009931C: "__cdecl TlgDefineProvider_annotation__Tlgmtaum_hTelemetryAssertDiagTrackProv" _TlgDefineProvider_annotation__Tlgmtaum_hTelemetryAssertDiagTrackProv
0x180086960: SampValidateGroupAdmCommentInformation
0x1800B3510: "%ls%ls" ??_C@_1O@OAIPCDPO@?$AA?$CF?$AAl?$AAs?$AA?$CF?$AAl?$AAs?$AA?$AA@
0x1800A8B18: "__cdecl _imp_NtOpenFile" __imp_NtOpenFile
0x18009CC30: EfiAddDriverEntry
0x1800B3E18: "AuthN: " ??_C@_07DPPIAFNI@AuthN?3?5?$AA@
0x1800A8A88: "__cdecl _imp_RtlExpandEnvironmentStrings_U" __imp_RtlExpandEnvironmentStrings_U
0x1800B2920: SampCloseHandleGuid
0x1800A8458: "__cdecl _imp_LeaveCriticalSection" __imp_LeaveCriticalSection
0x180007870: SampUpdateAccountDisabledFlag
0x180066C98: WPP_SF_qD_sid_
0x1800329C7: "__cdecl _imp_load_LsaOpenPolicy" __imp_load_LsaOpenPolicy
0x1800D3760: SampProductType
0x180031904: "__cdecl onexit" _onexit
0x1800B6770: "SampRegistryUpdateInteractiveLog" ??_C@_0GL@MCABCFHJ@SampRegistryUpdateInteractiveLog@
0x1800CC060: "__cdecl _IMPORT_DESCRIPTOR_LSASRV" __IMPORT_DESCRIPTOR_LSASRV
0x1800B1F78: "SamDisableResetBadPwdCountForwar" ??_C@_0CC@NMCCAIDP@SamDisableResetBadPwdCountForwar@
0x1800B4490: "Enterprise Domain Controllers" ??_C@_1DM@IJKEAFLO@?$AAE?$AAn?$AAt?$AAe?$AAr?$AAp?$AAr?$AAi?$AAs?$AAe?$AA?5?$AAD?$AAo?$AAm?$AAa?$AAi?$AAn?$AA?5?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAl?$AAe?$AAr?$AAs?$AA?$AA@
0x18006C01C: SamIRandomizeStoredPasswordLocallyWorker
0x18000FDD0: SampCalculateLmPassword
0x1800A8590: "__cdecl _imp_qsort_s" __imp_qsort_s
0x18006DE94: CngRsa32Compat_rc4
0x18006E890: SamIPromoteUndo
0x18001F2BC: SampLookupAccountRid
0x1800B4428: "Interactive" ??_C@_1BI@NFOKHDOD@?$AAI?$AAn?$AAt?$AAe?$AAr?$AAa?$AAc?$AAt?$AAi?$AAv?$AAe?$AA?$AA@
0x1800BB928: "SclpRegExpandProfileHivePath" ??_C@_0BN@GFLBHGBP@SclpRegExpandProfileHivePath?$AA@
0x18003275B: "__cdecl _imp_load_I_RpcBindingInqLocalClientPID" __imp_load_I_RpcBindingInqLocalClientPID
0x1800A8680: "__cdecl _imp_StartTraceW" __imp_StartTraceW
0x1800D348C: FlushOperationStatus
0x180060DB0: SampFreeOneSecurityAttribute
0x1800B5EF8: "unable to convert" ??_C@_1CE@GOMJDPFI@?$AAu?$AAn?$AAa?$AAb?$AAl?$AAe?$AA?5?$AAt?$AAo?$AA?5?$AAc?$AAo?$AAn?$AAv?$AAe?$AAr?$AAt?$AA?$AA@
0x18002F990: SampRtlSplitNames
0x1800BABD0: "|" ??_C@_13PPFCDPMH@?$AA?$HM?$AA?$AA@
0x1800A8718: "__cdecl _imp_QueryServiceConfigW" __imp_QueryServiceConfigW
0x18009CF34: EfiEnumerateDriverEntries
0x18000A9A4: SampValidateDomainPasswordInformation
0x1800B96A8: SclEvent_DeterminedNewSid
0x1800B50D0: "Sam Domain Log Update for %s fai" ??_C@_0DK@EOPNPOGL@Sam?5Domain?5Log?5Update?5for?5?$CFs?5fai@
0x180032791: "__cdecl _imp_load_RpcStringBindingParseW" __imp_load_RpcStringBindingParseW
0x1800AAD38: "ntdll.dll" ??_C@_1BE@GJOFHIHD@?$AAn?$AAt?$AAd?$AAl?$AAl?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x1800AB1F0: "DeltaNotify" ??_C@_0M@PJFEGBGH@DeltaNotify?$AA@
0x1800A88C0: "__cdecl _imp_RtlVerifyVersionInfo" __imp_RtlVerifyVersionInfo
0x1800321C5: "__cdecl _imp_load_I_NetNotifyDelta" __imp_load_I_NetNotifyDelta
0x180027890: SampCommitAndRetainWriteLockEx
0x1800195A0: SampLookupAccountNameDs
0x180010990: SampFlagsToAccountControl
0x18006831C: SampDeleteObjectExtendedAttributes
0x1800AAAB0: "Event" ??_C@_1M@JJBFPLJB@?$AAE?$AAv?$AAe?$AAn?$AAt?$AA?$AA@
0x1800B2AF0: SampSetSecurityObjectGuid
0x1800BAD68: "(%lx): Failed to query reg value" ??_C@_0CI@GNPACJIN@?$CI?$CFlx?$CJ?3?5Failed?5to?5query?5reg?5value@
0x1800AFF48: SamSrv2WppLoggingGuid
0x180032AAC: "__cdecl _imp_load_RpcStringBindingParseA" __imp_load_RpcStringBindingParseA
0x1800AB6E0: WPP_8d4f49cef61b35be7e6b3179073f4bd0_Traceguids
0x1800B2BA0: SampCreateComputerInDomainGuid
0x1800BB888: "SclRegProcessProfileHive" ??_C@_0BJ@NFHLIFDF@SclRegProcessProfileHive?$AA@
0x1800BC138: "performed" ??_C@_09GKKLPFO@performed?$AA@
0x1800D2B60: "struct __type_info_node __type_info_root_node" ?__type_info_root_node@@3U__type_info_node@@A
0x18009D740: OSDriverSetFileName
0x1800D0970: DsWellKnownMembershipsToAddBetween_WS03_And_LH_IDS1
0x180027B7C: SampRegistryUpdateInteractiveLogonStatistics
0x180028230: KEDecryptKey
0x18002EEFC: SafeAllocaInitialize
0x18008D2F4: SclDuplicateMultiSz
0x180018698: ResetTracingDirectory
0x1800856E4: SampExtractClientIpAddr
0x18006AFFC: RtlStringCchPrintfExA
0x18008A98C: RtlStringCchLengthW
0x180008F20: SampExtendAttributeBuffer
0x1800B2C50: SampSetBootKeyInformationGuid
0x18001FDB8: "__cdecl fgs__SAMPR_ENUMERATION_BUFFER" _fgs__SAMPR_ENUMERATION_BUFFER
0x1800B4BB0: "SampAddWellKnownAccounts: create" ??_C@_0CM@KLDADDBA@SampAddWellKnownAccounts?3?5create@
0x180068BB4: SampRegEnforceConsistencyInternetUID
0x1800679BC: SampReallocateBuffer
0x1800716D8: SampProcessDsDirsToDelete
0x1800B9638: SclEvent_ProcessRegistry_Stop
0x1800BA050: "FsProcessingTimeInMS" ??_C@_1CK@FFHBKHNB@?$AAF?$AAs?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AAi?$AAn?$AAg?$AAT?$AAi?$AAm?$AAe?$AAI?$AAn?$AAM?$AAS?$AA?$AA@
0x18007AD4C: SampCreate18471Key
0x1800A7FF8: "__cdecl _imp_CertGetCertificateContextProperty" __imp_CertGetCertificateContextProperty
0x1800BC278: "\REGISTRY\MACHINE\SECURITY" ??_C@_1DG@JMCMBKJC@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAE?$AAC?$AAU?$AAR?$AAI?$AAT?$AAY?$AA?$AA@
0x1800B2A20: SampGetBootKeyInformationGuid
0x1800B3998: WPP_a612c9aaccd733af52c4ff7e08581e9a_Traceguids
0x18000AEF0: SamILookupNamesInDomain
0x1800D3C98: SampComponentUpdateFailureEventLogged
0x1800BF2E0: "%s: cbInputCount size is not the" ??_C@_1GG@BOIKJDDF@?$AA?$CF?$AAs?$AA?3?$AA?5?$AAc?$AAb?$AAI?$AAn?$AAp?$AAu?$AAt?$AAC?$AAo?$AAu?$AAn?$AAt?$AA?5?$AAs?$AAi?$AAz?$AAe?$AA?5?$AAi?$AAs?$AA?5?$AAn?$AAo?$AAt?$AA?5?$AAt?$AAh?$AAe@
0x1800D35E8: SampNonCachablePrincipalsSid
0x1800D01F0: SampMandatoryNotificationPackagesNonDC
0x1800D3E28: SampComponentUpdatesBuiltIn
0x1800D2160: SampDefaultNonDCRestrictRemoteAccessSDString
0x18007CF30: SampCheckForAccountLockout
0x180001EA4: SampAreConnectedProvidersInstalled
0x1800B35B0: "User:%ls. All claims have been d" ??_C@_0DI@PCFAOIG@User?3?$CFls?4?5All?5claims?5have?5been?5d@
0x1800B9780: "Number of registry keys processe" ??_C@_1EE@EPFLKFCI@?$AAN?$AAu?$AAm?$AAb?$AAe?$AAr?$AA?5?$AAo?$AAf?$AA?5?$AAr?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?5?$AAk?$AAe?$AAy?$AAs?$AA?5?$AAp?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AAe@
0x1800B3828: "Krbtgt allocation: Using Id (%d)" ??_C@_0DJ@OLGAHDFL@Krbtgt?5allocation?3?5Using?5Id?5?$CI?$CFd?$CJ@
0x180089194: SampDsMakeSpnW
0x1800DD2D0: "__cdecl _imp_OpenSCManagerW" __imp_OpenSCManagerW
0x1800BDBD0: "HKEY_LOCAL_MACHINE\SOFTWARE\Micr" ??_C@_1HE@MGPCBHOL@?$AAH?$AAK?$AAE?$AAY?$AA_?$AAL?$AAO?$AAC?$AAA?$AAL?$AA_?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr@
0x1800AAD08: "SHA256" ??_C@_1O@HECGKAIN@?$AAS?$AAH?$AAA?$AA2?$AA5?$AA6?$AA?$AA@
0x1800D3F98: SampRODCCacheValid
0x1800108B4: SampPreventTimeUnitChange
0x1800B41C0: "PasswordNotificationRoutine resu" ??_C@_0DC@BDAOMNJL@PasswordNotificationRoutine?5resu@
0x18001D550: SampCompareNodeByRid
0x1800A85B0: "__cdecl _imp_wcstok" __imp_wcstok
0x1800B3280: "LSA-Policy-DisableBuiltinAdminBy" ??_C@_1FA@JIKAFHHN@?$AAL?$AAS?$AAA?$AA?9?$AAP?$AAo?$AAl?$AAi?$AAc?$AAy?$AA?9?$AAD?$AAi?$AAs?$AAa?$AAb?$AAl?$AAe?$AAB?$AAu?$AAi?$AAl?$AAt?$AAi?$AAn?$AAA?$AAd?$AAm?$AAi?$AAn?$AAB?$AAy@
0x1800A8560: "__cdecl _imp__o__wcsupr" __imp__o__wcsupr
0x18000FC00: SampExtMaybeEndDsTransactionDs
0x180016380: SampConvertFixedLengthAttributes
0x1800D2190: SampAllDomainUpdatesData
0x180067404: SampValidateDSRMPwdSet
0x180063030: SamrQueryDisplayInformation3
0x1800B5B58: "SamrRemoveMemberFromAlias" ??_C@_0BK@BBFPCMGI@SamrRemoveMemberFromAlias?$AA@
0x1800AB420: "\Registry\Machine\Security\SAM\F" ??_C@_1FA@OOGODHEH@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?2?$AAS?$AAA?$AAM?$AA?2?$AAF@
0x1800B9340: "(%lx): Request execution failed" ??_C@_0CA@MJDKHAL@?$CI?$CFlx?$CJ?3?5Request?5execution?5failed?$AA@
0x1800B6098: "NOT_FOUND" ??_C@_1BE@HBCCLHGK@?$AAN?$AAO?$AAT?$AA_?$AAF?$AAO?$AAU?$AAN?$AAD?$AA?$AA@
0x1800B96B8: SclEvent_ProcessUserProfiles_Stop
0x1800AB4A0: "__cdecl _sz_api_ms_win_security_sddl_l1_1_0_dll" __sz_api_ms_win_security_sddl_l1_1_0_dll
0x18003253C: "__cdecl _tailMerge_dnsapi_dll" __tailMerge_dnsapi_dll
0x180001320: SampConvertAttrValBlockToUlong
0x180002B24: SampIncrementActiveContextCount
0x180031EBE: "__cdecl _stdio_common_vswprintf" __stdio_common_vswprintf
0x180001398: "__cdecl fgu__SAMPR_USER_INFO_BUFFER" _fgu__SAMPR_USER_INFO_BUFFER
0x1800D2BE0: "__cdecl _hmod__DSPARSE_dll" __hmod__DSPARSE_dll
0x180021FEC: InternalVerifyStackAvailable
0x1800D1AF0: DsWellKnownSecurityPrincipalsToAddBetween_LH_RC1_IDS1_And_LH_BETA3
0x1800CC088: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-memory-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-memory-l1-1-0
0x180072160: SampSetPassword
0x1800B8CE0: WPP_704f32e328673daecb2461aa726f4cfe_Traceguids
0x180071ECC: SampRetrieveDsDirsToDeleteKey
0x1800BF6B0: "NtModifyBootEntry" ??_C@_0BC@HPFGDIFO@NtModifyBootEntry?$AA@
0x18002E458: SampRegEnforceConsistencyOnUserObject
0x1800C8F38: DSPARSE_NULL_THUNK_DATA_DLB
0x1800751E0: SamIFreeLookupNamesInfo
0x1800D2BC0: "__cdecl _hmod__api_ms_win_security_systemfunctions_l1_1_0_dll" __hmod__api_ms_win_security_systemfunctions_l1_1_0_dll
0x1800A88E8: "__cdecl _imp_RtlAcquireResourceExclusive" __imp_RtlAcquireResourceExclusive
0x1800D5238: EfipQueryBootEntryOrder
0x18009E080: SampRegistryConfigTable
0x1800D0EE0: DsWellKnownMembershipsToAddBetween_LH_BETA3_And_LH_RC0
0x180032B49: "__cdecl _imp_load_OpenSCManagerW" __imp_load_OpenSCManagerW
0x180076824: SampSetAttributeAccessWithWhichFields
0x180098AD8: "void __cdecl DbgPrintfW(unsigned long,unsigned short const * __ptr64,...)" ?DbgPrintfW@@YAXKPEBGZZ
0x18009CCC8: EfiApiInitialize
0x1800DD1C0: "__cdecl _imp_NdrClientCall3" __imp_NdrClientCall3
0x1800959B4: SclStringNeedsProcessing
0x1800B46E8: "Console Logon" ??_C@_1BM@HFIKFNOD@?$AAC?$AAo?$AAn?$AAs?$AAo?$AAl?$AAe?$AA?5?$AAL?$AAo?$AAg?$AAo?$AAn?$AA?$AA@
0x1800B92F0: "Marking event [&SclEvent_Retarge" ??_C@_0CN@MEEHFIOC@Marking?5event?5?$FL?$CGSclEvent_Retarge@
0x1800B4C58: "%ws\%ws" ??_C@_1BA@NPEHGALP@?$AA?$CF?$AAw?$AAs?$AA?2?$AA?$CF?$AAw?$AAs?$AA?$AA@
0x18000A9A4: SampValidateDomainModifiedInformation2
0x1800AAD50: "\Registry\Machine\SAM\SAM\LastSk" ??_C@_1FC@CLEDIIDD@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAA?$AAM?$AA?2?$AAS?$AAA?$AAM?$AA?2?$AAL?$AAa?$AAs?$AAt?$AAS?$AAk@
0x180073080: SampAuditGroupTypeChange
0x1800A8A48: "__cdecl _imp_NtCreateKey" __imp_NtCreateKey
0x1800DD0C8: "__cdecl _imp_I_NetLogonGetSerialNumber" __imp_I_NetLogonGetSerialNumber
0x18003236B: "__cdecl _imp_load_NdrMesTypeAlignSize3" __imp_load_NdrMesTypeAlignSize3
0x1800A8C20: "__cdecl _imp_RtlSetSaclSecurityDescriptor" __imp_RtlSetSaclSecurityDescriptor
0x1800A8BE0: "__cdecl _imp_RtlInitializeSid" __imp_RtlInitializeSid
0x1800B8D80: "GBG" ??_C@_03BEFOMAAL@GBG?$AA@
0x1800B5F28: WPP_211fcb067069313d7193f47e69c8f7ef_Traceguids
0x1800D2D00: g_pSamExtensionTableDs
0x180074030: SampExtDowngradeSecurityDescriptorDs
0x1800B97C8: "RegKeyProcessCount" ??_C@_1CG@BDDFJJGC@?$AAR?$AAe?$AAg?$AAK?$AAe?$AAy?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AAC?$AAo?$AAu?$AAn?$AAt?$AA?$AA@
0x1800B5080: "Sam Domain Update %s is starting" ??_C@_0CC@BMFNNNMB@Sam?5Domain?5Update?5?$CFs?5is?5starting@
0x180010180: SampValidatePwdSettingAttempt
0x18006EF10: SampAddNonLocalDomainRelativeMemberships
0x1800A85D0: "__cdecl _imp__configure_narrow_argv" __imp__configure_narrow_argv
0x180001300: SampConvertAttrValBlockToGuid
0x1800A8BA0: "__cdecl _imp_RtlSetDaclSecurityDescriptor" __imp_RtlSetDaclSecurityDescriptor
0x1800326CA: "__cdecl _tailMerge_ws2_32_dll" __tailMerge_ws2_32_dll
0x1800BB868: "Processing profile hive: [%ws]" ??_C@_0BP@DLEBJBAE@Processing?5profile?5hive?3?5?$FL?$CFws?$FN?$AA@
0x180051AF0: CreateAlias
0x1800BADB0: "(%lx): Failed to query key [%ws]" ??_C@_0CB@HFIMOGCJ@?$CI?$CFlx?$CJ?3?5Failed?5to?5query?5key?5?$FL?$CFws?$FN@
0x180012220: QueryUserProperty
0x180002F54: SampOpenDomainKey
0x180016F80: SampDsConvertReadAttrBlock
0x18007E40C: SampIncrementBadPasswordCount
0x1800A88F8: "__cdecl _imp_NtDuplicateObject" __imp_NtDuplicateObject
0x1800321B3: "__cdecl _imp_load_I_NetLogonGetSerialNumber" __imp_load_I_NetLogonGetSerialNumber
0x1800B5880: "SamrLookupDomainInSamServer" ??_C@_0BM@IIGCDNFG@SamrLookupDomainInSamServer?$AA@
0x1800B4BDC: "ub" ??_C@_15IEPNPNKG@?$AAu?$AAb?$AA?$AA@
0x180031F72: wcscpy_s
0x1800A8058: "__cdecl _imp_LsaILookupWellKnownName" __imp_LsaILookupWellKnownName
0x18006BA50: SampLogPrint
0x180054DDC: SampCreateDatabaseProtection
0x18007F0CC: SampStillInLockoutObservationWindow
0x1800D2C28: samcli_handle
0x180029E64: StringCchLengthW
0x1800D2EE0: ObjChgNotifEventListHeads
0x1800955CC: SclProcessObjectSecurity
0x1800A8320: "__cdecl _imp_GetProcessMitigationPolicy" __imp_GetProcessMitigationPolicy
0x1800BE630: "HKEY_LOCAL_MACHINE\TargetSoftwar" ??_C@_1EE@NPJPGLHA@?$AAH?$AAK?$AAE?$AAY?$AA_?$AAL?$AAO?$AAC?$AAA?$AAL?$AA_?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAT?$AAa?$AAr?$AAg?$AAe?$AAt?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr@
0x18000DC4C: SampDoGroupCreationChecks
0x180051578: BuildAccountSid
0x18008A9F4: SclEtwWriteSid
0x180032845: "__cdecl _imp_load_RpcImpersonateClient" __imp_load_RpcImpersonateClient
0x1800CC010: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0
0x1800D09A0: DsWellKnownSecurityPrincipalsToAddBetween_WinThresholdM3_And_WinThresholdUpdate4
0x1800BAA48: "SclRegCopyKeyHandleRecursive" ??_C@_0BN@PKNJCOL@SclRegCopyKeyHandleRecursive?$AA@
0x1800A9868: "Groups" ??_C@_1O@HELFAGNI@?$AAG?$AAr?$AAo?$AAu?$AAp?$AAs?$AA?$AA@
0x1800AB550: "__cdecl _sz_DNSAPI_dll" __sz_DNSAPI_dll
0x1800B5B30: "SamrDeleteAlias" ??_C@_0BA@EFCNHKGM@SamrDeleteAlias?$AA@
0x1800B4850: "\Registry\Machine\SAMUPGRADE\SAM" ??_C@_1EC@KMJLEOIH@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAA?$AAM?$AAU?$AAP?$AAG?$AAR?$AAA?$AAD?$AAE?$AA?2?$AAS?$AAA?$AAM@
0x1800330C8: "public: void __cdecl SP<unsigned short * __ptr64,class SP_MEM<unsigned short * __ptr64> >::Reset(void) __ptr64" ?Reset@?$SP@PEAGV?$SP_MEM@PEAG@@@@QEAAXXZ
0x1800B8F40: "(%lx): Failed to initialize Setu" ??_C@_0CM@NBGBJFON@?$CI?$CFlx?$CJ?3?5Failed?5to?5initialize?5Setu@
0x180068EB4: SampRegWriteExtendedAttribute
0x180071E30: SampRemoveAdminPasswordFromRegistry
0x1800DD100: "__cdecl _imp_NdrServerCall2" __imp_NdrServerCall2
0x180032530: "__cdecl _imp_load_DnsNameCompareEx_W" __imp_load_DnsNameCompareEx_W
0x18006D0C4: SampRandomizeScrilPasswordNotifyDc
0x1800B4768: "Service Asserted Identity" ??_C@_1DE@HIDIKKCB@?$AAS?$AAe?$AAr?$AAv?$AAi?$AAc?$AAe?$AA?5?$AAA?$AAs?$AAs?$AAe?$AAr?$AAt?$AAe?$AAd?$AA?5?$AAI?$AAd?$AAe?$AAn?$AAt?$AAi?$AAt?$AAy?$AA?$AA@
0x1800BE2F0: "Logger::WriteRegistryFailureEven" ??_C@_1EI@DCOKPEJP@?$AAL?$AAo?$AAg?$AAg?$AAe?$AAr?$AA?3?$AA?3?$AAW?$AAr?$AAi?$AAt?$AAe?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AAF?$AAa?$AAi?$AAl?$AAu?$AAr?$AAe?$AAE?$AAv?$AAe?$AAn@
0x1800A8600: "__cdecl _imp___std_type_info_destroy_list" __imp___std_type_info_destroy_list
0x1800A85D8: "__cdecl _imp__o__cexit" __imp__o__cexit
0x180031EBE: "__cdecl o___stdio_common_vswprintf" _o___stdio_common_vswprintf
0x1800BB170: "(%lx): Unable to grow partition." ??_C@_0CB@ICHDICJM@?$CI?$CFlx?$CJ?3?5Unable?5to?5grow?5partition?4@
0x180032DB1: "__cdecl _imp_load_SetupLogErrorW" __imp_load_SetupLogErrorW
0x18007E0F8: SampGetPasswordChangeFailureInfo
0x1800D3DD0: "private: static class JoinStatusStorage::JoinStatusRegKeyInfo JoinStatusStorage::DeviceJoinStatusRegKeyInfo" ?DeviceJoinStatusRegKeyInfo@JoinStatusStorage@@0VJoinStatusRegKeyInfo@1@A
0x18006FFBC: SampApplyWellKnownMemberships
0x1800AB408: "samsrv.dll" ??_C@_1BG@OGKAJKFF@?$AAs?$AAa?$AAm?$AAs?$AAr?$AAv?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x180073EFC: SampExtDeleteElementFromAccountNameTableDs
0x18004D760: SampChangeAliasAccountName
0x180075F0C: WPP_SF_sD
0x180076340: WPP_SF_SD
0x180083A70: WPP_SF_sd
0x180065F90: SamrEnumerateAliasesInDomain
0x180068374: SampEnabledCachedRealms
0x1800A8580: "__cdecl _imp_free" __imp_free
0x180014788: SampPasswordChangeCPTrace
0x1800B5A80: "SamrDeleteGroup" ??_C@_0BA@FJMNLHCB@SamrDeleteGroup?$AA@
0x1800659D0: SamrCreateAliasInDomain
0x1800DD090: DNSAPI_NULL_THUNK_DATA_DLA
0x1800D3AF0: SampAdministratorUserSid
0x1800C8D98: DNSAPI_NULL_THUNK_DATA_DLB
0x1800A84A0: api-ms-win-core-synch-l1-2-0_NULL_THUNK_DATA
0x1800BA728: "Failed to allocate boot entry bu" ??_C@_0CG@PGBOFFMF@Failed?5to?5allocate?5boot?5entry?5bu@
0x1800A82C8: "__cdecl _imp_TlsFree" __imp_TlsFree
0x1800A88D0: "__cdecl _imp_NtSetEvent" __imp_NtSetEvent
0x1800793D0: SamIIsDownlevelDcUpgrade
0x18008D9D4: OSBEFlush
0x180051614: BuildPrimaryDomainSid
0x1800BD130: "Invalid Provider" ??_C@_1CC@MKGPBOGE@?$AAI?$AAn?$AAv?$AAa?$AAl?$AAi?$AAd?$AA?5?$AAP?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AA?$AA@
0x1800B9D98: "FsMftSDFailedUpdateCount" ??_C@_1DC@JPABGBGI@?$AAF?$AAs?$AAM?$AAf?$AAt?$AAS?$AAD?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AAU?$AAp?$AAd?$AAa?$AAt?$AAe?$AAC?$AAo?$AAu?$AAn?$AAt?$AA?$AA@
0x180078A8C: WPP_SF_SS
0x1800DD1E8: "__cdecl _imp_RpcBindingSetAuthInfoExW" __imp_RpcBindingSetAuthInfoExW
0x1800CBFAC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-privateprofile-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-privateprofile-l1-1-0
0x18001DE00: SampGetDomainUpgradeTasks
0x1800C82A8: DNSAPI_NULL_THUNK_DATA_DLN
0x180031F7E: "__cdecl o_wcsncpy_s" _o_wcsncpy_s
0x180075A18: SampPerformInitializeFailurePopup
0x1800A80A8: "__cdecl _imp_LsarClose" __imp_LsarClose
0x1800BA350: "(%lx): Failed to open key [%ws]!" ??_C@_0CB@EHFDKGDH@?$CI?$CFlx?$CJ?3?5Failed?5to?5open?5key?5?$FL?$CFws?$FN?$CB@
0x180032869: "__cdecl _imp_load_RpcServerRegisterAuthInfoW" __imp_load_RpcServerRegisterAuthInfoW
0x1800D09E0: DsWellKnownMembershipsToAddTillWS03
0x1800D21A8: KE_AESBlockSize
0x1800CBF5C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-localization-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-localization-l1-2-0
0x1800B8EF0: "Acquiring needed privileges..." ??_C@_0BP@NKELFBD@Acquiring?5needed?5privileges?4?4?4?$AA@
0x1800BB9F8: "(%lx): Failed to calculate Windo" ??_C@_0DM@DKAPIANO@?$CI?$CFlx?$CJ?3?5Failed?5to?5calculate?5Windo@
0x1800254E8: SampGetPasswordMustChange
0x1800A8490: api-ms-win-core-synch-l1-1-0_NULL_THUNK_DATA
0x1800B5FF0: "Will do following operations. Up" ??_C@_0GI@KNCBPIBJ@Will?5do?5following?5operations?4?5Up@
0x180069820: SampRemoveAccountFromGroupMembers
0x1800AB370: "System\CurrentControlSet\Control" ??_C@_1GO@FGMPFHLG@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA?2?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl@
0x1800049C0: SamrLookupNamesInDomain2
0x1800CBF48: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0
0x1800908C8: SclRegValueExists
0x180031F06: "__cdecl execute_onexit_table" _execute_onexit_table
0x18001C958: SampCreateEnumerationContext
0x180078A20: SampValidateDomainControllerCreation
0x1800A79C8: SampProtSeqEndpoints
0x1800DD228: "__cdecl _imp_WSAStartup" __imp_WSAStartup
0x180032311: "__cdecl _imp_load_MesDecodeBufferHandleCreate" __imp_load_MesDecodeBufferHandleCreate
0x1800B6D80: WPP_8b90552576f63410d62392dac8d96463_Traceguids
0x1800B49F0: "\Registry\Machine\SOFTWARE\TEMPS" ??_C@_1EG@OGCCIFCJ@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAT?$AAE?$AAM?$AAP?$AAS@
0x18007C130: SampAssignPrimaryGroup
0x18001DB0C: WPP_SF_s
0x18001DA44: WPP_SF_S
0x18009A134: McTemplateU0z
0x1800A88A0: "__cdecl _imp_RtlOemStringToUnicodeString" __imp_RtlOemStringToUnicodeString
0x180031E8E: memset
0x1800CC114: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x1800313A4: "__cdecl _report_securityfailure" __report_securityfailure
0x180091E58: SclRegProcessKeyRecursiveByName
0x1800B2E90: SAMMSG_MEMBERSHIP_SETUP_ERROR_NO_GROUP
0x1800AA460: "System\CurrentControlSet\Control" ??_C@_1FK@EODBLPEE@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA?2?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl@
0x18001913C: RtlStringCchPrintfW
0x1800078F0: SampMaybeAcquireReadLock
0x1800B6C98: "%wZ@%s" ??_C@_1O@JOBBLHGN@?$AA?$CF?$AAw?$AAZ?$AA?$EA?$AA?$CF?$AAs?$AA?$AA@
0x18002DA68: SampQueryBadPasswordCount
0x1800B4C68: "DsDirs" ??_C@_1O@ECBABCCE@?$AAD?$AAs?$AAD?$AAi?$AAr?$AAs?$AA?$AA@
0x1800752F0: SamIFreeLookupSidsInfo
0x1800D2588: "unsigned __int64 `__local_stdio_scanf_options'::`2'::_OptionsStorage" ?_OptionsStorage@?1??__local_stdio_scanf_options@@9@4_KA
0x1800BB2B0: "SclpGetVolumeHandle" ??_C@_0BE@HPHBPCGL@SclpGetVolumeHandle?$AA@
0x180027394: "long __cdecl _LockStore(int,void * __ptr64 * __ptr64)" ?_LockStore@@YAJHPEAPEAX@Z

[JEB Decompiler by PNF Software]