Generated by JEB on 2019/08/01

PE: C:\Windows\System32\authz.dll Base=0x180000000 SHA-256=7EF8B4867209DCBBF279EA4929FCB428886ACAF7DE47E6CF665D926BBEB240D4
PDB: authz.pdb GUID={B2A1418C-1777-E6FF-C2EB876D033445A3} Age=1

1260 located named symbols:
0x180027930: AuthzBasepDeviceMemberOf
0x1800064A4: AuthzpInitializeAuditParamsV
0x180023FA8: AuthzBasepAllocateSecurityAttributesList
0x180011CA0: AuthzAddSidsToContext
0x180036820: "__cdecl _sz_SspiCli_dll" __sz_SspiCli_dll
0x1800095F8: "__cdecl _raise_securityfailure" __raise_securityfailure
0x180005B50: AuthziFreeAuditEventType
0x180029B88: LsaQueryInformationPolicy
0x180036330: "__cdecl _imp_GetSecurityDescriptorOwner" __imp_GetSecurityDescriptorOwner
0x18001B500: AuthzpComputeSkipFlagsForWellKnownSid
0x18000ABDD: "__cdecl _imp_load_AuthzrExtFreeContext" __imp_load_AuthzrExtFreeContext
0x1800099A4: "void __cdecl __scrt_initialize_type_info(void)" ?__scrt_initialize_type_info@@YAXXZ
0x180017E2C: AuthzpGetGroupsFromContext
0x1800364A8: "__cdecl _imp_EtwUnregisterTraceGuids" __imp_EtwUnregisterTraceGuids
0x180042234: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-2-0
0x18000AAEC: IsAuthzrExtInitializeCompoundContextPresent
0x180002B20: AuthzBasepFreeClaimCollection
0x180014FE8: AuthzpAllowOnlyMaximumAllowedMultipleSDAccessCheck
0x1800362A8: "__cdecl _imp_AllocateAndInitializeSid" __imp_AllocateAndInitializeSid
0x1800363D8: "__cdecl _imp_RtlIsPackageSid" __imp_RtlIsPackageSid
0x180036810: "__cdecl _sz_WLDAP32_dll" __sz_WLDAP32_dll
0x18002383C: "long __cdecl StringCchCatW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64)" ?StringCchCatW@@YAJPEAG_KPEBG@Z
0x18003D5B8: "(objectClass=*)" ??_C@_1CA@CGKDPGGM@?$AA?$CI?$AAo?$AAb?$AAj?$AAe?$AAc?$AAt?$AAC?$AAl?$AAa?$AAs?$AAs?$AA?$DN?$AA?$CK?$AA?$CJ?$AA?$AA@
0x180013940: AuthziFreeAuditQueue
0x18003DE50: "msDS-MembersOfResourcePropertyLi" ??_C@_1EG@HDDPFBMG@?$AAm?$AAs?$AAD?$AAS?$AA?9?$AAM?$AAe?$AAm?$AAb?$AAe?$AAr?$AAs?$AAO?$AAf?$AAR?$AAe?$AAs?$AAo?$AAu?$AAr?$AAc?$AAe?$AAP?$AAr?$AAo?$AAp?$AAe?$AAr?$AAt?$AAy?$AAL?$AAi@
0x180005770: "__cdecl _delayLoadHelper2" __delayLoadHelper2
0x18001B160: AuthzpCreateCapCache
0x180002760: AuthzGetInformationFromContext
0x18001CE38: AuthzpRetrievePrivileges
0x1800422C0: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x1800361C8: "__cdecl _imp__o__execute_onexit_table" __imp__o__execute_onexit_table
0x180013260: AuthzRegisterCapChangeNotification
0x1800060D4: AuthzpEnQueueAuditEventMonitor
0x18001D64C: "unsigned long __cdecl CopyCapeDetails(struct _CENTRAL_ACCESS_POLICY_ENTRY * __ptr64,struct _CENTRAL_POLICY_ENTRY * __ptr64,unsigned char * __ptr64,unsigned __int64)" ?CopyCapeDetails@@YAKPEAU_CENTRAL_ACCESS_POLICY_ENTRY@@PEAU_CENTRAL_POLICY_ENTRY@@PEAE_K@Z
0x180042144: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-crt-private-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-crt-private-l1-1-0
0x180023B50: LsaQueryCAPs
0x18003D650: "CN=Central Access Policies,CN=Cl" ??_C@_1KC@KJKIOKDO@?$AAC?$AAN?$AA?$DN?$AAC?$AAe?$AAn?$AAt?$AAr?$AAa?$AAl?$AA?5?$AAA?$AAc?$AAc?$AAe?$AAs?$AAs?$AA?5?$AAP?$AAo?$AAl?$AAi?$AAc?$AAi?$AAe?$AAs?$AA?0?$AAC?$AAN?$AA?$DN?$AAC?$AAl@
0x18000A750: "__cdecl _tailMerge_dsrole_dll" __tailMerge_dsrole_dll
0x180035FF0: "__cdecl _imp_VirtualProtect" __imp_VirtualProtect
0x180040B70: DSROLE_NULL_THUNK_DATA_DLN
0x180013690: AuthzShutdownRemoteAccessCheck
0x180047010: DSROLE_NULL_THUNK_DATA_DLA
0x180041528: DSROLE_NULL_THUNK_DATA_DLB
0x18001EDD4: "public: void * __ptr64 __cdecl CClaimDictionary::`scalar deleting destructor'(unsigned int) __ptr64" ??_GCClaimDictionary@@QEAAPEAXI@Z
0x180044850: "__cdecl _scrt_current_native_startup_state" __scrt_current_native_startup_state
0x1800441F8: "__cdecl _security_cookie_complement" __security_cookie_complement
0x18003DF00: "whenChanged" ??_C@_1BI@DJAFIECJ@?$AAw?$AAh?$AAe?$AAn?$AAC?$AAh?$AAa?$AAn?$AAg?$AAe?$AAd?$AA?$AA@
0x180036830: "__cdecl _sz_DSROLE_dll" __sz_DSROLE_dll
0x18000AA5A: "__cdecl _imp_load_ldap_first_attributeW" __imp_load_ldap_first_attributeW
0x18000328C: AuthzpInitSidHash
0x180012AF0: AuthzInitializeObjectAccessAuditEvent
0x1800472C8: "__cdecl _imp_AuthzrExtInitializeCompoundContext" __imp_AuthzrExtInitializeCompoundContext
0x18003E170: "127.0.0.1" ??_C@_1BE@KGBJBGOH@?$AA1?$AA2?$AA7?$AA?4?$AA0?$AA?4?$AA0?$AA?4?$AA1?$AA?$AA@
0x18000AAD8: "__cdecl _imp_load_ldap_count_valuesW" __imp_load_ldap_count_valuesW
0x18001B69C: AuthzpGetAccountDomainGroupsDs
0x18001B0A0: s_AuthzrModifySids
0x180047220: "__cdecl _imp_ldap_set_optionW" __imp_ldap_set_optionW
0x180036040: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x180047028: "__cdecl _imp_NdrServerCallAll" __imp_NdrServerCallAll
0x18000A216: "__cdecl configure_narrow_argv" _configure_narrow_argv
0x1800027BC: AuthzpGetInformationFromContext
0x18000AEFC: "__cdecl _vcrt_thread_attach" __vcrt_thread_attach
0x180047250: "__cdecl _imp_LookupAccountSidW" __imp_LookupAccountSidW
0x1800448D8: "__cdecl _hmod__api_ms_win_security_lsalookup_l2_1_0_dll" __hmod__api_ms_win_security_lsalookup_l2_1_0_dll
0x180001860: AuthzpIsSidInClientContext
0x1800363B0: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x1800470F8: "__cdecl _imp_SamGetGroupsForUser" __imp_SamGetGroupsForUser
0x1800149A0: WppControlCallback
0x18000A563: "__cdecl _imp_load_RpcExceptionFilter" __imp_load_RpcExceptionFilter
0x18000B0C0: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x1800471C0: "__cdecl _imp_ldap_search_abandon_page" __imp_ldap_search_abandon_page
0x1800470D0: "__cdecl _imp_RpcEpUnregister" __imp_RpcEpUnregister
0x1800470A0: "__cdecl _imp_RpcServerRegisterAuthInfoW" __imp_RpcServerRegisterAuthInfoW
0x18001C940: AuthzpGetTokenGroupsDownlevel
0x18001BC20: AuthzpGetDcName
0x18001E090: GetCentralAccessPoliciesByCapID
0x180036368: "__cdecl _imp_RtlUnsubscribeWnfNotificationWaitForCompletion" __imp_RtlUnsubscribeWnfNotificationWaitForCompletion
0x1800175D0: AuthzpGenerateAudit
0x18000AE69: "__cdecl _imp_load_SamOpenDomain" __imp_load_SamOpenDomain
0x180004D54: AuthzpInitializeSidSetBySid
0x18001A26C: AuthzpReferenceQuotaHandle
0x18000A278: "__cdecl vsnwprintf" _vsnwprintf
0x1800166BC: AuthzpCaptureObjectTypeList
0x180017578: AuthzpFillReplyStructureFromCachedGrantedAccessMask
0x180028704: AuthzBasepEvaluateExpression
0x180004674: AuthzpGetSecurityInfoBySid
0x180008B30: AuthzInitializeRemoteAccessCheck
0x18003DE00: "msDS-ClaimSharesPossibleValuesWi" ??_C@_1EG@JABCKPFO@?$AAm?$AAs?$AAD?$AAS?$AA?9?$AAC?$AAl?$AAa?$AAi?$AAm?$AAS?$AAh?$AAa?$AAr?$AAe?$AAs?$AAP?$AAo?$AAs?$AAs?$AAi?$AAb?$AAl?$AAe?$AAV?$AAa?$AAl?$AAu?$AAe?$AAs?$AAW?$AAi@
0x180036550: "__cdecl _xp_a" __xp_a
0x1800472A8: "__cdecl _imp_AuthzrExtInitializeRemoteResourceManager" __imp_AuthzrExtInitializeRemoteResourceManager
0x1800361D0: "__cdecl _imp__o__initialize_narrow_environment" __imp__o__initialize_narrow_environment
0x18000AA90: "__cdecl _imp_load_ldap_memfreeW" __imp_load_ldap_memfreeW
0x18000AF08: "__cdecl is_c_termination_complete" _is_c_termination_complete
0x180047138: "__cdecl _imp_SamOpenUser" __imp_SamOpenUser
0x180047160: "__cdecl _imp_LsaDeregisterLogonProcess" __imp_LsaDeregisterLogonProcess
0x180025BF4: AuthzBasepCopyoutSecurityAttributes
0x180009F34: "__cdecl RTC_Initialize" _RTC_Initialize
0x180001250: AuthzpExamineSacl
0x18003D4E0: "AuthzApi" ??_C@_08LICLGFGG@AuthzApi?$AA@
0x180013B80: AuthziInitializeContextFromSid
0x180044918: g_ulAdditionalProbeSize
0x180005260: PLSAPR_SERVER_NAME_bind
0x1800364C8: "__cdecl _imp_EtwGetTraceLoggerHandle" __imp_EtwGetTraceLoggerHandle
0x18000A671: "__cdecl _imp_load_LsaConnectUntrusted" __imp_load_LsaConnectUntrusted
0x18003E1F8: "__cdecl _pfnDliFailureHook2" __pfnDliFailureHook2
0x18000AEFC: "__cdecl _vcrt_thread_detach" __vcrt_thread_detach
0x180036090: "__cdecl _imp_RegDeleteKeyExW" __imp_RegDeleteKeyExW
0x180019EA8: AuthzrModifyClaims
0x180023234: "unsigned long __cdecl LdapResolveDomainDn(struct ldap * __ptr64,unsigned short * __ptr64 * __ptr64)" ?LdapResolveDomainDn@@YAKPEAUldap@@PEAPEAG@Z
0x1800167D8: AuthzpClearAuthzSecurityAttributesInheritableFlag
0x18003E770: "__cdecl _rtc_taa" __rtc_taa
0x180036098: "__cdecl _imp_RegEnumValueW" __imp_RegEnumValueW
0x180027330: AuthzBasepCompareIntegerOperands
0x180036258: "__cdecl _imp__initterm_e" __imp__initterm_e
0x180036930: "__cdecl _sz_api_ms_win_security_sddlparsecond_l1_1_0_dll" __sz_api_ms_win_security_sddlparsecond_l1_1_0_dll
0x18000AA24: "__cdecl _imp_load_ber_free" __imp_load_ber_free
0x180035FC8: api-ms-win-core-heap-l2-1-0_NULL_THUNK_DATA
0x180041410: api-ms-win-security-sddl-l1-1-0_NULL_THUNK_DATA_DLB
0x180021DF0: "unsigned long __cdecl LdapParseCapAttribute(struct ldap * __ptr64,struct ldapmsg * __ptr64,unsigned short * __ptr64,unsigned short * __ptr64 * __ptr64 const,unsigned long,struct _CENTRAL_POLICY * __ptr64)" ?LdapParseCapAttribute@@YAKPEAUldap@@PEAUldapmsg@@PEAGQEAPEAGKPEAU_CENTRAL_POLICY@@@Z
0x180036268: api-ms-win-crt-runtime-l1-1-0_NULL_THUNK_DATA
0x18000A1A4: "__cdecl _scrt_is_ucrt_dll_in_use" __scrt_is_ucrt_dll_in_use
0x18001BF98: AuthzpGetPrimaryGroup
0x180024AA8: AuthzBasepAuthzGetSecurityAttributeValueCopyoutBufferSize
0x1800055B4: WppInitUm
0x18000AEFC: "__cdecl _vcrt_initialize" __vcrt_initialize
0x180036140: "__cdecl _imp_SetEvent" __imp_SetEvent
0x18000440C: AuthzBasepRemoveSecurityAttributeFromLists
0x1800361D8: "__cdecl _imp__initialize_onexit_table" __imp__initialize_onexit_table
0x180005B70: AuthzFreeAuditEvent
0x18000A65F: "__cdecl _imp_load_RpcBindingVectorFree" __imp_load_RpcBindingVectorFree
0x180003F60: AuthzBasepAllocateSecurityAttributeValue
0x18000A575: "__cdecl _imp_load_RpcBindingInqObject" __imp_load_RpcBindingInqObject
0x1800364E0: "__cdecl _imp_RtlEnterCriticalSection" __imp_RtlEnterCriticalSection
0x180014CE0: AuthzpIsLocalSystem
0x180036518: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x1800262D8: AuthzBasepGetSecurityAttributesCopyoutBufferSize
0x18001B1D8: AuthzpFetchCapFromCache
0x18000A440: NdrServerCall2
0x180013330: AuthzRegisterSecurityEventSource
0x18003DFB0: "msAuthz-EffectiveSecurityPolicy" ??_C@_1EA@CPEGLIOC@?$AAm?$AAs?$AAA?$AAu?$AAt?$AAh?$AAz?$AA?9?$AAE?$AAf?$AAf?$AAe?$AAc?$AAt?$AAi?$AAv?$AAe?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AAP?$AAo?$AAl?$AAi?$AAc?$AAy?$AA?$AA@
0x18003D4B8: "UseGroupRecursion" ??_C@_1CE@GGCOBNHF@?$AAU?$AAs?$AAe?$AAG?$AAr?$AAo?$AAu?$AAp?$AAR?$AAe?$AAc?$AAu?$AAr?$AAs?$AAi?$AAo?$AAn?$AA?$AA@
0x18000581C: LsaGetInprocDispatchTable
0x180036128: "__cdecl _imp_InitializeCriticalSection" __imp_InitializeCriticalSection
0x18001AB90: s_AuthzrFreeContext
0x18000A426: "__cdecl _imp_load_NdrServerCall2" __imp_load_NdrServerCall2
0x1800470B8: "__cdecl _imp_RpcEpRegisterW" __imp_RpcEpRegisterW
0x1800361F8: "__cdecl _imp__wcsnicmp" __imp__wcsnicmp
0x180019FD0: AUTHZR_HANDLE_rundown
0x18000A975: "__cdecl _imp_load_LookupAccountSidW" __imp_load_LookupAccountSidW
0x1800041EC: AuthzBasepFinaliseSecurityAttributesList
0x18000A2E0: "__cdecl _imp_load_I_RpcMapWin32Status" __imp_load_I_RpcMapWin32Status
0x1800448E8: "__cdecl _hmod__ext_ms_win_authz_remote_l1_1_0_dll" __hmod__ext_ms_win_authz_remote_l1_1_0_dll
0x18000A252: "__cdecl o__wcsnicmp" _o__wcsnicmp
0x18002486C: AuthzBasepAuthzGetAttributeToTokenAttributeSize
0x18003E760: "__cdecl _rtc_iaa" __rtc_iaa
0x18000AEFC: "__cdecl _acrt_thread_attach" __acrt_thread_attach
0x180036418: "__cdecl _imp_RtlInitString" __imp_RtlInitString
0x1800448A0: "__cdecl _hmod__RPCRT4_dll" __hmod__RPCRT4_dll
0x18000A4F7: "__cdecl _imp_load_ldap_initW" __imp_load_ldap_initW
0x180036320: "__cdecl _imp_GetSecurityDescriptorControl" __imp_GetSecurityDescriptorControl
0x180040DB8: api-ms-win-security-lsalookup-l2-1-0_NULL_THUNK_DATA_DLN
0x180004BFC: AuthzpAddSidToSidSet
0x180017C88: AuthzpGetDefaultCape
0x18000A732: "__cdecl _imp_load_LsaDeregisterLogonProcess" __imp_load_LsaDeregisterLogonProcess
0x180040DA8: api-ms-win-security-lsalookup-l1-1-0_NULL_THUNK_DATA_DLN
0x18001F080: "private: void __cdecl CClaimDictionary::GetClaimArray(enum CLAIM_DEFINITION_TYPE,struct CLAIM_OBJECT * __ptr64 * __ptr64,unsigned long * __ptr64) __ptr64" ?GetClaimArray@CClaimDictionary@@AEAAXW4CLAIM_DEFINITION_TYPE@@PEAPEAUCLAIM_OBJECT@@PEAK@Z
0x180036398: "__cdecl _imp_RtlOwnerAcesPresent" __imp_RtlOwnerAcesPresent
0x180047248: api-ms-win-security-lsalookup-l1-1-0_NULL_THUNK_DATA_DLA
0x180041598: api-ms-win-security-lsalookup-l2-1-0_NULL_THUNK_DATA_DLB
0x18000486C: AuthzpDeleteSidSet
0x180041658: api-ms-win-security-lsalookup-l1-1-0_NULL_THUNK_DATA_DLB
0x180047258: api-ms-win-security-lsalookup-l2-1-0_NULL_THUNK_DATA_DLA
0x180036228: "__cdecl _imp__o___stdio_common_vswprintf" __imp__o___stdio_common_vswprintf
0x180036520: "__cdecl _xc_a" __xc_a
0x180036238: "__cdecl _imp_wcsstr" __imp_wcsstr
0x1800470E0: "__cdecl _imp_RpcBindingInqObject" __imp_RpcBindingInqObject
0x1800019F0: AuthzpNormalAccessCheck
0x18001BC84: AuthzpGetLocalGroups
0x180047230: "__cdecl _imp_ldap_search_init_pageW" __imp_ldap_search_init_pageW
0x180026978: RtlStringCbCopyNW
0x180047268: "__cdecl _imp_ConvertStringSidToSidW" __imp_ConvertStringSidToSidW
0x1800367C0: "__cdecl pDefaultRawDllMain" _pDefaultRawDllMain
0x180036188: "__cdecl _imp_GetComputerNameExW" __imp_GetComputerNameExW
0x1800361C0: "__cdecl _imp__o__configure_narrow_argv" __imp__o__configure_narrow_argv
0x18001B86C: AuthzpGetAccountDomainGroupsSam
0x180044210: "__cdecl _scrt_ucrt_dll_is_in_use" __scrt_ucrt_dll_is_in_use
0x180019D5C: AuthzrInitializeRemoteResourceManager
0x180018830: GenerateNewCAPID
0x1800471D0: "__cdecl _imp_ldap_get_next_page_s" __imp_ldap_get_next_page_s
0x1800364F8: "__cdecl _imp_NtAllocateLocallyUniqueId" __imp_NtAllocateLocallyUniqueId
0x180047208: "__cdecl _imp_ldap_next_attributeW" __imp_ldap_next_attributeW
0x180047130: "__cdecl _imp_SamOpenDomain" __imp_SamOpenDomain
0x1800063DC: AuthzpGetProcessTokenInfo
0x18003D0E0: "Microsoft-Windows-Security-Audit" ??_C@_1EI@PMFGCIEG@?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?9?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?9?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?9?$AAA?$AAu?$AAd?$AAi?$AAt@
0x180006950: AuthzpAccessCheckWithCaching
0x180004E80: AuthzInitializeObjectAccessAuditEvent2
0x180036338: "__cdecl _imp_SetSecurityDescriptorOwner" __imp_SetSecurityDescriptorOwner
0x180047278: api-ms-win-security-sddl-l1-1-0_NULL_THUNK_DATA_DLA
0x18000AAA2: "__cdecl _imp_load_ldap_search_abandon_page" __imp_load_ldap_search_abandon_page
0x18000A587: "__cdecl _imp_load_RpcServerInqCallAttributesW" __imp_load_RpcServerInqCallAttributesW
0x180024D34: AuthzBasepAuthzQuerySecurityAttributesToken
0x180020BD8: "long __cdecl AuthzEscapeLdapFilterValues(unsigned short const * __ptr64,unsigned short * __ptr64 * __ptr64)" ?AuthzEscapeLdapFilterValues@@YAJPEBGPEAPEAG@Z
0x18003DD18: "msDS-ClaimIsSingleValued" ??_C@_1DC@OPHILLPN@?$AAm?$AAs?$AAD?$AAS?$AA?9?$AAC?$AAl?$AAa?$AAi?$AAm?$AAI?$AAs?$AAS?$AAi?$AAn?$AAg?$AAl?$AAe?$AAV?$AAa?$AAl?$AAu?$AAe?$AAd?$AA?$AA@
0x180036430: "__cdecl _imp_RtlNtStatusToDosErrorNoTeb" __imp_RtlNtStatusToDosErrorNoTeb
0x180036470: "__cdecl _imp_RtlIsNameInExpression" __imp_RtlIsNameInExpression
0x180005590: PSECURITY_SOURCE_NAME_unbind
0x180019A38: AuthzrGetInformationFromContext
0x18000AEE7: "__cdecl _imp_load_SamQueryInformationUser" __imp_load_SamQueryInformationUser
0x180044208: "__cdecl _memcpy_nt_iters" __memcpy_nt_iters
0x18000A1FE: "__cdecl callnewh" _callnewh
0x180036218: "__cdecl _imp__o_malloc" __imp__o_malloc
0x18002A060: LsapLookupSids
0x180036280: "__cdecl _imp_wcsncmp" __imp_wcsncmp
0x18003676C: "__cdecl _guard_iat_table" __guard_iat_table
0x18000AAEC: IsAuthzrExtInitializeContextFromSidPresent
0x18000B09F: memcpy
0x1800471A0: "__cdecl _imp_ldap_first_attributeW" __imp_ldap_first_attributeW
0x1800471A8: "__cdecl _imp_ldap_next_entry" __imp_ldap_next_entry
0x180044260: AuthzTakeOwnershipPrivilege
0x180044940: g_AuthzQuotaTableLock
0x180036270: "__cdecl _imp_memset" __imp_memset
0x18000AEFC: "__cdecl _acrt_initialize" __acrt_initialize
0x180036158: "__cdecl _imp_CreateEventW" __imp_CreateEventW
0x18000A1B6: "__cdecl initterm" _initterm
0x1800472B8: "__cdecl _imp_AuthzrExtAccessCheck" __imp_AuthzrExtAccessCheck
0x180036840: "__cdecl _sz_netutils_dll" __sz_netutils_dll
0x18000ADA8: "__cdecl _imp_load_RpcBindingFree" __imp_load_RpcBindingFree
0x180004488: AuthzBasepDeleteAllSecurityAttributes
0x180047098: "__cdecl _imp_RpcServerInqDefaultPrincNameW" __imp_RpcServerInqDefaultPrincNameW
0x18000A23A: "__cdecl o__initialize_onexit_table" _o__initialize_onexit_table
0x1800138E0: AuthziCheckContextMembership
0x18004220C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0
0x180044908: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x18003DDD0: "msDS-ValueTypeReference" ??_C@_1DA@MCFLKEBE@?$AAm?$AAs?$AAD?$AAS?$AA?9?$AAV?$AAa?$AAl?$AAu?$AAe?$AAT?$AAy?$AAp?$AAe?$AAR?$AAe?$AAf?$AAe?$AAr?$AAe?$AAn?$AAc?$AAe?$AA?$AA@
0x180036168: "__cdecl _imp_Sleep" __imp_Sleep
0x180023CE0: "__cdecl resetstkoflw_static" _resetstkoflw_static
0x180036410: "__cdecl _imp_RtlSubAuthoritySid" __imp_RtlSubAuthoritySid
0x180003F9C: AuthzBasepFindSecurityAttributeValue
0x180036548: "__cdecl _xi_z" __xi_z
0x180035F90: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x180036278: "__cdecl _imp_wcscmp" __imp_wcscmp
0x18003DC90: "(&(Enabled=TRUE)" ??_C@_1CC@MNDDNDDB@?$AA?$CI?$AA?$CG?$AA?$CI?$AAE?$AAn?$AAa?$AAb?$AAl?$AAe?$AAd?$AA?$DN?$AAT?$AAR?$AAU?$AAE?$AA?$CJ?$AA?$AA@
0x18001DB34: "unsigned long __cdecl GetCentralAccessPolicies(unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short * __ptr64,unsigned long,struct _CENTRAL_ACCESS_POLICY * __ptr64 * __ptr64,struct _UNICODE_STRING * __ptr64 * __ptr64,unsigned long * __ptr64)" ?GetCentralAccessPolicies@@YAKPEBG0PEAGKPEAPEAU_CENTRAL_ACCESS_POLICY@@PEAPEAU_UNICODE_STRING@@PEAK@Z
0x1800364B0: "__cdecl _imp_EtwRegisterTraceGuidsW" __imp_EtwRegisterTraceGuidsW
0x18000A1DA: "__cdecl _C_specific_handler" __C_specific_handler
0x1800472B0: "__cdecl _imp_AuthzrExtInitializeContextFromSid" __imp_AuthzrExtInitializeContextFromSid
0x180019520: MIDL_user_free
0x18001721C: AuthzpEveryoneIncludesAnonymous
0x180004388: AuthzBasepRemoveSecurityAttributeValueFromLists
0x1800142E8: AuthzpModifyClaims
0x180025220: AuthzBasepConvertRelativeToAbsoluteTokenAttribute
0x18000AEFC: "__cdecl _acrt_thread_detach" __acrt_thread_detach
0x1800057AC: AuthzpInitializeCapCaching
0x1800362F0: "__cdecl _imp_AddAccessAllowedAce" __imp_AddAccessAllowedAce
0x1800472F0: netutils_NULL_THUNK_DATA_DLA
0x180041538: netutils_NULL_THUNK_DATA_DLB
0x180040E50: netutils_NULL_THUNK_DATA_DLN
0x180047290: "__cdecl _imp_AuthzrExtFreeContext" __imp_AuthzrExtFreeContext
0x18003D500: "tokenGroupsGlobalAndUniversal" ??_C@_1DM@MCOKKPLH@?$AAt?$AAo?$AAk?$AAe?$AAn?$AAG?$AAr?$AAo?$AAu?$AAp?$AAs?$AAG?$AAl?$AAo?$AAb?$AAa?$AAl?$AAA?$AAn?$AAd?$AAU?$AAn?$AAi?$AAv?$AAe?$AAr?$AAs?$AAa?$AAl?$AA?$AA@
0x1800277DC: AuthzBasepCompareUnsigned
0x1800449E0: WPP_REGISTRATION_GUIDS
0x1800363D0: "__cdecl _imp_RtlLengthRequiredSid" __imp_RtlLengthRequiredSid
0x18000AA48: "__cdecl _imp_load_ConvertStringSecurityDescriptorToSecurityDescriptorW" __imp_load_ConvertStringSecurityDescriptorToSecurityDescriptorW
0x180036458: "__cdecl _imp_RtlCopyUnicodeString" __imp_RtlCopyUnicodeString
0x180009D8C: "__cdecl _scrt_uninitialize_crt" __scrt_uninitialize_crt
0x18000A26A: malloc
0x180047178: "__cdecl _imp_ldap_msgfree" __imp_ldap_msgfree
0x180036200: "__cdecl _imp__wtoi" __imp__wtoi
0x180035FB0: api-ms-win-core-handle-l1-1-0_NULL_THUNK_DATA
0x180029E5C: LsapFreePrivateHandle
0x1800360B8: "__cdecl _imp_RegCloseKey" __imp_RegCloseKey
0x180036490: "__cdecl _imp_NtQueryInformationToken" __imp_NtQueryInformationToken
0x18000AFC4: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x180029244: AuthzBasepRestartOperandValueEnumeration
0x1800448F0: "__cdecl _hmod__api_ms_win_security_lsalookup_l1_1_0_dll" __hmod__api_ms_win_security_lsalookup_l1_1_0_dll
0x180007C1C: AuthzBasepSetAccessReasons
0x180047050: "__cdecl _imp_RpcSsDestroyClientContext" __imp_RpcSsDestroyClientContext
0x18000A1E6: "__cdecl o___std_type_info_destroy_list" _o___std_type_info_destroy_list
0x180009CC0: "__cdecl _scrt_is_nonwritable_in_current_image" __scrt_is_nonwritable_in_current_image
0x180021D58: "void __cdecl LdapDeleteResourceList(struct _RESOURCE_CLAIM_LIST * __ptr64 const,unsigned __int64)" ?LdapDeleteResourceList@@YAXQEAU_RESOURCE_CLAIM_LIST@@_K@Z
0x18002A5E0: RtlStringCbCatW
0x18000884C: AuthzpInitializeContextFromAuthzContext
0x18000A20A: "__cdecl cexit" _cexit
0x18000A25E: "__cdecl o_free" _o_free
0x180013640: AuthzSetAppContainerInformation
0x180009B90: "__cdecl _scrt_initialize_crt" __scrt_initialize_crt
0x1800134D0: AuthzReportSecurityEventFromParams
0x18000A70E: "__cdecl _imp_load_LsaLogonUser" __imp_load_LsaLogonUser
0x180002E20: AuthzInitializeContextFromToken
0x180044248: AuthzpAnonymousSidBuffer
0x180025988: AuthzBasepCopyoutSecurityAttributeValues
0x1800360B0: "__cdecl _imp_RegEnumKeyExW" __imp_RegEnumKeyExW
0x180018260: AuthzpQuickNormalAccessCheck
0x1800011E0: AuthziAllocateAuditParams
0x18003D1E0: "EventMessageFile" ??_C@_1CC@JONFAEOP@?$AAE?$AAv?$AAe?$AAn?$AAt?$AAM?$AAe?$AAs?$AAs?$AAa?$AAg?$AAe?$AAF?$AAi?$AAl?$AAe?$AA?$AA@
0x180018D58: AuthzpConvertAuthzrClaimsToAuthzClaims
0x180026A84: RtlULongLongMult
0x18000AEFC: "__cdecl _acrt_uninitialize" __acrt_uninitialize
0x180036288: api-ms-win-crt-string-l1-1-0_NULL_THUNK_DATA
0x18000A222: "__cdecl o__execute_onexit_table" _o__execute_onexit_table
0x180023CC0: SafeAllocaFreeToHeap
0x1800099B8: "void __cdecl __scrt_uninitialize_type_info(void)" ?__scrt_uninitialize_type_info@@YAXXZ
0x180036438: "__cdecl _imp_RtlAllocateHeap" __imp_RtlAllocateHeap
0x180016804: AuthzpCompoundUserContext
0x180044A00: WPP_MAIN_CB
0x1800029F0: AuthzFreeContext
0x18000A252: "__cdecl wcsnicmp" _wcsnicmp
0x180016A90: AuthzpComputeClaimAttributesCollectionSize
0x180024F28: AuthzBasepAuthzValidateSecurityAttributes
0x1800421BC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0
0x180011844: AuthzpParseCommandLine
0x180020080: FreeClaimDictionary
0x180012B40: AuthzInitializeRemoteResourceManager
0x18003D610: "(msAuthz-CentralAccessPolicyID=" ??_C@_1EA@IIDCNOIE@?$AA?$CI?$AAm?$AAs?$AAA?$AAu?$AAt?$AAh?$AAz?$AA?9?$AAC?$AAe?$AAn?$AAt?$AAr?$AAa?$AAl?$AAA?$AAc?$AAc?$AAe?$AAs?$AAs?$AAP?$AAo?$AAl?$AAi?$AAc?$AAy?$AAI?$AAD?$AA?$DN?$AA?$AA@
0x1800360C0: "__cdecl _imp_RegSetValueExW" __imp_RegSetValueExW
0x1800361B0: "__cdecl _imp__callnewh" __imp__callnewh
0x1800362D0: "__cdecl _imp_IsWellKnownSid" __imp_IsWellKnownSid
0x180001010: AuthziSourceAudit
0x180005590: PAUTHZ_AUDIT_EVENT_TYPE_OLD_unbind
0x18003E1F4: "__cdecl _DefaultResolveDelayLoadedAPIFlags" __DefaultResolveDelayLoadedAPIFlags
0x18000A51B: "__cdecl _imp_load_LdapGetLastError" __imp_load_LdapGetLastError
0x180008754: AuthzBasepObjectInTypeList
0x18001EE70: "public: void __cdecl CClaimDictionary::ClearClaimDictionary(void) __ptr64" ?ClearClaimDictionary@CClaimDictionary@@QEAAXXZ
0x180044A30: gLSARPCInprocFunctions
0x180044A50: g_pAuthzQuotaTable
0x18003D4F0: "Kerberos" ??_C@_08DEIMIBAF@Kerberos?$AA@
0x180026684: AuthzBasepQuerySecurityAttributeAndValues
0x18000AEFC: "__cdecl _scrt_stub_for_acrt_thread_detach" __scrt_stub_for_acrt_thread_detach
0x18000A64D: "__cdecl _imp_load_RpcEpUnregister" __imp_load_RpcEpUnregister
0x1800033F8: AuthzpAddDynamicSidsToToken
0x1800290AC: AuthzBasepOperandValueTypesCompatible
0x180026BD4: AuthzBasepDeleteSid
0x1800448A8: "__cdecl _hmod__api_ms_win_security_sddl_l1_1_0_dll" __hmod__api_ms_win_security_sddl_l1_1_0_dll
0x18000AA36: "__cdecl _imp_load_ldap_search_init_pageW" __imp_load_ldap_search_init_pageW
0x18000A744: "__cdecl _imp_load_DsRoleGetPrimaryDomainInformation" __imp_load_DsRoleGetPrimaryDomainInformation
0x18002965C: LsaICLookupSids
0x180009B3C: "__cdecl _scrt_dllmain_uninitialize_c" __scrt_dllmain_uninitialize_c
0x180017344: AuthzpExamineSaclForObjectTypeList
0x180002738: AuthzpFillReplyStructure
0x180026FF4: AuthzBasepValidateSids
0x180036480: "__cdecl _imp_RtlSidHashInitialize" __imp_RtlSidHashInitialize
0x1800204D8: "long __cdecl AuthzpComputeEffectivePermission(void * __ptr64,void * __ptr64,unsigned short const * __ptr64,struct _SECURITY_OBJECT * __ptr64,unsigned long,struct _TOKEN_GROUPS * __ptr64,enum AUTHZ_SID_OPERATION * __ptr64,struct _TOKEN_GROUPS * __ptr64,enum AUTHZ_SID_OPERATION * __ptr64,struct _AUTHZ_SECURITY_ATTRIBUTES_INFORMATION * __ptr64,enum AUTHZ_SECURITY_ATTRIBUTE_OPERATION * __ptr64,struct _AUTHZ_SECURITY_ATTRIBUTES_INFORMATION * __ptr64,enum AUTHZ_SECURITY_ATTRIBUTE_OPERATION * __ptr64,struct _EFFPERM_RESULT_LIST * __ptr64,struct AUTHZ_RESOURCE_MANAGER_HANDLE__ * __ptr64)" ?AuthzpComputeEffectivePermission@@YAJPEAX0PEBGPEAU_SECURITY_OBJECT@@KPEAU_TOKEN_GROUPS@@PEAW4AUTHZ_SID_OPERATION@@34PEAU_AUTHZ_SECURITY_ATTRIBUTES_INFORMATION@@PEAW4AUTHZ_SECURITY_ATTRIBUTE_OPERATION@@56PEAU_EFFPERM_RESULT_LIST@@PEAUAUTHZ_RESOURCE_MANAGER_HANDLE__@@@Z
0x1800081A0: VerifyStackAvailable
0x1800409C0: "__cdecl _DELAY_IMPORT_DESCRIPTOR_RPCRT4_dll" __DELAY_IMPORT_DESCRIPTOR_RPCRT4_dll
0x18003D260: "XmlSchemaFile" ??_C@_1BM@HKFOAOIJ@?$AAX?$AAm?$AAl?$AAS?$AAc?$AAh?$AAe?$AAm?$AAa?$AAF?$AAi?$AAl?$AAe?$AA?$AA@
0x1800363C8: "__cdecl _imp_RtlInitializeCriticalSection" __imp_RtlInitializeCriticalSection
0x18000A22E: "__cdecl o__initialize_narrow_environment" _o__initialize_narrow_environment
0x18000ACF3: "__cdecl _tailMerge_api_ms_win_security_sddlparsecond_l1_1_0_dll" __tailMerge_api_ms_win_security_sddlparsecond_l1_1_0_dll
0x18000AC37: "__cdecl _imp_load_AuthzrExtModifyClaims" __imp_load_AuthzrExtModifyClaims
0x180019FF0: AuthzpAllocateQuotaHandle
0x180036AD0: "__cdecl _real@3fe8000000000000" __real@3fe8000000000000
0x180006ED0: AuthzpMaximumAllowedMultipleSDAccessCheck
0x180036148: "__cdecl _imp_EnterCriticalSection" __imp_EnterCriticalSection
0x1800448D0: "__cdecl _hmod__logoncli_dll" __hmod__logoncli_dll
0x1800239BC: LsaEnumeratePrivilegesOfAccount
0x18000A605: "__cdecl _imp_load_RpcServerInqBindings" __imp_load_RpcServerInqBindings
0x1800360F0: api-ms-win-core-registry-l1-1-0_NULL_THUNK_DATA
0x180024118: AuthzBasepAuthzConvertFromTokenSecurityAttributeValueType
0x1800195D8: AuthzrAccessCheck
0x18000AEFC: "__cdecl _scrt_stub_for_acrt_initialize" __scrt_stub_for_acrt_initialize
0x18001C6F4: AuthzpGetSidHistory
0x180036300: "__cdecl _imp_GetSecurityDescriptorLength" __imp_GetSecurityDescriptorLength
0x180035FA0: api-ms-win-core-errorhandling-l1-1-0_NULL_THUNK_DATA
0x180006324: AuthzpSendAuditToLsa
0x1800361E0: "__cdecl _imp__o__seh_filter_dll" __imp__o__seh_filter_dll
0x1800270C0: AuthzBasepCompareFQBNOperands
0x180044980: AuthzpCacheLock
0x180014FA8: AuthzpReleaseLdapHandle
0x180021A24: "unsigned long __cdecl LdapConstructContainerName(unsigned short * __ptr64,unsigned short * __ptr64,unsigned short * __ptr64 * __ptr64)" ?LdapConstructContainerName@@YAKPEAG0PEAPEAG@Z
0x180036000: "__cdecl _imp_VirtualFree" __imp_VirtualFree
0x180036560: "__cdecl _xt_a" __xt_a
0x180012F90: AuthzModifySecurityAttributes
0x180044894: "__cdecl _scrt_debugger_hook_flag" __scrt_debugger_hook_flag
0x18003D7A0: WPP_6ef66fffcd463d0039bc1df2c4f5bd11_Traceguids
0x180036190: "__cdecl _imp_GetSystemInfo" __imp_GetSystemInfo
0x180036048: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x1800057E0: AuthzpInitializeLSARPCInprocFunctionsCallback
0x1800362A0: "__cdecl _imp_InitializeSid" __imp_InitializeSid
0x1800361E0: "__cdecl _imp__seh_filter_dll" __imp__seh_filter_dll
0x18003D8F0: "(cn=Global Resource Property Lis" ??_C@_1EG@NFFCGJIE@?$AA?$CI?$AAc?$AAn?$AA?$DN?$AAG?$AAl?$AAo?$AAb?$AAa?$AAl?$AA?5?$AAR?$AAe?$AAs?$AAo?$AAu?$AAr?$AAc?$AAe?$AA?5?$AAP?$AAr?$AAo?$AAp?$AAe?$AAr?$AAt?$AAy?$AA?5?$AAL?$AAi?$AAs@
0x180013D80: AuthziModifySecurityAttributes
0x180006450: AuthziInitializeAuditParams
0x180014A28: AuthzpFindCacheNode
0x1800470F0: RPCRT4_NULL_THUNK_DATA_DLA
0x180041400: RPCRT4_NULL_THUNK_DATA_DLB
0x18001B61C: AuthzpConvertSidToEdn
0x18000AA00: "__cdecl _imp_load_ldap_next_attributeW" __imp_load_ldap_next_attributeW
0x180036468: "__cdecl _imp_RtlUpcaseUnicodeChar" __imp_RtlUpcaseUnicodeChar
0x18000AF14: DllMain
0x180040C50: RPCRT4_NULL_THUNK_DATA_DLN
0x18000ADEA: "__cdecl _tailMerge_samlib_dll" __tailMerge_samlib_dll
0x18000AEFC: "__cdecl _scrt_stub_for_acrt_thread_attach" __scrt_stub_for_acrt_thread_attach
0x180047068: "__cdecl _imp_RpcExceptionFilter" __imp_RpcExceptionFilter
0x18003DAC0: ")" ??_C@_13DIBMAFH@?$AA?$CJ?$AA?$AA@
0x1800367B4: "DS" ??_C@_15DEMLGGK@?$AAD?$AAS?$AA?$AA@
0x18001B274: AuthzpGetLatestCapCache
0x1800367D0: "__cdecl _sz_RPCRT4_dll" __sz_RPCRT4_dll
0x180047170: SspiCli_NULL_THUNK_DATA_DLA
0x18000182C: AuthzpOwnerSidInClientContext
0x18003D440: "host/" ??_C@_1M@MAKFBKFH@?$AAh?$AAo?$AAs?$AAt?$AA?1?$AA?$AA@
0x180047088: "__cdecl _imp_UuidFromStringW" __imp_UuidFromStringW
0x18003D208: "ParameterMessageFile" ??_C@_1CK@EBDBJBGH@?$AAP?$AAa?$AAr?$AAa?$AAm?$AAe?$AAt?$AAe?$AAr?$AAM?$AAe?$AAs?$AAs?$AAa?$AAg?$AAe?$AAF?$AAi?$AAl?$AAe?$AA?$AA@
0x180016D18: AuthzpComputeClaimCollectionSize
0x180009F78: "__cdecl RTC_Terminate" _RTC_Terminate
0x1800054A8: AuthzpFreeResourceManager
0x18000A92D: "__cdecl _imp_load_ldap_value_free_len" __imp_load_ldap_value_free_len
0x1800470B0: "__cdecl _imp_RpcServerInqBindings" __imp_RpcServerInqBindings
0x180036408: "__cdecl _imp_RtlSubAuthorityCountSid" __imp_RtlSubAuthorityCountSid
0x1800361F0: "__cdecl _imp__wcsicmp" __imp__wcsicmp
0x1800362E8: "__cdecl _imp_IsValidSid" __imp_IsValidSid
0x180036240: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x18002B060: g_LsapBindingHandleSecurity
0x180036108: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x18003D540: "objectClass=*" ??_C@_1BM@LBAGCIDJ@?$AAo?$AAb?$AAj?$AAe?$AAc?$AAt?$AAC?$AAl?$AAa?$AAs?$AAs?$AA?$DN?$AA?$CK?$AA?$AA@
0x18000ADDE: "__cdecl _imp_load_SamConnect" __imp_load_SamConnect
0x180035FE8: api-ms-win-core-libraryloader-l1-2-0_NULL_THUNK_DATA
0x18003D560: "sidHistory" ??_C@_1BG@DENFIEFE@?$AAs?$AAi?$AAd?$AAH?$AAi?$AAs?$AAt?$AAo?$AAr?$AAy?$AA?$AA@
0x180044A48: g_AuthzQuotaTableSize
0x18001A1F4: AuthzpFreeQuotaTable
0x180047238: WLDAP32_NULL_THUNK_DATA_DLA
0x180044AF0: pAuthzpCurrentCapCache
0x180001F30: AuthzAccessCheck
0x180017808: AuthzpGetDaclForDefaultCape
0x180005DE0: AuthzpMarshallAuditParams
0x180035F80: "__cdecl _imp_GetLastError" __imp_GetLastError
0x180009174: "void * __ptr64 __cdecl operator new(unsigned __int64)" ??2@YAPEAX_K@Z
0x180047260: "__cdecl _imp_ConvertSidToStringSidW" __imp_ConvertSidToStringSidW
0x18003DA70: "WithCap" ??_C@_1BA@OOJGLDLA@?$AAW?$AAi?$AAt?$AAh?$AAC?$AAa?$AAp?$AA?$AA@
0x18002746C: AuthzBasepCompareOctetStringOperands
0x18000AFA0: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x18003DF78: "msAuthz-ResourceCondition" ??_C@_1DE@IPPHAMBP@?$AAm?$AAs?$AAA?$AAu?$AAt?$AAh?$AAz?$AA?9?$AAR?$AAe?$AAs?$AAo?$AAu?$AAr?$AAc?$AAe?$AAC?$AAo?$AAn?$AAd?$AAi?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x180036428: "__cdecl _imp_EtwTraceMessage" __imp_EtwTraceMessage
0x180017CF4: AuthzpGetDefaultCapeSd
0x18000A22E: "__cdecl initialize_narrow_environment" _initialize_narrow_environment
0x180036248: "__cdecl _imp_memcmp" __imp_memcmp
0x1800078C0: AuthzBasepAddAccessTypeList
0x1800471F8: "__cdecl _imp_ldap_unbind" __imp_ldap_unbind
0x180047030: "__cdecl _imp_RpcBindingCreateW" __imp_RpcBindingCreateW
0x180022B84: "unsigned long __cdecl LdapParsePossibleValueAttribute(unsigned short * __ptr64,unsigned short * __ptr64,struct CLAIM_OBJECT * __ptr64)" ?LdapParsePossibleValueAttribute@@YAKPEAG0PEAUCLAIM_OBJECT@@@Z
0x180024000: AuthzBasepAuthzConvertAttributeToTokenAttribute
0x180036058: "__cdecl _imp_SetThreadStackGuarantee" __imp_SetThreadStackGuarantee
0x180016F8C: AuthzpComputeSidCollectionSize
0x18000A5CF: "__cdecl _imp_load_RpcServerInqDefaultPrincNameW" __imp_load_RpcServerInqDefaultPrincNameW
0x1800361F8: "__cdecl _imp__o__wcsnicmp" __imp__o__wcsnicmp
0x180026E60: AuthzBasepModifySids
0x18001EEB8: "unsigned long __cdecl CopyPossibleValues(struct POSSIBLE_VALUE * __ptr64 const,unsigned long,struct POSSIBLE_VALUE * __ptr64 * __ptr64,unsigned long * __ptr64)" ?CopyPossibleValues@@YAKQEAUPOSSIBLE_VALUE@@KPEAPEAU1@PEAK@Z
0x180044204: "__cdecl _isa_enabled" __isa_enabled
0x180023A38: LsaOpenAccount
0x1800098E4: "void __cdecl operator delete(void * __ptr64,unsigned __int64)" ??3@YAXPEAX_K@Z
0x18003D5A8: "NULL" ??_C@_19CIJIHAKK@?$AAN?$AAU?$AAL?$AAL?$AA?$AA@
0x1800422E8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-0
0x180036020: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x180036130: "__cdecl _imp_WaitForSingleObject" __imp_WaitForSingleObject
0x18003D130: "SYSTEM\CurrentControlSet\Service" ??_C@_1GI@HCOOAKBB@?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA?2?$AAS?$AAe?$AAr?$AAv?$AAi?$AAc?$AAe@
0x18000A53F: "__cdecl _imp_load_ldap_bind_sW" __imp_load_ldap_bind_sW
0x180007AC8: AuthzBasepUpdateParentTypeList
0x1800360A0: "__cdecl _imp_RegDeleteValueW" __imp_RegDeleteValueW
0x180011A14: AuthzpEnQueueAuditEvent
0x180040B00: "__cdecl _DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_sddlparsecond_l1_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_sddlparsecond_l1_1_0_dll
0x18000A23A: "__cdecl initialize_onexit_table" _initialize_onexit_table
0x18003E1F4: "__cdecl _ResolveDelayLoadedAPIFlags" __ResolveDelayLoadedAPIFlags
0x180027A80: AuthzBasepEqualUnicodeStringCaseSensitive
0x18001A4D0: s_AuthzGetInformationFromContext
0x180044858: "__cdecl _scrt_native_startup_lock" __scrt_native_startup_lock
0x1800292B0: AuthzBasepUnicodeStringFromOperandValue
0x1800414F8: SspiCli_NULL_THUNK_DATA_DLB
0x18000A909: "__cdecl _imp_load_ldap_get_values_lenW" __imp_load_ldap_get_values_lenW
0x180044A78: AuthzpAuditsEnqueued
0x18000A67D: "__cdecl _tailMerge_sspicli_dll" __tailMerge_sspicli_dll
0x180008AB4: AuthzBasepDuplicateSecurityAttributes
0x1800470C0: "__cdecl _imp_RpcServerRegisterIf3" __imp_RpcServerRegisterIf3
0x1800238C4: "long __cdecl StringCchCopyW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64)" ?StringCchCopyW@@YAJPEAG_KPEBG@Z
0x180040A00: "__cdecl _DELAY_IMPORT_DESCRIPTOR_WLDAP32_dll" __DELAY_IMPORT_DESCRIPTOR_WLDAP32_dll
0x180044270: AuthzpEveryoneSidBuffer
0x18003D1C0: "ProviderGuid" ??_C@_1BK@KELFPHLL@?$AAP?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AAG?$AAu?$AAi?$AAd?$AA?$AA@
0x18003DFF0: "msAuthz-ProposedSecurityPolicy" ??_C@_1DO@ONPOECN@?$AAm?$AAs?$AAA?$AAu?$AAt?$AAh?$AAz?$AA?9?$AAP?$AAr?$AAo?$AAp?$AAo?$AAs?$AAe?$AAd?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AAP?$AAo?$AAl?$AAi?$AAc?$AAy?$AA?$AA@
0x18000AEFC: "__cdecl _vcrt_uninitialize" __vcrt_uninitialize
0x180047128: "__cdecl _imp_SamConnect" __imp_SamConnect
0x180036448: "__cdecl _imp_RtlFreeHeap" __imp_RtlFreeHeap
0x180036370: "__cdecl _imp_RtlInitializeResource" __imp_RtlInitializeResource
0x180036070: "__cdecl _imp_IsProcessorFeaturePresent" __imp_IsProcessorFeaturePresent
0x180036538: "__cdecl _PLEASE_LINK_WITH_legacy_stdio_wide_specifiers.lib" __PLEASE_LINK_WITH_legacy_stdio_wide_specifiers.lib
0x180040AC0: "__cdecl _DELAY_IMPORT_DESCRIPTOR_ext_ms_win_authz_remote_l1_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_ext_ms_win_authz_remote_l1_1_0_dll
0x180041440: WLDAP32_NULL_THUNK_DATA_DLB
0x1800421E4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0
0x18000AC25: "__cdecl _imp_load_AuthzrExtGetInformationFromContext" __imp_load_AuthzrExtGetInformationFromContext
0x180003918: AuthzpAllocateAndInitializeClientContext
0x1800363A0: "__cdecl _imp_RtlLengthSecurityDescriptor" __imp_RtlLengthSecurityDescriptor
0x18000A478: "__cdecl _tailMerge_wldap32_dll" __tailMerge_wldap32_dll
0x18001EC60: WPP_SF_
0x180017050: AuthzpCreateSecurityDescriptorFromCape
0x180005C90: AuthziLogAuditEvent
0x18003E1A0: "securityevent" ??_C@_1BM@MLFHKLND@?$AAs?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AAe?$AAv?$AAe?$AAn?$AAt?$AA?$AA@
0x1800362E0: "__cdecl _imp_EqualDomainSid" __imp_EqualDomainSid
0x180012300: AuthzEnumerateSecurityEventSources
0x180040B40: "__cdecl _NULL_DELAY_IMPORT_DESCRIPTOR" __NULL_DELAY_IMPORT_DESCRIPTOR
0x18001C160: AuthzpGetSecurityInfoXp
0x180036890: "ext-ms-win-authz-remote-l1-1-0" ??_C@_1DO@NIDDNAEH@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAa?$AAu?$AAt?$AAh?$AAz?$AA?9?$AAr?$AAe?$AAm?$AAo?$AAt?$AAe?$AA?9?$AAl?$AA1?$AA?9?$AA1?$AA?9?$AA0?$AA?$AA@
0x18000A26A: "__cdecl o_malloc" _o_malloc
0x180001FC0: AuthzpAccessCheck
0x18001CC24: AuthzpGetUserDomainName
0x180009A6C: "__cdecl _scrt_dllmain_before_initialize_c" __scrt_dllmain_before_initialize_c
0x180047038: "__cdecl _imp_RpcBindingFree" __imp_RpcBindingFree
0x180036298: "__cdecl _imp_GetSidSubAuthority" __imp_GetSidSubAuthority
0x180009580: "__cdecl DllMainCRTStartup" _DllMainCRTStartup
0x18000A460: NdrServerCallAll
0x180018A10: AuthzpConvertAuthzClaimsToAuthzrClaims
0x18001AF70: s_AuthzrModifyClaims
0x180026434: AuthzBasepInitializeResourceClaimsFromSacl
0x180036260: "__cdecl _imp__initterm" __imp__initterm
0x180047040: "__cdecl _imp_RpcStringBindingComposeW" __imp_RpcStringBindingComposeW
0x18004225C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-debug-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-debug-l1-1-0
0x18000553C: AuthzpCleanupCache
0x180008630: AuthziInitializeAuditParamsWithRM
0x180035F88: "__cdecl _imp_SetLastError" __imp_SetLastError
0x1800422D4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-1" __IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-1
0x18001D090: "unsigned long __cdecl ConvertCapsToSelfRelativeForm(struct _CENTRAL_POLICY * __ptr64 const,unsigned long,struct _CENTRAL_POLICY_ENTRY * __ptr64 const,unsigned long,struct _CENTRAL_ACCESS_POLICY * __ptr64 * __ptr64)" ?ConvertCapsToSelfRelativeForm@@YAKQEAU_CENTRAL_POLICY@@KQEAU_CENTRAL_POLICY_ENTRY@@KPEAPEAU_CENTRAL_ACCESS_POLICY@@@Z
0x180011AB0: AuthzpConvertGuidToString
0x1800448C8: "__cdecl _hmod__netutils_dll" __hmod__netutils_dll
0x180005C08: AuthzpUnregisterAuditEvent
0x180023964: "unsigned long __cdecl WIN32_FROM_HRESULT(long)" ?WIN32_FROM_HRESULT@@YAKJ@Z
0x180024C88: AuthzBasepAuthzGetSecurityAttributesCopyoutBufferSize
0x180013DE0: AuthziQuerySecurityAttributes
0x180029EE8: LsapIsLocalServerName
0x18001D4D8: "unsigned long __cdecl CopyCapDetails(struct _CENTRAL_ACCESS_POLICY * __ptr64,struct _CENTRAL_POLICY * __ptr64,unsigned char * __ptr64,unsigned __int64)" ?CopyCapDetails@@YAKPEAU_CENTRAL_ACCESS_POLICY@@PEAU_CENTRAL_POLICY@@PEAE_K@Z
0x18003D318: "DefaultCape" ??_C@_1BI@PDEPNIHO@?$AAD?$AAe?$AAf?$AAa?$AAu?$AAl?$AAt?$AAC?$AAa?$AAp?$AAe?$AA?$AA@
0x180001D40: AuthzpSidApplicable
0x180044258: AuthzSecurityPrivilege
0x180036450: "__cdecl _imp_RtlEqualUnicodeString" __imp_RtlEqualUnicodeString
0x18000A629: "__cdecl _imp_load_RpcServerRegisterIf3" __imp_load_RpcServerRegisterIf3
0x18003DCC0: "displayName" ??_C@_1BI@LKHJNJMH@?$AAd?$AAi?$AAs?$AAp?$AAl?$AAa?$AAy?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x1800362F8: "__cdecl _imp_IsValidSecurityDescriptor" __imp_IsValidSecurityDescriptor
0x180020250: InitializeClaimDictionary
0x1800137B0: AuthzUnregisterSecurityEventSource
0x180002910: AuthzInitializeContextFromSid
0x1800421F8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0
0x18002A294: LsapVerifyReturnedNames
0x1800268C4: AuthzBasepRollbackSecurityAttributeChanges
0x18002868C: AuthzBasepEvaluateAttribute
0x18002A2F0: PSECURITY_SOURCE_NAME_bind
0x18000A5BD: "__cdecl _imp_load_RpcServerUseProtseqW" __imp_load_RpcServerUseProtseqW
0x18000A551: "__cdecl _imp_load_UuidCreate" __imp_load_UuidCreate
0x18003D050: "Security" ??_C@_1BC@FCJNIDNL@?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?$AA@
0x180036220: "__cdecl _imp__o_wcstol" __imp__o_wcstol
0x1800367A8: "audit" ??_C@_1M@LILKJADD@?$AAa?$AAu?$AAd?$AAi?$AAt?$AA?$AA@
0x180011C1C: StringCchPrintfW
0x18000A216: "__cdecl o__configure_narrow_argv" _o__configure_narrow_argv
0x180036328: "__cdecl _imp_InitializeSecurityDescriptor" __imp_InitializeSecurityDescriptor
0x18003D298: WNF_CAPS_CENTRAL_ACCESS_POLICIES_CHANGED
0x1800099CC: "__cdecl _scrt_initialize_default_local_stdio_options" __scrt_initialize_default_local_stdio_options
0x180020E04: "unsigned long __cdecl LdapConstructCapeFilter(struct _CENTRAL_POLICY * __ptr64,unsigned long,unsigned short * __ptr64 * __ptr64)" ?LdapConstructCapeFilter@@YAKPEAU_CENTRAL_POLICY@@KPEAPEAG@Z
0x1800136A0: AuthzUninstallSecurityEventSource
0x180005FC0: AuthzpComputeAuditSize
0x1800471D8: "__cdecl _imp_ldap_count_valuesW" __imp_ldap_count_valuesW
0x18003D2A0: WPP_ThisDir_CTLGUID_AuthzTraceProvider
0x180036028: "__cdecl _imp_CreateThread" __imp_CreateThread
0x180036308: "__cdecl _imp_AdjustTokenPrivileges" __imp_AdjustTokenPrivileges
0x18000AAEC: IsAuthzrExtFreeResourceManagerPresent
0x18001A2C0: AuthzpReleaseQuotaHandle
0x180009BE0: "__cdecl _scrt_initialize_onexit_tables" __scrt_initialize_onexit_tables
0x180036510: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x18001E6A0: GetCentralAccessPoliciesByDN
0x1800471B0: "__cdecl _imp_ldap_count_entries" __imp_ldap_count_entries
0x180007C40: AuthzpExamineSingleSaclForObjectTypeList
0x180015BE0: AuthzpAllowOnlyNormalSingleAclAccessCheck
0x180009DD0: "__cdecl _crt_debugger_hook" __crt_debugger_hook
0x180017FB0: AuthzpIsAccessMaskApplicable
0x180047280: "__cdecl _imp_LocalGetConditionForString" __imp_LocalGetConditionForString
0x180036030: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x18000A7DB: "__cdecl _tailMerge_netutils_dll" __tailMerge_netutils_dll
0x18003D7B0: "CN=Claim Types,CN=Claims Configu" ??_C@_1IK@JCHPGEOC@?$AAC?$AAN?$AA?$DN?$AAC?$AAl?$AAa?$AAi?$AAm?$AA?5?$AAT?$AAy?$AAp?$AAe?$AAs?$AA?0?$AAC?$AAN?$AA?$DN?$AAC?$AAl?$AAa?$AAi?$AAm?$AAs?$AA?5?$AAC?$AAo?$AAn?$AAf?$AAi?$AAg?$AAu@
0x180012F30: AuthzModifyClaims
0x180036310: "__cdecl _imp_GetTokenInformation" __imp_GetTokenInformation
0x180036220: "__cdecl _imp_wcstol" __imp_wcstol
0x180036850: "__cdecl _sz_logoncli_dll" __sz_logoncli_dll
0x1800364F0: "__cdecl _imp_RtlNtStatusToDosError" __imp_RtlNtStatusToDosError
0x18000A85A: "__cdecl _imp_load_DsGetDcNameW" __imp_load_DsGetDcNameW
0x180025F00: AuthzBasepDeleteSecurityAttributeValues
0x18001813C: AuthzpQuickMaximumAllowedAccessCheck
0x180035F50: "__cdecl _imp_IsDebuggerPresent" __imp_IsDebuggerPresent
0x18000A599: "__cdecl _imp_load_RpcBindingInqAuthClientW" __imp_load_RpcBindingInqAuthClientW
0x180047108: "__cdecl _imp_SamRidToSid" __imp_SamRidToSid
0x180036198: api-ms-win-core-sysinfo-l1-1-0_NULL_THUNK_DATA
0x180036530: "__cdecl _xi_a" __xi_a
0x1800361A8: api-ms-win-core-sysinfo-l1-2-0_NULL_THUNK_DATA
0x180036078: api-ms-win-core-processthreads-l1-1-1_NULL_THUNK_DATA
0x180005664: AuthzpFreeCapCache
0x180021CBC: "void __cdecl LdapDeleteClaims(struct CLAIM_OBJECT * __ptr64 const,unsigned __int64)" ?LdapDeleteClaims@@YAXQEAUCLAIM_OBJECT@@_K@Z
0x180035F58: api-ms-win-core-debug-l1-1-0_NULL_THUNK_DATA
0x180009AB8: "__cdecl _scrt_dllmain_crt_thread_detach" __scrt_dllmain_crt_thread_detach
0x180035F70: "__cdecl _imp_ResolveDelayLoadedAPI" __imp_ResolveDelayLoadedAPI
0x180012940: AuthzFreeCentralAccessPolicyCache
0x180013CB0: AuthziModifyAuditEventType
0x18000AEB1: "__cdecl _imp_load_SamFreeMemory" __imp_load_SamFreeMemory
0x180021B1C: "void __cdecl LdapDeleteCapes(struct _CENTRAL_POLICY_ENTRY * __ptr64 const,unsigned __int64)" ?LdapDeleteCapes@@YAXQEAU_CENTRAL_POLICY_ENTRY@@_K@Z
0x180007FF0: AuthzpSetAuditInfoForObjectType
0x180002BB0: AuthzpInitializeContextFromSid
0x180047218: "__cdecl _imp_LdapGetLastError" __imp_LdapGetLastError
0x1800099F0: "__cdecl _scrt_acquire_startup_lock" __scrt_acquire_startup_lock
0x180036360: "__cdecl _imp_RtlSubscribeWnfStateChangeNotification" __imp_RtlSubscribeWnfStateChangeNotification
0x1800448B0: "__cdecl _hmod__WLDAP32_dll" __hmod__WLDAP32_dll
0x180036358: api-ms-win-security-base-l1-1-0_NULL_THUNK_DATA
0x180028D9C: AuthzBasepGetOperandStringCaseForEvaluation
0x180002B54: AuthzBasepFreeSecurityAttributesList
0x1800067F0: AuthzpGetThreadTokenInfo
0x1800472E0: logoncli_NULL_THUNK_DATA_DLA
0x1800042B4: AuthzBasepCommitSecurityAttributeChanges
0x180041548: logoncli_NULL_THUNK_DATA_DLB
0x180040E40: logoncli_NULL_THUNK_DATA_DLN
0x1800472E8: "__cdecl _imp_NetApiBufferFree" __imp_NetApiBufferFree
0x180026AA8: AuthzBasepAddSid
0x18002A324: RpcpBindRpc
0x18000A20A: "__cdecl o__cexit" _o__cexit
0x180047090: "__cdecl _imp_RpcServerUseProtseqW" __imp_RpcServerUseProtseqW
0x180047100: "__cdecl _imp_SamFreeMemory" __imp_SamFreeMemory
0x180020D94: "void __cdecl LdapCleanupMemory(enum _QUERY_TYPE,void * __ptr64,unsigned __int64)" ?LdapCleanupMemory@@YAXW4_QUERY_TYPE@@PEAX_K@Z
0x18001935C: AuthzpConvertPwstrToStringValue
0x18003E040: "CN=Claims Configuration,CN=Servi" ??_C@_1GM@KKOOPG@?$AAC?$AAN?$AA?$DN?$AAC?$AAl?$AAa?$AAi?$AAm?$AAs?$AA?5?$AAC?$AAo?$AAn?$AAf?$AAi?$AAg?$AAu?$AAr?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?0?$AAC?$AAN?$AA?$DN?$AAS?$AAe?$AAr?$AAv?$AAi@
0x18003D450: "SOFTWARE\Microsoft\Windows NT\Cu" ??_C@_1GG@MJPMFNGH@?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAN?$AAT?$AA?2?$AAC?$AAu@
0x18000A246: "__cdecl seh_filter_dll" _seh_filter_dll
0x180044000: WPP_GLOBAL_Control
0x180036488: "__cdecl _imp_NtQuerySecurityAttributesToken" __imp_NtQuerySecurityAttributesToken
0x1800361C8: "__cdecl _imp__execute_onexit_table" __imp__execute_onexit_table
0x18000A63B: "__cdecl _imp_load_RpcServerUnregisterIfEx" __imp_load_RpcServerUnregisterIfEx
0x180023EEC: AuthzBasepAllocateClaimCollection
0x18000137C: AuthzpNormalMultipleSDAccessCheck
0x180036780: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x180023E7C: AuthzBasepAddSecurityAttributeValueToLists
0x1800421A8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0
0x180042270: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-1" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-1
0x180036010: api-ms-win-core-memory-l1-1-0_NULL_THUNK_DATA
0x18003DCF0: "msDS-ClaimValueType" ??_C@_1CI@LNMIFCPF@?$AAm?$AAs?$AAD?$AAS?$AA?9?$AAC?$AAl?$AAa?$AAi?$AAm?$AAV?$AAa?$AAl?$AAu?$AAe?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x180028F64: AuthzBasepMemberOf
0x180020494: WPP_SF_D
0x18001ED90: WPP_SF_d
0x180009738: "__cdecl _report_rangecheckfailure" __report_rangecheckfailure
0x18001EE20: "private: void __cdecl CClaimDictionary::AddDefaultClaimAttributes(enum CLAIM_DEFINITION_TYPE) __ptr64" ?AddDefaultClaimAttributes@CClaimDictionary@@AEAAXW4CLAIM_DEFINITION_TYPE@@@Z
0x1800367C0: "__cdecl pRawDllMain" _pRawDllMain
0x180044AA8: authzpCapChangeSubscriptionLock
0x18001B404: AuthzpReleaseCapCache
0x180012950: AuthzFreeHandle
0x18002A178: LsapNeutralizeNt4Emulation
0x18003D5D8: "(distinguishedName=" ??_C@_1CI@FJPGJJDH@?$AA?$CI?$AAd?$AAi?$AAs?$AAt?$AAi?$AAn?$AAg?$AAu?$AAi?$AAs?$AAh?$AAe?$AAd?$AAN?$AAa?$AAm?$AAe?$AA?$DN?$AA?$AA@
0x180047058: "__cdecl _imp_I_RpcExceptionFilter" __imp_I_RpcExceptionFilter
0x180036900: "__cdecl _sz_api_ms_win_security_lsalookup_l1_1_0_dll" __sz_api_ms_win_security_lsalookup_l1_1_0_dll
0x180036860: "__cdecl _sz_api_ms_win_security_lsalookup_l2_1_0_dll" __sz_api_ms_win_security_lsalookup_l2_1_0_dll
0x180022D08: "unsigned long __cdecl LdapQueryActiveDirectory(enum _QUERY_TYPE,struct ldap * __ptr64,unsigned short * __ptr64,unsigned short * __ptr64,unsigned long,void * __ptr64 * __ptr64,unsigned long * __ptr64)" ?LdapQueryActiveDirectory@@YAKW4_QUERY_TYPE@@PEAUldap@@PEAG2KPEAPEAXPEAK@Z
0x18003DE98: "msAuthz-CentralAccessPolicyID" ??_C@_1DM@FNJGCLCO@?$AAm?$AAs?$AAA?$AAu?$AAt?$AAh?$AAz?$AA?9?$AAC?$AAe?$AAn?$AAt?$AAr?$AAa?$AAl?$AAA?$AAc?$AAc?$AAe?$AAs?$AAs?$AAP?$AAo?$AAl?$AAi?$AAc?$AAy?$AAI?$AAD?$AA?$AA@
0x180008F40: AuthzpDeQueueThreadWorker
0x18003DB20: "CN=ms-DS-Managed-Service-Account" ??_C@_1HK@PPKCCIEA@?$AAC?$AAN?$AA?$DN?$AAm?$AAs?$AA?9?$AAD?$AAS?$AA?9?$AAM?$AAa?$AAn?$AAa?$AAg?$AAe?$AAd?$AA?9?$AAS?$AAe?$AAr?$AAv?$AAi?$AAc?$AAe?$AA?9?$AAA?$AAc?$AAc?$AAo?$AAu?$AAn?$AAt@
0x1800362B0: "__cdecl _imp_SetSecurityDescriptorSacl" __imp_SetSecurityDescriptorSacl
0x180004254: AuthzBasepFreeSecurityAttributeValues
0x18003E1C0: "lsacap" ??_C@_1O@BDGOHPEN@?$AAl?$AAs?$AAa?$AAc?$AAa?$AAp?$AA?$AA@
0x180009FD8: "__cdecl _isa_available_init" __isa_available_init
0x180047118: "__cdecl _imp_SamGetAliasMembership" __imp_SamGetAliasMembership
0x180009FCC: "void __cdecl operator delete(void * __ptr64)" ??3@YAXPEAX@Z
0x18000AAEC: IsAuthzrExtFreeContextPresent
0x18003DF20: "msAuthz-MemberRulesInCentralAcce" ??_C@_1FC@IGPFOBJP@?$AAm?$AAs?$AAA?$AAu?$AAt?$AAh?$AAz?$AA?9?$AAM?$AAe?$AAm?$AAb?$AAe?$AAr?$AAR?$AAu?$AAl?$AAe?$AAs?$AAI?$AAn?$AAC?$AAe?$AAn?$AAt?$AAr?$AAa?$AAl?$AAA?$AAc?$AAc?$AAe@
0x18000ABCB: "__cdecl _imp_load_AuthzrExtFreeResourceManager" __imp_load_AuthzrExtFreeResourceManager
0x18000A198: "__cdecl get_startup_argv_mode" _get_startup_argv_mode
0x180036380: "__cdecl _imp_RtlAcquireResourceShared" __imp_RtlAcquireResourceShared
0x180036340: "__cdecl _imp_GetSecurityDescriptorGroup" __imp_GetSecurityDescriptorGroup
0x180036460: "__cdecl _imp_RtlCompareUnicodeString" __imp_RtlCompareUnicodeString
0x18003E768: "__cdecl _rtc_izz" __rtc_izz
0x18000A951: "__cdecl _imp_load_DsRoleFreeMemory" __imp_load_DsRoleFreeMemory
0x18000A963: "__cdecl _imp_load_ConvertSidToStringSidW" __imp_load_ConvertSidToStringSidW
0x180012FF0: AuthzModifySids
0x1800363C0: "__cdecl _imp_NtQueryValueKey" __imp_NtQueryValueKey
0x180036120: "__cdecl _imp_DeleteCriticalSection" __imp_DeleteCriticalSection
0x180011620: AuthziGenerateAdminAlertAuditW
0x180040A60: "__cdecl _DELAY_IMPORT_DESCRIPTOR_netutils_dll" __DELAY_IMPORT_DESCRIPTOR_netutils_dll
0x1800095D0: "__cdecl _security_check_cookie" __security_check_cookie
0x180036528: "__cdecl _xc_z" __xc_z
0x180047008: "__cdecl _imp_DsRoleGetPrimaryDomainInformation" __imp_DsRoleGetPrimaryDomainInformation
0x18001C0B0: AuthzpGetResourceDomainGroups
0x180029288: AuthzBasepSupportSetOperation
0x180042180: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0
0x180036068: api-ms-win-core-processthreads-l1-1-0_NULL_THUNK_DATA
0x18003DA90: "rootDomainNamingContext" ??_C@_1DA@BJANLJGF@?$AAr?$AAo?$AAo?$AAt?$AAD?$AAo?$AAm?$AAa?$AAi?$AAn?$AAN?$AAa?$AAm?$AAi?$AAn?$AAg?$AAC?$AAo?$AAn?$AAt?$AAe?$AAx?$AAt?$AA?$AA@
0x18001A6E0: s_AuthzrAccessCheck
0x180047190: "__cdecl _imp_ldap_value_free_len" __imp_ldap_value_free_len
0x180036170: "__cdecl _imp_InitOnceExecuteOnce" __imp_InitOnceExecuteOnce
0x1800363A8: "__cdecl _imp_RtlMakeSelfRelativeSD" __imp_RtlMakeSelfRelativeSD
0x18000AEFC: "__cdecl _vcrt_uninitialize_critical" __vcrt_uninitialize_critical
0x18000A7CF: "__cdecl _imp_load_NetApiBufferFree" __imp_load_NetApiBufferFree
0x1800056E8: WppCleanupUm
0x18000131C: AuthzpExamineSingleSacl
0x1800471B8: "__cdecl _imp_ldap_memfreeW" __imp_ldap_memfreeW
0x18003E1E0: "ncacn_np" ??_C@_1BC@CCHMBIKG@?$AAn?$AAc?$AAa?$AAc?$AAn?$AA_?$AAn?$AAp?$AA?$AA@
0x180005460: AuthzFreeResourceManager
0x180009040: AuthziInitializeAuditQueue
0x180036180: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x18000AAEC: IsAuthzrExtAccessCheckPresent
0x180002618: AuthzpGetApplicableCentralAccessPolicy
0x18000A93F: "__cdecl _imp_load_ldap_msgfree" __imp_load_ldap_msgfree
0x180036498: "__cdecl _imp_RtlReleaseResource" __imp_RtlReleaseResource
0x180014A80: AuthzpGetLdapHandle
0x180035FC0: "__cdecl _imp_LocalAlloc" __imp_LocalAlloc
0x180009A88: "__cdecl _scrt_dllmain_crt_thread_attach" __scrt_dllmain_crt_thread_attach
0x1800364C0: "__cdecl _imp_EtwGetTraceEnableLevel" __imp_EtwGetTraceEnableLevel
0x18001BA24: AuthzpGetAliasMembership
0x18000A246: "__cdecl o__seh_filter_dll" _o__seh_filter_dll
0x1800448B8: "__cdecl _hmod__SspiCli_dll" __hmod__SspiCli_dll
0x180035F60: "__cdecl _imp_DelayLoadFailureHook" __imp_DelayLoadFailureHook
0x180016690: AuthzpCapChangeCallback
0x18000A1E6: "__cdecl _std_type_info_destroy_list" __std_type_info_destroy_list
0x18000B030: "__cdecl _chkstk" __chkstk
0x180014804: DeleteKeyRecursivelyW
0x18001EFF0: "void __cdecl DeletePossibleValues(struct CLAIM_OBJECT * __ptr64)" ?DeletePossibleValues@@YAXPEAUCLAIM_OBJECT@@@Z
0x180047240: "__cdecl _imp_LookupAccountSidLocalW" __imp_LookupAccountSidLocalW
0x18002917C: AuthzBasepPopResult
0x18003E1D0: "\PIPE\" ??_C@_1O@PGAGHCON@?$AA?2?$AAP?$AAI?$AAP?$AAE?$AA?2?$AA?$AA@
0x18000A91B: "__cdecl _imp_load_ldap_count_values_len" __imp_load_ldap_count_values_len
0x18000A402: "__cdecl _imp_load_I_RpcExceptionFilter" __imp_load_I_RpcExceptionFilter
0x180027844: AuthzBasepComputeBitwise
0x180040A40: "__cdecl _DELAY_IMPORT_DESCRIPTOR_DSROLE_dll" __DELAY_IMPORT_DESCRIPTOR_DSROLE_dll
0x1800361B0: "__cdecl _imp__o__callnewh" __imp__o__callnewh
0x180020968: "int __cdecl AuthzpSkipLocalGroup(unsigned short const * __ptr64,void * __ptr64)" ?AuthzpSkipLocalGroup@@YAHPEBGPEAX@Z
0x18003DED8: "distinguishedName" ??_C@_1CE@OEKOHCPI@?$AAd?$AAi?$AAs?$AAt?$AAi?$AAn?$AAg?$AAu?$AAi?$AAs?$AAh?$AAe?$AAd?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x180036118: api-ms-win-core-rtlsupport-l1-1-0_NULL_THUNK_DATA
0x180040A80: "__cdecl _DELAY_IMPORT_DESCRIPTOR_logoncli_dll" __DELAY_IMPORT_DESCRIPTOR_logoncli_dll
0x180036558: "__cdecl _xp_z" __xp_z
0x18000A46C: "__cdecl _imp_load_ldap_unbind" __imp_load_ldap_unbind
0x180006190: AuthziInitializeAuditEventType
0x18003DBA0: "CN=inetOrgPerson,CN=Schema,CN=Co" ??_C@_1FK@BKLHOLBI@?$AAC?$AAN?$AA?$DN?$AAi?$AAn?$AAe?$AAt?$AAO?$AAr?$AAg?$AAP?$AAe?$AAr?$AAs?$AAo?$AAn?$AA?0?$AAC?$AAN?$AA?$DN?$AAS?$AAc?$AAh?$AAe?$AAm?$AAa?$AA?0?$AAC?$AAN?$AA?$DN?$AAC?$AAo@
0x18000AEC3: "__cdecl _imp_load_SamCloseHandle" __imp_load_SamCloseHandle
0x180036390: "__cdecl _imp_RtlValidSecurityDescriptor" __imp_RtlValidSecurityDescriptor
0x18000A866: "__cdecl _tailMerge_logoncli_dll" __tailMerge_logoncli_dll
0x1800291A0: AuthzBasepPushResult
0x180012B70: AuthzInstallSecurityEventSource
0x180024DF4: AuthzBasepAuthzSetSecurityAttributesToken
0x180036788: "LSARPC_ENDPOINT" ??_C@_1CA@CFBBCIJN@?$AAL?$AAS?$AAA?$AAR?$AAP?$AAC?$AA_?$AAE?$AAN?$AAD?$AAP?$AAO?$AAI?$AAN?$AAT?$AA?$AA@
0x180042220: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0
0x180044970: AuthzCacheList
0x180019CEC: AuthzrInitializeContextFromSid
0x1800422AC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-apiquery-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-apiquery-l1-1-0
0x18001F2E8: "public: unsigned long __cdecl CClaimDictionary::Initialize(void) __ptr64" ?Initialize@CClaimDictionary@@QEAAKXZ
0x180036088: api-ms-win-core-profile-l1-1-0_NULL_THUNK_DATA
0x180029408: AuthzBasepValueInSet
0x18003E778: "__cdecl _rtc_tzz" __rtc_tzz
0x180047228: "__cdecl _imp_ldap_bind_sW" __imp_ldap_bind_sW
0x1800221A8: "unsigned long __cdecl LdapParseClaimAttribute(struct ldap * __ptr64,unsigned short * __ptr64,unsigned short * __ptr64,struct CLAIM_OBJECT * __ptr64)" ?LdapParseClaimAttribute@@YAKPEAUldap@@PEAG1PEAUCLAIM_OBJECT@@@Z
0x180036570: "__cdecl _guard_fids_table" __guard_fids_table
0x180029A94: LsaOpenPolicy
0x1800362D8: "__cdecl _imp_CreateWellKnownSid" __imp_CreateWellKnownSid
0x18000A509: "__cdecl _imp_load_LdapMapErrorToWin32" __imp_load_LdapMapErrorToWin32
0x18001A308: AuthzpRmHandleFromBindingHandle
0x180021498: "unsigned long __cdecl LdapConstructClaimsFilter(unsigned short * __ptr64,enum CLAIM_DEFINITION_TYPE,unsigned short * __ptr64 * __ptr64)" ?LdapConstructClaimsFilter@@YAKPEAGW4CLAIM_DEFINITION_TYPE@@PEAPEAG@Z
0x18002B1A0: "__cdecl load_config_used" _load_config_used
0x18003D280: "ObjectNames" ??_C@_1BI@OADGGPMJ@?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAN?$AAa?$AAm?$AAe?$AAs?$AA?$AA@
0x180029CBC: LsapCreateNullTerminatedServerName
0x18000A6FC: "__cdecl _imp_load_LsaLookupAuthenticationPackage" __imp_load_LsaLookupAuthenticationPackage
0x18003D600: "(|" ??_C@_15IECLMGCD@?$AA?$CI?$AA?$HM?$AA?$AA@
0x18000A8F7: "__cdecl _imp_load_ldap_first_entry" __imp_load_ldap_first_entry
0x180003DA4: AuthzBasepAddSecurityAttributeValues
0x180036208: "__cdecl _imp__o__wtoi64" __imp__o__wtoi64
0x1800363E8: "__cdecl _imp_RtlCopySid" __imp_RtlCopySid
0x180040CD0: SspiCli_NULL_THUNK_DATA_DLN
0x1800409E0: "__cdecl _DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_sddl_l1_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_sddl_l1_1_0_dll
0x180024174: AuthzBasepAuthzCopyValueToTokenValue
0x180013E48: AuthzpAddSidsToContext
0x18003D070: "{%08lX-%04X-%04X-%02X%02X-%02X%0" ??_C@_1GI@LBPPMOKF@?$AA?$HL?$AA?$CF?$AA0?$AA8?$AAl?$AAX?$AA?9?$AA?$CF?$AA0?$AA4?$AAX?$AA?9?$AA?$CF?$AA0?$AA4?$AAX?$AA?9?$AA?$CF?$AA0?$AA2?$AAX?$AA?$CF?$AA0?$AA2?$AAX?$AA?9?$AA?$CF?$AA0?$AA2?$AAX?$AA?$CF?$AA0@
0x18003E158: "localhost" ??_C@_1BE@JDLPANCI@?$AAl?$AAo?$AAc?$AAa?$AAl?$AAh?$AAo?$AAs?$AAt?$AA?$AA@
0x180006274: AuthzpRegisterAuditEvent
0x180047198: "__cdecl _imp_ldap_count_values_len" __imp_ldap_count_values_len
0x180035F78: api-ms-win-core-delayload-l1-1-1_NULL_THUNK_DATA
0x180035F68: api-ms-win-core-delayload-l1-1-0_NULL_THUNK_DATA
0x18001FFF0: FreeClaimDefinitions
0x180036540: "__cdecl _scrt_stdio_legacy_msvcrt_compatibility" __scrt_stdio_legacy_msvcrt_compatibility
0x18000AA6C: "__cdecl _imp_load_ldap_next_entry" __imp_load_ldap_next_entry
0x18003D9C0: "CN=Resource Properties,CN=Claims" ??_C@_1JK@BAKNFNGF@?$AAC?$AAN?$AA?$DN?$AAR?$AAe?$AAs?$AAo?$AAu?$AAr?$AAc?$AAe?$AA?5?$AAP?$AAr?$AAo?$AAp?$AAe?$AAr?$AAt?$AAi?$AAe?$AAs?$AA?0?$AAC?$AAN?$AA?$DN?$AAC?$AAl?$AAa?$AAi?$AAm?$AAs@
0x18003DC00: "CN=Computer,CN=Schema,CN=Configu" ??_C@_1FA@KMICNKFL@?$AAC?$AAN?$AA?$DN?$AAC?$AAo?$AAm?$AAp?$AAu?$AAt?$AAe?$AAr?$AA?0?$AAC?$AAN?$AA?$DN?$AAS?$AAc?$AAh?$AAe?$AAm?$AAa?$AA?0?$AAC?$AAN?$AA?$DN?$AAC?$AAo?$AAn?$AAf?$AAi?$AAg?$AAu@
0x180044A7C: AuthzpOutstandingRMCalls
0x180040D98: WLDAP32_NULL_THUNK_DATA_DLN
0x18001CDC0: AuthzpIsDC
0x180044900: "__cdecl _hmod__SAMLIB_dll" __hmod__SAMLIB_dll
0x180007BCC: AuthzBasepSetTypeListAccessReasons
0x18000A617: "__cdecl _imp_load_RpcEpRegisterW" __imp_load_RpcEpRegisterW
0x1800360E8: "__cdecl _imp_RegQueryValueExA" __imp_RegQueryValueExA
0x1800052D4: LsapCreateBindingHandleForLocal
0x18003D2B0: "7a4381a8-4be5-4e62-911c-cc20475d" ??_C@_1EK@KDFIGFEB@?$AA7?$AAa?$AA4?$AA3?$AA8?$AA1?$AAa?$AA8?$AA?9?$AA4?$AAb?$AAe?$AA5?$AA?9?$AA4?$AAe?$AA6?$AA2?$AA?9?$AA9?$AA1?$AA1?$AAc?$AA?9?$AAc?$AAc?$AA2?$AA0?$AA4?$AA7?$AA5?$AAd@
0x18003E0C0: "SYSTEM\CurrentControlSet\Service" ??_C@_0ED@LMBGCJEI@SYSTEM?2CurrentControlSet?2Service@
0x180047078: "__cdecl _imp_RpcServerInqCallAttributesW" __imp_RpcServerInqCallAttributesW
0x180036420: "__cdecl _imp_RtlGetNtProductType" __imp_RtlGetNtProductType
0x180040DE8: api-ms-win-security-sddlparsecond-l1-1-0_NULL_THUNK_DATA_DLN
0x180047048: "__cdecl _imp_RpcBindingFromStringBindingW" __imp_RpcBindingFromStringBindingW
0x180041668: api-ms-win-security-sddlparsecond-l1-1-0_NULL_THUNK_DATA_DLB
0x180047288: api-ms-win-security-sddlparsecond-l1-1-0_NULL_THUNK_DATA_DLA
0x180009DC0: "__cdecl _scrt_get_dyn_tls_init_callback" __scrt_get_dyn_tls_init_callback
0x18003E030: "TRUE" ??_C@_19ELAAHEEL@?$AAT?$AAR?$AAU?$AAE?$AA?$AA@
0x1800363E0: "__cdecl _imp_RtlIsCapabilitySid" __imp_RtlIsCapabilitySid
0x180035FE0: "__cdecl _imp_DisableThreadLibraryCalls" __imp_DisableThreadLibraryCalls
0x180036500: "__cdecl _imp_NtClose" __imp_NtClose
0x180047080: "__cdecl _imp_RpcBindingInqAuthClientW" __imp_RpcBindingInqAuthClientW
0x18000AE7B: "__cdecl _imp_load_SamOpenUser" __imp_load_SamOpenUser
0x180047120: "__cdecl _imp_SamCloseHandle" __imp_SamCloseHandle
0x18003D198: "EventSourceFlags" ??_C@_1CC@OCKCEJGC@?$AAE?$AAv?$AAe?$AAn?$AAt?$AAS?$AAo?$AAu?$AAr?$AAc?$AAe?$AAF?$AAl?$AAa?$AAg?$AAs?$AA?$AA@
0x18000AC13: "__cdecl _imp_load_AuthzrExtAccessCheck" __imp_load_AuthzrExtAccessCheck
0x180013850: AuthziAccessCheckEx
0x180036110: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x1800363F0: "__cdecl _imp_RtlValidSid" __imp_RtlValidSid
0x180036080: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x1800141A8: AuthzpInitializeCompoundContext
0x18004211C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-crt-string-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-crt-string-l1-1-0
0x1800363F8: "__cdecl _imp_RtlCopyLuid" __imp_RtlCopyLuid
0x180036388: "__cdecl _imp_RtlEqualSid" __imp_RtlEqualSid
0x180026840: AuthzBasepQuerySystemSecurityAttributeAndValues
0x1800364B8: "__cdecl _imp_EtwGetTraceEnableFlags" __imp_EtwGetTraceEnableFlags
0x18003DC50: "(msDS-ClaimTypeAppliesToClass=" ??_C@_1DO@MBFPFNGB@?$AA?$CI?$AAm?$AAs?$AAD?$AAS?$AA?9?$AAC?$AAl?$AAa?$AAi?$AAm?$AAT?$AAy?$AAp?$AAe?$AAA?$AAp?$AAp?$AAl?$AAi?$AAe?$AAs?$AAT?$AAo?$AAC?$AAl?$AAa?$AAs?$AAs?$AA?$DN?$AA?$AA@
0x180047110: "__cdecl _imp_SamQueryInformationUser" __imp_SamQueryInformationUser
0x1800448F8: "__cdecl _hmod__api_ms_win_security_sddlparsecond_l1_1_0_dll" __hmod__api_ms_win_security_sddlparsecond_l1_1_0_dll
0x18000AEFC: "__cdecl _acrt_uninitialize_critical" __acrt_uninitialize_critical
0x180036008: "__cdecl _imp_VirtualAlloc" __imp_VirtualAlloc
0x180013D10: AuthziModifyAuditQueue
0x1800361A0: "__cdecl _imp_GetOsSafeBootMode" __imp_GetOsSafeBootMode
0x180024430: AuthzBasepAuthzCopyoutSecurityAttributeValues
0x1800362B8: "__cdecl _imp_GetSecurityDescriptorSacl" __imp_GetSecurityDescriptorSacl
0x180003320: AuthzpGetClaimsFromToken
0x18000AC50: ApiSetQueryApiSetPresence
0x1800364D8: "__cdecl _imp_RtlLeaveCriticalSection" __imp_RtlLeaveCriticalSection
0x18000A25E: free
0x1800361D0: "__cdecl _imp__initialize_narrow_environment" __imp__initialize_narrow_environment
0x180036348: "__cdecl _imp_SetSecurityDescriptorGroup" __imp_SetSecurityDescriptorGroup
0x1800052A0: PAUTHZ_AUDIT_EVENT_TYPE_OLD_bind
0x180044A40: g_pBindingVector
0x180015254: AuthzpAllowOnlyMaximumAllowedSingleAclAccessCheck
0x180035FF8: "__cdecl _imp_VirtualQuery" __imp_VirtualQuery
0x180035FD0: "__cdecl _imp_InitializeSListHead" __imp_InitializeSListHead
0x1800470A8: "__cdecl _imp_RpcStringFreeW" __imp_RpcStringFreeW
0x18003D330: "\Registry\Machine\System\Current" ??_C@_1GO@BNNKBEEN@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1800360F8: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x1800360D8: "__cdecl _imp_RegQueryInfoKeyW" __imp_RegQueryInfoKeyW
0x180027558: AuthzBasepCompareUnicodeStringCaseSensitive
0x18003E1F8: "__cdecl _pfnDefaultDliFailureHook2" __pfnDefaultDliFailureHook2
0x180036228: "__cdecl _imp___stdio_common_vswprintf" __imp___stdio_common_vswprintf
0x18001CFF8: StringCchCopyNW
0x18000A377: "__cdecl _tailMerge_api_ms_win_security_sddl_l1_1_0_dll" __tailMerge_api_ms_win_security_sddl_l1_1_0_dll
0x180047200: "__cdecl _imp_ldap_initW" __imp_ldap_initW
0x18000AAEC: IsAuthzrExtInitializeRemoteResourceManagerPresent
0x180011DA0: AuthzCachedAccessCheck
0x180003C28: AuthzBasepReplaceSecurityAttribute
0x1800442A0: "unsigned __int64 `__local_stdio_printf_options'::`2'::_OptionsStorage" ?_OptionsStorage@?1??__local_stdio_printf_options@@9@4_KA
0x180020A30: AuthzComputeEffectivePermission
0x180019500: MIDL_user_allocate
0x180009FC0: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x18000B093: memcmp
0x18000AAC6: "__cdecl _imp_load_ldap_get_next_page_s" __imp_load_ldap_get_next_page_s
0x180013400: AuthzReportSecurityEvent
0x18000AEFC: "__cdecl _scrt_stub_for_acrt_uninitialize" __scrt_stub_for_acrt_uninitialize
0x18003D0D8: "" ??_C@_13NOLLCAOD@?$AA?$AA?$AA?$AA@
0x18000AF08: "__cdecl _scrt_stub_for_is_c_termination_complete" __scrt_stub_for_is_c_termination_complete
0x18003D940: "(&(Enabled=TRUE)(msDS-IsUsedAsRe" ??_C@_1HM@MENDMBKA@?$AA?$CI?$AA?$CG?$AA?$CI?$AAE?$AAn?$AAa?$AAb?$AAl?$AAe?$AAd?$AA?$DN?$AAT?$AAR?$AAU?$AAE?$AA?$CJ?$AA?$CI?$AAm?$AAs?$AAD?$AAS?$AA?9?$AAI?$AAs?$AAU?$AAs?$AAe?$AAd?$AAA?$AAs?$AAR?$AAe@
0x18000AA12: "__cdecl _imp_load_ldap_value_freeW" __imp_load_ldap_value_freeW
0x1800203E0: RefreshClaimDictionary
0x1800234B8: "int __cdecl LdapValidateResults(enum _QUERY_TYPE,void * __ptr64,unsigned long)" ?LdapValidateResults@@YAHW4_QUERY_TYPE@@PEAXK@Z
0x18000A5AB: "__cdecl _imp_load_UuidFromStringW" __imp_load_UuidFromStringW
0x180015A08: AuthzpAllowOnlyNormalMultipleSDAccessCheck
0x1800014B0: AuthzpNormalAccessCheckWithoutCaching
0x18000A720: "__cdecl _imp_load_LsaFreeReturnBuffer" __imp_load_LsaFreeReturnBuffer
0x180005924: AuthzpInitializeResourceManager
0x1800128B0: AuthzEvaluateSacl
0x180047210: "__cdecl _imp_LdapMapErrorToWin32" __imp_LdapMapErrorToWin32
0x180047270: "__cdecl _imp_ConvertStringSecurityDescriptorToSecurityDescriptorW" __imp_ConvertStringSecurityDescriptorToSecurityDescriptorW
0x1800470C8: "__cdecl _imp_RpcServerUnregisterIfEx" __imp_RpcServerUnregisterIfEx
0x180042298: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-interlocked-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-interlocked-l1-1-0
0x180044910: g_ulMaxStackAllocSize
0x1800421D0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0
0x18003DCD8: "description" ??_C@_1BI@MFBGCOGB@?$AAd?$AAe?$AAs?$AAc?$AAr?$AAi?$AAp?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x18000AD72: "__cdecl _imp_load_RpcSsDestroyClientContext" __imp_load_RpcSsDestroyClientContext
0x180008790: AuthzInitializeContextFromAuthzContext
0x1800471C8: "__cdecl _imp_ldap_get_valuesW" __imp_ldap_get_valuesW
0x18003DD98: "msDS-ClaimPossibleValues" ??_C@_1DC@PDLAAJPO@?$AAm?$AAs?$AAD?$AAS?$AA?9?$AAC?$AAl?$AAa?$AAi?$AAm?$AAP?$AAo?$AAs?$AAs?$AAi?$AAb?$AAl?$AAe?$AAV?$AAa?$AAl?$AAu?$AAe?$AAs?$AA?$AA@
0x180003684: AuthzBasepCopySidsAndAttributes
0x180008E44: AuthzpInitializeQuotaTable
0x1800470E8: "__cdecl _imp_I_RpcMapWin32Status" __imp_I_RpcMapWin32Status
0x18000A52D: "__cdecl _imp_load_ldap_set_optionW" __imp_load_ldap_set_optionW
0x1800295BC: LsaClose
0x180029D4C: LsapCreateNullTerminatedString
0x18000ABEF: "__cdecl _imp_load_AuthzrExtInitializeContextFromSid" __imp_load_AuthzrExtInitializeContextFromSid
0x180026DEC: AuthzBasepFindSid
0x180047070: "__cdecl _imp_RpcBindingBind" __imp_RpcBindingBind
0x1800472D8: "__cdecl _imp_DsGetDcNameW" __imp_DsGetDcNameW
0x18000A1C2: "__cdecl initterm_e" _initterm_e
0x1800470D8: "__cdecl _imp_RpcBindingVectorFree" __imp_RpcBindingVectorFree
0x18003DAD0: "CN=User,CN=Schema,CN=Configurati" ??_C@_1EI@OFJEMCNI@?$AAC?$AAN?$AA?$DN?$AAU?$AAs?$AAe?$AAr?$AA?0?$AAC?$AAN?$AA?$DN?$AAS?$AAc?$AAh?$AAe?$AAm?$AAa?$AA?0?$AAC?$AAN?$AA?$DN?$AAC?$AAo?$AAn?$AAf?$AAi?$AAg?$AAu?$AAr?$AAa?$AAt?$AAi@
0x180028DE4: AuthzBasepIsValidExpression
0x180009D60: "__cdecl _scrt_release_startup_lock" __scrt_release_startup_lock
0x180020180: GetClaimDomainInfo
0x180040A20: "__cdecl _DELAY_IMPORT_DESCRIPTOR_SspiCli_dll" __DELAY_IMPORT_DESCRIPTOR_SspiCli_dll
0x180036200: "__cdecl _imp__o__wtoi" __imp__o__wtoi
0x180036440: "__cdecl _imp_RtlImageNtHeader" __imp_RtlImageNtHeader
0x18003D3E0: "O:SYG:SYD:(A;;FA;;;OW)(A;;FA;;;B" ??_C@_1FO@PAFLKCAJ@?$AAO?$AA?3?$AAS?$AAY?$AAG?$AA?3?$AAS?$AAY?$AAD?$AA?3?$AA?$CI?$AAA?$AA?$DL?$AA?$DL?$AAF?$AAA?$AA?$DL?$AA?$DL?$AA?$DL?$AAO?$AAW?$AA?$CJ?$AA?$CI?$AAA?$AA?$DL?$AA?$DL?$AAF?$AAA?$AA?$DL?$AA?$DL?$AA?$DL?$AAB@
0x180036378: "__cdecl _imp_RtlDeleteResource" __imp_RtlDeleteResource
0x18003D300: "DefaultCap" ??_C@_1BG@IJKNGDH@?$AAD?$AAe?$AAf?$AAa?$AAu?$AAl?$AAt?$AAC?$AAa?$AAp?$AA?$AA@
0x180001180: AuthziFreeAuditParams
0x180009B74: "__cdecl _scrt_dllmain_uninitialize_critical" __scrt_dllmain_uninitialize_critical
0x180036508: ntdll_NULL_THUNK_DATA
0x1800361E8: "__cdecl _imp_memcpy" __imp_memcpy
0x18000A1FE: "__cdecl o__callnewh" _o__callnewh
0x18001904C: AuthzpConvertAuthzrClaimsToAuthzClaimsSizeOnly
0x1800362C8: "__cdecl _imp_GetSecurityDescriptorDacl" __imp_GetSecurityDescriptorDacl
0x180005BAC: AuthzpDereferenceAuditEventType
0x18000AC68: "__cdecl _tailMerge_api_ms_win_security_lsalookup_l1_1_0_dll" __tailMerge_api_ms_win_security_lsalookup_l1_1_0_dll
0x180033970: g_LsapBindingHandleSecurityQos
0x180011B60: AuthzpEnableAuditPrivilege
0x18003D840: "CN=Resource Property Lists,CN=Cl" ??_C@_1KC@CNCEPGEI@?$AAC?$AAN?$AA?$DN?$AAR?$AAe?$AAs?$AAo?$AAu?$AAr?$AAc?$AAe?$AA?5?$AAP?$AAr?$AAo?$AAp?$AAe?$AAr?$AAt?$AAy?$AA?5?$AAL?$AAi?$AAs?$AAt?$AAs?$AA?0?$AAC?$AAN?$AA?$DN?$AAC?$AAl@
0x18000ACE7: "__cdecl _imp_load_LocalGetConditionForString" __imp_load_LocalGetConditionForString
0x18000AEFC: "__cdecl _scrt_stub_for_acrt_uninitialize_critical" __scrt_stub_for_acrt_uninitialize_critical
0x1800040D4: AuthzBasepAllocateSecurityAttribute
0x180004FF0: AuthziInitializeAuditEvent
0x18001AC20: s_AuthzrInitializeCompoundContext
0x180036350: "__cdecl _imp_GetSidSubAuthorityCount" __imp_GetSidSubAuthorityCount
0x180040E30: ext-ms-win-authz-remote-l1-1-0_NULL_THUNK_DATA_DLN
0x1800472D0: ext-ms-win-authz-remote-l1-1-0_NULL_THUNK_DATA_DLA
0x180041610: ext-ms-win-authz-remote-l1-1-0_NULL_THUNK_DATA_DLB
0x180042194: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0
0x180026F78: AuthzBasepReplaceSid
0x180035F40: "__cdecl _imp_ApiSetQueryApiSetPresence" __imp_ApiSetQueryApiSetPresence
0x1800441F0: "__cdecl _security_cookie" __security_cookie
0x18001BD88: AuthzpGetLocalInfo
0x180036208: "__cdecl _imp__wtoi64" __imp__wtoi64
0x1800360A8: "__cdecl _imp_RegQueryValueExW" __imp_RegQueryValueExW
0x180044920: g_pfnAllocate
0x180008EB0: AuthzInitializeResourceManagerEx
0x18000B030: "__cdecl alloca_probe" _alloca_probe
0x1800183A0: AuthzpSetAppContainerInfoToContext
0x180005590: PLSAPR_SERVER_NAME_unbind
0x180009DE0: "__cdecl _scrt_fastfail" __scrt_fastfail
0x18000AED5: "__cdecl _imp_load_SamGetAliasMembership" __imp_load_SamGetAliasMembership
0x18000AAEC: IsAuthzrExtModifyClaimsPresent
0x180036138: "__cdecl _imp_ResetEvent" __imp_ResetEvent
0x180042130: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-crt-runtime-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-crt-runtime-l1-1-0
0x18000AA7E: "__cdecl _imp_load_ldap_count_entries" __imp_load_ldap_count_entries
0x180035FA8: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x180036100: "__cdecl _imp_RtlCompareMemory" __imp_RtlCompareMemory
0x180035FB8: "__cdecl _imp_LocalFree" __imp_LocalFree
0x1800472C0: "__cdecl _imp_AuthzrExtGetInformationFromContext" __imp_AuthzrExtGetInformationFromContext
0x180036318: "__cdecl _imp_GetLengthSid" __imp_GetLengthSid
0x18001F0C0: "public: unsigned long __cdecl CClaimDictionary::GetClaimDefinitions(enum CLAIM_DEFINITION_TYPE,struct CLAIM_OBJECT * __ptr64 * __ptr64,unsigned long * __ptr64) __ptr64" ?GetClaimDefinitions@CClaimDictionary@@QEAAKW4CLAIM_DEFINITION_TYPE@@PEAPEAUCLAIM_OBJECT@@PEAK@Z
0x180044238: AuthzpPrincipalSelfSidBuffer
0x180042158: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0
0x180026A0C: RtlStringCbLengthW
0x180035FD8: api-ms-win-core-interlocked-l1-1-0_NULL_THUNK_DATA
0x18000A2EC: "__cdecl _tailMerge_rpcrt4_dll" __tailMerge_rpcrt4_dll
0x18003DCB4: "cn" ??_C@_15BLKEKDJI@?$AAc?$AAn?$AA?$AA@
0x180017C0C: AuthzpGetDefaultCap
0x180036250: api-ms-win-crt-private-l1-1-0_NULL_THUNK_DATA
0x180047298: "__cdecl _imp_AuthzrExtFreeResourceManager" __imp_AuthzrExtFreeResourceManager
0x180028BAC: AuthzBasepGetConstantOperand
0x18000AB4C: "__cdecl _tailMerge_ext_ms_win_authz_remote_l1_1_0_dll" __tailMerge_ext_ms_win_authz_remote_l1_1_0_dll
0x18000408C: AuthzBasepAddSecurityAttributeToLists
0x180047000: "__cdecl _imp_DsRoleFreeMemory" __imp_DsRoleFreeMemory
0x18000AE8D: "__cdecl _imp_load_SamGetGroupsForUser" __imp_load_SamGetGroupsForUser
0x18000A414: "__cdecl _imp_load_NdrClientCall3" __imp_load_NdrClientCall3
0x180047168: "__cdecl _imp_LsaConnectUntrusted" __imp_LsaConnectUntrusted
0x180019290: AuthzpConvertPwstrToAttributeName
0x1800360C8: "__cdecl _imp_RegCreateKeyExW" __imp_RegCreateKeyExW
0x180019F54: AuthzrModifySids
0x1800246A0: AuthzBasepAuthzCopyoutSecurityAttributes
0x180036230: "__cdecl _imp__o___std_type_info_destroy_list" __imp__o___std_type_info_destroy_list
0x180047150: "__cdecl _imp_LsaLookupAuthenticationPackage" __imp_LsaLookupAuthenticationPackage
0x180044228: AuthzpOwnerRightsSidBuffer
0x18003E108: "SYSTEM\CurrentControlSet\Service" ??_C@_0DG@MKBHFNPC@SYSTEM?2CurrentControlSet?2Service@
0x180044200: "__cdecl _isa_available" __isa_available
0x180003860: AuthzpCopyLuidAndAttributes
0x1800139F0: AuthziInitializeAuditParamsFromArray
0x180022C34: "unsigned long __cdecl LdapParseResourceListAttribute(unsigned short * __ptr64,unsigned short * __ptr64 * __ptr64 const,unsigned long,struct _RESOURCE_CLAIM_LIST * __ptr64)" ?LdapParseResourceListAttribute@@YAKPEAGQEAPEAGKPEAU_RESOURCE_CLAIM_LIST@@@Z
0x1800471E8: "__cdecl _imp_ldap_first_entry" __imp_ldap_first_entry
0x180013750: AuthzUnregisterCapChangeNotification
0x180044AD0: AuthzpAuditsDequeued
0x180047148: "__cdecl _imp_LsaLogonUser" __imp_LsaLogonUser
0x180027AB4: AuthzBasepEvaluateAceCondition
0x180035F98: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x180036038: "__cdecl _imp_GetCurrentThread" __imp_GetCurrentThread
0x180040DD8: api-ms-win-security-sddl-l1-1-0_NULL_THUNK_DATA_DLN
0x18000AAEC: IsAuthzrExtGetInformationFromContextPresent
0x180040AA0: "__cdecl _DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_lsalookup_l2_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_lsalookup_l2_1_0_dll
0x180025EB0: AuthzBasepDeleteAllSecurityAttributeValues
0x18003D3A0: "EveryoneIncludesAnonymous" ??_C@_1DE@CKOBBNBJ@?$AAE?$AAv?$AAe?$AAr?$AAy?$AAo?$AAn?$AAe?$AAI?$AAn?$AAc?$AAl?$AAu?$AAd?$AAe?$AAs?$AAA?$AAn?$AAo?$AAn?$AAy?$AAm?$AAo?$AAu?$AAs?$AA?$AA@
0x1800091F4: "__cdecl _local_stdio_scanf_options" __local_stdio_scanf_options
0x1800360E0: "__cdecl _imp_RegOpenKeyExA" __imp_RegOpenKeyExA
0x180036210: "__cdecl _imp__o_free" __imp__o_free
0x18000ADBA: "__cdecl _imp_load_RpcBindingCreateW" __imp_load_RpcBindingCreateW
0x1800360D0: "__cdecl _imp_RegOpenKeyExW" __imp_RegOpenKeyExW
0x1800361D8: "__cdecl _imp__o__initialize_onexit_table" __imp__o__initialize_onexit_table
0x180044898: "__cdecl _favor" __favor
0x18000A36B: "__cdecl _imp_load_ConvertStringSidToSidW" __imp_load_ConvertStringSidToSidW
0x18000AD96: "__cdecl _imp_load_RpcStringBindingComposeW" __imp_load_RpcStringBindingComposeW
0x180017754: AuthzpGetCentralAccessPolicy
0x1800098F0: "__cdecl _security_init_cookie" __security_init_cookie
0x180047180: "__cdecl _imp_ldap_value_freeW" __imp_ldap_value_freeW
0x180005870: AuthzInitializeResourceManager
0x180016ED4: AuthzpComputeClientContextSize
0x1800361B8: "__cdecl _imp__cexit" __imp__cexit
0x1800200A0: GetClaimDefinitions
0x18003E190: "lsarpc" ??_C@_1O@CJFJGHLH@?$AAl?$AAs?$AAa?$AAr?$AAp?$AAc?$AA?$AA@
0x180047188: "__cdecl _imp_ber_free" __imp_ber_free
0x180016300: AuthzpAllowOnlySidApplicable
0x180026110: AuthzBasepGetSecurityAttributeValueCopyoutBufferSize
0x1800278AC: AuthzBasepComputeExpression
0x180044928: g_pfnFree
0x1800362C0: "__cdecl _imp_SetSecurityDescriptorDacl" __imp_SetSecurityDescriptorDacl
0x180028870: AuthzBasepEvaluateSetRelationship
0x180022010: "unsigned long __cdecl LdapParseCapeAttribute(unsigned short * __ptr64,unsigned short * __ptr64,struct _CENTRAL_POLICY_ENTRY * __ptr64)" ?LdapParseCapeAttribute@@YAKPEAG0PEAU_CENTRAL_POLICY_ENTRY@@@Z
0x1800361F0: "__cdecl _imp__o__wcsicmp" __imp__o__wcsicmp
0x18000A5F3: "__cdecl _imp_load_RpcStringFreeW" __imp_load_RpcStringFreeW
0x18000A44C: "__cdecl _imp_load_NdrServerCallAll" __imp_load_NdrServerCallAll
0x18003BBD8: g_LsapLocalSystemSid
0x18000B087: wcscmp
0x180044AF8: authzpCapChangeSubscription
0x1800071D0: AuthzpMaximumAllowedSingleAclAccessCheck
0x180019428: AuthzpFreeAuthzrClaims
0x180004160: AuthzBasepFindSecurityAttribute
0x180036568: "__cdecl _xt_z" __xt_z
0x1800363B8: "__cdecl _imp_NtOpenKey" __imp_NtOpenKey
0x1800275AC: AuthzBasepCompareUnicodeStringOperands
0x18003DD50: "msDS-ClaimIsValueSpaceRestricted" ??_C@_1EC@CCILFEC@?$AAm?$AAs?$AAD?$AAS?$AA?9?$AAC?$AAl?$AAa?$AAi?$AAm?$AAI?$AAs?$AAV?$AAa?$AAl?$AAu?$AAe?$AAS?$AAp?$AAa?$AAc?$AAe?$AAR?$AAe?$AAs?$AAt?$AAr?$AAi?$AAc?$AAt?$AAe?$AAd@
0x180036218: "__cdecl _imp_malloc" __imp_malloc
0x18001ADC0: s_AuthzrInitializeContextFromSid
0x18000AC5C: "__cdecl _imp_load_LookupAccountSidLocalW" __imp_load_LookupAccountSidLocalW
0x180005634: AuthzpCleanupCapCaching
0x180040B20: "__cdecl _DELAY_IMPORT_DESCRIPTOR_SAMLIB_dll" __DELAY_IMPORT_DESCRIPTOR_SAMLIB_dll
0x1800044C0: AuthzBasepValidateSecurityAttributes
0x1800472A0: "__cdecl _imp_AuthzrExtModifyClaims" __imp_AuthzrExtModifyClaims
0x18003E140: "NeutralizeNt4Emulator" ??_C@_0BG@ICCLOMHM@NeutralizeNt4Emulator?$AA@
0x180009A30: "__cdecl _scrt_dllmain_after_initialize_c" __scrt_dllmain_after_initialize_c
0x180044A28: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUwhUhvxfirgbUzfgsaUyfrowUlyquivUznwGEUkxsOlyq@authz" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUwhUhvxfirgbUzfgsaUyfrowUlyquivUznwGEUkxsOlyq@authz
0x1800364D0: "__cdecl _imp_RtlLengthSid" __imp_RtlLengthSid
0x180028C94: AuthzBasepGetNextValue
0x18000AD84: "__cdecl _imp_load_RpcBindingFromStringBindingW" __imp_load_RpcBindingFromStringBindingW
0x1800129E0: AuthzInitializeCompoundContext
0x180036478: "__cdecl _imp_RtlDeleteCriticalSection" __imp_RtlDeleteCriticalSection
0x1800369D0: AuthzpByteToIndexLookupTable
0x1800163C0: AuthzpCacheResults
0x180009AD4: "__cdecl _scrt_dllmain_exception_filter" __scrt_dllmain_exception_filter
0x18003D064: "-" ??_C@_13IMODFHAA@?$AA?9?$AA?$AA@
0x18000AE9F: "__cdecl _imp_load_SamRidToSid" __imp_load_SamRidToSid
0x180009660: "__cdecl _report_gsfailure" __report_gsfailure
0x180040AE0: "__cdecl _DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_lsalookup_l1_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_lsalookup_l1_1_0_dll
0x180035F48: api-ms-win-core-apiquery-l1-1-0_NULL_THUNK_DATA
0x1800091E4: "__cdecl _local_stdio_printf_options" __local_stdio_printf_options
0x180018950: GetDefaultCAPESecurityDescriptor
0x180008218: AuthzpCreateAndLogAudit
0x180036150: "__cdecl _imp_LeaveCriticalSection" __imp_LeaveCriticalSection
0x18000A8E5: "__cdecl _imp_load_ldap_search_sW" __imp_load_ldap_search_sW
0x180013C70: AuthziModifyAuditEvent
0x18001D824: "unsigned long __cdecl FlagInvalidCaps(struct _CENTRAL_POLICY * __ptr64,struct _CENTRAL_POLICY_ENTRY * __ptr64,unsigned long,unsigned long)" ?FlagInvalidCaps@@YAKPEAU_CENTRAL_POLICY@@PEAU_CENTRAL_POLICY_ENTRY@@KK@Z
0x18000AC01: "__cdecl _imp_load_AuthzrExtInitializeCompoundContext" __imp_load_AuthzrExtInitializeCompoundContext
0x180006860: AuthzpGetTokenInfo
0x18001B444: AuthzpAddPrivilegesToPrivilegeSet
0x180008100: AuthziModifyAuditEvent2
0x1800368D0: "__cdecl _sz_ext_ms_win_authz_remote_l1_1_0_dll" __sz_ext_ms_win_authz_remote_l1_1_0_dll
0x18000573C: AuthzpInitializeCache
0x180019530: AuthzpConvertSdToSelfRelativeSd
0x18000AB40: "__cdecl _imp_load_AuthzrExtInitializeRemoteResourceManager" __imp_load_AuthzrExtInitializeRemoteResourceManager
0x180044840: "struct __type_info_node __type_info_root_node" ?__type_info_root_node@@3U__type_info_node@@A
0x180047158: "__cdecl _imp_LsaFreeReturnBuffer" __imp_LsaFreeReturnBuffer
0x1800448C0: "__cdecl _hmod__DSROLE_dll" __hmod__DSROLE_dll
0x180005398: SafeAllocaInitialize
0x180036960: "__cdecl _sz_SAMLIB_dll" __sz_SAMLIB_dll
0x18003E0B0: WPP_3fc441256b733ca084290235768b843b_Traceguids
0x18001F23C: "public: unsigned long __cdecl CClaimDictionary::GetClaimDomainInfo(unsigned short * __ptr64 * __ptr64,unsigned short * __ptr64 * __ptr64) __ptr64" ?GetClaimDomainInfo@CClaimDictionary@@QEAAKPEAPEAG0@Z
0x1800291C8: AuthzBasepResetOperands
0x180003C98: AuthzBasepDeleteSecurityAttribute
0x180036018: "__cdecl _imp_SetThreadPriority" __imp_SetThreadPriority
0x180040CA0: SAMLIB_NULL_THUNK_DATA_DLN
0x1800416A8: SAMLIB_NULL_THUNK_DATA_DLB
0x180047140: SAMLIB_NULL_THUNK_DATA_DLA
0x180026050: AuthzBasepFindSystemSecurityAttribute
0x1800367E0: "__cdecl _sz_api_ms_win_security_sddl_l1_1_0_dll" __sz_api_ms_win_security_sddl_l1_1_0_dll
0x18003D238: "ExecutableImagePath" ??_C@_1CI@CKGIMBFA@?$AAE?$AAx?$AAe?$AAc?$AAu?$AAt?$AAa?$AAb?$AAl?$AAe?$AAI?$AAm?$AAa?$AAg?$AAe?$AAP?$AAa?$AAt?$AAh?$AA?$AA@
0x180026728: AuthzBasepQuerySecurityAttributesToken
0x18000A1F2: "__cdecl _stdio_common_vswprintf" __stdio_common_vswprintf
0x1800081C8: InternalVerifyStackAvailable
0x180003B74: AuthzBasepSetSecurityAttributesToken
0x18000ADCC: "__cdecl _imp_load_RpcBindingBind" __imp_load_RpcBindingBind
0x180042248: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-memory-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-memory-l1-1-0
0x18000AAB4: "__cdecl _imp_load_ldap_get_valuesW" __imp_load_ldap_get_valuesW
0x180017484: AuthzpFillReplyFromParameters
0x1800364A0: "__cdecl _imp_RtlAcquireResourceExclusive" __imp_RtlAcquireResourceExclusive
0x180036060: "__cdecl _imp_OpenThreadToken" __imp_OpenThreadToken
0x180003AA0: AuthzpGetGroupsFromToken
0x180047018: "__cdecl _imp_NdrClientCall3" __imp_NdrClientCall3
0x180047060: "__cdecl _imp_UuidCreate" __imp_UuidCreate
0x180026D38: AuthzBasepDuplicateSidsAndAttributes
0x1800364E8: "__cdecl _imp_RtlInitializeSid" __imp_RtlInitializeSid
0x18001B350: AuthzpRefreshCapCache
0x180044A80: authzpCapCachePtrLock
0x180014420: AuthzpModifySids
0x1800471F0: "__cdecl _imp_ldap_search_sW" __imp_ldap_search_sW
0x1800361C0: "__cdecl _imp__configure_narrow_argv" __imp__configure_narrow_argv
0x180013050: AuthzOpenObjectAudit
0x180036290: "__cdecl _imp_InitializeAcl" __imp_InitializeAcl
0x180023CA0: SafeAllocaAllocateFromHeap
0x180044A4C: g_AuthzQuotaTableUsed
0x18000A3F6: RegCloseKey
0x180042284: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0
0x180014DE8: AuthzpMakeLdapConnection
0x180003D00: AuthzBasepAddSecurityAttribute
0x180003794: AuthzBasepGetSidsAndAttributesLength
0x18000A981: "__cdecl _tailMerge_api_ms_win_security_lsalookup_l2_1_0_dll" __tailMerge_api_ms_win_security_lsalookup_l2_1_0_dll
0x180047020: "__cdecl _imp_NdrServerCall2" __imp_NdrServerCall2
0x180036230: "__cdecl _imp___std_type_info_destroy_list" __imp___std_type_info_destroy_list
0x1800361B8: "__cdecl _imp__o__cexit" __imp__o__cexit
0x18000A1F2: "__cdecl o___stdio_common_vswprintf" _o___stdio_common_vswprintf
0x18001A434: AuthzrShutdownRemoteAccessCheck
0x180020D40: "void __cdecl LdapCleanClaimMemory(struct CLAIM_OBJECT * __ptr64)" ?LdapCleanClaimMemory@@YAXPEAUCLAIM_OBJECT@@@Z
0x180018030: AuthzpMaximumAllowedAccessCheck
0x180036210: "__cdecl _imp_free" __imp_free
0x180036178: api-ms-win-core-synch-l1-2-0_NULL_THUNK_DATA
0x18001ECE4: WPP_SF_SS
0x1800471E0: "__cdecl _imp_ldap_get_values_lenW" __imp_ldap_get_values_lenW
0x18003D700: "CN=Central Access Rules,CN=Claim" ??_C@_1JM@EJKBBOPJ@?$AAC?$AAN?$AA?$DN?$AAC?$AAe?$AAn?$AAt?$AAr?$AAa?$AAl?$AA?5?$AAA?$AAc?$AAc?$AAe?$AAs?$AAs?$AA?5?$AAR?$AAu?$AAl?$AAe?$AAs?$AA?0?$AAC?$AAN?$AA?$DN?$AAC?$AAl?$AAa?$AAi?$AAm@
0x180021BD8: "void __cdecl LdapDeleteCaps(struct _CENTRAL_POLICY * __ptr64 const,unsigned __int64,int)" ?LdapDeleteCaps@@YAXQEAU_CENTRAL_POLICY@@_KH@Z
0x180008B58: AuthzrInitializeRemoteAccessCheck
0x180036050: "__cdecl _imp_OpenProcessToken" __imp_OpenProcessToken
0x18003DA60: WPP_43bb7188ef003dc6b1d46bc453371ed8_Traceguids
0x180008A58: AuthzBasepDuplicateClaimCollection
0x18000A5E1: "__cdecl _imp_load_RpcServerRegisterAuthInfoW" __imp_load_RpcServerRegisterAuthInfoW
0x1800171D0: AuthzpDefaultAccessCheck
0x180002A44: AuthzpFreeContext
0x180024118: AuthzBasepAuthzConvertToTokenSecurityAttributeValueType
0x180036160: api-ms-win-core-synch-l1-1-0_NULL_THUNK_DATA
0x18004216C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0
0x18000A222: "__cdecl execute_onexit_table" _execute_onexit_table
0x180004990: AuthzpAddWellKnownSids
0x180029DE0: LsapCreatePrivateHandleFromString
0x18001EC84: WPP_SF_S
0x180023E2C: AuthzBasepSetAppContainerAccessReasons
0x18000A1CE: memset
0x1800422FC: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x180009754: "__cdecl _report_securityfailure" __report_securityfailure
0x1800233FC: "unsigned long __cdecl LdapSafeCopyString(unsigned short * __ptr64,unsigned short * __ptr64 * __ptr64)" ?LdapSafeCopyString@@YAKPEAGPEAPEAG@Z
0x1800442A8: "unsigned __int64 `__local_stdio_scanf_options'::`2'::_OptionsStorage" ?_OptionsStorage@?1??__local_stdio_scanf_options@@9@4_KA
0x180036400: "__cdecl _imp_RtlCopyLuidAndAttributesArray" __imp_RtlCopyLuidAndAttributesArray
0x1800187A0: AuthzpVerifyOpenObjectArguments

[JEB Decompiler by PNF Software]