Generated by JEB on 2019/08/01

PE: C:\Windows\System32\oobe\FirstLogonAnim.exe Base=0x140000000 SHA-256=7FB56536D846405D6B9BE71BC8BC485E01B54AA336AC9A6BE47ADFE7410D2B2C
PDB: FirstLogonAnim.pdb GUID={E8192F37-60E4-588F-13AD6C98B66CEF26} Age=1

121 located named symbols:
0x1400018BC: "__cdecl _raise_securityfailure" __raise_securityfailure
0x1400016D0: "__cdecl FindPESection" _FindPESection
0x1400016C0: "__cdecl wsetargv" _wsetargv
0x140004010: "__cdecl _security_cookie_complement" __security_cookie_complement
0x1400032B8: "__cdecl _imp___wgetmainargs" __imp___wgetmainargs
0x1400031F8: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x140001B20: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x140004048: "__cdecl commode" _commode
0x140003188: "__cdecl _imp_HeapSetInformation" __imp_HeapSetInformation
0x1400015A0: "long __cdecl __CxxUnhandledExceptionFilter(struct _EXCEPTION_POINTERS * __ptr64)" ?__CxxUnhandledExceptionFilter@@YAJPEAU_EXCEPTION_POINTERS@@@Z
0x1400032E8: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x140004054: "__cdecl fmode" _fmode
0x140001008: wWinMain
0x140002000: MsftWatermark
0x1400015FE: "__cdecl XcptFilter" _XcptFilter
0x1400032F0: "__cdecl _xc_a" __xc_a
0x1400031E8: "__cdecl _imp_GetStartupInfoW" __imp_GetStartupInfoW
0x140003198: "__cdecl _imp_LoadLibraryExW" __imp_LoadLibraryExW
0x14000188F: "__cdecl initterm" _initterm
0x140003834: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0
0x1400045F0: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x140003240: "__cdecl _imp_Sleep" __imp_Sleep
0x140003320: "__cdecl _xi_z" __xi_z
0x1400031A8: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x140003170: "__cdecl _imp_GetCommandLineW" __imp_GetCommandLineW
0x14000189B: "__cdecl _C_specific_handler" __C_specific_handler
0x140001AAC: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x1400016B3: "__cdecl amsg_exit" _amsg_exit
0x140003390: "/explorer" ??_C@_1BE@KJKMGMJL@?$AA?1?$AAe?$AAx?$AAp?$AAl?$AAo?$AAr?$AAe?$AAr?$AA?$AA@
0x1400032A8: "__cdecl _imp_exit" __imp_exit
0x140003280: "__cdecl _imp__wcmdln" __imp__wcmdln
0x1400031B8: api-ms-win-core-errorhandling-l1-1-0_NULL_THUNK_DATA
0x1400031E0: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x1400045E0: "__cdecl _native_startup_lock" __native_startup_lock
0x140003380: "/zdp" ??_C@_19GHOJKPFM@?$AA?1?$AAz?$AAd?$AAp?$AA?$AA@
0x1400015E0: "__cdecl _CxxSetUnhandledExceptionFilter" __CxxSetUnhandledExceptionFilter
0x140003288: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x140003230: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x1400031C8: api-ms-win-core-libraryloader-l1-2-0_NULL_THUNK_DATA
0x1400031A0: KERNEL32_NULL_THUNK_DATA
0x140003180: "__cdecl _imp_GetLastError" __imp_GetLastError
0x140001A88: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x140003350: "/oobe" ??_C@_1M@IOGMDJJD@?$AA?1?$AAo?$AAo?$AAb?$AAe?$AA?$AA@
0x140003270: "__cdecl _imp__commode" __imp__commode
0x140003360: "/existinguser" ??_C@_1BM@KJGLMEME@?$AA?1?$AAe?$AAx?$AAi?$AAs?$AAt?$AAi?$AAn?$AAg?$AAu?$AAs?$AAe?$AAr?$AA?$AA@
0x140003290: "__cdecl _imp___setusermatherr" __imp___setusermatherr
0x1400031F0: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x140001540: wWinMainCRTStartup
0x140001780: "__cdecl ValidateImageBase" _ValidateImageBase
0x14000380C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0
0x140004050: "__cdecl newmode" _newmode
0x1400032D0: "__cdecl _imp__initterm" __imp__initterm
0x1400032B0: "__cdecl _imp___set_app_type" __imp___set_app_type
0x1400037BC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-path-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-path-l1-1-0
0x1400045D0: "__cdecl _onexitend" __onexitend
0x1400032A0: "__cdecl _imp__exit" __imp__exit
0x1400032E0: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x140003200: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x140003260: api-ms-win-core-sysinfo-l1-1-0_NULL_THUNK_DATA
0x140003308: "__cdecl _xi_a" __xi_a
0x140003250: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x1400016C0: "__cdecl matherr" _matherr
0x1400037E4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0
0x140001570: "__cdecl _security_check_cookie" __security_check_cookie
0x140003300: "__cdecl _xc_z" __xc_z
0x140003208: api-ms-win-core-processthreads-l1-1-0_NULL_THUNK_DATA
0x140003190: "__cdecl _imp_GetProcAddress" __imp_GetProcAddress
0x140003268: "__cdecl _imp_?terminate@@YAXXZ" __imp_?terminate@@YAXXZ
0x140003258: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x1400033A8: "/oobetransition" ??_C@_1CA@FNPINHIC@?$AA?1?$AAo?$AAo?$AAb?$AAe?$AAt?$AAr?$AAa?$AAn?$AAs?$AAi?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x140003238: api-ms-win-core-rtlsupport-l1-1-0_NULL_THUNK_DATA
0x1400031D0: "__cdecl _imp_PathCchCombine" __imp_PathCchCombine
0x140003848: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0
0x140003218: api-ms-win-core-profile-l1-1-0_NULL_THUNK_DATA
0x140003328: "__cdecl _guard_fids_table" __guard_fids_table
0x1400032D8: msvcrt_NULL_THUNK_DATA
0x140003060: "__cdecl load_config_used" _load_config_used
0x1400032C0: "__cdecl _imp__amsg_exit" __imp__amsg_exit
0x140003228: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x140003210: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x14000404C: "__cdecl dowildcard" _dowildcard
0x140003220: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x1400018B0: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x140003178: "__cdecl _imp_GetSystemDirectoryW" __imp_GetSystemDirectoryW
0x14000160C: RtlpImageNtHeader
0x1400031C0: "__cdecl _imp_GetModuleHandleW" __imp_GetModuleHandleW
0x1400032C8: "__cdecl _imp__XcptFilter" __imp__XcptFilter
0x1400033C8: "/RunFirstLogonAnim" ??_C@_1CG@POOIEIOB@?$AA?1?$AAR?$AAu?$AAn?$AAF?$AAi?$AAr?$AAs?$AAt?$AAL?$AAo?$AAg?$AAo?$AAn?$AAA?$AAn?$AAi?$AAm?$AA?$AA@
0x140004008: "__cdecl _security_cookie" __security_cookie
0x140004000: "__cdecl _defaultmatherr" __defaultmatherr
0x1400037F8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0
0x1400045D8: "__cdecl _onexitbegin" __onexitbegin
0x1400033F0: "oobe\msoobeFirstLogonAnim.dll" ??_C@_1DM@EPNPACMO@?$AAo?$AAo?$AAb?$AAe?$AA?2?$AAm?$AAs?$AAo?$AAo?$AAb?$AAe?$AAF?$AAi?$AAr?$AAs?$AAt?$AAL?$AAo?$AAg?$AAo?$AAn?$AAA?$AAn?$AAi?$AAm?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x1400031B0: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x140003794: "__cdecl _IMPORT_DESCRIPTOR_KERNEL32" __IMPORT_DESCRIPTOR_KERNEL32
0x1400017B4: "__cdecl _security_init_cookie" __security_init_cookie
0x140003298: "__cdecl _imp__cexit" __imp__cexit
0x140001668: "__cdecl get_image_app_type" _get_image_app_type
0x1400037A8: "__cdecl _IMPORT_DESCRIPTOR_msvcrt" __IMPORT_DESCRIPTOR_msvcrt
0x140001900: "__cdecl _report_gsfailure" __report_gsfailure
0x140003168: "__cdecl _imp_FindStringOrdinal" __imp_FindStringOrdinal
0x1400045E8: "__cdecl _native_startup_state" __native_startup_state
0x1400031D8: api-ms-win-core-path-l1-1-0_NULL_THUNK_DATA
0x140003278: "__cdecl _imp__fmode" __imp__fmode
0x140003820: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0
0x140001720: "__cdecl IsNonwritableInCurrentImage" _IsNonwritableInCurrentImage
0x140003248: api-ms-win-core-synch-l1-2-0_NULL_THUNK_DATA
0x1400037D0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0
0x14000385C: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR

[JEB Decompiler by PNF Software]