Generated by JEB on 2019/08/01

PE: C:\Windows\System32\offlinelsa.dll Base=0x180000000 SHA-256=8255A8CECE4DC51EF487989E03B5A54983896DEB25D704225412CFCE9F28619D
PDB: offlinelsa.pdb GUID={1A45810C-5E7B-72E2-CC33742EDDA10CDD} Age=1

780 located named symbols:
0x1800056D8: "private: long __cdecl LsaOfflinePolicy::ApplyPendingRXactTxns(int) __ptr64" ?ApplyPendingRXactTxns@LsaOfflinePolicy@@AEAAJH@Z
0x1800166B8: "__cdecl _imp_UnregisterTraceGuids" __imp_UnregisterTraceGuids
0x180014A1C: "__cdecl _raise_securityfailure" __raise_securityfailure
0x1800014C0: "protected: long __cdecl LsaOfflineRegistryHandle::DbReadAttributesObject(struct LsaOfflineRegistryHandle::_DB_ATTRIBUTE * __ptr64,unsigned long) __ptr64" ?DbReadAttributesObject@LsaOfflineRegistryHandle@@IEAAJPEAU_DB_ATTRIBUTE@1@K@Z
0x1800165A0: api-ms-win-core-file-l1-1-0_NULL_THUNK_DATA
0x1800112F0: RtlDecodeUtf16LE
0x180012048: LspDestroyEncryptionContext
0x1800101D0: RtlAllocateLUnicodeString
0x1800165C8: api-ms-win-core-heap-obsolete-l1-1-0_NULL_THUNK_DATA
0x180017918: "TrDmSid" ??_C@_1BA@FDEHIOAN@?$AAT?$AAr?$AAD?$AAm?$AAS?$AAi?$AAd?$AA?$AA@
0x180017900: "TrDmTrPN" ??_C@_1BC@JIIDNPJM@?$AAT?$AAr?$AAD?$AAm?$AAT?$AAr?$AAP?$AAN?$AA?$AA@
0x180014BF0: "__cdecl FindPESection" _FindPESection
0x180004A7C: "public: long __cdecl LsaOfflinePolicy::EnumerateAccounts(unsigned long * __ptr64,void * __ptr64 * __ptr64,unsigned long,unsigned long * __ptr64) __ptr64" ?EnumerateAccounts@LsaOfflinePolicy@@QEAAJPEAKPEAPEAXK0@Z
0x180018870: LspSyskeyEncryptionKeyID
0x18001AE10: T4
0x18001B310: U4
0x180017E98: " *** Assertion failed: %s *** " ??_C@_0DM@NBFILLLK@?6?$CK?$CK?$CK?5Assertion?5failed?3?5?$CFs?6?$CK?$CK?$CK?5?5?5@
0x1800168F0: "__cdecl _imp_RtlFreeUnicodeString" __imp_RtlFreeUnicodeString
0x180017698: "Privilgs" ??_C@_1BC@HLDNHEBD@?$AAP?$AAr?$AAi?$AAv?$AAi?$AAl?$AAg?$AAs?$AA?$AA@
0x18001D060: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x180010E6C: RtlConvertWin32RegistryPathToNtRegistryPathWithSid
0x18000266C: "public: long __cdecl LsaOfflineAccount::EnumeratePrivileges(struct _PRIVILEGE_SET * __ptr64 * __ptr64) __ptr64" ?EnumeratePrivileges@LsaOfflineAccount@@QEAAJPEAPEAU_PRIVILEGE_SET@@@Z
0x18001D178: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-kernel32-legacy-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-kernel32-legacy-l1-1-0
0x1800165F8: "__cdecl _imp_VirtualProtect" __imp_VirtualProtect
0x18000DA50: "public: __cdecl ImpersonateHelper::~ImpersonateHelper(void) __ptr64" ??1ImpersonateHelper@@QEAA@XZ
0x180017D70: WPP_32f381367d2e3f7adeda385eabf53e43_Traceguids
0x180007C60: "private: long __cdecl LsaOfflinePolicy::QueryTargetProductSuiteHelper(class IOfflineKey * __ptr64,int * __ptr64) __ptr64" ?QueryTargetProductSuiteHelper@LsaOfflinePolicy@@AEAAJPEAVIOfflineKey@@PEAH@Z
0x180016CB0: "SeDenyInteractiveLogonRight" ??_C@_1DI@FHICHPLG@?$AAS?$AAe?$AAD?$AAe?$AAn?$AAy?$AAI?$AAn?$AAt?$AAe?$AAr?$AAa?$AAc?$AAt?$AAi?$AAv?$AAe?$AAL?$AAo?$AAg?$AAo?$AAn?$AAR?$AAi?$AAg?$AAh?$AAt?$AA?$AA@
0x18001F130: "__cdecl _security_cookie_complement" __security_cookie_complement
0x180013650: rijndaelDecrypt
0x1800172D8: "SeBackupPrivilege" ??_C@_1CE@MBNFGOEN@?$AAS?$AAe?$AAB?$AAa?$AAc?$AAk?$AAu?$AAp?$AAP?$AAr?$AAi?$AAv?$AAi?$AAl?$AAe?$AAg?$AAe?$AA?$AA@
0x180017AF0: "PolEKList" ??_C@_1BE@MOBMDEO@?$AAP?$AAo?$AAl?$AAE?$AAK?$AAL?$AAi?$AAs?$AAt?$AA?$AA@
0x18000BF3C: "long __cdecl LoadSyskeyClassValue(class IOfflineKey * __ptr64,unsigned short * __ptr64,char * __ptr64)" ?LoadSyskeyClassValue@@YAJPEAVIOfflineKey@@PEAGPEAD@Z
0x1800179A8: "TrDmTrRt" ??_C@_1BC@EKNNGGFC@?$AAT?$AAr?$AAD?$AAm?$AAT?$AAr?$AAR?$AAt?$AA?$AA@
0x180016400: g_LUNICODE_STRING_HKLM_bslash_
0x180008EA0: "long __cdecl LsaOfflineEnumerateAccountRights(void * __ptr64,void * __ptr64,struct _UNICODE_STRING * __ptr64 * __ptr64,unsigned long * __ptr64)" ?LsaOfflineEnumerateAccountRights@@YAJPEAX0PEAPEAU_UNICODE_STRING@@PEAK@Z
0x180017830: "PolPrDmS" ??_C@_1BC@BDILJHAF@?$AAP?$AAo?$AAl?$AAP?$AAr?$AAD?$AAm?$AAS?$AA?$AA@
0x1800180B0: "BUCL::Rtl::ConvertInteger(Source" ??_C@_0EA@MDGBNKIL@BUCL?3?3Rtl?3?3ConvertInteger?$CISource@
0x180016F70: "HKLM\SECURITY" ??_C@_1BM@MGAGLMOI@?$AAH?$AAK?$AAL?$AAM?$AA?2?$AAS?$AAE?$AAC?$AAU?$AAR?$AAI?$AAT?$AAY?$AA?$AA@
0x1800102DC: RtlFreeLUnicodeString
0x1800144FC: "__cdecl CRT_INIT" _CRT_INIT
0x18000A300: "public: virtual long __cdecl CWin32OfflineKey::DeleteValue(struct _UNICODE_STRING * __ptr64) __ptr64" ?DeleteValue@CWin32OfflineKey@@UEAAJPEAU_UNICODE_STRING@@@Z
0x180010B08: "public: void __cdecl Windows::ErrorHandling::Rtl::CBaseFrame<class Windows::ErrorHandling::Rtl::CSimpleNtStatusCarryingFrame>::ReportErrorOrigination(struct Windows::ErrorHandling::_RTL_CALL_SITE const * __ptr64) __ptr64" ?ReportErrorOrigination@?$CBaseFrame@VCSimpleNtStatusCarryingFrame@Rtl@ErrorHandling@Windows@@@Rtl@ErrorHandling@Windows@@QEAAXPEBU_RTL_CALL_SITE@34@@Z
0x180016638: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x18001FBC0: "struct _LSAP_DB_OBJECT_TYPE * DbObjectTypes" ?DbObjectTypes@@3PAU_LSAP_DB_OBJECT_TYPE@@A
0x180018810: g_RGWCH_HKEY_under_USERS_bslash_
0x18001FD90: "struct _UNICODE_STRING * LsaOfflineObjectTypeNames" ?LsaOfflineObjectTypeNames@@3PAU_UNICODE_STRING@@A
0x1800169D8: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x180017708: "CurrVal" ??_C@_1BA@GBOCAPEB@?$AAC?$AAu?$AAr?$AAr?$AAV?$AAa?$AAl?$AA?$AA@
0x18000F1B0: WppControlCallback
0x180005B90: "private: long __cdecl LsaOfflinePolicy::MountSystemHive(void) __ptr64" ?MountSystemHive@LsaOfflinePolicy@@AEAAJXZ
0x180014EA0: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x180019C90: rcon
0x180016DC0: "SeDenyRemoteInteractiveLogonRigh" ??_C@_1EE@MIHNMCGB@?$AAS?$AAe?$AAD?$AAe?$AAn?$AAy?$AAR?$AAe?$AAm?$AAo?$AAt?$AAe?$AAI?$AAn?$AAt?$AAe?$AAr?$AAa?$AAc?$AAt?$AAi?$AAv?$AAe?$AAL?$AAo?$AAg?$AAo?$AAn?$AAR?$AAi?$AAg?$AAh@
0x180017A30: "KerMinT" ??_C@_1BA@HFJPFGJN@?$AAK?$AAe?$AAr?$AAM?$AAi?$AAn?$AAT?$AA?$AA@
0x180017990: "TrDmTrPr" ??_C@_1BC@CCHOJIIF@?$AAT?$AAr?$AAD?$AAm?$AAT?$AAr?$AAP?$AAr?$AA?$AA@
0x180014370: aes
0x180011650: LspRC4EncryptedTextLength
0x18000249C: "public: __cdecl LsaOfflineRegistryHandle::LsaOfflineRegistryHandle(class SystemToken * __ptr64,struct Windows::Rtl::IRtlSystemIsolationLayer * __ptr64,enum _LSAP_DB_OBJECT_TYPE_ID) __ptr64" ??0LsaOfflineRegistryHandle@@QEAA@PEAVSystemToken@@PEAUIRtlSystemIsolationLayer@Rtl@Windows@@W4_LSAP_DB_OBJECT_TYPE_ID@@@Z
0x180011B90: LspMD5HashUpdate
0x18001F020: LspAES256EncryptionAlgorithmData
0x18000AE80: "public: virtual long __cdecl CSilOfflineKey::DeleteRecursively(void) __ptr64" ?DeleteRecursively@CSilOfflineKey@@UEAAJXZ
0x180001720: "protected: long __cdecl LsaOfflineRegistryHandle::DbWriteAttributeObject(struct _UNICODE_STRING * __ptr64,void * __ptr64,unsigned long) __ptr64" ?DbWriteAttributeObject@LsaOfflineRegistryHandle@@IEAAJPEAU_UNICODE_STRING@@PEAXK@Z
0x180019D10: S5
0x18001AA10: T5
0x180007AA8: "private: long __cdecl LsaOfflinePolicy::QueryTargetProductInfoHelper(class IOfflineKey * __ptr64,enum _NT_PRODUCT_TYPE * __ptr64) __ptr64" ?QueryTargetProductInfoHelper@LsaOfflinePolicy@@AEAAJPEAVIOfflineKey@@PEAW4_NT_PRODUCT_TYPE@@@Z
0x180016018: "const LsaOfflineRegistryHandle::`vftable'" ??_7LsaOfflineRegistryHandle@@6B@
0x180002460: "public: virtual void * __ptr64 __cdecl LsaOfflineRegistryHandle::`scalar deleting destructor'(unsigned int) __ptr64" ??_GLsaOfflineRegistryHandle@@UEAAPEAXI@Z
0x180017CD8: "SecretObject" ??_C@_1BK@GNJBMJMJ@?$AAS?$AAe?$AAc?$AAr?$AAe?$AAt?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AA?$AA@
0x180017E90: "" ??_C@_00CNPNBAHC@?$AA@
0x180016D78: "SeRemoteInteractiveLogonRight" ??_C@_1DM@NINDPFE@?$AAS?$AAe?$AAR?$AAe?$AAm?$AAo?$AAt?$AAe?$AAI?$AAn?$AAt?$AAe?$AAr?$AAa?$AAc?$AAt?$AAi?$AAv?$AAe?$AAL?$AAo?$AAg?$AAo?$AAn?$AAR?$AAi?$AAg?$AAh?$AAt?$AA?$AA@
0x180018490: "RtlConvertWin32RegistryPathToNtR" ??_C@_0DD@LJOBJCFF@RtlConvertWin32RegistryPathToNtR@
0x18001FEA8: g_ulAdditionalProbeSize
0x180016770: "__cdecl _imp_BCryptDestroyKey" __imp_BCryptDestroyKey
0x180009280: "long __cdecl LsaOfflineGetSystemAccessAccount(void * __ptr64,unsigned long * __ptr64)" ?LsaOfflineGetSystemAccessAccount@@YAJPEAXPEAK@Z
0x18001F720: "struct _LIST_ENTRY gWin32Keys" ?gWin32Keys@@3U_LIST_ENTRY@@A
0x18000603C: "private: long __cdecl LsaOfflinePolicy::UnloadSystemHive(void) __ptr64" ?UnloadSystemHive@LsaOfflinePolicy@@AEAAJXZ
0x18001D100: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-1-0
0x1800176C8: "QuotaLim" ??_C@_1BC@BNACIMNA@?$AAQ?$AAu?$AAo?$AAt?$AAa?$AAL?$AAi?$AAm?$AA?$AA@
0x1800167B0: bcrypt_NULL_THUNK_DATA
0x18001D0B0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-eventing-classicprovider-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-eventing-classicprovider-l1-1-0
0x1800168E8: "__cdecl _imp_RtlUnicodeStringToAnsiString" __imp_RtlUnicodeStringToAnsiString
0x180016D18: "SeDenyBatchLogonRight" ??_C@_1CM@GNGBHIMJ@?$AAS?$AAe?$AAD?$AAe?$AAn?$AAy?$AAB?$AAa?$AAt?$AAc?$AAh?$AAL?$AAo?$AAg?$AAo?$AAn?$AAR?$AAi?$AAg?$AAh?$AAt?$AA?$AA@
0x180016860: "__cdecl _imp_RtlCreateSecurityDescriptor" __imp_RtlCreateSecurityDescriptor
0x1800168B8: "__cdecl _imp_NtSetInformationThread" __imp_NtSetInformationThread
0x18000B5D0: "public: static long __cdecl IOfflineKey::CreateAndInitializeForSIL(struct Windows::Rtl::IRtlKey * __ptr64,class IOfflineKey * __ptr64 * __ptr64)" ?CreateAndInitializeForSIL@IOfflineKey@@SAJPEAUIRtlKey@Rtl@Windows@@PEAPEAV1@@Z
0x180002078: "protected: void __cdecl LsaOfflineRegistryHandle::CloseKey(void * __ptr64) __ptr64" ?CloseKey@LsaOfflineRegistryHandle@@IEAAXPEAX@Z
0x180016720: "__cdecl _imp_CryptReleaseContext" __imp_CryptReleaseContext
0x180016328: g_LUNICODE_STRING_HKEY_under_CURRENT_under_USER_bslash_
0x180002550: "public: virtual __cdecl LsaOfflineRegistryHandle::~LsaOfflineRegistryHandle(void) __ptr64" ??1LsaOfflineRegistryHandle@@UEAA@XZ
0x180016A08: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x180017300: "SeRestorePrivilege" ??_C@_1CG@LMBBLCJG@?$AAS?$AAe?$AAR?$AAe?$AAs?$AAt?$AAo?$AAr?$AAe?$AAP?$AAr?$AAi?$AAv?$AAi?$AAl?$AAe?$AAg?$AAe?$AA?$AA@
0x180003334: "public: long __cdecl LsaOfflineAccount::SetSystemAccess(unsigned long) __ptr64" ?SetSystemAccess@LsaOfflineAccount@@QEAAJK@Z
0x18000B798: "private: long __cdecl LsaOfflinePolicy::SetupInitialSyskey(void) __ptr64" ?SetupInitialSyskey@LsaOfflinePolicy@@AEAAJXZ
0x18001F760: "struct _UNICODE_STRING LsaOfflineNullString" ?LsaOfflineNullString@@3U_UNICODE_STRING@@A
0x180016938: "__cdecl _imp_RtlGetOwnerSecurityDescriptor" __imp_RtlGetOwnerSecurityDescriptor
0x180016FA0: "\REGISTRY\MACHINE\SYSTEM" ??_C@_1DC@GKOJGBFO@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?$AA@
0x1800179D0: "TrDmSAO" ??_C@_1BA@MPILCBGJ@?$AAT?$AAr?$AAD?$AAm?$AAS?$AAA?$AAO?$AA?$AA@
0x1800178E8: "TrDmName" ??_C@_1BC@JFOMMEDJ@?$AAT?$AAr?$AAD?$AAm?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x180008910: "long __cdecl LsaOfflineQueryInformationPolicy(void * __ptr64,enum _POLICY_INFORMATION_CLASS,void * __ptr64 * __ptr64)" ?LsaOfflineQueryInformationPolicy@@YAJPEAXW4_POLICY_INFORMATION_CLASS@@PEAPEAX@Z
0x180017C68: "PolicyObject" ??_C@_1BK@JNOIACEB@?$AAP?$AAo?$AAl?$AAi?$AAc?$AAy?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AA?$AA@
0x180010310: RtlDuplicateUnicodeStringToLUnicodeString
0x1800179C0: "TrDmSAI" ??_C@_1BA@OKOAHOLF@?$AAT?$AAr?$AAD?$AAm?$AAS?$AAA?$AAI?$AA?$AA@
0x180017A60: "KerProxy" ??_C@_1BC@KBONMJMB@?$AAK?$AAe?$AAr?$AAP?$AAr?$AAo?$AAx?$AAy?$AA?$AA@
0x1800177E8: "PolDnDmG" ??_C@_1BC@POHMOACI@?$AAP?$AAo?$AAl?$AAD?$AAn?$AAD?$AAm?$AAG?$AA?$AA@
0x1800186E0: g_RGWCH_HKCC_bslash_
0x1800182D8: "::RtlIsLUnicodeStringValid(Desti" ??_C@_0CI@IKOLADAO@?3?3RtlIsLUnicodeStringValid?$CIDesti@
0x180016BB0: WPP_ThisDir_CTLGUID_OFFLINELSA
0x180014BD7: "__cdecl XcptFilter" _XcptFilter
0x180016A10: "__cdecl _xc_a" __xc_a
0x180018890: T6
0x180016C88: "SeServiceLogonRight" ??_C@_1CI@LEDFFMOC@?$AAS?$AAe?$AAS?$AAe?$AAr?$AAv?$AAi?$AAc?$AAe?$AAL?$AAo?$AAg?$AAo?$AAn?$AAR?$AAi?$AAg?$AAh?$AAt?$AA?$AA@
0x180017138: WPP_517d5ceda802342187ed678d2f2ee4c1_Traceguids
0x1800161D0: "private: static struct LsaOfflineDBOptions::DB_OPTION const * const LsaOfflineDBOptions::_StringOptions" ?_StringOptions@LsaOfflineDBOptions@@0QBUDB_OPTION@1@B
0x180010AF8: "public: void __cdecl Windows::ErrorHandling::Rtl::CBaseFrame<class Windows::ErrorHandling::Rtl::CSimpleNtStatusCarryingFrame>::SetInvalidParameter(void) __ptr64" ?SetInvalidParameter@?$CBaseFrame@VCSimpleNtStatusCarryingFrame@Rtl@ErrorHandling@Windows@@@Rtl@ErrorHandling@Windows@@QEAAXXZ
0x180016718: "__cdecl _imp_CryptGenRandom" __imp_CryptGenRandom
0x1800167A8: "__cdecl _imp_BCryptCreateHash" __imp_BCryptCreateHash
0x180016750: "__cdecl _imp_ConvertStringSidToSidW" __imp_ConvertStringSidToSidW
0x180006FCC: "private: long __cdecl LsaOfflinePolicy::UpdateInitializationPassCompleted(unsigned long) __ptr64" ?UpdateInitializationPassCompleted@LsaOfflinePolicy@@AEAAJK@Z
0x18000133C: "protected: static void __cdecl LsaOfflineRegistryHandle::DbInitializeAttribute(struct LsaOfflineRegistryHandle::_DB_ATTRIBUTE * __ptr64,enum _LSAP_DB_NAMES,void * __ptr64,unsigned long,unsigned char)" ?DbInitializeAttribute@LsaOfflineRegistryHandle@@KAXPEAU_DB_ATTRIBUTE@1@W4_LSAP_DB_NAMES@@PEAXKE@Z
0x180017B40: "XRefNetbiosName" ??_C@_1CA@DCMBAGJG@?$AAX?$AAR?$AAe?$AAf?$AAN?$AAe?$AAt?$AAb?$AAi?$AAo?$AAs?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x1800096EC: WPP_SF_ZDD
0x18000E640: "long __cdecl LsaOfflineInitializeObjectTypes(void)" ?LsaOfflineInitializeObjectTypes@@YAJXZ
0x1800013BC: "public: long __cdecl LsaOfflineRegistryHandle::DbReadAttributeObject(struct _UNICODE_STRING * __ptr64,void * __ptr64,unsigned long * __ptr64) __ptr64" ?DbReadAttributeObject@LsaOfflineRegistryHandle@@QEAAJPEAU_UNICODE_STRING@@PEAXPEAK@Z
0x180016918: "__cdecl _imp_NtSetValueKey" __imp_NtSetValueKey
0x1800170D0: "ServerNt" ??_C@_1BC@GNJGMHML@?$AAS?$AAe?$AAr?$AAv?$AAe?$AAr?$AAN?$AAt?$AA?$AA@
0x180011DD8: LspFreeBaseEncryptionKey
0x18001FE50: ?g_pfnRtlErrorReportFunction@?A0x98913741@@3P6AXPEBU_RTL_CALL_SITE@ErrorHandling@Windows@@AEBU_GUID@@K@ZEA
0x180017CB0: "UserAccountObject" ??_C@_1CE@HMHLHPCB@?$AAU?$AAs?$AAe?$AAr?$AAA?$AAc?$AAc?$AAo?$AAu?$AAn?$AAt?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AA?$AA@
0x18001FB98: "void * __ptr64 __ptr64 LsaOfflineWindowManagerGroupSid" ?LsaOfflineWindowManagerGroupSid@@3PEAXEA
0x180011CA0: LspSHA256HashInit
0x180010028: "private: long __cdecl LsaOfflineDBOptions::Initialize(class IOfflineKey * __ptr64) __ptr64" ?Initialize@LsaOfflineDBOptions@@AEAAJPEAVIOfflineKey@@@Z
0x180016988: "__cdecl _imp_NtFlushKey" __imp_NtFlushKey
0x180016728: "__cdecl _imp_CryptAcquireContextW" __imp_CryptAcquireContextW
0x180014E76: memcpy
0x180017E80: WPP_33718bd1d1ce3d55d558c6422ee7633f_Traceguids
0x180013AD0: rijndaelDecrypt128
0x1800176B0: "Sid" ??_C@_17NKMLOKHF@?$AAS?$AAi?$AAd?$AA?$AA@
0x1800182B0: "RtlAppendLUnicodeStringToLUnicod" ??_C@_0CI@JKPPDGNE@RtlAppendLUnicodeStringToLUnicod@
0x180011C10: LspSHA256HashData
0x1800179E0: "TrDmForT" ??_C@_1BC@CJKGLJHF@?$AAT?$AAr?$AAD?$AAm?$AAF?$AAo?$AAr?$AAT?$AA?$AA@
0x18001FE00: "void * __ptr64 __ptr64 LsaOfflineAnonymousSid" ?LsaOfflineAnonymousSid@@3PEAXEA
0x180016310: g_LUNICODE_STRING__empty_
0x180016808: "__cdecl _imp_memset" __imp_memset
0x180002A20: "public: long __cdecl LsaOfflineAccount::EnumerateAccountRights(struct _UNICODE_STRING * __ptr64 * __ptr64,unsigned long * __ptr64) __ptr64" ?EnumerateAccountRights@LsaOfflineAccount@@QEAAJPEAPEAU_UNICODE_STRING@@PEAK@Z
0x1800170A8: "WinNt" ??_C@_1M@PFFFELPH@?$AAW?$AAi?$AAn?$AAN?$AAt?$AA?$AA@
0x180014DAF: "__cdecl initterm" _initterm
0x1800166D8: "__cdecl _imp_TraceMessage" __imp_TraceMessage
0x1800089E0: "long __cdecl LsaOfflineEnumerateAccounts(void * __ptr64,unsigned long * __ptr64,void * __ptr64 * __ptr64,unsigned long,unsigned long * __ptr64)" ?LsaOfflineEnumerateAccounts@@YAJPEAXPEAKPEAPEAXK1@Z
0x18001D1DC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0
0x18001FE80: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x18000B460: "public: virtual long __cdecl CSilOfflineKey::QueryClass(unsigned short * __ptr64 * __ptr64) __ptr64" ?QueryClass@CSilOfflineKey@@UEAAJPEAPEAG@Z
0x180018640: g_RGWCH_HKCR_bslash_
0x180008BA0: "long __cdecl LsaOfflineOpenAccount(void * __ptr64,void * __ptr64,void * __ptr64 * __ptr64)" ?LsaOfflineOpenAccount@@YAJPEAX0PEAPEAX@Z
0x180016688: "__cdecl _imp_Sleep" __imp_Sleep
0x180004CAC: "public: long __cdecl LsaOfflinePolicy::OpenAccount(void * __ptr64,class LsaOfflineAccount * __ptr64 * __ptr64) __ptr64" ?OpenAccount@LsaOfflinePolicy@@QEAAJPEAXPEAPEAVLsaOfflineAccount@@@Z
0x18000B070: "public: virtual long __cdecl CSilOfflineKey::SetValue(struct _UNICODE_STRING * __ptr64,unsigned long,void * __ptr64,unsigned long) __ptr64" ?SetValue@CSilOfflineKey@@UEAAJPEAU_UNICODE_STRING@@KPEAXK@Z
0x1800113C8: "__cdecl resetstkoflw_static" _resetstkoflw_static
0x180016970: "__cdecl _imp_RtlSubAuthoritySid" __imp_RtlSubAuthoritySid
0x180016A30: "__cdecl _xi_z" __xi_z
0x180017770: "PolAdtEv" ??_C@_1BC@FHFIEMBD@?$AAP?$AAo?$AAl?$AAA?$AAd?$AAt?$AAE?$AAv?$AA?$AA@
0x180019890: T7
0x180018388: "RtlConvertWin32RegistryPathToNtR" ??_C@_0DA@OBOIHGMC@RtlConvertWin32RegistryPathToNtR@
0x180016588: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x18000B634: "void __cdecl AddKeyToList(struct _LIST_ENTRY * __ptr64,struct _LIST_ENTRY * __ptr64)" ?AddKeyToList@@YAXPEAU_LIST_ENTRY@@0@Z
0x1800168D0: "__cdecl _imp_NtOpenProcessToken" __imp_NtOpenProcessToken
0x1800186F0: g_RGWCH_HKEY_under_CLASSES_under_ROOT_bslash_
0x180002460: "public: virtual void * __ptr64 __cdecl LsaOfflineRegistryHandle::`vector deleting destructor'(unsigned int) __ptr64" ??_ELsaOfflineRegistryHandle@@UEAAPEAXI@Z
0x180002110: "public: static long __cdecl LsaOfflineRegistryHandle::CreateKey(void * __ptr64,void * __ptr64,struct _UNICODE_STRING * __ptr64,void * __ptr64 * __ptr64)" ?CreateKey@LsaOfflineRegistryHandle@@SAJPEAX0PEAU_UNICODE_STRING@@PEAPEAX@Z
0x180014DBB: "__cdecl _C_specific_handler" __C_specific_handler
0x18000B470: "public: virtual void __cdecl CSilOfflineKey::Release(void) __ptr64" ?Release@CSilOfflineKey@@UEAAXXZ
0x1800165D0: "__cdecl _imp_WTSGetActiveConsoleSessionId" __imp_WTSGetActiveConsoleSessionId
0x180017DA0: "LocalAccountDomainSid" ??_C@_1CM@HEEIAIOJ@?$AAL?$AAo?$AAc?$AAa?$AAl?$AAA?$AAc?$AAc?$AAo?$AAu?$AAn?$AAt?$AAD?$AAo?$AAm?$AAa?$AAi?$AAn?$AAS?$AAi?$AAd?$AA?$AA@
0x180016668: "__cdecl _imp_ReleaseSRWLockExclusive" __imp_ReleaseSRWLockExclusive
0x180008300: WPP_SF_q_sid_
0x180018020: "RtlInitUnicodeStringFromLUnicode" ??_C@_0CH@OBJMEFGP@RtlInitUnicodeStringFromLUnicode@
0x180003620: "public: static long __cdecl LsaOfflineAccount::Create(class LsaOfflinePolicy * __ptr64,struct Windows::Rtl::IRtlSystemIsolationLayer * __ptr64,class LsaOfflineAccount * __ptr64 * __ptr64)" ?Create@LsaOfflineAccount@@SAJPEAVLsaOfflinePolicy@@PEAUIRtlSystemIsolationLayer@Rtl@Windows@@PEAPEAV1@@Z
0x180016C60: "SeBatchLogonRight" ??_C@_1CE@JIKHJFFJ@?$AAS?$AAe?$AAB?$AAa?$AAt?$AAc?$AAh?$AAL?$AAo?$AAg?$AAo?$AAn?$AAR?$AAi?$AAg?$AAh?$AAt?$AA?$AA@
0x18001FB80: "void * __ptr64 __ptr64 LsaOfflineNetworkServiceSid" ?LsaOfflineNetworkServiceSid@@3PEAXEA
0x180016990: "__cdecl _imp_RtlDosPathNameToRelativeNtPathName_U_WithStatus" __imp_RtlDosPathNameToRelativeNtPathName_U_WithStatus
0x18001FE20: WPP_REGISTRATION_GUIDS
0x180016FD8: WPP_c8d23087ae3533b21b7f0e812bc5a818_Traceguids
0x180017158: "ControlSet001\Control\Lsa" ??_C@_1DE@CKGLCGKM@?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA0?$AA0?$AA1?$AA?2?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AA?2?$AAL?$AAs?$AAa?$AA?$AA@
0x18001F730: "struct _LIST_ENTRY gSilKeys" ?gSilKeys@@3U_LIST_ENTRY@@A
0x180016868: "__cdecl _imp_RtlCreateAcl" __imp_RtlCreateAcl
0x1800165B0: api-ms-win-core-handle-l1-1-0_NULL_THUNK_DATA
0x180017108: "Personal" ??_C@_1BC@EANCBBIH@?$AAP?$AAe?$AAr?$AAs?$AAo?$AAn?$AAa?$AAl?$AA?$AA@
0x180003FB8: "public: static long __cdecl LsaOfflinePolicy::CreateAndInitializeForInstaller(struct Windows::Rtl::IRtlSystemIsolationLayer * __ptr64,class LsaOfflinePolicy * __ptr64 * __ptr64)" ?CreateAndInitializeForInstaller@LsaOfflinePolicy@@SAJPEAUIRtlSystemIsolationLayer@Rtl@Windows@@PEAPEAV1@@Z
0x18000CA20: "public: static long __cdecl SystemToken::GetToken(class SystemToken * __ptr64 * __ptr64)" ?GetToken@SystemToken@@SAJPEAPEAV1@@Z
0x18000F0A4: "long __cdecl LsaOfflineInitializeGlobals(void)" ?LsaOfflineInitializeGlobals@@YAJXZ
0x18001FB90: "void * __ptr64 __ptr64 LsaOfflineWorldSid" ?LsaOfflineWorldSid@@3PEAXEA
0x18000D7D0: "private: __cdecl SystemToken::SystemToken(void * __ptr64) __ptr64" ??0SystemToken@@AEAA@PEAX@Z
0x1800168B0: "__cdecl _imp_NtQueryInformationToken" __imp_NtQueryInformationToken
0x180018520: "::RtlIsLBlobValid(Blob)" ??_C@_0BI@HCBMPJOG@?3?3RtlIsLBlobValid?$CIBlob?$CJ?$AA@
0x180014E0C: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x180017938: "TrDmCtN" ??_C@_1BA@FPDLOBDJ@?$AAT?$AAr?$AAD?$AAm?$AAC?$AAt?$AAN?$AA?$AA@
0x18000ECB8: "long __cdecl LsaOfflineInitializeWellKnownSids(void)" ?LsaOfflineInitializeWellKnownSids@@YAJXZ
0x180018430: "RtlFormatCurrentUserKeyPath(User" ??_C@_0EB@GEAFLEF@RtlFormatCurrentUserKeyPath?$CIUser@
0x18000B9F4: "private: long __cdecl LsaOfflinePolicy::GetLsaKeyForSyskey(class IOfflineKey * __ptr64,class IOfflineKey * __ptr64 * __ptr64) __ptr64" ?GetLsaKeyForSyskey@LsaOfflinePolicy@@AEAAJPEAVIOfflineKey@@PEAPEAV2@@Z
0x1800109C8: RtlReallocateLUnicodeString
0x180017A78: "KerLogoff" ??_C@_1BE@GHMNBMPC@?$AAK?$AAe?$AAr?$AAL?$AAo?$AAg?$AAo?$AAf?$AAf?$AA?$AA@
0x18000F838: "private: long __cdecl LsaOfflineDBOptions::QuerySidOptions(class IOfflineKey * __ptr64) __ptr64" ?QuerySidOptions@LsaOfflineDBOptions@@AEAAJPEAVIOfflineKey@@@Z
0x180017788: "PolAcDmN" ??_C@_1BC@OOCJFDAC@?$AAP?$AAo?$AAl?$AAA?$AAc?$AAD?$AAm?$AAN?$AA?$AA@
0x180016828: "__cdecl _imp_RtlAllocateHeap" __imp_RtlAllocateHeap
0x18000D3C4: "private: static long __cdecl SystemToken::GetTokenForProcess(unsigned long,void * __ptr64 * __ptr64)" ?GetTokenForProcess@SystemToken@@CAJKPEAPEAX@Z
0x18001138C: RtlUpcaseUCSCharacter
0x1800176F8: "Domains" ??_C@_1BA@DPEKONGI@?$AAD?$AAo?$AAm?$AAa?$AAi?$AAn?$AAs?$AA?$AA@
0x180017C08: "PolMachineAccountS" ??_C@_1CG@DOLPPKEE@?$AAP?$AAo?$AAl?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AAA?$AAc?$AAc?$AAo?$AAu?$AAn?$AAt?$AAS?$AA?$AA@
0x18000DB24: "unsigned short * __ptr64 __cdecl LsaOfflineUnicodeStringToString(struct _UNICODE_STRING * __ptr64)" ?LsaOfflineUnicodeStringToString@@YAPEAGPEAU_UNICODE_STRING@@@Z
0x18001FE28: WPP_MAIN_CB
0x18000AE20: "public: virtual long __cdecl CSilOfflineKey::Delete(void) __ptr64" ?Delete@CSilOfflineKey@@UEAAJXZ
0x180018830: g_RGWCH_HKCU_bslash_
0x18001D128: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0
0x180005338: "private: long __cdecl LsaOfflinePolicy::GenerateRandomHiveMountKeyPath(unsigned short * __ptr64,unsigned short * __ptr64 * __ptr64) __ptr64" ?GenerateRandomHiveMountKeyPath@LsaOfflinePolicy@@AEAAJPEAGPEAPEAG@Z
0x180014BE3: "__cdecl amsg_exit" _amsg_exit
0x18001B210: S
0x180009BA0: "public: virtual long __cdecl CWin32OfflineKey::DeleteKey(struct _UNICODE_STRING * __ptr64) __ptr64" ?DeleteKey@CWin32OfflineKey@@UEAAJPEAU_UNICODE_STRING@@@Z
0x180011B90: LspSHA256HashUpdate
0x180016210: "private: static struct LsaOfflineDBOptions::DB_OPTION const * const LsaOfflineDBOptions::_SidOptions" ?_SidOptions@LsaOfflineDBOptions@@0QBUDB_OPTION@1@B
0x180012324: LspEncryptData
0x180011660: LspNoEncryptionEncryptData
0x180010AF8: "public: void __cdecl Windows::ErrorHandling::Rtl::CBaseFrame<class Windows::ErrorHandling::Rtl::CSimpleNtStatusCarryingFrame>::SetInvalidParameter_NullPointer(void) __ptr64" ?SetInvalidParameter_NullPointer@?$CBaseFrame@VCSimpleNtStatusCarryingFrame@Rtl@ErrorHandling@Windows@@@Rtl@ErrorHandling@Windows@@QEAAXXZ
0x1800170B8: "LanmanNt" ??_C@_1BC@HCEJBDJB@?$AAL?$AAa?$AAn?$AAm?$AAa?$AAn?$AAN?$AAt?$AA?$AA@
0x18001D074: "__cdecl _IMPORT_DESCRIPTOR_bcrypt" __IMPORT_DESCRIPTOR_bcrypt
0x1800043DC: "private: static long __cdecl LsaOfflinePolicy::GetFullPathToLsaHive(unsigned short * __ptr64,unsigned short * __ptr64 * __ptr64,unsigned short * __ptr64 * __ptr64)" ?GetFullPathToLsaHive@LsaOfflinePolicy@@CAJPEAGPEAPEAG1@Z
0x180007FA4: "long __cdecl LsapGenerateRandomDomainSid(void * __ptr64 * __ptr64)" ?LsapGenerateRandomDomainSid@@YAJPEAPEAX@Z
0x180016E08: WPP_ba7fe5a6b1a13f5f0d12386f1df54686_Traceguids
0x18001161C: VerifyStackAvailable
0x1800184C8: "onecore\base\lstring\lblob.cpp" ??_C@_0BP@OEPJOLFM@onecore?2base?2lstring?2lblob?4cpp?$AA@
0x1800178B8: "PolState" ??_C@_1BC@CJAEKNKO@?$AAP?$AAo?$AAl?$AAS?$AAt?$AAa?$AAt?$AAe?$AA?$AA@
0x180012D70: rijndaelEncrypt256
0x180016898: "__cdecl _imp_NtAdjustPrivilegesToken" __imp_NtAdjustPrivilegesToken
0x180001624: "protected: long __cdecl LsaOfflineRegistryHandle::DbCopyUnicodeAttributeForReturn(struct _UNICODE_STRING * __ptr64,unsigned char * __ptr64 * __ptr64,unsigned __int64 * __ptr64,struct LsaOfflineRegistryHandle::_DB_ATTRIBUTE * __ptr64,unsigned char) __ptr64" ?DbCopyUnicodeAttributeForReturn@LsaOfflineRegistryHandle@@IEAAJPEAU_UNICODE_STRING@@PEAPEAEPEA_KPEAU_DB_ATTRIBUTE@1@E@Z
0x18000DC18: "long __cdecl LsaOfflineAppendString(unsigned short * __ptr64,unsigned short * __ptr64,unsigned short * __ptr64 * __ptr64)" ?LsaOfflineAppendString@@YAJPEAG0PEAPEAG@Z
0x1800166D0: "__cdecl _imp_GetTraceLoggerHandle" __imp_GetTraceLoggerHandle
0x1800177D0: "PolDnTrN" ??_C@_1BC@NEPCOMH@?$AAP?$AAo?$AAl?$AAD?$AAn?$AAT?$AAr?$AAN?$AA?$AA@
0x1800163D0: g_LUNICODE_STRING__bslash_Registry_bslash_User_bslash_
0x1800171F0: "GBG" ??_C@_17PNNGCAIB@?$AAG?$AAB?$AAG?$AA?$AA@
0x180016590: api-ms-win-core-errorhandling-l1-1-0_NULL_THUNK_DATA
0x1800166C0: "__cdecl _imp_GetTraceEnableLevel" __imp_GetTraceEnableLevel
0x1800165D8: api-ms-win-core-kernel32-legacy-l1-1-0_NULL_THUNK_DATA
0x180009920: "public: virtual long __cdecl CWin32OfflineKey::CreateNewKeyEx(struct _UNICODE_STRING * __ptr64,unsigned long,void * __ptr64,struct _UNICODE_STRING * __ptr64,class IOfflineKey * __ptr64 * __ptr64) __ptr64" ?CreateNewKeyEx@CWin32OfflineKey@@UEAAJPEAU_UNICODE_STRING@@KPEAX0PEAPEAVIOfflineKey@@@Z
0x180007114: "private: long __cdecl LsaOfflinePolicy::InstallAccount(void * __ptr64,struct _PRIVILEGE_SET * __ptr64,unsigned long) __ptr64" ?InstallAccount@LsaOfflinePolicy@@AEAAJPEAXPEAU_PRIVILEGE_SET@@K@Z
0x180016928: "__cdecl _imp_NtDeleteValueKey" __imp_NtDeleteValueKey
0x180018188: "Valid flags check failed: Flags" ??_C@_0CA@HINKLGMI@Valid?5flags?5check?5failed?3?5Flags?$AA@
0x1800171C0: "Skew1" ??_C@_1M@CAHDECIJ@?$AAS?$AAk?$AAe?$AAw?$AA1?$AA?$AA@
0x180018C90: T1
0x18001B710: U1
0x1800166A8: "__cdecl _imp_GetSystemInfo" __imp_GetSystemInfo
0x180016628: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x180010A98: RtlIsUnicodeStringValid
0x18001F770: "struct _UNICODE_STRING * LsaOfflineDbNames" ?LsaOfflineDbNames@@3PAU_UNICODE_STRING@@A
0x180010424: RtlInitUnicodeStringFromLUnicodeString
0x180017878: "PolRepAc" ??_C@_1BC@LLAAPDGA@?$AAP?$AAo?$AAl?$AAR?$AAe?$AAp?$AAA?$AAc?$AA?$AA@
0x18000E104: "long __cdecl LsaOfflineCreateSDObject(class LsaOfflineRegistryHandle * __ptr64,class SystemToken * __ptr64,enum _LSAP_DB_OBJECT_TYPE_ID,void * __ptr64 * __ptr64)" ?LsaOfflineCreateSDObject@@YAJPEAVLsaOfflineRegistryHandle@@PEAVSystemToken@@W4_LSAP_DB_OBJECT_TYPE_ID@@PEAPEAX@Z
0x18001FE70: "__cdecl _native_startup_lock" __native_startup_lock
0x180016798: "__cdecl _imp_BCryptHashData" __imp_BCryptHashData
0x180016818: "__cdecl _imp_RtlUpcaseUnicodeChar" __imp_RtlUpcaseUnicodeChar
0x180002190: "protected: long __cdecl LsaOfflineRegistryHandle::VirtualRegistryPathToAbsolutePhysical(unsigned short * __ptr64,unsigned short * __ptr64 * __ptr64) __ptr64" ?VirtualRegistryPathToAbsolutePhysical@LsaOfflineRegistryHandle@@IEAAJPEAGPEAPEAG@Z
0x18000F28C: DllMain
0x180016E24: "" ??_C@_13BLAPAIAM@?$AA?$AI?$AA?$AA@
0x180010940: RtlEqualLUnicodeStringPrefix
0x1800181A8: "Not-null check failed: String" ??_C@_0BO@DPPPJCDC@Not?9null?5check?5failed?3?5String?$AA@
0x180017C88: "TrustedDomainObject" ??_C@_1CI@FOBIGCAP@?$AAT?$AAr?$AAu?$AAs?$AAt?$AAe?$AAd?$AAD?$AAo?$AAm?$AAa?$AAi?$AAn?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AA?$AA@
0x1800165E8: api-ms-win-core-libraryloader-l1-1-0_NULL_THUNK_DATA
0x1800087B0: "long __cdecl LsaOfflineOpenPolicyExternal(unsigned short * __ptr64,unsigned short * __ptr64,unsigned short * __ptr64,unsigned short * __ptr64,void * __ptr64 * __ptr64)" ?LsaOfflineOpenPolicyExternal@@YAJPEAG000PEAPEAX@Z
0x1800167F0: "__cdecl _imp__wcsicmp" __imp__wcsicmp
0x180016708: "__cdecl _imp_IsValidSid" __imp_IsValidSid
0x1800167D0: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x180011E1C: LspFreeBaseEncryptionKeyList
0x180016BD0: "%s\%s" ??_C@_1M@DFKENGJN@?$AA?$CF?$AAs?$AA?2?$AA?$CF?$AAs?$AA?$AA@
0x180011BB0: LspMD5HashFinal
0x180016858: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x180016E28: "Policy" ??_C@_1O@MPKBHDFA@?$AAP?$AAo?$AAl?$AAi?$AAc?$AAy?$AA?$AA@
0x180016EC0: "\system32\config" ??_C@_1CC@MJEBKIFK@?$AA?2?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAc?$AAo?$AAn?$AAf?$AAi?$AAg?$AA?$AA@
0x180017028: "ACCOUNT" ??_C@_1BA@OKDNDGIN@?$AAA?$AAC?$AAC?$AAO?$AAU?$AAN?$AAT?$AA?$AA@
0x18001D1A0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-1-0
0x18000A890: "public: virtual void __cdecl CWin32OfflineKey::AddRef(void) __ptr64" ?AddRef@CWin32OfflineKey@@UEAAXXZ
0x180016740: "__cdecl _imp_LookupPrivilegeNameW" __imp_LookupPrivilegeNameW
0x180016580: "__cdecl _imp_GetLastError" __imp_GetLastError
0x180016758: "__cdecl _imp_ConvertSidToStringSidW" __imp_ConvertSidToStringSidW
0x1800019F0: "protected: long __cdecl LsaOfflineRegistryHandle::OpenRootKey(void) __ptr64" ?OpenRootKey@LsaOfflineRegistryHandle@@IEAAJXZ
0x180011780: LspAES256EncryptedTextLength
0x18000D9F0: "public: __cdecl ImpersonateHelper::ImpersonateHelper(class SystemToken * __ptr64) __ptr64" ??0ImpersonateHelper@@QEAA@PEAVSystemToken@@@Z
0x18001F120: "__cdecl _native_dllmain_reason" __native_dllmain_reason
0x180014DE8: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x180016890: "__cdecl _imp_RtlSetOwnerSecurityDescriptor" __imp_RtlSetOwnerSecurityDescriptor
0x180011D40: LspSHA256HashFinal
0x180016878: "__cdecl _imp_RtlAddAccessAllowedAce" __imp_RtlAddAccessAllowedAce
0x1800011C4: "long __cdecl RtlStringCchPrintfW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64,...)" ?RtlStringCchPrintfW@@YAJPEAG_KPEBGZZ
0x1800176B8: "Name" ??_C@_19DINFBLAK@?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x180018340: "__rv.UcsCharacter != (0xffffffff" ??_C@_0CC@ILNCJCBD@__rv?4UcsCharacter?5?$CB?$DN?5?$CI0xffffffff@
0x180016618: "__cdecl _imp_SetThreadStackGuarantee" __imp_SetThreadStackGuarantee
0x18001A210: T2
0x180016790: "__cdecl _imp_BCryptCloseAlgorithmProvider" __imp_BCryptCloseAlgorithmProvider
0x18001A610: U2
0x180011AF0: LspMD5HashInit
0x180016E18: "NULL" ??_C@_19CIJIHAKK@?$AAN?$AAU?$AAL?$AAL?$AA?$AA@
0x180012560: rijndaelKeySched
0x180016610: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x1800171A8: "SkewMatrix" ??_C@_1BG@OENMMBEE@?$AAS?$AAk?$AAe?$AAw?$AAM?$AAa?$AAt?$AAr?$AAi?$AAx?$AA?$AA@
0x18001D0D8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-lsalookup-l2-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-lsalookup-l2-1-0
0x1800183D8: "Not-null check failed: PathOut" ??_C@_0BP@NEMHNDIC@Not?9null?5check?5failed?3?5PathOut?$AA@
0x18001D09C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-obsolete-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-obsolete-l1-1-0
0x180016820: "__cdecl _imp_RtlReAllocateHeap" __imp_RtlReAllocateHeap
0x180007944: "private: long __cdecl LsaOfflinePolicy::QueryTargetProductInfo(enum _NT_PRODUCT_TYPE * __ptr64,enum _DOMAIN_SERVER_ROLE * __ptr64,int * __ptr64) __ptr64" ?QueryTargetProductInfo@LsaOfflinePolicy@@AEAAJPEAW4_NT_PRODUCT_TYPE@@PEAW4_DOMAIN_SERVER_ROLE@@PEAH@Z
0x18001015C: RtlReportErrorOrigination
0x180006474: "private: long __cdecl LsaOfflinePolicy::QueryNewDBCreationOptions(struct LsaOfflinePolicy::LSADB_CREATE_PARAMS * __ptr64) __ptr64" ?QueryNewDBCreationOptions@LsaOfflinePolicy@@AEAAJPEAULSADB_CREATE_PARAMS@1@@Z
0x180014CA0: "__cdecl ValidateImageBase" _ValidateImageBase
0x1800063C0: "private: __cdecl LsaOfflinePolicy::LsaOfflinePolicy(class SystemToken * __ptr64,struct Windows::Rtl::IRtlSystemIsolationLayer * __ptr64) __ptr64" ??0LsaOfflinePolicy@@AEAA@PEAVSystemToken@@PEAUIRtlSystemIsolationLayer@Rtl@Windows@@@Z
0x180003B10: WPP_SF_ZD
0x180002F80: "public: long __cdecl LsaOfflineAccount::RemoveAccountRights(unsigned char,struct _UNICODE_STRING * __ptr64,unsigned long) __ptr64" ?RemoveAccountRights@LsaOfflineAccount@@QEAAJEPEAU_UNICODE_STRING@@K@Z
0x180001010: "void * __ptr64 __cdecl LsaOfflineAlloc(unsigned __int64)" ?LsaOfflineAlloc@@YAPEAX_K@Z
0x1800032B0: "public: long __cdecl LsaOfflineAccount::GetSystemAccess(unsigned long * __ptr64) __ptr64" ?GetSystemAccess@LsaOfflineAccount@@QEAAJPEAK@Z
0x180017CF8: "AllObject" ??_C@_1BE@CCFDNBPO@?$AAA?$AAl?$AAl?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AA?$AA@
0x18000FDE4: "private: long __cdecl LsaOfflineDBOptions::QueryUlongOptions(class IOfflineKey * __ptr64) __ptr64" ?QueryUlongOptions@LsaOfflineDBOptions@@AEAAJPEAVIOfflineKey@@@Z
0x180017718: "OldVal" ??_C@_1O@ONCMCOLJ@?$AAO?$AAl?$AAd?$AAV?$AAa?$AAl?$AA?$AA@
0x180008C80: "long __cdecl LsaOfflineEnumeratePrivilegesOfAccount(void * __ptr64,struct _PRIVILEGE_SET * __ptr64 * __ptr64)" ?LsaOfflineEnumeratePrivilegesOfAccount@@YAJPEAXPEAPEAU_PRIVILEGE_SET@@@Z
0x180016880: "__cdecl _imp_RtlGetAce" __imp_RtlGetAce
0x180016978: "__cdecl _imp_RtlFreeHeap" __imp_RtlFreeHeap
0x180016700: "__cdecl _imp_DuplicateTokenEx" __imp_DuplicateTokenEx
0x180006830: "private: long __cdecl LsaOfflinePolicy::CreateNewDatabase(void) __ptr64" ?CreateNewDatabase@LsaOfflinePolicy@@AEAAJXZ
0x180009120: "long __cdecl LsaOfflineRemoveAccountRights(void * __ptr64,void * __ptr64,unsigned char,struct _UNICODE_STRING * __ptr64,unsigned long)" ?LsaOfflineRemoveAccountRights@@YAJPEAX0EPEAU_UNICODE_STRING@@K@Z
0x18001FBB8: "void * __ptr64 __ptr64 LsaOfflineAllAppPackagesSid" ?LsaOfflineAllAppPackagesSid@@3PEAXEA
0x180002ECC: "public: long __cdecl LsaOfflineAccount::AddAccountRights(struct _UNICODE_STRING * __ptr64,unsigned long) __ptr64" ?AddAccountRights@LsaOfflineAccount@@QEAAJPEAU_UNICODE_STRING@@K@Z
0x1800181C8: "::RtlIsLUnicodeStringValid(Strin" ??_C@_0CD@HAGKBJM@?3?3RtlIsLUnicodeStringValid?$CIStrin@
0x180016730: api-ms-win-security-cryptoapi-l1-1-0_NULL_THUNK_DATA
0x18000D828: "public: long __cdecl ImpersonateHelper::Impersonate(void) __ptr64" ?Impersonate@ImpersonateHelper@@QEAAJXZ
0x180016EE8: "Policy\%wZ\%s" ??_C@_1BM@FANPFIL@?$AAP?$AAo?$AAl?$AAi?$AAc?$AAy?$AA?2?$AA?$CF?$AAw?$AAZ?$AA?2?$AA?$CF?$AAs?$AA?$AA@
0x180018320: "RtlReallocateLUnicodeString" ??_C@_0BM@MGBMJPAL@RtlReallocateLUnicodeString?$AA@
0x180018828: g_RGWCH__empty_
0x1800169A8: "__cdecl _imp_RtlLengthSecurityDescriptor" __imp_RtlLengthSecurityDescriptor
0x180017E20: "ControlSet001\Control\Lsa\Offlin" ??_C@_1FO@NKJICMCN@?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA0?$AA0?$AA1?$AA?2?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AA?2?$AAL?$AAs?$AAa?$AA?2?$AAO?$AAf?$AAf?$AAl?$AAi?$AAn@
0x1800037C4: WPP_SF_
0x1800085C0: "long __cdecl LsaOfflineOpenPolicy(unsigned short * __ptr64,void * __ptr64 * __ptr64)" ?LsaOfflineOpenPolicy@@YAJPEAGPEAPEAX@Z
0x180016358: g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_System_bslash_CurrentControlSet_bslash_Hardware_space_Profiles_bslash_Current_bslash_
0x180016F30: "OFFLINELSA" ??_C@_1BG@FENKJDJE@?$AAO?$AAF?$AAF?$AAL?$AAI?$AAN?$AAE?$AAL?$AAS?$AAA?$AA?$AA@
0x18001FD80: "void * __ptr64 __ptr64 LsaOfflineAllRestrictedAppPackagesSid" ?LsaOfflineAllRestrictedAppPackagesSid@@3PEAXEA
0x180017890: "PolRevision" ??_C@_1BI@OCMFNFFB@?$AAP?$AAo?$AAl?$AAR?$AAe?$AAv?$AAi?$AAs?$AAi?$AAo?$AAn?$AA?$AA@
0x180017678: "%s%s" ??_C@_19LJDFFCJJ@?$AA?$CF?$AAs?$AA?$CF?$AAs?$AA?$AA@
0x180016670: "__cdecl _imp_AcquireSRWLockExclusive" __imp_AcquireSRWLockExclusive
0x180016920: "__cdecl _imp_RtlGetGroupSecurityDescriptor" __imp_RtlGetGroupSecurityDescriptor
0x180016648: "__cdecl _imp_OpenProcess" __imp_OpenProcess
0x180016870: "__cdecl _imp_RtlNewSecurityObject" __imp_RtlNewSecurityObject
0x180017860: "PolRepSc" ??_C@_1BC@PFBOFAPA@?$AAP?$AAo?$AAl?$AAR?$AAe?$AAp?$AAS?$AAc?$AA?$AA@
0x180017090: "ProductType" ??_C@_1BI@JPCMFPH@?$AAP?$AAr?$AAo?$AAd?$AAu?$AAc?$AAt?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x180016FE8: "Workgroup" ??_C@_1BE@NJKKNJIP@?$AAW?$AAo?$AAr?$AAk?$AAg?$AAr?$AAo?$AAu?$AAp?$AA?$AA@
0x180014740: "__cdecl DllMainCRTStartup" _DllMainCRTStartup
0x180017758: "PolAdtLg" ??_C@_1BC@JIPCCNCB@?$AAP?$AAo?$AAl?$AAA?$AAd?$AAt?$AAL?$AAg?$AA?$AA@
0x1800167C8: "__cdecl _imp__initterm" __imp__initterm
0x180009B80: "public: virtual long __cdecl CWin32OfflineKey::SetSecurityDescriptor(unsigned long,void * __ptr64) __ptr64" ?SetSecurityDescriptor@CWin32OfflineKey@@UEAAJKPEAX@Z
0x1800185C8: "Not-null check failed: Compariso" ??_C@_0CI@EEEPPPDD@Not?9null?5check?5failed?3?5Compariso@
0x1800169A0: "__cdecl _imp_RtlInitializeRXact" __imp_RtlInitializeRXact
0x180019090: T3
0x180019490: U3
0x1800127C0: rijndaelKeyEncToDec
0x180004F30: "private: long __cdecl LsaOfflinePolicy::BuildAccountSubkeyPath(void * __ptr64,unsigned short * __ptr64 * __ptr64) __ptr64" ?BuildAccountSubkeyPath@LsaOfflinePolicy@@AEAAJPEAXPEAPEAG@Z
0x180016BF0: "__cdecl GUID_05db2668_9ac9_4413_8817_e359264d68dd" _GUID_05db2668_9ac9_4413_8817_e359264d68dd
0x180017B28: "XRefDnsRoot" ??_C@_1BI@DAFMCFMO@?$AAX?$AAR?$AAe?$AAf?$AAD?$AAn?$AAs?$AAR?$AAo?$AAo?$AAt?$AA?$AA@
0x1800083CC: WPP_SF_q_sid_d
0x1800169B0: "__cdecl _imp_RtlEqualUnicodeString" __imp_RtlEqualUnicodeString
0x1800179F8: "TrDmCrSid" ??_C@_1BE@JDHKMEJK@?$AAT?$AAr?$AAD?$AAm?$AAC?$AAr?$AAS?$AAi?$AAd?$AA?$AA@
0x180018300: "Not-null check failed: Source" ??_C@_0BO@FJDIJNDF@Not?9null?5check?5failed?3?5Source?$AA@
0x18000AEE0: "public: virtual long __cdecl CSilOfflineKey::QueryValue(struct _UNICODE_STRING * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64,void * __ptr64) __ptr64" ?QueryValue@CSilOfflineKey@@UEAAJPEAU_UNICODE_STRING@@PEAK1PEAX@Z
0x1800093D0: "long __cdecl LsaOfflineClose(void * __ptr64)" ?LsaOfflineClose@@YAJPEAX@Z
0x180017A40: "KerMaxT" ??_C@_1BA@HDPFKMKO@?$AAK?$AAe?$AAr?$AAM?$AAa?$AAx?$AAT?$AA?$AA@
0x18000C6CC: "private: long __cdecl LsaOfflinePolicy::SaveSysKey(unsigned long,void * __ptr64) __ptr64" ?SaveSysKey@LsaOfflinePolicy@@AEAAJKPEAX@Z
0x180016BC0: WPP_2be0fc12523a3f5b5fba16d6394a068c_Traceguids
0x1800084B8: WPP_SF_q_sid_dd
0x180017348: WPP_af74ee96a1883698074149ee355d8d07_Traceguids
0x18001FE60: "__cdecl _onexitend" __onexitend
0x180011134: RtlCompareEncodedLBlobs
0x180016A00: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x180017B08: "PolOldSyskey" ??_C@_1BK@MBOKHAFD@?$AAP?$AAo?$AAl?$AAO?$AAl?$AAd?$AAS?$AAy?$AAs?$AAk?$AAe?$AAy?$AA?$AA@
0x180018070: "BUCL::Rtl::ConvertInteger(Source" ??_C@_0DC@KOJNJLDJ@BUCL?3?3Rtl?3?3ConvertInteger?$CISource@
0x180001CDC: "protected: long __cdecl LsaOfflineRegistryHandle::CreateRootKey(void) __ptr64" ?CreateRootKey@LsaOfflineRegistryHandle@@IEAAJXZ
0x180017130: "NULL" ??_C@_04HIBGFPH@NULL?$AA@
0x1800167A0: "__cdecl _imp_BCryptEncrypt" __imp_BCryptEncrypt
0x180016620: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x1800131E0: rijndaelEncrypt128
0x18001110C: RtlIsLBlobValid
0x180008D30: "long __cdecl LsaOfflineAddPrivilegesToAccount(void * __ptr64,struct _PRIVILEGE_SET * __ptr64)" ?LsaOfflineAddPrivilegesToAccount@@YAJPEAXPEAU_PRIVILEGE_SET@@@Z
0x18000287C: "public: long __cdecl LsaOfflineAccount::RemovePrivilegesFromAccount(unsigned char,struct _PRIVILEGE_SET * __ptr64) __ptr64" ?RemovePrivilegesFromAccount@LsaOfflineAccount@@QEAAJEPEAU_PRIVILEGE_SET@@@Z
0x1800166F8: "__cdecl _imp_GetTokenInformation" __imp_GetTokenInformation
0x180018698: g_RGWCH__bslash_Registry_bslash_User_bslash_
0x18001FE90: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUhvzfwrgUzfwrgUzwgohzkUlyquivUznwGEUzwgkxsOlyq@adtlsap" __@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUhvzfwrgUzfwrgUzwgohzkUlyquivUznwGEUzwgkxsOlyq@adtlsap
0x180017FC8: "RtlDuplicateUnicodeStringToLUnic" ??_C@_0CK@LLEFCFIL@RtlDuplicateUnicodeStringToLUnic@
0x180016768: "__cdecl _imp_BCryptDestroyHash" __imp_BCryptDestroyHash
0x18000D764: "public: void __cdecl SystemToken::ReleaseReference(void) __ptr64" ?ReleaseReference@SystemToken@@QEAAXXZ
0x180018718: g_RGWCH_HKEY_under_LOCAL_under_MACHINE_bslash_
0x18001FD78: "void * __ptr64 __ptr64 LsaOfflineDefaultSystemManagedAccountGroup" ?LsaOfflineDefaultSystemManagedAccountGroup@@3PEAXEA
0x180017120: WPP_384be9a1d75f3917c19d47082253b60a_Traceguids
0x1800166B0: api-ms-win-core-sysinfo-l1-1-0_NULL_THUNK_DATA
0x180016A20: "__cdecl _xi_a" __xi_a
0x180016650: api-ms-win-core-processthreads-l1-1-1_NULL_THUNK_DATA
0x1800166A0: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x1800098A0: "public: virtual long __cdecl CWin32OfflineKey::CreateNewKey(struct _UNICODE_STRING * __ptr64,unsigned long,class IOfflineKey * __ptr64 * __ptr64) __ptr64" ?CreateNewKey@CWin32OfflineKey@@UEAAJPEAU_UNICODE_STRING@@KPEAPEAVIOfflineKey@@@Z
0x18000CBF8: "private: static long __cdecl SystemToken::GetNewSystemToken(class SystemToken * __ptr64 * __ptr64)" ?GetNewSystemToken@SystemToken@@CAJPEAPEAV1@@Z
0x180016C08: "SeInteractiveLogonRight" ??_C@_1DA@HODMOLDJ@?$AAS?$AAe?$AAI?$AAn?$AAt?$AAe?$AAr?$AAa?$AAc?$AAt?$AAi?$AAv?$AAe?$AAL?$AAo?$AAg?$AAo?$AAn?$AAR?$AAi?$AAg?$AAh?$AAt?$AA?$AA@
0x180017BA8: "CompletedPrivilegeUpdates" ??_C@_1DE@BGHIBLMD@?$AAC?$AAo?$AAm?$AAp?$AAl?$AAe?$AAt?$AAe?$AAd?$AAP?$AAr?$AAi?$AAv?$AAi?$AAl?$AAe?$AAg?$AAe?$AAU?$AAp?$AAd?$AAa?$AAt?$AAe?$AAs?$AA?$AA@
0x18000A890: "public: virtual void __cdecl CSilOfflineKey::AddRef(void) __ptr64" ?AddRef@CSilOfflineKey@@UEAAXXZ
0x180017ED8: "onecore\base\lstring\lunicode_st" ??_C@_0CJ@OHHDMDHM@onecore?2base?2lstring?2lunicode_st@
0x180011EBC: LspAddNewEncryptionKey
0x180016710: api-ms-win-security-base-l1-1-0_NULL_THUNK_DATA
0x18000E870: "long __cdecl LsaOfflinebInitializeUnicodeNames(void)" ?LsaOfflinebInitializeUnicodeNames@@YAJXZ
0x1800168A8: "__cdecl _imp_NtOpenThreadToken" __imp_NtOpenThreadToken
0x18000B6E0: "long __cdecl LsapInitializeSyskeyEncryptionContext(unsigned long,void * __ptr64,void * __ptr64 * __ptr64)" ?LsapInitializeSyskeyEncryptionContext@@YAJKPEAXPEAPEAX@Z
0x1800171A0: "JD" ??_C@_15PEIILIDM@?$AAJ?$AAD?$AA?$AA@
0x1800162F8: g_LUNICODE_STRING_HKCU_bslash_
0x180017D40: "DummyLastObject" ??_C@_1CA@HKCGBBDH@?$AAD?$AAu?$AAm?$AAm?$AAy?$AAL?$AAa?$AAs?$AAt?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AA?$AA@
0x18000C9B0: WPP_SF_DD
0x1800081BC: WPP_SF_dZ
0x18000DCDC: "long __cdecl LsaOfflineSetPrivileges(void * __ptr64,unsigned long,struct PRIV_ENABLE * __ptr64)" ?LsaOfflineSetPrivileges@@YAJPEAXKPEAUPRIV_ENABLE@@@Z
0x180003840: WPP_SF_DS
0x180018538: "Temp = (*RtlReallocateStringRout" ??_C@_0DK@KMDDBAIM@Temp?5?$DN?5?$CI?$CKRtlReallocateStringRout@
0x180017928: "TrDmAcN" ??_C@_1BA@DMNNEGH@?$AAT?$AAr?$AAD?$AAm?$AAA?$AAc?$AAN?$AA?$AA@
0x18001F0B0: WPP_GLOBAL_Control
0x1800176E0: "DefQuota" ??_C@_1BC@LDJKDGMD@?$AAD?$AAe?$AAf?$AAQ?$AAu?$AAo?$AAt?$AAa?$AA?$AA@
0x180017BE0: "PolMachineAccountR" ??_C@_1CG@IGADJNCB@?$AAP?$AAo?$AAl?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AAA?$AAc?$AAc?$AAo?$AAu?$AAn?$AAt?$AAR?$AA?$AA@
0x180017218: "ControlSet001\Control\Lsa\" ??_C@_1DG@FBGEOMGJ@?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA0?$AA0?$AA1?$AA?2?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AA?2?$AAL?$AAs?$AAa?$AA?2?$AA?$AA@
0x180016C00: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x18001D150: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0
0x18001D164: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-1" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-1
0x180017A90: "PseudoSystemCritical" ??_C@_1CK@MMKCGDLH@?$AAP?$AAs?$AAe?$AAu?$AAd?$AAo?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAC?$AAr?$AAi?$AAt?$AAi?$AAc?$AAa?$AAl?$AA?$AA@
0x180016608: api-ms-win-core-memory-l1-1-0_NULL_THUNK_DATA
0x180016958: "__cdecl _imp_NtQueryKey" __imp_NtQueryKey
0x1800037E8: WPP_SF_D
0x180006A54: "private: long __cdecl LsaOfflinePolicy::InstallPolicyObjectPass1(struct LsaOfflinePolicy::LSADB_CREATE_PARAMS * __ptr64) __ptr64" ?InstallPolicyObjectPass1@LsaOfflinePolicy@@AEAAJPEAULSADB_CREATE_PARAMS@1@@Z
0x18001FE88: "__cdecl pRawDllMain" _pRawDllMain
0x1800071B8: "private: long __cdecl LsaOfflinePolicy::InstallAccountObjects(enum _NT_PRODUCT_TYPE) __ptr64" ?InstallAccountObjects@LsaOfflinePolicy@@AEAAJW4_NT_PRODUCT_TYPE@@@Z
0x180016960: "__cdecl _imp_RtlFreeSid" __imp_RtlFreeSid
0x180018120: "cch <= (((((SIZE_T)~((SIZE_T)0))" ??_C@_0GD@IELHNMHL@cch?5?$DM?$DN?5?$CI?$CI?$CI?$CI?$CISIZE_T?$CJ?$HO?$CI?$CISIZE_T?$CJ0?$CJ?$CJ@
0x180012434: LspSerializeEncryptionContext
0x1800095E0: "long __cdecl LsaOfflineFreeMemory(void * __ptr64)" ?LsaOfflineFreeMemory@@YAJPEAX@Z
0x180005E3C: "private: long __cdecl LsaOfflinePolicy::GetSystemHiveRootKey(class IOfflineKey * __ptr64 * __ptr64) __ptr64" ?GetSystemHiveRootKey@LsaOfflinePolicy@@AEAAJPEAPEAVIOfflineKey@@@Z
0x18001FD88: "void * __ptr64 __ptr64 LsaOfflineAliasDeviceOwnersSid" ?LsaOfflineAliasDeviceOwnersSid@@3PEAXEA
0x1800168D8: "__cdecl _imp_RtlCompareUnicodeString" __imp_RtlCompareUnicodeString
0x1800143F0: aeskey
0x180017728: "CupdTime" ??_C@_1BC@GLCCJBJK@?$AAC?$AAu?$AAp?$AAd?$AAT?$AAi?$AAm?$AAe?$AA?$AA@
0x180016908: "__cdecl _imp_NtQueryValueKey" __imp_NtQueryValueKey
0x18000504C: "private: long __cdecl LsaOfflinePolicy::AssignInitialHiveProtectionIfNecessary(void) __ptr64" ?AssignInitialHiveProtectionIfNecessary@LsaOfflinePolicy@@AEAAJXZ
0x1800149E0: "__cdecl _security_check_cookie" __security_check_cookie
0x1800161F0: "private: static struct LsaOfflineDBOptions::DB_OPTION_ULONG const * const LsaOfflineDBOptions::_UlongOptions" ?_UlongOptions@LsaOfflineDBOptions@@0QBUDB_OPTION_ULONG@1@B
0x18000A940: "public: virtual long __cdecl CSilOfflineKey::CreateNewKeyEx(struct _UNICODE_STRING * __ptr64,unsigned long,void * __ptr64,struct _UNICODE_STRING * __ptr64,class IOfflineKey * __ptr64 * __ptr64) __ptr64" ?CreateNewKeyEx@CSilOfflineKey@@UEAAJPEAU_UNICODE_STRING@@KPEAX0PEAPEAVIOfflineKey@@@Z
0x180016A18: "__cdecl _xc_z" __xc_z
0x180016640: api-ms-win-core-processthreads-l1-1-0_NULL_THUNK_DATA
0x1800027C0: "public: long __cdecl LsaOfflineAccount::AddPrivilegesToAccount(struct _PRIVILEGE_SET * __ptr64) __ptr64" ?AddPrivilegesToAccount@LsaOfflineAccount@@QEAAJPEAU_PRIVILEGE_SET@@@Z
0x180011650: LspNoEncryptionEncryptedTextLength
0x18000BA98: "private: long __cdecl LsaOfflinePolicy::ObfuscateKey(class IOfflineKey * __ptr64,struct _WXHASH * __ptr64) __ptr64" ?ObfuscateKey@LsaOfflinePolicy@@AEAAJPEAVIOfflineKey@@PEAU_WXHASH@@@Z
0x180011E6C: LspInitializeEncryptionContext
0x1800168C8: "__cdecl _imp_NtDuplicateToken" __imp_NtDuplicateToken
0x180010BE8: "long __cdecl RtlConvertWin32RegistryPathToNtRegistryPathUser(unsigned long,struct _LUNICODE_STRING const * __ptr64,struct _LUNICODE_STRING const * __ptr64,struct _LUNICODE_STRING * __ptr64)" ?RtlConvertWin32RegistryPathToNtRegistryPathUser@@YAJKPEBU_LUNICODE_STRING@@0PEAU1@@Z
0x180016900: "__cdecl _imp_RtlFreeAnsiString" __imp_RtlFreeAnsiString
0x18000F238: WppCleanupUm
0x180005490: "private: long __cdecl LsaOfflinePolicy::MountLsaHive(unsigned short * __ptr64) __ptr64" ?MountLsaHive@LsaOfflinePolicy@@AEAAJPEAG@Z
0x1800180F0: "RtlInitLUnicodeStringFromNullTer" ??_C@_0CO@IGKAHGPG@RtlInitLUnicodeStringFromNullTer@
0x180008280: WPP_SF_qDD
0x180016698: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x1800012AC: WPP_SF_qqd
0x1800183F8: "HKEY_CURRENT_USER" ??_C@_1CE@HLHNCBPM@?$AAH?$AAK?$AAE?$AAY?$AA_?$AAC?$AAU?$AAR?$AAR?$AAE?$AAN?$AAT?$AA_?$AAU?$AAS?$AAE?$AAR?$AA?$AA@
0x1800165C0: "__cdecl _imp_LocalAlloc" __imp_LocalAlloc
0x180016748: api-ms-win-security-lsalookup-l2-1-0_NULL_THUNK_DATA
0x180017D10: "NewTrustedDomainObject" ??_C@_1CO@OKLBCHBG@?$AAN?$AAe?$AAw?$AAT?$AAr?$AAu?$AAs?$AAt?$AAe?$AAd?$AAD?$AAo?$AAm?$AAa?$AAi?$AAn?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AA?$AA@
0x180014EC0: "__cdecl _chkstk" __chkstk
0x180017978: "TrDmTrLA" ??_C@_1BC@LEPEANCK@?$AAT?$AAr?$AAD?$AAm?$AAT?$AAr?$AAL?$AAA?$AA?$AA@
0x18001FE5C: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUohgirmtUfnlwvUlyquivUznwGEUhgwrmxOlyq@lstring" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUohgirmtUfnlwvUlyquivUznwGEUhgwrmxOlyq@lstring
0x180016830: "__cdecl _imp_RtlFormatCurrentUserKeyPath" __imp_RtlFormatCurrentUserKeyPath
0x1800178A8: "PolMod" ??_C@_1O@GHCMFAMF@?$AAP?$AAo?$AAl?$AAM?$AAo?$AAd?$AA?$AA@
0x1800168E0: "__cdecl _imp_RtlInitAnsiString" __imp_RtlInitAnsiString
0x180017A20: "KerOpts" ??_C@_1BA@INDGBKNK@?$AAK?$AAe?$AAr?$AAO?$AAp?$AAt?$AAs?$AA?$AA@
0x18000D5B8: "private: static long __cdecl SystemToken::GetDupeOfCurrentToken(void * __ptr64 * __ptr64)" ?GetDupeOfCurrentToken@SystemToken@@CAJPEAPEAX@Z
0x18001FBA8: "void * __ptr64 __ptr64 LsaOfflineLocalSystemSid" ?LsaOfflineLocalSystemSid@@3PEAXEA
0x1800117A0: LspAES256EncryptData
0x1800178D0: "ActSysAc" ??_C@_1BC@KAIAMCOB@?$AAA?$AAc?$AAt?$AAS?$AAy?$AAs?$AAA?$AAc?$AA?$AA@
0x180018578: "Temp = (PUCHAR)((*RtlAllocateStr" ??_C@_0DE@HEDPHPEG@Temp?5?$DN?5?$CIPUCHAR?$CJ?$CI?$CI?$CKRtlAllocateStr@
0x180017148: WPP_51591685d45036110881d5d8c826533c_Traceguids
0x180010F9C: RtlReallocateLBlob
0x1800010B4: "public: __cdecl LsaOfflineHandleBase::LsaOfflineHandleBase(void) __ptr64" ??0LsaOfflineHandleBase@@QEAA@XZ
0x180009330: "long __cdecl LsaOfflineSetSystemAccessAccount(void * __ptr64,unsigned long)" ?LsaOfflineSetSystemAccessAccount@@YAJPEAXK@Z
0x180011950: LspAES256DecryptData
0x18001F090: LspNoEncryptionAlgorithmData
0x180016660: api-ms-win-core-profile-l1-1-0_NULL_THUNK_DATA
0x1800033E8: "private: long __cdecl LsaOfflineAccount::AddPrivileges(struct _PRIVILEGE_SET * __ptr64 * __ptr64,unsigned long * __ptr64,struct _PRIVILEGE_SET * __ptr64,unsigned long,unsigned char * __ptr64) __ptr64" ?AddPrivileges@LsaOfflineAccount@@AEAAJPEAPEAU_PRIVILEGE_SET@@PEAKPEAU2@KPEAE@Z
0x180016A38: "__cdecl _guard_fids_table" __guard_fids_table
0x180016948: "__cdecl _imp_RtlpNtEnumerateSubKey" __imp_RtlpNtEnumerateSubKey
0x180018780: g_RGWCH__bslash_Registry_bslash_Machine_bslash_System_bslash_CurrentControlSet_bslash_Hardware_space_Profiles_bslash_Current_bslash_
0x180016810: msvcrt_NULL_THUNK_DATA
0x180016450: "__cdecl load_config_used" _load_config_used
0x180017FA0: "Not-null check failed: Destinati" ??_C@_0CD@CBCHKJPP@Not?9null?5check?5failed?3?5Destinati@
0x1800059D8: "private: long __cdecl LsaOfflinePolicy::UnloadLsaHive(void) __ptr64" ?UnloadLsaHive@LsaOfflinePolicy@@AEAAJXZ
0x1800169C0: "__cdecl _imp_RtlCopySid" __imp_RtlCopySid
0x180001040: "void __cdecl LsaOfflineFree(void * __ptr64)" ?LsaOfflineFree@@YAXPEAX@Z
0x18001D0EC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-sddl-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-sddl-l1-1-0
0x180010980: RtlEqualLUnicodeStrings
0x18000E4C8: "long __cdecl LsaOfflineCreateDatabaseProtection(void * __ptr64 * __ptr64)" ?LsaOfflineCreateDatabaseProtection@@YAJPEAPEAX@Z
0x18000A090: "public: virtual long __cdecl CWin32OfflineKey::QueryValue(struct _UNICODE_STRING * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64,void * __ptr64) __ptr64" ?QueryValue@CWin32OfflineKey@@UEAAJPEAU_UNICODE_STRING@@PEAK1PEAX@Z
0x1800172B0: "SeDebugPrivilege" ??_C@_1CC@DMDJMJLM@?$AAS?$AAe?$AAD?$AAe?$AAb?$AAu?$AAg?$AAP?$AAr?$AAi?$AAv?$AAi?$AAl?$AAe?$AAg?$AAe?$AA?$AA@
0x180008AC0: "long __cdecl LsaOfflineCreateAccount(void * __ptr64,void * __ptr64,void * __ptr64 * __ptr64)" ?LsaOfflineCreateAccount@@YAJPEAX0PEAPEAX@Z
0x180004D6C: "public: long __cdecl LsaOfflinePolicy::CreateAccount(void * __ptr64,class LsaOfflineAccount * __ptr64 * __ptr64) __ptr64" ?CreateAccount@LsaOfflinePolicy@@QEAAJPEAXPEAPEAVLsaOfflineAccount@@@Z
0x18001F700: "private: static unsigned long * LsaOfflineRegistryHandle::_ulObjectCount" ?_ulObjectCount@LsaOfflineRegistryHandle@@0PAKA
0x180003390: "public: virtual long __cdecl LsaOfflineAccount::Delete(void) __ptr64" ?Delete@LsaOfflineAccount@@UEAAJXZ
0x1800163A0: g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_SOFTWARE_bslash_Classes_bslash_
0x180018420: "HKCU" ??_C@_19JAPAIJDE@?$AAH?$AAK?$AAC?$AAU?$AA?$AA@
0x180018500: "Not-null check failed: Blob" ??_C@_0BM@NOGHIDPG@Not?9null?5check?5failed?3?5Blob?$AA@
0x18000B180: "public: virtual long __cdecl CSilOfflineKey::DeleteValue(struct _UNICODE_STRING * __ptr64) __ptr64" ?DeleteValue@CSilOfflineKey@@UEAAJPEAU_UNICODE_STRING@@@Z
0x180016930: "__cdecl _imp_NtSetSecurityObject" __imp_NtSetSecurityObject
0x1800167E0: "__cdecl _imp__amsg_exit" __imp__amsg_exit
0x180010610: RtlConcatenateLUnicodeStrings
0x18000C798: "private: long __cdecl LsaOfflinePolicy::SaveBootOption(enum _WX_AUTH_TYPE) __ptr64" ?SaveBootOption@LsaOfflinePolicy@@AEAAJW4_WX_AUTH_TYPE@@@Z
0x180009DA0: "public: virtual long __cdecl CWin32OfflineKey::DeleteRecursively(void) __ptr64" ?DeleteRecursively@CWin32OfflineKey@@UEAAJXZ
0x18000E014: "long __cdecl LsaOfflineGenerateRandomNumber(void * __ptr64,unsigned long)" ?LsaOfflineGenerateRandomNumber@@YAJPEAXK@Z
0x1800161E0: "private: static struct LsaOfflineDBOptions::DB_OPTION const * const LsaOfflineDBOptions::_BoolOptions" ?_BoolOptions@LsaOfflineDBOptions@@0QBUDB_OPTION@1@B
0x180016CE8: "SeDenyNetworkLogonRight" ??_C@_1DA@JLBFLOOG@?$AAS?$AAe?$AAD?$AAe?$AAn?$AAy?$AAN?$AAe?$AAt?$AAw?$AAo?$AAr?$AAk?$AAL?$AAo?$AAg?$AAo?$AAn?$AAR?$AAi?$AAg?$AAh?$AAt?$AA?$AA@
0x180017948: "TrDmPxOf" ??_C@_1BC@JHKOFELB@?$AAT?$AAr?$AAD?$AAm?$AAP?$AAx?$AAO?$AAf?$AA?$AA@
0x180016780: "__cdecl _imp_BCryptOpenAlgorithmProvider" __imp_BCryptOpenAlgorithmProvider
0x1800165E0: "__cdecl _imp_DisableThreadLibraryCalls" __imp_DisableThreadLibraryCalls
0x1800169C8: "__cdecl _imp_NtClose" __imp_NtClose
0x18000D950: "public: void __cdecl ImpersonateHelper::Unimpersonate(void) __ptr64" ?Unimpersonate@ImpersonateHelper@@QEAAXXZ
0x180018840: g_RGWCH_HKEY_under_CURRENT_under_CONFIG_bslash_
0x180009600: "long __cdecl LsaOfflineSyskeyRequest(void * __ptr64,unsigned long,unsigned char * __ptr64 const)" ?LsaOfflineSyskeyRequest@@YAJPEAXKQEAE@Z
0x180016850: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x180011D94: LspFreeEncryptionKey
0x180016048: "const CWin32OfflineKey::`vftable'" ??_7CWin32OfflineKey@@6B@
0x180016778: "__cdecl _imp_BCryptGenerateSymmetricKey" __imp_BCryptGenerateSymmetricKey
0x1800169E8: "__cdecl _imp_RtlValidSid" __imp_RtlValidSid
0x180016658: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x180016940: "__cdecl _imp_RtlGetSaclSecurityDescriptor" __imp_RtlGetSaclSecurityDescriptor
0x180012098: LspCreateEncryptionKey
0x1800168A0: "__cdecl _imp_RtlEqualSid" __imp_RtlEqualSid
0x180016910: "__cdecl _imp_RtlGetDaclSecurityDescriptor" __imp_RtlGetDaclSecurityDescriptor
0x180016F08: "\REGISTRY\MACHINE\" ??_C@_1CG@GOLKLNMC@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AA?$AA@
0x1800169F0: "__cdecl _imp_RtlAnsiStringToUnicodeString" __imp_RtlAnsiStringToUnicodeString
0x1800171F8: "Pattern" ??_C@_1BA@BHDJAPNN@?$AAP?$AAa?$AAt?$AAt?$AAe?$AAr?$AAn?$AA?$AA@
0x180016838: "__cdecl _imp_RtlRaiseStatus" __imp_RtlRaiseStatus
0x180016678: "__cdecl _imp_InitializeSRWLock" __imp_InitializeSRWLock
0x180016600: "__cdecl _imp_VirtualAlloc" __imp_VirtualAlloc
0x1800128D0: rijndaelEncrypt
0x180017D80: "WorkgroupName" ??_C@_1BM@KMICHCMD@?$AAW?$AAo?$AAr?$AAk?$AAg?$AAr?$AAo?$AAu?$AAp?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x18000F3F4: WPP_SF_SDd
0x180017B80: "LastPassCompleted" ??_C@_1CE@IMOMAKIN@?$AAL?$AAa?$AAs?$AAt?$AAP?$AAa?$AAs?$AAs?$AAC?$AAo?$AAm?$AAp?$AAl?$AAe?$AAt?$AAe?$AAd?$AA?$AA@
0x18001F750: "private: static struct _RTL_SRWLOCK SystemToken::_srwTokenLock" ?_srwTokenLock@SystemToken@@0U_RTL_SRWLOCK@@A
0x1800186B8: g_RGWCH__bslash_Registry_bslash_Machine_bslash_
0x1800165F0: "__cdecl _imp_VirtualQuery" __imp_VirtualQuery
0x180003A30: WPP_SF_SZD
0x180016558: "__cdecl _imp_RpcStringFreeW" __imp_RpcStringFreeW
0x180016848: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x180014A10: "__cdecl purecall" _purecall
0x180016E88: "\system32\config\SECURITY" ??_C@_1DE@JJCCDCNL@?$AA?2?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAc?$AAo?$AAn?$AAf?$AAi?$AAg?$AA?2?$AAS?$AAE?$AAC?$AAU?$AAR?$AAI?$AAT?$AAY?$AA?$AA@
0x18001FE08: "void * __ptr64 __ptr64 LsaOfflineIUserSid" ?LsaOfflineIUserSid@@3PEAXEA
0x1800023BC: "public: __cdecl LsaOfflineRegistryHandle::LsaOfflineRegistryHandle(class SystemToken * __ptr64,enum _LSAP_DB_OBJECT_TYPE_ID) __ptr64" ??0LsaOfflineRegistryHandle@@QEAA@PEAVSystemToken@@W4_LSAP_DB_OBJECT_TYPE_ID@@@Z
0x180016998: "__cdecl _imp_NtLoadKey" __imp_NtLoadKey
0x180014DD0: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x180009CC0: "public: virtual long __cdecl CWin32OfflineKey::Delete(void) __ptr64" ?Delete@CWin32OfflineKey@@UEAAJXZ
0x18000A8A0: "public: virtual void __cdecl CWin32OfflineKey::Release(void) __ptr64" ?Release@CWin32OfflineKey@@UEAAXXZ
0x18001F000: LspRC4Encryption128AlgorithmData
0x180017A50: "KerMaxR" ??_C@_1BA@FGJOPDHC@?$AAK?$AAe?$AAr?$AAM?$AAa?$AAx?$AAR?$AA?$AA@
0x180007048: "private: long __cdecl LsaOfflinePolicy::SetDomainInfo(struct LsaOfflinePolicy::LSADB_CREATE_PARAMS * __ptr64,struct LsaOfflineRegistryHandle::_DB_ATTRIBUTE * __ptr64 * __ptr64,unsigned long * __ptr64) __ptr64" ?SetDomainInfo@LsaOfflinePolicy@@AEAAJPEAULSADB_CREATE_PARAMS@1@PEAPEAU_DB_ATTRIBUTE@LsaOfflineRegistryHandle@@PEAK@Z
0x180018610: "Not-null check failed: String2" ??_C@_0BP@CFJIPKGD@Not?9null?5check?5failed?3?5String2?$AA@
0x180001110: "public: virtual void * __ptr64 __cdecl LsaOfflineHandleBase::`vector deleting destructor'(unsigned int) __ptr64" ??_ELsaOfflineHandleBase@@UEAAPEAXI@Z
0x18001FE98: g_ulMaxStackAllocSize
0x18001D114: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0
0x180017F80: "RtlAllocateLUnicodeString" ??_C@_0BK@HIPMGLGK@RtlAllocateLUnicodeString?$AA@
0x180017250: "SecureBoot" ??_C@_1BG@JEGAFCNI@?$AAS?$AAe?$AAc?$AAu?$AAr?$AAe?$AAB?$AAo?$AAo?$AAt?$AA?$AA@
0x180017DD0: "CreateEmptyAuditPolicy" ??_C@_1CO@LLFIINLM@?$AAC?$AAr?$AAe?$AAa?$AAt?$AAe?$AAE?$AAm?$AAp?$AAt?$AAy?$AAA?$AAu?$AAd?$AAi?$AAt?$AAP?$AAo?$AAl?$AAi?$AAc?$AAy?$AA?$AA@
0x18000B51C: "public: static long __cdecl IOfflineKey::CreateAndInitializeForWin32(void * __ptr64,class SystemToken * __ptr64,class IOfflineKey * __ptr64 * __ptr64)" ?CreateAndInitializeForWin32@IOfflineKey@@SAJPEAXPEAVSystemToken@@PEAPEAV1@@Z
0x180019E10: T8
0x1800086D0: "long __cdecl LsaOfflineOpenPolicyForInstaller(struct Windows::Rtl::IRtlSystemIsolationLayer * __ptr64,void * __ptr64 * __ptr64)" ?LsaOfflineOpenPolicyForInstaller@@YAJPEAUIRtlSystemIsolationLayer@Rtl@Windows@@PEAPEAX@Z
0x1800163B8: g_LUNICODE_STRING_HKEY_under_CLASSES_under_ROOT_bslash_
0x180017B60: "GlobalSaclName" ??_C@_1BO@HMHKNNEJ@?$AAG?$AAl?$AAo?$AAb?$AAa?$AAl?$AAS?$AAa?$AAc?$AAl?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x1800166E8: api-ms-win-eventing-classicprovider-l1-1-0_NULL_THUNK_DATA
0x1800168F8: "__cdecl _imp_RtlImageNtHeader" __imp_RtlImageNtHeader
0x1800167E8: "__cdecl _imp__XcptFilter" __imp__XcptFilter
0x180010AC8: RtlIsLUnicodeStringValid
0x180016370: g_LUNICODE_STRING_HKEY_under_CURRENT_under_CONFIG_bslash_
0x1800169F8: ntdll_NULL_THUNK_DATA
0x180016800: "__cdecl _imp_memcpy" __imp_memcpy
0x180017000: "Accounts" ??_C@_1BC@ELPACKDN@?$AAA?$AAc?$AAc?$AAo?$AAu?$AAn?$AAt?$AAs?$AA?$AA@
0x18001FBA0: "void * __ptr64 __ptr64 LsaOfflineServiceSid" ?LsaOfflineServiceSid@@3PEAXEA
0x18000AC70: "public: virtual long __cdecl CSilOfflineKey::SetSecurityDescriptor(unsigned long,void * __ptr64) __ptr64" ?SetSecurityDescriptor@CSilOfflineKey@@UEAAJKPEAX@Z
0x180018880: "MD5" ??_C@_17HLHJLHED@?$AAM?$AAD?$AA5?$AA?$AA@
0x18000AAF0: "public: virtual long __cdecl CSilOfflineKey::OpenExistingKey(struct _UNICODE_STRING * __ptr64,unsigned long,class IOfflineKey * __ptr64 * __ptr64) __ptr64" ?OpenExistingKey@CSilOfflineKey@@UEAAJPEAU_UNICODE_STRING@@KPEAPEAVIOfflineKey@@@Z
0x1800017F4: "public: long __cdecl LsaOfflineRegistryHandle::DbWriteAttributesObject(struct LsaOfflineRegistryHandle::_DB_ATTRIBUTE * __ptr64,unsigned long) __ptr64" ?DbWriteAttributesObject@LsaOfflineRegistryHandle@@QEAAJPEAU_DB_ATTRIBUTE@1@K@Z
0x180001190: "public: void __cdecl LsaOfflineHandleBase::ReleaseReference(void) __ptr64" ?ReleaseReference@LsaOfflineHandleBase@@QEAAXXZ
0x1800016AC: "protected: long __cdecl LsaOfflineRegistryHandle::DbCopySidAttributeForReturn(void * __ptr64 * __ptr64,unsigned char * __ptr64 * __ptr64,unsigned __int64 * __ptr64,struct LsaOfflineRegistryHandle::_DB_ATTRIBUTE * __ptr64) __ptr64" ?DbCopySidAttributeForReturn@LsaOfflineRegistryHandle@@IEAAJPEAPEAXPEAPEAEPEA_KPEAU_DB_ATTRIBUTE@1@@Z
0x1800061F4: "private: __cdecl LsaOfflinePolicy::LsaOfflinePolicy(class SystemToken * __ptr64,unsigned short * __ptr64) __ptr64" ??0LsaOfflinePolicy@@AEAA@PEAVSystemToken@@PEAG@Z
0x18001F758: "private: static class SystemToken * __ptr64 __ptr64 SystemToken::_CachedSystemToken" ?_CachedSystemToken@SystemToken@@0PEAV1@EA
0x18001F040: LspMD5HashAlgorithmData
0x1800166C8: "__cdecl _imp_GetTraceEnableFlags" __imp_GetTraceEnableFlags
0x18001D13C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0
0x180008068: WPP_SF_SSSS
0x180009798: WPP_SF_ZDZD
0x18000A910: "public: virtual long __cdecl CSilOfflineKey::CreateNewKey(struct _UNICODE_STRING * __ptr64,unsigned long,class IOfflineKey * __ptr64 * __ptr64) __ptr64" ?CreateNewKey@CSilOfflineKey@@UEAAJPEAU_UNICODE_STRING@@KPEAPEAVIOfflineKey@@@Z
0x1800166E0: "__cdecl _imp_RegisterTraceGuidsW" __imp_RegisterTraceGuidsW
0x18000B250: "public: virtual long __cdecl CSilOfflineKey::EnumerateKeys(unsigned long * __ptr64,unsigned short * __ptr64 * __ptr64 * __ptr64) __ptr64" ?EnumerateKeys@CSilOfflineKey@@UEAAJPEAKPEAPEAPEAG@Z
0x18001F128: "__cdecl _security_cookie" __security_cookie
0x18000DB78: "long __cdecl LsaOfflineCopyString(unsigned short * __ptr64,unsigned short * __ptr64 * __ptr64)" ?LsaOfflineCopyString@@YAJPEAGPEAPEAG@Z
0x180018650: g_RGWCH__bslash_Registry_bslash_Machine_bslash_SOFTWARE_bslash_Classes_bslash_
0x1800116A0: LspRC4EncryptData
0x18000B4D0: "public: __cdecl CSilOfflineKey::CSilOfflineKey(struct Windows::Rtl::IRtlKey * __ptr64) __ptr64" ??0CSilOfflineKey@@QEAA@PEAUIRtlKey@Rtl@Windows@@@Z
0x18001FEA0: g_pfnAllocate
0x18000AD50: "public: virtual long __cdecl CSilOfflineKey::DeleteKey(struct _UNICODE_STRING * __ptr64) __ptr64" ?DeleteKey@CSilOfflineKey@@UEAAJPEAU_UNICODE_STRING@@@Z
0x180014EC0: "__cdecl alloca_probe" _alloca_probe
0x18000A220: "public: virtual long __cdecl CWin32OfflineKey::SetValue(struct _UNICODE_STRING * __ptr64,unsigned long,void * __ptr64,unsigned long) __ptr64" ?SetValue@CWin32OfflineKey@@UEAAJPEAU_UNICODE_STRING@@KPEAXK@Z
0x18001F71C: "unsigned long gulWin32KeyCount" ?gulWin32KeyCount@@3KA
0x180005040: "public: virtual long __cdecl LsaOfflinePolicy::Delete(void) __ptr64" ?Delete@LsaOfflinePolicy@@UEAAJXZ
0x1800165A8: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x180017688: "SecDesc" ??_C@_1BA@OBILJAH@?$AAS?$AAe?$AAc?$AAD?$AAe?$AAs?$AAc?$AA?$AA@
0x18001F740: "struct _RTL_SRWLOCK gKeyListLock" ?gKeyListLock@@3U_RTL_SRWLOCK@@A
0x1800165B8: "__cdecl _imp_LocalFree" __imp_LocalFree
0x180017288: WPP_3d67e565126c31222e3557bcba00f898_Traceguids
0x1800166F0: "__cdecl _imp_GetLengthSid" __imp_GetLengthSid
0x180016950: "__cdecl _imp_NtDeleteKey" __imp_NtDeleteKey
0x180016BE0: WPP_d3a2c524a6193922f06a10b97c84a316_Traceguids
0x18001D0C4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0
0x180016430: g_LUNICODE_STRING_HKEY_under_LOCAL_under_MACHINE_bslash_
0x18000F5C4: "private: long __cdecl LsaOfflineDBOptions::QueryStringOptions(class IOfflineKey * __ptr64) __ptr64" ?QueryStringOptions@LsaOfflineDBOptions@@AEAAJPEAVIOfflineKey@@@Z
0x180016598: "__cdecl _imp_GetFileAttributesW" __imp_GetFileAttributesW
0x180016840: "__cdecl _imp_DbgPrintEx" __imp_DbgPrintEx
0x18001FB88: "void * __ptr64 __ptr64 LsaOfflineLocalServiceSid" ?LsaOfflineLocalServiceSid@@3PEAXEA
0x18001FE68: "__cdecl _onexitbegin" __onexitbegin
0x18001F74C: "private: static int SystemToken::_StaticsInitialized" ?_StaticsInitialized@SystemToken@@0HA
0x180018260: "BUCL::Rtl::AddInPlaceWithOverflo" ??_C@_0EK@FINDHGGP@BUCL?3?3Rtl?3?3AddInPlaceWithOverflo@
0x1800183B8: "Not-null check failed: PathIn" ??_C@_0BO@IGDAGCGO@Not?9null?5check?5failed?3?5PathIn?$AA@
0x1800163E8: g_LUNICODE_STRING_HKEY_under_USERS_bslash_
0x180017A10: "TrDmSET" ??_C@_1BA@NDACLDOB@?$AAT?$AAr?$AAD?$AAm?$AAS?$AAE?$AAT?$AA?$AA@
0x180016968: "__cdecl _imp_RtlAllocateAndInitializeSid" __imp_RtlAllocateAndInitializeSid
0x180016038: "const LsaOfflinePolicy::`vftable'" ??_7LsaOfflinePolicy@@6B@
0x1800167C0: "__cdecl _imp__vsnwprintf" __imp__vsnwprintf
0x180008FC0: "long __cdecl LsaOfflineAddAccountRights(void * __ptr64,void * __ptr64,struct _UNICODE_STRING * __ptr64,unsigned long)" ?LsaOfflineAddAccountRights@@YAJPEAX0PEAU_UNICODE_STRING@@K@Z
0x180018768: g_RGWCH_HKLM_bslash_
0x180001244: WPP_SF_qd
0x180001244: WPP_SF_qD
0x180018368: "onecore\base\lstring\path.cpp" ??_C@_0BO@MAHDFKKG@onecore?2base?2lstring?2path?4cpp?$AA@
0x180016578: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x18000EF54: "void __cdecl LsaOfflineCleanupGlobals(void)" ?LsaOfflineCleanupGlobals@@YAXXZ
0x180017FF8: "::RtlIsUnicodeStringValid(Source" ??_C@_0CC@IAHNJHKE@?3?3RtlIsUnicodeStringValid?$CISource@
0x1800160B8: "const CSilOfflineKey::`vftable'" ??_7CSilOfflineKey@@6B@
0x1800025FC: WPP_SF_qq
0x1800062C0: "private: virtual void * __ptr64 __cdecl LsaOfflinePolicy::`vector deleting destructor'(unsigned int) __ptr64" ??_ELsaOfflinePolicy@@EEAAPEAXI@Z
0x180018238: "::RtlIsLUnicodeStringValid(&Sour" ??_C@_0CI@NAADPAOI@?3?3RtlIsLUnicodeStringValid?$CI?$CGSour@
0x18000C89C: "private: long __cdecl LsaOfflinePolicy::RetrieveBootOption(enum _WX_AUTH_TYPE * __ptr64) __ptr64" ?RetrieveBootOption@LsaOfflinePolicy@@AEAAJPEAW4_WX_AUTH_TYPE@@@Z
0x18000C0AC: "private: long __cdecl LsaOfflinePolicy::DeobfuscateKey(class IOfflineKey * __ptr64,struct _WXHASH * __ptr64) __ptr64" ?DeobfuscateKey@LsaOfflinePolicy@@AEAAJPEAVIOfflineKey@@PEAU_WXHASH@@@Z
0x180018048: "::RtlIsLUnicodeStringValid(Sourc" ??_C@_0CD@JJAEPDDA@?3?3RtlIsLUnicodeStringValid?$CISourc@
0x18001FE10: "struct _RTL_SRWLOCK srwGlobalInitLock" ?srwGlobalInitLock@@3U_RTL_SRWLOCK@@A
0x180011A60: LspMD5HashData
0x180017208: "Data" ??_C@_19IEEMEPMH@?$AAD?$AAa?$AAt?$AAa?$AA?$AA@
0x180014CD4: "__cdecl _security_init_cookie" __security_init_cookie
0x18000105C: WPP_SF_q
0x18000CFD8: "private: static long __cdecl SystemToken::GetWinLogonProcessId(unsigned long * __ptr64)" ?GetWinLogonProcessId@SystemToken@@CAJPEAK@Z
0x180003BAC: "private: long __cdecl LsaOfflinePolicy::CommonInitialize(void) __ptr64" ?CommonInitialize@LsaOfflinePolicy@@AEAAJXZ
0x1800177B8: "PolDnDDN" ??_C@_1BC@KDNHPLFM@?$AAP?$AAo?$AAl?$AAD?$AAn?$AAD?$AAD?$AAN?$AA?$AA@
0x180016788: "__cdecl _imp_BCryptFinishHash" __imp_BCryptFinishHash
0x180003740: "private: virtual void * __ptr64 __cdecl LsaOfflineAccount::`scalar deleting destructor'(unsigned int) __ptr64" ??_GLsaOfflineAccount@@EEAAPEAXI@Z
0x1800168C0: "__cdecl _imp_NtQuerySystemInformation" __imp_NtQuerySystemInformation
0x180016D48: "SeDenyServiceLogonRight" ??_C@_1DA@PIDIIIOO@?$AAS?$AAe?$AAD?$AAe?$AAn?$AAy?$AAS?$AAe?$AAr?$AAv?$AAi?$AAc?$AAe?$AAL?$AAo?$AAg?$AAo?$AAn?$AAR?$AAi?$AAg?$AAh?$AAt?$AA?$AA@
0x180009540: "long __cdecl LsaOfflineDelete(void * __ptr64)" ?LsaOfflineDelete@@YAJPEAX@Z
0x18000192C: "protected: long __cdecl LsaOfflineRegistryHandle::DbMakeSidAttribute(void * __ptr64,enum _LSAP_DB_NAMES,struct LsaOfflineRegistryHandle::_DB_ATTRIBUTE * __ptr64) __ptr64" ?DbMakeSidAttribute@LsaOfflineRegistryHandle@@IEAAJPEAXW4_LSAP_DB_NAMES@@PEAU_DB_ATTRIBUTE@1@@Z
0x180017740: "OupdTime" ??_C@_1BC@HHNLOIJA@?$AAO?$AAu?$AAp?$AAd?$AAT?$AAi?$AAm?$AAe?$AA?$AA@
0x18001F068: LspSHA256HashAlgorithmData
0x180017800: "PolEfDat" ??_C@_1BC@ODFCHLIH@?$AAP?$AAo?$AAl?$AAE?$AAf?$AAD?$AAa?$AAt?$AA?$AA@
0x18001FEB0: g_pfnFree
0x180013F20: rijndaelDecrypt256
0x180017AC0: "PolSecretEncryptionKey" ??_C@_1CO@EHFPKFE@?$AAP?$AAo?$AAl?$AAS?$AAe?$AAc?$AAr?$AAe?$AAt?$AAE?$AAn?$AAc?$AAr?$AAy?$AAp?$AAt?$AAi?$AAo?$AAn?$AAK?$AAe?$AAy?$AA?$AA@
0x18000A6F0: "public: virtual long __cdecl CWin32OfflineKey::QueryClass(unsigned short * __ptr64 * __ptr64) __ptr64" ?QueryClass@CWin32OfflineKey@@UEAAJPEAPEAG@Z
0x18001D04C: "__cdecl _IMPORT_DESCRIPTOR_msvcrt" __IMPORT_DESCRIPTOR_msvcrt
0x180016010: "const LsaOfflineHandleBase::`vftable'" ??_7LsaOfflineHandleBase@@6B@
0x1800185F0: "Not-null check failed: String1" ??_C@_0BP@OLFKJKA@Not?9null?5check?5failed?3?5String1?$AA@
0x180016760: api-ms-win-security-sddl-l1-1-0_NULL_THUNK_DATA
0x180001110: "public: virtual void * __ptr64 __cdecl LsaOfflineHandleBase::`scalar deleting destructor'(unsigned int) __ptr64" ??_GLsaOfflineHandleBase@@UEAAPEAXI@Z
0x180017018: "Secrets" ??_C@_1BA@CGOJCMFP@?$AAS?$AAe?$AAc?$AAr?$AAe?$AAt?$AAs?$AA?$AA@
0x180003D40: "public: static long __cdecl LsaOfflinePolicy::CreateAndInitialize(unsigned short * __ptr64,class LsaOfflinePolicy * __ptr64 * __ptr64)" ?CreateAndInitialize@LsaOfflinePolicy@@SAJPEAGPEAPEAV1@@Z
0x180017E00: "NtProductType" ??_C@_1BM@IEOGMDOM@?$AAN?$AAt?$AAP?$AAr?$AAo?$AAd?$AAu?$AAc?$AAt?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x180017F08: "(Bytes % sizeof(WCHAR)) == 0" ??_C@_0BN@OMEDCNLD@?$CIBytes?5?$CF?5sizeof?$CIWCHAR?$CJ?$CJ?5?$DN?$DN?50?$AA@
0x180017360: "struct _LSAP_DB_DS_INFO const * const LsaOfflineDbDsAttInfo" ?LsaOfflineDbDsAttInfo@@3QBU_LSAP_DB_DS_INFO@@B
0x18000B690: "void __cdecl RemoveKeyFromList(struct _LIST_ENTRY * __ptr64)" ?RemoveKeyFromList@@YAXPEAU_LIST_ENTRY@@@Z
0x180017960: "TrDmCtEn" ??_C@_1BC@GILHHAJM@?$AAT?$AAr?$AAD?$AAm?$AAC?$AAt?$AAE?$AAn?$AA?$AA@
0x1800169E0: "__cdecl _imp_NtOpenKey" __imp_NtOpenKey
0x180008DE0: "long __cdecl LsaOfflineRemovePrivilegesFromAccount(void * __ptr64,unsigned char,struct _PRIVILEGE_SET * __ptr64)" ?LsaOfflineRemovePrivilegesFromAccount@@YAJPEAXEPEAU_PRIVILEGE_SET@@@Z
0x1800181F0: "RtlConcatenateLUnicodeStrings" ??_C@_0BO@PEMKFOPH@RtlConcatenateLUnicodeStrings?$AA@
0x180016568: "__cdecl _imp_UuidToStringW" __imp_UuidToStringW
0x18001F152: gUseImplicitAlgHandles
0x1800167D8: "__cdecl _imp_malloc" __imp_malloc
0x18000114C: "public: virtual __cdecl LsaOfflineHandleBase::~LsaOfflineHandleBase(void) __ptr64" ??1LsaOfflineHandleBase@@UEAA@XZ
0x1800167F8: "__cdecl _imp__purecall" __imp__purecall
0x18001FE58: g_NTSTATUS_to_break_on
0x1800170E8: "ProductSuite" ??_C@_1BK@HJNBLNLJ@?$AAP?$AAr?$AAo?$AAd?$AAu?$AAc?$AAt?$AAS?$AAu?$AAi?$AAt?$AAe?$AA?$AA@
0x18001D088: "__cdecl _IMPORT_DESCRIPTOR_RPCRT4" __IMPORT_DESCRIPTOR_RPCRT4
0x1800046A8: "public: long __cdecl LsaOfflinePolicy::QueryInformationPolicy(enum _POLICY_INFORMATION_CLASS,void * __ptr64 * __ptr64) __ptr64" ?QueryInformationPolicy@LsaOfflinePolicy@@QEAAJW4_POLICY_INFORMATION_CLASS@@PEAPEAX@Z
0x180017040: "ControlSet001\Control\ProductOpt" ??_C@_1EK@IGONOPFD@?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA0?$AA0?$AA1?$AA?2?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AA?2?$AAP?$AAr?$AAo?$AAd?$AAu?$AAc?$AAt?$AAO?$AAp?$AAt@
0x180007E08: "private: void __cdecl LsaOfflinePolicy::CreateDefaultAuditPolicy(struct LsaOfflinePolicy::LSADB_CREATE_PARAMS * __ptr64,struct _LSA_AUDIT_POLICY_STORAGE * __ptr64) __ptr64" ?CreateDefaultAuditPolicy@LsaOfflinePolicy@@AEAAXPEAULSADB_CREATE_PARAMS@1@PEAU_LSA_AUDIT_POLICY_STORAGE@@@Z
0x1800169D0: "__cdecl _imp_RtlLengthSid" __imp_RtlLengthSid
0x180016340: g_LUNICODE_STRING_HKCC_bslash_
0x180016570: RPCRT4_NULL_THUNK_DATA
0x1800030AC: "private: long __cdecl LsaOfflineAccount::ConvertRightsToPrivileges(struct _UNICODE_STRING * __ptr64,unsigned long,struct _PRIVILEGE_SET * __ptr64 * __ptr64,unsigned long * __ptr64) __ptr64" ?ConvertRightsToPrivileges@LsaOfflineAccount@@AEAAJPEAU_UNICODE_STRING@@KPEAPEAU_PRIVILEGE_SET@@PEAK@Z
0x180016738: "__cdecl _imp_LookupPrivilegeValueW" __imp_LookupPrivilegeValueW
0x180004168: "public: static long __cdecl LsaOfflinePolicy::CreateAndInitializeExternal(unsigned short * __ptr64,unsigned short * __ptr64,unsigned short * __ptr64,unsigned short * __ptr64,class LsaOfflinePolicy * __ptr64 * __ptr64)" ?CreateAndInitializeExternal@LsaOfflinePolicy@@SAJPEAG000PEAPEAV1@@Z
0x180017C50: "NullObject" ??_C@_1BG@DAIELEKD@?$AAN?$AAu?$AAl?$AAl?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AA?$AA@
0x180014A60: "__cdecl _report_gsfailure" __report_gsfailure
0x180010554: RtlInitLUnicodeStringFromNullTerminatedString
0x18000B8E8: "long __cdecl SaveSyskeyKeyAndValue(class IOfflineKey * __ptr64,unsigned short * __ptr64,char * __ptr64,unsigned short * __ptr64,unsigned long,void * __ptr64)" ?SaveSyskeyKeyAndValue@@YAJPEAVIOfflineKey@@PEAGPEAD1KPEAX@Z
0x180016028: "const LsaOfflineAccount::`vftable'" ??_7LsaOfflineAccount@@6B@
0x180016E70: "\SECURITY" ??_C@_1BE@OPIEPCBA@?$AA?2?$AAS?$AAE?$AAC?$AAU?$AAR?$AAI?$AAT?$AAY?$AA?$AA@
0x1800121F0: LspEncryptDataInternal
0x18001FE78: "__cdecl _native_startup_state" __native_startup_state
0x180016F90: "\SYSTEM" ??_C@_1BA@DDCDPKJF@?$AA?2?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?$AA@
0x18000FBE0: "private: long __cdecl LsaOfflineDBOptions::QueryBoolOptions(class IOfflineKey * __ptr64) __ptr64" ?QueryBoolOptions@LsaOfflineDBOptions@@AEAAJPEAVIOfflineKey@@@Z
0x180017328: "winlogon.exe" ??_C@_1BK@HLMOGDAH@?$AAw?$AAi?$AAn?$AAl?$AAo?$AAg?$AAo?$AAn?$AA?4?$AAe?$AAx?$AAe?$AA?$AA@
0x180011514: SafeAllocaInitialize
0x180016C38: "SeNetworkLogonRight" ??_C@_1CI@NHBIGKOK@?$AAS?$AAe?$AAN?$AAe?$AAt?$AAw?$AAo?$AAr?$AAk?$AAL?$AAo?$AAg?$AAo?$AAn?$AAR?$AAi?$AAg?$AAh?$AAt?$AA?$AA@
0x180016E38: "\REGISTRY\MACHINE\SECURITY" ??_C@_1DG@JMCMBKJC@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAE?$AAC?$AAU?$AAR?$AAI?$AAT?$AAY?$AA?$AA@
0x1800171D0: "GrafBlumGroup" ??_C@_1BM@JOKBACHC@?$AAG?$AAr?$AAa?$AAf?$AAB?$AAl?$AAu?$AAm?$AAG?$AAr?$AAo?$AAu?$AAp?$AA?$AA@
0x18001D18C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-cryptoapi-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-cryptoapi-l1-1-0
0x180018630: "SHA256" ??_C@_1O@HECGKAIN@?$AAS?$AAH?$AAA?$AA2?$AA5?$AA6?$AA?$AA@
0x180009A60: "public: virtual long __cdecl CWin32OfflineKey::OpenExistingKey(struct _UNICODE_STRING * __ptr64,unsigned long,class IOfflineKey * __ptr64 * __ptr64) __ptr64" ?OpenExistingKey@CWin32OfflineKey@@UEAAJPEAU_UNICODE_STRING@@KPEAPEAVIOfflineKey@@@Z
0x180016F48: "%s%s___(%s)___%s" ??_C@_1CC@FPHLLIBI@?$AA?$CF?$AAs?$AA?$CF?$AAs?$AA_?$AA_?$AA_?$AA?$CI?$AA?$CF?$AAs?$AA?$CJ?$AA_?$AA_?$AA_?$AA?$CF?$AAs?$AA?$AA@
0x180016980: "__cdecl _imp_NtUnloadKey2" __imp_NtUnloadKey2
0x1800115CC: InternalVerifyStackAvailable
0x18001D1F0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-memory-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-memory-l1-1-0
0x1800184E8: "RtlReallocateLBlob" ??_C@_0BD@MBNOBJLB@RtlReallocateLBlob?$AA@
0x180018210: "(SourceCount == 0) || (Sources !" ??_C@_0CF@PIIBDOBJ@?$CISourceCount?5?$DN?$DN?50?$CJ?5?$HM?$HM?5?$CISources?5?$CB@
0x18000A3C0: "public: virtual long __cdecl CWin32OfflineKey::EnumerateKeys(unsigned long * __ptr64,unsigned short * __ptr64 * __ptr64 * __ptr64) __ptr64" ?EnumerateKeys@CWin32OfflineKey@@UEAAJPEAKPEAPEAPEAG@Z
0x180016560: "__cdecl _imp_UuidCreate" __imp_UuidCreate
0x1800169B8: "__cdecl _imp_NtCreateKey" __imp_NtCreateKey
0x180016888: "__cdecl _imp_RtlSetDaclSecurityDescriptor" __imp_RtlSetDaclSecurityDescriptor
0x18001F140: AdtpPerCategoryCount
0x180017D60: WPP_fb74f5598d443b7844a667c8ff9d779e_Traceguids
0x180017C30: "DummyLastName" ??_C@_1BM@PJANCHGK@?$AAD?$AAu?$AAm?$AAm?$AAy?$AAL?$AAa?$AAs?$AAt?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x18001D1C8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0
0x18001F0C0: LspEncryptionSuite
0x180016388: g_LUNICODE_STRING_HKCR_bslash_
0x18000C4B0: "private: long __cdecl LsaOfflinePolicy::RetrieveSyskey(void) __ptr64" ?RetrieveSyskey@LsaOfflinePolicy@@AEAAJXZ
0x18000F540: WPP_SF_Sd
0x18000DAA8: WPP_SF_SD
0x180018478: "PathOut->Length != 0" ??_C@_0BF@HCLJNMOH@PathOut?9?$DOLength?5?$CB?$DN?50?$AA@
0x1800167B8: "__cdecl _imp_free" __imp_free
0x180003958: WPP_SF_SZ
0x180014C40: "__cdecl IsNonwritableInCurrentImage" _IsNonwritableInCurrentImage
0x180016690: api-ms-win-core-synch-l1-2-0_NULL_THUNK_DATA
0x1800185B0: "RtlCompareEncodedLBlobs" ??_C@_0BI@GPFMMLMN@RtlCompareEncodedLBlobs?$AA@
0x1800062C0: "private: virtual void * __ptr64 __cdecl LsaOfflinePolicy::`scalar deleting destructor'(unsigned int) __ptr64" ??_GLsaOfflinePolicy@@EEAAPEAXI@Z
0x18000F48C: WPP_SF_SS
0x180017F30: "String->Buffer = reinterpret_cas" ??_C@_0EN@BBOBNKDL@String?9?$DOBuffer?5?$DN?5reinterpret_cas@
0x18001FBB0: "void * __ptr64 __ptr64 LsaOfflineAliasAdminsSid" ?LsaOfflineAliasAdminsSid@@3PEAXEA
0x180016630: "__cdecl _imp_OpenProcessToken" __imp_OpenProcessToken
0x18001FE18: "int gfGlobalsInitialized" ?gfGlobalsInitialized@@3HA
0x180018740: g_RGWCH_HKEY_under_CURRENT_under_USER_bslash_
0x180001858: "protected: long __cdecl LsaOfflineRegistryHandle::DbMakeUnicodeAttribute(struct _UNICODE_STRING * __ptr64,enum _LSAP_DB_NAMES,struct LsaOfflineRegistryHandle::_DB_ATTRIBUTE * __ptr64) __ptr64" ?DbMakeUnicodeAttribute@LsaOfflineRegistryHandle@@IEAAJPEAU_UNICODE_STRING@@W4_LSAP_DB_NAMES@@PEAU_DB_ATTRIBUTE@1@@Z
0x180017848: "PolPdAcN" ??_C@_1BC@OJKCIGPM@?$AAP?$AAo?$AAl?$AAP?$AAd?$AAA?$AAc?$AAN?$AA?$AA@
0x180017818: "PolPrDmN" ??_C@_1BC@LBPIBIEH@?$AAP?$AAo?$AAl?$AAP?$AAr?$AAD?$AAm?$AAN?$AA?$AA@
0x180016680: api-ms-win-core-synch-l1-1-0_NULL_THUNK_DATA
0x180017190: "Lookup" ??_C@_1O@ICHDMMGD@?$AAL?$AAo?$AAo?$AAk?$AAu?$AAp?$AA?$AA@
0x18001D1B4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0
0x1800038F0: WPP_SF_S
0x1800177A0: "PolAcDmS" ??_C@_1BC@EMFKNMEA@?$AAP?$AAo?$AAl?$AAA?$AAc?$AAD?$AAm?$AAS?$AA?$AA@
0x180014E82: memset
0x18001D204: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x180016418: g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_
0x18001F748: "unsigned long gulSilKeyCount" ?gulSilKeyCount@@3KA
0x180003740: "private: virtual void * __ptr64 __cdecl LsaOfflineAccount::`vector deleting destructor'(unsigned int) __ptr64" ??_ELsaOfflineAccount@@EEAAPEAXI@Z

[JEB Decompiler by PNF Software]