Generated by JEB on 2019/08/01

PE: C:\Windows\System32\keyiso.dll Base=0x180000000 SHA-256=83107A1D17D215EE4B8675C4C9B0EE7D2D847D40938001ABC1846EC72ABE1388
PDB: keyiso.pdb GUID={78375EB0-80FE-16DA-7091FEB2A809EF02} Age=1

458 located named symbols:
0x180009DC0: s_SrvRpcCryptSecretAgreement
0x18000D08C: CheckAppAccessRightBasedOnCapability
0x18000AE80: SrvRundownMemoryBuffer
0x180011320: "__cdecl _imp_EtwUnregisterTraceGuids" __imp_EtwUnregisterTraceGuids
0x1800111A0: "__cdecl _imp_CapabilityCheck" __imp_CapabilityCheck
0x1800147B4: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x1800166E8: g_hInstance
0x180016138: "__cdecl _security_cookie_complement" __security_cookie_complement
0x180011318: "__cdecl _imp_NtOpenProcess" __imp_NtOpenProcess
0x18000B070: SrvRundownProviderNotifyEventList
0x18000D634: GetCallerToken
0x1800132C0: "ncalrpc" ??_C@_1BA@EONDGCCM@?$AAn?$AAc?$AAa?$AAl?$AAr?$AAp?$AAc?$AA?$AA@
0x18000D80C: IsCallerLocalServiceOrLocalSystem
0x180006D80: SrvCryptGetProviderProperty
0x1800135A8: "ID_CAP_NETWORKING_VPN_PROVIDER" ??_C@_1DO@LCGPOMHP@?$AAI?$AAD?$AA_?$AAC?$AAA?$AAP?$AA_?$AAN?$AAE?$AAT?$AAW?$AAO?$AAR?$AAK?$AAI?$AAN?$AAG?$AA_?$AAV?$AAP?$AAN?$AA_?$AAP?$AAR?$AAO?$AAV?$AAI?$AAD?$AAE?$AAR?$AA?$AA@
0x18000C1A8: GetDllPath
0x180011028: "__cdecl _imp_NdrServerCallAll" __imp_NdrServerCallAll
0x180007700: SrvCryptSetProviderProperty
0x180009820: s_SrvRpcCryptGetKeyProperty
0x180014868: "__cdecl _IMPORT_DESCRIPTOR_CRYPTBASE" __IMPORT_DESCRIPTOR_CRYPTBASE
0x1800112E0: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x18000C0A0: WppControlCallback
0x1800035F0: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x180010FE0: "__cdecl _imp_RpcEpUnregister" __imp_RpcEpUnregister
0x180013510: "userSigninSupport" ??_C@_1CE@GKMDCOCD@?$AAu?$AAs?$AAe?$AAr?$AAS?$AAi?$AAg?$AAn?$AAi?$AAn?$AAS?$AAu?$AAp?$AAp?$AAo?$AAr?$AAt?$AA?$AA@
0x1800169D4: g_fLoaderInitialized
0x18000BFBC: WPP_INIT_CONTROL_ARRAY
0x180014908: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-capability-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-capability-l1-1-0
0x18000AC38: SrvRemoveMemoryBufferFromList
0x18000AA78: SrvLookupProviderNotifyEvent
0x180011200: "__cdecl _imp_BCryptDestroyKey" __imp_BCryptDestroyKey
0x180011268: "__cdecl _imp_EtwGetTraceLoggerHandle" __imp_EtwGetTraceLoggerHandle
0x180011600: "onecore\ds\security\cryptoapi\nc" ??_C@_0DM@CLCFNMGA@onecore?2ds?2security?2cryptoapi?2nc@
0x180011140: "__cdecl _imp_AcquireSRWLockShared" __imp_AcquireSRWLockShared
0x180009BD0: s_SrvRpcCryptKeyDerivation
0x180002D00: s_VerifyWithSymmetricPopKey
0x180002AB0: s_DecryptWithSymmetricPopKey
0x180011218: bcrypt_NULL_THUNK_DATA
0x180011078: api-ms-win-core-heap-l2-1-0_NULL_THUNK_DATA
0x18000C128: WppInitUm
0x180011108: "__cdecl _imp_SetEvent" __imp_SetEvent
0x180011250: "__cdecl _imp_RtlEnterCriticalSection" __imp_RtlEnterCriticalSection
0x180011358: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x1800030D0: NdrServerCall2
0x18000CBBC: "__cdecl GetImagePath" _GetImagePath
0x180011118: "__cdecl _imp_InitializeCriticalSection" __imp_InitializeCriticalSection
0x180010FD8: "__cdecl _imp_RpcEpRegisterW" __imp_RpcEpRegisterW
0x180011080: "__cdecl _imp_GetModuleHandleExW" __imp_GetModuleHandleExW
0x180002C10: s_SignWithSymmetricPopKey
0x180012DA0: "SYSTEM\CurrentControlSet\Control" ??_C@_1GE@OMFIAPNP@?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA?2?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl@
0x18000A5FC: SrvAddMemoryBufferToList
0x1800115F0: "ntStatus" ??_C@_08DBOEHLEI@ntStatus?$AA@
0x1800073B0: SrvCryptSecretAgreement
0x1800111F8: "__cdecl _imp_BCryptResolveProviders" __imp_BCryptResolveProviders
0x1800111D0: "__cdecl _imp_RegisterServiceCtrlHandlerExW" __imp_RegisterServiceCtrlHandlerExW
0x180006200: SrvCryptEnumAlgorithms
0x180012F00: "s_NgcEncryptWithSymmetricPopKey" ??_C@_0CA@KJHFGEOF@s_NgcEncryptWithSymmetricPopKey?$AA@
0x180009440: s_SrvRpcCryptEnumKeys
0x180001E10: SrvCryptFreeKey
0x1800111B0: "__cdecl _imp_ConvertStringSidToSidW" __imp_ConvertStringSidToSidW
0x180011298: "__cdecl _imp_LdrDisableThreadCalloutsForDll" __imp_LdrDisableThreadCalloutsForDll
0x180013578: "networkingVpnProvider" ??_C@_1CM@NKAHJFIE@?$AAn?$AAe?$AAt?$AAw?$AAo?$AAr?$AAk?$AAi?$AAn?$AAg?$AAV?$AAp?$AAn?$AAP?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AA?$AA@
0x180007DF8: StringCchCopyW
0x180001F80: s_SrvRpcCryptFreeKey
0x180011220: "__cdecl _imp_NCryptOpenStorageProvider" __imp_NCryptOpenStorageProvider
0x18000A80C: SrvLookupAndReferenceKey
0x1800166F8: g_ResLock
0x1800110B8: api-ms-win-core-processenvironment-l1-1-0_NULL_THUNK_DATA
0x1800035BD: memcpy
0x1800117A8: "GetKeyProtectionInterface" ??_C@_0BK@FECGEIAN@GetKeyProtectionInterface?$AA@
0x180011090: "__cdecl _imp_LoadLibraryExW" __imp_LoadLibraryExW
0x180009030: s_SrvRpcCryptDeriveKey
0x180002FDC: "__cdecl _security_init_cookie_ex" __security_init_cookie_ex
0x1800117E0: WPP_77c44b4cfa6d308db66c9d4b397b28a3_Traceguids
0x1800112A0: "__cdecl _imp_memset" __imp_memset
0x180011130: "__cdecl _imp_CreateEventW" __imp_CreateEventW
0x18000CE74: "__cdecl NewLoadedProviderHandle" _NewLoadedProviderHandle
0x1800148F4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0
0x180007F44: "__cdecl CreateProviderNotifyEventMapping" _CreateProviderNotifyEventMapping
0x18000ADB0: SrvRundownKeyList
0x1800116E0: "sResult" ??_C@_07LMHMJEJF@sResult?$AA@
0x180006EC0: SrvCryptIsAlgSupported
0x18000AB04: SrvRemoveContextFromList
0x1800030AA: RtlUnhandledExceptionFilter
0x180011340: "__cdecl _imp_wcscmp" __imp_wcscmp
0x1800112F0: "__cdecl _imp_RtlIsMultiSessionSku" __imp_RtlIsMultiSessionSku
0x180011280: "__cdecl _imp_EtwRegisterTraceGuidsW" __imp_EtwRegisterTraceGuidsW
0x18000306E: "__cdecl _C_specific_handler" __C_specific_handler
0x18000D1C8: CheckBasedOnAppContainerAccessRight
0x180002A40: MIDL_user_free
0x180011110: "__cdecl _imp_ReleaseSRWLockExclusive" __imp_ReleaseSRWLockExclusive
0x180003086: RtlCaptureContext
0x180016970: g_NgcPopKeyFunctions
0x180016730: WPP_REGISTRATION_GUIDS
0x180009630: s_SrvRpcCryptFreeBuffer
0x18000336C: DebugTraceError
0x180011060: api-ms-win-core-handle-l1-1-0_NULL_THUNK_DATA
0x1800099C0: s_SrvRpcCryptGetProviderProperty
0x180012FE8: "s_NgcGetPregenKeyState" ??_C@_0BH@GDHABBOM@s_NgcGetPregenKeyState?$AA@
0x18000A6D8: SrvAddSecretToList
0x1800110F8: "__cdecl _imp_RegCloseKey" __imp_RegCloseKey
0x1800112E8: "__cdecl _imp_NtQueryInformationToken" __imp_NtQueryInformationToken
0x18000355C: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x180008160: "__cdecl MapBufferDescToRPC" _MapBufferDescToRPC
0x18000A7C0: SrvDereferenceSecret
0x18000CD24: "__cdecl LoadImage" _LoadImage
0x1800116E8: "GetCipherInterface" ??_C@_0BD@CLBFJFIO@GetCipherInterface?$AA@
0x1800112B8: "__cdecl _imp_RtlAllocateHeap" __imp_RtlAllocateHeap
0x1800018A0: SrvCryptFreeProvider
0x180008860: s_SrvRpcCryptCipherDecrypt
0x180016738: WPP_MAIN_CB
0x180007860: SrvCryptSignHash
0x1800148B8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0
0x180011180: "__cdecl _imp_IsWellKnownSid" __imp_IsWellKnownSid
0x18000D8A0: IsParameterSidEqualsUserSidOnToken
0x180002580: NCRYPT_RPC_CONTEXT_HANDLE_rundown
0x18000CCE0: "__cdecl InitializeLoaderLock" _InitializeLoaderLock
0x1800131E0: "RSAPRIVATEBLOB" ??_C@_1BO@MGHJKOLO@?$AAR?$AAS?$AAA?$AAP?$AAR?$AAI?$AAV?$AAA?$AAT?$AAE?$AAB?$AAL?$AAO?$AAB?$AA?$AA@
0x18000AD4C: SrvRemoveSecretFromList
0x180011310: "__cdecl _imp_NtTerminateProcess" __imp_NtTerminateProcess
0x18000A66C: SrvAddProviderNotifyEventToList
0x18001487C: "__cdecl _IMPORT_DESCRIPTOR_ncrypt" __IMPORT_DESCRIPTOR_ncrypt
0x18000AEF4: SrvRundownMemoryBufferList
0x180014840: "__cdecl _IMPORT_DESCRIPTOR_bcrypt" __IMPORT_DESCRIPTOR_bcrypt
0x18000C614: OpenCallerToken
0x18000A798: SrvDereferenceProvider
0x180011568: "GetKeyStorageInterface" ??_C@_0BH@IJGFAJFP@GetKeyStorageInterface?$AA@
0x180007C20: SrvCryptVerifySignature
0x180009EF0: s_SrvRpcCryptSetKeyProperty
0x1800049F4: LoadPopKeyFunctionTable
0x180012EB8: "s_NgcGetSymmetricPopKeyTransport" ??_C@_0CI@IJGFELFP@s_NgcGetSymmetricPopKeyTransport@
0x180011700: "GetHashInterface" ??_C@_0BB@BKDJOIGI@GetHashInterface?$AA@
0x1800112F8: "__cdecl _imp_RtlInitializeCriticalSection" __imp_RtlInitializeCriticalSection
0x180013538: "remotePassportAuthentication" ??_C@_1DK@FPMPFLOD@?$AAr?$AAe?$AAm?$AAo?$AAt?$AAe?$AAP?$AAa?$AAs?$AAs?$AAp?$AAo?$AAr?$AAt?$AAA?$AAu?$AAt?$AAh?$AAe?$AAn?$AAt?$AAi?$AAc?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x1800111E0: api-ms-win-service-core-l1-1-0_NULL_THUNK_DATA
0x180011260: "__cdecl _imp_NtAdjustPrivilegesToken" __imp_NtAdjustPrivilegesToken
0x180011128: "__cdecl _imp_EnterCriticalSection" __imp_EnterCriticalSection
0x180011158: "__cdecl _imp_ReleaseSRWLockShared" __imp_ReleaseSRWLockShared
0x180011100: api-ms-win-core-registry-l1-1-0_NULL_THUNK_DATA
0x18000B660: s_TokenBindingGenerateTpmKeyFromSoftware
0x1800166F0: g_ngcFuncLoadLock
0x1800092F0: s_SrvRpcCryptEnumAlgorithms
0x180011048: api-ms-win-core-errorhandling-l1-1-0_NULL_THUNK_DATA
0x180013058: "NTE_NO_MEMORY" ??_C@_0O@DOJBMNDF@NTE_NO_MEMORY?$AA@
0x1800116A8: "onecore\ds\security\cryptoapi\nc" ??_C@_0DF@JHBMEGKP@onecore?2ds?2security?2cryptoapi?2nc@
0x1800030DC: SrvFreeKey
0x180008A00: s_SrvRpcCryptCipherEncrypt
0x18000D68C: GetDomainRelevantKeyCharacteristics
0x180002330: s_SrvRpcCreateContext
0x180011760: "GetSignatureInterface" ??_C@_0BG@PPKIELNH@GetSignatureInterface?$AA@
0x1800110D0: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x180001010: s_SrvRpcCryptExportKey
0x180003230: DllMain
0x180009B00: s_SrvRpcCryptIsAlgSupported
0x1800132B0: "KeyIso" ??_C@_1O@ECEJLOJC@?$AAK?$AAe?$AAy?$AAI?$AAs?$AAo?$AA?$AA@
0x180010FD0: "__cdecl _imp_RpcServerInqBindings" __imp_RpcServerInqBindings
0x1800112D8: "__cdecl _imp__wcsicmp" __imp__wcsicmp
0x180009720: s_SrvRpcCryptFreeSecret
0x180011288: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x180011308: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x1800110A8: api-ms-win-core-libraryloader-l1-2-0_NULL_THUNK_DATA
0x18000A948: SrvLookupAndReferenceSecret
0x1800023F0: SrvCryptCreateContext
0x180007F00: WPP_SF_I
0x180009580: s_SrvRpcCryptFinalizeKey
0x180011038: "__cdecl _imp_GetLastError" __imp_GetLastError
0x1800111C0: "__cdecl _imp_ConvertSidToStringSidW" __imp_ConvertSidToStringSidW
0x180011058: "__cdecl _imp_DuplicateHandle" __imp_DuplicateHandle
0x180003538: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x180011270: "__cdecl _imp_EtwTraceMessage" __imp_EtwTraceMessage
0x1800134D0: WPP_136b2bdcac0e38533393541b4c639450_Traceguids
0x1800166B0: g_pLoadedProviderList
0x180011190: "__cdecl _imp_EqualSid" __imp_EqualSid
0x18000A3D0: s_SrvRpcCryptVerifySignature
0x180013298: "NULL" ??_C@_19CIJIHAKK@?$AAN?$AAU?$AAL?$AAL?$AA?$AA@
0x180011230: "__cdecl _imp_NCryptSetProperty" __imp_NCryptSetProperty
0x18000D724: GetUserSid
0x1800169D0: g_ngcFuncLoaded
0x180011698: WPP_8fe678b880893ec67965c8780d403d88_Traceguids
0x180011590: "NCRYPTPROV" ??_C@_1BG@OOKKENBP@?$AAN?$AAC?$AAR?$AAY?$AAP?$AAT?$AAP?$AAR?$AAO?$AAV?$AA?$AA@
0x180011018: "__cdecl _imp_RpcServerRegisterIf3" __imp_RpcServerRegisterIf3
0x1800112C8: "__cdecl _imp_RtlFreeHeap" __imp_RtlFreeHeap
0x1800134B8: "dwReturn" ??_C@_08KOCHCJLB@dwReturn?$AA@
0x180011188: "__cdecl _imp_DuplicateTokenEx" __imp_DuplicateTokenEx
0x180014804: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0
0x180011520: "MSSP/Client Process ID" ??_C@_1CO@BHAAFOPO@?$AAM?$AAS?$AAS?$AAP?$AA?1?$AAC?$AAl?$AAi?$AAe?$AAn?$AAt?$AA?5?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AA?5?$AAI?$AAD?$AA?$AA@
0x180016760: "struct _RTL_SRWLOCK g_ngcFuncLoadLock" ?g_ngcFuncLoadLock@@3U_RTL_SRWLOCK@@A
0x18000A2B0: s_SrvRpcCryptVerifyClaim
0x18000C990: WPP_SF_
0x180012E90: "s_NgcGetSymmetricPopKeyTransport" ??_C@_0CE@DEICOCAF@s_NgcGetSymmetricPopKeyTransport@
0x1800110A0: "__cdecl _imp_FreeLibrary" __imp_FreeLibrary
0x18000ABD8: SrvRemoveKeyFromList
0x18000D3A0: CheckKeyAccessRightInternal
0x1800115B0: "onecore\ds\security\cryptoapi\nc" ??_C@_0DK@GKFDINFA@onecore?2ds?2security?2cryptoapi?2nc@
0x180011148: "__cdecl _imp_AcquireSRWLockExclusive" __imp_AcquireSRWLockExclusive
0x1800130C8: "dwStatus" ??_C@_08CKEFPGDF@dwStatus?$AA@
0x18000C7F0: UninitializeLoader
0x1800030C0: NdrServerCallAll
0x18000A58C: SrvAddKeyToList
0x180012E10: "onecore\ds\security\cryptoapi\nc" ??_C@_0EB@GKGBKMGE@onecore?2ds?2security?2cryptoapi?2nc@
0x180011010: "__cdecl _imp_RpcImpersonateClient" __imp_RpcImpersonateClient
0x1800115A8: "Status" ??_C@_06PGDKHFME@Status?$AA@
0x180011040: "__cdecl _imp_SetLastError" __imp_SetLastError
0x180011088: "__cdecl _imp_GetModuleFileNameW" __imp_GetModuleFileNameW
0x180016720: SrvCryptContextList
0x1800052A0: s_GetSymmetricPopKeyTransportKey
0x180008BA0: s_SrvRpcCryptCreateClaim
0x180004F90: s_GetKeyAttestationForContainerService
0x1800148CC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0
0x180005C90: SrvCryptDecrypt
0x1800134B0: "lResult" ??_C@_07BJOHLHBC@lResult?$AA@
0x18000D178: CheckAppKeyStorageKeyAccessRight
0x1800022A0: SrvCryptLocalFree
0x180013088: "onecore\ds\security\cryptoapi\nc" ??_C@_0DK@IAKMBNAB@onecore?2ds?2security?2cryptoapi?2nc@
0x180005F10: SrvCryptDeriveKey
0x18000A070: s_SrvRpcCryptSetProviderProperty
0x180010FC0: "__cdecl _imp_SystemFunction040" __imp_SystemFunction040
0x1800130D8: "Security Descr" ??_C@_1BO@PJKBACG@?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?5?$AAD?$AAe?$AAs?$AAc?$AAr?$AA?$AA@
0x180011350: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x180011640: "dwError" ??_C@_07KEIALHHM@dwError?$AA@
0x180003092: RtlLookupFunctionEntry
0x1800013F0: SrvCryptOpenStorageProvider
0x1800134C4: "NULL" ??_C@_04HIBGFPH@NULL?$AA@
0x180016A40: "struct HINSTANCE__ * __ptr64 __ptr64 g_NgcPopKeyLibrary" ?g_NgcPopKeyLibrary@@3PEAUHINSTANCE__@@EA
0x1800025E0: SrvCryptRundownContext
0x180010FC8: CRYPTBASE_NULL_THUNK_DATA
0x180011178: "__cdecl _imp_GetTokenInformation" __imp_GetTokenInformation
0x18000307A: NtTerminateProcess
0x180011258: "__cdecl _imp_RtlNtStatusToDosError" __imp_RtlNtStatusToDosError
0x180012F40: "s_NgcSignWithSymmetricPopKey" ??_C@_0BN@DLMALNPG@s_NgcSignWithSymmetricPopKey?$AA@
0x180011228: "__cdecl _imp_NCryptFreeObject" __imp_NCryptFreeObject
0x180011170: api-ms-win-core-sysinfo-l1-1-0_NULL_THUNK_DATA
0x180005600: s_ImportSymmetricPopKey
0x180001310: s_SrvRpcCryptOpenStorageProvider
0x180005DF0: SrvCryptDeleteKey
0x180007D54: SrvFreeSecret
0x180013658: "login.live.com" ??_C@_1BO@INLCNCPF@?$AAl?$AAo?$AAg?$AAi?$AAn?$AA?4?$AAl?$AAi?$AAv?$AAe?$AA?4?$AAc?$AAo?$AAm?$AA?$AA@
0x180013250: "PCP_ALTERNATE_KEY_STORAGE_LOCATI" ??_C@_1EG@HAHIDIOJ@?$AAP?$AAC?$AAP?$AA_?$AAA?$AAL?$AAT?$AAE?$AAR?$AAN?$AAA?$AAT?$AAE?$AA_?$AAK?$AAE?$AAY?$AA_?$AAS?$AAT?$AAO?$AAR?$AAA?$AAG?$AAE?$AA_?$AAL?$AAO?$AAC?$AAA?$AAT?$AAI@
0x180011198: api-ms-win-security-base-l1-1-0_NULL_THUNK_DATA
0x1800134E0: "hResult" ??_C@_07JNKNLJOI@hResult?$AA@
0x180012D70: "NgcPopKeyServiceImage" ??_C@_1CM@DIAFAGOE@?$AAN?$AAg?$AAc?$AAP?$AAo?$AAp?$AAK?$AAe?$AAy?$AAS?$AAe?$AAr?$AAv?$AAi?$AAc?$AAe?$AAI?$AAm?$AAa?$AAg?$AAe?$AA?$AA@
0x180011648: WPP_19cc2af0146b3b25a0c4a9664d51d00d_Traceguids
0x180010FE8: "__cdecl _imp_RpcServerUseProtseqW" __imp_RpcServerUseProtseqW
0x18000844C: WPP_SF_dq
0x180016000: WPP_GLOBAL_Control
0x1800111A8: api-ms-win-security-capability-l1-1-0_NULL_THUNK_DATA
0x18000AC94: SrvRemoveProviderFromList
0x18001482C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0
0x180001BD0: SrvCryptImportKey
0x1800080A8: "__cdecl GetClientProcessHandle" _GetClientProcessHandle
0x18000B7E0: "long __cdecl KeyIsoServiceMain(unsigned long,unsigned short * __ptr64 * __ptr64,struct _LSAP_SERVICE_STOP_CALLBACK_CONTEXT * __ptr64)" ?KeyIsoServiceMain@@YAJKPEAPEAGPEAU_LSAP_SERVICE_STOP_CALLBACK_CONTEXT@@@Z
0x1800112D0: "__cdecl _imp_RtlCompareUnicodeString" __imp_RtlCompareUnicodeString
0x180011138: "__cdecl _imp_DeleteCriticalSection" __imp_DeleteCriticalSection
0x180002DF0: "__cdecl _security_check_cookie" __security_check_cookie
0x180011208: "__cdecl _imp_BCryptExportKey" __imp_BCryptExportKey
0x180012F80: "s_NgcGetKeyAttestationForContain" ??_C@_0CK@BGPGPDGK@s_NgcGetKeyAttestationForContain@
0x180014818: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0
0x1800110E0: api-ms-win-core-processthreads-l1-1-0_NULL_THUNK_DATA
0x180011098: "__cdecl _imp_GetProcAddress" __imp_GetProcAddress
0x180002300: SrvCryptLocalAlloc
0x180012548: "RSA" ??_C@_17CEGMJBCM@?$AAR?$AAS?$AAA?$AA?$AA@
0x180016A84: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUwhUhvxfirgbUmtxUxlnnlmUpvbzxxvhhxsvxpUoryUlyquivUznwGEUkivxlnkOlyq@ngckeyaccesscheck" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUwhUhvxfirgbUmtxUxlnnlmUpvbzxxvhhxsvxpUoryUlyquivUznwGEUkivxlnkOlyq@ngckeyaccesscheck
0x1800136A0: "FIDO_AUTHENTICATOR" ??_C@_1CG@OEDEDMCA@?$AAF?$AAI?$AAD?$AAO?$AA_?$AAA?$AAU?$AAT?$AAH?$AAE?$AAN?$AAT?$AAI?$AAC?$AAA?$AAT?$AAO?$AAR?$AA?$AA@
0x180009180: s_SrvRpcCryptEncrypt
0x18000C04C: WppCleanupUm
0x1800033B0: NormalizeNteStatus
0x1800017F0: s_SrvRpcCryptFreeProvider
0x1800131D0: "SecStatus" ??_C@_09JCGPJMDE@SecStatus?$AA@
0x18000C9C0: WPP_SF_qSD
0x18000D4D0: GetAppSid
0x180011068: "__cdecl _imp_LocalAlloc" __imp_LocalAlloc
0x180011278: "__cdecl _imp_EtwGetTraceEnableLevel" __imp_EtwGetTraceEnableLevel
0x18000C89C: UnloadProvider
0x18000A8AC: SrvLookupAndReferenceProvider
0x180008DF0: s_SrvRpcCryptDecrypt
0x180009CE0: s_SrvRpcCryptNotifyChangeKey
0x18000A74C: SrvDereferenceKey
0x1800111D8: "__cdecl _imp_SetServiceStatus" __imp_SetServiceStatus
0x180012E80: "GetLastError()" ??_C@_0P@OLMLMBJL@GetLastError?$CI?$CJ?$AA@
0x180012E58: "s_NgcDeleteSymmetricPopKeyTransp" ??_C@_0CH@HLKIAJCB@s_NgcDeleteSymmetricPopKeyTransp@
0x180005470: s_GetSymmetricPopKeyTransportKeyName
0x1800111F0: "__cdecl _imp_BCryptFreeBuffer" __imp_BCryptFreeBuffer
0x180011360: "__cdecl _guard_fids_table" __guard_fids_table
0x18000B464: TokenBindingGenerateSoftwareKeyAndImportIntoTpm
0x18000E010: "__cdecl load_config_used" _load_config_used
0x180012FB0: "s_NgcRenewKeyAttestation" ??_C@_0BJ@CKILMNIP@s_NgcRenewKeyAttestation?$AA@
0x180014890: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-sddl-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-sddl-l1-1-0
0x180004E40: s_EncryptWithSymmetricPopKey
0x180004CD0: s_DeleteSymmetricPopKeyTransportKey
0x1800079B0: SrvCryptVerifyClaim
0x1800148E0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processenvironment-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processenvironment-l1-1-0
0x180011788: "GetKeyDerivationInterface" ??_C@_0BK@BMPPCKFB@GetKeyDerivationInterface?$AA@
0x1800058E0: SrvCryptCreateClaim
0x180013010: "onecore\ds\security\cryptoapi\nc" ??_C@_0ED@FFPIAEJF@onecore?2ds?2security?2cryptoapi?2nc@
0x1800084EC: "__cdecl SrvAdjustPrivilege" _SrvAdjustPrivilege
0x18000D2F4: CheckKeyAccessRight
0x180001AA0: s_SrvRpcCryptImportKey
0x180006A60: SrvCryptFinalizeKey
0x180011328: "__cdecl _imp_NtClose" __imp_NtClose
0x180011300: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x1800169E0: "struct _NGCPOPKEY_FUNCTION_TABLE g_NgcPopKeyFunctions" ?g_NgcPopKeyFunctions@@3U_NGCPOPKEY_FUNCTION_TABLE@@A
0x180012F60: "s_NgcVerifyWithSymmetricPopKey" ??_C@_0BP@DBMLPGKG@s_NgcVerifyWithSymmetricPopKey?$AA@
0x1800028C0: SrvCryptOpenKey
0x180012EE0: "s_NgcImportSymmetricPopKey" ??_C@_0BL@JMGAKKHC@s_NgcImportSymmetricPopKey?$AA@
0x180011330: "__cdecl _imp_EtwGetTraceEnableFlags" __imp_EtwGetTraceEnableFlags
0x180013470: "onecore\ds\security\cryptoapi\nc" ??_C@_0DL@ILLMCFPK@onecore?2ds?2security?2cryptoapi?2nc@
0x180011150: "__cdecl _imp_InitializeSRWLock" __imp_InitializeSRWLock
0x18000C798: InitializeLoader
0x180011248: "__cdecl _imp_RtlLeaveCriticalSection" __imp_RtlLeaveCriticalSection
0x180008058: "__cdecl FreeBufferDesc" _FreeBufferDesc
0x180008210: "__cdecl MapRPCToBufferDesc" _MapRPCToBufferDesc
0x1800112B0: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x180007100: SrvCryptNotifyChangeKey
0x180012FD0: "s_NgcGetPregenUserKey" ??_C@_0BG@LEMANABF@s_NgcGetPregenUserKey?$AA@
0x180002BB0: MIDL_user_allocate
0x1800132D0: "Ngc Pop Key Service" ??_C@_1CI@MPIKAMDI@?$AAN?$AAg?$AAc?$AA?5?$AAP?$AAo?$AAp?$AA?5?$AAK?$AAe?$AAy?$AA?5?$AAS?$AAe?$AAr?$AAv?$AAi?$AAc?$AAe?$AA?$AA@
0x180003520: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x1800110B0: "__cdecl _imp_ExpandEnvironmentStringsW" __imp_ExpandEnvironmentStringsW
0x180011168: "__cdecl _imp_GetSystemDirectoryW" __imp_GetSystemDirectoryW
0x180013054: "hr" ??_C@_02FLHDKHAB@hr?$AA@
0x180013180: "onecore\ds\security\cryptoapi\nc" ??_C@_0EJ@IPONPJHK@onecore?2ds?2security?2cryptoapi?2nc@
0x1800027C0: s_SrvRpcCryptOpenKey
0x180011210: "__cdecl _imp_BCryptGenerateKeyPair" __imp_BCryptGenerateKeyPair
0x18000C278: GetFullPath
0x180013678: "login.windows.net" ??_C@_1CE@HFFJFIOF@?$AAl?$AAo?$AAg?$AAi?$AAn?$AA?4?$AAw?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?4?$AAn?$AAe?$AAt?$AA?$AA@
0x1800111B8: "__cdecl _imp_ConvertStringSecurityDescriptorToSecurityDescriptorW" __imp_ConvertStringSecurityDescriptorToSecurityDescriptorW
0x180010FF0: "__cdecl _imp_RpcServerUnregisterIfEx" __imp_RpcServerUnregisterIfEx
0x180014854: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0
0x1800015D0: LoadProviderEx
0x180006590: SrvCryptEnumKeys
0x180013068: "tmpStatus" ??_C@_09HGACBAEN@tmpStatus?$AA@
0x180006BB0: SrvCryptFreeSecret
0x180010FF8: "__cdecl _imp_RpcBindingVectorFree" __imp_RpcBindingVectorFree
0x1800166C0: g_csLoaderLock
0x1800112A8: "__cdecl _imp_RtlUnhandledExceptionFilter" __imp_RtlUnhandledExceptionFilter
0x180011000: "__cdecl _imp_I_RpcBindingInqLocalClientPID" __imp_I_RpcBindingInqLocalClientPID
0x180011348: ntdll_NULL_THUNK_DATA
0x180011338: "__cdecl _imp_memcpy" __imp_memcpy
0x18000A4F0: s_SrvRpcReleaseContext
0x1800057A0: s_RenewKeyAttestation
0x1800060A0: SrvCryptEncrypt
0x18000AFA4: SrvRundownProviderList
0x18000CA64: WPP_SF_qSq
0x18000CFE0: CanAccessAllKeys
0x1800147F0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0
0x18000C3C0: GetImagePathInReg
0x18000C6D0: WPP_SF_sDsd
0x180016130: "__cdecl _security_cookie" __security_cookie
0x1800110E8: "__cdecl _imp_RegQueryValueExW" __imp_RegQueryValueExW
0x1800050B0: s_GetPregenKeyState
0x180011778: "GetRngInterface" ??_C@_0BA@BFGABNCK@GetRngInterface?$AA@
0x180011050: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x180011070: "__cdecl _imp_LocalFree" __imp_LocalFree
0x1800147DC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0
0x180008CC0: s_SrvRpcCryptCreatePersistedKey
0x180013200: "Microsoft Platform Crypto Provid" ??_C@_1EG@LKLLOCAK@?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?5?$AAP?$AAl?$AAa?$AAt?$AAf?$AAo?$AAr?$AAm?$AA?5?$AAC?$AAr?$AAy?$AAp?$AAt?$AAo?$AA?5?$AAP?$AAr?$AAo?$AAv?$AAi?$AAd@
0x180005190: s_GetPregenUserKey
0x180011240: ncrypt_NULL_THUNK_DATA
0x18000B208: WPP_SF_qd
0x180011008: "__cdecl _imp_RpcRevertToSelf" __imp_RpcRevertToSelf
0x1800110C8: "__cdecl _imp_GetCurrentThread" __imp_GetCurrentThread
0x18000B25C: WPP_SF_qq
0x18000BFE0: WPP_SF_qS
0x180006F90: SrvCryptKeyDerivation
0x1800135E8: "sharedUserCertificates" ??_C@_1CO@MPFOBCGE@?$AAs?$AAh?$AAa?$AAr?$AAe?$AAd?$AAU?$AAs?$AAe?$AAr?$AAC?$AAe?$AAr?$AAt?$AAi?$AAf?$AAi?$AAc?$AAa?$AAt?$AAe?$AAs?$AA?$AA@
0x180011238: "__cdecl _imp_NCryptImportKey" __imp_NCryptImportKey
0x1800111E8: "__cdecl _imp_BCryptFinalizeKeyPair" __imp_BCryptFinalizeKeyPair
0x1800110F0: "__cdecl _imp_RegOpenKeyExW" __imp_RegOpenKeyExW
0x180002F90: "__cdecl _security_init_cookie" __security_init_cookie
0x1800084A4: WPP_SF_q
0x180001140: SrvCryptExportKey
0x1800148A4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-service-core-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-service-core-l1-1-0
0x180011658: "onecore\ds\security\cryptoapi\nc" ??_C@_0DM@KOBMJAHH@onecore?2ds?2security?2cryptoapi?2nc@
0x180011550: "KEY_STORAGE" ??_C@_1BI@EFGFPGGA@?$AAK?$AAE?$AAY?$AA_?$AAS?$AAT?$AAO?$AAR?$AAA?$AAG?$AAE?$AA?$AA@
0x180016010: IsolationServerFunctionTable
0x18000B2AC: TokenBindingGenerateBCryptKeyBlob
0x1800035D5: wcscmp
0x180011718: "GetAsymmetricEncryptionInterface" ??_C@_0CB@FFCMDJPG@GetAsymmetricEncryptionInterface@
0x1800111C8: api-ms-win-security-sddl-l1-1-0_NULL_THUNK_DATA
0x18000309E: RtlVirtualUnwind
0x1800130F8: WPP_446350a8d0da31424f6ea917fa90ade2_Traceguids
0x1800132A4: "status" ??_C@_06DJIHEMFI@status?$AA@
0x1800147C8: "__cdecl _IMPORT_DESCRIPTOR_RPCRT4" __IMPORT_DESCRIPTOR_RPCRT4
0x180011740: "GetSecretAgreementInterface" ??_C@_0BM@MOBGJCDL@GetSecretAgreementInterface?$AA@
0x1800117C8: "GetSChannelInterface" ??_C@_0BF@KINJPDKM@GetSChannelInterface?$AA@
0x180011290: "__cdecl _imp_RtlDeleteCriticalSection" __imp_RtlDeleteCriticalSection
0x1800075C0: SrvCryptSetKeyProperty
0x180011030: RPCRT4_NULL_THUNK_DATA
0x180003180: SrvFreeProvider
0x180011580: "SKCacheFlush" ??_C@_0N@OJGKJAIE@SKCacheFlush?$AA@
0x180002E40: "__cdecl _report_gsfailure" __report_gsfailure
0x180006C30: SrvCryptGetKeyProperty
0x180012F20: "s_NgcDecryptWithSymmetricPopKey" ??_C@_0CA@GAIHLPOA@s_NgcDecryptWithSymmetricPopKey?$AA@
0x18000A9EC: SrvLookupMemoryBufferFromList
0x180011120: "__cdecl _imp_LeaveCriticalSection" __imp_LeaveCriticalSection
0x180006B20: SrvCryptFreeBuffer
0x18000C544: LoadDllBasedOnRegistryValue
0x180008338: "__cdecl RPCClientDuplicateHandle" _RPCClientDuplicateHandle
0x18000CB08: WPP_SF_qqSD
0x180008F60: s_SrvRpcCryptDeleteKey
0x18000A160: s_SrvRpcCryptSignHash
0x180013500: "NTE_FAIL" ??_C@_08OCLNAKPD@NTE_FAIL?$AA@
0x1800110D8: "__cdecl _imp_OpenThreadToken" __imp_OpenThreadToken
0x18000ACF4: SrvRemoveProviderNotifyEventFromList
0x1800134E8: "ncrypt.dll" ??_C@_1BG@FGGJGPDG@?$AAn?$AAc?$AAr?$AAy?$AAp?$AAt?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x180013078: WPP_e41edbd465923f3df4ce88b8e28bbf02_Traceguids
0x180005AB0: SrvCryptCreatePersistedKey
0x180007E80: StringCchLengthW
0x180011020: "__cdecl _imp_NdrServerCall2" __imp_NdrServerCall2
0x1800112C0: "__cdecl _imp_RtlSizeHeap" __imp_RtlSizeHeap
0x18000D5CC: IsAppContainer
0x180013000: WPP_ThisDir_CTLGUID_CNGTraceControlGuid
0x180013618: "windowsHelloCredentialAccess" ??_C@_1DK@OHAPJCNE@?$AAw?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AAH?$AAe?$AAl?$AAl?$AAo?$AAC?$AAr?$AAe?$AAd?$AAe?$AAn?$AAt?$AAi?$AAa?$AAl?$AAA?$AAc?$AAc?$AAe?$AAs?$AAs?$AA?$AA@
0x1800110C0: "__cdecl _imp_OpenProcessToken" __imp_OpenProcessToken
0x180011160: api-ms-win-core-synch-l1-1-0_NULL_THUNK_DATA
0x180002E14: "__cdecl DllMainCRTStartupForGS2" _DllMainCRTStartupForGS2
0x18000B154: SrvRundownSecretList
0x1800035C9: memset
0x18001491C: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x180007EDC: ULongLongMult

[JEB Decompiler by PNF Software]