Generated by JEB on 2019/08/01

PE: C:\Windows\System32\drivers\ipt.sys Base=0x1C0000000 SHA-256=8A841A2A563682CE93777348E0CCFFA856FA11689D4F4897C6100A26D5795AD2
PDB: ipt.pdb GUID={5A305009-BBA7-3540-4C47B4FEB4CD211A} Age=1

260 located named symbols:
0x1C0003918: "RC" ??_C@_15IGNKAAHD@?$AAR?$AAC?$AA?$AA@
0x1C0003808: "Start" ??_C@_1M@IOJLKPKK@?$AAS?$AAt?$AAa?$AAr?$AAt?$AA?$AA@
0x1C000115C: IptQueryProcessTrace
0x1C00071D8: "__cdecl _imp_PsGetThreadProcess" __imp_PsGetThreadProcess
0x1C0003520: "WriteCoreTraceMetadataV1" ??_C@_0BJ@NPJMCKDP@WriteCoreTraceMetadataV1?$AA@
0x1C0003720: "\Registry\Machine\Software\Micro" ??_C@_1LI@FFKDHKIH@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x1C0003838: "\Device\IPT" ??_C@_1BI@JCJLLHAP@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAI?$AAP?$AAT?$AA?$AA@
0x1C000BD98: SepSddlGetAclForString
0x1C00072B8: "__cdecl _imp_RtlFreeUnicodeString" __imp_RtlFreeUnicodeString
0x1C00070B0: "__cdecl _imp_ZwGetNextThread" __imp_ZwGetNextThread
0x1C0005168: "__cdecl _security_cookie_complement" __security_cookie_complement
0x1C0007038: "__cdecl _imp_ObfDereferenceObject" __imp_ObfDereferenceObject
0x1C00052F0: PfnIoCreateDeviceSecure
0x1C0007000: "__cdecl _imp_KeInitializeTriageDumpDataArray" __imp_KeInitializeTriageDumpDataArray
0x1C0003408: "IptTraceUntil" ??_C@_1BM@GENFCMK@?$AAI?$AAp?$AAt?$AAT?$AAr?$AAa?$AAc?$AAe?$AAU?$AAn?$AAt?$AAi?$AAl?$AA?$AA@
0x1C0007060: "__cdecl _imp_MmAllocateContiguousNodeMemory" __imp_MmAllocateContiguousNodeMemory
0x1C0007130: "__cdecl _imp_KeIpiGenericCall" __imp_KeIpiGenericCall
0x1C0007098: "__cdecl _imp_MmGetPhysicalAddress" __imp_MmGetPhysicalAddress
0x1C0007058: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x1C0001C30: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x1C0001A5C: IptQueryCoreTrace
0x1C000A53C: IptServiceNeededForUserTracing
0x1C0003148: "AllocateToPA" ??_C@_0N@NFFDCCOH@AllocateToPA?$AA@
0x1C0007108: "__cdecl _imp_ZwEnumerateKey" __imp_ZwEnumerateKey
0x1C0007228: "__cdecl _imp_IoCreateDevice" __imp_IoCreateDevice
0x1C0007230: "__cdecl _imp_IoDeviceObjectType" __imp_IoDeviceObjectType
0x1C0003920: "WD" ??_C@_15ELMAKJHJ@?$AAW?$AAD?$AA?$AA@
0x1C0007208: "__cdecl _imp_IofCompleteRequest" __imp_IofCompleteRequest
0x1C0007278: "__cdecl _imp_RtlCreateSecurityDescriptor" __imp_RtlCreateSecurityDescriptor
0x1C000B720: IoDevObjCreateDeviceSecure
0x1C0007268: "__cdecl _imp_wcschr" __imp_wcschr
0x1C0001280: BugCheckTriageDumpDataCallback
0x1C00072D0: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x1C00052FC: PiRegStateDiscriptor
0x1C00072A8: "__cdecl _imp_RtlGetOwnerSecurityDescriptor" __imp_RtlGetOwnerSecurityDescriptor
0x1C0007270: "__cdecl _imp__wcsnicmp" __imp__wcsnicmp
0x1C000B8CC: IopDevObjApplyPostCreationSettings
0x1C0007140: "__cdecl _imp_ExAcquirePushLockSharedEx" __imp_ExAcquirePushLockSharedEx
0x1C00036C0: "[%s] Data request. SecondaryDump" ??_C@_0FH@KNNKJGAF@?$FL?$CFs?$FN?5Data?5request?4?5SecondaryDump@
0x1C0007220: "__cdecl _imp_MmGetSystemRoutineAddress" __imp_MmGetSystemRoutineAddress
0x1C0003680: "[%s] Size request. SecondaryDump" ??_C@_0DI@FHOOKFCH@?$FL?$CFs?$FN?5Size?5request?4?5SecondaryDump@
0x1C00033E8: "IptIgnoreCheck" ??_C@_1BO@DCPHOLLH@?$AAI?$AAp?$AAt?$AAI?$AAg?$AAn?$AAo?$AAr?$AAe?$AAC?$AAh?$AAe?$AAc?$AAk?$AA?$AA@
0x1C00094D4: IptStopProcessTrace
0x1C0003940: "GR" ??_C@_15DNGEKDKB@?$AAG?$AAR?$AA?$AA@
0x1C0007190: "__cdecl _imp_KeWaitForSingleObject" __imp_KeWaitForSingleObject
0x1C0001C40: memcpy
0x1C0007188: "__cdecl _imp_PsGetCurrentThreadId" __imp_PsGetCurrentThreadId
0x1C00071F8: "__cdecl _imp_IoRegisterShutdownNotification" __imp_IoRegisterShutdownNotification
0x1C00070D0: "__cdecl _imp_PsSetCreateProcessNotifyRoutineEx" __imp_PsSetCreateProcessNotifyRoutineEx
0x1C000BBE0: SepSddlDaclFromSDDLString
0x1C00071A0: "__cdecl _imp_ZwSetValueKey" __imp_ZwSetValueKey
0x1C00071E0: "__cdecl _imp_IoDeleteDevice" __imp_IoDeleteDevice
0x1C0007260: "__cdecl _imp_RtlAbsoluteToSelfRelativeSD" __imp_RtlAbsoluteToSelfRelativeSD
0x1C000A720: IptStartTraceOnEachCoreForEtw
0x1C0007148: "__cdecl _imp_KeEnterGuardedRegion" __imp_KeEnterGuardedRegion
0x1C0007018: "__cdecl _imp_KeInitializeApc" __imp_KeInitializeApc
0x1C00035F0: "BugCheckSecondaryDumpDataCallbac" ??_C@_0CC@NGECNJPI@BugCheckSecondaryDumpDataCallbac@
0x1C0001C40: memmove
0x1C000BA64: SepSddlSecurityDescriptorFromSDDLString
0x1C0003850: "IoCreateDeviceSecure" ??_C@_1CK@LEEDIGFP@?$AAI?$AAo?$AAC?$AAr?$AAe?$AAa?$AAt?$AAe?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAS?$AAe?$AAc?$AAu?$AAr?$AAe?$AA?$AA@
0x1C0009E24: OpenIptServiceKey
0x1C0001BBC: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x1C00071A8: "__cdecl _imp_KeQueryActiveProcessorCountEx" __imp_KeQueryActiveProcessorCountEx
0x1C0003310: "\Registry\Machine\System\Current" ??_C@_1KI@MIGMKAEH@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1C000C27C: SepSddlParseWideStringUlong
0x1C00031C0: "[%s] MmAllocatePagesForMdlEx fai" ??_C@_0HD@IBFLAENK@?$FL?$CFs?$FN?5MmAllocatePagesForMdlEx?5fai@
0x1C0007110: "__cdecl _imp_ExUnregisterExtension" __imp_ExUnregisterExtension
0x1C0003950: "GX" ??_C@_15FCNJEDMF@?$AAG?$AAX?$AA?$AA@
0x1C0003928: "WO" ??_C@_15JMMBCOHI@?$AAW?$AAO?$AA?$AA@
0x1C0007210: "__cdecl _imp_IoCreateSymbolicLink" __imp_IoCreateSymbolicLink
0x1C0007138: "__cdecl _imp_ExAllocatePoolWithTag" __imp_ExAllocatePoolWithTag
0x1C0001580: BugCheckSecondaryDumpDataCallback
0x1C00070B8: "__cdecl _imp_PsGetCurrentProcessId" __imp_PsGetCurrentProcessId
0x1C0007290: "__cdecl _imp__snwprintf" __imp__snwprintf
0x1C00039CC: "A" ??_C@_13PNBDBPLL@?$AAA?$AA?$AA@
0x1C0007298: "__cdecl _imp_SeCaptureSecurityDescriptor" __imp_SeCaptureSecurityDescriptor
0x1C00071C8: "__cdecl _imp_KeLeaveCriticalRegion" __imp_KeLeaveCriticalRegion
0x1C0007178: "__cdecl _imp_MmUnmapLockedPages" __imp_MmUnmapLockedPages
0x1C0001B98: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x1C0007258: "__cdecl _imp_RtlAddAccessAllowedAce" __imp_RtlAddAccessAllowedAce
0x1C0003818: "\DosDevices\IPT" ??_C@_1CA@DAOKCFAI@?$AA?2?$AAD?$AAo?$AAs?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAs?$AA?2?$AAI?$AAP?$AAT?$AA?$AA@
0x1C0007280: "__cdecl _imp_SeExports" __imp_SeExports
0x1C0007170: "__cdecl _imp_KfRaiseIrql" __imp_KfRaiseIrql
0x1C00070F8: "__cdecl _imp_ExReleasePushLockSharedEx" __imp_ExReleasePushLockSharedEx
0x1C00071B0: "__cdecl _imp_KeAddTriageDumpDataBlock" __imp_KeAddTriageDumpDataBlock
0x1C00071E8: "__cdecl _imp_IoDeleteSymbolicLink" __imp_IoDeleteSymbolicLink
0x1C000CE9C: CmRegUtilWstrValueGetDword
0x1C0003880: "IoValidateDeviceIoControlAccess" ??_C@_1EA@BAHCLPHE@?$AAI?$AAo?$AAV?$AAa?$AAl?$AAi?$AAd?$AAa?$AAt?$AAe?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAI?$AAo?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAA?$AAc?$AAc?$AAe?$AAs?$AAs?$AA?$AA@
0x1C000986C: IptResumeThreadTrace
0x1C00037D8: "IPT" ??_C@_03IKMMIBLE@IPT?$AA@
0x1C0007288: "__cdecl _imp_RtlLengthSecurityDescriptor" __imp_RtlLengthSecurityDescriptor
0x1C0003930: "SD" ??_C@_15NAFBOLGP@?$AAS?$AAD?$AA?$AA@
0x1C000CC24: CmRegUtilUcValueSetUcString
0x1C000B9A0: SeSddlSecurityDescriptorFromSDDL
0x1C00072B0: "__cdecl _imp_RtlGetGroupSecurityDescriptor" __imp_RtlGetGroupSecurityDescriptor
0x1C0003AB0: "\Registry\Machine\System\Current" ??_C@_1HC@DKINPPAJ@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1C00095D8: IptGetProcessTrace
0x1C00053B0: IptSessionList
0x1C000CD68: CmRegUtilOpenExistingWstrKey
0x1C00071D0: "__cdecl _imp_KeGetCurrentProcessorNumberEx" __imp_KeGetCurrentProcessorNumberEx
0x1C00033B8: "IptOption" ??_C@_1BE@NOGLCDHI@?$AAI?$AAp?$AAt?$AAO?$AAp?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x1C000C52C: PiRegStateReadStackCreationSettingsFromKey
0x1C000C6FC: PiRegStateOpenClassKey
0x1C0007100: "__cdecl _imp_KeDeregisterBugCheckReasonCallback" __imp_KeDeregisterBugCheckReasonCallback
0x1C0001AE4: WdmlibRtlInitUnicodeStringEx
0x1C0003630: "[%s] SecondaryDump->MaximumAllow" ??_C@_0EJ@JEOBFHND@?$FL?$CFs?$FN?5SecondaryDump?9?$DOMaximumAllow@
0x1C0003A30: "Security" ??_C@_1BC@FCJNIDNL@?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?$AA@
0x1C00038C0: SDDL_DEVOBJ_SYS_ALL_ADM_RWX_WORLD_R_buffer
0x1C000D540: GsDriverEntry
0x1C00072C8: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x1C0008970: RunOnEachThread
0x1C000C380: PpRegStateReadCreateClassCreationSettings
0x1C000BCC0: SepSddlGetSidForString
0x1C0003A48: "DeviceType" ??_C@_1BG@KCOOGCNN@?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x1C00070E8: "__cdecl _imp_ObReferenceObjectByHandle" __imp_ObReferenceObjectByHandle
0x1C00070F0: "__cdecl _imp_ExRegisterExtension" __imp_ExRegisterExtension
0x1C000ACD4: IptDestroy
0x1C0003B30: "{%08X-%04X-%04X-%02X%02X-%02X%02" ??_C@_1GG@FCALANDO@?$AA?$HL?$AA?$CF?$AA0?$AA8?$AAX?$AA?9?$AA?$CF?$AA0?$AA4?$AAX?$AA?9?$AA?$CF?$AA0?$AA4?$AAX?$AA?9?$AA?$CF?$AA0?$AA2?$AAX?$AA?$CF?$AA0?$AA2?$AAX?$AA?9?$AA?$CF?$AA0?$AA2?$AAX?$AA?$CF?$AA0?$AA2@
0x1C0003140: "IPT: " ??_C@_05KGGOBGCC@IPT?3?5?$AA@
0x1C0007080: "__cdecl _imp_MmFreeContiguousMemory" __imp_MmFreeContiguousMemory
0x1C0007048: PsProcessType
0x1C0007150: "__cdecl _imp_ZwQueryValueKey" __imp_ZwQueryValueKey
0x1C0003938: "GA" ??_C@_15HPMIFLNA@?$AAG?$AAA?$AA?$AA@
0x1C0007008: "__cdecl _imp_MmAllocatePagesForMdlEx" __imp_MmAllocatePagesForMdlEx
0x1C0001B40: "__cdecl _security_check_cookie" __security_check_cookie
0x1C00072D8: "__cdecl _IMPORT_DESCRIPTOR_ntoskrnl" __IMPORT_DESCRIPTOR_ntoskrnl
0x1C0007070: "__cdecl _imp_PsRemoveCreateThreadNotifyRoutine" __imp_PsRemoveCreateThreadNotifyRoutine
0x1C0003240: "[%s] MmGetSystemAddressForMdlSaf" ??_C@_0FD@JGGKEMBC@?$FL?$CFs?$FN?5MmGetSystemAddressForMdlSaf@
0x1C0007010: "__cdecl _imp_KeLeaveGuardedRegion" __imp_KeLeaveGuardedRegion
0x1C0007078: "__cdecl _imp_KeRegisterBugCheckReasonCallback" __imp_KeRegisterBugCheckReasonCallback
0x1C00032A0: "\Registry\Machine\System\Current" ??_C@_1HA@HAPNBPDM@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1C00070E0: "__cdecl _imp_KeInsertQueueApc" __imp_KeInsertQueueApc
0x1C0003960: "SeConvertStringSecurityDescripto" ??_C@_1GM@JINLDKKK@?$AAS?$AAe?$AAC?$AAo?$AAn?$AAv?$AAe?$AAr?$AAt?$AAS?$AAt?$AAr?$AAi?$AAn?$AAg?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AAD?$AAe?$AAs?$AAc?$AAr?$AAi?$AAp?$AAt?$AAo@
0x1C0007040: "__cdecl _imp_RtlHashUnicodeString" __imp_RtlHashUnicodeString
0x1C000E000: "__cdecl _guard_fids_table" __guard_fids_table
0x1C0007238: "__cdecl _imp_ZwSetSecurityObject" __imp_ZwSetSecurityObject
0x1C0001860: IptLogTraceOnCurrentCore
0x1C0003030: "__cdecl load_config_used" _load_config_used
0x1C00039D0: "Properties" ??_C@_1BG@COALCEMK@?$AAP?$AAr?$AAo?$AAp?$AAe?$AAr?$AAt?$AAi?$AAe?$AAs?$AA?$AA@
0x1C00070C8: PsThreadType
0x1C00033D0: "IptNumTries" ??_C@_1BI@FNKNDAJO@?$AAI?$AAp?$AAt?$AAN?$AAu?$AAm?$AAT?$AAr?$AAi?$AAe?$AAs?$AA?$AA@
0x1C0007198: "__cdecl _imp_ZwClose" __imp_ZwClose
0x1C00070A8: "__cdecl _imp_ExReleasePushLockExclusiveEx" __imp_ExReleasePushLockExclusiveEx
0x1C0007050: "__cdecl _imp_PsGetProcessId" __imp_PsGetProcessId
0x1C000C17C: SepSddlAddAceToAcl
0x1C0007028: "__cdecl _imp_RtlQueryPackageIdentity" __imp_RtlQueryPackageIdentity
0x1C00037F0: GUID_IPT
0x1C000932C: IptStartProcessTrace
0x1C00053A0: IptProcessList
0x1C000CDE4: CmRegUtilCreateWstrKey
0x1C0007168: "__cdecl _imp_KeInitializeEvent" __imp_KeInitializeEvent
0x1C00070A0: "__cdecl _imp_ObOpenObjectByPointer" __imp_ObOpenObjectByPointer
0x1C0007118: "__cdecl _imp_MmGetVirtualForPhysical" __imp_MmGetVirtualForPhysical
0x1C00072A0: "__cdecl _imp_RtlGetSaclSecurityDescriptor" __imp_RtlGetSaclSecurityDescriptor
0x1C00039F8: "NoDisplayClass" ??_C@_1BO@DAOBINHA@?$AAN?$AAo?$AAD?$AAi?$AAs?$AAp?$AAl?$AAa?$AAy?$AAC?$AAl?$AAa?$AAs?$AAs?$AA?$AA@
0x1C0003618: "[%s] Entered " ??_C@_0O@GMCEOPKB@?$FL?$CFs?$FN?5Entered?6?$AA@
0x1C0003018: SDDL_DEVOBJ_SYS_ALL_ADM_RWX_WORLD_R
0x1C0007218: "__cdecl _imp_RtlGetDaclSecurityDescriptor" __imp_RtlGetDaclSecurityDescriptor
0x1C000C88C: PpRegStateUpdateStackCreationSettings
0x1C0007248: "__cdecl _imp_IoIsWdmVersionAvailable" __imp_IoIsWdmVersionAvailable
0x1C0003A60: "DeviceCharacteristics" ??_C@_1CM@DIJFBEC@?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAC?$AAh?$AAa?$AAr?$AAa?$AAc?$AAt?$AAe?$AAr?$AAi?$AAs?$AAt?$AAi?$AAc?$AAs?$AA?$AA@
0x1C0003448: "[%s] CoreTracing == %u, IptCoreT" ??_C@_0DL@OLPNDAFM@?$FL?$CFs?$FN?5CoreTracing?5?$DN?$DN?5?$CFu?0?5IptCoreT@
0x1C00052C0: PiRegStateSysAllInherittedSecurityDescriptor
0x1C00052F8: WdmlibInitialized
0x1C0001B80: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x1C000B640: WdmlibIoCreateDeviceSecure
0x1C0007180: "__cdecl _imp_MmMapLockedPagesSpecifyCache" __imp_MmMapLockedPagesSpecifyCache
0x1C0007020: "__cdecl _imp_vDbgPrintExWithPrefix" __imp_vDbgPrintExWithPrefix
0x1C0007120: "__cdecl _imp_PsReferencePrimaryToken" __imp_PsReferencePrimaryToken
0x1C0007128: "__cdecl _imp_PsGetCurrentProcess" __imp_PsGetCurrentProcess
0x1C0003428: "BugCheckTriageDumpDataCallback" ??_C@_0BP@LONGJHEN@BugCheckTriageDumpDataCallback?$AA@
0x1C00039E8: "Class" ??_C@_1M@OAHBGIFG@?$AAC?$AAl?$AAa?$AAs?$AAs?$AA?$AA@
0x1C00097B4: IptPauseThreadTrace
0x1C0007088: "__cdecl _imp_PsSetCreateThreadNotifyRoutineEx" __imp_PsSetCreateThreadNotifyRoutineEx
0x1C0003540: "[%s] IptCoreTraceMetadata[%u] = " ??_C@_0KK@OAADIFME@?$FL?$CFs?$FN?5IptCoreTraceMetadata?$FL?$CFu?$FN?5?$DN?5@
0x1C0007048: "__cdecl _imp_PsProcessType" __imp_PsProcessType
0x1C00070C8: "__cdecl _imp_PsThreadType" __imp_PsThreadType
0x1C00071F0: "__cdecl _imp_ZwDeleteKey" __imp_ZwDeleteKey
0x1C0005160: "__cdecl _security_cookie" __security_cookie
0x1C0007158: "__cdecl _imp_MmFreePagesFromMdl" __imp_MmFreePagesFromMdl
0x1C00071C0: "__cdecl _imp_RtlCompareMemory" __imp_RtlCompareMemory
0x1C0003BA0: "__stdcall _xmm" __xmm@82028202820282028202820282028202
0x1C0003A90: "Exclusive" ??_C@_1BE@DJHAJDEM@?$AAE?$AAx?$AAc?$AAl?$AAu?$AAs?$AAi?$AAv?$AAe?$AA?$AA@
0x1C000ABF0: IptStopTraceOnEachCore
0x1C000CAE0: CmRegUtilUcValueGetFullBuffer
0x1C000A73C: IptStartTraceOnEachCoreForIoctl
0x1C0003A18: "NoUseClass" ??_C@_1BG@OPOOGLJC@?$AAN?$AAo?$AAU?$AAs?$AAe?$AAC?$AAl?$AAa?$AAs?$AAs?$AA?$AA@
0x1C000D574: "__cdecl _security_init_cookie" __security_init_cookie
0x1C00070C0: "__cdecl _imp_KeSetEvent" __imp_KeSetEvent
0x1C00017A0: IptTraceCurrentCore
0x1C000C9F8: SeUtilSecurityInfoFromSecurityDescriptor
0x1C0007230: IoDeviceObjectType
0x1C0007090: "__cdecl _imp_ExAcquirePushLockExclusiveEx" __imp_ExAcquirePushLockExclusiveEx
0x1C0003948: "GW" ??_C@_15KLKFDJD@?$AAG?$AAW?$AA?$AA@
0x1C000D008: IptInit
0x1C0007250: "__cdecl _imp_RtlLengthSid" __imp_RtlLengthSid
0x1C0001B70: "__cdecl _report_gsfailure" __report_gsfailure
0x1C00070D8: "__cdecl _imp_KeLowerIrql" __imp_KeLowerIrql
0x1C0007068: "__cdecl _imp_ZwCreateKey" __imp_ZwCreateKey
0x1C0007200: "__cdecl _imp_IoUnregisterShutdownNotification" __imp_IoUnregisterShutdownNotification
0x1C0003160: "[%s] MmAllocateContiguousNodeMem" ??_C@_0FL@HLNNDLEL@?$FL?$CFs?$FN?5MmAllocateContiguousNodeMem@
0x1C00034E0: "[%s] Add processor %u's IPT trac" ??_C@_0DK@BKBJPKFP@?$FL?$CFs?$FN?5Add?5processor?5?$CFu?8s?5IPT?5trac@
0x1C0003490: "[%s] Add bugcheck owner processo" ??_C@_0EJ@JFJNPHCO@?$FL?$CFs?$FN?5Add?5bugcheck?5owner?5processo@
0x1C00072C0: ntoskrnl_NULL_THUNK_DATA
0x1C0007160: "__cdecl _imp_ExFreePoolWithTag" __imp_ExFreePoolWithTag
0x1C0007030: "__cdecl _imp_KeEnterCriticalRegion" __imp_KeEnterCriticalRegion
0x1C0007240: "__cdecl _imp_RtlSetDaclSecurityDescriptor" __imp_RtlSetDaclSecurityDescriptor
0x1C000D340: DriverEntry
0x1C00071B8: "__cdecl _imp_ZwOpenKey" __imp_ZwOpenKey
0x1C0001F80: memset
0x1C00072EC: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR

[JEB Decompiler by PNF Software]