Generated by JEB on 2019/08/01

PE: C:\Windows\System32\winsrvext.dll Base=0x180000000 SHA-256=8D25C6013A433719475E1320C4C178AC07B7E6E08A90C0C3F34FC26C735E3D56
PDB: winsrvext.pdb GUID={44881428-D954-3893-9733A35A04933AE7} Age=1

805 located named symbols:
0x18001AAB8: hKeyPriority
0x18000BE90: W32WinStationSendWindowMessage
0x18000FAF4: "__cdecl _raise_securityfailure" __raise_securityfailure
0x180003020: SrvLogon
0x180010730: api-ms-win-core-file-l1-1-0_NULL_THUNK_DATA
0x1800108D8: "__cdecl _imp_EventRegister" __imp_EventRegister
0x1800104C0: "__cdecl _imp_MB_GetString" __imp_MB_GetString
0x180009AE0: HardErrorWorkerThread
0x18000FDE4: IsGetWindowThreadProcessIdPresent
0x180016830: g_pcsrAutoRotationThread
0x180007E5C: RtlStringCchCatW
0x1800118F0: WinSrvEvt_ThreadShutdown_Stop
0x1800122F8: "NotificationTimeOut" ??_C@_1CI@HCKGAGKD@?$AAN?$AAo?$AAt?$AAi?$AAf?$AAi?$AAc?$AAa?$AAt?$AAi?$AAo?$AAn?$AAT?$AAi?$AAm?$AAe?$AAO?$AAu?$AAt?$AA?$AA@
0x180010CD8: "__cdecl _imp_NtUserProcessConnect" __imp_NtUserProcessConnect
0x18000F7B0: "__cdecl _delayLoadHelper2" __delayLoadHelper2
0x180010B00: "__cdecl _imp_RtlFreeUnicodeString" __imp_RtlFreeUnicodeString
0x1800104F0: "__cdecl _imp_ShutdownBlockReasonQuery" __imp_ShutdownBlockReasonQuery
0x180013538: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x1800109A0: "__cdecl _imp_RtlDeriveCapabilitySidsFromName" __imp_RtlDeriveCapabilitySidsFromName
0x1800124D8: "Failed to get program id [%d]" ??_C@_0BO@LPJHGMKI@Failed?5to?5get?5program?5id?5?$FL?$CFd?$FN?$AA@
0x18000C760: W32WinStationDisplayIOCtl
0x180013600: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-com-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-com-l1-1-0
0x180010CA0: "__cdecl _imp_NtUserRemoteConnect" __imp_NtUserRemoteConnect
0x1800065C4: WowExitTask
0x180010BD0: "__cdecl _imp_RtlQueryPackageClaims" __imp_RtlQueryPackageClaims
0x1800111A0: "ext-ms-win-ntuser-message-l1-1-2" ??_C@_1EC@IBCKCP@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAn?$AAt?$AAu?$AAs?$AAe?$AAr?$AA?9?$AAm?$AAe?$AAs?$AAs?$AAa?$AAg?$AAe?$AA?9?$AAl?$AA1?$AA?9?$AA1?$AA?9?$AA2@
0x1800136C8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-kernel32-legacy-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-kernel32-legacy-l1-1-0
0x1800125C0: "\WindowsErrorReportingServicePor" ??_C@_1EE@NIHCKLHD@?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AAE?$AAr?$AAr?$AAo?$AAr?$AAR?$AAe?$AAp?$AAo?$AAr?$AAt?$AAi?$AAn?$AAg?$AAS?$AAe?$AAr?$AAv?$AAi?$AAc?$AAe?$AAP?$AAo?$AAr@
0x1800160E8: "__cdecl _security_cookie_complement" __security_cookie_complement
0x18000CFA4: ResolverFindAppToShutdownLast
0x18000784C: DefaultProcessShutdown
0x1800116E0: "%ws\%ld\BaseNamedObjects\%ws" ??_C@_1DK@EKKCFNBG@?$AA?$CF?$AAw?$AAs?$AA?2?$AA?$CF?$AAl?$AAd?$AA?2?$AAB?$AAa?$AAs?$AAe?$AAN?$AAa?$AAm?$AAe?$AAd?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAs?$AA?2?$AA?$CF?$AAw?$AAs?$AA?$AA@
0x180010A08: "__cdecl _imp_NtOpenProcess" __imp_NtOpenProcess
0x180012438: "RegLoadAppKey failed [%d]" ??_C@_0BK@ONMPEAAB@RegLoadAppKey?5failed?5?$FL?$CFd?$FN?$AA@
0x180010988: "__cdecl _imp_NtReadVirtualMemory" __imp_NtReadVirtualMemory
0x180009C30: UserHardErrorEx
0x180012020: wOptions
0x18000F93A: CloseHandle
0x180010380: CSRSRV_NULL_THUNK_DATA
0x1800107C0: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x180010310: "__cdecl _imp_CsrUnlockProcess" __imp_CsrUnlockProcess
0x1800108F8: "__cdecl _imp_AlpcGetMessageAttribute" __imp_AlpcGetMessageAttribute
0x1800030F0: StartCreateSystemThreads
0x18001A9B8: gEventSource
0x180010A80: "__cdecl _imp_NtEnumerateKey" __imp_NtEnumerateKey
0x1800168E8: G_ConsoleShadowBeepChannel
0x180010B48: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x180010438: "__cdecl _imp_GetWindowLongPtrW" __imp_GetWindowLongPtrW
0x180010578: "__cdecl _imp_SetFocus" __imp_SetFocus
0x1800108C0: api-ms-win-devices-swdevice-l1-1-0_NULL_THUNK_DATA
0x18000FF60: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x18001AA20: gpwszaSYSTEM_ERROR
0x180016868: G_IcaCommandChannel
0x180002DDC: GetTimeouts
0x180010C28: "__cdecl _imp_ZwUpdateWnfStateData" __imp_ZwUpdateWnfStateData
0x180011BC0: "Comment" ??_C@_1BA@BCPHNIGF@?$AAC?$AAo?$AAm?$AAm?$AAe?$AAn?$AAt?$AA?$AA@
0x1800022D8: CreateBSMEventSD
0x18000CD20: CompareShutdownInfo
0x180010C98: "__cdecl _imp_NtUserCallOneParam" __imp_NtUserCallOneParam
0x180007A38: CreateCtrlThread
0x180010570: "__cdecl _imp_GetThreadDesktop" __imp_GetThreadDesktop
0x180010560: "__cdecl _imp_InvalidateRect" __imp_InvalidateRect
0x180010CB8: "__cdecl _imp_NtUserCtxDisplayIOCtl" __imp_NtUserCtxDisplayIOCtl
0x180012750: "__cdecl _pfnDliFailureHook2" __pfnDliFailureHook2
0x180010948: "__cdecl _imp_NtEnumerateValueKey" __imp_NtEnumerateValueKey
0x1800135C4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-1-0
0x180010688: "__cdecl _imp_SendNotifyMessageW" __imp_SendNotifyMessageW
0x180010980: "__cdecl _imp_RtlUnicodeStringToAnsiString" __imp_RtlUnicodeStringToAnsiString
0x180010A98: "__cdecl _imp_RtlCreateSecurityDescriptor" __imp_RtlCreateSecurityDescriptor
0x180010750: api-ms-win-core-heap-l2-1-0_NULL_THUNK_DATA
0x180010660: "__cdecl _imp_IsWindowEnabled" __imp_IsWindowEnabled
0x18001AB08: ghFontRegistryHKLM
0x180010A78: "__cdecl _imp_NtSetInformationThread" __imp_NtSetInformationThread
0x180006DB8: WriteShutdownReasonToRegistry
0x180012468: "Failed to open file key [%d]" ??_C@_0BN@ECCPHNKE@Failed?5to?5open?5file?5key?5?$FL?$CFd?$FN?$AA@
0x180010308: "__cdecl _imp_CsrDereferenceProcess" __imp_CsrDereferenceProcess
0x18001AAF8: ghFontChangeEventHKLM
0x18000F9E0: IsGetApplicationExecutableRelativePathPresent
0x1800037D4: BuildPackagedCWARestartProcessInfo
0x180012620: "\KernelObjects\SystemErrorPortRe" ??_C@_1EI@MEPMEHFB@?$AA?2?$AAK?$AAe?$AAr?$AAn?$AAe?$AAl?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAs?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAE?$AAr?$AAr?$AAo?$AAr?$AAP?$AAo?$AAr?$AAt?$AAR?$AAe@
0x18000DE50: Win32CommandChannelThread
0x180013524: "__cdecl _IMPORT_DESCRIPTOR_KERNELBASE" __IMPORT_DESCRIPTOR_KERNELBASE
0x180010B58: "__cdecl _imp_RtlEnterCriticalSection" __imp_RtlEnterCriticalSection
0x180010D18: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x180010898: api-ms-win-core-timezone-private-l1-1-0_NULL_THUNK_DATA
0x1800015B0: OpenCurrentUserFontKey
0x180011860: WinSrvEvt_Notification_Event_Stop
0x180011CD8: "User32" ??_C@_1O@NPEPGMDM@?$AAU?$AAs?$AAe?$AAr?$AA3?$AA2?$AA?$AA@
0x1800121C8: "Local\WERReportingForProcess%u" ??_C@_1DO@BFHMKKHD@?$AAL?$AAo?$AAc?$AAa?$AAl?$AA?2?$AAW?$AAE?$AAR?$AAR?$AAe?$AAp?$AAo?$AAr?$AAt?$AAi?$AAn?$AAg?$AAF?$AAo?$AAr?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AA?$CF?$AAu?$AA?$AA@
0x180010C38: "__cdecl _imp_PssNtFreeSnapshot" __imp_PssNtFreeSnapshot
0x180016810: gpchiList
0x1800107C8: "__cdecl _imp_GetThreadId" __imp_GetThreadId
0x180003FA0: UserClientShutdownWorker
0x1800167A0: WinStationIcaApiPort
0x1800168E0: G_ConsoleShadowKeyboardChannel
0x180010368: "__cdecl _imp_CsrConnectToUser" __imp_CsrConnectToUser
0x1800105B8: "__cdecl _imp_DispatchMessageW" __imp_DispatchMessageW
0x180011B00: "\Registry\Machine\Software\Micro" ??_C@_1KC@EJNKKBNG@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x180010510: "__cdecl _imp_GetGUIThreadInfo" __imp_GetGUIThreadInfo
0x180013428: api-ms-win-security-lsalookup-l1-1-0_NULL_THUNK_DATA_DLN
0x18001C008: api-ms-win-security-lsalookup-l1-1-0_NULL_THUNK_DATA_DLA
0x180013490: api-ms-win-security-lsalookup-l1-1-0_NULL_THUNK_DATA_DLB
0x180016848: g_pcsrCommandThread
0x18000C3A0: CreateTermSrvReadyEvent
0x1800168C8: G_DupIcaCommandChannel
0x18001A9E0: gcsUserSrv
0x180010848: "__cdecl _imp_OpenMutexW" __imp_OpenMutexW
0x180010428: "__cdecl _imp_SetWindowLongPtrW" __imp_SetWindowLongPtrW
0x1800102F8: "__cdecl _imp_CsrValidateMessageBuffer" __imp_CsrValidateMessageBuffer
0x180010C78: "__cdecl _imp_NtUserRemoteRedrawScreen" __imp_NtUserRemoteRedrawScreen
0x1800105E8: "__cdecl _imp_SendMessageCallbackW" __imp_SendMessageCallbackW
0x18000E348: ConnectToTerminalServer
0x1800119F8: DEVPKEY_Device_SessionId
0x180011E80: "Click on CANCEL xx to debug the " ??_C@_1FI@NDLBDMLB@?$AAC?$AAl?$AAi?$AAc?$AAk?$AA?5?$AAo?$AAn?$AA?5?$AAC?$AAA?$AAN?$AAC?$AAE?$AAL?$AA?5?$AAx?$AAx?$AA?5?$AAt?$AAo?$AA?5?$AAd?$AAe?$AAb?$AAu?$AAg?$AA?5?$AAt?$AAh?$AAe?$AA?5@
0x18000BF00: W32WinStationShadowStop
0x18000A6C0: AutoRotationRequestThread
0x180010BC0: "__cdecl _imp_NtSetValueKey" __imp_NtSetValueKey
0x18000CC58: GetShutdownInfo
0x180009B14: ProcessHardErrorRequest
0x180010508: "__cdecl _imp_EnumWindows" __imp_EnumWindows
0x180010480: "__cdecl _imp_DestroyIcon" __imp_DestroyIcon
0x180011720: "Control Panel\Desktop" ??_C@_1CM@FDDKAFMM@?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AA?5?$AAP?$AAa?$AAn?$AAe?$AAl?$AA?2?$AAD?$AAe?$AAs?$AAk?$AAt?$AAo?$AAp?$AA?$AA@
0x180010658: "__cdecl _imp_GetWindow" __imp_GetWindow
0x18000F92E: SetLastError
0x180016850: ghSwDevice
0x18000BEE0: W32WinStationShadowStart
0x180010A38: "__cdecl _imp_wcsncmp" __imp_wcsncmp
0x180010E48: "__cdecl _guard_iat_table" __guard_iat_table
0x180011750: "\Registry\Machine\System\Current" ??_C@_1GG@KMAKALDL@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x18000FF2D: memcpy
0x180010668: "__cdecl _imp_RecordShutdownReason" __imp_RecordShutdownReason
0x180010788: "__cdecl _imp_LoadLibraryExW" __imp_LoadLibraryExW
0x18001683C: gHRes
0x180011930: WinsrvControlGuid
0x1800126A0: "\Registry\Machine\SYSTEM\Current" ??_C@_1IG@EPMAHCPK@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x180005988: SetEndTaskDlgStatus
0x18000FA40: "__cdecl _tailMerge_ext_ms_win_desktopappx_l1_1_3_dll" __tailMerge_ext_ms_win_desktopappx_l1_1_3_dll
0x18000BEC0: W32WinStationShadowSetup
0x180010160: UserServerApiDispatchTable
0x180012608: "struct _GUID const `long __cdecl SignalStartWerSvc(void)'::`2'::WerSvcTriggerGuid" ?WerSvcTriggerGuid@?1??SignalStartWerSvc@@YAJXZ@4U_GUID@@B
0x180011A98: "Application Restart #%d" ??_C@_1DA@DJHIFBNN@?$AAA?$AAp?$AAp?$AAl?$AAi?$AAc?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?5?$AAR?$AAe?$AAs?$AAt?$AAa?$AAr?$AAt?$AA?5?$AA?$CD?$AA?$CF?$AAd?$AA?$AA@
0x180010C68: "__cdecl _imp_memset" __imp_memset
0x180010850: "__cdecl _imp_WaitForMultipleObjectsEx" __imp_WaitForMultipleObjectsEx
0x180010858: "__cdecl _imp_CreateEventW" __imp_CreateEventW
0x180010A58: "__cdecl _imp_NtWaitForSingleObject" __imp_NtWaitForSingleObject
0x180016880: G_WinStationName
0x180011950: WNF_PNPA_PORTS_CHANGED
0x180013588: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0
0x180010758: "__cdecl _imp_GetOverlappedResult" __imp_GetOverlappedResult
0x1800103F8: "__cdecl _imp_Sleep" __imp_Sleep
0x180010678: "__cdecl _imp_GetSystemMetrics" __imp_GetSystemMetrics
0x180010C80: "__cdecl _imp_NtUserRemoteRedrawRectangle" __imp_NtUserRemoteRedrawRectangle
0x18000CD58: ResolverSortEnumeratedWindows
0x180010700: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x180010BB8: "__cdecl _imp_NtOpenProcessToken" __imp_NtOpenProcessToken
0x1800077E0: KillProcess
0x18001A9A0: gphiList
0x180010CB0: "__cdecl _imp_NtUserSetSensorPresence" __imp_NtUserSetSensorPresence
0x180009A18: RtlLoadStringOrError
0x180010900: "__cdecl _imp_NtTerminateThread" __imp_NtTerminateThread
0x180011DA0: "\Device" ??_C@_07BCIOEOOB@?2Device?$AA@
0x180011ED8: " " ??_C@_13LBAGMAIH@?$AA?6?$AA?$AA@
0x180010818: api-ms-win-core-psapi-l1-1-0_NULL_THUNK_DATA
0x18001AB18: g_EtwRegHandle
0x180001DE8: HandleVolumesChangedBroadcast
0x1800102D8: "__cdecl _imp_BaseGetProcessCrtlRoutine" __imp_BaseGetProcessCrtlRoutine
0x18000B0B8: CreateDoConnectMsgForWin32
0x18000EF64: "long __cdecl WersvcSendMessage(unsigned short const * __ptr64,struct _WERSVC_MSG * __ptr64,struct _WERSVC_MSG * __ptr64,unsigned long)" ?WersvcSendMessage@@YAJPEBGPEAU_WERSVC_MSG@@1K@Z
0x1800119A8: GUID_HWPROFILE_CHANGE_COMPLETE
0x18000FF39: memmove
0x180016904: G_fCursorShadow
0x180010CF0: "__cdecl _imp_NtUserInitialize" __imp_NtUserInitialize
0x18000BEA0: W32WinStationThinwireStats
0x180011E20: "Click on OK to terminate the app" ??_C@_1FC@CDHLBEMO@?$AAC?$AAl?$AAi?$AAc?$AAk?$AA?5?$AAo?$AAn?$AA?5?$AAO?$AAK?$AA?5?$AAt?$AAo?$AA?5?$AAt?$AAe?$AAr?$AAm?$AAi?$AAn?$AAa?$AAt?$AAe?$AA?5?$AAt?$AAh?$AAe?$AA?5?$AAa?$AAp?$AAp@
0x180010B18: "__cdecl _imp_RtlCopyUnicodeString" __imp_RtlCopyUnicodeString
0x1800124F8: "FileId" ??_C@_1O@ONAHBNDH@?$AAF?$AAi?$AAl?$AAe?$AAI?$AAd?$AA?$AA@
0x180011470: "EventRitExited" ??_C@_1BO@OBGHPEIN@?$AAE?$AAv?$AAe?$AAn?$AAt?$AAR?$AAi?$AAt?$AAE?$AAx?$AAi?$AAt?$AAe?$AAd?$AA?$AA@
0x180010AA8: "__cdecl _imp_RtlCreateAcl" __imp_RtlCreateAcl
0x1800105A0: "__cdecl _imp_DestroyWindow" __imp_DestroyWindow
0x1800109F0: "__cdecl _imp__wtoi" __imp__wtoi
0x180010740: api-ms-win-core-handle-l1-1-0_NULL_THUNK_DATA
0x1800168C0: G_DupIcaVideoChannel
0x180004020: UserClientShutdownProcesses
0x1800103A0: "__cdecl _imp_CreateCompatibleDC" __imp_CreateCompatibleDC
0x180012420: "StringCchPrintf [%#x]" ??_C@_0BG@BICCCHJP@StringCchPrintf?5?$FL?$CF?$CDx?$FN?$AA@
0x180010820: "__cdecl _imp_RegCloseKey" __imp_RegCloseKey
0x180010468: "__cdecl _imp_EndPaint" __imp_EndPaint
0x1800105D8: "__cdecl _imp_PeekMessageW" __imp_PeekMessageW
0x180010A30: "__cdecl _imp_NtQueryInformationToken" __imp_NtQueryInformationToken
0x18000FECC: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x180010B50: "__cdecl _imp_NtCreateEvent" __imp_NtCreateEvent
0x1800161A0: "__cdecl _hmod__api_ms_win_security_lsalookup_l1_1_0_dll" __hmod__api_ms_win_security_lsalookup_l1_1_0_dll
0x180002B7C: GetRegIntFromID
0x180010810: "__cdecl _imp_QueryFullProcessImageNameW" __imp_QueryFullProcessImageNameW
0x180010620: "__cdecl _imp_EnumThreadWindows" __imp_EnumThreadWindows
0x18000C370: W32WinStationRedrawRectangle
0x18001AB28: CsrApiPort
0x1800066AC: InternalWaitCancel
0x180011880: WinSrvEvt_ProcessShutdown_Stop
0x180011CB8: "BugcheckString" ??_C@_1BO@IPCENDHP@?$AAB?$AAu?$AAg?$AAc?$AAh?$AAe?$AAc?$AAk?$AAS?$AAt?$AAr?$AAi?$AAn?$AAg?$AA?$AA@
0x1800135D8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-psapi-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-psapi-l1-1-0
0x1800168F0: G_ConsoleShadowCommandChannel
0x180010968: "__cdecl _imp_AlpcInitializeMessageAttribute" __imp_AlpcInitializeMessageAttribute
0x180010450: "__cdecl _imp_DrawEdge" __imp_DrawEdge
0x180013614: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0
0x18000D638: ShowResolverDialog
0x18000B340: CreateCommandChannelThread
0x180010990: "__cdecl _imp_NtAlpcOpenSenderProcess" __imp_NtAlpcOpenSenderProcess
0x180010340: "__cdecl _imp_CsrGetProcessLuid" __imp_CsrGetProcessLuid
0x1800123B0: "StringCchPrintf for StoreDirecto" ??_C@_0CJ@BHDOAMKJ@StringCchPrintf?5for?5StoreDirecto@
0x180010648: "__cdecl _imp_InternalGetWindowIcon" __imp_InternalGetWindowIcon
0x180016908: G_DupConsoleShadowVideoChannel
0x18001274C: "__cdecl _DefaultResolveDelayLoadedAPIFlags" __DefaultResolveDelayLoadedAPIFlags
0x18001AA60: gCmsQuickAppShutdownTimeout
0x180010388: "__cdecl _imp_DeleteDC" __imp_DeleteDC
0x180012270: "\Registry\Machine\System\Current" ??_C@_1IG@MGFLCOHJ@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1800105C8: "__cdecl _imp_CallMsgFilterW" __imp_CallMsgFilterW
0x18001AA64: gCmsQuickAppShutdownCleanupTimeout
0x180004CC0: WMCSCallback
0x1800168F8: G_ConsoleShadowThinwireChannel
0x1800093FC: HardErrorHandler
0x180010B90: "__cdecl _imp_NtTerminateProcess" __imp_NtTerminateProcess
0x180011490: "\Registry\Machine\SOFTWARE\Micro" ??_C@_1IK@KBIABBDA@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x180005D90: EndTaskDlgProc
0x180010BE8: "__cdecl _imp_RtlOpenCurrentUser" __imp_RtlOpenCurrentUser
0x180010CC0: "__cdecl _imp_NtUserQueryWindow" __imp_NtUserQueryWindow
0x180010338: "__cdecl _imp_CsrShutdownProcesses" __imp_CsrShutdownProcesses
0x18001AA18: gpwszaSYSTEM_WARNING
0x1800103F0: "__cdecl _imp_lstrcmpiW" __imp_lstrcmpiW
0x1800134A0: ext-ms-win-desktopappx-l1-1-3_NULL_THUNK_DATA_DLB
0x180010630: "__cdecl _imp_GetClassLongW" __imp_GetClassLongW
0x1800103E8: GDI32_NULL_THUNK_DATA
0x18000BF60: W32WinStationPassthruDisable
0x180011FC8: dwResponseDefault
0x180007F80: SrvActivateDebugger
0x180011AF8: "IME" ??_C@_17LDADEION@?$AAI?$AAM?$AAE?$AA?$AA@
0x180010B60: "__cdecl _imp_RtlInitializeCriticalSection" __imp_RtlInitializeCriticalSection
0x180010FF8: "ext-ms-win-ntuser-gui-l1-1-0" ??_C@_1DK@IELAMIKN@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAn?$AAt?$AAu?$AAs?$AAe?$AAr?$AA?9?$AAg?$AAu?$AAi?$AA?9?$AAl?$AA1?$AA?9?$AA1?$AA?9?$AA0?$AA?$AA@
0x180010608: "__cdecl _imp_IsHungAppWindow" __imp_IsHungAppWindow
0x1800109E8: "__cdecl _imp_RtlFindMessage" __imp_RtlFindMessage
0x180010A40: "__cdecl _imp_towlower" __imp_towlower
0x1800026D0: NotificationThread
0x180016920: gApiMsg
0x18001A998: gbExitInProgress
0x180012558: "user32.dll" ??_C@_1BG@OILDLIOJ@?$AAu?$AAs?$AAe?$AAr?$AA3?$AA2?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x180010840: api-ms-win-core-registry-l1-1-0_NULL_THUNK_DATA
0x180010718: api-ms-win-core-errorhandling-l1-1-0_NULL_THUNK_DATA
0x180010770: api-ms-win-core-kernel32-legacy-l1-1-0_NULL_THUNK_DATA
0x180010A00: "__cdecl _imp_NtDeleteValueKey" __imp_NtDeleteValueKey
0x18000C860: GetProcessImagePathWin32
0x18000BF80: W32WinStationGetSystemMetrics
0x180010478: "__cdecl _imp_ReleaseDC" __imp_ReleaseDC
0x1800109C0: "__cdecl _imp_NtAlertThread" __imp_NtAlertThread
0x1800107D8: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x180010320: "__cdecl _imp_CsrLockProcessByClientId" __imp_CsrLockProcessByClientId
0x18001AA58: gdwHungToKillCount
0x180010A48: "__cdecl _imp_RtlUpcaseUnicodeChar" __imp_RtlUpcaseUnicodeChar
0x180003374: EtwBlockingAppLog
0x1800119C8: GUID_HWPROFILE_QUERY_CHANGE
0x1800102E8: BASESRV_NULL_THUNK_DATA
0x18000BF40: W32WinStationPassthruEnable
0x18001AAB0: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxudrmwldhUxlivUmgfhviUhvieviUlyquivUznwGEUkivxlnkOlyq@usersrvl" __@@_PchSym_@00@KxulyqvxgPillgKxudrmwldhUxlivUmgfhviUhvieviUlyquivUznwGEUkivxlnkOlyq@usersrvl
0x1800123A0: "%s\%s" ??_C@_1M@DFKENGJN@?$AA?$CF?$AAs?$AA?2?$AA?$CF?$AAs?$AA?$AA@
0x180001860: RegReadApcProcedure
0x180011948: WNF_PNPA_PORTS_CHANGED_SESSION
0x180010C40: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x180010F90: "ext-ms-win-desktopappx-l1-1-4" ??_C@_1DM@FPDICGAP@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAd?$AAe?$AAs?$AAk?$AAt?$AAo?$AAp?$AAa?$AAp?$AAp?$AAx?$AA?9?$AAl?$AA1?$AA?9?$AA1?$AA?9?$AA4?$AA?$AA@
0x1800107A0: api-ms-win-core-libraryloader-l1-2-0_NULL_THUNK_DATA
0x180010978: "__cdecl _imp_strstr" __imp_strstr
0x180016828: AutoRotationApiPort
0x180013628: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-eventing-provider-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-eventing-provider-l1-1-0
0x180010CD0: "__cdecl _imp_NtUserCallNoParam" __imp_NtUserCallNoParam
0x180011DE0: "%s%s - %s" ??_C@_1BE@GMNFDHIA@?$AA?$CF?$AAs?$AA?$CF?$AAs?$AA?5?$AA?9?$AA?5?$AA?$CF?$AAs?$AA?$AA@
0x1800103B8: "__cdecl _imp_GetLayout" __imp_GetLayout
0x1800104F8: "__cdecl _imp_GetWindowLongW" __imp_GetWindowLongW
0x18000F574: "public: static void __cdecl MetroHash64::Hash(unsigned char const * __ptr64,unsigned __int64,unsigned char * __ptr64 const,unsigned __int64)" ?Hash@MetroHash64@@SAXPEBE_KQEAE1@Z
0x180009C20: UserHardError
0x1800115B8: "ConvertibleSlateMode" ??_C@_1CK@CPPNMIPF@?$AAC?$AAo?$AAn?$AAv?$AAe?$AAr?$AAt?$AAi?$AAb?$AAl?$AAe?$AAS?$AAl?$AAa?$AAt?$AAe?$AAM?$AAo?$AAd?$AAe?$AA?$AA@
0x18000F922: GetProcAddress
0x18000E7F4: AeWERQueryFileInfo
0x180010C08: "__cdecl _imp_WinSqmAddToStream" __imp_WinSqmAddToStream
0x1800106F8: "__cdecl _imp_GetLastError" __imp_GetLastError
0x18000E704: "long __cdecl ComputeFileCacheKey(unsigned short * __ptr64,unsigned long,unsigned short const * __ptr64)" ?ComputeFileCacheKey@@YAJPEAGKPEBG@Z
0x1800108E0: api-ms-win-eventing-provider-l1-1-0_NULL_THUNK_DATA
0x180011E08: "read" ??_C@_19BCONAFI@?$AAr?$AAe?$AAa?$AAd?$AA?$AA@
0x18000FEA8: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x180010300: "__cdecl _imp_CsrLockedReferenceProcess" __imp_CsrLockedReferenceProcess
0x1800102F0: "__cdecl _imp_CsrReplyToMessage" __imp_CsrReplyToMessage
0x18001AA28: gheventCancel
0x18001AA48: gSessionId
0x18000C780: FindReasonOrVisibleWindowFromThread
0x180004364: UserClientShutdown
0x180011DF8: "written" ??_C@_1BA@NLFJHKOG@?$AAw?$AAr?$AAi?$AAt?$AAt?$AAe?$AAn?$AA?$AA@
0x180016900: G_fConsoleShadow
0x180010AA0: "__cdecl _imp_RtlAddAccessAllowedAce" __imp_RtlAddAccessAllowedAce
0x18000ACCC: FixDoConnectHandles
0x180011890: WinSrvEvt_ProcessShutdown_Start
0x180010A28: "__cdecl _imp_NtDeviceIoControlFile" __imp_NtDeviceIoControlFile
0x180016000: Win32WinStationDispatch
0x180012198: "(null)" ??_C@_1O@CEDCILHN@?$AA?$CI?$AAn?$AAu?$AAl?$AAl?$AA?$CJ?$AA?$AA@
0x18001372C: "__cdecl _IMPORT_DESCRIPTOR_win32u" __IMPORT_DESCRIPTOR_win32u
0x1800121A8: kszTitleExplorer
0x180013754: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-0
0x18001AB24: LastNetDrives
0x180010720: "__cdecl _imp_GetLogicalDrives" __imp_GetLogicalDrives
0x1800107E0: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x180010C18: "__cdecl _imp_PssNtCaptureSnapshot" __imp_PssNtCaptureSnapshot
0x180010358: "__cdecl _imp_CsrImpersonateClient" __imp_CsrImpersonateClient
0x180010F50: "ext-ms-win-desktopappx-l1-1-3" ??_C@_1DM@MCOPBOLG@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAd?$AAe?$AAs?$AAk?$AAt?$AAo?$AAp?$AAa?$AAp?$AAp?$AAx?$AA?9?$AAl?$AA1?$AA?9?$AA1?$AA?9?$AA3?$AA?$AA@
0x180010460: "__cdecl _imp_LoadBitmapW" __imp_LoadBitmapW
0x18001AA50: gCmsHungAppTimeout
0x180006CA0: GetUserSid
0x180010640: "__cdecl _imp_LoadIconW" __imp_LoadIconW
0x18001274C: "__cdecl _ResolveDelayLoadedAPIFlags" __ResolveDelayLoadedAPIFlags
0x18000F8FE: NtQueryValueKey
0x180004F24: ThreadShutdownNotify
0x1800160FC: g_DirtyShutdownMax
0x180016838: g_bAutoRotationThreadTerminate
0x180012528: "RtlGetPersistedStateLocation" ??_C@_0BN@EEOFOFNM@RtlGetPersistedStateLocation?$AA@
0x180010A18: "__cdecl _imp_NtClearEvent" __imp_NtClearEvent
0x180010918: "__cdecl _imp_VerSetConditionMask" __imp_VerSetConditionMask
0x180010928: "__cdecl _imp_RtlFreeHeap" __imp_RtlFreeHeap
0x18000E460: BrokenConnection
0x18001354C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0
0x1800119B8: GUID_HWPROFILE_CHANGE_CANCELLED
0x1800105F0: "__cdecl _imp_PostMessageW" __imp_PostMessageW
0x180010458: "__cdecl _imp_FillRect" __imp_FillRect
0x180010588: "__cdecl _imp_GetDlgItem" __imp_GetDlgItem
0x18001AA30: gheventCancelled
0x1800119D8: "\" ??_C@_13FPGAJAPJ@?$AA?2?$AA?$AA@
0x180010908: "__cdecl _imp_NtAlpcCreatePort" __imp_NtAlpcCreatePort
0x180010790: "__cdecl _imp_FreeLibrary" __imp_FreeLibrary
0x180010A20: "__cdecl _imp__strnicmp" __imp__strnicmp
0x180010618: "__cdecl _imp_IsWindowVisible" __imp_IsWindowVisible
0x180002B10: PowerNotificationThread
0x1800133FC: "__cdecl _NULL_DELAY_IMPORT_DESCRIPTOR" __NULL_DELAY_IMPORT_DESCRIPTOR
0x180010610: "__cdecl _imp_GhostWindowFromHungWindow" __imp_GhostWindowFromHungWindow
0x1800107F0: "__cdecl _imp_OpenProcess" __imp_OpenProcess
0x18000D6B0: ResetResolverDialog
0x1800104A0: "__cdecl _imp_GetWindowTextLengthW" __imp_GetWindowTextLengthW
0x180011078: "ext-ms-win-ntuser-gui-l1-3-0" ??_C@_1DK@MGJFMPNA@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAn?$AAt?$AAu?$AAs?$AAe?$AAr?$AA?9?$AAg?$AAu?$AAi?$AA?9?$AAl?$AA1?$AA?9?$AA3?$AA?9?$AA0?$AA?$AA@
0x180011BD0: "0x%x" ??_C@_19PCNJIDGC@?$AA0?$AAx?$AA?$CF?$AAx?$AA?$AA@
0x18001AAD8: ghNlsEvent
0x180013650: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-debug-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-debug-l1-1-0
0x18000FD90: IsRegisterWindowMessageWPresent
0x180008174: GetHardErrorMode
0x180010710: "__cdecl _imp_SetLastError" __imp_SetLastError
0x180006F30: SrvRecordShutdownReason
0x18000F8E6: NtClose
0x180013740: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-1" __IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-1
0x1800103B0: "__cdecl _imp_SetLayout" __imp_SetLayout
0x180006890: SrvExitWindowsEx
0x180010330: "__cdecl _imp_CsrLockThreadByClientId" __imp_CsrLockThreadByClientId
0x180012488: "InventoryApplicationFile" ??_C@_1DC@POIGHIOO@?$AAI?$AAn?$AAv?$AAe?$AAn?$AAt?$AAo?$AAr?$AAy?$AAA?$AAp?$AAp?$AAl?$AAi?$AAc?$AAa?$AAt?$AAi?$AAo?$AAn?$AAF?$AAi?$AAl?$AAe?$AA?$AA@
0x18000D310: ResolverContextThread
0x180010998: "__cdecl _imp_RtlEqualUnicodeString" __imp_RtlEqualUnicodeString
0x18001AA80: gVetoProcess
0x18000EC34: "long __cdecl ReportHangInternal(struct HWND__ * __ptr64,unsigned long * __ptr64,unsigned long,unsigned long,unsigned long,unsigned short const * __ptr64)" ?ReportHangInternal@@YAJPEAUHWND__@@PEAKKKKPEBG@Z
0x1800136A0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0
0x1800118A0: WinSrvEvt_WaitForProcess_Stop
0x18000B5BC: CreateRemoteDisplayDeviceNode
0x18000F7F0: "__cdecl DllMainCRTStartupForGS" _DllMainCRTStartupForGS
0x180001008: StringCchPrintfW
0x18000BE40: W32WinStationBroadcastSystemMessage
0x18000D010: ResolverEnumWindowsProc
0x180010690: "__cdecl _imp_RegisterWindowMessageW" __imp_RegisterWindowMessageW
0x18000A44C: AutoRotationAPIInit
0x18001C018: ext-ms-win-desktopappx-l1-1-3_NULL_THUNK_DATA_DLA
0x180010400: "__cdecl _imp_WTSGetServiceSessionId" __imp_WTSGetServiceSessionId
0x180016858: G_IcaVideoChannel
0x180010D10: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x180010420: KERNELBASE_NULL_THUNK_DATA
0x1800105D0: "__cdecl _imp_IsDialogMessageW" __imp_IsDialogMessageW
0x180012150: "\BaseNamedObjects\TermSrvReadyEv" ??_C@_1EI@ELBEHBAG@?$AA?2?$AAB?$AAa?$AAs?$AAe?$AAN?$AAa?$AAm?$AAe?$AAd?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAs?$AA?2?$AAT?$AAe?$AAr?$AAm?$AAS?$AAr?$AAv?$AAR?$AAe?$AAa?$AAd?$AAy?$AAE?$AAv@
0x1800107D0: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x1800106A0: USER32_NULL_THUNK_DATA
0x180011870: WinSrvEvt_Notification_Event_Start
0x180010CE8: "__cdecl _imp_NtUserSetInformationThread" __imp_NtUserSetInformationThread
0x180010488: "__cdecl _imp_CheckWindowThreadDesktop" __imp_CheckWindowThreadDesktop
0x180010B10: "__cdecl _imp_RtlAppendUnicodeToString" __imp_RtlAppendUnicodeToString
0x18001A9B0: gNtDllHandle
0x1800104C8: "__cdecl _imp_SoftModalMessageBox" __imp_SoftModalMessageBox
0x1800108A0: "__cdecl _imp_GetApplicationRestartSettings" __imp_GetApplicationRestartSettings
0x180011920: AppVetoEvent
0x180010BF8: "__cdecl _imp_EtwEventRegister" __imp_EtwEventRegister
0x18000BA50: W32WinStationDoDisconnect
0x1800168D8: G_ConsoleShadowMouseChannel
0x180012320: "%.16ls|%I64x" ??_C@_1BK@JLAJAIHB@?$AA?$CF?$AA?4?$AA1?$AA6?$AAl?$AAs?$AA?$HM?$AA?$CF?$AAI?$AA6?$AA4?$AAx?$AA?$AA@
0x18001AA40: gheventRitExited
0x180010BA0: "__cdecl _imp_RtlNtStatusToDosError" __imp_RtlNtStatusToDosError
0x18000E540: ReplyMessageToTerminalServer
0x18000B790: W32WinStationDoConnect
0x1800102D0: "__cdecl _imp_BaseSrvNlsLogon" __imp_BaseSrvNlsLogon
0x1800106C8: "__cdecl _imp_IsDebuggerPresent" __imp_IsDebuggerPresent
0x180010ED0: "ext-ms-win-desktopappx-l1-1-1" ??_C@_1DM@GIOGNGDN@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAd?$AAe?$AAs?$AAk?$AAt?$AAo?$AAp?$AAa?$AAp?$AAp?$AAx?$AA?9?$AAl?$AA1?$AA?9?$AA1?$AA?9?$AA1?$AA?$AA@
0x180010B88: "__cdecl _imp_NtOpenThread" __imp_NtOpenThread
0x180010880: api-ms-win-core-sysinfo-l1-1-0_NULL_THUNK_DATA
0x1800107F8: api-ms-win-core-processthreads-l1-1-1_NULL_THUNK_DATA
0x180010870: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x1800106D0: api-ms-win-core-debug-l1-1-0_NULL_THUNK_DATA
0x180011588: "Win32PrioritySeparation" ??_C@_1DA@LIECLLEO@?$AAW?$AAi?$AAn?$AA3?$AA2?$AAP?$AAr?$AAi?$AAo?$AAr?$AAi?$AAt?$AAy?$AAS?$AAe?$AAp?$AAa?$AAr?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x1800106E8: "__cdecl _imp_ResolveDelayLoadedAPI" __imp_ResolveDelayLoadedAPI
0x180010A50: "__cdecl _imp_RtlUnicodeStringToInteger" __imp_RtlUnicodeStringToInteger
0x18001AA70: gdwProcessTerminateTimeout
0x18000BE20: W32WinStationNtSecurity
0x18001AA6C: gdwServicesWaitToKillTimeout
0x180010AC8: "__cdecl _imp_RtlSubscribeWnfStateChangeNotification" __imp_RtlSubscribeWnfStateChangeNotification
0x180016808: g_AslLogPfnVPrintf
0x1800108F0: api-ms-win-security-base-l1-1-0_NULL_THUNK_DATA
0x1800167A8: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUdrmwldhUuvvwyzxpUxlivUuzfogivkUoryUlyquivUznwGEUkivxlnkOlyq@FaultRepLib" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUdrmwldhUuvvwyzxpUxlivUuzfogivkUoryUlyquivUznwGEUkivxlnkOlyq@FaultRepLib
0x18001AB20: gLastLogicalDrives
0x180010638: "__cdecl _imp_GetClassNameW" __imp_GetClassNameW
0x1800106B8: "__cdecl _imp_CoTaskMemFree" __imp_CoTaskMemFree
0x1800109F8: "__cdecl _imp_NtOpenThreadToken" __imp_NtOpenThreadToken
0x180011FB0: "HardError" ??_C@_1BE@BBLKCMBP@?$AAH?$AAa?$AAr?$AAd?$AAE?$AAr?$AAr?$AAo?$AAr?$AA?$AA@
0x180016870: G_IcaThinwireChannel
0x1800105F8: "__cdecl _imp_SetForegroundWindow" __imp_SetForegroundWindow
0x180010C60: "__cdecl _imp_RtlRunOnceExecuteOnce" __imp_RtlRunOnceExecuteOnce
0x18001A990: WinStationApiPort
0x18001AA54: gCmsWaitToKillTimeout
0x180010498: "__cdecl _imp_GetReasonTitleFromReasonCode" __imp_GetReasonTitleFromReasonCode
0x180013438: ext-ms-win-desktopappx-l1-1-3_NULL_THUNK_DATA_DLN
0x180010920: "__cdecl _imp_NtAlpcSendWaitReceivePort" __imp_NtAlpcSendWaitReceivePort
0x18000A9B0: TerminalServerRequestThread
0x180011CE8: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x180013574: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0
0x180013664: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-1" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-1
0x180002C54: MyRegOpenKey
0x180011610: "\Registry\Machine\System\Current" ??_C@_1IG@JKPOHDKC@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x18000F450: RtlpTestHookInitialize
0x18000FE38: IsGetUserObjectInformationWPresent
0x18000FC7C: "__cdecl _report_rangecheckfailure" __report_rangecheckfailure
0x1800113D0: "ext-ms-win-ntuser-windowstation-" ??_C@_1EO@OAMAPFNA@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAn?$AAt?$AAu?$AAs?$AAe?$AAr?$AA?9?$AAw?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AAt?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?9@
0x1800032C0: EtwLogThreadShutdown_SentMessage
0x180010E60: "__cdecl _sz_api_ms_win_security_lsalookup_l1_1_0_dll" __sz_api_ms_win_security_lsalookup_l1_1_0_dll
0x180011DA8: "\??\" ??_C@_04FFEPHCCK@?2?$DP?$DP?2?$AA@
0x180010A88: "__cdecl _imp_RtlFreeSid" __imp_RtlFreeSid
0x180010A68: "__cdecl _imp_NtResetEvent" __imp_NtResetEvent
0x180010C90: "__cdecl _imp_NtUserCallTwoParam" __imp_NtUserCallTwoParam
0x180010490: "__cdecl _imp_HungWindowFromGhostWindow" __imp_HungWindowFromGhostWindow
0x1800077C0: SrvCancelShutdown
0x180010538: "__cdecl _imp_GetWindowRect" __imp_GetWindowRect
0x180010550: "__cdecl _imp_OffsetRect" __imp_OffsetRect
0x180010680: "__cdecl _imp_SystemParametersInfoW" __imp_SystemParametersInfoW
0x180010B30: "__cdecl _imp_NtResumeThread" __imp_NtResumeThread
0x18000D280: ResolverProcessMessages
0x180012048: wIcons
0x180010CF8: "__cdecl _imp_NtUserNotifyProcessCreate" __imp_NtUserNotifyProcessCreate
0x180003514: HandlePendingRestartCommands
0x180010370: "__cdecl _imp_CsrDereferenceThread" __imp_CsrDereferenceThread
0x180011998: GUID_DEVICE_INTERFACE_ARRIVAL
0x180012210: "__cdecl _lookuptable" __lookuptable
0x18000FD3C: IsChangeWindowMessageFilterExPresent
0x180010AE8: "__cdecl _imp_NtQueryValueKey" __imp_NtQueryValueKey
0x180010378: "__cdecl _imp_CsrExecServerThread" __imp_CsrExecServerThread
0x180010940: "__cdecl _imp_RtlCreateUnicodeString" __imp_RtlCreateUnicodeString
0x18000FAD0: "__cdecl _security_check_cookie" __security_check_cookie
0x18001359C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0
0x1800107E8: api-ms-win-core-processthreads-l1-1-0_NULL_THUNK_DATA
0x180010778: "__cdecl _imp_GetProcAddress" __imp_GetProcAddress
0x180010440: "__cdecl _imp_BeginPaint" __imp_BeginPaint
0x1800136B4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-windowserrorreporting-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-windowserrorreporting-l1-1-0
0x18001AA68: gCmsQuickResolverTimeout
0x180016840: gColorDepth
0x180010BB0: "__cdecl _imp_NtDuplicateToken" __imp_NtDuplicateToken
0x1800118E0: WinSrvEvt_ThreadShutdown_SentMessage
0x180011978: WNF_PNPA_DEVNODES_CHANGED_SESSION
0x180010C10: "__cdecl _imp_RtlFreeAnsiString" __imp_RtlFreeAnsiString
0x180010518: "__cdecl _imp_SendInput" __imp_SendInput
0x1800105B0: "__cdecl _imp_IsWindow" __imp_IsWindow
0x18001AAF0: ghMediaRequestEvent
0x180011150: "ext-ms-win-ntuser-message-l1-1-1" ??_C@_1EC@BCDEIFMB@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAn?$AAt?$AAu?$AAs?$AAe?$AAr?$AA?9?$AAm?$AAe?$AAs?$AAs?$AAa?$AAg?$AAe?$AA?9?$AAl?$AA1?$AA?9?$AA1?$AA?9?$AA1@
0x18000BFC0: W32WinStationSetTimezone
0x180010650: "__cdecl _imp_GetWindowTextW" __imp_GetWindowTextW
0x180010760: api-ms-win-core-io-l1-1-0_NULL_THUNK_DATA
0x180010878: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x180011D88: "ErrorMode" ??_C@_1BE@JFAICNAE@?$AAE?$AAr?$AAr?$AAo?$AAr?$AAM?$AAo?$AAd?$AAe?$AA?$AA@
0x18001AB10: ghFontRegistryHKCU
0x180010830: "__cdecl _imp_RegLoadAppKeyW" __imp_RegLoadAppKeyW
0x18001AAC0: IoStatusRegChange
0x180010600: "__cdecl _imp_IsCoreWindow" __imp_IsCoreWindow
0x180010418: "__cdecl _imp_LocalAlloc" __imp_LocalAlloc
0x180010448: "__cdecl _imp_DrawIcon" __imp_DrawIcon
0x1800106D8: "__cdecl _imp_DelayLoadFailureHook" __imp_DelayLoadFailureHook
0x180010548: "__cdecl _imp_MapWindowPoints" __imp_MapWindowPoints
0x180010528: "__cdecl _imp_ChangeWindowMessageFilterEx" __imp_ChangeWindowMessageFilterEx
0x1800133DC: "__cdecl _DELAY_IMPORT_DESCRIPTOR_ext_ms_win_desktopappx_l1_1_3_dll" __DELAY_IMPORT_DESCRIPTOR_ext_ms_win_desktopappx_l1_1_3_dll
0x180010470: "__cdecl _imp_GetDC" __imp_GetDC
0x1800104B0: "__cdecl _imp_SetWindowPos" __imp_SetWindowPos
0x1800108B8: "__cdecl _imp_SwDeviceClose" __imp_SwDeviceClose
0x180012408: "Amcache.hve" ??_C@_1BI@FPANNLBN@?$AAA?$AAm?$AAc?$AAa?$AAc?$AAh?$AAe?$AA?4?$AAh?$AAv?$AAe?$AA?$AA@
0x180010B20: "__cdecl _imp_RtlFormatCurrentUserKeyPath" __imp_RtlFormatCurrentUserKeyPath
0x180010FD0: "__cdecl _sz_ext_ms_win_desktopappx_l1_1_3_dll" __sz_ext_ms_win_desktopappx_l1_1_3_dll
0x18001AA5C: gfAutoEndTask
0x18000C390: W32WinStationRedrawScreen
0x18001C000: "__cdecl _imp_LookupAccountSidLocalW" __imp_LookupAccountSidLocalW
0x1800119E0: DEVPKEY_Device_TerminalLuid
0x1800160F4: UserServerApiServerValidTable
0x18000EB78: "long __cdecl AeGetPersistedLocation(unsigned short * __ptr64,unsigned long,unsigned short const * __ptr64 const)" ?AeGetPersistedLocation@@YAJPEAGKQEBG@Z
0x1800104B8: "__cdecl _imp_SendMessageTimeoutW" __imp_SendMessageTimeoutW
0x180012598: "RegisterErrorReportingDialog" ??_C@_0BN@LAMKKOEI@RegisterErrorReportingDialog?$AA@
0x180010AF8: "__cdecl _imp_EtwEventEnabled" __imp_EtwEventEnabled
0x180008250: ReplyHardError
0x18001AA38: ghModuleWin
0x1800107B8: "__cdecl _imp_GetExitCodeThread" __imp_GetExitCodeThread
0x180011240: "ext-ms-win-ntuser-window-l1-1-0" ??_C@_1EA@EOLBBGDA@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAn?$AAt?$AAu?$AAs?$AAe?$AAr?$AA?9?$AAw?$AAi?$AAn?$AAd?$AAo?$AAw?$AA?9?$AAl?$AA1?$AA?9?$AA1?$AA?9?$AA0?$AA?$AA@
0x18001AA4C: gServiceSessionId
0x1800104A8: "__cdecl _imp_GetTaskmanWindow" __imp_GetTaskmanWindow
0x1800105A8: "__cdecl _imp_CreateDialogParamW" __imp_CreateDialogParamW
0x18001AA74: gfAllowBlockingApps
0x180011988: GUID_DEVICE_INTERFACE_REMOVAL
0x180016818: PendingMessages
0x180011900: WinSrvEvt_ThreadShutdown_Start
0x18000F414: AslLogCallPrintf
0x18000BCB0: W32WinStationTerminate
0x180010410: "__cdecl _imp_GetApplicationUserModelId" __imp_GetApplicationUserModelId
0x180010CC8: "__cdecl _imp_NtUserQueryInformationThread" __imp_NtUserQueryInformationThread
0x1800108B0: "__cdecl _imp_SwDeviceCreate" __imp_SwDeviceCreate
0x180013768: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-apiquery-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-apiquery-l1-1-0
0x180010808: api-ms-win-core-profile-l1-1-0_NULL_THUNK_DATA
0x180011840: PopupEvent
0x180010D20: "__cdecl _guard_fids_table" __guard_fids_table
0x180010BA8: "__cdecl _imp_wcscpy_s" __imp_wcscpy_s
0x1800101C0: "__cdecl load_config_used" _load_config_used
0x180010C30: "__cdecl _imp_ZwQueryWnfStateNameInformation" __imp_ZwQueryWnfStateNameInformation
0x1800102C8: "__cdecl _imp_BaseSetProcessCreateNotify" __imp_BaseSetProcessCreateNotify
0x180010CE0: "__cdecl _imp_gDispatchTableValues" __imp_gDispatchTableValues
0x180010A10: "__cdecl _imp_RtlCopySid" __imp_RtlCopySid
0x1800116C8: "\Sessions" ??_C@_1BE@GBAFMKEO@?$AA?2?$AAS?$AAe?$AAs?$AAs?$AAi?$AAo?$AAn?$AAs?$AA?$AA@
0x180013678: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-devices-swdevice-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-devices-swdevice-l1-1-0
0x180010500: "__cdecl _imp_KillTimer" __imp_KillTimer
0x1800106F0: api-ms-win-core-delayload-l1-1-1_NULL_THUNK_DATA
0x1800106E0: api-ms-win-core-delayload-l1-1-0_NULL_THUNK_DATA
0x180010670: "__cdecl _imp_GetWindowThreadProcessId" __imp_GetWindowThreadProcessId
0x180007E00: RecordPowerTransitionCheckpoint
0x180010C88: "__cdecl _imp_NtUserRemoteStopScreenUpdates" __imp_NtUserRemoteStopScreenUpdates
0x18001678C: gNumTerminalServerRequestThreads
0x18001A9A8: gdwHardErrorThreadId
0x18000A35C: WinStationAPIInit
0x180001F1C: HandleHardwareProfilesChangedBroadcast
0x18001368C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-io-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-io-l1-1-0
0x18000C120: W32WinStationSetDynamicTimezone
0x1800168D0: G_ConsoleShadowVideoChannel
0x180013510: "__cdecl _IMPORT_DESCRIPTOR_USER32" __IMPORT_DESCRIPTOR_USER32
0x1800124C0: "ProgramId" ??_C@_1BE@JGLKKBGB@?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAI?$AAd?$AA?$AA@
0x1800109B0: "__cdecl _imp_qsort" __imp_qsort
0x180010430: "__cdecl _imp_SetWindowTextW" __imp_SetWindowTextW
0x180012360: "AeWERQueryFileInfo" ??_C@_0BD@PDILLFEJ@AeWERQueryFileInfo?$AA@
0x1800016C0: UserClientConnect
0x180016844: g_bInitialConnected
0x180010568: "__cdecl _imp_GetUserObjectInformationW" __imp_GetUserObjectInformationW
0x180010C58: "__cdecl _imp_RtlGetNtProductType" __imp_RtlGetNtProductType
0x180010B38: "__cdecl _imp_RtlCreateUserThread" __imp_RtlCreateUserThread
0x18000AFAC: CaptureDoConnectMsg
0x1800117C0: "\Registry\Machine\Software\Polic" ??_C@_1HK@BDCJFGLI@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAP?$AAo?$AAl?$AAi?$AAc@
0x180010AD0: "__cdecl _imp_NtQueryInformationProcess" __imp_NtQueryInformationProcess
0x180010798: "__cdecl _imp_DisableThreadLibraryCalls" __imp_DisableThreadLibraryCalls
0x180010B68: "__cdecl _imp_NtClose" __imp_NtClose
0x180001008: "long __cdecl StringCchPrintfW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64,...)" ?StringCchPrintfW@@YAJPEAG_KPEBGZZ
0x18001C010: "__cdecl _imp_GetApplicationExecutableRelativePath" __imp_GetApplicationExecutableRelativePath
0x180003B78: RegisterApplicationRestartCL
0x180010C48: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x180010800: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x180011968: WNF_PNPA_VOLUMES_CHANGED_SESSION
0x18001AA08: gpwszaSUCCESS
0x1800103C8: "__cdecl _imp_GdiAddInitialFonts" __imp_GdiAddInitialFonts
0x18000E648: ShadowHotkey
0x180010970: "__cdecl _imp_RtlAnsiStringToUnicodeString" __imp_RtlAnsiStringToUnicodeString
0x18001AAE0: gfLogon
0x180012548: "Amcache" ??_C@_1BA@HPKHNAFL@?$AAA?$AAm?$AAc?$AAa?$AAc?$AAh?$AAe?$AA?$AA@
0x1800108C8: "__cdecl _imp_EventWrite" __imp_EventWrite
0x18000B5A0: RemoteDisplayCreationCallback
0x18000FD30: ApiSetQueryApiSetPresence
0x180010B28: "__cdecl _imp_RtlLeaveCriticalSection" __imp_RtlLeaveCriticalSection
0x180010950: "__cdecl _imp_NtAlpcConnectPort" __imp_NtAlpcConnectPort
0x1800109E0: "__cdecl _imp_NtOpenEvent" __imp_NtOpenEvent
0x180010D08: win32u_NULL_THUNK_DATA
0x180010B98: "__cdecl _imp_RtlRegisterThreadWithCsrss" __imp_RtlRegisterThreadWithCsrss
0x180010C50: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x180011960: WNF_PNPA_HARDWAREPROFILES_CHANGED
0x180012750: "__cdecl _pfnDefaultDliFailureHook2" __pfnDefaultDliFailureHook2
0x180011C90: "DirtyShutdownTime" ??_C@_1CE@KDILIADL@?$AAD?$AAi?$AAr?$AAt?$AAy?$AAS?$AAh?$AAu?$AAt?$AAd?$AAo?$AAw?$AAn?$AAT?$AAi?$AAm?$AAe?$AA?$AA@
0x180011AC8: "PackagedCWALauncher.exe" ??_C@_1DA@LJMIGFIL@?$AAP?$AAa?$AAc?$AAk?$AAa?$AAg?$AAe?$AAd?$AAC?$AAW?$AAA?$AAL?$AAa?$AAu?$AAn?$AAc?$AAh?$AAe?$AAr?$AA?4?$AAe?$AAx?$AAe?$AA?$AA@
0x180010530: "__cdecl _imp_GetClientRect" __imp_GetClientRect
0x18000F8F2: NtOpenKey
0x1800120F8: "RemoteDisplayEnum" ??_C@_1CE@FGDAEEKC@?$AAR?$AAe?$AAm?$AAo?$AAt?$AAe?$AAD?$AAi?$AAs?$AAp?$AAl?$AAa?$AAy?$AAE?$AAn?$AAu?$AAm?$AA?$AA@
0x1800111F0: "ext-ms-win-ntuser-message-l1-1-3" ??_C@_1EC@LIDNENEK@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAn?$AAt?$AAu?$AAs?$AAe?$AAr?$AA?9?$AAm?$AAe?$AAs?$AAs?$AAa?$AAg?$AAe?$AA?9?$AAl?$AA1?$AA?9?$AA1?$AA?9?$AA3@
0x18000FE90: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x180010408: "__cdecl _imp_LocalReAlloc" __imp_LocalReAlloc
0x180010868: "__cdecl _imp_GetSystemDirectoryW" __imp_GetSystemDirectoryW
0x180016800: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUzkkxlnkzgUhszivwUoryfUlyquivUznwGEUxlnkzghszivwxlivkOlyq@compatsharedcore" __@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUzkkxlnkzgUhszivwUoryfUlyquivUznwGEUxlnkzghszivwxlivkOlyq@compatsharedcore
0x180010930: "__cdecl _imp_NtAlpcAcceptConnectPort" __imp_NtAlpcAcceptConnectPort
0x180010958: "__cdecl _imp_wcsrchr" __imp_wcsrchr
0x18000FE38: IsGetThreadDesktopPresent
0x180010520: "__cdecl _imp_PostUIActions" __imp_PostUIActions
0x180011DD0: "ntdll" ??_C@_1M@OAIMIKLP@?$AAn?$AAt?$AAd?$AAl?$AAl?$AA?$AA@
0x180011980: WNF_PNPA_DEVNODES_CHANGED
0x18001363C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0
0x18000DC90: RemoteMessageThread
0x180010398: "__cdecl _imp_SelectObject" __imp_SelectObject
0x180010AC0: "__cdecl _imp_RtlUnsubscribeWnfStateChangeNotification" __imp_RtlUnsubscribeWnfStateChangeNotification
0x1800167B8: RtlpTestHookInit
0x180010780: "__cdecl _imp_GetModuleHandleW" __imp_GetModuleHandleW
0x1800108A8: api-ms-win-core-windowserrorreporting-l1-1-0_NULL_THUNK_DATA
0x1800102E0: "__cdecl _imp_BaseSrvNlsUpdateRegistryCache" __imp_BaseSrvNlsUpdateRegistryCache
0x180002CBC: AddFontsFromRegistry
0x180010C20: "__cdecl _imp_EtwEventWriteNoRegistration" __imp_EtwEventWriteNoRegistration
0x180010BE0: "__cdecl _imp_LdrFlushAlternateResourceModules" __imp_LdrFlushAlternateResourceModules
0x1800110B8: "ext-ms-win-ntuser-gui-l1-3-1" ??_C@_1DK@HOCJKILF@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAn?$AAt?$AAu?$AAs?$AAe?$AAr?$AA?9?$AAg?$AAu?$AAi?$AA?9?$AAl?$AA1?$AA?9?$AA3?$AA?9?$AA1?$AA?$AA@
0x1800105C0: "__cdecl _imp_TranslateMessage" __imp_TranslateMessage
0x180010F10: "ext-ms-win-desktopappx-l1-1-2" ??_C@_1DM@HKFDHJND@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAd?$AAe?$AAs?$AAk?$AAt?$AAo?$AAp?$AAa?$AAp?$AAp?$AAx?$AA?9?$AAl?$AA1?$AA?9?$AA1?$AA?9?$AA2?$AA?$AA@
0x18000C924: SqmReportBlockingAppData
0x1800161C0: "__cdecl _hmod__ext_ms_win_desktopappx_l1_1_3_dll" __hmod__ext_ms_win_desktopappx_l1_1_3_dll
0x18000A300: StringCopyNoNull
0x1800120D8: "HTREE\ROOT\0" ??_C@_1BK@CCOOHMCM@?$AAH?$AAT?$AAR?$AAE?$AAE?$AA?2?$AAR?$AAO?$AAO?$AAT?$AA?2?$AA0?$AA?$AA@
0x180011380: "ext-ms-win-ntuser-windowstation-" ??_C@_1EO@FIHMJCLF@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAn?$AAt?$AAu?$AAs?$AAe?$AAr?$AA?9?$AAw?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AAt?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?9@
0x180010580: "__cdecl _imp_SendMessageW" __imp_SendMessageW
0x180010360: "__cdecl _imp_CsrRevertToSelf" __imp_CsrRevertToSelf
0x180010C70: ntdll_NULL_THUNK_DATA
0x180010B80: "__cdecl _imp_memcpy" __imp_memcpy
0x18000F95E: "__cdecl _tailMerge_api_ms_win_security_lsalookup_l1_1_0_dll" __tailMerge_api_ms_win_security_lsalookup_l1_1_0_dll
0x18001AA10: gpwszaSYSTEM_INFORMATION
0x180003220: EtwLogThreadShutdownNotifyStop
0x180016820: g_hDoMessageEvent
0x180013718: "__cdecl _IMPORT_DESCRIPTOR_CSRSRV" __IMPORT_DESCRIPTOR_CSRSRV
0x1800104E0: "__cdecl _imp_GetProcessUIContextInformation" __imp_GetProcessUIContextInformation
0x1800103E0: "__cdecl _imp_GdiSupportsFontChangeEvent" __imp_GdiSupportsFontChangeEvent
0x180006320: "__cdecl EndTask" _EndTask
0x1800104E8: "__cdecl _imp_CtxInitUser32" __imp_CtxInitUser32
0x180010B78: "__cdecl _imp_EtwEventUnregister" __imp_EtwEventUnregister
0x180010768: "__cdecl _imp_GetComputerNameW" __imp_GetComputerNameW
0x1800103D0: "__cdecl _imp_GdiAddFontResourceW" __imp_GdiAddFontResourceW
0x180001AC0: HandleRemoteNetDeviceChangeEvent
0x18000A144: BoostHardError
0x180012060: "\RPC Control\AutoRotationApiPort" ??_C@_1EC@GLNGPAPD@?$AA?2?$AAR?$AAP?$AAC?$AA?5?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AA?2?$AAA?$AAu?$AAt?$AAo?$AAR?$AAo?$AAt?$AAa?$AAt?$AAi?$AAo?$AAn?$AAA?$AAp?$AAi?$AAP?$AAo?$AAr?$AAt@
0x1800136F0: "__cdecl _IMPORT_DESCRIPTOR_BASESRV" __IMPORT_DESCRIPTOR_BASESRV
0x1800135B0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0
0x180006B04: TestShutdownPrivilege
0x1800021F0: BroadcastDeviceEventCallback
0x1800106A8: "__cdecl _imp_ApiSetQueryApiSetPresence" __imp_ApiSetQueryApiSetPresence
0x1800160E0: "__cdecl _security_cookie" __security_cookie
0x180010698: "__cdecl _imp_BroadcastSystemMessageW" __imp_BroadcastSystemMessageW
0x18000C300: W32WinStationStopScreenUpdates
0x180011DB0: "System Process" ??_C@_1BO@EAKNKPGD@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?5?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AA?$AA@
0x18001683E: gVRes
0x180006900: SrvEndTask
0x1800109D8: "__cdecl _imp_EvtIntReportEventAndSourceAsync" __imp_EvtIntReportEventAndSourceAsync
0x1800107B0: "__cdecl _imp_GetExitCodeProcess" __imp_GetExitCodeProcess
0x180010A60: "__cdecl _imp_RtlExitUserThread" __imp_RtlExitUserThread
0x1800108E8: "__cdecl _imp_CheckTokenMembership" __imp_CheckTokenMembership
0x1800167B0: RtlpUserPolicies
0x180012120: "lpacSessionManagement" ??_C@_1CM@NONINMBB@?$AAl?$AAp?$AAa?$AAc?$AAS?$AAe?$AAs?$AAs?$AAi?$AAo?$AAn?$AAM?$AAa?$AAn?$AAa?$AAg?$AAe?$AAm?$AAe?$AAn?$AAt?$AA?$AA@
0x180012458: "Root" ??_C@_19LFKAPJKP@?$AAR?$AAo?$AAo?$AAt?$AA?$AA@
0x1800091C0: CheckShellHardError
0x180010348: "__cdecl _imp_CsrAddStaticServerThread" __imp_CsrAddStaticServerThread
0x180012378: "AppCompat\Programs" ??_C@_1CG@JLDAOJFK@?$AAA?$AAp?$AAp?$AAC?$AAo?$AAm?$AAp?$AAa?$AAt?$AA?2?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAs?$AA?$AA@
0x180010590: "__cdecl _imp_SetTimer" __imp_SetTimer
0x180011CF0: User32ControlGuid
0x180010738: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x180011970: WNF_PNPA_VOLUMES_CHANGED
0x1800103D8: "__cdecl _imp_DeleteObject" __imp_DeleteObject
0x180010748: "__cdecl _imp_LocalFree" __imp_LocalFree
0x180011910: AppHungEvent
0x180011A30: "Software\Microsoft\Windows\Curre" ??_C@_1GE@HLGCOFKK@?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe@
0x1800135EC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0
0x180011520: "\SOFTWARE\Microsoft\Windows NT\C" ??_C@_1GI@LJOIOJJH@?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAN?$AAT?$AA?2?$AAC@
0x1800106C0: api-ms-win-core-com-l1-1-0_NULL_THUNK_DATA
0x1800017D4: EtwLogNotificationStop
0x180011D00: "\??\A:" ??_C@_1O@IFOEILMN@?$AA?2?$AA?$DP?$AA?$DP?$AA?2?$AAA?$AA?3?$AA?$AA@
0x180004D48: GetApplicationText
0x180011340: "ext-ms-win-ntuser-window-l1-1-4" ??_C@_1EA@MBNDIBGH@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAn?$AAt?$AAu?$AAs?$AAe?$AAr?$AA?9?$AAw?$AAi?$AAn?$AAd?$AAo?$AAw?$AA?9?$AAl?$AA1?$AA?9?$AA1?$AA?9?$AA4?$AA?$AA@
0x180011BA8: "ReasonCode" ??_C@_1BG@BIHHHHEB@?$AAR?$AAe?$AAa?$AAs?$AAo?$AAn?$AAC?$AAo?$AAd?$AAe?$AA?$AA@
0x180010890: "__cdecl _imp_SetClientTimeZoneInformation" __imp_SetClientTimeZoneInformation
0x1800024CC: HandleFontChangeEvent
0x180011EE0: "%s %s%s%s" ??_C@_1BE@KJFCJHMB@?$AA?$CF?$AAs?$AA?6?$AA?$CF?$AAs?$AA?$CF?$AAs?$AA?$CF?$AAs?$AA?$AA@
0x18000BE30: W32WinStationDoMessage
0x180003DBC: "__cdecl ExitWindowsEx" _ExitWindowsEx
0x1800109A8: "__cdecl _imp_NtQuerySymbolicLinkObject" __imp_NtQuerySymbolicLinkObject
0x180003130: SrvCreateSystemThreads
0x180008034: SubstituteDeviceName
0x1800066F8: InternalCreateCallbackThread
0x180010AB8: "__cdecl _imp_RtlAllocateAndInitializeSid" __imp_RtlAllocateAndInitializeSid
0x180011300: "ext-ms-win-ntuser-window-l1-1-3" ??_C@_1EA@FMAELJNO@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAn?$AAt?$AAu?$AAs?$AAe?$AAr?$AA?9?$AAw?$AAi?$AAn?$AAd?$AAo?$AAw?$AA?9?$AAl?$AA1?$AA?9?$AA1?$AA?9?$AA3?$AA?$AA@
0x1800118B0: WinSrvEvt_WaitForProcess_Start
0x180010C00: "__cdecl _imp__vsnwprintf" __imp__vsnwprintf
0x180001FF0: HandlePortsChangedBroadcast
0x180010708: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x180011D10: "\Registry\Machine\System\Current" ??_C@_1HG@MOFLELCI@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1800107A8: "__cdecl _imp_GetCurrentThread" __imp_GetCurrentThread
0x18000C7F0: ThreadWindowsCanBlock
0x180011F90: "ShellErrorMode" ??_C@_1BO@KCIOCOJG@?$AAS?$AAh?$AAe?$AAl?$AAl?$AAE?$AAr?$AAr?$AAo?$AAr?$AAM?$AAo?$AAd?$AAe?$AA?$AA@
0x180010838: "__cdecl _imp_RegOpenKeyExW" __imp_RegOpenKeyExW
0x18000D56C: PrepareResolverEntry
0x18000F814: "__cdecl _security_init_cookie" __security_init_cookie
0x180010318: "__cdecl _imp_CsrReferenceThread" __imp_CsrReferenceThread
0x180010BC8: "__cdecl _imp_NtQuerySystemInformation" __imp_NtQuerySystemInformation
0x180010828: "__cdecl _imp_RegGetValueW" __imp_RegGetValueW
0x1800103A8: "__cdecl _imp_GetObjectW" __imp_GetObjectW
0x180010328: "__cdecl _imp_CsrUnlockThread" __imp_CsrUnlockThread
0x1800109B8: "__cdecl _imp_NtOpenSymbolicLinkObject" __imp_NtOpenSymbolicLinkObject
0x18001AAA8: gprpi
0x180011940: WNF_WER_SERVICE_START
0x180006A4C: CancelExitWindows
0x180010E90: "ext-ms-win-desktopappx-l1-1-0" ??_C@_1DM@NAFKLBFI@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAd?$AAe?$AAs?$AAk?$AAt?$AAo?$AAp?$AAa?$AAp?$AAp?$AAx?$AA?9?$AAl?$AA1?$AA?9?$AA1?$AA?9?$AA0?$AA?$AA@
0x180010BF0: "__cdecl _imp_memmove" __imp_memmove
0x18000F916: GetTickCount
0x1800120A8: "\SmSsWinStationApiPort" ??_C@_1CO@JIALBAGD@?$AA?2?$AAS?$AAm?$AAS?$AAs?$AAW?$AAi?$AAn?$AAS?$AAt?$AAa?$AAt?$AAi?$AAo?$AAn?$AAA?$AAp?$AAi?$AAP?$AAo?$AAr?$AAt?$AA?$AA@
0x180010598: "__cdecl _imp_SetDlgItemTextW" __imp_SetDlgItemTextW
0x18000F90A: GetCurrentThreadId
0x1800103C0: "__cdecl _imp_CreateSolidBrush" __imp_CreateSolidBrush
0x18001AAE8: ghPowerRequestEvent
0x180010B40: "__cdecl _imp_NtOpenKey" __imp_NtOpenKey
0x1800104D8: "__cdecl _imp_PostThreadMessageW" __imp_PostThreadMessageW
0x18000D9F0: RemoteDoMessage
0x18000F952: "__cdecl _imp_load_LookupAccountSidLocalW" __imp_load_LookupAccountSidLocalW
0x1800104D0: "__cdecl _imp_MessageBoxTimeoutW" __imp_MessageBoxTimeoutW
0x1800026C0: GdiAddInitialFontsThread
0x1800108D0: "__cdecl _imp_EventUnregister" __imp_EventUnregister
0x180011958: WNF_PNPA_HARDWAREPROFILES_CHANGED_SESSION
0x180016100: g_ShutdownState
0x180010AB0: "__cdecl _imp_RtlLengthSid" __imp_RtlLengthSid
0x180013704: "__cdecl _IMPORT_DESCRIPTOR_GDI32" __IMPORT_DESCRIPTOR_GDI32
0x180011038: "ext-ms-win-ntuser-gui-l1-1-1" ??_C@_1DK@DMAMKPMI@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAn?$AAt?$AAu?$AAs?$AAe?$AAr?$AA?9?$AAg?$AAu?$AAi?$AA?9?$AAl?$AA1?$AA?9?$AA1?$AA?9?$AA1?$AA?$AA@
0x18001AAD0: RegChangeBuffer
0x180010B70: "__cdecl _imp_RtlDeleteCriticalSection" __imp_RtlDeleteCriticalSection
0x180011FF0: dwResponses
0x18000D778: ValidateFormatStringW
0x180011BE0: "\Registry\Machine\Software\Micro" ??_C@_1JA@FMKBOKEM@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x18000FB30: "__cdecl _report_gsfailure" __report_gsfailure
0x180010888: "__cdecl _imp_SetClientDynamicTimeZoneInformation" __imp_SetClientDynamicTimeZoneInformation
0x1800133BC: "__cdecl _DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_lsalookup_l1_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_lsalookup_l1_1_0_dll
0x1800106B0: api-ms-win-core-apiquery-l1-1-0_NULL_THUNK_DATA
0x180010AF0: "__cdecl _imp_EtwEventWrite" __imp_EtwEventWrite
0x18001AB00: ghFontChangeEventHKCU
0x180010628: "__cdecl _imp_IsInDesktopWindowBand" __imp_IsInDesktopWindowBand
0x1800123E0: "AeGetPersistedLocation failed [%" ??_C@_0CE@JJBDPMPB@AeGetPersistedLocation?5failed?5?$FL?$CF@
0x18000BF20: W32WinStationShadowCleanup
0x180010558: "__cdecl _imp_InflateRect" __imp_InflateRect
0x1800109C8: "__cdecl _imp_DbgUiIssueRemoteBreakin" __imp_DbgUiIssueRemoteBreakin
0x18000B49C: CloseAllInputHandles
0x180010AD8: "__cdecl _imp_NtNotifyChangeKey" __imp_NtNotifyChangeKey
0x180011A10: "ntdll.dll" ??_C@_1BE@GJOFHIHD@?$AAn?$AAt?$AAd?$AAl?$AAl?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x180010910: "__cdecl _imp_RtlVerifyVersionInfo" __imp_RtlVerifyVersionInfo
0x1800112C0: "ext-ms-win-ntuser-window-l1-1-2" ??_C@_1EA@OELINOLL@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAn?$AAt?$AAu?$AAs?$AAe?$AAr?$AA?9?$AAw?$AAi?$AAn?$AAd?$AAo?$AAw?$AA?9?$AAl?$AA1?$AA?9?$AA1?$AA?9?$AA2?$AA?$AA@
0x180011698: "ARIAL.TTF" ??_C@_1BE@ICANCPFE@?$AAA?$AAR?$AAI?$AAA?$AAL?$AA?4?$AAT?$AAT?$AAF?$AA?$AA@
0x18001A9C0: gdwThreadEndSession
0x1800082CC: CheckDefaultDesktop
0x18000E0C4: RemoteDoSendWindowMessage
0x180003164: EtwLogThreadShutdownNotifyStart
0x180012570: "WerHangRepMessage" ??_C@_1CE@EMKEJNBD@?$AAW?$AAe?$AAr?$AAH?$AAa?$AAn?$AAg?$AAR?$AAe?$AAp?$AAM?$AAe?$AAs?$AAs?$AAa?$AAg?$AAe?$AA?$AA@
0x18000F946: LoadLibraryExW
0x1800105E0: "__cdecl _imp_MsgWaitForMultipleObjects" __imp_MsgWaitForMultipleObjects
0x180001088: UserServerCleanup
0x180001750: EtwLogNotificationStart
0x180012728: "ResourcePolicies" ??_C@_1CC@NNGJHDFE@?$AAR?$AAe?$AAs?$AAo?$AAu?$AAr?$AAc?$AAe?$AAP?$AAo?$AAl?$AAi?$AAc?$AAi?$AAe?$AAs?$AA?$AA@
0x180011850: PopupControlGuid
0x180010540: "__cdecl _imp_GetSysColor" __imp_GetSysColor
0x180016910: G_DupConsoleShadowCommandChannel
0x180011C70: "DirtyShutdown" ??_C@_1BM@HCNMCBMK@?$AAD?$AAi?$AAr?$AAt?$AAy?$AAS?$AAh?$AAu?$AAt?$AAd?$AAo?$AAw?$AAn?$AA?$AA@
0x180016860: G_IcaBeepChannel
0x180010390: "__cdecl _imp_GdiTransparentBlt" __imp_GdiTransparentBlt
0x180010A70: "__cdecl _imp_NtWaitForMultipleObjects" __imp_NtWaitForMultipleObjects
0x180010D00: "__cdecl _imp_NtUserHardErrorControl" __imp_NtUserHardErrorControl
0x180010350: "__cdecl _imp_CsrQueryApiPort" __imp_CsrQueryApiPort
0x180010B08: "__cdecl _imp_NtCreateKey" __imp_NtCreateKey
0x180004E40: FindWindowFromThread
0x180011100: "ext-ms-win-ntuser-message-l1-1-0" ??_C@_1EC@KKIIOCKE@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAn?$AAt?$AAu?$AAs?$AAe?$AAr?$AA?9?$AAm?$AAe?$AAs?$AAs?$AAa?$AAg?$AAe?$AA?9?$AAl?$AA1?$AA?9?$AA1?$AA?9?$AA0@
0x180010AE0: "__cdecl _imp_NtSetSystemInformation" __imp_NtSetSystemInformation
0x180010A90: "__cdecl _imp_RtlSetDaclSecurityDescriptor" __imp_RtlSetDaclSecurityDescriptor
0x18000C710: W32WinStationSessionNotificationMessage
0x180001C28: RegisterForDeviceBroadcastNotifications
0x180010960: "__cdecl _imp_NtDuplicateObject" __imp_NtDuplicateObject
0x1800109D0: "__cdecl _imp_NtPowerInformation" __imp_NtPowerInformation
0x180012508: "Failed to get file id [%d]" ??_C@_0BL@NNAPJGGL@Failed?5to?5get?5file?5id?5?$FL?$CFd?$FN?$AA@
0x180013560: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0
0x180010CA8: "__cdecl _imp_NtUserAutoRotateScreen" __imp_NtUserAutoRotateScreen
0x1800011B0: UserServerDllInitialization
0x1800118D0: WinSrvEvt_TerminateProcess_Start
0x1800115E8: "SystemDockMode" ??_C@_1BO@IAHCGBEC@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAD?$AAo?$AAc?$AAk?$AAM?$AAo?$AAd?$AAe?$AA?$AA@
0x180004CE4: GetInputWindow
0x180010BD8: "__cdecl _imp_NtSetEvent" __imp_NtSetEvent
0x180012340: "Failed to hash File path [%#x]" ??_C@_0BP@HEIMFOKE@Failed?5to?5hash?5File?5path?5?$FL?$CF?$CDx?$FN?$AA@
0x180011280: "ext-ms-win-ntuser-window-l1-1-1" ??_C@_1EA@PGANHBFF@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAn?$AAt?$AAu?$AAs?$AAe?$AAr?$AA?9?$AAw?$AAi?$AAn?$AAd?$AAo?$AAw?$AA?9?$AAl?$AA1?$AA?9?$AA1?$AA?9?$AA1?$AA?$AA@
0x18000FA34: "__cdecl _imp_load_GetApplicationExecutableRelativePath" __imp_load_GetApplicationExecutableRelativePath
0x180011420: "ext-ms-win-ntuser-windowstation-" ??_C@_1EO@PCHFFKDO@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAn?$AAt?$AAu?$AAs?$AAe?$AAr?$AA?9?$AAw?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AAt?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?9@
0x180010860: api-ms-win-core-synch-l1-1-0_NULL_THUNK_DATA
0x180003708: GetProcessImpersonationToken
0x180011F00: "Exception Processing Message 0x%" ??_C@_1IK@MDOMPJJE@?$AAE?$AAx?$AAc?$AAe?$AAp?$AAt?$AAi?$AAo?$AAn?$AA?5?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AAi?$AAn?$AAg?$AA?5?$AAM?$AAe?$AAs?$AAs?$AAa?$AAg?$AAe?$AA?5?$AA0?$AAx?$AA?$CF@
0x1800116B0: "ScNetDrvMsg" ??_C@_1BI@PALEENNE@?$AAS?$AAc?$AAN?$AAe?$AAt?$AAD?$AAr?$AAv?$AAM?$AAs?$AAg?$AA?$AA@
0x1800118C0: WinSrvEvt_TerminateProcess_Stop
0x1800136DC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-timezone-private-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-timezone-private-l1-1-0
0x180008320: GetHardErrorText
0x180010938: "__cdecl _imp_NtAlpcCancelMessage" __imp_NtAlpcCancelMessage
0x18000FF45: memset
0x18001377C: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x18000FC98: "__cdecl _report_securityfailure" __report_securityfailure
0x180007EFC: RtlStringCchPrintfW
0x180010728: "__cdecl _imp_ReadFile" __imp_ReadFile

[JEB Decompiler by PNF Software]