Generated by JEB on 2019/08/01
PE: C:\Windows\System32\winlogonext.dll Base=0x180000000 SHA-256=9205F55491593ABB9B32CDFE46932057AD64872CBC39C463BA2E9220E14C3D3F
PDB: winlogonext.pdb GUID={9B2FD033-6525-4A4D-D73B7359AEFF496B} Age=1
164 located named symbols:
0x180002144: "__cdecl _raise_securityfailure" __raise_securityfailure
0x180001050: WinLogonExt
0x180001F60: "__cdecl FindPESection" _FindPESection
0x180013010: "__cdecl _security_cookie_complement" __security_cookie_complement
0x18000C5D0: "ncalrpc" ??_C@_1BA@EONDGCCM@?$AAn?$AAc?$AAa?$AAl?$AAr?$AAp?$AAc?$AA?$AA@
0x180001A3C: "__cdecl CRT_INIT" _CRT_INIT
0x18000C2E8: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x1800023B0: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x18000C388: "__cdecl _imp_StartServiceW" __imp_StartServiceW
0x180001610: PLSAPR_SERVER_NAME_bind
0x1800011FC: "unsigned long __cdecl AicpStartAIS(unsigned long)" ?AicpStartAIS@@YAKK@Z
0x180012510: "__cdecl _IMPORT_DESCRIPTOR_KERNELBASE" __IMPORT_DESCRIPTOR_KERNELBASE
0x18000C408: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x18000C3B0: "__cdecl _imp__wcsnicmp" __imp__wcsnicmp
0x18000C3A0: "__cdecl _imp_QueryServiceStatus" __imp_QueryServiceStatus
0x180001F44: "__cdecl XcptFilter" _XcptFilter
0x18000C410: "__cdecl _xc_a" __xc_a
0x18000C248: "__cdecl _imp_GetComputerNameExW" __imp_GetComputerNameExW
0x180001650: PSECURITY_SOURCE_NAME_unbind
0x18000238D: memcpy
0x1800014A0: LsaInteractiveSessionIsLoggedOff
0x18000C3F0: "__cdecl _imp_memset" __imp_memset
0x18000212C: "__cdecl initterm" _initterm
0x1800124D4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0
0x180013620: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x18000C340: "__cdecl _imp_Sleep" __imp_Sleep
0x18000C430: "__cdecl _xi_z" __xi_z
0x18000C2D8: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x180002138: "__cdecl _C_specific_handler" __C_specific_handler
0x180001490: MIDL_user_free
0x18000C390: "__cdecl _imp_OpenServiceW" __imp_OpenServiceW
0x18000232C: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x18001254C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0
0x180001F50: "__cdecl amsg_exit" _amsg_exit
0x180001650: PAUTHZ_AUDIT_EVENT_TYPE_OLD_unbind
0x18000C2E0: api-ms-win-core-errorhandling-l1-1-0_NULL_THUNK_DATA
0x18000C300: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x180013610: "__cdecl _native_startup_lock" __native_startup_lock
0x180002120: DllMain
0x18000105C: "unsigned long __cdecl AicDisableElevationForSession(unsigned long)" ?AicDisableElevationForSession@@YAKK@Z
0x18000C3C8: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x18000C118: g_LsapBindingHandleSecurity
0x18000C328: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x18000C260: KERNEL32_NULL_THUNK_DATA
0x18000C258: "__cdecl _imp_GetLastError" __imp_GetLastError
0x180013000: "__cdecl _native_dllmain_reason" __native_dllmain_reason
0x180002308: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x18000C2C0: "__cdecl _imp_RpcBindingCreateW" __imp_RpcBindingCreateW
0x18000C2F0: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x180002010: "__cdecl ValidateImageBase" _ValidateImageBase
0x180011ED0: "securityevent" ??_C@_1BM@MLFHKLND@?$AAs?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AAe?$AAv?$AAe?$AAn?$AAt?$AA?$AA@
0x18000C280: "__cdecl _imp_RpcBindingFree" __imp_RpcBindingFree
0x180001C80: "__cdecl DllMainCRTStartup" _DllMainCRTStartup
0x18000C3C0: "__cdecl _imp__initterm" __imp__initterm
0x18000C2B0: "__cdecl _imp_RpcStringBindingComposeW" __imp_RpcStringBindingComposeW
0x1800014F0: LsaConfigureUserArso
0x1800016B0: PSECURITY_SOURCE_NAME_bind
0x180011EC0: "audit" ??_C@_1M@LILKJADD@?$AAa?$AAu?$AAd?$AAi?$AAt?$AA?$AA@
0x180013600: "__cdecl _onexitend" __onexitend
0x18000C400: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x18000C270: KERNELBASE_NULL_THUNK_DATA
0x18000C5C0: "AppInfo" ??_C@_1BA@EHFBHEIB@?$AAA?$AAp?$AAp?$AAI?$AAn?$AAf?$AAo?$AA?$AA@
0x18000C2F8: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x18000C360: api-ms-win-core-sysinfo-l1-1-0_NULL_THUNK_DATA
0x18000C420: "__cdecl _xi_a" __xi_a
0x18000C358: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x18000C370: api-ms-win-security-base-l1-1-0_NULL_THUNK_DATA
0x1800016DC: RpcpBindRpc
0x180001318: "unsigned long __cdecl AicpCreateBindingHandle(unsigned short * __ptr64,int,void * __ptr64 * __ptr64)" ?AicpCreateBindingHandle@@YAKPEAGHPEAPEAX@Z
0x18000C380: "__cdecl _imp_CloseServiceHandle" __imp_CloseServiceHandle
0x1800124C0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0
0x180012574: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-service-winsvc-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-service-winsvc-l1-1-0
0x180013628: "__cdecl pRawDllMain" _pRawDllMain
0x18000C4D0: "ext-ms-win-ntuser-windowstation-" ??_C@_1EO@OAMAPFNA@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAn?$AAt?$AAu?$AAs?$AAe?$AAr?$AA?9?$AAw?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AAt?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?9@
0x18000C2A8: "__cdecl _imp_I_RpcExceptionFilter" __imp_I_RpcExceptionFilter
0x180001040: ConfigureUserArso
0x180001F20: "__cdecl _security_check_cookie" __security_check_cookie
0x18000C418: "__cdecl _xc_z" __xc_z
0x18000C308: api-ms-win-core-processthreads-l1-1-0_NULL_THUNK_DATA
0x180001010: EnableDisableElevationForSessionWorker
0x180011F10: "ncacn_np" ??_C@_1BC@CCHMBIKG@?$AAn?$AAc?$AAa?$AAc?$AAn?$AA_?$AAn?$AAp?$AA?$AA@
0x18000C350: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x18000C268: "__cdecl _imp_LocalAlloc" __imp_LocalAlloc
0x180012560: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-service-management-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-service-management-l1-1-0
0x180011F00: "\PIPE\" ??_C@_1O@PGAGHCON@?$AA?2?$AAP?$AAI?$AAP?$AAE?$AA?2?$AA?$AA@
0x18000C338: api-ms-win-core-rtlsupport-l1-1-0_NULL_THUNK_DATA
0x180011E90: "LSARPC_ENDPOINT" ??_C@_1CA@CFBBCIJN@?$AAL?$AAS?$AAA?$AAR?$AAP?$AAC?$AA_?$AAE?$AAN?$AAD?$AAP?$AAO?$AAI?$AAN?$AAT?$AA?$AA@
0x1800124E8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0
0x18000C398: api-ms-win-service-management-l1-1-0_NULL_THUNK_DATA
0x18000C318: api-ms-win-core-profile-l1-1-0_NULL_THUNK_DATA
0x18000C438: "__cdecl _guard_fids_table" __guard_fids_table
0x18000C368: "__cdecl _imp_CreateWellKnownSid" __imp_CreateWellKnownSid
0x18000C3F8: msvcrt_NULL_THUNK_DATA
0x18000C140: "__cdecl load_config_used" _load_config_used
0x180001540: LsapCreateBindingHandleForLocal
0x18000C2B8: "__cdecl _imp_RpcBindingFromStringBindingW" __imp_RpcBindingFromStringBindingW
0x18000C3E0: "__cdecl _imp__amsg_exit" __imp__amsg_exit
0x180001030: NotifyInteractiveSessionLogoff
0x18000112C: "unsigned long __cdecl AicEnableElevationForSession(unsigned long)" ?AicEnableElevationForSession@@YAKK@Z
0x18000C330: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x18000C310: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x180001680: PAUTHZ_AUDIT_EVENT_TYPE_OLD_bind
0x18000C288: "__cdecl _imp_RpcStringFreeW" __imp_RpcStringFreeW
0x18000C320: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x180001470: MIDL_user_allocate
0x180001050: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x18000C290: "__cdecl _imp_I_RpcMapWin32Status" __imp_I_RpcMapWin32Status
0x18000C298: "__cdecl _imp_RpcBindingBind" __imp_RpcBindingBind
0x18000C570: "201ef99a-7fa0-444c-9399-19ba84f1" ??_C@_1EK@PNAIGACG@?$AA2?$AA0?$AA1?$AAe?$AAf?$AA9?$AA9?$AAa?$AA?9?$AA7?$AAf?$AAa?$AA0?$AA?9?$AA4?$AA4?$AA4?$AAc?$AA?9?$AA9?$AA3?$AA9?$AA9?$AA?9?$AA1?$AA9?$AAb?$AAa?$AA8?$AA4?$AAf?$AA1@
0x18000C3D8: "__cdecl _imp__XcptFilter" __imp__XcptFilter
0x18000C480: "ext-ms-win-ntuser-windowstation-" ??_C@_1EO@FIHMJCLF@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAn?$AAt?$AAu?$AAs?$AAe?$AAr?$AA?9?$AAw?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AAt?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?9@
0x18000C3D0: "__cdecl _imp_memcpy" __imp_memcpy
0x18000C0E8: g_LsapBindingHandleSecurityQos
0x180013008: "__cdecl _security_cookie" __security_cookie
0x180001650: PLSAPR_SERVER_NAME_unbind
0x18000C250: "__cdecl _imp_LocalFree" __imp_LocalFree
0x1800124FC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0
0x180013608: "__cdecl _onexitbegin" __onexitbegin
0x18000C2D0: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x180012538: "__cdecl _IMPORT_DESCRIPTOR_KERNEL32" __IMPORT_DESCRIPTOR_KERNEL32
0x180002044: "__cdecl _security_init_cookie" __security_init_cookie
0x180011EB0: "lsarpc" ??_C@_1O@CJFJGHLH@?$AAl?$AAs?$AAa?$AAr?$AAp?$AAc?$AA?$AA@
0x180011EF0: g_LsapLocalSystemSid
0x180012484: "__cdecl _IMPORT_DESCRIPTOR_msvcrt" __IMPORT_DESCRIPTOR_msvcrt
0x18000C3E8: "__cdecl _imp_malloc" __imp_malloc
0x180012524: "__cdecl _IMPORT_DESCRIPTOR_RPCRT4" __IMPORT_DESCRIPTOR_RPCRT4
0x18000C2C8: RPCRT4_NULL_THUNK_DATA
0x180002180: "__cdecl _report_gsfailure" __report_gsfailure
0x18000C3A8: api-ms-win-service-winsvc-l1-1-0_NULL_THUNK_DATA
0x180013618: "__cdecl _native_startup_state" __native_startup_state
0x18000C378: "__cdecl _imp_OpenSCManagerW" __imp_OpenSCManagerW
0x18000C278: "__cdecl _imp_NdrClientCall3" __imp_NdrClientCall3
0x1800124AC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0
0x18000C3B8: "__cdecl _imp_free" __imp_free
0x180001FB0: "__cdecl IsNonwritableInCurrentImage" _IsNonwritableInCurrentImage
0x18000C348: api-ms-win-core-synch-l1-2-0_NULL_THUNK_DATA
0x18000C2A0: "__cdecl _imp_RpcBindingSetAuthInfoExW" __imp_RpcBindingSetAuthInfoExW
0x18000C520: "ext-ms-win-ntuser-windowstation-" ??_C@_1EO@PCHFFKDO@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAn?$AAt?$AAu?$AAs?$AAe?$AAr?$AA?9?$AAw?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AAt?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?9@
0x180012498: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0
0x180002399: memset
0x180012588: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
[JEB Decompiler by PNF Software]