Generated by JEB on 2019/08/01

PE: C:\Windows\System32\wbem\KrnlProv.dll Base=0x180000000 SHA-256=99DF18E6CAEE6925D6D11A2C5A5E263389BC74612DFC7E9449BB218FCA868BDB
PDB: KrnlProv.pdb GUID={0AB8F185-81AD-0D0D-D59CA7082AC9554E} Age=1

633 located named symbols:
0x18000B518: "__cdecl GUID_00000001_0000_0000_c000_000000000046" _GUID_00000001_0000_0000_c000_000000000046
0x180007CBC: "__cdecl _raise_securityfailure" __raise_securityfailure
0x180008090: "__cdecl FindPESection" _FindPESection
0x180007460: "public: virtual __cdecl std::bad_alloc::~bad_alloc(void) __ptr64" ??1bad_alloc@std@@UEAA@XZ
0x180001758: "protected: long __cdecl CKernelTraceProvider::InitTracing(void) __ptr64" ?InitTracing@CKernelTraceProvider@@IEAAJXZ
0x180006F60: "__cdecl _delayLoadHelper2" __delayLoadHelper2
0x18000A8E8: "__cdecl _imp_??1exception@@UEAA@XZ" __imp_??1exception@@UEAA@XZ
0x18000D06C: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x18000CF18: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-com-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-com-l1-1-0
0x1800049BC: "public: long __cdecl ATL::CAtlModule::UpdateRegistryFromResourceS(unsigned short const * __ptr64,int,struct ATL::_ATL_REGMAP_ENTRY * __ptr64) __ptr64" ?UpdateRegistryFromResourceS@CAtlModule@ATL@@QEAAJPEBGHPEAU_ATL_REGMAP_ENTRY@2@@Z
0x18000B698: "AllocateAndInitializeSid" ??_C@_0BJ@ECIKFEOL@AllocateAndInitializeSid?$AA@
0x18000A690: "__cdecl _imp_VirtualProtect" __imp_VirtualProtect
0x18000296C: "long __cdecl ATL::AtlHresultFromLastError(void)" ?AtlHresultFromLastError@ATL@@YAJXZ
0x180002020: "protected: static void __cdecl CKernelTraceProvider::OnThreadEvent(struct _EVENT_RECORD * __ptr64,unsigned long)" ?OnThreadEvent@CKernelTraceProvider@@KAXPEAU_EVENT_RECORD@@K@Z
0x18000E150: "__cdecl _security_cookie_complement" __security_cookie_complement
0x18000A5E8: "__cdecl _imp_RaiseException" __imp_RaiseException
0x18000A8D8: "__cdecl _imp_wcsncpy_s" __imp_wcsncpy_s
0x180007C48: "void __cdecl `eh vector constructor iterator'(void * __ptr64,unsigned __int64,int,void (__cdecl*)(void * __ptr64),void (__cdecl*)(void * __ptr64))" ??_L@YAXPEAX_KHP6AX0@Z2@Z
0x18000B0A8: PsProvGuid
0x180002910: "[thunk]:public: virtual unsigned long __cdecl ATL::CComObject<class CKernelTraceProvider>::AddRef`adjustor{16}' (void) __ptr64" ?AddRef@?$CComObject@VCKernelTraceProvider@@@ATL@@WBA@EAAKXZ
0x18000638C: "void __cdecl _com_raise_error(long,struct IErrorInfo * __ptr64)" ?_com_raise_error@@YAXJPEAUIErrorInfo@@@Z
0x18000B1C0: "B" ??_C@_13OPKGLAFF@?$AAB?$AA?$AA@
0x18000ABD8: "ForceRemove" ??_C@_1BI@JFAIJMHL@?$AAF?$AAo?$AAr?$AAc?$AAe?$AAR?$AAe?$AAm?$AAo?$AAv?$AAe?$AA?$AA@
0x18000E160: "class _variant_t vtMissing" ?vtMissing@@3V_variant_t@@A
0x180007520: "protected: virtual void __cdecl std::bad_alloc::_Doraise(void)const __ptr64" ?_Doraise@bad_alloc@std@@MEBAXXZ
0x18000758C: "__cdecl CRT_INIT" _CRT_INIT
0x18000A6A8: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x180002A50: "public: virtual long __cdecl ATL::CAtlModule::Lock(void) __ptr64" ?Lock@CAtlModule@ATL@@UEAAJXZ
0x18000E924: DloadSectionOldProtection
0x180002648: "public: static long __cdecl CWMIComObjectEx<class CKernelTraceProvider>::CreateInstance(class CWMIComObjectEx<class CKernelTraceProvider> * __ptr64 * __ptr64)" ?CreateInstance@?$CWMIComObjectEx@VCKernelTraceProvider@@@@SAJPEAPEAV1@@Z
0x180007A66: "__cdecl _CxxFrameHandler3" __CxxFrameHandler3
0x1800012B4: "public: static long __cdecl ATL::CComObjectRootBase::InternalQueryInterface(void * __ptr64,struct ATL::_ATL_INTMAP_ENTRY const * __ptr64,struct _GUID const & __ptr64,void * __ptr64 * __ptr64)" ?InternalQueryInterface@CComObjectRootBase@ATL@@SAJPEAXPEBU_ATL_INTMAP_ENTRY@2@AEBU_GUID@@PEAPEAX@Z
0x18000742C: "public: __cdecl std::bad_alloc::bad_alloc(void) __ptr64" ??0bad_alloc@std@@QEAA@XZ
0x1800074C8: "void __cdecl operator delete[](void * __ptr64)" ??_V@YAXPEAX@Z
0x180008530: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x18000B508: "__cdecl GUID_00000000_0000_0000_c000_000000000046" _GUID_00000000_0000_0000_c000_000000000046
0x18000CD30: "__cdecl CTA1?AVCAtlException@ATL@@" _CTA1?AVCAtlException@ATL@@
0x1800028D0: "[thunk]:public: virtual long __cdecl ATL::CComObject<class CKernelTraceProvider>::QueryInterface`adjustor{16}' (struct _GUID const & __ptr64,void * __ptr64 * __ptr64) __ptr64" ?QueryInterface@?$CComObject@VCKernelTraceProvider@@@ATL@@WBA@EAAJAEBU_GUID@@PEAPEAX@Z
0x18000A560: "__cdecl _imp_VarUI4FromStr" __imp_VarUI4FromStr
0x18000CF7C: "__cdecl _IMPORT_DESCRIPTOR_OLEAUT32" __IMPORT_DESCRIPTOR_OLEAUT32
0x180006AC8: "public: __cdecl CArray<class CProp,class CProp & __ptr64>::~CArray<class CProp,class CProp & __ptr64>(void) __ptr64" ??1?$CArray@VCProp@@AEAV1@@@QEAA@XZ
0x18000E928: DloadSectionLockCount
0x18000B3F0: "HKEY_CURRENT_CONFIG" ??_C@_1CI@BBJOACGG@?$AAH?$AAK?$AAE?$AAY?$AA_?$AAC?$AAU?$AAR?$AAR?$AAE?$AAN?$AAT?$AA_?$AAC?$AAO?$AAN?$AAF?$AAI?$AAG?$AA?$AA@
0x18000A320: "const ATL::CComClassFactory::`vftable'" ??_7CComClassFactory@ATL@@6B@
0x18000B1B4: "S" ??_C@_13HADIAKP@?$AAS?$AA?$AA@
0x18000AD88: "Win32StartAddr" ??_C@_1BO@PGPEHOJI@?$AAW?$AAi?$AAn?$AA3?$AA2?$AAS?$AAt?$AAa?$AAr?$AAt?$AAA?$AAd?$AAd?$AAr?$AA?$AA@
0x180005A90: DllGetClassObject
0x18000B580: "api-ms-win-core-processsecurity-" ??_C@_1FG@OCNEBFDC@?$AAa?$AAp?$AAi?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAc?$AAo?$AAr?$AAe?$AA?9?$AAp?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AAs?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?9@
0x18000B6D0: "__cdecl _pfnDliFailureHook2" __pfnDliFailureHook2
0x180007478: "void * __ptr64 __cdecl operator new[](unsigned __int64)" ??_U@YAPEAX_K@Z
0x180002920: "void __cdecl ATL::_AtlRaiseException(unsigned long,unsigned long)" ?_AtlRaiseException@ATL@@YAXKK@Z
0x18000AFD0: "select * from Win32_ThreadStopTr" ??_C@_1EI@CDCIBHEG@?$AAs?$AAe?$AAl?$AAe?$AAc?$AAt?$AA?5?$AA?$CK?$AA?5?$AAf?$AAr?$AAo?$AAm?$AA?5?$AAW?$AAi?$AAn?$AA3?$AA2?$AA_?$AAT?$AAh?$AAr?$AAe?$AAa?$AAd?$AAS?$AAt?$AAo?$AAp?$AAT?$AAr@
0x18000AE38: "ImageBase" ??_C@_1BE@OAIGADCK@?$AAI?$AAm?$AAa?$AAg?$AAe?$AAB?$AAa?$AAs?$AAe?$AA?$AA@
0x18000A628: api-ms-win-core-heap-l2-1-0_NULL_THUNK_DATA
0x18000CDA0: "__cdecl _pobjMapEntryLast" __pobjMapEntryLast
0x18000B298: "TypeLib" ??_C@_1BA@JIHHIEDE@?$AAT?$AAy?$AAp?$AAe?$AAL?$AAi?$AAb?$AA?$AA@
0x1800013D0: "public: __cdecl CCritSec::~CCritSec(void) __ptr64" ??1CCritSec@@QEAA@XZ
0x180002B50: "public: virtual void * __ptr64 __cdecl ATL::CComModule::`vector deleting destructor'(unsigned int) __ptr64" ??_ECComModule@ATL@@UEAAPEAXI@Z
0x180002990: "long __cdecl ATL::AtlHresultFromWin32(unsigned long)" ?AtlHresultFromWin32@ATL@@YAJK@Z
0x18000A530: "__cdecl _imp_UnRegisterTypeLib" __imp_UnRegisterTypeLib
0x180006300: "public: __cdecl _com_error::_com_error(class _com_error const & __ptr64) __ptr64" ??0_com_error@@QEAA@AEBV0@@Z
0x180005FB8: "public: __cdecl ATL::CTempBuffer<unsigned short,256,class ATL::CCRTAllocator>::~CTempBuffer<unsigned short,256,class ATL::CCRTAllocator>(void) __ptr64" ??1?$CTempBuffer@G$0BAA@VCCRTAllocator@ATL@@@ATL@@QEAA@XZ
0x180005FB8: "public: __cdecl ATL::CTempBuffer<unsigned short,1024,class ATL::CCRTAllocator>::~CTempBuffer<unsigned short,1024,class ATL::CCRTAllocator>(void) __ptr64" ??1?$CTempBuffer@G$0EAA@VCCRTAllocator@ATL@@@ATL@@QEAA@XZ
0x18000B100: "API-MS-Win-Core-LocalRegistry-L1" ??_C@_1FC@DBDBPMB@?$AAA?$AAP?$AAI?$AA?9?$AAM?$AAS?$AA?9?$AAW?$AAi?$AAn?$AA?9?$AAC?$AAo?$AAr?$AAe?$AA?9?$AAL?$AAo?$AAc?$AAa?$AAl?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?9?$AAL?$AA1@
0x180007AC0: "void __cdecl `eh vector destructor iterator'(void * __ptr64,unsigned __int64,int,void (__cdecl*)(void * __ptr64))" ??_M@YAXPEAX_KHP6AX0@Z@Z
0x18000A970: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x18000A5A0: "__cdecl _imp_CoImpersonateClient" __imp_CoImpersonateClient
0x18000A028: "__cdecl _imp__recalloc" __imp__recalloc
0x180004068: "public: long __cdecl ATL::CRegParser::RegisterBuffer(unsigned short * __ptr64,int) __ptr64" ?RegisterBuffer@CRegParser@ATL@@QEAAJPEAGH@Z
0x18000A7B0: "__cdecl _imp_InitializeCriticalSection" __imp_InitializeCriticalSection
0x180002944: "void __cdecl ATL::AtlThrowImpl(long)" ?AtlThrowImpl@ATL@@YAXJ@Z
0x180006230: "private: void __cdecl ATL::CTempBuffer<unsigned short,256,class ATL::CCRTAllocator>::AllocateHeap(unsigned __int64) __ptr64" ?AllocateHeap@?$CTempBuffer@G$0BAA@VCCRTAllocator@ATL@@@ATL@@AEAAX_K@Z
0x180006230: "private: void __cdecl ATL::CTempBuffer<unsigned char,256,class ATL::CCRTAllocator>::AllocateHeap(unsigned __int64) __ptr64" ?AllocateHeap@?$CTempBuffer@E$0BAA@VCCRTAllocator@ATL@@@ATL@@AEAAX_K@Z
0x180007B30: "void __cdecl __ArrayUnwind(void * __ptr64,unsigned __int64,int,void (__cdecl*)(void * __ptr64))" ?__ArrayUnwind@@YAXPEAX_KHP6AX0@Z@Z
0x1800022E0: "public: virtual long __cdecl CKernelTraceProviderShimClassFactory::CreateInstance(struct IUnknown * __ptr64,struct _GUID const & __ptr64,void * __ptr64 * __ptr64) __ptr64" ?CreateInstance@CKernelTraceProviderShimClassFactory@@UEAAJPEAUIUnknown@@AEBU_GUID@@PEAPEAX@Z
0x18000A830: api-ms-win-eventing-controller-l1-1-0_NULL_THUNK_DATA
0x18000D008: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-string-obsolete-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-string-obsolete-l1-1-0
0x180002BB8: "public: long __cdecl ATL::CRegKey::DeleteSubKey(unsigned short const * __ptr64) __ptr64" ?DeleteSubKey@CRegKey@ATL@@QEAAJPEBG@Z
0x180003114: "public: int __cdecl ATL::CRegParser::CParseBuffer::Append(unsigned short const * __ptr64,int) __ptr64" ?Append@CParseBuffer@CRegParser@ATL@@QEAAHPEBGH@Z
0x180008074: "__cdecl XcptFilter" _XcptFilter
0x18000A978: "__cdecl _xc_a" __xc_a
0x18000CD50: "__cdecl TI1?AV_com_error@@" _TI1?AV_com_error@@
0x18000B168: "advapi32.dll" ??_C@_1BK@JHLNAEJL@?$AAa?$AAd?$AAv?$AAa?$AAp?$AAi?$AA3?$AA2?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x1800063F0: "public: __cdecl CObjAccess::CObjAccess(void) __ptr64" ??0CObjAccess@@QEAA@XZ
0x180006060: "public: virtual long __cdecl ATL::CComObjectCached<class CKernelTraceProviderShimClassFactory>::QueryInterface(struct _GUID const & __ptr64,void * __ptr64 * __ptr64) __ptr64" ?QueryInterface@?$CComObjectCached@VCKernelTraceProviderShimClassFactory@@@ATL@@UEAAJAEBU_GUID@@PEAPEAX@Z
0x18000B0B8: ImageLoad
0x18000CF04: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-eventing-legacy-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-eventing-legacy-l1-1-0
0x18000A250: "const ATL::CComObject<class CKernelTraceProvider>::`vftable'{for `IWbemProviderInit'}" ??_7?$CComObject@VCKernelTraceProvider@@@ATL@@6BIWbemProviderInit@@@
0x180005920: "public: static long __cdecl CKernelTraceProvider::UpdateRegistry(int)" ?UpdateRegistry@CKernelTraceProvider@@SAJH@Z
0x18000642C: "public: __cdecl CObjAccess::~CObjAccess(void) __ptr64" ??1CObjAccess@@QEAA@XZ
0x18000128C: "public: long __cdecl ATL::CComCriticalSection::Init(void) __ptr64" ?Init@CComCriticalSection@ATL@@QEAAJXZ
0x18000A618: api-ms-win-core-heap-l1-1-0_NULL_THUNK_DATA
0x1800028F0: "[thunk]:public: virtual unsigned long __cdecl CWMIComObjectEx<class CKernelTraceProvider>::Release`adjustor{16}' (void) __ptr64" ?Release@?$CWMIComObjectEx@VCKernelTraceProvider@@@@WBA@EAAKXZ
0x18000825B: "__cdecl lock" _lock
0x18000E8E8: DloadSrwLock
0x180003240: "public: virtual long __cdecl ATL::CRegObject::QueryInterface(struct _GUID const & __ptr64,void * __ptr64 * __ptr64) __ptr64" ?QueryInterface@CRegObject@ATL@@UEAAJAEBU_GUID@@PEAPEAX@Z
0x18000805C: "__cdecl callnewh" _callnewh
0x180003054: "public: long __cdecl ATL::CExpansionVector::ClearReplacements(void) __ptr64" ?ClearReplacements@CExpansionVector@ATL@@QEAAJXZ
0x18000AB44: "__cdecl _guard_iat_table" __guard_iat_table
0x180002B40: "public: virtual long __cdecl ATL::CComModule::UpdateRegistryFromResourceS(unsigned int,int,struct ATL::_ATL_REGMAP_ENTRY * __ptr64) __ptr64" ?UpdateRegistryFromResourceS@CComModule@ATL@@UEAAJIHPEAU_ATL_REGMAP_ENTRY@2@@Z
0x18000A630: "__cdecl _imp_LoadLibraryExW" __imp_LoadLibraryExW
0x18000ABA0: "__cdecl _sz_USER32_dll" __sz_USER32_dll
0x18000AC68: "Sid" ??_C@_17NKMLOKHF@?$AAS?$AAi?$AAd?$AA?$AA@
0x180001568: "protected: long __cdecl CKernelTraceProvider::InitEvents(void) __ptr64" ?InitEvents@CKernelTraceProvider@@IEAAJXZ
0x180008488: "__cdecl _GSHandlerCheck_EH" __GSHandlerCheck_EH
0x18000A930: "__cdecl _imp_memset" __imp_memset
0x18000CDF0: USER32_NULL_THUNK_DATA_DLN
0x18000E920: DloadSectionCommitPermanent
0x180010008: USER32_NULL_THUNK_DATA_DLA
0x18000824F: "__cdecl initterm" _initterm
0x18000CE18: USER32_NULL_THUNK_DATA_DLB
0x180007404: "public: __cdecl std::bad_alloc::bad_alloc(class std::bad_alloc const & __ptr64) __ptr64" ??0bad_alloc@std@@QEAA@AEBV01@@Z
0x18000D058: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0
0x18000E910: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x18000A7D0: "__cdecl _imp_Sleep" __imp_Sleep
0x18000B2A8: "HKCR" ??_C@_19NCHLBIN@?$AAH?$AAK?$AAC?$AAR?$AA?$AA@
0x18000A9C8: "__cdecl _xi_z" __xi_z
0x18000AE80: "Win32_ModuleLoadTrace" ??_C@_1CM@HIENBLDI@?$AAW?$AAi?$AAn?$AA3?$AA2?$AA_?$AAM?$AAo?$AAd?$AAu?$AAl?$AAe?$AAL?$AAo?$AAa?$AAd?$AAT?$AAr?$AAa?$AAc?$AAe?$AA?$AA@
0x18000A5C8: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x1800028E0: "[thunk]:public: virtual unsigned long __cdecl ATL::CComObject<class CKernelTraceProvider>::Release`adjustor{16}' (void) __ptr64" ?Release@?$CComObject@VCKernelTraceProvider@@@ATL@@WBA@EAAKXZ
0x1800052B0: "long __cdecl ATL::AtlRegisterClassCategoriesHelper(struct _GUID const & __ptr64,struct ATL::_ATL_CATMAP_ENTRY const * __ptr64,int)" ?AtlRegisterClassCategoriesHelper@ATL@@YAJAEBU_GUID@@PEBU_ATL_CATMAP_ENTRY@1@H@Z
0x180007A72: "__cdecl _C_specific_handler" __C_specific_handler
0x18000AC30: "ParentProcessID" ??_C@_1CA@GOJLKLGG@?$AAP?$AAa?$AAr?$AAe?$AAn?$AAt?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AAI?$AAD?$AA?$AA@
0x18000A788: "__cdecl _imp_ReleaseSRWLockExclusive" __imp_ReleaseSRWLockExclusive
0x18000D080: "__cdecl _IMPORT_DESCRIPTOR_esscli" __IMPORT_DESCRIPTOR_esscli
0x18000A8A8: "__cdecl _imp__onexit" __imp__onexit
0x1800013E0: "public: __cdecl CInCritSec::CInCritSec(struct _RTL_CRITICAL_SECTION * __ptr64) __ptr64" ??0CInCritSec@@QEAA@PEAU_RTL_CRITICAL_SECTION@@@Z
0x180003270: ?GetObjectDescription@?$CComCoClass@VCKernelTraceProvider@@$1?CLSID_KernelTraceProvider@@3U_GUID@@B@ATL@@SAPEBGXZ
0x180002B50: "public: virtual void * __ptr64 __cdecl ATL::CComModule::`scalar deleting destructor'(unsigned int) __ptr64" ??_GCComModule@ATL@@UEAAPEAXI@Z
0x1800024B4: "public: virtual __cdecl ATL::CComObject<class CKernelTraceProvider>::~CComObject<class CKernelTraceProvider>(void) __ptr64" ??1?$CComObject@VCKernelTraceProvider@@@ATL@@UEAA@XZ
0x18000A600: api-ms-win-core-handle-l1-1-0_NULL_THUNK_DATA
0x18000A7B8: "__cdecl _imp_InitializeCriticalSectionAndSpinCount" __imp_InitializeCriticalSectionAndSpinCount
0x18000B428: "Module_Raw" ??_C@_1BG@JBACFMF@?$AAM?$AAo?$AAd?$AAu?$AAl?$AAe?$AA_?$AAR?$AAa?$AAw?$AA?$AA@
0x180005FB8: "public: __cdecl ATL::CTempBuffer<unsigned char,256,class ATL::CCRTAllocator>::~CTempBuffer<unsigned char,256,class ATL::CCRTAllocator>(void) __ptr64" ??1?$CTempBuffer@E$0BAA@VCCRTAllocator@ATL@@@ATL@@QEAA@XZ
0x18000A700: "__cdecl _imp_RegCloseKey" __imp_RegCloseKey
0x18000ACD0: "Win32_ProcessStopTrace" ??_C@_1CO@KDEKMJDO@?$AAW?$AAi?$AAn?$AA3?$AA2?$AA_?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AAS?$AAt?$AAo?$AAp?$AAT?$AAr?$AAa?$AAc?$AAe?$AA?$AA@
0x18000839C: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x180002748: "public: __cdecl ATL::CComObject<class CKernelTraceProvider>::CComObject<class CKernelTraceProvider>(void * __ptr64) __ptr64" ??0?$CComObject@VCKernelTraceProvider@@@ATL@@QEAA@PEAX@Z
0x18000B548: GUID_ATLVer70
0x18000A810: "__cdecl _imp_OpenTraceW" __imp_OpenTraceW
0x180003270: "public: static struct ATL::_ATL_CATMAP_ENTRY const * __ptr64 __cdecl ATL::CComObjectRootBase::GetCategoryMap(void)" ?GetCategoryMap@CComObjectRootBase@ATL@@SAPEBU_ATL_CATMAP_ENTRY@2@XZ
0x18000AC50: "SessionID" ??_C@_1BE@IFHLDFGK@?$AAS?$AAe?$AAs?$AAs?$AAi?$AAo?$AAn?$AAI?$AAD?$AA?$AA@
0x180005A70: DllCanUnloadNow
0x18000A6E8: "__cdecl _imp_RegEnumKeyExW" __imp_RegEnumKeyExW
0x18000ABB0: CLSID_StdComponentCategoriesMgr
0x180006988: "public: int __cdecl CObjAccess::WriteNULL(unsigned long) __ptr64" ?WriteNULL@CObjAccess@@QEAAHK@Z
0x1800021DC: "protected: static void __cdecl CKernelTraceProvider::OnImageEvent(struct _EVENT_RECORD * __ptr64)" ?OnImageEvent@CKernelTraceProvider@@KAXPEAU_EVENT_RECORD@@@Z
0x18000B270: "SYSTEM" ??_C@_1O@GBFINDKL@?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?$AA@
0x18000A838: "__cdecl _imp_EnableTraceEx" __imp_EnableTraceEx
0x180006740: "public: int __cdecl CObjAccess::WriteString(unsigned long,unsigned short const * __ptr64) __ptr64" ?WriteString@CObjAccess@@QEAAHKPEBG@Z
0x18000A758: api-ms-win-core-string-l1-1-0_NULL_THUNK_DATA
0x180004F14: "long __cdecl ATL::AtlLoadTypeLib(struct HINSTANCE__ * __ptr64,unsigned short const * __ptr64,unsigned short * __ptr64 * __ptr64,struct ITypeLib * __ptr64 * __ptr64)" ?AtlLoadTypeLib@ATL@@YAJPEAUHINSTANCE__@@PEBGPEAPEAGPEAPEAUITypeLib@@@Z
0x180003310: "public: virtual void * __ptr64 __cdecl ATL::CRegObject::`scalar deleting destructor'(unsigned int) __ptr64" ??_GCRegObject@ATL@@UEAAPEAXI@Z
0x18000A708: "__cdecl _imp_RegSetValueExW" __imp_RegSetValueExW
0x180008080: "__cdecl amsg_exit" _amsg_exit
0x180006798: "public: int __cdecl CObjAccess::WriteString(unsigned long,char const * __ptr64) __ptr64" ?WriteString@CObjAccess@@QEAAHKPEBD@Z
0x18000A8D0: "__cdecl _imp__callnewh" __imp__callnewh
0x18000B188: "RegDeleteKeyW" ??_C@_0O@BJCLIAAA@RegDeleteKeyW?$AA@
0x1800028C0: "[thunk]:public: virtual unsigned long __cdecl CWMIComObjectEx<class CKernelTraceProvider>::Release`adjustor{8}' (void) __ptr64" ?Release@?$CWMIComObjectEx@VCKernelTraceProvider@@@@W7EAAKXZ
0x1800024A0: "public: virtual unsigned long __cdecl ATL::CComObject<class CKernelTraceProvider>::AddRef(void) __ptr64" ?AddRef@?$CComObject@VCKernelTraceProvider@@@ATL@@UEAAKXZ
0x18000B478: "\Required Categories" ??_C@_1CK@IFBKBFAA@?$AA?2?$AAR?$AAe?$AAq?$AAu?$AAi?$AAr?$AAe?$AAd?$AA?5?$AAC?$AAa?$AAt?$AAe?$AAg?$AAo?$AAr?$AAi?$AAe?$AAs?$AA?$AA@
0x18000B1B8: "M" ??_C@_13LHMFKAAD@?$AAM?$AA?$AA@
0x18000AD00: "StackBase" ??_C@_1BE@HBGIBAMB@?$AAS?$AAt?$AAa?$AAc?$AAk?$AAB?$AAa?$AAs?$AAe?$AA?$AA@
0x18000ABC0: GUID_NULL
0x18000A770: "__cdecl _imp_lstrcmpiW" __imp_lstrcmpiW
0x18000A890: "__cdecl _imp__lock" __imp__lock
0x18000A570: OLEAUT32_NULL_THUNK_DATA
0x1800023B0: "public: virtual unsigned long __cdecl CWMIComObjectEx<class CKernelTraceProvider>::Release(void) __ptr64" ?Release@?$CWMIComObjectEx@VCKernelTraceProvider@@@@UEAAKXZ
0x18000AE68: "FileName" ??_C@_1BC@PKFGPGJB@?$AAF?$AAi?$AAl?$AAe?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x18000A558: "__cdecl _imp_LoadTypeLib" __imp_LoadTypeLib
0x180007C1C: atexit
0x18000CEDC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-eventing-consumer-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-eventing-consumer-l1-1-0
0x18000AB50: "bad allocation" ??_C@_0P@GHFPNOJB@bad?5allocation?$AA@
0x18000E7F0: "class ATL::CAtlBaseModule ATL::_AtlBaseModule" ?_AtlBaseModule@ATL@@3VCAtlBaseModule@1@A
0x18000A230: "const ATL::CComObject<class CKernelTraceProvider>::`vftable'{for `IWbemEventProviderSecurity'}" ??_7?$CComObject@VCKernelTraceProvider@@@ATL@@6BIWbemEventProviderSecurity@@@
0x18000A668: "__cdecl _imp_LoadLibraryExA" __imp_LoadLibraryExA
0x1800025A0: ??1?$_com_ptr_t@V?$_com_IIID@UIWbemEventSink@@$1?_GUID_3ae0080a_7e3a_4366_bf89_0feedc931659@@3U__s_GUID@@B@@@@QEAA@XZ
0x18000A790: "__cdecl _imp_EnterCriticalSection" __imp_EnterCriticalSection
0x180006230: "private: void __cdecl ATL::CTempBuffer<unsigned short,1024,class ATL::CCRTAllocator>::AllocateHeap(unsigned __int64) __ptr64" ?AllocateHeap@?$CTempBuffer@G$0EAA@VCCRTAllocator@ATL@@@ATL@@AEAAX_K@Z
0x18000A720: api-ms-win-core-registry-l1-1-0_NULL_THUNK_DATA
0x18000AB60: "Invalid parameter passed to C ru" ??_C@_0DB@OPDBMGNG@Invalid?5parameter?5passed?5to?5C?5ru@
0x1800025D0: ??0?$_com_ptr_t@V?$_com_IIID@UIWbemEventSink@@$1?_GUID_3ae0080a_7e3a_4366_bf89_0feedc931659@@3U__s_GUID@@B@@@@QEAA@XZ
0x180002440: "public: virtual unsigned long __cdecl ATL::CComObject<class CKernelTraceProvider>::Release(void) __ptr64" ?Release@?$CComObject@VCKernelTraceProvider@@@ATL@@UEAAKXZ
0x18000A168: "const ATL::CComObject<class CKernelTraceProvider>::`vftable'{for `IWbemEventProvider'}" ??_7?$CComObject@VCKernelTraceProvider@@@ATL@@6BIWbemEventProvider@@@
0x18000A5F0: api-ms-win-core-errorhandling-l1-1-0_NULL_THUNK_DATA
0x18000A370: "const _com_error::`vftable'" ??_7_com_error@@6B@
0x18000CD08: "__stdcall CT??_R0?AVCAtlException@ATL@@" _CT??_R0?AVCAtlException@ATL@@@84
0x18000A7E8: "__cdecl _imp_GetSystemInfo" __imp_GetSystemInfo
0x18000A6B8: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x180008273: "__cdecl _dllonexit" __dllonexit
0x180001940: "protected: static unsigned long __cdecl CKernelTraceProvider::DoProcessTrace(class CKernelTraceProvider * __ptr64)" ?DoProcessTrace@CKernelTraceProvider@@KAKPEAV1@@Z
0x18000B068: "__cdecl GUID_e245105b_b06e_11d0_ad61_00c04fd8fdff" _GUID_e245105b_b06e_11d0_ad61_00c04fd8fdff
0x1800025A0: ??1?$_com_ptr_t@V?$_com_IIID@UIWbemServices@@$1?_GUID_9556dc99_828c_11cf_a37e_00aa003240c7@@3U__s_GUID@@B@@@@QEAA@XZ
0x18000CD70: "__cdecl CT??_R0?AV_com_error@@@8??0_com_error@@QEAA@AEBV0@@Z32" _CT??_R0?AV_com_error@@@8??0_com_error@@QEAA@AEBV0@@Z32
0x18000A778: "__cdecl _imp_lstrlenA" __imp_lstrlenA
0x18000B310: "HKEY_CLASSES_ROOT" ??_C@_1CE@PACHPJFI@?$AAH?$AAK?$AAE?$AAY?$AA_?$AAC?$AAL?$AAA?$AAS?$AAS?$AAE?$AAS?$AA_?$AAR?$AAO?$AAO?$AAT?$AA?$AA@
0x18000E8F0: "__cdecl _native_startup_lock" __native_startup_lock
0x180006C5C: "public: __cdecl _bstr_t::~_bstr_t(void) __ptr64" ??1_bstr_t@@QEAA@XZ
0x180005938: DllMain
0x18000CFF4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-string-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-string-l1-1-0
0x18000A8F0: "__cdecl _imp_wcscat_s" __imp_wcscat_s
0x18000CFE0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-string-l2-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-string-l2-1-0
0x18000A8B8: "__cdecl _imp_realloc" __imp_realloc
0x18000A910: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x18000A740: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x18000A680: api-ms-win-core-libraryloader-l1-2-0_NULL_THUNK_DATA
0x180001280: "public: static void __cdecl ATL::CComObjectRootBase::ObjectMain(bool)" ?ObjectMain@CComObjectRootBase@ATL@@SAX_N@Z
0x1800083FD: "__cdecl _imp_load_UnregisterClassA" __imp_load_UnregisterClassA
0x18000E8E0: "__cdecl _puiHead" __puiHead
0x18000AE08: "Win32_ThreadStopTrace" ??_C@_1CM@ELPOHLFJ@?$AAW?$AAi?$AAn?$AA3?$AA2?$AA_?$AAT?$AAh?$AAr?$AAe?$AAa?$AAd?$AAS?$AAt?$AAo?$AAp?$AAT?$AAr?$AAa?$AAc?$AAe?$AA?$AA@
0x180002B20: "public: virtual long __cdecl ATL::CComModule::UpdateRegistryFromResourceD(unsigned int,int,struct ATL::_ATL_REGMAP_ENTRY * __ptr64) __ptr64" ?UpdateRegistryFromResourceD@CComModule@ATL@@UEAAJIHPEAU_ATL_REGMAP_ENTRY@2@@Z
0x18000A5D8: "__cdecl _imp_GetLastError" __imp_GetLastError
0x180007478: "void * __ptr64 __cdecl operator new(unsigned __int64)" ??2@YAPEAX_K@Z
0x18000A848: api-ms-win-eventing-legacy-l1-1-0_NULL_THUNK_DATA
0x180002420: "public: virtual long __cdecl ATL::CComObject<class CKernelTraceProvider>::QueryInterface(struct _GUID const & __ptr64,void * __ptr64 * __ptr64) __ptr64" ?QueryInterface@?$CComObject@VCKernelTraceProvider@@@ATL@@UEAAJAEBU_GUID@@PEAPEAX@Z
0x18000827F: "__cdecl errno" _errno
0x18000E140: "__cdecl _native_dllmain_reason" __native_dllmain_reason
0x180008378: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x1800050BC: "long __cdecl ATL::AtlRegisterTypeLib(struct HINSTANCE__ * __ptr64,unsigned short const * __ptr64)" ?AtlRegisterTypeLib@ATL@@YAJPEAUHINSTANCE__@@PEBG@Z
0x18000AC70: "ProcessName" ??_C@_1BI@DMELAOBE@?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x18000B538: "__cdecl GUID_00000146_0000_0000_c000_000000000046" _GUID_00000146_0000_0000_c000_000000000046
0x180002938: "public: __cdecl ATL::CAtlException::CAtlException(long) __ptr64" ??0CAtlException@ATL@@QEAA@J@Z
0x18000B558: IID_IWbemEventSink
0x18000E728: "class CCritSec g_KernelTraceCritSec" ?g_KernelTraceCritSec@@3VCCritSec@@A
0x180006910: "public: int __cdecl CObjAccess::WriteDWORD(unsigned long,unsigned long) __ptr64" ?WriteDWORD@CObjAccess@@QEAAHKK@Z
0x18000A960: wbemcomn_NULL_THUNK_DATA
0x180003310: "public: virtual void * __ptr64 __cdecl ATL::CRegObject::`vector deleting destructor'(unsigned int) __ptr64" ??_ECRegObject@ATL@@UEAAPEAXI@Z
0x1800064C0: "public: int __cdecl CObjAccess::Init(struct IWbemServices * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64 * __ptr64,unsigned long,enum CObjAccess::INIT_FAILED_PROP_TYPE) __ptr64" ?Init@CObjAccess@@QEAAHPEAUIWbemServices@@PEBGPEAPEBGKW4INIT_FAILED_PROP_TYPE@1@@Z
0x18000A5B8: "__cdecl _imp_OutputDebugStringA" __imp_OutputDebugStringA
0x18000A850: "__cdecl _imp_?IsUserAdministrator@@YAJPEAX@Z" __imp_?IsUserAdministrator@@YAJPEAX@Z
0x18000AC08: "Delete" ??_C@_1O@JDLOHAN@?$AAD?$AAe?$AAl?$AAe?$AAt?$AAe?$AA?$AA@
0x180006124: "public: static long __cdecl ATL::CComCreator<class ATL::CComObject<class CKernelTraceProvider> >::CreateInstance(void * __ptr64,struct _GUID const & __ptr64,void * __ptr64 * __ptr64)" ?CreateInstance@?$CComCreator@V?$CComObject@VCKernelTraceProvider@@@ATL@@@ATL@@SAJPEAXAEBU_GUID@@PEAPEAX@Z
0x18000A6B0: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x18000A7A8: "__cdecl _imp_WaitForSingleObject" __imp_WaitForSingleObject
0x18000ABF0: "NoRemove" ??_C@_1BC@GCKHIPE@?$AAN?$AAo?$AAR?$AAe?$AAm?$AAo?$AAv?$AAe?$AA?$AA@
0x18000B098: "__cdecl GUID_631f7d96_d993_11d2_b339_00105a1f4aaf" _GUID_631f7d96_d993_11d2_b339_00105a1f4aaf
0x180003350: "public: virtual long __cdecl ATL::CRegObject::AddReplacement(unsigned short const * __ptr64,unsigned short const * __ptr64) __ptr64" ?AddReplacement@CRegObject@ATL@@UEAAJPEBG0@Z
0x18000A6F0: "__cdecl _imp_RegDeleteValueW" __imp_RegDeleteValueW
0x18000A5A8: "__cdecl _imp_CoRevertToSelf" __imp_CoRevertToSelf
0x180008140: "__cdecl ValidateImageBase" _ValidateImageBase
0x18000A670: "__cdecl _imp_SizeofResource" __imp_SizeofResource
0x180006348: "public: virtual __cdecl _com_error::~_com_error(void) __ptr64" ??1_com_error@@UEAA@XZ
0x180008032: "public: __cdecl exception::exception(class exception const & __ptr64) __ptr64" ??0exception@@QEAA@AEBV0@@Z
0x18000B2C8: "HKLM" ??_C@_19PEALEEJB@?$AAH?$AAK?$AAL?$AAM?$AA?$AA@
0x18000CFB8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0
0x18000A608: "__cdecl _imp_HeapAlloc" __imp_HeapAlloc
0x18000A658: "__cdecl _imp_FreeLibrary" __imp_FreeLibrary
0x18000A798: "__cdecl _imp_AcquireSRWLockExclusive" __imp_AcquireSRWLockExclusive
0x18000CDC8: "__cdecl _NULL_DELAY_IMPORT_DESCRIPTOR" __NULL_DELAY_IMPORT_DESCRIPTOR
0x18000E0E8: "__vectorcall ??_R0?AVCAtlException@ATL@" ??_R0?AVCAtlException@ATL@@@8
0x18000A780: api-ms-win-core-string-obsolete-l1-1-0_NULL_THUNK_DATA
0x18000A768: api-ms-win-core-string-l2-1-0_NULL_THUNK_DATA
0x1800077D0: "__cdecl DllMainCRTStartup" _DllMainCRTStartup
0x18000A878: "__cdecl _imp__initterm" __imp__initterm
0x18000AD50: "UserStackLimit" ??_C@_1BO@HIGAIIEH@?$AAU?$AAs?$AAe?$AAr?$AAS?$AAt?$AAa?$AAc?$AAk?$AAL?$AAi?$AAm?$AAi?$AAt?$AA?$AA@
0x18000CF40: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-debug-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-debug-l1-1-0
0x1800037CC: "protected: long __cdecl ATL::CRegParser::AddValue(class ATL::CRegKey & __ptr64,unsigned short const * __ptr64,unsigned short * __ptr64) __ptr64" ?AddValue@CRegParser@ATL@@IEAAJAEAVCRegKey@2@PEBGPEAG@Z
0x180001500: "public: virtual long __cdecl CKernelTraceProvider::Initialize(unsigned short * __ptr64,long,unsigned short * __ptr64,unsigned short * __ptr64,struct IWbemServices * __ptr64,struct IWbemContext * __ptr64,struct IWbemProviderInitSink * __ptr64) __ptr64" ?Initialize@CKernelTraceProvider@@UEAAJPEAGJ00PEAUIWbemServices@@PEAUIWbemContext@@PEAUIWbemProviderInitSink@@@Z
0x18000A598: "__cdecl _imp_StringFromGUID2" __imp_StringFromGUID2
0x18000A5E0: "__cdecl _imp_SetLastError" __imp_SetLastError
0x180003CF8: "protected: long __cdecl ATL::CRegParser::SkipAssignment(unsigned short * __ptr64) __ptr64" ?SkipAssignment@CRegParser@ATL@@IEAAJPEAG@Z
0x18000CC88: "__cdecl TI2?AVbad_alloc@std@@" _TI2?AVbad_alloc@std@@
0x180002C74: "public: long __cdecl ATL::CRegKey::RecurseDeleteKey(unsigned short const * __ptr64) __ptr64" ?RecurseDeleteKey@CRegKey@ATL@@QEAAJPEBG@Z
0x180007F80: "__cdecl recalloc" _recalloc
0x18000B1C8: "Component Categories" ??_C@_1CK@OEKPKBNA@?$AAC?$AAo?$AAm?$AAp?$AAo?$AAn?$AAe?$AAn?$AAt?$AA?5?$AAC?$AAa?$AAt?$AAe?$AAg?$AAo?$AAr?$AAi?$AAe?$AAs?$AA?$AA@
0x18000A640: "__cdecl _imp_GetModuleFileNameW" __imp_GetModuleFileNameW
0x18000803E: "public: virtual __cdecl exception::~exception(void) __ptr64" ??1exception@@UEAA@XZ
0x18000A800: "__cdecl _imp_CloseTrace" __imp_CloseTrace
0x18000CFCC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0
0x18000CC60: "__cdecl CT??_R0?AVexception@@@8??0exception@@QEAA@AEBV0@@Z24" _CT??_R0?AVexception@@@8??0exception@@QEAA@AEBV0@@Z24
0x18000E700: "__cdecl _hmod__USER32_dll" __hmod__USER32_dll
0x180005900: "public: virtual long __cdecl ATL::CComClassFactory::LockServer(int) __ptr64" ?LockServer@CComClassFactory@ATL@@UEAAJH@Z
0x18000B250: "SAM" ??_C@_17OMAOINJK@?$AAS?$AAA?$AAM?$AA?$AA@
0x18000E900: "__cdecl _onexitend" __onexitend
0x18000A6A0: "__cdecl _imp_CreateThread" __imp_CreateThread
0x18000B2E0: "HKPD" ??_C@_19PNBHMJPL@?$AAH?$AAK?$AAP?$AAD?$AA?$AA@
0x180002A70: "public: virtual long __cdecl ATL::CAtlModule::Unlock(void) __ptr64" ?Unlock@CAtlModule@ATL@@UEAAJXZ
0x180008267: "__cdecl unlock" _unlock
0x180003614: "protected: long __cdecl ATL::CRegParser::NextToken(unsigned short * __ptr64) __ptr64" ?NextToken@CRegParser@ATL@@IEAAJPEAG@Z
0x180006274: "public: __cdecl _com_error::_com_error(long,struct IErrorInfo * __ptr64,bool) __ptr64" ??0_com_error@@QEAA@JPEAUIErrorInfo@@_N@Z
0x18000A968: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x18000A8E0: "__cdecl _imp__CxxThrowException" __imp__CxxThrowException
0x1800028A0: "[thunk]:public: virtual long __cdecl ATL::CComObject<class CKernelTraceProvider>::QueryInterface`adjustor{8}' (struct _GUID const & __ptr64,void * __ptr64 * __ptr64) __ptr64" ?QueryInterface@?$CComObject@VCKernelTraceProvider@@@ATL@@W7EAAJAEBU_GUID@@PEAPEAX@Z
0x180007FF0: "public: virtual void * __ptr64 __cdecl type_info::`vector deleting destructor'(unsigned int) __ptr64" ??_Etype_info@@UEAAPEAXI@Z
0x18000A6C0: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x18000A950: "__cdecl _imp_?_ThrowMemoryException_@@YAXXZ" __imp_?_ThrowMemoryException_@@YAXXZ
0x18000B0C8: "__cdecl GUID_1be41572_91dd_11d1_aeb2_00c04fb68820" _GUID_1be41572_91dd_11d1_aeb2_00c04fb68820
0x180002B20: "public: virtual long __cdecl ATL::CComModule::UpdateRegistryFromResourceD(unsigned short const * __ptr64,int,struct ATL::_ATL_REGMAP_ENTRY * __ptr64) __ptr64" ?UpdateRegistryFromResourceD@CComModule@ATL@@UEAAJPEBGHPEAU_ATL_REGMAP_ENTRY@2@@Z
0x18000AF80: "select * from Win32_ThreadStartT" ??_C@_1EK@NFAIKGPM@?$AAs?$AAe?$AAl?$AAe?$AAc?$AAt?$AA?5?$AA?$CK?$AA?5?$AAf?$AAr?$AAo?$AAm?$AA?5?$AAW?$AAi?$AAn?$AA3?$AA2?$AA_?$AAT?$AAh?$AAr?$AAe?$AAa?$AAd?$AAS?$AAt?$AAa?$AAr?$AAt?$AAT@
0x18000AD18: "StackLimit" ??_C@_1BG@MPBOMAEA@?$AAS?$AAt?$AAa?$AAc?$AAk?$AAL?$AAi?$AAm?$AAi?$AAt?$AA?$AA@
0x18000A7F8: api-ms-win-core-sysinfo-l1-1-0_NULL_THUNK_DATA
0x18000A9B8: "__cdecl _xi_a" __xi_a
0x18000B3D0: "HKEY_DYN_DATA" ??_C@_1BM@HAGMMHIA@?$AAH?$AAK?$AAE?$AAY?$AA_?$AAD?$AAY?$AAN?$AA_?$AAD?$AAA?$AAT?$AAA?$AA?$AA@
0x18000A7E0: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x18000A5C0: api-ms-win-core-debug-l1-1-0_NULL_THUNK_DATA
0x180005890: "public: virtual long __cdecl ATL::CComClassFactory::CreateInstance(struct IUnknown * __ptr64,struct _GUID const & __ptr64,void * __ptr64 * __ptr64) __ptr64" ?CreateInstance@CComClassFactory@ATL@@UEAAJPEAUIUnknown@@AEBU_GUID@@PEAPEAX@Z
0x180002610: "public: virtual void * __ptr64 __cdecl CWMIComObjectEx<class CKernelTraceProvider>::`vector deleting destructor'(unsigned int) __ptr64" ??_E?$CWMIComObjectEx@VCKernelTraceProvider@@@@UEAAPEAXI@Z
0x18000A918: "__cdecl _imp__unlock" __imp__unlock
0x18000A2A0: "const ATL::CComModule::`vftable'" ??_7CComModule@ATL@@6B@
0x18000E8A0: "long (__cdecl* __ptr64 ATL::_pPerfRegFunc)(struct HINSTANCE__ * __ptr64)" ?_pPerfRegFunc@ATL@@3P6AJPEAUHINSTANCE__@@@ZEA
0x18000E710: "class CKernelTraceProvider * __ptr64 __ptr64 g_pThis" ?g_pThis@@3PEAVCKernelTraceProvider@@EA
0x18000B1BC: "D" ??_C@_13MKMNOPIJ@?$AAD?$AA?$AA@
0x18000B240: "Mime" ??_C@_19HLLLM@?$AAM?$AAi?$AAm?$AAe?$AA?$AA@
0x180002610: "public: virtual void * __ptr64 __cdecl ATL::CComObject<class CKernelTraceProvider>::`scalar deleting destructor'(unsigned int) __ptr64" ??_G?$CComObject@VCKernelTraceProvider@@@ATL@@UEAAPEAXI@Z
0x18000B360: "HKEY_LOCAL_MACHINE" ??_C@_1CG@GFBEANJL@?$AAH?$AAK?$AAE?$AAY?$AA_?$AAL?$AAO?$AAC?$AAA?$AAL?$AA_?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?$AA@
0x18000A588: "__cdecl _imp_CoTaskMemFree" __imp_CoTaskMemFree
0x1800074E0: "public: virtual void * __ptr64 __cdecl std::bad_alloc::`scalar deleting destructor'(unsigned int) __ptr64" ??_Gbad_alloc@std@@UEAAPEAXI@Z
0x18000CCC0: "__cdecl CT??_R0?AVbad_alloc@std@@@8??0bad_alloc@std@@QEAA@AEBV01@@Z24" _CT??_R0?AVbad_alloc@std@@@8??0bad_alloc@std@@QEAA@AEBV01@@Z24
0x180010000: "__cdecl _imp_UnregisterClassA" __imp_UnregisterClassA
0x180008298: "__cdecl invoke_watson" _invoke_watson
0x180008409: "__cdecl _tailMerge_user32_dll" __tailMerge_user32_dll
0x18000B454: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x180006DB4: DloadMakePermanentImageCommit
0x18000CF54: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0
0x18000A698: api-ms-win-core-memory-l1-1-0_NULL_THUNK_DATA
0x18000E8B0: "public: static struct _GUID ATL::CAtlModule::m_libid" ?m_libid@CAtlModule@ATL@@2U_GUID@@A
0x18000B468: "CLSID\" ??_C@_1O@FHBGLCIO@?$AAC?$AAL?$AAS?$AAI?$AAD?$AA?2?$AA?$AA@
0x18000A650: "__cdecl _imp_FindResourceExW" __imp_FindResourceExW
0x180007E78: "__cdecl _report_rangecheckfailure" __report_rangecheckfailure
0x18000E918: "__cdecl pRawDllMain" _pRawDllMain
0x18000A8C8: "__cdecl _imp_??1type_info@@UEAA@XZ" __imp_??1type_info@@UEAA@XZ
0x180006028: "public: __cdecl ATL::_ATL_SAFE_ALLOCA_IMPL::CAtlSafeAllocBufferManager<class ATL::CCRTAllocator>::~CAtlSafeAllocBufferManager<class ATL::CCRTAllocator>(void) __ptr64" ??1?$CAtlSafeAllocBufferManager@VCCRTAllocator@ATL@@@_ATL_SAFE_ALLOCA_IMPL@ATL@@QEAA@XZ
0x180005CB0: DllUnregisterServer
0x18000A940: "__cdecl _imp_RtlFreeSid" __imp_RtlFreeSid
0x18000A8A0: "__cdecl _imp___dllonexit" __imp___dllonexit
0x18000A568: "__cdecl _imp_VariantClear" __imp_VariantClear
0x18000E850: "class ATL::CAtlWinModule ATL::_AtlWinModule" ?_AtlWinModule@ATL@@3VCAtlWinModule@1@A
0x1800035D0: "public: virtual long __cdecl ATL::CRegObject::ClearReplacements(void) __ptr64" ?ClearReplacements@CRegObject@ATL@@UEAAJXZ
0x1800074C8: "void __cdecl operator delete(void * __ptr64)" ??3@YAXPEAX@Z
0x180001AA0: "public: virtual long __cdecl CKernelTraceProvider::AccessCheck(unsigned short const * __ptr64,unsigned short const * __ptr64,long,unsigned char const * __ptr64) __ptr64" ?AccessCheck@CKernelTraceProvider@@UEAAJPEBG0JPEBE@Z
0x180001280: "public: __cdecl ATL::CComCriticalSection::~CComCriticalSection(void) __ptr64" ??1CComCriticalSection@ATL@@QEAA@XZ
0x18000A030: "const type_info::`vftable'" ??_7type_info@@6B@
0x18000D0BC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-l1-1-0
0x18000A7A0: "__cdecl _imp_DeleteCriticalSection" __imp_DeleteCriticalSection
0x180007A90: "__cdecl _security_check_cookie" __security_check_cookie
0x18000E8C0: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUvmwfhviUexPyrmzirvhUhixUzgoHBUzgohUivgzroUlyquivUznwGEUhgwzucOlyq@atls" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUvmwfhviUexPyrmzirvhUhixUzgoHBUzgohUivgzroUlyquivUznwGEUhgwzucOlyq@atls
0x18000A9B0: "__cdecl _xc_z" __xc_z
0x18000D01C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0
0x18000A6D0: api-ms-win-core-processthreads-l1-1-0_NULL_THUNK_DATA
0x18000694C: "public: int __cdecl CObjAccess::WriteDWORD64(unsigned long,unsigned __int64) __ptr64" ?WriteDWORD64@CObjAccess@@QEAAHK_K@Z
0x18000A660: "__cdecl _imp_GetProcAddress" __imp_GetProcAddress
0x18000A818: api-ms-win-eventing-consumer-l1-1-0_NULL_THUNK_DATA
0x18000B088: ThreadStop
0x18000ACB8: "ExitStatus" ??_C@_1BG@NIOLAPFI@?$AAE?$AAx?$AAi?$AAt?$AAS?$AAt?$AAa?$AAt?$AAu?$AAs?$AA?$AA@
0x18000B078: ProcessStop
0x180008068: "__cdecl CxxThrowException" _CxxThrowException
0x18000A380: ?_entries@?1??_GetEntries@CComClassFactory@ATL@@SAPEBU_ATL_INTMAP_ENTRY@3@XZ@4QBU43@B
0x18000A880: "__cdecl _imp_?terminate@@YAXXZ" __imp_?terminate@@YAXXZ
0x18000B6D0: "__cdecl _pfnDefaultDliNotifyHook2" __pfnDefaultDliNotifyHook2
0x18000AD30: "UserStackBase" ??_C@_1BM@GJNKMPDM@?$AAU?$AAs?$AAe?$AAr?$AAS?$AAt?$AAa?$AAc?$AAk?$AAB?$AAa?$AAs?$AAe?$AA?$AA@
0x18000AF30: "select * from Win32_ProcessStopT" ??_C@_1EK@CKBEICAF@?$AAs?$AAe?$AAl?$AAe?$AAc?$AAt?$AA?5?$AA?$CK?$AA?5?$AAf?$AAr?$AAo?$AAm?$AA?5?$AAW?$AAi?$AAn?$AA3?$AA2?$AA_?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AAS?$AAt?$AAo?$AAp?$AAT@
0x18000A580: "__cdecl _imp_CoCreateInstance" __imp_CoCreateInstance
0x18000A7F0: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x18000CDA8: "__cdecl _DELAY_IMPORT_DESCRIPTOR_USER32_dll" __DELAY_IMPORT_DESCRIPTOR_USER32_dll
0x18000B300: "HKCC" ??_C@_19OFICIBHH@?$AAH?$AAK?$AAC?$AAC?$AA?$AA@
0x18000E0C0: "__vectorcall ??_R0?AVbad_alloc@std@" ??_R0?AVbad_alloc@std@@@8
0x18000B338: "HKEY_CURRENT_USER" ??_C@_1CE@HLHNCBPM@?$AAH?$AAK?$AAE?$AAY?$AA_?$AAC?$AAU?$AAR?$AAR?$AAE?$AAN?$AAT?$AA_?$AAU?$AAS?$AAE?$AAR?$AA?$AA@
0x18000A610: "__cdecl _imp_GetProcessHeap" __imp_GetProcessHeap
0x180008550: "__cdecl _chkstk" __chkstk
0x18000AC18: "ProcessID" ??_C@_1BE@BNMOPHPL@?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AAI?$AAD?$AA?$AA@
0x18000B228: "Hardware" ??_C@_1BC@MAICEHGI@?$AAH?$AAa?$AAr?$AAd?$AAw?$AAa?$AAr?$AAe?$AA?$AA@
0x180002DB4: "public: int __cdecl ATL::CExpansionVector::Add(unsigned short const * __ptr64,unsigned short const * __ptr64) __ptr64" ?Add@CExpansionVector@ATL@@QEAAHPEBG0@Z
0x180007FF0: "public: virtual void * __ptr64 __cdecl type_info::`scalar deleting destructor'(unsigned int) __ptr64" ??_Gtype_info@@UEAAPEAXI@Z
0x18000A8B0: "__cdecl _imp__errno" __imp__errno
0x18000B4F8: CLSID_KernelTraceProvider
0x18000ADD8: "Win32_ThreadStartTrace" ??_C@_1CO@FMFGONMH@?$AAW?$AAi?$AAn?$AA3?$AA2?$AA_?$AAT?$AAh?$AAr?$AAe?$AAa?$AAd?$AAS?$AAt?$AAa?$AAr?$AAt?$AAT?$AAr?$AAa?$AAc?$AAe?$AA?$AA@
0x18000A858: esscli_NULL_THUNK_DATA
0x18000828C: "__cdecl invalid_parameter" _invalid_parameter
0x180008361: realloc
0x18000B568: IID__IWmiObject
0x18000B258: "SECURITY" ??_C@_1BC@IBECJAAI@?$AAS?$AAE?$AAC?$AAU?$AAR?$AAI?$AAT?$AAY?$AA?$AA@
0x18000E7A0: "class ATL::CAtlComModule ATL::_AtlComModule" ?_AtlComModule@ATL@@3VCAtlComModule@1@A
0x18000A748: api-ms-win-core-rtlsupport-l1-1-0_NULL_THUNK_DATA
0x1800029A4: "public: void __cdecl ATL::CAtlModule::Term(void) __ptr64" ?Term@CAtlModule@ATL@@QEAAXXZ
0x180001DBC: "protected: static void __cdecl CKernelTraceProvider::OnProcessEvent(struct _EVENT_RECORD * __ptr64,unsigned long)" ?OnProcessEvent@CKernelTraceProvider@@KAXPEAU_EVENT_RECORD@@K@Z
0x18000AEB0: "Admin_PS_Provider" ??_C@_1CE@IKBDLDKO@?$AAA?$AAd?$AAm?$AAi?$AAn?$AA_?$AAP?$AAS?$AA_?$AAP?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AA?$AA@
0x18000B2F0: "HKDD" ??_C@_19GFFAIJHG@?$AAH?$AAK?$AAD?$AAD?$AA?$AA@
0x180002A90: "public: virtual long __cdecl ATL::CAtlModule::GetLockCount(void) __ptr64" ?GetLockCount@CAtlModule@ATL@@UEAAJXZ
0x18000A750: "__cdecl _imp_MultiByteToWideChar" __imp_MultiByteToWideChar
0x18000A828: "__cdecl _imp_StopTraceW" __imp_StopTraceW
0x180002610: "public: virtual void * __ptr64 __cdecl CWMIComObjectEx<class CKernelTraceProvider>::`scalar deleting destructor'(unsigned int) __ptr64" ??_G?$CWMIComObjectEx@VCKernelTraceProvider@@@@UEAAPEAXI@Z
0x18000CFA4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0
0x18000ADA8: "ThreadID" ??_C@_1BC@KAGFOADF@?$AAT?$AAh?$AAr?$AAe?$AAa?$AAd?$AAI?$AAD?$AA?$AA@
0x18000A6E0: api-ms-win-core-profile-l1-1-0_NULL_THUNK_DATA
0x18000A9D0: "__cdecl _guard_fids_table" __guard_fids_table
0x180006100: "public: virtual unsigned long __cdecl ATL::CComObjectCached<class CKernelTraceProviderShimClassFactory>::AddRef(void) __ptr64" ?AddRef@?$CComObjectCached@VCKernelTraceProviderShimClassFactory@@@ATL@@UEAAKXZ
0x18000A8F8: "__cdecl _imp_wcscpy_s" __imp_wcscpy_s
0x18000A760: "__cdecl _imp_CharNextW" __imp_CharNextW
0x180007AB4: "void __cdecl `eh vector destructor iterator'(void * __ptr64,unsigned __int64,unsigned __int64,void (__cdecl*)(void * __ptr64))" ??_M@YAXPEAX_K1P6AX0@Z@Z
0x180002610: "public: virtual void * __ptr64 __cdecl ATL::CComObject<class CKernelTraceProvider>::`vector deleting destructor'(unsigned int) __ptr64" ??_E?$CComObject@VCKernelTraceProvider@@@ATL@@UEAAPEAXI@Z
0x18000A808: "__cdecl _imp_ProcessTrace" __imp_ProcessTrace
0x18000A938: msvcrt_NULL_THUNK_DATA
0x18000A040: "__cdecl load_config_used" _load_config_used
0x18000A920: "__cdecl _imp_??0exception@@QEAA@AEBQEBDH@Z" __imp_??0exception@@QEAA@AEBQEBDH@Z
0x18000CCE8: "__cdecl TI1?AVCAtlException@ATL@@" _TI1?AVCAtlException@ATL@@
0x1800074E0: "public: virtual void * __ptr64 __cdecl std::bad_alloc::`vector deleting destructor'(unsigned int) __ptr64" ??_Ebad_alloc@std@@UEAAPEAXI@Z
0x180006E54: DloadProtectSection
0x1800069DC: "public: int __cdecl CArray<class CProp,class CProp & __ptr64>::Init(int) __ptr64" ?Init@?$CArray@VCProp@@AEAV1@@@QEAAHH@Z
0x180003260: "public: virtual unsigned long __cdecl ATL::CRegObject::AddRef(void) __ptr64" ?AddRef@CRegObject@ATL@@UEAAKXZ
0x18000B158: "RegDeleteKeyExW" ??_C@_0BA@LILAPHGE@RegDeleteKeyExW?$AA@
0x18000B650: "API-MS-Win-Security-Base-L1-1-0." ??_C@_1EI@POPCMECF@?$AAA?$AAP?$AAI?$AA?9?$AAM?$AAS?$AA?9?$AAW?$AAi?$AAn?$AA?9?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?9?$AAB?$AAa?$AAs?$AAe?$AA?9?$AAL?$AA1?$AA?9?$AA1?$AA?9?$AA0?$AA?4@
0x18000AE50: "ImageSize" ??_C@_1BE@NMAAKDIB@?$AAI?$AAm?$AAa?$AAg?$AAe?$AAS?$AAi?$AAz?$AAe?$AA?$AA@
0x18000B528: LIBID_KRNLPROVLib
0x180006CC8: "unsigned long __cdecl DLpLoadProcThreadsDll(void)" ?DLpLoadProcThreadsDll@@YAKXZ
0x18000B2B8: "HKCU" ??_C@_19JAPAIJDE@?$AAH?$AAK?$AAC?$AAU?$AA?$AA@
0x1800025E0: "public: __cdecl ATL::CComObjectRootEx<class ATL::CComMultiThreadModel>::~CComObjectRootEx<class ATL::CComMultiThreadModel>(void) __ptr64" ??1?$CComObjectRootEx@VCComMultiThreadModel@ATL@@@ATL@@QEAA@XZ
0x18000A870: "__cdecl _imp__amsg_exit" __imp__amsg_exit
0x18000E110: "__vectorcall ??_R0?AV_com_error@" ??_R0?AV_com_error@@@8
0x180008050: "public: virtual char const * __ptr64 __cdecl exception::what(void)const __ptr64" ?what@exception@@UEBAPEBDXZ
0x18000B0D8: ThreadStart
0x18000B4D8: "APPID" ??_C@_1M@PPPPCDEP@?$AAA?$AAP?$AAP?$AAI?$AAD?$AA?$AA@
0x1800028B0: "[thunk]:public: virtual unsigned long __cdecl ATL::CComObject<class CKernelTraceProvider>::Release`adjustor{8}' (void) __ptr64" ?Release@?$CComObject@VCKernelTraceProvider@@@ATL@@W7EAAKXZ
0x18000327C: "public: virtual __cdecl ATL::CRegObject::~CRegObject(void) __ptr64" ??1CRegObject@ATL@@UEAA@XZ
0x18000A648: "__cdecl _imp_DisableThreadLibraryCalls" __imp_DisableThreadLibraryCalls
0x180006220: "private: void __cdecl ATL::CTempBuffer<unsigned short,256,class ATL::CCRTAllocator>::FreeHeap(void) __ptr64" ?FreeHeap@?$CTempBuffer@G$0BAA@VCCRTAllocator@ATL@@@ATL@@AEAAXXZ
0x180006220: "private: void __cdecl ATL::CTempBuffer<unsigned char,256,class ATL::CCRTAllocator>::FreeHeap(void) __ptr64" ?FreeHeap@?$CTempBuffer@E$0BAA@VCCRTAllocator@ATL@@@ATL@@AEAAXXZ
0x18000B6D0: "__cdecl _pfnDliNotifyHook2" __pfnDliNotifyHook2
0x180004228: "protected: long __cdecl ATL::CRegParser::RegisterSubkeys(unsigned short * __ptr64,struct HKEY__ * __ptr64,int,int) __ptr64" ?RegisterSubkeys@CRegParser@ATL@@IEAAJPEAGPEAUHKEY__@@HH@Z
0x18000A738: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x18000A6D8: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x18000A148: "const CWMIComObjectEx<class CKernelTraceProvider>::`vftable'{for `IWbemEventProviderSecurity'}" ??_7?$CWMIComObjectEx@VCKernelTraceProvider@@@@6BIWbemEventProviderSecurity@@@
0x18000B5E0: "API-MS-Win-Core-ProcessThreads-L" ??_C@_1FE@EONGKHGH@?$AAA?$AAP?$AAI?$AA?9?$AAM?$AAS?$AA?9?$AAW?$AAi?$AAn?$AA?9?$AAC?$AAo?$AAr?$AAe?$AA?9?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AAT?$AAh?$AAr?$AAe?$AAa?$AAd?$AAs?$AA?9?$AAL@
0x18000A908: "__cdecl _imp_??0exception@@QEAA@AEBV0@@Z" __imp_??0exception@@QEAA@AEBV0@@Z
0x18000A958: "__cdecl _imp_?BreakOnDbgAndRenterLoop@@YAKXZ" __imp_?BreakOnDbgAndRenterLoop@@YAKXZ
0x18000A000: "const std::bad_alloc::`vftable'" ??_7bad_alloc@std@@6B@
0x18000A688: "__cdecl _imp_VirtualQuery" __imp_VirtualQuery
0x18000A730: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x180007FE0: "__cdecl purecall" _purecall
0x18000A710: "__cdecl _imp_RegQueryInfoKeyW" __imp_RegQueryInfoKeyW
0x18000B6D0: "__cdecl _pfnDefaultDliFailureHook2" __pfnDefaultDliFailureHook2
0x180007C3C: "void __cdecl `eh vector constructor iterator'(void * __ptr64,unsigned __int64,unsigned __int64,void (__cdecl*)(void * __ptr64),void (__cdecl*)(void * __ptr64))" ??_L@YAXPEAX_K1P6AX0@Z2@Z
0x18000B280: "Software" ??_C@_1BC@EAHCMADO@?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?$AA@
0x180001280: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x18000B4E8: "__cdecl GUID_0002e012_0000_0000_c000_000000000046" _GUID_0002e012_0000_0000_c000_000000000046
0x18000A1B0: "const CWMIComObjectEx<class CKernelTraceProvider>::`vftable'{for `IWbemEventProvider'}" ??_7?$CWMIComObjectEx@VCKernelTraceProvider@@@@6BIWbemEventProvider@@@
0x1800062A0: "public: virtual void * __ptr64 __cdecl _com_error::`vector deleting destructor'(unsigned int) __ptr64" ??_E_com_error@@UEAAPEAXI@Z
0x18000CF68: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0
0x180001990: "public: virtual long __cdecl CKernelTraceProvider::ProvideEvents(struct IWbemObjectSink * __ptr64,long) __ptr64" ?ProvideEvents@CKernelTraceProvider@@UEAAJPEAUIWbemObjectSink@@J@Z
0x18000A678: "__cdecl _imp_GetModuleHandleW" __imp_GetModuleHandleW
0x180006220: "private: void __cdecl ATL::CTempBuffer<unsigned short,1024,class ATL::CCRTAllocator>::FreeHeap(void) __ptr64" ?FreeHeap@?$CTempBuffer@G$0EAA@VCCRTAllocator@ATL@@@ATL@@AEAAXXZ
0x18000E8A8: "long (__cdecl* __ptr64 ATL::_pPerfUnRegFunc)(void)" ?_pPerfUnRegFunc@ATL@@3P6AJXZEA
0x18000A550: "__cdecl _imp_RegisterTypeLib" __imp_RegisterTypeLib
0x180006B8C: "public: class _bstr_t & __ptr64 __cdecl _bstr_t::operator=(unsigned short const * __ptr64) __ptr64" ??4_bstr_t@@QEAAAEAV0@PEBG@Z
0x18000A578: "__cdecl _imp_CoTaskMemAlloc" __imp_CoTaskMemAlloc
0x18000B6B8: "CheckTokenMembership" ??_C@_0BF@KEDGKLKA@CheckTokenMembership?$AA@
0x180002AA0: "public: virtual long __cdecl ATL::CAtlModule::GetGITPtr(struct IGlobalInterfaceTable * __ptr64 * __ptr64) __ptr64" ?GetGITPtr@CAtlModule@ATL@@UEAAJPEAPEAUIGlobalInterfaceTable@@@Z
0x18000A540: "__cdecl _imp_SysStringLen" __imp_SysStringLen
0x18000A898: "__cdecl _imp__XcptFilter" __imp__XcptFilter
0x18000A948: ntdll_NULL_THUNK_DATA
0x18000E0A0: "__vectorcall ??_R0?AVexception@" ??_R0?AVexception@@@8
0x18000E000: "char const * __ptr64 const __ptr64 std::_bad_alloc_Message" ?_bad_alloc_Message@std@@3PEBDEB
0x18000CEF0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0
0x180002B90: "public: __cdecl ATL::CRegKey::~CRegKey(void) __ptr64" ??1CRegKey@ATL@@QEAA@XZ
0x180005F90: "public: static long __cdecl ATL::CComCreator2<class ATL::CComCreator<class ATL::CComObject<class CKernelTraceProvider> >,class ATL::CComFailCreator<-2147221232> >::CreateInstance(void * __ptr64,struct _GUID const & __ptr64,void * __ptr64 * __ptr64)" ?CreateInstance@?$CComCreator2@V?$CComCreator@V?$CComObject@VCKernelTraceProvider@@@ATL@@@ATL@@V?$CComFailCreator@$0?HPPLPOPA@@2@@ATL@@SAJPEAXAEBU_GUID@@PEAPEAX@Z
0x18000A888: "__cdecl _imp___CxxFrameHandler3" __imp___CxxFrameHandler3
0x18000E148: "__cdecl _security_cookie" __security_cookie
0x180006264: "void __cdecl _com_issue_error(long)" ?_com_issue_error@@YAXJ@Z
0x180008550: "__cdecl alloca_probe" _alloca_probe
0x18000A5F8: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x18000A728: "__cdecl _imp_RtlCompareMemory" __imp_RtlCompareMemory
0x18000CF90: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-eventing-controller-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-eventing-controller-l1-1-0
0x18000A620: "__cdecl _imp_LocalFree" __imp_LocalFree
0x18000CD40: "__cdecl CTA1?AV_com_error@@" _CTA1?AV_com_error@@
0x18000CF2C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0
0x18000A5B0: api-ms-win-core-com-l1-1-0_NULL_THUNK_DATA
0x180003100: "public: __cdecl ATL::CRegParser::CParseBuffer::~CParseBuffer(void) __ptr64" ??1CParseBuffer@CRegParser@ATL@@QEAA@XZ
0x18000A548: "__cdecl _imp_SysAllocString" __imp_SysAllocString
0x18000A6F8: "__cdecl _imp_RegCreateKeyExW" __imp_RegCreateKeyExW
0x18000E750: "class ATL::CComModule _Module" ?_Module@@3VCComModule@ATL@@A
0x18000E908: "__cdecl _onexitbegin" __onexitbegin
0x18000B388: "HKEY_USERS" ??_C@_1BG@BGODANIO@?$AAH?$AAK?$AAE?$AAY?$AA_?$AAU?$AAS?$AAE?$AAR?$AAS?$AA?$AA@
0x18000B418: "Module" ??_C@_1O@MNLDABAF@?$AAM?$AAo?$AAd?$AAu?$AAl?$AAe?$AA?$AA@
0x18000B1A8: "AppID" ??_C@_1M@EJNEECMJ@?$AAA?$AAp?$AAp?$AAI?$AAD?$AA?$AA@
0x18000A928: "__cdecl _imp_?what@exception@@UEBAPEBDXZ" __imp_?what@exception@@UEBAPEBDXZ
0x18000A5D0: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x18000A6C8: "__cdecl _imp_GetCurrentThread" __imp_GetCurrentThread
0x180004C7C: "public: long __cdecl ATL::CAtlModule::UpdateRegistryFromResourceS(unsigned int,int,struct ATL::_ATL_REGMAP_ENTRY * __ptr64) __ptr64" ?UpdateRegistryFromResourceS@CAtlModule@ATL@@QEAAJIHPEAU_ATL_REGMAP_ENTRY@2@@Z
0x18000AC88: "Win32_ProcessStartTrace" ??_C@_1DA@FDIFCKLD@?$AAW?$AAi?$AAn?$AA3?$AA2?$AA_?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AAS?$AAt?$AAa?$AAr?$AAt?$AAT?$AAr?$AAa?$AAc?$AAe?$AA?$AA@
0x18000E718: "struct HINSTANCE__ * __ptr64 __ptr64 g_hInstProcThreadsDLL" ?g_hInstProcThreadsDLL@@3PEAUHINSTANCE__@@EA
0x18000B1F8: "FileType" ??_C@_1BC@NKMMNMGL@?$AAF?$AAi?$AAl?$AAe?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x18000A718: "__cdecl _imp_RegOpenKeyExW" __imp_RegOpenKeyExW
0x18000AD70: "StartAddr" ??_C@_1BE@IEJDFHDE@?$AAS?$AAt?$AAa?$AAr?$AAt?$AAA?$AAd?$AAd?$AAr?$AA?$AA@
0x18000B0E8: CLSID_StdGlobalInterfaceTable
0x180008174: "__cdecl _security_init_cookie" __security_init_cookie
0x18000B6D8: IID_IWbemObjectAccess
0x180006D4C: "unsigned long __cdecl DLpLoadSecurityDll(void)" ?DLpLoadSecurityDll@@YAKXZ
0x18000B4A8: "\Implemented Categories" ??_C@_1DA@BIHALFED@?$AA?2?$AAI?$AAm?$AAp?$AAl?$AAe?$AAm?$AAe?$AAn?$AAt?$AAe?$AAd?$AA?5?$AAC?$AAa?$AAt?$AAe?$AAg?$AAo?$AAr?$AAi?$AAe?$AAs?$AA?$AA@
0x1800062A0: "public: virtual void * __ptr64 __cdecl _com_error::`scalar deleting destructor'(unsigned int) __ptr64" ??_G_com_error@@UEAAPEAXI@Z
0x18000A840: "__cdecl _imp_QueryTraceW" __imp_QueryTraceW
0x180008026: "public: __cdecl exception::exception(char const * __ptr64 const & __ptr64,int) __ptr64" ??0exception@@QEAA@AEBQEBDH@Z
0x18000CEC8: "__cdecl _IMPORT_DESCRIPTOR_msvcrt" __IMPORT_DESCRIPTOR_msvcrt
0x18000B638: "OpenThreadToken" ??_C@_0BA@MOEFBCGC@OpenThreadToken?$AA@
0x180006080: "public: virtual unsigned long __cdecl ATL::CComObjectCached<class CKernelTraceProviderShimClassFactory>::Release(void) __ptr64" ?Release@?$CComObjectCached@VCKernelTraceProviderShimClassFactory@@@ATL@@UEAAKXZ
0x18000A490: ?map@?1??VTFromRegType@CRegParser@ATL@@KAHPEBGAEAG@Z@4QBUtypemap@?1??123@KAH01@Z@B
0x18000A590: "__cdecl _imp_CoTaskMemRealloc" __imp_CoTaskMemRealloc
0x18000B210: "Interface" ??_C@_1BE@EKPAFMCP@?$AAI?$AAn?$AAt?$AAe?$AAr?$AAf?$AAa?$AAc?$AAe?$AA?$AA@
0x180001420: "public: __cdecl CKernelTraceProvider::~CKernelTraceProvider(void) __ptr64" ??1CKernelTraceProvider@@QEAA@XZ
0x18000A868: "__cdecl _imp_malloc" __imp_malloc
0x180002900: "[thunk]:public: virtual unsigned long __cdecl ATL::CComObject<class CKernelTraceProvider>::AddRef`adjustor{8}' (void) __ptr64" ?AddRef@?$CComObject@VCKernelTraceProvider@@@ATL@@W7EAAKXZ
0x18000A8C0: "__cdecl _imp__purecall" __imp__purecall
0x180001CC0: "protected: static void __cdecl CKernelTraceProvider::ProcessPsEvents(struct _EVENT_RECORD * __ptr64)" ?ProcessPsEvents@CKernelTraceProvider@@KAXPEAU_EVENT_RECORD@@@Z
0x180005E40: "public: static long __cdecl ATL::CComCreator<class ATL::CComObjectCached<class CKernelTraceProviderShimClassFactory> >::CreateInstance(void * __ptr64,struct _GUID const & __ptr64,void * __ptr64 * __ptr64)" ?CreateInstance@?$CComCreator@V?$CComObjectCached@VCKernelTraceProviderShimClassFactory@@@ATL@@@ATL@@SAJPEAXAEBU_GUID@@PEAPEAX@Z
0x180003DA4: "public: long __cdecl ATL::CRegParser::PreProcessBuffer(unsigned short * __ptr64,unsigned short * __ptr64 * __ptr64) __ptr64" ?PreProcessBuffer@CRegParser@ATL@@QEAAJPEAGPEAPEAG@Z
0x18000B020: "select * from Win32_ModuleLoadTr" ??_C@_1EI@BAJLHHCH@?$AAs?$AAe?$AAl?$AAe?$AAc?$AAt?$AA?5?$AA?$CK?$AA?5?$AAf?$AAr?$AAo?$AAm?$AA?5?$AAW?$AAi?$AAn?$AA3?$AA2?$AA_?$AAM?$AAo?$AAd?$AAu?$AAl?$AAe?$AAL?$AAo?$AAa?$AAd?$AAT?$AAr@
0x180007D00: "__cdecl _report_gsfailure" __report_gsfailure
0x18000AEE0: "select * from Win32_ProcessStart" ??_C@_1EM@IODJNEMN@?$AAs?$AAe?$AAl?$AAe?$AAc?$AAt?$AA?5?$AA?$CK?$AA?5?$AAf?$AAr?$AAo?$AAm?$AA?5?$AAW?$AAi?$AAn?$AA3?$AA2?$AA_?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AAS?$AAt?$AAa?$AAr?$AAt@
0x18000A7C0: "__cdecl _imp_LeaveCriticalSection" __imp_LeaveCriticalSection
0x180007B88: "__cdecl onexit" _onexit
0x18000B440: "REGISTRY" ??_C@_1BC@KAILKFFG@?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?$AA@
0x18000A820: "__cdecl _imp_StartTraceW" __imp_StartTraceW
0x18000E8F8: "__cdecl _native_startup_state" __native_startup_state
0x1800066D8: "public: int __cdecl CObjAccess::WriteNonPackedArrayData(unsigned long,void * __ptr64,unsigned long,unsigned long) __ptr64" ?WriteNonPackedArrayData@CObjAccess@@QEAAHKPEAXKK@Z
0x18000E898: "class ATL::CAtlModule * __ptr64 __ptr64 ATL::_pAtlModule" ?_pAtlModule@ATL@@3PEAVCAtlModule@1@EA
0x18000A2F0: "const ATL::CRegObject::`vftable'" ??_7CRegObject@ATL@@6B@
0x18000B2D8: "HKU" ??_C@_17PJOJPMPB@?$AAH?$AAK?$AAU?$AA?$AA@
0x18000E8C4: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUzwnrmUdnrUdyvnUdrmntngUvhhxlnkUmlmxlnUfgrohUozgvhgUlyquivUznwGEUkivxlnkOlyq@utils" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUzwnrmUdnrUdyvnUdrmntngUvhhxlnkUmlmxlnUfgrohUozgvhgUlyquivUznwGEUkivxlnkOlyq@utils
0x18000A638: "__cdecl _imp_LoadResource" __imp_LoadResource
0x180002B30: "public: virtual long __cdecl ATL::CComModule::UpdateRegistryFromResourceS(unsigned short const * __ptr64,int,struct ATL::_ATL_REGMAP_ENTRY * __ptr64) __ptr64" ?UpdateRegistryFromResourceS@CComModule@ATL@@UEAAJPEBGHPEAU_ATL_REGMAP_ENTRY@2@@Z
0x18000A1D0: ?_entries@?1??_GetEntries@CKernelTraceProvider@@SAPEBU_ATL_INTMAP_ENTRY@ATL@@XZ@4QBU34@B
0x180003270: "public: virtual unsigned long __cdecl ATL::CRegObject::Release(void) __ptr64" ?Release@CRegObject@ATL@@UEAAKXZ
0x18000B3A0: "HKEY_PERFORMANCE_DATA" ??_C@_1CM@KHNNAOIC@?$AAH?$AAK?$AAE?$AAY?$AA_?$AAP?$AAE?$AAR?$AAF?$AAO?$AAR?$AAM?$AAA?$AAN?$AAC?$AAE?$AA_?$AAD?$AAA?$AAT?$AAA?$AA?$AA@
0x180001410: "public: __cdecl CInCritSec::~CInCritSec(void) __ptr64" ??1CInCritSec@@QEAA@XZ
0x18000ADC0: "WaitMode" ??_C@_1BC@ICBILECA@?$AAW?$AAa?$AAi?$AAt?$AAM?$AAo?$AAd?$AAe?$AA?$AA@
0x18000ABD0: "Val" ??_C@_17LLMMEOJD@?$AAV?$AAa?$AAl?$AA?$AA@
0x18000D0A8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-memory-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-memory-l1-1-0
0x18000B198: "CLSID" ??_C@_1M@KANJNLFF@?$AAC?$AAL?$AAS?$AAI?$AAD?$AA?$AA@
0x18000A348: "const ATL::CComObjectCached<class CKernelTraceProviderShimClassFactory>::`vftable'" ??_7?$CComObjectCached@VCKernelTraceProviderShimClassFactory@@@ATL@@6B@
0x180005BB0: DllRegisterServer
0x180005FD8: "public: __cdecl ATL::CAutoVectorPtr<unsigned short>::~CAutoVectorPtr<unsigned short>(void) __ptr64" ??1?$CAutoVectorPtr@G@ATL@@QEAA@XZ
0x1800033D8: "protected: long __cdecl ATL::CRegObject::RegisterFromResource(unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,int) __ptr64" ?RegisterFromResource@CRegObject@ATL@@IEAAJPEBG00H@Z
0x18000A538: "__cdecl _imp_SysFreeString" __imp_SysFreeString
0x180005770: "long __cdecl ATL::AtlComModuleGetClassObject(struct ATL::_ATL_COM_MODULE70 * __ptr64,struct _GUID const & __ptr64,struct _GUID const & __ptr64,void * __ptr64 * __ptr64)" ?AtlComModuleGetClassObject@ATL@@YAJPEAU_ATL_COM_MODULE70@1@AEBU_GUID@@1PEAPEAX@Z
0x18000CCA8: "__cdecl CTA2?AVbad_alloc@std@@" _CTA2?AVbad_alloc@std@@
0x18000A4D0: "protected: static unsigned short const * __ptr64 const * const ATL::CRegParser::rgszNeverDelete" ?rgszNeverDelete@CRegParser@ATL@@1QBQEBGB
0x1800063C0: "public: __cdecl CProp::CProp(void) __ptr64" ??0CProp@@QEAA@XZ
0x18000D044: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0
0x18000A3B0: ?map@?1??HKeyFromString@CRegParser@ATL@@KAPEAUHKEY__@@PEAG@Z@4QBUkeymap@?1??123@KAPEAU4@0@Z@B
0x18000B458: ".tlb" ??_C@_19ILOCMLCJ@?$AA?4?$AAt?$AAl?$AAb?$AA?$AA@
0x18000CD98: "__cdecl _pobjMapEntryFirst" __pobjMapEntryFirst
0x180006000: "public: virtual long __cdecl ATL::CAtlModuleT<class ATL::CComModule>::AddCommonRGSReplacements(struct IRegistrarBase * __ptr64) __ptr64" ?AddCommonRGSReplacements@?$CAtlModuleT@VCComModule@ATL@@@ATL@@UEAAJPEAUIRegistrarBase@@@Z
0x18000A860: "__cdecl _imp_free" __imp_free
0x180006B10: "public: __cdecl CProp::~CProp(void) __ptr64" ??1CProp@@QEAA@XZ
0x1800080E0: "__cdecl IsNonwritableInCurrentImage" _IsNonwritableInCurrentImage
0x18000A7D8: api-ms-win-core-synch-l1-2-0_NULL_THUNK_DATA
0x18000D094: "__cdecl _IMPORT_DESCRIPTOR_wbemcomn" __IMPORT_DESCRIPTOR_wbemcomn
0x18000A188: "const CWMIComObjectEx<class CKernelTraceProvider>::`vftable'{for `IWbemProviderInit'}" ??_7?$CWMIComObjectEx@VCKernelTraceProvider@@@@6BIWbemProviderInit@@@
0x18000A900: "__cdecl _imp_memcpy_s" __imp_memcpy_s
0x18000A7C8: api-ms-win-core-synch-l1-1-0_NULL_THUNK_DATA
0x18000E720: "struct HINSTANCE__ * __ptr64 __ptr64 g_hInstSecurityDLL" ?g_hInstSecurityDLL@@3PEAUHINSTANCE__@@EA
0x18000D030: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0
0x180008516: memset
0x18000D0D0: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR

[JEB Decompiler by PNF Software]