Generated by JEB on 2019/08/01

PE: C:\Windows\System32\smss.exe Base=0x140000000 SHA-256=A15DF33F7B666BC79A2FE9864442623AAEA393552591A4AB1F3A7CB29CF40DAE
PDB: smss.pdb GUID={FC55AFEC-90D0-1E7D-520FBF92844270A0} Age=1

1065 located named symbols:
0x140015D30: "__cdecl _imp_RtlInitUnicodeStringEx" __imp_RtlInitUnicodeStringEx
0x140004318: SmpUnlockKnownSubSysList
0x140022A18: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUhfyhbhUhnUhvieviUlyquivUznwGEUhnhiekOlyq@smss" __@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUhfyhbhUhnUhvieviUlyquivUznwGEUhnhiekOlyq@smss
0x140011428: SmpQueryPagefileTooSmallForDump
0x1400216D8: SmpNumberInitialSessions
0x14001ADF0: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1GK@HCENGFOK@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x140016150: "__cdecl _imp_RtlDeleteNoSplay" __imp_RtlDeleteNoSplay
0x14001D728: "Master Subsystem Process" ??_C@_1DC@NMMAJFCA@?$AAM?$AAa?$AAs?$AAt?$AAe?$AAr?$AA?5?$AAS?$AAu?$AAb?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?5?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AA?$AA@
0x14001C630: "\REGISTRY\MACHINE\SOFTWARE\Class" ??_C@_1GO@DEIJCEHG@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAC?$AAl?$AAa?$AAs?$AAs@
0x140015F00: "__cdecl _imp_NtSerializeBoot" __imp_NtSerializeBoot
0x140004EA4: SmpAllocateInitialCommandBuffer
0x140018FC0: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1IK@CFPGNGEB@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x14001D8B8: "ntsd -isd -d " ??_C@_1BM@PFJCJDPP@?$AAn?$AAt?$AAs?$AAd?$AA?5?$AA?9?$AAi?$AAs?$AAd?$AA?5?$AA?9?$AAd?$AA?5?$AA?$AA@
0x14001A400: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1IG@PFGHMADC@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x1400164F0: "KnownDllPath" ??_C@_1BK@HNONDBBL@?$AAK?$AAn?$AAo?$AAw?$AAn?$AAD?$AAl?$AAl?$AAP?$AAa?$AAt?$AAh?$AA?$AA@
0x140015ED8: "__cdecl _imp_RtlCreateEnvironment" __imp_RtlCreateEnvironment
0x140022341: SmpUseFilterPagesDumpFile
0x1400159E0: SmpSecureKeyword
0x140017870: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1HM@BCFOGDKF@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x140001158: SmpInvokeAutoChk
0x14000CA74: SmpGetCoreProcessIds
0x140022570: SmpVolumeDescriptorList
0x140015D08: "__cdecl _imp_RtlFreeUnicodeString" __imp_RtlFreeUnicodeString
0x14001F3AC: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x14001AE60: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1HE@DNJAKOKE@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140016048: "__cdecl _imp_RtlFindSetBits" __imp_RtlFindSetBits
0x140016080: "__cdecl _imp_NtQueryDirectoryObject" __imp_NtQueryDirectoryObject
0x1400129A0: SmpLoadDeferredSubsystem
0x140004380: SmpTreeLookupControlBlock
0x1400170C0: SmssEvt_PlatformExecuteList_Start
0x1400225F1: SmpManagedPfInitialized
0x14001AB20: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1FE@BMCOBLAD@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x1400216C8: "__cdecl _security_cookie_complement" __security_cookie_complement
0x140015F80: "__cdecl _imp__stricmp" __imp__stricmp
0x1400166C0: "PROCESSOR_REVISION" ??_C@_1CG@CKPMBEAN@?$AAP?$AAR?$AAO?$AAC?$AAE?$AAS?$AAS?$AAO?$AAR?$AA_?$AAR?$AAE?$AAV?$AAI?$AAS?$AAI?$AAO?$AAN?$AA?$AA@
0x14001D240: "DSREPAIR" ??_C@_1BC@LDIFPMCE@?$AAD?$AAS?$AAR?$AAE?$AAP?$AAA?$AAI?$AAR?$AA?$AA@
0x140022A98: SmpSavePageFiles
0x140002240: SmpQueryEnvVariable
0x140016100: "__cdecl _imp_RtlSetThreadIsCritical" __imp_RtlSetThreadIsCritical
0x14000869C: SmpReadyBootSync
0x14001135C: SmpQueryFileExists
0x140001010: SmpSessionComplete
0x140015DB0: "__cdecl _imp_NtUpdateWnfStateData" __imp_NtUpdateWnfStateData
0x140019E40: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1IO@OMPLELHI@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x1400225AD: SmpClientSku
0x140016118: "__cdecl _imp_AlpcGetMessageAttribute" __imp_AlpcGetMessageAttribute
0x140015FE8: "__cdecl _imp_RtlWriteRegistryValue" __imp_RtlWriteRegistryValue
0x1400161C8: "__cdecl _imp_TpAllocAlpcCompletion" __imp_TpAllocAlpcCompletion
0x140015C98: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x140018730: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1MI@GIFBOMGL@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x1400138D0: WppControlCallback
0x14000D4F0: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x14001CEC0: "PagefileUsage" ??_C@_1BM@NLOLJDPA@?$AAP?$AAa?$AAg?$AAe?$AAf?$AAi?$AAl?$AAe?$AAU?$AAs?$AAa?$AAg?$AAe?$AA?$AA@
0x140015C80: WowAmd64NodeString
0x1400216DC: SmpProtectionMode
0x14001BAF0: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1JA@PKAAGEJP@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x140015FC8: "__cdecl _imp_RtlAppxIsFileOwnedByTrustedInstaller" __imp_RtlAppxIsFileOwnedByTrustedInstaller
0x140017378: SmpSavedPageFileExtension
0x14001CA00: "ObjectDirectories" ??_C@_1CE@CMFPHAEJ@?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAD?$AAi?$AAr?$AAe?$AAc?$AAt?$AAo?$AAr?$AAi?$AAe?$AAs?$AA?$AA@
0x140004464: SmpMarkThreadBusy
0x14001CD68: "__cdecl TraceLoggingMetadata" _TraceLoggingMetadata
0x14001D4A0: "wpbbin.exe" ??_C@_1BG@ILOLABEL@?$AAw?$AAp?$AAb?$AAb?$AAi?$AAn?$AA?4?$AAe?$AAx?$AAe?$AA?$AA@
0x14001A210: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1HO@DHLBJOMK@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x140017018: "Path" ??_C@_19NHABCBNP@?$AAP?$AAa?$AAt?$AAh?$AA?$AA@
0x140010BDC: SmpCopyFile
0x14000A258: SmpRecordNewPageFile
0x14001C110: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1IC@MEOMPACN@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140016568: SmssEventProvider
0x140016EC0: "\Device\NamedPipe\ProtectedPrefi" ??_C@_1GC@KDBOOJNN@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAN?$AAa?$AAm?$AAe?$AAd?$AAP?$AAi?$AAp?$AAe?$AA?2?$AAP?$AAr?$AAo?$AAt?$AAe?$AAc?$AAt?$AAe?$AAd?$AAP?$AAr?$AAe?$AAf?$AAi@
0x14001A740: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1GO@CDNAOFC@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x140015EC8: "__cdecl _imp_RtlSetBits" __imp_RtlSetBits
0x140015C00: SmpLogfileName
0x140019620: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1LI@BOMALBKL@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140015D60: "__cdecl _imp_RtlSecondsSince1970ToTime" __imp_RtlSecondsSince1970ToTime
0x140002EE0: NtProcessStartupW_AfterSecurityCookieInitialized
0x140015E18: "__cdecl _imp_NtReadFile" __imp_NtReadFile
0x14001108C: SmpGetDumpDestination
0x14000AC18: SmpCreatePagingFiles
0x1400099F0: SmpProcessModuleImports
0x140011AD8: SmpSetDumpSecurityAndAttributes
0x140001900: SmpParseCommandLine
0x140016200: "__cdecl _imp_wcstoul" __imp_wcstoul
0x140016558: SmssEvt_LoadSubsystem_Start
0x14001BE20: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1FK@NPOLACEE@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140018960: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1LE@JPNAMBGB@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x14000CD90: SmpConfigurePagefileOptions
0x140016178: "__cdecl _imp_EtwGetTraceLoggerHandle" __imp_EtwGetTraceLoggerHandle
0x14001CCF8: "DOS Devices" ??_C@_1BI@EJICPCCP@?$AAD?$AAO?$AAS?$AA?5?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAs?$AA?$AA@
0x14000D1E4: SmpQueryCopyDumpSetting
0x140010278: SmpCreateEmergencyPagingFile
0x1400176A8: ".exe" ??_C@_19DOGDICKI@?$AA?4?$AAe?$AAx?$AAe?$AA?$AA@
0x140021EE8: SmpKnownDllsSymLinkSecurityDescriptor
0x140021FA8: SmpAllowProtectedRenames
0x14001A490: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1HA@HNMEHJMD@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140007620: SmpConfigureSharedSessionData
0x140012ECC: SmpRenameTargetFile
0x14000478C: SmpDereferenceKnownSubSys
0x1400161F0: "__cdecl _imp_RtlUnicodeStringToAnsiString" __imp_RtlUnicodeStringToAnsiString
0x1400197B0: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1JM@KIDKJDDA@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140009594: SmpEventWrite
0x140015C10: SmscpDebuggerString
0x140015DD0: "__cdecl _imp_RtlCreateSecurityDescriptor" __imp_RtlCreateSecurityDescriptor
0x140015F18: "__cdecl _imp_RtlQueryPerformanceCounter" __imp_RtlQueryPerformanceCounter
0x14000BAC4: SmpQueryCrashDumpType
0x1400164C8: "\??\A:\" ??_C@_1BA@IFOFMGFF@?$AA?2?$AA?$DP?$AA?$DP?$AA?2?$AAA?$AA?3?$AA?2?$AA?$AA@
0x140015E30: "__cdecl _imp_NtWriteFile" __imp_NtWriteFile
0x1400160F0: "__cdecl _imp_NtSetInformationThread" __imp_NtSetInformationThread
0x1400170A0: SmssEvt_BootExecuteNoPnpSyncList_Start
0x140007D30: SmpInitializeKnownDllsInternal
0x140015FE0: "__cdecl _imp_RtlDeleteRegistryValue" __imp_RtlDeleteRegistryValue
0x140013DB0: PathReplaceGreedy
0x140016920: "\??" ??_C@_17MFDAJLJA@?$AA?2?$AA?$DP?$AA?$DP?$AA?$AA@
0x140015EA0: "__cdecl _imp_RtlCreateTagHeap" __imp_RtlCreateTagHeap
0x1400178F0: "\REGISTRY\MACHINE\SOFTWARE\Polic" ??_C@_1EI@BJMBIMLC@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAP?$AAo?$AAl?$AAi?$AAc@
0x1400182E0: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1LC@MHANLDKI@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x14001D938: "\WOW6432Node" ??_C@_1BK@GKBHLFGI@?$AA?2?$AAW?$AAO?$AAW?$AA6?$AA4?$AA3?$AA2?$AAN?$AAo?$AAd?$AAe?$AA?$AA@
0x140016AD0: "ExistingPageFiles" ??_C@_1CE@PLNJMHPE@?$AAE?$AAx?$AAi?$AAs?$AAt?$AAi?$AAn?$AAg?$AAP?$AAa?$AAg?$AAe?$AAF?$AAi?$AAl?$AAe?$AAs?$AA?$AA@
0x140011E28: "__cdecl TlgWrite" _TlgWrite
0x140018F10: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1KO@FLDMFIPD@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x140015CC8: "__cdecl _imp_RtlGetNtSystemRoot" __imp_RtlGetNtSystemRoot
0x140007B04: SmpCopyListToSharedSection
0x1400162A8: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x1400123D0: SmpConfigureClearTempFiles
0x140016130: "__cdecl _imp_RtlInitializeSRWLock" __imp_RtlInitializeSRWLock
0x140018440: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1LI@CEADKCJH@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x14001A8F0: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1IC@PMJEPEDC@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x140022A30: SmpCoreSubsysProcess
0x14001D1A0: "\SystemRoot\System32\wpbbin.exe" ??_C@_1EA@JDDDGMPK@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAo?$AAo?$AAt?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAw?$AAp?$AAb?$AAb?$AAi?$AAn?$AA?4?$AAe?$AAx?$AAe?$AA?$AA@
0x14001AD90: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1FC@FEBIJJIO@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140022240: SmpKnownDllsList
0x14001CD40: "SymbolicLinkValue" ??_C@_1CE@CFOIKICP@?$AAS?$AAy?$AAm?$AAb?$AAo?$AAl?$AAi?$AAc?$AAL?$AAi?$AAn?$AAk?$AAV?$AAa?$AAl?$AAu?$AAe?$AA?$AA@
0x140021F00: SmpKnownDllsSymLinkSDBody
0x140012E60: SmpPlatformBinaryTableExists
0x140012480: SmpConfigureExecute
0x140003DC0: SmpHandleConnectionRequest
0x14001D230: "NETWORK" ??_C@_1BA@EBPJHHKE@?$AAN?$AAE?$AAT?$AAW?$AAO?$AAR?$AAK?$AA?$AA@
0x14000A168: SmpDeallocSavedRegistryEntry
0x140009660: SmpBuildSubSystemLists
0x14001AC50: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1GK@ECKPPPDB@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x14001A810: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1GO@POCHEODI@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x140017580: "\??\%s" ??_C@_1O@PAJNNBDG@?$AA?2?$AA?$DP?$AA?$DP?$AA?2?$AA?$CF?$AAs?$AA?$AA@
0x14001AD20: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1GO@NEKDCOOL@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x140015CE0: "__cdecl _imp_TpAllocTimer" __imp_TpAllocTimer
0x140016C10: "FilterPages" ??_C@_1BI@KJENMKEE@?$AAF?$AAi?$AAl?$AAt?$AAe?$AAr?$AAP?$AAa?$AAg?$AAe?$AAs?$AA?$AA@
0x1400183A0: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1KA@FLJMACEG@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140011E1C: "__cdecl TlgKeywordOn" _TlgKeywordOn
0x14001CA58: "BootExecute" ??_C@_1BI@NDACJMLF@?$AAB?$AAo?$AAo?$AAt?$AAE?$AAx?$AAe?$AAc?$AAu?$AAt?$AAe?$AA?$AA@
0x140017550: "NUMBER_OF_PROCESSORS" ??_C@_1CK@OLLBFPKD@?$AAN?$AAU?$AAM?$AAB?$AAE?$AAR?$AA_?$AAO?$AAF?$AA_?$AAP?$AAR?$AAO?$AAC?$AAE?$AAS?$AAS?$AAO?$AAR?$AAS?$AA?$AA@
0x140019C50: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1KM@JAHPFKMD@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x14001D4C0: "initial session process or" ??_C@_1DG@FOFKBKJD@?$AAi?$AAn?$AAi?$AAt?$AAi?$AAa?$AAl?$AA?5?$AAs?$AAe?$AAs?$AAs?$AAi?$AAo?$AAn?$AA?5?$AAp?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AA?5?$AAo?$AAr?$AA?$AA@
0x140022AB8: SmpSubSysSynchLock
0x1400170B0: SmssEvt_InitializeRegistry_Stop
0x140022A28: SmpHostSmss
0x1400160B0: "__cdecl _imp_RtlAcquireSRWLockExclusive" __imp_RtlAcquireSRWLockExclusive
0x140009FDC: SmpInitializeDosDevices
0x140016600: " %08x %08x " ??_C@_1BI@GHGLANKI@?$AA?5?$AA?$CF?$AA0?$AA8?$AAx?$AA?5?$AA?$CF?$AA0?$AA8?$AAx?$AA?5?$AA?$AA@
0x140015D90: "__cdecl _imp_RtlAppendUnicodeStringToString" __imp_RtlAppendUnicodeStringToString
0x140021CC0: SmpSubSysReadyCondition
0x1400114B0: SmpQueryPathFromRegistry
0x14001D600: "Session Manager Initialization" ??_C@_1DO@DNNNFOLB@?$AAS?$AAe?$AAs?$AAs?$AAi?$AAo?$AAn?$AA?5?$AAM?$AAa?$AAn?$AAa?$AAg?$AAe?$AAr?$AA?5?$AAI?$AAn?$AAi?$AAt?$AAi?$AAa?$AAl?$AAi?$AAz?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x14001C8B0: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1FO@JNMMPKJI@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x140016B18: "SavedPageFilePath" ??_C@_1CE@DBFCDFNE@?$AAS?$AAa?$AAv?$AAe?$AAd?$AAP?$AAa?$AAg?$AAe?$AAF?$AAi?$AAl?$AAe?$AAP?$AAa?$AAt?$AAh?$AA?$AA@
0x140015FC0: "__cdecl _imp_LdrVerifyImageMatchesChecksumEx" __imp_LdrVerifyImageMatchesChecksumEx
0x1400015E8: SmExecPgmEx
0x140015D00: "__cdecl _imp_NtSetValueKey" __imp_NtSetValueKey
0x140017060: SmssEvt_InitializeRegistry_Start
0x140002B78: SmpSessionIdToInitialSessionIndex
0x140016068: "__cdecl _imp_NtDisplayString" __imp_NtDisplayString
0x14000B634: SmpBuildFilesStringFromList
0x14001CB08: "NumberOfInitialSessions" ??_C@_1DA@LMDDKGAG@?$AAN?$AAu?$AAm?$AAb?$AAe?$AAr?$AAO?$AAf?$AAI?$AAn?$AAi?$AAt?$AAi?$AAa?$AAl?$AAS?$AAe?$AAs?$AAs?$AAi?$AAo?$AAn?$AAs?$AA?$AA@
0x140015BC0: SmpPlatformBinarySymbolicLink
0x140022580: SmpOsVolumeDescriptor
0x140016360: "__cdecl _guard_iat_table" __guard_iat_table
0x140022A10: SmpTraceHandle
0x140015DA8: "__cdecl _imp_NtFlushKey" __imp_NtFlushKey
0x14001AB80: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1GM@KJLECNMC@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x14000D4C7: memcpy
0x140015D38: "__cdecl _imp__vsnwprintf_s" __imp__vsnwprintf_s
0x14000B8A0: SmpPagefileInitialize
0x140021D70: SmpSessionCreateBlockEvent
0x140012520: SmpConfigureRenameTempDir
0x14001CC68: "PagingFiles" ??_C@_1BI@CFHAKEKA@?$AAP?$AAa?$AAg?$AAi?$AAn?$AAg?$AAF?$AAi?$AAl?$AAe?$AAs?$AA?$AA@
0x14001D6E0: "Failed to locate core GUI proces" ??_C@_1EG@DPLNGPDP@?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAl?$AAo?$AAc?$AAa?$AAt?$AAe?$AA?5?$AAc?$AAo?$AAr?$AAe?$AA?5?$AAG?$AAU?$AAI?$AA?5?$AAp?$AAr?$AAo?$AAc?$AAe?$AAs@
0x14001D9B8: "__cdecl _real@41e471c71c71c71c" __real@41e471c71c71c71c
0x140021C70: SmpInitLastCall
0x14000CFAC: "__cdecl _security_init_cookie_ex" __security_init_cookie_ex
0x14000619C: SmpInit
0x14001BF70: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1IE@MLNFBANF@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x140016290: "__cdecl _imp_memset" __imp_memset
0x140008D54: SmpNtSerializeBoot
0x140015E98: "__cdecl _imp_NtCreateMutant" __imp_NtCreateMutant
0x140015F28: "__cdecl _imp_NtWaitForSingleObject" __imp_NtWaitForSingleObject
0x14001D1E0: "\DosDevices\ACPI_ROOT_OBJECT" ??_C@_1DK@JGLLEIAO@?$AA?2?$AAD?$AAo?$AAs?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAs?$AA?2?$AAA?$AAC?$AAP?$AAI?$AA_?$AAR?$AAO?$AAO?$AAT?$AA_?$AAO?$AAB?$AAJ?$AAE?$AAC?$AAT?$AA?$AA@
0x1400225A1: SmpAnyDriveDescriptorCreated
0x140016548: SmssEvt_LoadSubsystem_Stop
0x140012400: SmpConfigureExcludeKnownDlls
0x1400168E0: "Required" ??_C@_1BC@KOHFMEOF@?$AAR?$AAe?$AAq?$AAu?$AAi?$AAr?$AAe?$AAd?$AA?$AA@
0x140008D8C: SmpLoadDataFromRegistry
0x140022290: SmpS0CommandOverride
0x140017590: "\REGISTRY\MACHINE\OSDATA\Session" ??_C@_1FC@DEIKOKEA@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAO?$AAS?$AAD?$AAA?$AAT?$AAA?$AA?2?$AAS?$AAe?$AAs?$AAs?$AAi?$AAo?$AAn@
0x14001D5A0: "Configuring thread pool minimum " ??_C@_1FM@NAOCNKAH@?$AAC?$AAo?$AAn?$AAf?$AAi?$AAg?$AAu?$AAr?$AAi?$AAn?$AAg?$AA?5?$AAt?$AAh?$AAr?$AAe?$AAa?$AAd?$AA?5?$AAp?$AAo?$AAo?$AAl?$AA?5?$AAm?$AAi?$AAn?$AAi?$AAm?$AAu?$AAm?$AA?5@
0x14001A390: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1GO@KNEPEFIA@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140017100: SmssEvt_SetupExecuteList_Start
0x14001BB80: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1GI@NACCHFOL@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x14001D9C0: "__cdecl _real@43e0000000000000" __real@43e0000000000000
0x140007570: RtlQueryVolumeDiskSpeedPolicy
0x140015F10: "__cdecl _imp_RtlQueryPerformanceFrequency" __imp_RtlQueryPerformanceFrequency
0x1400127E0: SmpForceDeleteTargetFile
0x14000D086: RtlUnhandledExceptionFilter
0x140015FF8: "__cdecl _imp_RtlSetEnvironmentVariable" __imp_RtlSetEnvironmentVariable
0x14001B570: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1HG@PMCCDMFL@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x14001C6A0: "\REGISTRY\MACHINE\SOFTWARE\Class" ??_C@_1FK@OBKOJHPJ@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAC?$AAl?$AAa?$AAs?$AAs@
0x14001404C: Wow64SelectWowNodePathInternal
0x140016190: "__cdecl _imp_EtwRegisterTraceGuidsW" __imp_EtwRegisterTraceGuidsW
0x14000D056: "__cdecl _C_specific_handler" __C_specific_handler
0x140015BE0: SmpSafebootOptionValue
0x1400125A0: SmpConfigureS0InitCmd
0x140015010: SmpDebugKeyword
0x14000D062: RtlCaptureContext
0x140022334: SmpMiniNTBoot
0x140016590: "\Registry\Machine\System\Current" ??_C@_1GO@MBBBLOKI@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x14000D03E: NtDeviceIoControlFile
0x140010718: SmpMakeSystemManagedPagingFileDescriptor
0x140021CD0: WPP_REGISTRATION_GUIDS
0x1400161A0: "__cdecl _imp_NtDelayExecution" __imp_NtDelayExecution
0x14001CCD0: "WaitForPagingFiles" ??_C@_1CG@KLDNLCIE@?$AAW?$AAa?$AAi?$AAt?$AAF?$AAo?$AAr?$AAP?$AAa?$AAg?$AAi?$AAn?$AAg?$AAF?$AAi?$AAl?$AAe?$AAs?$AA?$AA@
0x140015E68: "__cdecl _imp_RtlCopyUnicodeString" __imp_RtlCopyUnicodeString
0x1400160C8: "__cdecl _imp_RtlAcquireSRWLockShared" __imp_RtlAcquireSRWLockShared
0x140017788: "wininit.exe" ??_C@_1BI@DBNLEFLG@?$AAw?$AAi?$AAn?$AAi?$AAn?$AAi?$AAt?$AA?4?$AAe?$AAx?$AAe?$AA?$AA@
0x140015DD8: "__cdecl _imp_RtlCreateAcl" __imp_RtlCreateAcl
0x140016268: "__cdecl _imp_RtlSendMsgToSm" __imp_RtlSendMsgToSm
0x14001B1F0: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1HM@DODKDKP@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x140004408: SmpMarkThreadFree
0x1400139EC: SmpDisposeSubSysSynch
0x1400171D0: "\Registry\Machine\System\Current" ??_C@_1IA@OMCDLACP@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1400160E8: "__cdecl _imp_NtQueryInformationToken" __imp_NtQueryInformationToken
0x14000D3CC: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x140015FA8: "__cdecl _imp_NtCreateEvent" __imp_NtCreateEvent
0x140017110: SmssEvt_PlatformExecuteList_Stop
0x140016FC8: "\Device\mailslot\" ??_C@_1CE@MPHMOHNC@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAm?$AAa?$AAi?$AAl?$AAs?$AAl?$AAo?$AAt?$AA?2?$AA?$AA@
0x140021F80: SmpCurrentNodeCount
0x14001B510: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1FO@PKHJCIKC@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x1400172C0: "System-ConfigurePagefileForLowSt" ??_C@_1FM@GOKPCFNF@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?9?$AAC?$AAo?$AAn?$AAf?$AAi?$AAg?$AAu?$AAr?$AAe?$AAP?$AAa?$AAg?$AAe?$AAf?$AAi?$AAl?$AAe?$AAF?$AAo?$AAr?$AAL?$AAo?$AAw?$AAS?$AAt@
0x14001C4A0: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1HE@CIGNKJLA@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x1400097C0: SmpConfigureSubSystems
0x140008C18: SmpProcessFileRenames
0x1400225AC: SmpWsSwapPagefileCreated
0x1400225B8: SmpDumpType
0x14001A0C0: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1FM@OCJNCNPL@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140016630: "\Device\RdyBoost" ??_C@_1CC@MHOEJLNL@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAR?$AAd?$AAy?$AAB?$AAo?$AAo?$AAs?$AAt?$AA?$AA@
0x14001B4A0: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1GM@FJBPICIM@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x14001D2C0: "Non-DLL file included in KnownDL" ??_C@_1FA@OEFBOKOB@?$AAN?$AAo?$AAn?$AA?9?$AAD?$AAL?$AAL?$AA?5?$AAf?$AAi?$AAl?$AAe?$AA?5?$AAi?$AAn?$AAc?$AAl?$AAu?$AAd?$AAe?$AAd?$AA?5?$AAi?$AAn?$AA?5?$AAK?$AAn?$AAo?$AAw?$AAn?$AAD?$AAL@
0x1400192D0: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1KG@IGEANDIK@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x14001BCD0: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1GK@FMFAPIJB@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x140015CF0: "__cdecl _imp_RtlAllocateHeap" __imp_RtlAllocateHeap
0x1400225E8: SmpDesiredPfSizeForApps
0x140021CE0: WPP_MAIN_CB
0x14000CCF0: SmpConfigureNumberInitialSessions
0x14000AE48: SmpRecordCreatedPageFiles
0x1400050B0: SmpSortDllList
0x140016108: "__cdecl _imp_AlpcInitializeMessageAttribute" __imp_AlpcInitializeMessageAttribute
0x1400216E4: SmpSafeBootOption
0x14001CD28: "Environment" ??_C@_1BI@GGNGIFIL@?$AAE?$AAn?$AAv?$AAi?$AAr?$AAo?$AAn?$AAm?$AAe?$AAn?$AAt?$AA?$AA@
0x140016170: "__cdecl _imp_NtAssignProcessToJobObject" __imp_NtAssignProcessToJobObject
0x1400221F0: SmpBootExecuteNoPnpSyncList
0x1400185B0: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1ME@BANKGEIP@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x140017320: "TempDestination" ??_C@_1CA@JNBGKABD@?$AAT?$AAe?$AAm?$AAp?$AAD?$AAe?$AAs?$AAt?$AAi?$AAn?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x140002A94: SmpSetCoreProcessIds
0x140016544: SmpSessionCreatePrivilege
0x140001020: SmpStopCsr
0x140016128: "__cdecl _imp_NtAlpcOpenSenderProcess" __imp_NtAlpcOpenSenderProcess
0x14001171C: SmpQueryVolumeFreeSpace
0x14001036C: SmpDeletePagingFile
0x140005090: SmpFreeSavedRegistryEntry
0x140010F2C: SmpEventWriteString
0x1400160C0: "__cdecl _imp_RtlReleaseSRWLockExclusive" __imp_RtlReleaseSRWLockExclusive
0x14001D310: "SMSS-PFRO" ??_C@_1BE@CLCJHJHD@?$AAS?$AAM?$AAS?$AAS?$AA?9?$AAP?$AAF?$AAR?$AAO?$AA?$AA@
0x1400168C8: "Optional" ??_C@_1BC@BKJNEEFE@?$AAO?$AAp?$AAt?$AAi?$AAo?$AAn?$AAa?$AAl?$AA?$AA@
0x140019050: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1KC@FFLFECMJ@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x140019570: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1LA@NNJOMGAH@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x140015F30: "__cdecl _imp_NtTerminateProcess" __imp_NtTerminateProcess
0x14001D120: "|delete operation|" ??_C@_1CG@JADHGMOG@?$AA?$HM?$AAd?$AAe?$AAl?$AAe?$AAt?$AAe?$AA?5?$AAo?$AAp?$AAe?$AAr?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$HM?$AA?$AA@
0x1400225B0: SmpMmKey
0x140009940: SmpConfigureKnownDlls
0x140016AB0: "TempPageFile" ??_C@_1BK@CONHCFPL@?$AAT?$AAe?$AAm?$AAp?$AAP?$AAa?$AAg?$AAe?$AAF?$AAi?$AAl?$AAe?$AA?$AA@
0x140021FA0: SmpNodeBitmapBuffer
0x140021CB0: SmpOverflowSubSysList
0x140016CD0: "\Device\mailslot\ProtectedPrefix" ??_C@_1GA@HMPHIFBL@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAm?$AAa?$AAi?$AAl?$AAs?$AAl?$AAo?$AAt?$AA?2?$AAP?$AAr?$AAo?$AAt?$AAe?$AAc?$AAt?$AAe?$AAd?$AAP?$AAr?$AAe?$AAf?$AAi?$AAx@
0x140021DB8: MailPrefix1
0x140021DC0: MailPrefix2
0x140021DC8: MailPrefix3
0x140021DD0: MailPrefix4
0x14001D0B8: "\??\" ??_C@_19JHEHLFPM@?$AA?2?$AA?$DP?$AA?$DP?$AA?2?$AA?$AA@
0x14001262C: SmpDeleteFile
0x1400068E0: SmpCreateVolumeDescriptors
0x1400229F0: SmpDefaultLibPath
0x14001CBB0: "ExcludeFromKnownDlls" ??_C@_1CK@KHEBLMMF@?$AAE?$AAx?$AAc?$AAl?$AAu?$AAd?$AAe?$AAF?$AAr?$AAo?$AAm?$AAK?$AAn?$AAo?$AAw?$AAn?$AAD?$AAl?$AAl?$AAs?$AA?$AA@
0x140022288: SmpInitExecuteCmd
0x1400173E8: "`string'" ??_C@_1BK@OLOLICDK@?$AAI?$AAN?$AAI?$AAT?$AA?$AA?$AAD?$AAB?$AAG?$AA?$AA?$AAS?$AAM?$AA?$AA?$AA?$AA@
0x14000856C: SmpWow64IsWowGuestMachineSupported
0x140006A90: SmpTranslateSystemPartitionInformation
0x14001B750: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1GO@GMCDGIOE@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x140015D18: "__cdecl _imp_RtlPrefixUnicodeString" __imp_RtlPrefixUnicodeString
0x140001350: SmscpLoadSubSystemsForMuSession
0x140017C60: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1JM@FMNDFCEB@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x14001C080: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1IO@PPLHPHNK@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x14000169C: SmscpLoadSubSystem
0x14001CB88: "TempFileDirectory" ??_C@_1CE@IHFKDOJK@?$AAT?$AAe?$AAm?$AAp?$AAF?$AAi?$AAl?$AAe?$AAD?$AAi?$AAr?$AAe?$AAc?$AAt?$AAo?$AAr?$AAy?$AA?$AA@
0x1400164E8: " " ??_C@_13HOIJIPNN@?$AA?5?$AA?$AA@
0x1400177A0: "Windows_NT" ??_C@_1BG@PPEGGAFF@?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA_?$AAN?$AAT?$AA?$AA@
0x140016058: "__cdecl _imp_RtlCreateUserProcessEx" __imp_RtlCreateUserProcessEx
0x140018500: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1KM@DJAEHICE@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x1400177C8: "AMD64" ??_C@_1M@EEBFAJEO@?$AAA?$AAM?$AAD?$AA6?$AA4?$AA?$AA@
0x14000B720: SmpAsyncMemoryConfiguration
0x140013958: SmpDeleteSubSys
0x14000B7F0: SmpCheckMemoryCoolingCompatibility
0x140021C90: SmscpInitExecuteCmd
0x140002180: SmpEventWriteULONG
0x140017358: "%wZ\pf%02u.dmp" ??_C@_1BO@HPJFDAJK@?$AA?$CF?$AAw?$AAZ?$AA?2?$AAp?$AAf?$AA?$CF?$AA0?$AA2?$AAu?$AA?4?$AAd?$AAm?$AAp?$AA?$AA@
0x14001B900: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1HE@ODMKAHDM@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x1400160D0: "__cdecl _imp_RtlReleaseSRWLockShared" __imp_RtlReleaseSRWLockShared
0x14001CF70: "ramdisk" ??_C@_1BA@JKJEDBJO@?$AAr?$AAa?$AAm?$AAd?$AAi?$AAs?$AAk?$AA?$AA@
0x140015DA0: "__cdecl _imp_NtDeleteValueKey" __imp_NtDeleteValueKey
0x14001AF70: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1HA@JBENLOIB@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x1400050C0: SmpNotImplemented
0x1400081A0: SmpRandomizeDllList
0x140022360: SmpPagefileLog
0x14001C520: "\REGISTRY\MACHINE\SOFTWARE\Clien" ??_C@_1EG@LJHHMOKB@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAC?$AAl?$AAi?$AAe?$AAn@
0x140015D78: "__cdecl _imp_NtQueryInformationFile" __imp_NtQueryInformationFile
0x140012A54: SmpLoadSubSystem
0x140016520: "`string'" ??_C@_1CE@DCDIGJMC@?$AAP?$AAA?$AAR?$AAS?$AA?$AA?$AAI?$AAN?$AAI?$AAT?$AA?$AA?$AAD?$AAB?$AAG?$AA?$AA?$AAS?$AAM?$AA?$AA?$AA?$AA@
0x140016E00: "\Device\NamedPipe\ProtectedPrefi" ??_C@_1FO@HKGAEBHC@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAN?$AAa?$AAm?$AAe?$AAd?$AAP?$AAi?$AAp?$AAe?$AA?2?$AAP?$AAr?$AAo?$AAt?$AAe?$AAc?$AAt?$AAe?$AAd?$AAP?$AAr?$AAe?$AAf?$AAi@
0x140021F78: SmpManufacturingMode
0x14000CD50: SmpConfigureAllowProtectedRenames
0x140017760: "secure" ??_C@_1O@JMMJIAMC@?$AAs?$AAe?$AAc?$AAu?$AAr?$AAe?$AA?$AA@
0x140022270: SmpSubSystemsToDefer
0x14000BB9C: SmpQueryDedicatedDumpSetting
0x14001D360: "%wZ program not found - skipping" ??_C@_1FI@BJHGOCBB@?$AA?$CF?$AAw?$AAZ?$AA?5?$AAp?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AA?5?$AAn?$AAo?$AAt?$AA?5?$AAf?$AAo?$AAu?$AAn?$AAd?$AA?5?$AA?9?$AA?5?$AAs?$AAk?$AAi?$AAp?$AAp?$AAi?$AAn?$AAg@
0x140015CC0: "__cdecl _imp_RtlUpcaseUnicodeChar" __imp_RtlUpcaseUnicodeChar
0x140015F48: "__cdecl _imp_TpPostWork" __imp_TpPostWork
0x140022330: SmpMaximumNodeCount
0x14001D070: "Overwrite" ??_C@_1BE@MHMBHFFJ@?$AAO?$AAv?$AAe?$AAr?$AAw?$AAr?$AAi?$AAt?$AAe?$AA?$AA@
0x14001CA28: "`string'" ??_C@_1CO@HPJNAHOA@?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?$AA?$AA?2?$AAR?$AAP?$AAC?$AA?5?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AA?$AA?$AA?$AA@
0x140018800: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1KA@OLDGNDLM@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140016158: "__cdecl _imp_RtlSleepConditionVariableSRW" __imp_RtlSleepConditionVariableSRW
0x14001C000: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1HG@FCNGOAAE@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140017770: "autocheck" ??_C@_1BE@CBHFMHJC@?$AAa?$AAu?$AAt?$AAo?$AAc?$AAh?$AAe?$AAc?$AAk?$AA?$AA@
0x14000D430: "__cdecl _GSHandlerCheck_SEH" __GSHandlerCheck_SEH
0x140015FF0: "__cdecl _imp__wcsicmp" __imp__wcsicmp
0x14001BC70: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1FC@HKAFAEPF@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x1400160A8: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x140017750: "async" ??_C@_1M@ICNBJLBA@?$AAa?$AAs?$AAy?$AAn?$AAc?$AA?$AA@
0x14001D348: "%s\%s" ??_C@_1M@DFKENGJN@?$AA?$CF?$AAs?$AA?2?$AA?$CF?$AAs?$AA?$AA@
0x140016A18: "\SysWOW64" ??_C@_1BE@MJECBGNO@?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?$AA@
0x14000A1B0: SmpConfigureMemoryMgmt
0x140016220: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x140015C50: Wowx86NodeString
0x140017070: SmssEvt_ExecuteImage_Start
0x140015EE8: "__cdecl _imp_RtlQueryRegistryValuesEx" __imp_RtlQueryRegistryValuesEx
0x140018AF0: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1IM@DIOHODED@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x14001D870: "Core Windows subsystem terminate" ??_C@_1EE@CFABOFBF@?$AAC?$AAo?$AAr?$AAe?$AA?5?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAs?$AAu?$AAb?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?5?$AAt?$AAe?$AAr?$AAm?$AAi?$AAn?$AAa?$AAt?$AAe@
0x140016578: "BootOptions" ??_C@_1BI@KODDANKI@?$AAB?$AAo?$AAo?$AAt?$AAO?$AAp?$AAt?$AAi?$AAo?$AAn?$AAs?$AA?$AA@
0x140002358: SmpLoadPnPSerializeSettings
0x1400160A0: "__cdecl _imp_NtDeleteFile" __imp_NtDeleteFile
0x14000C704: SmpFinalizePathStrings
0x140008720: SmpGetControlDeviceHandle
0x14000D3A8: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x140004E50: SmpInsertControlBlock
0x140015DF0: "__cdecl _imp_RtlSetOwnerSecurityDescriptor" __imp_RtlSetOwnerSecurityDescriptor
0x140017040: "\RPC Control" ??_C@_1BK@OABNDDOD@?$AA?2?$AAR?$AAP?$AAC?$AA?5?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AA?$AA@
0x14001A630: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1LA@KFEADHBB@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x140015E40: "__cdecl _imp_NtFreeVirtualMemory" __imp_NtFreeVirtualMemory
0x140002444: SmscpParseArgs
0x140016D30: "\Device\NamedPipe\ProtectedPrefi" ??_C@_1GC@MFCHBAOF@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAN?$AAa?$AAm?$AAe?$AAd?$AAP?$AAi?$AAp?$AAe?$AA?2?$AAP?$AAr?$AAo?$AAt?$AAe?$AAc?$AAt?$AAe?$AAd?$AAP?$AAr?$AAe?$AAf?$AAi@
0x140015DE0: "__cdecl _imp_RtlAddAccessAllowedAce" __imp_RtlAddAccessAllowedAce
0x1400087B8: SmpCreateDynamicEnvironmentVariables
0x140002850: SmpExecPgm
0x140005F54: SmpInitializePendingRename
0x140001234: SmscMain
0x140015CA8: "__cdecl _imp_NtDeviceIoControlFile" __imp_NtDeviceIoControlFile
0x140022280: SmpClearTempFiles
0x140019BB0: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1JE@LJKOBFCB@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140015E80: "__cdecl _imp_RtlAdjustPrivilege" __imp_RtlAdjustPrivilege
0x140016008: "__cdecl _imp_NtMapViewOfSection" __imp_NtMapViewOfSection
0x140017940: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1GA@IEMMLMMB@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x14001ABF0: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1FC@GEPKADFF@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140021D80: SmpApiConnectionPort
0x140017800: "\REGISTRY\MACHINE\SOFTWARE\Regis" ??_C@_1GE@KNCCOOCH@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs@
0x140004824: SmpWaitForSingleSubSys
0x14001B180: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1GE@LMJPCOCN@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140015FD8: "__cdecl _imp_NtQueryDirectoryFile" __imp_NtQueryDirectoryFile
0x140017120: "\Registry\Machine\System\Current" ??_C@_1KK@LGHIJPGA@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1400225A0: SmpRegistrySpecifierPresent
0x14000BA74: SmpQueryFilterPagesDumpSetting
0x140022320: SmpPagingFileList
0x140016B70: "\Registry\Machine\System\Current" ??_C@_1JK@IIJAPNAK@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1400113CC: SmpQueryFileSize
0x140015CD8: "__cdecl _imp_RtlGetVersion" __imp_RtlGetVersion
0x1400161E0: "__cdecl _imp_RtlInitializeConditionVariable" __imp_RtlInitializeConditionVariable
0x140015CE8: "__cdecl _imp_TpSetTimer" __imp_TpSetTimer
0x1400161C0: "__cdecl _imp_TpAllocPool" __imp_TpAllocPool
0x140002DBC: SmpAllocateControlBlock
0x14001D998: "\WowAA64Node" ??_C@_1BK@BOJDEMAO@?$AA?2?$AAW?$AAo?$AAw?$AAA?$AAA?$AA6?$AA4?$AAN?$AAo?$AAd?$AAe?$AA?$AA@
0x140021CA0: SmpHelperCmd
0x140021D68: SmpCoreProcessIds
0x14001D820: "Session Manager Core Session fai" ??_C@_1EK@KBFPJNPE@?$AAS?$AAe?$AAs?$AAs?$AAi?$AAo?$AAn?$AA?5?$AAM?$AAa?$AAn?$AAa?$AAg?$AAe?$AAr?$AA?5?$AAC?$AAo?$AAr?$AAe?$AA?5?$AAS?$AAe?$AAs?$AAs?$AAi?$AAo?$AAn?$AA?5?$AAf?$AAa?$AAi@
0x1400074D0: SmpIsVolumeOnSCMDevice
0x140021F7C: SmpCalledConfigEnv
0x140002EC0: NtProcessStartupW
0x1400161E8: "__cdecl _imp_NtClearEvent" __imp_NtClearEvent
0x140016078: "__cdecl _imp_RtlGetAce" __imp_RtlGetAce
0x140015F50: "__cdecl _imp_TpWaitForWork" __imp_TpWaitForWork
0x140012924: SmpGetTime
0x140015CF8: "__cdecl _imp_RtlFreeHeap" __imp_RtlFreeHeap
0x140015EB8: "__cdecl _imp_RtlInitializeBitMap" __imp_RtlInitializeBitMap
0x14001D958: "\Wow6464Node" ??_C@_1BK@JDOKLMCN@?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4?$AA6?$AA4?$AAN?$AAo?$AAd?$AAe?$AA?$AA@
0x14000A524: SmpCreateWorkingSetSwapPagingFile
0x140015EE0: "__cdecl _imp_RtlSetCurrentEnvironment" __imp_RtlSetCurrentEnvironment
0x140021DB0: PipePrefix4
0x1400225C8: SmpHighestPhysicalAddress
0x140021D98: PipePrefix1
0x14001BF00: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1GM@NNHNELDP@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140021DA0: PipePrefix2
0x140021DA8: PipePrefix3
0x140016A80: "PagefileHybridPriority" ??_C@_1CO@NNFJGNIH@?$AAP?$AAa?$AAg?$AAe?$AAf?$AAi?$AAl?$AAe?$AAH?$AAy?$AAb?$AAr?$AAi?$AAd?$AAP?$AAr?$AAi?$AAo?$AAr?$AAi?$AAt?$AAy?$AA?$AA@
0x1400159C0: SmpAutoChkDefaultCommand
0x140015EB0: "__cdecl _imp_NtAlpcCreatePort" __imp_NtAlpcCreatePort
0x14001BA70: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1HI@GGGIKEKI@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140016850: "Kmode" ??_C@_1M@HHJEFNME@?$AAK?$AAm?$AAo?$AAd?$AAe?$AA?$AA@
0x14001C9E0: "ProtectionMode" ??_C@_1BO@JFJHGLBJ@?$AAP?$AAr?$AAo?$AAt?$AAe?$AAc?$AAt?$AAi?$AAo?$AAn?$AAM?$AAo?$AAd?$AAe?$AA?$AA@
0x14000CB30: SmpEstablishClientSecurity
0x140015E08: "__cdecl _imp_RtlDosPathNameToNtPathName_U" __imp_RtlDosPathNameToNtPathName_U
0x140005190: SmpConfigureProtectionMode
0x140016160: "__cdecl _imp_RtlWakeAllConditionVariable" __imp_RtlWakeAllConditionVariable
0x140019ED0: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1KG@LFFNKIHK@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x140017A00: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1GM@EHFHBDE@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x14000662C: SmpExpandKnownDllsPath
0x140021C88: SmscpSubsystemRegistered
0x140021000: SmpS0InitCmd
0x140015BF0: SmpDeletedFile
0x140019D00: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1JA@HJDDMKDD@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x1400159D0: SmpAutoChkKeyword
0x14001CA70: "BootExecuteNoPnpSync" ??_C@_1CK@DLMCJHFO@?$AAB?$AAo?$AAo?$AAt?$AAE?$AAx?$AAe?$AAc?$AAu?$AAt?$AAe?$AAN?$AAo?$AAP?$AAn?$AAp?$AAS?$AAy?$AAn?$AAc?$AA?$AA@
0x140022A38: SmpBackgroundLoadKnownDlls
0x140022560: SmpPagefileLogIndex
0x140016258: "__cdecl _imp_iswspace" __imp_iswspace
0x140013270: SmpSetTargetAttributes
0x1400108A0: SmpPagefileUsageSampleCompare
0x1400043C4: SmpGetProcessMuSessionId
0x140022A58: SmpControlLock
0x140016658: "%04x" ??_C@_19BKMMBKI@?$AA?$CF?$AA0?$AA4?$AAx?$AA?$AA@
0x14001D8E8: "-g -x " ??_C@_1O@GCHNFPPJ@?$AA?9?$AAg?$AA?5?$AA?9?$AAx?$AA?5?$AA?$AA@
0x1400017E8: SmpExecuteCommand
0x14001D430: "%d/%d/%d %d:%d:%d - %d Successfu" ??_C@_1GM@CMEBMCLG@?$AA?$CF?$AAd?$AA?1?$AA?$CF?$AAd?$AA?1?$AA?$CF?$AAd?$AA?5?$AA?$CF?$AAd?$AA?3?$AA?$CF?$AAd?$AA?3?$AA?$CF?$AAd?$AA?5?$AA?9?$AA?5?$AA?$CF?$AAd?$AA?5?$AAS?$AAu?$AAc?$AAc?$AAe?$AAs?$AAs?$AAf?$AAu@
0x140004FA0: RtlStringCbPrintfW
0x14001B660: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1IC@CDFKOHEN@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x1400225D8: SmpDesiredPfSizeBasedOnRAM
0x140015EF8: "__cdecl _imp_RtlEqualUnicodeString" __imp_RtlEqualUnicodeString
0x140015C70: WowArmNodeString
0x14001CBE0: "BackgroundLoadKnownDlls" ??_C@_1DA@NJAGJEEO@?$AAB?$AAa?$AAc?$AAk?$AAg?$AAr?$AAo?$AAu?$AAn?$AAd?$AAL?$AAo?$AAa?$AAd?$AAK?$AAn?$AAo?$AAw?$AAn?$AAD?$AAl?$AAl?$AAs?$AA?$AA@
0x140019420: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1LA@KMGNHBBL@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x1400050D0: SmpInitializeKnownSubSystems
0x14000D094: SmpAdjustPagefileSizeforLowStorage
0x1400105C8: SmpIsRamdiskBoot
0x1400179A0: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1FE@LBOPEHPF@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140006DD0: SmpCreateVolumeDescriptor
0x140019A70: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1IK@CBNMIEFI@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140007424: SmpIsVhdVolume
0x140016800: "Session Manager" ??_C@_1CA@NGDFGHGA@?$AAS?$AAe?$AAs?$AAs?$AAi?$AAo?$AAn?$AA?5?$AAM?$AAa?$AAn?$AAa?$AAg?$AAe?$AAr?$AA?$AA@
0x140021F79: SmpDisableWpbtExecution
0x140016E60: "\Device\mailslot\ProtectedPrefix" ??_C@_1GA@BKMOHMCD@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAm?$AAa?$AAi?$AAl?$AAs?$AAl?$AAo?$AAt?$AA?2?$AAP?$AAr?$AAo?$AAt?$AAe?$AAc?$AAt?$AAe?$AAd?$AAP?$AAr?$AAe?$AAf?$AAi?$AAx@
0x140001E2C: SmpExpandEnvironmentString
0x140015E10: "__cdecl _imp_NtCreateFile" __imp_NtCreateFile
0x140013A84: SmpGetSubSysSynch
0x140019850: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1LE@MODPDGED@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x14000AF5C: SmpCleanupStalePageFiles
0x1400162A0: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x14001AA50: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1FC@HKEKKGOJ@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x14000D06E: RtlLookupFunctionEntry
0x14001B6F0: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1FG@HBHIKOOI@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x14000AA58: SmpUpdatePagingFileSizes
0x140022600: SmpPagefileUsage
0x140016860: "DllDirectoryArm32" ??_C@_1CE@LEFKLBPB@?$AAD?$AAl?$AAl?$AAD?$AAi?$AAr?$AAe?$AAc?$AAt?$AAo?$AAr?$AAy?$AAA?$AAr?$AAm?$AA3?$AA2?$AA?$AA@
0x140021D78: SmpSharedSection
0x14001D690: "Thread pool work object allocati" ??_C@_1EI@FLBEECNJ@?$AAT?$AAh?$AAr?$AAe?$AAa?$AAd?$AA?5?$AAp?$AAo?$AAo?$AAl?$AA?5?$AAw?$AAo?$AAr?$AAk?$AA?5?$AAo?$AAb?$AAj?$AAe?$AAc?$AAt?$AA?5?$AAa?$AAl?$AAl?$AAo?$AAc?$AAa?$AAt?$AAi@
0x140015D58: "__cdecl _imp_RtlAppendUnicodeToString" __imp_RtlAppendUnicodeToString
0x140016AF8: "SavedPageFiles" ??_C@_1BO@DMOCEDPN@?$AAS?$AAa?$AAv?$AAe?$AAd?$AAP?$AAa?$AAg?$AAe?$AAF?$AAi?$AAl?$AAe?$AAs?$AA?$AA@
0x14001D328: "SMSS-PFRO*.tmp" ??_C@_1BO@DOCAHMIG@?$AAS?$AAM?$AAS?$AAS?$AA?9?$AAP?$AAF?$AAR?$AAO?$AA?$CK?$AA?4?$AAt?$AAm?$AAp?$AA?$AA@
0x1400026CC: SmpGetFirstSessionId
0x140021F28: SmpApiPortSecurityDescriptor
0x1400221E0: SmpBootExecuteList
0x1400161B8: "__cdecl _imp_EtwEventRegister" __imp_EtwEventRegister
0x14001A290: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1HA@JBMOGHEH@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x14000105C: SmpTerminateCSR
0x140021DD8: SmpPipeSessionsPrefix
0x14000D04A: NtTerminateProcess
0x140021C80: SmscpSharedWindow
0x140013680: SmpStartServerSilo
0x1400222A0: SmpSystemRoot
0x14001CC80: "?:\pagefile.sys" ??_C@_1CC@HBLIKDMN@?$AA?$DP?$AA?3?$AA?2?$AAp?$AAa?$AAg?$AAe?$AAf?$AAi?$AAl?$AAe?$AA?4?$AAs?$AAy?$AAs?$AA?$AA?$AA?$AA@
0x140012DDC: SmpOpenTargetFile
0x140004968: SmpReleaseControlBlock
0x140009DC0: SmpSaveRegistryValue_U
0x140016840: "Execute" ??_C@_1BA@GMIPEBEM@?$AAE?$AAx?$AAe?$AAc?$AAu?$AAt?$AAe?$AA?$AA@
0x140001EE4: SmpExecuteImage
0x140022250: SmpExcludeKnownDllsList
0x1400225F0: SmpTryHardForCrashDump
0x1400026F8: SmscpSetupSharedSpace
0x14001B5F0: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1GK@NGLPIALE@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140015DC0: "__cdecl _imp_RtlUnicodeStringToInteger" __imp_RtlUnicodeStringToInteger
0x140015BD0: SmpPlatformBinaryName
0x14001D8D8: "-p -1 " ??_C@_1O@DCKKAACO@?$AA?9?$AAp?$AA?5?$AA?9?$AA1?$AA?5?$AA?$AA@
0x140009F84: SmpFindRegistryValueEx
0x1400177D8: "IA64" ??_C@_19DGIHPCNG@?$AAI?$AAA?$AA6?$AA4?$AA?$AA@
0x1400031DC: wmain
0x140016218: "__cdecl _imp_RtlReleasePrivilege" __imp_RtlReleasePrivilege
0x140016198: "__cdecl _imp_RtlGetCurrentServiceSessionId" __imp_RtlGetCurrentServiceSessionId
0x140018A20: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1MM@CMGMPMCL@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x14001A880: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1GK@JHBJDML@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x14001C910: "\Registry\Machine\System\Current" ??_C@_1IG@MJLEDPAM@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x14001B9F0: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1HK@EKKGFKIA@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x1400160E0: "__cdecl _imp_NtOpenThreadToken" __imp_NtOpenThreadToken
0x1400225C0: SmpMemorySize
0x140016250: "__cdecl _imp_RtlNormalizeProcessParams" __imp_RtlNormalizeProcessParams
0x140015EC0: "__cdecl _imp_RtlClearAllBits" __imp_RtlClearAllBits
0x1400221D0: SmpTempFilesDir
0x140016430: "\Registry\Machine\Software\Micro" ??_C@_1IE@GFIPFHFC@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140017720: "debug" ??_C@_1M@PHGAFFNN@?$AAd?$AAe?$AAb?$AAu?$AAg?$AA?$AA@
0x140018DC0: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1KM@GIIGMFNL@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x1400229E0: SmpDebug
0x1400168A8: "DllDirectory" ??_C@_1BK@LHHCJEAH@?$AAD?$AAl?$AAl?$AAD?$AAi?$AAr?$AAe?$AAc?$AAt?$AAo?$AAr?$AAy?$AA?$AA@
0x1400180F0: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1JC@BGACKCPH@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140016B40: "SavePageFileContents" ??_C@_1CK@HEIGBACP@?$AAS?$AAa?$AAv?$AAe?$AAP?$AAa?$AAg?$AAe?$AAF?$AAi?$AAl?$AAe?$AAC?$AAo?$AAn?$AAt?$AAe?$AAn?$AAt?$AAs?$AA?$AA@
0x1400176B4: "%s" ??_C@_15GANGMFKL@?$AA?$CF?$AAs?$AA?$AA@
0x140015020: RegistrySymbolicLinks
0x140001540: SmscpExecuteInitialCommand
0x140017E50: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1IK@MHJBOFMA@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140015D48: "__cdecl _imp_NtQueryLicenseValue" __imp_NtQueryLicenseValue
0x140010114: SmpComputeDesiredPfSizeForCrashDump
0x140021010: WPP_GLOBAL_Control
0x140011DC0: SmpSetPagefileTooSmallForDump
0x1400229D8: SmpDosDevicesObjectDirectory
0x140016110: "__cdecl _imp_NtAlpcSendWaitReceivePort" __imp_NtAlpcSendWaitReceivePort
0x14001ACC0: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1FG@MJPIOIOH@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x14001D4B8: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x1400124D0: SmpConfigureFileRenames
0x140005030: "__cdecl TlgEnableCallback" _TlgEnableCallback
0x140016270: "__cdecl _imp_NtQueryKey" __imp_NtQueryKey
0x140004860: SmpCheckSubSysStatus
0x140007390: SmpGetVolumeDiskNumber
0x140015D20: "__cdecl _imp_NtQueryVolumeInformationFile" __imp_NtQueryVolumeInformationFile
0x14001CB68: "ClearTempFiles" ??_C@_1BO@PPCBHCBC@?$AAC?$AAl?$AAe?$AAa?$AAr?$AAT?$AAe?$AAm?$AAp?$AAF?$AAi?$AAl?$AAe?$AAs?$AA?$AA@
0x1400022EC: SmpSelectNodeNumber
0x14001D048: WNF_SMSS_MEMORY_COOLING_COMPATIBLE
0x140016380: "\PendingRenameMutex" ??_C@_1CI@LBPBPHLM@?$AA?2?$AAP?$AAe?$AAn?$AAd?$AAi?$AAn?$AAg?$AAR?$AAe?$AAn?$AAa?$AAm?$AAe?$AAM?$AAu?$AAt?$AAe?$AAx?$AA?$AA@
0x140016148: "__cdecl _imp_NtRequestWaitReplyPort" __imp_NtRequestWaitReplyPort
0x140015E88: "__cdecl _imp_RtlFreeSid" __imp_RtlFreeSid
0x14001D220: "%02x" ??_C@_19NHPFCCLF@?$AA?$CF?$AA0?$AA2?$AAx?$AA?$AA@
0x1400177E8: "Unknown" ??_C@_1BA@LEPJIIOK@?$AAU?$AAn?$AAk?$AAn?$AAo?$AAw?$AAn?$AA?$AA@
0x140021E68: SmpKnownDllsDirSecurityDescriptor
0x14001D270: "Verification of a KnownDLL faile" ??_C@_1EG@CEIMLJAI@?$AAV?$AAe?$AAr?$AAi?$AAf?$AAi?$AAc?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?5?$AAo?$AAf?$AA?5?$AAa?$AA?5?$AAK?$AAn?$AAo?$AAw?$AAn?$AAD?$AAL?$AAL?$AA?5?$AAf?$AAa?$AAi?$AAl?$AAe@
0x140015FA0: "__cdecl _imp_RtlWow64IsWowGuestMachineSupported" __imp_RtlWow64IsWowGuestMachineSupported
0x140018030: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1LE@FKLLAIBM@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x14001D7D0: "Unhandled Exception in Session M" ??_C@_1EO@LEEMOMHE@?$AAU?$AAn?$AAh?$AAa?$AAn?$AAd?$AAl?$AAe?$AAd?$AA?5?$AAE?$AAx?$AAc?$AAe?$AAp?$AAt?$AAi?$AAo?$AAn?$AA?5?$AAi?$AAn?$AA?5?$AAS?$AAe?$AAs?$AAs?$AAi?$AAo?$AAn?$AA?5?$AAM@
0x140015F20: "__cdecl _imp_NtResumeThread" __imp_NtResumeThread
0x140011EC8: RtlStringCbPrintfExW
0x14001CEB0: SmssEvt_CrashDumpCopy_Error
0x140021CC8: SmpKnownSubSysTable
0x140017608: "Failure in known dll worker." ??_C@_1DK@DHLBANAO@?$AAF?$AAa?$AAi?$AAl?$AAu?$AAr?$AAe?$AA?5?$AAi?$AAn?$AA?5?$AAk?$AAn?$AAo?$AAw?$AAn?$AA?5?$AAd?$AAl?$AAl?$AA?5?$AAw?$AAo?$AAr?$AAk?$AAe?$AAr?$AA?4?$AA?$AA@
0x140022A00: SmpDefaultEnvironment
0x140006524: InitializeWow64OnBoot
0x14000A988: SmpTrimPagingFileExtents
0x140015D88: "__cdecl _imp_RtlCompareUnicodeString" __imp_RtlCompareUnicodeString
0x14001CC40: "Memory Management" ??_C@_1CE@IOPMEOCL@?$AAM?$AAe?$AAm?$AAo?$AAr?$AAy?$AA?5?$AAM?$AAa?$AAn?$AAa?$AAg?$AAe?$AAm?$AAe?$AAn?$AAt?$AA?$AA@
0x140015D10: "__cdecl _imp_NtQueryValueKey" __imp_NtQueryValueKey
0x14000A1B0: SmpConfigureExistingPageFiles
0x140015E48: "__cdecl _imp_RtlCreateUnicodeString" __imp_RtlCreateUnicodeString
0x140016C50: "DedicatedDumpFile" ??_C@_1CE@EBPAEGBE@?$AAD?$AAe?$AAd?$AAi?$AAc?$AAa?$AAt?$AAe?$AAd?$AAD?$AAu?$AAm?$AAp?$AAF?$AAi?$AAl?$AAe?$AA?$AA@
0x14000CDE0: "__cdecl _security_check_cookie" __security_check_cookie
0x1400170D0: SmssEvt_SetupExecuteList_Stop
0x14001CEE0: "\Registry\Machine\SYSTEM\Current" ??_C@_1GG@DILNKBOH@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x14000C960: SmpConfigureObjectDirectories
0x14000FDA0: SmpClearPagingFileDescriptorList
0x140021EA8: SmpKnownDllSecurityDescriptor
0x140017250: "SwapfileControl" ??_C@_1CA@DOLOLICA@?$AAS?$AAw?$AAa?$AAp?$AAf?$AAi?$AAl?$AAe?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AA?$AA@
0x140015A00: SmpSafeBootEnvironmentValue
0x140016168: "__cdecl _imp_NtQueryInformationJobObject" __imp_NtQueryInformationJobObject
0x140017090: SmssEvt_BootExecuteList_Stop
0x14001C370: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1FE@EIHHJPBC@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x14001B2E0: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1IC@MINJAHFL@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x140022200: SmpPlatformExecuteList
0x140022300: SmpPagefileOnOsVolume
0x140019100: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1IK@OJONOICA@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x14001A9E0: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1GK@MEIMNMCM@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x14001C850: "\REGISTRY\MACHINE\SOFTWARE\Class" ??_C@_1FO@BPMCHDCC@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAC?$AAl?$AAa?$AAs?$AAs@
0x1400216D0: SmpMaxSwapFileSize
0x140016674: "%u" ??_C@_15EFLNJKHH@?$AA?$CF?$AAu?$AA?$AA@
0x140021E28: SmpLiberalSecurityDescriptor
0x14001CE66: "__cdecl TraceLoggingMetadataEnd" _TraceLoggingMetadataEnd
0x140021DE0: SmpPrimarySecurityDescriptor
0x140022A20: SmpControlBlockRoot
0x14000FE1C: SmpComputeDesiredPfSizeBasedOnHistory
0x140015FB0: "__cdecl _imp_RtlRandomEx" __imp_RtlRandomEx
0x14001D0F0: "\SystemRoot\PFRO.log" ??_C@_1CK@EAPIFJCB@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAo?$AAo?$AAt?$AA?2?$AAP?$AAF?$AAR?$AAO?$AA?4?$AAl?$AAo?$AAg?$AA?$AA@
0x140016738: "PROCESSOR_ARCHITECTURE" ??_C@_1CO@KPLMNPIA@?$AAP?$AAR?$AAO?$AAC?$AAE?$AAS?$AAS?$AAO?$AAR?$AA_?$AAA?$AAR?$AAC?$AAH?$AAI?$AAT?$AAE?$AAC?$AAT?$AAU?$AAR?$AAE?$AA?$AA@
0x14001D640: "ALPC Completion object allocatio" ??_C@_1EE@OOKFGNKC@?$AAA?$AAL?$AAP?$AAC?$AA?5?$AAC?$AAo?$AAm?$AAp?$AAl?$AAe?$AAt?$AAi?$AAo?$AAn?$AA?5?$AAo?$AAb?$AAj?$AAe?$AAc?$AAt?$AA?5?$AAa?$AAl?$AAl?$AAo?$AAc?$AAa?$AAt?$AAi?$AAo@
0x140018B80: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1KE@DMNPNGBO@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x140007090: CreateRegistryLinksForMachine
0x140010FD0: SmpGetCrashParameters
0x140013CB8: SmscpIsDebuggerPresent
0x14000433C: SmpLookupControlBlock
0x140016180: "__cdecl _imp_EtwGetTraceEnableLevel" __imp_EtwGetTraceEnableLevel
0x14001BBF0: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1IA@KGMLBLGP@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x140017340: "DumpFile" ??_C@_1BC@LMFNIDDK@?$AAD?$AAu?$AAm?$AAp?$AAF?$AAi?$AAl?$AAe?$AA?$AA@
0x140016770: "\Registry\Machine\Hardware\Descr" ??_C@_1IC@BKGJPAFM@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAH?$AAa?$AAr?$AAd?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAD?$AAe?$AAs?$AAc?$AAr@
0x140015C60: WowArm64NodeString
0x14000D4BB: "__cdecl _chkstk" __chkstk
0x1400225D0: SmpDesiredPfSizeForCrashDump
0x14001AAB0: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1GK@FMBPFKIN@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x140018190: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1KK@PNEFPGLK@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x140015F88: "__cdecl _imp_RtlInitAnsiString" __imp_RtlInitAnsiString
0x140013834: SmpUnhandledExceptionFilter
0x1400222C0: SmpSystemInfo
0x14001A300: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1II@NKOPIEPK@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x1400044D4: SmpInitializeControlBlock
0x140015D40: "__cdecl _imp_NtCreatePagingFile" __imp_NtCreatePagingFile
0x14001A980: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1FC@OCNJCAEI@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x14001CE80: SmssEvt_PlatformBinaryExecuted
0x140016A50: "\System32" ??_C@_1BE@JPDJANBF@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?$AA@
0x14001A010: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1KG@BAJIMHEF@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x140015E58: "__cdecl _imp_EtwEventEnabled" __imp_EtwEventEnabled
0x140015BB0: SmpPagefileUsageValue
0x14001C998: "SAFEBOOT_OPTION" ??_C@_1CA@FDDIIEOH@?$AAS?$AAA?$AAF?$AAE?$AAB?$AAO?$AAO?$AAT?$AA_?$AAO?$AAP?$AAT?$AAI?$AAO?$AAN?$AA?$AA@
0x140016240: "__cdecl _imp_RtlCompareUnicodeStrings" __imp_RtlCompareUnicodeStrings
0x1400108B8: SmpRoundDownToPowerOf2
0x1400225A4: SmpNumberOfPagefilesCreated
0x140021FC0: SmpTempDirNameBuffer
0x140016908: "SubSystems" ??_C@_1BG@FHHFFJHB@?$AAS?$AAu?$AAb?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAs?$AA?$AA@
0x140021F70: SmpSessionsObjectDirectory
0x140015F78: "__cdecl _imp_NtMakeTemporaryObject" __imp_NtMakeTemporaryObject
0x140016030: "__cdecl _imp_RtlDosSearchPath_U" __imp_RtlDosSearchPath_U
0x14001CE90: SmssEvt_FileRename_Info
0x140022340: SmpUseDedicatedDumpFile
0x140015F60: "__cdecl _imp__wcsupr_s" __imp__wcsupr_s
0x14001A6E0: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1FG@BPGGMIFO@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140015C90: "__cdecl _imp_RtlComputeCrc32" __imp_RtlComputeCrc32
0x140015F38: "__cdecl _imp_RtlIsStateSeparationEnabled" __imp_RtlIsStateSeparationEnabled
0x1400085F4: SmpInitCoreProcessArray
0x140016510: "SMSC!" ??_C@_1M@OOGAHJMA@?$AAS?$AAM?$AAS?$AAC?$AA?$CB?$AA?$AA@
0x1400162B0: "__cdecl _guard_fids_table" __guard_fids_table
0x14000AB98: SmpProcessPagefileDescriptor
0x140017650: "\BaseNamedObjects\SmKnownDllsIni" ??_C@_1FC@GBICDGOJ@?$AA?2?$AAB?$AAa?$AAs?$AAe?$AAN?$AAa?$AAm?$AAe?$AAd?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAs?$AA?2?$AAS?$AAm?$AAK?$AAn?$AAo?$AAw?$AAn?$AAD?$AAl?$AAl?$AAs?$AAI?$AAn?$AAi@
0x140017420: "\Registry\Machine\System\Current" ??_C@_1HE@EPADLGDB@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x140016978: "PendingFileRenameOperations" ??_C@_1DI@GJCOJBON@?$AAP?$AAe?$AAn?$AAd?$AAi?$AAn?$AAg?$AAF?$AAi?$AAl?$AAe?$AAR?$AAe?$AAn?$AAa?$AAm?$AAe?$AAO?$AAp?$AAe?$AAr?$AAa?$AAt?$AAi?$AAo?$AAn?$AAs?$AA?$AA@
0x14001C780: "\REGISTRY\MACHINE\SOFTWARE\Class" ??_C@_1FC@LOLDFNMB@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAC?$AAl?$AAa?$AAs?$AAs@
0x140021E80: SmpKnownDllsDirSDBody
0x140017B10: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1LI@IHDKJPJC@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x140015A10: "__cdecl load_config_used" _load_config_used
0x140021F68: SmpWaitForPagingFiles
0x140017408: "SMSS!" ??_C@_1M@ONLGHLFL@?$AAS?$AAM?$AAS?$AAS?$AA?$CB?$AA?$AA@
0x1400194D0: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1JI@LPOJHL@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140017498: "\Sessions" ??_C@_1BE@GBAFMKEO@?$AA?2?$AAS?$AAe?$AAs?$AAs?$AAi?$AAo?$AAn?$AAs?$AA?$AA@
0x14001B980: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1GC@BKMLCJKL@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x14001D180: "OptionValue" ??_C@_1BI@CBOLNBDL@?$AAO?$AAp?$AAt?$AAi?$AAo?$AAn?$AAV?$AAa?$AAl?$AAu?$AAe?$AA?$AA@
0x140017D00: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1JI@HNCKIBPK@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x14001CB38: "AllowProtectedRenames" ??_C@_1CM@PGOPEFPK@?$AAA?$AAl?$AAl?$AAo?$AAw?$AAP?$AAr?$AAo?$AAt?$AAe?$AAc?$AAt?$AAe?$AAd?$AAR?$AAe?$AAn?$AAa?$AAm?$AAe?$AAs?$AA?$AA@
0x1400095D0: SmpConfigureOneTimeExecute
0x140021C78: SmpInitReturnStatus
0x140021EC0: SmpKnownDllSDBody
0x140022338: SmpCrashDumpKey
0x1400175E8: "ntdll.dll" ??_C@_09FLKFJBLM@ntdll?4dll?$AA@
0x1400100AC: SmpComputeDesiredPfSizeForApps
0x140021F40: SmpApiPortSDBody
0x14001B440: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1FE@OMIFLEEN@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x14001CFB0: "\Registry\Machine\SOFTWARE\Micro" ??_C@_1HO@HGEJKIOJ@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x14001B270: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1GK@DNDMGAKC@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x1400159F0: SmpASyncKeyword
0x140015EA8: "__cdecl _imp_NtSetInformationProcess" __imp_NtSetInformationProcess
0x14001BDA0: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1HG@JAOMBLAE@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x14001BD40: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1FO@JGLHAPPN@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140017080: SmssEvt_BootExecuteList_Start
0x14001BE80: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1HC@DKFGLPEI@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x14000AFD0: SmpCreatePagingFileDescriptor
0x14000A1DC: SmpCreatePagingFile
0x1400161A8: "__cdecl _imp_RtlSetHeapInformation" __imp_RtlSetHeapInformation
0x140015D68: "__cdecl _imp_qsort" __imp_qsort
0x1400119E8: SmpSavePageFile
0x140016938: "PendingFileRenameOperations2" ??_C@_1DK@DGPKHHHH@?$AAP?$AAe?$AAn?$AAd?$AAi?$AAn?$AAg?$AAF?$AAi?$AAl?$AAe?$AAR?$AAe?$AAn?$AAa?$AAm?$AAe?$AAO?$AAp?$AAe?$AAr?$AAa?$AAt?$AAi?$AAo?$AAn?$AAs?$AA2?$AA?$AA@
0x140012FA8: SmpSendPlatformBinaryStatus
0x140015DF8: "__cdecl _imp_NtSetSecurityObject" __imp_NtSetSecurityObject
0x140015DB8: "__cdecl _imp_NtInitializeRegistry" __imp_NtInitializeRegistry
0x140004250: SmpSearchKnownSubSysDatabase
0x14001A500: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1II@DGOFJKHO@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x1400137A4: SmpTerminate
0x140013B50: SmpWaitForStatusChange
0x140015D28: "__cdecl _imp_NtQueryInformationProcess" __imp_NtQueryInformationProcess
0x140015CB0: "__cdecl _imp_NtClose" __imp_NtClose
0x140017BD0: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1IE@HDFKFEBE@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x1400160F8: "__cdecl _imp_TpSetPoolMinThreads" __imp_TpSetPoolMinThreads
0x14001CEA0: SmssEvt_PlatformBinaryExecutionFailed
0x140021E00: SmpPrimarySDBody
0x140021E40: SmpLiberalSDBody
0x140010500: SmpInitializeManagedPagefileSupport
0x140016228: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x140016DA0: "\Device\mailslot\ProtectedPrefix" ??_C@_1FM@HNNOOKNK@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAm?$AAa?$AAi?$AAl?$AAs?$AAl?$AAo?$AAt?$AA?2?$AAP?$AAr?$AAo?$AAt?$AAe?$AAc?$AAt?$AAe?$AAd?$AAP?$AAr?$AAe?$AAf?$AAi?$AAx@
0x140017F90: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1JM@DMLOKNGP@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140022A48: SmpMappedView
0x140021F84: SmpActiveProcessorCount
0x140016010: "__cdecl _imp_NtUnmapViewOfSection" __imp_NtUnmapViewOfSection
0x14001B370: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1FC@EMJDBLOD@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x14001AEE0: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1IM@BELNNLOB@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x140016060: "__cdecl _imp_RtlDestroyProcessParameters" __imp_RtlDestroyProcessParameters
0x140015F98: "__cdecl _imp_RtlDosPathNameToNtPathName_U_WithStatus" __imp_RtlDosPathNameToNtPathName_U_WithStatus
0x14001D258: "MINIMAL" ??_C@_1BA@MHDMKJEM@?$AAM?$AAI?$AAN?$AAI?$AAM?$AAA?$AAL?$AA?$AA@
0x140016188: "__cdecl _imp_EtwGetTraceEnableFlags" __imp_EtwGetTraceEnableFlags
0x140021D20: SmpCallbackEnviron
0x140015F90: "__cdecl _imp_RtlAnsiStringToUnicodeString" __imp_RtlAnsiStringToUnicodeString
0x140017028: "\Windows" ??_C@_1BC@HIBBLOLI@?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?$AA@
0x1400098A0: SmpConfigureDosDevices
0x140022220: SmpDosDevicesList
0x1400072B0: CreateKeyRecursively
0x140016260: "__cdecl _imp_RtlConnectToSm" __imp_RtlConnectToSm
0x140007130: CreateMergeLink
0x140016888: "DllDirectory32" ??_C@_1BO@PHANFAOH@?$AAD?$AAl?$AAl?$AAD?$AAi?$AAr?$AAe?$AAc?$AAt?$AAo?$AAr?$AAy?$AA3?$AA2?$AA?$AA@
0x1400082D0: SmpInitializeKnownDlls
0x140016408: "SymbolicLink" ??_C@_1BK@KDPOKCA@?$AAS?$AAy?$AAm?$AAb?$AAo?$AAl?$AAi?$AAc?$AAL?$AAi?$AAn?$AAk?$AA?$AA@
0x140015D80: "__cdecl _imp_NtFsControlFile" __imp_NtFsControlFile
0x140015ED0: "__cdecl _imp_NtOpenEvent" __imp_NtOpenEvent
0x1400170F0: SmssEvt_BootExecuteNoPnpSyncList_Stop
0x14001D568: "Thread pool allocation" ??_C@_1CO@DJEDFCEN@?$AAT?$AAh?$AAr?$AAe?$AAa?$AAd?$AA?5?$AAp?$AAo?$AAo?$AAl?$AA?5?$AAa?$AAl?$AAl?$AAo?$AAc?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x140018CA0: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1IA@GNFJEINI@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x140016230: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x14001D760: "Unexpected error code from NtWai" ??_C@_1GI@NNLGIPIA@?$AAU?$AAn?$AAe?$AAx?$AAp?$AAe?$AAc?$AAt?$AAe?$AAd?$AA?5?$AAe?$AAr?$AAr?$AAo?$AAr?$AA?5?$AAc?$AAo?$AAd?$AAe?$AA?5?$AAf?$AAr?$AAo?$AAm?$AA?5?$AAN?$AAt?$AAW?$AAa?$AAi@
0x1400121D0: SmpClearTemporaryFiles
0x140019240: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1IO@NPOGDAII@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x14001A590: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1JI@HIGBBIGN@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140018680: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1LA@LKAOFIIG@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x1400160D8: "__cdecl _imp_NtAlpcImpersonateClientOfPort" __imp_NtAlpcImpersonateClientOfPort
0x140007CA4: RtlStringCbCopyW
0x14000BC2C: SmpGetPlatformBinary
0x1400161D8: "__cdecl _imp_NtRaiseHardError" __imp_NtRaiseHardError
0x14000D390: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x140016138: "__cdecl _imp_NtAlpcAcceptConnectPort" __imp_NtAlpcAcceptConnectPort
0x140016718: "PROCESSOR_LEVEL" ??_C@_1CA@KINAHM@?$AAP?$AAR?$AAO?$AAC?$AAE?$AAS?$AAS?$AAO?$AAR?$AA_?$AAL?$AAE?$AAV?$AAE?$AAL?$AA?$AA@
0x14001AFE0: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1II@NKGMFNDM@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x14001CBDC: "" ??_C@_13NOLLCAOD@?$AA?$AA?$AA?$AA@
0x1400166E8: "PROCESSOR_IDENTIFIER" ??_C@_1CK@FCAMODLL@?$AAP?$AAR?$AAO?$AAC?$AAE?$AAS?$AAS?$AAO?$AAR?$AA_?$AAI?$AAD?$AAE?$AAN?$AAT?$AAI?$AAF?$AAI?$AAE?$AAR?$AA?$AA@
0x14000474C: SmpLockKnownSubSysList
0x14001CC10: "DisableWpbtExecution" ??_C@_1CK@PFCCMPKA@?$AAD?$AAi?$AAs?$AAa?$AAb?$AAl?$AAe?$AAW?$AAp?$AAb?$AAt?$AAE?$AAx?$AAe?$AAc?$AAu?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x140018D20: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1JE@EBFHIKDJ@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140013610: SmpAdoptJob
0x140016C78: "\system32;" ??_C@_1BG@HENCCKDL@?$AA?2?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?$DL?$AA?$AA@
0x14001D030: "InstallDate" ??_C@_1BI@JAAGCEJ@?$AAI?$AAn?$AAs?$AAt?$AAa?$AAl?$AAl?$AAD?$AAa?$AAt?$AAe?$AA?$AA@
0x14002258C: SmpNumberOfPagefileDescriptors
0x140016A68: "\KnownDlls" ??_C@_1BG@MHCCONHN@?$AA?2?$AAK?$AAn?$AAo?$AAw?$AAn?$AAD?$AAl?$AAl?$AAs?$AA?$AA@
0x14000A8E8: SmpCheckHybridPriority
0x1400222B0: SmpSystemWriteConstraintInfo
0x14001C700: "\REGISTRY\MACHINE\SOFTWARE\Class" ??_C@_1HC@PBACDNOC@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAC?$AAl?$AAa?$AAs?$AAs@
0x140016668: ", %ws" ??_C@_1M@IHHPCAA@?$AA?0?$AA?5?$AA?$CF?$AAw?$AAs?$AA?$AA@
0x140021D90: SmpLogFileHandle
0x14001A120: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1HE@PLPIEIHL@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x140004DDC: SmpRecordControlBlock
0x140004B30: SmpStartCsr
0x1400048D8: SmpDestroyControlBlock
0x140015EF0: "__cdecl _imp_NtCreateDirectoryObject" __imp_NtCreateDirectoryObject
0x140021C7C: SmpInitProgressByLine
0x140003860: SmpApiCallback
0x140021100: SmpRegistryConfigurationTable
0x1400225A8: SmpNumberOfManagedPagefilesCreated
0x1400051C0: SmpCreateSecurityDescriptors
0x140002D40: SmpReadySubSys
0x14001CCA8: "PagefileOnOsVolume" ??_C@_1CG@JAKMLOKK@?$AAP?$AAa?$AAg?$AAe?$AAf?$AAi?$AAl?$AAe?$AAO?$AAn?$AAO?$AAs?$AAV?$AAo?$AAl?$AAu?$AAm?$AAe?$AA?$AA@
0x14001C3D0: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1GM@PNONKJND@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x140016238: "__cdecl _imp_RtlUnhandledExceptionFilter" __imp_RtlUnhandledExceptionFilter
0x14001A1A0: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1GG@KNANCEOC@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140013604: "__cdecl TlgDefineProvider_annotation__TlgSmpTraceLogHandleProv" _TlgDefineProvider_annotation__TlgSmpTraceLogHandleProv
0x140016298: ntdll_NULL_THUNK_DATA
0x140016248: "__cdecl _imp_memcpy" __imp_memcpy
0x14001C1A0: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1JK@NNGCMNGC@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x140015F40: "__cdecl _imp_TpAllocWork" __imp_TpAllocWork
0x140015E70: "__cdecl _imp_RtlAddMandatoryAce" __imp_RtlAddMandatoryAce
0x14001C440: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1FM@DBAIMMDA@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140018C30: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1GI@BLLACGFM@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x14001C2D0: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1JK@ELGKGKPL@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x140013D34: SmscpNotifySmOfFailure
0x140019190: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1KC@JJKOHMKI@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x14001CAC0: "SetupExecute" ??_C@_1BK@BJIJONBF@?$AAS?$AAe?$AAt?$AAu?$AAp?$AAE?$AAx?$AAe?$AAc?$AAu?$AAt?$AAe?$AA?$AA@
0x140015F68: "__cdecl _imp_NtOpenDirectoryObject" __imp_NtOpenDirectoryObject
0x14000CD70: SmpConfigureWaitForPagingFiles
0x140016098: "__cdecl _imp_RtlTimeToTimeFields" __imp_RtlTimeToTimeFields
0x140017288: "swapfile.sys" ??_C@_1BK@HCODOGFN@?$AAs?$AAw?$AAa?$AAp?$AAf?$AAi?$AAl?$AAe?$AA?4?$AAs?$AAy?$AAs?$AA?$AA@
0x1400021D4: SmpEventWriteULONGString
0x1400161F8: "__cdecl _imp_NtQueryEvent" __imp_NtQueryEvent
0x140015E38: "__cdecl _imp_EtwEventWriteTransfer" __imp_EtwEventWriteTransfer
0x140015FD0: "__cdecl _imp_NtQueryAttributesFile" __imp_NtQueryAttributesFile
0x14000462C: SmpWaitForSubSysStartup
0x1400216C0: "__cdecl _security_cookie" __security_cookie
0x14001B3D0: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1GK@GKMGOHIH@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x140016928: SmssEvt_ProcessFileRenames_Stop
0x1400169F8: "\KnownDllsArm32" ??_C@_1CA@LAHPPCMD@?$AA?2?$AAK?$AAn?$AAo?$AAw?$AAn?$AAD?$AAl?$AAl?$AAs?$AAA?$AAr?$AAm?$AA3?$AA2?$AA?$AA@
0x1400177B8: "ARM64" ??_C@_1M@INPPMIAA@?$AAA?$AAR?$AAM?$AA6?$AA4?$AA?$AA@
0x140016830: SmssEvt_SerializeBoot_Start
0x1400098C8: SmpSaveRegistryValue
0x140016280: "__cdecl _imp_NtQuerySystemInformationEx" __imp_NtQuerySystemInformationEx
0x140016618: "Debugger" ??_C@_1BC@MLJJDKHA@?$AAD?$AAe?$AAb?$AAu?$AAg?$AAg?$AAe?$AAr?$AA?$AA@
0x140016F30: "\Device\mailslot\ProtectedPrefix" ??_C@_1EC@JCBGOPNP@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAm?$AAa?$AAi?$AAl?$AAs?$AAl?$AAo?$AAt?$AA?2?$AAP?$AAr?$AAo?$AAt?$AAe?$AAc?$AAt?$AAe?$AAd?$AAP?$AAr?$AAe?$AAf?$AAi?$AAx@
0x14000A2E4: SmpEnableSwapOnPagingFiles
0x140015D98: "__cdecl _imp_RtlCompareMemory" __imp_RtlCompareMemory
0x140016208: "__cdecl _imp_LdrQueryImageFileExecutionOptions" __imp_LdrQueryImageFileExecutionOptions
0x1400132EC: SmpShuffleMove
0x140016070: "__cdecl _imp_RtlAddProcessTrustLabelAce" __imp_RtlAddProcessTrustLabelAce
0x140010B30: RtlUnicodeStringPrintf
0x140001CC0: SmpParseToken
0x14001D8F8: "\SystemRoot\System32\ntsd.exe" ??_C@_1DM@KMPBHCDF@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAo?$AAo?$AAt?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAn?$AAt?$AAs?$AAd?$AA?4?$AAe?$AAx?$AAe?$AA?$AA@
0x1400175F8: "ntdll32.dll" ??_C@_0M@HMKEDKAO@ntdll32?4dll?$AA@
0x140019F80: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1IO@EJDOCEEH@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140016278: "__cdecl _imp_NtDeleteKey" __imp_NtDeleteKey
0x140016050: "__cdecl _imp_RtlCreateProcessParametersEx" __imp_RtlCreateProcessParametersEx
0x1400169B0: SmssEvt_ProcessFileRenames_Start
0x14001D500: "Session Manager failed to set af" ??_C@_1GG@EPFLIJPJ@?$AAS?$AAe?$AAs?$AAs?$AAi?$AAo?$AAn?$AA?5?$AAM?$AAa?$AAn?$AAa?$AAg?$AAe?$AAr?$AA?5?$AAf?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAs?$AAe?$AAt?$AA?5?$AAa?$AAf@
0x1400164D8: "\??\A:" ??_C@_1O@IFOEILMN@?$AA?2?$AA?$DP?$AA?$DP?$AA?2?$AAA?$AA?3?$AA?$AA@
0x140017270: "SwapFile" ??_C@_1BC@NOIFGBAI@?$AAS?$AAw?$AAa?$AAp?$AAF?$AAi?$AAl?$AAe?$AA?$AA@
0x140021D88: SmpUniqueProcessId
0x140019D90: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1KI@HCAGECNF@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x14001B820: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1HC@IPFMDIFF@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x140022260: SmpSubSystemsRequired
0x14000BCB4: SmpCreateProtectedPrefixes
0x1400169C0: SmssEvt_InitializeKnownDlls_Stop
0x1400169E0: "\SysArm32" ??_C@_1BE@NGMBNGJA@?$AA?2?$AAS?$AAy?$AAs?$AAA?$AAr?$AAm?$AA3?$AA2?$AA?$AA@
0x14001B8A0: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1FM@PKKPGCLM@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140017EE0: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1KC@LHNCHBEI@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x140004888: SmpGetMuSessionIdFromClientContext
0x14001D088: "%s\MEMORY.DMP" ??_C@_1BM@JDJPEOCI@?$AA?$CF?$AAs?$AA?2?$AAM?$AAE?$AAM?$AAO?$AAR?$AAY?$AA?4?$AAD?$AAM?$AAP?$AA?$AA@
0x140015F58: "__cdecl _imp_TpReleaseWork" __imp_TpReleaseWork
0x140017388: "\SmApiPort" ??_C@_1BG@HCJAPODC@?$AA?2?$AAS?$AAm?$AAA?$AAp?$AAi?$AAP?$AAo?$AAr?$AAt?$AA?$AA@
0x140016090: "__cdecl _imp_NtQuerySymbolicLinkObject" __imp_NtQuerySymbolicLinkObject
0x140018240: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1JK@OPFGGFCK@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x14000C880: SmpConfigureEnvironment
0x1400163A8: "\Registry\Machine\System\Setup" ??_C@_1DO@PGOAJPNE@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAS?$AAe?$AAt?$AAu?$AAp?$AA?$AA@
0x140022588: SmpOsVolumeLetter
0x14000BB0C: SmpQueryDwordFromRegistry
0x1400167F4: "OS" ??_C@_15GJILEGKJ@?$AAO?$AAS?$AA?$AA@
0x14001C570: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1FO@JOEEIIAN@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x140015DC8: "__cdecl _imp_RtlAllocateAndInitializeSid" __imp_RtlAllocateAndInitializeSid
0x140004A5C: SmpAddKnownSubSys
0x140015E28: "__cdecl _imp_NtAllocateVirtualMemory" __imp_NtAllocateVirtualMemory
0x1400216B0: SymbolicLinkValueName
0x140015E60: "__cdecl _imp__vsnwprintf" __imp__vsnwprintf
0x14001D0C8: "PagefileTooSmall" ??_C@_1CC@HACFDMDG@?$AAP?$AAa?$AAg?$AAe?$AAf?$AAi?$AAl?$AAe?$AAT?$AAo?$AAo?$AAS?$AAm?$AAa?$AAl?$AAl?$AA?$AA@
0x14001C5D0: "\REGISTRY\MACHINE\SOFTWARE\Class" ??_C@_1FG@EDNMNCEJ@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAC?$AAl?$AAa?$AAs?$AAs@
0x14000859C: SmpInitializeSessionManagement
0x1400172A8: "\??\%c:\%s" ??_C@_1BG@PIHBIFLI@?$AA?2?$AA?$DP?$AA?$DP?$AA?2?$AA?$CF?$AAc?$AA?3?$AA?2?$AA?$CF?$AAs?$AA?$AA@
0x14001D978: "\WowAA32Node" ??_C@_1BK@HFANIHID@?$AA?2?$AAW?$AAo?$AAw?$AAA?$AAA?$AA3?$AA2?$AAN?$AAo?$AAd?$AAe?$AA?$AA@
0x140002BB0: SmpSbCreateSession
0x140015F70: "__cdecl _imp_NtCreateSymbolicLinkObject" __imp_NtCreateSymbolicLinkObject
0x14001D0A8: "DUMP" ??_C@_19OOCJNLOB@?$AAD?$AAU?$AAM?$AAP?$AA?$AA@
0x1400164B8: "BootDir" ??_C@_1BA@IGKNHAOF@?$AAB?$AAo?$AAo?$AAt?$AAD?$AAi?$AAr?$AA?$AA@
0x14001D148: "Error logging PFRO error" ??_C@_1DC@LDGNBHNE@?$AAE?$AAr?$AAr?$AAo?$AAr?$AA?5?$AAl?$AAo?$AAg?$AAg?$AAi?$AAn?$AAg?$AA?5?$AAP?$AAF?$AAR?$AAO?$AA?5?$AAe?$AAr?$AAr?$AAo?$AAr?$AA?$AA@
0x14000CF60: "__cdecl _security_init_cookie" __security_init_cookie
0x14000AB00: SmpCreatePagefileFromDescriptor
0x140016288: "__cdecl _imp___chkstk" __imp___chkstk
0x140015CB8: "__cdecl _imp_NtQuerySystemInformation" __imp_NtQuerySystemInformation
0x1400174B0: "\Registry\Machine\System\Current" ??_C@_1JO@IFKCAGO@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x14000A364: SmpCreatePagefileOnVolume
0x14000B13C: SmpParseSwapOrPageFileArguments
0x1400134D4: SmpTryOverwriteReadonlyFile
0x140017A70: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1KA@PIKFDPED@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140016088: "__cdecl _imp_NtOpenSymbolicLinkObject" __imp_NtOpenSymbolicLinkObject
0x14000AA90: SmpGetPagingFileSize
0x140016C28: "CrashDumpEnabled" ??_C@_1CC@BHHAOCEE@?$AAC?$AAr?$AAa?$AAs?$AAh?$AAD?$AAu?$AAm?$AAp?$AAE?$AAn?$AAa?$AAb?$AAl?$AAe?$AAd?$AA?$AA@
0x140022AB0: SmpSubSysSynchCache
0x140019910: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1JO@DLCBAKGM@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x14000D200: SmpConfigureBackgroundLoadKnownDlls
0x1400173A0: "\Device\VolumesSafeForWriteAcces" ??_C@_1EE@BKEAFBFL@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAV?$AAo?$AAl?$AAu?$AAm?$AAe?$AAs?$AAS?$AAa?$AAf?$AAe?$AAF?$AAo?$AAr?$AAW?$AAr?$AAi?$AAt?$AAe?$AAA?$AAc?$AAc?$AAe?$AAs@
0x1400108E0: SmpUpdatePagefileUsageCallback
0x14001B7C0: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1FK@GKOBIFFJ@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140016000: "__cdecl _imp_NtCreateSection" __imp_NtCreateSection
0x140015CD0: "__cdecl _imp_NtOpenKey" __imp_NtOpenKey
0x140016680: "VendorIdentifier" ??_C@_1CC@GHLLHEOD@?$AAV?$AAe?$AAn?$AAd?$AAo?$AAr?$AAI?$AAd?$AAe?$AAn?$AAt?$AAi?$AAf?$AAi?$AAe?$AAr?$AA?$AA@
0x14000D07A: RtlVirtualUnwind
0x140021050: SmpRegistryConfigurationTable2
0x14001D3C0: "%d/%d/%d %d:%d:%d - PFRO Error: " ??_C@_1GC@PAJKNDCG@?$AA?$CF?$AAd?$AA?1?$AA?$CF?$AAd?$AA?1?$AA?$CF?$AAd?$AA?5?$AA?$CF?$AAd?$AA?3?$AA?$CF?$AAd?$AA?3?$AA?$CF?$AAd?$AA?5?$AA?9?$AA?5?$AAP?$AAF?$AAR?$AAO?$AA?5?$AAE?$AAr?$AAr?$AAo?$AAr?$AA?3?$AA?5@
0x14001B0F0: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1IK@LFKKGIPD@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x14001C240: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1IC@FCOEFHLE@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140016210: "__cdecl _imp_RtlAcquirePrivilege" __imp_RtlAcquirePrivilege
0x140022A08: SmBaseTag
0x140015E90: "__cdecl _imp_RtlLengthSid" __imp_RtlLengthSid
0x1400126F0: SmpEventWriteString2
0x140015D70: "__cdecl _imp_NtSetInformationFile" __imp_NtSetInformationFile
0x140016FF0: "\Device\NamedPipe\" ??_C@_1CG@NDPCIMIK@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAN?$AAa?$AAm?$AAe?$AAd?$AAP?$AAi?$AAp?$AAe?$AA?2?$AA?$AA@
0x140012BBC: SmpLogPFROError
0x14000CC60: SmpCreateInitialSession
0x140016140: "__cdecl _imp_NtConnectPort" __imp_NtConnectPort
0x140004A9C: SmpCreateKnownSubSys
0x1400159A0: SmpSafebootOptionKey
0x140010484: SmpGetVolumeDescriptorForPath
0x14000CE10: "__cdecl _report_gsfailure" __report_gsfailure
0x140022210: SmpSetupExecuteList
0x140002DA4: SmpCompleteSubSysStatusChange
0x140015E50: "__cdecl _imp_EtwEventWrite" __imp_EtwEventWrite
0x14001CAE0: "S0InitialCommand" ??_C@_1CC@LHNOKAOG@?$AAS?$AA0?$AAI?$AAn?$AAi?$AAt?$AAi?$AAa?$AAl?$AAC?$AAo?$AAm?$AAm?$AAa?$AAn?$AAd?$AA?$AA@
0x140015CA0: "__cdecl _imp_NtOpenFile" __imp_NtOpenFile
0x140015E00: "__cdecl _imp_RtlExpandEnvironmentStrings_U" __imp_RtlExpandEnvironmentStrings_U
0x14001D050: "%s\%s%4.4x.tmp" ??_C@_1BO@MHOCCBH@?$AA?$CF?$AAs?$AA?2?$AA?$CF?$AAs?$AA?$CF?$AA4?$AA?4?$AA4?$AAx?$AA?4?$AAt?$AAm?$AAp?$AA?$AA@
0x14000D228: SmpInitializeKnownDllsAsync
0x140015FB8: "__cdecl _imp_qsort_s" __imp_qsort_s
0x1400166A8: "Identifier" ??_C@_1BG@IEICLFFJ@?$AAI?$AAd?$AAe?$AAn?$AAt?$AAi?$AAf?$AAi?$AAe?$AAr?$AA?$AA@
0x140022590: SmpPagingFileDescriptorList
0x140016038: "__cdecl _imp_RtlTestBit" __imp_RtlTestBit
0x140015B20: SmpApiDispatch
0x140022310: SmpExistingPageFilesList
0x140022230: SmpFileRenameList
0x140016028: "__cdecl _imp_RtlQueryEnvironmentVariable_U" __imp_RtlQueryEnvironmentVariable_U
0x1400169D0: SmssEvt_InitializeKnownDlls_Start
0x140017730: "winlogon.exe" ??_C@_1BK@HLMOGDAH@?$AAw?$AAi?$AAn?$AAl?$AAo?$AAg?$AAo?$AAn?$AA?4?$AAe?$AAx?$AAe?$AA?$AA@
0x1400160B8: "__cdecl _imp_NtAlpcDisconnectPort" __imp_NtAlpcDisconnectPort
0x140016040: "__cdecl _imp_RtlInterlockedSetBitRun" __imp_RtlInterlockedSetBitRun
0x1400225E0: SmpDesiredPfSizeBasedOnHistory
0x14001CE70: WPP_ThisDir_CTLGUID_Smss
0x14001CAA0: "PlatformExecute" ??_C@_1CA@LHECEAII@?$AAP?$AAl?$AAa?$AAt?$AAf?$AAo?$AAr?$AAm?$AAE?$AAx?$AAe?$AAc?$AAu?$AAt?$AAe?$AA?$AA@
0x1400229E8: SmpDefaultLibPathBuffer
0x14001C7E0: "\REGISTRY\MACHINE\SOFTWARE\Class" ??_C@_1GK@FMPJADEA@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAC?$AAl?$AAa?$AAs?$AAs@
0x1400115C4: SmpQuerySameVolume
0x14001CD10: "KnownDlls" ??_C@_1BE@OGIFBLJG@?$AAK?$AAn?$AAo?$AAw?$AAn?$AAD?$AAl?$AAl?$AAs?$AA?$AA@
0x1400168F8: "Posix" ??_C@_1M@DLBCHMPD@?$AAP?$AAo?$AAs?$AAi?$AAx?$AA?$AA@
0x1400196E0: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1NA@NMMCHMLD@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x14001CF48: "SystemBootDevice" ??_C@_1CC@DMHBPKKF@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAB?$AAo?$AAo?$AAt?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?$AA@
0x14001183C: SmpSaveOldPageFile
0x14001A7B0: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1FG@ODHMIIDE@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140019380: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1JI@HBEMFOGH@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x1400161D0: "__cdecl _imp_NtWaitForMultipleObjects" __imp_NtWaitForMultipleObjects
0x140016820: SmssEvt_SerializeBoot_Stop
0x140015000: SmscpDefaultCmd
0x140021F90: SmpNodeBitmap
0x140022342: SmpForceCopyDumpFile
0x140011D54: SmpSetEndOfFile
0x140015E20: "__cdecl _imp_NtCreateKey" __imp_NtCreateKey
0x140015E78: "__cdecl _imp_RtlSetSaclSecurityDescriptor" __imp_RtlSetSaclSecurityDescriptor
0x14000B4FC: SmpSaveOldPageFiles
0x14001CF80: "\??\?:\pagefile.sys" ??_C@_1CI@PFLMFHBM@?$AA?2?$AA?$DP?$AA?$DP?$AA?2?$AA?$DP?$AA?3?$AA?2?$AAp?$AAa?$AAg?$AAe?$AAf?$AAi?$AAl?$AAe?$AA?4?$AAs?$AAy?$AAs?$AA?$AA@
0x1400163E8: "SystemPartition" ??_C@_1CA@BCILKFEE@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAP?$AAa?$AAr?$AAt?$AAi?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x140019B00: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1KC@FBJPBANA@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x14000CDB0: SmpQueryWpbtExecutionPolicy
0x140015D50: "__cdecl _imp_NtSetSystemInformation" __imp_NtSetSystemInformation
0x140015DE8: "__cdecl _imp_RtlSetDaclSecurityDescriptor" __imp_RtlSetDaclSecurityDescriptor
0x1400066D0: SmpOpenKnownDllsHandles
0x140022A29: SmpPrimarySmss
0x140016018: "__cdecl _imp_NtDuplicateObject" __imp_NtDuplicateObject
0x140022AA8: SmpSubSysSynchCacheSize
0x140016A30: "\KnownDlls32" ??_C@_1BK@ECBBGPKI@?$AA?2?$AAK?$AAn?$AAo?$AAw?$AAn?$AAD?$AAl?$AAl?$AAs?$AA3?$AA2?$AA?$AA@
0x1400216E0: SmpSerializeBoot
0x14000D310: SmpInitializeKnownDllsWorker
0x140016C90: "\Device\NamedPipe\Sessions" ??_C@_1DG@KIEDHAMB@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAN?$AAa?$AAm?$AAe?$AAd?$AAP?$AAi?$AAp?$AAe?$AA?2?$AAS?$AAe?$AAs?$AAs?$AAi?$AAo?$AAn?$AAs?$AA?$AA@
0x140015F08: "__cdecl _imp_NtSetEvent" __imp_NtSetEvent
0x1400188A0: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1LI@JEKJHDGN@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x1400161B0: "__cdecl _imp_EtwEventSetInformation" __imp_EtwEventSetInformation
0x140016F80: "\Device\NamedPipe\ProtectedPrefi" ??_C@_1EE@EGJCMJHL@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAN?$AAa?$AAm?$AAe?$AAd?$AAP?$AAi?$AAp?$AAe?$AA?2?$AAP?$AAr?$AAo?$AAt?$AAe?$AAc?$AAt?$AAe?$AAd?$AAP?$AAr?$AAe?$AAf?$AAi@
0x14000C7DC: SmpReadSafeBootOption
0x14001C9B8: "autocheck autochk *" ??_C@_1CI@LOGHEKCL@?$AAa?$AAu?$AAt?$AAo?$AAc?$AAh?$AAe?$AAc?$AAk?$AA?5?$AAa?$AAu?$AAt?$AAo?$AAc?$AAh?$AAk?$AA?5?$AA?$CK?$AA?$AA@
0x140018E70: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1JG@NBBHLMEN@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x1400170E0: SmssEvt_ExecuteImage_Stop
0x140016020: "__cdecl _imp_iswctype" __imp_iswctype
0x140003CDC: SmpFinalizeClientContext
0x14001B070: "\REGISTRY\MACHINE\SOFTWARE\Micro" ??_C@_1HC@NNMCEAOF@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x140016120: "__cdecl _imp_NtAlpcCancelMessage" __imp_NtAlpcCancelMessage
0x14000D4D3: memset
0x14001F3C0: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x1400199B0: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1LG@JJIPBBDL@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x14000B23C: SmpCheckForCrashDump
0x140017DA0: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1LA@KAALKOIG@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@

[JEB Decompiler by PNF Software]