Generated by JEB on 2019/08/01

PE: C:\Windows\System32\drivers\bam.sys Base=0x1C0000000 SHA-256=A2088B36CCF6E28E072C471E635CAB153F6D889B41E25642F8943C1A32A54F28
PDB: bam.pdb GUID={79A201E3-825A-97DB-2C60A57FD639E09B} Age=1

289 located named symbols:
0x1C0002528: "RC" ??_C@_15IGNKAAHD@?$AAR?$AAC?$AA?$AA@
0x1C000CF70: BampProcessWindowReportApply
0x1C0005370: BamDriverObject
0x1C000EA58: SepSddlGetAclForString
0x1C0005000: BampDeviceNtFilePathPrefix
0x1C0007278: "__cdecl _imp_RtlFreeUnicodeString" __imp_RtlFreeUnicodeString
0x1C0007068: "__cdecl _imp_RtlQueryPackageClaims" __imp_RtlQueryPackageClaims
0x1C000D540: BamUserSettingsShutdown
0x1C00051D8: "__cdecl _security_cookie_complement" __security_cookie_complement
0x1C0007070: "__cdecl _imp_ObfDereferenceObject" __imp_ObfDereferenceObject
0x1C0005378: PfnIoCreateDeviceSecure
0x1C00082D0: BamControlDispatch
0x1C000BEA0: BampUpdateThrottledProcessSiufState
0x1C00022B0: "RecheckSettingsIntervalMs" ??_C@_1DE@CBINFCNJ@?$AAR?$AAe?$AAc?$AAh?$AAe?$AAc?$AAk?$AAS?$AAe?$AAt?$AAt?$AAi?$AAn?$AAg?$AAs?$AAI?$AAn?$AAt?$AAe?$AAr?$AAv?$AAa?$AAl?$AAM?$AAs?$AA?$AA@
0x1C000AD70: BampCancelThrottledProcessActionItem
0x1C00071C0: "__cdecl _imp_ZwEnumerateValueKey" __imp_ZwEnumerateValueKey
0x1C0007018: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x1C00050A8: BampScavengeUserSettingsIntervalValueName
0x1C00014E0: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x1C0007110: "__cdecl _imp_PsLookupProcessByProcessId" __imp_PsLookupProcessByProcessId
0x1C0002808: "__cdecl TraceLoggingMetadata" _TraceLoggingMetadata
0x1C00071B0: "__cdecl _imp_ZwEnumerateKey" __imp_ZwEnumerateKey
0x1C00071E8: "__cdecl _imp_IoCreateDevice" __imp_IoCreateDevice
0x1C00071F0: "__cdecl _imp_IoDeviceObjectType" __imp_IoDeviceObjectType
0x1C0007158: "__cdecl _imp_SeQueryInformationToken" __imp_SeQueryInformationToken
0x1C000DF90: BampUserSettingsOpenUserKey
0x1C0002530: "WD" ??_C@_15ELMAKJHJ@?$AAW?$AAD?$AA?$AA@
0x1C0007050: "__cdecl _imp_IofCompleteRequest" __imp_IofCompleteRequest
0x1C0002260: "TelemetryIntervalMs" ??_C@_1CI@LNIBJGIP@?$AAT?$AAe?$AAl?$AAe?$AAm?$AAe?$AAt?$AAr?$AAy?$AAI?$AAn?$AAt?$AAe?$AAr?$AAv?$AAa?$AAl?$AAM?$AAs?$AA?$AA@
0x1C0005390: BampUserSettingsContext
0x1C0007238: "__cdecl _imp_RtlCreateSecurityDescriptor" __imp_RtlCreateSecurityDescriptor
0x1C000E3E0: IoDevObjCreateDeviceSecure
0x1C0007228: "__cdecl _imp_wcschr" __imp_wcschr
0x1C0001008: "__cdecl TlgWrite" _TlgWrite
0x1C0007290: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x1C0005384: PiRegStateDiscriptor
0x1C0007268: "__cdecl _imp_RtlGetOwnerSecurityDescriptor" __imp_RtlGetOwnerSecurityDescriptor
0x1C0007230: "__cdecl _imp__wcsnicmp" __imp__wcsnicmp
0x1C000BF80: BampLogThrottlingRundownEventsCallback
0x1C000CD40: BampQueryProcessIdentifier
0x1C000E58C: IopDevObjApplyPostCreationSettings
0x1C000A650: BampGetShortNameFromIdentifier
0x1C00083D4: BampAcquireThrottlingLockShared
0x1C0007088: "__cdecl _imp_ExAcquirePushLockSharedEx" __imp_ExAcquirePushLockSharedEx
0x1C0005098: BampScavengeUserSettingsLifetimeValueName
0x1C00071E0: "__cdecl _imp_MmGetSystemRoutineAddress" __imp_MmGetSystemRoutineAddress
0x1C00050B8: BampRecheckSettingsValueName
0x1C0001100: BampGetUserSettingsHandle
0x1C0002550: "GR" ??_C@_15DNGEKDKB@?$AAG?$AAR?$AA?$AA@
0x1C0007188: "__cdecl _imp_IoOpenDriverRegistryKey" __imp_IoOpenDriverRegistryKey
0x1C0007140: "__cdecl _imp_KeWaitForSingleObject" __imp_KeWaitForSingleObject
0x1C00070E8: "__cdecl _imp_ZwWaitForSingleObject" __imp_ZwWaitForSingleObject
0x1C000BA6C: BampCommitThrottledProcessStateChange
0x1C0008914: BampThrottlingShutdownModule
0x1C0008518: BampReleaseThrottlingWorkerLock
0x1C0002410: "UserSettings" ??_C@_1BK@GNOOHOII@?$AAU?$AAs?$AAe?$AAr?$AAS?$AAe?$AAt?$AAt?$AAi?$AAn?$AAg?$AAs?$AA?$AA@
0x1C0001500: memcpy
0x1C0005520: BampKernelCalloutTable
0x1C0007160: "__cdecl _imp_RtlConvertSidToUnicodeString" __imp_RtlConvertSidToUnicodeString
0x1C000C5C8: BampScavengeUserSettingsCallback
0x1C000E8A0: SepSddlDaclFromSDDLString
0x1C00071A0: "__cdecl _imp_ZwSetValueKey" __imp_ZwSetValueKey
0x1C0007028: "__cdecl _imp_IoDeleteDevice" __imp_IoDeleteDevice
0x1C0007220: "__cdecl _imp_RtlAbsoluteToSelfRelativeSD" __imp_RtlAbsoluteToSelfRelativeSD
0x1C0009A30: BampFindThrottledProcessInformation
0x1C0001500: memmove
0x1C000E724: SepSddlSecurityDescriptorFromSDDLString
0x1C0007170: "__cdecl _imp_RtlCopyUnicodeString" __imp_RtlCopyUnicodeString
0x1C0002460: "IoCreateDeviceSecure" ??_C@_1CK@LEEDIGFP@?$AAI?$AAo?$AAC?$AAr?$AAe?$AAa?$AAt?$AAe?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAS?$AAe?$AAc?$AAu?$AAr?$AAe?$AA?$AA@
0x1C000146C: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x1C000AAFC: BampInsertThrottlingActionItem
0x1C0001368: BampThrottlingProcessGetNextSiblingOrParent
0x1C000D284: BamUserSettingsInitialize
0x1C0008FCC: BampReparentChildren
0x1C00022E8: "ScavengeUserSettingsIntervalMs" ??_C@_1DO@BHAJBKFD@?$AAS?$AAc?$AAa?$AAv?$AAe?$AAn?$AAg?$AAe?$AAU?$AAs?$AAe?$AAr?$AAS?$AAe?$AAt?$AAt?$AAi?$AAn?$AAg?$AAs?$AAI?$AAn?$AAt?$AAe?$AAr?$AAv?$AAa?$AAl?$AAM?$AAs?$AA?$AA@
0x1C00050E8: BampTimerCoalesceValueName
0x1C000CC8C: BampQueryProcessUserSidString
0x1C0007180: "__cdecl _imp_PsGetProcessSessionId" __imp_PsGetProcessSessionId
0x1C000E098: BampUserSettingsReadEntry
0x1C000EF3C: SepSddlParseWideStringUlong
0x1C000B8D0: BampThrottlingProcessPropagateStateToChildren
0x1C0007000: "__cdecl _imp_EtwSetInformation" __imp_EtwSetInformation
0x1C000DAAC: BamUserSettingsEnumerateUsers
0x1C0007020: "__cdecl _imp_ExUnregisterExtension" __imp_ExUnregisterExtension
0x1C0005118: BampUserSettingsSequenceValueName
0x1C000A71C: BampReadGlobalThrottlingSettings
0x1C00071A8: "__cdecl _imp_ZwDeleteValueKey" __imp_ZwDeleteValueKey
0x1C0002560: "GX" ??_C@_15FCNJEDMF@?$AAG?$AAX?$AA?$AA@
0x1C0002220: "TimerDelayMs" ??_C@_1BK@HPBLIAJG@?$AAT?$AAi?$AAm?$AAe?$AAr?$AAD?$AAe?$AAl?$AAa?$AAy?$AAM?$AAs?$AA?$AA@
0x1C0002190: "\REGISTRY\MACHINE\SYSTEM\Current" ??_C@_1IO@EFABNGFM@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1C0002538: "WO" ??_C@_15JMMBCOHI@?$AAW?$AAO?$AA?$AA@
0x1C0007040: "__cdecl _imp_RtlPrefixUnicodeString" __imp_RtlPrefixUnicodeString
0x1C00070B8: "__cdecl _imp_ExAllocatePoolWithTag" __imp_ExAllocatePoolWithTag
0x1C00054F0: BampThrottledProcessTable
0x1C0007250: "__cdecl _imp__snwprintf" __imp__snwprintf
0x1C000A6B8: BampOpenThrottlingPolicyKeyHandle
0x1C0008550: BampAllocateForHashTable
0x1C0007078: "__cdecl _imp_EtwWriteTransfer" __imp_EtwWriteTransfer
0x1C000C5B0: BampScavengeUsersCallback
0x1C0009EAC: BampUpdateThrottledProcessState
0x1C0009D3C: BampRemoveThrottledProcessFromTable
0x1C00025DC: "A" ??_C@_13PNBDBPLL@?$AAA?$AA?$AA@
0x1C000A3D4: BampIsPerMechanismExemptionActive
0x1C00050F8: BampTimerDelayValueName
0x1C0007258: "__cdecl _imp_SeCaptureSecurityDescriptor" __imp_SeCaptureSecurityDescriptor
0x1C0008A90: BampDereferenceThrottledProcessInformation
0x1C00070A0: "__cdecl _imp_KeLeaveCriticalRegion" __imp_KeLeaveCriticalRegion
0x1C00054E0: BampThrottledProcessSequenceNumber
0x1C0001448: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x1C000DC50: BamUserSettingsEnumerateSettingsForUser
0x1C000C3A0: BampThrottlingOnSetLoaderDetourHelper
0x1C0007218: "__cdecl _imp_RtlAddAccessAllowedAce" __imp_RtlAddAccessAllowedAce
0x1C000AEF0: BampThrottlingWorker
0x1C00070D0: "__cdecl _imp_ExUuidCreate" __imp_ExUuidCreate
0x1C0007240: "__cdecl _imp_SeExports" __imp_SeExports
0x1C0005138: BampUserSettingsKeyName
0x1C00071C8: "__cdecl _imp_ZwCreateFile" __imp_ZwCreateFile
0x1C0005088: BampNonExemptGlobalPolicyValueName
0x1C00070D8: "__cdecl _imp_PsCreateSystemThread" __imp_PsCreateSystemThread
0x1C00084D8: BampAcquireThrottlingWorkerLock
0x1C0002430: "Version" ??_C@_1BA@LIACFDLB@?$AAV?$AAe?$AAr?$AAs?$AAi?$AAo?$AAn?$AA?$AA@
0x1C0005360: BampKernelExtensionRegistration
0x1C0007098: "__cdecl _imp_ExReleasePushLockSharedEx" __imp_ExReleasePushLockSharedEx
0x1C0008434: BampReleaseThrottlingLockExclusive
0x1C0008404: BampReleaseThrottlingLockShared
0x1C000FB5C: CmRegUtilWstrValueGetDword
0x1C0002490: "IoValidateDeviceIoControlAccess" ??_C@_1EA@BAHCLPHE@?$AAI?$AAo?$AAV?$AAa?$AAl?$AAi?$AAd?$AAa?$AAt?$AAe?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAI?$AAo?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAA?$AAc?$AAc?$AAe?$AAs?$AAs?$AA?$AA@
0x1C000A254: BampGetThrottledProcessExemptionState
0x1C0007248: "__cdecl _imp_RtlLengthSecurityDescriptor" __imp_RtlLengthSecurityDescriptor
0x1C00010E0: BampGetThrottleStateCallback
0x1C0002540: "SD" ??_C@_15NAFBOLGP@?$AAS?$AAD?$AA?$AA@
0x1C000F8E4: CmRegUtilUcValueSetUcString
0x1C00010C0: BampSetThrottleStateCallback
0x1C000E660: SeSddlSecurityDescriptorFromSDDL
0x1C0009B68: BampEnumerateThrottledProcesses
0x1C0007270: "__cdecl _imp_RtlGetGroupSecurityDescriptor" __imp_RtlGetGroupSecurityDescriptor
0x1C00026C0: "\Registry\Machine\System\Current" ??_C@_1HC@DKINPPAJ@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1C000FA28: CmRegUtilOpenExistingWstrKey
0x1C00023B0: "ScreenOnExemptions" ??_C@_1CG@MCNIIJFD@?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AAO?$AAn?$AAE?$AAx?$AAe?$AAm?$AAp?$AAt?$AAi?$AAo?$AAn?$AAs?$AA?$AA@
0x1C000F1EC: PiRegStateReadStackCreationSettingsFromKey
0x1C000F3BC: PiRegStateOpenClassKey
0x1C00023F0: "WIN://SYSAPPID" ??_C@_1BO@BOGEHPME@?$AAW?$AAI?$AAN?$AA?3?$AA?1?$AA?1?$AAS?$AAY?$AAS?$AAA?$AAP?$AAP?$AAI?$AAD?$AA?$AA@
0x1C0001394: WdmlibRtlInitUnicodeStringEx
0x1C0002640: "Security" ??_C@_1BC@FCJNIDNL@?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?$AA@
0x1C00024D0: SDDL_DEVOBJ_SYS_ALL_ADM_RWX_WORLD_R_buffer
0x1C00101B0: GsDriverEntry
0x1C0007288: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x1C0005068: BampNonExemptImageExemptionsValueName
0x1C0007138: "__cdecl _imp_KeQueryUnbiasedInterruptTime" __imp_KeQueryUnbiasedInterruptTime
0x1C000F040: PpRegStateReadCreateClassCreationSettings
0x1C000E130: BamUserSettingsCheckOrigin
0x1C00054D0: BampSessionGuid
0x1C000E980: SepSddlGetSidForString
0x1C0002440: "SequenceNumber" ??_C@_1BO@KODFFLBH@?$AAS?$AAe?$AAq?$AAu?$AAe?$AAn?$AAc?$AAe?$AAN?$AAu?$AAm?$AAb?$AAe?$AAr?$AA?$AA@
0x1C0002658: "DeviceType" ??_C@_1BG@KCOOGCNN@?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x1C0002240: "TimerCoalesceMs" ??_C@_1CA@KOPHNIFP@?$AAT?$AAi?$AAm?$AAe?$AAr?$AAC?$AAo?$AAa?$AAl?$AAe?$AAs?$AAc?$AAe?$AAM?$AAs?$AA?$AA@
0x1C0007030: "__cdecl _imp_ExRegisterExtension" __imp_ExRegisterExtension
0x1C00010B0: "__cdecl TlgDefineProvider_annotation__TlgBampTraceLoggingHandleProv" _TlgDefineProvider_annotation__TlgBampTraceLoggingHandleProv
0x1C0002740: "{%08X-%04X-%04X-%02X%02X-%02X%02" ??_C@_1GG@FCALANDO@?$AA?$HL?$AA?$CF?$AA0?$AA8?$AAX?$AA?9?$AA?$CF?$AA0?$AA4?$AAX?$AA?9?$AA?$CF?$AA0?$AA4?$AAX?$AA?9?$AA?$CF?$AA0?$AA2?$AAX?$AA?$CF?$AA0?$AA2?$AAX?$AA?9?$AA?$CF?$AA0?$AA2?$AAX?$AA?$CF?$AA0?$AA2@
0x1C0007100: PsProcessType
0x1C00050C8: BampDebounceIntervalValueName
0x1C0007130: "__cdecl _imp_ZwQueryValueKey" __imp_ZwQueryValueKey
0x1C0002180: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x1C0008010: "__cdecl TlgEnableCallback" _TlgEnableCallback
0x1C0002548: "GA" ??_C@_15HPMIFLNA@?$AAG?$AAA?$AA?$AA@
0x1C00092C0: BampStartThrottledProcessInformation
0x1C0007150: "__cdecl _imp_RtlCompareUnicodeString" __imp_RtlCompareUnicodeString
0x1C00013F0: "__cdecl _security_check_cookie" __security_check_cookie
0x1C00071B8: "__cdecl _imp_ZwQueryKey" __imp_ZwQueryKey
0x1C00071D0: "__cdecl _imp_ZwQueryVolumeInformationFile" __imp_ZwQueryVolumeInformationFile
0x1C0007298: "__cdecl _IMPORT_DESCRIPTOR_ntoskrnl" __IMPORT_DESCRIPTOR_ntoskrnl
0x1C000C820: BampThrottlingSetProcessThrottleState
0x1C000369C: "__cdecl TraceLoggingMetadataEnd" _TraceLoggingMetadataEnd
0x1C0002378: "ImagePolicy" ??_C@_1BI@HHKKFKKB@?$AAI?$AAm?$AAa?$AAg?$AAe?$AAP?$AAo?$AAl?$AAi?$AAc?$AAy?$AA?$AA@
0x1C000A4C0: BampThrottledProcessWakeNotificationCallback
0x1C0007148: "__cdecl _imp_ObReferenceObjectByHandleWithTag" __imp_ObReferenceObjectByHandleWithTag
0x1C000DA6C: BamUserSettingsGetHandleForUser
0x1C0005128: BampUserSettingsVersionValueName
0x1C000859C: BampThrottlingInitializeModule
0x1C0009144: BampInitializeThrottledProcessInformation
0x1C0002570: "SeConvertStringSecurityDescripto" ??_C@_1GM@JINLDKKK@?$AAS?$AAe?$AAC?$AAo?$AAn?$AAv?$AAe?$AAr?$AAt?$AAS?$AAt?$AAr?$AAi?$AAn?$AAg?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AAD?$AAe?$AAs?$AAc?$AAr?$AAi?$AAp?$AAt?$AAo@
0x1C000C1C8: BampRecheckGlobalThrottlingSettings
0x1C000A048: BampComputeThrottledProcessPolicy
0x1C0002010: BampEmptyString
0x1C0002390: "ImageExemptions" ??_C@_1CA@DGMIFPEN@?$AAI?$AAm?$AAa?$AAg?$AAe?$AAE?$AAx?$AAe?$AAm?$AAp?$AAt?$AAi?$AAo?$AAn?$AAs?$AA?$AA@
0x1C0007168: "__cdecl _imp_SeQuerySecurityAttributesToken" __imp_SeQuerySecurityAttributesToken
0x1C0007008: "__cdecl _imp_EtwUnregister" __imp_EtwUnregister
0x1C0008E88: BampThrottlingProcessRemoveFromTree
0x1C0011000: "__cdecl _guard_fids_table" __guard_fids_table
0x1C00071F8: "__cdecl _imp_ZwSetSecurityObject" __imp_ZwSetSecurityObject
0x1C000ABA4: BampQueueThrottledProcessActionItem
0x1C0002030: "__cdecl load_config_used" _load_config_used
0x1C0007108: "__cdecl _imp_ZwQueryInformationProcess" __imp_ZwQueryInformationProcess
0x1C00025E0: "Properties" ??_C@_1BG@COALCEMK@?$AAP?$AAr?$AAo?$AAp?$AAe?$AAr?$AAt?$AAi?$AAe?$AAs?$AA?$AA@
0x1C0008270: BampOnSetLoaderDetour
0x1C00070F0: "__cdecl _imp_ZwClose" __imp_ZwClose
0x1C00070A8: "__cdecl _imp_ExReleasePushLockExclusiveEx" __imp_ExReleasePushLockExclusiveEx
0x1C0005368: BamDeviceObject
0x1C00011C0: BampSetUserSettings
0x1C000C98C: BampThrottlingGetProcessThrottleState
0x1C0007120: "__cdecl _imp_ExSubscribeWnfStateChange" __imp_ExSubscribeWnfStateChange
0x1C000EE3C: SepSddlAddAceToAcl
0x1C000FAA4: CmRegUtilCreateWstrKey
0x1C0007048: "__cdecl _imp_IoThreadToProcess" __imp_IoThreadToProcess
0x1C00084A4: BampReleaseThrottledProcessLock
0x1C00070C8: "__cdecl _imp_KeInitializeEvent" __imp_KeInitializeEvent
0x1C00070F8: "__cdecl _imp_ObOpenObjectByPointer" __imp_ObOpenObjectByPointer
0x1C00070B0: "__cdecl _imp_ExTryAcquirePushLockExclusiveEx" __imp_ExTryAcquirePushLockExclusiveEx
0x1C000868C: BampThrottlingStartModule
0x1C0007260: "__cdecl _imp_RtlGetSaclSecurityDescriptor" __imp_RtlGetSaclSecurityDescriptor
0x1C0002608: "NoDisplayClass" ??_C@_1BO@DAOBINHA@?$AAN?$AAo?$AAD?$AAi?$AAs?$AAp?$AAl?$AAa?$AAy?$AAC?$AAl?$AAa?$AAs?$AAs?$AA?$AA@
0x1C0002020: SDDL_DEVOBJ_SYS_ALL_ADM_RWX_WORLD_R
0x1C00071D8: "__cdecl _imp_RtlGetDaclSecurityDescriptor" __imp_RtlGetDaclSecurityDescriptor
0x1C000F54C: PpRegStateUpdateStackCreationSettings
0x1C0007208: "__cdecl _imp_IoIsWdmVersionAvailable" __imp_IoIsWdmVersionAvailable
0x1C0002670: "DeviceCharacteristics" ??_C@_1CM@DIJFBEC@?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAC?$AAh?$AAa?$AAr?$AAa?$AAc?$AAt?$AAe?$AAr?$AAi?$AAs?$AAt?$AAi?$AAc?$AAs?$AA?$AA@
0x1C0005330: PiRegStateSysAllInherittedSecurityDescriptor
0x1C0005380: WdmlibInitialized
0x1C0008170: BampRegisterKernelExtension
0x1C0005550: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUyzxptilfmwUyznUhbhUlyquivUznwGEUhgwzucOlyq@bam" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUyzxptilfmwUyznUhbhUlyquivUznwGEUhgwzucOlyq@bam
0x1C0001430: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x1C000E2F0: WdmlibIoCreateDeviceSecure
0x1C00023D8: "EnableBAM" ??_C@_1BE@DGHAOLDE@?$AAE?$AAn?$AAa?$AAb?$AAl?$AAe?$AAB?$AAA?$AAM?$AA?$AA@
0x1C0007058: "__cdecl _imp_PsReferencePrimaryToken" __imp_PsReferencePrimaryToken
0x1C0007038: "__cdecl _imp_PsGetCurrentProcess" __imp_PsGetCurrentProcess
0x1C00025F8: "Class" ??_C@_1M@OAHBGIFG@?$AAC?$AAl?$AAa?$AAs?$AAs?$AA?$AA@
0x1C0005058: BampScreenOnExemptionValueName
0x1C000D878: BamUserSettingsGet
0x1C0009060: BampThrottlingOnProcessTerminated
0x1C0005500: BampKernelInterface
0x1C0007100: "__cdecl _imp_PsProcessType" __imp_PsProcessType
0x1C0002328: "UserSettingsLifetimeMs" ??_C@_1CO@EJJCBLAI@?$AAU?$AAs?$AAe?$AAr?$AAS?$AAe?$AAt?$AAt?$AAi?$AAn?$AAg?$AAs?$AAL?$AAi?$AAf?$AAe?$AAt?$AAi?$AAm?$AAe?$AAM?$AAs?$AA?$AA@
0x1C0007198: "__cdecl _imp_ZwDeleteKey" __imp_ZwDeleteKey
0x1C0005078: BampNonExemptImagePolicyValueName
0x1C0008240: BampCreateProcessCallback
0x1C00051D0: "__cdecl _security_cookie" __security_cookie
0x1C0005108: BampPolicyKeyName
0x1C000D578: BamUserSettingsAddOrUpdate
0x1C000D3E0: BampInitializeUsersCallback
0x1C00026A0: "Exclusive" ??_C@_1BE@DJHAJDEM@?$AAE?$AAx?$AAc?$AAl?$AAu?$AAs?$AAi?$AAv?$AAe?$AA?$AA@
0x1C0002358: "GlobalPolicy" ??_C@_1BK@CDJFABKF@?$AAG?$AAl?$AAo?$AAb?$AAa?$AAl?$AAP?$AAo?$AAl?$AAi?$AAc?$AAy?$AA?$AA@
0x1C0007118: "__cdecl _imp_ExUnsubscribeWnfStateChange" __imp_ExUnsubscribeWnfStateChange
0x1C0008110: BampTracingControlCallback
0x1C000F7A0: CmRegUtilUcValueGetFullBuffer
0x1C0002628: "NoUseClass" ??_C@_1BG@OPOOGLJC@?$AAN?$AAo?$AAU?$AAs?$AAe?$AAC?$AAl?$AAa?$AAs?$AAs?$AA?$AA@
0x1C0007178: "__cdecl _imp_ZwQueryFullAttributesFile" __imp_ZwQueryFullAttributesFile
0x1C00012A0: BampIsProcessModern
0x1C00101E4: "__cdecl _security_init_cookie" __security_init_cookie
0x1C0008B04: BampThrottlingRegisterProcessEx
0x1C000AE60: BampQueuePolicyActionItemAfterStateChange
0x1C0007010: "__cdecl _imp_EtwRegister" __imp_EtwRegister
0x1C00054A0: BampGlobalThrottlingSettings
0x1C0002288: "DebounceIntervalMs" ??_C@_1CG@HONCGOLA@?$AAD?$AAe?$AAb?$AAo?$AAu?$AAn?$AAc?$AAe?$AAI?$AAn?$AAt?$AAe?$AAr?$AAv?$AAa?$AAl?$AAM?$AAs?$AA?$AA@
0x1C00070E0: "__cdecl _imp_KeSetEvent" __imp_KeSetEvent
0x1C0002168: "\Device\Bam" ??_C@_1BI@INPEMIHK@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAB?$AAa?$AAm?$AA?$AA@
0x1C00053C0: BampThrottlingWorkerState
0x1C000DEA8: BamUserSettingsTouch
0x1C000F6B8: SeUtilSecurityInfoFromSecurityDescriptor
0x1C00071F0: IoDeviceObjectType
0x1C0005048: BampEnableBAMValueName
0x1C0007090: "__cdecl _imp_ExAcquirePushLockExclusiveEx" __imp_ExAcquirePushLockExclusiveEx
0x1C0002558: "GW" ??_C@_15KLKFDJD@?$AAG?$AAW?$AA?$AA@
0x1C0007210: "__cdecl _imp_RtlLengthSid" __imp_RtlLengthSid
0x1C0002140: "\Device\Harddisk" ??_C@_1CC@PFKCPBG@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAH?$AAa?$AAr?$AAd?$AAd?$AAi?$AAs?$AAk?$AA?$AA@
0x1C0001420: "__cdecl _report_gsfailure" __report_gsfailure
0x1C000857C: BampFreeForHashTable
0x1C0007060: "__cdecl _imp_PsQueryProcessAttributesByToken" __imp_PsQueryProcessAttributesByToken
0x1C0007190: "__cdecl _imp_ZwCreateKey" __imp_ZwCreateKey
0x1C00050D8: BampTelemetryIntervalValueName
0x1C0007280: ntoskrnl_NULL_THUNK_DATA
0x1C00070C0: "__cdecl _imp_ExFreePoolWithTag" __imp_ExFreePoolWithTag
0x1C0007080: "__cdecl _imp_KeEnterCriticalRegion" __imp_KeEnterCriticalRegion
0x1C000CB6C: BampThrottlingSetUserSettings
0x1C0007200: "__cdecl _imp_RtlSetDaclSecurityDescriptor" __imp_RtlSetDaclSecurityDescriptor
0x1C0010008: DriverEntry
0x1C000D808: BamUserSettingsRemove
0x1C0008090: BamDriverUnload
0x1C00053A0: BampThrottlingLock
0x1C0007128: "__cdecl _imp_ZwOpenKey" __imp_ZwOpenKey
0x1C0008464: BampAcquireThrottledProcessLock
0x1C0001840: memset
0x1C00072AC: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x1C000CA30: BampThrottlingSetUserSettingsProcessInfo

[JEB Decompiler by PNF Software]