Generated by JEB on 2019/08/01

PE: C:\Windows\System32\drivers\appid.sys Base=0x1C0000000 SHA-256=A429C17B887AA6921D71E835400DF56FB7604E106ECAB1E0D7BB82B2CEE0B700
PDB: appid.pdb GUID={F1E63980-E5EE-5179-1F1151044FADD636} Age=1

828 located named symbols:
0x1C002061C: SrpFreeGlobalPolicy
0x1C0009DD0: "\??\UNC\" ??_C@_1BC@MAMPPFNN@?$AA?2?$AA?$DP?$AA?$DP?$AA?2?$AAU?$AAN?$AAC?$AA?2?$AA?$AA@
0x1C0017000: "__cdecl _imp_CiFreePolicyInfo" __imp_CiFreePolicyInfo
0x1C0029738: AiSetTokenAttributes
0x1C0001120: WppClassicProviderCallback
0x1C000B0D8: "UserOwned" ??_C@_1BE@BKBHCLFJ@?$AAU?$AAs?$AAe?$AAr?$AAO?$AAw?$AAn?$AAe?$AAd?$AA?$AA@
0x1C0009298: "AppLocker" ??_C@_1BE@KJGPLILG@?$AAA?$AAp?$AAp?$AAL?$AAo?$AAc?$AAk?$AAe?$AAr?$AA?$AA@
0x1C0017580: "__cdecl _imp_ZwWriteFile" __imp_ZwWriteFile
0x1C0017508: "__cdecl _imp_ZwSetInformationThread" __imp_ZwSetInformationThread
0x1C001CD64: SmartlockerRegistryDisableOverrideIsSet
0x1C0012CB0: "MICROSOFTEDPAUTOPROTECTIONALLOWE" ??_C@_1FC@OECLGAFJ@?$AAM?$AAI?$AAC?$AAR?$AAO?$AAS?$AAO?$AAF?$AAT?$AAE?$AAD?$AAP?$AAA?$AAU?$AAT?$AAO?$AAP?$AAR?$AAO?$AAT?$AAE?$AAC?$AAT?$AAI?$AAO?$AAN?$AAA?$AAL?$AAL?$AAO?$AAW?$AAE@
0x1C0017408: "__cdecl _imp_KeExpandKernelStackAndCalloutEx" __imp_KeExpandKernelStackAndCalloutEx
0x1C00174E8: "__cdecl _imp_SeCaptureSubjectContext" __imp_SeCaptureSubjectContext
0x1C0017148: "__cdecl _imp_FsRtlQueryKernelEaFile" __imp_FsRtlQueryKernelEaFile
0x1C0001D08: AiGetPublisherCache
0x1C0002314: AiRegReadBinaryValue
0x1C002F984: SrppMapFileImage
0x1C002D970: EdpIoctlCallback
0x1C0017270: "__cdecl _imp_RtlFreeUnicodeString" __imp_RtlFreeUnicodeString
0x1C0008270: "EnableSha256FlatHash" ??_C@_1CK@CBFMEPFJ@?$AAE?$AAn?$AAa?$AAb?$AAl?$AAe?$AAS?$AAh?$AAa?$AA2?$AA5?$AA6?$AAF?$AAl?$AAa?$AAt?$AAH?$AAa?$AAs?$AAh?$AA?$AA@
0x1C00171F0: "__cdecl _imp_RtlQueryPackageClaims" __imp_RtlQueryPackageClaims
0x1C00018A4: "long __cdecl RtlStringCbPrintfW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64,...)" ?RtlStringCbPrintfW@@YAJPEAG_KPEBGZZ
0x1C002EB68: EdppComposeFullPath
0x1C00255D4: AiSmartHashImageFile
0x1C0015188: "__cdecl _security_cookie_complement" __security_cookie_complement
0x1C001A270: WppTraceCallback
0x1C00153F0: EdppShuttingDown
0x1C000AF50: "Permissive" ??_C@_1BG@LOFAHIAF@?$AAP?$AAe?$AAr?$AAm?$AAi?$AAs?$AAs?$AAi?$AAv?$AAe?$AA?$AA@
0x1C00039B0: SrpDeleteEdpAttributeString
0x1C0017120: "__cdecl _imp_ObfDereferenceObject" __imp_ObfDereferenceObject
0x1C0017150: "__cdecl _imp__stricmp" __imp__stricmp
0x1C0017380: "__cdecl _imp_ZwNotifyChangeDirectoryFile" __imp_ZwNotifyChangeDirectoryFile
0x1C0021E1C: AiLogAppxSrpRuleEvent
0x1C001E964: SrpOpenTrackInstallIoctl
0x1C0003DD0: EnterpriseContextLibMemAllocPaged
0x1C00172A8: "__cdecl _imp_ZwReadFile" __imp_ZwReadFile
0x1C001D268: SmartlockerOriginClaimProcessTokenCheck
0x1C0009A80: "Exe" ??_C@_17BACJGEIC@?$AAE?$AAx?$AAe?$AA?$AA@
0x1C000AE48: WNF_ENTR_EVALUATE_EDP_CONFIGURATION_STATE
0x1C00170B8: "__cdecl _imp_RpcAsyncCompleteCall" __imp_RpcAsyncCompleteCall
0x1C0009A68: "Dll" ??_C@_17DJMMGLBL@?$AAD?$AAl?$AAl?$AA?$AA@
0x1C002C7BC: EdpInitPluginRuntimeConfig
0x1C002A11C: AppHashInitialize
0x1C0017658: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x1C000A658: "OriginalFileName" ??_C@_1CC@GIEPEENO@?$AAO?$AAr?$AAi?$AAg?$AAi?$AAn?$AAa?$AAl?$AAF?$AAi?$AAl?$AAe?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x1C00306A0: SrpInitialize
0x1C0009878: "TrustedOriginDataId" ??_C@_1CI@BHAEDDBG@?$AAT?$AAr?$AAu?$AAs?$AAt?$AAe?$AAd?$AAO?$AAr?$AAi?$AAg?$AAi?$AAn?$AAD?$AAa?$AAt?$AAa?$AAI?$AAd?$AA?$AA@
0x1C0012D08: "AUTOPROTECTIONALLOWEDAPPINFOID" ??_C@_1DO@DJCGALL@?$AAA?$AAU?$AAT?$AAO?$AAP?$AAR?$AAO?$AAT?$AAE?$AAC?$AAT?$AAI?$AAO?$AAN?$AAA?$AAL?$AAL?$AAO?$AAW?$AAE?$AAD?$AAA?$AAP?$AAP?$AAI?$AAN?$AAF?$AAO?$AAI?$AAD?$AA?$AA@
0x1C0005E50: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x1C0021990: SrpGetPluginFileName
0x1C00173D0: "__cdecl _imp_RtlGetNextEntryHashTable" __imp_RtlGetNextEntryHashTable
0x1C0003BF8: SrpGetPolicyFlags
0x1C00173E0: "__cdecl _imp_RtlInsertEntryHashTable" __imp_RtlInsertEntryHashTable
0x1C002DE58: EdppServiceExempt
0x1C0017308: "__cdecl _imp_PsLookupProcessByProcessId" __imp_PsLookupProcessByProcessId
0x1C0009790: "$Kernel.Smartlocker.OriginClaim" ??_C@_0CA@NIOIDHGE@$Kernel?4Smartlocker?4OriginClaim?$AA@
0x1C002E370: WdagPluginNotifyRoutine
0x1C0017028: "__cdecl _imp_FltGetFileNameInformationUnsafe" __imp_FltGetFileNameInformationUnsafe
0x1C0009700: "SMARTLOCKER://ORIGINCLAIM" ??_C@_1DE@EPPICNLN@?$AAS?$AAM?$AAA?$AAR?$AAT?$AAL?$AAO?$AAC?$AAK?$AAE?$AAR?$AA?3?$AA?1?$AA?1?$AAO?$AAR?$AAI?$AAG?$AAI?$AAN?$AAC?$AAL?$AAA?$AAI?$AAM?$AA?$AA@
0x1C0012DA8: "__cdecl TraceLoggingMetadata" _TraceLoggingMetadata
0x1C00272F4: AipExpandPathMacros
0x1C0017328: "__cdecl _imp_ZwOpenProcess" __imp_ZwOpenProcess
0x1C0029260: AiRegReadStringValue
0x1C000291C: ClientAppIDRpcVerifyPackageMoniker
0x1C0017548: "__cdecl _imp_PsIsProtectedProcess" __imp_PsIsProtectedProcess
0x1C0017398: "__cdecl _imp_SeAccessCheck" __imp_SeAccessCheck
0x1C0017450: "__cdecl _imp_ZwEnumerateKey" __imp_ZwEnumerateKey
0x1C0015394: AipServiceContextInitialized
0x1C00083E0: WPP_7da7167e08a8365beaf6718aefed20d9_Traceguids
0x1C00170C8: "__cdecl _imp_RpcAsyncCancelCall" __imp_RpcAsyncCancelCall
0x1C00175A0: "__cdecl _imp_IoCreateDevice" __imp_IoCreateDevice
0x1C0017528: "__cdecl _imp_ZwUpdateWnfStateData" __imp_ZwUpdateWnfStateData
0x1C000AA90: cpuidBitInfo
0x1C0012B00: "TSA://ProcUnique" ??_C@_1CC@DJOPDNMF@?$AAT?$AAS?$AAA?$AA?3?$AA?1?$AA?1?$AAP?$AAr?$AAo?$AAc?$AAU?$AAn?$AAi?$AAq?$AAu?$AAe?$AA?$AA@
0x1C0009838: "APPID://PATH" ??_C@_1BK@FENJIPJD@?$AAA?$AAP?$AAP?$AAI?$AAD?$AA?3?$AA?1?$AA?1?$AAP?$AAA?$AAT?$AAH?$AA?$AA@
0x1C0001F94: RtlStringCbPrintfA
0x1C002D0E0: EdppImpersonateProcess
0x1C000137C: SrppGetPluginPolicy
0x1C0008158: "WmiTraceMessage" ??_C@_1CA@OFIBBPKJ@?$AAW?$AAm?$AAi?$AAT?$AAr?$AAa?$AAc?$AAe?$AAM?$AAe?$AAs?$AAs?$AAa?$AAg?$AAe?$AA?$AA@
0x1C00151E8: SrpReplaceOperations
0x1C001539C: AipPathMacroListInitialized
0x1C0009740: "SMARTLOCKER://SMARTSCREENORIGINC" ??_C@_1EK@CPMNILBM@?$AAS?$AAM?$AAA?$AAR?$AAT?$AAL?$AAO?$AAC?$AAK?$AAE?$AAR?$AA?3?$AA?1?$AA?1?$AAS?$AAM?$AAA?$AAR?$AAT?$AAS?$AAC?$AAR?$AAE?$AAE?$AAN?$AAO?$AAR?$AAI?$AAG?$AAI?$AAN?$AAC@
0x1C00175E8: "__cdecl _imp_IofCompleteRequest" __imp_IofCompleteRequest
0x1C001CDCC: SmartlockerTagProcessToken
0x1C0017620: "__cdecl _imp_ExEnterCriticalRegionAndAcquireResourceExclusive" __imp_ExEnterCriticalRegionAndAcquireResourceExclusive
0x1C0021BF4: AiLogStatusEvent
0x1C00304EC: AipInitializeGlobals
0x1C0003CDC: SrpIsEnterpriseAllowedInternal
0x1C0017418: "__cdecl _imp_RtlCreateSecurityDescriptor" __imp_RtlCreateSecurityDescriptor
0x1C0017618: "__cdecl _imp_ExReleaseResourceAndLeaveCriticalRegion" __imp_ExReleaseResourceAndLeaveCriticalRegion
0x1C002CA8C: EdppIsCurrentContextAllowed
0x1C0002CF0: SymCryptDetectCpuFeaturesByCpuid
0x1C0002CC0: SymCryptFatalEnvWindowsKernelmodeWin8_1nLater
0x1C00176D4: "__cdecl _IMPORT_DESCRIPTOR_HAL" __IMPORT_DESCRIPTOR_HAL
0x1C00175C0: "__cdecl _imp_ExEnterCriticalRegionAndAcquireResourceShared" __imp_ExEnterCriticalRegionAndAcquireResourceShared
0x1C00297D8: AiQueryTokenAttributes
0x1C002E700: SrpGetExemptEnterpriseIdsPresent
0x1C0017008: "__cdecl _imp_CiValidateFileObject" __imp_CiValidateFileObject
0x1C000A630: AppHashSupportedAttributes
0x1C00093F8: "MANAGEDINSTALLER" ??_C@_1CC@LKAGOEJM@?$AAM?$AAA?$AAN?$AAA?$AAG?$AAE?$AAD?$AAI?$AAN?$AAS?$AAT?$AAA?$AAL?$AAL?$AAE?$AAR?$AA?$AA@
0x1C0007C40: EdppPersonalName
0x1C00097F0: "APPID://SHA256HASH" ??_C@_1CG@DLCLGHKD@?$AAA?$AAP?$AAP?$AAI?$AAD?$AA?3?$AA?1?$AA?1?$AAS?$AAH?$AAA?$AA2?$AA5?$AA6?$AAH?$AAA?$AAS?$AAH?$AA?$AA@
0x1C0001008: "__cdecl TlgWrite" _TlgWrite
0x1C0017340: "__cdecl _imp_RtlGetNtSystemRoot" __imp_RtlGetNtSystemRoot
0x1C0001218: WPP_SF_qDDZcZ
0x1C0012B50: "PEDP://InhProcUnique" ??_C@_1CK@OMEOEEMB@?$AAP?$AAE?$AAD?$AAP?$AA?3?$AA?1?$AA?1?$AAI?$AAn?$AAh?$AAP?$AAr?$AAo?$AAc?$AAU?$AAn?$AAi?$AAq?$AAu?$AAe?$AA?$AA@
0x1C0017690: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x1C000A168: WPP_e80ce1ccbd993703ccc96778ef2f1d43_Traceguids
0x1C0012AEC: "." ??_C@_13JOFGPIOO@?$AA?4?$AA?$AA@
0x1C002C090: EdpPluginNotifyRoutine
0x1C002B660: AiConvertToTokenAttributes
0x1C0009D18: "Plugin.*.Policy" ??_C@_1CA@PCMKHNCB@?$AAP?$AAl?$AAu?$AAg?$AAi?$AAn?$AA?4?$AA?$CK?$AA?4?$AAP?$AAo?$AAl?$AAi?$AAc?$AAy?$AA?$AA@
0x1C001FCC8: SrpReadPolicy
0x1C0008128: AppIdSmartlockerEnforcementStatusAudit
0x1C0023CCC: AiReloadCertificate
0x1C0024330: AiSigningLevelCacheExists
0x1C0030010: AipInitializePluginsCallback
0x1C0017678: "__cdecl _imp_MmUnmapViewOfSection" __imp_MmUnmapViewOfSection
0x1C0022D58: AiFreeLib
0x1C00201CC: SrppAccessCheck
0x1C001AC84: AipTransactionBegin
0x1C0008028: SrpPolicyLoadStart
0x1C0017460: "__cdecl _imp_FsRtlSetKernelEaFile" __imp_FsRtlSetKernelEaFile
0x1C00172D0: "__cdecl _imp_ExAcquirePushLockSharedEx" __imp_ExAcquirePushLockSharedEx
0x1C00042A0: DeleteAttributes
0x1C00175F8: "__cdecl _imp_MmGetSystemRoutineAddress" __imp_MmGetSystemRoutineAddress
0x1C000A698: "\VarFileInfo\Translation" ??_C@_1DC@HCLBMGIA@?$AA?2?$AAV?$AAa?$AAr?$AAF?$AAi?$AAl?$AAe?$AAI?$AAn?$AAf?$AAo?$AA?2?$AAT?$AAr?$AAa?$AAn?$AAs?$AAl?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x1C0009318: "WPC Plugin" ??_C@_1BG@PHKDBHFN@?$AAW?$AAP?$AAC?$AA?5?$AAP?$AAl?$AAu?$AAg?$AAi?$AAn?$AA?$AA@
0x1C0009EF0: "\Registry\Machine\System\Current" ??_C@_1II@IAOOMNEI@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1C000A6D0: "\StringFileInfo\%04x%04x\" ??_C@_1DE@JAJGJDNB@?$AA?2?$AAS?$AAt?$AAr?$AAi?$AAn?$AAg?$AAF?$AAi?$AAl?$AAe?$AAI?$AAn?$AAf?$AAo?$AA?2?$AA?$CF?$AA0?$AA4?$AAx?$AA?$CF?$AA0?$AA4?$AAx?$AA?2?$AA?$AA@
0x1C00269A8: AiInitializeSoftwarePathMacroList
0x1C0017540: "__cdecl _imp_wcsstr" __imp_wcsstr
0x1C0015390: AiEnablePublisherId
0x1C0012A70: EdpAuditProviderTcb
0x1C001BA78: AiRemoveProcFromTracking
0x1C0017348: "__cdecl _imp_ZwCreateEvent" __imp_ZwCreateEvent
0x1C0015460: EdppSingleInstanceAttributes
0x1C0017330: "__cdecl _imp_ZwQueryInformationToken" __imp_ZwQueryInformationToken
0x1C00095E0: "\??\SrpDevice" ??_C@_1BM@HJILLEBC@?$AA?2?$AA?$DP?$AA?$DP?$AA?2?$AAS?$AAr?$AAp?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?$AA@
0x1C002075C: SrpGetPolicy
0x1C0017078: "__cdecl _imp_BCryptCreateHash" __imp_BCryptCreateHash
0x1C0022FF0: AiFree
0x1C000A060: "$KERNEL.PURGE.APPID.SIGNERINFO" ??_C@_0BP@MIGNOLCM@$KERNEL?4PURGE?4APPID?4SIGNERINFO?$AA@
0x1C00174A0: "__cdecl _imp_KeWaitForSingleObject" __imp_KeWaitForSingleObject
0x1C0017538: "__cdecl _imp_RtlAppendUnicodeStringToString" __imp_RtlAppendUnicodeStringToString
0x1C0017240: "__cdecl _imp_ZwWaitForSingleObject" __imp_ZwWaitForSingleObject
0x1C0001B94: WPP_SF_ZDD
0x1C001C0B0: AiProcessNotifyRoutine
0x1C002B830: AiRpcDisconnect
0x1C002AD34: AipGetPeImageVersionInfo
0x1C0002E44: EdppIsAppxBroker
0x1C00293F4: AiRegReadDwordValue
0x1C0017598: "__cdecl _imp_ObSetSecurityObjectByPointer" __imp_ObSetSecurityObjectByPointer
0x1C0023014: AiReadFile
0x1C001AB80: AipCleanupDispatch
0x1C0009BF0: "\SystemRoot\System32\AppLocker\{" ??_C@_1LG@HGKEAMDK@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAo?$AAo?$AAt?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAA?$AAp?$AAp?$AAL?$AAo?$AAc?$AAk?$AAe?$AAr?$AA?2?$AA?$HL@
0x1C0015408: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUzkknlwvoUpzkkcUoryUlyquivUznwGEUkxsOlyq@KAppxLib" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUzkknlwvoUpzkkcUoryUlyquivUznwGEUkxsOlyq@KAppxLib
0x1C00205C8: SrpServiceBypass
0x1C002B8E8: AipCompleteRpc
0x1C0004BD8: CopyEnterpriseId
0x1C0005E80: memcpy
0x1C00257DC: AipAddHashAttribute
0x1C0026FD8: AipConvertToNtPath
0x1C0001CF4: AipCertDeleteRoutine
0x1C002142C: SrpFreePlugin
0x1C0015600: g_Srp
0x1C0017048: "__cdecl _imp_NikEdpNotifyProcessTokenChange0" __imp_NikEdpNotifyProcessTokenChange0
0x1C0017128: "__cdecl _imp_SeSetSecurityAttributesToken" __imp_SeSetSecurityAttributesToken
0x1C001C3E0: AipInitRunOnce
0x1C00095B8: "\Device\SrpDevice" ??_C@_1CE@KLMMFFPN@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAS?$AAr?$AAp?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?$AA@
0x1C0021494: SrpDisplayAccessReason
0x1C00173B0: "__cdecl _imp_RtlRemoveEntryHashTable" __imp_RtlRemoveEntryHashTable
0x1C0017250: "__cdecl _imp_PsSetCreateProcessNotifyRoutineEx" __imp_PsSetCreateProcessNotifyRoutineEx
0x1C0009420: "\SystemRoot\System32\AppLocker\E" ??_C@_1FK@BELANAJI@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAo?$AAo?$AAt?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAA?$AAp?$AAp?$AAL?$AAo?$AAc?$AAk?$AAe?$AAr?$AA?2?$AAE@
0x1C0017448: "__cdecl _imp_ZwSetValueKey" __imp_ZwSetValueKey
0x1C0009630: "\REGISTRY\MACHINE\System\Current" ??_C@_1KG@JIFPMPIC@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1C0015500: AipServiceContext
0x1C002968C: AiSetCacheEaFile
0x1C0017630: "__cdecl _imp_IoDeleteDevice" __imp_IoDeleteDevice
0x1C0015210: pfnWppGetVersion
0x1C000AEC8: "ExeExempt" ??_C@_1BE@HHKFAGM@?$AAE?$AAx?$AAe?$AAE?$AAx?$AAe?$AAm?$AAp?$AAt?$AA?$AA@
0x1C0008108: AppIdServiceTriggerEventProviderId
0x1C0024948: AipAllocateImageContext
0x1C002EE00: EdppDeleteLogFile
0x1C0005C16: "__cdecl _C_specific_handler" __C_specific_handler
0x1C0024BDC: AipCollectImageProperties
0x1C0003C70: SrpGetEvaluationFlagsToken
0x1C001AB20: AipCloseDispatch
0x1C0022FF0: MIDL_user_free
0x1C0017158: "__cdecl _imp_SeCompareSigningLevels" __imp_SeCompareSigningLevels
0x1C00170E0: "__cdecl _imp_RpcBindingUnbind" __imp_RpcBindingUnbind
0x1C0028004: AipkRemoveEntryFromAppxCache
0x1C0024A84: AipFreeImageContext
0x1C0004C4C: InitSubjectByTokenHandle
0x1C0005E80: memmove
0x1C0029500: AiRegWriteDwordValue
0x1C00080C8: SrpPolicyLoadFailure
0x1C0029974: AiQueryLogonId
0x1C002A774: AppHashHashBytes
0x1C0009DE4: "\\" ??_C@_15LEKKCGMK@?$AA?2?$AA?2?$AA?$AA@
0x1C0009858: "\%u.%u.%u.%u" ??_C@_1BK@JJIKBIOE@?$AA?2?$AA?$CF?$AAu?$AA?4?$AA?$CF?$AAu?$AA?4?$AA?$CF?$AAu?$AA?4?$AA?$CF?$AAu?$AA?$AA@
0x1C0009DA0: "\%u.%u.%u.%02u" ??_C@_1BO@HHLJEFAH@?$AA?2?$AA?$CF?$AAu?$AA?4?$AA?$CF?$AAu?$AA?4?$AA?$CF?$AAu?$AA?4?$AA?$CF?$AA0?$AA2?$AAu?$AA?$AA@
0x1C001AE20: AipDeviceIoControlDispatch
0x1C00172B0: "__cdecl _imp_RtlCopyUnicodeString" __imp_RtlCopyUnicodeString
0x1C0026C9C: AiConvertFullImagePathToMacroFormat
0x1C0017430: "__cdecl _imp_RtlCreateAcl" __imp_RtlCreateAcl
0x1C0009B50: "\SystemRoot\System32\AppLocker\{" ??_C@_1JK@FFLEFHOI@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAo?$AAo?$AAt?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAA?$AAp?$AAp?$AAL?$AAo?$AAc?$AAk?$AAe?$AAr?$AA?2?$AA?$HL@
0x1C0017118: "__cdecl _imp_ExUnregisterCallback" __imp_ExUnregisterCallback
0x1C002EE94: EdppStartAndEnableSession
0x1C000A080: WPP_6de1372f7f863d2250915da67c8c1e6d_Traceguids
0x1C0017550: "__cdecl _imp_SeSetSecurityAttributesTokenEx" __imp_SeSetSecurityAttributesTokenEx
0x1C000A470: "\Registry\Machine\WindowsAppLock" ??_C@_1FA@FNLPCDHJ@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AAA?$AAp?$AAp?$AAL?$AAo?$AAc?$AAk@
0x1C0005C6C: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x1C002D350: EdppProcessEnumRoutine
0x1C00153F1: EdppAuditEnabled
0x1C00080A8: SrpAppxProcessAllowed
0x1C0017020: "__cdecl _imp_FltReleaseFileNameInformation" __imp_FltReleaseFileNameInformation
0x1C0017050: fwpkclnt_NULL_THUNK_DATA
0x1C000A028: "Untrusted" ??_C@_1BE@JFNOEEFJ@?$AAU?$AAn?$AAt?$AAr?$AAu?$AAs?$AAt?$AAe?$AAd?$AA?$AA@
0x1C000A0D0: "APPID://SHA1HASH" ??_C@_1CC@PHBMLIJB@?$AAA?$AAP?$AAP?$AAI?$AAD?$AA?3?$AA?1?$AA?1?$AAS?$AAH?$AAA?$AA1?$AAH?$AAA?$AAS?$AAH?$AA?$AA@
0x1C0027E30: AipCatalogUpdateThread
0x1C0027A40: AipIsPathMacroPrefix
0x1C00098F0: "dbc4c77e-cf0a-44d7-8a79-5eb45d64" ??_C@_1EK@FIJBAONC@?$AAd?$AAb?$AAc?$AA4?$AAc?$AA7?$AA7?$AAe?$AA?9?$AAc?$AAf?$AA0?$AAa?$AA?9?$AA4?$AA4?$AAd?$AA7?$AA?9?$AA8?$AAa?$AA7?$AA9?$AA?9?$AA5?$AAe?$AAb?$AA4?$AA5?$AAd?$AA6?$AA4@
0x1C000AEE0: "AppxAllow" ??_C@_1BE@IHJOPKDP@?$AAA?$AAp?$AAp?$AAx?$AAA?$AAl?$AAl?$AAo?$AAw?$AA?$AA@
0x1C0017478: "__cdecl _imp_PsInitialSystemProcess" __imp_PsInitialSystemProcess
0x1C0017198: "__cdecl _imp_RtlUTF8ToUnicodeN" __imp_RtlUTF8ToUnicodeN
0x1C000AB30: "\REGISTRY\MACHINE\System\Current" ??_C@_1JG@OFIHCANB@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1C0015660: WPP_MAIN_CB
0x1C0017610: "__cdecl _imp_ExDeleteResourceLite" __imp_ExDeleteResourceLite
0x1C0017400: "__cdecl _imp_ZwLoadKeyEx" __imp_ZwLoadKeyEx
0x1C000A0A0: "APPID://SHA256FLATHASH" ??_C@_1CO@PDAAGJKG@?$AAA?$AAP?$AAP?$AAI?$AAD?$AA?3?$AA?1?$AA?1?$AAS?$AAH?$AAA?$AA2?$AA5?$AA6?$AAF?$AAL?$AAA?$AAT?$AAH?$AAA?$AAS?$AAH?$AA?$AA@
0x1C0017310: "__cdecl _imp_ObfReferenceObject" __imp_ObfReferenceObject
0x1C00172E8: "__cdecl _imp_KeUnstackDetachProcess" __imp_KeUnstackDetachProcess
0x1C0017410: "__cdecl _imp_ZwDeleteFile" __imp_ZwDeleteFile
0x1C000A318: "%HOT%" ??_C@_1M@HJJLBHIA@?$AA?$CF?$AAH?$AAO?$AAT?$AA?$CF?$AA?$AA@
0x1C0024044: AiServiceStopped
0x1C001B5C8: AipAllocTrackOriginProcess
0x1C001A8C4: AipReadConfigOptions
0x1C002EA70: EdppCreateOrOpenFileOrDirectory
0x1C001A008: AipForEachPlugin
0x1C0012BF0: "EDPPERMISSIVEAPPINFOID" ??_C@_1CO@LGPMNENH@?$AAE?$AAD?$AAP?$AAP?$AAE?$AAR?$AAM?$AAI?$AAS?$AAS?$AAI?$AAV?$AAE?$AAA?$AAP?$AAP?$AAI?$AAN?$AAF?$AAO?$AAI?$AAD?$AA?$AA@
0x1C002FD40: SrppIsApplicationEDPResourceSet
0x1C002034C: SrpGetHitCount
0x1C0015458: EdppAuditSessionLock
0x1C0002ACC: AiOnCreateProcess
0x1C0009D88: WPP_5f29d944be093abe3f35e6365236857d_Traceguids
0x1C002B97C: AiVerifyPackageMoniker
0x1C0015470: g_SymCryptCpuid1
0x1C00175B0: "__cdecl _imp_EtwSetInformation" __imp_EtwSetInformation
0x1C0009DC0: "\??\" ??_C@_19JHEHLFPM@?$AA?2?$AA?$DP?$AA?$DP?$AA?2?$AA?$AA@
0x1C00153E8: EdppPurgeWnfEvtHandle
0x1C0017390: "__cdecl _imp_ZwAlertThread" __imp_ZwAlertThread
0x1C0017180: "__cdecl _imp_ZwQueryInformationFile" __imp_ZwQueryInformationFile
0x1C00258A8: AipAddFQBNAttribute
0x1C001B87C: AiAddSessionToOriginList
0x1C0005210: CreateFqbnString
0x1C0009480: "\SystemRoot\System32\AppLocker\D" ??_C@_1FK@MGOLLJLK@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAo?$AAo?$AAt?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAA?$AAp?$AAp?$AAL?$AAo?$AAc?$AAk?$AAe?$AAr?$AA?2?$AAD@
0x1C002B270: AipCheckBlock
0x1C0028594: AipkReadRegCache
0x1C001FAFC: SrpComputeCombinedAttributes
0x1C0012C20: "MICROSOFTEDPPERMISSIVEAPPINFO" ??_C@_1DM@BDIHGFJC@?$AAM?$AAI?$AAC?$AAR?$AAO?$AAS?$AAO?$AAF?$AAT?$AAE?$AAD?$AAP?$AAP?$AAE?$AAR?$AAM?$AAI?$AAS?$AAS?$AAI?$AAV?$AAE?$AAA?$AAP?$AAP?$AAI?$AAN?$AAF?$AAO?$AA?$AA@
0x1C0017590: "__cdecl _imp_IoCreateSymbolicLink" __imp_IoCreateSymbolicLink
0x1C0008068: AppIdNewProcessFailed
0x1C00172A0: "__cdecl _imp_RtlPrefixUnicodeString" __imp_RtlPrefixUnicodeString
0x1C002EDB0: EdppDisableAudit
0x1C0017130: "__cdecl _imp_ExAllocatePoolWithTag" __imp_ExAllocatePoolWithTag
0x1C00030E0: EdppIsActive
0x1C0001520: SmartlockerGetSubSessionID
0x1C000589C: SrpSetAttributeOnToken
0x1C0028BE0: AipkGetAppxAttributes
0x1C002F470: EdppSetLoggerInfoBaseParameters
0x1C0021BB0: AiLogEvent
0x1C000AC60: "\Device\AppidEDPPlugin" ??_C@_1CO@HCILIJAK@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAA?$AAp?$AAp?$AAi?$AAd?$AAE?$AAD?$AAP?$AAP?$AAl?$AAu?$AAg?$AAi?$AAn?$AA?$AA@
0x1C0015391: AiUseSystemAppIdentityOnly
0x1C0001EDC: AiGetOriginalFileName
0x1C0005BED: "__cdecl stricmp" _stricmp
0x1C0005B00: SrpGetProcessUniqueIdFromToken
0x1C002F630: EdppThreadStart
0x1C0015230: pfnWppQueryTraceInformation
0x1C0009268: "<Not available>" ??_C@_1CA@GAPDCOBK@?$AA?$DM?$AAN?$AAo?$AAt?$AA?5?$AAa?$AAv?$AAa?$AAi?$AAl?$AAa?$AAb?$AAl?$AAe?$AA?$DO?$AA?$AA@
0x1C0017178: "__cdecl _imp_PsGetCurrentProcessId" __imp_PsGetCurrentProcessId
0x1C001B7CC: AiReferenceProcOriginList
0x1C0009380: "Windows Defender Application Gua" ??_C@_1FE@JBKAFAHB@?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAD?$AAe?$AAf?$AAe?$AAn?$AAd?$AAe?$AAr?$AA?5?$AAA?$AAp?$AAp?$AAl?$AAi?$AAc?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?5?$AAG?$AAu?$AAa@
0x1C00046F8: QueryAttributes
0x1C00174D8: "__cdecl _imp_SeCaptureSubjectContextEx" __imp_SeCaptureSubjectContextEx
0x1C0009A58: WPP_fe0991e89f1d35aab323f89b07ebec73_Traceguids
0x1C0017248: "__cdecl _imp_EtwWriteTransfer" __imp_EtwWriteTransfer
0x1C0015410: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUwhUhvxfirgbUzkkrwUifmgrnvUwireviUkoftrmhUdkxUpnlwvUlyquivUznwGEUkxsOlyq@wpcplugink" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUwhUhvxfirgbUzkkrwUifmgrnvUwireviUkoftrmhUdkxUpnlwvUlyquivUznwGEUkxsOlyq@wpcplugink
0x1C002CC24: EdppEvaluateToken
0x1C0003D58: SrpIsEnterpriseExempt
0x1C00289FC: AipkIsCertificateTrusted
0x1C0017080: "__cdecl _imp_BCryptHashData" __imp_BCryptHashData
0x1C0015158: InheritedAppUniqueId
0x1C0009264: "" ??_C@_13BLAPAIAM@?$AA?$AI?$AA?$AA@
0x1C0017030: FLTMGR_NULL_THUNK_DATA
0x1C00170F0: "__cdecl _imp_SeLocateProcessImageName" __imp_SeLocateProcessImageName
0x1C0005CD4: "__cdecl _GSHandlerCheck_SEH" __GSHandlerCheck_SEH
0x1C0017228: "__cdecl _imp__wcsicmp" __imp__wcsicmp
0x1C003093C: AiInitializeCertStore
0x1C0017470: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x1C002DA50: EdpPluginCleanup
0x1C0009FE8: "NotAfter" ??_C@_1BC@LJAGGCIE@?$AAN?$AAo?$AAt?$AAA?$AAf?$AAt?$AAe?$AAr?$AA?$AA@
0x1C0008058: AppIdEventProviderId
0x1C0017600: "__cdecl _imp_RtlQueryRegistryValuesEx" __imp_RtlQueryRegistryValuesEx
0x1C0020B80: SrpOpenFile
0x1C0001C94: AiUpdatePerfTime
0x1C002873C: AiCapturePackageMoniker
0x1C00153D8: g_SymCryptCpuFeaturesPresentCheck
0x1C00175B8: "__cdecl _imp_KeLeaveCriticalRegion" __imp_KeLeaveCriticalRegion
0x1C001EB74: SmartlockerAddChildProcToTrackedListIfParentPresent
0x1C000A118: "$KERNEL.PURGE.APPID.VERSIONINFO" ??_C@_0CA@HPKGEPBG@$KERNEL?4PURGE?4APPID?4VERSIONINFO?$AA@
0x1C0015194: g_SymCryptCpuFeaturesNotPresent
0x1C002FBDC: SrpIsApplicationAutoProtectionAllowed
0x1C00173F0: "__cdecl _imp_ExQueryFastCacheDevLicense" __imp_ExQueryFastCacheDevLicense
0x1C000B0B0: "EnforcementLevel" ??_C@_1CC@BFACNBFP@?$AAE?$AAn?$AAf?$AAo?$AAr?$AAc?$AAe?$AAm?$AAe?$AAn?$AAt?$AAL?$AAe?$AAv?$AAe?$AAl?$AA?$AA@
0x1C0029A48: AiGetPolicy
0x1C00173D8: "__cdecl _imp_RtlCreateHashTable" __imp_RtlCreateHashTable
0x1C0005C48: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x1C00153D0: AppHashAlgInitialized
0x1C00298A4: AiQueryUserSid
0x1C0008138: "PsGetVersion" ??_C@_1BK@DHLDGJM@?$AAP?$AAs?$AAG?$AAe?$AAt?$AAV?$AAe?$AAr?$AAs?$AAi?$AAo?$AAn?$AA?$AA@
0x1C0022FB4: AiAlloc
0x1C00283F8: AipkAllocAndFillCacheEntry
0x1C0023734: AiGetTrustedPublisherName
0x1C0017438: "__cdecl _imp_RtlAddAccessAllowedAce" __imp_RtlAddAccessAllowedAce
0x1C00097B0: "$Kernel.Smartlocker.Hash" ??_C@_0BJ@LEBBFJKL@$Kernel?4Smartlocker?4Hash?$AA@
0x1C00154A0: AipPathMacroList
0x1C00170D8: "__cdecl _imp_RpcBindingCreateW" __imp_RpcBindingCreateW
0x1C0017378: "__cdecl _imp_ZwCreateFile" __imp_ZwCreateFile
0x1C00080B8: AppIdStartServiceEvent
0x1C0017388: "__cdecl _imp_PsCreateSystemThread" __imp_PsCreateSystemThread
0x1C0001C60: AiQueryPerformanceCounter
0x1C0017068: "__cdecl _imp_BCryptCloseAlgorithmProvider" __imp_BCryptCloseAlgorithmProvider
0x1C0017588: "__cdecl _imp_ZwTraceControl" __imp_ZwTraceControl
0x1C000A5C8: "SHA1" ??_C@_19DILNDFJH@?$AAS?$AAH?$AAA?$AA1?$AA?$AA@
0x1C0009258: "NULL" ??_C@_19CIJIHAKK@?$AAN?$AAU?$AAL?$AAL?$AA?$AA@
0x1C0015218: pfnEtwRegisterClassicProvider
0x1C00170E8: msrpc_NULL_THUNK_DATA
0x1C0004558: QueryFlags
0x1C0012B28: "PEDP://InhAppUnique" ??_C@_1CI@PEJPMIDP@?$AAP?$AAE?$AAD?$AAP?$AA?3?$AA?1?$AA?1?$AAI?$AAn?$AAh?$AAA?$AAp?$AAp?$AAU?$AAn?$AAi?$AAq?$AAu?$AAe?$AA?$AA@
0x1C000ABF0: EDP_APP_LEARNING_LOG_PATH
0x1C000A520: "\SystemRoot\System32\AppLocker\A" ??_C@_1FI@BPJFCJND@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAo?$AAo?$AAt?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAA?$AAp?$AAp?$AAL?$AAo?$AAc?$AAk?$AAe?$AAr?$AA?2?$AAA@
0x1C00015FC: SmartlockerGetValidEA
0x1C002D02C: EdppSetIntentToken
0x1C00172D8: "__cdecl _imp_ExReleasePushLockSharedEx" __imp_ExReleasePushLockSharedEx
0x1C0008118: SrpProcessAudited
0x1C00174B8: "__cdecl _imp_RtlGetVersion" __imp_RtlGetVersion
0x1C0015080: AipDefaultAttributes
0x1C0026578: AiSetAttributesExe
0x1C0004D2C: "long __cdecl RtlStringCbCatNW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64,unsigned __int64)" ?RtlStringCbCatNW@@YAJPEAG_KPEBG1@Z
0x1C002D2B0: EdppCleanupArgs
0x1C0001170: WPP_SF_ZD
0x1C001BEBC: AipTrackListCleanup
0x1C00019C0: WPP_SF_ZZ
0x1C001A560: AipUnload
0x1C001F150: SrpVerifyDll
0x1C0017638: "__cdecl _imp_IoDeleteSymbolicLink" __imp_IoDeleteSymbolicLink
0x1C00096D8: "ENABLED" ??_C@_1BA@MJBJJCCC@?$AAE?$AAN?$AAA?$AAB?$AAL?$AAE?$AAD?$AA?$AA@
0x1C0008008: SrpEventProviderId
0x1C000A298: "%SYSTEM32%" ??_C@_1BG@ELNEIAKE@?$AA?$CF?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA3?$AA2?$AA?$CF?$AA?$AA@
0x1C000A680: "ProductName" ??_C@_1BI@CJGIOPAN@?$AAP?$AAr?$AAo?$AAd?$AAu?$AAc?$AAt?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x1C0026248: AiIsTokenSandBoxed
0x1C0027AA8: AipGetImageId
0x1C0004314: GetEnterpriseContext
0x1C000192C: WPP_SF_Z
0x1C0015820: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUwhUhvxfirgbUzkkrwUifmgrnvUwireviUhbhUlyquivUznwGEUkxsOlyq@appid" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUwhUhvxfirgbUzkkrwUifmgrnvUwireviUhbhUlyquivUznwGEUkxsOlyq@appid
0x1C0008000: "\" ??_C@_13FPGAJAPJ@?$AA?2?$AA?$AA@
0x1C00092B0: "EDP Plugin" ??_C@_1BG@BKAKFFJK@?$AAE?$AAD?$AAP?$AA?5?$AAP?$AAl?$AAu?$AAg?$AAi?$AAn?$AA?$AA@
0x1C00010B0: WPP_SF_
0x1C000307C: EdppClearToken
0x1C0020158: SrppPluginAccessCheck
0x1C00039B0: SrpDeleteEnterpriseContext
0x1C000AF28: "EnlightenedAllowed" ??_C@_1CG@JFINDGCB@?$AAE?$AAn?$AAl?$AAi?$AAg?$AAh?$AAt?$AAe?$AAn?$AAe?$AAd?$AAA?$AAl?$AAl?$AAo?$AAw?$AAe?$AAd?$AA?$AA@
0x1C002BCC0: EdppAppEventsPurgeCallback
0x1C0015040: AipRegistryPathMacros
0x1C0009360: "WDAG Plugin" ??_C@_1BI@IKGCHOAG@?$AAW?$AAD?$AAA?$AAG?$AA?5?$AAP?$AAl?$AAu?$AAg?$AAi?$AAn?$AA?$AA@
0x1C0004478: IsEnterpriseAllowed
0x1C000A238: "ProgramFilesDir (x86)" ??_C@_1CM@LPGAILIM@?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAF?$AAi?$AAl?$AAe?$AAs?$AAD?$AAi?$AAr?$AA?5?$AA?$CI?$AAx?$AA8?$AA6?$AA?$CJ?$AA?$AA@
0x1C00170D0: "__cdecl _imp_RpcBindingFree" __imp_RpcBindingFree
0x1C002A18C: AppHashComputeImageHashInternal
0x1C0015220: pfnEtwUnregister
0x1C0005464: GetAttribute
0x1C0017490: "__cdecl _imp_iswspace" __imp_iswspace
0x1C0022BC4: AipGUIDFromString
0x1C0012B80: "EDPENLIGHTENEDAPPINFOID" ??_C@_1DA@LDBLOKME@?$AAE?$AAD?$AAP?$AAE?$AAN?$AAL?$AAI?$AAG?$AAH?$AAT?$AAE?$AAN?$AAE?$AAD?$AAA?$AAP?$AAP?$AAI?$AAN?$AAF?$AAO?$AAI?$AAD?$AA?$AA@
0x1C0009818: "APPID://FQBN" ??_C@_1BK@PCDGPBEN@?$AAA?$AAP?$AAP?$AAI?$AAD?$AA?3?$AA?1?$AA?1?$AAF?$AAQ?$AAB?$AAN?$AA?$AA@
0x1C000A330: "\SystemRoot\System32\CatRoot\{F7" ??_C@_1IK@GKAHCNJE@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAo?$AAo?$AAt?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAC?$AAa?$AAt?$AAR?$AAo?$AAo?$AAt?$AA?2?$AA?$HL?$AAF?$AA7@
0x1C000ABE8: "NA" ??_C@_15FIMHAKBI@?$AAN?$AAA?$AA?$AA@
0x1C001540C: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUwhUhvxfirgbUzkkrwUifmgrnvUwireviUkoftrmhUdwztUpnlwvUlyquivUznwGEUkxsOlyq@wdagplugink" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUwhUhvxfirgbUzkkrwUifmgrnvUwireviUkoftrmhUdwztUpnlwvUlyquivUznwGEUkxsOlyq@wdagplugink
0x1C0002554: AppHashComputeFileHashes
0x1C0030AB0: EdpPluginInit
0x1C00018A4: RtlStringCbPrintfW
0x1C0017710: "__cdecl _IMPORT_DESCRIPTOR_fwpkclnt" __IMPORT_DESCRIPTOR_fwpkclnt
0x1C001D56C: SmartlockerTelemetrizeOriginInfo
0x1C002DB84: EdppPolicyOverride
0x1C0012668: "WDAG://RestrictInternetAccess" ??_C@_1DM@BOBOJOGF@?$AAW?$AAD?$AAA?$AAG?$AA?3?$AA?1?$AA?1?$AAR?$AAe?$AAs?$AAt?$AAr?$AAi?$AAc?$AAt?$AAI?$AAn?$AAt?$AAe?$AAr?$AAn?$AAe?$AAt?$AAA?$AAc?$AAc?$AAe?$AAs?$AAs?$AA?$AA@
0x1C0017190: "__cdecl _imp_RtlEqualUnicodeString" __imp_RtlEqualUnicodeString
0x1C0003740: WpcPluginNotifyRoutine
0x1C0017318: "__cdecl _imp_FsRtlGetFileSize" __imp_FsRtlGetFileSize
0x1C0017230: "__cdecl _imp_MmMapViewInSystemSpace" __imp_MmMapViewInSystemSpace
0x1C000AF10: "Enlightened" ??_C@_1BI@LKPKDJLL@?$AAE?$AAn?$AAl?$AAi?$AAg?$AAh?$AAt?$AAe?$AAn?$AAe?$AAd?$AA?$AA@
0x1C000A178: "%PROGRAMFILES%" ??_C@_1BO@DFNLOLHA@?$AA?$CF?$AAP?$AAR?$AAO?$AAG?$AAR?$AAA?$AAM?$AAF?$AAI?$AAL?$AAE?$AAS?$AA?$CF?$AA?$AA@
0x1C0015168: InheritedProcessUniqueId
0x1C0028274: AipkFindAndReturnEntryFromAppxCache
0x1C00174E0: "__cdecl _imp_SeReleaseSubjectContext" __imp_SeReleaseSubjectContext
0x1C0009D38: "\SystemRoot\System32\Applocker" ??_C@_1DO@POLKPGLI@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAo?$AAo?$AAt?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAA?$AAp?$AAp?$AAl?$AAo?$AAc?$AAk?$AAe?$AAr?$AA?$AA@
0x1C002744C: AiGetFullImagePath
0x1C001C4C4: AipCreateProcessNotifyRoutine
0x1C001FEA0: SrpUpdatePolicy
0x1C002311C: AiFreeCertStore
0x1C00255F0: AiAddImagePathWithMacro
0x1C00172E0: "__cdecl _imp_KeStackAttachProcess" __imp_KeStackAttachProcess
0x1C000221C: AiRegReadQwordValue
0x1C0026480: AiSetAttributesAppx
0x1C0003A98: SrpDeleteEnterpriseContextToken
0x1C00266D4: AiGetFileNameFromPath
0x1C0004C70: InitSubjectByTokenPointer
0x1C0017360: "__cdecl _imp_ZwDeviceIoControlFile" __imp_ZwDeviceIoControlFile
0x1C001B644: AiAddProcToTrackedSessionList
0x1C0030C60: GsDriverEntry
0x1C0017688: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x1C0008048: SrpAppxProcessDisabled
0x1C0017070: "__cdecl _imp_BCryptGetProperty" __imp_BCryptGetProperty
0x1C0017278: "__cdecl _imp_ZwQueryDirectoryFile" __imp_ZwQueryDirectoryFile
0x1C000A4F8: "CertPublicKey" ??_C@_1BM@KMCPOMA@?$AAC?$AAe?$AAr?$AAt?$AAP?$AAu?$AAb?$AAl?$AAi?$AAc?$AAK?$AAe?$AAy?$AA?$AA@
0x1C0026290: AiGetTokens
0x1C000A090: "NULL" ??_C@_04HIBGFPH@NULL?$AA@
0x1C0008018: SrpPolicyLoadSuccess
0x1C0017530: "__cdecl _imp_RtlAppendUnicodeToString" __imp_RtlAppendUnicodeToString
0x1C0009FB0: "PublisherName" ??_C@_1BM@NJNCFKEG@?$AAP?$AAu?$AAb?$AAl?$AAi?$AAs?$AAh?$AAe?$AAr?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x1C0009E00: "\Registry\Machine\System\Current" ??_C@_1IO@OPFCBBIC@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1C0008258: "EnableFqbn" ??_C@_1BG@CNNHDKKD@?$AAE?$AAn?$AAa?$AAb?$AAl?$AAe?$AAF?$AAq?$AAb?$AAn?$AA?$AA@
0x1C00171A8: "__cdecl _imp_ObReferenceObjectByHandle" __imp_ObReferenceObjectByHandle
0x1C00174C0: "__cdecl _imp_RtlCapabilityCheck" __imp_RtlCapabilityCheck
0x1C000AE60: "222A8A43-0122-432F-86BB-FECA4097" ??_C@_1EK@KOPNBIKC@?$AA2?$AA2?$AA2?$AAA?$AA8?$AAA?$AA4?$AA3?$AA?9?$AA0?$AA1?$AA2?$AA2?$AA?9?$AA4?$AA3?$AA2?$AAF?$AA?9?$AA8?$AA6?$AAB?$AAB?$AA?9?$AAF?$AAE?$AAC?$AAA?$AA4?$AA0?$AA9?$AA7@
0x1C002A9B8: AiGetImageVersionInfo
0x1C00093D8: "EXE" ??_C@_17LHLHMOIK@?$AAE?$AAX?$AAE?$AA?$AA@
0x1C0017058: "__cdecl _imp_BCryptDestroyHash" __imp_BCryptDestroyHash
0x1C0028DC0: AipkLoadRegCache_Callout
0x1C0009EB0: "UseSystemIdentityOnly" ??_C@_1CM@DLOCIKEI@?$AAU?$AAs?$AAe?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAI?$AAd?$AAe?$AAn?$AAt?$AAi?$AAt?$AAy?$AAO?$AAn?$AAl?$AAy?$AA?$AA@
0x1C002A848: AppHashIsPeImage
0x1C002EA44: EdpAuditLibMemAlloc
0x1C0024130: AiGetTrustedPublisherNameFromCache
0x1C0026434: AiCleanTokens
0x1C000A2D8: "%WINDIR%\SysWOW64" ??_C@_1CE@MEJBOCEK@?$AA?$CF?$AAW?$AAI?$AAN?$AAD?$AAI?$AAR?$AA?$CF?$AA?2?$AAS?$AAy?$AAs?$AAW?$AAO?$AAW?$AA6?$AA4?$AA?$AA@
0x1C001B9AC: AiUnreferenceProcOriginList
0x1C0017570: "__cdecl _imp_RtlUnicodeStringToInteger" __imp_RtlUnicodeStringToInteger
0x1C001E848: SrpInheritOrigin
0x1C001EC4C: SrpIsWindowsSigned
0x1C001E150: SmartlockerVerifyProcess
0x1C0003E08: EnterpriseContextLibMemFree
0x1C0004658: QueryEnterpriseIds
0x1C000A158: WPP_4f63fd1870a535c5d9382c166c277d42_Traceguids
0x1C001BFD0: AiEnsureServiceRunning
0x1C00175E0: "__cdecl _imp_ZwResetEvent" __imp_ZwResetEvent
0x1C00129C0: EdpAuditProviderRegular
0x1C002E30C: EdpFreePluginConfig
0x1C00173A0: "__cdecl _imp_RtlInitEnumerationHashTable" __imp_RtlInitEnumerationHashTable
0x1C0008088: SrpNoAppxRuleConfigured
0x1C00098A0: "CurrentOriginDataId" ??_C@_1CI@PMLPMNEG@?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAO?$AAr?$AAi?$AAg?$AAi?$AAn?$AAD?$AAa?$AAt?$AAa?$AAI?$AAd?$AA?$AA@
0x1C0009330: "Family Safety Plugin" ??_C@_1CK@EBMLLAKH@?$AAF?$AAa?$AAm?$AAi?$AAl?$AAy?$AA?5?$AAS?$AAa?$AAf?$AAe?$AAt?$AAy?$AA?5?$AAP?$AAl?$AAu?$AAg?$AAi?$AAn?$AA?$AA@
0x1C000416C: CreateAttributesFromIntentEnterpriseId
0x1C0015414: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUwhUhvxfirgbUzkkrwUifmgrnvUwireviUkoftrmhUvwkUpnlwvUlyquivUznwGEUkxsOlyq@edpplugink" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUwhUhvxfirgbUzkkrwUifmgrnvUwireviUkoftrmhUvwkUpnlwvUlyquivUznwGEUkxsOlyq@edpplugink
0x1C002D6E4: EdppPolicyUpdate
0x1C0001B3C: WPP_SF_DD
0x1C0017100: "__cdecl _imp_RtlRunOnceExecuteOnce" __imp_RtlRunOnceExecuteOnce
0x1C00171C0: PsProcessType
0x1C0015038: WPP_GLOBAL_Control
0x1C0023BA4: AipGetTrustedPublisherNameFromService
0x1C0028890: AipkGetAppxFqbnAttributes
0x1C00098C8: "appid-EnableV2" ??_C@_1BO@ODJFFLKD@?$AAa?$AAp?$AAp?$AAi?$AAd?$AA?9?$AAE?$AAn?$AAa?$AAb?$AAl?$AAe?$AAV?$AA2?$AA?$AA@
0x1C00172B8: "__cdecl _imp_ZwQueryValueKey" __imp_ZwQueryValueKey
0x1C0009DEC: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x1C001C030: "__cdecl TlgEnableCallback" _TlgEnableCallback
0x1C0017220: "__cdecl _imp_ZwDuplicateToken" __imp_ZwDuplicateToken
0x1C000244C: WPP_SF_d
0x1C00010DC: WPP_SF_D
0x1C0029214: AiRegOpenKey
0x1C0005BE0: "__cdecl _report_rangecheckfailure" __report_rangecheckfailure
0x1C00170B0: "__cdecl _imp_I_RpcExceptionFilter" __imp_I_RpcExceptionFilter
0x1C000AF68: "AppxDisallowedIsExempted" ??_C@_1DC@LHNBIKGE@?$AAA?$AAp?$AAp?$AAx?$AAD?$AAi?$AAs?$AAa?$AAl?$AAl?$AAo?$AAw?$AAe?$AAd?$AAI?$AAs?$AAE?$AAx?$AAe?$AAm?$AAp?$AAt?$AAe?$AAd?$AA?$AA@
0x1C0012AF0: "%02x" ??_C@_19NHPFCCLF@?$AA?$CF?$AA0?$AA2?$AAx?$AA?$AA@
0x1C000A018: "Unknown" ??_C@_1BA@LEPJIIOK@?$AAU?$AAn?$AAk?$AAn?$AAo?$AAw?$AAn?$AA?$AA@
0x1C0001154: "__cdecl TlgDefineProvider_annotation__Tlgg_hLogProviderProv" _TlgDefineProvider_annotation__Tlgg_hLogProviderProv
0x1C0015238: AipInitRunOnceState
0x1C001CA50: PluginInvokeCallback
0x1C0004F18: RtlStringCbPrintfExW
0x1C00153A0: AipAppxRegCacheInitialized
0x1C0017488: "__cdecl _imp_RtlCompareUnicodeString" __imp_RtlCompareUnicodeString
0x1C0009FD0: "PublicKey" ??_C@_1BE@KFJNGKKA@?$AAP?$AAu?$AAb?$AAl?$AAi?$AAc?$AAK?$AAe?$AAy?$AA?$AA@
0x1C0017320: "__cdecl _imp__vsnprintf" __imp__vsnprintf
0x1C0017268: "__cdecl _imp_RtlCreateUnicodeString" __imp_RtlCreateUnicodeString
0x1C0005BA0: "__cdecl _security_check_cookie" __security_check_cookie
0x1C002BBF0: EdppIsAppxLineOfBusiness
0x1C000310C: EdpPluginEvaluate
0x1C0017468: "__cdecl _imp_ZwQueryLicenseValue" __imp_ZwQueryLicenseValue
0x1C00082C0: "EnableSha256Hash" ??_C@_1CC@ECEOEHOF@?$AAE?$AAn?$AAa?$AAb?$AAl?$AAe?$AAS?$AAh?$AAa?$AA2?$AA5?$AA6?$AAH?$AAa?$AAs?$AAh?$AA?$AA@
0x1C0017108: "__cdecl _imp_ExCreateCallback" __imp_ExCreateCallback
0x1C0017018: CI_NULL_THUNK_DATA
0x1C001B480: AiReleaseOriginProcessData
0x1C0017138: "__cdecl _imp_ZwQuerySecurityAttributesToken" __imp_ZwQuerySecurityAttributesToken
0x1C0015490: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUwhUhvxfirgbUzkkrwUifmgrnvUoryUpnlwvUlyquivUznwGEUkxsOlyq@appidk" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUwhUhvxfirgbUzkkrwUifmgrnvUoryUpnlwvUlyquivUznwGEUkxsOlyq@appidk
0x1C000A4C0: "PackageName" ??_C@_1BI@CAKJMNBO@?$AAP?$AAa?$AAc?$AAk?$AAa?$AAg?$AAe?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x1C000493C: GetPointersOfAttributesValues
0x1C002DA10: EdppPolicyUpdateSystemThread
0x1C00153A8: AipAppxRegCache
0x1C0003968: SrpGetEnterpriseContextToken
0x1C0025370: AipSmartHashImageFile
0x1C0017458: "__cdecl _imp_ZwQueryKey" __imp_ZwQueryKey
0x1C0017358: "__cdecl _imp_ZwQueryVolumeInformationFile" __imp_ZwQueryVolumeInformationFile
0x1C00176E8: "__cdecl _IMPORT_DESCRIPTOR_FLTMGR" __IMPORT_DESCRIPTOR_FLTMGR
0x1C0017698: "__cdecl _IMPORT_DESCRIPTOR_ntoskrnl" __IMPORT_DESCRIPTOR_ntoskrnl
0x1C00173F8: "__cdecl _imp_ZwUnloadKeyEx" __imp_ZwUnloadKeyEx
0x1C000A1A0: "\Registry\Machine\Software\Micro" ??_C@_1HI@BHMKBIMG@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x1C00037B8: SrpCreateEnterpriseContext
0x1C00171B0: SeTokenObjectType
0x1C00153C0: AipAppxInMemoryCache
0x1C0017500: "__cdecl _imp_ZwCompareTokens" __imp_ZwCompareTokens
0x1C002E764: KappxParseString
0x1C0013645: "__cdecl TraceLoggingMetadataEnd" _TraceLoggingMetadataEnd
0x1C002771C: AiGetVolumeInfo
0x1C000AC90: "\??\AppidEDPPlugin" ??_C@_1CG@IGCLJDMG@?$AA?2?$AA?$DP?$AA?$DP?$AA?2?$AAA?$AAp?$AAp?$AAi?$AAd?$AAE?$AAD?$AAP?$AAP?$AAl?$AAu?$AAg?$AAi?$AAn?$AA?$AA@
0x1C0008228: "\??\AppID" ??_C@_1BE@MMEKBBNK@?$AA?2?$AA?$DP?$AA?$DP?$AA?2?$AAA?$AAp?$AAp?$AAI?$AAD?$AA?$AA@
0x1C0023200: AipAddCertFromCertStore
0x1C00176FC: "__cdecl _IMPORT_DESCRIPTOR_msrpc" __IMPORT_DESCRIPTOR_msrpc
0x1C002E164: EdppIsEnterpriseSMBFile
0x1C000A280: "%WINDIR%" ??_C@_1BC@FFGMDNMH@?$AA?$CF?$AAW?$AAI?$AAN?$AAD?$AAI?$AAR?$AA?$CF?$AA?$AA@
0x1C00176C0: "__cdecl _IMPORT_DESCRIPTOR_CI" __IMPORT_DESCRIPTOR_CI
0x1C0009600: "\Callback\LicensingData" ??_C@_1DA@JCKMAOAN@?$AA?2?$AAC?$AAa?$AAl?$AAl?$AAb?$AAa?$AAc?$AAk?$AA?2?$AAL?$AAi?$AAc?$AAe?$AAn?$AAs?$AAi?$AAn?$AAg?$AAD?$AAa?$AAt?$AAa?$AA?$AA@
0x1C0017160: "__cdecl _imp_RtlInitAnsiString" __imp_RtlInitAnsiString
0x1C0017260: "__cdecl _imp_KeDelayExecutionThread" __imp_KeDelayExecutionThread
0x1C0008208: "\Device\AppID" ??_C@_1BM@BMIKNEDG@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAA?$AAp?$AAp?$AAI?$AAD?$AA?$AA@
0x1C00080D8: SrpProcessAllowed
0x1C000AE50: EdpPluginGuid
0x1C0017668: "__cdecl _imp_MmUnmapViewInSystemSpace" __imp_MmUnmapViewInSystemSpace
0x1C002F3A8: EdppCreateBaseLoggerInfo
0x1C0017560: "__cdecl _imp_SeQuerySecurityAttributesTokenAccessInformation" __imp_SeQuerySecurityAttributesTokenAccessInformation
0x1C0017288: "__cdecl _imp_EtwEventEnabled" __imp_EtwEventEnabled
0x1C0017370: "__cdecl _imp_ZwFsControlFile" __imp_ZwFsControlFile
0x1C0020298: SrppDuplicateProcessToken
0x1C000A098: "%2.2x" ??_C@_05ECFJDLDC@?$CF2?42x?$AA@
0x1C00156A0: g_AppId
0x1C0012C60: "EDPAUTOPROTECTIONALLOWEDAPPINFOI" ??_C@_1EE@LMNNKFIE@?$AAE?$AAD?$AAP?$AAA?$AAU?$AAT?$AAO?$AAP?$AAR?$AAO?$AAT?$AAE?$AAC?$AAT?$AAI?$AAO?$AAN?$AAA?$AAL?$AAL?$AAO?$AAW?$AAE?$AAD?$AAA?$AAP?$AAP?$AAI?$AAN?$AAF?$AAO?$AAI@
0x1C0009F78: "IgnoreCacheUnsignedFiles" ??_C@_1DC@KINHFOJG@?$AAI?$AAg?$AAn?$AAo?$AAr?$AAe?$AAC?$AAa?$AAc?$AAh?$AAe?$AAU?$AAn?$AAs?$AAi?$AAg?$AAn?$AAe?$AAd?$AAF?$AAi?$AAl?$AAe?$AAs?$AA?$AA@
0x1C0017010: "__cdecl _imp_CiSetTrustedOriginClaimId" __imp_CiSetTrustedOriginClaimId
0x1C000A300: "%REMOVABLE%" ??_C@_1BI@KIOJHBMB@?$AA?$CF?$AAR?$AAE?$AAM?$AAO?$AAV?$AAA?$AAB?$AAL?$AAE?$AA?$CF?$AA?$AA@
0x1C00094E0: "\SystemRoot\System32\AppLocker\A" ??_C@_1FM@IJHLAHFK@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAo?$AAo?$AAt?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAA?$AAp?$AAp?$AAL?$AAo?$AAc?$AAk?$AAe?$AAr?$AA?2?$AAA@
0x1C0001160: SymCryptFatal
0x1C0017558: "__cdecl _imp_SeQuerySecurityAttributesToken" __imp_SeQuerySecurityAttributesToken
0x1C002CAF4: EdppOpenKernelTokenHandle
0x1C0017628: "__cdecl _imp_EtwUnregister" __imp_EtwUnregister
0x1C0031000: "__cdecl _guard_fids_table" __guard_fids_table
0x1C0017428: "__cdecl _imp_ZwSetSecurityObject" __imp_ZwSetSecurityObject
0x1C00175C8: "__cdecl _imp_ExAcquireResourceExclusiveLite" __imp_ExAcquireResourceExclusiveLite
0x1C00083F0: WPP_ThisDir_CTLGUID_AppIDLog
0x1C0017640: "__cdecl _imp_IoVolumeDeviceToDosName" __imp_IoVolumeDeviceToDosName
0x1C0029120: AipkConstructCacheDacl
0x1C002E800: KappxParseVersion
0x1C002BCA4: EdppRemoveIntentEnterpriseIdToken
0x1C0007E10: "__cdecl load_config_used" _load_config_used
0x1C0015480: AppHashAlgHandle
0x1C0017218: "__cdecl _imp_SeSrpAccessCheck" __imp_SeSrpAccessCheck
0x1C0017518: "__cdecl _imp_ZwQueryInformationProcess" __imp_ZwQueryInformationProcess
0x1C00171D8: "__cdecl _imp_PsDereferencePrimaryToken" __imp_PsDereferencePrimaryToken
0x1C0017188: "__cdecl _imp_ZwOpenProcessTokenEx" __imp_ZwOpenProcessTokenEx
0x1C0009288: WPP_72d1dd356a0d3d70bb632207906daba9_Traceguids
0x1C002BEB0: EdppInitializeCallback
0x1C0017648: "__cdecl _imp_ZwClose" __imp_ZwClose
0x1C002A7FC: AppHashDestroyHash
0x1C0017300: "__cdecl _imp_ExReleasePushLockExclusiveEx" __imp_ExReleasePushLockExclusiveEx
0x1C0017140: "__cdecl _imp_PsGetProcessId" __imp_PsGetProcessId
0x1C0004CEC: DeinitSubjectWithTokenPointer
0x1C000AAF8: "enterpriseDataPolicy" ??_C@_1CK@CNBNBBMH@?$AAe?$AAn?$AAt?$AAe?$AAr?$AAp?$AAr?$AAi?$AAs?$AAe?$AAD?$AAa?$AAt?$AAa?$AAP?$AAo?$AAl?$AAi?$AAc?$AAy?$AA?$AA@
0x1C00173C0: "__cdecl _imp_RtlDeleteHashTable" __imp_RtlDeleteHashTable
0x1C002F54C: EdppDoWorkAsSystem
0x1C00170C0: "__cdecl _imp_Ndr64AsyncClientCall" __imp_Ndr64AsyncClientCall
0x1C00174F0: "__cdecl _imp_wcsnlen" __imp_wcsnlen
0x1C001B574: AipAddProcToOriginListLocked
0x1C00174D0: "__cdecl _imp_ExSubscribeWnfStateChange" __imp_ExSubscribeWnfStateChange
0x1C0002014: RtlStringCbCopyUnicodeString
0x1C0002864: AiGetHashInfoFromCache
0x1C002958C: AiRegGetSubkeyName
0x1C0028AAC: AipGetPublisherId
0x1C0017060: "__cdecl _imp_BCryptOpenAlgorithmProvider" __imp_BCryptOpenAlgorithmProvider
0x1C000AFF0: "\REGISTRY\MACHINE\System\Current" ??_C@_1LM@BFKFNNMJ@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1C0017208: IoFileObjectType
0x1C0020928: SrpPolicyTransactionRollback
0x1C000271C: AiSetHashInfoInCache
0x1C0017498: "__cdecl _imp_KeInitializeEvent" __imp_KeInitializeEvent
0x1C00171B8: "__cdecl _imp_ObOpenObjectByPointer" __imp_ObOpenObjectByPointer
0x1C00260B4: AiOpenImageFile
0x1C0008178: "WmiQueryTraceInformation" ??_C@_1DC@DOCOAJH@?$AAW?$AAm?$AAi?$AAQ?$AAu?$AAe?$AAr?$AAy?$AAT?$AAr?$AAa?$AAc?$AAe?$AAI?$AAn?$AAf?$AAo?$AAr?$AAm?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x1C0017090: "__cdecl _imp_BCryptGenRandom" __imp_BCryptGenRandom
0x1C0009A70: "Appx" ??_C@_19GEPEOPDF@?$AAA?$AAp?$AAp?$AAx?$AA?$AA@
0x1C0009CB0: "\SystemRoot\System32\AppLocker\p" ??_C@_1GG@IKDNNCBP@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAo?$AAo?$AAt?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAA?$AAp?$AAp?$AAL?$AAo?$AAc?$AAk?$AAe?$AAr?$AA?2?$AAp@
0x1C0017098: ksecdd_NULL_THUNK_DATA
0x1C000A610: "ObjectLength" ??_C@_1BK@GPNIFMAA@?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAL?$AAe?$AAn?$AAg?$AAt?$AAh?$AA?$AA@
0x1C002DD90: EdppEvaluatePolicies
0x1C00247D8: AipkVerifyPackageMonikerFromService
0x1C000AFA0: "ExeDisallowedIsExempted" ??_C@_1DA@JECIMJEC@?$AAE?$AAx?$AAe?$AAD?$AAi?$AAs?$AAa?$AAl?$AAl?$AAo?$AAw?$AAe?$AAd?$AAI?$AAs?$AAE?$AAx?$AAe?$AAm?$AAp?$AAt?$AAe?$AAd?$AA?$AA@
0x1C00174C8: "__cdecl _imp_ExReleasePushLockEx" __imp_ExReleasePushLockEx
0x1C0004E24: "long __cdecl EdppCreateFileObject(unsigned short const * __ptr64,struct _OBJECT_ATTRIBUTES * __ptr64,struct _UNICODE_STRING * __ptr64 * __ptr64)" ?EdppCreateFileObject@@YAJPEBGPEAU_OBJECT_ATTRIBUTES@@PEAPEAU_UNICODE_STRING@@@Z
0x1C00081E8: "EtwUnregister" ??_C@_1BM@CJMKDOJH@?$AAE?$AAt?$AAw?$AAU?$AAn?$AAr?$AAe?$AAg?$AAi?$AAs?$AAt?$AAe?$AAr?$AA?$AA@
0x1C002FC28: SrppIsApplicationEDPResourceSetKernel
0x1C002BF68: EdppSMBFileOverride
0x1C00222A0: AiLogSrpRuleEvent
0x1C0026B3C: AipAddPathMacro
0x1C001AAC0: AipCreateDispatch
0x1C0003D40: SrpIsEnterpriseAllowed
0x1C000A2B0: "%WINDIR%\System32" ??_C@_1CE@JCOKPJIB@?$AA?$CF?$AAW?$AAI?$AAN?$AAD?$AAI?$AAR?$AA?$CF?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?$AA@
0x1C00218F4: SrpCreatePluginFileName
0x1C00174B0: "__cdecl _imp_RtlGetEnabledExtendedFeatures" __imp_RtlGetEnabledExtendedFeatures
0x1C002BAA0: MIDL_user_allocate
0x1C0005C30: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x1C0005D70: memcmp
0x1C0015420: EdppRuntimeConfig
0x1C000A268: "%OSDRIVE%" ??_C@_1BE@NNPFOCHJ@?$AA?$CF?$AAO?$AAS?$AAD?$AAR?$AAI?$AAV?$AAE?$AA?$CF?$AA?$AA@
0x1C0017338: "__cdecl _imp_wcsrchr" __imp_wcsrchr
0x1C00043F0: IsContextAllowed
0x1C00173A8: "__cdecl _imp_RtlEnumerateEntryHashTable" __imp_RtlEnumerateEntryHashTable
0x1C00228D0: AiLogSmartlockerEnforcementStatusEvent
0x1C00171C8: "__cdecl _imp_PsReferencePrimaryToken" __imp_PsReferencePrimaryToken
0x1C0017298: "__cdecl _imp_RtlGUIDFromString" __imp_RtlGUIDFromString
0x1C0017170: "__cdecl _imp_PsGetCurrentProcess" __imp_PsGetCurrentProcess
0x1C0017350: "__cdecl _imp_ZwQuerySymbolicLinkObject" __imp_ZwQuerySymbolicLinkObject
0x1C0003E28: CreateAttributesFromContext
0x1C002C984: EdppPolicyUpdateRequired
0x1C001EDB4: AiIsAppxInbox
0x1C0005B3C: SrpSetInheritedAppUniqueIdOnToken
0x1C001A128: WppLoadTracingSupport
0x1C0009540: "\SystemRoot\System32\AppLocker\M" ??_C@_1HE@EBPABKDE@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAo?$AAo?$AAt?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAA?$AAp?$AAp?$AAL?$AAo?$AAc?$AAk?$AAe?$AAr?$AA?2?$AAM@
0x1C0017110: "__cdecl _imp_ExRegisterCallback" __imp_ExRegisterCallback
0x1C002F654: HashpParsePEHeader
0x1C00175F0: "__cdecl _imp_IoWMIRegistrationControl" __imp_IoWMIRegistrationControl
0x1C00128F8: EdpAuditProviderAppLearning
0x1C001FFEC: SrpAccessCheckCommon
0x1C00239B0: AipGetTrustedPublisherName
0x1C00176AC: "__cdecl _IMPORT_DESCRIPTOR_ksecdd" __IMPORT_DESCRIPTOR_ksecdd
0x1C0023080: AiInitializeConfiguration
0x1C0005B64: SrpSetInheritedProcessUniqueIdOnToken
0x1C00170A8: "__cdecl _imp_RpcBindingBind" __imp_RpcBindingBind
0x1C00024B0: AipQueryFileHandle
0x1C00097D0: "$Kernel.Purge.Smartlocker.Valid" ??_C@_0CA@PLCACHIO@$Kernel?4Purge?4Smartlocker?4Valid?$AA@
0x1C001E7B0: SrppOpenKernelTokenHandle
0x1C0008240: "EnablePath" ??_C@_1BG@ILDIEEHN@?$AAE?$AAn?$AAa?$AAb?$AAl?$AAe?$AAP?$AAa?$AAt?$AAh?$AA?$AA@
0x1C00175D8: "__cdecl _imp_ExAcquireResourceSharedLite" __imp_ExAcquireResourceSharedLite
0x1C001C928: SrpCleanup
0x1C0028124: AipkAddEntryToAppxCache
0x1C0022C50: AipNtPathToDosPath
0x1C002BAB4: EdppIsApplicationClaimSet
0x1C00154F0: AipCertificateStore
0x1C00172F8: "__cdecl _imp_RtlAvlRemoveNode" __imp_RtlAvlRemoveNode
0x1C00093E0: "DLL" ??_C@_17JOFCMBBD@?$AAD?$AAL?$AAL?$AA?$AA@
0x1C00174A8: "__cdecl _imp_KeBugCheckEx" __imp_KeBugCheckEx
0x1C0009E90: "UsePublisherId" ??_C@_1BO@GANAGCDL@?$AAU?$AAs?$AAe?$AAP?$AAu?$AAb?$AAl?$AAi?$AAs?$AAh?$AAe?$AAr?$AAI?$AAd?$AA?$AA@
0x1C0002E8C: EdpPluginAction
0x1C00080F8: SrpAppxProcessAudited
0x1C0025E54: AiEncodeAttributeString
0x1C00171C0: "__cdecl _imp_PsProcessType" __imp_PsProcessType
0x1C002B4D8: AiGetVersionInfoFromCache
0x1C0002494: AiSetAttributes
0x1C00246B0: AipSetServicePublisherInfoInCache
0x1C000A0F8: "$KERNEL.PURGE.APPID.HASHINFO" ??_C@_0BN@IAOFDMJN@$KERNEL?4PURGE?4APPID?4HASHINFO?$AA@
0x1C0026000: AiOpenTokenByProcessId
0x1C000257C: AppHashComputeFileHashesInternal
0x1C0008078: AppIdDriverFailed
0x1C0017038: "__cdecl _imp_KeQueryPerformanceCounter" __imp_KeQueryPerformanceCounter
0x1C002B884: AipInitRpc
0x1C002E4B8: WdagPluginEvaluate
0x1C0015398: AipCertificateStoreInitialized
0x1C00175D0: "__cdecl _imp_ExReleaseResourceLite" __imp_ExReleaseResourceLite
0x1C0001DF8: WPP_SF_DDDD
0x1C00171B0: "__cdecl _imp_SeTokenObjectType" __imp_SeTokenObjectType
0x1C001AC20: AipPluginInvokeIoctlCallback
0x1C0007C30: enterpriseDataPolicyCapability
0x1C0015180: "__cdecl _security_cookie" __security_cookie
0x1C00024F0: AipReadFileHandle
0x1C0015392: IgnoreCacheUnsignedFiles
0x1C0025224: AiGetFileAttributes
0x1C00174F8: "__cdecl _imp_RtlIsSandboxedToken" __imp_RtlIsSandboxedToken
0x1C0027CF8: AiGetCatalogLastWriteTime
0x1C0025AB4: AipQueryAttributeCache
0x1C000A4D8: "PackageVersion" ??_C@_1BO@BFCMHECJ@?$AAP?$AAa?$AAc?$AAk?$AAa?$AAg?$AAe?$AAV?$AAe?$AAr?$AAs?$AAi?$AAo?$AAn?$AA?$AA@
0x1C0003B80: SrpSetIntentEnterpriseIdToken
0x1C0021068: SrpLoadPlugin
0x1C0017568: "__cdecl _imp_RtlCompareMemory" __imp_RtlCompareMemory
0x1C0009B28: "LastWriteTime" ??_C@_1BM@GFGFGIDD@?$AAL?$AAa?$AAs?$AAt?$AAW?$AAr?$AAi?$AAt?$AAe?$AAT?$AAi?$AAm?$AAe?$AA?$AA@
0x1C00252AC: AipSetEaFromOrigin
0x1C00081B0: "EtwRegisterClassicProvider" ??_C@_1DG@PFOPAIND@?$AAE?$AAt?$AAw?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAe?$AAr?$AAC?$AAl?$AAa?$AAs?$AAs?$AAi?$AAc?$AAP?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AA?$AA@
0x1C00093E8: "APPX" ??_C@_19DKBMCHGL@?$AAA?$AAP?$AAP?$AAX?$AA?$AA@
0x1C000AEF8: "AppxExempt" ??_C@_1BG@FEGMMEPM@?$AAA?$AAp?$AAp?$AAx?$AAE?$AAx?$AAe?$AAm?$AAp?$AAt?$AA?$AA@
0x1C002FB5C: SrppUnmapFileImage
0x1C00039D4: SrpSetEnterpriseContextToken
0x1C0017520: "__cdecl _imp_ExUnsubscribeWnfStateChange" __imp_ExUnsubscribeWnfStateChange
0x1C0009AB0: "\Registry\Machine\System\Current" ??_C@_1HG@GFIGAPAF@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1C000A5B8: WPP_34acfe902d3b337b5b287dd4abfaa129_Traceguids
0x1C002A674: AppHashInitHash
0x1C0027F8C: SrpIsSubjectService
0x1C002B348: AipQueryValue
0x1C0017578: "__cdecl _imp_EtwEnableTrace" __imp_EtwEnableTrace
0x1C0004B78: CalcEnterpriseIdsBufferSize
0x1C00171F8: "__cdecl _imp_EtwWrite" __imp_EtwWrite
0x1C00171A0: "__cdecl _imp__vsnwprintf" __imp__vsnwprintf
0x1C002F25C: EdppDisableAndStopSession
0x1C0005A20: SrpGetAppUniqueIdFromToken
0x1C0023194: AipFreeCert
0x1C000A3C0: WPP_b3536dd67433359e4ea29239ef3fcdb9_Traceguids
0x1C000A218: "ProgramFilesDir" ??_C@_1CA@BENHECIP@?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAF?$AAi?$AAl?$AAe?$AAs?$AAD?$AAi?$AAr?$AA?$AA@
0x1C002CB90: EdppParseEvaluateData
0x1C0030C94: "__cdecl _security_init_cookie" __security_init_cookie
0x1C000A5E8: "HashDigestLength" ??_C@_1CC@DMMMEHOM@?$AAH?$AAa?$AAs?$AAh?$AAD?$AAi?$AAg?$AAe?$AAs?$AAt?$AAL?$AAe?$AAn?$AAg?$AAt?$AAh?$AA?$AA@
0x1C0017168: "__cdecl _imp_PsGetProcessImageFileName" __imp_PsGetProcessImageFileName
0x1C0009DF0: WPP_90d97248b70a3333ed58c5cca44950a7_Traceguids
0x1C001ED34: AipGetPackageClaim
0x1C0017088: "__cdecl _imp_BCryptFinishHash" __imp_BCryptFinishHash
0x1C0008098: SrpProcessDisabled
0x1C000ABC8: "EdpDisableAudit" ??_C@_1CA@PGDHGGFN@?$AAE?$AAd?$AAp?$AAD?$AAi?$AAs?$AAa?$AAb?$AAl?$AAe?$AAA?$AAu?$AAd?$AAi?$AAt?$AA?$AA@
0x1C00175A8: "__cdecl _imp_EtwRegister" __imp_EtwRegister
0x1C00082F0: "\Registry\Machine\System\Current" ??_C@_1HE@FAHJCIPF@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1C002449C: AipSetTrustedPublisherNameInCache
0x1C00172C0: "__cdecl _imp_RtlUpcaseUnicodeString" __imp_RtlUpcaseUnicodeString
0x1C0015208: WPPTraceSuite
0x1C001EE14: SrpVerifyProcess
0x1C0017210: "__cdecl _imp_ZwDuplicateObject" __imp_ZwDuplicateObject
0x1C0017238: "__cdecl _imp_ZwSetEvent" __imp_ZwSetEvent
0x1C0020D60: SrpLoadPlugins
0x1C00153B8: AipAppxInMemoryCacheInitialized
0x1C00296B8: AiAddEaToQueryBuffer
0x1C0017510: "__cdecl _imp_ZwGetNextProcess" __imp_ZwGetNextProcess
0x1C002E0DC: EdppIsDisallowedExempt
0x1C002CD2C: EdppInheritCallersEnterpriseContext
0x1C0015540: AiPerfStats
0x1C0017280: "__cdecl _imp_RtlUnicodeStringToInt64" __imp_RtlUnicodeStringToInt64
0x1C001A0BC: AiEvaluateAppLockerPolicyClass
0x1C0023E8C: AiServiceStarted
0x1C0005154: UShortToUnicodeString
0x1C00172F0: "__cdecl _imp_ExAcquirePushLockExclusiveEx" __imp_ExAcquirePushLockExclusiveEx
0x1C0002118: AipkFreeAppxInMemoryCache
0x1C000A000: "NotBefore" ??_C@_1BE@EJMPFJDK@?$AAN?$AAo?$AAt?$AAB?$AAe?$AAf?$AAo?$AAr?$AAe?$AA?$AA@
0x1C000A040: "LifetimeSigning" ??_C@_1CA@JHBHKPGM@?$AAL?$AAi?$AAf?$AAe?$AAt?$AAi?$AAm?$AAe?$AAS?$AAi?$AAg?$AAn?$AAi?$AAn?$AAg?$AA?$AA@
0x1C0017290: "__cdecl _imp_RtlLengthSid" __imp_RtlLengthSid
0x1C0017480: "__cdecl _imp_LdrResSearchResource" __imp_LdrResSearchResource
0x1C000ACC0: "\REGISTRY\MACHINE\System\Current" ??_C@_1JE@MEEODJIG@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1C00080E8: AppIdSmartlockerEnforcementStatusFail
0x1C002D1C0: EdppCaptureProcess
0x1C001CB9C: SrpInvokePlugins
0x1C00092D0: "Enterprise Data protection plugi" ??_C@_1EE@FFOGPGC@?$AAE?$AAn?$AAt?$AAe?$AAr?$AAp?$AAr?$AAi?$AAs?$AAe?$AA?5?$AAD?$AAa?$AAt?$AAa?$AA?5?$AAp?$AAr?$AAo?$AAt?$AAe?$AAc?$AAt?$AAi?$AAo?$AAn?$AA?5?$AAp?$AAl?$AAu?$AAg?$AAi@
0x1C0009D98: "-" ??_C@_13IMODFHAA@?$AA?9?$AA?$AA@
0x1C001CCFC: SmartlockerSmartScreenRegistryIsEnabled
0x1C001D418: SmartlockerCheckEA
0x1C0005BD0: "__cdecl _report_gsfailure" __report_gsfailure
0x1C000AD60: "SeTokenSingletonAttributesConfig" ??_C@_1EC@GEAHDILE@?$AAS?$AAe?$AAT?$AAo?$AAk?$AAe?$AAn?$AAS?$AAi?$AAn?$AAg?$AAl?$AAe?$AAt?$AAo?$AAn?$AAA?$AAt?$AAt?$AAr?$AAi?$AAb?$AAu?$AAt?$AAe?$AAs?$AAC?$AAo?$AAn?$AAf?$AAi?$AAg@
0x1C0028E10: AipkLoadRegCache
0x1C00170A0: "__cdecl _imp_RpcAsyncInitializeHandle" __imp_RpcAsyncInitializeHandle
0x1C000AEB0: "ExeAllow" ??_C@_1BC@IKILGDBI@?$AAE?$AAx?$AAe?$AAA?$AAl?$AAl?$AAo?$AAw?$AA?$AA@
0x1C00173E8: "__cdecl _imp_PsQueryProcessAttributesByToken" __imp_PsQueryProcessAttributesByToken
0x1C0027EFC: SrpIsTokenService
0x1C002EC90: EdppEnableAudit
0x1C00171D0: "__cdecl _imp_ObCloseHandle" __imp_ObCloseHandle
0x1C0017208: "__cdecl _imp_IoFileObjectType" __imp_IoFileObjectType
0x1C0017608: "__cdecl _imp_ExInitializeResourceLite" __imp_ExInitializeResourceLite
0x1C0021D74: AiLogTriggerServiceStartEvent
0x1C0020990: AppLockerPluginNotifyRoutine
0x1C00096E8: "DISABLED" ??_C@_1BC@IFPGCOKD@?$AAD?$AAI?$AAS?$AAA?$AAB?$AAL?$AAE?$AAD?$AA?$AA@
0x1C000A5D8: "SHA256" ??_C@_1O@HECGKAIN@?$AAS?$AAH?$AAA?$AA2?$AA5?$AA6?$AA?$AA@
0x1C0017200: "__cdecl _imp_SeGetLogonSessionToken" __imp_SeGetLogonSessionToken
0x1C0017660: "__cdecl _imp_MmMapViewOfSection" __imp_MmMapViewOfSection
0x1C0008038: AppIdSmartlockerEnforcementStatusSuccess
0x1C0001C4C: AiResetPerfTimeCounter
0x1C001B4B0: AiAddProcToTrackedList
0x1C00243AC: AiSetSigningLevelCache
0x1C002DE94: EdppPolicyExempt
0x1C0017680: ntoskrnl_NULL_THUNK_DATA
0x1C00170F8: "__cdecl _imp_ExFreePoolWithTag" __imp_ExFreePoolWithTag
0x1C0017368: "__cdecl _imp_KeEnterCriticalRegion" __imp_KeEnterCriticalRegion
0x1C0012BB0: "MICROSOFTEDPENLIGHTENEDAPPINFO" ??_C@_1DO@EHBEOCFC@?$AAM?$AAI?$AAC?$AAR?$AAO?$AAS?$AAO?$AAF?$AAT?$AAE?$AAD?$AAP?$AAE?$AAN?$AAL?$AAI?$AAG?$AAH?$AAT?$AAE?$AAN?$AAE?$AAD?$AAA?$AAP?$AAP?$AAI?$AAN?$AAF?$AAO?$AA?$AA@
0x1C001A080: AipCleanupPluginsCallback
0x1C00082A0: "EnableSha1Hash" ??_C@_1BO@DPDIHHLK@?$AAE?$AAn?$AAa?$AAb?$AAl?$AAe?$AAS?$AAh?$AAa?$AA1?$AAH?$AAa?$AAs?$AAh?$AA?$AA@
0x1C0017258: "__cdecl _imp_ZwOpenFile" __imp_ZwOpenFile
0x1C000AC50: WNF_EDP_PURGE_APP_LEARNING_EVT
0x1C00173B8: "__cdecl _imp_RtlEndEnumerationHashTable" __imp_RtlEndEnumerationHashTable
0x1C00151A8: AiCategoryExe
0x1C002E8F0: KappxParsePackageFullNameFromToken
0x1C0017420: "__cdecl _imp_RtlSetDaclSecurityDescriptor" __imp_RtlSetDaclSecurityDescriptor
0x1C000AC58: WNF_EDP_ENTERPRISE_CONTEXTS_UPDATED
0x1C0017650: "__cdecl _imp_ZwOpenSymbolicLinkObject" __imp_ZwOpenSymbolicLinkObject
0x1C0030054: DriverEntry
0x1C00171E8: "__cdecl _imp_ZwSetCachedSigningLevel" __imp_ZwSetCachedSigningLevel
0x1C0002994: AiVerifyFile
0x1C001A108: AiResultIsExplicitDeny
0x1C001CF68: SmartlockerManagedInstallerCheck
0x1C0015090: AipDefaultAttributesArray
0x1C00171E0: "__cdecl _imp_ZwGetCachedSigningLevel" __imp_ZwGetCachedSigningLevel
0x1C00172C8: "__cdecl _imp_RtlAvlInsertNodeEx" __imp_RtlAvlInsertNodeEx
0x1C001D07C: SmartlockerSmartscreenProcessTokenCheck
0x1C000AFD0: "DataContext" ??_C@_1BI@LHLCLPLK@?$AAD?$AAa?$AAt?$AAa?$AAC?$AAo?$AAn?$AAt?$AAe?$AAx?$AAt?$AA?$AA@
0x1C0029E60: AiGetPlugins
0x1C00173C8: "__cdecl _imp_RtlLookupEntryHashTable" __imp_RtlLookupEntryHashTable
0x1C0005848: SrpGetAttributeFromToken
0x1C002679C: AiInitializePathMacroList
0x1C0015228: pfnWppTraceMessage
0x1C0017440: "__cdecl _imp_ZwOpenKey" __imp_ZwOpenKey
0x1C001A4C4: WppInitKm
0x1C001CE44: SmartlockerConstructOriginClaim
0x1C0017670: "__cdecl _imp_ZwCreateSection" __imp_ZwCreateSection
0x1C0017040: HAL_NULL_THUNK_DATA
0x1C00153D4: g_SymCryptFlags
0x1C0001E68: WPP_SF_s
0x1C00061C0: memset
0x1C0017724: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x1C0021C90: AiLogFileAndStatusEvent
0x1C0001AB8: RtlStringCchPrintfW
0x1C00204F0: SrppPolicyChangeCallback
0x1C0020C34: SrpLoadPolicy
0x1C00151B8: AiCategoryAppx
0x1C00014A4: SrpGetPluginPolicy

[JEB Decompiler by PNF Software]