PDB Symbols - AuditShD.exe (0xAC9284E17FEB93F313FA31B5B62CF6E6743F0DF3797C3D513E6FD3E55382115F)

Generated by JEB on 2019/08/01

PE: C:\Windows\System32\oobe\AuditShD.exe Base=0x140000000 SHA-256=AC9284E17FEB93F313FA31B5B62CF6E6743F0DF3797C3D513E6FD3E55382115F
PDB: AuditShD.pdb GUID={6C0ABE2C-7459-9AA7-84AC20CA0056354B} Age=1

322 located named symbols:
0x140002CAC: ParseUncPath
0x140006790: "ConstructPartialMsgVA" ??_C@_0BG@HIFPNDJH@ConstructPartialMsgVA?$AA@
0x1400051B0: "__cdecl _imp_UnregisterTraceGuids" __imp_UnregisterTraceGuids
0x140002BA0: BuildPathHr
0x140005F20: "WaitForStartScreen: Start screen" ??_C@_1FG@KJHOPCFM@?$AAW?$AAa?$AAi?$AAt?$AAF?$AAo?$AAr?$AAS?$AAt?$AAa?$AAr?$AAt?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AA?3?$AA?5?$AAS?$AAt?$AAa?$AAr?$AAt?$AA?5?$AAs?$AAc?$AAr?$AAe?$AAe?$AAn@
0x140006980: "\\?\UNC" ??_C@_1BA@BFGBFLGI@?$AA?2?$AA?2?$AA?$DP?$AA?2?$AAU?$AAN?$AAC?$AA?$AA@
0x1400042BC: "__cdecl _raise_securityfailure" __raise_securityfailure
0x140006AC0: "api-ms-win-eventing-provider-l1-" ??_C@_1FA@IOGJNGGM@?$AAa?$AAp?$AAi?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAe?$AAv?$AAe?$AAn?$AAt?$AAi?$AAn?$AAg?$AA?9?$AAp?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AA?9?$AAl?$AA1?$AA?9@
0x140004030: "__cdecl FindPESection" _FindPESection
0x140005480: "__cdecl _imp_CoInitializeEx" __imp_CoInitializeEx
0x140006130: "WaitForStartScreen: App visibili" ??_C@_1JO@PNJDPFPD@?$AAW?$AAa?$AAi?$AAt?$AAF?$AAo?$AAr?$AAS?$AAt?$AAa?$AAr?$AAt?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AA?3?$AA?5?$AAA?$AAp?$AAp?$AA?5?$AAv?$AAi?$AAs?$AAi?$AAb?$AAi?$AAl?$AAi@
0x14000725C: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x1400011E0: "__cdecl wsetargv" _wsetargv
0x140008070: "__cdecl _security_cookie_complement" __security_cookie_complement
0x140005238: "__cdecl _imp_RaiseException" __imp_RaiseException
0x140005C20: "Failed to enable calls to SetFor" ??_C@_1HC@BGEPKGHD@?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAe?$AAn?$AAa?$AAb?$AAl?$AAe?$AA?5?$AAc?$AAa?$AAl?$AAl?$AAs?$AA?5?$AAt?$AAo?$AA?5?$AAS?$AAe?$AAt?$AAF?$AAo?$AAr@
0x1400053E0: "__cdecl _imp___wgetmainargs" __imp___wgetmainargs
0x140006B40: Microsoft_Windows_Deplorch
0x1400086DC: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUwhUhvxfirgbUorxvmhrmtUhkkUkpvbUkpvbrmhghUoryUlyquivUznwGEUhgwzucOlyq@pkeyinsts" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUwhUhvxfirgbUorxvmhrmtUhkkUkpvbUkpvbrmhghUoryUlyquivUznwGEUhgwzucOlyq@pkeyinsts
0x1400052A8: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x140004477: "__cdecl _CxxFrameHandler3" __CxxFrameHandler3
0x140005200: "__cdecl _imp_LookupAccountSidW" __imp_LookupAccountSidW
0x1400045D0: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x140006730: "WdsGenericSetupLogInit" ??_C@_0BH@OICHNGNB@WdsGenericSetupLogInit?$AA@
0x1400066F0: "__cdecl GUID_00000000_0000_0000_c000_000000000046" _GUID_00000000_0000_0000_c000_000000000046
0x140006B80: "EtwEventEnabled" ??_C@_0BA@MIAFEPPA@EtwEventEnabled?$AA@
0x140006990: "CreatePath: Unable to create [%s" ??_C@_1FM@OFCLJDAE@?$AAC?$AAr?$AAe?$AAa?$AAt?$AAe?$AAP?$AAa?$AAt?$AAh?$AA?3?$AA?5?$AAU?$AAn?$AAa?$AAb?$AAl?$AAe?$AA?5?$AAt?$AAo?$AA?5?$AAc?$AAr?$AAe?$AAa?$AAt?$AAe?$AA?5?$AA?$FL?$AA?$CF?$AAs@
0x1400065F0: "WaitForStartScreen: Failed to ge" ??_C@_1IG@PIPBCIPF@?$AAW?$AAa?$AAi?$AAt?$AAF?$AAo?$AAr?$AAS?$AAt?$AAa?$AAr?$AAt?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AA?3?$AA?5?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAg?$AAe@
0x1400080A8: "__cdecl commode" _commode
0x140005660: "Could not allocate memory for cu" ??_C@_1GA@LHEKNPDJ@?$AAC?$AAo?$AAu?$AAl?$AAd?$AA?5?$AAn?$AAo?$AAt?$AA?5?$AAa?$AAl?$AAl?$AAo?$AAc?$AAa?$AAt?$AAe?$AA?5?$AAm?$AAe?$AAm?$AAo?$AAr?$AAy?$AA?5?$AAf?$AAo?$AAr?$AA?5?$AAc?$AAu@
0x140008640: g_WdsNativeLibLog
0x140005890: "This is not audit mode; will not" ??_C@_1FM@MLIBDDGB@?$AAT?$AAh?$AAi?$AAs?$AA?5?$AAi?$AAs?$AA?5?$AAn?$AAo?$AAt?$AA?5?$AAa?$AAu?$AAd?$AAi?$AAt?$AA?5?$AAm?$AAo?$AAd?$AAe?$AA?$DL?$AA?5?$AAw?$AAi?$AAl?$AAl?$AA?5?$AAn?$AAo?$AAt@
0x140001E00: "public: virtual void * __ptr64 __cdecl Microsoft::WRL::RuntimeClass<struct Microsoft::WRL::RuntimeClassFlags<2>,struct IAppVisibilityEvents>::`vector deleting destructor'(unsigned int) __ptr64" ??_E?$RuntimeClass@U?$RuntimeClassFlags@$01@WRL@Microsoft@@UIAppVisibilityEvents@@@WRL@Microsoft@@UEAAPEAXI@Z
0x140005430: "__cdecl _imp_wcschr" __imp_wcschr
0x140005248: "__cdecl _imp_SetEvent" __imp_SetEvent
0x140005488: ole32_NULL_THUNK_DATA
0x140003F10: "long __cdecl __CxxUnhandledExceptionFilter(struct _EXCEPTION_POINTERS * __ptr64)" ?__CxxUnhandledExceptionFilter@@YAJPEAU_EXCEPTION_POINTERS@@@Z
0x140005498: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x140006B10: "EventWrite" ??_C@_0L@JMEHOADM@EventWrite?$AA@
0x1400080B4: "__cdecl fmode" _fmode
0x1400052F8: "__cdecl _imp_InitializeCriticalSection" __imp_InitializeCriticalSection
0x140005428: "__cdecl _imp__wcsnicmp" __imp__wcsnicmp
0x140005220: "__cdecl _imp_GetModuleHandleExW" __imp_GetModuleHandleExW
0x1400060B0: "WaitForStartScreen: Waiting for " ??_C@_1HC@MJJODJGD@?$AAW?$AAa?$AAi?$AAt?$AAF?$AAo?$AAr?$AAS?$AAt?$AAa?$AAr?$AAt?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AA?3?$AA?5?$AAW?$AAa?$AAi?$AAt?$AAi?$AAn?$AAg?$AA?5?$AAf?$AAo?$AAr?$AA?5@
0x140003F6E: "__cdecl XcptFilter" _XcptFilter
0x1400054A0: "__cdecl _xc_a" __xc_a
0x1400056C0: "Failed to get the build-in admin" ??_C@_1HG@HGHLKACK@?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAg?$AAe?$AAt?$AA?5?$AAt?$AAh?$AAe?$AA?5?$AAb?$AAu?$AAi?$AAl?$AAd?$AA?9?$AAi?$AAn?$AA?5?$AAa?$AAd?$AAm?$AAi?$AAn@
0x140006A98: "advapi32.dll" ??_C@_1BK@JHLNAEJL@?$AAa?$AAd?$AAv?$AAa?$AAp?$AAi?$AA3?$AA2?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x140001D80: "public: virtual long __cdecl Microsoft::WRL::Details::RuntimeClassImpl<struct Microsoft::WRL::RuntimeClassFlags<2>,1,0,0,struct IAppVisibilityEvents>::QueryInterface(struct _GUID const & __ptr64,void * __ptr64 * __ptr64) __ptr64" ?QueryInterface@?$RuntimeClassImpl@U?$RuntimeClassFlags@$01@WRL@Microsoft@@$00$0A@$0A@UIAppVisibilityEvents@@@Details@WRL@Microsoft@@UEAAJAEBU_GUID@@PEAPEAX@Z
0x1400086C8: PfnEventUnregister
0x1400086A8: McGenPreVista
0x14000266C: StringCchCopyW
0x140008058: g_ProviderRegistrationMicrosoft_Windows_Deplorch
0x140005AE0: "The wait for start screen expire" ??_C@_1GI@JMECPMB@?$AAT?$AAh?$AAe?$AA?5?$AAw?$AAa?$AAi?$AAt?$AA?5?$AAf?$AAo?$AAr?$AA?5?$AAs?$AAt?$AAa?$AAr?$AAt?$AA?5?$AAs?$AAc?$AAr?$AAe?$AAe?$AAn?$AA?5?$AAe?$AAx?$AAp?$AAi?$AAr?$AAe@
0x140004483: "__cdecl lock" _lock
0x140004515: "__cdecl callnewh" _callnewh
0x140006860: "onecore\base\ntsetup\lib\unatten" ??_C@_1HC@PLEDFMHN@?$AAo?$AAn?$AAe?$AAc?$AAo?$AAr?$AAe?$AA?2?$AAb?$AAa?$AAs?$AAe?$AA?2?$AAn?$AAt?$AAs?$AAe?$AAt?$AAu?$AAp?$AA?2?$AAl?$AAi?$AAb?$AA?2?$AAu?$AAn?$AAa?$AAt?$AAt?$AAe?$AAn@
0x140005568: "__cdecl _guard_iat_table" __guard_iat_table
0x1400045A9: memcpy
0x140002BFC: FormFullPathName
0x140005318: "__cdecl _imp_LoadLibraryExW" __imp_LoadLibraryExW
0x140005400: "__cdecl _imp_memset" __imp_memset
0x1400058F0: "ShellDesktopSwitchEvent" ??_C@_1DA@JNJPEACF@?$AAS?$AAh?$AAe?$AAl?$AAl?$AAD?$AAe?$AAs?$AAk?$AAt?$AAo?$AAp?$AAS?$AAw?$AAi?$AAt?$AAc?$AAh?$AAE?$AAv?$AAe?$AAn?$AAt?$AA?$AA@
0x140005260: "__cdecl _imp_CreateEventW" __imp_CreateEventW
0x1400041EF: "__cdecl initterm" _initterm
0x140006970: Microsoft_Windows_DeplorchKeywords
0x140005BA0: "SendInput failed to send 'Win+D'" ??_C@_1IA@FEMOIGME@?$AAS?$AAe?$AAn?$AAd?$AAI?$AAn?$AAp?$AAu?$AAt?$AA?5?$AAf?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAs?$AAe?$AAn?$AAd?$AA?5?$AA?8?$AAW?$AAi?$AAn?$AA?$CL?$AAD?$AA?8@
0x140008750: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x140005258: "__cdecl _imp_Sleep" __imp_Sleep
0x1400055B8: "AuditShowDesktopEvent" ??_C@_1CM@HJPIMLIN@?$AAA?$AAu?$AAd?$AAi?$AAt?$AAS?$AAh?$AAo?$AAw?$AAD?$AAe?$AAs?$AAk?$AAt?$AAo?$AAp?$AAE?$AAv?$AAe?$AAn?$AAt?$AA?$AA@
0x1400054F0: "__cdecl _xi_z" __xi_z
0x1400055A0: CLSID_AppVisibility
0x1400052C0: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x140003E88: "__cdecl _C_specific_handler" __C_specific_handler
0x140005370: "__cdecl _imp__onexit" __imp__onexit
0x140005278: "__cdecl _imp_HeapFree" __imp_HeapFree
0x140005040: "const Microsoft::WRL::RuntimeClass<struct Microsoft::WRL::RuntimeClassFlags<2>,struct IAppVisibilityEvents>::`vftable'" ??_7?$RuntimeClass@U?$RuntimeClassFlags@$01@WRL@Microsoft@@UIAppVisibilityEvents@@@WRL@Microsoft@@6B@
0x140006A78: "\\" ??_C@_15LEKKCGMK@?$AA?2?$AA?2?$AA?$AA@
0x140001E00: "public: virtual void * __ptr64 __cdecl Microsoft::WRL::RuntimeClass<struct Microsoft::WRL::RuntimeClassFlags<2>,struct IAppVisibilityEvents>::`scalar deleting destructor'(unsigned int) __ptr64" ??_G?$RuntimeClass@U?$RuntimeClassFlags@$01@WRL@Microsoft@@UIAppVisibilityEvents@@@WRL@Microsoft@@UEAAPEAXI@Z
0x1400011F0: "public: virtual long __cdecl CAppVisibilityNotificationSubscriber::LauncherVisibilityChange(int) __ptr64" ?LauncherVisibilityChange@CAppVisibilityNotificationSubscriber@@UEAAJH@Z
0x140004509: malloc
0x140002228: UnattendInitializeLogEx2
0x140001D60: "public: virtual unsigned long __cdecl Microsoft::WRL::Details::RuntimeClassImpl<struct Microsoft::WRL::RuntimeClassFlags<2>,1,0,0,struct IAppVisibilityEvents>::AddRef(void) __ptr64" ?AddRef@?$RuntimeClassImpl@U?$RuntimeClassFlags@$01@WRL@Microsoft@@$00$0A@$0A@UIAppVisibilityEvents@@@Details@WRL@Microsoft@@UEAAKXZ
0x140005CF0: "Failed to show the desktop" ??_C@_1DG@BLINMBMK@?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAs?$AAh?$AAo?$AAw?$AA?5?$AAt?$AAh?$AAe?$AA?5?$AAd?$AAe?$AAs?$AAk?$AAt?$AAo?$AAp?$AA?$AA@
0x1400051B8: "__cdecl _imp_RegCloseKey" __imp_RegCloseKey
0x140004548: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x140006978: Microsoft_Windows_DeplorchLevels
0x140006550: "WaitForStartScreen: Failed to in" ??_C@_1JE@FKFMLLHD@?$AAW?$AAa?$AAi?$AAt?$AAF?$AAo?$AAr?$AAS?$AAt?$AAa?$AAr?$AAt?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AA?3?$AA?5?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAi?$AAn@
0x140005450: "__cdecl _imp_RtlAllocateHeap" __imp_RtlAllocateHeap
0x140006B30: "EventUnregister" ??_C@_0BA@FAKLIPIC@EventUnregister?$AA@
0x140004023: "__cdecl amsg_exit" _amsg_exit
0x140005360: "__cdecl _imp__callnewh" __imp__callnewh
0x1400067D0: "%windir%\Panther\UnattendGC" ??_C@_1DI@MEGHDGIK@?$AA?$CF?$AAw?$AAi?$AAn?$AAd?$AAi?$AAr?$AA?$CF?$AA?2?$AAP?$AAa?$AAn?$AAt?$AAh?$AAe?$AAr?$AA?2?$AAU?$AAn?$AAa?$AAt?$AAt?$AAe?$AAn?$AAd?$AAG?$AAC?$AA?$AA@
0x1400057D0: "Current user name is [%s], while" ??_C@_1LI@CDANODKD@?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AA?5?$AAu?$AAs?$AAe?$AAr?$AA?5?$AAn?$AAa?$AAm?$AAe?$AA?5?$AAi?$AAs?$AA?5?$AA?$FL?$AA?$CF?$AAs?$AA?$FN?$AA?0?$AA?5?$AAw?$AAh?$AAi?$AAl?$AAe@
0x140005598: "struct std::nothrow_t const std::nothrow" ?nothrow@std@@3Unothrow_t@1@B
0x1400053D0: "__cdecl _imp_exit" __imp_exit
0x140005388: "__cdecl _imp__lock" __imp__lock
0x140004290: atexit
0x140006B50: "EtwEventRegister" ??_C@_0BB@DHHHEAKO@EtwEventRegister?$AA@
0x140005478: "__cdecl _imp_CoUninitialize" __imp_CoUninitialize
0x1400051D8: "__cdecl _imp_GetSidLengthRequired" __imp_GetSidLengthRequired
0x1400052E0: "__cdecl _imp_EnterCriticalSection" __imp_EnterCriticalSection
0x1400068D8: "AuditBoot" ??_C@_1BE@OLOLOOKB@?$AAA?$AAu?$AAd?$AAi?$AAt?$AAB?$AAo?$AAo?$AAt?$AA?$AA@
0x140005190: "__cdecl _imp_GetTraceLoggerHandle" __imp_GetTraceLoggerHandle
0x1400051A0: "__cdecl _imp_GetTraceEnableLevel" __imp_GetTraceEnableLevel
0x140005348: "__cdecl _imp_LockSetForegroundWindow" __imp_LockSetForegroundWindow
0x140003AFC: StrStartsWithIC
0x1400086D4: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUmghvgfkUoryUhpforyUhixUlyquivUznwGEUhgwzucOlyq@skulib" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUmghvgfkUoryUhpforyUhixUlyquivUznwGEUhgwzucOlyq@skulib
0x1400052C8: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x14000449B: "__cdecl _dllonexit" __dllonexit
0x140008740: "__cdecl _native_startup_lock" __native_startup_lock
0x140006300: "WaitForStartScreen: Failed to ge" ??_C@_1MG@OAAEKBNP@?$AAW?$AAa?$AAi?$AAt?$AAF?$AAo?$AAr?$AAS?$AAt?$AAa?$AAr?$AAt?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AA?3?$AA?5?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAg?$AAe@
0x140003F50: "__cdecl _CxxSetUnhandledExceptionFilter" __CxxSetUnhandledExceptionFilter
0x140005408: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x140005458: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x140005338: KERNEL32_NULL_THUNK_DATA
0x1400086D0: McGenTracingSupportInit
0x140005250: "__cdecl _imp_GetLastError" __imp_GetLastError
0x1400044B8: "void * __ptr64 __cdecl operator new(unsigned __int64)" ??2@YAPEAX_K@Z
0x140004524: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x1400053A0: "__cdecl _imp__commode" __imp__commode
0x1400053B8: "__cdecl _imp___setusermatherr" __imp___setusermatherr
0x1400071F8: "__cdecl _IMPORT_DESCRIPTOR_ADVAPI32" __IMPORT_DESCRIPTOR_ADVAPI32
0x1400052A0: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x140005270: "__cdecl _imp_WaitForSingleObject" __imp_WaitForSingleObject
0x1400040E0: "__cdecl ValidateImageBase" _ValidateImageBase
0x1400051E0: "__cdecl _imp_LsaQueryInformationPolicy" __imp_LsaQueryInformationPolicy
0x140006720: "WdsSetupLogInit" ??_C@_0BA@EGFDPMGD@WdsSetupLogInit?$AA@
0x140003EC4: "void * __ptr64 __cdecl operator new(unsigned __int64,struct std::nothrow_t const & __ptr64)" ??2@YAPEAX_KAEBUnothrow_t@std@@@Z
0x140005448: "__cdecl _imp_RtlFreeHeap" __imp_RtlFreeHeap
0x1400011E0: "public: virtual long __cdecl CAppVisibilityNotificationSubscriber::AppVisibilityOnMonitorChanged(struct HMONITOR__ * __ptr64,enum MONITOR_APP_VISIBILITY,enum MONITOR_APP_VISIBILITY) __ptr64" ?AppVisibilityOnMonitorChanged@CAppVisibilityNotificationSubscriber@@UEAAJPEAUHMONITOR__@@W4MONITOR_APP_VISIBILITY@@1@Z
0x140008710: "protected: static struct CEtwProviderT<void>::CETWApiSet CEtwProviderT<void>::g_etwApi" ?g_etwApi@?$CEtwProviderT@X@@1UCETWApiSet@1@A
0x1400055B0: "\" ??_C@_13FPGAJAPJ@?$AA?2?$AA?$AA@
0x140005230: "__cdecl _imp_HeapAlloc" __imp_HeapAlloc
0x140007234: "__cdecl _IMPORT_DESCRIPTOR_ole32" __IMPORT_DESCRIPTOR_ole32
0x140005310: "__cdecl _imp_FreeLibrary" __imp_FreeLibrary
0x140005280: "__cdecl _imp_CompareStringW" __imp_CompareStringW
0x140006270: "WaitForStartScreen: Failed to wa" ??_C@_1IO@HHEILFIG@?$AAW?$AAa?$AAi?$AAt?$AAF?$AAo?$AAr?$AAS?$AAt?$AAa?$AAr?$AAt?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AA?3?$AA?5?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAw?$AAa@
0x1400080B0: "__cdecl newmode" _newmode
0x1400051D0: "__cdecl _imp_GetSidSubAuthority" __imp_GetSidSubAuthority
0x1400053B0: "__cdecl _imp__initterm" __imp__initterm
0x1400053D8: "__cdecl _imp___set_app_type" __imp___set_app_type
0x140002E18: AllocateExpand
0x1400052D8: "__cdecl _imp_SetLastError" __imp_SetLastError
0x140003670: RegGetDword
0x1400052E8: "__cdecl _imp_GetModuleFileNameW" __imp_GetModuleFileNameW
0x140005218: "__cdecl _imp_GetVersionExW" __imp_GetVersionExW
0x140001EF0: GetNameFromSID
0x140008730: "__cdecl _onexitend" __onexitend
0x1400053C8: "__cdecl _imp__exit" __imp__exit
0x14000448F: "__cdecl unlock" _unlock
0x140005490: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x140005740: "Failed to get the build-in admin" ??_C@_1IK@ILABGBFH@?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAg?$AAe?$AAt?$AA?5?$AAt?$AAh?$AAe?$AA?5?$AAb?$AAu?$AAi?$AAl?$AAd?$AA?9?$AAi?$AAn?$AA?5?$AAa?$AAd?$AAm?$AAi?$AAn@
0x1400052D0: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x140005350: USER32_NULL_THUNK_DATA
0x14000386C: BuildPath
0x1400054D8: "__cdecl _xi_a" __xi_a
0x1400086C0: Microsoft_Windows_DeplorchEnableBits
0x1400052B8: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x1400011E0: "__cdecl matherr" _matherr
0x140005380: "__cdecl _imp__unlock" __imp__unlock
0x1400012A8: wmain
0x140006778: "WdsSetupLogMessageW" ??_C@_0BE@PMAMNFBG@WdsSetupLogMessageW?$AA@
0x1400068D4: "D" ??_C@_13MKMNOPIJ@?$AAD?$AA?$AA@
0x140006820: "<unknown>" ??_C@_1BE@ELICABCK@?$AA?$DM?$AAu?$AAn?$AAk?$AAn?$AAo?$AAw?$AAn?$AA?$DO?$AA?$AA@
0x140001250: "private: virtual void * __ptr64 __cdecl CAppVisibilityNotificationSubscriber::`scalar deleting destructor'(unsigned int) __ptr64" ??_GCAppVisibilityNotificationSubscriber@@EEAAPEAXI@Z
0x1400067A8: "ConstructPartialMsgVW" ??_C@_0BG@GEMHGGEA@ConstructPartialMsgVW?$AA@
0x140005378: "__cdecl _imp___dllonexit" __imp___dllonexit
0x140005A80: "The shell desktop switch event w" ??_C@_1FI@IMGCAFGG@?$AAT?$AAh?$AAe?$AA?5?$AAs?$AAh?$AAe?$AAl?$AAl?$AA?5?$AAd?$AAe?$AAs?$AAk?$AAt?$AAo?$AAp?$AA?5?$AAs?$AAw?$AAi?$AAt?$AAc?$AAh?$AA?5?$AAe?$AAv?$AAe?$AAn?$AAt?$AA?5?$AAw@
0x140005F80: "WaitForStartScreen: Start screen" ??_C@_1KA@OEKFEBNL@?$AAW?$AAa?$AAi?$AAt?$AAF?$AAo?$AAr?$AAS?$AAt?$AAa?$AAr?$AAt?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AA?3?$AA?5?$AAS?$AAt?$AAa?$AAr?$AAt?$AA?5?$AAs?$AAc?$AAr?$AAe?$AAe?$AAn@
0x140003B64: "void __cdecl operator delete(void * __ptr64)" ??3@YAXPEAX@Z
0x14000278C: PrepareUnicodePath
0x140005308: "__cdecl _imp_DeleteCriticalSection" __imp_DeleteCriticalSection
0x140005418: "__cdecl _imp__vsnprintf" __imp__vsnprintf
0x1400051C0: "__cdecl _imp_LsaFreeMemory" __imp_LsaFreeMemory
0x140005920: "Failed to open the shell desktop" ??_C@_1HC@BBIOGACL@?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAo?$AAp?$AAe?$AAn?$AA?5?$AAt?$AAh?$AAe?$AA?5?$AAs?$AAh?$AAe?$AAl?$AAl?$AA?5?$AAd?$AAe?$AAs?$AAk?$AAt?$AAo?$AAp@
0x140003EA0: "__cdecl _security_check_cookie" __security_check_cookie
0x1400067C0: "CurrentIP" ??_C@_09BJNIHBEK@CurrentIP?$AA@
0x1400054D0: "__cdecl _xc_z" __xc_z
0x140005300: "__cdecl _imp_GetProcAddress" __imp_GetProcAddress
0x1400063D0: "WaitForStartScreen: Failed to un" ??_C@_1LK@CCFLJBOD@?$AAW?$AAa?$AAi?$AAt?$AAF?$AAo?$AAr?$AAS?$AAt?$AAa?$AAr?$AAt?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AA?3?$AA?5?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAu?$AAn@
0x140005340: "__cdecl _imp_SendInput" __imp_SendInput
0x1400086B0: PfnEventWrite
0x140005390: "__cdecl _imp_?terminate@@YAXXZ" __imp_?terminate@@YAXXZ
0x140005470: "__cdecl _imp_CoCreateInstance" __imp_CoCreateInstance
0x1400052B0: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x140006808: "wdscore.dll" ??_C@_1BI@LOLJMEGL@?$AAw?$AAd?$AAs?$AAc?$AAo?$AAr?$AAe?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x140005228: "__cdecl _imp_GetProcessHeap" __imp_GetProcessHeap
0x1400086C4: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUmghvgfkUoryUwvkolixsUhixUlyquivUznwGEUkxsOlyq@DeplOrch" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUmghvgfkUoryUwvkolixsUhixUlyquivUznwGEUkxsOlyq@DeplOrch
0x140003170: McGenEventTracingRegister
0x1400029B4: CreatePath
0x140005330: "__cdecl _imp_CreateDirectoryW" __imp_CreateDirectoryW
0x1400051F8: "__cdecl _imp_LsaClose" __imp_LsaClose
0x1400054F8: "__cdecl _guard_fids_table" __guard_fids_table
0x140005438: msvcrt_NULL_THUNK_DATA
0x140005070: "__cdecl load_config_used" _load_config_used
0x140005010: "const CAppVisibilityNotificationSubscriber::`vftable'" ??_7CAppVisibilityNotificationSubscriber@@6B@
0x140006760: "WdsSetupLogMessageA" ??_C@_0BE@OAJEGAMB@WdsSetupLogMessageA?$AA@
0x140001250: "private: virtual void * __ptr64 __cdecl CAppVisibilityNotificationSubscriber::`vector deleting destructor'(unsigned int) __ptr64" ??_ECAppVisibilityNotificationSubscriber@@EEAAPEAXI@Z
0x140006710: "__cdecl GUID_6584ce6b_7d82_49c2_89c9_c6bc02ba8c38" _GUID_6584ce6b_7d82_49c2_89c9_c6bc02ba8c38
0x1400059A0: "Waiting for the shell desktop sw" ??_C@_1FG@LGKJIIED@?$AAW?$AAa?$AAi?$AAt?$AAi?$AAn?$AAg?$AA?5?$AAf?$AAo?$AAr?$AA?5?$AAt?$AAh?$AAe?$AA?5?$AAs?$AAh?$AAe?$AAl?$AAl?$AA?5?$AAd?$AAe?$AAs?$AAk?$AAt?$AAo?$AAp?$AA?5?$AAs?$AAw@
0x140005268: "__cdecl _imp_OpenEventW" __imp_OpenEventW
0x140007248: "__cdecl _IMPORT_DESCRIPTOR_USER32" __IMPORT_DESCRIPTOR_USER32
0x140005A00: "Failed to wait for the shell des" ??_C@_1HK@MKMDJKEB@?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAw?$AAa?$AAi?$AAt?$AA?5?$AAf?$AAo?$AAr?$AA?5?$AAt?$AAh?$AAe?$AA?5?$AAs?$AAh?$AAe?$AAl?$AAl?$AA?5?$AAd?$AAe?$AAs@
0x1400053E8: "__cdecl _imp__amsg_exit" __imp__amsg_exit
0x1400055F0: "Failed to get the current user n" ??_C@_1GE@JCJBGMCJ@?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAg?$AAe?$AAt?$AA?5?$AAt?$AAh?$AAe?$AA?5?$AAc?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AA?5?$AAu?$AAs?$AAe?$AAr?$AA?5?$AAn@
0x140003740: StringCchCopyNExW
0x140002048: "long __cdecl StringCchPrintfA(char * __ptr64,unsigned __int64,char const * __ptr64,...)" ?StringCchPrintfA@@YAJPEAD_KPEBDZZ
0x140005460: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x140005298: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x1400080AC: "__cdecl dowildcard" _dowildcard
0x140006020: "WaitForStartScreen: Failed to op" ??_C@_1IO@BPBLEFKL@?$AAW?$AAa?$AAi?$AAt?$AAF?$AAo?$AAr?$AAS?$AAt?$AAa?$AAr?$AAt?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AA?3?$AA?5?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAo?$AAp@
0x140001E2C: ??$Make@VCAppVisibilityNotificationSubscriber@@$$V@Details@WRL@Microsoft@@YA?AV?$ComPtr@VCAppVisibilityNotificationSubscriber@@@12@XZ
0x140003EFC: free
0x140005440: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x140003EF0: "__cdecl purecall" _purecall
0x140005B50: "Sending 'Win+D' to show the desk" ??_C@_1EI@LAGPBDFL@?$AAS?$AAe?$AAn?$AAd?$AAi?$AAn?$AAg?$AA?5?$AA?8?$AAW?$AAi?$AAn?$AA?$CL?$AAD?$AA?8?$AA?5?$AAt?$AAo?$AA?5?$AAs?$AAh?$AAo?$AAw?$AA?5?$AAt?$AAh?$AAe?$AA?5?$AAd?$AAe?$AAs?$AAk@
0x1400044F8: "__cdecl _std_terminate" __std_terminate
0x1400026F4: StringCchCopyNW
0x1400035B0: RegExists
0x140005178: "__cdecl _imp_GetUserNameW" __imp_GetUserNameW
0x1400042B0: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x140005210: "__cdecl _imp_ExpandEnvironmentStringsW" __imp_ExpandEnvironmentStringsW
0x140006840: "UnattendLogWV" ??_C@_1BM@PPHHDPAK@?$AAU?$AAn?$AAa?$AAt?$AAt?$AAe?$AAn?$AAd?$AAL?$AAo?$AAg?$AAW?$AAV?$AA?$AA@
0x140005420: "__cdecl _imp_wcsrchr" __imp_wcsrchr
0x140003F7C: RtlpImageNtHeader
0x1400086D8: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUwhUhvxfirgbUorxvmhrmtUhkkUkpvbrmhgUoryUlyquivUznwGEUhgwzucOlyq@pkeyinst" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUwhUhvxfirgbUorxvmhrmtUhkkUkpvbrmhgUoryUlyquivUznwGEUhgwzucOlyq@pkeyinst
0x140006748: "WdsSetupLogDestroy" ??_C@_0BD@EHPFJNKD@WdsSetupLogDestroy?$AA@
0x140005290: "__cdecl _imp_GetModuleHandleW" __imp_GetModuleHandleW
0x1400051F0: "__cdecl _imp_LsaOpenPolicy" __imp_LsaOpenPolicy
0x140008000: PfnEventRegister
0x140006B68: "EtwEventUnregister" ??_C@_0BD@JDHMJNFM@EtwEventUnregister?$AA@
0x1400053F0: "__cdecl _imp__XcptFilter" __imp__XcptFilter
0x140005468: ntdll_NULL_THUNK_DATA
0x140005358: "__cdecl _imp_memcpy" __imp_memcpy
0x140006490: "WaitForStartScreen: Failed when " ??_C@_1MA@HLDBMGFF@?$AAW?$AAa?$AAi?$AAt?$AAF?$AAo?$AAr?$AAS?$AAt?$AAa?$AAr?$AAt?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AA?3?$AA?5?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAw?$AAh?$AAe?$AAn?$AA?5@
0x140006838: "[%S] %S" ??_C@_07EKKPINLM@?$FL?$CFS?$FN?5?$CFS?$AA@
0x1400051C8: "__cdecl _imp_GetSidSubAuthorityCount" __imp_GetSidSubAuthorityCount
0x140005198: "__cdecl _imp_GetTraceEnableFlags" __imp_GetTraceEnableFlags
0x1400068F0: "System\Setup\Status" ??_C@_1CI@EDJKIOEK@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAS?$AAe?$AAt?$AAu?$AAp?$AA?2?$AAS?$AAt?$AAa?$AAt?$AAu?$AAs?$AA?$AA@
0x140005398: "__cdecl _imp___CxxFrameHandler3" __imp___CxxFrameHandler3
0x1400051A8: "__cdecl _imp_RegisterTraceGuidsW" __imp_RegisterTraceGuidsW
0x140008068: "__cdecl _security_cookie" __security_cookie
0x140006680: "WaitForStartScreen: Failed to Co" ??_C@_1HA@FMGKJLPD@?$AAW?$AAa?$AAi?$AAt?$AAF?$AAo?$AAr?$AAS?$AAt?$AAa?$AAr?$AAt?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AA?3?$AA?5?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAC?$AAo@
0x140005188: "__cdecl _imp_RegQueryValueExW" __imp_RegQueryValueExW
0x140005CA0: "SendInput succeeded in sending '" ??_C@_1EO@NEKGJBMJ@?$AAS?$AAe?$AAn?$AAd?$AAI?$AAn?$AAp?$AAu?$AAt?$AA?5?$AAs?$AAu?$AAc?$AAc?$AAe?$AAe?$AAd?$AAe?$AAd?$AA?5?$AAi?$AAn?$AA?5?$AAs?$AAe?$AAn?$AAd?$AAi?$AAn?$AAg?$AA?5?$AA?8@
0x140005EA0: "WaitForStartScreen: Waiting for " ??_C@_1HI@KPIAJCAG@?$AAW?$AAa?$AAi?$AAt?$AAF?$AAo?$AAr?$AAS?$AAt?$AAa?$AAr?$AAt?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AA?3?$AA?5?$AAW?$AAa?$AAi?$AAt?$AAi?$AAn?$AAg?$AA?5?$AAf?$AAo?$AAr?$AA?5@
0x140005328: "__cdecl _imp_GetFullPathNameW" __imp_GetFullPathNameW
0x140005240: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x1400051E8: "__cdecl _imp_GetLengthSid" __imp_GetLengthSid
0x140005D30: "GetAppVisibilityInterface: CoCre" ??_C@_1LE@HMOIAFOC@?$AAG?$AAe?$AAt?$AAA?$AAp?$AAp?$AAV?$AAi?$AAs?$AAi?$AAb?$AAi?$AAl?$AAi?$AAt?$AAy?$AAI?$AAn?$AAt?$AAe?$AAr?$AAf?$AAa?$AAc?$AAe?$AA?3?$AA?5?$AAC?$AAo?$AAC?$AAr?$AAe@
0x140008060: "__cdecl _defaultmatherr" __defaultmatherr
0x140003030: McGenControlCallbackV2
0x140005DF0: "GetAppVisibilityInterface: CoCre" ??_C@_1KE@IFFDFDL@?$AAG?$AAe?$AAt?$AAA?$AAp?$AAp?$AAV?$AAi?$AAs?$AAi?$AAb?$AAi?$AAl?$AAi?$AAt?$AAy?$AAI?$AAn?$AAt?$AAe?$AAr?$AAf?$AAa?$AAc?$AAe?$AA?3?$AA?5?$AAC?$AAo?$AAC?$AAr?$AAe@
0x140005320: "__cdecl _imp_GetFileAttributesW" __imp_GetFileAttributesW
0x140006B20: "EventRegister" ??_C@_0O@BAMBGLIE@EventRegister?$AA@
0x140008738: "__cdecl _onexitbegin" __onexitbegin
0x140005288: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x14000720C: "__cdecl _IMPORT_DESCRIPTOR_KERNEL32" __IMPORT_DESCRIPTOR_KERNEL32
0x140008638: g_WdsLibLog
0x140008010: Microsoft_Windows_Deplorch_Context
0x140005180: "__cdecl _imp_RegOpenKeyExW" __imp_RegOpenKeyExW
0x140004114: "__cdecl _security_init_cookie" __security_init_cookie
0x140006B90: "EtwEventWrite" ??_C@_0O@MJPOMPOC@EtwEventWrite?$AA@
0x1400053C0: "__cdecl _imp__cexit" __imp__cexit
0x1400069F0: "CreatePath: Unable to create par" ??_C@_1IG@HCLNMHAA@?$AAC?$AAr?$AAe?$AAa?$AAt?$AAe?$AAP?$AAa?$AAt?$AAh?$AA?3?$AA?5?$AAU?$AAn?$AAa?$AAb?$AAl?$AAe?$AA?5?$AAt?$AAo?$AA?5?$AAc?$AAr?$AAe?$AAa?$AAt?$AAe?$AA?5?$AAp?$AAa?$AAr@
0x14000231C: UnattendLogW
0x140002540: LibLog
0x140003FD8: "__cdecl get_image_app_type" _get_image_app_type
0x140007220: "__cdecl _IMPORT_DESCRIPTOR_msvcrt" __IMPORT_DESCRIPTOR_msvcrt
0x140008630: "public: static class Microsoft::WRL::Details::ModuleBase * __ptr64 __ptr64 Microsoft::WRL::Details::ModuleBase::module_" ?module_@ModuleBase@Details@WRL@Microsoft@@2PEAV1234@EA
0x140001D10: "public: virtual unsigned long __cdecl Microsoft::WRL::Details::RuntimeClassImpl<struct Microsoft::WRL::RuntimeClassFlags<2>,1,0,0,struct IAppVisibilityEvents>::Release(void) __ptr64" ?Release@?$RuntimeClassImpl@U?$RuntimeClassFlags@$01@WRL@Microsoft@@$00$0A@$0A@UIAppVisibilityEvents@@@Details@WRL@Microsoft@@UEAAKXZ
0x140008708: "private: static class CEtwProviderT<void> CChkMacroETWLoggerT<class CEmptyType>::g_chkMacroETWProvider" ?g_chkMacroETWProvider@?$CChkMacroETWLoggerT@VCEmptyType@@@@0V?$CEtwProviderT@X@@A
0x140002344: UnattendLogWV
0x140003E70: wmainCRTStartup
0x140003A38: StrDupe
0x140005368: "__cdecl _imp_malloc" __imp_malloc
0x140005410: "__cdecl _imp__purecall" __imp__purecall
0x140005208: ADVAPI32_NULL_THUNK_DATA
0x140006700: "__cdecl GUID_2246ea2d_caea_4444_a3c4_6de827e44313" _GUID_2246ea2d_caea_4444_a3c4_6de827e44313
0x1400025C8: DirectoryExists
0x140004300: "__cdecl _report_gsfailure" __report_gsfailure
0x1400052F0: "__cdecl _imp_LeaveCriticalSection" __imp_LeaveCriticalSection
0x1400041FC: "__cdecl onexit" _onexit
0x140006920: "System\Setup\Status\AuditBootVol" ??_C@_1EM@EIPHPJDH@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAS?$AAe?$AAt?$AAu?$AAp?$AA?2?$AAS?$AAt?$AAa?$AAt?$AAu?$AAs?$AA?2?$AAA?$AAu?$AAd?$AAi?$AAt?$AAB?$AAo?$AAo?$AAt?$AAV?$AAo?$AAl@
0x1400061D0: "WaitForStartScreen: Timed out wh" ??_C@_1JC@NLKIMEGE@?$AAW?$AAa?$AAi?$AAt?$AAF?$AAo?$AAr?$AAS?$AAt?$AAa?$AAr?$AAt?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AA?3?$AA?5?$AAT?$AAi?$AAm?$AAe?$AAd?$AA?5?$AAo?$AAu?$AAt?$AA?5?$AAw?$AAh@
0x140008748: "__cdecl _native_startup_state" __native_startup_state
0x140006A80: "ntdll.dll" ??_C@_1BE@GJOFHIHD@?$AAn?$AAt?$AAd?$AAl?$AAl?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x140002EC0: McGenControlCallback
0x1400053A8: "__cdecl _imp__fmode" __imp__fmode
0x1400053F8: "__cdecl _imp_free" __imp_free
0x140004080: "__cdecl IsNonwritableInCurrentImage" _IsNonwritableInCurrentImage
0x1400045B5: memset
0x140007270: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR

[JEB Decompiler by PNF Software]