Generated by JEB on 2019/08/01

PE: C:\Windows\System32\drivers\WppRecorder.sys Base=0x1C0000000 SHA-256=B22D7633B6363CF04B65BB053D2D6C772C1503477BC3C5E44B25E15635061EB0
PDB: wpprecorder.pdb GUID={F0A0033D-5941-CCB8-AEDB2CD65C5ED01F} Age=1

167 located named symbols:
0x1C0005570: "WppRecorder" ??_C@_1BI@FHPPGEKG@?$AAW?$AAp?$AAp?$AAR?$AAe?$AAc?$AAo?$AAr?$AAd?$AAe?$AAr?$AA?$AA@
0x1C0003880: WppClassicProviderCallback
0x1C0005170: "WppRecorder_TraceGuid" ??_C@_1CM@LAHCDCDP@?$AAW?$AAp?$AAp?$AAR?$AAe?$AAc?$AAo?$AAr?$AAd?$AAe?$AAr?$AA_?$AAT?$AAr?$AAa?$AAc?$AAe?$AAG?$AAu?$AAi?$AAd?$AA?$AA@
0x1C0003C70: DllUnload
0x1C0006068: g_AssertSpinLock
0x1C00027F0: WppAutoLogpBugCheckCallbackForDriver
0x1C00051D0: "ForceLogsInMiniDump" ??_C@_1CI@IHDMNONM@?$AAF?$AAo?$AAr?$AAc?$AAe?$AAL?$AAo?$AAg?$AAs?$AAI?$AAn?$AAM?$AAi?$AAn?$AAi?$AAD?$AAu?$AAm?$AAp?$AA?$AA@
0x1C0008008: "__cdecl _imp_RtlFreeUnicodeString" __imp_RtlFreeUnicodeString
0x1C00051A0: "VerboseOn" ??_C@_1BE@GNDHNNGJ@?$AAV?$AAe?$AAr?$AAb?$AAo?$AAs?$AAe?$AAO?$AAn?$AA?$AA@
0x1C00052B0: "Error: failed to allocate memory" ??_C@_0DF@GHECMGCH@Error?3?5failed?5to?5allocate?5memory@
0x1C0006018: "__cdecl _security_cookie_complement" __security_cookie_complement
0x1C000A150: WppTraceCallback
0x1C0008048: "__cdecl _imp__stricmp" __imp__stricmp
0x1C0005470: "\Registry\Machine\System\Current" ??_C@_1HO@GCGFOCLM@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1C0005158: "Parameters" ??_C@_1BG@PGIGMDPA@?$AAP?$AAa?$AAr?$AAa?$AAm?$AAe?$AAt?$AAe?$AAr?$AAs?$AA?$AA@
0x1C0003E04: "__cdecl TlgDefineProvider_annotation__Tlgmtakm_hTelemetryAssertDiagTrackProv" _TlgDefineProvider_annotation__Tlgmtakm_hTelemetryAssertDiagTrackProv
0x1C0002850: WppAutoLogpBugCheckCallbackForLog
0x1C0008010: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x1C00045E0: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x1C0002430: imp_WppRecorderLinkCounters
0x1C0005648: "__cdecl TraceLoggingMetadata" _TraceLoggingMetadata
0x1C00055BC: "" ??_C@_00CNPNBAHC@?$AA@
0x1C0002AAC: WPP_RECORDER_SF_dscs
0x1C00053B8: "WmiTraceMessage" ??_C@_1CA@OFIBBPKJ@?$AAW?$AAm?$AAi?$AAT?$AAr?$AAa?$AAc?$AAe?$AAM?$AAe?$AAs?$AAs?$AAa?$AAg?$AAe?$AA?$AA@
0x1C0001008: "__cdecl TlgWrite" _TlgWrite
0x1C00017C0: WppAutoLogDeleteLog
0x1C0008128: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x1C000164C: WppAutoLogCreateLog
0x1C0005278: "WppRecorder_ReplayEnabled" ??_C@_1DE@PGLNGHPB@?$AAW?$AAp?$AAp?$AAR?$AAe?$AAc?$AAo?$AAr?$AAd?$AAe?$AAr?$AA_?$AAR?$AAe?$AAp?$AAl?$AAa?$AAy?$AAE?$AAn?$AAa?$AAb?$AAl?$AAe?$AAd?$AA?$AA@
0x1C0008040: "__cdecl _imp_MmGetSystemRoutineAddress" __imp_MmGetSystemRoutineAddress
0x1C00054F0: "WppRecorder.sys" ??_C@_0BA@LHPDLGND@WppRecorder?4sys?$AA@
0x1C0008110: "__cdecl _imp_KeInitializeSpinLock" __imp_KeInitializeSpinLock
0x1C00080E0: "__cdecl _imp_KiBugCheckData" __imp_KiBugCheckData
0x1C000A800: TraceLoggingRegister
0x1C0001EA0: WppAutoLogTrace
0x1C0008060: "__cdecl _imp_KeWaitForSingleObject" __imp_KeWaitForSingleObject
0x1C0008020: "__cdecl _imp_KeReleaseSpinLock" __imp_KeReleaseSpinLock
0x1C0004424: MicrosoftTelemetryAssertTriggeredArgsKM
0x1C000276C: WppAutoLogGetBugCheckDataForLog
0x1C0005118: "__cdecl _guard_iat_table" __guard_iat_table
0x1C0004600: memcpy
0x1C00055D0: "TELASSERT" ??_C@_1BE@BNPGOOBN@?$AAT?$AAE?$AAL?$AAA?$AAS?$AAS?$AAE?$AAR?$AAT?$AA?$AA@
0x1C0003E04: "__cdecl TlgDefineProvider_annotation__Tlgmtakm_hTelemetryAssertDiagTrack_KMProv" _TlgDefineProvider_annotation__Tlgmtakm_hTelemetryAssertDiagTrack_KMProv
0x1C0008078: "__cdecl _imp_ZwSetValueKey" __imp_ZwSetValueKey
0x1C0006030: pfnWppGetVersion
0x1C000448D: "__cdecl _C_specific_handler" __C_specific_handler
0x1C00052F0: "Error: failed to allocate memory" ??_C@_0DD@LBNLIDLL@Error?3?5failed?5to?5allocate?5memory@
0x1C0004600: memmove
0x1C0006080: g_AssertsOperational
0x1C00044DC: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x1C00060A0: WPP_MAIN_CB
0x1C0002410: imp_WppRecorderGetCounterHandle
0x1C00055C0: "<unknown>" ??_C@_09EEKGDCPH@?$DMunknown?$DO?$AA@
0x1C0002210: imp_WppRecorderIsDefaultLogAvailable
0x1C00080E8: "__cdecl _imp_EtwSetInformation" __imp_EtwSetInformation
0x1C0008050: "__cdecl _imp_ExAllocatePoolWithTag" __imp_ExAllocatePoolWithTag
0x1C0002090: imp_WppRecorderConfigure
0x1C0006040: pfnWppQueryTraceInformation
0x1C00080F8: "__cdecl _imp_EtwWriteTransfer" __imp_EtwWriteTransfer
0x1C0002EDC: WppAutoLogValidateLogHeader
0x1C0001840: WppAutoLogStart
0x1C0004544: "__cdecl _GSHandlerCheck_SEH" __GSHandlerCheck_SEH
0x1C00080A8: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x1C0005120: "RtlQueryRegistryValuesEx" ??_C@_1DC@OAPHKEJN@?$AAR?$AAt?$AAl?$AAQ?$AAu?$AAe?$AAr?$AAy?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AAV?$AAa?$AAl?$AAu?$AAe?$AAs?$AAE?$AAx?$AA?$AA@
0x1C00044B8: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x1C0005398: "PsGetVersion" ??_C@_1BK@DHLDGJM@?$AAP?$AAs?$AAG?$AAe?$AAt?$AAV?$AAe?$AAr?$AAs?$AAi?$AAo?$AAn?$AA?$AA@
0x1C00010B0: SetWppAutoLogRegistrySettings
0x1C0003140: WppAutoLogSendRecordsToWpp
0x1C0001274: GetWppAutoLogRegistrySettings
0x1C00080D0: "__cdecl _imp_ExAllocatePoolWithQuotaTag" __imp_ExAllocatePoolWithQuotaTag
0x1C0006020: pfnEtwRegisterClassicProvider
0x1C0008030: "__cdecl _imp_RtlGetVersion" __imp_RtlGetVersion
0x1C00052E8: ".pdb" ??_C@_04DEAGFDMC@?4pdb?$AA@
0x1C0003E04: "__cdecl TlgDefineProvider_annotation__Tlgmtakm_hTelemetryAssertProv" _TlgDefineProvider_annotation__Tlgmtakm_hTelemetryAssertProv
0x1C0005530: "RecentlyUnloadedDriversMaxCount" ??_C@_1EA@EMDNLLOB@?$AAR?$AAe?$AAc?$AAe?$AAn?$AAt?$AAl?$AAy?$AAU?$AAn?$AAl?$AAo?$AAa?$AAd?$AAe?$AAd?$AAD?$AAr?$AAi?$AAv?$AAe?$AAr?$AAs?$AAM?$AAa?$AAx?$AAC?$AAo?$AAu?$AAn?$AAt?$AA?$AA@
0x1C0006048: pfnEtwUnregister
0x1C0003740: WppAutoLogGetPdbInfo
0x1C0008098: "__cdecl _imp_KeDeregisterBugCheckReasonCallback" __imp_KeDeregisterBugCheckReasonCallback
0x1C00021E0: imp_WppRecorderLogGetDefault
0x1C0001D20: WppAutoLogStop
0x1C0002688: WppAutoLogpBugCheckCallbackFilter
0x1C000C010: GsDriverEntry
0x1C0008120: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x1C0005370: "NULL" ??_C@_04HIBGFPH@NULL?$AA@
0x1C0002520: imp_WppRecorderLogDumpLiveData
0x1C00024D0: imp_WppRecorderDumpLiveDriverData
0x1C0006000: WPP_GLOBAL_Control
0x1C000A780: "__cdecl TlgEnableCallback" _TlgEnableCallback
0x1C0001C58: WppAutoLogpMoveContextToRecentlyUnloadedList
0x1C0002C8C: WPP_RECORDER_SF_s
0x1C0004450: "__cdecl _security_check_cookie" __security_check_cookie
0x1C0005588: "RtlQueryModuleInformation" ??_C@_1DE@HMCCLJNL@?$AAR?$AAt?$AAl?$AAQ?$AAu?$AAe?$AAr?$AAy?$AAM?$AAo?$AAd?$AAu?$AAl?$AAe?$AAI?$AAn?$AAf?$AAo?$AAr?$AAm?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x1C00080F0: "__cdecl _imp_DbgkWerCaptureLiveKernelDump" __imp_DbgkWerCaptureLiveKernelDump
0x1C0003490: imp_WppRecorderReplay
0x1C0009000: g_ModuleName
0x1C0008130: "__cdecl _IMPORT_DESCRIPTOR_ntoskrnl" __IMPORT_DESCRIPTOR_ntoskrnl
0x1C0005869: "__cdecl TraceLoggingMetadataEnd" _TraceLoggingMetadataEnd
0x1C0006100: WppRecorderGlobals
0x1C0005238: "WppRecorder_PerBufferMaxBytes" ??_C@_1DM@FBCHJDJE@?$AAW?$AAp?$AAp?$AAR?$AAe?$AAc?$AAo?$AAr?$AAd?$AAe?$AAr?$AA_?$AAP?$AAe?$AAr?$AAB?$AAu?$AAf?$AAf?$AAe?$AAr?$AAM?$AAa?$AAx?$AAB?$AAy?$AAt?$AAe?$AAs?$AA?$AA@
0x1C0008090: "__cdecl _imp_KeRegisterBugCheckReasonCallback" __imp_KeRegisterBugCheckReasonCallback
0x1C000A454: WppCleanupKm
0x1C000296C: WPP_RECORDER_SF_ds
0x1C0002544: WppAutoLogpGetImageBase
0x1C0008100: "__cdecl _imp_EtwUnregister" __imp_EtwUnregister
0x1C000D000: "__cdecl _guard_fids_table" __guard_fids_table
0x1C0005010: "__cdecl load_config_used" _load_config_used
0x1C0008070: "__cdecl _imp_ZwClose" __imp_ZwClose
0x1C00080B8: "__cdecl _imp_KeInitializeEvent" __imp_KeInitializeEvent
0x1C00053D8: "WmiQueryTraceInformation" ??_C@_1DC@DOCOAJH@?$AAW?$AAm?$AAi?$AAQ?$AAu?$AAe?$AAr?$AAy?$AAT?$AAr?$AAa?$AAc?$AAe?$AAI?$AAn?$AAf?$AAo?$AAr?$AAm?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x1C0005448: "EtwUnregister" ??_C@_1BM@CJMKDOJH@?$AAE?$AAt?$AAw?$AAU?$AAn?$AAr?$AAe?$AAg?$AAi?$AAs?$AAt?$AAe?$AAr?$AA?$AA@
0x1C00044A0: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x1C00036E8: RtlpImageNtHeader
0x1C0006070: g_MicrosoftTelemetryAssertsTriggeredList
0x1C000A008: WppLoadTracingSupport
0x1C00080B0: "__cdecl _imp_IoWMIRegistrationControl" __imp_IoWMIRegistrationControl
0x1C0005338: "Error: failed to re-allocate mem" ??_C@_0DG@EHCCBILH@Error?3?5failed?5to?5re?9allocate?5mem@
0x1C0002250: imp_WppRecorderLogCreate
0x1C00080C8: "__cdecl _imp_ZwQuerySystemInformation" __imp_ZwQuerySystemInformation
0x1C0008080: "__cdecl _imp_strrchr" __imp_strrchr
0x1C0003E10: MicrosoftTelemetryAssertTriggeredWorker
0x1C0006050: g_IsDllDisabled
0x1C00080E0: KiBugCheckData
0x1C000A4E4: AuxKlibInitialize
0x1C0008000: "__cdecl _imp_KeAcquireSpinLockRaiseToDpc" __imp_KeAcquireSpinLockRaiseToDpc
0x1C0006010: "__cdecl _security_cookie" __security_cookie
0x1C0002490: imp_WppRecorderGetTriageInfo
0x1C0002D9C: WPP_RECORDER_SF_sd
0x1C0005410: "EtwRegisterClassicProvider" ??_C@_1DG@PFOPAIND@?$AAE?$AAt?$AAw?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAe?$AAr?$AAC?$AAl?$AAa?$AAs?$AAs?$AAi?$AAc?$AAP?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AA?$AA@
0x1C00080A0: "__cdecl _imp_WmiTraceMessage" __imp_WmiTraceMessage
0x1C00028A4: WPP_RECORDER_SF_dd
0x1C0002350: imp_WppRecorderLogSetIdentifier
0x1C00038D0: DllInitialize
0x1C000A550: AuxKlibQueryModuleInformation
0x1C0008018: "__cdecl _imp_RtlQueryRegistryValues" __imp_RtlQueryRegistryValues
0x1C0008038: "__cdecl _imp_RtlStringFromGUID" __imp_RtlStringFromGUID
0x1C0008068: "__cdecl _imp_DbgPrint" __imp_DbgPrint
0x1C0005388: WPP_ThisDir_CTLGUID_TestTraceGuid
0x1C000C044: "__cdecl _security_init_cookie" __security_init_cookie
0x1C00080C0: "__cdecl _imp_KeQueryTimeIncrement" __imp_KeQueryTimeIncrement
0x1C0008108: "__cdecl _imp_EtwRegister" __imp_EtwRegister
0x1C0006038: WPPTraceSuite
0x1C0005500: "ForceDisabledCrashLogs" ??_C@_1CO@FFNJJJBD@?$AAF?$AAo?$AAr?$AAc?$AAe?$AAD?$AAi?$AAs?$AAa?$AAb?$AAl?$AAe?$AAd?$AAC?$AAr?$AAa?$AAs?$AAh?$AAL?$AAo?$AAg?$AAs?$AA?$AA@
0x1C0008028: "__cdecl _imp_KeSetEvent" __imp_KeSetEvent
0x1C0004480: "__cdecl _report_gsfailure" __report_gsfailure
0x1C0002FF8: WppAutoLogCreateLogSnapshot
0x1C0008118: ntoskrnl_NULL_THUNK_DATA
0x1C0008058: "__cdecl _imp_ExFreePoolWithTag" __imp_ExFreePoolWithTag
0x1C0005328: "DriverLog" ??_C@_09HGLDDODP@DriverLog?$AA@
0x1C0001E40: WppAutoLogDeleteAutoLogContext
0x1C00051F8: "WppRecorder_PerBufferMinBytes" ??_C@_1DM@LMEEHLAB@?$AAW?$AAp?$AAp?$AAR?$AAe?$AAc?$AAo?$AAr?$AAd?$AAe?$AAr?$AA_?$AAP?$AAe?$AAr?$AAB?$AAu?$AAf?$AAf?$AAe?$AAr?$AAM?$AAi?$AAn?$AAB?$AAy?$AAt?$AAe?$AAs?$AA?$AA@
0x1C00038B4: DriverEntry
0x1C00080D8: "__cdecl _imp_PsGetVersion" __imp_PsGetVersion
0x1C00023A0: imp_WppRecorderLogDelete
0x1C0005378: WPP_844f4431103636d0db8dffdfa8a57bdb_Traceguids
0x1C0006028: pfnWppTraceMessage
0x1C0008088: "__cdecl _imp_ZwOpenKey" __imp_ZwOpenKey
0x1C000A3A4: WppInitKm
0x1C0004940: memset
0x1C0008144: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x1C00051B8: "LogPages" ??_C@_1BC@JJOIPLPH@?$AAL?$AAo?$AAg?$AAP?$AAa?$AAg?$AAe?$AAs?$AA?$AA@

[JEB Decompiler by PNF Software]