Generated by JEB on 2019/08/01

PE: C:\Windows\System32\KdsCli.dll Base=0x180000000 SHA-256=B4E1F1AE0FB29213374F89887371CA6AB450E141A6B49F922E601070DBB64AC1
PDB: KdsCli.pdb GUID={DED85613-BBE3-E475-E5DBB785362B660E} Age=1

539 located named symbols:
0x180015640: g_MachineFullDcRpcCache
0x1800105C8: api-ms-win-core-file-l1-1-0_NULL_THUNK_DATA
0x180010960: "__cdecl _imp_EtwUnregisterTraceGuids" __imp_EtwUnregisterTraceGuids
0x180011768: "onecore\ds\security\keyman\sidke" ??_C@_0DM@CAHPNJLF@onecore?2ds?2security?2keyman?2sidke@
0x180010E80: "onecore\ds\security\keyman\sidke" ??_C@_0DK@GDBAJPDH@onecore?2ds?2security?2keyman?2sidke@
0x180010B88: "(objectClass=*)" ??_C@_1CA@CGKDPGGM@?$AA?$CI?$AAo?$AAb?$AAj?$AAe?$AAc?$AAt?$AAC?$AAl?$AAa?$AAs?$AAs?$AA?$DN?$AA?$CK?$AA?$CJ?$AA?$AA@
0x18000EAA0: "__cdecl _delayLoadHelper2" __delayLoadHelper2
0x18001336C: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x180013344: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-kernel32-legacy-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-kernel32-legacy-l1-1-0
0x180010B08: "onecore\ds\security\keyman\sidke" ??_C@_0DF@NPBKBFCP@onecore?2ds?2security?2keyman?2sidke@
0x18000C0D0: SIDKeyProtect
0x180010E58: KdsSvcInvalidMRK
0x180011D38: WPP_7a810d74fb663fa763476e0773cd764a_Traceguids
0x18000AF00: GetKdsKeyCycleDuration
0x180015068: "__cdecl _security_cookie_complement" __security_cookie_complement
0x180009FD0: UnlockRpcCache
0x180010F70: "msKds-ProvRootKey" ??_C@_1CE@PHPKCCPE@?$AAm?$AAs?$AAK?$AAd?$AAs?$AA?9?$AAP?$AAr?$AAo?$AAv?$AAR?$AAo?$AAo?$AAt?$AAK?$AAe?$AAy?$AA?$AA@
0x180011068: "msKds-PublicKeyLength" ??_C@_1CM@CENFELGA@?$AAm?$AAs?$AAK?$AAd?$AAs?$AA?9?$AAP?$AAu?$AAb?$AAl?$AAi?$AAc?$AAK?$AAe?$AAy?$AAL?$AAe?$AAn?$AAg?$AAt?$AAh?$AA?$AA@
0x1800104B8: "__cdecl _imp_ldap_search_ext_sW" __imp_ldap_search_ext_sW
0x1800104B0: "__cdecl _imp_ldap_set_optionW" __imp_ldap_set_optionW
0x180010658: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x1800110C8: "msKds-KDFParam" ??_C@_1BO@PPMMGENH@?$AAm?$AAs?$AAK?$AAd?$AAs?$AA?9?$AAK?$AAD?$AAF?$AAP?$AAa?$AAr?$AAa?$AAm?$AA?$AA@
0x1800116B0: "PublicKey\" ??_C@_1BG@ICLLCBCI@?$AAP?$AAu?$AAb?$AAl?$AAi?$AAc?$AAK?$AAe?$AAy?$AA?2?$AA?$AA@
0x180004D0C: ValidateKDFParam
0x1800108E8: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x18000923C: GetDomainControllerInfo
0x180002450: WppControlCallback
0x18000F080: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x1800105B0: "__cdecl _imp_CreateFileW" __imp_CreateFileW
0x180010DF0: WPP_2d0764f1ee4a33c0f59eb4d6eaf30e76_Traceguids
0x1800105A0: "__cdecl _imp_RemoveDirectoryW" __imp_RemoveDirectoryW
0x18000BC50: KdsGetGmsaPasswordBasedOnKeyId
0x180015698: g_ulAdditionalProbeSize
0x180010858: "__cdecl _imp_BCryptDestroyKey" __imp_BCryptDestroyKey
0x180010928: "__cdecl _imp_EtwGetTraceLoggerHandle" __imp_EtwGetTraceLoggerHandle
0x1800106C8: "__cdecl _imp_AcquireSRWLockShared" __imp_AcquireSRWLockShared
0x180011D50: "__cdecl _pfnDliFailureHook2" __pfnDliFailureHook2
0x180004940: FreeRootKeyMetaDataList
0x180008A40: GenerateEphemeralKeyPair
0x180013254: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-1-0
0x180010880: bcrypt_NULL_THUNK_DATA
0x18000B4B8: "__cdecl GenerateGmsaPassword" _GenerateGmsaPassword
0x180010608: api-ms-win-core-heap-l2-1-0_NULL_THUNK_DATA
0x1800108D8: "__cdecl _imp_NtSetInformationThread" __imp_NtSetInformationThread
0x1800108C8: "__cdecl _imp_wcschr" __imp_wcschr
0x180011098: "msKds-PrivateKeyLength" ??_C@_1CO@CBEFDDEC@?$AAm?$AAs?$AAK?$AAd?$AAs?$AA?9?$AAP?$AAr?$AAi?$AAv?$AAa?$AAt?$AAe?$AAK?$AAe?$AAy?$AAL?$AAe?$AAn?$AAg?$AAt?$AAh?$AA?$AA@
0x180010990: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x180007788: DeleteFolder
0x1800116F4: "." ??_C@_13JOFGPIOO@?$AA?4?$AA?$AA@
0x180011710: "onecore\ds\security\keyman\sidke" ??_C@_0DJ@OLGHGLGD@onecore?2ds?2security?2keyman?2sidke@
0x1800108A8: "__cdecl _imp__ui64tow_s" __imp__ui64tow_s
0x180011CA0: g_rgbObjSID
0x180010F38: "msKds-DomainID" ??_C@_1BO@EHIBKKFO@?$AAm?$AAs?$AAK?$AAd?$AAs?$AA?9?$AAD?$AAo?$AAm?$AAa?$AAi?$AAn?$AAI?$AAD?$AA?$AA@
0x180010510: "__cdecl _imp_ldap_modify_sW" __imp_ldap_modify_sW
0x180011C90: g_rgbObjDescriptor
0x180010DC0: "cn=Master Root Keys," ??_C@_1CK@JMHIIEDF@?$AAc?$AAn?$AA?$DN?$AAM?$AAa?$AAs?$AAt?$AAe?$AAr?$AA?5?$AAR?$AAo?$AAo?$AAt?$AA?5?$AAK?$AAe?$AAy?$AAs?$AA?0?$AA?$AA@
0x1800155F0: "__cdecl _hmod__RPCRT4_dll" __hmod__RPCRT4_dll
0x180011938: "ntStatus" ??_C@_08DBOEHLEI@ntStatus?$AA@
0x180009AA0: AddCacheEntry
0x180011D20: EveryoneSid
0x180011248: WPP_dc038cab65ba32fb6b7058578e48acef_Traceguids
0x18000AF14: IsLowbox
0x1800132CC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-timezone-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-timezone-l1-1-0
0x180010850: "__cdecl _imp_BCryptCreateHash" __imp_BCryptCreateHash
0x18000E5FC: GetLatestKey
0x180011238: "ulLdapError" ??_C@_0M@FEBOFLAN@ulLdapError?$AA@
0x1800107C0: "__cdecl _imp_ConvertStringSidToSidW" __imp_ConvertStringSidToSidW
0x1800105A8: "__cdecl _imp_FindClose" __imp_FindClose
0x180011B28: "AES" ??_C@_17PJMHNJHG@?$AAA?$AAE?$AAS?$AA?$AA@
0x1800090A0: StringCchCopyW
0x1800104F8: "__cdecl _imp_ldap_next_attributeW" __imp_ldap_next_attributeW
0x180001CAC: GenerateSingleValueBervalAttribute
0x1800107B8: api-ms-win-security-lsapolicy-l1-1-0_NULL_THUNK_DATA
0x18000A010: SIDKeyProvAlloc
0x1800105F8: api-ms-win-core-heap-l1-1-0_NULL_THUNK_DATA
0x180010718: "__cdecl _imp_SetSecurityDescriptorOwner" __imp_SetSecurityDescriptorOwner
0x180010E48: KdsSvcMRKCreationFailure
0x1800105B8: "__cdecl _imp_DeleteFileW" __imp_DeleteFileW
0x180010AB0: "__cdecl _guard_iat_table" __guard_iat_table
0x180010FC0: "msKds-UseStartTime" ??_C@_1CG@PIDMJOOC@?$AAm?$AAs?$AAK?$AAd?$AAs?$AA?9?$AAU?$AAs?$AAe?$AAS?$AAt?$AAa?$AAr?$AAt?$AAT?$AAi?$AAm?$AAe?$AA?$AA@
0x180011210: "(&%s%s%s%s)" ??_C@_1BI@BPINKHAJ@?$AA?$CI?$AA?$CG?$AA?$CF?$AAs?$AA?$CF?$AAs?$AA?$CF?$AAs?$AA?$CF?$AAs?$AA?$CJ?$AA?$AA@
0x1800116C8: "PrivateKey\" ??_C@_1BI@FHOPDCHN@?$AAP?$AAr?$AAi?$AAv?$AAa?$AAt?$AAe?$AAK?$AAe?$AAy?$AA?2?$AA?$AA@
0x18000B3D4: WPP_SF__HEX_
0x18000F04D: memcpy
0x1800104C8: "__cdecl _imp_ldap_first_attributeW" __imp_ldap_first_attributeW
0x18000B77C: "__cdecl GetGmsaPasswordForInterval" _GetGmsaPasswordForInterval
0x1800104D0: "__cdecl _imp_ldap_next_entry" __imp_ldap_next_entry
0x18000E470: GetLatestSidKey
0x180010C10: "OU=Domain Controllers," ??_C@_1CO@PCIAMFLN@?$AAO?$AAU?$AA?$DN?$AAD?$AAo?$AAm?$AAa?$AAi?$AAn?$AA?5?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAl?$AAe?$AAr?$AAs?$AA?0?$AA?$AA@
0x180010828: "__cdecl _imp_BCryptDeriveKey" __imp_BCryptDeriveKey
0x180011140: "D:P(A;;GA;;;EA)(A;;GA;;;DA)(A;;G" ??_C@_1FA@EFJCAAMF@?$AAD?$AA?3?$AAP?$AA?$CI?$AAA?$AA?$DL?$AA?$DL?$AAG?$AAA?$AA?$DL?$AA?$DL?$AA?$DL?$AAE?$AAA?$AA?$CJ?$AA?$CI?$AAA?$AA?$DL?$AA?$DL?$AAG?$AAA?$AA?$DL?$AA?$DL?$AA?$DL?$AAD?$AAA?$AA?$CJ?$AA?$CI?$AAA?$AA?$DL?$AA?$DL?$AAG@
0x180010958: "__cdecl _imp_memset" __imp_memset
0x180011B30: "onecore\ds\security\keyman\sidke" ??_C@_0EA@EKIGKGAD@onecore?2ds?2security?2keyman?2sidke@
0x180011CC0: "onecore\ds\security\keyman\sidke" ??_C@_0EC@OINJAGEK@onecore?2ds?2security?2keyman?2sidke@
0x180010B58: "LDAP_NO_SUCH_OBJECT" ??_C@_0BE@MJDMKHMN@LDAP_NO_SUCH_OBJECT?$AA@
0x180010AE0: "__cdecl _sz_netutils_dll" __sz_netutils_dll
0x18000EEDD: "__cdecl _imp_load_RpcBindingFree" __imp_load_RpcBindingFree
0x18001322C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0
0x1800106E0: "__cdecl _imp_GetSystemTime" __imp_GetSystemTime
0x1800108B8: "__cdecl _imp_NtRollbackTransaction" __imp_NtRollbackTransaction
0x180010560: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x18000A070: ConvertStrToUlong
0x180010968: "__cdecl _imp_wcscmp" __imp_wcscmp
0x180010450: "__cdecl _imp_CryptUnprotectData" __imp_CryptUnprotectData
0x180010938: "__cdecl _imp_EtwRegisterTraceGuidsW" __imp_EtwRegisterTraceGuidsW
0x18000EF9E: "__cdecl _C_specific_handler" __C_specific_handler
0x180002890: MIDL_user_free
0x1800106B8: "__cdecl _imp_ReleaseSRWLockExclusive" __imp_ReleaseSRWLockExclusive
0x180010768: "__cdecl _imp_AddAccessAllowedAce" __imp_AddAccessAllowedAce
0x180017070: netutils_NULL_THUNK_DATA_DLA
0x180012BC8: netutils_NULL_THUNK_DATA_DLB
0x180012A58: netutils_NULL_THUNK_DATA_DLN
0x1800105E0: "__cdecl _imp_HeapFree" __imp_HeapFree
0x1800156D0: WPP_REGISTRATION_GUIDS
0x18000EDF8: "__cdecl _imp_load_UuidToStringW" __imp_load_UuidToStringW
0x18000EEB9: "__cdecl _imp_load_RpcBindingSetAuthInfoExW" __imp_load_RpcBindingSetAuthInfoExW
0x1800097F4: UpdateCachedBindingToMachineDC
0x180001D98: DeleteAttrsList
0x180010488: "__cdecl _imp_ldap_msgfree" __imp_ldap_msgfree
0x1800105D8: api-ms-win-core-handle-l1-1-0_NULL_THUNK_DATA
0x18000EFEC: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x180011B98: "KeyDataBlob" ??_C@_1BI@NNGJONND@?$AAK?$AAe?$AAy?$AAD?$AAa?$AAt?$AAa?$AAB?$AAl?$AAo?$AAb?$AA?$AA@
0x180010E28: KdsSvcInvalidSrvConfig
0x1800115F0: "onecore\ds\security\keyman\sidke" ??_C@_0DP@HACNIDP@onecore?2ds?2security?2keyman?2sidke@
0x1800059C0: GenerateServerConfigAttributes
0x1800106A8: api-ms-win-core-string-l1-1-0_NULL_THUNK_DATA
0x1800156A0: WPP_MAIN_CB
0x1800132A4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0
0x1800118A0: "HOST" ??_C@_19KPNAOCDA@?$AAH?$AAO?$AAS?$AAT?$AA?$AA@
0x1800118E8: "onecore\ds\security\keyman\sidke" ??_C@_0DK@GFLIJDBB@onecore?2ds?2security?2keyman?2sidke@
0x180011D48: "__cdecl _DefaultResolveDelayLoadedAPIFlags" __DefaultResolveDelayLoadedAPIFlags
0x180010978: "__cdecl _imp_GetBasicProfileFolderPath" __imp_GetBasicProfileFolderPath
0x180010980: profapi_NULL_THUNK_DATA
0x180011258: "onecore\ds\security\keyman\sidke" ??_C@_0DM@HABFKHAG@onecore?2ds?2security?2keyman?2sidke@
0x1800111D0: "(objectClass=msKds-ProvRootKey)" ??_C@_1EA@PEACMJBA@?$AA?$CI?$AAo?$AAb?$AAj?$AAe?$AAc?$AAt?$AAC?$AAl?$AAa?$AAs?$AAs?$AA?$DN?$AAm?$AAs?$AAK?$AAd?$AAs?$AA?9?$AAP?$AAr?$AAo?$AAv?$AAR?$AAo?$AAo?$AAt?$AAK?$AAe?$AAy?$AA?$CJ?$AA?$AA@
0x1800131DC: "__cdecl _IMPORT_DESCRIPTOR_bcrypt" __IMPORT_DESCRIPTOR_bcrypt
0x180010EC0: "msKds-KDFAlgorithmID" ??_C@_1CK@OFPFIPLC@?$AAm?$AAs?$AAK?$AAd?$AAs?$AA?9?$AAK?$AAD?$AAF?$AAA?$AAl?$AAg?$AAo?$AAr?$AAi?$AAt?$AAh?$AAm?$AAI?$AAD?$AA?$AA@
0x180006060: GetSIDKeyCacheFolder
0x18000A1E0: OpenCallerToken
0x1800117F0: "PUBLICBLOB" ??_C@_1BG@HPKCIHOF@?$AAP?$AAU?$AAB?$AAL?$AAI?$AAC?$AAB?$AAL?$AAO?$AAB?$AA?$AA@
0x18000EECB: "__cdecl _imp_load_RpcEpResolveBinding" __imp_load_RpcEpResolveBinding
0x180012964: "__cdecl _DELAY_IMPORT_DESCRIPTOR_RPCRT4_dll" __DELAY_IMPORT_DESCRIPTOR_RPCRT4_dll
0x180005720: GetDefaultServerConfig
0x180011120: "cn=%s,%s" ??_C@_1BC@INJIBENO@?$AAc?$AAn?$AA?$DN?$AA?$CF?$AAs?$AA?0?$AA?$CF?$AAs?$AA?$AA@
0x180007500: FindKeyForOfflineUsage
0x180010EF0: "msKds-RootKeyData" ??_C@_1CE@CHAEOONG@?$AAm?$AAs?$AAK?$AAd?$AAs?$AA?9?$AAR?$AAo?$AAo?$AAt?$AAK?$AAe?$AAy?$AAD?$AAa?$AAt?$AAa?$AA?$AA@
0x180011A50: "onecore\ds\security\keyman\sidke" ??_C@_0EF@IHFLFNBC@onecore?2ds?2security?2keyman?2sidke@
0x1800155F8: "__cdecl _hmod__logoncli_dll" __hmod__logoncli_dll
0x1800106C0: "__cdecl _imp_ReleaseSRWLockShared" __imp_ReleaseSRWLockShared
0x180011838: "SP800_56A_CONCAT" ??_C@_1CC@MMGMOOPO@?$AAS?$AAP?$AA8?$AA0?$AA0?$AA_?$AA5?$AA6?$AAA?$AA_?$AAC?$AAO?$AAN?$AAC?$AAA?$AAT?$AA?$AA@
0x180011D10: WPP_f16c85724cc23feff667badcfe25a7a7_Traceguids
0x180010738: "__cdecl _imp_GetSecurityDescriptorLength" __imp_GetSecurityDescriptorLength
0x180010570: api-ms-win-core-errorhandling-l1-1-0_NULL_THUNK_DATA
0x180010618: api-ms-win-core-kernel32-legacy-l1-1-0_NULL_THUNK_DATA
0x180010648: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x18000B4A0: KdsGetEpochLength
0x180017050: RPCRT4_NULL_THUNK_DATA_DLA
0x180012B70: RPCRT4_NULL_THUNK_DATA_DLB
0x180010E10: Microsoft_Windows_KdsSvcKeywords
0x180010848: "__cdecl _imp_BCryptHashData" __imp_BCryptHashData
0x1800026A0: DllMain
0x180012A38: RPCRT4_NULL_THUNK_DATA_DLN
0x18000D110: ClientComputeL2Key
0x180010AC0: "__cdecl _sz_RPCRT4_dll" __sz_RPCRT4_dll
0x180017000: "__cdecl _imp_UuidFromStringW" __imp_UuidFromStringW
0x18000A75C: ValidateSIDKeyID
0x1800132E0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-string-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-string-l1-1-0
0x180010C50: "dNSHostName=%s" ??_C@_1BO@GINNJIBG@?$AAd?$AAN?$AAS?$AAH?$AAo?$AAs?$AAt?$AAN?$AAa?$AAm?$AAe?$AA?$DN?$AA?$CF?$AAs?$AA?$AA@
0x1800108C0: "__cdecl _imp_wcscat_s" __imp_wcscat_s
0x180010750: "__cdecl _imp_IsValidSid" __imp_IsValidSid
0x1800108F8: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x18000AC30: GetCachedMachineDomainInfo
0x180010680: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x18000A7C0: ValidateClientKEKInfo
0x180010628: api-ms-win-core-libraryloader-l1-2-0_NULL_THUNK_DATA
0x18000295C: McTemplateU0jz
0x180010568: "__cdecl _imp_GetLastError" __imp_GetLastError
0x1800107C8: "__cdecl _imp_ConvertSidToStringSidW" __imp_ConvertSidToStringSidW
0x1800156C8: Microsoft_Windows_KdsSvcEnableBits
0x18000A040: SIDKeyProvFree
0x18000EFC8: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x18000A120: GenerateObjGuid
0x180010948: "__cdecl _imp_EtwTraceMessage" __imp_EtwTraceMessage
0x1800104E8: "__cdecl _imp_ldap_unbind" __imp_ldap_unbind
0x180011B18: WPP_4c5382d06a8f34534fd2130659aa7fe8_Traceguids
0x180001210: GetLdapBinding
0x1800107E8: "__cdecl _imp_BCryptCloseAlgorithmProvider" __imp_BCryptCloseAlgorithmProvider
0x180011AB8: "onecore\ds\security\keyman\sidke" ??_C@_0DL@DFPMAGPF@onecore?2ds?2security?2keyman?2sidke@
0x180010AF8: "NULL" ??_C@_19CIJIHAKK@?$AAN?$AAU?$AAL?$AAL?$AA?$AA@
0x180013394: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-0
0x180010660: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x18001318C: "__cdecl _IMPORT_DESCRIPTOR_WLDAP32" __IMPORT_DESCRIPTOR_WLDAP32
0x180010E00: WPP_ThisDir_CTLGUID_KDSPROVCtlGuid
0x180010940: "__cdecl _imp_swprintf_s" __imp_swprintf_s
0x180011D48: "__cdecl _ResolveDelayLoadedAPIFlags" __ResolveDelayLoadedAPIFlags
0x180010800: "__cdecl _imp_BCryptSecretAgreement" __imp_BCryptSecretAgreement
0x180010798: "__cdecl _imp_LsaQueryInformationPolicy" __imp_LsaQueryInformationPolicy
0x180017048: "__cdecl _imp_RpcEpResolveBinding" __imp_RpcEpResolveBinding
0x180011228: "NTE_BAD_KEY" ??_C@_0M@LGBEGMKM@NTE_BAD_KEY?$AA@
0x180011668: "dwReturn" ??_C@_08KOCHCJLB@dwReturn?$AA@
0x180011808: "SHA512" ??_C@_1O@GKBAHMNF@?$AAS?$AAH?$AAA?$AA5?$AA1?$AA2?$AA?$AA@
0x1800131A0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0
0x180015010: KdsSvcOperational_Context
0x180010AF0: "\" ??_C@_13FPGAJAPJ@?$AA?2?$AA?$AA@
0x180011924: "0" ??_C@_13COJANIEC@?$AA0?$AA?$AA@
0x180001008: WPP_SF_
0x1800105F0: "__cdecl _imp_HeapAlloc" __imp_HeapAlloc
0x180011BC0: "1.3.6.1.4.1.311.74.1.5" ??_C@_1CO@DLHKNHOP@?$AA1?$AA?4?$AA3?$AA?4?$AA6?$AA?4?$AA1?$AA?4?$AA4?$AA?4?$AA1?$AA?4?$AA3?$AA1?$AA1?$AA?4?$AA7?$AA4?$AA?4?$AA1?$AA?4?$AA5?$AA?$AA@
0x1800106A0: "__cdecl _imp_CompareStringW" __imp_CompareStringW
0x180010C40: "%s%s" ??_C@_19LJDFFCJJ@?$AA?$CF?$AAs?$AA?$CF?$AAs?$AA?$AA@
0x1800106B0: "__cdecl _imp_AcquireSRWLockExclusive" __imp_AcquireSRWLockExclusive
0x1800129C4: "__cdecl _NULL_DELAY_IMPORT_DESCRIPTOR" __NULL_DELAY_IMPORT_DESCRIPTOR
0x180017030: "__cdecl _imp_RpcBindingFree" __imp_RpcBindingFree
0x180011BB0: "SDDL" ??_C@_19KGIKMJCK@?$AAS?$AAD?$AAD?$AAL?$AA?$AA@
0x180017028: "__cdecl _imp_RpcStringBindingComposeW" __imp_RpcStringBindingComposeW
0x18000BC40: KdsGetGmsaPasswordBasedOnTimestamp
0x18000AE10: GetFullDCName
0x180010888: "__cdecl _imp__ultow_s" __imp__ultow_s
0x180013380: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-1" __IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-1
0x180015600: "__cdecl _hmod__netutils_dll" __hmod__netutils_dll
0x180013308: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-lsalookup-l1-1-2" __IMPORT_DESCRIPTOR_api-ms-win-security-lsalookup-l1-1-2
0x180010730: "__cdecl _imp_IsValidSecurityDescriptor" __imp_IsValidSecurityDescriptor
0x180010F18: "msKds-Version" ??_C@_1BM@OKPHCHHA@?$AAm?$AAs?$AAK?$AAd?$AAs?$AA?9?$AAV?$AAe?$AAr?$AAs?$AAi?$AAo?$AAn?$AA?$AA@
0x18000B268: GetCachedBCryptHandle
0x180010780: api-ms-win-security-base-private-l1-1-0_NULL_THUNK_DATA
0x180011C30: "{34e4912d-f770-4f49-b020-96dd74c" ??_C@_1EO@PDBHJFDD@?$AA?$HL?$AA3?$AA4?$AAe?$AA4?$AA9?$AA1?$AA2?$AAd?$AA?9?$AAf?$AA7?$AA7?$AA0?$AA?9?$AA4?$AAf?$AA4?$AA9?$AA?9?$AAb?$AA0?$AA2?$AA0?$AA?9?$AA9?$AA6?$AAd?$AAd?$AA7?$AA4?$AAc@
0x180010460: CRYPT32_NULL_THUNK_DATA
0x180010728: "__cdecl _imp_InitializeSecurityDescriptor" __imp_InitializeSecurityDescriptor
0x1800104A0: "__cdecl _imp_ldap_count_valuesW" __imp_ldap_count_valuesW
0x180011190: "(%s<=%s)" ??_C@_1BC@EEKPJHJP@?$AA?$CI?$AA?$CF?$AAs?$AA?$DM?$AA?$DN?$AA?$CF?$AAs?$AA?$CJ?$AA?$AA@
0x180001DE0: AddADObject
0x180002FB0: CreateRootKey
0x180010810: "__cdecl _imp_BCryptSetProperty" __imp_BCryptSetProperty
0x180010988: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x180001BC0: GenerateSingleValueStrAttribute
0x1800104D8: "__cdecl _imp_ldap_count_entries" __imp_ldap_count_entries
0x180010478: "__cdecl _imp_RtlAsn1GetModuleHandle" __imp_RtlAsn1GetModuleHandle
0x180011678: "\Microsoft\Crypto\KdsKey\" ??_C@_1DE@LCALHDMM@?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAC?$AAr?$AAy?$AAp?$AAt?$AAo?$AA?2?$AAK?$AAd?$AAs?$AAK?$AAe?$AAy?$AA?2?$AA?$AA@
0x1800107E0: "__cdecl _imp_BCryptGetProperty" __imp_BCryptGetProperty
0x180011D2C: "NULL" ??_C@_04HIBGFPH@NULL?$AA@
0x180010650: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x18000EEFB: "__cdecl _tailMerge_netutils_dll" __tailMerge_netutils_dll
0x180010760: "__cdecl _imp_GetTokenInformation" __imp_GetTokenInformation
0x180010910: "__cdecl _imp_EtwEventRegister" __imp_EtwEventRegister
0x18000BC5C: CNG_AesKeyWrap
0x1800113B0: rgbDHParam
0x180010AD0: "__cdecl _sz_logoncli_dll" __sz_logoncli_dll
0x1800108E0: "__cdecl _imp_RtlNtStatusToDosError" __imp_RtlNtStatusToDosError
0x18000EE2E: "__cdecl _imp_load_DsGetDcNameW" __imp_load_DsGetDcNameW
0x180010840: "__cdecl _imp_BCryptDestroyHash" __imp_BCryptDestroyHash
0x1800118B0: "%s/%s/%s" ??_C@_1BC@NPFHFLNO@?$AA?$CF?$AAs?$AA?1?$AA?$CF?$AAs?$AA?1?$AA?$CF?$AAs?$AA?$AA@
0x1800117D8: "PrivKeyVal" ??_C@_1BG@DHGBBHDO@?$AAP?$AAr?$AAi?$AAv?$AAK?$AAe?$AAy?$AAV?$AAa?$AAl?$AA?$AA@
0x1800106F8: api-ms-win-core-sysinfo-l1-1-0_NULL_THUNK_DATA
0x1800106E8: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x180010548: "__cdecl _imp_ResolveDelayLoadedAPI" __imp_ResolveDelayLoadedAPI
0x1800108F0: "__cdecl _imp_RtlUnicodeStringToInteger" __imp_RtlUnicodeStringToInteger
0x1800104C0: "__cdecl _imp_LdapGetLastError" __imp_LdapGetLastError
0x180011BF0: "1.3.6.1.4.1.311.74.1.1" ??_C@_1CO@LEBIEALI@?$AA1?$AA?4?$AA3?$AA?4?$AA6?$AA?4?$AA1?$AA?4?$AA4?$AA?4?$AA1?$AA?4?$AA3?$AA1?$AA1?$AA?4?$AA7?$AA4?$AA?4?$AA1?$AA?4?$AA1?$AA?$AA@
0x18000499C: AddRootMetaDataToSortedList
0x18000EA50: SidKeyDebugTraceError
0x180010770: api-ms-win-security-base-l1-1-0_NULL_THUNK_DATA
0x180002EA0: GetRootKeyDN
0x180017060: logoncli_NULL_THUNK_DATA_DLA
0x180012BA0: logoncli_NULL_THUNK_DATA_DLB
0x180012A48: logoncli_NULL_THUNK_DATA_DLN
0x180005BF0: SetServerConfig
0x1800063C0: GetSIDKeyFileName
0x180017068: "__cdecl _imp_NetApiBufferFree" __imp_NetApiBufferFree
0x180011818: "KDS public key" ??_C@_1BO@BAMLBNFK@?$AAK?$AAD?$AAS?$AA?5?$AAp?$AAu?$AAb?$AAl?$AAi?$AAc?$AA?5?$AAk?$AAe?$AAy?$AA?$AA@
0x1800057D0: GetServerConfig
0x18000289C: McGenEventWrite
0x180015000: WPP_GLOBAL_Control
0x18000A904: ValidateSIDKey
0x180010E7C: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x180013218: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0
0x180008450: GenerateSecretAgreementPrivateKey
0x18000102C: WPP_SF_D
0x18000A4B0: GetUserSidStr
0x180004790: GetAllRootKeys
0x1800116F8: ".." ??_C@_15DDHGOCBH@?$AA?4?$AA?4?$AA?$AA@
0x180017038: "__cdecl _imp_I_RpcExceptionFilter" __imp_I_RpcExceptionFilter
0x180001660: GetDCInfo
0x1800118C8: "ncacn_ip_tcp" ??_C@_1BK@BPGFLIHL@?$AAn?$AAc?$AAa?$AAc?$AAn?$AA_?$AAi?$AAp?$AA_?$AAt?$AAc?$AAp?$AA?$AA@
0x180010BA8: "configurationNamingContext" ??_C@_1DG@JEEBFMIB@?$AAc?$AAo?$AAn?$AAf?$AAi?$AAg?$AAu?$AAr?$AAa?$AAt?$AAi?$AAo?$AAn?$AAN?$AAa?$AAm?$AAi?$AAn?$AAg?$AAC?$AAo?$AAn?$AAt?$AAe?$AAx?$AAt?$AA?$AA@
0x180010860: "__cdecl _imp_BCryptKeyDerivation" __imp_BCryptKeyDerivation
0x180010788: "__cdecl _imp_LsaLookupUserAccountType" __imp_LsaLookupUserAccountType
0x1800132B8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-l1-1-0
0x1800107A8: "__cdecl _imp_LsaFreeMemory" __imp_LsaFreeMemory
0x1800129A4: "__cdecl _DELAY_IMPORT_DESCRIPTOR_netutils_dll" __DELAY_IMPORT_DESCRIPTOR_netutils_dll
0x18000EAF0: "__cdecl _security_check_cookie" __security_check_cookie
0x180007E30: GenerateKDFContext
0x180010830: "__cdecl _imp_BCryptExportKey" __imp_BCryptExportKey
0x1800131F0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0
0x180010668: api-ms-win-core-processthreads-l1-1-0_NULL_THUNK_DATA
0x1800104E0: "__cdecl _imp_ldap_value_free_len" __imp_ldap_value_free_len
0x180010530: WLDAP32_NULL_THUNK_DATA
0x180010900: "__cdecl _imp_RtlMakeSelfRelativeSD" __imp_RtlMakeSelfRelativeSD
0x18000EEEF: "__cdecl _imp_load_NetApiBufferFree" __imp_load_NetApiBufferFree
0x1800104F0: "__cdecl _imp_ldap_memfreeW" __imp_ldap_memfreeW
0x180007C04: ParseBCryptKDFParam
0x1800106F0: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x180010930: "__cdecl _imp_EtwGetTraceEnableLevel" __imp_EtwGetTraceEnableLevel
0x180010790: api-ms-win-security-lsalookup-l1-1-2_NULL_THUNK_DATA
0x180010538: "__cdecl _imp_DelayLoadFailureHook" __imp_DelayLoadFailureHook
0x1800115C0: WPP_0a914b3f944a3846d83e0d8fddc3b412_Traceguids
0x180013330: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-base-private-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-base-private-l1-1-0
0x18000B000: GetKey
0x1800105E8: "__cdecl _imp_GetProcessHeap" __imp_GetProcessHeap
0x180010590: "__cdecl _imp_FindNextFileW" __imp_FindNextFileW
0x180011928: "GetLastError()" ??_C@_0P@OLMLMBJL@GetLastError?$CI?$CJ?$AA@
0x180010778: "__cdecl _imp_IsValidRelativeSecurityDescriptor" __imp_IsValidRelativeSecurityDescriptor
0x180010470: "__cdecl _imp_RtlAsn1EncodeAndAllocate" __imp_RtlAsn1EncodeAndAllocate
0x180010E38: KdsSvcOperational
0x18000EF8C: "__cdecl _imp_load_I_RpcExceptionFilter" __imp_load_I_RpcExceptionFilter
0x180010C70: "distinguishedName" ??_C@_1CE@OEKOHCPI@?$AAd?$AAi?$AAs?$AAt?$AAi?$AAn?$AAg?$AAu?$AAi?$AAs?$AAh?$AAe?$AAd?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x180010588: "__cdecl _imp_CreateDirectoryW" __imp_CreateDirectoryW
0x180010698: api-ms-win-core-rtlsupport-l1-1-0_NULL_THUNK_DATA
0x180012984: "__cdecl _DELAY_IMPORT_DESCRIPTOR_logoncli_dll" __DELAY_IMPORT_DESCRIPTOR_logoncli_dll
0x180010468: "__cdecl _imp_RtlAsn1DecodeAndAllocate" __imp_RtlAsn1DecodeAndAllocate
0x180010700: "__cdecl _imp_SystemTimeToFileTime" __imp_SystemTimeToFileTime
0x18000EE3A: "__cdecl _tailMerge_logoncli_dll" __tailMerge_logoncli_dll
0x180010458: "__cdecl _imp_CryptBinaryToStringW" __imp_CryptBinaryToStringW
0x180013240: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0
0x1800070E0: FindAndReadSIDKeyInCache
0x180010678: api-ms-win-core-profile-l1-1-0_NULL_THUNK_DATA
0x1800107A0: "__cdecl _imp_LsaClose" __imp_LsaClose
0x180010520: "__cdecl _imp_ldap_bind_sW" __imp_ldap_bind_sW
0x180010998: "__cdecl _guard_fids_table" __guard_fids_table
0x180010890: "__cdecl _imp_wcscpy_s" __imp_wcscpy_s
0x180010480: NTASN1_NULL_THUNK_DATA
0x18000B9BC: "__cdecl GetGmsaPasswordForKeyID" _GetGmsaPasswordForKeyID
0x18000CA10: ConvertSIDToSD
0x18000E004: GetSpecifiedSidKey
0x180015620: g_MachineDefaultDcRpcCache
0x180010340: "__cdecl load_config_used" _load_config_used
0x1800131B4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-sddl-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-sddl-l1-1-0
0x180010550: api-ms-win-core-delayload-l1-1-1_NULL_THUNK_DATA
0x180007F10: GenerateDerivedKey
0x180010540: api-ms-win-core-delayload-l1-1-0_NULL_THUNK_DATA
0x180002414: McGenEventUnregister
0x180015660: g_pwszDomainDNSName
0x180013268: "__cdecl _IMPORT_DESCRIPTOR_CRYPT32" __IMPORT_DESCRIPTOR_CRYPT32
0x180011860: "onecore\ds\security\keyman\sidke" ??_C@_0DP@JAJCJDKP@onecore?2ds?2security?2keyman?2sidke@
0x180011D08: "hrCache" ??_C@_07LIGHCBDC@hrCache?$AA@
0x180002110: GetKDSSrvConfigPath
0x180007A00: DeleteAllCachedKeys
0x1800111A8: "(cn=%s)" ??_C@_1BA@DKKALPBN@?$AA?$CI?$AAc?$AAn?$AA?$DN?$AA?$CF?$AAs?$AA?$CJ?$AA?$AA@
0x180017020: "__cdecl _imp_RpcBindingFromStringBindingW" __imp_RpcBindingFromStringBindingW
0x180010CB0: "TRUE" ??_C@_19ELAAHEEL@?$AAT?$AAR?$AAU?$AAE?$AA?$AA@
0x1800107F0: "__cdecl _imp_BCryptOpenAlgorithmProvider" __imp_BCryptOpenAlgorithmProvider
0x1800110E8: "msKds-SecretAgreementParam" ??_C@_1DG@HCMBAAFB@?$AAm?$AAs?$AAK?$AAd?$AAs?$AA?9?$AAS?$AAe?$AAc?$AAr?$AAe?$AAt?$AAA?$AAg?$AAr?$AAe?$AAe?$AAm?$AAe?$AAn?$AAt?$AAP?$AAa?$AAr?$AAa?$AAm?$AA?$AA@
0x180010620: "__cdecl _imp_DisableThreadLibraryCalls" __imp_DisableThreadLibraryCalls
0x180010FF0: "nTSecurityDescriptor" ??_C@_1CK@IPFODMAF@?$AAn?$AAT?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AAD?$AAe?$AAs?$AAc?$AAr?$AAi?$AAp?$AAt?$AAo?$AAr?$AA?$AA@
0x180010688: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x180008250: TestServerConfig
0x180010878: "__cdecl _imp_BCryptGenRandom" __imp_BCryptGenRandom
0x180010868: "__cdecl _imp_BCryptGenerateSymmetricKey" __imp_BCryptGenerateSymmetricKey
0x180010670: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x180011CB0: g_rgbObjSDDL
0x180010920: "__cdecl _imp_EtwGetTraceEnableFlags" __imp_EtwGetTraceEnableFlags
0x1800106D0: "__cdecl _imp_InitializeSRWLock" __imp_InitializeSRWLock
0x180010330: g_ObjBlobSDDL
0x180010710: "__cdecl _imp_SetSecurityDescriptorGroup" __imp_SetSecurityDescriptorGroup
0x180015608: g_RPCHandleCacheLock
0x18000CEC0: ParseSidKeyResult
0x180017010: "__cdecl _imp_RpcStringFreeW" __imp_RpcStringFreeW
0x180010690: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x180011D50: "__cdecl _pfnDefaultDliFailureHook2" __pfnDefaultDliFailureHook2
0x1800113A0: "ulLdapErr" ??_C@_09GLEFCHME@ulLdapErr?$AA@
0x180010498: "__cdecl _imp_ldap_initW" __imp_ldap_initW
0x180010F58: "objectClass" ??_C@_1BI@PHJBOPCE@?$AAo?$AAb?$AAj?$AAe?$AAc?$AAt?$AAC?$AAl?$AAa?$AAs?$AAs?$AA?$AA@
0x180010D20: "cn=Group Key Distribution Servic" ??_C@_1KA@CODPHDCC@?$AAc?$AAn?$AA?$DN?$AAG?$AAr?$AAo?$AAu?$AAp?$AA?5?$AAK?$AAe?$AAy?$AA?5?$AAD?$AAi?$AAs?$AAt?$AAr?$AAi?$AAb?$AAu?$AAt?$AAi?$AAo?$AAn?$AA?5?$AAS?$AAe?$AAr?$AAv?$AAi?$AAc@
0x180002D70: FreeRootKeyConfig
0x180002880: MIDL_user_allocate
0x18000EFB0: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x180010B40: "hr" ??_C@_02FLHDKHAB@hr?$AA@
0x180010490: "__cdecl _imp_ldap_add_sW" __imp_ldap_add_sW
0x180010610: "__cdecl _imp_CreateFileTransactedW" __imp_CreateFileTransactedW
0x180010838: "__cdecl _imp_BCryptGenerateKeyPair" __imp_BCryptGenerateKeyPair
0x18000ED5B: "__cdecl _imp_load_UuidFromStringW" __imp_load_UuidFromStringW
0x180011630: "\AppData\Local" ??_C@_1BO@JPHDMIB@?$AA?2?$AAA?$AAp?$AAp?$AAD?$AAa?$AAt?$AAa?$AA?2?$AAL?$AAo?$AAc?$AAa?$AAl?$AA?$AA@
0x18000A620: GetCurrentL0ID
0x1800107D0: "__cdecl _imp_ConvertStringSecurityDescriptorToSecurityDescriptorW" __imp_ConvertStringSecurityDescriptorToSecurityDescriptorW
0x18001327C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0
0x18001331C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-lsapolicy-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-lsapolicy-l1-1-0
0x180010820: "__cdecl _imp_BCryptDestroySecret" __imp_BCryptDestroySecret
0x180011AF8: "GMSA PASSWORD" ??_C@_1BM@HGECHLDA@?$AAG?$AAM?$AAS?$AAA?$AA?5?$AAP?$AAA?$AAS?$AAS?$AAW?$AAO?$AAR?$AAD?$AA?$AA@
0x1800104A8: "__cdecl _imp_ldap_get_valuesW" __imp_ldap_get_valuesW
0x1800107B0: "__cdecl _imp_LsaOpenPolicy" __imp_LsaOpenPolicy
0x180002DF0: FreeRootKey
0x180011700: LocalSystem
0x1800115D0: rgbKDFParam
0x18000E154: GetSpecifiedKey
0x1800107F8: "__cdecl _imp_BCryptImportKey" __imp_BCryptImportKey
0x180017058: "__cdecl _imp_DsGetDcNameW" __imp_DsGetDcNameW
0x180011370: "SP800_108_CTR_HMAC" ??_C@_1CG@GKFGHMMK@?$AAS?$AAP?$AA8?$AA0?$AA0?$AA_?$AA1?$AA0?$AA8?$AA_?$AAC?$AAT?$AAR?$AA_?$AAH?$AAM?$AAA?$AAC?$AA?$AA@
0x180009ED0: GetAndLockCachedRPCBinding
0x18000A5D0: GetCurrentTimeInULL
0x180010908: "__cdecl _imp_RtlImageNtHeader" __imp_RtlImageNtHeader
0x180010BE0: "defaultNamingContext" ??_C@_1CK@PLPKJNOD@?$AAd?$AAe?$AAf?$AAa?$AAu?$AAl?$AAt?$AAN?$AAa?$AAm?$AAi?$AAn?$AAg?$AAC?$AAo?$AAn?$AAt?$AAe?$AAx?$AAt?$AA?$AA@
0x180010E68: KdsSvcCreateMRK
0x180010970: ntdll_NULL_THUNK_DATA
0x180010CC0: "cn=Group Key Distribution Servic" ??_C@_1FO@CFIMBNEF@?$AAc?$AAn?$AA?$DN?$AAG?$AAr?$AAo?$AAu?$AAp?$AA?5?$AAK?$AAe?$AAy?$AA?5?$AAD?$AAi?$AAs?$AAt?$AAr?$AAi?$AAb?$AAu?$AAt?$AAi?$AAo?$AAn?$AA?5?$AAS?$AAe?$AAr?$AAv?$AAi?$AAc@
0x180010950: "__cdecl _imp_memcpy" __imp_memcpy
0x180010448: "__cdecl _imp_CryptProtectData" __imp_CryptProtectData
0x180010E78: Microsoft_Windows_KdsSvcLevels
0x1800010D0: WPP_SF_SSS
0x180010918: "__cdecl _imp_EtwEventUnregister" __imp_EtwEventUnregister
0x180010B70: "LDAP_NO_SUCH_ATTRIBUTE" ??_C@_0BH@JFGFKJK@LDAP_NO_SUCH_ATTRIBUTE?$AA@
0x1800108A0: "__cdecl _imp_EtwEventWriteTransfer" __imp_EtwEventWriteTransfer
0x180010F98: "msKds-CreateTime" ??_C@_1CC@LJGJGOIJ@?$AAm?$AAs?$AAK?$AAd?$AAs?$AA?9?$AAC?$AAr?$AAe?$AAa?$AAt?$AAe?$AAT?$AAi?$AAm?$AAe?$AA?$AA@
0x1800108B0: "__cdecl _imp_NtCreateTransaction" __imp_NtCreateTransaction
0x180013290: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0
0x18000E980: WPP_SF_sDsd
0x180015060: "__cdecl _security_cookie" __security_cookie
0x180010898: "__cdecl _imp__wtoi64" __imp__wtoi64
0x180015668: g_pwszForestName
0x180008D40: GenerateSIDPublicKeyBlob
0x180008C2C: GenerateSecretAgreementPubKey
0x1800105D0: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x180010600: "__cdecl _imp_LocalFree" __imp_LocalFree
0x180010758: "__cdecl _imp_GetLengthSid" __imp_GetLengthSid
0x1800112A0: "(&(objectClass=msKds-ProvServerC" ??_C@_1MO@NPNFEPDI@?$AA?$CI?$AA?$CG?$AA?$CI?$AAo?$AAb?$AAj?$AAe?$AAc?$AAt?$AAC?$AAl?$AAa?$AAs?$AAs?$AA?$DN?$AAm?$AAs?$AAK?$AAd?$AAs?$AA?9?$AAP?$AAr?$AAo?$AAv?$AAS?$AAe?$AAr?$AAv?$AAe?$AAr?$AAC@
0x1800131C8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0
0x1800022D0: McGenControlCallbackV2
0x18000ED67: "__cdecl _tailMerge_rpcrt4_dll" __tailMerge_rpcrt4_dll
0x180010FE8: "cn" ??_C@_15BLKEKDJI@?$AAc?$AAn?$AA?$AA@
0x1800105C0: "__cdecl _imp_FindFirstFileExW" __imp_FindFirstFileExW
0x1800132F4: "__cdecl _IMPORT_DESCRIPTOR_profapi" __IMPORT_DESCRIPTOR_profapi
0x18000A6E0: GetIntervalStartTime
0x180010748: "__cdecl _imp_CopySid" __imp_CopySid
0x18000EF7A: "__cdecl _imp_load_NdrClientCall3" __imp_load_NdrClientCall3
0x1800116EC: "\*" ??_C@_15PKPONJIK@?$AA?2?$AA?$CK?$AA?$AA@
0x180010818: "__cdecl _imp_BCryptImportKeyPair" __imp_BCryptImportKeyPair
0x180008E6C: GenerateSecretFromSecretAgreement
0x180009480: KdsCreateClientBinding
0x1800117A8: "SecretAgreementParam" ??_C@_1CK@EALPIICH@?$AAS?$AAe?$AAc?$AAr?$AAe?$AAt?$AAA?$AAg?$AAr?$AAe?$AAe?$AAm?$AAe?$AAn?$AAt?$AAP?$AAa?$AAr?$AAa?$AAm?$AA?$AA@
0x180010C98: "msDS-isRODC" ??_C@_1BI@FGOHDJFC@?$AAm?$AAs?$AAD?$AAS?$AA?9?$AAi?$AAs?$AAR?$AAO?$AAD?$AAC?$AA?$AA@
0x180010508: "__cdecl _imp_ldap_first_entry" __imp_ldap_first_entry
0x180010558: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x180010630: "__cdecl _imp_GetCurrentThread" __imp_GetCurrentThread
0x1800108D0: "__cdecl _imp_NtCommitTransaction" __imp_NtCommitTransaction
0x180004A80: GetAllRootKeysMetaData
0x180010870: "__cdecl _imp_BCryptFinalizeKeyPair" __imp_BCryptFinalizeKeyPair
0x180009A38: FindCachedRPCHandle
0x18000EE1C: "__cdecl _imp_load_RpcStringBindingComposeW" __imp_load_RpcStringBindingComposeW
0x18000EB34: "__cdecl _security_init_cookie" __security_init_cookie
0x1800116E0: "rpcStatus" ??_C@_09NEKHPDOE@rpcStatus?$AA@
0x180010518: "__cdecl _imp_ldap_value_freeW" __imp_ldap_value_freeW
0x180010808: "__cdecl _imp_BCryptFinishHash" __imp_BCryptFinishHash
0x180010528: "__cdecl _imp_ber_free" __imp_ber_free
0x180010720: "__cdecl _imp_SetSecurityDescriptorDacl" __imp_SetSecurityDescriptorDacl
0x18000BE78: CNG_AesKeyUnwrap
0x18000EDE6: "__cdecl _imp_load_RpcStringFreeW" __imp_load_RpcStringFreeW
0x18000F065: wcscmp
0x1800107D8: api-ms-win-security-sddl-l1-1-0_NULL_THUNK_DATA
0x180011B70: "Rfc3565KeyWrapBlob" ??_C@_1CG@HHCKKMCI@?$AAR?$AAf?$AAc?$AA3?$AA5?$AA6?$AA5?$AAK?$AAe?$AAy?$AAW?$AAr?$AAa?$AAp?$AAB?$AAl?$AAo?$AAb?$AA?$AA@
0x180004700: GetRootKey
0x180007BAC: FreeBCryptBuffers
0x1800023DC: McGenEventRegister
0x180017018: "__cdecl _imp_UuidToStringW" __imp_UuidToStringW
0x180010598: "__cdecl _imp_WriteFile" __imp_WriteFile
0x180011398: "DH" ??_C@_15IEFEGGPE@?$AAD?$AAH?$AA?$AA@
0x180011660: "status" ??_C@_06DJIHEMFI@status?$AA@
0x180010580: "__cdecl _imp_GetFileSize" __imp_GetFileSize
0x18000EE0A: "__cdecl _imp_load_RpcBindingFromStringBindingW" __imp_load_RpcBindingFromStringBindingW
0x18000A670: GetCurrentIntervalID
0x18000EC10: "__cdecl _report_gsfailure" __report_gsfailure
0x180001F68: GetSidKeyServicePath
0x180013358: "__cdecl _IMPORT_DESCRIPTOR_NTASN1" __IMPORT_DESCRIPTOR_NTASN1
0x180010708: api-ms-win-core-timezone-l1-1-0_NULL_THUNK_DATA
0x1800065A4: GetSIDKeyFileNameFilter
0x1800021F0: GetMRKPath
0x180011750: "KDS service" ??_C@_1BI@MBAFNJLM@?$AAK?$AAD?$AAS?$AA?5?$AAs?$AAe?$AAr?$AAv?$AAi?$AAc?$AAe?$AA?$AA@
0x18000DC64: GetKeyFromKdsService
0x180011020: "msKds-SecretAgreementAlgorithmID" ??_C@_1EC@OIOGMMKA@?$AAm?$AAs?$AAK?$AAd?$AAs?$AA?9?$AAS?$AAe?$AAc?$AAr?$AAe?$AAt?$AAA?$AAg?$AAr?$AAe?$AAe?$AAm?$AAe?$AAn?$AAt?$AAA?$AAl?$AAg?$AAo?$AAr?$AAi?$AAt?$AAh?$AAm?$AAI?$AAD@
0x180011650: "SHA256" ??_C@_1O@HECGKAIN@?$AAS?$AAH?$AAA?$AA2?$AA5?$AA6?$AA?$AA@
0x1800058C0: ValidateSrvConfig
0x180006700: WriteSIDKeyInCache
0x180010640: "__cdecl _imp_OpenThreadToken" __imp_OpenThreadToken
0x18000B420: KdsGetKeyStartTime
0x180017008: "__cdecl _imp_NdrClientCall3" __imp_NdrClientCall3
0x180011C20: "SID" ??_C@_17HNFFEAHN@?$AAS?$AAI?$AAD?$AA?$AA@
0x1800111B8: "(%s>=%s)" ??_C@_1BC@KIJEAJAA@?$AA?$CI?$AA?$CF?$AAs?$AA?$DO?$AA?$DN?$AA?$CF?$AAs?$AA?$CJ?$AA?$AA@
0x180010740: "__cdecl _imp_InitializeAcl" __imp_InitializeAcl
0x180013204: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0
0x180004CE0: FreeServerConfig
0x180001180: WPP_SF_Sd
0x180011A98: "PrimitiveType" ??_C@_1BM@JBKFHMPN@?$AAP?$AAr?$AAi?$AAm?$AAi?$AAt?$AAi?$AAv?$AAe?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x180017040: "__cdecl _imp_RpcBindingSetAuthInfoExW" __imp_RpcBindingSetAuthInfoExW
0x180010500: "__cdecl _imp_ldap_get_values_lenW" __imp_ldap_get_values_lenW
0x18000C620: SIDKeyUnprotect
0x180010638: "__cdecl _imp_OpenProcessToken" __imp_OpenProcessToken
0x1800024D8: KdsCliShutDown
0x1800106D8: api-ms-win-core-synch-l1-1-0_NULL_THUNK_DATA
0x18000EB14: "__cdecl DllMainCRTStartupForGS2" _DllMainCRTStartupForGS2
0x180001068: WPP_SF_S
0x1800029F0: McTemplateU0z
0x180010310: g_ObjBlobDescriptor
0x18000F059: memset
0x1800133A8: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x180010B48: "ulReturn" ??_C@_08DEENFCPO@ulReturn?$AA@
0x1800028F8: McTemplateU0d
0x180010578: "__cdecl _imp_ReadFile" __imp_ReadFile

[JEB Decompiler by PNF Software]