Generated by JEB on 2019/08/01

PE: C:\Windows\System32\drivers\pcw.sys Base=0x1C0000000 SHA-256=B6AC8708A2A79B327338A19D88BF86D9A31C7AFF117440F7D4545EC94782DFAE
PDB: pcw.pdb GUID={6195DF9E-45F7-1A8A-4733C6FA0CF0F8A2} Age=1

298 located named symbols:
0x1C0002560: "RC" ??_C@_15IGNKAAHD@?$AAR?$AAC?$AA?$AA@
0x1C0006270: "__cdecl _imp_SeCaptureSubjectContext" __imp_SeCaptureSubjectContext
0x1C000CD58: SepSddlGetAclForString
0x1C00061B0: "__cdecl _imp_RtlFreeUnicodeString" __imp_RtlFreeUnicodeString
0x1C0006200: "__cdecl _imp_RtlDeriveCapabilitySidsFromName" __imp_RtlDeriveCapabilitySidsFromName
0x1C00040D8: "__cdecl _security_cookie_complement" __security_cookie_complement
0x1C00060A0: "__cdecl _imp_ObfDereferenceObject" __imp_ObfDereferenceObject
0x1C0008C50: PcwpIoctlReadNotificationData
0x1C000A9E4: PcwpDereferenceCounterSet
0x1C0004260: PfnIoCreateDeviceSecure
0x1C0006000: "__cdecl _imp_PsGetCurrentServerSilo" __imp_PsGetCurrentServerSilo
0x1C0002358: PcwCreateFail
0x1C0006268: "__cdecl _imp_ObReferenceSecurityDescriptor" __imp_ObReferenceSecurityDescriptor
0x1C0006118: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x1C00060E0: "__cdecl _imp_ExEventObjectType" __imp_ExEventObjectType
0x1C0001200: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x1C0008810: PcwpIoctlCollect
0x1C0010008: PcwInitialize
0x1C0009BCC: PcwpSendNotificationToRegistaration
0x1C0007CF8: PcwpEnumerateInstances
0x1C000B4FC: PcwpNotifyCounterSet
0x1C000A740: PcwpOpenObject
0x1C000A048: PcwpSendDisconnectNotification
0x1C0006278: "__cdecl _imp_SeAccessCheck" __imp_SeAccessCheck
0x1C00062E0: "__cdecl _imp_IoCreateDevice" __imp_IoCreateDevice
0x1C0004000: PCW_EVENT_PROVIDER_Context
0x1C00062E8: "__cdecl _imp_IoDeviceObjectType" __imp_IoDeviceObjectType
0x1C00086E0: PcwpIoctlRemoveQueryItem
0x1C0006010: "__cdecl _imp_PsGetPermanentSiloContext" __imp_PsGetPermanentSiloContext
0x1C0002568: "WD" ??_C@_15ELMAKJHJ@?$AAW?$AAD?$AA?$AA@
0x1C00060D0: "__cdecl _imp_IofCompleteRequest" __imp_IofCompleteRequest
0x1C0006208: "__cdecl _imp_RtlCreateSecurityDescriptor" __imp_RtlCreateSecurityDescriptor
0x1C000C6E0: IoDevObjCreateDeviceSecure
0x1C0006300: "__cdecl _imp_wcschr" __imp_wcschr
0x1C000A928: PcwpCreateObject
0x1C0006330: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x1C000A998: PcwpFreeCounterSet
0x1C0006120: "__cdecl _imp_ObCreateObjectType" __imp_ObCreateObjectType
0x1C000426C: PiRegStateDiscriptor
0x1C00062C0: "__cdecl _imp_RtlGetOwnerSecurityDescriptor" __imp_RtlGetOwnerSecurityDescriptor
0x1C0006308: "__cdecl _imp__wcsnicmp" __imp__wcsnicmp
0x1C000C88C: IopDevObjApplyPostCreationSettings
0x1C0006068: "__cdecl _imp_ExAcquirePushLockSharedEx" __imp_ExAcquirePushLockSharedEx
0x1C00062B0: "__cdecl _imp_MmGetSystemRoutineAddress" __imp_MmGetSystemRoutineAddress
0x1C00060F0: "__cdecl _imp_SeReleaseSecurityDescriptor" __imp_SeReleaseSecurityDescriptor
0x1C0002588: "GR" ??_C@_15DNGEKDKB@?$AAG?$AAR?$AA?$AA@
0x1C0008F20: PcwpIoctlStatelessNotify
0x1C0006260: "__cdecl _imp_RtlValidRelativeSecurityDescriptor" __imp_RtlValidRelativeSecurityDescriptor
0x1C0002378: PcwRegisterFail
0x1C0006180: "__cdecl _imp_KeWaitForSingleObject" __imp_KeWaitForSingleObject
0x1C0006040: "__cdecl _imp_PsDereferenceSiloContext" __imp_PsDereferenceSiloContext
0x1C0007078: PcwiRegisterForSiloNotifications
0x1C00061A0: "__cdecl _imp_IoFreeMiniCompletionPacket" __imp_IoFreeMiniCompletionPacket
0x1C000427C: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUkxdUhbhUnkUlyquivUznwGEUkxdkOlyq@pcw" __@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUkxdUhbhUnkUlyquivUznwGEUkxdkOlyq@pcw
0x1C0001240: memcpy
0x1C000AECC: PcwpCreateInstance
0x1C0006190: "__cdecl _imp_ZwAllocateLocallyUniqueId" __imp_ZwAllocateLocallyUniqueId
0x1C0006240: "__cdecl _imp_ObLogSecurityDescriptor" __imp_ObLogSecurityDescriptor
0x1C00099D0: PcwpCompleteInFlightNotification
0x1C0006220: "__cdecl _imp_RtlSetGroupSecurityDescriptor" __imp_RtlSetGroupSecurityDescriptor
0x1C000CBA0: SepSddlDaclFromSDDLString
0x1C00061E0: "__cdecl _imp_RtlSubAuthoritySid" __imp_RtlSubAuthoritySid
0x1C0006298: "__cdecl _imp_ZwSetValueKey" __imp_ZwSetValueKey
0x1C000B19C: PcwpCloseInstance
0x1C0006140: "__cdecl _imp_IoDeleteDevice" __imp_IoDeleteDevice
0x1C0006238: "__cdecl _imp_RtlAbsoluteToSelfRelativeSD" __imp_RtlAbsoluteToSelfRelativeSD
0x1C000109D: "__cdecl _C_specific_handler" __C_specific_handler
0x1C0007008: PcwiGetSiloSpecificCounterSetBucket
0x1C0001240: memmove
0x1C000CA24: SepSddlSecurityDescriptorFromSDDLString
0x1C0007B10: PcwpEnumerateInstancesNotification
0x1C00061D0: "__cdecl _imp_RtlLengthRequiredSid" __imp_RtlLengthRequiredSid
0x1C00061F0: "__cdecl _imp_RtlCreateAcl" __imp_RtlCreateAcl
0x1C00024E8: "IoCreateDeviceSecure" ??_C@_1CK@LEEDIGFP@?$AAI?$AAo?$AAC?$AAr?$AAe?$AAa?$AAt?$AAe?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAS?$AAe?$AAc?$AAu?$AAr?$AAe?$AA?$AA@
0x1C00089C0: PcwpIoctlSetSecurity
0x1C00098F4: PcwpCompleteNotification
0x1C000F010: PcwCounterSetGenericMap
0x1C0006058: "__cdecl _imp_KeReadStateEvent" __imp_KeReadStateEvent
0x1C00010EC: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x1C000A780: PcwpDeleteObject
0x1C000A550: PcwpDisconnectUserRegistration
0x1C0008400: PcwpDispatchCreate
0x1C0006008: "__cdecl _imp_PsIsHostSilo" __imp_PsIsHostSilo
0x1C0006028: "__cdecl _imp_PsStartSiloMonitor" __imp_PsStartSiloMonitor
0x1C0006148: "__cdecl _imp_IoSetIoCompletionEx" __imp_IoSetIoCompletionEx
0x1C00060B0: "__cdecl _imp_ObfReferenceObject" __imp_ObfReferenceObject
0x1C0006160: "__cdecl _imp_KeUnstackDetachProcess" __imp_KeUnstackDetachProcess
0x1C0002400: "\Device\PcwDrv" ??_C@_1BO@GNDHGMHM@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAP?$AAc?$AAw?$AAD?$AAr?$AAv?$AA?$AA@
0x1C0002460: "\Registry\Machine\System\Current" ??_C@_1IA@DOLOBFCI@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1C0008CC0: PcwpIoctlCompleteNotification
0x1C000D23C: SepSddlParseWideStringUlong
0x1C0007E88: PcwpAddItemToCounterSet
0x1C00023A8: Microsoft_Windows_Diagnosis_PCWKeywords
0x1C00073F4: PcwpAddCounterToBuffer
0x1C000F000: PcwDefaultSecurityDescriptor
0x1C0006128: "__cdecl _imp_ExUnregisterExtension" __imp_ExUnregisterExtension
0x1C00062A0: "__cdecl _imp_ZwDeleteValueKey" __imp_ZwDeleteValueKey
0x1C0002598: "GX" ??_C@_15FCNJEDMF@?$AAG?$AAX?$AA?$AA@
0x1C000B09C: PcwpDereferenceInstance
0x1C000B204: PcwpNextInstance
0x1C0002570: "WO" ??_C@_15JMMBCOHI@?$AAW?$AAO?$AA?$AA@
0x1C0006178: "__cdecl _imp_ExAllocatePoolWithTag" __imp_ExAllocatePoolWithTag
0x1C00060C8: "__cdecl _imp_MmUserProbeAddress" __imp_MmUserProbeAddress
0x1C000A67C: PcwpCloseUserRegistration
0x1C0006170: "__cdecl _imp_PsGetCurrentProcessId" __imp_PsGetCurrentProcessId
0x1C0002388: PcwIoctlFail
0x1C0006310: "__cdecl _imp__snwprintf" __imp__snwprintf
0x1C00095B0: PcwpPacketCompleted
0x1C000BB78: PcwpCreateDefaultSecurityDescriptor
0x1C0006100: "__cdecl _imp_EtwWriteTransfer" __imp_EtwWriteTransfer
0x1C0001154: "__cdecl _GSHandlerCheck_SEH" __GSHandlerCheck_SEH
0x1C0008740: PcwpIoctlModifyQueryItem
0x1C0006048: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x1C000260C: "A" ??_C@_13PNBDBPLL@?$AAA?$AA?$AA@
0x1C00060E8: "__cdecl _imp_SeCaptureSecurityDescriptor" __imp_SeCaptureSecurityDescriptor
0x1C000E008: PcwCounterSetBucket
0x1C0006078: "__cdecl _imp_KeLeaveCriticalRegion" __imp_KeLeaveCriticalRegion
0x1C0007F80: PcwpRemoveItemFromCounterSet
0x1C00010C8: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x1C0006210: "__cdecl _imp_RtlSetOwnerSecurityDescriptor" __imp_RtlSetOwnerSecurityDescriptor
0x1C00061F8: "__cdecl _imp_RtlAddAccessAllowedAce" __imp_RtlAddAccessAllowedAce
0x1C00060C0: "__cdecl _imp_ExAllocatePoolWithQuotaTag" __imp_ExAllocatePoolWithQuotaTag
0x1C0006218: "__cdecl _imp_SeExports" __imp_SeExports
0x1C0006080: "__cdecl _imp_ExReleasePushLockSharedEx" __imp_ExReleasePushLockSharedEx
0x1C000DD74: CmRegUtilWstrValueGetDword
0x1C0002520: "IoValidateDeviceIoControlAccess" ??_C@_1EA@BAHCLPHE@?$AAI?$AAo?$AAV?$AAa?$AAl?$AAi?$AAd?$AAa?$AAt?$AAe?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAI?$AAo?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAA?$AAc?$AAc?$AAe?$AAs?$AAs?$AA?$AA@
0x1C0009050: PcwpIoctlCheckNotifier
0x1C0006230: "__cdecl _imp_RtlLengthSecurityDescriptor" __imp_RtlLengthSecurityDescriptor
0x1C0002578: "SD" ??_C@_15NAFBOLGP@?$AAS?$AAD?$AA?$AA@
0x1C000DAFC: CmRegUtilUcValueSetUcString
0x1C000C960: SeSddlSecurityDescriptorFromSDDL
0x1C00062C8: "__cdecl _imp_RtlGetGroupSecurityDescriptor" __imp_RtlGetGroupSecurityDescriptor
0x1C00026F0: "\Registry\Machine\System\Current" ??_C@_1HC@DKINPPAJ@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1C000DC40: CmRegUtilOpenExistingWstrKey
0x1C000806C: PcwpAddItemToQuery
0x1C0009D6C: PcwpSendNotification
0x1C000E000: PcwSiloMonitor
0x1C000D4EC: PiRegStateReadStackCreationSettingsFromKey
0x1C000D6BC: PiRegStateOpenClassKey
0x1C0001008: WdmlibRtlInitUnicodeStringEx
0x1C0006280: "__cdecl _imp_SeReleaseSubjectContext" __imp_SeReleaseSubjectContext
0x1C000B360: PcwpCreateRegistration
0x1C0002670: "Security" ??_C@_1BC@FCJNIDNL@?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?$AA@
0x1C0006158: "__cdecl _imp_KeStackAttachProcess" __imp_KeStackAttachProcess
0x1C000B560: PcwRegister
0x1C0008AB0: PcwpIoctlGetSecurity
0x1C000B9B8: PcwpInitSid
0x1C0010290: GsDriverEntry
0x1C0006328: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x1C00061A8: "__cdecl _imp_ObCreateObject" __imp_ObCreateObject
0x1C00060E0: ExEventObjectType
0x1C000D340: PpRegStateReadCreateClassCreationSettings
0x1C000CC80: SepSddlGetSidForString
0x1C0007654: PcwpCollectQueryItem
0x1C0002688: "DeviceType" ??_C@_1BG@KCOOGCNN@?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x1C00060D8: "__cdecl _imp_ObReferenceObjectByHandle" __imp_ObReferenceObjectByHandle
0x1C000F008: PcwSecurityKey
0x1C0006110: "__cdecl _imp_ExRegisterExtension" __imp_ExRegisterExtension
0x1C0002770: "{%08X-%04X-%04X-%02X%02X-%02X%02" ??_C@_1GG@FCALANDO@?$AA?$HL?$AA?$CF?$AA0?$AA8?$AAX?$AA?9?$AA?$CF?$AA0?$AA4?$AAX?$AA?9?$AA?$CF?$AA0?$AA4?$AAX?$AA?9?$AA?$CF?$AA0?$AA2?$AAX?$AA?$CF?$AA0?$AA2?$AAX?$AA?9?$AA?$CF?$AA0?$AA2?$AAX?$AA?$CF?$AA0?$AA2@
0x1C0004278: Microsoft_Windows_Diagnosis_PCWEnableBits
0x1C0006030: "__cdecl _imp_PsCreateSiloContext" __imp_PsCreateSiloContext
0x1C000B770: PcwAddInstance
0x1C000C218: PcwpSetCounterSetSecurityDescriptor
0x1C00094DC: McGenEventWrite
0x1C0006258: "__cdecl _imp_ZwQueryValueKey" __imp_ZwQueryValueKey
0x1C000C148: PcwpGetCounterSetSecurityDescriptor
0x1C00024E0: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x1C0002580: "GA" ??_C@_15HPMIFLNA@?$AAG?$AAA?$AA?$AA@
0x1C000BA48: PcwpCreateAllowedDacl
0x1C000AD38: PcwpOpenCounterSet
0x1C00060C8: MmUserProbeAddress
0x1C0008430: PcwpIoctlCreateQuery
0x1C00061C8: "__cdecl _imp_RtlCompareUnicodeString" __imp_RtlCompareUnicodeString
0x1C0006290: "__cdecl _imp_SeSetSecurityDescriptorInfo" __imp_SeSetSecurityDescriptorInfo
0x1C0008128: PcwpCreateQueryItem
0x1C0001060: "__cdecl _security_check_cookie" __security_check_cookie
0x1C0002220: "D:P(A;;GA;;;SY)(A;;GRGWGX;;;BA)(" ??_C@_1BDA@CKAMBCFC@?$AAD?$AA?3?$AAP?$AA?$CI?$AAA?$AA?$DL?$AA?$DL?$AAG?$AAA?$AA?$DL?$AA?$DL?$AA?$DL?$AAS?$AAY?$AA?$CJ?$AA?$CI?$AAA?$AA?$DL?$AA?$DL?$AAG?$AAR?$AAG?$AAW?$AAG?$AAX?$AA?$DL?$AA?$DL?$AA?$DL?$AAB?$AAA?$AA?$CJ?$AA?$CI@
0x1C0006198: "__cdecl _imp_IoAllocateMiniCompletionPacket" __imp_IoAllocateMiniCompletionPacket
0x1C000B5F0: PcwUnregister
0x1C0006338: "__cdecl _IMPORT_DESCRIPTOR_ntoskrnl" __IMPORT_DESCRIPTOR_ntoskrnl
0x1C0002350: Microsoft_Windows_Diagnosis_PCWLevels
0x1C0009160: PcwpFastIoDeviceControl
0x1C0006288: "__cdecl _imp_SeQuerySecurityDescriptorInfo" __imp_SeQuerySecurityDescriptorInfo
0x1C000C404: PcwpClearCounterSetSecurityDescriptor
0x1C00078A8: PcwpCollectQuery
0x1C00011DF: "__cdecl _chkstk" __chkstk
0x1C00025A0: "SeConvertStringSecurityDescripto" ??_C@_1GM@JINLDKKK@?$AAS?$AAe?$AAC?$AAo?$AAn?$AAv?$AAe?$AAr?$AAt?$AAS?$AAt?$AAr?$AAi?$AAn?$AAg?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AAD?$AAe?$AAs?$AAc?$AAr?$AAi?$AAp?$AAt?$AAo@
0x1C000AB10: PcwpCreateCounterSet
0x1C0006060: "__cdecl _imp_RtlCompareUnicodeStrings" __imp_RtlCompareUnicodeStrings
0x1C0006108: "__cdecl _imp_ProbeForWrite" __imp_ProbeForWrite
0x1C0006018: "__cdecl _imp_PsGetSiloMonitorContextSlot" __imp_PsGetSiloMonitorContextSlot
0x1C0008550: PcwpIoctlAddQueryItem
0x1C00061C0: "__cdecl _imp_RtlDuplicateUnicodeString" __imp_RtlDuplicateUnicodeString
0x1C0006138: "__cdecl _imp_EtwUnregister" __imp_EtwUnregister
0x1C0011000: "__cdecl _guard_fids_table" __guard_fids_table
0x1C00062F0: "__cdecl _imp_ZwSetSecurityObject" __imp_ZwSetSecurityObject
0x1C000AAAC: PcwpFindCounterSet
0x1C0002110: "__cdecl load_config_used" _load_config_used
0x1C0002610: "Properties" ??_C@_1BG@COALCEMK@?$AAP?$AAr?$AAo?$AAp?$AAe?$AAr?$AAt?$AAi?$AAe?$AAs?$AA?$AA@
0x1C000935C: McGenEventUnregister
0x1C0006250: "__cdecl _imp_ZwClose" __imp_ZwClose
0x1C0006098: "__cdecl _imp_ExReleasePushLockExclusiveEx" __imp_ExReleasePushLockExclusiveEx
0x1C000D13C: SepSddlAddAceToAcl
0x1C000DCBC: CmRegUtilCreateWstrKey
0x1C00060F8: IoFileObjectType
0x1C0006188: "__cdecl _imp_KeInitializeEvent" __imp_KeInitializeEvent
0x1C00062D8: "__cdecl _imp_ObOpenObjectByPointer" __imp_ObOpenObjectByPointer
0x1C00062B8: "__cdecl _imp_RtlGetSaclSecurityDescriptor" __imp_RtlGetSaclSecurityDescriptor
0x1C0002638: "NoDisplayClass" ??_C@_1BO@DAOBINHA@?$AAN?$AAo?$AAD?$AAi?$AAs?$AAp?$AAl?$AAa?$AAy?$AAC?$AAl?$AAa?$AAs?$AAs?$AA?$AA@
0x1C0008E60: PcwpIoctlNotify
0x1C0008D70: PcwpIoctlDisconnect
0x1C00062D0: "__cdecl _imp_RtlGetDaclSecurityDescriptor" __imp_RtlGetDaclSecurityDescriptor
0x1C000D84C: PpRegStateUpdateStackCreationSettings
0x1C00062F8: "__cdecl _imp_IoIsWdmVersionAvailable" __imp_IoIsWdmVersionAvailable
0x1C00026A0: "DeviceCharacteristics" ??_C@_1CM@DIJFBEC@?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAC?$AAh?$AAa?$AAr?$AAa?$AAc?$AAt?$AAe?$AAr?$AAi?$AAs?$AAt?$AAi?$AAc?$AAs?$AA?$AA@
0x1C0004230: PiRegStateSysAllInherittedSecurityDescriptor
0x1C0004268: WdmlibInitialized
0x1C000C0C4: PcwpInitDefaultSecurityDescriptor
0x1C000F020: PcwObjectGenericMap
0x1C0007110: PcwiSiloCreateNotify
0x1C00010B0: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x1C000C510: WdmlibIoCreateDeviceSecure
0x1C00072B8: PcwpCollectNotification
0x1C0009CE8: PcwpAllocateNotification
0x1C000A328: PcwpCreateUserRegistration
0x1C00060A8: "__cdecl _imp_PsGetCurrentProcess" __imp_PsGetCurrentProcess
0x1C0008880: PcwpIoctlEnumerateInstances
0x1C0002628: "Class" ??_C@_1M@OAHBGIFG@?$AAC?$AAl?$AAa?$AAs?$AAs?$AA?$AA@
0x1C0002368: DriverLoadFail
0x1C0006020: "__cdecl _imp_PsRegisterSiloMonitor" __imp_PsRegisterSiloMonitor
0x1C00060B8: "__cdecl _imp_ObInsertObject" __imp_ObInsertObject
0x1C0004270: PcwObjectType
0x1C00023D8: PCW_EVENT_PROVIDER
0x1C000B884: McTemplateK0qhzr1hzr3
0x1C00074A8: PcwpCollectInstance
0x1C000BE74: PcwpOpenSecurityKey
0x1C0006038: "__cdecl _imp_PsInsertPermanentSiloContext" __imp_PsInsertPermanentSiloContext
0x1C0008230: PcwpCloseQueryItem
0x1C00071BC: PcwpWriteToUserBuffer
0x1C00040D0: "__cdecl _security_cookie" __security_cookie
0x1C0006150: "__cdecl _imp_MmCopyVirtualMemory" __imp_MmCopyVirtualMemory
0x1C000A750: PcwpCloseObjectHandle
0x1C000953C: McTemplateK0qq
0x1C000B930: McTemplateK0qhzr1
0x1C0009390: McGenControlCallbackV2
0x1C00026D0: "Exclusive" ??_C@_1BE@DJHAJDEM@?$AAE?$AAx?$AAc?$AAl?$AAu?$AAs?$AAi?$AAv?$AAe?$AA?$AA@
0x1C0002398: PcwAddFail
0x1C000B750: PcwCloseInstance
0x1C0009794: PcwpCopyToNotificationBuffer
0x1C000D9B8: CmRegUtilUcValueGetFullBuffer
0x1C0002420: "windowsPerformanceCounters" ??_C@_1DG@DHAIPKJ@?$AAw?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AAP?$AAe?$AAr?$AAf?$AAo?$AAr?$AAm?$AAa?$AAn?$AAc?$AAe?$AAC?$AAo?$AAu?$AAn?$AAt?$AAe?$AAr?$AAs?$AA?$AA@
0x1C0002658: "NoUseClass" ??_C@_1BG@OPOOGLJC@?$AAN?$AAo?$AAU?$AAs?$AAe?$AAC?$AAl?$AAa?$AAs?$AAs?$AA?$AA@
0x1C00102C4: "__cdecl _security_init_cookie" __security_init_cookie
0x1C0006318: "__cdecl _imp___chkstk" __imp___chkstk
0x1C0006130: "__cdecl _imp_EtwRegister" __imp_EtwRegister
0x1C000A8AC: PcwpReferenceObjectByHandle
0x1C0006168: "__cdecl _imp_KeSetEvent" __imp_KeSetEvent
0x1C000F030: PcwpCallbackTable
0x1C0008330: PcwpCaptureString
0x1C0008DD0: PcwpIoctlCreateNotifier
0x1C000949C: McGenEventRegister
0x1C000C5F4: SeUtilSecurityInfoFromSecurityDescriptor
0x1C00062E8: IoDeviceObjectType
0x1C0006090: "__cdecl _imp_ExAcquirePushLockExclusiveEx" __imp_ExAcquirePushLockExclusiveEx
0x1C0002590: "GW" ??_C@_15KLKFDJD@?$AAG?$AAW?$AA?$AA@
0x1C00023E8: "PcwObject" ??_C@_1BE@ONHBPANG@?$AAP?$AAc?$AAw?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AA?$AA@
0x1C00061E8: "__cdecl _imp_RtlLengthSid" __imp_RtlLengthSid
0x1C0001090: "__cdecl _report_gsfailure" __report_gsfailure
0x1C00071B0: PcwiSiloTerminateNotify
0x1C00062A8: "__cdecl _imp_ZwCreateKey" __imp_ZwCreateKey
0x1C00071D8: PcwpWildcardMatch
0x1C000A214: PcwpCreateNotifier
0x1C00060F8: "__cdecl _imp_IoFileObjectType" __imp_IoFileObjectType
0x1C000BF08: PcwpReadSecurityDescriptor
0x1C000B2AC: PcwpNotifyOfPreExistingItems
0x1C0006320: ntoskrnl_NULL_THUNK_DATA
0x1C0006088: "__cdecl _imp_ExFreePoolWithTag" __imp_ExFreePoolWithTag
0x1C00061B8: "__cdecl _imp_ObDereferenceSecurityDescriptor" __imp_ObDereferenceSecurityDescriptor
0x1C0006070: "__cdecl _imp_KeEnterCriticalRegion" __imp_KeEnterCriticalRegion
0x1C0007C18: PcwpAddInstanceNameToBuffer
0x1C00061D8: "__cdecl _imp_RtlInitializeSid" __imp_RtlInitializeSid
0x1C0006228: "__cdecl _imp_RtlSetDaclSecurityDescriptor" __imp_RtlSetDaclSecurityDescriptor
0x1C000B6C0: PcwCreateInstance
0x1C00101A8: DriverEntry
0x1C0002000: SDDL_DEVOBJ_SYS_ALL_ADM_RWX_WORLD_R_PCW_RW
0x1C0009630: PcwpReadInFlightNotificationBuffer
0x1C000F060: PcwpFastIoDispatchTable
0x1C0006248: "__cdecl _imp_ZwOpenKey" __imp_ZwOpenKey
0x1C0008B30: PcwpIoctlRegister
0x1C0001580: memset
0x1C000634C: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x1C0006050: "__cdecl _imp_PsIsThreadTerminating" __imp_PsIsThreadTerminating

[JEB Decompiler by PNF Software]