Generated by JEB on 2019/08/01

PE: C:\Windows\System32\drivers\filecrypt.sys Base=0x1C0000000 SHA-256=B6DB41FB3D863C53E92BAF60DD6CED702C29594F66673582DA986E7648080E3E
PDB: filecrypt.pdb GUID={ABB07DFA-C750-33D8-9064EFCBF4832F89} Age=1

390 located named symbols:
0x1C00047A0: "\Music\" ??_C@_1BA@OLPEJGKN@?$AA?2?$AAM?$AAu?$AAs?$AAi?$AAc?$AA?2?$AA?$AA@
0x1C00082E8: "__cdecl _imp_RtlEnumerateGenericTableWithoutSplaying" __imp_RtlEnumerateGenericTableWithoutSplaying
0x1C000F468: StSecpSealKey
0x1C00080E8: "__cdecl _imp_FltSetCallbackDataDirty" __imp_FltSetCallbackDataDirty
0x1C000C720: FCpFreeChamberId
0x1C0005038: "PackageRoot" ??_C@_1BI@KNNMCPLL@?$AAP?$AAa?$AAc?$AAk?$AAa?$AAg?$AAe?$AAR?$AAo?$AAo?$AAt?$AA?$AA@
0x1C00082E0: "__cdecl _imp_ExAcquireFastMutex" __imp_ExAcquireFastMutex
0x1C0004C98: "SkipSealKey" ??_C@_1BI@CKJHFMJF@?$AAS?$AAk?$AAi?$AAp?$AAS?$AAe?$AAa?$AAl?$AAK?$AAe?$AAy?$AA?$AA@
0x1C00045B0: "CacheLifetime" ??_C@_1BM@MNAAHDOG@?$AAC?$AAa?$AAc?$AAh?$AAe?$AAL?$AAi?$AAf?$AAe?$AAt?$AAi?$AAm?$AAe?$AA?$AA@
0x1C00061F0: g_StSecFolderPropertyCacheListHead
0x1C0008268: "__cdecl _imp_RtlFreeUnicodeString" __imp_RtlFreeUnicodeString
0x1C000D96C: StSecpFindFolderPropertyPolicyElement
0x1C0004B10: "<PackageFullNameRedirected>" ??_C@_1DI@ONGOLJEF@?$AA?$DM?$AAP?$AAa?$AAc?$AAk?$AAa?$AAg?$AAe?$AAF?$AAu?$AAl?$AAl?$AAN?$AAa?$AAm?$AAe?$AAR?$AAe?$AAd?$AAi?$AAr?$AAe?$AAc?$AAt?$AAe?$AAd?$AA?$DO?$AA?$AA@
0x1C0004F90: "PackageSid" ??_C@_1BG@CKBLLBMF@?$AAP?$AAa?$AAc?$AAk?$AAa?$AAg?$AAe?$AAS?$AAi?$AAd?$AA?$AA@
0x1C00063C0: g_cbHashOutputLength
0x1C0006400: g_PackageRoot
0x1C0006000: FileCryptGuid_Context
0x1C0008070: "__cdecl _imp_FltGetFileNameInformation" __imp_FltGetFileNameInformation
0x1C00060F8: "__cdecl _security_cookie_complement" __security_cookie_complement
0x1C000DC6C: StSecpGetAppSid
0x1C00081B0: "__cdecl _imp_ObfDereferenceObject" __imp_ObfDereferenceObject
0x1C0004820: "VideosChamber" ??_C@_1BM@BJBEHELL@?$AAV?$AAi?$AAd?$AAe?$AAo?$AAs?$AAC?$AAh?$AAa?$AAm?$AAb?$AAe?$AAr?$AA?$AA@
0x1C0001CD4: mbtowc
0x1C000ACA0: FCpRetrieveAppPairingId
0x1C000C4B0: FCpAccessCheck
0x1C0004C90: "MK" ??_C@_15LBOOJINC@?$AAM?$AAK?$AA?$AA@
0x1C0008218: "__cdecl _imp_ExInitializeNPagedLookasideList" __imp_ExInitializeNPagedLookasideList
0x1C0004908: ParseFileNameInformationFailure
0x1C0008198: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x1C00060D0: gMusicPath
0x1C000612C: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUzkknlwvoUpzkkcUoryuhUlyquivUznwGEUkxsOlyq@KAppxLibFs" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUzkknlwvoUpzkkcUoryuhUlyquivUznwGEUkxsOlyq@KAppxLibFs
0x1C0001E90: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x1C0006114: g_CacheCleanupTriggerSize
0x1C000C6EC: FCpEqualChamberIds
0x1C0004678: "DebugTraceLevel" ??_C@_1CA@CAKGHBMK@?$AAD?$AAe?$AAb?$AAu?$AAg?$AAT?$AAr?$AAa?$AAc?$AAe?$AAL?$AAe?$AAv?$AAe?$AAl?$AA?$AA@
0x1C00010B0: "__cdecl vsnwprintf" _vsnwprintf
0x1C00081E0: "__cdecl _imp_SeAccessCheck" __imp_SeAccessCheck
0x1C0008250: "__cdecl _imp_ZwEnumerateKey" __imp_ZwEnumerateKey
0x1C000238C: FCAllocateShadowBuffer
0x1C00081A0: "__cdecl _imp_ExpInterlockedPushEntrySList" __imp_ExpInterlockedPushEntrySList
0x1C00063C4: g_cbHashObjectLength
0x1C000DAB4: StSecpFindSecurityDescriptorPolicyElement
0x1C0008150: "__cdecl _imp_BCryptDestroyKey" __imp_BCryptDestroyKey
0x1C000F130: StSecpCacheGenericTableAllocRoutine
0x1C000A4B0: StSecInitialize
0x1C00080C0: "__cdecl _imp_FltAllocateContext" __imp_FltAllocateContext
0x1C000D624: StSecpDeriveChamberProfileKey
0x1C0004480: "\Registry\Machine\System\Control" ??_C@_1JC@JNJAEODE@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl@
0x1C00081B8: "__cdecl _imp_MmBuildMdlForNonPagedPool" __imp_MmBuildMdlForNonPagedPool
0x1C0006110: g_CacheMaxSize
0x1C00083A0: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x1C00080A0: "__cdecl _imp_FltGetDestinationFileNameInformation" __imp_FltGetDestinationFileNameInformation
0x1C000FFF8: KappxGetSecurityDescriptorStringForPackageFullName
0x1C0008240: "__cdecl _imp__wcsnicmp" __imp__wcsnicmp
0x1C0004EF0: "\Registry\Machine\Software\Micro" ??_C@_1KA@MJBBPFPH@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x1C00082D0: "__cdecl _imp_MmGetSystemRoutineAddress" __imp_MmGetSystemRoutineAddress
0x1C0004FB0: "\Registry\Machine\Software\Micro" ??_C@_1IC@GKFGAIAB@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x1C000E794: StSecpOpenMasterKeyHandle
0x1C0004A08: DriverEntryFailure
0x1C0008190: "__cdecl _imp_FsRtlIsMobileOS" __imp_FsRtlIsMobileOS
0x1C0008110: "__cdecl _imp_BCryptCreateHash" __imp_BCryptCreateHash
0x1C00037D8: RtlStringCbCopyNW
0x1C0004328: "FolderId" ??_C@_1BC@FDGKDNLA@?$AAF?$AAo?$AAl?$AAd?$AAe?$AAr?$AAI?$AAd?$AA?$AA@
0x1C0008330: "__cdecl _imp_RtlAppendUnicodeStringToString" __imp_RtlAppendUnicodeStringToString
0x1C0004A58: "AES" ??_C@_17PJMHNJHG@?$AAA?$AAE?$AAS?$AA?$AA@
0x1C000AE90: StSecpGetSecurityDescriptorPolicy
0x1C00083E4: "__cdecl _IMPORT_DESCRIPTOR_tbs" __IMPORT_DESCRIPTOR_tbs
0x1C0004A38: "ChainingModeCBC" ??_C@_1CA@NDPDKCGP@?$AAC?$AAh?$AAa?$AAi?$AAn?$AAi?$AAn?$AAg?$AAM?$AAo?$AAd?$AAe?$AAC?$AAB?$AAC?$AA?$AA@
0x1C00041C0: Callbacks
0x1C000E02C: StSecpGetSidFromPackageFamilyName
0x1C00011B0: "__cdecl wcsicmp" _wcsicmp
0x1C00042C0: "__cdecl _guard_iat_table" __guard_iat_table
0x1C000BC40: FCPostCreate
0x1C0001EC0: memcpy
0x1C0008140: "__cdecl _imp_BCryptDecrypt" __imp_BCryptDecrypt
0x1C000FA80: KappxGetPackageRootPathForPackageFullName
0x1C0008100: "__cdecl _imp_BCryptDuplicateHash" __imp_BCryptDuplicateHash
0x1C0006240: gPre2PostIoContextList
0x1C0008298: "__cdecl _imp_RtlSubAuthoritySid" __imp_RtlSubAuthoritySid
0x1C000F190: StSecpCacheGenericTableFreeRoutine
0x1C00082B0: "__cdecl _imp_ZwSetValueKey" __imp_ZwSetValueKey
0x1C00062C0: gPre2PostCreateContextList
0x1C00063E8: g_WorkItemQueued
0x1C00082B8: "__cdecl _imp_ZwFlushKey" __imp_ZwFlushKey
0x1C000109D: "__cdecl _C_specific_handler" __C_specific_handler
0x1C000E21C: StSecpGetStorageFolderProperty
0x1C0001EC0: memmove
0x1C00061A0: g_StSecKeyMutex
0x1C00049D8: GetSystemAddressFailure
0x1C0008188: "__cdecl _imp_RtlCopyUnicodeString" __imp_RtlCopyUnicodeString
0x1C0008030: "__cdecl _imp_FltLockUserBuffer" __imp_FltLockUserBuffer
0x1C0004928: PreReadFailure
0x1C0001D4C: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x1C0008018: "__cdecl _imp_FltCreateFileEx" __imp_FltCreateFileEx
0x1C00080D0: "__cdecl _imp_FltRegisterFilter" __imp_FltRegisterFilter
0x1C0003760: RtlStringCbCatW
0x1C0008060: "__cdecl _imp_FltReleaseFileNameInformation" __imp_FltReleaseFileNameInformation
0x1C0008300: "__cdecl _imp_RtlLookupElementGenericTable" __imp_RtlLookupElementGenericTable
0x1C0004BF8: "Install" ??_C@_1BA@BJPGMHHO@?$AAI?$AAn?$AAs?$AAt?$AAa?$AAl?$AAl?$AA?$AA@
0x1C000C5F0: FCpConstructFullPath
0x1C0008038: "__cdecl _imp_FltClose" __imp_FltClose
0x1C00080B8: "__cdecl _imp_FltGetVolumeName" __imp_FltGetVolumeName
0x1C0004C20: "\REGISTRY\MACHINE\Software\Micro" ??_C@_1HA@PMMMPDKD@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x1C00082F8: "__cdecl _imp_ExReleaseFastMutex" __imp_ExReleaseFastMutex
0x1C000BBB0: FCFilterUnload
0x1C000A640: StSecpInitializePolicyCache
0x1C000363C: FCpEncEncrypt
0x1C0004988: InvalidBufferFailure
0x1C0002A00: FCPreRead
0x1C0008170: "__cdecl _imp_RtlPrefixUnicodeString" __imp_RtlPrefixUnicodeString
0x1C0008220: "__cdecl _imp_ExAllocatePoolWithTag" __imp_ExAllocatePoolWithTag
0x1C00048B8: LockUserBufferFailure
0x1C0004948: GenerateSymmetricKeyFailure
0x1C0006130: g_SkipSealKey
0x1C0006340: gShadowBufferList
0x1C0004778: Microsoft_Windows_FileCryptKeywords
0x1C0004A60: "BlockLength" ??_C@_1BI@JJDKEEML@?$AAB?$AAl?$AAo?$AAc?$AAk?$AAL?$AAe?$AAn?$AAg?$AAt?$AAh?$AA?$AA@
0x1C000E118: StSecpGetSidFromProductId
0x1C0008248: "__cdecl _imp_EtwWriteTransfer" __imp_EtwWriteTransfer
0x1C00063DC: FcDebugTraceLevel
0x1C0006230: g_WorkItem
0x1C0008108: "__cdecl _imp_BCryptHashData" __imp_BCryptHashData
0x1C00080F0: FLTMGR_NULL_THUNK_DATA
0x1C00048F8: AccessCheckFailure
0x1C0001DF8: "__cdecl _GSHandlerCheck_SEH" __GSHandlerCheck_SEH
0x1C00081D0: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x1C0004840: "{0b7992da-c5e6-41e3-b24f-55419b9" ??_C@_1EO@HCJHDGPG@?$AA?$HL?$AA0?$AAb?$AA7?$AA9?$AA9?$AA2?$AAd?$AAa?$AA?9?$AAc?$AA5?$AAe?$AA6?$AA?9?$AA4?$AA1?$AAe?$AA3?$AA?9?$AAb?$AA2?$AA4?$AAf?$AA?9?$AA5?$AA5?$AA4?$AA1?$AA9?$AAb?$AA9@
0x1C000DE74: StSecpGetParameterValue
0x1C00080E0: "__cdecl _imp_FltSetFsZeroingOffsetRequired" __imp_FltSetFsZeroingOffsetRequired
0x1C0004918: DecryptWorkerFailure
0x1C0008048: "__cdecl _imp_FltCancelFileOpen" __imp_FltCancelFileOpen
0x1C0004528: "RtlQueryRegistryValuesEx" ??_C@_1DC@OAPHKEJN@?$AAR?$AAt?$AAl?$AAQ?$AAu?$AAe?$AAr?$AAy?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AAV?$AAa?$AAl?$AAu?$AAe?$AAs?$AAE?$AAx?$AA?$AA@
0x1C000CDCC: FCpEncStreamCleanup
0x1C0001D28: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x1C00081A8: "__cdecl _imp_IoAllocateMdl" __imp_IoAllocateMdl
0x1C0006100: "__cdecl _mb_cur_max" __mb_cur_max
0x1C0001DB4: "__cdecl flswbuf" _flswbuf
0x1C0006140: g_StSecCacheGenericTable
0x1C000C7A0: FCpObtainSecurityInfo
0x1C00081E8: "__cdecl _imp_ExpInterlockedPopEntrySList" __imp_ExpInterlockedPopEntrySList
0x1C0004618: "BypassAccessChecks" ??_C@_1CG@JDIANKCI@?$AAB?$AAy?$AAp?$AAa?$AAs?$AAs?$AAA?$AAc?$AAc?$AAe?$AAs?$AAs?$AAC?$AAh?$AAe?$AAc?$AAk?$AAs?$AA?$AA@
0x1C00046A0: "(null)" ??_C@_1O@CEDCILHN@?$AA?$CI?$AAn?$AAu?$AAl?$AAl?$AA?$CJ?$AA?$AA@
0x1C0008160: "__cdecl _imp_BCryptCloseAlgorithmProvider" __imp_BCryptCloseAlgorithmProvider
0x1C000FCD4: KappxGetPackageSidFromPackageFamilyNameInRegistry
0x1C000D420: StSecpCheckConditionalPolicy
0x1C0004790: "NULL" ??_C@_19CIJIHAKK@?$AAN?$AAU?$AAL?$AAL?$AA?$AA@
0x1C0006050: FilterRegistration
0x1C0008078: "__cdecl _imp_FltIsDirectory" __imp_FltIsDirectory
0x1C0008000: "__cdecl _imp_FltGetDiskDeviceObject" __imp_FltGetDiskDeviceObject
0x1C000340C: McTemplateK0zzd
0x1C00063D8: gFCFlags
0x1C0006128: gbl_errno
0x1C0008200: "__cdecl _imp_RtlGetVersion" __imp_RtlGetVersion
0x1C0004380: "Debug" ??_C@_1M@OPFBIOCF@?$AAD?$AAe?$AAb?$AAu?$AAg?$AA?$AA@
0x1C00061E0: g_StSecSecurityDescriptorCacheListHead
0x1C00010CC: "__cdecl vsnwprintf_l" _vsnwprintf_l
0x1C0004A18: PostCreateFailure
0x1C00082A0: "__cdecl _imp_SeConvertSidToStringSid" __imp_SeConvertSidToStringSid
0x1C0008088: "__cdecl _imp_FltReleaseContext" __imp_FltReleaseContext
0x1C000E0B0: StSecpGetSidFromPackageFullName
0x1C0004A28: DecryptFailure
0x1C000C480: FCPreSetInformation
0x1C000BF60: FCPreCreate
0x1C00081F0: "__cdecl _imp_RtlVolumeDeviceToDosName" __imp_RtlVolumeDeviceToDosName
0x1C00045E0: "FilterEmulatedExternalDrive" ??_C@_1DI@DDDOFHEC@?$AAF?$AAi?$AAl?$AAt?$AAe?$AAr?$AAE?$AAm?$AAu?$AAl?$AAa?$AAt?$AAe?$AAd?$AAE?$AAx?$AAt?$AAe?$AAr?$AAn?$AAa?$AAl?$AAD?$AAr?$AAi?$AAv?$AAe?$AA?$AA@
0x1C00038E4: RtlStringCbPrintfW
0x1C000A7A0: StSecpGetFolderPropertyPolicy
0x1C0008270: "__cdecl _imp_FsRtlDissectName" __imp_FsRtlDissectName
0x1C00047C8: "\Videos\" ??_C@_1BC@LAEMFBAI@?$AA?2?$AAV?$AAi?$AAd?$AAe?$AAo?$AAs?$AA?2?$AA?$AA@
0x1C0004340: "ChamberId" ??_C@_1BE@LHCOJMCI@?$AAC?$AAh?$AAa?$AAm?$AAb?$AAe?$AAr?$AAI?$AAd?$AA?$AA@
0x1C00081F8: "__cdecl _imp_MmMdlPageContentsState" __imp_MmMdlPageContentsState
0x1C0004358: "SecurityDescriptor" ??_C@_1CG@KBIJJJCD@?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AAD?$AAe?$AAs?$AAc?$AAr?$AAi?$AAp?$AAt?$AAo?$AAr?$AA?$AA@
0x1C00049B8: GetFileNameInformationFailure
0x1C0008120: "__cdecl _imp_BCryptSetProperty" __imp_BCryptSetProperty
0x1C0011010: GsDriverEntry
0x1C0008398: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x1C0008148: "__cdecl _imp_BCryptGetProperty" __imp_BCryptGetProperty
0x1C0004800: "PicturesChamber" ??_C@_1CA@GIFIADEH@?$AAP?$AAi?$AAc?$AAt?$AAu?$AAr?$AAe?$AAs?$AAC?$AAh?$AAa?$AAm?$AAb?$AAe?$AAr?$AA?$AA@
0x1C0008158: "__cdecl _imp_BCryptEncrypt" __imp_BCryptEncrypt
0x1C00063F0: g_MasterKey
0x1C00047B0: "\Pictures\" ??_C@_1BG@CCACIONH@?$AA?2?$AAP?$AAi?$AAc?$AAt?$AAu?$AAr?$AAe?$AAs?$AA?2?$AA?$AA@
0x1C0006200: g_cbHashObject
0x1C00060C0: gPicturesPath
0x1C00081D8: "__cdecl _imp_RtlAppendUnicodeToString" __imp_RtlAppendUnicodeToString
0x1C0004220: CallbacksMobile
0x1C000EEC0: StSecpCacheCleanupWorkItem
0x1C0004A78: "ChainingMode" ??_C@_1BK@BCJKEJJO@?$AAC?$AAh?$AAa?$AAi?$AAn?$AAi?$AAn?$AAg?$AAM?$AAo?$AAd?$AAe?$AA?$AA@
0x1C0004A98: "<PackageFamilyName>" ??_C@_1CI@HJGECCFO@?$AA?$DM?$AAP?$AAa?$AAc?$AAk?$AAa?$AAg?$AAe?$AAF?$AAa?$AAm?$AAi?$AAl?$AAy?$AAN?$AAa?$AAm?$AAe?$AA?$DO?$AA?$AA@
0x1C0003300: McTemplateK0pd
0x1C0008128: "__cdecl _imp_BCryptDestroyHash" __imp_BCryptDestroyHash
0x1C000336C: McTemplateK0zd
0x1C0004770: Microsoft_Windows_FileCryptLevels
0x1C0004658: "EncryptMedia" ??_C@_1BK@OBNDFHAL@?$AAE?$AAn?$AAc?$AAr?$AAy?$AAp?$AAt?$AAM?$AAe?$AAd?$AAi?$AAa?$AA?$AA@
0x1C0002330: ExFreeToNPagedLookasideList
0x1C0004AD8: "<PackageFullName>" ??_C@_1CE@MNGPJLFA@?$AA?$DM?$AAP?$AAa?$AAc?$AAk?$AAa?$AAg?$AAe?$AAF?$AAu?$AAl?$AAl?$AAN?$AAa?$AAm?$AAe?$AA?$DO?$AA?$AA@
0x1C0004CB0: "D:AI(A;OICI;0x1200a9;;;BU)(A;ID;" ??_C@_1CDK@KPLAEJCM@?$AAD?$AA?3?$AAA?$AAI?$AA?$CI?$AAA?$AA?$DL?$AAO?$AAI?$AAC?$AAI?$AA?$DL?$AA0?$AAx?$AA1?$AA2?$AA0?$AA0?$AAa?$AA9?$AA?$DL?$AA?$DL?$AA?$DL?$AAB?$AAU?$AA?$CJ?$AA?$CI?$AAA?$AA?$DL?$AAI?$AAD?$AA?$DL@
0x1C0003244: McGenEventWrite
0x1C000E978: StSecpReadSealedKeyBlob
0x1C0004698: "(null)" ??_C@_06OJHGLDPL@?$CInull?$CJ?$AA@
0x1C0008230: "__cdecl _imp_ZwQueryValueKey" __imp_ZwQueryValueKey
0x1C0008068: "__cdecl _imp_FltQueryVolumeInformation" __imp_FltQueryVolumeInformation
0x1C000EB34: StSecpWriteSealedKeyBlob
0x1C00048E8: PreWriteFailure
0x1C000D01C: FCpEncVolumeStart
0x1C00081C0: "__cdecl _imp_IoGetFileObjectGenericMapping" __imp_IoGetFileObjectGenericMapping
0x1C000D2D4: StSecGetChamberProfileEncryptionKey
0x1C0008050: "__cdecl _imp_FltStartFiltering" __imp_FltStartFiltering
0x1C0008098: "__cdecl _imp_FltAllocateGenericWorkItem" __imp_FltAllocateGenericWorkItem
0x1C00046B0: "__cdecl _lookuptable" __lookuptable
0x1C0008278: "__cdecl _imp_RtlCompareUnicodeString" __imp_RtlCompareUnicodeString
0x1C0008260: "__cdecl _imp_RtlCreateUnicodeString" __imp_RtlCreateUnicodeString
0x1C0001060: "__cdecl _security_check_cookie" __security_check_cookie
0x1C0008178: "__cdecl _imp_IoGetLowerDeviceObject" __imp_IoGetLowerDeviceObject
0x1C0006118: g_CacheLifetime
0x1C0008258: "__cdecl _imp_ZwQueryKey" __imp_ZwQueryKey
0x1C00083BC: "__cdecl _IMPORT_DESCRIPTOR_FLTMGR" __IMPORT_DESCRIPTOR_FLTMGR
0x1C00083A8: "__cdecl _IMPORT_DESCRIPTOR_ntoskrnl" __IMPORT_DESCRIPTOR_ntoskrnl
0x1C00048D8: GetSecurityDescriptorFailure
0x1C0006208: Microsoft_Windows_FileCryptEnableBits
0x1C0004580: "CacheCleanupTriggerSize" ??_C@_1DA@MHGDCHIH@?$AAC?$AAa?$AAc?$AAh?$AAe?$AAC?$AAl?$AAe?$AAa?$AAn?$AAu?$AAp?$AAT?$AAr?$AAi?$AAg?$AAg?$AAe?$AAr?$AAS?$AAi?$AAz?$AAe?$AA?$AA@
0x1C0004518: "StSec" ??_C@_1M@JKGOKGKP@?$AAS?$AAt?$AAS?$AAe?$AAc?$AA?$AA@
0x1C000F294: StSecpGetMasterKey
0x1C0004390: "\System Volume Information\WPApp" ??_C@_1FK@DDKDGKFL@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?5?$AAV?$AAo?$AAl?$AAu?$AAm?$AAe?$AA?5?$AAI?$AAn?$AAf?$AAo?$AAr?$AAm?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?2?$AAW?$AAP?$AAA?$AAp?$AAp@
0x1C00080A8: "__cdecl _imp_FltGetVolumeProperties" __imp_FltGetVolumeProperties
0x1C00026B8: FCFreeShadowBuffer
0x1C0001C68: "__cdecl get_printf_count_output" _get_printf_count_output
0x1C0008378: "__cdecl _imp_Tbsip_Submit_Command" __imp_Tbsip_Submit_Command
0x1C00112B0: FCReadDriverParameters
0x1C0004938: PreCreateFailure
0x1C0008340: "__cdecl _imp_ZwQuerySecurityObject" __imp_ZwQuerySecurityObject
0x1C00082F0: "__cdecl _imp_RtlDeleteElementGenericTable" __imp_RtlDeleteElementGenericTable
0x1C000E4A8: StSecpGetStorageFolderStringSecurityDescriptor
0x1C0004890: "SDCARD" ??_C@_1O@IDMBPMLH@?$AAS?$AAD?$AAC?$AAA?$AAR?$AAD?$AA?$AA@
0x1C0001DD0: "__cdecl invalid_parameter" _invalid_parameter
0x1C000F1BC: StSecpGetChamberProfileKey
0x1C00049F8: GetChamberProfileEncryptionKeyFailure
0x1C0004110: ContextRegistration
0x1C00023E0: FCDecryptWorker
0x1C000B530: StSecpCacheInitialize
0x1C00080C8: "__cdecl _imp_FltGetVolumeContext" __imp_FltGetVolumeContext
0x1C00063D0: g_HashProvider
0x1C0004958: PostReadFailure
0x1C0008208: "__cdecl _imp_EtwUnregister" __imp_EtwUnregister
0x1C0012000: "__cdecl _guard_fids_table" __guard_fids_table
0x1C0008058: "__cdecl _imp_FltGetStreamContext" __imp_FltGetStreamContext
0x1C0004000: "__cdecl load_config_used" _load_config_used
0x1C000622C: ExDefaultNonPagedPoolType
0x1C0006220: gFilterHandle
0x1C000320C: McGenEventUnregister
0x1C0008358: "__cdecl _imp_ZwClose" __imp_ZwClose
0x1C00049E8: PreRenameFailure
0x1C00063EC: g_MasterKeyPersisted
0x1C00029A0: FCPostWrite
0x1C000C8F0: FCpPreRename
0x1C0004AC0: "<ProductId>" ??_C@_1BI@IHBIKCFJ@?$AA?$DM?$AAP?$AAr?$AAo?$AAd?$AAu?$AAc?$AAt?$AAI?$AAd?$AA?$DO?$AA?$AA@
0x1C0008138: "__cdecl _imp_BCryptOpenAlgorithmProvider" __imp_BCryptOpenAlgorithmProvider
0x1C000CE34: FCpEncStreamStart
0x1C000BB10: FCCleanupStreamContext
0x1C00022F0: ExAllocateFromNPagedLookasideList
0x1C00082C0: "__cdecl _imp_KeInitializeEvent" __imp_KeInitializeEvent
0x1C0008130: "__cdecl _imp_BCryptGenRandom" __imp_BCryptGenRandom
0x1C0008118: "__cdecl _imp_BCryptGenerateSymmetricKey" __imp_BCryptGenerateSymmetricKey
0x1C0001DD9: RtlAnsiCharToUnicodeChar
0x1C0008168: ksecdd_NULL_THUNK_DATA
0x1C00042F8: "ObjectLength" ??_C@_1BK@GPNIFMAA@?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAL?$AAe?$AAn?$AAg?$AAt?$AAh?$AA?$AA@
0x1C0004998: ConstructFullPathFailure
0x1C0008010: "__cdecl _imp_FltFreeGenericWorkItem" __imp_FltFreeGenericWorkItem
0x1C00081C8: "__cdecl _imp_ExDeleteNPagedLookasideList" __imp_ExDeleteNPagedLookasideList
0x1C0003834: RtlStringCbCopyW
0x1C0004978: ObtainSdAndChamberIdFailure
0x1C0001DD0: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x1C0005050: "\??\%ws\" ??_C@_1BC@KIHODPLO@?$AA?2?$AA?$DP?$AA?$DP?$AA?2?$AA?$CF?$AAw?$AAs?$AA?2?$AA?$AA@
0x1C0008280: "__cdecl _imp_RtlDowncaseUnicodeString" __imp_RtlDowncaseUnicodeString
0x1C0003738: FCpInitializeIvBuffer
0x1C0004FA8: "" ??_C@_13NOLLCAOD@?$AA?$AA?$AA?$AA@
0x1C0008350: "__cdecl _imp_MmMapLockedPagesSpecifyCache" __imp_MmMapLockedPagesSpecifyCache
0x1C000EBF4: StSecpAddChamberProfileKey
0x1C00061D8: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUhvxfirgbUhgliztvhvxUlyquivUznwGEUkxsOlyq@StorageSec" __@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUhvxfirgbUhgliztvhvxUlyquivUznwGEUkxsOlyq@StorageSec
0x1C00048A0: ":" ??_C@_13EBCNDICG@?$AA?3?$AA?$AA@
0x1C00032A8: McTemplateK0d
0x1C0008080: "__cdecl _imp_FltReadFile" __imp_FltReadFile
0x1C00048A8: EncryptFailure
0x1C00083D0: "__cdecl _IMPORT_DESCRIPTOR_ksecdd" __IMPORT_DESCRIPTOR_ksecdd
0x1C0004560: "CacheMaxSize" ??_C@_1BK@NKJALLBJ@?$AAC?$AAa?$AAc?$AAh?$AAe?$AAM?$AAa?$AAx?$AAS?$AAi?$AAz?$AAe?$AA?$AA@
0x1C00045D0: FileCryptGuid
0x1C000EFF4: StSecpCacheDeinitialize
0x1C0008390: tbs_NULL_THUNK_DATA
0x1C00063E0: g_DebugProfileKey
0x1C00049A8: MoveAcrossChamberFailure
0x1C00060F0: "__cdecl _security_cookie" __security_cookie
0x1C0001214: "__cdecl woutput_l" _woutput_l
0x1C000DC2C: StSecpFreeNonPaged
0x1C0002700: FCPostRead
0x1C0003A00: RtlStringCbCatNW
0x1C0003884: RtlStringCbLengthW
0x1C0008380: "__cdecl _imp_Tbsip_Context_Close" __imp_Tbsip_Context_Close
0x1C0003100: McGenControlCallbackV2
0x1C000A4A0: FCInstanceQueryTeardown
0x1C0008388: "__cdecl _imp_Tbsi_Context_Create" __imp_Tbsi_Context_Create
0x1C0008308: "__cdecl _imp_RtlInsertElementGenericTable" __imp_RtlInsertElementGenericTable
0x1C000A010: FCInstanceSetup
0x1C00063C8: g_HmacHashProvider
0x1C00082C8: "__cdecl _imp_RtlQueryRegistryValues" __imp_RtlQueryRegistryValues
0x1C00080D8: "__cdecl _imp_FltUnregisterFilter" __imp_FltUnregisterFilter
0x1C0001204: "__cdecl flsbuf" _flsbuf
0x1C0008210: "__cdecl _imp_IoFreeMdl" __imp_IoFreeMdl
0x1C0004C08: "Data" ??_C@_19IEEMEPMH@?$AAD?$AAa?$AAt?$AAa?$AA?$AA@
0x1C0004B00: "<User>" ??_C@_1O@NINEMNKB@?$AA?$DM?$AAU?$AAs?$AAe?$AAr?$AA?$DO?$AA?$AA@
0x1C0011044: "__cdecl _security_init_cookie" __security_init_cookie
0x1C00042D0: "HashDigestLength" ??_C@_1CC@DMMMEHOM@?$AAH?$AAa?$AAs?$AAh?$AAD?$AAi?$AAg?$AAe?$AAs?$AAt?$AAL?$AAe?$AAn?$AAg?$AAt?$AAh?$AA?$AA@
0x1C0004B50: "\REGISTRY\MACHINE\Software\Micro" ??_C@_1KE@BICMAGLI@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x1C00080F8: "__cdecl _imp_BCryptFinishHash" __imp_BCryptFinishHash
0x1C00043F0: "\Registry\Machine\System\Control" ??_C@_1IM@HGCFFLFG@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl@
0x1C0008320: "__cdecl _imp_KeQueryTimeIncrement" __imp_KeQueryTimeIncrement
0x1C0008228: "__cdecl _imp_EtwRegister" __imp_EtwRegister
0x1C0008288: "__cdecl _imp_RtlUpcaseUnicodeString" __imp_RtlUpcaseUnicodeString
0x1C00048C8: GetFsZeroingOffsetFailure
0x1C0002C80: FCPreWrite
0x1C000BB50: FCCleanupVolumeContext
0x1C000E184: StSecpGetSidFromUserName
0x1C0006210: gRegistryPath
0x1C0001010: McGenEventRegister
0x1C0008028: "__cdecl _imp_FltSetVolumeContext" __imp_FltSetVolumeContext
0x1C00060E0: gVideosPath
0x1C0006238: g_FilterObject
0x1C0006608: g_PackageRootLength
0x1C0006228: ExDefaultMdlProtection
0x1C0008040: "__cdecl _imp_FltSetStreamContext" __imp_FltSetStreamContext
0x1C000F6F4: StSecpSealKeyTestHookSet
0x1C0008090: "__cdecl _imp_FltCompletePendedPostOperation" __imp_FltCompletePendedPostOperation
0x1C0001090: "__cdecl _report_gsfailure" __report_gsfailure
0x1C0008020: "__cdecl _imp_FltQueueGenericWorkItem" __imp_FltQueueGenericWorkItem
0x1C0008008: "__cdecl _imp_FltGetFsZeroingOffset" __imp_FltGetFsZeroingOffset
0x1C00049C8: GetVolumeContextFailure
0x1C0008180: "__cdecl _imp_ExQueryDepthSList" __imp_ExQueryDepthSList
0x1C000D34C: StSecGetSecurityDescriptor
0x1C0008328: "__cdecl _imp_RtlAnsiCharToUnicodeChar" __imp_RtlAnsiCharToUnicodeChar
0x1C000F160: StSecpCacheGenericTableCompareRoutine
0x1C00082D8: "__cdecl _imp_RtlInitializeGenericTable" __imp_RtlInitializeGenericTable
0x1C0004968: AllocationFailure
0x1C0004318: "SHA256" ??_C@_1O@HECGKAIN@?$AAS?$AAH?$AAA?$AA2?$AA5?$AA6?$AA?$AA@
0x1C000D14C: StSecDeinitialize
0x1C0008370: ntoskrnl_NULL_THUNK_DATA
0x1C0008368: "__cdecl _imp_IoGetAttachedDeviceReference" __imp_IoGetAttachedDeviceReference
0x1C0008238: "__cdecl _imp_ExFreePoolWithTag" __imp_ExFreePoolWithTag
0x1C0008338: "__cdecl _imp_ZwOpenFile" __imp_ZwOpenFile
0x1C0004640: "EncryptAll" ??_C@_1BG@MBEGAPNA@?$AAE?$AAn?$AAc?$AAr?$AAy?$AAp?$AAt?$AAA?$AAl?$AAl?$AA?$AA@
0x1C0008290: "__cdecl _imp_RtlInitializeSid" __imp_RtlInitializeSid
0x1C00082A8: "__cdecl _imp_SeConvertStringSecurityDescriptorToSecurityDescriptor" __imp_SeConvertStringSecurityDescriptorToSecurityDescriptor
0x1C0011080: DriverEntry
0x1C0008310: "__cdecl _imp_RtlNumberGenericTableElements" __imp_RtlNumberGenericTableElements
0x1C00047E0: "MusicChamber" ??_C@_1BK@GPJNMIMH@?$AAM?$AAu?$AAs?$AAi?$AAc?$AAC?$AAh?$AAa?$AAm?$AAb?$AAe?$AAr?$AA?$AA@
0x1C0001C88: "__cdecl fputwc_nolock" _fputwc_nolock
0x1C0008348: "__cdecl _imp_SeConvertSecurityDescriptorToStringSecurityDescriptor" __imp_SeConvertSecurityDescriptorToStringSecurityDescriptor
0x1C0006204: g_cbHashValue
0x1C000E838: StSecpPackageFamilyNameFromFullName
0x1C0008360: "__cdecl _imp_ZwOpenKey" __imp_ZwOpenKey
0x1C00080B0: "__cdecl _imp_FltParseFileNameInformation" __imp_FltParseFileNameInformation
0x1C0008318: "__cdecl _imp_RtlGetElementGenericTable" __imp_RtlGetElementGenericTable
0x1C0002200: memset
0x1C00083F8: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x1C00034F4: FCpEncDecrypt
0x1C000F7D0: StSecpUnsealKey

[JEB Decompiler by PNF Software]