Generated by JEB on 2019/08/01

PE: C:\Windows\System32\lsass.exe Base=0x140000000 SHA-256=BBC83E4759D4B82BAD31E371AD679AA414C72273BF97CEE5AED8337ED8A4D79F
PDB: lsass.pdb GUID={5E111DD1-660D-C96C-E357D4B5469552F7} Age=1

406 located named symbols:
0x140009428: "KsecRpcIncomingBuffer is NULL re" ??_C@_0DG@PKKMMFDA@KsecRpcIncomingBuffer?5is?5NULL?5re@
0x140008CC8: "SetKsecEvent failed: 0x%lx " ??_C@_0BM@LGCFIKN@SetKsecEvent?5failed?3?50x?$CFlx?6?$AA@
0x1400035B0: LsapMakePipeSD
0x1400043E8: "__cdecl _raise_securityfailure" __raise_securityfailure
0x1400075B8: api-ms-win-core-heap-obsolete-l1-1-0_NULL_THUNK_DATA
0x1400041B0: "__cdecl _delayLoadHelper2" __delayLoadHelper2
0x14000A5B8: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x140007790: "__cdecl _imp_RtlDeriveCapabilitySidsFromName" __imp_RtlDeriveCapabilitySidsFromName
0x14000A3AC: "__cdecl _DELAY_IMPORT_DESCRIPTOR_SspiSrv_dll" __DELAY_IMPORT_DESCRIPTOR_SspiSrv_dll
0x140004204: "__cdecl wsetargv" _wsetargv
0x140001340: LsaLookuprGetDomainInfo
0x14000C620: gLsapCommandPortHandle
0x140007D10: "SystemRoot" ??_C@_1BG@FIGGICF@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAo?$AAo?$AAt?$AA?$AA@
0x14000C088: "__cdecl _security_cookie_complement" __security_cookie_complement
0x1400075C0: "__cdecl _imp_DeviceIoControl" __imp_DeviceIoControl
0x140007B38: "ncalrpc" ??_C@_1BA@EONDGCCM@?$AAn?$AAc?$AAa?$AAl?$AAr?$AAp?$AAc?$AA?$AA@
0x140007640: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x1400074C8: "__cdecl _imp_NdrServerCallAll" __imp_NdrServerCallAll
0x140007620: "__cdecl _imp_TlsGetValue" __imp_TlsGetValue
0x140009580: "FAILED to allocate TLS slot for " ??_C@_0DJ@MGIFBFFB@FAILED?5to?5allocate?5TLS?5slot?5for?5@
0x1400078A0: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x140008C80: "Failed to init RM: 0x%x " ??_C@_0BJ@IFMJIKCD@Failed?5to?5init?5RM?3?50x?$CFx?6?$AA@
0x140004760: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x140008FB8: "LsapLoadRequiredExtensions faile" ??_C@_0CJ@HGIMNPHG@LsapLoadRequiredExtensions?5faile@
0x140002350: InitializeAsyncKsec
0x140009398: "%hs - Ignoring API status as mar" ??_C@_0CP@JLAEKCKO@?$CFhs?5?9?5Ignoring?5API?5status?5as?5mar@
0x140003100: LsapLookupRpcInit
0x140008E20: "LsapLoadRequiredExtensions: RegQ" ??_C@_0EF@GNNACCKG@LsapLoadRequiredExtensions?3?5RegQ@
0x140002230: LsapOpenKsec
0x140007D00: "Path" ??_C@_19NHABCBNP@?$AAP?$AAa?$AAt?$AAh?$AA?$AA@
0x140007B98: "lpacIdentityServices" ??_C@_1CK@IBGBDPLP@?$AAl?$AAp?$AAa?$AAc?$AAI?$AAd?$AAe?$AAn?$AAt?$AAi?$AAt?$AAy?$AAS?$AAe?$AAr?$AAv?$AAi?$AAc?$AAe?$AAs?$AA?$AA@
0x140002870: LsaGetInterface
0x140009308: "LsapCallRm: Command sent from LS" ??_C@_0DH@ODKOCHCJ@LsapCallRm?3?5Command?5sent?5from?5LS@
0x140007610: "__cdecl _imp_TlsAlloc" __imp_TlsAlloc
0x1400011B0: LsaLookuprTranslateSids2
0x140009028: "RegEnumKeyEx failed at index %u:" ??_C@_0CH@KPKFAHCD@RegEnumKeyEx?5failed?5at?5index?5?$CFu?3@
0x140009628: "__cdecl _pfnDliFailureHook2" __pfnDliFailureHook2
0x14000C6F8: gLsapRmExtension
0x1400077C0: "__cdecl _imp_RtlCreateSecurityDescriptor" __imp_RtlCreateSecurityDescriptor
0x140007520: "__cdecl _imp__initterm_e" __imp__initterm_e
0x140004669: "__cdecl _imp_load_SspirProcessSecurityContext" __imp_load_SspirProcessSecurityContext
0x140007818: "__cdecl _imp_NtSetInformationThread" __imp_NtSetInformationThread
0x1400074E0: "__cdecl _imp_wcschr" __imp_wcschr
0x1400076A0: "__cdecl _imp_SetEvent" __imp_SetEvent
0x140007808: "__cdecl _imp_RtlEnterCriticalSection" __imp_RtlEnterCriticalSection
0x140007E20: "Failed to init connection handle" ??_C@_0CP@IOCIGCPL@Failed?5to?5init?5connection?5handle@
0x1400078C0: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x1400045C0: NdrServerCall2
0x14000C718: DebugComponentName
0x140007868: "__cdecl _imp_NtCreatePort" __imp_NtCreatePort
0x140009150: "Failed to set event SD: 0x%x " ??_C@_0BO@NDMOBICH@Failed?5to?5set?5event?5SD?3?50x?$CFx?6?$AA@
0x140007A60: "System\CurrentControlSet\Control" ??_C@_1HG@OLDNPHMC@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA?2?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl@
0x140001130: LsapRpcNotify
0x140002DA0: LsapCreateLsaExtension
0x14000C638: gLsapLocalSystemSid
0x1400078C8: "__cdecl _xc_a" __xc_a
0x140009100: "LsapLoadLsaInterfaces failed: 0x" ??_C@_0CE@LMPIFEGO@LsapLoadLsaInterfaces?5failed?3?50x@
0x140007860: "__cdecl _imp_NtCompleteConnectPort" __imp_NtCompleteConnectPort
0x140008AD0: "FAILED to open %ws, status %x " ??_C@_0BP@IOHABNOC@FAILED?5to?5open?5?$CFws?0?5status?5?$CFx?6?$AA@
0x1400076D8: "__cdecl _imp_CancelThreadpoolIo" __imp_CancelThreadpoolIo
0x1400057F0: LsaTopLevelExceptionHandler
0x140007E50: "The registered SSPI extenstion d" ??_C@_0DE@IFOGBMPK@The?5registered?5SSPI?5extenstion?5d@
0x140007980: "__cdecl _guard_iat_table" __guard_iat_table
0x1400075F8: api-ms-win-core-processenvironment-l1-1-0_NULL_THUNK_DATA
0x140004080: LsapRmServerThread
0x14000469F: memcpy
0x140008BD0: "Failed to init well known SIDs: " ??_C@_0CG@OKGFNDAB@Failed?5to?5init?5well?5known?5SIDs?3?5@
0x1400075D0: "__cdecl _imp_LoadLibraryExW" __imp_LoadLibraryExW
0x140001370: LsapCallKsec
0x140007708: "__cdecl _imp_WerSetFlags" __imp_WerSetFlags
0x140007510: "__cdecl _imp_memset" __imp_memset
0x140007690: "__cdecl _imp_CreateEventW" __imp_CreateEventW
0x140004300: "__cdecl initterm" _initterm
0x14000C700: gLsapSspiExtension
0x14000A6BC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0
0x14000C720: DebugDpfltrId
0x140007768: "__cdecl _imp_RtlSubAuthoritySid" __imp_RtlSubAuthoritySid
0x1400078E0: "__cdecl _xi_z" __xi_z
0x140007580: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x140005800: LsapIfClientCallback
0x140008DD0: "LsapLoadRequiredExtensions: RegO" ??_C@_0EC@LGJLKIBK@LsapLoadRequiredExtensions?3?5RegO@
0x1400010E0: MIDL_user_free
0x140007878: "__cdecl _imp_RtlLengthRequiredSid" __imp_RtlLengthRequiredSid
0x140009460: "Out of memory while processing w" ??_C@_0DB@EFFLNGJP@Out?5of?5memory?5while?5processing?5w@
0x140003080: SpmOpenEvent
0x140001120: LsaLookuprGetDomainInfo_notify
0x1400077B8: "__cdecl _imp_RtlCreateAcl" __imp_RtlCreateAcl
0x14000468D: "__cdecl _imp_load_SspirAcquireCredentialsHandle" __imp_load_SspirAcquireCredentialsHandle
0x1400075A0: api-ms-win-core-handle-l1-1-0_NULL_THUNK_DATA
0x140007678: "__cdecl _imp_RegCloseKey" __imp_RegCloseKey
0x1400046DC: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x1400092D0: "LsapRmInitializeServer: CreateTh" ??_C@_0DF@CPLLIEKB@LsapRmInitializeServer?3?5CreateTh@
0x140007560: "__cdecl _imp_SetErrorMode" __imp_SetErrorMode
0x1400091A8: "LsapRmInitializeServer: NtConnec" ??_C@_0DF@GHDOADA@LsapRmInitializeServer?3?5NtConnec@
0x140007668: "__cdecl _imp_RegEnumKeyExW" __imp_RegEnumKeyExW
0x1400089A0: "Error printing message " ??_C@_0BI@NMGKDACI@Error?5printing?5message?6?$AA@
0x14000C610: "__cdecl _hmod__SspiSrv_dll" __hmod__SspiSrv_dll
0x140007738: "__cdecl _imp_RtlAllocateHeap" __imp_RtlAllocateHeap
0x1400090C0: "Ignore failure to load interface" ??_C@_0DP@JILAMKDN@Ignore?5failure?5to?5load?5interface@
0x1400075E8: "__cdecl _imp_SetEnvironmentVariableW" __imp_SetEnvironmentVariableW
0x14000A658: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0
0x140007D90: "IOCTL_KSEC_IPC_GET_QUEUED_FUNCTI" ??_C@_0DM@DPJHIKNN@IOCTL_KSEC_IPC_GET_QUEUED_FUNCTI@
0x14000C710: DebugInfoLevel
0x140009620: "__cdecl _DefaultResolveDelayLoadedAPIFlags" __DefaultResolveDelayLoadedAPIFlags
0x140001120: LsaLookuprTranslateSids2_notify
0x1400089B8: "LsapRPCInit: failed to build pip" ??_C@_0CN@JMNIOLHJ@LsapRPCInit?3?5failed?5to?5build?5pip@
0x1400041F0: LsaRegisterInterface
0x140009050: "Ignore failure to open interface" ??_C@_0DE@MGOACHNG@Ignore?5failure?5to?5open?5interface@
0x1400093C8: "Invalid async ksecdd function ca" ??_C@_0CI@KEGEAFCM@Invalid?5async?5ksecdd?5function?5ca@
0x140007528: "__cdecl _imp_exit" __imp_exit
0x140007630: "__cdecl _imp_TlsSetValue" __imp_TlsSetValue
0x140003220: LsapMakeLowBoxRpcSD
0x140003FD0: FixupEnvironment
0x140007D28: "\SeRmCommandPort" ??_C@_1CC@NHFIIIMN@?$AA?2?$AAS?$AAe?$AAR?$AAm?$AAC?$AAo?$AAm?$AAm?$AAa?$AAn?$AAd?$AAP?$AAo?$AAr?$AAt?$AA?$AA@
0x140007DD0: "IOCTL_KSEC_IPC_SET_FUNCTION_RETU" ??_C@_0DG@LADCIIFH@IOCTL_KSEC_IPC_SET_FUNCTION_RETU@
0x140007E08: "AsyncKsecDD" ??_C@_1BI@EEMINJEM@?$AAA?$AAs?$AAy?$AAn?$AAc?$AAK?$AAs?$AAe?$AAc?$AAD?$AAD?$AA?$AA@
0x140007688: api-ms-win-core-registry-l1-1-0_NULL_THUNK_DATA
0x140008A58: "LsapRPCInit: RpcServerUseProtseq" ??_C@_0DO@OLFKCFPH@LsapRPCInit?3?5RpcServerUseProtseq@
0x140007588: api-ms-win-core-errorhandling-l1-1-0_NULL_THUNK_DATA
0x140001220: LsaLookuprClose
0x140008B70: "SetKsecEvent: Could not open eve" ??_C@_0CN@KPPEEFMG@SetKsecEvent?3?5Could?5not?5open?5eve@
0x1400076B0: "__cdecl _imp_GetSystemInfo" __imp_GetSystemInfo
0x140007600: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x140008BA0: "SetKsecEvent: Failed to set ksec" ??_C@_0CN@FOGOBMHE@SetKsecEvent?3?5Failed?5to?5set?5ksec@
0x140001740: "void __cdecl AsyncProcessSecurityContext(void * __ptr64,struct _KsecIoctlIpcFunctionCall * __ptr64)" ?AsyncProcessSecurityContext@@YAXPEAXPEAU_KsecIoctlIpcFunctionCall@@@Z
0x140003DF0: LsapRmInitializeServer
0x1400093F0: "Error requesting async ksecdd fu" ??_C@_0DB@NGLDCEJC@Error?5requesting?5async?5ksecdd?5fu@
0x140007A28: "QueryLsaInterface" ??_C@_0BC@LJEDBDHP@QueryLsaInterface?$AA@
0x1400074E8: "__cdecl _imp__wcsicmp" __imp__wcsicmp
0x1400077F8: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x1400075E0: api-ms-win-core-libraryloader-l1-2-0_NULL_THUNK_DATA
0x140007858: "__cdecl _imp_NtListenPort" __imp_NtListenPort
0x140009498: "Error processing work on worker " ??_C@_0CL@BLPFDKCP@Error?5processing?5work?5on?5worker?5@
0x14000C048: "struct _RTL_CRITICAL_SECTION_DEBUG InitConnectionCriticalSection_DEBUG" ?InitConnectionCriticalSection_DEBUG@@3U_RTL_CRITICAL_SECTION_DEBUG@@A
0x140007568: "__cdecl _imp_GetLastError" __imp_GetLastError
0x140007590: "__cdecl _imp_DuplicateHandle" __imp_DuplicateHandle
0x140004170: LsaRegisterExtension
0x1400046B8: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x1400077D8: "__cdecl _imp_RtlSetOwnerSecurityDescriptor" __imp_RtlSetOwnerSecurityDescriptor
0x1400013F0: LsaLookuprUserAccountType
0x1400058F4: "void __cdecl AsyncAcquireCredentialsHandle(void * __ptr64,struct _KsecIoctlIpcFunctionCall * __ptr64)" ?AsyncAcquireCredentialsHandle@@YAXPEAXPEAU_KsecIoctlIpcFunctionCall@@@Z
0x140007820: "__cdecl _imp_NtFreeVirtualMemory" __imp_NtFreeVirtualMemory
0x140008C50: "Failed to init Lsass global stat" ??_C@_0CK@DIACGDGH@Failed?5to?5init?5Lsass?5global?5stat@
0x140007880: "__cdecl _imp_RtlAddAccessAllowedAce" __imp_RtlAddAccessAllowedAce
0x140007778: "__cdecl _imp_NtDeviceIoControlFile" __imp_NtDeviceIoControlFile
0x140008A98: "LsapRPCInit: RpcServerRegisterIf" ??_C@_0DB@BONOEHNI@LsapRPCInit?3?5RpcServerRegisterIf@
0x140001120: LsaLookuprManageCache_notify
0x14000A6F8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-0
0x140007648: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x14000A418: SspiSrv_NULL_THUNK_DATA_DLN
0x14000A644: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-obsolete-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-obsolete-l1-1-0
0x1400076E8: "__cdecl _imp_StartThreadpoolIo" __imp_StartThreadpoolIo
0x140009620: "__cdecl _ResolveDelayLoadedAPIFlags" __ResolveDelayLoadedAPIFlags
0x1400075F0: "__cdecl _imp_GetEnvironmentVariableW" __imp_GetEnvironmentVariableW
0x1400012C0: LsaLookuprTranslateNames3
0x1400074B8: "__cdecl _imp_RpcServerRegisterIf3" __imp_RpcServerRegisterIf3
0x140007D50: "\SeLsaCommandPort" ??_C@_1CE@KFPIKEIA@?$AA?2?$AAS?$AAe?$AAL?$AAs?$AAa?$AAC?$AAo?$AAm?$AAm?$AAa?$AAn?$AAd?$AAP?$AAo?$AAr?$AAt?$AA?$AA@
0x1400056A0: LsapDebugOut
0x140007870: "__cdecl _imp_RtlFreeHeap" __imp_RtlFreeHeap
0x140007750: "__cdecl _imp_RtlInitializeResource" __imp_RtlInitializeResource
0x14000E020: "__cdecl _imp_SspiSrvInitialize" __imp_SspiSrvInitialize
0x14000A61C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0
0x140007850: "__cdecl _imp_NtReplyWaitReceivePort" __imp_NtReplyWaitReceivePort
0x140001010: LsapCallRm
0x14000C630: gLsapAliasAdminsSid
0x140008F60: "LsapLoadRequiredExtensions: RegQ" ??_C@_0FD@EJHCIOII@LsapLoadRequiredExtensions?3?5RegQ@
0x14000A3CC: "__cdecl _NULL_DELAY_IMPORT_DESCRIPTOR" __NULL_DELAY_IMPORT_DESCRIPTOR
0x140001420: LsaLookuprManageCache
0x1400045B0: NdrServerCallAll
0x140007530: "__cdecl _imp__initterm" __imp__initterm
0x140001120: LsaLookuprClose_notify
0x140007578: "__cdecl _imp_SetLastError" __imp_SetLastError
0x14000A70C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-1" __IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-1
0x1400076F0: "__cdecl _imp_SetThreadpoolThreadMaximum" __imp_SetThreadpoolThreadMaximum
0x1400076F8: "__cdecl _imp_TrySubmitThreadpoolCallback" __imp_TrySubmitThreadpoolCallback
0x140008CA0: "Failed to load extensions: 0x%x " ??_C@_0CB@HMAMEENK@Failed?5to?5load?5extensions?3?50x?$CFx?6@
0x140007538: api-ms-win-core-crt-l2-1-0_NULL_THUNK_DATA
0x14000A630: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0
0x1400021D0: LsapActivateRpcServer
0x14000E018: "__cdecl _imp_SspirDeleteSecurityContext" __imp_SspirDeleteSecurityContext
0x140007618: "__cdecl _imp_CreateThread" __imp_CreateThread
0x1400078B8: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x1400077A8: "__cdecl _imp_RtlCreateAndSetSD" __imp_RtlCreateAndSetSD
0x1400074B0: "__cdecl _imp_RpcServerUseProtseqEpW" __imp_RpcServerUseProtseqEpW
0x140001120: LsaLookuprTranslateNames3_notify
0x140007518: api-ms-win-core-crt-l1-1-0_NULL_THUNK_DATA
0x140007628: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x140007718: "__cdecl _imp_GetTokenInformation" __imp_GetTokenInformation
0x1400074F0: "__cdecl _imp_wcstol" __imp_wcstol
0x140007728: "__cdecl _imp_RtlNtStatusToDosError" __imp_RtlNtStatusToDosError
0x14000C628: gLsapAnyPackageSid
0x140008EC0: "LsapLoadRequiredExtensions: Bad " ??_C@_0EM@LNFFEBCO@LsapLoadRequiredExtensions?3?5Bad?5@
0x1400076C8: api-ms-win-core-sysinfo-l1-1-0_NULL_THUNK_DATA
0x1400078D8: "__cdecl _xi_a" __xi_a
0x140008B48: "FixupEnvironment: Setting PATH t" ??_C@_0CH@KJMDAMFB@FixupEnvironment?3?5Setting?5PATH?5t@
0x1400076B8: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x140007550: "__cdecl _imp_ResolveDelayLoadedAPI" __imp_ResolveDelayLoadedAPI
0x140002100: LsapStartExtensions
0x140001F30: wmain
0x140004210: "__cdecl _wmainCRTStartup" __wmainCRTStartup
0x140007720: api-ms-win-security-base-l1-1-0_NULL_THUNK_DATA
0x1400076E0: "__cdecl _imp_CreateThreadpoolIo" __imp_CreateThreadpoolIo
0x14000C650: gLsapWorldSid
0x140007BD0: "System\CurrentControlSet\Control" ??_C@_1HO@EGJOFJGB@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA?2?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl@
0x14000E008: "__cdecl _imp_SspiSrvClientCallback" __imp_SspiSrvClientCallback
0x14000C680: gLsaIfLock
0x140007A10: "Extension" ??_C@_1BE@CKKDHEH@?$AAE?$AAx?$AAt?$AAe?$AAn?$AAs?$AAi?$AAo?$AAn?$AA?$AA@
0x140002900: LsapFindRegisteredInterface
0x140008F10: "LsapLoadRequiredExtensions: Bad " ??_C@_0EH@GGPOIBGO@LsapLoadRequiredExtensions?3?5Bad?5@
0x14000A66C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0
0x140001250: LsaLookuprOpenPolicy2
0x14000E010: "__cdecl _imp_SspirProcessSecurityContext" __imp_SspirProcessSecurityContext
0x140001160: LsaImpersonateKsecCaller
0x140009170: "LsapRmInitializeServer: NtCreate" ??_C@_0DE@NHCDFGOA@LsapRmInitializeServer?3?5NtCreate@
0x140008CE8: "Failed to start LPR server: 0x%l" ??_C@_0CD@FEIAJLJA@Failed?5to?5start?5LPR?5server?3?50x?$CFl@
0x140008D10: "LsapLoadLsaExtension: Can't load" ??_C@_0DH@JPJNGGGI@LsapLoadLsaExtension?3?5Can?8t?5load@
0x140007830: "__cdecl _imp_NtRequestWaitReplyPort" __imp_NtRequestWaitReplyPort
0x140007788: "__cdecl _imp_RtlFreeSid" __imp_RtlFreeSid
0x140007780: "__cdecl _imp_RtlSetProcessIsCritical" __imp_RtlSetProcessIsCritical
0x140007760: "__cdecl _imp_RtlAcquireResourceShared" __imp_RtlAcquireResourceShared
0x140008D48: "LsaInitializeExtension: Can't ge" ??_C@_0DN@CCGPIAHN@LsaInitializeExtension?3?5Can?8t?5ge@
0x1400042D0: "__cdecl _security_check_cookie" __security_check_cookie
0x1400078D0: "__cdecl _xc_z" __xc_z
0x140007650: api-ms-win-core-processthreads-l1-1-0_NULL_THUNK_DATA
0x1400075D8: "__cdecl _imp_GetProcAddress" __imp_GetProcAddress
0x14000A6E4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-windowserrorreporting-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-windowserrorreporting-l1-1-0
0x14000E028: SspiSrv_NULL_THUNK_DATA_DLA
0x1400078A8: "__cdecl _imp_RtlMakeSelfRelativeSD" __imp_RtlMakeSelfRelativeSD
0x14000C028: gLsapRmFunctions
0x140002930: LsapLoadRequiredExtensions
0x140001120: LsaLookuprOpenPolicy2_notify
0x140002770: LsapRegisterInterface
0x140007B68: "ncacn_np" ??_C@_1BC@CCHMBIKG@?$AAn?$AAc?$AAa?$AAc?$AAn?$AA_?$AAn?$AAp?$AA?$AA@
0x1400075C8: api-ms-win-core-io-l1-1-0_NULL_THUNK_DATA
0x1400076C0: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x1400013C0: LsaRpcIfCallbackFn
0x140001460: LsapGetSystemInfo
0x140007758: "__cdecl _imp_RtlReleaseResource" __imp_RtlReleaseResource
0x140008D88: "LsaInitializeExtension: Init rou" ??_C@_0DM@KPABOBDI@LsaInitializeExtension?3?5Init?5rou@
0x1400075A8: "__cdecl _imp_LocalAlloc" __imp_LocalAlloc
0x140007540: "__cdecl _imp_DelayLoadFailureHook" __imp_DelayLoadFailureHook
0x14000C000: "struct _RTL_CRITICAL_SECTION InitConnectionCriticalSection" ?InitConnectionCriticalSection@@3U_RTL_CRITICAL_SECTION@@A
0x1400074F8: "__cdecl _imp__vsnprintf_s" __imp__vsnprintf_s
0x140007EF0: "\System32" ??_C@_1BE@JPDJANBF@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?$AA@
0x1400045CC: "__cdecl _imp_load_SspiSrvInitialize" __imp_load_SspiSrvInitialize
0x1400091E0: "LsapRmInitializeServer: Server p" ??_C@_0DC@DJEMEFP@LsapRmInitializeServer?3?5Server?5p@
0x14000C640: gLsapIdentityServicesLpacSid
0x140007700: api-ms-win-core-threadpool-l1-2-0_NULL_THUNK_DATA
0x140008E70: "LsapLoadRequiredExtensions: Bad " ??_C@_0EG@KHGOIPNA@LsapLoadRequiredExtensions?3?5Bad?5@
0x140007C90: "System\CurrentControlSet\Control" ??_C@_1EK@GFPFBLJC@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA?2?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl@
0x140009290: "LsapRmInitializeServer: NtComple" ??_C@_0DN@NAKHCGMD@LsapRmInitializeServer?3?5NtComple@
0x140008C20: "Failed to init LSA interface lis" ??_C@_0CJ@DCHGDLNK@Failed?5to?5init?5LSA?5interface?5lis@
0x1400079C8: "LSA_RPC_SERVER_ACTIVE" ??_C@_1CM@FBKEHFOJ@?$AAL?$AAS?$AAA?$AA_?$AAR?$AAP?$AAC?$AA_?$AAS?$AAE?$AAR?$AAV?$AAE?$AAR?$AA_?$AAA?$AAC?$AAT?$AAI?$AAV?$AAE?$AA?$AA@
0x14000A4B0: SspiSrv_NULL_THUNK_DATA_DLB
0x1400095E8: "Unable to setup IO completion th" ??_C@_0DG@KPDHEDKH@Unable?5to?5setup?5IO?5completion?5th@
0x140007660: api-ms-win-core-profile-l1-1-0_NULL_THUNK_DATA
0x1400078E8: "__cdecl _guard_fids_table" __guard_fids_table
0x140007CE0: "\Device\KsecDD" ??_C@_1BO@BAEMGIAB@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAK?$AAs?$AAe?$AAc?$AAD?$AAD?$AA?$AA@
0x140006070: "__cdecl load_config_used" _load_config_used
0x140007558: api-ms-win-core-delayload-l1-1-1_NULL_THUNK_DATA
0x140007548: api-ms-win-core-delayload-l1-1-0_NULL_THUNK_DATA
0x14000A608: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-io-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-io-l1-1-0
0x1400077B0: "__cdecl _imp_NtSetInformationProcess" __imp_NtSetInformationProcess
0x140007B48: "lsapolicylookup" ??_C@_1CA@GIFHGMIH@?$AAl?$AAs?$AAa?$AAp?$AAo?$AAl?$AAi?$AAc?$AAy?$AAl?$AAo?$AAo?$AAk?$AAu?$AAp?$AA?$AA@
0x14000A680: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processenvironment-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processenvironment-l1-1-0
0x1400094C8: "RegOpenKeyEx(%S) failed: %d " ??_C@_0BN@CGOJICHM@RegOpenKeyEx?$CI?$CFS?$CJ?5failed?3?5?$CFd?6?$AA@
0x140007698: "__cdecl _imp_OpenEventW" __imp_OpenEventW
0x1400079C4: "LSA" ??_C@_03IIOBCJML@LSA?$AA@
0x140007C50: "MaxAsyncWorkerThreadsPerCpu" ??_C@_1DI@LKCEKEPJ@?$AAM?$AAa?$AAx?$AAA?$AAs?$AAy?$AAn?$AAc?$AAW?$AAo?$AAr?$AAk?$AAe?$AAr?$AAT?$AAh?$AAr?$AAe?$AAa?$AAd?$AAs?$AAP?$AAe?$AAr?$AAC?$AAp?$AAu?$AA?$AA@
0x140007770: "__cdecl _imp_NtSetSecurityObject" __imp_NtSetSecurityObject
0x14000C648: gLsapAnonymousSid
0x140007840: "__cdecl _imp_NtClose" __imp_NtClose
0x1400045D8: "__cdecl _tailMerge_sspisrv_dll" __tailMerge_sspisrv_dll
0x1400077F0: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x140007658: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x1400089E8: "LsapRPCInit: RpcServerUseProtseq" ??_C@_0DD@CACMECHI@LsapRPCInit?3?5RpcServerUseProtseq@
0x14000E000: "__cdecl _imp_SspirAcquireCredentialsHandle" __imp_SspirAcquireCredentialsHandle
0x140002AC0: LsapLoadExtensionFromRegistry
0x1400095C0: "Failed to create worker pool: %d" ??_C@_0CC@GFEIEHHI@Failed?5to?5create?5worker?5pool?3?5?$CFd@
0x140007800: "__cdecl _imp_RtlLeaveCriticalSection" __imp_RtlLeaveCriticalSection
0x140007748: "__cdecl _imp_NtOpenEvent" __imp_NtOpenEvent
0x1400077E8: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x140009628: "__cdecl _pfnDefaultDliFailureHook2" __pfnDefaultDliFailureHook2
0x14000C798: gHasInitLsaIfConfig
0x140009530: "%S reg value is missing or inval" ??_C@_0EK@JCONCCJH@?$CFS?5reg?5value?5is?5missing?5or?5inval@
0x140001280: MIDL_user_allocate
0x140004740: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x14000C618: gLsapRmCommandPortHandle
0x140002E80: LsapBuildSD
0x1400094E8: "%S reg value is valid, setting %" ??_C@_0DN@NKLJCKKM@?$CFS?5reg?5value?5is?5valid?0?5setting?5?$CF@
0x14000A5F4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0
0x140004657: "__cdecl _imp_load_SspiSrvClientCallback" __imp_load_SspiSrvClientCallback
0x140007710: api-ms-win-core-windowserrorreporting-l1-1-0_NULL_THUNK_DATA
0x1400074C0: "__cdecl _imp_RpcServerListen" __imp_RpcServerListen
0x1400074D0: "__cdecl _imp_I_RpcMapWin32Status" __imp_I_RpcMapWin32Status
0x1400058D0: LSA_LOOKPR_HANDLE_rundown
0x1400042F4: "__cdecl initterm_e" _initterm_e
0x1400077A0: "__cdecl _imp_RtlUnhandledExceptionFilter" __imp_RtlUnhandledExceptionFilter
0x1400078B0: ntdll_NULL_THUNK_DATA
0x140007508: "__cdecl _imp_memcpy" __imp_memcpy
0x140007798: "__cdecl _imp_RtlAddMandatoryAce" __imp_RtlAddMandatoryAce
0x140002530: LsapLoadLsaInterfaces
0x140007D80: "__cdecl _sz_SspiSrv_dll" __sz_SspiSrv_dll
0x14000A694: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0
0x140002D30: LsapFindExistingExtension
0x14000C098: LsapSystemProcessId
0x14000C080: "__cdecl _security_cookie" __security_cookie
0x140007680: "__cdecl _imp_RegQueryValueExW" __imp_RegQueryValueExW
0x140007500: "__cdecl _imp_strcpy_s" __imp_strcpy_s
0x140007598: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x140009088: "Ignore failure to load LSA exten" ??_C@_0DF@HAAEMLEI@Ignore?5failure?5to?5load?5LSA?5exten@
0x1400075B0: "__cdecl _imp_LocalFree" __imp_LocalFree
0x14000A5E0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0
0x140008BF8: "Failed to set Ksec security: 0x%" ??_C@_0CD@OIGMCHEK@Failed?5to?5set?5Ksec?5security?3?50x?$CF@
0x14000A5A4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-crt-l2-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-crt-l2-1-0
0x1400077C8: "__cdecl _imp_DbgPrintEx" __imp_DbgPrintEx
0x140009218: "LsapRmInitializeServer: NtListen" ??_C@_0DE@KOAAEHIC@LsapRmInitializeServer?3?5NtListen@
0x140007890: "__cdecl _imp_RtlAllocateAndInitializeSid" __imp_RtlAllocateAndInitializeSid
0x140007810: "__cdecl _imp_NtAllocateVirtualMemory" __imp_NtAllocateVirtualMemory
0x1400024B0: LsapInitializeExtensionConfig
0x140007570: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x14000C660: gLsapIfList
0x140009128: "LsapBuildSD: Could not open %ws," ??_C@_0CF@KKAOEKJG@LsapBuildSD?3?5Could?5not?5open?5?$CFws?0@
0x140007670: "__cdecl _imp_RegOpenKeyExW" __imp_RegOpenKeyExW
0x1400079F8: "Extensions" ??_C@_1BG@HOAPHBBF@?$AAE?$AAx?$AAt?$AAe?$AAn?$AAs?$AAi?$AAo?$AAn?$AAs?$AA?$AA@
0x14000430C: "__cdecl _security_init_cookie" __security_init_cookie
0x140007AE0: "\SECURITY\LSA_AUTHENTICATION_INI" ??_C@_1FC@PDNDEKHJ@?$AA?2?$AAS?$AAE?$AAC?$AAU?$AAR?$AAI?$AAT?$AAY?$AA?2?$AAL?$AAS?$AAA?$AA_?$AAA?$AAU?$AAT?$AAH?$AAE?$AAN?$AAT?$AAI?$AAC?$AAA?$AAT?$AAI?$AAO?$AAN?$AA_?$AAI?$AAN?$AAI@
0x140007B80: "\pipe\lsass" ??_C@_1BI@NNMJKFFJ@?$AA?2?$AAp?$AAi?$AAp?$AAe?$AA?2?$AAl?$AAs?$AAa?$AAs?$AAs?$AA?$AA@
0x1400042A0: wmainCRTStartup
0x14000A590: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-crt-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-crt-l1-1-0
0x14000467B: "__cdecl _imp_load_SspirDeleteSecurityContext" __imp_load_SspirDeleteSecurityContext
0x140009250: "LsapRmInitializeServer: NtAccept" ??_C@_0DL@BIDOGJO@LsapRmInitializeServer?3?5NtAccept@
0x14000A5CC: "__cdecl _IMPORT_DESCRIPTOR_RPCRT4" __IMPORT_DESCRIPTOR_RPCRT4
0x140007888: "__cdecl _imp_RtlLengthSid" __imp_RtlLengthSid
0x140007898: "__cdecl _imp_NtSetInformationFile" __imp_NtSetInformationFile
0x140007828: "__cdecl _imp_NtConnectPort" __imp_NtConnectPort
0x1400074D8: RPCRT4_NULL_THUNK_DATA
0x140004430: "__cdecl _report_gsfailure" __report_gsfailure
0x14000C030: gLsapCallbackFunctions
0x1400076D0: "__cdecl _imp_CreateThreadpool" __imp_CreateThreadpool
0x140007740: "__cdecl _imp_NtOpenFile" __imp_NtOpenFile
0x140008A20: "LsapLookupRpcInit: LsapMakeLowBo" ??_C@_0DD@LJNBGCFB@LsapLookupRpcInit?3?5LsapMakeLowBo@
0x14000C6E0: gLsapExtensionList
0x140008B18: "Failed to set IOCTL completion m" ??_C@_0CN@MNNLMDEO@Failed?5to?5set?5IOCTL?5completion?5m@
0x140008970: "Error printing message: Bad Comp" ??_C@_0CL@IJPNDHEL@Error?5printing?5message?3?5Bad?5Comp@
0x140002BF0: LsapLoadExtension
0x140007848: "__cdecl _imp_NtAcceptConnectPort" __imp_NtAcceptConnectPort
0x140002170: LsapNotifyExtensionsLoadComplete
0x140009378: "AsyncProcessSecurityContext" ??_C@_0BM@CONEKDGP@AsyncProcessSecurityContext?$AA@
0x140007608: "__cdecl _imp_ExitThread" __imp_ExitThread
0x14000C708: KsecDevice
0x140009340: "The registered SSPI extenstion d" ??_C@_0DE@JCJBFGLL@The?5registered?5SSPI?5extenstion?5d@
0x140003940: LsapBuildWellKnownSids
0x140007838: "__cdecl _imp_RtlAcquireResourceExclusive" __imp_RtlAcquireResourceExclusive
0x140002710: LsapGetInterfaceFromExtension
0x140008FE8: "LsapStartExtensions: Extension %" ??_C@_0DL@GINEPPPF@LsapStartExtensions?3?5Extension?5?$CF@
0x1400077D0: "__cdecl _imp_RtlSetSaclSecurityDescriptor" __imp_RtlSetSaclSecurityDescriptor
0x140007730: "__cdecl _imp_RtlInitializeSid" __imp_RtlInitializeSid
0x1400077E0: "__cdecl _imp_RtlSetDaclSecurityDescriptor" __imp_RtlSetDaclSecurityDescriptor
0x14000A6D0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0
0x1400074A8: "__cdecl _imp_NdrServerCall2" __imp_NdrServerCall2
0x14000A6A8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-threadpool-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-threadpool-l1-2-0
0x140007638: "__cdecl _imp_OpenProcessToken" __imp_OpenProcessToken
0x14000C6F0: gLsapLookupExtension
0x1400076A8: api-ms-win-core-synch-l1-1-0_NULL_THUNK_DATA
0x140007A40: "InitializeLsaExtension" ??_C@_0BH@EBDMJCNA@InitializeLsaExtension?$AA@
0x1400046AB: memset
0x14000A720: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x140007990: "LSA_SUBSYSTEM_INITIALIZED" ??_C@_1DE@CEODPALN@?$AAL?$AAS?$AAA?$AA_?$AAS?$AAU?$AAB?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA_?$AAI?$AAN?$AAI?$AAT?$AAI?$AAA?$AAL?$AAI?$AAZ?$AAE?$AAD?$AA?$AA@
0x140008AF0: "FAILED to send ioctl, status %x " ??_C@_0CB@JJOBANMJ@FAILED?5to?5send?5ioctl?0?5status?5?$CFx?6@

[JEB Decompiler by PNF Software]