Generated by JEB on 2019/08/01

PE: C:\Windows\System32\MdSched.exe Base=0x140000000 SHA-256=BC516F17AFC7658C4F20726272D9CE9F77C83DD5575307B15DBBDECA6F04D273
PDB: mdsched.pdb GUID={2FD2DC45-5577-3684-45F682A80BBDE464} Age=1

192 located named symbols:
0x1400041E0: "__cdecl _imp_UnregisterTraceGuids" __imp_UnregisterTraceGuids
0x1400034DC: "__cdecl _raise_securityfailure" __raise_securityfailure
0x140004210: "__cdecl _imp_EventRegister" __imp_EventRegister
0x1400032F0: "__cdecl FindPESection" _FindPESection
0x140004440: WMD_SCHEDULE_DEFERRED_EVENT
0x140004D44: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x1400032E0: "__cdecl wsetargv" _wsetargv
0x140006020: "__cdecl _security_cookie_complement" __security_cookie_complement
0x140004350: "__cdecl _imp___wgetmainargs" __imp___wgetmainargs
0x140004268: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x140004680: "SeShutdownPrivilege" ??_C@_1CI@NKKEIBLI@?$AAS?$AAe?$AAS?$AAh?$AAu?$AAt?$AAd?$AAo?$AAw?$AAn?$AAP?$AAr?$AAi?$AAv?$AAi?$AAl?$AAe?$AAg?$AAe?$AA?$AA@
0x140004648: WPP_ThisDir_CTLGUID_MemDiagTracingGuid
0x1400010E0: WppControlCallback
0x140003750: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x1400027B8: "private: long __cdecl CMdScheduler::LogCrimsonEvents(long) __ptr64" ?LogCrimsonEvents@CMdScheduler@@AEAAJJ@Z
0x140006058: "__cdecl commode" _commode
0x140001368: "long __cdecl ParseCommandLine(int,unsigned short * __ptr64 * __ptr64 const,enum _MD_TYPES * __ptr64,enum _MD_TYPES * __ptr64)" ?ParseCommandLine@@YAJHQEAPEAGPEAW4_MD_TYPES@@1@Z
0x1400019D4: "public: long __cdecl CMdScheduler::Initialize(class IMdSchedDisplay * __ptr64,enum _MD_TYPES,enum _MD_TYPES) __ptr64" ?Initialize@CMdScheduler@@QEAAJPEAVIMdSchedDisplay@@W4_MD_TYPES@@1@Z
0x140004528: "Error" ??_C@_1M@ILHOPKA@?$AAE?$AAr?$AAr?$AAo?$AAr?$AA?$AA@
0x140004208: "__cdecl _imp_InitiateShutdownW" __imp_InitiateShutdownW
0x140004280: "__cdecl _imp_HeapSetInformation" __imp_HeapSetInformation
0x1400031C0: "long __cdecl __CxxUnhandledExceptionFilter(struct _EXCEPTION_POINTERS * __ptr64)" ?__CxxUnhandledExceptionFilter@@YAJPEAU_EXCEPTION_POINTERS@@@Z
0x1400043C8: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x140004658: "SeRestorePrivilege" ??_C@_1CG@LMBBLCJG@?$AAS?$AAe?$AAR?$AAe?$AAs?$AAt?$AAo?$AAr?$AAe?$AAP?$AAr?$AAi?$AAv?$AAi?$AAl?$AAe?$AAg?$AAe?$AA?$AA@
0x1400045A0: "WinRE" ??_C@_1M@MJNGBGND@?$AAW?$AAi?$AAn?$AAR?$AAE?$AA?$AA@
0x140006064: "__cdecl fmode" _fmode
0x14000321E: "__cdecl XcptFilter" _XcptFilter
0x1400043D0: "__cdecl _xc_a" __xc_a
0x140004560: "Extended" ??_C@_1BC@FOCGEOBK@?$AAE?$AAx?$AAt?$AAe?$AAn?$AAd?$AAe?$AAd?$AA?$AA@
0x140004248: COMCTL32_NULL_THUNK_DATA
0x1400031A0: "__cdecl callnewh" _callnewh
0x140004390: "__cdecl _imp_memset" __imp_memset
0x1400034AF: "__cdecl initterm" _initterm
0x1400041B8: "__cdecl _imp_TraceMessage" __imp_TraceMessage
0x140006640: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x140004258: "__cdecl _imp_Sleep" __imp_Sleep
0x140004400: "__cdecl _xi_z" __xi_z
0x1400042B0: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x1400034BB: "__cdecl _C_specific_handler" __C_specific_handler
0x140004D6C: "__cdecl _IMPORT_DESCRIPTOR_bcd" __IMPORT_DESCRIPTOR_bcd
0x140006610: WPP_REGISTRATION_GUIDS
0x140003194: malloc
0x140004218: "__cdecl _imp_RegCloseKey" __imp_RegCloseKey
0x1400036CC: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x1400045B0: "IsTest" ??_C@_1O@NDGABNME@?$AAI?$AAs?$AAT?$AAe?$AAs?$AAt?$AA?$AA@
0x1400065E8: WPP_MAIN_CB
0x1400044E0: "Deferred" ??_C@_1BC@FOIDCFDH@?$AAD?$AAe?$AAf?$AAe?$AAr?$AAr?$AAe?$AAd?$AA?$AA@
0x140004228: "__cdecl _imp_RegSetValueExW" __imp_RegSetValueExW
0x1400032D3: "__cdecl amsg_exit" _amsg_exit
0x140004370: "__cdecl _imp__callnewh" __imp__callnewh
0x140004508: "Fail" ??_C@_19MNJLFGGC@?$AAF?$AAa?$AAi?$AAl?$AA?$AA@
0x140004340: "__cdecl _imp_exit" __imp_exit
0x1400042F8: "__cdecl _imp_BcdOpenObject" __imp_BcdOpenObject
0x1400041C0: "__cdecl _imp_GetTraceLoggerHandle" __imp_GetTraceLoggerHandle
0x1400044B8: "Manual" ??_C@_1O@PCDGBOIG@?$AAM?$AAa?$AAn?$AAu?$AAa?$AAl?$AA?$AA@
0x140004240: "__cdecl _imp_TaskDialogIndirect" __imp_TaskDialogIndirect
0x1400041C8: "__cdecl _imp_GetTraceEnableLevel" __imp_GetTraceEnableLevel
0x140004538: "Basic" ??_C@_1M@ECOAOPLN@?$AAB?$AAa?$AAs?$AAi?$AAc?$AA?$AA@
0x140004278: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x140006630: "__cdecl _native_startup_lock" __native_startup_lock
0x140003200: "__cdecl _CxxSetUnhandledExceptionFilter" __CxxSetUnhandledExceptionFilter
0x140004310: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x1400044C8: "Immediate" ??_C@_1BE@JHNHJALP@?$AAI?$AAm?$AAm?$AAe?$AAd?$AAi?$AAa?$AAt?$AAe?$AA?$AA@
0x1400043A0: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x1400042C8: KERNEL32_NULL_THUNK_DATA
0x140004290: "__cdecl _imp_GetLastError" __imp_GetLastError
0x140002DEC: "void * __ptr64 __cdecl operator new(unsigned __int64)" ??2@YAPEAX_K@Z
0x1400036A8: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x140004318: "__cdecl _imp__commode" __imp__commode
0x140004328: "__cdecl _imp___setusermatherr" __imp___setusermatherr
0x140004CF4: "__cdecl _IMPORT_DESCRIPTOR_ADVAPI32" __IMPORT_DESCRIPTOR_ADVAPI32
0x140004480: "NULL" ??_C@_19CIJIHAKK@?$AAN?$AAU?$AAL?$AAL?$AA?$AA@
0x140004260: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x140001168: "long __cdecl GetScheduleTypeFromUser(enum _MD_TYPES * __ptr64,enum _MD_TYPES)" ?GetScheduleTypeFromUser@@YAJPEAW4_MD_TYPES@@W41@@Z
0x1400044F8: "Pass" ??_C@_19ENBMMBPJ@?$AAP?$AAa?$AAs?$AAs?$AA?$AA@
0x1400033A0: "__cdecl ValidateImageBase" _ValidateImageBase
0x140004518: "Aborted" ??_C@_1BA@JCPMFPEO@?$AAA?$AAb?$AAo?$AAr?$AAt?$AAe?$AAd?$AA?$AA@
0x1400045C0: "MemTestError" ??_C@_1BK@JNEJAADA@?$AAM?$AAe?$AAm?$AAT?$AAe?$AAs?$AAt?$AAE?$AAr?$AAr?$AAo?$AAr?$AA?$AA@
0x140001008: WPP_SF_
0x140004288: "__cdecl _imp_CompareStringW" __imp_CompareStringW
0x1400047F8: WPP_7497e2d259cc34038e4fd2b8db0c20f2_Traceguids
0x140006060: "__cdecl newmode" _newmode
0x140004320: "__cdecl _imp__initterm" __imp__initterm
0x140004348: "__cdecl _imp___set_app_type" __imp___set_app_type
0x1400045E0: "BootManager" ??_C@_1BI@CGEIDMKL@?$AAB?$AAo?$AAo?$AAt?$AAM?$AAa?$AAn?$AAa?$AAg?$AAe?$AAr?$AA?$AA@
0x1400042E8: "__cdecl _imp_BcdCloseStore" __imp_BcdCloseStore
0x140006620: "__cdecl _onexitend" __onexitend
0x1400041F8: "__cdecl _imp_AdjustTokenPrivileges" __imp_AdjustTokenPrivileges
0x140004338: "__cdecl _imp__exit" __imp__exit
0x1400043C0: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x1400042C0: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x1400042D8: USER32_NULL_THUNK_DATA
0x1400043E8: "__cdecl _xi_a" __xi_a
0x1400042B8: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x14000200C: "private: long __cdecl CMdScheduler::SetBCDBootSequence(void) __ptr64" ?SetBCDBootSequence@CMdScheduler@@AEAAJXZ
0x1400032E0: "__cdecl matherr" _matherr
0x1400014FC: wmain
0x140004010: "const CMdSchedDisplayGUI::`vftable'" ??_7CMdSchedDisplayGUI@@6B@
0x140006000: WPP_GLOBAL_Control
0x14000109C: WPP_SF_d
0x140004490: "Unknown" ??_C@_1BA@LEPJIIOK@?$AAU?$AAn?$AAk?$AAn?$AAo?$AAw?$AAn?$AA?$AA@
0x140004450: WMD
0x140004D58: "__cdecl _IMPORT_DESCRIPTOR_COMCTL32" __IMPORT_DESCRIPTOR_COMCTL32
0x140002E2C: "void __cdecl operator delete(void * __ptr64)" ??3@YAXPEAX@Z
0x140003170: "__cdecl _security_check_cookie" __security_check_cookie
0x1400043E0: "__cdecl _xc_z" __xc_z
0x1400042E0: "__cdecl _imp_BcdCloseObject" __imp_BcdCloseObject
0x140004578: "Custom" ??_C@_1O@KKPPJBFG@?$AAC?$AAu?$AAs?$AAt?$AAo?$AAm?$AA?$AA@
0x140002930: "public: virtual long __cdecl CMdSchedDisplayGUI::DisplaySuccess(enum _MD_TYPES) __ptr64" ?DisplaySuccess@CMdSchedDisplayGUI@@UEAAJW4_MD_TYPES@@@Z
0x140004380: "__cdecl _imp_?terminate@@YAXXZ" __imp_?terminate@@YAXXZ
0x140004270: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x140003770: "__cdecl _chkstk" __chkstk
0x140004818: GUID_WINDOWS_BOOTMGR
0x1400042F0: "__cdecl _imp_BcdSetElementData" __imp_BcdSetElementData
0x140004408: "__cdecl _guard_fids_table" __guard_fids_table
0x140004398: msvcrt_NULL_THUNK_DATA
0x1400040B0: "__cdecl load_config_used" _load_config_used
0x140004460: WMD_SCHEDULE_IMMEDIATE_EVENT
0x140004548: "Standard" ??_C@_1BC@LEJCHMO@?$AAS?$AAt?$AAa?$AAn?$AAd?$AAa?$AAr?$AAd?$AA?$AA@
0x140004588: "SelfHost" ??_C@_1BC@CJFOPLDC@?$AAS?$AAe?$AAl?$AAf?$AAH?$AAo?$AAs?$AAt?$AA?$AA@
0x140004D1C: "__cdecl _IMPORT_DESCRIPTOR_USER32" __IMPORT_DESCRIPTOR_USER32
0x140004358: "__cdecl _imp__amsg_exit" __imp__amsg_exit
0x1400044A0: "Response" ??_C@_1BC@JMIBKFJI@?$AAR?$AAe?$AAs?$AAp?$AAo?$AAn?$AAs?$AAe?$AA?$AA@
0x1400042D0: "__cdecl _imp_LoadStringW" __imp_LoadStringW
0x1400043A8: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x1400042A0: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x14000605C: "__cdecl dowildcard" _dowildcard
0x140004200: "__cdecl _imp_EventWrite" __imp_EventWrite
0x1400031AC: free
0x140004838: WPP_17e4e1fdd67037afe7e8a27191ab53fd_Traceguids
0x1400043B0: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x1400034D0: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x140004470: WMD_SCHEDULE_FAILURE_EVENT
0x14000322C: RtlpImageNtHeader
0x140002574: "private: long __cdecl CMdScheduler::LogCrimsonFailureEvent(unsigned __int64,long) __ptr64" ?LogCrimsonFailureEvent@CMdScheduler@@AEAAJ_KJ@Z
0x140004298: "__cdecl _imp_GetModuleHandleW" __imp_GetModuleHandleW
0x140004360: "__cdecl _imp__XcptFilter" __imp__XcptFilter
0x1400043B8: ntdll_NULL_THUNK_DATA
0x140001E94: "private: long __cdecl CMdScheduler::AcquirePrivilege(unsigned short const * __ptr64) __ptr64" ?AcquirePrivilege@CMdScheduler@@AEAAJPEBG@Z
0x1400041D0: "__cdecl _imp_GetTraceEnableFlags" __imp_GetTraceEnableFlags
0x1400041D8: "__cdecl _imp_RegisterTraceGuidsW" __imp_RegisterTraceGuidsW
0x140006018: "__cdecl _security_cookie" __security_cookie
0x1400022EC: "private: long __cdecl CMdScheduler::LogCrimsonSuccessEvent(unsigned __int64) __ptr64" ?LogCrimsonSuccessEvent@CMdScheduler@@AEAAJ_K@Z
0x140003770: "__cdecl alloca_probe" _alloca_probe
0x140006618: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxuyzhvUwrztmlhrhUnvnwrztUfgroUlyquivUznwGEUkivxlnkOlyq@mdutils" __@@_PchSym_@00@KxulyqvxgPillgKxuyzhvUwrztmlhrhUnvnwrztUfgroUlyquivUznwGEUkivxlnkOlyq@mdutils
0x1400021DC: "private: long __cdecl CMdScheduler::SetRegistryKeys(void) __ptr64" ?SetRegistryKeys@CMdScheduler@@AEAAJXZ
0x140002A40: "public: virtual long __cdecl CMdSchedDisplayGUI::DisplayError(enum _MD_ERROR_TYPE,enum _MD_TYPES) __ptr64" ?DisplayError@CMdSchedDisplayGUI@@UEAAJW4_MD_ERROR_TYPE@@W4_MD_TYPES@@@Z
0x1400042A8: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x140006010: "__cdecl _defaultmatherr" __defaultmatherr
0x140004828: GUID_WINDOWS_MEMORY_TESTER
0x140004220: "__cdecl _imp_RegCreateKeyExW" __imp_RegCreateKeyExW
0x140006628: "__cdecl _onexitbegin" __onexitbegin
0x140004308: bcd_NULL_THUNK_DATA
0x140004250: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x140004D08: "__cdecl _IMPORT_DESCRIPTOR_KERNEL32" __IMPORT_DESCRIPTOR_KERNEL32
0x1400033D4: "__cdecl _security_init_cookie" __security_init_cookie
0x140004330: "__cdecl _imp__cexit" __imp__cexit
0x140003288: "__cdecl get_image_app_type" _get_image_app_type
0x140004D30: "__cdecl _IMPORT_DESCRIPTOR_msvcrt" __IMPORT_DESCRIPTOR_msvcrt
0x140004808: WPP_b5f70de6a41a34d67d076e0178480e7c_Traceguids
0x140003140: wmainCRTStartup
0x140004378: "__cdecl _imp_malloc" __imp_malloc
0x140004238: ADVAPI32_NULL_THUNK_DATA
0x140004230: "__cdecl _imp_EventUnregister" __imp_EventUnregister
0x140004638: WPP_a91896601d63348270076d48fbb695aa_Traceguids
0x1400065E0: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxuyzhvUwrztmlhrhUnvnwrztUnwhxsvwUlyquivUznwGEUkivxlnkOlyq@mdsched" __@@_PchSym_@00@KxulyqvxgPillgKxuyzhvUwrztmlhrhUnvnwrztUnwhxsvwUlyquivUznwGEUkivxlnkOlyq@mdsched
0x1400041E8: "__cdecl _imp_LookupPrivilegeValueW" __imp_LookupPrivilegeValueW
0x140003520: "__cdecl _report_gsfailure" __report_gsfailure
0x140002CE0: "public: static long __cdecl MdUtils::WriteRegKeyValue(struct HKEY__ * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned char const * __ptr64,unsigned long,unsigned long)" ?WriteRegKeyValue@MdUtils@@SAJPEAUHKEY__@@PEBG1PEBEKK@Z
0x140006638: "__cdecl _native_startup_state" __native_startup_state
0x140001AC0: "public: long __cdecl CMdScheduler::Schedule(void) __ptr64" ?Schedule@CMdScheduler@@QEAAJXZ
0x140004388: "__cdecl _imp__fmode" __imp__fmode
0x140004368: "__cdecl _imp_free" __imp_free
0x140003340: "__cdecl IsNonwritableInCurrentImage" _IsNonwritableInCurrentImage
0x140001928: WPP_SF_SS
0x140004300: "__cdecl _imp_BcdOpenSystemStore" __imp_BcdOpenSystemStore
0x1400041F0: "__cdecl _imp_OpenProcessToken" __imp_OpenProcessToken
0x14000102C: WPP_SF_S
0x140003736: memset
0x140004D80: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR

[JEB Decompiler by PNF Software]