Generated by JEB on 2019/02/01

PE: C:\Windows\System32\oobe\AuditShD.exe Base=0x140000000 SHA-256=C07621091415F35AAD91521E0C7DBC6862FB6E8B449F50CDA4BFB1A2BA7B9178
PDB: AuditShD.pdb GUID={32952872-FEF1-91ED-F827B89F3437A50F} Age=1

322 located named symbols:
0x140002BF8: ParseUncPath
0x140006790: "`string'" ??_C@_0BG@HIFPNDJH@ConstructPartialMsgVA?$AA@
0x1400051A8: "__cdecl _imp_UnregisterTraceGuids" __imp_UnregisterTraceGuids
0x140002AFC: BuildPathHr
0x140005F20: "`string'" ??_C@_1FG@KJHOPCFM@?$AAW?$AAa?$AAi?$AAt?$AAF?$AAo?$AAr?$AAS?$AAt?$AAa?$AAr?$AAt?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AA?3?$AA?5?$AAS?$AAt?$AAa?$AAr?$AAt?$AA?5?$AAs?$AAc?$AAr?$AAe?$AAe?$AAn@
0x140006980: "`string'" ??_C@_1BA@BFGBFLGI@?$AA?2?$AA?2?$AA?$DP?$AA?2?$AAU?$AAN?$AAC?$AA?$AA@
0x140004134: "__cdecl _raise_securityfailure" __raise_securityfailure
0x140006AC0: "`string'" ??_C@_1FA@IOGJNGGM@?$AAa?$AAp?$AAi?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAe?$AAv?$AAe?$AAn?$AAt?$AAi?$AAn?$AAg?$AA?9?$AAp?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AA?9?$AAl?$AA1?$AA?9@
0x140003ED0: "__cdecl FindPESection" _FindPESection
0x140005478: "__cdecl _imp_CoInitializeEx" __imp_CoInitializeEx
0x140006130: "`string'" ??_C@_1JO@PNJDPFPD@?$AAW?$AAa?$AAi?$AAt?$AAF?$AAo?$AAr?$AAS?$AAt?$AAa?$AAr?$AAt?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AA?3?$AA?5?$AAA?$AAp?$AAp?$AA?5?$AAv?$AAi?$AAs?$AAi?$AAb?$AAi?$AAl?$AAi@
0x140007294: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x1400011D0: "__cdecl wsetargv" _wsetargv
0x140008070: "__cdecl _security_cookie_complement" __security_cookie_complement
0x140005230: "__cdecl _imp_RaiseException" __imp_RaiseException
0x140005C20: "`string'" ??_C@_1HC@BGEPKGHD@?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAe?$AAn?$AAa?$AAb?$AAl?$AAe?$AA?5?$AAc?$AAa?$AAl?$AAl?$AAs?$AA?5?$AAt?$AAo?$AA?5?$AAS?$AAe?$AAt?$AAF?$AAo?$AAr@
0x1400053D8: "__cdecl _imp___wgetmainargs" __imp___wgetmainargs
0x140006B40: Microsoft_Windows_Deplorch
0x1400086DC: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUwhUhvxfirgbUorxvmhrmtUhkkUkpvbUkpvbrmhghUoryUlyquivUznwGEUhgwzucOlyq@pkeyinsts" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUwhUhvxfirgbUorxvmhrmtUhkkUkpvbUkpvbrmhghUoryUlyquivUznwGEUhgwzucOlyq@pkeyinsts
0x1400052A0: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x1400042E1: "__cdecl _CxxFrameHandler3" __CxxFrameHandler3
0x1400051F8: "__cdecl _imp_LookupAccountSidW" __imp_LookupAccountSidW
0x1400043F0: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x140006730: "`string'" ??_C@_0BH@OICHNGNB@WdsGenericSetupLogInit?$AA@
0x1400066F0: "__cdecl GUID_00000000_0000_0000_c000_000000000046" _GUID_00000000_0000_0000_c000_000000000046
0x140006B80: "`string'" ??_C@_0BA@MIAFEPPA@EtwEventEnabled?$AA@
0x140006990: "`string'" ??_C@_1FM@OFCLJDAE@?$AAC?$AAr?$AAe?$AAa?$AAt?$AAe?$AAP?$AAa?$AAt?$AAh?$AA?3?$AA?5?$AAU?$AAn?$AAa?$AAb?$AAl?$AAe?$AA?5?$AAt?$AAo?$AA?5?$AAc?$AAr?$AAe?$AAa?$AAt?$AAe?$AA?5?$AA?$FL?$AA?$CF?$AAs@
0x1400065F0: "`string'" ??_C@_1IG@PIPBCIPF@?$AAW?$AAa?$AAi?$AAt?$AAF?$AAo?$AAr?$AAS?$AAt?$AAa?$AAr?$AAt?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AA?3?$AA?5?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAg?$AAe@
0x1400080A8: "__cdecl commode" _commode
0x140005660: "`string'" ??_C@_1GA@LHEKNPDJ@?$AAC?$AAo?$AAu?$AAl?$AAd?$AA?5?$AAn?$AAo?$AAt?$AA?5?$AAa?$AAl?$AAl?$AAo?$AAc?$AAa?$AAt?$AAe?$AA?5?$AAm?$AAe?$AAm?$AAo?$AAr?$AAy?$AA?5?$AAf?$AAo?$AAr?$AA?5?$AAc?$AAu@
0x140008640: g_WdsNativeLibLog
0x140005890: "`string'" ??_C@_1FM@MLIBDDGB@?$AAT?$AAh?$AAi?$AAs?$AA?5?$AAi?$AAs?$AA?5?$AAn?$AAo?$AAt?$AA?5?$AAa?$AAu?$AAd?$AAi?$AAt?$AA?5?$AAm?$AAo?$AAd?$AAe?$AA?$DL?$AA?5?$AAw?$AAi?$AAl?$AAl?$AA?5?$AAn?$AAo?$AAt@
0x140001DB0: "public: virtual void * __ptr64 __cdecl Microsoft::WRL::RuntimeClass<struct Microsoft::WRL::RuntimeClassFlags<2>,struct IAppVisibilityEvents>::`vector deleting destructor'(unsigned int) __ptr64" ??_E?$RuntimeClass@U?$RuntimeClassFlags@$01@WRL@Microsoft@@UIAppVisibilityEvents@@@WRL@Microsoft@@UEAAPEAXI@Z
0x140005428: "__cdecl _imp_wcschr" __imp_wcschr
0x140005240: "__cdecl _imp_SetEvent" __imp_SetEvent
0x140005480: ole32_NULL_THUNK_DATA
0x140003DD0: "long __cdecl __CxxUnhandledExceptionFilter(struct _EXCEPTION_POINTERS * __ptr64)" ?__CxxUnhandledExceptionFilter@@YAJPEAU_EXCEPTION_POINTERS@@@Z
0x140005490: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x140006B10: "`string'" ??_C@_0L@JMEHOADM@EventWrite?$AA@
0x1400080B4: "__cdecl fmode" _fmode
0x1400052F0: "__cdecl _imp_InitializeCriticalSection" __imp_InitializeCriticalSection
0x140005420: "__cdecl _imp__wcsnicmp" __imp__wcsnicmp
0x140005218: "__cdecl _imp_GetModuleHandleExW" __imp_GetModuleHandleExW
0x1400060B0: "`string'" ??_C@_1HC@MJJODJGD@?$AAW?$AAa?$AAi?$AAt?$AAF?$AAo?$AAr?$AAS?$AAt?$AAa?$AAr?$AAt?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AA?3?$AA?5?$AAW?$AAa?$AAi?$AAt?$AAi?$AAn?$AAg?$AA?5?$AAf?$AAo?$AAr?$AA?5@
0x140003E28: "__cdecl XcptFilter" _XcptFilter
0x140005498: "__cdecl _xc_a" __xc_a
0x1400056C0: "`string'" ??_C@_1HG@HGHLKACK@?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAg?$AAe?$AAt?$AA?5?$AAt?$AAh?$AAe?$AA?5?$AAb?$AAu?$AAi?$AAl?$AAd?$AA?9?$AAi?$AAn?$AA?5?$AAa?$AAd?$AAm?$AAi?$AAn@
0x140006A98: "`string'" ??_C@_1BK@JHLNAEJL@?$AAa?$AAd?$AAv?$AAa?$AAp?$AAi?$AA3?$AA2?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x140001D30: "public: virtual long __cdecl Microsoft::WRL::Details::RuntimeClassImpl<struct Microsoft::WRL::RuntimeClassFlags<2>,1,0,0,struct IAppVisibilityEvents>::QueryInterface(struct _GUID const & __ptr64,void * __ptr64 * __ptr64) __ptr64" ?QueryInterface@?$RuntimeClassImpl@U?$RuntimeClassFlags@$01@WRL@Microsoft@@$00$0A@$0A@UIAppVisibilityEvents@@@Details@WRL@Microsoft@@UEAAJAEBU_GUID@@PEAPEAX@Z
0x1400086C8: PfnEventUnregister
0x1400086A8: McGenPreVista
0x1400025E4: StringCchCopyW
0x140008058: g_ProviderRegistrationMicrosoft_Windows_Deplorch
0x140005AE0: "`string'" ??_C@_1GI@JMECPMB@?$AAT?$AAh?$AAe?$AA?5?$AAw?$AAa?$AAi?$AAt?$AA?5?$AAf?$AAo?$AAr?$AA?5?$AAs?$AAt?$AAa?$AAr?$AAt?$AA?5?$AAs?$AAc?$AAr?$AAe?$AAe?$AAn?$AA?5?$AAe?$AAx?$AAp?$AAi?$AAr?$AAe@
0x1400042E7: "__cdecl lock" _lock
0x14000434D: "__cdecl callnewh" _callnewh
0x140006860: "`string'" ??_C@_1HC@PLEDFMHN@?$AAo?$AAn?$AAe?$AAc?$AAo?$AAr?$AAe?$AA?2?$AAb?$AAa?$AAs?$AAe?$AA?2?$AAn?$AAt?$AAs?$AAe?$AAt?$AAu?$AAp?$AA?2?$AAl?$AAi?$AAb?$AA?2?$AAu?$AAn?$AAa?$AAt?$AAt?$AAe?$AAn@
0x140005560: "__cdecl _guard_iat_table" __guard_iat_table
0x1400043CF: memcpy
0x140002B50: FormFullPathName
0x140005310: "__cdecl _imp_LoadLibraryExW" __imp_LoadLibraryExW
0x1400053F8: "__cdecl _imp_memset" __imp_memset
0x1400058F0: "`string'" ??_C@_1DA@JNJPEACF@?$AAS?$AAh?$AAe?$AAl?$AAl?$AAD?$AAe?$AAs?$AAk?$AAt?$AAo?$AAp?$AAS?$AAw?$AAi?$AAt?$AAc?$AAh?$AAE?$AAv?$AAe?$AAn?$AAt?$AA?$AA@
0x140005258: "__cdecl _imp_CreateEventW" __imp_CreateEventW
0x140004075: "__cdecl initterm" _initterm
0x140006970: Microsoft_Windows_DeplorchKeywords
0x140005BA0: "`string'" ??_C@_1IA@FEMOIGME@?$AAS?$AAe?$AAn?$AAd?$AAI?$AAn?$AAp?$AAu?$AAt?$AA?5?$AAf?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAs?$AAe?$AAn?$AAd?$AA?5?$AA?8?$AAW?$AAi?$AAn?$AA?$CL?$AAD?$AA?8@
0x140008750: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x140005250: "__cdecl _imp_Sleep" __imp_Sleep
0x1400055B8: "`string'" ??_C@_1CM@HJPIMLIN@?$AAA?$AAu?$AAd?$AAi?$AAt?$AAS?$AAh?$AAo?$AAw?$AAD?$AAe?$AAs?$AAk?$AAt?$AAo?$AAp?$AAE?$AAv?$AAe?$AAn?$AAt?$AA?$AA@
0x1400054E8: "__cdecl _xi_z" __xi_z
0x1400055A0: CLSID_AppVisibility
0x1400052B8: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x140003D62: "__cdecl _C_specific_handler" __C_specific_handler
0x140005368: "__cdecl _imp__onexit" __imp__onexit
0x140005270: "__cdecl _imp_HeapFree" __imp_HeapFree
0x140005040: "const Microsoft::WRL::RuntimeClass<struct Microsoft::WRL::RuntimeClassFlags<2>,struct IAppVisibilityEvents>::`vftable'" ??_7?$RuntimeClass@U?$RuntimeClassFlags@$01@WRL@Microsoft@@UIAppVisibilityEvents@@@WRL@Microsoft@@6B@
0x140006A78: "`string'" ??_C@_15LEKKCGMK@?$AA?2?$AA?2?$AA?$AA@
0x140001DB0: "public: virtual void * __ptr64 __cdecl Microsoft::WRL::RuntimeClass<struct Microsoft::WRL::RuntimeClassFlags<2>,struct IAppVisibilityEvents>::`scalar deleting destructor'(unsigned int) __ptr64" ??_G?$RuntimeClass@U?$RuntimeClassFlags@$01@WRL@Microsoft@@UIAppVisibilityEvents@@@WRL@Microsoft@@UEAAPEAXI@Z
0x1400011E0: "public: virtual long __cdecl CAppVisibilityNotificationSubscriber::LauncherVisibilityChange(int) __ptr64" ?LauncherVisibilityChange@CAppVisibilityNotificationSubscriber@@UEAAJH@Z
0x140004347: malloc
0x1400021B8: UnattendInitializeLogEx2
0x140001D20: "public: virtual unsigned long __cdecl Microsoft::WRL::Details::RuntimeClassImpl<struct Microsoft::WRL::RuntimeClassFlags<2>,1,0,0,struct IAppVisibilityEvents>::AddRef(void) __ptr64" ?AddRef@?$RuntimeClassImpl@U?$RuntimeClassFlags@$01@WRL@Microsoft@@$00$0A@$0A@UIAppVisibilityEvents@@@Details@WRL@Microsoft@@UEAAKXZ
0x140005CF0: "`string'" ??_C@_1DG@BLINMBMK@?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAs?$AAh?$AAo?$AAw?$AA?5?$AAt?$AAh?$AAe?$AA?5?$AAd?$AAe?$AAs?$AAk?$AAt?$AAo?$AAp?$AA?$AA@
0x1400051B0: "__cdecl _imp_RegCloseKey" __imp_RegCloseKey
0x140004374: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x140006978: Microsoft_Windows_DeplorchLevels
0x140006550: "`string'" ??_C@_1JE@FKFMLLHD@?$AAW?$AAa?$AAi?$AAt?$AAF?$AAo?$AAr?$AAS?$AAt?$AAa?$AAr?$AAt?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AA?3?$AA?5?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAi?$AAn@
0x140005448: "__cdecl _imp_RtlAllocateHeap" __imp_RtlAllocateHeap
0x140006B30: "`string'" ??_C@_0BA@FAKLIPIC@EventUnregister?$AA@
0x140003EC9: "__cdecl amsg_exit" _amsg_exit
0x140005358: "__cdecl _imp__callnewh" __imp__callnewh
0x1400067D0: "`string'" ??_C@_1DI@MEGHDGIK@?$AA?$CF?$AAw?$AAi?$AAn?$AAd?$AAi?$AAr?$AA?$CF?$AA?2?$AAP?$AAa?$AAn?$AAt?$AAh?$AAe?$AAr?$AA?2?$AAU?$AAn?$AAa?$AAt?$AAt?$AAe?$AAn?$AAd?$AAG?$AAC?$AA?$AA@
0x1400057D0: "`string'" ??_C@_1LI@CDANODKD@?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AA?5?$AAu?$AAs?$AAe?$AAr?$AA?5?$AAn?$AAa?$AAm?$AAe?$AA?5?$AAi?$AAs?$AA?5?$AA?$FL?$AA?$CF?$AAs?$AA?$FN?$AA?0?$AA?5?$AAw?$AAh?$AAi?$AAl?$AAe@
0x140005598: "struct std::nothrow_t const std::nothrow" ?nothrow@std@@3Unothrow_t@1@B
0x1400053C8: "__cdecl _imp_exit" __imp_exit
0x140005380: "__cdecl _imp__lock" __imp__lock
0x14000410C: atexit
0x140006B50: "`string'" ??_C@_0BB@DHHHEAKO@EtwEventRegister?$AA@
0x140005470: "__cdecl _imp_CoUninitialize" __imp_CoUninitialize
0x1400051D0: "__cdecl _imp_GetSidLengthRequired" __imp_GetSidLengthRequired
0x1400052D8: "__cdecl _imp_EnterCriticalSection" __imp_EnterCriticalSection
0x1400068D8: "`string'" ??_C@_1BE@OLOLOOKB@?$AAA?$AAu?$AAd?$AAi?$AAt?$AAB?$AAo?$AAo?$AAt?$AA?$AA@
0x140005188: "__cdecl _imp_GetTraceLoggerHandle" __imp_GetTraceLoggerHandle
0x140005198: "__cdecl _imp_GetTraceEnableLevel" __imp_GetTraceEnableLevel
0x140005340: "__cdecl _imp_LockSetForegroundWindow" __imp_LockSetForegroundWindow
0x1400039FC: StrStartsWithIC
0x1400086D4: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUmghvgfkUoryUhpforyUhixUlyquivUznwGEUhgwzucOlyq@skulib" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUmghvgfkUoryUhpforyUhixUlyquivUznwGEUhgwzucOlyq@skulib
0x1400052C0: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x1400042F3: "__cdecl _dllonexit" __dllonexit
0x140008740: "__cdecl _native_startup_lock" __native_startup_lock
0x140006300: "`string'" ??_C@_1MG@OAAEKBNP@?$AAW?$AAa?$AAi?$AAt?$AAF?$AAo?$AAr?$AAS?$AAt?$AAa?$AAr?$AAt?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AA?3?$AA?5?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAg?$AAe@
0x140003E10: "__cdecl _CxxSetUnhandledExceptionFilter" __CxxSetUnhandledExceptionFilter
0x140005400: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x140005450: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x140005330: KERNEL32_NULL_THUNK_DATA
0x1400086D0: McGenTracingSupportInit
0x140005248: "__cdecl _imp_GetLastError" __imp_GetLastError
0x140004300: "void * __ptr64 __cdecl operator new(unsigned __int64)" ??2@YAPEAX_K@Z
0x140004354: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x140005398: "__cdecl _imp__commode" __imp__commode
0x1400053B0: "__cdecl _imp___setusermatherr" __imp___setusermatherr
0x140007230: "__cdecl _IMPORT_DESCRIPTOR_ADVAPI32" __IMPORT_DESCRIPTOR_ADVAPI32
0x140005298: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x140005268: "__cdecl _imp_WaitForSingleObject" __imp_WaitForSingleObject
0x140003F70: "__cdecl ValidateImageBase" _ValidateImageBase
0x1400051D8: "__cdecl _imp_LsaQueryInformationPolicy" __imp_LsaQueryInformationPolicy
0x140006720: "`string'" ??_C@_0BA@EGFDPMGD@WdsSetupLogInit?$AA@
0x140003DA0: "void * __ptr64 __cdecl operator new(unsigned __int64,struct std::nothrow_t const & __ptr64)" ??2@YAPEAX_KAEBUnothrow_t@std@@@Z
0x140005440: "__cdecl _imp_RtlFreeHeap" __imp_RtlFreeHeap
0x1400011D0: "public: virtual long __cdecl CAppVisibilityNotificationSubscriber::AppVisibilityOnMonitorChanged(struct HMONITOR__ * __ptr64,enum MONITOR_APP_VISIBILITY,enum MONITOR_APP_VISIBILITY) __ptr64" ?AppVisibilityOnMonitorChanged@CAppVisibilityNotificationSubscriber@@UEAAJPEAUHMONITOR__@@W4MONITOR_APP_VISIBILITY@@1@Z
0x140008710: "protected: static struct CEtwProviderT<void>::CETWApiSet CEtwProviderT<void>::g_etwApi" ?g_etwApi@?$CEtwProviderT@X@@1UCETWApiSet@1@A
0x1400055B0: "`string'" ??_C@_13FPGAJAPJ@?$AA?2?$AA?$AA@
0x140005228: "__cdecl _imp_HeapAlloc" __imp_HeapAlloc
0x14000726C: "__cdecl _IMPORT_DESCRIPTOR_ole32" __IMPORT_DESCRIPTOR_ole32
0x140005308: "__cdecl _imp_FreeLibrary" __imp_FreeLibrary
0x140005278: "__cdecl _imp_CompareStringW" __imp_CompareStringW
0x140006270: "`string'" ??_C@_1IO@HHEILFIG@?$AAW?$AAa?$AAi?$AAt?$AAF?$AAo?$AAr?$AAS?$AAt?$AAa?$AAr?$AAt?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AA?3?$AA?5?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAw?$AAa@
0x1400080B0: "__cdecl newmode" _newmode
0x1400051C8: "__cdecl _imp_GetSidSubAuthority" __imp_GetSidSubAuthority
0x1400053A8: "__cdecl _imp__initterm" __imp__initterm
0x1400053D0: "__cdecl _imp___set_app_type" __imp___set_app_type
0x140002D5C: AllocateExpand
0x1400052D0: "__cdecl _imp_SetLastError" __imp_SetLastError
0x140003588: RegGetDword
0x1400052E0: "__cdecl _imp_GetModuleFileNameW" __imp_GetModuleFileNameW
0x140005210: "__cdecl _imp_GetVersionExW" __imp_GetVersionExW
0x140001E94: GetNameFromSID
0x140008730: "__cdecl _onexitend" __onexitend
0x1400053C0: "__cdecl _imp__exit" __imp__exit
0x1400042ED: "__cdecl unlock" _unlock
0x140005488: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x140005740: "`string'" ??_C@_1IK@ILABGBFH@?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAg?$AAe?$AAt?$AA?5?$AAt?$AAh?$AAe?$AA?5?$AAb?$AAu?$AAi?$AAl?$AAd?$AA?9?$AAi?$AAn?$AA?5?$AAa?$AAd?$AAm?$AAi?$AAn@
0x1400052C8: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x140005348: USER32_NULL_THUNK_DATA
0x140003778: BuildPath
0x1400054D0: "__cdecl _xi_a" __xi_a
0x1400086C0: Microsoft_Windows_DeplorchEnableBits
0x1400052B0: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x1400011D0: "__cdecl matherr" _matherr
0x140005378: "__cdecl _imp__unlock" __imp__unlock
0x140001290: wmain
0x140006778: "`string'" ??_C@_0BE@PMAMNFBG@WdsSetupLogMessageW?$AA@
0x1400068D4: "`string'" ??_C@_13MKMNOPIJ@?$AAD?$AA?$AA@
0x140006820: "`string'" ??_C@_1BE@ELICABCK@?$AA?$DM?$AAu?$AAn?$AAk?$AAn?$AAo?$AAw?$AAn?$AA?$DO?$AA?$AA@
0x140001240: "private: virtual void * __ptr64 __cdecl CAppVisibilityNotificationSubscriber::`scalar deleting destructor'(unsigned int) __ptr64" ??_GCAppVisibilityNotificationSubscriber@@EEAAPEAXI@Z
0x1400067A8: "`string'" ??_C@_0BG@GEMHGGEA@ConstructPartialMsgVW?$AA@
0x140005370: "__cdecl _imp___dllonexit" __imp___dllonexit
0x140005A80: "`string'" ??_C@_1FI@IMGCAFGG@?$AAT?$AAh?$AAe?$AA?5?$AAs?$AAh?$AAe?$AAl?$AAl?$AA?5?$AAd?$AAe?$AAs?$AAk?$AAt?$AAo?$AAp?$AA?5?$AAs?$AAw?$AAi?$AAt?$AAc?$AAh?$AA?5?$AAe?$AAv?$AAe?$AAn?$AAt?$AA?5?$AAw@
0x140005F80: "`string'" ??_C@_1KA@OEKFEBNL@?$AAW?$AAa?$AAi?$AAt?$AAF?$AAo?$AAr?$AAS?$AAt?$AAa?$AAr?$AAt?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AA?3?$AA?5?$AAS?$AAt?$AAa?$AAr?$AAt?$AA?5?$AAs?$AAc?$AAr?$AAe?$AAe?$AAn@
0x140003A60: "void __cdecl operator delete(void * __ptr64)" ??3@YAXPEAX@Z
0x1400026F8: PrepareUnicodePath
0x140005300: "__cdecl _imp_DeleteCriticalSection" __imp_DeleteCriticalSection
0x140005410: "__cdecl _imp__vsnprintf" __imp__vsnprintf
0x1400051B8: "__cdecl _imp_LsaFreeMemory" __imp_LsaFreeMemory
0x140005920: "`string'" ??_C@_1HC@BBIOGACL@?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAo?$AAp?$AAe?$AAn?$AA?5?$AAt?$AAh?$AAe?$AA?5?$AAs?$AAh?$AAe?$AAl?$AAl?$AA?5?$AAd?$AAe?$AAs?$AAk?$AAt?$AAo?$AAp@
0x140003D80: "__cdecl _security_check_cookie" __security_check_cookie
0x1400067C0: "`string'" ??_C@_09BJNIHBEK@CurrentIP?$AA@
0x1400054C8: "__cdecl _xc_z" __xc_z
0x1400052F8: "__cdecl _imp_GetProcAddress" __imp_GetProcAddress
0x1400063D0: "`string'" ??_C@_1LK@CCFLJBOD@?$AAW?$AAa?$AAi?$AAt?$AAF?$AAo?$AAr?$AAS?$AAt?$AAa?$AAr?$AAt?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AA?3?$AA?5?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAu?$AAn@
0x140005338: "__cdecl _imp_SendInput" __imp_SendInput
0x1400086B0: PfnEventWrite
0x140005388: "__cdecl _imp_?terminate@@YAXXZ" __imp_?terminate@@YAXXZ
0x140005468: "__cdecl _imp_CoCreateInstance" __imp_CoCreateInstance
0x1400052A8: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x140006808: "`string'" ??_C@_1BI@LOLJMEGL@?$AAw?$AAd?$AAs?$AAc?$AAo?$AAr?$AAe?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x140005220: "__cdecl _imp_GetProcessHeap" __imp_GetProcessHeap
0x1400086C4: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUmghvgfkUoryUwvkolixsUhixUlyquivUznwGEUkxsOlyq@DeplOrch" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUmghvgfkUoryUwvkolixsUhixUlyquivUznwGEUkxsOlyq@DeplOrch
0x1400030A0: McGenEventTracingRegister
0x140002918: CreatePath
0x140005328: "__cdecl _imp_CreateDirectoryW" __imp_CreateDirectoryW
0x1400051F0: "__cdecl _imp_LsaClose" __imp_LsaClose
0x1400054F0: "__cdecl _guard_fids_table" __guard_fids_table
0x140005430: msvcrt_NULL_THUNK_DATA
0x140005070: "__cdecl load_config_used" _load_config_used
0x140005010: "const CAppVisibilityNotificationSubscriber::`vftable'" ??_7CAppVisibilityNotificationSubscriber@@6B@
0x140006760: "`string'" ??_C@_0BE@OAJEGAMB@WdsSetupLogMessageA?$AA@
0x140001240: "private: virtual void * __ptr64 __cdecl CAppVisibilityNotificationSubscriber::`vector deleting destructor'(unsigned int) __ptr64" ??_ECAppVisibilityNotificationSubscriber@@EEAAPEAXI@Z
0x140006710: "__cdecl GUID_6584ce6b_7d82_49c2_89c9_c6bc02ba8c38" _GUID_6584ce6b_7d82_49c2_89c9_c6bc02ba8c38
0x1400059A0: "`string'" ??_C@_1FG@LGKJIIED@?$AAW?$AAa?$AAi?$AAt?$AAi?$AAn?$AAg?$AA?5?$AAf?$AAo?$AAr?$AA?5?$AAt?$AAh?$AAe?$AA?5?$AAs?$AAh?$AAe?$AAl?$AAl?$AA?5?$AAd?$AAe?$AAs?$AAk?$AAt?$AAo?$AAp?$AA?5?$AAs?$AAw@
0x140005260: "__cdecl _imp_OpenEventW" __imp_OpenEventW
0x140007280: "__cdecl _IMPORT_DESCRIPTOR_USER32" __IMPORT_DESCRIPTOR_USER32
0x140005A00: "`string'" ??_C@_1HK@MKMDJKEB@?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAw?$AAa?$AAi?$AAt?$AA?5?$AAf?$AAo?$AAr?$AA?5?$AAt?$AAh?$AAe?$AA?5?$AAs?$AAh?$AAe?$AAl?$AAl?$AA?5?$AAd?$AAe?$AAs@
0x1400053E0: "__cdecl _imp__amsg_exit" __imp__amsg_exit
0x1400055F0: "`string'" ??_C@_1GE@JCJBGMCJ@?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAg?$AAe?$AAt?$AA?5?$AAt?$AAh?$AAe?$AA?5?$AAc?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AA?5?$AAu?$AAs?$AAe?$AAr?$AA?5?$AAn@
0x140003654: StringCchCopyNExW
0x140001FE8: "long __cdecl StringCchPrintfA(char * __ptr64,unsigned __int64,char const * __ptr64,...)" ?StringCchPrintfA@@YAJPEAD_KPEBDZZ
0x140005458: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x140005290: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x1400080AC: "__cdecl dowildcard" _dowildcard
0x140006020: "`string'" ??_C@_1IO@BPBLEFKL@?$AAW?$AAa?$AAi?$AAt?$AAF?$AAo?$AAr?$AAS?$AAt?$AAa?$AAr?$AAt?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AA?3?$AA?5?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAo?$AAp@
0x140001DD4: ??$Make@VCAppVisibilityNotificationSubscriber@@$$V@Details@WRL@Microsoft@@YA?AV?$ComPtr@VCAppVisibilityNotificationSubscriber@@@12@XZ
0x140003DC6: free
0x140005438: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x140003DC0: "__cdecl purecall" _purecall
0x140005B50: "`string'" ??_C@_1EI@LAGPBDFL@?$AAS?$AAe?$AAn?$AAd?$AAi?$AAn?$AAg?$AA?5?$AA?8?$AAW?$AAi?$AAn?$AA?$CL?$AAD?$AA?8?$AA?5?$AAt?$AAo?$AA?5?$AAs?$AAh?$AAo?$AAw?$AA?5?$AAt?$AAh?$AAe?$AA?5?$AAd?$AAe?$AAs?$AAk@
0x14000433C: "__cdecl _std_terminate" __std_terminate
0x140002668: StringCchCopyNW
0x1400034CC: RegExists
0x140005170: "__cdecl _imp_GetUserNameW" __imp_GetUserNameW
0x140004130: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x140005208: "__cdecl _imp_ExpandEnvironmentStringsW" __imp_ExpandEnvironmentStringsW
0x140006840: "`string'" ??_C@_1BM@PPHHDPAK@?$AAU?$AAn?$AAa?$AAt?$AAt?$AAe?$AAn?$AAd?$AAL?$AAo?$AAg?$AAW?$AAV?$AA?$AA@
0x140005418: "__cdecl _imp_wcsrchr" __imp_wcsrchr
0x140003E30: RtlpImageNtHeader
0x1400086D8: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUwhUhvxfirgbUorxvmhrmtUhkkUkpvbrmhgUoryUlyquivUznwGEUhgwzucOlyq@pkeyinst" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUwhUhvxfirgbUorxvmhrmtUhkkUkpvbrmhgUoryUlyquivUznwGEUhgwzucOlyq@pkeyinst
0x140006748: "`string'" ??_C@_0BD@EHPFJNKD@WdsSetupLogDestroy?$AA@
0x140005288: "__cdecl _imp_GetModuleHandleW" __imp_GetModuleHandleW
0x1400051E8: "__cdecl _imp_LsaOpenPolicy" __imp_LsaOpenPolicy
0x140008000: PfnEventRegister
0x140006B68: "`string'" ??_C@_0BD@JDHMJNFM@EtwEventUnregister?$AA@
0x1400053E8: "__cdecl _imp__XcptFilter" __imp__XcptFilter
0x140005460: ntdll_NULL_THUNK_DATA
0x140005350: "__cdecl _imp_memcpy" __imp_memcpy
0x140006490: "`string'" ??_C@_1MA@HLDBMGFF@?$AAW?$AAa?$AAi?$AAt?$AAF?$AAo?$AAr?$AAS?$AAt?$AAa?$AAr?$AAt?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AA?3?$AA?5?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAw?$AAh?$AAe?$AAn?$AA?5@
0x140006838: "`string'" ??_C@_07EKKPINLM@?$FL?$CFS?$FN?5?$CFS?$AA@
0x1400051C0: "__cdecl _imp_GetSidSubAuthorityCount" __imp_GetSidSubAuthorityCount
0x140005190: "__cdecl _imp_GetTraceEnableFlags" __imp_GetTraceEnableFlags
0x1400068F0: "`string'" ??_C@_1CI@EDJKIOEK@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAS?$AAe?$AAt?$AAu?$AAp?$AA?2?$AAS?$AAt?$AAa?$AAt?$AAu?$AAs?$AA?$AA@
0x140005390: "__cdecl _imp___CxxFrameHandler3" __imp___CxxFrameHandler3
0x1400051A0: "__cdecl _imp_RegisterTraceGuidsW" __imp_RegisterTraceGuidsW
0x140008068: "__cdecl _security_cookie" __security_cookie
0x140006680: "`string'" ??_C@_1HA@FMGKJLPD@?$AAW?$AAa?$AAi?$AAt?$AAF?$AAo?$AAr?$AAS?$AAt?$AAa?$AAr?$AAt?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AA?3?$AA?5?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AA?5?$AAt?$AAo?$AA?5?$AAC?$AAo@
0x140005180: "__cdecl _imp_RegQueryValueExW" __imp_RegQueryValueExW
0x140005CA0: "`string'" ??_C@_1EO@NEKGJBMJ@?$AAS?$AAe?$AAn?$AAd?$AAI?$AAn?$AAp?$AAu?$AAt?$AA?5?$AAs?$AAu?$AAc?$AAc?$AAe?$AAe?$AAd?$AAe?$AAd?$AA?5?$AAi?$AAn?$AA?5?$AAs?$AAe?$AAn?$AAd?$AAi?$AAn?$AAg?$AA?5?$AA?8@
0x140005EA0: "`string'" ??_C@_1HI@KPIAJCAG@?$AAW?$AAa?$AAi?$AAt?$AAF?$AAo?$AAr?$AAS?$AAt?$AAa?$AAr?$AAt?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AA?3?$AA?5?$AAW?$AAa?$AAi?$AAt?$AAi?$AAn?$AAg?$AA?5?$AAf?$AAo?$AAr?$AA?5@
0x140005320: "__cdecl _imp_GetFullPathNameW" __imp_GetFullPathNameW
0x140005238: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x1400051E0: "__cdecl _imp_GetLengthSid" __imp_GetLengthSid
0x140005D30: "`string'" ??_C@_1LE@HMOIAFOC@?$AAG?$AAe?$AAt?$AAA?$AAp?$AAp?$AAV?$AAi?$AAs?$AAi?$AAb?$AAi?$AAl?$AAi?$AAt?$AAy?$AAI?$AAn?$AAt?$AAe?$AAr?$AAf?$AAa?$AAc?$AAe?$AA?3?$AA?5?$AAC?$AAo?$AAC?$AAr?$AAe@
0x140008060: "__cdecl _defaultmatherr" __defaultmatherr
0x140002F70: McGenControlCallbackV2
0x140005DF0: "`string'" ??_C@_1KE@IFFDFDL@?$AAG?$AAe?$AAt?$AAA?$AAp?$AAp?$AAV?$AAi?$AAs?$AAi?$AAb?$AAi?$AAl?$AAi?$AAt?$AAy?$AAI?$AAn?$AAt?$AAe?$AAr?$AAf?$AAa?$AAc?$AAe?$AA?3?$AA?5?$AAC?$AAo?$AAC?$AAr?$AAe@
0x140005318: "__cdecl _imp_GetFileAttributesW" __imp_GetFileAttributesW
0x140006B20: "`string'" ??_C@_0O@BAMBGLIE@EventRegister?$AA@
0x140008738: "__cdecl _onexitbegin" __onexitbegin
0x140005280: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x140007244: "__cdecl _IMPORT_DESCRIPTOR_KERNEL32" __IMPORT_DESCRIPTOR_KERNEL32
0x140008638: g_WdsLibLog
0x140008010: Microsoft_Windows_Deplorch_Context
0x140005178: "__cdecl _imp_RegOpenKeyExW" __imp_RegOpenKeyExW
0x140003FA0: "__cdecl _security_init_cookie" __security_init_cookie
0x140006B90: "`string'" ??_C@_0O@MJPOMPOC@EtwEventWrite?$AA@
0x1400053B8: "__cdecl _imp__cexit" __imp__cexit
0x1400069F0: "`string'" ??_C@_1IG@HCLNMHAA@?$AAC?$AAr?$AAe?$AAa?$AAt?$AAe?$AAP?$AAa?$AAt?$AAh?$AA?3?$AA?5?$AAU?$AAn?$AAa?$AAb?$AAl?$AAe?$AA?5?$AAt?$AAo?$AA?5?$AAc?$AAr?$AAe?$AAa?$AAt?$AAe?$AA?5?$AAp?$AAa?$AAr@
0x1400022A8: UnattendLogW
0x1400024C4: LibLog
0x140003E84: "__cdecl get_image_app_type" _get_image_app_type
0x140007258: "__cdecl _IMPORT_DESCRIPTOR_msvcrt" __IMPORT_DESCRIPTOR_msvcrt
0x140008630: "public: static class Microsoft::WRL::Details::ModuleBase * __ptr64 __ptr64 Microsoft::WRL::Details::ModuleBase::module_" ?module_@ModuleBase@Details@WRL@Microsoft@@2PEAV1234@EA
0x140001CD0: "public: virtual unsigned long __cdecl Microsoft::WRL::Details::RuntimeClassImpl<struct Microsoft::WRL::RuntimeClassFlags<2>,1,0,0,struct IAppVisibilityEvents>::Release(void) __ptr64" ?Release@?$RuntimeClassImpl@U?$RuntimeClassFlags@$01@WRL@Microsoft@@$00$0A@$0A@UIAppVisibilityEvents@@@Details@WRL@Microsoft@@UEAAKXZ
0x140008708: "private: static class CEtwProviderT<void> CChkMacroETWLoggerT<class CEmptyType>::g_chkMacroETWProvider" ?g_chkMacroETWProvider@?$CChkMacroETWLoggerT@VCEmptyType@@@@0V?$CEtwProviderT@X@@A
0x1400022CC: UnattendLogWV
0x140003D50: wmainCRTStartup
0x140003940: StrDupe
0x140005360: "__cdecl _imp_malloc" __imp_malloc
0x140005408: "__cdecl _imp__purecall" __imp__purecall
0x140005200: ADVAPI32_NULL_THUNK_DATA
0x140006700: "__cdecl GUID_2246ea2d_caea_4444_a3c4_6de827e44313" _GUID_2246ea2d_caea_4444_a3c4_6de827e44313
0x140002544: DirectoryExists
0x140004170: "__cdecl _report_gsfailure" __report_gsfailure
0x1400052E8: "__cdecl _imp_LeaveCriticalSection" __imp_LeaveCriticalSection
0x14000407C: "__cdecl onexit" _onexit
0x140006920: "`string'" ??_C@_1EM@EIPHPJDH@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAS?$AAe?$AAt?$AAu?$AAp?$AA?2?$AAS?$AAt?$AAa?$AAt?$AAu?$AAs?$AA?2?$AAA?$AAu?$AAd?$AAi?$AAt?$AAB?$AAo?$AAo?$AAt?$AAV?$AAo?$AAl@
0x1400061D0: "`string'" ??_C@_1JC@NLKIMEGE@?$AAW?$AAa?$AAi?$AAt?$AAF?$AAo?$AAr?$AAS?$AAt?$AAa?$AAr?$AAt?$AAS?$AAc?$AAr?$AAe?$AAe?$AAn?$AA?3?$AA?5?$AAT?$AAi?$AAm?$AAe?$AAd?$AA?5?$AAo?$AAu?$AAt?$AA?5?$AAw?$AAh@
0x140008748: "__cdecl _native_startup_state" __native_startup_state
0x140006A80: "`string'" ??_C@_1BE@GJOFHIHD@?$AAn?$AAt?$AAd?$AAl?$AAl?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x140002E00: McGenControlCallback
0x1400053A0: "__cdecl _imp__fmode" __imp__fmode
0x1400053F0: "__cdecl _imp_free" __imp_free
0x140003F20: "__cdecl IsNonwritableInCurrentImage" _IsNonwritableInCurrentImage
0x1400043D5: memset
0x1400072A8: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR

[JEB Decompiler by PNF Software]