Generated by JEB on 2019/08/01

PE: C:\Windows\System32\drivers\wcnfs.sys Base=0x1C0000000 SHA-256=D16E557965DBE9E5B9715DE8B5501BA27B6799DC3C28AEB9187285EDFD82AF55
PDB: wcnfs.pdb GUID={FCBD4F73-D047-A90B-5B244FD4224E3AD0} Age=1

358 located named symbols:
0x1C0009140: "__cdecl _imp_FltSetCallbackDataDirty" __imp_FltSetCallbackDataDirty
0x1C0003F24: WcnGetSiloFromFileObject
0x1C00043A0: WppClassicProviderCallback
0x1C0007388: g_AssertSpinLock
0x1C0009328: "__cdecl _imp_ExAcquireFastMutex" __imp_ExAcquireFastMutex
0x1C00050A8: EmptyUnicodeString
0x1C000EF08: WcnpDeleteInstanceTierNode
0x1C000CF48: WcnpCheckForReparseEcp
0x1C0009150: "__cdecl _imp_FltPurgeFileNameInformationCache" __imp_FltPurgeFileNameInformationCache
0x1C0005620: "onecore\base\fs\wci\wcnfs\filter" ??_C@_0CL@BEIKHHPE@onecore?2base?2fs?2wci?2wcnfs?2filter@
0x1C00090D8: "__cdecl _imp_FltGetFileNameInformation" __imp_FltGetFileNameInformation
0x1C0007098: "__cdecl _security_cookie_complement" __security_cookie_complement
0x1C0017010: WppTraceCallback
0x1C0004408: WcnGetCurrentProcessName
0x1C0009350: "__cdecl _imp_ObfDereferenceObject" __imp_ObfDereferenceObject
0x1C00043FC: "__cdecl TlgDefineProvider_annotation__Tlgmtakm_hTelemetryAssertDiagTrackProv" _TlgDefineProvider_annotation__Tlgmtakm_hTelemetryAssertDiagTrackProv
0x1C0002B3C: WcnReferenceMappingDataWeak
0x1C0009290: "__cdecl _imp_PsGetCurrentSilo" __imp_PsGetCurrentSilo
0x1C00055D0: WPP_fef07573979836dd893c9e9ecabfc0d1_Traceguids
0x1C0009238: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x1C00119A4: WcnMappingLookup
0x1C0004B20: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x1C000CCB0: WcnCleanupSiloContext
0x1C0005790: "(NOT AVAILABLE)" ??_C@_1CA@MEEMOAPL@?$AA?$CI?$AAN?$AAO?$AAT?$AA?5?$AAA?$AAV?$AAA?$AAI?$AAL?$AAA?$AAB?$AAL?$AAE?$AA?$CJ?$AA?$AA@
0x1C0009078: "__cdecl _imp_FltGetFileNameInformationUnsafe" __imp_FltGetFileNameInformationUnsafe
0x1C00059A8: "__cdecl TraceLoggingMetadata" _TraceLoggingMetadata
0x1C0016C50: WcnPreSetQuota
0x1C00092E0: "__cdecl _imp_ExpInterlockedPushEntrySList" __imp_ExpInterlockedPushEntrySList
0x1C0009010: "__cdecl _imp_FltCloseCommunicationPort" __imp_FltCloseCommunicationPort
0x1C0005918: "" ??_C@_00CNPNBAHC@?$AA@
0x1C00173FC: WcnTelemetryTraceBlockedIo
0x1C000F4E4: WcnpCreatePathTierNode
0x1C0005828: "WmiTraceMessage" ??_C@_1CA@OFIBBPKJ@?$AAW?$AAm?$AAi?$AAT?$AAr?$AAa?$AAc?$AAe?$AAM?$AAe?$AAs?$AAs?$AAa?$AAg?$AAe?$AA?$AA@
0x1C0003398: WPP_RECORDER_SF_sDDD
0x1C0002088: WPP_RECORDER_SF_sDdd
0x1C000C010: WcnContextCleanup
0x1C0009008: "__cdecl _imp_FltFreeSecurityDescriptor" __imp_FltFreeSecurityDescriptor
0x1C0017544: WcnTelemetryFatalError
0x1C0003C54: WcnReplaceFirstSubstring
0x1C0009188: "__cdecl _imp_FltAllocateContext" __imp_FltAllocateContext
0x1C0003B0C: WPP_RECORDER_SF_sDddd
0x1C0003910: WPP_RECORDER_SF_sDddZ
0x1C00091B0: "__cdecl _imp_imp_WppRecorderLogGetDefault" __imp_imp_WppRecorderLogGetDefault
0x1C0015D7C: WcnValidateContainerRootId
0x1C0001008: "__cdecl TlgWrite" _TlgWrite
0x1C00093A0: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x1C00090C8: "__cdecl _imp_FltCreateFileEx2" __imp_FltCreateFileEx2
0x1C0016C50: WcnPreDasdReadWrite
0x1C0009070: "__cdecl _imp_FltGetDestinationFileNameInformation" __imp_FltGetDestinationFileNameInformation
0x1C0009230: "__cdecl _imp_ExDeletePagedLookasideList" __imp_ExDeletePagedLookasideList
0x1C00091D8: WppRecorder_NULL_THUNK_DATA
0x1C0015090: WcnPreSetInfo
0x1C00091F8: "__cdecl _imp_MmGetSystemRoutineAddress" __imp_MmGetSystemRoutineAddress
0x1C000ED90: WcnPostFsControl
0x1C0001E20: WPP_RECORDER_SF_sDZd
0x1C0016E30: TraceLoggingRegister
0x1C00160DC: WcnAllocateUnicodeString
0x1C000ED9C: WcnpCreateInstanceTierNode
0x1C00054D0: WcnfsUnloadSuccessful
0x1C00092A8: "__cdecl _imp_RtlRbInsertNodeEx" __imp_RtlRbInsertNodeEx
0x1C00091A8: "__cdecl _imp_imp_WppRecorderConfigure" __imp_imp_WppRecorderConfigure
0x1C00092C8: "__cdecl _imp_RtlAppendUnicodeStringToString" __imp_RtlAppendUnicodeStringToString
0x1C00092C0: "__cdecl _imp_PsGetJobSilo" __imp_PsGetJobSilo
0x1C0009148: "__cdecl _imp_FltSetInstanceContext" __imp_FltSetInstanceContext
0x1C0009388: "__cdecl _imp_KeReleaseSpinLock" __imp_KeReleaseSpinLock
0x1C0016138: WcnFreeUnicodeString
0x1C0009308: "__cdecl _imp_PsDereferenceSiloContext" __imp_PsDereferenceSiloContext
0x1C00050C0: Callbacks
0x1C00041A4: WPP_RECORDER_SF_sDDDDs
0x1C00149D0: WcnPreQueryInfo
0x1C0009120: "__cdecl _imp_FltFreeExtraCreateParameter" __imp_FltFreeExtraCreateParameter
0x1C000EBD4: WcnFsctlDefaultFilter
0x1C0016178: WcnPrependVolumeDeviceName
0x1C0004B40: memcpy
0x1C001065C: WcnpMappingInsertExceptions
0x1C0007100: g_WcnfsState
0x1C0005580: "create failed" ??_C@_0O@LEEKGLHF@create?5failed?$AA@
0x1C00057F8: WPP_334692cede46345019a6104c70387d64_Traceguids
0x1C0005930: "TELASSERT" ??_C@_1BE@BNPGOOBN@?$AAT?$AAE?$AAL?$AAA?$AAS?$AAS?$AAE?$AAR?$AAT?$AA?$AA@
0x1C00090B8: "__cdecl _imp_FltReleaseResource" __imp_FltReleaseResource
0x1C0009158: "__cdecl _imp_FltGetStreamHandleContext" __imp_FltGetStreamHandleContext
0x1C000FA24: WcnpDeletePathTierNode
0x1C00043FC: "__cdecl TlgDefineProvider_annotation__Tlgmtakm_hTelemetryAssertDiagTrack_KMProv" _TlgDefineProvider_annotation__Tlgmtakm_hTelemetryAssertDiagTrack_KMProv
0x1C00070D0: pfnWppGetVersion
0x1C0004A5D: "__cdecl _C_specific_handler" __C_specific_handler
0x1C00043FC: "__cdecl TlgDefineProvider_annotation__TlgWcnfsTelemetryProviderProv" _TlgDefineProvider_annotation__TlgWcnfsTelemetryProviderProv
0x1C00031F4: WPP_RECORDER_SF_sDsd
0x1C0009090: "__cdecl _imp_FltGetVolumeFromName" __imp_FltGetVolumeFromName
0x1C000E514: WcnpHandleRecursiveChangeNotify
0x1C0005498: WcnfsInstanceAttachFailure
0x1C0016658: WcnFormatPathFromFileNameInfo
0x1C00090D0: "__cdecl _imp_FltGetVolumeInstanceFromName" __imp_FltGetVolumeInstanceFromName
0x1C0005778: "*" ??_C@_13BBDEGPLJ@?$AA?$CK?$AA?$AA@
0x1C0004B40: memmove
0x1C00090B0: "__cdecl _imp_FltAcquireResourceShared" __imp_FltAcquireResourceShared
0x1C0009338: "__cdecl _imp_PsInsertSiloContext" __imp_PsInsertSiloContext
0x1C00055A0: "onecore\base\fs\wci\wcnfs\filter" ??_C@_0CL@IKANJDMP@onecore?2base?2fs?2wci?2wcnfs?2filter@
0x1C0009368: "__cdecl _imp_RtlCopyUnicodeString" __imp_RtlCopyUnicodeString
0x1C0012490: WcnPortConnect
0x1C00073A0: g_AssertsOperational
0x1C0010D08: WcnpMappingInsert
0x1C00124B0: WcnPortDisconnect
0x1C000E7A0: WcnPreDirectoryControl
0x1C0004AAC: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x1C0012A8C: WcnpGeneratePreCreateNormalizedName
0x1C0009030: "__cdecl _imp_FltRegisterFilter" __imp_FltRegisterFilter
0x1C0009110: "__cdecl _imp_FltReleaseFileNameInformation" __imp_FltReleaseFileNameInformation
0x1C000555C: "hard" ??_C@_04EFOBLGJF@hard?$AA@
0x1C0009280: "__cdecl _imp_PsIsHostSilo" __imp_PsIsHostSilo
0x1C0009088: "__cdecl _imp_FltClose" __imp_FltClose
0x1C00073C0: WPP_MAIN_CB
0x1C0009358: "__cdecl _imp_ExDeleteResourceLite" __imp_ExDeleteResourceLite
0x1C0009180: "__cdecl _imp_FltGetVolumeName" __imp_FltGetVolumeName
0x1C0009330: "__cdecl _imp_ObfReferenceObject" __imp_ObfReferenceObject
0x1C0005570: "draining" ??_C@_08PMOPNODI@draining?$AA@
0x1C0005920: "<unknown>" ??_C@_09EEKGDCPH@?$DMunknown?$DO?$AA@
0x1C0009360: "__cdecl _imp_ExReleaseFastMutex" __imp_ExReleaseFastMutex
0x1C000166C: WPP_RECORDER_SF_sDLdZZsDl
0x1C00054E0: WcnfsDriverEntryFailure
0x1C0009200: "__cdecl _imp_EtwSetInformation" __imp_EtwSetInformation
0x1C0005780: "\??\" ??_C@_19JHEHLFPM@?$AA?2?$AA?$DP?$AA?$DP?$AA?2?$AA?$AA@
0x1C00090F0: "__cdecl _imp_FltFreeExtraCreateParameterList" __imp_FltFreeExtraCreateParameterList
0x1C0016428: WcnPrependVolumeNameFromInstance
0x1C000FA94: WcnpRBTreeDeletePathTierNode
0x1C0009318: "__cdecl _imp_ExAllocatePoolWithTag" __imp_ExAllocatePoolWithTag
0x1C0005750: "Path is too long?!" ??_C@_0BD@BJNPJJFL@Path?5is?5too?5long?$DP?$CB?$AA@
0x1C0002B64: WcnReleaseMappingDataWeak
0x1C0016A34: WcnpAttachVolume
0x1C00070E0: pfnWppQueryTraceInformation
0x1C00049E8: MicrosoftTelemetryAssertTriggeredNoArgsKM
0x1C0009210: "__cdecl _imp_PsFreeSiloContextSlot" __imp_PsFreeSiloContextSlot
0x1C00056F8: "onecore\base\fs\wci\wcnfs\filter" ??_C@_0CJ@HJPGLEOO@onecore?2base?2fs?2wci?2wcnfs?2filter@
0x1C00093BC: "__cdecl _IMPORT_DESCRIPTOR_WppRecorder" __IMPORT_DESCRIPTOR_WppRecorder
0x1C0005610: WPP_7a65340cff293177cac11d73240f1a33_Traceguids
0x1C0009340: "__cdecl _imp_EtwWriteTransfer" __imp_EtwWriteTransfer
0x1C00025A8: WPP_RECORDER_SF_sDddddd
0x1C000552C: "" ??_C@_13BLAPAIAM@?$AA?$AI?$AA?$AA@
0x1C0009198: FLTMGR_NULL_THUNK_DATA
0x1C000F480: WcnpDeleteMappingData
0x1C0009268: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x1C00090A0: "__cdecl _imp_FltAcquireResourceExclusive" __imp_FltAcquireResourceExclusive
0x1C0009100: "__cdecl _imp_FltCancelFileOpen" __imp_FltCancelFileOpen
0x1C0005908: WPP_75b6866d40293f4feeee68d5d3ab0e06_Traceguids
0x1C00057E0: "\WcnfsPort" ??_C@_1BG@MENKGJOC@?$AA?2?$AAW?$AAc?$AAn?$AAf?$AAs?$AAP?$AAo?$AAr?$AAt?$AA?$AA@
0x1C0004A88: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x1C00090E8: "__cdecl _imp_FltAllocateExtraCreateParameterList" __imp_FltAllocateExtraCreateParameterList
0x1C0005808: "PsGetVersion" ??_C@_1BK@DHLDGJM@?$AAP?$AAs?$AAG?$AAe?$AAt?$AAV?$AAe?$AAr?$AAs?$AAi?$AAo?$AAn?$AA?$AA@
0x1C00092E8: "__cdecl _imp_ExpInterlockedPopEntrySList" __imp_ExpInterlockedPopEntrySList
0x1C0007410: Microsoft_Windows_Containers_WcnfsEnableBits
0x1C00056D0: "normalized" ??_C@_0L@KOFHIIDF@normalized?$AA@
0x1C0005520: "NULL" ??_C@_19CIJIHAKK@?$AAN?$AAU?$AAL?$AAL?$AA?$AA@
0x1C0005260: FilterRegistration
0x1C00070C0: pfnEtwRegisterClassicProvider
0x1C0009098: "__cdecl _imp_FltGetFileSystemType" __imp_FltGetFileSystemType
0x1C00124E0: WcnPortMessage
0x1C0009348: "__cdecl _imp_PsGetSiloContext" __imp_PsGetSiloContext
0x1C0009248: "__cdecl _imp_IoGetSilo" __imp_IoGetSilo
0x1C0009190: "__cdecl _imp_FltGetInstanceContext" __imp_FltGetInstanceContext
0x1C0007000: PROV_WCNFS_Context
0x1C0009170: "__cdecl _imp_FltReleaseContext" __imp_FltReleaseContext
0x1C00054C0: WPP_7fe7917dc2ab3c3f81619019d7d7d097_Traceguids
0x1C0016D40: WcnPreQueryVolumeInfo
0x1C000564C: "\" ??_C@_13FPGAJAPJ@?$AA?2?$AA?$AA@
0x1C0014390: WcnNormalizeNameComponentExCallback
0x1C0005660: "onecore\base\fs\wci\wcnfs\filter" ??_C@_0CL@LNELBDBB@onecore?2base?2fs?2wci?2wcnfs?2filter@
0x1C00043FC: "__cdecl TlgDefineProvider_annotation__Tlgmtakm_hTelemetryAssertProv" _TlgDefineProvider_annotation__Tlgmtakm_hTelemetryAssertProv
0x1C00070E8: pfnEtwUnregister
0x1C00167F8: WcnGetCreateCompletionInstance
0x1C0009168: "__cdecl _imp_FltSetStreamHandleContext" __imp_FltSetStreamHandleContext
0x1C000CD84: WcnpAddEcpForReparse
0x1C000C9FC: WcnGetOrCreateSiloContext
0x1C00101E4: WcnpInitializeMappingEntry
0x1C000C490: WcnInstanceQueryTeardown
0x1C0005650: WPP_6f00bc6439643b639ec0ac923a043507_Traceguids
0x1C0009028: "__cdecl _imp_FltBuildDefaultSecurityDescriptor" __imp_FltBuildDefaultSecurityDescriptor
0x1C0009270: "__cdecl _imp_RtlRbRemoveNode" __imp_RtlRbRemoveNode
0x1C0012724: WcnpGeneratePreCreateOpenedName
0x1C0005460: "Name Not Available" ??_C@_1CG@MAKNKNKJ@?$AAN?$AAa?$AAm?$AAe?$AA?5?$AAN?$AAo?$AAt?$AA?5?$AAA?$AAv?$AAa?$AAi?$AAl?$AAa?$AAb?$AAl?$AAe?$AA?$AA@
0x1C00092B8: "__cdecl _imp_RtlEqualUnicodeString" __imp_RtlEqualUnicodeString
0x1C000F0D8: WcnpCreateMappingData
0x1C00092A0: "__cdecl _imp_ObIsKernelHandle" __imp_ObIsKernelHandle
0x1C000C764: WcnGetContextsForFileObject
0x1C00052E0: g_rootName
0x1C00184D0: GsDriverEntry
0x1C00090A8: "__cdecl _imp_FltAdjustDeviceStackSizeForIoRedirection" __imp_FltAdjustDeviceStackSizeForIoRedirection
0x1C0009398: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x1C0005424: "NULL" ??_C@_04HIBGFPH@NULL?$AA@
0x1C0001A04: WPP_RECORDER_SF_sDZZZd
0x1C0011E90: WcnStoreVirtualizationMapping
0x1C00092B0: "__cdecl _imp_RtlAppendUnicodeToString" __imp_RtlAppendUnicodeToString
0x1C00151B0: WcnPostSetInfo
0x1C0009278: "__cdecl _imp_ObReferenceObjectByHandle" __imp_ObReferenceObjectByHandle
0x1C001732C: WcnTelemetryAndTracingCleanup
0x1C0009288: "__cdecl _imp_PsGetHostSilo" __imp_PsGetHostSilo
0x1C0015D44: WcnWalkContainerRootId
0x1C0009040: "__cdecl _imp_FltGetVolumeFromFileObject" __imp_FltGetVolumeFromFileObject
0x1C0016CA0: WcnPreQueryQuota
0x1C0009320: "__cdecl _imp_PsCreateSiloContext" __imp_PsCreateSiloContext
0x1C0009068: "__cdecl _imp_FltQueryDirectoryFile" __imp_FltQueryDirectoryFile
0x1C000C52C: WcnCreateHandleContext
0x1C00049C4: MicrosoftTelemetryAssertTriggeredMsgKM
0x1C00014D0: WPP_RECORDER_SF_sDlLD
0x1C00010B0: McGenEventWrite
0x1C0007048: WPP_GLOBAL_Control
0x1C0005420: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x1C0016DB0: "__cdecl TlgEnableCallback" _TlgEnableCallback
0x1C00090C0: "__cdecl _imp_FltIsIoRedirectionAllowed" __imp_FltIsIoRedirectionAllowed
0x1C00090F8: "__cdecl _imp_FltInsertExtraCreateParameter" __imp_FltInsertExtraCreateParameter
0x1C001337C: WcnpPassthroughNameQuery
0x1C0009018: "__cdecl _imp_FltStartFiltering" __imp_FltStartFiltering
0x1C0009240: "__cdecl _imp_ExInitializePagedLookasideList" __imp_ExInitializePagedLookasideList
0x1C0014C50: WcnpPreRenameSetLink
0x1C00092D0: "__cdecl _imp_RtlCompareUnicodeString" __imp_RtlCompareUnicodeString
0x1C0004A20: "__cdecl _security_check_cookie" __security_check_cookie
0x1C000C120: WcnInstanceSetup
0x1C0009370: "__cdecl _imp_DbgkWerCaptureLiveKernelDump" __imp_DbgkWerCaptureLiveKernelDump
0x1C0009178: "__cdecl _imp_FltObjectDereference" __imp_FltObjectDereference
0x1C0009020: "__cdecl _imp_FltCreateCommunicationPort" __imp_FltCreateCommunicationPort
0x1C00093D0: "__cdecl _IMPORT_DESCRIPTOR_FLTMGR" __IMPORT_DESCRIPTOR_FLTMGR
0x1C000B000: g_ModuleName
0x1C00093A8: "__cdecl _IMPORT_DESCRIPTOR_ntoskrnl" __IMPORT_DESCRIPTOR_ntoskrnl
0x1C0009080: "__cdecl _imp_FltCloseClientPort" __imp_FltCloseClientPort
0x1C0005DCE: "__cdecl TraceLoggingMetadataEnd" _TraceLoggingMetadataEnd
0x1C0014BC0: WcnPostQueryInfo
0x1C0009000: "__cdecl _imp_FltGetVolumeProperties" __imp_FltGetVolumeProperties
0x1C0015E6C: WcnGetFileNameInformation
0x1C00092F8: "__cdecl _imp_IoReplaceFileObjectName" __imp_IoReplaceFileObjectName
0x1C0015338: WcnConvertContainerRootIdToShortNames
0x1C00058D8: "onecore\base\fs\wci\wcnfs\filter" ??_C@_0CN@PJFHPKJB@onecore?2base?2fs?2wci?2wcnfs?2filter@
0x1C0010598: WcnpCleanupMappingEntry
0x1C00091C8: "__cdecl _imp_WppAutoLogStart" __imp_WppAutoLogStart
0x1C00091A0: "__cdecl _imp_imp_WppRecorderLogDelete" __imp_imp_WppRecorderLogDelete
0x1C0015EFC: WcnGetFltCallbackSiloDetails
0x1C0005728: "Found unexpected stream componen" ??_C@_0CD@HJDBEJOL@Found?5unexpected?5stream?5componen@
0x1C0007380: "__cdecl WcnTraceRecorder" _WcnTraceRecorder
0x1C0009250: "__cdecl _imp_RtlCompareUnicodeStrings" __imp_RtlCompareUnicodeStrings
0x1C0005000: ContextRegistration
0x1C001345C: WcnpPostQueryHardLinks
0x1C0009260: "__cdecl _imp_ProbeForWrite" __imp_ProbeForWrite
0x1C0009298: "__cdecl _imp_PsJobType" __imp_PsJobType
0x1C00091B8: "__cdecl _imp_WppAutoLogStop" __imp_WppAutoLogStop
0x1C0009160: "__cdecl _imp_FltReferenceContext" __imp_FltReferenceContext
0x1C0002BA4: WcnRemapPath
0x1C0009228: "__cdecl _imp_EtwUnregister" __imp_EtwUnregister
0x1C0009138: "__cdecl _imp_FltAllocateExtraCreateParameterFromLookasideList" __imp_FltAllocateExtraCreateParameterFromLookasideList
0x1C0009208: "__cdecl _imp_PsAllocSiloContextSlot" __imp_PsAllocSiloContextSlot
0x1C0019000: "__cdecl _guard_fids_table" __guard_fids_table
0x1C0005310: "__cdecl load_config_used" _load_config_used
0x1C0009108: "__cdecl _imp_FltRemoveExtraCreateParameter" __imp_FltRemoveExtraCreateParameter
0x1C0001618: WcnInitializeSiloContext
0x1C000409C: McGenEventUnregister
0x1C000FF8C: WcnpValidateVirtualizationRoots
0x1C0005530: "onecore\base\fs\wci\wcnfs\filter" ??_C@_0CK@ONOHFHMG@onecore?2base?2fs?2wci?2wcnfs?2filter@
0x1C0005590: WPP_0889475c9eab3d03f266539f2b563734_Traceguids
0x1C0009218: "__cdecl _imp_KeInitializeEvent" __imp_KeInitializeEvent
0x1C0005848: "WmiQueryTraceInformation" ??_C@_1DC@DOCOAJH@?$AAW?$AAm?$AAi?$AAQ?$AAu?$AAe?$AAr?$AAy?$AAT?$AAr?$AAa?$AAc?$AAe?$AAI?$AAn?$AAf?$AAo?$AAr?$AAm?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x1C0013A90: WcnpPostQueryName
0x1C00058B8: "EtwUnregister" ??_C@_1BM@CJMKDOJH@?$AAE?$AAt?$AAw?$AAU?$AAn?$AAr?$AAe?$AAg?$AAi?$AAs?$AAt?$AAe?$AAr?$AA?$AA@
0x1C0002ADC: WcnReleaseMappingData
0x1C00056A0: "onecore\base\fs\wci\wcnfs\filter" ??_C@_0CL@FFFGLDCM@onecore?2base?2fs?2wci?2wcnfs?2filter@
0x1C0005488: PROV_WCNFS
0x1C00131A4: WcnpGeneratePostCreateName
0x1C001694C: WcnGetInstanceFromVolumeName
0x1C0004A70: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x1C00091E0: "__cdecl _imp_PsGetCurrentProcess" __imp_PsGetCurrentProcess
0x1C0007390: g_MicrosoftTelemetryAssertsTriggeredList
0x1C0002EB4: WPP_RECORDER_SF_sDZZd
0x1C0016ECC: WppLoadTracingSupport
0x1C0004110: McTemplateK0d
0x1C00091F0: "__cdecl _imp_IoWMIRegistrationControl" __imp_IoWMIRegistrationControl
0x1C00056E8: WPP_8f559a2d5e1637987eaf596373e87d1c_Traceguids
0x1C000FB70: WcnpValidateMappingExceptions
0x1C0005430: "onecore\base\fs\wci\wcnfs\filter" ??_C@_0CL@IFDBMBPH@onecore?2base?2fs?2wci?2wcnfs?2filter@
0x1C0002834: WPP_RECORDER_SF_sDZZ
0x1C00040D0: McTemplateK0
0x1C00091C0: "__cdecl _imp_imp_WppRecorderReplay" __imp_imp_WppRecorderReplay
0x1C0004444: MicrosoftTelemetryAssertTriggeredWorker
0x1C00092F0: "__cdecl _imp_KeBugCheckEx" __imp_KeBugCheckEx
0x1C0009048: "__cdecl _imp_FltAttachVolume" __imp_FltAttachVolume
0x1C00055E0: "onecore\base\fs\wci\wcnfs\filter" ??_C@_0CK@KJFJAOCP@onecore?2base?2fs?2wci?2wcnfs?2filter@
0x1C000EFF8: WcnpDeletePathTree
0x1C0002A9C: WcnTryReferenceMappingData
0x1C0009050: "__cdecl _imp_FltCheckAndGrowNameControl" __imp_FltCheckAndGrowNameControl
0x1C0009128: "__cdecl _imp_FltIsIoRedirectionAllowedForOperation" __imp_FltIsIoRedirectionAllowedForOperation
0x1C0009380: "__cdecl _imp_KeAcquireSpinLockRaiseToDpc" __imp_KeAcquireSpinLockRaiseToDpc
0x1C0007090: "__cdecl _security_cookie" __security_cookie
0x1C0001320: WPP_RECORDER_SF_sDD
0x1C0001320: WPP_RECORDER_SF_sDd
0x1C000FAF8: WcnpRBComparePathNodes
0x1C0002730: WPP_RECORDER_SF_sDL
0x1C0002434: WPP_RECORDER_SF_sDs
0x1C0002D0C: WPP_RECORDER_SF_sDZ
0x1C0001110: McTemplateK0dhzr1
0x1C00054A8: Microsoft_Windows_Containers_WcnfsKeywords
0x1C000DCE0: WcnPostCreate
0x1C000225C: WPP_RECORDER_SF_sDqZ
0x1C000C4F0: WcnInstanceTeardownStart
0x1C0001198: WPP_RECORDER_SF_sD
0x1C0003F50: McGenControlCallbackV2
0x1C0005880: "EtwRegisterClassicProvider" ??_C@_1DG@PFOPAIND@?$AAE?$AAt?$AAw?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAe?$AAr?$AAC?$AAl?$AAa?$AAs?$AAs?$AAi?$AAc?$AAP?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AA?$AA@
0x1C000C520: WcnInstanceTeardownComplete
0x1C0005300: g_notAvailableString
0x1C0015FBC: WcnRemoveFinalComponent
0x1C0009258: "__cdecl _imp_ProbeForRead" __imp_ProbeForRead
0x1C0009118: "__cdecl _imp_FltGetEcpListFromCallbackData" __imp_FltGetEcpListFromCallbackData
0x1C00152A0: RtlFindUnicodeSubstring
0x1C0009038: "__cdecl _imp_FltUnregisterFilter" __imp_FltUnregisterFilter
0x1C0005500: WPP_ThisDir_CTLGUID_WcnfsTrace
0x1C000ED50: WcnPreFsControl
0x1C0009130: "__cdecl _imp_FltSetEcpListIntoCallbackData" __imp_FltSetEcpListIntoCallbackData
0x1C0018504: "__cdecl _security_init_cookie" __security_init_cookie
0x1C00054B8: Microsoft_Windows_Containers_WcnfsLevels
0x1C00091E8: "__cdecl _imp_PsGetProcessImageFileName" __imp_PsGetProcessImageFileName
0x1C00057B0: "onecore\base\fs\wci\wcnfs\filter" ??_C@_0CJ@MOBPDJMK@onecore?2base?2fs?2wci?2wcnfs?2filter@
0x1C0009378: "__cdecl _imp_KeQueryTimeIncrement" __imp_KeQueryTimeIncrement
0x1C0009220: "__cdecl _imp_EtwRegister" __imp_EtwRegister
0x1C00070D8: WPPTraceSuite
0x1C0009298: PsJobType
0x1C000405C: McGenEventRegister
0x1C00052D0: g_NoShortComponent
0x1C0009058: "__cdecl _imp_FltGetVolumeFromInstance" __imp_FltGetVolumeFromInstance
0x1C0005768: WPP_679dae986e8d36987958c1a4cc208c6c_Traceguids
0x1C0005690: WPP_e19e8bb370153bd999600e66d92399fe_Traceguids
0x1C000EF68: WcnpCreatePathTree
0x1C0004A50: "__cdecl _report_gsfailure" __report_gsfailure
0x1C00054F0: GUID_ECP_WCNFS_CREATE_REPARSED
0x1C0015C44: WcnpWalkPath
0x1C0005564: "soft" ??_C@_04ODODHOMI@soft?$AA@
0x1C0002A78: WcnReferenceMappingData
0x1C00091D0: "__cdecl _imp_WppAutoLogTrace" __imp_WppAutoLogTrace
0x1C000C678: WcnGetSetHandleContext
0x1C0004180: WcnPostQueryVolumeInfo
0x1C00092D8: "__cdecl _imp_ExQueryDepthSList" __imp_ExQueryDepthSList
0x1C0009300: "__cdecl _imp_ExInitializeResourceLite" __imp_ExInitializeResourceLite
0x1C000D050: WcnPreCreate
0x1C0009390: ntoskrnl_NULL_THUNK_DATA
0x1C0009310: "__cdecl _imp_ExFreePoolWithTag" __imp_ExFreePoolWithTag
0x1C0013DD0: WcnGenerateFileNameCallback
0x1C0009060: "__cdecl _imp_FltSetInformationFile" __imp_FltSetInformationFile
0x1C0016B10: WcnUnload
0x1C000E8C0: WcnFsctlSetLayerRoot
0x1C0018008: DriverEntry
0x1C00056DC: "opened" ??_C@_06NBOJMOCJ@opened?$AA@
0x1C00034C0: WPP_RECORDER_SF_sDdZ
0x1C00052F0: g_ntNamePrefix
0x1C00070C8: pfnWppTraceMessage
0x1C0017264: WppInitKm
0x1C0003690: WPP_RECORDER_SF_sDdZZ
0x1C00090E0: "__cdecl _imp_FltParseFileNameInformation" __imp_FltParseFileNameInformation
0x1C0004E80: memset
0x1C00093E4: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x1C0005510: WcnfsDriverEntrySuccess

[JEB Decompiler by PNF Software]