Generated by JEB on 2019/08/01

PE: C:\Windows\System32\drivers\bindflt.sys Base=0x1C0000000 SHA-256=DCA6712D0A9BE5B72F8541386206EE39E67ACE3F450A9B5B43F77B6D8F019B61
PDB: bindflt.pdb GUID={0D1F53DD-9C2D-408B-C15105E236DE0747} Age=1

365 located named symbols:
0x1C000B088: "__cdecl _imp_FltIs32bitProcess" __imp_FltIs32bitProcess
0x1C000B100: "__cdecl _imp_FltSetCallbackDataDirty" __imp_FltSetCallbackDataDirty
0x1C0004A50: WppClassicProviderCallback
0x1C000B2E8: "__cdecl _imp_ExAcquireFastMutex" __imp_ExAcquireFastMutex
0x1C000B358: "__cdecl _imp_RtlFreeUnicodeString" __imp_RtlFreeUnicodeString
0x1C00028A8: BfTryReferenceMappingData
0x1C0018A38: BfFormatPathFromFileNameInfo
0x1C000B098: "__cdecl _imp_FltGetFileNameInformation" __imp_FltGetFileNameInformation
0x1C0013184: BfpInitializeMappingEntry
0x1C0009098: "__cdecl _security_cookie_complement" __security_cookie_complement
0x1C0019330: WppTraceCallback
0x1C000B408: "__cdecl _imp_ObfDereferenceObject" __imp_ObfDereferenceObject
0x1C0018F40: BfPreReadWrite
0x1C0007A80: WPP_961e1c33259a3bf18a0c3eaf4dec380c_Traceguids
0x1C000B308: "__cdecl _imp_PsGetCurrentSilo" __imp_PsGetCurrentSilo
0x1C000B278: "__cdecl _imp_ExInitializeNPagedLookasideList" __imp_ExInitializeNPagedLookasideList
0x1C000B2A8: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x1C0004BC0: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x1C00092F0: Microsoft_Windows_Containers_BindFltEnableBits
0x1C0012A64: BfpRBTreeDeletePathTierNode
0x1C000F178: BfpHandleRecursiveChangeNotify
0x1C000B078: "__cdecl _imp_FltGetFileNameInformationUnsafe" __imp_FltGetFileNameInformationUnsafe
0x1C0007CA8: "__cdecl TraceLoggingMetadata" _TraceLoggingMetadata
0x1C0004600: BfPreCleanup
0x1C001830C: BfWalkContainerRootId
0x1C0007C38: WPP_16387623961837917cf401838c6b85e1_Traceguids
0x1C000B400: "__cdecl _imp_ExpInterlockedPushEntrySList" __imp_ExpInterlockedPushEntrySList
0x1C000B008: "__cdecl _imp_FltCloseCommunicationPort" __imp_FltCloseCommunicationPort
0x1C000B258: "__cdecl _imp_SeCreateClientSecurityFromSubjectContext" __imp_SeCreateClientSecurityFromSubjectContext
0x1C00078A8: WPP_ThisDir_CTLGUID_BindFltTrace
0x1C0007B58: "WmiTraceMessage" ??_C@_1CA@OFIBBPKJ@?$AAW?$AAm?$AAi?$AAT?$AAr?$AAa?$AAc?$AAe?$AAM?$AAe?$AAs?$AAs?$AAa?$AAg?$AAe?$AA?$AA@
0x1C00026B4: WPP_RECORDER_SF_sDdd
0x1C00155A0: BfPortConnect
0x1C000B000: "__cdecl _imp_FltFreeSecurityDescriptor" __imp_FltFreeSecurityDescriptor
0x1C0011C6C: BfpCreateInstanceTierNode
0x1C000B3F0: "__cdecl _imp_ExInitializeRundownProtection" __imp_ExInitializeRundownProtection
0x1C000B170: "__cdecl _imp_FltAllocateContext" __imp_FltAllocateContext
0x1C0002B98: BfpValidateVirtualizationRoot
0x1C000B1A0: "__cdecl _imp_imp_WppRecorderLogGetDefault" __imp_imp_WppRecorderLogGetDefault
0x1C0018C4C: BfGetInstanceFromVolumeName
0x1C000B448: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x1C000B0D8: "__cdecl _imp_FltCreateFileEx2" __imp_FltCreateFileEx2
0x1C000B298: "__cdecl _imp_ExDeletePagedLookasideList" __imp_ExDeletePagedLookasideList
0x1C0018600: BfFreeUnicodeString
0x1C000B1C8: WppRecorder_NULL_THUNK_DATA
0x1C000B028: "__cdecl _imp_FltDoCompletionProcessingWhenSafe" __imp_FltDoCompletionProcessingWhenSafe
0x1C000B1E8: "__cdecl _imp_MmGetSystemRoutineAddress" __imp_MmGetSystemRoutineAddress
0x1C000E230: BfPreCreate
0x1C0003330: BfRemapPath
0x1C0001C64: WPP_RECORDER_SF_sDZd
0x1C0014A58: BfMappingLookup
0x1C000B320: "__cdecl _imp_RtlRbInsertNodeEx" __imp_RtlRbInsertNodeEx
0x1C00061A0: SfoUpdateFileSizesWorker
0x1C0007888: Microsoft_Windows_Containers_BindFltKeywords
0x1C000B190: "__cdecl _imp_imp_WppRecorderConfigure" __imp_imp_WppRecorderConfigure
0x1C000B340: "__cdecl _imp_KeWaitForSingleObject" __imp_KeWaitForSingleObject
0x1C000B430: "__cdecl _imp_RtlAppendUnicodeStringToString" __imp_RtlAppendUnicodeStringToString
0x1C000B338: "__cdecl _imp_PsGetJobSilo" __imp_PsGetJobSilo
0x1C000B120: "__cdecl _imp_FltSetInstanceContext" __imp_FltSetInstanceContext
0x1C001971C: SfoCreateFile
0x1C000B3A0: "__cdecl _imp_PsDereferenceSiloContext" __imp_PsDereferenceSiloContext
0x1C0014F24: BfStoreVirtualizationMapping
0x1C00070E0: Callbacks
0x1C0012F2C: BfpValidateVirtualizationRoots
0x1C00078D8: BindFltDriverEntrySuccess
0x1C0012A9C: BfpRBComparePathNodes
0x1C0004C00: memcpy
0x1C000D63C: BfCreateStreamContext
0x1C000B0C0: "__cdecl _imp_FltReleaseResource" __imp_FltReleaseResource
0x1C0003F98: WPP_RECORDER_SF_sDqd
0x1C000B0A0: "__cdecl _imp_FltClearCallbackDataDirty" __imp_FltClearCallbackDataDirty
0x1C000B130: "__cdecl _imp_FltGetStreamHandleContext" __imp_FltGetStreamHandleContext
0x1C000B250: "__cdecl _imp_SeTokenType" __imp_SeTokenType
0x1C00090D0: pfnWppGetVersion
0x1C0016428: BfpPassthroughNameQuery
0x1C000DD64: BfGetContextsForFileObject
0x1C0018818: BfPrependVolumeNameFromInstance
0x1C0004AFD: "__cdecl _C_specific_handler" __C_specific_handler
0x1C0003C60: WPP_RECORDER_SF_sDsd
0x1C000E140: BfCleanupSiloContext
0x1C000B058: "__cdecl _imp_FltGetVolumeFromName" __imp_FltGetVolumeFromName
0x1C000162C: BfCleanupMappingContext
0x1C000B080: "__cdecl _imp_FltGetVolumeInstanceFromName" __imp_FltGetVolumeInstanceFromName
0x1C0007AD0: "*" ??_C@_13BBDEGPLJ@?$AA?$CK?$AA?$AA@
0x1C0004C00: memmove
0x1C001362C: BfClearMappingTable
0x1C000B0B8: "__cdecl _imp_FltAcquireResourceShared" __imp_FltAcquireResourceShared
0x1C000B3C8: "__cdecl _imp_PsInsertSiloContext" __imp_PsInsertSiloContext
0x1C000B300: "__cdecl _imp_RtlCopyUnicodeString" __imp_RtlCopyUnicodeString
0x1C00155F0: BfPortMessage
0x1C0004B4C: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x1C000B030: "__cdecl _imp_FltRegisterFilter" __imp_FltRegisterFilter
0x1C000B0E0: "__cdecl _imp_FltReleaseFileNameInformation" __imp_FltReleaseFileNameInformation
0x1C0017A9C: BfHandleReparsePoint
0x1C000B420: "__cdecl _imp_PsIsHostSilo" __imp_PsIsHostSilo
0x1C000B110: "__cdecl _imp_FltClose" __imp_FltClose
0x1C0003200: BfCombinedMappingLookup
0x1C00092A0: WPP_MAIN_CB
0x1C000B410: "__cdecl _imp_ExDeleteResourceLite" __imp_ExDeleteResourceLite
0x1C000FC04: BfGetFileInformationClassOffsets
0x1C000B0F0: "__cdecl _imp_FltQueryInformationByName" __imp_FltQueryInformationByName
0x1C0004AAC: "__cdecl TlgDefineProvider_annotation__TlgBindFltTelemetryProviderProv" _TlgDefineProvider_annotation__TlgBindFltTelemetryProviderProv
0x1C000B168: "__cdecl _imp_FltGetVolumeName" __imp_FltGetVolumeName
0x1C00178F8: BfpGetReparseData
0x1C000B428: "__cdecl _imp_PsGetParentSilo" __imp_PsGetParentSilo
0x1C0007860: BindFltUnloadSuccessful
0x1C000B328: "__cdecl _imp_ExReleaseFastMutex" __imp_ExReleaseFastMutex
0x1C0006010: BfPostReadWrite
0x1C000B368: "__cdecl _imp_FsRtlDoesNameContainWildCards" __imp_FsRtlDoesNameContainWildCards
0x1C000B1E0: "__cdecl _imp_EtwSetInformation" __imp_EtwSetInformation
0x1C0012430: BfpDeleteMappingData
0x1C0012B14: BfpValidateMappingExceptions
0x1C000B3B8: "__cdecl _imp_ExAllocatePoolWithTag" __imp_ExAllocatePoolWithTag
0x1C0011E2C: BfpCreatePathTree
0x1C00090E0: pfnWppQueryTraceInformation
0x1C000B218: "__cdecl _imp_PsFreeSiloContextSlot" __imp_PsFreeSiloContextSlot
0x1C000B464: "__cdecl _IMPORT_DESCRIPTOR_WppRecorder" __IMPORT_DESCRIPTOR_WppRecorder
0x1C0001570: BfInitializeMappingContext
0x1C0018434: BfGetFileNameInformation
0x1C000B3D8: "__cdecl _imp_EtwWriteTransfer" __imp_EtwWriteTransfer
0x1C000D8D8: BfGetSetStreamContext
0x1C000B090: "__cdecl _imp_FltFsControlFile" __imp_FltFsControlFile
0x1C00078F4: "" ??_C@_13BLAPAIAM@?$AA?$AI?$AA?$AA@
0x1C0012494: BfpCreatePathTierNode
0x1C000B188: FLTMGR_NULL_THUNK_DATA
0x1C000B2D8: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x1C0017110: BfPreQueryInfo
0x1C000B060: "__cdecl _imp_FltAcquireResourceExclusive" __imp_FltAcquireResourceExclusive
0x1C000B238: "__cdecl _imp_PsReferenceImpersonationToken" __imp_PsReferenceImpersonationToken
0x1C0004B28: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x1C000B0A8: "__cdecl _imp_FltPerformSynchronousIo" __imp_FltPerformSynchronousIo
0x1C0002CF0: BfpMappingDelete
0x1C0007B38: "PsGetVersion" ??_C@_1BK@DHLDGJM@?$AAP?$AAs?$AAG?$AAe?$AAt?$AAV?$AAe?$AAr?$AAs?$AAi?$AAo?$AAn?$AA?$AA@
0x1C001357C: BfpCleanupMappingEntry
0x1C000B418: "__cdecl _imp_ExpInterlockedPopEntrySList" __imp_ExpInterlockedPopEntrySList
0x1C0007A68: "normalized" ??_C@_0L@KOFHIIDF@normalized?$AA@
0x1C0001754: BfInitShadowFileHandleContext
0x1C00078E8: "NULL" ??_C@_19CIJIHAKK@?$AAN?$AAU?$AAL?$AAL?$AA?$AA@
0x1C0007660: FilterRegistration
0x1C00090C0: pfnEtwRegisterClassicProvider
0x1C000B108: "__cdecl _imp_FltGetDiskDeviceObject" __imp_FltGetDiskDeviceObject
0x1C000F54C: BfWalkMappingTree
0x1C0006124: SfoUpdateFileSizes
0x1C0019B1C: SfoMapShadowFileHandleToReal
0x1C000B3F8: "__cdecl _imp_PsGetSiloContext" __imp_PsGetSiloContext
0x1C000B3D0: "__cdecl _imp_IoGetSilo" __imp_IoGetSilo
0x1C000B178: "__cdecl _imp_FltGetInstanceContext" __imp_FltGetInstanceContext
0x1C001094C: BfMergeEnumerationResults
0x1C0019BC8: BfMapShadowFileObjectToReal
0x1C000B148: "__cdecl _imp_FltReleaseContext" __imp_FltReleaseContext
0x1C0007808: "onecore\base\fs\wci\bindflt\filt" ??_C@_0CN@CCFAHANJ@onecore?2base?2fs?2wci?2bindflt?2filt@
0x1C0007A90: "onecore\base\fs\wci\bindflt\filt" ??_C@_0CL@FIAMEPKL@onecore?2base?2fs?2wci?2bindflt?2filt@
0x1C0007924: "\" ??_C@_13FPGAJAPJ@?$AA?2?$AA?$AA@
0x1C0018E80: BfFltUnload
0x1C000FC90: BfGenerateDirectoryEntry
0x1C00090E8: pfnEtwUnregister
0x1C0019030: BfPreQuerySetQuota
0x1C0007898: PROV_BINDFLT
0x1C000B140: "__cdecl _imp_FltSetStreamHandleContext" __imp_FltSetStreamHandleContext
0x1C0009100: g_BindFltState
0x1C0001ECC: BfGetPreCreateFileName
0x1C000B020: "__cdecl _imp_FltBuildDefaultSecurityDescriptor" __imp_FltBuildDefaultSecurityDescriptor
0x1C000B2F0: "__cdecl _imp_RtlRbRemoveNode" __imp_RtlRbRemoveNode
0x1C0007838: "Name Not Available" ??_C@_1CG@MAKNKNKJ@?$AAN?$AAa?$AAm?$AAe?$AA?5?$AAN?$AAo?$AAt?$AA?5?$AAA?$AAv?$AAa?$AAi?$AAl?$AAa?$AAb?$AAl?$AAe?$AA?$AA@
0x1C000B330: "__cdecl _imp_RtlEqualUnicodeString" __imp_RtlEqualUnicodeString
0x1C000B318: "__cdecl _imp_ObIsKernelHandle" __imp_ObIsKernelHandle
0x1C0007A38: "onecore\base\fs\wci\bindflt\filt" ??_C@_0CN@PCDHACAC@onecore?2base?2fs?2wci?2bindflt?2filt@
0x1C0007928: WPP_e365321d5cd63f6243c93a216d7c70cc_Traceguids
0x1C00076E0: g_rootName
0x1C001A4A0: GsDriverEntry
0x1C000B068: "__cdecl _imp_FltAdjustDeviceStackSizeForIoRedirection" __imp_FltAdjustDeviceStackSizeForIoRedirection
0x1C000B440: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x1C0007800: "NULL" ??_C@_04HIBGFPH@NULL?$AA@
0x1C0001848: WPP_RECORDER_SF_sDZZZd
0x1C000349C: BfRemoveVirtualizationMapping
0x1C0019050: BfPreQueryVolumeInfo
0x1C0015BF0: BfpGeneratePreCreateNormalizedName
0x1C000B388: "__cdecl _imp_RtlAppendUnicodeToString" __imp_RtlAppendUnicodeToString
0x1C0017CC4: BfConvertContainerRootIdToShortNames
0x1C000B2F8: "__cdecl _imp_ObReferenceObjectByHandle" __imp_ObReferenceObjectByHandle
0x1C000B2E0: "__cdecl _imp_RtlRbReplaceNode" __imp_RtlRbReplaceNode
0x1C000B380: "__cdecl _imp_PsGetHostSilo" __imp_PsGetHostSilo
0x1C00078F8: "onecore\base\fs\wci\bindflt\filt" ??_C@_0CM@OLHABICC@onecore?2base?2fs?2wci?2bindflt?2filt@
0x1C00079E8: WPP_dc0c88d97f5f387c9669acda9cf7827a_Traceguids
0x1C0016AE0: BfNormalizeNameComponentExCallback
0x1C000D560: BfInstanceQueryTeardown
0x1C000DEBC: BfGetOrCreateSiloContext
0x1C000D1A0: BfInstanceSetup
0x1C000B3C0: "__cdecl _imp_PsCreateSiloContext" __imp_PsCreateSiloContext
0x1C00078B8: BindFltDriverEntryFailure
0x1C0007AC0: WPP_fe62b0e5fbcb37e38e582da070754b52_Traceguids
0x1C000B048: "__cdecl _imp_FltQueryDirectoryFile" __imp_FltQueryDirectoryFile
0x1C000D630: BfInstanceTeardownComplete
0x1C0007AD8: "onecore\base\fs\wci\bindflt\filt" ??_C@_0CN@MKKCLNEP@onecore?2base?2fs?2wci?2bindflt?2filt@
0x1C0001428: WPP_RECORDER_SF_sDlLD
0x1C0001008: McGenEventWrite
0x1C0009048: WPP_GLOBAL_Control
0x1C0019170: "__cdecl TlgEnableCallback" _TlgEnableCallback
0x1C000B1F8: "__cdecl _imp_PsRevertToSelf" __imp_PsRevertToSelf
0x1C000B070: "__cdecl _imp_FltIsIoRedirectionAllowed" __imp_FltIsIoRedirectionAllowed
0x1C0007C08: "onecore\base\fs\wci\bindflt\filt" ??_C@_0CP@EODGNHMG@onecore?2base?2fs?2wci?2bindflt?2filt@
0x1C0007878: WPP_0693fcf7d7df3e2d92bf131217c45aff_Traceguids
0x1C000B010: "__cdecl _imp_FltStartFiltering" __imp_FltStartFiltering
0x1C000B2A0: "__cdecl _imp_ExInitializePagedLookasideList" __imp_ExInitializePagedLookasideList
0x1C000B0D0: "__cdecl _imp_FltAllocateCallbackData" __imp_FltAllocateCallbackData
0x1C000B378: "__cdecl _imp_RtlCompareUnicodeString" __imp_RtlCompareUnicodeString
0x1C0004AC0: "__cdecl _security_check_cookie" __security_check_cookie
0x1C000B200: "__cdecl _imp_IoIsFileObjectIgnoringSharing" __imp_IoIsFileObjectIgnoringSharing
0x1C000B158: "__cdecl _imp_FltObjectDereference" __imp_FltObjectDereference
0x1C000B018: "__cdecl _imp_FltCreateCommunicationPort" __imp_FltCreateCommunicationPort
0x1C000B478: "__cdecl _IMPORT_DESCRIPTOR_FLTMGR" __IMPORT_DESCRIPTOR_FLTMGR
0x1C001369C: BfpMappingInsertExceptions
0x1C000B450: "__cdecl _IMPORT_DESCRIPTOR_ntoskrnl" __IMPORT_DESCRIPTOR_ntoskrnl
0x1C000E188: SfoInitFsContext2
0x1C000B050: "__cdecl _imp_FltCloseClientPort" __imp_FltCloseClientPort
0x1C0011618: BfFsctlSetLayerRoot
0x1C0002948: BfReferenceMappingDataWeak
0x1C0007D1E: "__cdecl TraceLoggingMetadataEnd" _TraceLoggingMetadataEnd
0x1C0018640: BfPrependVolumeDeviceName
0x1C0009000: PROV_BINDFLT_Context
0x1C00040CC: BfReplaceFirstSubstring
0x1C000B160: "__cdecl _imp_FltGetVolumeProperties" __imp_FltGetVolumeProperties
0x1C0015858: BfpGeneratePreCreateOpenedName
0x1C000B390: "__cdecl _imp_IoReplaceFileObjectName" __imp_IoReplaceFileObjectName
0x1C0007A28: WPP_7dd54aac5e7e333ef91e6028299bf20b_Traceguids
0x1C000B1B0: "__cdecl _imp_WppAutoLogStart" __imp_WppAutoLogStart
0x1C000B198: "__cdecl _imp_imp_WppRecorderLogDelete" __imp_imp_WppRecorderLogDelete
0x1C0002A84: BfpRemoveMapping
0x1C000DA88: BfGetSetHandleContext
0x1C000B350: "__cdecl _imp_RtlCompareUnicodeStrings" __imp_RtlCompareUnicodeStrings
0x1C0011F9C: BfpPathTreeEmpty
0x1C0007000: ContextRegistration
0x1C0011FC4: BfpCreateMappingData
0x1C000B2D0: "__cdecl _imp_ProbeForWrite" __imp_ProbeForWrite
0x1C0007B28: WPP_571ea8bd811c35ef83d3ea66ed78f76a_Traceguids
0x1C00190E0: BfCommonPreOp
0x1C000B310: "__cdecl _imp_PsJobType" __imp_PsJobType
0x1C000B1C0: "__cdecl _imp_WppAutoLogStop" __imp_WppAutoLogStop
0x1C0009280: "__cdecl BfTraceRecorder" _BfTraceRecorder
0x1C000B138: "__cdecl _imp_FltReferenceContext" __imp_FltReferenceContext
0x1C000F9A0: BfGetMappingList
0x1C000D630: BfInstanceTeardownStart
0x1C000B280: "__cdecl _imp_EtwUnregister" __imp_EtwUnregister
0x1C000B1D8: "__cdecl _imp_PsAllocSiloContextSlot" __imp_PsAllocSiloContextSlot
0x1C001B000: "__cdecl _guard_fids_table" __guard_fids_table
0x1C000B128: "__cdecl _imp_FltGetStreamContext" __imp_FltGetStreamContext
0x1C00076F0: "__cdecl load_config_used" _load_config_used
0x1C00185A4: BfAllocateUnicodeString
0x1C0010654: BfConvertWalkContextToDirectoryEnumeration
0x1C000B210: "__cdecl _imp_PsDereferencePrimaryToken" __imp_PsDereferencePrimaryToken
0x1C00079B8: "onecore\base\fs\wci\bindflt\filt" ??_C@_0CN@LDOLMGNK@onecore?2base?2fs?2wci?2bindflt?2filt@
0x1C0004720: BfPreClose
0x1C0016510: BfGenerateFileNameCallback
0x1C000451C: McGenEventUnregister
0x1C0010C60: BfGetSetDirectoryEnumerationHandleContext
0x1C000B288: "__cdecl _imp_ExAcquireRundownProtection" __imp_ExAcquireRundownProtection
0x1C00177B0: BfPostSetInfo
0x1C000D010: BfContextCleanup
0x1C00129E8: BfpDeletePathTierNode
0x1C0001814: BfInitializeSiloContext
0x1C00028E8: BfReleaseMappingData
0x1C000B260: "__cdecl _imp_PsDereferenceImpersonationToken" __imp_PsDereferenceImpersonationToken
0x1C000B248: "__cdecl _imp_SeLockSubjectContext" __imp_SeLockSubjectContext
0x1C000B220: IoFileObjectType
0x1C000B3A8: "__cdecl _imp_KeInitializeEvent" __imp_KeInitializeEvent
0x1C0007B78: "WmiQueryTraceInformation" ??_C@_1DC@DOCOAJH@?$AAW?$AAm?$AAi?$AAQ?$AAu?$AAe?$AAr?$AAy?$AAT?$AAr?$AAa?$AAc?$AAe?$AAI?$AAn?$AAf?$AAo?$AAr?$AAm?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x1C00079A8: WPP_3ec77d939bd0344b21688163eaf6a97f_Traceguids
0x1C0011EBC: BfpDeletePathTree
0x1C0007BE8: "EtwUnregister" ??_C@_1BM@CJMKDOJH@?$AAE?$AAt?$AAw?$AAU?$AAn?$AAr?$AAe?$AAg?$AAi?$AAs?$AAt?$AAe?$AAr?$AA?$AA@
0x1C0007870: Microsoft_Windows_Containers_BindFltLevels
0x1C000B370: "__cdecl _imp_FsRtlIsNameInExpression" __imp_FsRtlIsNameInExpression
0x1C000B0C8: "__cdecl _imp_FltFreeCallbackData" __imp_FltFreeCallbackData
0x1C000B268: "__cdecl _imp_ExDeleteNPagedLookasideList" __imp_ExDeleteNPagedLookasideList
0x1C000B290: "__cdecl _imp_FsRtlChangeBackingFileObject" __imp_FsRtlChangeBackingFileObject
0x1C0004B10: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x1C0018D34: BfCheckAndSwitchTarget
0x1C0003920: WPP_RECORDER_SF_sDZZd
0x1C00191F0: WppLoadTracingSupport
0x1C0004590: McTemplateK0d
0x1C000B1F0: "__cdecl _imp_IoWMIRegistrationControl" __imp_IoWMIRegistrationControl
0x1C0018490: BfRemoveFinalComponent
0x1C0002470: WPP_RECORDER_SF_sDZZ
0x1C0004550: McTemplateK0
0x1C000B1A8: "__cdecl _imp_imp_WppRecorderReplay" __imp_imp_WppRecorderReplay
0x1C00174E0: BfPreSetInfo
0x1C0019AB4: SfoUnlockAll
0x1C0007938: "onecore\base\fs\wci\bindflt\filt" ??_C@_0CN@CNGMCCOB@onecore?2base?2fs?2wci?2bindflt?2filt@
0x1C000B040: "__cdecl _imp_FltCheckAndGrowNameControl" __imp_FltCheckAndGrowNameControl
0x1C000B208: "__cdecl _imp_SeImpersonateClientEx" __imp_SeImpersonateClientEx
0x1C00079F8: "onecore\base\fs\wci\bindflt\filt" ??_C@_0CN@BKCKKCDP@onecore?2base?2fs?2wci?2bindflt?2filt@
0x1C00110D0: BfPreDirectoryControl
0x1C000B230: "__cdecl _imp_SeUnlockSubjectContext" __imp_SeUnlockSubjectContext
0x1C000B3E0: "__cdecl _imp_FsRtlTeardownPerStreamContexts" __imp_FsRtlTeardownPerStreamContexts
0x1C0009090: "__cdecl _security_cookie" __security_cookie
0x1C0003E04: BfGeneratePostCreateName
0x1C000F778: BfPopulateWalkContext
0x1C0001278: WPP_RECORDER_SF_sDD
0x1C0001278: WPP_RECORDER_SF_sDd
0x1C000236C: WPP_RECORDER_SF_sDL
0x1C0002970: BfReleaseMappingDataWeak
0x1C0001068: McTemplateK0dhzr1
0x1C000B2B8: "__cdecl _imp_ExReInitializeRundownProtection" __imp_ExReInitializeRundownProtection
0x1C0007B08: "\BindFltPort" ??_C@_1BK@GGAHDDGJ@?$AA?2?$AAB?$AAi?$AAn?$AAd?$AAF?$AAl?$AAt?$AAP?$AAo?$AAr?$AAt?$AA?$AA@
0x1C00010F0: WPP_RECORDER_SF_sD
0x1C00043D0: McGenControlCallbackV2
0x1C0007BB0: "EtwRegisterClassicProvider" ??_C@_1DG@PFOPAIND@?$AAE?$AAt?$AAw?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAe?$AAr?$AAC?$AAl?$AAa?$AAs?$AAs?$AAi?$AAc?$AAP?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AA?$AA@
0x1C0013D48: BfpMappingInsert
0x1C000B0B0: "__cdecl _imp_FltQueryInformationFile" __imp_FltQueryInformationFile
0x1C0002884: BfReferenceMappingData
0x1C000B2C8: "__cdecl _imp_ProbeForRead" __imp_ProbeForRead
0x1C000B180: "__cdecl _imp_FltGetEcpListFromCallbackData" __imp_FltGetEcpListFromCallbackData
0x1C0017860: RtlFindUnicodeSubstring
0x1C000B038: "__cdecl _imp_FltUnregisterFilter" __imp_FltUnregisterFilter
0x1C000B150: "__cdecl _imp_FltObjectReference" __imp_FltObjectReference
0x1C001A4D4: "__cdecl _security_init_cookie" __security_init_cookie
0x1C000B270: "__cdecl _imp_EtwRegister" __imp_EtwRegister
0x1C000B360: "__cdecl _imp_RtlUpcaseUnicodeString" __imp_RtlUpcaseUnicodeString
0x1C00090D8: WPPTraceSuite
0x1C0007968: WPP_e7e74324e1ec34fa5b181a3a181d748e_Traceguids
0x1C000B348: "__cdecl _imp_KeSetEvent" __imp_KeSetEvent
0x1C000B310: PsJobType
0x1C0004830: BfPreReleaseForSectionSynchronization
0x1C000D9B4: BfCleanupStreamContext
0x1C000165C: BfGetMappingContexts
0x1C00044DC: McGenEventRegister
0x1C00076D0: g_NoShortComponent
0x1C000F44C: BfEnumerateDirectory
0x1C000B0E8: "__cdecl _imp_FltGetVolumeFromInstance" __imp_FltGetVolumeFromInstance
0x1C0007978: "onecore\base\fs\wci\bindflt\filt" ??_C@_0CM@KPMOEBML@onecore?2base?2fs?2wci?2bindflt?2filt@
0x1C001820C: BfpWalkPath
0x1C000B1D0: "__cdecl _imp_ExReleaseRundownProtection" __imp_ExReleaseRundownProtection
0x1C000B118: "__cdecl _imp_FltSetStreamContext" __imp_FltSetStreamContext
0x1C000F700: BfFreeWalkContext
0x1C0004AF0: "__cdecl _report_gsfailure" __report_gsfailure
0x1C000B1B8: "__cdecl _imp_WppAutoLogTrace" __imp_WppAutoLogTrace
0x1C000B3E8: "__cdecl _imp_ExQueryDepthSList" __imp_ExQueryDepthSList
0x1C000B220: "__cdecl _imp_IoFileObjectType" __imp_IoFileObjectType
0x1C000B2B0: "__cdecl _imp_ZwSetInformationFile" __imp_ZwSetInformationFile
0x1C00155C0: BfPortDisconnect
0x1C000B398: "__cdecl _imp_ExInitializeResourceLite" __imp_ExInitializeResourceLite
0x1C00078C8: BindFltInstanceAttachFailure
0x1C0011DD8: BfpDeleteInstanceTierNode
0x1C000B438: ntoskrnl_NULL_THUNK_DATA
0x1C000B3B0: "__cdecl _imp_ExFreePoolWithTag" __imp_ExFreePoolWithTag
0x1C000B240: "__cdecl _imp_IoGetTransactionParameterBlock" __imp_IoGetTransactionParameterBlock
0x1C00029B0: BfpCanRemoveMapping
0x1C0018344: BfValidateContainerRootId
0x1C000B228: "__cdecl _imp_PsImpersonateClient" __imp_PsImpersonateClient
0x1C001A008: DriverEntry
0x1C0007A74: "opened" ??_C@_06NBOJMOCJ@opened?$AA@
0x1C001964C: BfTelemetryAndTracingCleanup
0x1C0011A00: BfPreFsControl
0x1C000B2C0: "__cdecl _imp_ExWaitForRundownProtectionRelease" __imp_ExWaitForRundownProtectionRelease
0x1C00090C8: pfnWppTraceMessage
0x1C0019584: WppInitKm
0x1C000B0F8: "__cdecl _imp_FltParseFileNameInformation" __imp_FltParseFileNameInformation
0x1C0016358: BfpGeneratePostCreateName
0x1C0004F40: memset
0x1C000B48C: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR

[JEB Decompiler by PNF Software]