Generated by JEB on 2019/08/01

PE: C:\Windows\System32\offlinesam.dll Base=0x180000000 SHA-256=E46FDBA9F1B734F07F093CCA7746867B55869A81B170A297C9406D4774FB92DA
PDB: offlinesam.pdb GUID={69D5F092-9803-4DFD-A349F0366A672B94} Age=1

938 located named symbols:
0x18001F6D8: "Groups\%08x" ??_C@_1BI@OKIHBLBL@?$AAG?$AAr?$AAo?$AAu?$AAp?$AAs?$AA?2?$AA?$CF?$AA0?$AA8?$AAx?$AA?$AA@
0x18000188C: "protected: long __cdecl SAMOfflineHandleRegistry::GetLargeIntArrayAttribute(unsigned long,union _LARGE_INTEGER * __ptr64 * __ptr64,unsigned long * __ptr64) __ptr64" ?GetLargeIntArrayAttribute@SAMOfflineHandleRegistry@@IEAAJKPEAPEAT_LARGE_INTEGER@@PEAK@Z
0x180020490: "\??\Volume" ??_C@_1BG@KPDPFBJH@?$AA?2?$AA?$DP?$AA?$DP?$AA?2?$AAV?$AAo?$AAl?$AAu?$AAm?$AAe?$AA?$AA@
0x1800160F0: "long __cdecl OpenOrCreateAliasDomainKey(class IOfflineKey * __ptr64,void * __ptr64,struct _UNICODE_STRING * __ptr64,class IOfflineKey * __ptr64 * __ptr64)" ?OpenOrCreateAliasDomainKey@@YAJPEAVIOfflineKey@@PEAXPEAU_UNICODE_STRING@@PEAPEAV1@@Z
0x18001E710: "__cdecl _imp_UnregisterTraceGuids" __imp_UnregisterTraceGuids
0x180024CB0: "struct _UNICODE_STRING SamOfflineBuiltinInternalDomainNameU" ?SamOfflineBuiltinInternalDomainNameU@@3U_UNICODE_STRING@@A
0x180020430: "\??\UNC\" ??_C@_1BC@MAMPPFNN@?$AA?2?$AA?$DP?$AA?$DP?$AA?2?$AAU?$AAN?$AAC?$AA?2?$AA?$AA@
0x18001FC90: WPP_7ec741de4d3134290d569784cfee0134_Traceguids
0x18001D53C: "__cdecl _raise_securityfailure" __raise_securityfailure
0x18000A0F4: "char * __ptr64 __cdecl SamOfflineMagicConstantFromDataType(enum _SAMP_ENCRYPTED_DATA_TYPE,unsigned long * __ptr64)" ?SamOfflineMagicConstantFromDataType@@YAPEADW4_SAMP_ENCRYPTED_DATA_TYPE@@PEAK@Z
0x18001E5C0: api-ms-win-core-file-l1-1-0_NULL_THUNK_DATA
0x18001E9F0: "__cdecl _imp_RtlAddAuditAccessAce" __imp_RtlAddAuditAccessAce
0x18001BAEC: RtlDecodeUtf16LE
0x18001A624: RtlAllocateLUnicodeString
0x18001E5E8: api-ms-win-core-heap-obsolete-l1-1-0_NULL_THUNK_DATA
0x18001D710: "__cdecl FindPESection" _FindPESection
0x180002B90: "void __cdecl SamOfflineFreeAttrBlock(struct _ATTRBLOCKSIMPLE * __ptr64)" ?SamOfflineFreeAttrBlock@@YAXPEAU_ATTRBLOCKSIMPLE@@@Z
0x18001FC00: "\Aliases\" ??_C@_1BE@CFPKMFFL@?$AA?2?$AAA?$AAl?$AAi?$AAa?$AAs?$AAe?$AAs?$AA?2?$AA?$AA@
0x1800014DC: "protected: long __cdecl SAMOfflineHandleRegistry::SetUnicodeStringAttribute(unsigned long,struct _RPC_UNICODE_STRING * __ptr64) __ptr64" ?SetUnicodeStringAttribute@SAMOfflineHandleRegistry@@IEAAJKPEAU_RPC_UNICODE_STRING@@@Z
0x18001FDD8: " *** Assertion failed: %s *** " ??_C@_0DM@NBFILLLK@?6?$CK?$CK?$CK?5Assertion?5failed?3?5?$CFs?6?$CK?$CK?$CK?5?5?5@
0x18001EA50: "__cdecl _imp_RtlFreeUnicodeString" __imp_RtlFreeUnicodeString
0x18002248C: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x1800154E8: WPP_SF_DDDDD
0x18001B2C0: RtlConvertWin32RegistryPathToNtRegistryPathWithSid
0x18000E0AC: "public: long __cdecl SAMOfflineAliasHandleRegistry::RemoveMember(void * __ptr64) __ptr64" ?RemoveMember@SAMOfflineAliasHandleRegistry@@QEAAJPEAX@Z
0x18001E020: "const SAMOfflineHandleRegistry::`vftable'" ??_7SAMOfflineHandleRegistry@@6B@
0x1800225B8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-kernel32-legacy-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-kernel32-legacy-l1-1-0
0x180002920: "public: virtual void * __ptr64 __cdecl SAMOfflineHandleRegistry::`scalar deleting destructor'(unsigned int) __ptr64" ??_GSAMOfflineHandleRegistry@@UEAAPEAXI@Z
0x1800209A8: "!@#$%^&*()qwertyUIOPAzxcvbnmQQQQ" ??_C@_0CP@PNPEJJMN@?$CB?$EA?$CD$?$CF?$FO?$CG?$CK?$CI?$CJqwertyUIOPAzxcvbnmQQQQ@
0x18001E628: "__cdecl _imp_VirtualProtect" __imp_VirtualProtect
0x180011F20: "public: __cdecl ImpersonateHelper::~ImpersonateHelper(void) __ptr64" ??1ImpersonateHelper@@QEAA@XZ
0x180002F00: "long __cdecl SamOfflineConvertGuidToAttrValBlock(struct _GUID * __ptr64,struct _ATTRVALBLOCK * __ptr64)" ?SamOfflineConvertGuidToAttrValBlock@@YAJPEAU_GUID@@PEAU_ATTRVALBLOCK@@@Z
0x180024370: "__cdecl _security_cookie_complement" __security_cookie_complement
0x18001E040: "const SAMOfflineDomainHandleRegistry::`vftable'" ??_7SAMOfflineDomainHandleRegistry@@6B@
0x18000C440: "public: virtual long __cdecl SAMOfflineUserHandleRegistry::RidToSid(unsigned long,void * __ptr64 * __ptr64) __ptr64" ?RidToSid@SAMOfflineUserHandleRegistry@@UEAAJKPEAPEAX@Z
0x18001F8E8: "SeBackupPrivilege" ??_C@_1CE@MBNFGOEN@?$AAS?$AAe?$AAB?$AAa?$AAc?$AAk?$AAu?$AAp?$AAP?$AAr?$AAi?$AAv?$AAi?$AAl?$AAe?$AAg?$AAe?$AA?$AA@
0x18001E400: g_LUNICODE_STRING_HKLM_bslash_
0x1800011C0: "public: __cdecl SAMOfflineHandleBase::SAMOfflineHandleBase(enum _SAMP_OBJECT_TYPE,class SAMOfflineHandleScope * __ptr64) __ptr64" ??0SAMOfflineHandleBase@@QEAA@W4_SAMP_OBJECT_TYPE@@PEAVSAMOfflineHandleScope@@@Z
0x18001FFF0: "BUCL::Rtl::ConvertInteger(Source" ??_C@_0EA@MDGBNKIL@BUCL?3?3Rtl?3?3ConvertInteger?$CISource@
0x180001BB0: "private: long __cdecl SAMOfflineHandleRegistry::FlushAttributes(unsigned long) __ptr64" ?FlushAttributes@SAMOfflineHandleRegistry@@AEAAJK@Z
0x18001F298: "msDS-ManagedPasswordPreviousId" ??_C@_1DO@MKICGDNO@?$AAm?$AAs?$AAD?$AAS?$AA?9?$AAM?$AAa?$AAn?$AAa?$AAg?$AAe?$AAd?$AAP?$AAa?$AAs?$AAs?$AAw?$AAo?$AAr?$AAd?$AAP?$AAr?$AAe?$AAv?$AAi?$AAo?$AAu?$AAs?$AAI?$AAd?$AA?$AA@
0x1800166AC: "long __cdecl UpdateAliasXReference(class IOfflineKey * __ptr64,unsigned long,void * __ptr64,struct _UNICODE_STRING * __ptr64)" ?UpdateAliasXReference@@YAJPEAVIOfflineKey@@KPEAXPEAU_UNICODE_STRING@@@Z
0x18001A730: RtlFreeLUnicodeString
0x18001EAC8: "__cdecl _imp_?LsaOfflineClose@@YAJPEAX@Z" __imp_?LsaOfflineClose@@YAJPEAX@Z
0x18001D01C: "__cdecl CRT_INIT" _CRT_INIT
0x180012BC0: "public: virtual long __cdecl CWin32OfflineKey::DeleteValue(struct _UNICODE_STRING * __ptr64) __ptr64" ?DeleteValue@CWin32OfflineKey@@UEAAJPEAU_UNICODE_STRING@@@Z
0x18001AF5C: "public: void __cdecl Windows::ErrorHandling::Rtl::CBaseFrame<class Windows::ErrorHandling::Rtl::CSimpleNtStatusCarryingFrame>::ReportErrorOrigination(struct Windows::ErrorHandling::_RTL_CALL_SITE const * __ptr64) __ptr64" ?ReportErrorOrigination@?$CBaseFrame@VCSimpleNtStatusCarryingFrame@Rtl@ErrorHandling@Windows@@@Rtl@ErrorHandling@Windows@@QEAAXPEBU_RTL_CALL_SITE@34@@Z
0x18001E640: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x1800204D0: "\DosDevices\UNC\" ??_C@_1CC@EIHGKOOD@?$AA?2?$AAD?$AAo?$AAs?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAs?$AA?2?$AAU?$AAN?$AAC?$AA?2?$AA?$AA@
0x18001E558: "__cdecl _imp_SystemFunction036" __imp_SystemFunction036
0x18000A764: "private: long __cdecl SAMOfflineDomainHandleRegistry::DecryptSecretDataWithRc4(struct _UNICODE_STRING * __ptr64,enum _SAMP_ENCRYPTED_DATA_TYPE,struct _UNICODE_STRING * __ptr64,unsigned long) __ptr64" ?DecryptSecretDataWithRc4@SAMOfflineDomainHandleRegistry@@AEAAJPEAU_UNICODE_STRING@@W4_SAMP_ENCRYPTED_DATA_TYPE@@0K@Z
0x1800208F0: g_RGWCH_HKEY_under_USERS_bslash_
0x1800224DC: "__cdecl _IMPORT_DESCRIPTOR_CRYPTBASE" __IMPORT_DESCRIPTOR_CRYPTBASE
0x180007E60: p_GetAlgHandle
0x18001E890: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x18000E29C: "public: long __cdecl SAMOfflineGroupHandleRegistry::AddMember(unsigned long) __ptr64" ?AddMember@SAMOfflineGroupHandleRegistry@@QEAAJK@Z
0x180015290: WppControlCallback
0x18001D9D0: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x180019E48: "public: void __cdecl SAMOfflineHandleScope::Release(void) __ptr64" ?Release@SAMOfflineHandleScope@@QEAAXXZ
0x18000277C: "protected: long __cdecl SAMOfflineHandleRegistry::MarshalUnicodeStringToOutput(struct _UNICODE_STRING * __ptr64,struct _UNICODE_STRING * __ptr64,unsigned __int64,unsigned char * __ptr64,unsigned __int64 * __ptr64,unsigned char * __ptr64 * __ptr64) __ptr64" ?MarshalUnicodeStringToOutput@SAMOfflineHandleRegistry@@IEAAJPEAU_UNICODE_STRING@@0_KPEAEPEA_KPEAPEAE@Z
0x18001FB28: WPP_2a120a57d8d1328112bd6979630cc88b_Traceguids
0x1800043AC: "public: static long __cdecl SAMOfflineServerHandleRegistry::CreateAndInitialize(unsigned short * __ptr64,class SAMOfflineServerHandleRegistry * __ptr64 * __ptr64)" ?CreateAndInitialize@SAMOfflineServerHandleRegistry@@SAJPEAGPEAPEAV1@@Z
0x180024CA0: "struct _UNICODE_STRING SamOfflineDomainNamePrefixU" ?SamOfflineDomainNamePrefixU@@3U_UNICODE_STRING@@A
0x18000B2E0: "private: long __cdecl SAMOfflineUserHandleRegistry::QueryFullName(struct _USER_FULL_NAME_INFORMATION * __ptr64 * __ptr64) __ptr64" ?QueryFullName@SAMOfflineUserHandleRegistry@@AEAAJPEAPEAU_USER_FULL_NAME_INFORMATION@@@Z
0x180024DA8: "struct _LIST_ENTRY gInstallerScopes" ?gInstallerScopes@@3U_LIST_ENTRY@@A
0x180007898: "public: long __cdecl SAMOfflineServerHandleRegistry::GetLsaOfflinePolicy(void * __ptr64 * __ptr64) __ptr64" ?GetLsaOfflinePolicy@SAMOfflineServerHandleRegistry@@QEAAJPEAPEAX@Z
0x180013740: "public: virtual long __cdecl CSilOfflineKey::DeleteRecursively(void) __ptr64" ?DeleteRecursively@CSilOfflineKey@@UEAAJXZ
0x18001FAB8: "Domains\Account" ??_C@_1CA@LMCMHPBH@?$AAD?$AAo?$AAm?$AAa?$AAi?$AAn?$AAs?$AA?2?$AAA?$AAc?$AAc?$AAo?$AAu?$AAn?$AAt?$AA?$AA@
0x1800178A8: "long __cdecl CreateUser(class IOfflineKey * __ptr64,enum _NT_PRODUCT_TYPE,struct _SAMP_PROTECTION * __ptr64 const,struct _UNICODE_STRING * __ptr64,struct _UNICODE_STRING * __ptr64,struct _UNICODE_STRING * __ptr64,unsigned char,unsigned long,unsigned long,unsigned char,unsigned long,unsigned long,unsigned char)" ?CreateUser@@YAJPEAVIOfflineKey@@W4_NT_PRODUCT_TYPE@@QEAU_SAMP_PROTECTION@@PEAU_UNICODE_STRING@@33EKKEKKE@Z
0x18000B9A4: "private: long __cdecl SAMOfflineUserHandleRegistry::SetPassword(struct _USER_SET_PASSWORD_INFORMATION * __ptr64) __ptr64" ?SetPassword@SAMOfflineUserHandleRegistry@@AEAAJPEAU_USER_SET_PASSWORD_INFORMATION@@@Z
0x18001EE18: WPP_ThisDir_CTLGUID_OFFLINESAM
0x180001B34: "protected: long __cdecl SAMOfflineHandleRegistry::SetFixedAttributes(void * __ptr64) __ptr64" ?SetFixedAttributes@SAMOfflineHandleRegistry@@IEAAJPEAX@Z
0x18001A49C: "private: long __cdecl SamOfflineDBOptions::Initialize(class IOfflineKey * __ptr64) __ptr64" ?Initialize@SamOfflineDBOptions@@AEAAJPEAVIOfflineKey@@@Z
0x18000F530: "long __cdecl SamOfflineConnectExternal(unsigned short * __ptr64,unsigned short * __ptr64,unsigned short * __ptr64,unsigned short * __ptr64,void * __ptr64 * __ptr64)" ?SamOfflineConnectExternal@@YAJPEAG000PEAPEAX@Z
0x18001FDD0: "" ??_C@_00CNPNBAHC@?$AA@
0x1800203D0: "RtlConvertWin32RegistryPathToNtR" ??_C@_0DD@LJOBJCFF@RtlConvertWin32RegistryPathToNtR@
0x180024E20: g_ulAdditionalProbeSize
0x18001E800: "__cdecl _imp_BCryptDestroyKey" __imp_BCryptDestroyKey
0x18001FB68: "Users\Names" ??_C@_1BI@IBLMLAOJ@?$AAU?$AAs?$AAe?$AAr?$AAs?$AA?2?$AAN?$AAa?$AAm?$AAe?$AAs?$AA?$AA@
0x180003E0C: WPP_SF_S_sid_
0x180024BE8: "struct _LIST_ENTRY gWin32Keys" ?gWin32Keys@@3U_LIST_ENTRY@@A
0x18001F890: WPP_97778f18f9333ddfff3ad4c3871dcdc8_Traceguids
0x18002252C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-1-0
0x18001E810: bcrypt_NULL_THUNK_DATA
0x180022504: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-eventing-classicprovider-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-eventing-classicprovider-l1-1-0
0x18001CA5C: KEDecryptKeyWithAES
0x18001E9D8: "__cdecl _imp_RtlCreateSecurityDescriptor" __imp_RtlCreateSecurityDescriptor
0x18001F1F8: "InternetSID" ??_C@_1BI@JFOMFAGD@?$AAI?$AAn?$AAt?$AAe?$AAr?$AAn?$AAe?$AAt?$AAS?$AAI?$AAD?$AA?$AA@
0x18000BE70: "public: long __cdecl SAMOfflineUserHandleRegistry::SetInformationUser(enum _USER_INFORMATION_CLASS,void * __ptr64) __ptr64" ?SetInformationUser@SAMOfflineUserHandleRegistry@@QEAAJW4_USER_INFORMATION_CLASS@@PEAX@Z
0x18001EAC0: "__cdecl _imp_?LsaOfflineOpenPolicyForInstaller@@YAJPEAUIRtlSystemIsolationLayer@Rtl@Windows@@PEAPEAX@Z" __imp_?LsaOfflineOpenPolicyForInstaller@@YAJPEAUIRtlSystemIsolationLayer@Rtl@Windows@@PEAPEAX@Z
0x18001E9A8: "__cdecl _imp_NtSetInformationThread" __imp_NtSetInformationThread
0x180014C88: "long __cdecl SamOfflineUnicodeStringToString(struct _UNICODE_STRING * __ptr64,unsigned short * __ptr64 * __ptr64)" ?SamOfflineUnicodeStringToString@@YAJPEAU_UNICODE_STRING@@PEAPEAG@Z
0x18001FC38: "\Groups\" ??_C@_1BC@CCCOPPOH@?$AA?2?$AAG?$AAr?$AAo?$AAu?$AAp?$AAs?$AA?2?$AA?$AA@
0x180013E90: "public: static long __cdecl IOfflineKey::CreateAndInitializeForSIL(struct Windows::Rtl::IRtlKey * __ptr64,class IOfflineKey * __ptr64 * __ptr64)" ?CreateAndInitializeForSIL@IOfflineKey@@SAJPEAUIRtlKey@Rtl@Windows@@PEAPEAV1@@Z
0x1800036C4: "private: long __cdecl SAMOfflineHandleRegistry::RegWriteExtendedAttributes(void) __ptr64" ?RegWriteExtendedAttributes@SAMOfflineHandleRegistry@@AEAAJXZ
0x18001ED48: "SampGroupObjectType" ??_C@_1CI@FHPBCNDO@?$AAS?$AAa?$AAm?$AAp?$AAG?$AAr?$AAo?$AAu?$AAp?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x18000C440: "public: virtual long __cdecl SAMOfflineGroupHandleRegistry::RidToSid(unsigned long,void * __ptr64 * __ptr64) __ptr64" ?RidToSid@SAMOfflineGroupHandleRegistry@@UEAAJKPEAPEAX@Z
0x18001ED70: "SampAliasObjectType" ??_C@_1CI@CACDIPC@?$AAS?$AAa?$AAm?$AAp?$AAA?$AAl?$AAi?$AAa?$AAs?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x18001F268: "msDS-ManagedPasswordId" ??_C@_1CO@MDNENCHL@?$AAm?$AAs?$AAD?$AAS?$AA?9?$AAM?$AAa?$AAn?$AAa?$AAg?$AAe?$AAd?$AAP?$AAa?$AAs?$AAs?$AAw?$AAo?$AAr?$AAd?$AAI?$AAd?$AA?$AA@
0x18001E780: "__cdecl _imp_CryptReleaseContext" __imp_CryptReleaseContext
0x180024DB8: "struct _LIST_ENTRY gDirectScopes" ?gDirectScopes@@3U_LIST_ENTRY@@A
0x18001EAB8: "__cdecl _imp_?LsaOfflineOpenPolicy@@YAJPEAGPEAPEAX@Z" __imp_?LsaOfflineOpenPolicy@@YAJPEAGPEAPEAX@Z
0x18001E328: g_LUNICODE_STRING_HKEY_under_CURRENT_under_USER_bslash_
0x18001EB00: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x18001F910: "SeRestorePrivilege" ??_C@_1CG@LMBBLCJG@?$AAS?$AAe?$AAR?$AAe?$AAs?$AAt?$AAo?$AAr?$AAe?$AAP?$AAr?$AAi?$AAv?$AAi?$AAl?$AAe?$AAg?$AAe?$AA?$AA@
0x180024CF0: "struct _UNICODE_STRING SamOfflineFullAccountInternalDomainNameU" ?SamOfflineFullAccountInternalDomainNameU@@3U_UNICODE_STRING@@A
0x18001EDC0: "SampUnknownObjectType" ??_C@_1CM@IMPLPECP@?$AAS?$AAa?$AAm?$AAp?$AAU?$AAn?$AAk?$AAn?$AAo?$AAw?$AAn?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x18001EEB8: WPP_a909d2d891b035650d8563dc84e99c3f_Traceguids
0x18001E970: "__cdecl _imp_RtlGetOwnerSecurityDescriptor" __imp_RtlGetOwnerSecurityDescriptor
0x180010440: "long __cdecl SamOfflineEnumerateAliasesInDomain(void * __ptr64,unsigned long * __ptr64,void * __ptr64 * __ptr64,unsigned long,unsigned long * __ptr64)" ?SamOfflineEnumerateAliasesInDomain@@YAJPEAXPEAKPEAPEAXK1@Z
0x18001F498: "\REGISTRY\MACHINE\SYSTEM" ??_C@_1DC@GKOJGBFO@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?$AA@
0x18001F368: "Account" ??_C@_1BA@CONNFOCD@?$AAA?$AAc?$AAc?$AAo?$AAu?$AAn?$AAt?$AA?$AA@
0x180010580: "long __cdecl SamOfflineEnumerateUsersInDomain2(void * __ptr64,unsigned long * __ptr64,unsigned long,void * __ptr64 * __ptr64,unsigned long,unsigned long * __ptr64)" ?SamOfflineEnumerateUsersInDomain2@@YAJPEAXPEAKKPEAPEAXK1@Z
0x18001A764: RtlDuplicateUnicodeStringToLUnicodeString
0x180024DD8: KerbGlobalStrToKeyProvider
0x1800207C0: g_RGWCH_HKCC_bslash_
0x180024C88: "void * __ptr64 __ptr64 SamOfflineAnonymousSid" ?SamOfflineAnonymousSid@@3PEAXEA
0x180020218: "::RtlIsLUnicodeStringValid(Desti" ??_C@_0CI@IKOLADAO@?3?3RtlIsLUnicodeStringValid?$CIDesti@
0x18000B3B0: "private: long __cdecl SAMOfflineUserHandleRegistry::QueryAdminComment(struct _USER_ADMIN_COMMENT_INFORMATION * __ptr64 * __ptr64) __ptr64" ?QueryAdminComment@SAMOfflineUserHandleRegistry@@AEAAJPEAPEAU_USER_ADMIN_COMMENT_INFORMATION@@@Z
0x18001D6F7: "__cdecl XcptFilter" _XcptFilter
0x18001EB08: "__cdecl _xc_a" __xc_a
0x180006838: "private: long __cdecl SAMOfflineServerHandleRegistry::GenerateRandomHiveMountKeyPath(unsigned short * __ptr64,unsigned short * __ptr64 * __ptr64) __ptr64" ?GenerateRandomHiveMountKeyPath@SAMOfflineServerHandleRegistry@@AEAAJPEAGPEAPEAG@Z
0x18001FB80: "Groups\Names" ??_C@_1BK@PHEBCOBE@?$AAG?$AAr?$AAo?$AAu?$AAp?$AAs?$AA?2?$AAN?$AAa?$AAm?$AAe?$AAs?$AA?$AA@
0x18001F3B8: "\SAM" ??_C@_19MJIOFMED@?$AA?2?$AAS?$AAA?$AAM?$AA?$AA@
0x180020450: "\??\HardDisk" ??_C@_1BK@PLLAELKC@?$AA?2?$AA?$DP?$AA?$DP?$AA?2?$AAH?$AAa?$AAr?$AAd?$AAD?$AAi?$AAs?$AAk?$AA?$AA@
0x18001686C: "long __cdecl PrepDomain(class IOfflineKey * __ptr64,int,int,void * __ptr64,enum _NT_PRODUCT_TYPE,struct _SAMP_PROTECTION * __ptr64 const,enum _DOMAIN_SERVER_ROLE,int)" ?PrepDomain@@YAJPEAVIOfflineKey@@HHPEAXW4_NT_PRODUCT_TYPE@@QEAU_SAMP_PROTECTION@@W4_DOMAIN_SERVER_ROLE@@H@Z
0x180024D38: "struct _UNICODE_STRING SamOfflineAccountInternalDomainNameU" ?SamOfflineAccountInternalDomainNameU@@3U_UNICODE_STRING@@A
0x18001AF4C: "public: void __cdecl Windows::ErrorHandling::Rtl::CBaseFrame<class Windows::ErrorHandling::Rtl::CSimpleNtStatusCarryingFrame>::SetInvalidParameter(void) __ptr64" ?SetInvalidParameter@?$CBaseFrame@VCSimpleNtStatusCarryingFrame@Rtl@ErrorHandling@Windows@@@Rtl@ErrorHandling@Windows@@QEAAXXZ
0x180019D9C: "long __cdecl SamOfflineGetMessageStrings(void * __ptr64,unsigned long,unsigned long,struct _UNICODE_STRING * __ptr64,unsigned long,struct _UNICODE_STRING * __ptr64)" ?SamOfflineGetMessageStrings@@YAJPEAXKKPEAU_UNICODE_STRING@@K1@Z
0x180002920: "public: virtual void * __ptr64 __cdecl SAMOfflineHandleRegistry::`vector deleting destructor'(unsigned int) __ptr64" ??_ESAMOfflineHandleRegistry@@UEAAPEAXI@Z
0x18001E7D0: "__cdecl _imp_BCryptCreateHash" __imp_BCryptCreateHash
0x18001E7A0: "__cdecl _imp_ConvertStringSidToSidW" __imp_ConvertStringSidToSidW
0x180003078: "private: long __cdecl SAMOfflineHandleRegistry::PlaceAttrBlockOntoExtendedAttributes(struct _ATTRBLOCKSIMPLE * __ptr64,struct _ATTRBLOCKSIMPLE * __ptr64) __ptr64" ?PlaceAttrBlockOntoExtendedAttributes@SAMOfflineHandleRegistry@@AEAAJPEAU_ATTRBLOCKSIMPLE@@0@Z
0x180014E9C: "long __cdecl SamOfflineInitializeGlobals(void)" ?SamOfflineInitializeGlobals@@YAJXZ
0x18001E938: "__cdecl _imp_RtlAppendUnicodeStringToString" __imp_RtlAppendUnicodeStringToString
0x18001F798: "AES" ??_C@_17PJMHNJHG@?$AAA?$AAE?$AAS?$AA?$AA@
0x180013FA0: "long __cdecl SamOfflineInitializeWellKnownSids(void)" ?SamOfflineInitializeWellKnownSids@@YAJXZ
0x180011F7C: WPP_SF_ZDD
0x180002F28: "long __cdecl SamOfflineConvertAttrValToByteArray(struct _ATTRVAL * __ptr64,struct _SAM_BYTE_ARRAY * __ptr64)" ?SamOfflineConvertAttrValToByteArray@@YAJPEAU_ATTRVAL@@PEAU_SAM_BYTE_ARRAY@@@Z
0x180024C58: "void * __ptr64 __ptr64 SamOfflineWorldSid" ?SamOfflineWorldSid@@3PEAXEA
0x18001F7B8: "ChainingModeCBC" ??_C@_1CA@NDPDKCGP@?$AAC?$AAh?$AAa?$AAi?$AAn?$AAi?$AAn?$AAg?$AAM?$AAo?$AAd?$AAe?$AAC?$AAB?$AAC?$AA?$AA@
0x18001E950: "__cdecl _imp_NtSetValueKey" __imp_NtSetValueKey
0x18001F5D0: "ServerNt" ??_C@_1BC@GNJGMHML@?$AAS?$AAe?$AAr?$AAv?$AAe?$AAr?$AAN?$AAt?$AA?$AA@
0x180002A34: "public: long __cdecl Windows::Rtl::IRtlObject::CreateRequiredInterface<struct Windows::Rtl::IRtlSystemCreator>(class Windows::Auto<struct Windows::Rtl::IRtlSystemCreator * __ptr64> * __ptr64) __ptr64" ??$CreateRequiredInterface@UIRtlSystemCreator@Rtl@Windows@@@IRtlObject@Rtl@Windows@@QEAAJPEAV?$Auto@PEAUIRtlSystemCreator@Rtl@Windows@@@2@@Z
0x18001E778: "__cdecl _imp_CryptHashData" __imp_CryptHashData
0x18001FC18: "\Groups\Names\" ??_C@_1BO@FCAPIMPH@?$AA?2?$AAG?$AAr?$AAo?$AAu?$AAp?$AAs?$AA?2?$AAN?$AAa?$AAm?$AAe?$AAs?$AA?2?$AA?$AA@
0x180024DC8: ?g_pfnRtlErrorReportFunction@?A0x98913741@@3P6AXPEBU_RTL_CALL_SITE@ErrorHandling@Windows@@AEBU_GUID@@K@ZEA
0x18001F8B0: WPP_5dd05677692d3102c6d172aba65b2ab9_Traceguids
0x18000295C: "public: virtual __cdecl SAMOfflineHandleRegistry::~SAMOfflineHandleRegistry(void) __ptr64" ??1SAMOfflineHandleRegistry@@UEAA@XZ
0x180020518: "\SystemRoot" ??_C@_1BI@OMNCDEIM@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAo?$AAo?$AAt?$AA?$AA@
0x180024D30: "void * __ptr64 __ptr64 SamOfflineNetworkServiceSid" ?SamOfflineNetworkServiceSid@@3PEAXEA
0x18001EA90: "__cdecl _imp_NtFlushKey" __imp_NtFlushKey
0x18001F670: "LCID" ??_C@_19DMACBGH@?$AAL?$AAC?$AAI?$AAD?$AA?$AA@
0x18001D9A2: memcpy
0x18001E030: "const SAMOfflineServerHandleRegistry::`vftable'" ??_7SAMOfflineServerHandleRegistry@@6B@
0x180024C18: "void * __ptr64 __ptr64 SamOfflineBuiltinDomainSid" ?SamOfflineBuiltinDomainSid@@3PEAXEA
0x18001E7C0: "__cdecl _imp_BCryptDecrypt" __imp_BCryptDecrypt
0x18001E610: "__cdecl _imp_LoadLibraryExW" __imp_LoadLibraryExW
0x18001EA58: "__cdecl _imp_RtlConvertSidToUnicodeString" __imp_RtlConvertSidToUnicodeString
0x1800201F0: "RtlAppendLUnicodeStringToLUnicod" ??_C@_0CI@JKPPDGNE@RtlAppendLUnicodeStringToLUnicod@
0x180010260: "long __cdecl SamOfflineRemoveMemberFromAlias(void * __ptr64,void * __ptr64)" ?SamOfflineRemoveMemberFromAlias@@YAJPEAX0@Z
0x180004024: WPP_SF__sid__sid_
0x180007D04: "long __cdecl RtlUnicodeStringCat(struct _UNICODE_STRING * __ptr64,struct _UNICODE_STRING const * __ptr64)" ?RtlUnicodeStringCat@@YAJPEAU_UNICODE_STRING@@PEBU1@@Z
0x18001E310: g_LUNICODE_STRING__empty_
0x18001E878: "__cdecl _imp_memset" __imp_memset
0x18001E9E0: "__cdecl _imp_RtlSetGroupSecurityDescriptor" __imp_RtlSetGroupSecurityDescriptor
0x18001F5A8: "WinNt" ??_C@_1M@PFFFELPH@?$AAW?$AAi?$AAn?$AAN?$AAt?$AA?$AA@
0x18001D8CF: "__cdecl initterm" _initterm
0x18001E718: "__cdecl _imp_TraceMessage" __imp_TraceMessage
0x180024A78: "struct _UNICODE_STRING SampNameDomainGroups" ?SampNameDomainGroups@@3U_UNICODE_STRING@@A
0x180022630: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0
0x180024E00: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x18001EE08: WPP_58f7771271053369ffacf452aa8a6e0b_Traceguids
0x180013D20: "public: virtual long __cdecl CSilOfflineKey::QueryClass(unsigned short * __ptr64 * __ptr64) __ptr64" ?QueryClass@CSilOfflineKey@@UEAAJPEAPEAG@Z
0x180020720: g_RGWCH_HKCR_bslash_
0x18001E6C8: "__cdecl _imp_Sleep" __imp_Sleep
0x180013930: "public: virtual long __cdecl CSilOfflineKey::SetValue(struct _UNICODE_STRING * __ptr64,unsigned long,void * __ptr64,unsigned long) __ptr64" ?SetValue@CSilOfflineKey@@UEAAJPEAU_UNICODE_STRING@@KPEAXK@Z
0x18001BBC4: "__cdecl resetstkoflw_static" _resetstkoflw_static
0x18001EA60: "__cdecl _imp_RtlSubAuthoritySid" __imp_RtlSubAuthoritySid
0x18001EB28: "__cdecl _xi_z" __xi_z
0x180024C20: "struct _UNICODE_STRING SamOfflineNullString" ?SamOfflineNullString@@3U_UNICODE_STRING@@A
0x1800202C8: "RtlConvertWin32RegistryPathToNtR" ??_C@_0DA@OBOIHGMC@RtlConvertWin32RegistryPathToNtR@
0x18001E598: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x180013EF4: "void __cdecl AddKeyToList(struct _LIST_ENTRY * __ptr64,struct _LIST_ENTRY * __ptr64)" ?AddKeyToList@@YAXPEAU_LIST_ENTRY@@0@Z
0x180024D20: "void * __ptr64 __ptr64 SamOfflineAuthenticatedUsersSid" ?SamOfflineAuthenticatedUsersSid@@3PEAXEA
0x18001EFB8: "UserPasswordHint" ??_C@_1CC@PJLEDLDE@?$AAU?$AAs?$AAe?$AAr?$AAP?$AAa?$AAs?$AAs?$AAw?$AAo?$AAr?$AAd?$AAH?$AAi?$AAn?$AAt?$AA?$AA@
0x18001E9C0: "__cdecl _imp_NtOpenProcessToken" __imp_NtOpenProcessToken
0x1800207D0: g_RGWCH_HKEY_under_CLASSES_under_ROOT_bslash_
0x18001E9F8: "__cdecl _imp_RtlAbsoluteToSelfRelativeSD" __imp_RtlAbsoluteToSelfRelativeSD
0x18000D7D8: "private: long __cdecl SAMOfflineAliasHandleRegistry::RetrieveAliasMembers(unsigned long * __ptr64,void * __ptr64 * __ptr64 * __ptr64) __ptr64" ?RetrieveAliasMembers@SAMOfflineAliasHandleRegistry@@AEAAJPEAKPEAPEAPEAX@Z
0x18001D8DB: "__cdecl _C_specific_handler" __C_specific_handler
0x18001F680: "Type" ??_C@_19BIEPDBPA@?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x180013D30: "public: virtual void __cdecl CSilOfflineKey::Release(void) __ptr64" ?Release@CSilOfflineKey@@UEAAXXZ
0x18001E5F0: "__cdecl _imp_WTSGetActiveConsoleSessionId" __imp_WTSGetActiveConsoleSessionId
0x18001E6B8: "__cdecl _imp_ReleaseSRWLockExclusive" __imp_ReleaseSRWLockExclusive
0x18000F268: WPP_SF_q_sid_
0x180014950: "long __cdecl SamOfflineCopyUnicodeString(struct _UNICODE_STRING * __ptr64,unsigned short * __ptr64)" ?SamOfflineCopyUnicodeString@@YAJPEAU_UNICODE_STRING@@PEAG@Z
0x18001FF60: "RtlInitUnicodeStringFromLUnicode" ??_C@_0CH@OBJMEFGP@RtlInitUnicodeStringFromLUnicode@
0x1800082B0: "private: long __cdecl SAMOfflineDomainHandleRegistry::LookupName(struct _UNICODE_STRING * __ptr64,unsigned long * __ptr64,enum _SID_NAME_USE * __ptr64) __ptr64" ?LookupName@SAMOfflineDomainHandleRegistry@@AEAAJPEAU_UNICODE_STRING@@PEAKPEAW4_SID_NAME_USE@@@Z
0x180024C90: "struct _UNICODE_STRING SamOfflineFullBuiltinInternalDomainNameU" ?SamOfflineFullBuiltinInternalDomainNameU@@3U_UNICODE_STRING@@A
0x18001F8A0: WPP_01ee91fbc50134a8a3f58b47490a0e10_Traceguids
0x18001D9AE: memmove
0x18001EA98: "__cdecl _imp_RtlDosPathNameToRelativeNtPathName_U_WithStatus" __imp_RtlDosPathNameToRelativeNtPathName_U_WithStatus
0x1800090C0: "public: long __cdecl SAMOfflineDomainHandleRegistry::GetDomainSID(void * __ptr64 * __ptr64) __ptr64" ?GetDomainSID@SAMOfflineDomainHandleRegistry@@QEAAJPEAPEAX@Z
0x180024D50: WPP_REGISTRATION_GUIDS
0x180020444: "\\" ??_C@_15LEKKCGMK@?$AA?2?$AA?2?$AA?$AA@
0x18001E920: "__cdecl _imp_RtlLengthRequiredSid" __imp_RtlLengthRequiredSid
0x18001EAE8: "__cdecl _imp_?LsaOfflineOpenPolicyExternal@@YAJPEAG000PEAPEAX@Z" __imp_?LsaOfflineOpenPolicyExternal@@YAJPEAG000PEAPEAX@Z
0x180024BF8: "struct _LIST_ENTRY gSilKeys" ?gSilKeys@@3U_LIST_ENTRY@@A
0x18001E928: "__cdecl _imp_RtlCopyUnicodeString" __imp_RtlCopyUnicodeString
0x18001E9E8: "__cdecl _imp_RtlCreateAcl" __imp_RtlCreateAcl
0x1800209D8: "MD4" ??_C@_17MDMFNACG@?$AAM?$AAD?$AA4?$AA?$AA@
0x18001E5D0: api-ms-win-core-handle-l1-1-0_NULL_THUNK_DATA
0x18001F608: "Personal" ??_C@_1BC@EANCBBIH@?$AAP?$AAe?$AAr?$AAs?$AAo?$AAn?$AAa?$AAl?$AA?$AA@
0x180010EAC: "public: static long __cdecl SystemToken::GetToken(class SystemToken * __ptr64 * __ptr64)" ?GetToken@SystemToken@@SAJPEAPEAV1@@Z
0x18001E560: "__cdecl _imp_SystemFunction001" __imp_SystemFunction001
0x18001E568: "__cdecl _imp_SystemFunction003" __imp_SystemFunction003
0x18000B480: "private: long __cdecl SAMOfflineUserHandleRegistry::QueryExtendedInfo(struct _USER_EXTENDED_INFORMATION * __ptr64 * __ptr64) __ptr64" ?QueryExtendedInfo@SAMOfflineUserHandleRegistry@@AEAAJPEAPEAU_USER_EXTENDED_INFORMATION@@@Z
0x180014AE0: "void __cdecl SamOfflineSecureFreeUnicodeString(struct _UNICODE_STRING * __ptr64)" ?SamOfflineSecureFreeUnicodeString@@YAXPEAU_UNICODE_STRING@@@Z
0x1800148C0: "long __cdecl SamOfflineValidateNewAccountName(struct _UNICODE_STRING * __ptr64,enum _SAMP_OBJECT_TYPE)" ?SamOfflineValidateNewAccountName@@YAJPEAU_UNICODE_STRING@@W4_SAMP_OBJECT_TYPE@@@Z
0x180011C94: "private: __cdecl SystemToken::SystemToken(void * __ptr64) __ptr64" ??0SystemToken@@AEAA@PEAX@Z
0x18001E9A0: "__cdecl _imp_NtQueryInformationToken" __imp_NtQueryInformationToken
0x1800205E0: "::RtlIsLBlobValid(Blob)" ??_C@_0BI@HCBMPJOG@?3?3RtlIsLBlobValid?$CIBlob?$CJ?$AA@
0x18001D92C: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x18000D368: "private: long __cdecl SAMOfflineAliasHandleRegistry::AddAccountToAlias(void * __ptr64) __ptr64" ?AddAccountToAlias@SAMOfflineAliasHandleRegistry@@AEAAJPEAX@Z
0x18000DDCC: "private: long __cdecl SAMOfflineAliasHandleRegistry::DeleteAliasKeys(void) __ptr64" ?DeleteAliasKeys@SAMOfflineAliasHandleRegistry@@AEAAJXZ
0x180020370: "RtlFormatCurrentUserKeyPath(User" ??_C@_0EB@GEAFLEF@RtlFormatCurrentUserKeyPath?$CIUser@
0x180004264: "private: long __cdecl SAMOfflineServerHandleRegistry::CommonInitialize(void) __ptr64" ?CommonInitialize@SAMOfflineServerHandleRegistry@@AEAAJXZ
0x18001AE1C: RtlReallocateLUnicodeString
0x1800204A8: "\\?\Volume" ??_C@_1BG@CPJCOMEA@?$AA?2?$AA?2?$AA?$DP?$AA?2?$AAV?$AAo?$AAl?$AAu?$AAm?$AAe?$AA?$AA@
0x180024D88: "struct _RTL_SRWLOCK gHndlScopeLock" ?gHndlScopeLock@@3U_RTL_SRWLOCK@@A
0x180024D58: "struct HINSTANCE__ * __ptr64 __ptr64 SamOfflineThisModule" ?SamOfflineThisModule@@3PEAUHINSTANCE__@@EA
0x180024BD0: "struct _UNICODE_STRING SampVariableAttributeName" ?SampVariableAttributeName@@3U_UNICODE_STRING@@A
0x180005794: "private: long __cdecl SAMOfflineServerHandleRegistry::GetTargetSamsrvPath(unsigned short * __ptr64 * __ptr64) __ptr64" ?GetTargetSamsrvPath@SAMOfflineServerHandleRegistry@@AEAAJPEAPEAG@Z
0x18001F808: WPP_bc4fb2b2c69c36d0e8e7e002b11c1014_Traceguids
0x18001ED18: "SampDomainObjectType" ??_C@_1CK@LGHMBMBP@?$AAS?$AAa?$AAm?$AAp?$AAD?$AAo?$AAm?$AAa?$AAi?$AAn?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x18001E8C8: "__cdecl _imp_RtlAllocateHeap" __imp_RtlAllocateHeap
0x180011870: "private: static long __cdecl SystemToken::GetTokenForProcess(unsigned long,void * __ptr64 * __ptr64)" ?GetTokenForProcess@SystemToken@@CAJKPEAPEAX@Z
0x18001BB88: RtlUpcaseUCSCharacter
0x18001FAF8: "Domains" ??_C@_1BA@DPEKONGI@?$AAD?$AAo?$AAm?$AAa?$AAi?$AAn?$AAs?$AA?$AA@
0x18001E6A0: api-ms-win-core-string-l1-1-0_NULL_THUNK_DATA
0x180024D60: WPP_MAIN_CB
0x180001A54: "private: void __cdecl SAMOfflineHandleRegistry::InvalidateCachesInScopeAfterFlush(void) __ptr64" ?InvalidateCachesInScopeAfterFlush@SAMOfflineHandleRegistry@@AEAAXXZ
0x1800136E0: "public: virtual long __cdecl CSilOfflineKey::Delete(void) __ptr64" ?Delete@CSilOfflineKey@@UEAAJXZ
0x180020910: g_RGWCH_HKCU_bslash_
0x180022518: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0
0x180014BC4: "long __cdecl SamOfflineAppendString(unsigned short * __ptr64,unsigned short * __ptr64,unsigned short * __ptr64 * __ptr64)" ?SamOfflineAppendString@@YAJPEAG0PEAPEAG@Z
0x18001D703: "__cdecl amsg_exit" _amsg_exit
0x180012440: "public: virtual long __cdecl CWin32OfflineKey::DeleteKey(struct _UNICODE_STRING * __ptr64) __ptr64" ?DeleteKey@CWin32OfflineKey@@UEAAJPEAU_UNICODE_STRING@@@Z
0x18001F358: "BuiltIn" ??_C@_1BA@HBMCEMIC@?$AAB?$AAu?$AAi?$AAl?$AAt?$AAI?$AAn?$AA?$AA@
0x180001404: "protected: long __cdecl SAMOfflineHandleRegistry::GetUnicodeStringAttribute(unsigned long,struct _RPC_UNICODE_STRING * __ptr64) __ptr64" ?GetUnicodeStringAttribute@SAMOfflineHandleRegistry@@IEAAJKPEAU_RPC_UNICODE_STRING@@@Z
0x18000F450: "long __cdecl SamOfflineConnectForInstaller(struct Windows::Rtl::IRtlSystemIsolationLayer * __ptr64,void * __ptr64 * __ptr64)" ?SamOfflineConnectForInstaller@@YAJPEAUIRtlSystemIsolationLayer@Rtl@Windows@@PEAPEAX@Z
0x18001EF00: "PerComponentWellKnownAccountAppl" ??_C@_1FG@FFDFFGJ@?$AAP?$AAe?$AAr?$AAC?$AAo?$AAm?$AAp?$AAo?$AAn?$AAe?$AAn?$AAt?$AAW?$AAe?$AAl?$AAl?$AAK?$AAn?$AAo?$AAw?$AAn?$AAA?$AAc?$AAc?$AAo?$AAu?$AAn?$AAt?$AAA?$AAp?$AAp?$AAl@
0x18001F620: "ControlSet001\Control\MUI\UILang" ??_C@_1EM@HCFODIIG@?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA0?$AA0?$AA1?$AA?2?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AA?2?$AAM?$AAU?$AAI?$AA?2?$AAU?$AAI?$AAL?$AAa?$AAn?$AAg@
0x18001EE98: "\SystemRoot\" ??_C@_1BK@DHFJHPDK@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAo?$AAo?$AAt?$AA?2?$AA?$AA@
0x18001AF4C: "public: void __cdecl Windows::ErrorHandling::Rtl::CBaseFrame<class Windows::ErrorHandling::Rtl::CSimpleNtStatusCarryingFrame>::SetInvalidParameter_NullPointer(void) __ptr64" ?SetInvalidParameter_NullPointer@?$CBaseFrame@VCSimpleNtStatusCarryingFrame@Rtl@ErrorHandling@Windows@@@Rtl@ErrorHandling@Windows@@QEAAXXZ
0x180020470: "\\?\HardDisk" ??_C@_1BK@HLKEOGEF@?$AA?2?$AA?2?$AA?$DP?$AA?2?$AAH?$AAa?$AAr?$AAd?$AAD?$AAi?$AAs?$AAk?$AA?$AA@
0x180006990: "private: long __cdecl SAMOfflineServerHandleRegistry::QueryTargetProductInfo(enum _NT_PRODUCT_TYPE * __ptr64,enum _DOMAIN_SERVER_ROLE * __ptr64,int * __ptr64,unsigned long * __ptr64) __ptr64" ?QueryTargetProductInfo@SAMOfflineServerHandleRegistry@@AEAAJPEAW4_NT_PRODUCT_TYPE@@PEAW4_DOMAIN_SERVER_ROLE@@PEAHPEAK@Z
0x18001F5B8: "LanmanNt" ??_C@_1BC@HCEJBDJB@?$AAL?$AAa?$AAn?$AAm?$AAa?$AAn?$AAN?$AAt?$AA?$AA@
0x1800224B4: "__cdecl _IMPORT_DESCRIPTOR_bcrypt" __IMPORT_DESCRIPTOR_bcrypt
0x1800142F4: "long __cdecl SamOfflineSplitSid(void * __ptr64,void * __ptr64 * __ptr64,unsigned long * __ptr64)" ?SamOfflineSplitSid@@YAJPEAXPEAPEAXPEAK@Z
0x1800204C0: "\??\" ??_C@_19JHEHLFPM@?$AA?2?$AA?$DP?$AA?$DP?$AA?2?$AA?$AA@
0x18001EAE0: "__cdecl _imp_?LsaOfflineSyskeyRequest@@YAJPEAXKQEAE@Z" __imp_?LsaOfflineSyskeyRequest@@YAJPEAXKQEAE@Z
0x180024D0C: "unsigned long gulDirectScopeCount" ?gulDirectScopeCount@@3KA
0x180002B24: "void __cdecl SamOfflineFreeAttrValBlock(struct _ATTRVALBLOCK * __ptr64)" ?SamOfflineFreeAttrValBlock@@YAXPEAU_ATTRVALBLOCK@@@Z
0x18000A45C: "private: long __cdecl SAMOfflineDomainHandleRegistry::DecryptSecretDataWithAes(struct _UNICODE_STRING * __ptr64,enum _SAMP_ENCRYPTED_DATA_TYPE,struct _UNICODE_STRING * __ptr64,unsigned long) __ptr64" ?DecryptSecretDataWithAes@SAMOfflineDomainHandleRegistry@@AEAAJPEAU_UNICODE_STRING@@W4_SAMP_ENCRYPTED_DATA_TYPE@@0K@Z
0x18001F1B0: "InternetProviderGUID" ??_C@_1CK@GJCMDHBP@?$AAI?$AAn?$AAt?$AAe?$AAr?$AAn?$AAe?$AAt?$AAP?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AAG?$AAU?$AAI?$AAD?$AA?$AA@
0x18001BE18: VerifyStackAvailable
0x180020588: "onecore\base\lstring\lblob.cpp" ??_C@_0BP@OEPJOLFM@onecore?2base?2lstring?2lblob?4cpp?$AA@
0x18001E758: "__cdecl _imp_CryptAcquireContextA" __imp_CryptAcquireContextA
0x18001E900: "__cdecl _imp_RtlFindMessage" __imp_RtlFindMessage
0x18001FD60: "ControlSet001\Control\LSA\Offlin" ??_C@_1FO@OOEBJABN@?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA0?$AA0?$AA1?$AA?2?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AA?2?$AAL?$AAS?$AAA?$AA?2?$AAO?$AAf?$AAf?$AAl?$AAi?$AAn@
0x18001E940: "__cdecl _imp_NtAdjustPrivilegesToken" __imp_NtAdjustPrivilegesToken
0x18000E210: "private: virtual void * __ptr64 __cdecl SAMOfflineAliasHandleRegistry::`scalar deleting destructor'(unsigned int) __ptr64" ??_GSAMOfflineAliasHandleRegistry@@EEAAPEAXI@Z
0x18001FB38: "\Aliases" ??_C@_1BC@LOLPCCJA@?$AA?2?$AAA?$AAl?$AAi?$AAa?$AAs?$AAe?$AAs?$AA?$AA@
0x180002E70: "long __cdecl SamOfflineConvertUnicodeStringToAttrValBlock(struct _UNICODE_STRING * __ptr64,struct _ATTRVALBLOCK * __ptr64)" ?SamOfflineConvertUnicodeStringToAttrValBlock@@YAJPEAU_UNICODE_STRING@@PEAU_ATTRVALBLOCK@@@Z
0x18001E6F8: "__cdecl _imp_GetTraceLoggerHandle" __imp_GetTraceLoggerHandle
0x18000B210: "private: long __cdecl SAMOfflineUserHandleRegistry::QueryAccountName(struct _USER_ACCOUNT_NAME_INFORMATION * __ptr64 * __ptr64) __ptr64" ?QueryAccountName@SAMOfflineUserHandleRegistry@@AEAAJPEAPEAU_USER_ACCOUNT_NAME_INFORMATION@@@Z
0x18001E3D0: g_LUNICODE_STRING__bslash_Registry_bslash_User_bslash_
0x18000AA88: "private: __cdecl SAMOfflineDomainHandleRegistry::SAMOfflineDomainHandleRegistry(class SystemToken * __ptr64,class SAMOfflineHandleScope * __ptr64) __ptr64" ??0SAMOfflineDomainHandleRegistry@@AEAA@PEAVSystemToken@@PEAVSAMOfflineHandleScope@@@Z
0x18001E5B0: api-ms-win-core-errorhandling-l1-1-0_NULL_THUNK_DATA
0x18001E720: "__cdecl _imp_GetTraceEnableLevel" __imp_GetTraceEnableLevel
0x18001E5F8: api-ms-win-core-kernel32-legacy-l1-1-0_NULL_THUNK_DATA
0x18000A15C: "private: long __cdecl SAMOfflineDomainHandleRegistry::EncryptSecretDataWithAes(struct _UNICODE_STRING * __ptr64,unsigned short,enum _SAMP_ENCRYPTED_DATA_TYPE,struct _UNICODE_STRING * __ptr64,unsigned long) __ptr64" ?EncryptSecretDataWithAes@SAMOfflineDomainHandleRegistry@@AEAAJPEAU_UNICODE_STRING@@GW4_SAMP_ENCRYPTED_DATA_TYPE@@0K@Z
0x1800121B0: "public: virtual long __cdecl CWin32OfflineKey::CreateNewKeyEx(struct _UNICODE_STRING * __ptr64,unsigned long,void * __ptr64,struct _UNICODE_STRING * __ptr64,class IOfflineKey * __ptr64 * __ptr64) __ptr64" ?CreateNewKeyEx@CWin32OfflineKey@@UEAAJPEAU_UNICODE_STRING@@KPEAX0PEAPEAVIOfflineKey@@@Z
0x180024A48: "struct _UNICODE_STRING SampNameDomainAliases" ?SampNameDomainAliases@@3U_UNICODE_STRING@@A
0x18001E960: "__cdecl _imp_NtDeleteValueKey" __imp_NtDeleteValueKey
0x1800200C8: "Valid flags check failed: Flags" ??_C@_0CA@HINKLGMI@Valid?5flags?5check?5failed?3?5Flags?$AA@
0x18001E698: "__cdecl _imp_CompareStringEx" __imp_CompareStringEx
0x18001F968: WPP_56b3a0cd21923c4cb7634b6cdfba85cc_Traceguids
0x18001F6F0: "Aliases\%08x" ??_C@_1BK@BDJOBADK@?$AAA?$AAl?$AAi?$AAa?$AAs?$AAe?$AAs?$AA?2?$AA?$CF?$AA0?$AA8?$AAx?$AA?$AA@
0x18001F7A0: "BlockLength" ??_C@_1BI@JJDKEEML@?$AAB?$AAl?$AAo?$AAc?$AAk?$AAL?$AAe?$AAn?$AAg?$AAt?$AAh?$AA?$AA@
0x18001E6D8: "__cdecl _imp_GetSystemInfo" __imp_GetSystemInfo
0x18001E650: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x18001AEEC: RtlIsUnicodeStringValid
0x18001BE40: KEGetKEEncKey
0x180006B50: "private: long __cdecl SAMOfflineServerHandleRegistry::QueryTargetProductInfoHelper(class IOfflineKey * __ptr64,enum _NT_PRODUCT_TYPE * __ptr64) __ptr64" ?QueryTargetProductInfoHelper@SAMOfflineServerHandleRegistry@@AEAAJPEAVIOfflineKey@@PEAW4_NT_PRODUCT_TYPE@@@Z
0x18001F748: "NTPASSWORD" ??_C@_0L@BNJCHLNB@NTPASSWORD?$AA@
0x18000CBA0: "public: static long __cdecl SAMOfflineAliasHandleRegistry::BuildAliasMembersKeyName(void * __ptr64,struct _UNICODE_STRING * __ptr64,struct _UNICODE_STRING * __ptr64)" ?BuildAliasMembersKeyName@SAMOfflineAliasHandleRegistry@@SAJPEAXPEAU_UNICODE_STRING@@1@Z
0x18001A878: RtlInitUnicodeStringFromLUnicodeString
0x180018DF0: "void * __ptr64 __cdecl BuildAccountSid(void * __ptr64,unsigned long)" ?BuildAccountSid@@YAPEAXPEAXK@Z
0x180024A68: "struct _UNICODE_STRING SampNameDomainUsersNames" ?SampNameDomainUsersNames@@3U_UNICODE_STRING@@A
0x18001F210: "InternetProviderAttributes" ??_C@_1DG@KPKAMGJ@?$AAI?$AAn?$AAt?$AAe?$AAr?$AAn?$AAe?$AAt?$AAP?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AAA?$AAt?$AAt?$AAr?$AAi?$AAb?$AAu?$AAt?$AAe?$AAs?$AA?$AA@
0x180024A00: g_hRc4Provider
0x180002800: "protected: long __cdecl SAMOfflineHandleRegistry::MarshalByteArrayToOutput(struct _SAM_BYTE_ARRAY * __ptr64,struct _SAM_BYTE_ARRAY * __ptr64,unsigned __int64,unsigned char * __ptr64,unsigned __int64 * __ptr64,unsigned char * __ptr64 * __ptr64) __ptr64" ?MarshalByteArrayToOutput@SAMOfflineHandleRegistry@@IEAAJPEAU_SAM_BYTE_ARRAY@@0_KPEAEPEA_KPEAPEAE@Z
0x180024DF0: "__cdecl _native_startup_lock" __native_startup_lock
0x180008478: "public: long __cdecl SAMOfflineDomainHandleRegistry::LookupNames(unsigned long,struct _UNICODE_STRING * __ptr64,unsigned long * __ptr64 * __ptr64,enum _SID_NAME_USE * __ptr64 * __ptr64) __ptr64" ?LookupNames@SAMOfflineDomainHandleRegistry@@QEAAJKPEAU_UNICODE_STRING@@PEAPEAKPEAPEAW4_SID_NAME_USE@@@Z
0x18001E7C8: "__cdecl _imp_BCryptHashData" __imp_BCryptHashData
0x18001E8B8: "__cdecl _imp_RtlUpcaseUnicodeChar" __imp_RtlUpcaseUnicodeChar
0x18001536C: DllMain
0x18001F378: "" ??_C@_13BLAPAIAM@?$AA?$AI?$AA?$AA@
0x18001FCC0: "ShouldDisableAdminByDefault" ??_C@_1DI@HLPMAPNN@?$AAS?$AAh?$AAo?$AAu?$AAl?$AAd?$AAD?$AAi?$AAs?$AAa?$AAb?$AAl?$AAe?$AAA?$AAd?$AAm?$AAi?$AAn?$AAB?$AAy?$AAD?$AAe?$AAf?$AAa?$AAu?$AAl?$AAt?$AA?$AA@
0x18001AD94: RtlEqualLUnicodeStringPrefix
0x18001FDC0: WPP_3826c5083b28344635c11307eb0f89f1_Traceguids
0x18000F690: "long __cdecl SamOfflineEnumerateDomainsInSamServer(void * __ptr64,unsigned long * __ptr64,void * __ptr64 * __ptr64,unsigned long,unsigned long * __ptr64)" ?SamOfflineEnumerateDomainsInSamServer@@YAJPEAXPEAKPEAPEAXK1@Z
0x18001F2D8: "ForcePasswordReset" ??_C@_1CG@DOBNEHHH@?$AAF?$AAo?$AAr?$AAc?$AAe?$AAP?$AAa?$AAs?$AAs?$AAw?$AAo?$AAr?$AAd?$AAR?$AAe?$AAs?$AAe?$AAt?$AA?$AA@
0x180024C38: "union _LARGE_INTEGER SamOfflineWillNeverTime" ?SamOfflineWillNeverTime@@3T_LARGE_INTEGER@@A
0x1800204F8: "\DosDevices\" ??_C@_1BK@LABJKOM@?$AA?2?$AAD?$AAo?$AAs?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAs?$AA?2?$AA?$AA@
0x18001EE2C: "V" ??_C@_13DANNHAJN@?$AAV?$AA?$AA@
0x1800200E8: "Not-null check failed: String" ??_C@_0BO@DPPPJCDC@Not?9null?5check?5failed?3?5String?$AA@
0x18001E618: api-ms-win-core-libraryloader-l1-1-0_NULL_THUNK_DATA
0x18001EA48: "__cdecl _imp_RtlSubAuthorityCountSid" __imp_RtlSubAuthorityCountSid
0x180022540: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-string-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-string-l1-1-0
0x18001E820: "__cdecl _imp__wcsicmp" __imp__wcsicmp
0x18001E730: "__cdecl _imp_IsValidSid" __imp_IsValidSid
0x180024A58: "struct _UNICODE_STRING SampNameDomainAliasesMembers" ?SampNameDomainAliasesMembers@@3U_UNICODE_STRING@@A
0x18001E848: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x18000DF84: "private: long __cdecl SAMOfflineAliasHandleRegistry::RemoveAccountFromAlias(void * __ptr64) __ptr64" ?RemoveAccountFromAlias@SAMOfflineAliasHandleRegistry@@AEAAJPEAX@Z
0x1800087F0: "public: long __cdecl SAMOfflineDomainHandleRegistry::OpenGroup(unsigned long,class SAMOfflineGroupHandleRegistry * __ptr64 * __ptr64) __ptr64" ?OpenGroup@SAMOfflineDomainHandleRegistry@@QEAAJKPEAPEAVSAMOfflineGroupHandleRegistry@@@Z
0x18001E8F8: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x1800143C4: "long __cdecl SamOfflineExamineSid(class SAMOfflineServerHandleRegistry * __ptr64,void * __ptr64,unsigned char,unsigned char * __ptr64,unsigned char * __ptr64,unsigned char * __ptr64,unsigned char * __ptr64,unsigned char * __ptr64)" ?SamOfflineExamineSid@@YAJPEAVSAMOfflineServerHandleRegistry@@PEAXEPEAE2222@Z
0x18001F710: "Users\%08x" ??_C@_1BG@IBBOOOCP@?$AAU?$AAs?$AAe?$AAr?$AAs?$AA?2?$AA?$CF?$AA0?$AA8?$AAx?$AA?$AA@
0x18001F3F8: "\system32\config" ??_C@_1CC@MJEBKIFK@?$AA?2?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAc?$AAo?$AAn?$AAf?$AAi?$AAg?$AA?$AA@
0x18001A258: "private: long __cdecl SamOfflineDBOptions::QueryUlongOptions(class IOfflineKey * __ptr64) __ptr64" ?QueryUlongOptions@SamOfflineDBOptions@@AEAAJPEAVIOfflineKey@@@Z
0x18001FAD8: "Domains\Builtin" ??_C@_1CA@OEJPGIIA@?$AAD?$AAo?$AAm?$AAa?$AAi?$AAn?$AAs?$AA?2?$AAB?$AAu?$AAi?$AAl?$AAt?$AAi?$AAn?$AA?$AA@
0x18001F880: "ACCOUNT" ??_C@_1BA@OKDNDGIN@?$AAA?$AAC?$AAC?$AAO?$AAU?$AAN?$AAT?$AA?$AA@
0x1800225F4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-1-0
0x180013150: "public: virtual void __cdecl CWin32OfflineKey::AddRef(void) __ptr64" ?AddRef@CWin32OfflineKey@@UEAAXXZ
0x1800052E0: "public: long __cdecl SAMOfflineServerHandleRegistry::LookupDomain(struct _UNICODE_STRING * __ptr64,void * __ptr64 * __ptr64) __ptr64" ?LookupDomain@SAMOfflineServerHandleRegistry@@QEAAJPEAU_UNICODE_STRING@@PEAPEAX@Z
0x18001FB50: "\Members\" ??_C@_1BE@NGIECGPJ@?$AA?2?$AAM?$AAe?$AAm?$AAb?$AAe?$AAr?$AAs?$AA?2?$AA?$AA@
0x18001E5A0: "__cdecl _imp_GetLastError" __imp_GetLastError
0x18000A9AC: "public: long __cdecl SAMOfflineDomainHandleRegistry::DecryptSecretData(struct _UNICODE_STRING * __ptr64,enum _SAMP_ENCRYPTED_DATA_TYPE,struct _UNICODE_STRING * __ptr64,unsigned long) __ptr64" ?DecryptSecretData@SAMOfflineDomainHandleRegistry@@QEAAJPEAU_UNICODE_STRING@@W4_SAMP_ENCRYPTED_DATA_TYPE@@0K@Z
0x18001F4F8: "OFFLINESAM" ??_C@_1BG@PFIJKMDL@?$AAO?$AAF?$AAF?$AAL?$AAI?$AAN?$AAE?$AAS?$AAA?$AAM?$AA?$AA@
0x18001E770: "__cdecl _imp_CryptDestroyHash" __imp_CryptDestroyHash
0x180011EBC: "public: __cdecl ImpersonateHelper::ImpersonateHelper(class SystemToken * __ptr64) __ptr64" ??0ImpersonateHelper@@QEAA@PEAVSystemToken@@@Z
0x180024360: "__cdecl _native_dllmain_reason" __native_dllmain_reason
0x18001D908: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x18001EA30: "__cdecl _imp_RtlSetOwnerSecurityDescriptor" __imp_RtlSetOwnerSecurityDescriptor
0x180014590: "long __cdecl SamOfflineCheckSidType(void * __ptr64,unsigned char,unsigned long,void * __ptr64 * __ptr64,unsigned char * __ptr64,unsigned char * __ptr64,unsigned char * __ptr64,unsigned char * __ptr64,unsigned char * __ptr64)" ?SamOfflineCheckSidType@@YAJPEAXEKPEAPEAXPEAE2222@Z
0x1800061B4: "private: long __cdecl SAMOfflineServerHandleRegistry::MountSystemHive(void) __ptr64" ?MountSystemHive@SAMOfflineServerHandleRegistry@@AEAAJXZ
0x180024A38: "struct _UNICODE_STRING SampNameDomains" ?SampNameDomains@@3U_UNICODE_STRING@@A
0x18001E060: "const SAMOfflineAliasHandleRegistry::`vftable'" ??_7SAMOfflineAliasHandleRegistry@@6B@
0x18001C0C8: KEEncryptDataWithAES
0x18001E860: "__cdecl _imp_memcmp" __imp_memcmp
0x18001EFA0: "UserTile" ??_C@_1BC@NCAENBFL@?$AAU?$AAs?$AAe?$AAr?$AAT?$AAi?$AAl?$AAe?$AA?$AA@
0x18001EA00: "__cdecl _imp_RtlAddAccessAllowedAce" __imp_RtlAddAccessAllowedAce
0x180003960: "long __cdecl RtlStringCchPrintfW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64,...)" ?RtlStringCchPrintfW@@YAJPEAG_KPEBGZZ
0x18001FC50: "\Users\Names\" ??_C@_1BM@JHMCIJFI@?$AA?2?$AAU?$AAs?$AAe?$AAr?$AAs?$AA?2?$AAN?$AAa?$AAm?$AAe?$AAs?$AA?2?$AA?$AA@
0x180005A68: "private: long __cdecl SAMOfflineServerHandleRegistry::MountSamHive(unsigned short * __ptr64) __ptr64" ?MountSamHive@SAMOfflineServerHandleRegistry@@AEAAJPEAG@Z
0x180020280: "__rv.UcsCharacter != (0xffffffff" ??_C@_0CC@ILNCJCBD@__rv?4UcsCharacter?5?$CB?$DN?5?$CI0xffffffff@
0x18001E648: "__cdecl _imp_SetThreadStackGuarantee" __imp_SetThreadStackGuarantee
0x18001F100: "FailedInterLogonCountAtLastSucce" ??_C@_1FG@MGDNEMPA@?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AAI?$AAn?$AAt?$AAe?$AAr?$AAL?$AAo?$AAg?$AAo?$AAn?$AAC?$AAo?$AAu?$AAn?$AAt?$AAA?$AAt?$AAL?$AAa?$AAs?$AAt?$AAS?$AAu?$AAc?$AAc?$AAe@
0x18000DAB4: "private: long __cdecl SAMOfflineAliasHandleRegistry::RemoveAliasFromAccountMembership(void * __ptr64) __ptr64" ?RemoveAliasFromAccountMembership@SAMOfflineAliasHandleRegistry@@AEAAJPEAX@Z
0x18000EA08: "private: long __cdecl SAMOfflineDomainDescriptors::BuildSAMSecurityDescriptor(void * __ptr64,void * __ptr64,void * __ptr64,unsigned long,void * __ptr64 * __ptr64 const,unsigned long * __ptr64 const,struct _GENERIC_MAPPING * __ptr64,unsigned char,enum _NT_PRODUCT_TYPE,struct SAMOfflineDomainDescriptors::_NEW_OBJECT_DESCRIPTOR * __ptr64) __ptr64" ?BuildSAMSecurityDescriptor@SAMOfflineDomainDescriptors@@AEAAJPEAX00KQEAPEAXQEAKPEAU_GENERIC_MAPPING@@EW4_NT_PRODUCT_TYPE@@PEAU_NEW_OBJECT_DESCRIPTOR@1@@Z
0x180006468: "private: long __cdecl SAMOfflineServerHandleRegistry::GetSystemHiveRootKey(class IOfflineKey * __ptr64 * __ptr64) __ptr64" ?GetSystemHiveRootKey@SAMOfflineServerHandleRegistry@@AEAAJPEAPEAVIOfflineKey@@@Z
0x18001E7E8: "__cdecl _imp_BCryptCloseAlgorithmProvider" __imp_BCryptCloseAlgorithmProvider
0x180002380: "private: long __cdecl SAMOfflineHandleRegistry::ReadRegistryValue(unsigned char * __ptr64,unsigned long,struct _UNICODE_STRING * __ptr64,unsigned long * __ptr64) __ptr64" ?ReadRegistryValue@SAMOfflineHandleRegistry@@AEAAJPEAEKPEAU_UNICODE_STRING@@PEAK@Z
0x180002118: "public: static long __cdecl SAMOfflineHandleRegistry::Initialize(void)" ?Initialize@SAMOfflineHandleRegistry@@SAJXZ
0x18001F010: "UserShellAdminObjectProperties" ??_C@_1DO@HHJACJA@?$AAU?$AAs?$AAe?$AAr?$AAS?$AAh?$AAe?$AAl?$AAl?$AAA?$AAd?$AAm?$AAi?$AAn?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAP?$AAr?$AAo?$AAp?$AAe?$AAr?$AAt?$AAi?$AAe?$AAs?$AA?$AA@
0x18001ECD8: "NULL" ??_C@_19CIJIHAKK@?$AAN?$AAU?$AAL?$AAL?$AA?$AA@
0x18001E668: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x180024340: "struct _SAMP_EXTENDED_ATTRIBUTE_PROPERTY * AliasExtendedAttributeProperties" ?AliasExtendedAttributeProperties@@3PAU_SAMP_EXTENDED_ATTRIBUTE_PROPERTY@@A
0x1800225E0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-lsalookup-l2-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-lsalookup-l2-1-0
0x180020318: "Not-null check failed: PathOut" ??_C@_0BP@NEMHNDIC@Not?9null?5check?5failed?3?5PathOut?$AA@
0x1800224F0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-obsolete-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-obsolete-l1-1-0
0x18001E8C0: "__cdecl _imp_RtlReAllocateHeap" __imp_RtlReAllocateHeap
0x18000379C: "private: long __cdecl SAMOfflineHandleRegistry::FlushExtendedAttributes(void) __ptr64" ?FlushExtendedAttributes@SAMOfflineHandleRegistry@@AEAAJXZ
0x18001A5B0: RtlReportErrorOrigination
0x18001D7C0: "__cdecl ValidateImageBase" _ValidateImageBase
0x18000D4E0: "private: long __cdecl SAMOfflineAliasHandleRegistry::ValidateNewAliasMember(void * __ptr64) __ptr64" ?ValidateNewAliasMember@SAMOfflineAliasHandleRegistry@@AEAAJPEAX@Z
0x180004744: "public: static long __cdecl SAMOfflineServerHandleRegistry::CreateAndInitializeForInstaller(struct Windows::Rtl::IRtlSystemIsolationLayer * __ptr64,class SAMOfflineServerHandleRegistry * __ptr64 * __ptr64)" ?CreateAndInitializeForInstaller@SAMOfflineServerHandleRegistry@@SAJPEAUIRtlSystemIsolationLayer@Rtl@Windows@@PEAPEAV1@@Z
0x180003F88: WPP_SF_ZD
0x180010CB0: "long __cdecl SamOfflineCloseHandle(void * __ptr64)" ?SamOfflineCloseHandle@@YAJPEAX@Z
0x1800023EC: "protected: long __cdecl SAMOfflineHandleRegistry::VirtualRegistryPathToAbsolutePhysical(unsigned short * __ptr64,unsigned short * __ptr64 * __ptr64) __ptr64" ?VirtualRegistryPathToAbsolutePhysical@SAMOfflineHandleRegistry@@IEAAJPEAGPEAPEAG@Z
0x180010B10: "long __cdecl SamOfflineDeleteUser(void * __ptr64)" ?SamOfflineDeleteUser@@YAJPEAX@Z
0x18001EA10: "__cdecl _imp_RtlGetAce" __imp_RtlGetAce
0x18001EAD8: "__cdecl _imp_?LsaOfflineFreeMemory@@YAJPEAX@Z" __imp_?LsaOfflineFreeMemory@@YAJPEAX@Z
0x18001EA80: "__cdecl _imp_RtlFreeHeap" __imp_RtlFreeHeap
0x180020560: "\\?\HarddiskVolume" ??_C@_1CG@CPGMNPIJ@?$AA?2?$AA?2?$AA?$DP?$AA?2?$AAH?$AAa?$AAr?$AAd?$AAd?$AAi?$AAs?$AAk?$AAV?$AAo?$AAl?$AAu?$AAm?$AAe?$AA?$AA@
0x18001E748: "__cdecl _imp_DuplicateTokenEx" __imp_DuplicateTokenEx
0x18001F840: "Aliases\Members\%s\%08x" ??_C@_1DA@PINLFCOA@?$AAA?$AAl?$AAi?$AAa?$AAs?$AAe?$AAs?$AA?2?$AAM?$AAe?$AAm?$AAb?$AAe?$AAr?$AAs?$AA?2?$AA?$CF?$AAs?$AA?2?$AA?$CF?$AA0?$AA8?$AAx?$AA?$AA@
0x18001ED98: "SampUserObjectType" ??_C@_1CG@NEGDJFOP@?$AAS?$AAa?$AAm?$AAp?$AAU?$AAs?$AAe?$AAr?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x180002AD0: "long __cdecl SamOfflineInitAttrValBlock(struct _ATTRVALBLOCK * __ptr64,unsigned long)" ?SamOfflineInitAttrValBlock@@YAJPEAU_ATTRVALBLOCK@@K@Z
0x1800025D0: "protected: long __cdecl SAMOfflineHandleRegistry::GetTargetWindirPathFromSil(unsigned short * __ptr64 * __ptr64) __ptr64" ?GetTargetWindirPathFromSil@SAMOfflineHandleRegistry@@IEAAJPEAPEAG@Z
0x180003F00: WPP_SF_Z
0x180024C50: "void * __ptr64 __ptr64 SamOfflineUserSigninSupportCapabilitySid" ?SamOfflineUserSigninSupportCapabilitySid@@3PEAXEA
0x180001C48: "private: long __cdecl SAMOfflineHandleRegistry::ValidateOrReadAttributes(unsigned long) __ptr64" ?ValidateOrReadAttributes@SAMOfflineHandleRegistry@@AEAAJK@Z
0x180020108: "::RtlIsLUnicodeStringValid(Strin" ??_C@_0CD@HAGKBJM@?3?3RtlIsLUnicodeStringValid?$CIStrin@
0x18001E788: api-ms-win-security-cryptoapi-l1-1-0_NULL_THUNK_DATA
0x180011CEC: "public: long __cdecl ImpersonateHelper::Impersonate(void) __ptr64" ?Impersonate@ImpersonateHelper@@QEAAJXZ
0x180005FE8: "private: long __cdecl SAMOfflineServerHandleRegistry::UnloadSamHive(void) __ptr64" ?UnloadSamHive@SAMOfflineServerHandleRegistry@@AEAAJXZ
0x180020260: "RtlReallocateLUnicodeString" ??_C@_0BM@MGBMJPAL@RtlReallocateLUnicodeString?$AA@
0x180020908: g_RGWCH__empty_
0x18001ECD0: "\" ??_C@_13FPGAJAPJ@?$AA?2?$AA?$AA@
0x180016CC4: "long __cdecl CreateAliasInBuiltInDomain(class IOfflineKey * __ptr64,enum _NT_PRODUCT_TYPE,void * __ptr64,void * __ptr64,void * __ptr64,struct _UNICODE_STRING * __ptr64,struct _UNICODE_STRING * __ptr64,struct _UNICODE_STRING * __ptr64,unsigned char,unsigned long,struct _SAMP_PROTECTION * __ptr64 const,unsigned long)" ?CreateAliasInBuiltInDomain@@YAJPEAVIOfflineKey@@W4_NT_PRODUCT_TYPE@@PEAX22PEAU_UNICODE_STRING@@33EKQEAU_SAMP_PROTECTION@@K@Z
0x180005CB8: "private: long __cdecl SAMOfflineServerHandleRegistry::ApplyPendingRXactTxns(void) __ptr64" ?ApplyPendingRXactTxns@SAMOfflineServerHandleRegistry@@AEAAJXZ
0x1800039E0: WPP_SF_
0x18001E358: g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_System_bslash_CurrentControlSet_bslash_Hardware_space_Profiles_bslash_Current_bslash_
0x18000B0FC: "private: long __cdecl SAMOfflineUserHandleRegistry::QueryPreferences(struct _USER_PREFERENCES_INFORMATION * __ptr64 * __ptr64) __ptr64" ?QueryPreferences@SAMOfflineUserHandleRegistry@@AEAAJPEAPEAU_USER_PREFERENCES_INFORMATION@@@Z
0x18001E608: "__cdecl _imp_FreeLibrary" __imp_FreeLibrary
0x18000E210: "private: virtual void * __ptr64 __cdecl SAMOfflineAliasHandleRegistry::`vector deleting destructor'(unsigned int) __ptr64" ??_ESAMOfflineAliasHandleRegistry@@EEAAPEAXI@Z
0x18001FA48: "%s%s" ??_C@_19LJDFFCJJ@?$AA?$CF?$AAs?$AA?$CF?$AAs?$AA?$AA@
0x18001E6A8: "__cdecl _imp_AcquireSRWLockExclusive" __imp_AcquireSRWLockExclusive
0x18001E958: "__cdecl _imp_RtlGetGroupSecurityDescriptor" __imp_RtlGetGroupSecurityDescriptor
0x18001E678: "__cdecl _imp_OpenProcess" __imp_OpenProcess
0x180002058: "protected: long __cdecl SAMOfflineHandleRegistry::DeleteAttributeKeys(void) __ptr64" ?DeleteAttributeKeys@SAMOfflineHandleRegistry@@IEAAJXZ
0x18001F590: "ProductType" ??_C@_1BI@JPCMFPH@?$AAP?$AAr?$AAo?$AAd?$AAu?$AAc?$AAt?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x18001F1E0: "InternetUID" ??_C@_1BI@FDIDFJOE@?$AAI?$AAn?$AAt?$AAe?$AAr?$AAn?$AAe?$AAt?$AAU?$AAI?$AAD?$AA?$AA@
0x18001D260: "__cdecl DllMainCRTStartup" _DllMainCRTStartup
0x1800106D0: "long __cdecl SamOfflineOpenUser(void * __ptr64,unsigned long,void * __ptr64 * __ptr64)" ?SamOfflineOpenUser@@YAJPEAXKPEAPEAX@Z
0x18001E838: "__cdecl _imp__initterm" __imp__initterm
0x180012420: "public: virtual long __cdecl CWin32OfflineKey::SetSecurityDescriptor(unsigned long,void * __ptr64) __ptr64" ?SetSecurityDescriptor@CWin32OfflineKey@@UEAAJKPEAX@Z
0x180020688: "Not-null check failed: Compariso" ??_C@_0CI@EEEPPPDD@Not?9null?5check?5failed?3?5Compariso@
0x18001EAA8: "__cdecl _imp_RtlInitializeRXact" __imp_RtlInitializeRXact
0x180024D48: "void * __ptr64 __ptr64 SamOfflinePrincipalSelfSid" ?SamOfflinePrincipalSelfSid@@3PEAXEA
0x18001EEC8: "__cdecl GUID_05db2668_9ac9_4413_8817_e359264d68dd" _GUID_05db2668_9ac9_4413_8817_e359264d68dd
0x18001F6B8: "RC4" ??_C@_17HLFLMDBJ@?$AAR?$AAC?$AA4?$AA?$AA@
0x180024C78: "struct _UNICODE_STRING SamOfflineBuiltinExternalDomainNameU" ?SamOfflineBuiltinExternalDomainNameU@@3U_UNICODE_STRING@@A
0x180020240: "Not-null check failed: Source" ??_C@_0BO@FJDIJNDF@Not?9null?5check?5failed?3?5Source?$AA@
0x1800137A0: "public: virtual long __cdecl CSilOfflineKey::QueryValue(struct _UNICODE_STRING * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64,void * __ptr64) __ptr64" ?QueryValue@CSilOfflineKey@@UEAAJPEAU_UNICODE_STRING@@PEAK1PEAX@Z
0x18000C4B0: "private: __cdecl SAMOfflineUserHandleRegistry::SAMOfflineUserHandleRegistry(class SystemToken * __ptr64,class SAMOfflineHandleScope * __ptr64) __ptr64" ??0SAMOfflineUserHandleRegistry@@AEAA@PEAVSystemToken@@PEAVSAMOfflineHandleScope@@@Z
0x180001160: "public: unsigned short * __ptr64 __cdecl SAMOfflineHandleBase::SampObjectTypeSz(void) __ptr64" ?SampObjectTypeSz@SAMOfflineHandleBase@@QEAAPEAGXZ
0x18000F8C0: "long __cdecl SamOfflineOpenDomain(void * __ptr64,void * __ptr64,void * __ptr64 * __ptr64)" ?SamOfflineOpenDomain@@YAJPEAX0PEAPEAX@Z
0x18001F420: "%ssystem32\samsrv.dll" ??_C@_1CM@LNLKFOOL@?$AA?$CF?$AAs?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAs?$AAa?$AAm?$AAs?$AAr?$AAv?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x18000FD90: "long __cdecl SamOfflineQueryInformationAlias(void * __ptr64,enum _ALIAS_INFORMATION_CLASS,void * __ptr64 * __ptr64)" ?SamOfflineQueryInformationAlias@@YAJPEAXW4_ALIAS_INFORMATION_CLASS@@PEAPEAX@Z
0x18001E910: "__cdecl _imp_RtlIntegerToUnicodeString" __imp_RtlIntegerToUnicodeString
0x18001FC80: "SAM" ??_C@_17OMAOINJK@?$AAS?$AAA?$AAM?$AA?$AA@
0x18001C724: KEDecryptKeyWithRC4
0x1800085B8: "public: long __cdecl SAMOfflineDomainHandleRegistry::CreateUser(struct _UNICODE_STRING * __ptr64,class SAMOfflineUserHandleRegistry * __ptr64 * __ptr64,unsigned long * __ptr64) __ptr64" ?CreateUser@SAMOfflineDomainHandleRegistry@@QEAAJPEAU_UNICODE_STRING@@PEAPEAVSAMOfflineUserHandleRegistry@@PEAK@Z
0x18001FCA8: "PersonalSku" ??_C@_1BI@EHIJDNJC@?$AAP?$AAe?$AAr?$AAs?$AAo?$AAn?$AAa?$AAl?$AAS?$AAk?$AAu?$AA?$AA@
0x180024A20: "private: static unsigned long * SAMOfflineHandleBase::_ulObjectCount" ?_ulObjectCount@SAMOfflineHandleBase@@0PAKA
0x180024BB0: "struct _UNICODE_STRING SampNameDomainAliasesNames" ?SampNameDomainAliasesNames@@3U_UNICODE_STRING@@A
0x180024DE0: "__cdecl _onexitend" __onexitend
0x180024D18: "void * __ptr64 __ptr64 SamOfflineAdministratorsAliasSid" ?SamOfflineAdministratorsAliasSid@@3PEAXEA
0x180010340: "long __cdecl SamOfflineGetMembersInAlias(void * __ptr64,void * __ptr64 * __ptr64 * __ptr64,unsigned long * __ptr64)" ?SamOfflineGetMembersInAlias@@YAJPEAXPEAPEAPEAXPEAK@Z
0x18001B930: RtlCompareEncodedLBlobs
0x18001E7E0: "__cdecl _imp_BCryptSetProperty" __imp_BCryptSetProperty
0x180003020: "long __cdecl SamOfflineConvertAttrValBlockToLargeInteger(struct _ATTRVALBLOCK * __ptr64,union _LARGE_INTEGER * __ptr64)" ?SamOfflineConvertAttrValBlockToLargeInteger@@YAJPEAU_ATTRVALBLOCK@@PEAT_LARGE_INTEGER@@@Z
0x18001EAF8: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x180001010: "void * __ptr64 __cdecl SamOfflineAlloc(unsigned __int64)" ?SamOfflineAlloc@@YAPEAX_K@Z
0x18001FFB0: "BUCL::Rtl::ConvertInteger(Source" ??_C@_0DC@KOJNJLDJ@BUCL?3?3Rtl?3?3ConvertInteger?$CISource@
0x180024000: "struct _EXTENDEDATTRIBUTE_GETSET_FUNCTIONS * SamOfflineExtendedAttributeFunctions" ?SamOfflineExtendedAttributeFunctions@@3PAU_EXTENDEDATTRIBUTE_GETSET_FUNCTIONS@@A
0x18001E7F8: "__cdecl _imp_BCryptGetProperty" __imp_BCryptGetProperty
0x18001F37C: "NULL" ??_C@_04HIBGFPH@NULL?$AA@
0x180014AB0: "void __cdecl SamOfflineFreeUnicodeString(struct _UNICODE_STRING * __ptr64)" ?SamOfflineFreeUnicodeString@@YAXPEAU_UNICODE_STRING@@@Z
0x18001E808: "__cdecl _imp_BCryptEncrypt" __imp_BCryptEncrypt
0x180001F20: "private: long __cdecl SAMOfflineHandleRegistry::ExtendAttributeBuffer(unsigned long) __ptr64" ?ExtendAttributeBuffer@SAMOfflineHandleRegistry@@AEAAJK@Z
0x18001E658: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x18001E908: "__cdecl _imp_RtlAppendUnicodeToString" __imp_RtlAppendUnicodeToString
0x18001B908: RtlIsLBlobValid
0x18001E570: CRYPTBASE_NULL_THUNK_DATA
0x18001E740: "__cdecl _imp_GetTokenInformation" __imp_GetTokenInformation
0x180024D10: "void * __ptr64 __ptr64 SamOfflineUsersAliasSid" ?SamOfflineUsersAliasSid@@3PEAXEA
0x180020778: g_RGWCH__bslash_Registry_bslash_User_bslash_
0x18001FF08: "RtlDuplicateUnicodeStringToLUnic" ??_C@_0CK@LLEFCFIL@RtlDuplicateUnicodeStringToLUnic@
0x18001F7D8: "ChainingMode" ??_C@_1BK@BCJKEJJO@?$AAC?$AAh?$AAa?$AAi?$AAn?$AAi?$AAn?$AAg?$AAM?$AAo?$AAd?$AAe?$AA?$AA@
0x18001FA60: "00000000000000000000000000000000" ??_C@_1EC@CFJJDGGP@?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0?$AA0@
0x18000987C: "private: long __cdecl SAMOfflineDomainHandleRegistry::ApplyDefaultSyskey(void) __ptr64" ?ApplyDefaultSyskey@SAMOfflineDomainHandleRegistry@@AEAAJXZ
0x18001E7B8: "__cdecl _imp_BCryptDestroyHash" __imp_BCryptDestroyHash
0x180011C28: "public: void __cdecl SystemToken::ReleaseReference(void) __ptr64" ?ReleaseReference@SystemToken@@QEAAXXZ
0x1800207F8: g_RGWCH_HKEY_under_LOCAL_under_MACHINE_bslash_
0x180010E20: "long __cdecl SamOfflineFreeMemory(void * __ptr64)" ?SamOfflineFreeMemory@@YAJPEAX@Z
0x180002FB0: "long __cdecl SamOfflineConvertAttrValBlockToUnicodeString(struct _ATTRVALBLOCK * __ptr64,struct _UNICODE_STRING * __ptr64)" ?SamOfflineConvertAttrValBlockToUnicodeString@@YAJPEAU_ATTRVALBLOCK@@PEAU_UNICODE_STRING@@@Z
0x18001E6F0: api-ms-win-core-sysinfo-l1-1-0_NULL_THUNK_DATA
0x18001EB18: "__cdecl _xi_a" __xi_a
0x18001CC70: UseOutsideStringToKey
0x18001E680: api-ms-win-core-processthreads-l1-1-1_NULL_THUNK_DATA
0x18001E6E8: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x180012130: "public: virtual long __cdecl CWin32OfflineKey::CreateNewKey(struct _UNICODE_STRING * __ptr64,unsigned long,class IOfflineKey * __ptr64 * __ptr64) __ptr64" ?CreateNewKey@CWin32OfflineKey@@UEAAJPEAU_UNICODE_STRING@@KPEAPEAVIOfflineKey@@@Z
0x180011088: "private: static long __cdecl SystemToken::GetNewSystemToken(class SystemToken * __ptr64 * __ptr64)" ?GetNewSystemToken@SystemToken@@CAJPEAPEAV1@@Z
0x18001E918: "__cdecl _imp_RtlUpcaseUnicodeStringToOemString" __imp_RtlUpcaseUnicodeStringToOemString
0x180001E14: "private: long __cdecl SAMOfflineHandleRegistry::ValidateVariableReadyForRead(unsigned long,unsigned long) __ptr64" ?ValidateVariableReadyForRead@SAMOfflineHandleRegistry@@AEAAJKK@Z
0x180013150: "public: virtual void __cdecl CSilOfflineKey::AddRef(void) __ptr64" ?AddRef@CSilOfflineKey@@UEAAXXZ
0x18001FE18: "onecore\base\lstring\lunicode_st" ??_C@_0CJ@OHHDMDHM@onecore?2base?2lstring?2lunicode_st@
0x18001F158: "InternetUserName" ??_C@_1CC@JGGANOLM@?$AAI?$AAn?$AAt?$AAe?$AAr?$AAn?$AAe?$AAt?$AAU?$AAs?$AAe?$AAr?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x18001E750: api-ms-win-security-base-l1-1-0_NULL_THUNK_DATA
0x18001E998: "__cdecl _imp_NtOpenThreadToken" __imp_NtOpenThreadToken
0x18001E2F8: g_LUNICODE_STRING_HKCU_bslash_
0x180010E3C: WPP_SF_DD
0x180003B0C: WPP_SF_dD
0x180003B0C: WPP_SF_Dd
0x18001EDF0: "<unknown>" ??_C@_1BE@ELICABCK@?$AA?$DM?$AAu?$AAn?$AAk?$AAn?$AAo?$AAw?$AAn?$AA?$DO?$AA?$AA@
0x18001F468: "HKLM\SAM\SAM" ??_C@_1BK@PONBGLK@?$AAH?$AAK?$AAL?$AAM?$AA?2?$AAS?$AAA?$AAM?$AA?2?$AAS?$AAA?$AAM?$AA?$AA@
0x180003A5C: WPP_SF_DS
0x1800205F8: "Temp = (*RtlReallocateStringRout" ??_C@_0DK@KMDDBAIM@Temp?5?$DN?5?$CI?$CKRtlReallocateStringRout@
0x18000FEF0: "long __cdecl SamOfflineSetInformationAlias(void * __ptr64,enum _ALIAS_INFORMATION_CLASS,void * __ptr64)" ?SamOfflineSetInformationAlias@@YAJPEAXW4_ALIAS_INFORMATION_CLASS@@0@Z
0x180024070: WPP_GLOBAL_Control
0x18000BD64: "public: long __cdecl SAMOfflineUserHandleRegistry::QueryInformationUser(enum _USER_INFORMATION_CLASS,void * __ptr64 * __ptr64) __ptr64" ?QueryInformationUser@SAMOfflineUserHandleRegistry@@QEAAJW4_USER_INFORMATION_CLASS@@PEAPEAX@Z
0x18000FB20: "long __cdecl SamOfflineOpenAlias(void * __ptr64,unsigned long,void * __ptr64 * __ptr64)" ?SamOfflineOpenAlias@@YAJPEAXKPEAPEAX@Z
0x18001F350: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x180022568: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0
0x180018840: "long __cdecl CreateAccountDomain(class IOfflineKey * __ptr64,int,void * __ptr64,enum _NT_PRODUCT_TYPE,enum _DOMAIN_SERVER_ROLE,unsigned long,int,int,struct HINSTANCE__ * __ptr64,struct _SAMP_PROTECTION * __ptr64 const)" ?CreateAccountDomain@@YAJPEAVIOfflineKey@@HPEAXW4_NT_PRODUCT_TYPE@@W4_DOMAIN_SERVER_ROLE@@KHHPEAUHINSTANCE__@@QEAU_SAMP_PROTECTION@@@Z
0x18001BF00: KEGenerateHashWithSHA256
0x18002257C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-1" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-1
0x18001E638: api-ms-win-core-memory-l1-1-0_NULL_THUNK_DATA
0x18000154C: "protected: long __cdecl SAMOfflineHandleRegistry::GetSidArrayAttribute(unsigned long,void * __ptr64 * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64) __ptr64" ?GetSidArrayAttribute@SAMOfflineHandleRegistry@@IEAAJKPEAPEAXPEAK1@Z
0x180002D60: "long __cdecl SamOfflineConvertAttrValBlockToUlongArray(struct _ATTRVALBLOCK * __ptr64,struct _SAM_ULONG_ARRAY * __ptr64)" ?SamOfflineConvertAttrValBlockToUlongArray@@YAJPEAU_ATTRVALBLOCK@@PEAU_SAM_ULONG_ARRAY@@@Z
0x18001E990: "__cdecl _imp_NtQueryKey" __imp_NtQueryKey
0x18001EE68: "Members" ??_C@_1BA@PIIKFFIB@?$AAM?$AAe?$AAm?$AAb?$AAe?$AAr?$AAs?$AA?$AA@
0x180003A04: WPP_SF_D
0x180004120: WPP_SF_d
0x180018044: "long __cdecl CreateBuiltinDomain(class IOfflineKey * __ptr64,void * __ptr64,void * __ptr64,int,unsigned long,enum _NT_PRODUCT_TYPE,enum _DOMAIN_SERVER_ROLE,struct HINSTANCE__ * __ptr64,struct _SAMP_PROTECTION * __ptr64 const)" ?CreateBuiltinDomain@@YAJPEAVIOfflineKey@@PEAX1HKW4_NT_PRODUCT_TYPE@@W4_DOMAIN_SERVER_ROLE@@PEAUHINSTANCE__@@QEAU_SAMP_PROTECTION@@@Z
0x180024E08: "__cdecl pRawDllMain" _pRawDllMain
0x1800107F0: "long __cdecl SamOfflineCreateUserInDomain(void * __ptr64,struct _UNICODE_STRING * __ptr64,void * __ptr64 * __ptr64,unsigned long * __ptr64)" ?SamOfflineCreateUserInDomain@@YAJPEAXPEAU_UNICODE_STRING@@PEAPEAXPEAK@Z
0x180002D00: "long __cdecl SamOfflineConvertByteArrayToAttrValBlock(struct _SAM_BYTE_ARRAY * __ptr64,struct _ATTRVALBLOCK * __ptr64)" ?SamOfflineConvertByteArrayToAttrValBlock@@YAJPEAU_SAM_BYTE_ARRAY@@PEAU_ATTRVALBLOCK@@@Z
0x180001978: "protected: long __cdecl SAMOfflineHandleRegistry::GetULongArrayAttribute(unsigned long,unsigned long * __ptr64 * __ptr64,unsigned long * __ptr64) __ptr64" ?GetULongArrayAttribute@SAMOfflineHandleRegistry@@IEAAJKPEAPEAKPEAK@Z
0x180010150: "long __cdecl SamOfflineAddMemberToAlias(void * __ptr64,void * __ptr64)" ?SamOfflineAddMemberToAlias@@YAJPEAX0@Z
0x180020060: "cch <= (((((SIZE_T)~((SIZE_T)0))" ??_C@_0GD@IELHNMHL@cch?5?$DM?$DN?5?$CI?$CI?$CI?$CI?$CISIZE_T?$CJ?$HO?$CI?$CISIZE_T?$CJ0?$CJ?$CJ@
0x18001F0C8: "FailedInterLogonCount" ??_C@_1CM@CCMKPGAJ@?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AAI?$AAn?$AAt?$AAe?$AAr?$AAL?$AAo?$AAg?$AAo?$AAn?$AAC?$AAo?$AAu?$AAn?$AAt?$AA?$AA@
0x18000C77C: WPP_SF__sid_Dd
0x180009728: "public: long __cdecl SAMOfflineDomainHandleRegistry::BuildDomainRelativeRidPath(enum _SAMP_OBJECT_TYPE,unsigned long,struct _UNICODE_STRING * __ptr64) __ptr64" ?BuildDomainRelativeRidPath@SAMOfflineDomainHandleRegistry@@QEAAJW4_SAMP_OBJECT_TYPE@@KPEAU_UNICODE_STRING@@@Z
0x18000350C: "protected: long __cdecl SAMOfflineHandleRegistry::QueryObjectExtendedAttributes(unsigned long,unsigned long,struct _SAMOFFLINE_ATTRIBUTES_INFORMATION const * __ptr64,void * __ptr64) __ptr64" ?QueryObjectExtendedAttributes@SAMOfflineHandleRegistry@@IEAAJKKPEBU_SAMOFFLINE_ATTRIBUTES_INFORMATION@@PEAX@Z
0x18001E9C8: "__cdecl _imp_RtlCompareUnicodeString" __imp_RtlCompareUnicodeString
0x18001F388: "\REGISTRY\MACHINE\SAM" ??_C@_1CM@PCCCJGMC@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAA?$AAM?$AA?$AA@
0x18001E948: "__cdecl _imp_NtQueryValueKey" __imp_NtQueryValueKey
0x18001D500: "__cdecl _security_check_cookie" __security_check_cookie
0x180013200: "public: virtual long __cdecl CSilOfflineKey::CreateNewKeyEx(struct _UNICODE_STRING * __ptr64,unsigned long,void * __ptr64,struct _UNICODE_STRING * __ptr64,class IOfflineKey * __ptr64 * __ptr64) __ptr64" ?CreateNewKeyEx@CSilOfflineKey@@UEAAJPEAU_UNICODE_STRING@@KPEAX0PEAPEAVIOfflineKey@@@Z
0x18001EB10: "__cdecl _xc_z" __xc_z
0x18001E670: api-ms-win-core-processthreads-l1-1-0_NULL_THUNK_DATA
0x1800093E8: "public: long __cdecl SAMOfflineDomainHandleRegistry::AdjustAccountCount(enum _SAMP_OBJECT_TYPE,unsigned char) __ptr64" ?AdjustAccountCount@SAMOfflineDomainHandleRegistry@@QEAAJW4_SAMP_OBJECT_TYPE@@E@Z
0x18001F320: "SupplementalCredentials" ??_C@_1DA@CAMBGEFI@?$AAS?$AAu?$AAp?$AAp?$AAl?$AAe?$AAm?$AAe?$AAn?$AAt?$AAa?$AAl?$AAC?$AAr?$AAe?$AAd?$AAe?$AAn?$AAt?$AAi?$AAa?$AAl?$AAs?$AA?$AA@
0x180004A28: "public: static long __cdecl SAMOfflineServerHandleRegistry::CreateAndInitializeExternal(unsigned short * __ptr64,unsigned short * __ptr64,unsigned short * __ptr64,unsigned short * __ptr64,class SAMOfflineServerHandleRegistry * __ptr64 * __ptr64)" ?CreateAndInitializeExternal@SAMOfflineServerHandleRegistry@@SAJPEAG000PEAPEAV1@@Z
0x18001F248: "CachedLogonInfo" ??_C@_1CA@MEFJCFFJ@?$AAC?$AAa?$AAc?$AAh?$AAe?$AAd?$AAL?$AAo?$AAg?$AAo?$AAn?$AAI?$AAn?$AAf?$AAo?$AA?$AA@
0x18001E9B8: "__cdecl _imp_NtDuplicateToken" __imp_NtDuplicateToken
0x18001F728: "%s\%08x" ??_C@_1BA@LLEGAFII@?$AA?$CF?$AAs?$AA?2?$AA?$CF?$AA0?$AA8?$AAx?$AA?$AA@
0x180009810: "public: virtual long __cdecl SAMOfflineDomainHandleRegistry::RidToSid(unsigned long,void * __ptr64 * __ptr64) __ptr64" ?RidToSid@SAMOfflineDomainHandleRegistry@@UEAAJKPEAPEAX@Z
0x18001B03C: "long __cdecl RtlConvertWin32RegistryPathToNtRegistryPathUser(unsigned long,struct _LUNICODE_STRING const * __ptr64,struct _LUNICODE_STRING const * __ptr64,struct _LUNICODE_STRING * __ptr64)" ?RtlConvertWin32RegistryPathToNtRegistryPathUser@@YAJKPEBU_LUNICODE_STRING@@0PEAU1@@Z
0x180020978: "01234567890123456789012345678901" ??_C@_0CJ@CCFLKPHK@01234567890123456789012345678901@
0x180015318: WppCleanupUm
0x180002C08: "long __cdecl SamOfflineCopyAttrVal(struct _ATTRVAL * __ptr64,struct _ATTRVAL * __ptr64)" ?SamOfflineCopyAttrVal@@YAJPEAU_ATTRVAL@@0@Z
0x18001E760: "__cdecl _imp_CryptCreateHash" __imp_CryptCreateHash
0x1800224C8: "__cdecl _IMPORT_DESCRIPTOR_offlinelsa" __IMPORT_DESCRIPTOR_offlinelsa
0x1800199F0: "private: long __cdecl SAMOfflineServerHandleRegistry::CreateNewDatabase(void) __ptr64" ?CreateNewDatabase@SAMOfflineServerHandleRegistry@@AEAAJXZ
0x180020030: "RtlInitLUnicodeStringFromNullTer" ??_C@_0CO@IGKAHGPG@RtlInitLUnicodeStringFromNullTer@
0x18000F014: WPP_SF_qDD
0x18000F124: WPP_SF_qDd
0x180007A40: "private: virtual void * __ptr64 __cdecl SAMOfflineServerHandleRegistry::`scalar deleting destructor'(unsigned int) __ptr64" ??_GSAMOfflineServerHandleRegistry@@EEAAPEAXI@Z
0x18001EE78: "Users" ??_C@_1M@JKOHCHHA@?$AAU?$AAs?$AAe?$AAr?$AAs?$AA?$AA@
0x18001E6E0: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x180001370: WPP_SF_qqd
0x18001F300: "AccountFlagsEx" ??_C@_1BO@NMFKMNLK@?$AAA?$AAc?$AAc?$AAo?$AAu?$AAn?$AAt?$AAF?$AAl?$AAa?$AAg?$AAs?$AAE?$AAx?$AA?$AA@
0x18000AB60: "private: virtual void * __ptr64 __cdecl SAMOfflineDomainHandleRegistry::`vector deleting destructor'(unsigned int) __ptr64" ??_ESAMOfflineDomainHandleRegistry@@EEAAPEAXI@Z
0x180020338: "HKEY_CURRENT_USER" ??_C@_1CE@HLHNCBPM@?$AAH?$AAK?$AAE?$AAY?$AA_?$AAC?$AAU?$AAR?$AAR?$AAE?$AAN?$AAT?$AA_?$AAU?$AAS?$AAE?$AAR?$AA?$AA@
0x18001E5D8: "__cdecl _imp_LocalAlloc" __imp_LocalAlloc
0x18001E798: api-ms-win-security-lsalookup-l2-1-0_NULL_THUNK_DATA
0x18001F818: "Aliases\Members\%s" ??_C@_1CG@IMLCOEIP@?$AAA?$AAl?$AAi?$AAa?$AAs?$AAe?$AAs?$AA?2?$AAM?$AAe?$AAm?$AAb?$AAe?$AAr?$AAs?$AA?2?$AA?$CF?$AAs?$AA?$AA@
0x18001EE58: "Aliases" ??_C@_1BA@LNMIPDPK@?$AAA?$AAl?$AAi?$AAa?$AAs?$AAe?$AAs?$AA?$AA@
0x18001E768: "__cdecl _imp_CryptGetHashParam" __imp_CryptGetHashParam
0x180018F7C: "private: long __cdecl SAMOfflineServerHandleRegistry::CreateRXactState(void) __ptr64" ?CreateRXactState@SAMOfflineServerHandleRegistry@@AEAAJXZ
0x180020530: "\Device\HarddiskVolume" ??_C@_1CO@JFDIPJLA@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAH?$AAa?$AAr?$AAd?$AAd?$AAi?$AAs?$AAk?$AAV?$AAo?$AAl?$AAu?$AAm?$AAe?$AA?$AA@
0x18001EE88: "Names" ??_C@_1M@JAABGMB@?$AAN?$AAa?$AAm?$AAe?$AAs?$AA?$AA@
0x18000C530: "private: virtual void * __ptr64 __cdecl SAMOfflineUserHandleRegistry::`scalar deleting destructor'(unsigned int) __ptr64" ??_GSAMOfflineUserHandleRegistry@@EEAAPEAXI@Z
0x18000F090: WPP_SF_qDDD
0x18001D9F0: "__cdecl _chkstk" __chkstk
0x180014708: "long __cdecl SamOfflineSetPrivileges(void * __ptr64,unsigned long,struct PRIV_ENABLE * __ptr64)" ?SamOfflineSetPrivileges@@YAJPEAXKPEAUPRIV_ENABLE@@@Z
0x180024DD4: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUohgirmtUfnlwvUlyquivUznwGEUhgwrmxOlyq@lstring" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUohgirmtUfnlwvUlyquivUznwGEUhgwrmxOlyq@lstring
0x18001E8D0: "__cdecl _imp_RtlFormatCurrentUserKeyPath" __imp_RtlFormatCurrentUserKeyPath
0x180011A74: "private: static long __cdecl SystemToken::GetDupeOfCurrentToken(void * __ptr64 * __ptr64)" ?GetDupeOfCurrentToken@SystemToken@@CAJPEAPEAX@Z
0x180024DA0: "unsigned long gulExternalScopeCount" ?gulExternalScopeCount@@3KA
0x180014D7C: "long __cdecl SamOfflineRtlConvertUlongToUnicodeString(unsigned long,unsigned long,unsigned long,unsigned char,struct _UNICODE_STRING * __ptr64)" ?SamOfflineRtlConvertUlongToUnicodeString@@YAJKKKEPEAU_UNICODE_STRING@@@Z
0x180010000: "long __cdecl SamOfflineDeleteAlias(void * __ptr64)" ?SamOfflineDeleteAlias@@YAJPEAX@Z
0x180007C08: "long __cdecl RtlUnicodeStringCatString(struct _UNICODE_STRING * __ptr64,unsigned short const * __ptr64)" ?RtlUnicodeStringCatString@@YAJPEAU_UNICODE_STRING@@PEBG@Z
0x180024C70: "union _LARGE_INTEGER SamOfflineImmediatelyDeltaTime" ?SamOfflineImmediatelyDeltaTime@@3T_LARGE_INTEGER@@A
0x180020638: "Temp = (PUCHAR)((*RtlAllocateStr" ??_C@_0DE@HEDPHPEG@Temp?5?$DN?5?$CIPUCHAR?$CJ?$CI?$CI?$CKRtlAllocateStr@
0x18001F770: "LMPASSWORDHISTORY" ??_C@_0BC@LNIDNGOK@LMPASSWORDHISTORY?$AA@
0x180019188: "private: long __cdecl SAMOfflineServerHandleRegistry::CreateNewDatabaseHelper(struct SAMOfflineServerHandleRegistry::SAMDB_CREATE_PARAMS * __ptr64,struct _POLICY_ACCOUNT_DOMAIN_INFO * __ptr64,struct _POLICY_PRIMARY_DOMAIN_INFO * __ptr64,unsigned char) __ptr64" ?CreateNewDatabaseHelper@SAMOfflineServerHandleRegistry@@AEAAJPEAUSAMDB_CREATE_PARAMS@1@PEAU_POLICY_ACCOUNT_DOMAIN_INFO@@PEAU_POLICY_PRIMARY_DOMAIN_INFO@@E@Z
0x18000F9F0: "long __cdecl SamOfflineLookupNamesInDomain(void * __ptr64,unsigned long,struct _UNICODE_STRING * __ptr64,unsigned long * __ptr64 * __ptr64,enum _SID_NAME_USE * __ptr64 * __ptr64)" ?SamOfflineLookupNamesInDomain@@YAJPEAXKPEAU_UNICODE_STRING@@PEAPEAKPEAPEAW4_SID_NAME_USE@@@Z
0x18001B798: RtlReallocateLBlob
0x18001F690: "%s\SAM" ??_C@_1O@OBKMAIED@?$AA?$CF?$AAs?$AA?2?$AAS?$AAA?$AAM?$AA?$AA@
0x180002EA0: "long __cdecl SamOfflineConvertUlongToAttrValBlock(unsigned long * __ptr64,struct _ATTRVALBLOCK * __ptr64)" ?SamOfflineConvertUlongToAttrValBlock@@YAJPEAKPEAU_ATTRVALBLOCK@@@Z
0x180007974: "private: __cdecl SAMOfflineServerHandleRegistry::SAMOfflineServerHandleRegistry(class SystemToken * __ptr64,unsigned short * __ptr64,class SAMOfflineHandleScope * __ptr64) __ptr64" ??0SAMOfflineServerHandleRegistry@@AEAA@PEAVSystemToken@@PEAGPEAVSAMOfflineHandleScope@@@Z
0x180007B28: "private: __cdecl SAMOfflineServerHandleRegistry::SAMOfflineServerHandleRegistry(class SystemToken * __ptr64,struct Windows::Rtl::IRtlSystemIsolationLayer * __ptr64,class SAMOfflineHandleScope * __ptr64) __ptr64" ??0SAMOfflineServerHandleRegistry@@AEAA@PEAVSystemToken@@PEAUIRtlSystemIsolationLayer@Rtl@Windows@@PEAVSAMOfflineHandleScope@@@Z
0x18001FD18: "DomainServerRole" ??_C@_1CC@KCBODCJI@?$AAD?$AAo?$AAm?$AAa?$AAi?$AAn?$AAS?$AAe?$AAr?$AAv?$AAe?$AAr?$AAR?$AAo?$AAl?$AAe?$AA?$AA@
0x18001E1D0: "private: static struct SamOfflineDBOptions::DB_OPTION_ULONG const * const SamOfflineDBOptions::_UlongOptions" ?_UlongOptions@SamOfflineDBOptions@@0QBUDB_OPTION_ULONG@1@B
0x180024A88: "struct _UNICODE_STRING SampFixedAttributeName" ?SampFixedAttributeName@@3U_UNICODE_STRING@@A
0x1800173DC: "long __cdecl CreateGroup(class IOfflineKey * __ptr64,enum _NT_PRODUCT_TYPE,struct _SAMP_PROTECTION * __ptr64 const,struct _UNICODE_STRING * __ptr64,struct _UNICODE_STRING * __ptr64,struct _UNICODE_STRING * __ptr64,unsigned char,unsigned long,unsigned char)" ?CreateGroup@@YAJPEAVIOfflineKey@@W4_NT_PRODUCT_TYPE@@QEAU_SAMP_PROTECTION@@PEAU_UNICODE_STRING@@33EKE@Z
0x180024A10: g_hMd4Provider
0x18001E690: api-ms-win-core-profile-l1-1-0_NULL_THUNK_DATA
0x180024D28: "void * __ptr64 __ptr64 SamOfflineIUserSid" ?SamOfflineIUserSid@@3PEAXEA
0x18001EB30: "__cdecl _guard_fids_table" __guard_fids_table
0x18001E980: "__cdecl _imp_RtlpNtEnumerateSubKey" __imp_RtlpNtEnumerateSubKey
0x180020860: g_RGWCH__bslash_Registry_bslash_Machine_bslash_System_bslash_CurrentControlSet_bslash_Hardware_space_Profiles_bslash_Current_bslash_
0x18001E880: msvcrt_NULL_THUNK_DATA
0x18001E450: "__cdecl load_config_used" _load_config_used
0x18001FEE0: "Not-null check failed: Destinati" ??_C@_0CD@CBCHKJPP@Not?9null?5check?5failed?3?5Destinati@
0x18001E8A0: "__cdecl _imp_RtlCopySid" __imp_RtlCopySid
0x1800225CC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-sddl-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-sddl-l1-1-0
0x18000ED98: "public: static long __cdecl SAMOfflineDomainDescriptors::Create(class SAMOfflineDomainHandleRegistry * __ptr64,class SAMOfflineDomainDescriptors * __ptr64 * __ptr64)" ?Create@SAMOfflineDomainDescriptors@@SAJPEAVSAMOfflineDomainHandleRegistry@@PEAPEAV1@@Z
0x18001C510: KEEncryptKeyWithAES
0x18001ADD4: RtlEqualLUnicodeStrings
0x180020408: "RtlConvertNtFilePathToWin32FileP" ??_C@_0CE@BOMEINLL@RtlConvertNtFilePathToWin32FileP@
0x180012950: "public: virtual long __cdecl CWin32OfflineKey::QueryValue(struct _UNICODE_STRING * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64,void * __ptr64) __ptr64" ?QueryValue@CWin32OfflineKey@@UEAAJPEAU_UNICODE_STRING@@PEAK1PEAX@Z
0x1800240C0: "struct _SAMP_EXTENDED_ATTRIBUTE_PROPERTY * UserExtendedAttributeProperties" ?UserExtendedAttributeProperties@@3PAU_SAMP_EXTENDED_ATTRIBUTE_PROPERTY@@A
0x180024474: KerbGlobalAvailableStrToKeyProvider
0x18001EE30: "C" ??_C@_13FHBKNHDA@?$AAC?$AA?$AA@
0x18001E1B0: "private: static struct SamOfflineDBOptions::DB_OPTION const * const SamOfflineDBOptions::_BoolOptions" ?_BoolOptions@SamOfflineDBOptions@@0QBUDB_OPTION@1@B
0x180015588: "long __cdecl SamOfflineBuildNewProtection(unsigned long,void * __ptr64 * __ptr64,unsigned long * __ptr64,struct _GENERIC_MAPPING * __ptr64,unsigned char,struct _SAMP_PROTECTION * __ptr64)" ?SamOfflineBuildNewProtection@@YAJKPEAPEAXPEAKPEAU_GENERIC_MAPPING@@EPEAU_SAMP_PROTECTION@@@Z
0x18001F8C0: "SeDebugPrivilege" ??_C@_1CC@DMDJMJLM@?$AAS?$AAe?$AAD?$AAe?$AAb?$AAu?$AAg?$AAP?$AAr?$AAi?$AAv?$AAi?$AAl?$AAe?$AAg?$AAe?$AA?$AA@
0x18000C440: "public: virtual long __cdecl SAMOfflineAliasHandleRegistry::RidToSid(unsigned long,void * __ptr64 * __ptr64) __ptr64" ?RidToSid@SAMOfflineAliasHandleRegistry@@UEAAJKPEAPEAX@Z
0x18001E3A0: g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_SOFTWARE_bslash_Classes_bslash_
0x180020360: "HKCU" ??_C@_19JAPAIJDE@?$AAH?$AAK?$AAC?$AAU?$AA?$AA@
0x180016438: "long __cdecl OpenOrCreateAccountRidKey(void * __ptr64,class IOfflineKey * __ptr64,class IOfflineKey * __ptr64 * __ptr64)" ?OpenOrCreateAccountRidKey@@YAJPEAXPEAVIOfflineKey@@PEAPEAV1@@Z
0x1800205C0: "Not-null check failed: Blob" ??_C@_0BM@NOGHIDPG@Not?9null?5check?5failed?3?5Blob?$AA@
0x180013A40: "public: virtual long __cdecl CSilOfflineKey::DeleteValue(struct _UNICODE_STRING * __ptr64) __ptr64" ?DeleteValue@CSilOfflineKey@@UEAAJPEAU_UNICODE_STRING@@@Z
0x18001F7F8: WPP_fb8177a649c63887949804839080de6d_Traceguids
0x18001E968: "__cdecl _imp_NtSetSecurityObject" __imp_NtSetSecurityObject
0x18001E868: "__cdecl _imp__amsg_exit" __imp__amsg_exit
0x180003858: "long __cdecl RtlStringCbCopyExW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64,unsigned short * __ptr64 * __ptr64,unsigned __int64 * __ptr64,unsigned long)" ?RtlStringCbCopyExW@@YAJPEAG_KPEBGPEAPEAGPEA_KK@Z
0x18001AA64: RtlConcatenateLUnicodeStrings
0x180012650: "public: virtual long __cdecl CWin32OfflineKey::DeleteRecursively(void) __ptr64" ?DeleteRecursively@CWin32OfflineKey@@UEAAJXZ
0x180001A98: "protected: long __cdecl SAMOfflineHandleRegistry::GetFixedAttributes(void * __ptr64 * __ptr64) __ptr64" ?GetFixedAttributes@SAMOfflineHandleRegistry@@IEAAJPEAPEAX@Z
0x18001E7D8: "__cdecl _imp_BCryptOpenAlgorithmProvider" __imp_BCryptOpenAlgorithmProvider
0x18001E600: "__cdecl _imp_DisableThreadLibraryCalls" __imp_DisableThreadLibraryCalls
0x18001E898: "__cdecl _imp_NtClose" __imp_NtClose
0x180004FF4: "public: long __cdecl SAMOfflineServerHandleRegistry::OpenDomain(unsigned short * __ptr64,class SAMOfflineDomainHandleRegistry * __ptr64 * __ptr64) __ptr64" ?OpenDomain@SAMOfflineServerHandleRegistry@@QEAAJPEAGPEAPEAVSAMOfflineDomainHandleRegistry@@@Z
0x180011E1C: "public: void __cdecl ImpersonateHelper::Unimpersonate(void) __ptr64" ?Unimpersonate@ImpersonateHelper@@QEAAXXZ
0x180020920: g_RGWCH_HKEY_under_CURRENT_under_CONFIG_bslash_
0x180024C60: "void * __ptr64 __ptr64 SamOfflineLocalSystemSid" ?SamOfflineLocalSystemSid@@3PEAXEA
0x180004E20: "public: long __cdecl SAMOfflineServerHandleRegistry::OpenDomain(void * __ptr64,class SAMOfflineDomainHandleRegistry * __ptr64 * __ptr64) __ptr64" ?OpenDomain@SAMOfflineServerHandleRegistry@@QEAAJPEAXPEAPEAVSAMOfflineDomainHandleRegistry@@@Z
0x18001971C: "private: long __cdecl SAMOfflineServerHandleRegistry::QueryNewDBCreationOptions(struct SAMOfflineServerHandleRegistry::SAMDB_CREATE_PARAMS * __ptr64) __ptr64" ?QueryNewDBCreationOptions@SAMOfflineServerHandleRegistry@@AEAAJPEAUSAMDB_CREATE_PARAMS@1@@Z
0x18001E8F0: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x18001E080: "const CWin32OfflineKey::`vftable'" ??_7CWin32OfflineKey@@6B@
0x18001E7F0: "__cdecl _imp_BCryptGenerateSymmetricKey" __imp_BCryptGenerateSymmetricKey
0x18001EA68: "__cdecl _imp_RtlValidSid" __imp_RtlValidSid
0x18001E688: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x18001E978: "__cdecl _imp_RtlGetSaclSecurityDescriptor" __imp_RtlGetSaclSecurityDescriptor
0x18000F7C0: "long __cdecl SamOfflineLookupDomainInSamServer(void * __ptr64,struct _UNICODE_STRING * __ptr64,void * __ptr64 * __ptr64)" ?SamOfflineLookupDomainInSamServer@@YAJPEAXPEAU_UNICODE_STRING@@PEAPEAX@Z
0x180024A08: g_hMd5Provider
0x18000B880: "private: long __cdecl SAMOfflineUserHandleRegistry::SetExtendedInfo(struct _USER_EXTENDED_INFORMATION * __ptr64) __ptr64" ?SetExtendedInfo@SAMOfflineUserHandleRegistry@@AEAAJPEAU_USER_EXTENDED_INFORMATION@@@Z
0x18001EA78: "__cdecl _imp_RtlEqualSid" __imp_RtlEqualSid
0x18001E9D0: "__cdecl _imp_RtlGetDaclSecurityDescriptor" __imp_RtlGetDaclSecurityDescriptor
0x18001F6A0: WPP_70ed963d440e37977da7319257fb7e24_Traceguids
0x18001FD40: "LanguageId" ??_C@_1BG@OCFPMLMB@?$AAL?$AAa?$AAn?$AAg?$AAu?$AAa?$AAg?$AAe?$AAI?$AAd?$AA?$AA@
0x18001F4D0: "\REGISTRY\MACHINE\" ??_C@_1CG@GOLKLNMC@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AA?$AA@
0x180020700: "ObjectLength" ??_C@_1BK@GPNIFMAA@?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAL?$AAe?$AAn?$AAg?$AAt?$AAh?$AA?$AA@
0x180010930: "long __cdecl SamOfflineQueryInformationUser(void * __ptr64,enum _USER_INFORMATION_CLASS,void * __ptr64 * __ptr64)" ?SamOfflineQueryInformationUser@@YAJPEAXW4_USER_INFORMATION_CLASS@@PEAPEAX@Z
0x180008120: "public: long __cdecl SAMOfflineDomainHandleRegistry::LookupRid(unsigned long,enum _SAMP_OBJECT_TYPE * __ptr64) __ptr64" ?LookupRid@SAMOfflineDomainHandleRegistry@@QEAAJKPEAW4_SAMP_OBJECT_TYPE@@@Z
0x18001E8D8: "__cdecl _imp_RtlRaiseStatus" __imp_RtlRaiseStatus
0x18001E6B0: "__cdecl _imp_InitializeSRWLock" __imp_InitializeSRWLock
0x18001E620: "__cdecl _imp_VirtualAlloc" __imp_VirtualAlloc
0x180014A40: "long __cdecl SamOfflineCopyUnicodeString(struct _UNICODE_STRING * __ptr64,struct _UNICODE_STRING * __ptr64)" ?SamOfflineCopyUnicodeString@@YAJPEAU_UNICODE_STRING@@0@Z
0x18001EE28: "F" ??_C@_13GAMECHAC@?$AAF?$AA?$AA@
0x180007850: "public: virtual long __cdecl SAMOfflineServerHandleRegistry::RidToSid(unsigned long,void * __ptr64 * __ptr64) __ptr64" ?RidToSid@SAMOfflineServerHandleRegistry@@UEAAJKPEAPEAX@Z
0x18001F050: "LastSuccessfulInterLogonTime" ??_C@_1DK@INLHAKLG@?$AAL?$AAa?$AAs?$AAt?$AAS?$AAu?$AAc?$AAc?$AAe?$AAs?$AAs?$AAf?$AAu?$AAl?$AAI?$AAn?$AAt?$AAe?$AAr?$AAL?$AAo?$AAg?$AAo?$AAn?$AAT?$AAi?$AAm?$AAe?$AA?$AA@
0x180019F38: WPP_SF_SDd
0x180009568: "public: long __cdecl SAMOfflineDomainHandleRegistry::BuildDomainRelativeName(enum _SAMP_OBJECT_TYPE,struct _UNICODE_STRING * __ptr64,struct _UNICODE_STRING * __ptr64) __ptr64" ?BuildDomainRelativeName@SAMOfflineDomainHandleRegistry@@QEAAJW4_SAMP_OBJECT_TYPE@@PEAU_UNICODE_STRING@@1@Z
0x180007A40: "private: virtual void * __ptr64 __cdecl SAMOfflineServerHandleRegistry::`vector deleting destructor'(unsigned int) __ptr64" ??_ESAMOfflineServerHandleRegistry@@EEAAPEAXI@Z
0x18001F758: "NTPASSWORDHISTORY" ??_C@_0BC@MOLAKAMJ@NTPASSWORDHISTORY?$AA@
0x180024AA8: "private: static struct _RTL_SRWLOCK SystemToken::_srwTokenLock" ?_srwTokenLock@SystemToken@@0U_RTL_SRWLOCK@@A
0x1800054C8: "private: static long __cdecl SAMOfflineServerHandleRegistry::GetFullPathToSamHive(unsigned short * __ptr64,unsigned short * __ptr64 * __ptr64,unsigned short * __ptr64 * __ptr64)" ?GetFullPathToSamHive@SAMOfflineServerHandleRegistry@@CAJPEAGPEAPEAG1@Z
0x18000D8F4: "public: long __cdecl SAMOfflineAliasHandleRegistry::DeleteAliasMembershipKeysForAccount(void * __ptr64) __ptr64" ?DeleteAliasMembershipKeysForAccount@SAMOfflineAliasHandleRegistry@@QEAAJPEAX@Z
0x180020798: g_RGWCH__bslash_Registry_bslash_Machine_bslash_
0x18001E630: "__cdecl _imp_VirtualQuery" __imp_VirtualQuery
0x180003D2C: WPP_SF_SZD
0x18001E580: "__cdecl _imp_RpcStringFreeW" __imp_RpcStringFreeW
0x180024380: "struct _SAMOFFLINE_ATTRIBUTES_INFORMATION * UserExtendedAttributesInformation" ?UserExtendedAttributesInformation@@3PAU_SAMOFFLINE_ATTRIBUTES_INFORMATION@@A
0x18001E8E8: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x18000CD90: "private: long __cdecl SAMOfflineAliasHandleRegistry::AddAliasToAccountMembership(void * __ptr64) __ptr64" ?AddAliasToAccountMembership@SAMOfflineAliasHandleRegistry@@AEAAJPEAX@Z
0x18000AB60: "private: virtual void * __ptr64 __cdecl SAMOfflineDomainHandleRegistry::`scalar deleting destructor'(unsigned int) __ptr64" ??_GSAMOfflineDomainHandleRegistry@@EEAAPEAXI@Z
0x18001D530: "__cdecl purecall" _purecall
0x18001E050: "const SAMOfflineUserHandleRegistry::`vftable'" ??_7SAMOfflineUserHandleRegistry@@6B@
0x180007ED8: "public: static long __cdecl SAMOfflineDomainHandleRegistry::CreateAndInitialize(class SAMOfflineServerHandleRegistry * __ptr64,unsigned short * __ptr64,class SAMOfflineDomainHandleRegistry * __ptr64 * __ptr64)" ?CreateAndInitialize@SAMOfflineDomainHandleRegistry@@SAJPEAVSAMOfflineServerHandleRegistry@@PEAGPEAPEAV1@@Z
0x18000BF98: "public: long __cdecl SAMOfflineUserHandleRegistry::Delete(void) __ptr64" ?Delete@SAMOfflineUserHandleRegistry@@QEAAJXZ
0x18000C530: "private: virtual void * __ptr64 __cdecl SAMOfflineUserHandleRegistry::`vector deleting destructor'(unsigned int) __ptr64" ??_ESAMOfflineUserHandleRegistry@@EEAAPEAXI@Z
0x18001EAA0: "__cdecl _imp_NtLoadKey" __imp_NtLoadKey
0x1800075B0: "private: long __cdecl SAMOfflineServerHandleRegistry::OpenSamHiveRootKey(class IOfflineKey * __ptr64 * __ptr64) __ptr64" ?OpenSamHiveRootKey@SAMOfflineServerHandleRegistry@@AEAAJPEAPEAVIOfflineKey@@@Z
0x18001D8F0: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x180024098: "struct _SAMP_EXTENDED_ATTRIBUTE_PROPERTY * DomainExtendedAttributeProperties" ?DomainExtendedAttributeProperties@@3PAU_SAMP_EXTENDED_ATTRIBUTE_PROPERTY@@A
0x18001D996: memcmp
0x18000C294: "private: long __cdecl SAMOfflineUserHandleRegistry::DeleteUserKeys(void) __ptr64" ?DeleteUserKeys@SAMOfflineUserHandleRegistry@@AEAAJXZ
0x180012560: "public: virtual long __cdecl CWin32OfflineKey::Delete(void) __ptr64" ?Delete@CWin32OfflineKey@@UEAAJXZ
0x180013160: "public: virtual void __cdecl CWin32OfflineKey::Release(void) __ptr64" ?Release@CWin32OfflineKey@@UEAAXXZ
0x180001040: "void __cdecl SamOfflineFree(void * __ptr64)" ?SamOfflineFree@@YAXPEAX@Z
0x18000E41C: "public: long __cdecl SAMOfflineDomainDescriptors::GetNewAccountSecurityNt4(enum _SAMP_OBJECT_TYPE,unsigned char,unsigned long,void * __ptr64 * __ptr64,unsigned long * __ptr64) __ptr64" ?GetNewAccountSecurityNt4@SAMOfflineDomainDescriptors@@QEAAJW4_SAMP_OBJECT_TYPE@@EKPEAPEAXPEAK@Z
0x18000E510: "private: long __cdecl SAMOfflineDomainDescriptors::InitializeSecurityDescriptors(class SAMOfflineDomainHandleRegistry * __ptr64) __ptr64" ?InitializeSecurityDescriptors@SAMOfflineDomainDescriptors@@AEAAJPEAVSAMOfflineDomainHandleRegistry@@@Z
0x18001FC70: "\Users\" ??_C@_1BA@FJJFMPFO@?$AA?2?$AAU?$AAs?$AAe?$AAr?$AAs?$AA?2?$AA?$AA@
0x18001FBA0: "Aliases\Names" ??_C@_1BM@OMAMBLGG@?$AAA?$AAl?$AAi?$AAa?$AAs?$AAe?$AAs?$AA?2?$AAN?$AAa?$AAm?$AAe?$AAs?$AA?$AA@
0x180008D88: "private: long __cdecl SAMOfflineDomainHandleRegistry::EnumerateAccountNames(enum _SAMP_OBJECT_TYPE,struct _SAM_RID_ENUMERATION * __ptr64 * __ptr64,unsigned long * __ptr64) __ptr64" ?EnumerateAccountNames@SAMOfflineDomainHandleRegistry@@AEAAJW4_SAMP_OBJECT_TYPE@@PEAPEAU_SAM_RID_ENUMERATION@@PEAK@Z
0x18000AC68: "public: static long __cdecl SAMOfflineUserHandleRegistry::CreateNew(class SAMOfflineServerHandleRegistry * __ptr64,class SAMOfflineDomainHandleRegistry * __ptr64,struct _UNICODE_STRING * __ptr64,class SAMOfflineUserHandleRegistry * __ptr64 * __ptr64,unsigned long * __ptr64)" ?CreateNew@SAMOfflineUserHandleRegistry@@SAJPEAVSAMOfflineServerHandleRegistry@@PEAVSAMOfflineDomainHandleRegistry@@PEAU_UNICODE_STRING@@PEAPEAV1@PEAK@Z
0x180002F90: "long __cdecl SamOfflineConvertAttrValBlockToByteArray(struct _ATTRVALBLOCK * __ptr64,struct _SAM_BYTE_ARRAY * __ptr64)" ?SamOfflineConvertAttrValBlockToByteArray@@YAJPEAU_ATTRVALBLOCK@@PEAU_SAM_BYTE_ARRAY@@@Z
0x1800206D0: "Not-null check failed: String2" ??_C@_0BP@CFJIPKGD@Not?9null?5check?5failed?3?5String2?$AA@
0x1800091AC: "public: long __cdecl SAMOfflineDomainHandleRegistry::RemoveAccountFromAllAliases(void * __ptr64) __ptr64" ?RemoveAccountFromAllAliases@SAMOfflineDomainHandleRegistry@@QEAAJPEAX@Z
0x180024E10: g_ulMaxStackAllocSize
0x1800225A4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0
0x180008694: "public: long __cdecl SAMOfflineDomainHandleRegistry::AllocateNextRid(unsigned long * __ptr64) __ptr64" ?AllocateNextRid@SAMOfflineDomainHandleRegistry@@QEAAJPEAK@Z
0x180024C30: "union _LARGE_INTEGER SamOfflineHasNeverTime" ?SamOfflineHasNeverTime@@3T_LARGE_INTEGER@@A
0x18001EAD0: "__cdecl _imp_?LsaOfflineQueryInformationPolicy@@YAJPEAXW4_POLICY_INFORMATION_CLASS@@PEAPEAX@Z" __imp_?LsaOfflineQueryInformationPolicy@@YAJPEAXW4_POLICY_INFORMATION_CLASS@@PEAPEAX@Z
0x18001FEC0: "RtlAllocateLUnicodeString" ??_C@_0BK@HIPMGLGK@RtlAllocateLUnicodeString?$AA@
0x180018E78: "long __cdecl CreateNewServerObjectAndDomains(class IOfflineKey * __ptr64,struct _SAMP_PROTECTION * __ptr64 const)" ?CreateNewServerObjectAndDomains@@YAJPEAVIOfflineKey@@QEAU_SAMP_PROTECTION@@@Z
0x180024CE0: "void * __ptr64 __ptr64 SamOfflineAccountOperatorsAliasSid" ?SamOfflineAccountOperatorsAliasSid@@3PEAXEA
0x18001FAA8: "Builtin" ??_C@_1BA@HGGOEJLE@?$AAB?$AAu?$AAi?$AAl?$AAt?$AAi?$AAn?$AA?$AA@
0x180013DDC: "public: static long __cdecl IOfflineKey::CreateAndInitializeForWin32(void * __ptr64,class SystemToken * __ptr64,class IOfflineKey * __ptr64 * __ptr64)" ?CreateAndInitializeForWin32@IOfflineKey@@SAJPEAXPEAVSystemToken@@PEAPEAV1@@Z
0x180002ED0: "long __cdecl SamOfflineConvertLargeIntegerToAttrValBlock(union _LARGE_INTEGER * __ptr64,struct _ATTRVALBLOCK * __ptr64)" ?SamOfflineConvertLargeIntegerToAttrValBlock@@YAJPEAT_LARGE_INTEGER@@PEAU_ATTRVALBLOCK@@@Z
0x18001EAF0: offlinelsa_NULL_THUNK_DATA
0x180024BA0: "struct _UNICODE_STRING SampNameDomainUsers" ?SampNameDomainUsers@@3U_UNICODE_STRING@@A
0x18001E3B8: g_LUNICODE_STRING_HKEY_under_CLASSES_under_ROOT_bslash_
0x18001E728: api-ms-win-eventing-classicprovider-l1-1-0_NULL_THUNK_DATA
0x18001EFE0: "UserDontShowInLogonUI" ??_C@_1CM@FLEDJJCE@?$AAU?$AAs?$AAe?$AAr?$AAD?$AAo?$AAn?$AAt?$AAS?$AAh?$AAo?$AAw?$AAI?$AAn?$AAL?$AAo?$AAg?$AAo?$AAn?$AAU?$AAI?$AA?$AA@
0x18001E8B0: "__cdecl _imp_RtlImageNtHeader" __imp_RtlImageNtHeader
0x180006EB0: "private: long __cdecl SAMOfflineServerHandleRegistry::QueryTargetLanguageHelper(class IOfflineKey * __ptr64,unsigned long * __ptr64) __ptr64" ?QueryTargetLanguageHelper@SAMOfflineServerHandleRegistry@@AEAAJPEAVIOfflineKey@@PEAK@Z
0x18001EE38: "DOMAINS" ??_C@_1BA@PLKKIFMG@?$AAD?$AAO?$AAM?$AAA?$AAI?$AAN?$AAS?$AA?$AA@
0x180015F80: "long __cdecl SamOfflineCreateDatabaseProtection(struct _SECURITY_DESCRIPTOR * __ptr64)" ?SamOfflineCreateDatabaseProtection@@YAJPEAU_SECURITY_DESCRIPTOR@@@Z
0x18001E818: "__cdecl _imp__XcptFilter" __imp__XcptFilter
0x18001E070: "const SAMOfflineGroupHandleRegistry::`vftable'" ??_7SAMOfflineGroupHandleRegistry@@6B@
0x18001AF1C: RtlIsLUnicodeStringValid
0x180014240: "long __cdecl SamOfflineCreateFullSid(void * __ptr64,unsigned long,void * __ptr64 * __ptr64)" ?SamOfflineCreateFullSid@@YAJPEAXKPEAPEAX@Z
0x18001E370: g_LUNICODE_STRING_HKEY_under_CURRENT_under_CONFIG_bslash_
0x18001EAB0: ntdll_NULL_THUNK_DATA
0x18001E858: "__cdecl _imp_memcpy" __imp_memcpy
0x18001EED8: "ServerDomainUpdates" ??_C@_1CI@CAECALHB@?$AAS?$AAe?$AAr?$AAv?$AAe?$AAr?$AAD?$AAo?$AAm?$AAa?$AAi?$AAn?$AAU?$AAp?$AAd?$AAa?$AAt?$AAe?$AAs?$AA?$AA@
0x180024C68: "void * __ptr64 __ptr64 SamOfflinePowerUsersAliasSid" ?SamOfflinePowerUsersAliasSid@@3PEAXEA
0x180013530: "public: virtual long __cdecl CSilOfflineKey::SetSecurityDescriptor(unsigned long,void * __ptr64) __ptr64" ?SetSecurityDescriptor@CSilOfflineKey@@UEAAJKPEAX@Z
0x18001F980: "S-1-15-3-1024-1730716382-2949791" ??_C@_1MG@JKPADOPJ@?$AAS?$AA?9?$AA1?$AA?9?$AA1?$AA5?$AA?9?$AA3?$AA?9?$AA1?$AA0?$AA2?$AA4?$AA?9?$AA1?$AA7?$AA3?$AA0?$AA7?$AA1?$AA6?$AA3?$AA8?$AA2?$AA?9?$AA2?$AA9?$AA4?$AA9?$AA7?$AA9?$AA1@
0x18001F6B0: "MD5" ??_C@_17HLHJLHED@?$AAM?$AAD?$AA5?$AA?$AA@
0x1800133B0: "public: virtual long __cdecl CSilOfflineKey::OpenExistingKey(struct _UNICODE_STRING * __ptr64,unsigned long,class IOfflineKey * __ptr64 * __ptr64) __ptr64" ?OpenExistingKey@CSilOfflineKey@@UEAAJPEAU_UNICODE_STRING@@KPEAPEAVIOfflineKey@@@Z
0x18000C5BC: WPP_SF_DdD
0x180024D90: "struct _LIST_ENTRY gExternalScopes" ?gExternalScopes@@3U_LIST_ENTRY@@A
0x180006D08: "private: long __cdecl SAMOfflineServerHandleRegistry::QueryTargetProductSuiteHelper(class IOfflineKey * __ptr64,int * __ptr64) __ptr64" ?QueryTargetProductSuiteHelper@SAMOfflineServerHandleRegistry@@AEAAJPEAVIOfflineKey@@PEAH@Z
0x180024BE0: "private: static class SystemToken * __ptr64 __ptr64 SystemToken::_CachedSystemToken" ?_CachedSystemToken@SystemToken@@0PEAV1@EA
0x18001EA70: "__cdecl _imp_NtQuerySystemTime" __imp_NtQuerySystemTime
0x180010C00: "long __cdecl SamOfflineRidToSid(void * __ptr64,unsigned long,void * __ptr64 * __ptr64)" ?SamOfflineRidToSid@@YAJPEAXKPEAPEAX@Z
0x18001E708: "__cdecl _imp_GetTraceEnableFlags" __imp_GetTraceEnableFlags
0x180022554: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0
0x18001F090: "LastFailedInterLogonTime" ??_C@_1DC@GBCKNEPB@?$AAL?$AAa?$AAs?$AAt?$AAF?$AAa?$AAi?$AAl?$AAe?$AAd?$AAI?$AAn?$AAt?$AAe?$AAr?$AAL?$AAo?$AAg?$AAo?$AAn?$AAT?$AAi?$AAm?$AAe?$AA?$AA@
0x18000EE50: WPP_SF_SSSS
0x180012028: WPP_SF_ZDZD
0x180015110: "void __cdecl SamOfflineCleanupGlobals(void)" ?SamOfflineCleanupGlobals@@YAXXZ
0x180003000: "long __cdecl SamOfflineConvertAttrValBlockToUlong(struct _ATTRVALBLOCK * __ptr64,unsigned long * __ptr64)" ?SamOfflineConvertAttrValBlockToUlong@@YAJPEAU_ATTRVALBLOCK@@PEAK@Z
0x1800131D0: "public: virtual long __cdecl CSilOfflineKey::CreateNewKey(struct _UNICODE_STRING * __ptr64,unsigned long,class IOfflineKey * __ptr64 * __ptr64) __ptr64" ?CreateNewKey@CSilOfflineKey@@UEAAJPEAU_UNICODE_STRING@@KPEAPEAVIOfflineKey@@@Z
0x18001E700: "__cdecl _imp_RegisterTraceGuidsW" __imp_RegisterTraceGuidsW
0x180013B10: "public: virtual long __cdecl CSilOfflineKey::EnumerateKeys(unsigned long * __ptr64,unsigned short * __ptr64 * __ptr64 * __ptr64) __ptr64" ?EnumerateKeys@CSilOfflineKey@@UEAAJPEAKPEAPEAPEAG@Z
0x180024368: "__cdecl _security_cookie" __security_cookie
0x180010A20: "long __cdecl SamOfflineSetInformationUser(void * __ptr64,enum _USER_INFORMATION_CLASS,void * __ptr64)" ?SamOfflineSetInformationUser@@YAJPEAXW4_USER_INFORMATION_CLASS@@0@Z
0x180020730: g_RGWCH__bslash_Registry_bslash_Machine_bslash_SOFTWARE_bslash_Classes_bslash_
0x18001F958: WPP_f1a189ec75fd36ea399f18f558542077_Traceguids
0x180013D90: "public: __cdecl CSilOfflineKey::CSilOfflineKey(struct Windows::Rtl::IRtlKey * __ptr64) __ptr64" ??0CSilOfflineKey@@QEAA@PEAUIRtlKey@Rtl@Windows@@@Z
0x180024E18: g_pfnAllocate
0x180024DA4: "unsigned long gulInstallerScopeCount" ?gulInstallerScopeCount@@3KA
0x180013610: "public: virtual long __cdecl CSilOfflineKey::DeleteKey(struct _UNICODE_STRING * __ptr64) __ptr64" ?DeleteKey@CSilOfflineKey@@UEAAJPEAU_UNICODE_STRING@@@Z
0x18001C2EC: KEDecryptDataWithAES
0x18001D9F0: "__cdecl alloca_probe" _alloca_probe
0x18001F3C8: "\system32\config\SAM" ??_C@_1CK@EFFIOKKO@?$AA?2?$AAs?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAc?$AAo?$AAn?$AAf?$AAi?$AAg?$AA?2?$AAS?$AAA?$AAM?$AA?$AA@
0x180012AE0: "public: virtual long __cdecl CWin32OfflineKey::SetValue(struct _UNICODE_STRING * __ptr64,unsigned long,void * __ptr64,unsigned long) __ptr64" ?SetValue@CWin32OfflineKey@@UEAAJPEAU_UNICODE_STRING@@KPEAXK@Z
0x1800144C0: "unsigned char __cdecl SamOfflineIsWellKnownSid(void * __ptr64)" ?SamOfflineIsWellKnownSid@@YAEPEAX@Z
0x18000324C: "private: long __cdecl SAMOfflineHandleRegistry::RegReadExtendedAttributes(unsigned long * __ptr64,unsigned long) __ptr64" ?RegReadExtendedAttributes@SAMOfflineHandleRegistry@@AEAAJPEAKK@Z
0x180024CD0: "struct _LM_OWF_PASSWORD SamOfflineNullNtOwfPassword" ?SamOfflineNullNtOwfPassword@@3U_LM_OWF_PASSWORD@@A
0x180024C08: "unsigned long gulWin32KeyCount" ?gulWin32KeyCount@@3KA
0x180024078: "struct _SAMP_EXTENDED_ATTRIBUTE_PROPERTY * ServerExtendedAttributeProperties" ?ServerExtendedAttributeProperties@@3PAU_SAMP_EXTENDED_ATTRIBUTE_PROPERTY@@A
0x18001E5C8: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x180003050: "long __cdecl SamOfflineConvertAttrValBlockToGuid(struct _ATTRVALBLOCK * __ptr64,struct _GUID * __ptr64)" ?SamOfflineConvertAttrValBlockToGuid@@YAJPEAU_ATTRVALBLOCK@@PEAU_GUID@@@Z
0x180024C10: "struct _RTL_SRWLOCK gKeyListLock" ?gKeyListLock@@3U_RTL_SRWLOCK@@A
0x18000C6CC: WPP_SF__sid_D
0x18001E5E0: "__cdecl _imp_LocalFree" __imp_LocalFree
0x18001E738: "__cdecl _imp_GetLengthSid" __imp_GetLengthSid
0x180005428: "public: static int __cdecl SAMOfflineServerHandleRegistry::IsBuiltInDomain(unsigned short * __ptr64)" ?IsBuiltInDomain@SAMOfflineServerHandleRegistry@@SAHPEAG@Z
0x18001E988: "__cdecl _imp_NtDeleteKey" __imp_NtDeleteKey
0x180022590: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0
0x18001ECE8: "SampServerObjectType" ??_C@_1CK@OOKHEEHJ@?$AAS?$AAa?$AAm?$AAp?$AAS?$AAe?$AAr?$AAv?$AAe?$AAr?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x18001E430: g_LUNICODE_STRING_HKEY_under_LOCAL_under_MACHINE_bslash_
0x18001E5B8: "__cdecl _imp_GetFileAttributesW" __imp_GetFileAttributesW
0x18000133C: "public: void __cdecl SAMOfflineHandleBase::ReleaseReference(void) __ptr64" ?ReleaseReference@SAMOfflineHandleBase@@QEAAXXZ
0x18001F180: "InternetProviderName" ??_C@_1CK@BAANMOCJ@?$AAI?$AAn?$AAt?$AAe?$AAr?$AAn?$AAe?$AAt?$AAP?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x180015968: "long __cdecl InitializeSecurityDescriptors(enum _NT_PRODUCT_TYPE,void * __ptr64,struct _SAMP_PROTECTION * __ptr64 const)" ?InitializeSecurityDescriptors@@YAJW4_NT_PRODUCT_TYPE@@PEAXQEAU_SAMP_PROTECTION@@@Z
0x18001E8E0: "__cdecl _imp_DbgPrintEx" __imp_DbgPrintEx
0x180008C08: "public: long __cdecl SAMOfflineDomainHandleRegistry::OpenUser(unsigned long,class SAMOfflineUserHandleRegistry * __ptr64 * __ptr64) __ptr64" ?OpenUser@SAMOfflineDomainHandleRegistry@@QEAAJKPEAPEAVSAMOfflineUserHandleRegistry@@@Z
0x180024DE8: "__cdecl _onexitbegin" __onexitbegin
0x18001EF60: "AliasShellAdminObjectProperties" ??_C@_1EA@LPOMCHEB@?$AAA?$AAl?$AAi?$AAa?$AAs?$AAS?$AAh?$AAe?$AAl?$AAl?$AAA?$AAd?$AAm?$AAi?$AAn?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAP?$AAr?$AAo?$AAp?$AAe?$AAr?$AAt?$AAi?$AAe?$AAs?$AA?$AA@
0x1800012AC: "public: virtual __cdecl SAMOfflineHandleBase::~SAMOfflineHandleBase(void) __ptr64" ??1SAMOfflineHandleBase@@UEAA@XZ
0x180024A34: "private: static int SystemToken::_StaticsInitialized" ?_StaticsInitialized@SystemToken@@0HA
0x180019C9C: "long __cdecl SamOfflineFindMessageWrapper(void * __ptr64,unsigned long,unsigned long,struct _UNICODE_STRING * __ptr64)" ?SamOfflineFindMessageWrapper@@YAJPEAXKKPEAU_UNICODE_STRING@@@Z
0x18001CBE0: SystemFunction024
0x18000C62C: WPP_SF__sid_
0x1800201A0: "BUCL::Rtl::AddInPlaceWithOverflo" ??_C@_0EK@FINDHGGP@BUCL?3?3Rtl?3?3AddInPlaceWithOverflo@
0x180002860: "public: __cdecl SAMOfflineHandleRegistry::SAMOfflineHandleRegistry(class SystemToken * __ptr64,enum _SAMP_OBJECT_TYPE,class SAMOfflineHandleScope * __ptr64) __ptr64" ??0SAMOfflineHandleRegistry@@QEAA@PEAVSystemToken@@W4_SAMP_OBJECT_TYPE@@PEAVSAMOfflineHandleScope@@@Z
0x1800202F8: "Not-null check failed: PathIn" ??_C@_0BO@IGDAGCGO@Not?9null?5check?5failed?3?5PathIn?$AA@
0x18001E3E8: g_LUNICODE_STRING_HKEY_under_USERS_bslash_
0x18000725C: "private: long __cdecl SAMOfflineServerHandleRegistry::OpenSamRootKey(void) __ptr64" ?OpenSamRootKey@SAMOfflineServerHandleRegistry@@AEAAJXZ
0x18001EA08: "__cdecl _imp_RtlAllocateAndInitializeSid" __imp_RtlAllocateAndInitializeSid
0x18001F788: "MISCCREDDATA" ??_C@_0N@ENNLCCGL@MISCCREDDATA?$AA@
0x18001E870: "__cdecl _imp__vsnwprintf" __imp__vsnwprintf
0x180014B24: "long __cdecl SamOfflineCopyString(unsigned short * __ptr64,unsigned short * __ptr64 * __ptr64)" ?SamOfflineCopyString@@YAJPEAGPEAPEAG@Z
0x180020848: g_RGWCH_HKLM_bslash_
0x18000EFA4: WPP_SF_qD
0x180004180: WPP_SF_qd
0x1800202A8: "onecore\base\lstring\path.cpp" ??_C@_0BO@MAHDFKKG@onecore?2base?2lstring?2path?4cpp?$AA@
0x18000F1A4: WPP_SF_qZ
0x18001E5A8: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x18001FF38: "::RtlIsUnicodeStringValid(Source" ??_C@_0CC@IAHNJHKE@?3?3RtlIsUnicodeStringValid?$CISource@
0x18001E0F0: "const CSilOfflineKey::`vftable'" ??_7CSilOfflineKey@@6B@
0x180005140: "public: long __cdecl SAMOfflineServerHandleRegistry::EnumerateDomains(unsigned long * __ptr64,struct _SAM_RID_ENUMERATION * __ptr64 * __ptr64,unsigned long,unsigned long * __ptr64) __ptr64" ?EnumerateDomains@SAMOfflineServerHandleRegistry@@QEAAJPEAKPEAPEAU_SAM_RID_ENUMERATION@@K0@Z
0x18001E010: "const SAMOfflineHandleBase::`vftable'" ??_7SAMOfflineHandleBase@@6B@
0x180024410: "unsigned short * InvalidDownLevelChars" ?InvalidDownLevelChars@@3PAGA
0x1800041F4: WPP_SF_qq
0x18000E390: "private: virtual void * __ptr64 __cdecl SAMOfflineGroupHandleRegistry::`vector deleting destructor'(unsigned int) __ptr64" ??_ESAMOfflineGroupHandleRegistry@@EEAAPEAXI@Z
0x1800010B4: WPP_SF_qS
0x180020178: "::RtlIsLUnicodeStringValid(&Sour" ??_C@_0CI@NAADPAOI@?3?3RtlIsLUnicodeStringValid?$CI?$CGSour@
0x18001FBC0: "Aliases\Members" ??_C@_1CA@FMDLLOJF@?$AAA?$AAl?$AAi?$AAa?$AAs?$AAe?$AAs?$AA?2?$AAM?$AAe?$AAm?$AAb?$AAe?$AAr?$AAs?$AA?$AA@
0x180001270: "public: virtual void * __ptr64 __cdecl SAMOfflineHandleBase::`scalar deleting destructor'(unsigned int) __ptr64" ??_GSAMOfflineHandleBase@@UEAAPEAXI@Z
0x18001FF88: "::RtlIsLUnicodeStringValid(Sourc" ??_C@_0CD@JJAEPDDA@?3?3RtlIsLUnicodeStringValid?$CISourc@
0x180024D00: "struct _RTL_SRWLOCK srwGlobalInitLock" ?srwGlobalInitLock@@3U_RTL_SRWLOCK@@A
0x180001E54: "private: long __cdecl SAMOfflineHandleRegistry::GetAttributeBufferReadInfo(unsigned long,unsigned char * __ptr64 * __ptr64,unsigned long * __ptr64,struct _UNICODE_STRING * __ptr64 * __ptr64) __ptr64" ?GetAttributeBufferReadInfo@SAMOfflineHandleRegistry@@AEAAJKPEAPEAEPEAKPEAPEAU_UNICODE_STRING@@@Z
0x18001D7F4: "__cdecl _security_init_cookie" __security_init_cookie
0x18001EA20: "__cdecl _imp_RtlMapGenericMask" __imp_RtlMapGenericMask
0x180020950: "HashDigestLength" ??_C@_1CC@DMMMEHOM@?$AAH?$AAa?$AAs?$AAh?$AAD?$AAi?$AAg?$AAe?$AAs?$AAt?$AAL?$AAe?$AAn?$AAg?$AAt?$AAh?$AA?$AA@
0x180015918: "void __cdecl CleanupSecurityDescriptors(struct _SAMP_PROTECTION * __ptr64 const)" ?CleanupSecurityDescriptors@@YAXQEAU_SAMP_PROTECTION@@@Z
0x18000105C: WPP_SF_q
0x180011480: "private: static long __cdecl SystemToken::GetWinLogonProcessId(unsigned long * __ptr64)" ?GetWinLogonProcessId@SystemToken@@CAJPEAK@Z
0x18001E7B0: "__cdecl _imp_BCryptFinishHash" __imp_BCryptFinishHash
0x18001FBE0: "\Aliases\Names\" ??_C@_1CA@NLLFMJPA@?$AA?2?$AAA?$AAl?$AAi?$AAa?$AAs?$AAe?$AAs?$AA?2?$AAN?$AAa?$AAm?$AAe?$AAs?$AA?2?$AA?$AA@
0x18001E9B0: "__cdecl _imp_NtQuerySystemInformation" __imp_NtQuerySystemInformation
0x18001E930: "__cdecl _imp_RtlIdentifierAuthoritySid" __imp_RtlIdentifierAuthoritySid
0x180024E28: g_pfnFree
0x18001F870: "BUILTIN" ??_C@_1BA@LCIOCBBK@?$AAB?$AAU?$AAI?$AAL?$AAT?$AAI?$AAN?$AA?$AA@
0x180012FB0: "public: virtual long __cdecl CWin32OfflineKey::QueryClass(unsigned short * __ptr64 * __ptr64) __ptr64" ?QueryClass@CWin32OfflineKey@@UEAAJPEAPEAG@Z
0x18000FC40: "long __cdecl SamOfflineCreateAliasInDomain(void * __ptr64,struct _UNICODE_STRING * __ptr64,void * __ptr64 * __ptr64,unsigned long * __ptr64)" ?SamOfflineCreateAliasInDomain@@YAJPEAXPEAU_UNICODE_STRING@@PEAPEAXPEAK@Z
0x180022478: "__cdecl _IMPORT_DESCRIPTOR_msvcrt" __IMPORT_DESCRIPTOR_msvcrt
0x1800206B0: "Not-null check failed: String1" ??_C@_0BP@OLFKJKA@Not?9null?5check?5failed?3?5String1?$AA@
0x18001E7A8: api-ms-win-security-sddl-l1-1-0_NULL_THUNK_DATA
0x18001E850: "__cdecl _imp_memmove" __imp_memmove
0x1800016A0: "private: long __cdecl SAMOfflineHandleRegistry::SetVariableAttribute(unsigned long,unsigned long,unsigned char * __ptr64,unsigned long) __ptr64" ?SetVariableAttribute@SAMOfflineHandleRegistry@@AEAAJKKPEAEK@Z
0x18001FCF8: "NtProductType" ??_C@_1BM@IEOGMDOM@?$AAN?$AAt?$AAP?$AAr?$AAo?$AAd?$AAu?$AAc?$AAt?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x18001FE48: "(Bytes % sizeof(WCHAR)) == 0" ??_C@_0BN@OMEDCNLD@?$CIBytes?5?$CF?5sizeof?$CIWCHAR?$CJ?$CJ?5?$DN?$DN?50?$AA@
0x180013F50: "void __cdecl RemoveKeyFromList(struct _LIST_ENTRY * __ptr64)" ?RemoveKeyFromList@@YAXPEAU_LIST_ENTRY@@@Z
0x18001E888: "__cdecl _imp_NtOpenKey" __imp_NtOpenKey
0x180020130: "RtlConcatenateLUnicodeStrings" ??_C@_0BO@PEMKFOPH@RtlConcatenateLUnicodeStrings?$AA@
0x18001E578: "__cdecl _imp_UuidToStringW" __imp_UuidToStringW
0x18001E830: "__cdecl _imp_malloc" __imp_malloc
0x18001F6C0: "Domains\%s" ??_C@_1BG@MDBPOJND@?$AAD?$AAo?$AAm?$AAa?$AAi?$AAn?$AAs?$AA?2?$AA?$CF?$AAs?$AA?$AA@
0x18001E840: "__cdecl _imp__purecall" __imp__purecall
0x180024DD0: g_NTSTATUS_to_break_on
0x18000F340: "long __cdecl SamOfflineConnect(unsigned short * __ptr64,void * __ptr64 * __ptr64)" ?SamOfflineConnect@@YAJPEAGPEAPEAX@Z
0x18001F5E8: "ProductSuite" ??_C@_1BK@HJNBLNLJ@?$AAP?$AAr?$AAo?$AAd?$AAu?$AAc?$AAt?$AAS?$AAu?$AAi?$AAt?$AAe?$AA?$AA@
0x1800224A0: "__cdecl _IMPORT_DESCRIPTOR_RPCRT4" __IMPORT_DESCRIPTOR_RPCRT4
0x18001F540: "ControlSet001\Control\ProductOpt" ??_C@_1EK@IGONOPFD@?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA0?$AA0?$AA1?$AA?2?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AA?2?$AAP?$AAr?$AAo?$AAd?$AAu?$AAc?$AAt?$AAO?$AAp?$AAt@
0x18001EA40: "__cdecl _imp_RtlLengthSid" __imp_RtlLengthSid
0x18000C840: "public: static long __cdecl SAMOfflineAliasHandleRegistry::CreateNew(class SAMOfflineServerHandleRegistry * __ptr64,class SAMOfflineDomainHandleRegistry * __ptr64,struct _UNICODE_STRING * __ptr64,class SAMOfflineAliasHandleRegistry * __ptr64 * __ptr64,unsigned long * __ptr64)" ?CreateNew@SAMOfflineAliasHandleRegistry@@SAJPEAVSAMOfflineServerHandleRegistry@@PEAVSAMOfflineDomainHandleRegistry@@PEAU_UNICODE_STRING@@PEAPEAV1@PEAK@Z
0x180002C90: "long __cdecl SamOfflineConvertByteArrayToAttrVal(struct _SAM_BYTE_ARRAY * __ptr64,struct _ATTRVAL * __ptr64)" ?SamOfflineConvertByteArrayToAttrVal@@YAJPEAU_SAM_BYTE_ARRAY@@PEAU_ATTRVAL@@@Z
0x18001E340: g_LUNICODE_STRING_HKCC_bslash_
0x18001F738: "LMPASSWORD" ??_C@_0L@JOEFGIDC@LMPASSWORD?$AA@
0x180001644: "protected: long __cdecl SAMOfflineHandleRegistry::SetUlongArrayAttribute(unsigned long,unsigned long * __ptr64,unsigned long,unsigned long) __ptr64" ?SetUlongArrayAttribute@SAMOfflineHandleRegistry@@IEAAJKPEAKKK@Z
0x18001E590: RPCRT4_NULL_THUNK_DATA
0x18001E790: "__cdecl _imp_LookupPrivilegeValueW" __imp_LookupPrivilegeValueW
0x18001D580: "__cdecl _report_gsfailure" __report_gsfailure
0x18001A9A8: RtlInitLUnicodeStringFromNullTerminatedString
0x180024DF8: "__cdecl _native_startup_state" __native_startup_state
0x18001F488: "\SYSTEM" ??_C@_1BA@DDCDPKJF@?$AA?2?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?$AA@
0x18001A054: "private: long __cdecl SamOfflineDBOptions::QueryBoolOptions(class IOfflineKey * __ptr64) __ptr64" ?QueryBoolOptions@SamOfflineDBOptions@@AEAAJPEAVIOfflineKey@@@Z
0x180024CC8: "void * __ptr64 __ptr64 SamOfflineNetworkSid" ?SamOfflineNetworkSid@@3PEAXEA
0x180002DE0: "long __cdecl SamOfflineConvertUlongArrayToAttrValBlock(struct _SAM_ULONG_ARRAY * __ptr64,struct _ATTRVALBLOCK * __ptr64)" ?SamOfflineConvertUlongArrayToAttrValBlock@@YAJPEAU_SAM_ULONG_ARRAY@@PEAU_ATTRVALBLOCK@@@Z
0x18001F938: "winlogon.exe" ??_C@_1BK@HLMOGDAH@?$AAw?$AAi?$AAn?$AAl?$AAo?$AAg?$AAo?$AAn?$AA?4?$AAe?$AAx?$AAe?$AA?$AA@
0x18001BD10: SafeAllocaInitialize
0x180022658: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-cryptoapi-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-cryptoapi-l1-1-0
0x1800206F0: "SHA256" ??_C@_1O@HECGKAIN@?$AAS?$AAH?$AAA?$AA2?$AA5?$AA6?$AA?$AA@
0x180005478: "public: static int __cdecl SAMOfflineServerHandleRegistry::IsAccountDomain(unsigned short * __ptr64)" ?IsAccountDomain@SAMOfflineServerHandleRegistry@@SAHPEAG@Z
0x180012300: "public: virtual long __cdecl CWin32OfflineKey::OpenExistingKey(struct _UNICODE_STRING * __ptr64,unsigned long,class IOfflineKey * __ptr64 * __ptr64) __ptr64" ?OpenExistingKey@CWin32OfflineKey@@UEAAJPEAU_UNICODE_STRING@@KPEAPEAVIOfflineKey@@@Z
0x18001F510: "%s%s___(%s)___%s" ??_C@_1CC@FPHLLIBI@?$AA?$CF?$AAs?$AA?$CF?$AAs?$AA_?$AA_?$AA_?$AA?$CI?$AA?$CF?$AAs?$AA?$CJ?$AA_?$AA_?$AA_?$AA?$CF?$AAs?$AA?$AA@
0x180024C40: "struct _LM_OWF_PASSWORD SamOfflineNullLmOwfPassword" ?SamOfflineNullLmOwfPassword@@3U_LM_OWF_PASSWORD@@A
0x180009B5C: "private: long __cdecl SAMOfflineDomainHandleRegistry::InitializePEK(void) __ptr64" ?InitializePEK@SAMOfflineDomainHandleRegistry@@AEAAJXZ
0x18001EA88: "__cdecl _imp_NtUnloadKey2" __imp_NtUnloadKey2
0x18001BDC8: InternalVerifyStackAvailable
0x180022644: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-memory-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-memory-l1-1-0
0x1800205A8: "RtlReallocateLBlob" ??_C@_0BD@MBNOBJLB@RtlReallocateLBlob?$AA@
0x180020150: "(SourceCount == 0) || (Sources !" ??_C@_0CF@PIIBDOBJ@?$CISourceCount?5?$DN?$DN?50?$CJ?5?$HM?$HM?5?$CISources?5?$CB@
0x180024BC0: "struct _UNICODE_STRING SampCombinedAttributeName" ?SampCombinedAttributeName@@3U_UNICODE_STRING@@A
0x180012C80: "public: virtual long __cdecl CWin32OfflineKey::EnumerateKeys(unsigned long * __ptr64,unsigned short * __ptr64 * __ptr64 * __ptr64) __ptr64" ?EnumerateKeys@CWin32OfflineKey@@UEAAJPEAKPEAPEAPEAG@Z
0x18001E588: "__cdecl _imp_UuidCreate" __imp_UuidCreate
0x18001E8A8: "__cdecl _imp_NtCreateKey" __imp_NtCreateKey
0x18001EA38: "__cdecl _imp_RtlSetSaclSecurityDescriptor" __imp_RtlSetSaclSecurityDescriptor
0x18001EA28: "__cdecl _imp_RtlInitializeSid" __imp_RtlInitializeSid
0x18001CDCC: SystemFunction006
0x18001CEB0: SystemFunction007
0x180024AB0: "struct _OFFLINESAM_OBJECT_INFO * OfflineSamObjectInfo" ?OfflineSamObjectInfo@@3PAU_OFFLINESAM_OBJECT_INFO@@A
0x18001EA18: "__cdecl _imp_RtlSetDaclSecurityDescriptor" __imp_RtlSetDaclSecurityDescriptor
0x18000666C: "private: long __cdecl SAMOfflineServerHandleRegistry::UnloadSystemHive(void) __ptr64" ?UnloadSystemHive@SAMOfflineServerHandleRegistry@@AEAAJXZ
0x18002261C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0
0x18001EE48: "Groups" ??_C@_1O@HELFAGNI@?$AAG?$AAr?$AAo?$AAu?$AAp?$AAs?$AA?$AA@
0x18001E388: g_LUNICODE_STRING_HKCR_bslash_
0x180024CC0: "void * __ptr64 __ptr64 SamOfflineEnterpriseDomainControllersSid" ?SamOfflineEnterpriseDomainControllersSid@@3PEAXEA
0x18001F450: "samsrv.dll" ??_C@_1BG@OGKAJKFF@?$AAs?$AAa?$AAm?$AAs?$AAr?$AAv?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x1800089BC: "public: long __cdecl SAMOfflineDomainHandleRegistry::OpenAlias(unsigned long,class SAMOfflineAliasHandleRegistry * __ptr64 * __ptr64) __ptr64" ?OpenAlias@SAMOfflineDomainHandleRegistry@@QEAAJKPEAPEAVSAMOfflineAliasHandleRegistry@@@Z
0x180019FD0: WPP_SF_Sd
0x180003BD8: WPP_SF_SD
0x1800203B8: "PathOut->Length != 0" ??_C@_0BF@HCLJNMOH@PathOut?9?$DOLength?5?$CB?$DN?50?$AA@
0x18001E828: "__cdecl _imp_free" __imp_free
0x180003C54: WPP_SF_SZ
0x18001D760: "__cdecl IsNonwritableInCurrentImage" _IsNonwritableInCurrentImage
0x18001E6D0: api-ms-win-core-synch-l1-2-0_NULL_THUNK_DATA
0x180020670: "RtlCompareEncodedLBlobs" ??_C@_0BI@GPFMMLMN@RtlCompareEncodedLBlobs?$AA@
0x180024CE8: "union _LARGE_INTEGER SamOfflineNeverDeltaTime" ?SamOfflineNeverDeltaTime@@3T_LARGE_INTEGER@@A
0x18000E390: "private: virtual void * __ptr64 __cdecl SAMOfflineGroupHandleRegistry::`scalar deleting destructor'(unsigned int) __ptr64" ??_GSAMOfflineGroupHandleRegistry@@EEAAPEAXI@Z
0x18001FE70: "String->Buffer = reinterpret_cas" ??_C@_0EN@BBOBNKDL@String?9?$DOBuffer?5?$DN?5reinterpret_cas@
0x180001270: "public: virtual void * __ptr64 __cdecl SAMOfflineHandleBase::`vector deleting destructor'(unsigned int) __ptr64" ??_ESAMOfflineHandleBase@@UEAAPEAXI@Z
0x18001E660: "__cdecl _imp_OpenProcessToken" __imp_OpenProcessToken
0x18000E190: "private: __cdecl SAMOfflineAliasHandleRegistry::SAMOfflineAliasHandleRegistry(class SystemToken * __ptr64,class SAMOfflineHandleScope * __ptr64) __ptr64" ??0SAMOfflineAliasHandleRegistry@@AEAA@PEAVSystemToken@@PEAVSAMOfflineHandleScope@@@Z
0x180024D08: "int gfGlobalsInitialized" ?gfGlobalsInitialized@@3HA
0x180020820: g_RGWCH_HKEY_under_CURRENT_under_USER_bslash_
0x18001B3F0: RtlConvertNtFilePathToWin32FilePath
0x180024470: KE_AESBlockSize
0x18001E6C0: api-ms-win-core-synch-l1-1-0_NULL_THUNK_DATA
0x180022608: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0
0x180003B70: WPP_SF_S
0x180008B3C: "public: long __cdecl SAMOfflineDomainHandleRegistry::CreateAlias(struct _UNICODE_STRING * __ptr64,class SAMOfflineAliasHandleRegistry * __ptr64 * __ptr64,unsigned long * __ptr64) __ptr64" ?CreateAlias@SAMOfflineDomainHandleRegistry@@QEAAJPEAU_UNICODE_STRING@@PEAPEAVSAMOfflineAliasHandleRegistry@@PEAK@Z
0x18001D9BA: memset
0x18002266C: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x18001E418: g_LUNICODE_STRING__bslash_Registry_bslash_Machine_bslash_
0x180024C0C: "unsigned long gulSilKeyCount" ?gulSilKeyCount@@3KA
0x180024A98: "struct _UNICODE_STRING SampNameDomainGroupsNames" ?SampNameDomainGroupsNames@@3U_UNICODE_STRING@@A

[JEB Decompiler by PNF Software]