Generated by JEB on 2019/08/01

PE: C:\Windows\System32\drivers\wof.sys Base=0x1C0000000 SHA-256=E80B5FF710AF9F6502822470A5FE6EED21889F039052B2E8CAC4866F74500838
PDB: wof.pdb GUID={C0902522-83CA-261C-46C948FBCEBAE260} Age=1

853 located named symbols:
0x1C002948C: WimpFSFBreakForIntegrityFailure
0x1C0019090: "__cdecl _imp_FltAllocatePoolAlignedWithTag" __imp_FltAllocatePoolAlignedWithTag
0x1C0035374: BiIsVolumePartitionInformationRetained
0x1C00105D0: WPP_e594b7462c2d35cb2a973928bcebc8ef_Traceguids
0x1C00196E8: "__cdecl _imp_ExAcquireFastMutexUnsafe" __imp_ExAcquireFastMutexUnsafe
0x1C00319C4: FileProvFinalizeCompress
0x1C0002394: "__cdecl TlgDefineProvider_annotation__TlgWofTelemetryProviderProv" _TlgDefineProvider_annotation__TlgWofTelemetryProviderProv
0x1C0003A90: WppClassicProviderCallback
0x1C00194B8: "__cdecl _imp_ZwSetInformationThread" __imp_ZwSetInformationThread
0x1C001CCF0: WofInstanceTeardownStart
0x1C0019698: "__cdecl _imp_KeExpandKernelStackAndCalloutEx" __imp_KeExpandKernelStackAndCalloutEx
0x1C002EE34: WimFSFFindStreamResource
0x1C00195F8: "__cdecl _imp_SeCaptureSubjectContext" __imp_SeCaptureSubjectContext
0x1C0019648: "__cdecl _imp_ExAcquireFastMutex" __imp_ExAcquireFastMutex
0x1C00140B8: FileProvXPressAlgorithm
0x1C002DCE4: WimFSFLoadOffsetTableHash
0x1C00106C0: "WIMH." ??_C@_1M@LPBICBEJ@?$AAW?$AAI?$AAM?$AAH?$AA?4?$AA?$AA@
0x1C0008710: initialise_decoder_bitbuf
0x1C0022DF0: WofPreFsctlUpdateOverlay
0x1C00195B0: "__cdecl _imp_KeAreAllApcsDisabled" __imp_KeAreAllApcsDisabled
0x1C001CD90: WofInstanceTeardownComplete
0x1C00192E8: "__cdecl _imp_RtlFreeUnicodeString" __imp_RtlFreeUnicodeString
0x1C0004B4C: WPP_SF_diddd
0x1C000F829: ZwOpenFile
0x1C001CDD0: WofCleanupContext
0x1C0010060: g_IntegrityFilesKeyName
0x1C00191A0: "__cdecl _imp_FltGetFileNameInformation" __imp_FltGetFileNameInformation
0x1C0022424: WofPreFsctlSetSparse
0x1C0014098: "__cdecl _security_cookie_complement" __security_cookie_complement
0x1C0024F70: WppTraceCallback
0x1C002ABFC: WimpFSFBackgroundValidateNextBlocks
0x1C00196D8: "__cdecl _imp_ObfDereferenceObject" __imp_ObfDereferenceObject
0x1C0003284: WofTraceRedirectedFileIo
0x1C0006F8C: FileProvOpenBackingObject
0x1C0004764: WPP_SF_iZZZd
0x1C0030DC0: FileProvCbQueryStreamSize
0x1C00316F4: FileProvInitializeCompress
0x1C0022A34: WofPreFsctlAddOverlay
0x1C0010898: "\System Volume Information\" ??_C@_1DI@MPNMLMLI@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?5?$AAV?$AAo?$AAl?$AAu?$AAm?$AAe?$AA?5?$AAI?$AAn?$AAf?$AAo?$AAr?$AAm?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?2?$AA?$AA@
0x1C00011A0: WPP_SF_lq
0x1C000F817: ZwDeviceIoControlFile
0x1C0014FCC: WimPostedReads
0x1C00107F0: WofIntegrityFileNotReadyEventId
0x1C001D954: WofFindOrCreateHandleContext
0x1C0019588: "__cdecl _imp_ExInitializeNPagedLookasideList" __imp_ExInitializeNPagedLookasideList
0x1C0010B88: WPP_004ebcb65b723d92bb838c08a9c8e7c2_Traceguids
0x1C000E1C0: A_SHAInit
0x1C0010C90: enc_extra_bits
0x1C0014FB0: g_PagesValidated
0x1C0008BB8: read_aligned_offset_tree
0x1C0023E84: WofPrePnpSurpriseRemove
0x1C0019360: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x1C00278A0: WimCbValidateReparseData
0x1C00338F8: BiCreateFileDeviceElement
0x1C000FA70: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x1C001095C: "SYNC" ??_C@_04FBDLEBNN@SYNC?$AA@
0x1C0006E78: FileProvReleaseReadCompletionContext
0x1C0010930: WPP_8acf356e32a731a921e8366d4f139d2c_Traceguids
0x1C00207F0: WofPreSetInfoCallback
0x1C0010598: "AutoAttach" ??_C@_1BG@HDHIKABP@?$AAA?$AAu?$AAt?$AAo?$AAA?$AAt?$AAt?$AAa?$AAc?$AAh?$AA?$AA@
0x1C0019118: "__cdecl _imp_FltGetFileNameInformationUnsafe" __imp_FltGetFileNameInformationUnsafe
0x1C0011168: "__cdecl TraceLoggingMetadata" _TraceLoggingMetadata
0x1C00190F8: "__cdecl _imp_FltWriteFile" __imp_FltWriteFile
0x1C00190B0: "__cdecl _imp_FltGetIoPriorityHintFromCallbackData" __imp_FltGetIoPriorityHintFromCallbackData
0x1C002E3D8: WimFSFInitializeDecompressionWorkspace
0x1C0005830: WimFSFCompleteRead
0x1C0019660: "__cdecl _imp_ExpInterlockedPushEntrySList" __imp_ExpInterlockedPushEntrySList
0x1C0019000: "__cdecl _imp_FltGetRoutineAddress" __imp_FltGetRoutineAddress
0x1C00102A8: "\Program Files\" ??_C@_1CA@MHAOAMEC@?$AA?2?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AA?5?$AAF?$AAi?$AAl?$AAe?$AAs?$AA?2?$AA?$AA@
0x1C00195A8: "__cdecl _imp_RtlDecompressFragment" __imp_RtlDecompressFragment
0x1C0010548: "ZwUpdateWnfStateData" ??_C@_1CK@IDDKECCL@?$AAZ?$AAw?$AAU?$AAp?$AAd?$AAa?$AAt?$AAe?$AAW?$AAn?$AAf?$AAS?$AAt?$AAa?$AAt?$AAe?$AAD?$AAa?$AAt?$AAa?$AA?$AA@
0x1C00239D0: WofPostFsctlSetEncryption
0x1C00107E0: WofIntegrityFileOpenEventId
0x1C00195A0: "__cdecl _imp_RtlDecompressBufferEx" __imp_RtlDecompressBufferEx
0x1C00196F0: "__cdecl _imp_ObDereferenceObjectDeferDelete" __imp_ObDereferenceObjectDeferDelete
0x1C00102A0: "" ??_C@_00CNPNBAHC@?$AA@
0x1C00193B8: "__cdecl _imp_ExAllocateTimer" __imp_ExAllocateTimer
0x1C0035460: BiGetVolumeDiskExtentsInformation
0x1C0010440: "WmiTraceMessage" ??_C@_1CA@OFIBBPKJ@?$AAW?$AAm?$AAi?$AAT?$AAr?$AAa?$AAc?$AAe?$AAM?$AAe?$AAs?$AAs?$AAa?$AAg?$AAe?$AA?$AA@
0x1C0019438: "__cdecl _imp_KeQueryPriorityThread" __imp_KeQueryPriorityThread
0x1C002B1FC: WimpValidateOverlayConfig
0x1C000A9A0: LZX_EncodeFlush
0x1C0030910: FileProvCbMountVolume
0x1C0019680: "__cdecl _imp_ExInitializeRundownProtection" __imp_ExInitializeRundownProtection
0x1C0001520: WPP_SF_qll
0x1C00109B8: "Wim" ??_C@_17CDIJKLAF@?$AAW?$AAi?$AAm?$AA?$AA@
0x1C0019220: "__cdecl _imp_FltAllocateContext" __imp_FltAllocateContext
0x1C0006FDC: WPP_SF_iqD
0x1C0028960: WimFSFDestroyIntegrity
0x1C0001754: WPP_SF_dDsZq
0x1C0004DB8: WPP_SF_iZd
0x1C0019720: "__cdecl _imp_wcschr" __imp_wcschr
0x1C0019550: "__cdecl _imp_IoQueueWorkItemEx" __imp_IoQueueWorkItemEx
0x1C0026B30: WimCbCreateLinkAccessCheck
0x1C0027520: WimCbQueryLockVolume
0x1C0001008: "__cdecl TlgWrite" _TlgWrite
0x1C0019510: "__cdecl _imp_KeSetPriorityThread" __imp_KeSetPriorityThread
0x1C0010944: "IS NOT" ??_C@_06CGABDINF@IS?5NOT?$AA@
0x1C0019748: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x1C0019128: "__cdecl _imp_FltCreateFileEx2" __imp_FltCreateFileEx2
0x1C00054DC: WPP_SF_iqDl
0x1C00196B8: "__cdecl _imp_ExDeletePagedLookasideList" __imp_ExDeletePagedLookasideList
0x1C00192C8: "__cdecl _imp_RtlEnumerateGenericTableAvl" __imp_RtlEnumerateGenericTableAvl
0x1C0020A80: WofPostSetInfoCallback
0x1C00193D0: "__cdecl _imp_ExQueueWorkItem" __imp_ExQueueWorkItem
0x1C00194D0: "__cdecl _imp_MmUnmapViewOfSection" __imp_MmUnmapViewOfSection
0x1C0019728: "__cdecl _imp__wcsnicmp" __imp__wcsnicmp
0x1C0029C50: WimpFSFIntegrityReportIntegrityFileEventWithoutStatus
0x1C00191C0: "__cdecl _imp_FltSetTransactionContext" __imp_FltSetTransactionContext
0x1C0009CA0: make_table
0x1C0023418: WofPreFsctlStartIntegrity
0x1C0019420: "__cdecl _imp_ExAcquirePushLockSharedEx" __imp_ExAcquirePushLockSharedEx
0x1C0020350: WofPostQueryInfoCallback
0x1C002F1E4: WimFSFReadWimResourceSwitchStacks
0x1C0019318: "__cdecl _imp_MmGetSystemRoutineAddress" __imp_MmGetSystemRoutineAddress
0x1C0030520: FileProvCbCleanupStreamContext
0x1C000A9E4: opt_encode_top
0x1C0019058: "__cdecl _imp_FltQueueDeferredIoWorkItem" __imp_FltQueueDeferredIoWorkItem
0x1C0019470: "__cdecl _imp_ZwQueryInformationThread" __imp_ZwQueryInformationThread
0x1C00105B0: "FltpTraceRedirectedFileIo" ??_C@_0BK@CBFHDNCD@FltpTraceRedirectedFileIo?$AA@
0x1C00270D0: WimCbNotifySectionCreation
0x1C0002DD8: WofGetAttachVolumeFromPathName
0x1C002EC78: WimFSFGenerateHash
0x1C0019590: "__cdecl _imp_KeInitializeMutex" __imp_KeInitializeMutex
0x1C00070E0: FileProvReadCompressedCallout
0x1C0006D84: FileProvInitializeCompletionContextOnStack
0x1C000DB2C: output_bits
0x1C0019098: "__cdecl _imp_FltIsIoCanceled" __imp_FltIsIoCanceled
0x1C00195C0: "__cdecl _imp_KeInitializeTimerEx" __imp_KeInitializeTimerEx
0x1C00110D8: VmbFsInterfaceTypeGuid
0x1C000DE1C: make_tree
0x1C0015F00: WimSqmDpc
0x1C0005AE0: WimFSFReadWimResourceOnNewStackExtendedCompletion
0x1C000F7BD: ExAllocatePoolWithTag
0x1C0019260: "__cdecl _imp_BCryptCreateHash" __imp_BCryptCreateHash
0x1C002D20C: WimFSFLockSystemBackingVolume
0x1C002B0C0: WimPerformRenameWorker
0x1C0010240: WPP_66c7aa02253e37255c704c74d5d07e74_Traceguids
0x1C0019628: "__cdecl _imp_KeWaitForSingleObject" __imp_KeWaitForSingleObject
0x1C0019300: "__cdecl _imp_RtlAppendUnicodeStringToString" __imp_RtlAppendUnicodeStringToString
0x1C0007C90: FileProvReadCompressedCompletionWorker
0x1C0020F60: WofPostFileSystemControlCallback
0x1C0019200: "__cdecl _imp_FltSetInstanceContext" __imp_FltSetInstanceContext
0x1C0015EE8: s_dwProcessHashValue
0x1C00052EC: WimFSFInitializeCompletionContextOnStack
0x1C0025CB0: TlgUnregisterAggregateProvider
0x1C0026D40: WimCbInitializeVolumeContext
0x1C0010920: WPP_860c5a9d9cf03b794351b102246ce8c7_Traceguids
0x1C0004608: WPP_SF_ZZd
0x1C0029210: WimpFSFMapIntegrityHashes
0x1C00043C8: TlgAggregateFlush
0x1C0014200: WofGlobal
0x1C0006C80: FileProvAllocateReadParameters
0x1C0015FB8: g_WimIntegrityMultiHashObjectLength
0x1C0022544: WofPreFsctlQueryAllocatedRanges
0x1C00327F8: FileProvReadCompressedOnNewStack
0x1C0010188: "__cdecl _guard_iat_table" __guard_iat_table
0x1C0019060: "__cdecl _imp_FltFreePoolAlignedWithTag" __imp_FltFreePoolAlignedWithTag
0x1C0005160: WimFSFInitializeConfigLock
0x1C000FA80: memcpy
0x1C0026D80: WimCbLocateObject
0x1C0010AF8: WimOneSecond
0x1C0020B20: WofPreFileSystemControlCallback
0x1C00322B0: FileProvCompressFile
0x1C00195B8: "__cdecl _imp_KeInitializeDpc" __imp_KeInitializeDpc
0x1C0019330: "__cdecl _imp_IoGetCurrentProcess" __imp_IoGetCurrentProcess
0x1C00350B8: BiGetPartitionInformation
0x1C0019250: "__cdecl _imp_FltGetStreamHandleContext" __imp_FltGetStreamHandleContext
0x1C00140D0: pfnWppGetVersion
0x1C00278E0: WimCbCountDependentVolumes
0x1C000F7E1: "__cdecl _C_specific_handler" __C_specific_handler
0x1C00194E8: "__cdecl _imp_IofCallDriver" __imp_IofCallDriver
0x1C002D890: WimFSFRemountWim
0x1C00276C0: WimCbQuerySectionCreation
0x1C00140A8: SQM_ADD_STREAMROW
0x1C0006B70: FileProvSimpleCompletionRoutine
0x1C002A76C: WimFSFStartBackgroundValidation
0x1C0015FC8: g_WimIntegrityEtwEventHandle
0x1C0026750: WimCbEnumOverlay
0x1C000FA80: memmove
0x1C0007EA8: LZX_DecodeNewGroup
0x1C00072E0: FileProvReadCompressedOnNewStackExtendedCompletion
0x1C000E4E0: SHATransform
0x1C00194D8: "__cdecl _imp_RtlFindNextForwardRunClear" __imp_RtlFindNextForwardRunClear
0x1C00196C0: "__cdecl _imp_RtlCopyUnicodeString" __imp_RtlCopyUnicodeString
0x1C00036B0: WofProviderFsctlFreeRoutine
0x1C002D348: WimFSFOpenWimFile
0x1C0019158: "__cdecl _imp_FltLockUserBuffer" __imp_FltLockUserBuffer
0x1C000F87C: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x1C0019388: "__cdecl _imp_KeIsExecutingDpc" __imp_KeIsExecutingDpc
0x1C002CC2C: WimUpdateOverlayConfig
0x1C00069DC: WimReportSqmData
0x1C0019498: "__cdecl _imp_IoGetDeviceObjectPointer" __imp_IoGetDeviceObjectPointer
0x1C00190E8: "__cdecl _imp_FltCreateFileEx" __imp_FltCreateFileEx
0x1C00190D8: "__cdecl _imp_FltRegisterFilter" __imp_FltRegisterFilter
0x1C0019190: "__cdecl _imp_FltReleaseFileNameInformation" __imp_FltReleaseFileNameInformation
0x1C001F810: WofMungeDirectoryEnumerateWithShortname
0x1C00191E8: "__cdecl _imp_FltDeleteInstanceContext" __imp_FltDeleteInstanceContext
0x1C002A4C0: WimpFSFBitLockerCheckWorker
0x1C0019490: "__cdecl _imp_IoBuildDeviceIoControlRequest" __imp_IoBuildDeviceIoControlRequest
0x1C00191E0: "__cdecl _imp_FltSetFileContext" __imp_FltSetFileContext
0x1C0025B0C: TlgRegisterAggregateProvider
0x1C0003B70: "void __cdecl TlgAggregateInternalFlushTimerCallbackKernelMode(struct _EX_TIMER * __ptr64,void * __ptr64)" ?TlgAggregateInternalFlushTimerCallbackKernelMode@@YAXPEAU_EX_TIMER@@PEAX@Z
0x1C000E340: A_SHAFinal
0x1C00195F0: "__cdecl _imp_KeQueryActiveProcessorCountEx" __imp_KeQueryActiveProcessorCountEx
0x1C00191F8: "__cdecl _imp_FltClose" __imp_FltClose
0x1C00192F8: "__cdecl _imp_RtlDeleteElementGenericTableAvl" __imp_RtlDeleteElementGenericTableAvl
0x1C0019488: "__cdecl _imp_PsInitialSystemProcess" __imp_PsInitialSystemProcess
0x1C00222BC: WofPreFsctlSetReparsePoint
0x1C0015FE0: WPP_MAIN_CB
0x1C0019650: "__cdecl _imp_ObfReferenceObject" __imp_ObfReferenceObject
0x1C0019518: "__cdecl _imp_KeUnstackDetachProcess" __imp_KeUnstackDetachProcess
0x1C001CA10: WofInstanceSetup
0x1C0006420: WimFSFReadWimCompletion
0x1C000B6A8: comp_alloc_compress_memory
0x1C0001588: WPP_SF_qllLL
0x1C0014FB8: g_PagesFaultedOnAgain
0x1C000F805: ZwClose
0x1C00192F0: "__cdecl _imp_SeTokenIsAdmin" __imp_SeTokenIsAdmin
0x1C0014078: CompressedStream
0x1C0005054: WimFSFAllocateXpress
0x1C00190A8: "__cdecl _imp_FltAcquirePushLockExclusiveEx" __imp_FltAcquirePushLockExclusiveEx
0x1C00106D0: "\System Volume Information" ??_C@_1DG@DJBEOOIC@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?5?$AAV?$AAo?$AAl?$AAu?$AAm?$AAe?$AA?5?$AAI?$AAn?$AAf?$AAo?$AAr?$AAm?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x1C0019028: "__cdecl _imp_FltPerformAsynchronousIo" __imp_FltPerformAsynchronousIo
0x1C0015000: FileProvCompressWorkitemsLookaside
0x1C001F3F0: WofPreQueryOpenCallback
0x1C0019668: "__cdecl _imp_ExReleaseFastMutex" __imp_ExReleaseFastMutex
0x1C00023A0: PathClassification
0x1C0019348: "__cdecl _imp_FsRtlIsNtstatusExpected" __imp_FsRtlIsNtstatusExpected
0x1C0006570: WimFSFReadWimCompletionWorker
0x1C000113C: WPP_SF_lLD
0x1C0019690: "__cdecl _imp_ExReleaseFastMutexUnsafe" __imp_ExReleaseFastMutexUnsafe
0x1C0010AD0: "CEIPEnable" ??_C@_1BG@OLBJDGGK@?$AAC?$AAE?$AAI?$AAP?$AAE?$AAn?$AAa?$AAb?$AAl?$AAe?$AA?$AA@
0x1C000F7F3: RtlInitUnicodeString
0x1C00193B0: "__cdecl _imp_EtwSetInformation" __imp_EtwSetInformation
0x1C0010220: WPP_ThisDir_CTLGUID_WofTrace
0x1C001DCF0: WofPreCreateCallback
0x1C001DA44: WofMarkProviderHandle
0x1C00107B0: "SEI" ??_C@_17PIPNFINL@?$AAS?$AAE?$AAI?$AA?$AA@
0x1C0006D6C: FileProvReleaseReadCbReadParameters
0x1C00109C0: "SqmInterval" ??_C@_1BI@KGIBNFL@?$AAS?$AAq?$AAm?$AAI?$AAn?$AAt?$AAe?$AAr?$AAv?$AAa?$AAl?$AA?$AA@
0x1C00196B0: "__cdecl _imp_ExAllocatePoolWithTag" __imp_ExAllocatePoolWithTag
0x1C0026280: WimCbUpdateOverlay
0x1C0002250: WofPreWriteCallback
0x1C000A7B0: LZX_EncodeInit
0x1C000353C: WofLocateInNamedScope
0x1C0029968: WimpFSFIntegrityReportReadFailure
0x1C00306A0: FileProvCbHideStream
0x1C002BC38: WimReadOverlayConfig
0x1C0019620: "__cdecl _imp_MmIsThisAnNtAsSystem" __imp_MmIsThisAnNtAsSystem
0x1C0002B74: WofGetRundownForUnknownFile
0x1C00140E0: pfnWppQueryTraceInformation
0x1C0015F98: WimDecompressionFailureCount
0x1C0037070: WofContexts
0x1C002EA7C: WimFSFDereferenceBackingFile
0x1C00190A0: "__cdecl _imp_FltCompletePendedPreOperation" __imp_FltCompletePendedPreOperation
0x1C000539C: WimFSFReferenceReadCompletionContext
0x1C0030AE0: FileProvCbRead
0x1C0002790: WofInflateTelemetry
0x1C0010910: WPP_54073bb9b07b3640c42139d78a0c9192_Traceguids
0x1C0019328: "__cdecl _imp_EtwWriteTransfer" __imp_EtwWriteTransfer
0x1C0019268: "__cdecl _imp_BCryptHashData" __imp_BCryptHashData
0x1C0019198: "__cdecl _imp_FltFsControlFile" __imp_FltFsControlFile
0x1C001020C: "" ??_C@_13BLAPAIAM@?$AA?$AI?$AA?$AA@
0x1C0029518: WimpFSFIntegrityValidateIntegrityFile
0x1C0019258: FLTMGR_NULL_THUNK_DATA
0x1C0004C48: WPP_SF_id
0x1C0004D08: WPP_SF_iZ
0x1C000F8E4: "__cdecl _GSHandlerCheck_SEH" __GSHandlerCheck_SEH
0x1C0019480: "__cdecl _imp_RtlAreBitsSet" __imp_RtlAreBitsSet
0x1C0019540: "__cdecl _imp__wcsicmp" __imp__wcsicmp
0x1C0010730: "CI\WIMIntegrity\DisableKdBreak" ??_C@_1DO@JKEJFLMJ@?$AAC?$AAI?$AA?2?$AAW?$AAI?$AAM?$AAI?$AAn?$AAt?$AAe?$AAg?$AAr?$AAi?$AAt?$AAy?$AA?2?$AAD?$AAi?$AAs?$AAa?$AAb?$AAl?$AAe?$AAK?$AAd?$AAB?$AAr?$AAe?$AAa?$AAk?$AA?$AA@
0x1C0019638: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x1C003300C: BiVerifyBootPartition
0x1C0024250: WofInflateFile
0x1C00141F0: RtlOsDeploymentStateFunc
0x1C000911C: fast_decode_verbatim_block
0x1C0023650: WofPreFsctlControlIntegrity
0x1C002E948: WimFSFDismountOverlay
0x1C0019178: "__cdecl _imp_FltCancelFileOpen" __imp_FltCancelFileOpen
0x1C0010980: "RtlQueryRegistryValuesEx" ??_C@_1DC@OAPHKEJN@?$AAR?$AAt?$AAl?$AAQ?$AAu?$AAe?$AAr?$AAy?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AAV?$AAa?$AAl?$AAu?$AAe?$AAs?$AAE?$AAx?$AA?$AA@
0x1C0022224: WofPreFsctlGetDeleteReparsePoint
0x1C0019688: "__cdecl _imp_KeLeaveCriticalRegion" __imp_KeLeaveCriticalRegion
0x1C000471C: WPP_SF_i
0x1C0010850: "WimOverlay.dat" ??_C@_1BO@CGDPOLFI@?$AAW?$AAi?$AAm?$AAO?$AAv?$AAe?$AAr?$AAl?$AAa?$AAy?$AA?4?$AAd?$AAa?$AAt?$AA?$AA@
0x1C0005E80: WimFSFDecompressWimResources
0x1C000F858: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x1C0019150: "__cdecl _imp_FltPerformSynchronousIo" __imp_FltPerformSynchronousIo
0x1C00140A0: WimSqmIsOptedIn
0x1C00191D0: "__cdecl _imp_FltGetTransactionContext" __imp_FltGetTransactionContext
0x1C0010250: "::$DATA" ??_C@_1BA@LCOICFNN@?$AA?3?$AA?3?$AA$?$AAD?$AAA?$AAT?$AAA?$AA?$AA@
0x1C0010420: "PsGetVersion" ??_C@_1BK@DHLDGJM@?$AAP?$AAs?$AAG?$AAe?$AAt?$AAV?$AAe?$AAr?$AAs?$AAi?$AAo?$AAn?$AA?$AA@
0x1C0019310: "__cdecl _imp_ExRundownCompleted" __imp_ExRundownCompleted
0x1C0015E80: FileProvNumberProcessors
0x1C0002394: "__cdecl TlgDefineProvider_annotation__TlgTlgAggregateInternalProviderProv" _TlgDefineProvider_annotation__TlgTlgAggregateInternalProviderProv
0x1C000A86C: LZX_Encode
0x1C0019670: "__cdecl _imp_ExpInterlockedPopEntrySList" __imp_ExpInterlockedPopEntrySList
0x1C0007640: FileProvDecompressChunks
0x1C0019558: "__cdecl _imp_IoFreeWorkItem" __imp_IoFreeWorkItem
0x1C0001DC0: WofPostReadCallback
0x1C002DD64: WimFSFAddFileOverlay
0x1C0019548: "__cdecl _imp_RtlCreateSystemVolumeInformationFolder" __imp_RtlCreateSystemVolumeInformationFolder
0x1C00102F8: "\Windows\" ??_C@_1BE@IBBOHCDA@?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?2?$AA?$AA@
0x1C0014F88: ExTryQueueWorkItemWrapper
0x1C0019278: "__cdecl _imp_BCryptCloseAlgorithmProvider" __imp_BCryptCloseAlgorithmProvider
0x1C001FAE4: WofFilterReparseEnumerate
0x1C0010970: WPP_af8d1777ffef33efb6fdb28ff3ab9541_Traceguids
0x1C0010200: "NULL" ??_C@_19CIJIHAKK@?$AAN?$AAU?$AAL?$AAL?$AA?$AA@
0x1C00140C0: pfnEtwRegisterClassicProvider
0x1C0019140: "__cdecl _imp_FltIsDirectory" __imp_FltIsDirectory
0x1C000E1F0: A_SHAUpdate
0x1C00191F0: "__cdecl _imp_FltGetDiskDeviceObject" __imp_FltGetDiskDeviceObject
0x1C0014170: WofBreakOnExternalFileCreation
0x1C0019130: "__cdecl _imp_FltEnumerateInstances" __imp_FltEnumerateInstances
0x1C0028150: WimCbUnload
0x1C003013C: WinSqmIsOptedIn
0x1C0027730: WimCbUpgradeReparseData
0x1C00313B0: FileProvInitializeCompression
0x1C00194C8: "__cdecl _imp_swprintf_s" __imp_swprintf_s
0x1C0019418: "__cdecl _imp_ExReleasePushLockSharedEx" __imp_ExReleasePushLockSharedEx
0x1C0019610: "__cdecl _imp_RtlGetVersion" __imp_RtlGetVersion
0x1C0010340: "\ProgramData\" ??_C@_1BM@EFJFHKJH@?$AA?2?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAD?$AAa?$AAt?$AAa?$AA?2?$AA?$AA@
0x1C0010278: "cached" ??_C@_06HEOINPBP@cached?$AA@
0x1C0019210: "__cdecl _imp_FltGetInstanceContext" __imp_FltGetInstanceContext
0x1C002DAD4: WimFSFInitializeOffsetTable
0x1C00192B0: "__cdecl _imp_IoGetSiloParameters" __imp_IoGetSiloParameters
0x1C0002ACC: WPP_SF_ZD
0x1C00016AC: WPP_SF_Zd
0x1C00067C0: WimSqmAddToStreamEx
0x1C00105F0: "\Device\CNG" ??_C@_1BI@HICLDAFN@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAC?$AAN?$AAG?$AA?$AA@
0x1C0015FA8: WimIntegityFailureCount
0x1C0019448: "__cdecl _imp_ExDeleteLookasideListEx" __imp_ExDeleteLookasideListEx
0x1C00194F0: "__cdecl _imp_RtlInitializeBitMap" __imp_RtlInitializeBitMap
0x1C0004574: WPP_SF_Z
0x1C0015180: CompressionScheme
0x1C0023128: WofPreFsctlSetEncryption
0x1C0019240: "__cdecl _imp_FltReleaseContext" __imp_FltReleaseContext
0x1C002FF70: WimSqmInitialize
0x1C0025400: "void __cdecl TlgAggregateInternalFlushWorkItemRoutineKernelMode(void * __ptr64)" ?TlgAggregateInternalFlushWorkItemRoutineKernelMode@@YAXPEAX@Z
0x1C001DC90: WofPreNetworkQueryOpen
0x1C0001680: WPP_SF_
0x1C0016020: Providers
0x1C001E7EC: WofCreateOpenContext
0x1C000BF30: get_block_stats
0x1C0026D30: FileProvCbInitializeVolumeContext
0x1C0002D18: WofFlushFile
0x1C00141F8: WofTelemetryRegistered
0x1C00140E8: pfnEtwUnregister
0x1C00191D8: "__cdecl _imp_FltSetStreamHandleContext" __imp_FltSetStreamHandleContext
0x1C0019068: "__cdecl _imp_FltAcquirePushLockSharedEx" __imp_FltAcquirePushLockSharedEx
0x1C0029E08: WimFSFQueryIntegrityStatusOfWim
0x1C00248BC: WofQueryVolumeRelativeName
0x1C0030580: FileProvCbCleanupVolumeContext
0x1C00052D4: WimFSFReleaseReadCbReadParameters
0x1C00105E0: WPP_6eb6364cf56f34db1d3e1ecded15ecad_Traceguids
0x1C0003660: WofProviderFsctlCompare
0x1C00140F0: WofBreakOnExternalFileOpen
0x1C0015F60: WimSqmLock
0x1C000A7A4: XpressDecodeAllocationSize
0x1C000F6F0: RtlStringCbPrintfW
0x1C001D060: WofTransactionNotificationCallback
0x1C0019460: "__cdecl _imp_RtlCheckRegistryKey" __imp_RtlCheckRegistryKey
0x1C0025DD0: WimCbAddOverlay
0x1C0007E08: LZX_GetDecodeBufferSize
0x1C0019368: "__cdecl _imp_RtlEqualUnicodeString" __imp_RtlEqualUnicodeString
0x1C0006E20: FileProvReferenceReadCompletionContext
0x1C001C010: WofFilterUnload
0x1C0027720: WimCbQueryStreamSizeCompressed
0x1C0033674: BiGetPartitionVhdFilePathFromUnicodeString
0x1C0010B00: Microsoft_Windows_SQM_Provider
0x1C0030E00: FileProvCbUpgradeReparseData
0x1C0004ED8: WPP_SF_qiZ
0x1C00192C0: "__cdecl _imp_SeReleaseSubjectContext" __imp_SeReleaseSubjectContext
0x1C0019038: "__cdecl _imp_FltInitializePushLock" __imp_FltInitializePushLock
0x1C0026D30: WimCbInitializeStreamContext
0x1C0019188: "__cdecl _imp_FltRemoveOpenReparseEntry" __imp_FltRemoveOpenReparseEntry
0x1C00249A4: WofRelativeStreamOpen
0x1C0010360: "RtlOsDeploymentState" ??_C@_1CK@LNHHCMBO@?$AAR?$AAt?$AAl?$AAO?$AAs?$AAD?$AAe?$AAp?$AAl?$AAo?$AAy?$AAm?$AAe?$AAn?$AAt?$AAS?$AAt?$AAa?$AAt?$AAe?$AA?$AA@
0x1C00194A8: "__cdecl _imp_KeStackAttachProcess" __imp_KeStackAttachProcess
0x1C0019598: "__cdecl _imp_KeReleaseMutex" __imp_KeReleaseMutex
0x1C0014FD4: DbgBackingFileFlushes
0x1C000CC98: encode_verbatim_block
0x1C0033F8C: BiConvertBootEnvironmentDeviceToNt
0x1C0019450: "__cdecl _imp_ZwDeviceIoControlFile" __imp_ZwDeviceIoControlFile
0x1C0019048: "__cdecl _imp_FltFlushBuffers" __imp_FltFlushBuffers
0x1C0036770: GsDriverEntry
0x1C0019740: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x1C0029440: WimFSFRevertIntegrityToSnapshot
0x1C00195E0: "__cdecl _imp_KeSetCoalescableTimer" __imp_KeSetCoalescableTimer
0x1C0019290: "__cdecl _imp_BCryptGetProperty" __imp_BCryptGetProperty
0x1C0026D30: FileProvCbInitializeStreamContext
0x1C0027960: WimCbStartIntegrity
0x1C002C188: WimBootEnvironmentDeviceToPath
0x1C0010270: "NULL" ??_C@_04HIBGFPH@NULL?$AA@
0x1C0019538: "__cdecl _imp_RtlAppendUnicodeToString" __imp_RtlAppendUnicodeToString
0x1C0027460: WimCbQueryDismountVolume
0x1C00194C0: "__cdecl _imp_ObReferenceObjectByHandle" __imp_ObReferenceObjectByHandle
0x1C00192E0: "__cdecl _imp_PsGetHostSilo" __imp_PsGetHostSilo
0x1C00191B0: "__cdecl _imp_FltAddOpenReparseEntry" __imp_FltAddOpenReparseEntry
0x1C0019270: "__cdecl _imp_BCryptDestroyHash" __imp_BCryptDestroyHash
0x1C0019050: "__cdecl _imp_FltAllocateDeferredIoWorkItem" __imp_FltAllocateDeferredIoWorkItem
0x1C00190E0: "__cdecl _imp_FltGetVolumeFromFileObject" __imp_FltGetVolumeFromFileObject
0x1C00228CC: WofPreFsctlDismountVolume
0x1C00265F0: WimCbSuspendOverlay
0x1C00051F4: WimFSFAllocateReadCbReadParameters
0x1C0003680: WofProviderFsctlAllocateRoutine
0x1C0010808: WofIntegrityInvalidBlockEventId
0x1C0002428: WofDeflateTelemetry
0x1C0014FC8: g_WimIntegrityDoNotBreakIntoKd
0x1C001094C: "PAGING" ??_C@_06EMLBPKBJ@PAGING?$AA@
0x1C00140A4: WimSqmInterval
0x1C00345B4: BiGetNtPartitionPath
0x1C0025A90: "void __cdecl TlgAggregateInternalRegisteredProviderEtwCallback(struct _GUID const * __ptr64,unsigned long,unsigned char,unsigned __int64,unsigned __int64,struct _EVENT_FILTER_DESCRIPTOR * __ptr64,void * __ptr64)" ?TlgAggregateInternalRegisteredProviderEtwCallback@@YAXPEBU_GUID@@KE_K1PEAU_EVENT_FILTER_DESCRIPTOR@@PEAX@Z
0x1C0019230: "__cdecl _imp_FltQueryDirectoryFile" __imp_FltQueryDirectoryFile
0x1C0007FF4: decode_data
0x1C0019528: "__cdecl _imp_RtlClearAllBits" __imp_RtlClearAllBits
0x1C000A858: LZX_EncodeNewGroup
0x1C0030EEC: FileProvInitializeCompressionScheme
0x1C0006B9C: FileProvWaitForWriteComplete
0x1C00048FC: WPP_SF_Dd
0x1C0003A34: WPP_SF_dd
0x1C002FE90: WimSqmInitializeWork
0x1C00194A0: "__cdecl _imp_RtlRunOnceExecuteOnce" __imp_RtlRunOnceExecuteOnce
0x1C0005000: WPP_SF_dq
0x1C0019478: "__cdecl _imp_RtlSetBit" __imp_RtlSetBit
0x1C0019340: "__cdecl _imp_FsRtlValidateReparsePointBuffer" __imp_FsRtlValidateReparsePointBuffer
0x1C0014000: WPP_GLOBAL_Control
0x1C00192A8: "__cdecl _imp_ZwQueryValueKey" __imp_ZwQueryValueKey
0x1C0010610: "\REGISTRY\MACHINE\SYSTEM\CURRENT" ??_C@_1KK@EFBGFDID@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?2?$AAC?$AAU?$AAR?$AAR?$AAE?$AAN?$AAT@
0x1C00252E0: "__cdecl TlgEnableCallback" _TlgEnableCallback
0x1C001D6B4: WofFindOrCreateFileContext
0x1C000A624: WIM_XpressDecode
0x1C00010B0: WPP_SF_D
0x1C00010F8: WPP_SF_d
0x1C0027A70: WimCbStopIntegrity
0x1C0028FA0: WimpFSFCalculateBlockIndices
0x1C0027710: WimCbQueryStreamSize
0x1C0015080: FileProvCompressContextLookaside
0x1C0006A90: WimSqmDpcRoutine
0x1C0010818: WofEventProviderId
0x1C00190C8: "__cdecl _imp_FltStartFiltering" __imp_FltStartFiltering
0x1C000CBA0: estimate_compressed_block_size
0x1C0019608: "__cdecl _imp_ExInitializePagedLookasideList" __imp_ExInitializePagedLookasideList
0x1C00371C0: WofOperationRegistration
0x1C0023794: WofPreFsctlQueryIntegrity
0x1C00053F4: WimFSFReleaseReadCompletionContext
0x1C0010A60: "\Registry\Machine\Software\Micro" ??_C@_1GO@NDGGKOHN@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x1C000DAC0: encode_trees
0x1C00107B8: "HEI" ??_C@_17NJCMHFKG@?$AAH?$AAE?$AAI?$AA?$AA@
0x1C0019030: "__cdecl _imp_FltAllocateGenericWorkItem" __imp_FltAllocateGenericWorkItem
0x1C0006B40: FileProvLzxOutput
0x1C0019678: "__cdecl _imp_RtlCompareUnicodeString" __imp_RtlCompareUnicodeString
0x1C000F780: "__cdecl _security_check_cookie" __security_check_cookie
0x1C0031480: FileProvCompressWorkItem
0x1C002D5BC: WimFSFValidateWim
0x1C00308C0: FileProvCbEncryptDecrypt
0x1C0026940: WimCbCleanupStreamContext
0x1C0019108: "__cdecl _imp_FltObjectDereference" __imp_FltObjectDereference
0x1C0007100: FileProvCompleteRead
0x1C0024DB0: WofLookupProviderFsctlCallback
0x1C0019764: "__cdecl _IMPORT_DESCRIPTOR_FLTMGR" __IMPORT_DESCRIPTOR_FLTMGR
0x1C0019750: "__cdecl _IMPORT_DESCRIPTOR_ntoskrnl" __IMPORT_DESCRIPTOR_ntoskrnl
0x1C00274C0: WimCbBacksSystemVolume
0x1C00269A0: WimCbCleanupVolumeContext
0x1C0019580: "__cdecl _imp_KeFreeCalloutStack" __imp_KeFreeCalloutStack
0x1C0010310: "\Windows.old\" ??_C@_1BM@DGAHGAIC@?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?4?$AAo?$AAl?$AAd?$AA?2?$AA?$AA@
0x1C0028768: WimpFSFIntegrityBuildContext
0x1C00273D0: WimCbQueryAutoAttachVolume
0x1C0011460: "__cdecl TraceLoggingMetadataEnd" _TraceLoggingMetadataEnd
0x1C0010B38: "MultiObjectLength" ??_C@_1CE@PIIJDGMM@?$AAM?$AAu?$AAl?$AAt?$AAi?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAL?$AAe?$AAn?$AAg?$AAt?$AAh?$AA?$AA@
0x1C002C9E4: WimRemoveOverlay
0x1C0014F98: ZwUpdateWnfStateDataWrapper
0x1C0019228: "__cdecl _imp_FltGetVolumeProperties" __imp_FltGetVolumeProperties
0x1C0010708: "%wZ%s\%s%016I64X" ??_C@_1CC@NHMIJMBK@?$AA?$CF?$AAw?$AAZ?$AA?$CF?$AAs?$AA?2?$AA?$CF?$AAs?$AA?$CF?$AA0?$AA1?$AA6?$AAI?$AA6?$AA4?$AAX?$AA?$AA@
0x1C0011030: "\Device\HarddiskVolume" ??_C@_1CO@JFDIPJLA@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAH?$AAa?$AAr?$AAd?$AAd?$AAi?$AAs?$AAk?$AAV?$AAo?$AAl?$AAu?$AAm?$AAe?$AA?$AA@
0x1C0010954: "NORMAL" ??_C@_06IOJAGNKJ@NORMAL?$AA@
0x1C000F96F: "__cdecl _chkstk" __chkstk
0x1C0031160: FileProvCbUnload
0x1C001FB50: WofPreDirectoryControlCallback
0x1C0019308: "__cdecl _imp_KeDelayExecutionThread" __imp_KeDelayExecutionThread
0x1C000A844: LZX_EncodeFree
0x1C0003230: WofIsMdlInvariant
0x1C0028400: WimpFSFInitializeIntegrity
0x1C002475C: WofIsDataInFilesystemEx
0x1C0021050: WofPreFsctlDeleteExternalBacking
0x1C0025360: TraceLoggingRegisterEx
0x1C000BCE4: output_block
0x1C00193E8: "__cdecl _imp_ExReleaseSpinLockShared" __imp_ExReleaseSpinLockShared
0x1C002ED80: WimFSFFindOverlayByDataSource
0x1C0019080: "__cdecl _imp_FltOpenVolume" __imp_FltOpenVolume
0x1C00306D0: FileProvCbLocateCleanupContext
0x1C0019458: "__cdecl _imp_EtwEventEnabled" __imp_EtwEventEnabled
0x1C00032A8: WofUserIsAdmin
0x1C0027D90: WimCbControlIntegrity
0x1C0025254: WppCleanupKm
0x1C0019138: "__cdecl _imp_FltTagFile" __imp_FltTagFile
0x1C001CC30: WofInstanceQueryTeardown
0x1C0019378: "__cdecl _imp_ProbeForWrite" __imp_ProbeForWrite
0x1C00293B0: WimFSFSnapshotIntegrity
0x1C0015FB0: g_WimIntegrityHashAlgorithmHandle
0x1C0003320: WofDeleteAlternateStream
0x1C0019070: "__cdecl _imp_FltDeviceIoControlFile" __imp_FltDeviceIoControlFile
0x1C00191C8: "__cdecl _imp_FltReferenceContext" __imp_FltReferenceContext
0x1C0019410: "__cdecl _imp_EtwUnregister" __imp_EtwUnregister
0x1C0019560: "__cdecl _imp_KeAllocateCalloutStackEx" __imp_KeAllocateCalloutStackEx
0x1C0006AF0: FileProvLzxAlloc
0x1C0038000: "__cdecl _guard_fids_table" __guard_fids_table
0x1C0019718: "__cdecl _imp_wcscpy_s" __imp_wcscpy_s
0x1C0019208: "__cdecl _imp_FltGetStreamContext" __imp_FltGetStreamContext
0x1C0010080: "__cdecl load_config_used" _load_config_used
0x1C00193A0: "__cdecl _imp_ExDeleteTimer" __imp_ExDeleteTimer
0x1C00311FC: FileProvInitializeProvider
0x1C00034A4: WofEnsureExtdFileContext
0x1C0019020: "__cdecl _imp_FltSetIoPriorityHintIntoCallbackData" __imp_FltSetIoPriorityHintIntoCallbackData
0x1C0019088: "__cdecl _imp_FltFreeDeferredIoWorkItem" __imp_FltFreeDeferredIoWorkItem
0x1C0011060: "\Device\Harddisk%lu\Partition%lu" ??_C@_1EC@CDJBOKNM@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAH?$AAa?$AAr?$AAd?$AAd?$AAi?$AAs?$AAk?$AA?$CF?$AAl?$AAu?$AA?2?$AAP?$AAa?$AAr?$AAt?$AAi?$AAt?$AAi?$AAo?$AAn?$AA?$CF?$AAl?$AAu@
0x1C0019380: "__cdecl _imp_ZwClose" __imp_ZwClose
0x1C002B12C: WimRenameOnSystemThread
0x1C00192D0: "__cdecl _imp_ExAcquireRundownProtection" __imp_ExAcquireRundownProtection
0x1C001C760: WofInstanceSetupNewStack
0x1C00193E0: "__cdecl _imp_ExReleasePushLockExclusiveEx" __imp_ExReleasePushLockExclusiveEx
0x1C001D7E4: WofFindOrCreateStreamContext
0x1C000F7CF: ExFreePoolWithTag
0x1C0019600: "__cdecl _imp_RtlInitializeGenericTableAvl" __imp_RtlInitializeGenericTableAvl
0x1C0010E10: enc_slot_mask
0x1C0023DC4: WofPrePnpQueryRemove
0x1C00349E4: BiConvertNtFilePathToBootEnvironment
0x1C0003910: WofQueryIntegerValueKey
0x1C0001890: WofPreReadCallback
0x1C001D480: WofPreAcquireForSectionCreationCallback
0x1C002277C: WofPreFsctlLockVolume
0x1C0019018: "__cdecl _imp_FltIsOperationSynchronous" __imp_FltIsOperationSynchronous
0x1C00190D0: "__cdecl _imp_FltQueryVolumeInformationFile" __imp_FltQueryVolumeInformationFile
0x1C0010210: WPP_01019f593f143a3f4bda0faa8862feab_Traceguids
0x1C00192A0: "__cdecl _imp_SeLockSubjectContext" __imp_SeLockSubjectContext
0x1C0010B98: WPP_d4010d2e8fa937e9c7fda867b02dd986_Traceguids
0x1C0027090: WimCbNotifyHandleClose
0x1C0019288: "__cdecl _imp_BCryptOpenAlgorithmProvider" __imp_BCryptOpenAlgorithmProvider
0x1C00211B0: WofPreFsctlGetExternalBacking
0x1C002F294: WimFSFReadWimResourceOnNewStack
0x1C00196A0: "__cdecl _imp_KeInitializeEvent" __imp_KeInitializeEvent
0x1C0019398: "__cdecl _imp_ExReleaseSpinLockExclusive" __imp_ExReleaseSpinLockExclusive
0x1C0010390: "UNKNOWN" ??_C@_1BA@HABJOAEE@?$AAU?$AAN?$AAK?$AAN?$AAO?$AAW?$AAN?$AA?$AA@
0x1C0025A20: "void __cdecl TlgAggregateInternalProviderCallback(struct _GUID const * __ptr64,unsigned long,unsigned char,unsigned __int64,unsigned __int64,struct _EVENT_FILTER_DESCRIPTOR * __ptr64,void * __ptr64)" ?TlgAggregateInternalProviderCallback@@YAXPEBU_GUID@@KE_K1PEAU_EVENT_FILTER_DESCRIPTOR@@PEAX@Z
0x1C00190C0: "__cdecl _imp_FltInitExtraCreateParameterLookasideList" __imp_FltInitExtraCreateParameterLookasideList
0x1C0010460: "WmiQueryTraceInformation" ??_C@_1DC@DOCOAJH@?$AAW?$AAm?$AAi?$AAQ?$AAu?$AAe?$AAr?$AAy?$AAT?$AAr?$AAa?$AAc?$AAe?$AAI?$AAn?$AAf?$AAo?$AAr?$AAm?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x1C00193C0: "__cdecl _imp_ExTryAcquirePushLockExclusiveEx" __imp_ExTryAcquirePushLockExclusiveEx
0x1C0010AE8: WinSqmGlobalSession
0x1C0027B78: WimCbForEachIntegrityContext
0x1C000CA1C: get_final_repeated_offset_states
0x1C0034DDC: BiTranslateSymbolicLink
0x1C00107C0: WofIntegrityBlockVerificationFailureEventId
0x1C0015F40: WimSqmStopped
0x1C0010940: "IS" ??_C@_02OOGDJODF@IS?$AA@
0x1C0010BA8: WPP_409feb8393a23f4e238ddd29a0dbba3d_Traceguids
0x1C0031CF4: FileProvPerformCompress
0x1C0010964: "ASYNC" ??_C@_05OCNPMOKK@ASYNC?$AA@
0x1C002E5A0: WimFSFLoadResource
0x1C0009884: fast_decode_aligned_offset_block
0x1C00194B0: "__cdecl _imp_KdRefreshDebuggerNotPresent" __imp_KdRefreshDebuggerNotPresent
0x1C00195E8: "__cdecl _imp_RtlCompressBuffer" __imp_RtlCompressBuffer
0x1C00104D0: "EtwUnregister" ??_C@_1BM@CJMKDOJH@?$AAE?$AAt?$AAw?$AAU?$AAn?$AAr?$AAe?$AAg?$AAi?$AAs?$AAt?$AAe?$AAr?$AA?$AA@
0x1C0010520: "ExTryQueueWorkItem" ??_C@_1CG@PDLPDDLG@?$AAE?$AAx?$AAT?$AAr?$AAy?$AAQ?$AAu?$AAe?$AAu?$AAe?$AAW?$AAo?$AAr?$AAk?$AAI?$AAt?$AAe?$AAm?$AA?$AA@
0x1C00281D4: WimFSFInitializeProvider
0x1C0010230: ":$DATA" ??_C@_1O@IKEDOIIA@?$AA?3?$AA$?$AAD?$AAA?$AAT?$AAA?$AA?$AA@
0x1C0014FC0: g_WimIntegrityRunOnce
0x1C0015FBC: g_WimIntegrityBackgroundValidationInProgress
0x1C00049D4: WPP_SF_Sld
0x1C0030DD0: FileProvCbQueryStreamSizeCompressed
0x1C0005550: WPP_SF_sqD
0x1C0005184: WimFSFAcquireConfigLock
0x1C0029A6C: WimpFSFIntegrityReportBlockFailure
0x1C0026670: WimCbRemoveOverlay
0x1C00270B0: WimCbNotifyHandleOpen
0x1C00038DC: WofConvertNtfsFileIdTo64
0x1C0019008: "__cdecl _imp_FltFreeGenericWorkItem" __imp_FltFreeGenericWorkItem
0x1C0032C0C: FileProvReadCompressed
0x1C0019170: "__cdecl _imp_FltFreeCallbackData" __imp_FltFreeCallbackData
0x1C0019570: "__cdecl _imp_ExDeleteNPagedLookasideList" __imp_ExDeleteNPagedLookasideList
0x1C0015EE0: WimSqmProvider
0x1C0029B70: WimpFSFIntegrityReportIntegrityFileEvent
0x1C0019400: "__cdecl _imp_ExAcquireSpinLockSharedAtDpcLevel" __imp_ExAcquireSpinLockSharedAtDpcLevel
0x1C000F840: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x1C000F990: memcmp
0x1C0010C90: dec_extra_bits
0x1C0019630: "__cdecl _imp_wcsrchr" __imp_wcsrchr
0x1C00103C0: "\$Extend\$Reparse:$R:$INDEX_ALLO" ??_C@_1EO@DEOJINAE@?$AA?2?$AA$?$AAE?$AAx?$AAt?$AAe?$AAn?$AAd?$AA?2?$AA$?$AAR?$AAe?$AAp?$AAa?$AAr?$AAs?$AAe?$AA?3?$AA$?$AAR?$AA?3?$AA$?$AAI?$AAN?$AAD?$AAE?$AAX?$AA_?$AAA?$AAL?$AAL?$AAO@
0x1C00306F0: FileProvCbLocateGenerateContext
0x1C0019370: "__cdecl _imp_MmMapLockedPagesSpecifyCache" __imp_MmMapLockedPagesSpecifyCache
0x1C000D960: create_trees
0x1C0034BA0: BiIssueGetDriveLayoutIoctl
0x1C0015FA0: WimDecompressionCount
0x1C0015100: FileProvCompressReadLookaside
0x1C0010330: "\Users\" ??_C@_1BA@FJJFMPFO@?$AA?2?$AAU?$AAs?$AAe?$AAr?$AAs?$AA?2?$AA?$AA@
0x1C00039F4: WofPropagateSiloContext
0x1C00050E4: WimFSFFreeXpress
0x1C0028F20: WimFSFAreBlocksIntegrityValidated
0x1C0023ACC: WofPreFsctlProviderDispatch
0x1C0019708: "__cdecl _imp_ZwQuerySymbolicLinkObject" __imp_ZwQuerySymbolicLinkObject
0x1C0019520: "__cdecl _imp__i64tow_s" __imp__i64tow_s
0x1C0003260: WofTryQueueWorkItem
0x1C0022F3C: WofPreFsctlEnumOverlay
0x1C0024E34: WppLoadTracingSupport
0x1C0015EA0: WimSqmTimer
0x1C0004BD8: WPP_SF_i_guid__guid_
0x1C0019618: "__cdecl _imp_IoWMIRegistrationControl" __imp_IoWMIRegistrationControl
0x1C0029878: WimpFSFIntegrityValidateWimHeader
0x1C0029054: WimpFSFIntegrityOpenIntegrityFile
0x1C00102C8: "\Program Files (x86)\" ??_C@_1CM@CJOMGIHN@?$AA?2?$AAP?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AA?5?$AAF?$AAi?$AAl?$AAe?$AAs?$AA?5?$AA?$CI?$AAx?$AA8?$AA6?$AA?$CJ?$AA?2?$AA?$AA@
0x1C0019078: "__cdecl _imp_FltReadFile" __imp_FltReadFile
0x1C002206C: WofPreFsctlEnumExternalBacking
0x1C002F8B0: WimFSFReadWim
0x1C0019568: "__cdecl _imp_IoGetRelatedDeviceObject" __imp_IoGetRelatedDeviceObject
0x1C00294D4: WimFSFGetIntegrityAlignedSizes
0x1C0027190: WimCbRead
0x1C0030850: FileProvCbLocateObject
0x1C0019160: "__cdecl _imp_FltAllocateCallbackDataEx" __imp_FltAllocateCallbackDataEx
0x1C0034AE4: BiGetDriveLayoutInformation
0x1C0019700: "__cdecl _imp_ZwQuerySystemInformation" __imp_ZwQuerySystemInformation
0x1C00013C8: WPP_SF_qZDlL
0x1C0023BD0: WofPrePnpCallback
0x1C00193A8: "__cdecl _imp_KeBugCheckEx" __imp_KeBugCheckEx
0x1C00190F0: "__cdecl _imp_FltAttachVolume" __imp_FltAttachVolume
0x1C0004A60: WPP_SF_ddd
0x1C0019390: "__cdecl _imp_ExSetTimer" __imp_ExSetTimer
0x1C0002BA4: WofAcquireFileSystemRundown
0x1C002EED4: WimFSFBuildChunkTable
0x1C002DA68: WimFSFDestroyOffsetTable
0x1C000C288: split_block
0x1C00302F0: WimpFSFSetupCng
0x1C0026B50: WimCbDismountVolume
0x1C00310EC: FileProvUninitializeCompressionScheme
0x1C0027E10: WimCbQueryIntegrity
0x1C00109E0: "\Registry\Machine\Software\Polic" ??_C@_1IA@DFJIGEFL@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAP?$AAo?$AAl?$AAi?$AAc@
0x1C000D0C0: encode_aligned_block
0x1C00012F0: WPP_SF_qqqZ
0x1C00192B8: "__cdecl _imp_SeUnlockSubjectContext" __imp_SeUnlockSubjectContext
0x1C0010280: "noncached" ??_C@_09IDJLKACI@noncached?$AA@
0x1C0004ACC: WPP_SF_didd
0x1C0014090: "__cdecl _security_cookie" __security_cookie
0x1C000CAC0: encode_uncompressed_block
0x1C00195D0: "__cdecl _imp_KeCancelTimer" __imp_KeCancelTimer
0x1C000C508: binary_search_findmatch
0x1C00055EC: WimFSFGetChunkOffset
0x1C001D2B0: WofPostCleanupCallback
0x1C00103A8: WPP_38b2dbbda23433a10176fabc0b96d631_Traceguids
0x1C0002370: WofPostWriteCallback
0x1C0004CB0: WPP_SF__guid__guid_
0x1C0023C90: WofPostPnpCallback
0x1C0023364: WofPreFsctlOffloadIo
0x1C00038EC: WofWakeFromDormant
0x1C00191A8: "__cdecl _imp_FltEnlistInTransaction" __imp_FltEnlistInTransaction
0x1C0019358: "__cdecl _imp_RtlCompareMemory" __imp_RtlCompareMemory
0x1C0034F80: BiGetDriveLayoutBlock
0x1C00196C8: "__cdecl _imp_ExReInitializeRundownProtection" __imp_ExReInitializeRundownProtection
0x1C0027150: WimCbOpenStream
0x1C002C414: WimPathToBootEnvironmentDevice
0x1C003325C: BiCreatePartitionDevice
0x1C000B478: init_compression_memory
0x1C0007F74: LZX_Decode
0x1C00110F0: "__cdecl _xmm@fffffffffffffffefffffffffffffffe" __xmm@fffffffffffffffefffffffffffffffe
0x1C0011100: "__cdecl _xmm@ffffffffffffffffffffffffffffffff" __xmm@ffffffffffffffffffffffffffffffff
0x1C0010498: "EtwRegisterClassicProvider" ??_C@_1DG@PFOPAIND@?$AAE?$AAt?$AAw?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAe?$AAr?$AAC?$AAl?$AAa?$AAs?$AAs?$AAi?$AAc?$AAP?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AA?$AA@
0x1C001F4B0: WofPostQueryOpenCallback
0x1C0010828: WNF_WOF_OVERLAY_CONFIGURATION_CHANGE
0x1C001E040: WofDoNotTrackOpen
0x1C0019100: "__cdecl _imp_FltQueryInformationFile" __imp_FltQueryInformationFile
0x1C002B934: WimOpenOverlayConfig
0x1C0019248: "__cdecl _imp_FltDeleteExtraCreateParameterLookasideList" __imp_FltDeleteExtraCreateParameterLookasideList
0x1C0005630: WimFSFGetAlignedSizes
0x1C00103A0: "UNKNOWN" ??_C@_07NFANNNEC@UNKNOWN?$AA@
0x1C002AE88: WimpFSFIsIntegrityMandatory
0x1C00110A8: "\??\PhysicalDrive%lu" ??_C@_1CK@HJDFLMHG@?$AA?2?$AA?$DP?$AA?$DP?$AA?2?$AAP?$AAh?$AAy?$AAs?$AAi?$AAc?$AAa?$AAl?$AAD?$AAr?$AAi?$AAv?$AAe?$AA?$CF?$AAl?$AAu?$AA?$AA@
0x1C001C280: WofAttachVolumeContext
0x1C0022CB8: WofPreFsctlRemoveOverlay
0x1C0010780: "\Device\BitLocker\%s" ??_C@_1CK@KALMFLBA@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAB?$AAi?$AAt?$AAL?$AAo?$AAc?$AAk?$AAe?$AAr?$AA?2?$AA?$CF?$AAs?$AA?$AA@
0x1C000876C: fillbuf
0x1C0019338: "__cdecl _imp_ProbeForRead" __imp_ProbeForRead
0x1C0030590: FileProvCbDeflateObject
0x1C0019578: "__cdecl _imp_RtlGetCompressionWorkSpaceSize" __imp_RtlGetCompressionWorkSpaceSize
0x1C001F514: WofMungeDirectoryEnumerateWithoutShortname
0x1C0027C90: WimCbStartIntegrityForHibernate
0x1C00195C8: "__cdecl _imp_RtlQueryRegistryValues" __imp_RtlQueryRegistryValues
0x1C0030D40: FileProvCbQueryReparseData
0x1C0014F80: MmMdlPageContentsStateWrapper
0x1C00194E0: "__cdecl _imp_EtwWrite" __imp_EtwWrite
0x1C00085EC: decoder_translate_e8
0x1C0019218: "__cdecl _imp_FltUnregisterFilter" __imp_FltUnregisterFilter
0x1C0019238: "__cdecl _imp_FltGetVolumeGuidName" __imp_FltGetVolumeGuidName
0x1C0004E80: WPP_SF_qi
0x1C0028A14: WimFSFCheckIntegrityOfBlocks
0x1C00196F8: "__cdecl _imp__vsnwprintf" __imp__vsnwprintf
0x1C0007044: WPP_SF_qD
0x1C00014C8: WPP_SF_qd
0x1C0010BC0: MP_POS_minus2
0x1C0001244: WPP_SF_qZ
0x1C0006FBC: FileProvDeleteOrTruncateBackingFile
0x1C0037000: WofRegistration
0x1C0024728: WofSanitizeAttributes
0x1C002A058: WimpFSFStartIntegrity
0x1C00195D8: "__cdecl _imp_KeFlushQueuedDpcs" __imp_KeFlushQueuedDpcs
0x1C00192D8: "__cdecl _imp_RtlLookupElementGenericTableAvl" __imp_RtlLookupElementGenericTableAvl
0x1C002D7E8: WimFSFAcquireRundownAndRemount
0x1C00367A4: "__cdecl _security_init_cookie" __security_init_cookie
0x1C0010B10: "HashDigestLength" ??_C@_1CC@DMMMEHOM@?$AAH?$AAa?$AAs?$AAh?$AAD?$AAi?$AAg?$AAe?$AAs?$AAt?$AAL?$AAe?$AAn?$AAg?$AAt?$AAh?$AA?$AA@
0x1C0019040: "__cdecl _imp_FltDeletePushLock" __imp_FltDeletePushLock
0x1C0001200: WPP_SF_q
0x1C0019320: "__cdecl _imp_PsGetProcessImageFileName" __imp_PsGetProcessImageFileName
0x1C0019730: "__cdecl _imp___chkstk" __imp___chkstk
0x1C0019280: "__cdecl _imp_BCryptFinishHash" __imp_BCryptFinishHash
0x1C002E710: WimFSFCreateOverlay
0x1C0019500: "__cdecl _imp_ExInitializeLookasideListEx" __imp_ExInitializeLookasideListEx
0x1C0010B60: ":WofCompressedData" ??_C@_1CG@JFBEAHHK@?$AA?3?$AAW?$AAo?$AAf?$AAC?$AAo?$AAm?$AAp?$AAr?$AAe?$AAs?$AAs?$AAe?$AAd?$AAD?$AAa?$AAt?$AAa?$AA?$AA@
0x1C0032F54: BiConvertBootEnvironmentDeviceToUnknown
0x1C0019428: "__cdecl _imp_EtwRegister" __imp_EtwRegister
0x1C0019530: "__cdecl _imp_IoAllocateWorkItem" __imp_IoAllocateWorkItem
0x1C00140D8: WPPTraceSuite
0x1C0019298: cng_NULL_THUNK_DATA
0x1C00193F8: "__cdecl _imp_KeSetEvent" __imp_KeSetEvent
0x1C0023F80: WofMarkFileAsInflated
0x1C0007E18: LZX_DecodeInit
0x1C0005664: WimFSFGetAlignedSizesForIntegrity
0x1C002CFC0: WimFSFInitializeVolume
0x1C0026F80: WimCbMountVolume
0x1C001E110: WofPostCreateCallback
0x1C002C6B4: WimAddToOverlayConfig
0x1C002AA10: WimpFSFBackgroundValidationWorker
0x1C0019168: "__cdecl _imp_FltPropagateIrpExtension" __imp_FltPropagateIrpExtension
0x1C001DB50: WofFindOrCreateTransactionContext
0x1C00315EC: FileProvInitializeCompressWorkItem
0x1C0015FC0: g_WimIntegrityCngExtensions
0x1C0014FD0: WimInlineReads
0x1C00193D8: "__cdecl _imp_ExAcquirePushLockExclusiveEx" __imp_ExAcquirePushLockExclusiveEx
0x1C0006B20: FileProvLzxFree
0x1C0019640: "__cdecl _imp_ExReleaseRundownProtection" __imp_ExReleaseRundownProtection
0x1C002AFB8: WimpFSFSetPriorities
0x1C00193C8: "__cdecl _imp_ExReleaseSpinLockSharedFromDpcLevel" __imp_ExReleaseSpinLockSharedFromDpcLevel
0x1C00191B8: "__cdecl _imp_FltSetStreamContext" __imp_FltSetStreamContext
0x1C0007B40: FileProvReadCompressedCompletion
0x1C0006F70: FileProvCompressionScheme
0x1C0023540: WofPreFsctlStopIntegrity
0x1C00055EC: FileProvGetChunkOffset
0x1C0030A90: FileProvCbNotifyInflate
0x1C0019778: "__cdecl _IMPORT_DESCRIPTOR_cng" __IMPORT_DESCRIPTOR_cng
0x1C0019180: "__cdecl _imp_FltDeleteStreamContext" __imp_FltDeleteStreamContext
0x1C002843C: WimFSFCreateIntegrity
0x1C000F7B0: "__cdecl _report_gsfailure" __report_gsfailure
0x1C00193F0: "__cdecl _imp_ExAcquireSpinLockShared" __imp_ExAcquireSpinLockShared
0x1C0022B80: WofPreFsctlSuspendOverlay
0x1C0010830: "WimOverlay.new" ??_C@_1BO@DONLBKGI@?$AAW?$AAi?$AAm?$AAO?$AAv?$AAe?$AAr?$AAl?$AAa?$AAy?$AA?4?$AAn?$AAe?$AAw?$AA?$AA@
0x1C0019010: "__cdecl _imp_FltQueueGenericWorkItem" __imp_FltQueueGenericWorkItem
0x1C000160C: WofCheckForFilenameBreak
0x1C001D5D0: WofPostAcquireForSectionCreationCallback
0x1C002B060: WimCreateSystemVolumeInfoWork
0x1C0033AC0: BiConvertNtDeviceToBootEnvironment
0x1C0014F90: FltTraceRedirectedFileIoWrapper
0x1C0019508: "__cdecl _imp_RtlTestBit" __imp_RtlTestBit
0x1C002ECEC: WimFSFFindBackingFileUnsafe
0x1C0032740: FileProvReadCompressedSwitchStacks
0x1C0010578: "NoAutoAttach" ??_C@_1BK@OBIPDHOF@?$AAN?$AAo?$AAA?$AAu?$AAt?$AAo?$AAA?$AAt?$AAt?$AAa?$AAc?$AAh?$AA?$AA@
0x1C0019658: "__cdecl _imp_ExQueryDepthSList" __imp_ExQueryDepthSList
0x1C0010800: WNF_FVE_WIM_HASH_DELETION_TRIGGER
0x1C00036D0: WofOpenReparseIndex
0x1C000C828: quick_insert_bsearch_findmatch
0x1C0029D30: WimpFSFAllocateMultiHashContext
0x1C00104F0: "MmMdlPageContentsState" ??_C@_1CO@HCGDGMNL@?$AAM?$AAm?$AAM?$AAd?$AAl?$AAP?$AAa?$AAg?$AAe?$AAC?$AAo?$AAn?$AAt?$AAe?$AAn?$AAt?$AAs?$AAS?$AAt?$AAa?$AAt?$AAe?$AA?$AA@
0x1C0010260: WPP_0c6810532d5632abf4510bbf0999d245_Traceguids
0x1C0010770: "SHA256" ??_C@_1O@HECGKAIN@?$AAS?$AAH?$AAA?$AA2?$AA5?$AA6?$AA?$AA@
0x1C002B4B8: WimWriteOverlayConfig
0x1C0019440: "__cdecl _imp_MmMapViewOfSection" __imp_MmMapViewOfSection
0x1C000C96C: binary_search_remove_node
0x1C0019738: ntoskrnl_NULL_THUNK_DATA
0x1C00238C4: WofPostFsctlQueryPersistentVolumeState
0x1C00212D4: WofPreFsctlSetExternalBacking
0x1C00196A8: "__cdecl _imp_ExFreePoolWithTag" __imp_ExFreePoolWithTag
0x1C002A240: WimpFSFIsBitLockerEnabled
0x1C0030E70: FileProvCbValidateReparseData
0x1C0035230: BiGetPhysicalDriveName
0x1C00108D0: "\Device\HarddiskVolumeUnknown" ??_C@_1DM@KIHGNJIB@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAH?$AAa?$AAr?$AAd?$AAd?$AAi?$AAs?$AAk?$AAV?$AAo?$AAl?$AAu?$AAm?$AAe?$AAU?$AAn?$AAk?$AAn?$AAo?$AAw?$AAn?$AA?$AA@
0x1C0004430: "__cdecl TlgWriteAgg" _TlgWriteAgg
0x1C00196E0: "__cdecl _imp_KeEnterCriticalRegion" __imp_KeEnterCriticalRegion
0x1C000D648: perform_flush_output_callback
0x1C000DA0C: fix_tree_cost_estimates
0x1C00194F8: "__cdecl _imp_ZwOpenFile" __imp_ZwOpenFile
0x1C00190B8: "__cdecl _imp_FltReleasePushLockEx" __imp_FltReleasePushLockEx
0x1C0005810: WimFSFReadWimResourceCallout
0x1C0010070: g_CngDeviceName
0x1C0027620: WimCbQueryReparseData
0x1C0019148: "__cdecl _imp_FltSetInformationFile" __imp_FltSetInformationFile
0x1C00070A4: FileProvGetAlignedSizes
0x1C0019350: "__cdecl _imp_TmCurrentTransaction" __imp_TmCurrentTransaction
0x1C0019710: "__cdecl _imp_ZwOpenSymbolicLinkObject" __imp_ZwOpenSymbolicLinkObject
0x1C000B9A8: comp_free_compress_memory
0x1C0036008: DriverEntry
0x1C0010410: WPP_bc594884ecfb392485a563f92a64c01c_Traceguids
0x1C0010870: "WimOverlay.backup" ??_C@_1CE@KLLAPPNF@?$AAW?$AAi?$AAm?$AAO?$AAv?$AAe?$AAr?$AAl?$AAa?$AAy?$AA?4?$AAb?$AAa?$AAc?$AAk?$AAu?$AAp?$AA?$AA@
0x1C000312C: WofOpenVolumeHandle
0x1C0010290: WPP_de7c8dd64b31390b1526b4b1f4b7dbcf_Traceguids
0x1C0023F54: WofUnregisterTelemetry
0x1C0019110: "__cdecl _imp_FltUntagFile" __imp_FltUntagFile
0x1C00196D0: "__cdecl _imp_ExWaitForRundownProtectionRelease" __imp_ExWaitForRundownProtectionRelease
0x1C00140C8: pfnWppTraceMessage
0x1C0032474: FileProvBuildChunkTable
0x1C0019430: "__cdecl _imp_ZwOpenKey" __imp_ZwOpenKey
0x1C00251C4: WppInitKm
0x1C00051C4: WimFSFReleaseConfigLock
0x1C0019120: "__cdecl _imp_FltParseFileNameInformation" __imp_FltParseFileNameInformation
0x1C00107D0: WofIntegrityFileOpenFailureEventId
0x1C0019468: "__cdecl _imp_ZwCreateSection" __imp_ZwCreateSection
0x1C0029DC0: WimpFSFFreeMultiHashContext
0x1C0004F98: WPP_SF_s
0x1C000495C: WPP_SF_S
0x1C000FDC0: memset
0x1C001978C: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x1C0002C04: WofIsDataAlternateStream
0x1C0019408: "__cdecl _imp_ExAcquireSpinLockExclusive" __imp_ExAcquireSpinLockExclusive

[JEB Decompiler by PNF Software]