Generated by JEB on 2019/08/01

PE: C:\Windows\System32\drivers\nsiproxy.sys Base=0x1C0000000 SHA-256=EA0A9643B158CB56D2DE74AD61B49E82E0C71E96393797B891FA5E5985E0E120
PDB: nsiproxy.pdb GUID={B5686FA8-A8F4-36F8-1FB77E1AB4C7E504} Age=1

236 located named symbols:
0x1C00075C0: "RC" ??_C@_15IGNKAAHD@?$AAR?$AAC?$AA?$AA@
0x1C0006280: NsippSetAllPersistentParametersWithMask
0x1C0005A34: NsippDispatchDeviceControl
0x1C000C978: SepSddlGetAclForString
0x1C000B258: "__cdecl _imp_RtlFreeUnicodeString" __imp_RtlFreeUnicodeString
0x1C0009238: DrvpReferenceCount
0x1C000B150: "__cdecl _imp_ObReleaseObjectSecurity" __imp_ObReleaseObjectSecurity
0x1C0009088: "__cdecl _security_cookie_complement" __security_cookie_complement
0x1C000B038: "__cdecl _imp_NsiSetParameterEx" __imp_NsiSetParameterEx
0x1C0009268: PfnIoCreateDeviceSecure
0x1C0001650: NsippFindNotificationHandle
0x1C000B010: "__cdecl _imp_NsiGetAllPersistentParametersWithMask" __imp_NsiGetAllPersistentParametersWithMask
0x1C000B160: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x1C0004870: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x1C0001940: NsippSetParameter
0x1C000B0C0: "__cdecl _imp_SeAccessCheck" __imp_SeAccessCheck
0x1C000B1F0: "__cdecl _imp_IoCreateDevice" __imp_IoCreateDevice
0x1C00071B8: "\Device\Nsi" ??_C@_1BI@BLCHOJPC@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAN?$AAs?$AAi?$AA?$AA@
0x1C000B1F8: "__cdecl _imp_IoDeviceObjectType" __imp_IoDeviceObjectType
0x1C00075C8: "WD" ??_C@_15ELMAKJHJ@?$AAW?$AAD?$AA?$AA@
0x1C000B188: "__cdecl _imp_IofCompleteRequest" __imp_IofCompleteRequest
0x1C000B130: "__cdecl _imp_RtlCreateSecurityDescriptor" __imp_RtlCreateSecurityDescriptor
0x1C000C090: IoDevObjCreateDeviceSecure
0x1C000B210: "__cdecl _imp_wcschr" __imp_wcschr
0x1C0001010: NsippChangeNotificationCallback
0x1C000B298: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x1C0009280: PiRegStateDiscriptor
0x1C000B248: "__cdecl _imp_RtlGetOwnerSecurityDescriptor" __imp_RtlGetOwnerSecurityDescriptor
0x1C000B218: "__cdecl _imp__wcsnicmp" __imp__wcsnicmp
0x1C000B050: "__cdecl _imp_NsiDeregisterChangeNotificationEx" __imp_NsiDeregisterChangeNotificationEx
0x1C000C240: IopDevObjApplyPostCreationSettings
0x1C0007120: "D:P(A;;FA;;;S-1-5-80-2310782386-" ??_C@_1JI@BCEJBOO@?$AAD?$AA?3?$AAP?$AA?$CI?$AAA?$AA?$DL?$AA?$DL?$AAF?$AAA?$AA?$DL?$AA?$DL?$AA?$DL?$AAS?$AA?9?$AA1?$AA?9?$AA5?$AA?9?$AA8?$AA0?$AA?9?$AA2?$AA3?$AA1?$AA0?$AA7?$AA8?$AA2?$AA3?$AA8?$AA6?$AA?9@
0x1C000B1E8: "__cdecl _imp_MmGetSystemRoutineAddress" __imp_MmGetSystemRoutineAddress
0x1C000B0F0: "__cdecl _imp_KeInitializeSpinLock" __imp_KeInitializeSpinLock
0x1C0003CE0: NsippProbeForRead
0x1C0009278: NsiProxyDeviceObject
0x1C00075E8: "GR" ??_C@_15DNGEKDKB@?$AAG?$AAR?$AA?$AA@
0x1C000B1D0: "__cdecl _imp_KeWaitForSingleObject" __imp_KeWaitForSingleObject
0x1C000B078: "__cdecl _imp_KeReleaseSpinLock" __imp_KeReleaseSpinLock
0x1C000D7A4: CmRegUtilUcValueGetDword
0x1C0009240: DrvpAllowUnloadEvent
0x1C000B198: "__cdecl _imp_IoReleaseCancelSpinLock" __imp_IoReleaseCancelSpinLock
0x1C000578C: DrvWaitForAllowUnloadEvent
0x1C0004880: memcpy
0x1C000C880: SepSddlDaclFromSDDLString
0x1C000B0F8: "__cdecl _imp_RtlSubAuthoritySid" __imp_RtlSubAuthoritySid
0x1C000B270: "__cdecl _imp_ZwSetValueKey" __imp_ZwSetValueKey
0x1C000B170: "__cdecl _imp_IoDeleteDevice" __imp_IoDeleteDevice
0x1C000B208: "__cdecl _imp_RtlAbsoluteToSelfRelativeSD" __imp_RtlAbsoluteToSelfRelativeSD
0x1C00046CD: "__cdecl _C_specific_handler" __C_specific_handler
0x1C0001B00: NsippDeregisterChangeNotification
0x1C0004880: memmove
0x1C000C410: SepSddlSecurityDescriptorFromSDDLString
0x1C000B0E0: "__cdecl _imp_RtlLengthRequiredSid" __imp_RtlLengthRequiredSid
0x1C000B120: "__cdecl _imp_RtlCreateAcl" __imp_RtlCreateAcl
0x1C0009230: NsippNotificationHandleListLock
0x1C0007280: "IoCreateDeviceSecure" ??_C@_1CK@LEEDIGFP@?$AAI?$AAo?$AAC?$AAr?$AAe?$AAa?$AAt?$AAe?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAS?$AAe?$AAc?$AAu?$AAr?$AAe?$AA?$AA@
0x1C000471C: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x1C0005728: DrvDereferenceDriver
0x1C000B008: NDIS_NULL_THUNK_DATA
0x1C0005F70: NsippGetAllPersistentParametersWithMask
0x1C000B180: "__cdecl _imp_IoQueueWorkItem" __imp_IoQueueWorkItem
0x1C0005764: DrvInitializeAllowUnloadEvent
0x1C000CEEC: SepSddlParseWideStringUlong
0x1C000B040: "__cdecl _imp_NsiGetParameterEx" __imp_NsiGetParameterEx
0x1C00075F8: "GX" ??_C@_15FCNJEDMF@?$AAG?$AAX?$AA?$AA@
0x1C000C480: WdmlibInit
0x1C00075D0: "WO" ??_C@_15JMMBCOHI@?$AAW?$AAO?$AA?$AA@
0x1C000B168: "__cdecl _imp_IoCreateSymbolicLink" __imp_IoCreateSymbolicLink
0x1C000B030: "__cdecl _imp_NsiSetAllPersistentParametersWithMask" __imp_NsiSetAllPersistentParametersWithMask
0x1C000B0E8: "__cdecl _imp_ExAllocatePoolWithTag" __imp_ExAllocatePoolWithTag
0x1C0003D30: NsippCleanup
0x1C0002190: NsippGetParameter
0x1C000B090: "__cdecl _imp_MmUserProbeAddress" __imp_MmUserProbeAddress
0x1C000B230: "__cdecl _imp__snwprintf" __imp__snwprintf
0x1C000B0B0: "__cdecl _imp_SeCaptureSubjectContextEx" __imp_SeCaptureSubjectContextEx
0x1C000B1C8: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x1C0007600: "A" ??_C@_13PNBDBPLL@?$AAA?$AA?$AA@
0x1C000B238: "__cdecl _imp_SeCaptureSecurityDescriptor" __imp_SeCaptureSecurityDescriptor
0x1C000B1A0: "__cdecl _imp_KeReleaseSpinLockFromDpcLevel" __imp_KeReleaseSpinLockFromDpcLevel
0x1C00046F8: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x1C000B128: "__cdecl _imp_RtlAddAccessAllowedAce" __imp_RtlAddAccessAllowedAce
0x1C000B0A0: "__cdecl _imp_ExAllocatePoolWithQuotaTag" __imp_ExAllocatePoolWithQuotaTag
0x1C000B1C0: "__cdecl _imp_IoFreeWorkItem" __imp_IoFreeWorkItem
0x1C000B1B0: "__cdecl _imp_IoAcquireCancelSpinLock" __imp_IoAcquireCancelSpinLock
0x1C000B220: "__cdecl _imp_SeExports" __imp_SeExports
0x1C000B058: "__cdecl _imp_NsiGetModuleHandle" __imp_NsiGetModuleHandle
0x1C0009220: NsippNotificationHandleList
0x1C000B2B4: "__cdecl _IMPORT_DESCRIPTOR_NETIO" __IMPORT_DESCRIPTOR_NETIO
0x1C00040A0: NsippCreateDevice
0x1C000B178: "__cdecl _imp_IoDeleteSymbolicLink" __imp_IoDeleteSymbolicLink
0x1C000DA6C: CmRegUtilWstrValueGetDword
0x1C0007240: "IoValidateDeviceIoControlAccess" ??_C@_1EA@BAHCLPHE@?$AAI?$AAo?$AAV?$AAa?$AAl?$AAi?$AAd?$AAa?$AAt?$AAe?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAI?$AAo?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAA?$AAc?$AAc?$AAe?$AAs?$AAs?$AA?$AA@
0x1C0003E10: NsippCancelChangeNotification
0x1C000B018: "__cdecl _imp_NsiRegisterChangeNotificationEx" __imp_NsiRegisterChangeNotificationEx
0x1C000B228: "__cdecl _imp_RtlLengthSecurityDescriptor" __imp_RtlLengthSecurityDescriptor
0x1C0005918: NsippCleanupNotification
0x1C00075D8: "SD" ??_C@_15NAFBOLGP@?$AAS?$AAD?$AA?$AA@
0x1C000D978: CmRegUtilUcValueSetUcString
0x1C00011E0: NsippRequestChangeNotification
0x1C000B250: "__cdecl _imp_RtlGetGroupSecurityDescriptor" __imp_RtlGetGroupSecurityDescriptor
0x1C00076E0: "\Registry\Machine\System\Current" ??_C@_1HC@DKINPPAJ@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1C000D770: CmRegUtilOpenExistingWstrKey
0x1C0007110: "\??\Nsi" ??_C@_1BA@LDGHIHMO@?$AA?2?$AA?$DP?$AA?$DP?$AA?2?$AAN?$AAs?$AAi?$AA?$AA@
0x1C000D1AC: PiRegStateReadStackCreationSettingsFromKey
0x1C000CFD8: PiRegStateOpenClassKey
0x1C000B098: "__cdecl _imp_IoIs32bitProcess" __imp_IoIs32bitProcess
0x1C0006518: WdmlibRtlInitUnicodeStringEx
0x1C000B0D8: "__cdecl _imp_SeReleaseSubjectContext" __imp_SeReleaseSubjectContext
0x1C0007668: "Security" ??_C@_1BC@FCJNIDNL@?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?$AA@
0x1C000B080: "__cdecl _imp_ExRaiseAccessViolation" __imp_ExRaiseAccessViolation
0x1C000E010: GsDriverEntry
0x1C000B290: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x1C000D390: PpRegStateReadCreateClassCreationSettings
0x1C000CD70: SepSddlGetSidForString
0x1C0007680: "DeviceType" ??_C@_1BG@KCOOGCNN@?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x1C000B060: "__cdecl _imp_NsiGetAllParametersEx" __imp_NsiGetAllParametersEx
0x1C0007760: "{%08X-%04X-%04X-%02X%02X-%02X%02" ??_C@_1GG@FCALANDO@?$AA?$HL?$AA?$CF?$AA0?$AA8?$AAX?$AA?9?$AA?$CF?$AA0?$AA4?$AAX?$AA?9?$AA?$CF?$AA0?$AA4?$AAX?$AA?9?$AA?$CF?$AA0?$AA2?$AAX?$AA?$CF?$AA0?$AA2?$AAX?$AA?9?$AA?$CF?$AA0?$AA2?$AAX?$AA?$CF?$AA0?$AA2@
0x1C0003CA0: NsippProbeForWrite
0x1C00024B0: NsippDispatch
0x1C000B268: "__cdecl _imp_ZwQueryValueKey" __imp_ZwQueryValueKey
0x1C00075E0: "GA" ??_C@_15HPMIFLNA@?$AAG?$AAA?$AA?$AA@
0x1C000B090: MmUserProbeAddress
0x1C000B0C8: "__cdecl _imp_IoGetFileObjectGenericMapping" __imp_IoGetFileObjectGenericMapping
0x1C0002700: NsippEnumerateObjectsAllParameters
0x1C0004690: "__cdecl _security_check_cookie" __security_check_cookie
0x1C000B2A0: "__cdecl _IMPORT_DESCRIPTOR_ntoskrnl" __IMPORT_DESCRIPTOR_ntoskrnl
0x1C0004340: AllocateCapabilitySid
0x1C0001D90: NsippGetAllParameters
0x1C0003870: NsippIsCallerNsiService
0x1C00071D0: "SeConvertStringSecurityDescripto" ??_C@_1GM@JINLDKKK@?$AAS?$AAe?$AAC?$AAo?$AAn?$AAv?$AAe?$AAr?$AAt?$AAS?$AAt?$AAr?$AAi?$AAn?$AAg?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AAD?$AAe?$AAs?$AAc?$AAr?$AAi?$AAp?$AAt?$AAo@
0x1C000B1A8: "__cdecl _imp_KeAcquireSpinLockAtDpcLevel" __imp_KeAcquireSpinLockAtDpcLevel
0x1C00059B8: NsippDeleteDevice
0x1C000B088: "__cdecl _imp_ProbeForWrite" __imp_ProbeForWrite
0x1C0007540: "D:P(A;;GX;;;WD)(A;;GA;;;SY)(A;;G" ??_C@_1IA@DFKOADOP@?$AAD?$AA?3?$AAP?$AA?$CI?$AAA?$AA?$DL?$AA?$DL?$AAG?$AAX?$AA?$DL?$AA?$DL?$AA?$DL?$AAW?$AAD?$AA?$CJ?$AA?$CI?$AAA?$AA?$DL?$AA?$DL?$AAG?$AAA?$AA?$DL?$AA?$DL?$AA?$DL?$AAS?$AAY?$AA?$CJ?$AA?$CI?$AAA?$AA?$DL?$AA?$DL?$AAG@
0x1C0002BD0: NsippProbeAndAllocateParameters
0x1C000F000: "__cdecl _guard_fids_table" __guard_fids_table
0x1C000B140: "__cdecl _imp_ZwSetSecurityObject" __imp_ZwSetSecurityObject
0x1C0007000: "__cdecl load_config_used" _load_config_used
0x1C0003DD0: NsippMoveList
0x1C0007608: "Properties" ??_C@_1BG@COALCEMK@?$AAP?$AAr?$AAo?$AAp?$AAe?$AAr?$AAt?$AAi?$AAe?$AAs?$AA?$AA@
0x1C000B148: "__cdecl _imp_ZwClose" __imp_ZwClose
0x1C000DA9C: CmRegUtilWstrValueSetFullBuffer
0x1C000C788: SepSddlAddAceToAcl
0x1C000B0B8: "__cdecl _imp_SeLockSubjectContext" __imp_SeLockSubjectContext
0x1C000D6B4: CmRegUtilCreateWstrKey
0x1C000B1D8: "__cdecl _imp_KeInitializeEvent" __imp_KeInitializeEvent
0x1C000B100: "__cdecl _imp_ObOpenObjectByPointer" __imp_ObOpenObjectByPointer
0x1C000B240: "__cdecl _imp_RtlGetSaclSecurityDescriptor" __imp_RtlGetSaclSecurityDescriptor
0x1C0007630: "NoDisplayClass" ??_C@_1BO@DAOBINHA@?$AAN?$AAo?$AAD?$AAi?$AAs?$AAp?$AAl?$AAa?$AAy?$AAC?$AAl?$AAa?$AAs?$AAs?$AA?$AA@
0x1C000B110: "__cdecl _imp_RtlGetDaclSecurityDescriptor" __imp_RtlGetDaclSecurityDescriptor
0x1C000D4E0: PpRegStateUpdateStackCreationSettings
0x1C000B200: "__cdecl _imp_IoIsWdmVersionAvailable" __imp_IoIsWdmVersionAvailable
0x1C0007698: "DeviceCharacteristics" ??_C@_1CM@DIJFBEC@?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAC?$AAh?$AAa?$AAr?$AAa?$AAc?$AAt?$AAe?$AAr?$AAi?$AAs?$AAt?$AAi?$AAc?$AAs?$AA?$AA@
0x1C00091E0: PiRegStateSysAllInherittedSecurityDescriptor
0x1C0009270: WdmlibInitialized
0x1C000B020: "__cdecl _imp_NsiEnumerateObjectsAllPersistentParametersWithMask" __imp_NsiEnumerateObjectsAllPersistentParametersWithMask
0x1C0004030: NsippDeregisterWorker
0x1C000D708: CmRegUtilOpenExistingUcKey
0x1C00046E0: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x1C0004790: memcmp
0x1C000C010: WdmlibIoCreateDeviceSecure
0x1C0009260: NsiServiceSecurityDescriptor
0x1C000B0A8: "__cdecl _imp_PsGetCurrentProcess" __imp_PsGetCurrentProcess
0x1C0007620: "Class" ??_C@_1M@OAHBGIFG@?$AAC?$AAl?$AAa?$AAs?$AAs?$AA?$AA@
0x1C000DB3C: CmpRegUtilAllocateUnicodeString
0x1C00016C0: NsippIsMatchingObject
0x1C000B048: "__cdecl _imp_NsiSetAllParametersEx" __imp_NsiSetAllParametersEx
0x1C0003F50: NsippFindIrp
0x1C000B070: "__cdecl _imp_KeAcquireSpinLockRaiseToDpc" __imp_KeAcquireSpinLockRaiseToDpc
0x1C000CE50: SepSddlLookupAccessMaskInTable
0x1C000B0D0: "__cdecl _imp_SeUnlockSubjectContext" __imp_SeUnlockSubjectContext
0x1C0009080: "__cdecl _security_cookie" __security_cookie
0x1C000DAF0: CmRegUtilWstrValueSetWstrString
0x1C000B028: "__cdecl _imp_NsiEnumerateObjectsAllParametersEx" __imp_NsiEnumerateObjectsAllParametersEx
0x1C000B108: "__cdecl _imp_ObGetObjectSecurity" __imp_ObGetObjectSecurity
0x1C00076C8: "Exclusive" ??_C@_1BE@DJHAJDEM@?$AAE?$AAx?$AAc?$AAl?$AAu?$AAs?$AAi?$AAv?$AAe?$AA?$AA@
0x1C00057D0: NsippCancelChangeNotificationRoutine
0x1C000D81C: CmRegUtilUcValueGetFullBuffer
0x1C000B068: NETIO_NULL_THUNK_DATA
0x1C0001730: NsippSetAllParameters
0x1C0007650: "NoUseClass" ??_C@_1BG@OPOOGLJC@?$AAN?$AAo?$AAU?$AAs?$AAe?$AAC?$AAl?$AAa?$AAs?$AAs?$AA?$AA@
0x1C000E044: "__cdecl _security_init_cookie" __security_init_cookie
0x1C000B190: "__cdecl _imp_IoAllocateWorkItem" __imp_IoAllocateWorkItem
0x1C000B280: "__cdecl _imp_KeSetEvent" __imp_KeSetEvent
0x1C0004440: ApplySecurityToDeviceObject
0x1C000C320: SeUtilSecurityInfoFromSecurityDescriptor
0x1C000B1F8: IoDeviceObjectType
0x1C000B2C8: "__cdecl _IMPORT_DESCRIPTOR_NDIS" __IMPORT_DESCRIPTOR_NDIS
0x1C00075F0: "GW" ??_C@_15KLKFDJD@?$AAG?$AAW?$AA?$AA@
0x1C000B118: "__cdecl _imp_RtlLengthSid" __imp_RtlLengthSid
0x1C00046C0: "__cdecl _report_gsfailure" __report_gsfailure
0x1C0003950: NsippRegisterChangeNotification
0x1C0009258: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxunrmrlUmvgrlUmhrUpvimvoUkilcbUlyquivUznwGEUmhrkkOlyq@nsiproxy" __@@_PchSym_@00@KxulyqvxgPillgKxunrmrlUmvgrlUmhrUpvimvoUkilcbUlyquivUznwGEUmhrkkOlyq@nsiproxy
0x1C000B260: "__cdecl _imp_ZwCreateKey" __imp_ZwCreateKey
0x1C000B000: "__cdecl _imp_NdisGetThreadObjectCompartmentId" __imp_NdisGetThreadObjectCompartmentId
0x1C000B288: ntoskrnl_NULL_THUNK_DATA
0x1C000B1B8: "__cdecl _imp_ExFreePoolWithTag" __imp_ExFreePoolWithTag
0x1C000B1E0: "__cdecl _imp_RtlInitializeSid" __imp_RtlInitializeSid
0x1C0005BC4: NsippEnumerateObjectsAllPersistentParametersWithMask
0x1C000B158: "__cdecl _imp_SeConvertStringSecurityDescriptorToSecurityDescriptor" __imp_SeConvertStringSecurityDescriptorToSecurityDescriptor
0x1C000B138: "__cdecl _imp_RtlSetDaclSecurityDescriptor" __imp_RtlSetDaclSecurityDescriptor
0x1C000E080: DriverEntry
0x1C000D610: CmRegUtilCreateUcKey
0x1C000B278: "__cdecl _imp_ZwOpenKey" __imp_ZwOpenKey
0x1C0004BC0: memset
0x1C000B2DC: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x1C000C760: NsippUnload

[JEB Decompiler by PNF Software]