Generated by JEB on 2019/08/01

PE: C:\Windows\System32\dpapisrv.dll Base=0x180000000 SHA-256=EA4AB615741EC548A62A3BB2BE5CC65B8A20F06E242333E1D51D5E809AA73C29
PDB: dpapisrv.pdb GUID={67ECE3FC-255F-CA41-C778F87F9D685E4C} Age=1

1222 located named symbols:
0x180034078: "__cdecl _imp_SIDKeyUnprotect" __imp_SIDKeyUnprotect
0x180028B00: "__cdecl _imp_EventSetInformation" __imp_EventSetInformation
0x180017F58: "unsigned long __cdecl BackupMasterKey(void * __ptr64,struct MASTERKEY_STORED * __ptr64,unsigned char * __ptr64,unsigned long,int,int)" ?BackupMasterKey@@YAKPEAXPEAUMASTERKEY_STORED@@PEAEKHH@Z
0x18002B508: "onecore\ds\security\keyman\sidke" ??_C@_0DI@LPCHCADD@onecore?2ds?2security?2keyman?2sidke@
0x180029890: "__cdecl _sz_SspiCli_dll" __sz_SspiCli_dll
0x18000B178: "__cdecl _raise_securityfailure" __raise_securityfailure
0x180003E90: "int __cdecl ReusableHMAC(void * __ptr64,void * __ptr64,unsigned long,unsigned char * __ptr64,unsigned long,unsigned char * __ptr64,unsigned long,unsigned char * __ptr64,unsigned long,unsigned char * __ptr64,unsigned long)" ?ReusableHMAC@@YAHPEAX0KPEAEK1K1K1K@Z
0x18000C21A: "__cdecl _imp_load_CryptSignAndEncodeCertificate" __imp_load_CryptSignAndEncodeCertificate
0x180028B88: "__cdecl _imp_ImpersonateLoggedOnUser" __imp_ImpersonateLoggedOnUser
0x18002AD48: "LocalConnectedUserAccountType" ??_C@_1DM@EPMOEMBD@?$AAL?$AAo?$AAc?$AAa?$AAl?$AAC?$AAo?$AAn?$AAn?$AAe?$AAc?$AAt?$AAe?$AAd?$AAU?$AAs?$AAe?$AAr?$AAA?$AAc?$AAc?$AAo?$AAu?$AAn?$AAt?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x18002B2A8: "FALSE" ??_C@_05MAJJAKPI@FALSE?$AA@
0x180028798: api-ms-win-core-file-l1-1-0_NULL_THUNK_DATA
0x1800291D0: "Encr Alg" ??_C@_1BC@JEDACOLI@?$AAE?$AAn?$AAc?$AAr?$AA?5?$AAA?$AAl?$AAg?$AA?$AA@
0x180028AF8: "__cdecl _imp_EventRegister" __imp_EventRegister
0x18002ADE0: "Normal" ??_C@_06EFAGIKOH@Normal?$AA@
0x18000B524: "void __cdecl __scrt_initialize_type_info(void)" ?__scrt_initialize_type_info@@YAXXZ
0x1800287E0: api-ms-win-core-heap-obsolete-l1-1-0_NULL_THUNK_DATA
0x180028CB0: "__cdecl _imp_EtwUnregisterTraceGuids" __imp_EtwUnregisterTraceGuids
0x180031090: "struct _LSA_IF_DPAPI_FUNCTION_TABLE g_pDPAPIIfTable" ?g_pDPAPIIfTable@@3U_LSA_IF_DPAPI_FUNCTION_TABLE@@A
0x18002AB68: ETW_LOG_MASTERKEY_ENCRYPTION_FAILED
0x180028B60: "__cdecl _imp_AllocateAndInitializeSid" __imp_AllocateAndInitializeSid
0x180028CD8: "__cdecl _imp_RtlReleaseRelativeName" __imp_RtlReleaseRelativeName
0x180001FD0: "long __cdecl StringCchCatW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64)" ?StringCchCatW@@YAJPEAG_KPEBG@Z
0x180008494: "struct MASTERKEY_CACHE_ENTRY * __ptr64 __cdecl FindMasterKeyEntry(struct _LIST_ENTRY * __ptr64,unsigned short const * __ptr64,struct _LUID * __ptr64,struct _GUID * __ptr64)" ?FindMasterKeyEntry@@YAPEAUMASTERKEY_CACHE_ENTRY@@PEAU_LIST_ENTRY@@PEBGPEAU_LUID@@PEAU_GUID@@@Z
0x180028848: "__cdecl _imp_SetThreadToken" __imp_SetThreadToken
0x18000ACD0: "__cdecl _delayLoadHelper2" __delayLoadHelper2
0x180028D10: "__cdecl _imp_RtlFreeUnicodeString" __imp_RtlFreeUnicodeString
0x180028918: "__cdecl _imp_CompareStringOrdinal" __imp_CompareStringOrdinal
0x18002E824: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x180028A98: "__cdecl _imp__o__execute_onexit_table" __imp__o__execute_onexit_table
0x18002AC68: "UnknownUserAccountType" ??_C@_1CO@EBMJOHKN@?$AAU?$AAn?$AAk?$AAn?$AAo?$AAw?$AAn?$AAU?$AAs?$AAe?$AAr?$AAA?$AAc?$AAc?$AAo?$AAu?$AAn?$AAt?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x18002E5CC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-crt-private-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-crt-private-l1-1-0
0x18002B0E8: "DESX-%d " ??_C@_1BC@CEJJHIKM@?$AAD?$AAE?$AAS?$AAX?$AA?9?$AA?$CF?$AAd?$AA?5?$AA?$AA@
0x180024F24: IsLocal
0x18000A958: "public: int __cdecl CLinkedList::Initialize(void) __ptr64" ?Initialize@CLinkedList@@QEAAHXZ
0x18002AE50: "ERROR_NOT_ENOUGH_SERVER_MEMORY" ??_C@_0BP@HBAMKKKH@ERROR_NOT_ENOUGH_SERVER_MEMORY?$AA@
0x18002B5A0: WPP_7a810d74fb663fa763476e0773cd764a_Traceguids
0x1800318D0: "__cdecl _scrt_current_native_startup_state" __scrt_current_native_startup_state
0x1800312D8: "__cdecl _security_cookie_complement" __security_cookie_complement
0x180029198: "MAC Alg" ??_C@_1BA@NMJGLCLG@?$AAM?$AAA?$AAC?$AA?5?$AAA?$AAl?$AAg?$AA?$AA@
0x180031B80: "unsigned char * __ptr64 __ptr64 g_pbPreferredKey" ?g_pbPreferredKey@@3PEAEEA
0x180008380: "void __cdecl DPAPINotifyLogonTerminated(struct _LUID * __ptr64)" ?DPAPINotifyLogonTerminated@@YAXPEAU_LUID@@@Z
0x180029378: "ncalrpc" ??_C@_1BA@EONDGCCM@?$AAn?$AAc?$AAa?$AAl?$AAr?$AAp?$AAc?$AA?$AA@
0x18002B0D0: "3DES-%d " ??_C@_1BC@ENFFKEMF@?$AA3?$AAD?$AAE?$AAS?$AA?9?$AA?$CF?$AAd?$AA?5?$AA?$AA@
0x180034000: "__cdecl _imp_CertCreateCertificateContext" __imp_CertCreateCertificateContext
0x180008778: "unsigned long __cdecl CPSOverrideToLocalSystem(void * __ptr64,int * __ptr64,int * __ptr64)" ?CPSOverrideToLocalSystem@@YAKPEAXPEAH1@Z
0x180028878: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x1800286D8: "__cdecl _imp_NdrServerCallAll" __imp_NdrServerCallAll
0x18000BD8A: "__cdecl configure_narrow_argv" _configure_narrow_argv
0x180028698: "__cdecl _imp_RpcNetworkIsProtseqValidW" __imp_RpcNetworkIsProtseqValidW
0x18001A3F0: "long __cdecl LsaIfSynchronizeMasterKeys(void * __ptr64,struct _CREDENTIAL_KEY * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64)" ?LsaIfSynchronizeMasterKeys@@YAJPEAXPEAU_CREDENTIAL_KEY@@PEAK2@Z
0x18000973C: QueryDerivedCredential
0x18000C780: "__cdecl _vcrt_thread_attach" __vcrt_thread_attach
0x180031950: "__cdecl _hmod__api_ms_win_security_lsalookup_l2_1_0_dll" __hmod__api_ms_win_security_lsalookup_l2_1_0_dll
0x18001D4B8: "void __cdecl DeleteKeyCache(void)" ?DeleteKeyCache@@YAXXZ
0x180028620: "__cdecl _imp_RpcServerRegisterIfEx" __imp_RpcServerRegisterIfEx
0x18002E6D0: "__cdecl _IMPORT_DESCRIPTOR_CRYPTBASE" __IMPORT_DESCRIPTOR_CRYPTBASE
0x180004E40: "unsigned long __cdecl SPCryptUnprotect(void * __ptr64,unsigned char * __ptr64 * __ptr64,unsigned long * __ptr64,unsigned char * __ptr64,unsigned long,unsigned short * __ptr64 * __ptr64,unsigned char * __ptr64,unsigned long,struct _SSCRYPTPROTECTDATA_PROMPTSTRUCT * __ptr64,unsigned long,unsigned char * __ptr64,unsigned long)" ?SPCryptUnprotect@@YAKPEAXPEAPEAEPEAKPEAEKPEAPEAG3KPEAU_SSCRYPTPROTECTDATA_PROMPTSTRUCT@@K3K@Z
0x180028D28: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x18002AA68: "RpcStatus" ??_C@_09JLPKPADE@RpcStatus?$AA@
0x180024E90: WppControlCallback
0x18000C950: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x18002DFA8: USERENV_NULL_THUNK_DATA_DLN
0x18002AD88: "AADUserAccountType" ??_C@_1CG@PCFLKABB@?$AAA?$AAA?$AAD?$AAU?$AAs?$AAe?$AAr?$AAA?$AAc?$AAc?$AAo?$AAu?$AAn?$AAt?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x180034010: "__cdecl _imp_CertFreeCertificateContext" __imp_CertFreeCertificateContext
0x180028638: "__cdecl _imp_RpcServerRegisterAuthInfoW" __imp_RpcServerRegisterAuthInfoW
0x180028748: "__cdecl _imp_CreateFileW" __imp_CreateFileW
0x180024198: "unsigned long __cdecl HashMasterKeyFile(void * __ptr64,struct _MK_LOCATION * __ptr64,void * __ptr64)" ?HashMasterKeyFile@@YAKPEAXPEAU_MK_LOCATION@@0@Z
0x180029488: "protected_storage" ??_C@_1CE@KBIBKOB@?$AAp?$AAr?$AAo?$AAt?$AAe?$AAc?$AAt?$AAe?$AAd?$AA_?$AAs?$AAt?$AAo?$AAr?$AAa?$AAg?$AAe?$AA?$AA@
0x180007CE8: MyGuidToStringW
0x180014618: "int __cdecl GetDomainControllerNameByToken(void * __ptr64,unsigned short * __ptr64,unsigned long * __ptr64,int,int)" ?GetDomainControllerNameByToken@@YAHPEAXPEAGPEAKHH@Z
0x18000A334: WPP_INIT_CONTROL_ARRAY
0x18000BDE0: "__cdecl vsnwprintf" _vsnwprintf
0x18002A150: "__cdecl TraceLoggingMetadata" _TraceLoggingMetadata
0x180001720: "unsigned char __cdecl DPAPICryptProtectData(void * __ptr64,unsigned long,struct _UNICODE_STRING * __ptr64,void * __ptr64,unsigned long,void * __ptr64,void * __ptr64,unsigned long,void * __ptr64 * __ptr64,unsigned long * __ptr64)" ?DPAPICryptProtectData@@YAEPEAXKPEAU_UNICODE_STRING@@0K00KPEAPEAXPEAK@Z
0x180001BEC: "int __cdecl CheckToStompMasterKey(struct MASTERKEY_STORED_ON_DISK * __ptr64,void * __ptr64,int * __ptr64)" ?CheckToStompMasterKey@@YAHPEAUMASTERKEY_STORED_ON_DISK@@PEAXPEAH@Z
0x18001DBC0: "int __cdecl ConvertRecoveredBlobToW2KBlob(unsigned char * __ptr64,unsigned long,unsigned char * __ptr64,unsigned long,void * __ptr64,unsigned char * __ptr64 * __ptr64,unsigned long * __ptr64)" ?ConvertRecoveredBlobToW2KBlob@@YAHPEAEK0KPEAXPEAPEAEPEAK@Z
0x1800206B0: "unsigned long __cdecl CreateSystemDirectory(unsigned short const * __ptr64)" ?CreateSystemDirectory@@YAKPEBG@Z
0x1800144D4: "unsigned long __cdecl CreateDcNameMutexes(struct _LUID * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,void * __ptr64 * __ptr64,void * __ptr64 * __ptr64)" ?CreateDcNameMutexes@@YAKPEAU_LUID@@PEBG1PEAPEAX2@Z
0x180017ED4: "public: __cdecl ScopedSSFree::~ScopedSSFree(void) __ptr64" ??1ScopedSSFree@@QEAA@XZ
0x180028DD0: "__cdecl _xp_a" __xp_a
0x180028A48: "__cdecl _imp__o__initialize_narrow_environment" __imp__o__initialize_narrow_environment
0x180008D9C: "unsigned long __cdecl RetrieveCurrentDerivedCredential(int,struct _LUID * __ptr64,struct _GUID * __ptr64,int,unsigned char * __ptr64,unsigned long,unsigned char * __ptr64 const,unsigned long * __ptr64)" ?RetrieveCurrentDerivedCredential@@YAKHPEAU_LUID@@PEAU_GUID@@HPEAEKQEAEPEAK@Z
0x18000C78C: "__cdecl is_c_termination_complete" _is_c_termination_complete
0x180034068: CRYPTSP_NULL_THUNK_DATA_DLA
0x180017048: ?zInternalRelatedId@?$_TlgActivityBase@V?$TraceLoggingActivity@$1?g_hDpapiTraceLoggingProvider@@3QEBU_TlgProvider_t@@EB$0EAAAAAAAAAAA@$04U_TlgReflectorTag_Param0IsHProvider@@@@$0EAAAAAAAAAAA@$04@@QEBAPEBU_GUID@@XZ
0x18002AB98: ETW_LOG_DPAPI_MASTER_KEY_INACCESIBLE
0x1800288B8: "__cdecl _imp_RegLoadKeyW" __imp_RegLoadKeyW
0x18000BAB4: "__cdecl RTC_Initialize" _RTC_Initialize
0x180031998: g_ulAdditionalProbeSize
0x18001CB84: "void __cdecl WriteCredKeyEventLog(struct DP_KEK * __ptr64,unsigned short * __ptr64,void * __ptr64)" ?WriteCredKeyEventLog@@YAXPEAUDP_KEK@@PEAGPEAX@Z
0x180015E5C: "unsigned long __cdecl DecryptCredentialHistory(struct _CREDENTIAL_HISTORY * __ptr64,unsigned char * __ptr64 const,unsigned char * __ptr64 const,unsigned char * __ptr64 const)" ?DecryptCredentialHistory@@YAKPEAU_CREDENTIAL_HISTORY@@QEAE11@Z
0x180028C30: "__cdecl _imp_BCryptDestroyKey" __imp_BCryptDestroyKey
0x180028CA0: "__cdecl _imp_EtwGetTraceLoggerHandle" __imp_EtwGetTraceLoggerHandle
0x18002B028: "1.3.14.3.2.29" ??_C@_0O@OIACHIAA@1?43?414?43?42?429?$AA@
0x180028978: "__cdecl _imp_AcquireSRWLockShared" __imp_AcquireSRWLockShared
0x180034028: "__cdecl _imp_CryptImportPublicKeyInfoEx2" __imp_CryptImportPublicKeyInfoEx2
0x18002B5B8: "__cdecl _pfnDliFailureHook2" __pfnDliFailureHook2
0x18000C780: "__cdecl _vcrt_thread_detach" __vcrt_thread_detach
0x1800072A0: "unsigned long __cdecl CPSCreateServerContext(struct CRYPT_SERVER_CONTEXT * __ptr64,void * __ptr64,unsigned short const * __ptr64 * __ptr64,unsigned long * __ptr64)" ?CPSCreateServerContext@@YAKPEAUCRYPT_SERVER_CONTEXT@@PEAXPEAPEBGPEAK@Z
0x180031948: "__cdecl _hmod__USERENV_dll" __hmod__USERENV_dll
0x180019758: "int __cdecl GetLocalKeyUserEncryptionKey(void * __ptr64,struct MASTERKEY_STORED * __ptr64,unsigned char * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64)" ?GetLocalKeyUserEncryptionKey@@YAHPEAXPEAUMASTERKEY_STORED@@PEAEPEAK3@Z
0x18000C03D: "__cdecl _tailMerge_samcli_dll" __tailMerge_samcli_dll
0x18002BBF8: "__cdecl _rtc_taa" __rtc_taa
0x18002034C: "unsigned long __cdecl AlgIDToString(unsigned short * __ptr64,unsigned long,unsigned long,unsigned long)" ?AlgIDToString@@YAKPEAGKKK@Z
0x18002E6BC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-1-0
0x180028C48: bcrypt_NULL_THUNK_DATA
0x180028AD8: "__cdecl _imp__initterm_e" __imp__initterm_e
0x1800287D0: api-ms-win-core-heap-l2-1-0_NULL_THUNK_DATA
0x18002E3F8: api-ms-win-security-sddl-l1-1-0_NULL_THUNK_DATA_DLB
0x180003820: PKCS5DerivePBKDF2
0x180028660: "__cdecl _imp_RpcServerUnregisterIf" __imp_RpcServerUnregisterIf
0x180028AE0: api-ms-win-crt-runtime-l1-1-0_NULL_THUNK_DATA
0x18000BD18: "__cdecl _scrt_is_ucrt_dll_in_use" __scrt_is_ucrt_dll_in_use
0x18000A1A4: WppInitUm
0x18000C780: "__cdecl _vcrt_initialize" __vcrt_initialize
0x180028970: "__cdecl _imp_SetEvent" __imp_SetEvent
0x180028A50: "__cdecl _imp__initialize_onexit_table" __imp__initialize_onexit_table
0x18002A930: WPP_b5a4f15cd7df30209566702d6fdfc3ae_Traceguids
0x180001E80: "unsigned long __cdecl GetDcMutexName(struct _LUID * __ptr64,unsigned short const * __ptr64,unsigned long,unsigned short * __ptr64)" ?GetDcMutexName@@YAKPEAU_LUID@@PEBGKPEAG@Z
0x1800290B0: "S-1-5-20" ??_C@_1BC@BNEOOHKE@?$AAS?$AA?9?$AA1?$AA?9?$AA5?$AA?9?$AA2?$AA0?$AA?$AA@
0x180028D78: "__cdecl _imp_RtlEnterCriticalSection" __imp_RtlEnterCriticalSection
0x180001C64: "__cdecl TlgWrite" _TlgWrite
0x180028D98: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x180031988: "__cdecl _hmod__SAMSRV_dll" __hmod__SAMSRV_dll
0x18000BE60: NdrServerCall2
0x1800289A0: "__cdecl _imp_InitializeCriticalSection" __imp_InitializeCriticalSection
0x180008BA8: DeriveWithHMAC_SHA1
0x18000C1D2: "__cdecl _imp_load_UnloadUserProfile" __imp_load_UnloadUserProfile
0x180028B28: "__cdecl _imp_RevertToSelf" __imp_RevertToSelf
0x180022610: s_SSRecoverImportRecoveryKey
0x18002B4A8: "SYNCHIST" ??_C@_1BC@ELHLLMFN@?$AAS?$AAY?$AAN?$AAC?$AAH?$AAI?$AAS?$AAT?$AA?$AA@
0x18002AF34: "E_FAIL" ??_C@_06FOOEOEIK@E_FAIL?$AA@
0x18002BBE8: "__cdecl _rtc_iaa" __rtc_iaa
0x180028790: "__cdecl _imp_SetFilePointer" __imp_SetFilePointer
0x18000C780: "__cdecl _acrt_thread_attach" __acrt_thread_attach
0x18002E7C0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-string-obsolete-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-string-obsolete-l1-1-0
0x1800299E0: "onecore\ds\security\cryptoapi\se" ??_C@_0DM@CFIOJPCA@onecore?2ds?2security?2cryptoapi?2se@
0x18002A9D0: "ntStatus" ??_C@_08DBOEHLEI@ntStatus?$AA@
0x18002AC50: WPP_d80c608ea8cf3bad9841162680d1f14d_Traceguids
0x1800142DC: "unsigned long __cdecl CPSGetDomainControllerName(unsigned short * __ptr64,unsigned long * __ptr64,int,int)" ?CPSGetDomainControllerName@@YAKPEAGPEAKHH@Z
0x18002DFD8: api-ms-win-security-lsalookup-l2-1-0_NULL_THUNK_DATA_DLN
0x18002DFC8: api-ms-win-security-lsalookup-l1-1-0_NULL_THUNK_DATA_DLN
0x180006280: "int __cdecl IsDomainBackupRequired(void * __ptr64)" ?IsDomainBackupRequired@@YAHPEAX@Z
0x1800340E8: api-ms-win-security-lsalookup-l1-1-0_NULL_THUNK_DATA_DLA
0x18002E448: api-ms-win-security-lsalookup-l2-1-0_NULL_THUNK_DATA_DLB
0x18002E498: api-ms-win-security-lsalookup-l1-1-0_NULL_THUNK_DATA_DLB
0x1800340F8: api-ms-win-security-lsalookup-l2-1-0_NULL_THUNK_DATA_DLA
0x180028AA8: "__cdecl _imp__o___stdio_common_vswprintf" __imp__o___stdio_common_vswprintf
0x18002B098: "MD5-%d " ??_C@_1BA@NIINDPNH@?$AAM?$AAD?$AA5?$AA?9?$AA?$CF?$AAd?$AA?5?$AA?$AA@
0x180028DA0: "__cdecl _xc_a" __xc_a
0x18000C311: "__cdecl _imp_load_CertOpenStore" __imp_load_CertOpenStore
0x18002B228: "RC5-%d " ??_C@_1BA@NFINMMLD@?$AAR?$AAC?$AA5?$AA?9?$AA?$CF?$AAd?$AA?5?$AA?$AA@
0x18002E4E8: CRYPTSP_NULL_THUNK_DATA_DLB
0x180001D04: "__cdecl TlgKeywordOn" _TlgKeywordOn
0x180028950: "__cdecl _imp_OpenMutexW" __imp_OpenMutexW
0x18002ABA8: ETW_LOG_DPAPI_MASTER_KEY_SYNCHRONIZATION_FAILED
0x18002AB38: ETW_LOG_DPAPI_MASTER_KEY_CREATED
0x18002E6F8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-timezone-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-timezone-l1-1-0
0x180023054: "void __cdecl std::_Make_heap_unchecked<struct _MK_LOCATION * __ptr64,bool (__cdecl*)(struct _MK_LOCATION,struct _MK_LOCATION * __ptr64)>(struct _MK_LOCATION * __ptr64,struct _MK_LOCATION * __ptr64,bool (__cdecl*)(struct _MK_LOCATION,struct _MK_LOCATION))" ??$_Make_heap_unchecked@PEAU_MK_LOCATION@@P6A_NU1@0@Z@std@@YAXPEAU_MK_LOCATION@@0P6A_NU1@1@Z@Z
0x180028BE0: "__cdecl _imp_BCryptCreateHash" __imp_BCryptCreateHash
0x180023664: "void __cdecl std::_Pop_heap_hole_by_index<struct _MK_LOCATION * __ptr64,struct _MK_LOCATION,bool (__cdecl*)(struct _MK_LOCATION,struct _MK_LOCATION * __ptr64)>(struct _MK_LOCATION * __ptr64,__int64,__int64,struct _MK_LOCATION &&,bool (__cdecl*)(struct _MK_LOCATION,struct _MK_LOCATION &&))" ??$_Pop_heap_hole_by_index@PEAU_MK_LOCATION@@U1@P6A_NU1@0@Z@std@@YAXPEAU_MK_LOCATION@@_J1$$QEAU1@P6A_NU1@3@Z@Z
0x180028760: "__cdecl _imp_FindClose" __imp_FindClose
0x180029720: "__cdecl pDefaultRawDllMain" _pDefaultRawDllMain
0x1800289E0: "__cdecl _imp_GetComputerNameExW" __imp_GetComputerNameExW
0x180028A88: "__cdecl _imp__o__configure_narrow_argv" __imp__o__configure_narrow_argv
0x1800312F0: "__cdecl _scrt_ucrt_dll_is_in_use" __scrt_ucrt_dll_is_in_use
0x1800078D0: GetTokenUserSid
0x180028F18: "AES" ??_C@_17PJMHNJHG@?$AAA?$AAE?$AAS?$AA?$AA@
0x180008B24: StringCchCopyW
0x1800023D8: "long __cdecl GetPreferredMasterKeyGuid(void * __ptr64,unsigned short const * __ptr64,struct _GUID * __ptr64)" ?GetPreferredMasterKeyGuid@@YAJPEAXPEBGPEAU_GUID@@@Z
0x1800260A4: TlgUnregisterAggregateProvider
0x18001A120: "unsigned long __cdecl LsaIfGetCurrentCredentialKeyId(void * __ptr64,struct _GUID * __ptr64)" ?LsaIfGetCurrentCredentialKeyId@@YAKPEAXPEAU_GUID@@@Z
0x1800027EC: "int __cdecl GetMasterKey(void * __ptr64,unsigned long,unsigned short const * __ptr64,void * __ptr64,struct _LUID * __ptr64,int,unsigned short * __ptr64 const,struct DP_KEK * __ptr64,struct DP_KEK * __ptr64,unsigned char * __ptr64 * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64)" ?GetMasterKey@@YAHPEAXKPEBG0PEAU_LUID@@HQEAGPEAUDP_KEK@@4PEAPEAEPEAK6@Z
0x180034150: api-ms-win-security-sddl-l1-1-0_NULL_THUNK_DATA_DLA
0x180028C68: "__cdecl _imp_NCryptOpenStorageProvider" __imp_NCryptOpenStorageProvider
0x180034018: "__cdecl _imp_CertOpenStore" __imp_CertOpenStore
0x18001D690: "long __cdecl BackupCallback(void * __ptr64,void * __ptr64)" ?BackupCallback@@YAJPEAX0@Z
0x1800312E8: "__cdecl _memcpy_nt_iters" __memcpy_nt_iters
0x18002B468: "onecore\ds\security\cryptoapi\se" ??_C@_0DL@LEABJPNN@onecore?2ds?2security?2cryptoapi?2se@
0x180001124: "unsigned long __cdecl EncryptMasterKeyToStorage(struct MASTERKEY_STORED * __ptr64,unsigned long,unsigned int,unsigned int,unsigned char * __ptr64,unsigned long,unsigned long,unsigned char * __ptr64,unsigned long)" ?EncryptMasterKeyToStorage@@YAKPEAUMASTERKEY_STORED@@KIIPEAEKK1K@Z
0x180028A78: "__cdecl _imp__o_malloc" __imp__o_malloc
0x18002A920: "dwRetVal" ??_C@_08DAPGFGMK@dwRetVal?$AA@
0x180028778: "__cdecl _imp_DeleteFileW" __imp_DeleteFileW
0x18001FB4C: "int __cdecl SaveBackupKey(struct _GUID * __ptr64,unsigned char * __ptr64,unsigned long)" ?SaveBackupKey@@YAHPEAU_GUID@@PEAEK@Z
0x180028ED8: "__cdecl _guard_iat_table" __guard_iat_table
0x180024F18: "__cdecl TlgDefineProvider_annotation__Tlgg_hDpapiTraceLoggingProviderProv" _TlgDefineProvider_annotation__Tlgg_hDpapiTraceLoggingProviderProv
0x180024DA0: WPP_SF__HEX_
0x18000C923: memcpy
0x1800081F4: "int __cdecl InsertMasterKeyCache(void * __ptr64,struct _LUID * __ptr64,unsigned short const * __ptr64,struct _GUID * __ptr64,unsigned char * __ptr64,unsigned long)" ?InsertMasterKeyCache@@YAHPEAXPEAU_LUID@@PEBGPEAU_GUID@@PEAEK@Z
0x180007D50: "unsigned long __cdecl DecryptMasterKeyToMemoryEx(unsigned char * __ptr64,unsigned long,unsigned char * __ptr64,unsigned long,void * __ptr64 (__cdecl*)(unsigned __int64),unsigned char * __ptr64 * __ptr64,unsigned long * __ptr64,unsigned int * __ptr64,unsigned int * __ptr64,unsigned long * __ptr64)" ?DecryptMasterKeyToMemoryEx@@YAKPEAEK0KP6APEAX_K@ZPEAPEAEPEAKPEAI54@Z
0x180028C00: "__cdecl _imp_BCryptDecrypt" __imp_BCryptDecrypt
0x180017070: ?zInternalStart@?$_TlgActivityBase@V?$TraceLoggingActivity@$1?g_hDpapiTraceLoggingProvider@@3QEBU_TlgProvider_t@@EB$0EAAAAAAAAAAA@$04U_TlgReflectorTag_Param0IsHProvider@@@@$0EAAAAAAAAAAA@$04@@QEAAXXZ
0x18002B340: "Security\Recovery\" ??_C@_1CG@LHNCAMFI@?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?2?$AAR?$AAe?$AAc?$AAo?$AAv?$AAe?$AAr?$AAy?$AA?2?$AA?$AA@
0x18001ACE0: "unsigned long __cdecl QueueSyncMasterKeysThreadFunc(void * __ptr64)" ?QueueSyncMasterKeysThreadFunc@@YAKPEAX@Z
0x180028B10: "__cdecl _imp_EventWriteTransfer" __imp_EventWriteTransfer
0x18000C542: "__cdecl _imp_load_SystemFunction007" __imp_load_SystemFunction007
0x18000854C: "int __cdecl GetMasterKeyUserEncryptionKey(void * __ptr64,struct _GUID * __ptr64,void * __ptr64,unsigned long,unsigned char * __ptr64 const,unsigned long * __ptr64)" ?GetMasterKeyUserEncryptionKey@@YAHPEAXPEAU_GUID@@0KQEAEPEAK@Z
0x180031B98: "unsigned char * __ptr64 __ptr64 g_pbW2KPreferredKey" ?g_pbW2KPreferredKey@@3PEAEEA
0x180028AE8: "__cdecl _imp_memset" __imp_memset
0x18000C44B: "__cdecl _imp_load_LsaClose" __imp_load_LsaClose
0x180022900: s_SSRecoverPassword
0x18000C780: "__cdecl _acrt_initialize" __acrt_initialize
0x180028980: "__cdecl _imp_CreateEventW" __imp_CreateEventW
0x18000BD36: "__cdecl initterm" _initterm
0x18000C2C9: "__cdecl _imp_load_CertAddCertificateContextToStore" __imp_load_CertAddCertificateContextToStore
0x180029750: "__cdecl _sz_netutils_dll" __sz_netutils_dll
0x180028618: "__cdecl _imp_RpcServerInqDefaultPrincNameW" __imp_RpcServerInqDefaultPrincNameW
0x18000BDAE: "__cdecl o__initialize_onexit_table" _o__initialize_onexit_table
0x180017ED4: "public: __cdecl ScopedLocalFree::~ScopedLocalFree(void) __ptr64" ??1ScopedLocalFree@@QEAA@XZ
0x1800299D0: WPP_b9c41bfc85bb35356b712877b5fa8b60_Traceguids
0x18002E658: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0
0x180031990: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x180007A10: GetBCryptProviderHandle
0x180020EA0: "unsigned long __cdecl MigrateLegacyRecovery(unsigned short * __ptr64)" ?MigrateLegacyRecovery@@YAKPEAG@Z
0x180029348: "\PIPE\protected_storage" ??_C@_1DA@GHAOMPJC@?$AA?2?$AAP?$AAI?$AAP?$AAE?$AA?2?$AAp?$AAr?$AAo?$AAt?$AAe?$AAc?$AAt?$AAe?$AAd?$AA_?$AAs?$AAt?$AAo?$AAr?$AAa?$AAg?$AAe?$AA?$AA@
0x1800289C0: "__cdecl _imp_Sleep" __imp_Sleep
0x18002AC48: "sResult" ??_C@_07LMHMJEJF@sResult?$AA@
0x180028DC8: "__cdecl _xi_z" __xi_z
0x1800289D0: "__cdecl _imp_GetSystemTime" __imp_GetSystemTime
0x180009BC0: "unsigned long __cdecl CPSGetDerivedCredential(void * __ptr64,struct _GUID * __ptr64,unsigned long,unsigned char * __ptr64,unsigned long,unsigned char * __ptr64 const,unsigned long * __ptr64)" ?CPSGetDerivedCredential@@YAKPEAXPEAU_GUID@@KPEAEKQEAEPEAK@Z
0x180017838: WPP_SF__guid_ddd
0x180028718: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x18002AB08: "ntstatus" ??_C@_08POFJECNE@ntstatus?$AA@
0x180034108: "__cdecl _imp_LsaStorePrivateData" __imp_LsaStorePrivateData
0x180028C90: "__cdecl _imp_EtwRegisterTraceGuidsW" __imp_EtwRegisterTraceGuidsW
0x18000BD5A: "__cdecl _C_specific_handler" __C_specific_handler
0x180028930: "__cdecl _imp_lstrlenW" __imp_lstrlenW
0x180003FC4: "unsigned long __cdecl OpenFileInStorageArea(void * __ptr64,unsigned long,unsigned short const * __ptr64,unsigned short const * __ptr64,void * __ptr64 * __ptr64)" ?OpenFileInStorageArea@@YAKPEAXKPEBG1PEAPEAX@Z
0x180002640: "int __cdecl BCryptProvIsMatch(struct _ELT * __ptr64,struct _ELT * __ptr64)" ?BCryptProvIsMatch@@YAHPEAU_ELT@@0@Z
0x180022CF0: s_SSRecoverQueryStatus
0x180002680: MIDL_user_free
0x180028948: "__cdecl _imp_ReleaseSRWLockExclusive" __imp_ReleaseSRWLockExclusive
0x18000C780: "__cdecl _acrt_thread_detach" __acrt_thread_detach
0x18000C031: "__cdecl _imp_load_NetUserGetInfo" __imp_load_NetUserGetInfo
0x180005F10: "unsigned long __cdecl UpdateGlobals(int)" ?UpdateGlobals@@YAKH@Z
0x180029840: "__cdecl _sz_api_ms_win_security_lsapolicy_l1_1_0_dll" __sz_api_ms_win_security_lsapolicy_l1_1_0_dll
0x180034170: netutils_NULL_THUNK_DATA_DLA
0x18002E3D8: netutils_NULL_THUNK_DATA_DLB
0x18002B2C0: "onecore\ds\security\cryptoapi\se" ??_C@_0DM@INOJMAIM@onecore?2ds?2security?2cryptoapi?2se@
0x18002E050: netutils_NULL_THUNK_DATA_DLN
0x180009ACC: DestroyCredentialHistoryMap
0x18000C92F: memmove
0x180025300: s_LRpcSIDKeyUnprotect
0x18000C54E: "__cdecl _tailMerge_cryptsp_dll" __tailMerge_cryptsp_dll
0x18000AC78: "void __cdecl InitLsaString(struct _UNICODE_STRING * __ptr64,unsigned short * __ptr64)" ?InitLsaString@@YAXPEAU_UNICODE_STRING@@PEAG@Z
0x180031A20: WPP_REGISTRATION_GUIDS
0x18000C22C: "__cdecl _imp_load_CryptEncodeObject" __imp_load_CryptEncodeObject
0x18000C0BC: "__cdecl _imp_load_ConvertStringSecurityDescriptorToSecurityDescriptorW" __imp_load_ConvertStringSecurityDescriptorToSecurityDescriptorW
0x180024830: "void * __ptr64 __cdecl OpenSyncHistoryFile(void * __ptr64,unsigned long)" ?OpenSyncHistoryFile@@YAPEAXPEAXK@Z
0x1800128C0: DebugTraceError
0x18000B90C: "__cdecl _scrt_uninitialize_crt" __scrt_uninitialize_crt
0x18000BDD2: malloc
0x18002B4E0: "MD4" ??_C@_17MDMFNACG@?$AAM?$AAD?$AA4?$AA?$AA@
0x180029210: "ProtectionPolicy" ??_C@_1CC@NKJBMMKM@?$AAP?$AAr?$AAo?$AAt?$AAe?$AAc?$AAt?$AAi?$AAo?$AAn?$AAP?$AAo?$AAl?$AAi?$AAc?$AAy?$AA?$AA@
0x1800287B0: api-ms-win-core-handle-l1-1-0_NULL_THUNK_DATA
0x1800095DC: "unsigned long __cdecl CPSGetUserName(void * __ptr64,unsigned short * __ptr64 * __ptr64,unsigned long * __ptr64)" ?CPSGetUserName@@YAKPEAXPEAPEAGPEAK@Z
0x180031B40: Microsoft_Windows_Crypto_DPAPIEnableBits
0x180034060: "__cdecl _imp_SystemFunction007" __imp_SystemFunction007
0x1800288E0: "__cdecl _imp_RegCloseKey" __imp_RegCloseKey
0x180009C9C: GetThreadAuthenticationId
0x18000C828: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x180028D48: "__cdecl _imp_NtCreateEvent" __imp_NtCreateEvent
0x180031960: "__cdecl _hmod__api_ms_win_security_lsalookup_l1_1_0_dll" __hmod__api_ms_win_security_lsalookup_l1_1_0_dll
0x18002A810: WPP_ThisDir_CTLGUID_DPAPIGlobalDebugTraceControlGuid
0x18000BD66: "__cdecl o___std_type_info_destroy_list" _o___std_type_info_destroy_list
0x18000B840: "__cdecl _scrt_is_nonwritable_in_current_image" __scrt_is_nonwritable_in_current_image
0x18002B160: "RSA Exchange-%d " ??_C@_1CC@DCEJDCAE@?$AAR?$AAS?$AAA?$AA?5?$AAE?$AAx?$AAc?$AAh?$AAa?$AAn?$AAg?$AAe?$AA?9?$AA?$CF?$AAd?$AA?5?$AA?$AA@
0x18002ACC8: "PrimaryDomainUserAccountType" ??_C@_1DK@PJPIMFOH@?$AAP?$AAr?$AAi?$AAm?$AAa?$AAr?$AAy?$AAD?$AAo?$AAm?$AAa?$AAi?$AAn?$AAU?$AAs?$AAe?$AAr?$AAA?$AAc?$AAc?$AAo?$AAu?$AAn?$AAt?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x18002AB28: ETW_LOG_BACKUPKEYSVC_STOPPED
0x18002AF58: "CAPIPRIVATEBLOB" ??_C@_1CA@LHEFDM@?$AAC?$AAA?$AAP?$AAI?$AAP?$AAR?$AAI?$AAV?$AAA?$AAT?$AAE?$AAB?$AAL?$AAO?$AAB?$AA?$AA@
0x18000BD7E: "__cdecl cexit" _cexit
0x18000BDC6: "__cdecl o_free" _o_free
0x18000B710: "__cdecl _scrt_initialize_crt" __scrt_initialize_crt
0x18001D260: WPP_SF_S_guid_
0x18001519C: "unsigned long __cdecl WriteBackupPublicKeyToStorage(void * __ptr64,void * __ptr64,unsigned short * __ptr64,unsigned char * __ptr64,unsigned long)" ?WriteBackupPublicKeyToStorage@@YAKPEAX0PEAGPEAEK@Z
0x18000C780: "__cdecl _acrt_uninitialize" __acrt_uninitialize
0x180028AF0: api-ms-win-crt-string-l1-1-0_NULL_THUNK_DATA
0x18000BD96: "__cdecl o__execute_onexit_table" _o__execute_onexit_table
0x18002AE88: "ERROR_INVALID_PARAMETER" ??_C@_0BI@KPGALHPM@ERROR_INVALID_PARAMETER?$AA@
0x18000B538: "void __cdecl __scrt_uninitialize_type_info(void)" ?__scrt_uninitialize_type_info@@YAXXZ
0x18002AC98: "LocalUserAccountType" ??_C@_1CK@CIPNIIBC@?$AAL?$AAo?$AAc?$AAa?$AAl?$AAU?$AAs?$AAe?$AAr?$AAA?$AAc?$AAc?$AAo?$AAu?$AAn?$AAt?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x18002DF38: CRYPT32_NULL_THUNK_DATA_DLN
0x1800288D0: "__cdecl _imp_RegUnLoadKeyW" __imp_RegUnLoadKeyW
0x18002B260: "SHA2-%d " ??_C@_1BC@KHOHBACB@?$AAS?$AAH?$AAA?$AA2?$AA?9?$AA?$CF?$AAd?$AA?5?$AA?$AA@
0x180028928: api-ms-win-core-string-l1-1-0_NULL_THUNK_DATA
0x180031A28: WPP_MAIN_CB
0x180031B78: "int g_fSetupPreferredAttempted" ?g_fSetupPreferredAttempted@@3HA
0x18002B388: WPP_345217f2ea943d22ab4f888c64718761_Traceguids
0x180028D80: "__cdecl _imp_RtlEqualDomainName" __imp_RtlEqualDomainName
0x18002E5F4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0
0x18002065C: "public: __cdecl ScopedCloseHandle::~ScopedCloseHandle(void) __ptr64" ??1ScopedCloseHandle@@QEAA@XZ
0x180029310: "CREDHIST" ??_C@_1BC@EKDBJJK@?$AAC?$AAR?$AAE?$AAD?$AAH?$AAI?$AAS?$AAT?$AA?$AA@
0x1800288E8: "__cdecl _imp_RegSetValueExW" __imp_RegSetValueExW
0x180028BA0: "__cdecl _imp_AllocateLocallyUniqueId" __imp_AllocateLocallyUniqueId
0x18001D544: WPP_SF__guid_Sdd
0x18002B4D0: WPP_b14219665eb63dd67731635c1f9ea748_Traceguids
0x180028960: "__cdecl _imp_TryAcquireSRWLockExclusive" __imp_TryAcquireSRWLockExclusive
0x180028C58: lsass_NULL_THUNK_DATA
0x18002B5B0: "__cdecl _DefaultResolveDelayLoadedAPIFlags" __DefaultResolveDelayLoadedAPIFlags
0x18002A9B0: "BK-" ??_C@_17MGKCGIEK@?$AAB?$AAK?$AA?9?$AA?$AA@
0x18000AD10: "long __cdecl QueryLsaInterface(enum _LSA_INTERFACE_TYPE,void * __ptr64 * __ptr64)" ?QueryLsaInterface@@YAJW4_LSA_INTERFACE_TYPE@@PEAPEAX@Z
0x18002E7AC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-threadpool-legacy-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-threadpool-legacy-l1-1-0
0x18002B278: "Unknown 0x%lx - %d" ??_C@_1CG@FMNBKBFE@?$AAU?$AAn?$AAk?$AAn?$AAo?$AAw?$AAn?$AA?5?$AA0?$AAx?$AA?$CF?$AAl?$AAx?$AA?5?$AA?9?$AA?5?$AA?$CF?$AAd?$AA?$AA@
0x18000C780: "__cdecl _scrt_stub_for_acrt_thread_detach" __scrt_stub_for_acrt_thread_detach
0x18002E70C: "__cdecl _IMPORT_DESCRIPTOR_ncrypt" __IMPORT_DESCRIPTOR_ncrypt
0x18002E680: "__cdecl _IMPORT_DESCRIPTOR_bcrypt" __IMPORT_DESCRIPTOR_bcrypt
0x18002B328: "Kerberos" ??_C@_1BC@KFNANHG@?$AAK?$AAe?$AAr?$AAb?$AAe?$AAr?$AAo?$AAs?$AA?$AA@
0x180031940: "__cdecl _hmod__api_ms_win_security_sddl_l1_1_0_dll" __hmod__api_ms_win_security_sddl_l1_1_0_dll
0x1800203D8: "void __cdecl FMyReverseBytes(unsigned char * __ptr64,unsigned long)" ?FMyReverseBytes@@YAXPEAEK@Z
0x180028A08: "__cdecl _imp_CloseThreadpoolTimer" __imp_CloseThreadpoolTimer
0x18000B6BC: "__cdecl _scrt_dllmain_uninitialize_c" __scrt_dllmain_uninitialize_c
0x180031920: "__cdecl _hmod__CRYPT32_dll" __hmod__CRYPT32_dll
0x180029298: "MasterKeyLegacyCompliance" ??_C@_1DE@OKOJLHFC@?$AAM?$AAa?$AAs?$AAt?$AAe?$AAr?$AAK?$AAe?$AAy?$AAL?$AAe?$AAg?$AAa?$AAc?$AAy?$AAC?$AAo?$AAm?$AAp?$AAl?$AAi?$AAa?$AAn?$AAc?$AAe?$AA?$AA@
0x180029870: "__cdecl _sz_CRYPTSP_dll" __sz_CRYPTSP_dll
0x18001CD20: McTemplateU0b32zk
0x18000123C: "unsigned long __cdecl PersistMasterKeyToStorage(struct MASTERKEY_STORED * __ptr64,unsigned long,unsigned char * __ptr64,unsigned long)" ?PersistMasterKeyToStorage@@YAKPEAUMASTERKEY_STORED@@KPEAEK@Z
0x180012D44: "unsigned long __cdecl CPSFreeContext(void * __ptr64)" ?CPSFreeContext@@YAKPEAX@Z
0x180028D68: "__cdecl _imp_RtlInitializeCriticalSection" __imp_RtlInitializeCriticalSection
0x180034178: "__cdecl _imp_NetUserGetInfo" __imp_NetUserGetInfo
0x18000BDA2: "__cdecl o__initialize_narrow_environment" _o__initialize_narrow_environment
0x180034128: "__cdecl _imp_LsaRetrievePrivateData" __imp_LsaRetrievePrivateData
0x180002DBC: "int __cdecl ReadMasterKey(void * __ptr64,struct MASTERKEY_STORED * __ptr64)" ?ReadMasterKey@@YAHPEAXPEAUMASTERKEY_STORED@@@Z
0x180034070: "__cdecl _imp_SIDKeyProtect" __imp_SIDKeyProtect
0x1800319BC: "int fKeyCacheInitialized" ?fKeyCacheInitialized@@3HA
0x1800289A8: "__cdecl _imp_EnterCriticalSection" __imp_EnterCriticalSection
0x180031928: "__cdecl _hmod__logoncli_dll" __hmod__logoncli_dll
0x180028968: "__cdecl _imp_ReleaseSRWLockShared" __imp_ReleaseSRWLockShared
0x1800288F0: api-ms-win-core-registry-l1-1-0_NULL_THUNK_DATA
0x18000C780: "__cdecl _scrt_stub_for_acrt_initialize" __scrt_stub_for_acrt_initialize
0x180034098: "__cdecl _imp_SeciIsProtectedUser" __imp_SeciIsProtectedUser
0x180028738: api-ms-win-core-errorhandling-l1-1-0_NULL_THUNK_DATA
0x180028A58: "__cdecl _imp__o__seh_filter_dll" __imp__o__seh_filter_dll
0x180021E58: DPAPICreateNestedDirectories
0x180028DE0: "__cdecl _xt_a" __xt_a
0x18002A9B8: "BlockLength" ??_C@_1BI@JJDKEEML@?$AAB?$AAl?$AAo?$AAc?$AAk?$AAL?$AAe?$AAn?$AAg?$AAt?$AAh?$AA?$AA@
0x180031914: "__cdecl _scrt_debugger_hook_flag" __scrt_debugger_hook_flag
0x1800024F4: FMyPrimitiveSHA
0x180028868: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x180031308: "struct _GUID g_guidDefaultProvider" ?g_guidDefaultProvider@@3U_GUID@@A
0x1800340B8: "__cdecl _imp_LoadUserProfileW" __imp_LoadUserProfileW
0x180028A58: "__cdecl _imp__seh_filter_dll" __imp__seh_filter_dll
0x180034040: "__cdecl _imp_CryptEncodeObject" __imp_CryptEncodeObject
0x18002DDA0: "__cdecl _DELAY_IMPORT_DESCRIPTOR_USERENV_dll" __DELAY_IMPORT_DESCRIPTOR_USERENV_dll
0x180028BD8: "__cdecl _imp_BCryptHashData" __imp_BCryptHashData
0x18000C798: DllMain
0x1800250E8: "public: int __cdecl CLinkedList::Reset(void) __ptr64" ?Reset@CLinkedList@@QEAAHXZ
0x180002714: "int __cdecl GetMasterKeyByGuid(void * __ptr64,unsigned short const * __ptr64,void * __ptr64,struct _LUID * __ptr64,int,struct _GUID * __ptr64,unsigned char * __ptr64 * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64)" ?GetMasterKeyByGuid@@YAHPEAXPEBG0PEAU_LUID@@HPEAU_GUID@@PEAPEAEPEAK5@Z
0x18000C780: "__cdecl _scrt_stub_for_acrt_thread_attach" __scrt_stub_for_acrt_thread_attach
0x1800340A0: SspiCli_NULL_THUNK_DATA_DLA
0x18001A970: "unsigned long __cdecl QueueBackupMasterKeyThreadFunc(void * __ptr64)" ?QueueBackupMasterKeyThreadFunc@@YAKPEAX@Z
0x180028640: "__cdecl _imp_UuidFromStringW" __imp_UuidFromStringW
0x18000BAF8: "__cdecl RTC_Terminate" _RTC_Terminate
0x18000C88C: "__cdecl _GSHandlerCheck_SEH" __GSHandlerCheck_SEH
0x18002E630: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-string-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-string-l1-1-0
0x180028A68: "__cdecl _imp__wcsicmp" __imp__wcsicmp
0x180028A80: "__cdecl _imp_wcscat_s" __imp_wcscat_s
0x18002DFB8: api-ms-win-core-registry-l2-1-0_NULL_THUNK_DATA_DLN
0x180028B90: "__cdecl _imp_IsValidSid" __imp_IsValidSid
0x180028AA0: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x1800019BC: "int __cdecl WriteMasterKey(void * __ptr64,struct MASTERKEY_STORED * __ptr64)" ?WriteMasterKey@@YAHPEAXPEAUMASTERKEY_STORED@@@Z
0x180028908: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x180028818: api-ms-win-core-libraryloader-l1-2-0_NULL_THUNK_DATA
0x180031AF8: "struct _RTL_CRITICAL_SECTION g_csInitialization" ?g_csInitialization@@3U_RTL_CRITICAL_SECTION@@A
0x18000C457: "__cdecl _tailMerge_api_ms_win_security_lsapolicy_l1_1_0_dll" __tailMerge_api_ms_win_security_lsapolicy_l1_1_0_dll
0x180014394: "int __cdecl CPSWouldRDRDeadLock(void * __ptr64,struct _LUID * __ptr64)" ?CPSWouldRDRDeadLock@@YAHPEAXPEAU_LUID@@@Z
0x180034030: "__cdecl _imp_CertCloseStore" __imp_CertCloseStore
0x18002E838: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-eventing-provider-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-eventing-provider-l1-1-0
0x18001CFCC: McTemplateU0zz
0x1800199E0: "unsigned long __cdecl HandleDomainUserPasswordChange(void * __ptr64,struct _CREDENTIAL_KEY * __ptr64)" ?HandleDomainUserPasswordChange@@YAKPEAXPEAU_CREDENTIAL_KEY@@@Z
0x18000A998: "unsigned long __cdecl CPSGetSystemCredential(void * __ptr64,int,unsigned char * __ptr64 const)" ?CPSGetSystemCredential@@YAKPEAXHQEAE@Z
0x18001CE98: McTemplateU0jz
0x180028728: "__cdecl _imp_GetLastError" __imp_GetLastError
0x180034140: "__cdecl _imp_ConvertSidToStringSidW" __imp_ConvertSidToStringSidW
0x18002183C: "unsigned long __cdecl RecoverFindRecoveryPublic(void * __ptr64,void * __ptr64,struct _CERT_CONTEXT const * __ptr64 * __ptr64,unsigned char * __ptr64,int)" ?RecoverFindRecoveryPublic@@YAKPEAX0PEAPEBU_CERT_CONTEXT@@PEAEH@Z
0x1800287A0: "__cdecl _imp_DuplicateHandle" __imp_DuplicateHandle
0x180028B18: api-ms-win-eventing-provider-l1-1-0_NULL_THUNK_DATA
0x18000C804: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x1800033B8: "void __cdecl TryUnInitPerUserLock(struct _PER_USER_LOCK_ENTRY * __ptr64)" ?TryUnInitPerUserLock@@YAXPEAU_PER_USER_LOCK_ENTRY@@@Z
0x18002DEA0: "__cdecl _DELAY_IMPORT_DESCRIPTOR_SAMSRV_dll" __DELAY_IMPORT_DESCRIPTOR_SAMSRV_dll
0x18001E208: "int __cdecl CreateSystemCredentials(void)" ?CreateSystemCredentials@@YAHXZ
0x180028D38: "__cdecl _imp_EtwTraceMessage" __imp_EtwTraceMessage
0x18000BDA2: "__cdecl initialize_narrow_environment" _initialize_narrow_environment
0x180029260: "MasterKeyLegacyNt4Domain" ??_C@_1DC@LIGCHEOH@?$AAM?$AAa?$AAs?$AAt?$AAe?$AAr?$AAK?$AAe?$AAy?$AAL?$AAe?$AAg?$AAa?$AAc?$AAy?$AAN?$AAt?$AA4?$AAD?$AAo?$AAm?$AAa?$AAi?$AAn?$AA?$AA@
0x180028AB8: "__cdecl _imp_memcmp" __imp_memcmp
0x18000AA64: "unsigned long __cdecl QuerySystemCredentials(unsigned char * __ptr64 const,unsigned char * __ptr64 const)" ?QuerySystemCredentials@@YAKQEAE0@Z
0x18000ABA8: "int __cdecl WaitOnSAMDatabase(void)" ?WaitOnSAMDatabase@@YAHXZ
0x180031010: ETW_LOG_DPAPI_PROVIDER_Context
0x180006AB0: "unsigned long __cdecl CPSGetUserStorageArea(void * __ptr64,void * __ptr64,int,int,unsigned short * __ptr64 * __ptr64)" ?CPSGetUserStorageArea@@YAKPEAX0HHPEAPEAG@Z
0x180024F18: "__cdecl TlgDefineProvider_annotation__TlgTlgAggregateInternalProviderProv" _TlgDefineProvider_annotation__TlgTlgAggregateInternalProviderProv
0x180028C10: "__cdecl _imp_BCryptCloseAlgorithmProvider" __imp_BCryptCloseAlgorithmProvider
0x1800312E4: "__cdecl _isa_enabled" __isa_enabled
0x180028B30: "__cdecl _imp_EqualSid" __imp_EqualSid
0x18002B188: "DSS-%d " ??_C@_1BA@MBOGGOEN@?$AAD?$AAS?$AAS?$AA?9?$AA?$CF?$AAd?$AA?5?$AA?$AA@
0x180034088: "__cdecl _imp_SamIChangePasswordForeignUser" __imp_SamIChangePasswordForeignUser
0x1800291A8: "Encr Alg Key Size" ??_C@_1CE@KNKJBCJJ@?$AAE?$AAn?$AAc?$AAr?$AA?5?$AAA?$AAl?$AAg?$AA?5?$AAK?$AAe?$AAy?$AA?5?$AAS?$AAi?$AAz?$AAe?$AA?$AA@
0x180034020: "__cdecl _imp_CertFindCertificateInStore" __imp_CertFindCertificateInStore
0x18000B464: "void __cdecl operator delete(void * __ptr64,unsigned __int64)" ??3@YAXPEAX_K@Z
0x180028F20: "SHA1" ??_C@_19DILNDFJH@?$AAS?$AAH?$AAA?$AA1?$AA?$AA@
0x1800207D0: "unsigned long __cdecl DecryptRecoveryPassword(void * __ptr64,unsigned char * __ptr64,unsigned long,unsigned short * __ptr64 * __ptr64)" ?DecryptRecoveryPassword@@YAKPEAXPEAEKPEAPEAG@Z
0x1800298B0: "NULL" ??_C@_19CIJIHAKK@?$AAN?$AAU?$AAL?$AAL?$AA?$AA@
0x180028C80: "__cdecl _imp_NCryptSetProperty" __imp_NCryptSetProperty
0x18002AF40: "G$BCKUPKEY_" ??_C@_1BI@GEEHNGOI@?$AAG?$AA$?$AAB?$AAC?$AAK?$AAU?$AAP?$AAK?$AAE?$AAY?$AA_?$AA?$AA@
0x18002E874: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-0
0x180028880: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x180028990: "__cdecl _imp_WaitForSingleObject" __imp_WaitForSingleObject
0x180002D5C: "int __cdecl IsBackupMasterKeyRequired(struct MASTERKEY_STORED * __ptr64,int * __ptr64)" ?IsBackupMasterKeyRequired@@YAHPEAUMASTERKEY_STORED@@PEAH@Z
0x18002E7D4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-obsolete-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-obsolete-l1-1-0
0x18002DDE0: "__cdecl _DELAY_IMPORT_DESCRIPTOR_api_ms_win_core_registry_l2_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_api_ms_win_core_registry_l2_1_0_dll
0x18002B0C0: "DES-%d " ??_C@_1BA@FPJGBJJH@?$AAD?$AAE?$AAS?$AA?9?$AA?$CF?$AAd?$AA?5?$AA?$AA@
0x18002DE20: "__cdecl _DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_lsapolicy_l1_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_lsapolicy_l1_1_0_dll
0x1800298A0: "__cdecl _sz_SAMSRV_dll" __sz_SAMSRV_dll
0x180024D50: "bool __cdecl lessMK_LOCATION(struct _MK_LOCATION,struct _MK_LOCATION)" ?lessMK_LOCATION@@YA_NU_MK_LOCATION@@0@Z
0x18000BDAE: "__cdecl initialize_onexit_table" _initialize_onexit_table
0x18002B5B0: "__cdecl _ResolveDelayLoadedAPIFlags" __ResolveDelayLoadedAPIFlags
0x1800318D8: "__cdecl _scrt_native_startup_lock" __scrt_native_startup_lock
0x180034118: "__cdecl _imp_LsaQueryInformationPolicy" __imp_LsaQueryInformationPolicy
0x18000C341: "__cdecl _tailMerge_api_ms_win_core_registry_l2_1_0_dll" __tailMerge_api_ms_win_core_registry_l2_1_0_dll
0x18002E510: SspiCli_NULL_THUNK_DATA_DLB
0x1800296D0: "DPAPI_SYSTEM" ??_C@_1BK@KEJDOLMM@?$AAD?$AAP?$AAA?$AAP?$AAI?$AA_?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?$AA@
0x18000C676: "__cdecl _tailMerge_sspicli_dll" __tailMerge_sspicli_dll
0x18002E520: SAMSRV_NULL_THUNK_DATA_DLB
0x18001AE0C: "unsigned long __cdecl ReencryptMasterKey(void * __ptr64,struct _LUID * __ptr64,unsigned short * __ptr64,unsigned short * __ptr64)" ?ReencryptMasterKey@@YAKPEAXPEAU_LUID@@PEAG2@Z
0x180034090: SAMSRV_NULL_THUNK_DATA_DLA
0x180025220: s_LRpcSIDKeyProtect
0x180028658: "__cdecl _imp_RpcServerRegisterIf3" __imp_RpcServerRegisterIf3
0x180028688: "__cdecl _imp_RpcEpResolveBinding" __imp_RpcEpResolveBinding
0x18001EC20: "unsigned long __cdecl InitializeBackupKeyServer(void)" ?InitializeBackupKeyServer@@YAKXZ
0x18000379C: "int __cdecl CheckIfUpgradeNeeded(unsigned int,unsigned int,unsigned int,unsigned int,unsigned long)" ?CheckIfUpgradeNeeded@@YAHIIIIK@Z
0x18002DF70: SAMSRV_NULL_THUNK_DATA_DLN
0x180001E40: "long __cdecl StringCchCopyW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64)" ?StringCchCopyW@@YAJPEAG_KPEBG@Z
0x18002AEA0: "NTE_BAD_KEY" ??_C@_0M@LGBEGMKM@NTE_BAD_KEY?$AA@
0x180021C80: "long __cdecl StringCchCopyNW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64,unsigned __int64)" ?StringCchCopyNW@@YAJPEAG_KPEBG1@Z
0x18002B250: "AES-%d " ??_C@_1BA@CFMPMEIB@?$AAA?$AAE?$AAS?$AA?9?$AA?$CF?$AAd?$AA?5?$AA?$AA@
0x18002AFC8: "2.5.4.3" ??_C@_07FBAAFAAA@2?45?44?43?$AA@
0x18002ABF8: "onecore\ds\security\cryptoapi\se" ??_C@_0DM@HANIFEFA@onecore?2ds?2security?2cryptoapi?2se@
0x180022E18: "void __cdecl std::_Guess_median_unchecked<struct _MK_LOCATION * __ptr64,bool (__cdecl*)(struct _MK_LOCATION,struct _MK_LOCATION * __ptr64)>(struct _MK_LOCATION * __ptr64,struct _MK_LOCATION * __ptr64,struct _MK_LOCATION * __ptr64,bool (__cdecl*)(struct _MK_LOCATION,struct _MK_LOCATION))" ??$_Guess_median_unchecked@PEAU_MK_LOCATION@@P6A_NU1@0@Z@std@@YAXPEAU_MK_LOCATION@@00P6A_NU1@1@Z@Z
0x18000C780: "__cdecl _vcrt_uninitialize" __vcrt_uninitialize
0x180028CD0: "__cdecl _imp_RtlFreeHeap" __imp_RtlFreeHeap
0x18002B038: WPP_3de555af60de3b894af5e82ae6b794e1_Traceguids
0x18002A800: WPP_7dfb33797e1f344b49f5817a8d670487_Traceguids
0x180028B78: "__cdecl _imp_DuplicateTokenEx" __imp_DuplicateTokenEx
0x180028788: "__cdecl _imp_FlushFileBuffers" __imp_FlushFileBuffers
0x180028890: "__cdecl _imp_IsProcessorFeaturePresent" __imp_IsProcessorFeaturePresent
0x180003674: "unsigned long __cdecl QueryMasterKeyFromStorage(struct MASTERKEY_STORED * __ptr64,unsigned long,unsigned char * __ptr64 * __ptr64,unsigned long * __ptr64)" ?QueryMasterKeyFromStorage@@YAKPEAUMASTERKEY_STORED@@KPEAPEAEPEAK@Z
0x180028DB8: "__cdecl _PLEASE_LINK_WITH_legacy_stdio_wide_specifiers.lib" __PLEASE_LINK_WITH_legacy_stdio_wide_specifiers.lib
0x18001BD64: "int __cdecl SetPreferredMasterKeyGuid(void * __ptr64,unsigned short const * __ptr64,struct _GUID * __ptr64)" ?SetPreferredMasterKeyGuid@@YAHPEAXPEBGPEAU_GUID@@@Z
0x180028F08: "SHA512" ??_C@_1O@GKBAHMNF@?$AAS?$AAH?$AAA?$AA5?$AA1?$AA2?$AA?$AA@
0x18000342C: "struct _PER_USER_LOCK_ENTRY * __ptr64 __cdecl GetLockEntryForUser(void * __ptr64,int)" ?GetLockEntryForUser@@YAPEAU_PER_USER_LOCK_ENTRY@@PEAXH@Z
0x18002E734: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0
0x18001DF1C: "int __cdecl CreateBackupKey(struct _GUID * __ptr64,unsigned char * __ptr64 * __ptr64,unsigned long * __ptr64,void * __ptr64 * __ptr64)" ?CreateBackupKey@@YAHPEAU_GUID@@PEAPEAEPEAKPEAPEAX@Z
0x18001FE0C: "unsigned long __cdecl StopBackupKeyServer(void)" ?StopBackupKeyServer@@YAKXZ
0x1800154EC: WPP_SF_
0x180028EE0: "dpapisrv" ??_C@_1BC@JJOKJJBF@?$AAd?$AAp?$AAa?$AAp?$AAi?$AAs?$AAr?$AAv?$AA?$AA@
0x180028920: "__cdecl _imp_CompareStringW" __imp_CompareStringW
0x180028940: "__cdecl _imp_AcquireSRWLockExclusive" __imp_AcquireSRWLockExclusive
0x18002DEC0: "__cdecl _NULL_DELAY_IMPORT_DESCRIPTOR" __NULL_DELAY_IMPORT_DESCRIPTOR
0x1800287D8: "__cdecl _imp_LocalSize" __imp_LocalSize
0x18002AB18: "dwStatus" ??_C@_08CKEFPGDF@dwStatus?$AA@
0x18002AE30: "Deadlock error" ??_C@_0P@IBILOGME@Deadlock?5error?$AA@
0x18000BDD2: "__cdecl o_malloc" _o_malloc
0x180020684: "public: __cdecl ScopedRegUnload::~ScopedRegUnload(void) __ptr64" ??1ScopedRegUnload@@QEAA@XZ
0x180028938: api-ms-win-core-string-obsolete-l1-1-0_NULL_THUNK_DATA
0x18000B5EC: "__cdecl _scrt_dllmain_before_initialize_c" __scrt_dllmain_before_initialize_c
0x180028680: "__cdecl _imp_RpcBindingFree" __imp_RpcBindingFree
0x180008AB8: GetTextualSid
0x180028CE0: "__cdecl _imp_NtPrivilegeCheck" __imp_NtPrivilegeCheck
0x18000B100: "__cdecl DllMainCRTStartup" _DllMainCRTStartup
0x18000BE50: NdrServerCallAll
0x18001CE04: McTemplateU0jtdd
0x18001ED64: "int __cdecl RestoreFromRecoverableBlob(void * __ptr64,int,unsigned char * __ptr64,unsigned long,unsigned char * __ptr64 * __ptr64,unsigned long * __ptr64)" ?RestoreFromRecoverableBlob@@YAHPEAXHPEAEKPEAPEAEPEAK@Z
0x180028AD0: "__cdecl _imp__initterm" __imp__initterm
0x1800286A8: "__cdecl _imp_RpcStringBindingComposeW" __imp_RpcStringBindingComposeW
0x18000C4E8: "__cdecl _imp_load_LsaQueryInformationPolicy" __imp_load_LsaQueryInformationPolicy
0x18002E75C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-debug-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-debug-l1-1-0
0x1800297E0: "__cdecl _sz_api_ms_win_core_registry_l2_1_0_dll" __sz_api_ms_win_core_registry_l2_1_0_dll
0x180023AB8: "public: __cdecl ScopedSSFreeMK_LOCATION_Array::~ScopedSSFreeMK_LOCATION_Array(void) __ptr64" ??1ScopedSSFreeMK_LOCATION_Array@@QEAA@XZ
0x18002AEF8: "onecore\ds\security\cryptoapi\se" ??_C@_0DK@GANLEOPN@onecore?2ds?2security?2cryptoapi?2se@
0x18002B1A8: "DH Ephemeral-%d " ??_C@_1CC@IDKDHKII@?$AAD?$AAH?$AA?5?$AAE?$AAp?$AAh?$AAe?$AAm?$AAe?$AAr?$AAa?$AAl?$AA?9?$AA?$CF?$AAd?$AA?5?$AA?$AA@
0x18000C5D9: "__cdecl _tailMerge_kdscli_dll" __tailMerge_kdscli_dll
0x1800286B8: "__cdecl _imp_RpcImpersonateClient" __imp_RpcImpersonateClient
0x180029914: "Status" ??_C@_06PGDKHFME@Status?$AA@
0x180028730: "__cdecl _imp_SetLastError" __imp_SetLastError
0x180001318: "unsigned long __cdecl EncryptMasterKeyToMemory(unsigned int,unsigned int,unsigned char * __ptr64,unsigned long,unsigned long,unsigned char * __ptr64,unsigned long,unsigned char * __ptr64 * __ptr64,unsigned long * __ptr64)" ?EncryptMasterKeyToMemory@@YAKIIPEAEKK0KPEAPEAEPEAK@Z
0x18002B4E8: "RC4" ??_C@_17HLFLMDBJ@?$AAR?$AAC?$AA4?$AA?$AA@
0x180029068: "RtlGetNtProductType" ??_C@_0BE@CFBJIPFO@RtlGetNtProductType?$AA@
0x18002B2A0: "TRUE" ??_C@_04HCDDPBNL@TRUE?$AA@
0x18002E860: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-1" __IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-1
0x180031930: "__cdecl _hmod__netutils_dll" __hmod__netutils_dll
0x180029388: "SidKey Local End Point" ??_C@_1CO@OMFCFKMI@?$AAS?$AAi?$AAd?$AAK?$AAe?$AAy?$AA?5?$AAL?$AAo?$AAc?$AAa?$AAl?$AA?5?$AAE?$AAn?$AAd?$AA?5?$AAP?$AAo?$AAi?$AAn?$AAt?$AA?$AA@
0x180029238: "DistributeBackupKey" ??_C@_1CI@CHGJHKBH@?$AAD?$AAi?$AAs?$AAt?$AAr?$AAi?$AAb?$AAu?$AAt?$AAe?$AAB?$AAa?$AAc?$AAk?$AAu?$AAp?$AAK?$AAe?$AAy?$AA?$AA@
0x18001ECF0: "unsigned long __cdecl QueueInitBackupKeyServerThreadFunc(void * __ptr64)" ?QueueInitBackupKeyServerThreadFunc@@YAKPEAX@Z
0x180028810: "__cdecl _imp_GetModuleFileNameW" __imp_GetModuleFileNameW
0x180031B74: "unsigned long g_cbW2KPreferredKey" ?g_cbW2KPreferredKey@@3KA
0x180019D34: "int __cdecl InitializeMasterKeyPolicy(void * __ptr64,struct MASTERKEY_STORED * __ptr64,int * __ptr64)" ?InitializeMasterKeyPolicy@@YAHPEAXPEAUMASTERKEY_STORED@@PEAH@Z
0x18002AF78: "G$BCKUPKEY_P" ??_C@_1BK@DCBKGFOA@?$AAG?$AA$?$AAB?$AAC?$AAK?$AAU?$AAP?$AAK?$AAE?$AAY?$AA_?$AAP?$AA?$AA@
0x18002AB78: ETW_LOG_DPAPI_UNPROTECT_FAILED
0x180007230: "unsigned long __cdecl CPSImpersonateClient(void * __ptr64)" ?CPSImpersonateClient@@YAKPEAX@Z
0x18002E720: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0
0x180017334: LogonCredVerifySignature
0x18002B550: "{34e4912d-f770-4f49-b020-96dd74c" ??_C@_1EO@PDBHJFDD@?$AA?$HL?$AA3?$AA4?$AAe?$AA4?$AA9?$AA1?$AA2?$AAd?$AA?9?$AAf?$AA7?$AA7?$AA0?$AA?9?$AA4?$AAf?$AA4?$AA9?$AA?9?$AAb?$AA0?$AA2?$AA0?$AA?9?$AA9?$AA6?$AAd?$AAd?$AA7?$AA4?$AAc@
0x18000BD8A: "__cdecl o__configure_narrow_argv" _o__configure_narrow_argv
0x18001A64C: "unsigned long __cdecl QueueBackupMasterKey(void * __ptr64,struct MASTERKEY_STORED * __ptr64,unsigned char * __ptr64,unsigned long,unsigned char * __ptr64,unsigned long,unsigned long)" ?QueueBackupMasterKey@@YAKPEAXPEAUMASTERKEY_STORED@@PEAEK2KK@Z
0x18000B54C: "__cdecl _scrt_initialize_default_local_stdio_options" __scrt_initialize_default_local_stdio_options
0x18002B300: WPP_05cb51aa3e363f64d471ead143d9bd18_Traceguids
0x1800285D0: "__cdecl _imp_SystemFunction041" __imp_SystemFunction041
0x1800285D8: "__cdecl _imp_SystemFunction040" __imp_SystemFunction040
0x180028D60: "__cdecl _imp_NtCreateFile" __imp_NtCreateFile
0x180028B20: "__cdecl _imp_AdjustTokenPrivileges" __imp_AdjustTokenPrivileges
0x180021F00: RecoverChangePasswordNotify
0x18000B760: "__cdecl _scrt_initialize_onexit_tables" __scrt_initialize_onexit_tables
0x180028D90: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x180029900: "dwError" ??_C@_07KEIALHHM@dwError?$AA@
0x180034130: "__cdecl _imp_LsaLookupNames2" __imp_LsaLookupNames2
0x180028670: "__cdecl _imp_RpcServerUseProtseqEpW" __imp_RpcServerUseProtseqEpW
0x18000BF94: "__cdecl _imp_load_CryptImportPublicKeyInfoEx2" __imp_load_CryptImportPublicKeyInfoEx2
0x180028600: "__cdecl _imp_RtlAsn1GetModuleHandle" __imp_RtlAsn1GetModuleHandle
0x180028C40: "__cdecl _imp_BCryptGetProperty" __imp_BCryptGetProperty
0x18000B950: "__cdecl _crt_debugger_hook" __crt_debugger_hook
0x18002B218: "TEK-%d " ??_C@_1BA@LDKFLMAL@?$AAT?$AAE?$AAK?$AA?9?$AA?$CF?$AAd?$AA?5?$AA?$AA@
0x180028740: "__cdecl _imp_FindFirstFileW" __imp_FindFirstFileW
0x18002A7F8: "NULL" ??_C@_04HIBGFPH@NULL?$AA@
0x180028C20: "__cdecl _imp_BCryptEncrypt" __imp_BCryptEncrypt
0x180028870: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x18000BFB2: "__cdecl _tailMerge_netutils_dll" __tailMerge_netutils_dll
0x180028A00: "__cdecl _imp_CreateThreadpoolTimer" __imp_CreateThreadpoolTimer
0x1800290D0: "\AppData\Roaming" ??_C@_1CC@LGPIBLKE@?$AA?2?$AAA?$AAp?$AAp?$AAD?$AAa?$AAt?$AAa?$AA?2?$AAR?$AAo?$AAa?$AAm?$AAi?$AAn?$AAg?$AA?$AA@
0x180017EFC: "public: __cdecl ScopedSecureSSFree::~ScopedSecureSSFree(void) __ptr64" ??1ScopedSecureSSFree@@QEAA@XZ
0x1800285E0: CRYPTBASE_NULL_THUNK_DATA
0x18001FC40: "int __cdecl SetPreferredBackupKeyGuid(unsigned long,struct _GUID * __ptr64)" ?SetPreferredBackupKeyGuid@@YAHKPEAU_GUID@@@Z
0x180028B80: "__cdecl _imp_GetTokenInformation" __imp_GetTokenInformation
0x180028CC0: "__cdecl _imp_EtwEventRegister" __imp_EtwEventRegister
0x180031978: "__cdecl _hmod__KdsCli_dll" __hmod__KdsCli_dll
0x18002E3A8: CRYPT32_NULL_THUNK_DATA_DLB
0x180029740: "__cdecl _sz_logoncli_dll" __sz_logoncli_dll
0x180028D08: "__cdecl _imp_RtlNtStatusToDosError" __imp_RtlNtStatusToDosError
0x180031B60: "struct _GUID g_guidW2KPreferredKey" ?g_guidW2KPreferredKey@@3U_GUID@@A
0x18000BF09: "__cdecl _imp_load_DsGetDcNameW" __imp_load_DsGetDcNameW
0x180028BD0: "__cdecl _imp_BCryptDestroyHash" __imp_BCryptDestroyHash
0x1800319C4: "int g_fSystemCredsInitialized" ?g_fSystemCredsInitialized@@3HA
0x180028C18: "__cdecl _imp_BCryptDeriveKeyCapi" __imp_BCryptDeriveKeyCapi
0x180029324: "DPAPI" ??_C@_05IMEIDMEJ@DPAPI?$AA@
0x1800286E8: "__cdecl _imp_IsDebuggerPresent" __imp_IsDebuggerPresent
0x180028C70: "__cdecl _imp_NCryptFreeObject" __imp_NCryptFreeObject
0x1800041A0: "unsigned char __cdecl DPAPICryptUnprotectDataEx(void * __ptr64,unsigned long,void * __ptr64,unsigned long,void * __ptr64,void * __ptr64,unsigned long,unsigned char * __ptr64,unsigned long,struct _UNICODE_STRING * __ptr64,void * __ptr64 * __ptr64,unsigned long * __ptr64)" ?DPAPICryptUnprotectDataEx@@YAEPEAXK0K00KPEAEKPEAU_UNICODE_STRING@@PEAPEAXPEAK@Z
0x18000A710: SIDKeyEnableLRpcInterface
0x1800289F8: api-ms-win-core-sysinfo-l1-1-0_NULL_THUNK_DATA
0x180028DB0: "__cdecl _xi_a" __xi_a
0x180028898: api-ms-win-core-processthreads-l1-1-1_NULL_THUNK_DATA
0x1800289D8: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x18002B370: "Recovery\" ??_C@_1BE@JJBBCDAO@?$AAR?$AAe?$AAc?$AAo?$AAv?$AAe?$AAr?$AAy?$AA?2?$AA?$AA@
0x1800286F0: api-ms-win-core-debug-l1-1-0_NULL_THUNK_DATA
0x18000B638: "__cdecl _scrt_dllmain_crt_thread_detach" __scrt_dllmain_crt_thread_detach
0x18000A824: "unsigned long __cdecl InitializeGlobals(void)" ?InitializeGlobals@@YAKXZ
0x180028708: "__cdecl _imp_ResolveDelayLoadedAPI" __imp_ResolveDelayLoadedAPI
0x180017E24: "void __cdecl _TlgWriteActivityAutoStop<35184372088832,5>(struct _TlgProvider_t const * __ptr64,struct _GUID const * __ptr64)" ??$_TlgWriteActivityAutoStop@$0CAAAAAAAAAAA@$04@@YAXPEBU_TlgProvider_t@@PEBU_GUID@@@Z
0x180023244: "struct std::pair<struct _MK_LOCATION * __ptr64,struct _MK_LOCATION * __ptr64> __cdecl std::_Partition_by_median_guess_unchecked<struct _MK_LOCATION * __ptr64,bool (__cdecl*)(struct _MK_LOCATION,struct _MK_LOCATION * __ptr64)>(struct _MK_LOCATION * __ptr64,struct _MK_LOCATION * __ptr64,bool (__cdecl*)(struct _MK_LOCATION,struct _MK_LOCATION))" ??$_Partition_by_median_guess_unchecked@PEAU_MK_LOCATION@@P6A_NU1@0@Z@std@@YA?AU?$pair@PEAU_MK_LOCATION@@PEAU1@@0@PEAU_MK_LOCATION@@0P6A_NU2@1@Z@Z
0x180029D88: Microsoft_Windows_Crypto_DPAPILevels
0x18000B570: "__cdecl _scrt_acquire_startup_lock" __scrt_acquire_startup_lock
0x180028A28: "__cdecl _imp_QueueUserWorkItem" __imp_QueueUserWorkItem
0x180025490: SidKeyDebugTraceError
0x180028BB0: api-ms-win-security-base-l1-1-0_NULL_THUNK_DATA
0x180015C40: "long __cdecl DPAPINotifyCredentialKeyChange(void * __ptr64,struct _CREDENTIAL_KEY * __ptr64,struct _CREDENTIAL_KEY * __ptr64,unsigned long)" ?DPAPINotifyCredentialKeyChange@@YAJPEAXPEAU_CREDENTIAL_KEY@@1K@Z
0x18001D338: WPP_SF__guid_S
0x18002A644: ?_TlgEvent@?3???$_TlgWriteActivityAutoStop@$0CAAAAAAAAAAA@$04@@YAXPEBU_TlgProvider_t@@PEBU_GUID@@@Z@4U<unnamed-type-_TlgEvent>@?3???$_TlgWriteActivityAutoStop@$0CAAAAAAAAAAA@$04@@YAX01@Z@B
0x18002A1C7: ?_TlgEvent@?3???$_TlgWriteActivityAutoStop@$0EAAAAAAAAAAA@$04@@YAXPEBU_TlgProvider_t@@PEBU_GUID@@@Z@4U<unnamed-type-_TlgEvent>@?3???$_TlgWriteActivityAutoStop@$0EAAAAAAAAAAA@$04@@YAX01@Z@B
0x180025FE0: "void __cdecl TlgAggregateInternalRegisteredProviderEtwCallback(struct _GUID const * __ptr64,unsigned long,unsigned char,unsigned __int64,unsigned __int64,struct _EVENT_FILTER_DESCRIPTOR * __ptr64,void * __ptr64)" ?TlgAggregateInternalRegisteredProviderEtwCallback@@YAXPEBU_GUID@@KE_K1PEAU_EVENT_FILTER_DESCRIPTOR@@PEAX@Z
0x180034160: logoncli_NULL_THUNK_DATA_DLA
0x18002E3C0: logoncli_NULL_THUNK_DATA_DLB
0x18002E040: logoncli_NULL_THUNK_DATA_DLN
0x180028CE8: "__cdecl _imp_NtOpenThreadToken" __imp_NtOpenThreadToken
0x180001D30: "long __cdecl LsaIfIsDcTargetForRecovery(struct _LUID * __ptr64,unsigned short const * __ptr64,int * __ptr64)" ?LsaIfIsDcTargetForRecovery@@YAJPEAU_LUID@@PEBGPEAH@Z
0x180034168: "__cdecl _imp_NetApiBufferFree" __imp_NetApiBufferFree
0x1800340D0: "__cdecl _imp_RegSaveKeyW" __imp_RegSaveKeyW
0x18000BD7E: "__cdecl o__cexit" _o__cexit
0x180021CE8: "unsigned long __cdecl VerifyCredentials(unsigned short * __ptr64,unsigned short * __ptr64,unsigned short * __ptr64)" ?VerifyCredentials@@YAKPEAG00@Z
0x180017D54: WPP_SF_Dd
0x1800178A0: WPP_SF_dd
0x180029038: "Preferred" ??_C@_1BE@JOOKCCGJ@?$AAP?$AAr?$AAe?$AAf?$AAe?$AAr?$AAr?$AAe?$AAd?$AA?$AA@
0x18001D7D0: "int __cdecl BackupToRecoverableBlobW2K(void * __ptr64,unsigned char * __ptr64,unsigned long,unsigned char * __ptr64 * __ptr64,unsigned long * __ptr64)" ?BackupToRecoverableBlobW2K@@YAHPEAXPEAEKPEAPEAEPEAK@Z
0x18001E138: "int __cdecl CreateBackupKeyW2K(struct _GUID * __ptr64,unsigned char * __ptr64 * __ptr64,unsigned long * __ptr64)" ?CreateBackupKeyW2K@@YAHPEAU_GUID@@PEAPEAEPEAK@Z
0x180009B24: PRGetProfilePath
0x180029D58: Microsoft_Windows_Crypto_DPAPIKeywords
0x1800243E0: "int __cdecl IsMasterKeySyncRequired(void * __ptr64)" ?IsMasterKeySyncRequired@@YAHPEAX@Z
0x18000BDBA: "__cdecl seh_filter_dll" _seh_filter_dll
0x18001767C: McGenEventWrite
0x180031000: WPP_GLOBAL_Control
0x180028A98: "__cdecl _imp__execute_onexit_table" __imp__execute_onexit_table
0x18002A900: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x1800083A8: "int __cdecl RemoveMasterKeyCache(struct _LUID * __ptr64,unsigned short const * __ptr64)" ?RemoveMasterKeyCache@@YAHPEAU_LUID@@PEBG@Z
0x18002E61C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0
0x18002E770: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-1" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-1
0x18002E810: "__cdecl _IMPORT_DESCRIPTOR_lsass" __IMPORT_DESCRIPTOR_lsass
0x1800261A0: "__cdecl TlgEnableCallback" _TlgEnableCallback
0x180028840: api-ms-win-core-memory-l1-1-0_NULL_THUNK_DATA
0x18000358C: "unsigned long __cdecl DecryptMasterKeyFromStorage(struct MASTERKEY_STORED * __ptr64,unsigned long,unsigned int,unsigned int,unsigned char * __ptr64,unsigned long,int * __ptr64,unsigned char * __ptr64 * __ptr64,unsigned long * __ptr64)" ?DecryptMasterKeyFromStorage@@YAKPEAUMASTERKEY_STORED@@KIIPEAEKPEAHPEAPEAEPEAK@Z
0x180015510: WPP_SF_d
0x180015510: WPP_SF_D
0x18000B2B8: "__cdecl _report_rangecheckfailure" __report_rangecheckfailure
0x1800162E0: "unsigned long __cdecl EncryptCredentialHistory(unsigned long,unsigned char * __ptr64 const,unsigned long,unsigned char * __ptr64 const,unsigned char * __ptr64 const,struct _CREDENTIAL_HISTORY * __ptr64 * __ptr64,unsigned long * __ptr64)" ?EncryptCredentialHistory@@YAKKQEAEK00PEAPEAU_CREDENTIAL_HISTORY@@PEAK@Z
0x180028FF0: "KeyLengths" ??_C@_1BG@OOALDDHJ@?$AAK?$AAe?$AAy?$AAL?$AAe?$AAn?$AAg?$AAt?$AAh?$AAs?$AA?$AA@
0x180029720: "__cdecl pRawDllMain" _pRawDllMain
0x180021008: "unsigned long __cdecl MyLookupLocalAccountName(unsigned short const * __ptr64,void * __ptr64 * __ptr64)" ?MyLookupLocalAccountName@@YAKPEBGPEAPEAX@Z
0x180031B50: "struct _GUID g_guidPreferredKey" ?g_guidPreferredKey@@3U_GUID@@A
0x18002A9F8: "ERROR_INSUFFICIENT_BUFFER" ??_C@_0BK@PIBMDNEP@ERROR_INSUFFICIENT_BUFFER?$AA@
0x18002AB58: ETW_LOG_DPAPI_MASTER_KEY_SYNCH
0x180029810: "__cdecl _sz_api_ms_win_security_lsalookup_l1_1_0_dll" __sz_api_ms_win_security_lsalookup_l1_1_0_dll
0x1800286C0: "__cdecl _imp_RpcRevertToSelfEx" __imp_RpcRevertToSelfEx
0x1800297B0: "__cdecl _sz_api_ms_win_security_lsalookup_l2_1_0_dll" __sz_api_ms_win_security_lsalookup_l2_1_0_dll
0x18002B4F0: "DES" ??_C@_17LBCHNHBC@?$AAD?$AAE?$AAS?$AA?$AA@
0x180028A30: api-ms-win-core-threadpool-legacy-l1-1-0_NULL_THUNK_DATA
0x18000C335: "__cdecl _imp_load_RegSaveKeyW" __imp_load_RegSaveKeyW
0x180021718: "unsigned long __cdecl PRCreateLocalToken(struct _UNICODE_STRING * __ptr64,struct _UNICODE_STRING * __ptr64,void * __ptr64 * __ptr64)" ?PRCreateLocalToken@@YAKPEAU_UNICODE_STRING@@0PEAPEAX@Z
0x18000BB4C: "__cdecl _isa_available_init" __isa_available_init
0x180028C38: "__cdecl _imp_BCryptKeyDerivation" __imp_BCryptKeyDerivation
0x180028988: "__cdecl _imp_CreateMutexW" __imp_CreateMutexW
0x180034138: api-ms-win-security-lsapolicy-l1-1-0_NULL_THUNK_DATA_DLA
0x180016DC4: "unsigned long __cdecl LogonCredGenerateSignatureKey(struct _LUID * __ptr64,unsigned long,unsigned char * __ptr64,struct _CRED_SIGNATURE * __ptr64,unsigned int,unsigned char * __ptr64,unsigned long)" ?LogonCredGenerateSignatureKey@@YAKPEAU_LUID@@KPEAEPEAU_CRED_SIGNATURE@@I1K@Z
0x18002033C: "void __cdecl operator delete(void * __ptr64)" ??3@YAXPEAX@Z
0x18002E4A8: api-ms-win-security-lsapolicy-l1-1-0_NULL_THUNK_DATA_DLB
0x1800167EC: "unsigned long __cdecl HandleLocalUserPasswordChange(void * __ptr64,unsigned long,struct _CREDENTIAL_KEY * __ptr64,struct _CREDENTIAL_KEY * __ptr64)" ?HandleLocalUserPasswordChange@@YAKPEAXKPEAU_CREDENTIAL_KEY@@1@Z
0x1800036C4: "void __cdecl GetReEncryptAlgorithms(struct MASTERKEY_STORED * __ptr64,unsigned int,unsigned int,unsigned int * __ptr64,unsigned int * __ptr64)" ?GetReEncryptAlgorithms@@YAXPEAUMASTERKEY_STORED@@IIPEAI1@Z
0x18000BD0C: "__cdecl get_startup_argv_mode" _get_startup_argv_mode
0x18002E018: api-ms-win-security-lsapolicy-l1-1-0_NULL_THUNK_DATA_DLN
0x1800319E8: "struct _RTL_CRITICAL_SECTION g_MasterKeyCacheCritSect" ?g_MasterKeyCacheCritSect@@3U_RTL_CRITICAL_SECTION@@A
0x180007BBC: "void * __ptr64 __cdecl CreateFileWithRetries(unsigned short const * __ptr64,unsigned long,unsigned long,struct _SECURITY_ATTRIBUTES * __ptr64,unsigned long,unsigned long,void * __ptr64)" ?CreateFileWithRetries@@YAPEAXPEBGKKPEAU_SECURITY_ATTRIBUTES@@KKPEAX@Z
0x18002BBF0: "__cdecl _rtc_izz" __rtc_izz
0x18000C1E4: "__cdecl _imp_load_ConvertSidToStringSidW" __imp_load_ConvertSidToStringSidW
0x180028998: "__cdecl _imp_DeleteCriticalSection" __imp_DeleteCriticalSection
0x180034120: "__cdecl _imp_LsaFreeMemory" __imp_LsaFreeMemory
0x18002DD40: "__cdecl _DELAY_IMPORT_DESCRIPTOR_netutils_dll" __DELAY_IMPORT_DESCRIPTOR_netutils_dll
0x18000B150: "__cdecl _security_check_cookie" __security_check_cookie
0x180028DA8: "__cdecl _xc_z" __xc_z
0x18001FEB0: s_BackuprKey
0x180028BF8: "__cdecl _imp_BCryptExportKey" __imp_BCryptExportKey
0x18002E644: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0
0x180028888: api-ms-win-core-processthreads-l1-1-0_NULL_THUNK_DATA
0x180018CA8: "int __cdecl DeleteMasterKey(void * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64)" ?DeleteMasterKey@@YAHPEAXPEBG1@Z
0x1800287F8: "__cdecl _imp_GetProcAddress" __imp_GetProcAddress
0x18002AF98: "G$BCKUPKEY_PREFERRED" ??_C@_1CK@PCMCMDED@?$AAG?$AA$?$AAB?$AAC?$AAK?$AAU?$AAP?$AAK?$AAE?$AAY?$AA_?$AAP?$AAR?$AAE?$AAF?$AAE?$AAR?$AAR?$AAE?$AAD?$AA?$AA@
0x1800292D0: "MasterKeyIterationCount" ??_C@_1DA@EKAFOLMA@?$AAM?$AAa?$AAs?$AAt?$AAe?$AAr?$AAK?$AAe?$AAy?$AAI?$AAt?$AAe?$AAr?$AAa?$AAt?$AAi?$AAo?$AAn?$AAC?$AAo?$AAu?$AAn?$AAt?$AA?$AA@
0x18000C23E: "__cdecl _imp_load_LookupAccountNameW" __imp_load_LookupAccountNameW
0x18002B020: "RSA" ??_C@_17CEGMJBCM@?$AAR?$AAS?$AAA?$AA?$AA@
0x180029010: "\Microsoft\Protect\" ??_C@_1CI@ICLKJCJG@?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAP?$AAr?$AAo?$AAt?$AAe?$AAc?$AAt?$AA?2?$AA?$AA@
0x18000C780: "__cdecl _vcrt_uninitialize_critical" __vcrt_uninitialize_critical
0x18002B238: "HMAC-%d " ??_C@_1BC@LBCFCPNK@?$AAH?$AAM?$AAA?$AAC?$AA?9?$AA?$CF?$AAd?$AA?5?$AA?$AA@
0x18002B138: "RSA Signature-%d " ??_C@_1CE@EOEKPAGI@?$AAR?$AAS?$AAA?$AA?5?$AAS?$AAi?$AAg?$AAn?$AAa?$AAt?$AAu?$AAr?$AAe?$AA?9?$AA?$CF?$AAd?$AA?5?$AA?$AA@
0x1800340B0: "__cdecl _imp_GetUserProfileDirectoryW" __imp_GetUserProfileDirectoryW
0x18000BFA6: "__cdecl _imp_load_NetApiBufferFree" __imp_load_NetApiBufferFree
0x18002B110: "RC4-%d " ??_C@_1BA@EOCIIANM@?$AAR?$AAC?$AA4?$AA?9?$AA?$CF?$AAd?$AA?5?$AA?$AA@
0x180024E34: WppCleanupUm
0x18002127C: "unsigned long __cdecl OpenSupplementalCredentialStore(unsigned long,struct HKEY__ * __ptr64 * __ptr64)" ?OpenSupplementalCredentialStore@@YAKKPEAPEAUHKEY__@@@Z
0x180009514: GetTokenAuthenticationId
0x180017DE8: "__cdecl TlgCreateWsz" _TlgCreateWsz
0x18002ADB0: "InternetUserAccountType" ??_C@_1DA@EPJBJHEH@?$AAI?$AAn?$AAt?$AAe?$AAr?$AAn?$AAe?$AAt?$AAU?$AAs?$AAe?$AAr?$AAA?$AAc?$AAc?$AAo?$AAu?$AAn?$AAt?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x1800156D4: DPAPIShutdown
0x180029330: "ncacn_np" ??_C@_1BC@CCHMBIKG@?$AAn?$AAc?$AAa?$AAc?$AAn?$AA_?$AAn?$AAp?$AA?$AA@
0x1800296F0: "\SAM_SERVICE_STARTED" ??_C@_1CK@INOCGDBH@?$AA?2?$AAS?$AAA?$AAM?$AA_?$AAS?$AAE?$AAR?$AAV?$AAI?$AAC?$AAE?$AA_?$AAS?$AAT?$AAA?$AAR?$AAT?$AAE?$AAD?$AA?$AA@
0x180020AC0: "unsigned long __cdecl EncryptRecoveryPassword(void * __ptr64,struct _CERT_CONTEXT const * __ptr64,struct _UNICODE_STRING * __ptr64)" ?EncryptRecoveryPassword@@YAKPEAXPEBU_CERT_CONTEXT@@PEAU_UNICODE_STRING@@@Z
0x18002A7CF: "__cdecl TraceLoggingMetadataEnd" _TraceLoggingMetadataEnd
0x180007C74: "unsigned long __cdecl CPSImpersonateCallingClient(void * __ptr64,int)" ?CPSImpersonateCallingClient@@YAKPEAXH@Z
0x1800289F0: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x18000C1F6: "__cdecl _imp_load_GetUserProfileDirectoryForUserSidW" __imp_load_GetUserProfileDirectoryForUserSidW
0x180008164: "int __cdecl IsProtectedAccount(void * __ptr64)" ?IsProtectedAccount@@YAHPEAX@Z
0x18002E488: api-ms-win-core-registry-l2-1-0_NULL_THUNK_DATA_DLB
0x180003D88: "void __cdecl GetDefaultAlgInfo(void * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64)" ?GetDefaultAlgInfo@@YAXPEAXPEAK111@Z
0x18002ADF8: "DC backup" ??_C@_09FHMECCG@DC?5backup?$AA@
0x180012B84: "unsigned long __cdecl CPSDuplicateContext(void * __ptr64,void * __ptr64 * __ptr64)" ?CPSDuplicateContext@@YAKPEAXPEAPEAX@Z
0x1800287B8: "__cdecl _imp_LocalAlloc" __imp_LocalAlloc
0x18000B608: "__cdecl _scrt_dllmain_crt_thread_attach" __scrt_dllmain_crt_thread_attach
0x180028C98: "__cdecl _imp_EtwGetTraceEnableLevel" __imp_EtwGetTraceEnableLevel
0x18000BDBA: "__cdecl o__seh_filter_dll" _o__seh_filter_dll
0x180031980: "__cdecl _hmod__SspiCli_dll" __hmod__SspiCli_dll
0x1800286F8: "__cdecl _imp_DelayLoadFailureHook" __imp_DelayLoadFailureHook
0x18000BD66: "__cdecl _std_type_info_destroy_list" __std_type_info_destroy_list
0x1800285F0: "__cdecl _imp_LsaILookupUserAccountType" __imp_LsaILookupUserAccountType
0x180031958: "__cdecl _hmod__api_ms_win_core_registry_l2_1_0_dll" __hmod__api_ms_win_core_registry_l2_1_0_dll
0x1800170BC: LogonCredGenerateSignature
0x180028768: "__cdecl _imp_FindNextFileW" __imp_FindNextFileW
0x18002AB48: ETW_LOG_BACKUPKEYSVC_STARTED
0x1800340E0: "__cdecl _imp_LookupAccountSidLocalW" __imp_LookupAccountSidLocalW
0x180025050: "void __cdecl BCryptProvFreeElt(struct _ELT * __ptr64)" ?BCryptProvFreeElt@@YAXPEAU_ELT@@@Z
0x1800298C0: "onecore\ds\security\cryptoapi\se" ??_C@_0DL@BCJIECFK@onecore?2ds?2security?2cryptoapi?2se@
0x18001C058: "unsigned long __cdecl SynchronizeSidMasterKeys(void * __ptr64,void * __ptr64,unsigned long,int,struct DP_KEK * __ptr64,struct DP_KEK * __ptr64,unsigned long,unsigned long * __ptr64,unsigned long * __ptr64)" ?SynchronizeSidMasterKeys@@YAKPEAX0KHPEAUDP_KEK@@1KPEAK2@Z
0x18002B100: "RC2-%d " ??_C@_1BA@KBBFCFDM@?$AAR?$AAC?$AA2?$AA?9?$AA?$CF?$AAd?$AA?5?$AA?$AA@
0x18002A9A0: "GetLastError()" ??_C@_0P@OLMLMBJL@GetLastError?$CI?$CJ?$AA@
0x180007CC4: "unsigned long __cdecl CPSQueryWellKnownAccount(void * __ptr64,unsigned long * __ptr64)" ?CPSQueryWellKnownAccount@@YAKPEAXPEAK@Z
0x1800288C0: "__cdecl _imp_RegNotifyChangeKeyValue" __imp_RegNotifyChangeKeyValue
0x180028828: "__cdecl _imp_UnmapViewOfFile" __imp_UnmapViewOfFile
0x180009ED8: TraceLoggingRegisterEx
0x180023B34: "unsigned long __cdecl EnumerateMasterKeys(void * __ptr64,struct _MK_LOCATION * __ptr64 * __ptr64,unsigned long * __ptr64)" ?EnumerateMasterKeys@@YAKPEAXPEAPEAU_MK_LOCATION@@PEAK@Z
0x180028650: "__cdecl _imp_RpcStringBindingParseW" __imp_RpcStringBindingParseW
0x18000C5CD: "__cdecl _imp_load_SIDKeyUnprotect" __imp_load_SIDKeyUnprotect
0x18002AEB0: "dwTempError" ??_C@_0M@DKNJHJAB@dwTempError?$AA@
0x18002A9E0: "ERROR_INVALID_DATA" ??_C@_0BD@ODGNLIIP@ERROR_INVALID_DATA?$AA@
0x18002AC60: "" ??_C@_07JKNNCAJG@?$AA?$AA?$AA?$AA?$AA?$AA?$AA?$AA@
0x180028910: api-ms-win-core-rtlsupport-l1-1-0_NULL_THUNK_DATA
0x18002DD20: "__cdecl _DELAY_IMPORT_DESCRIPTOR_logoncli_dll" __DELAY_IMPORT_DESCRIPTOR_logoncli_dll
0x180028A20: api-ms-win-core-threadpool-l1-2-0_NULL_THUNK_DATA
0x180028D00: "__cdecl _imp_EtwEventActivityIdControl" __imp_EtwEventActivityIdControl
0x180028608: "__cdecl _imp_RtlAsn1DecodeAndAllocate" __imp_RtlAsn1DecodeAndAllocate
0x180012B0C: "unsigned long __cdecl CPSDuplicateClientAccessToken(void * __ptr64,void * __ptr64 * __ptr64)" ?CPSDuplicateClientAccessToken@@YAKPEAXPEAPEAX@Z
0x1800043C8: "unsigned long __cdecl CPSDeleteServerContext(struct CRYPT_SERVER_CONTEXT * __ptr64)" ?CPSDeleteServerContext@@YAKPEAUCRYPT_SERVER_CONTEXT@@@Z
0x180031AE0: "unsigned char * g_rgbSystemCredUser" ?g_rgbSystemCredUser@@3PAEA
0x1800297A0: "__cdecl _sz_USERENV_dll" __sz_USERENV_dll
0x18001B1F0: "unsigned long __cdecl RestoreMasterKey(void * __ptr64,void * __ptr64,struct _LUID * __ptr64,struct MASTERKEY_STORED * __ptr64,unsigned long,struct _GUID * __ptr64,unsigned char * __ptr64 * __ptr64,unsigned long * __ptr64)" ?RestoreMasterKey@@YAKPEAX0PEAU_LUID@@PEAUMASTERKEY_STORED@@KPEAU_GUID@@PEAPEAEPEAK@Z
0x180031AC8: "unsigned char * g_rgbSystemCredMachine" ?g_rgbSystemCredMachine@@3PAEA
0x180028DD8: "__cdecl _xp_z" __xp_z
0x180028A38: "__cdecl _imp_SystemTimeToFileTime" __imp_SystemTimeToFileTime
0x180022EFC: "struct _MK_LOCATION * __ptr64 __cdecl std::_Insertion_sort_unchecked<struct _MK_LOCATION * __ptr64,bool (__cdecl*)(struct _MK_LOCATION,struct _MK_LOCATION * __ptr64)>(struct _MK_LOCATION * __ptr64,struct _MK_LOCATION * __ptr64 const,bool (__cdecl*)(struct _MK_LOCATION,struct _MK_LOCATION))" ??$_Insertion_sort_unchecked@PEAU_MK_LOCATION@@P6A_NU1@0@Z@std@@YAPEAU_MK_LOCATION@@PEAU1@QEAU1@P6A_NU1@2@Z@Z
0x180017734: TraceLoggingProviderEnabled
0x18000C50C: "__cdecl _imp_load_LsaRetrievePrivateData" __imp_load_LsaRetrievePrivateData
0x18000BF15: "__cdecl _tailMerge_logoncli_dll" __tailMerge_logoncli_dll
0x18000C2FF: "__cdecl _imp_load_GetUserProfileDirectoryW" __imp_load_GetUserProfileDirectoryW
0x18000A9C0: "unsigned long __cdecl GetSystemCredential(int,unsigned char * __ptr64 const)" ?GetSystemCredential@@YAKHQEAE@Z
0x180025094: FMyPrimitiveSHA512
0x180023100: "void __cdecl std::_Med3_unchecked<struct _MK_LOCATION * __ptr64,bool (__cdecl*)(struct _MK_LOCATION,struct _MK_LOCATION * __ptr64)>(struct _MK_LOCATION * __ptr64,struct _MK_LOCATION * __ptr64,struct _MK_LOCATION * __ptr64,bool (__cdecl*)(struct _MK_LOCATION,struct _MK_LOCATION))" ??$_Med3_unchecked@PEAU_MK_LOCATION@@P6A_NU1@0@Z@std@@YAXPEAU_MK_LOCATION@@00P6A_NU1@1@Z@Z
0x180028D30: "__cdecl _imp_RtlIsStateSeparationEnabled" __imp_RtlIsStateSeparationEnabled
0x18002E748: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0
0x180019564: "int __cdecl DuplicateMasterKey(struct MASTERKEY_STORED * __ptr64,struct MASTERKEY_STORED * __ptr64)" ?DuplicateMasterKey@@YAHPEAUMASTERKEY_STORED@@0@Z
0x1800288A8: api-ms-win-core-profile-l1-1-0_NULL_THUNK_DATA
0x180034100: "__cdecl _imp_LsaClose" __imp_LsaClose
0x18002BC00: "__cdecl _rtc_tzz" __rtc_tzz
0x180016C74: "unsigned long __cdecl LoadProfileWithUserToken(void * __ptr64,void * __ptr64 * __ptr64)" ?LoadProfileWithUserToken@@YAKPEAXPEAPEAX@Z
0x1800022C4: "int __cdecl SearchMasterKeyCache(struct _LUID * __ptr64,unsigned short const * __ptr64,struct _GUID * __ptr64,unsigned char * __ptr64 * __ptr64,unsigned long * __ptr64)" ?SearchMasterKeyCache@@YAHPEAU_LUID@@PEBGPEAU_GUID@@PEAPEAEPEAK@Z
0x180028DF0: "__cdecl _guard_fids_table" __guard_fids_table
0x180028610: NTASN1_NULL_THUNK_DATA
0x18002A904: "dwRet" ??_C@_05PCOBFNNP@dwRet?$AA@
0x180028B48: "__cdecl _imp_CreateWellKnownSid" __imp_CreateWellKnownSid
0x18002AE40: "Unknown error" ??_C@_0O@NIPGCINC@Unknown?5error?$AA@
0x180027160: "__cdecl load_config_used" _load_config_used
0x18002DF80: SspiCli_NULL_THUNK_DATA_DLN
0x180028C78: "__cdecl _imp_NCryptCreatePersistedKey" __imp_NCryptCreatePersistedKey
0x18002DD80: "__cdecl _DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_sddl_l1_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_sddl_l1_1_0_dll
0x180031968: "__cdecl _hmod__api_ms_win_security_lsapolicy_l1_1_0_dll" __hmod__api_ms_win_security_lsapolicy_l1_1_0_dll
0x180028B38: "__cdecl _imp_SetTokenInformation" __imp_SetTokenInformation
0x18000C66A: "__cdecl _imp_load_SeciIsProtectedUser" __imp_load_SeciIsProtectedUser
0x180031AB0: "struct _LSA_IF_LSASRV_FUNCTION_TABLE * __ptr64 __ptr64 g_pDPAPILsasrvIfTable" ?g_pDPAPILsasrvIfTable@@3PEAU_LSA_IF_LSASRV_FUNCTION_TABLE@@EA
0x180009980: "struct _CREDENTIAL_HISTORY * __ptr64 __cdecl GetPreviousCredentialHistory(struct _CREDENTIAL_HISTORY_MAP * __ptr64,struct _CREDENTIAL_HISTORY * __ptr64)" ?GetPreviousCredentialHistory@@YAPEAU_CREDENTIAL_HISTORY@@PEAU_CREDENTIAL_HISTORY_MAP@@PEAU1@@Z
0x1800340D8: api-ms-win-core-registry-l2-1-0_NULL_THUNK_DATA_DLA
0x180028710: api-ms-win-core-delayload-l1-1-1_NULL_THUNK_DATA
0x180028700: api-ms-win-core-delayload-l1-1-0_NULL_THUNK_DATA
0x180024E04: McGenEventUnregister
0x18000A4F0: "long __cdecl InitializeLsaExtension(enum _LSA_EXTENSION_INIT_STAGE)" ?InitializeLsaExtension@@YAJW4_LSA_EXTENSION_INIT_STAGE@@@Z
0x18002DD60: "__cdecl _DELAY_IMPORT_DESCRIPTOR_samcli_dll" __DELAY_IMPORT_DESCRIPTOR_samcli_dll
0x180028DC0: "__cdecl _scrt_stdio_legacy_msvcrt_compatibility" __scrt_stdio_legacy_msvcrt_compatibility
0x180029170: "MAC Alg Key Size" ??_C@_1CC@JBGAHCED@?$AAM?$AAA?$AAC?$AA?5?$AAA?$AAl?$AAg?$AA?5?$AAK?$AAe?$AAy?$AA?5?$AAS?$AAi?$AAz?$AAe?$AA?$AA@
0x180021ABC: "unsigned long __cdecl ResetLocalUserPassword(unsigned short * __ptr64,unsigned short * __ptr64,unsigned short * __ptr64,unsigned short * __ptr64)" ?ResetLocalUserPassword@@YAKPEAG000@Z
0x180028668: "__cdecl _imp_RpcBindingToStringBindingW" __imp_RpcBindingToStringBindingW
0x1800026B8: "void __cdecl AcquireExclusiveLockForUser(void * __ptr64)" ?AcquireExclusiveLockForUser@@YAXPEAX@Z
0x1800286B0: "__cdecl _imp_RpcBindingFromStringBindingW" __imp_RpcBindingFromStringBindingW
0x18000B940: "__cdecl _scrt_get_dyn_tls_init_callback" __scrt_get_dyn_tls_init_callback
0x18002B2B0: WPP_f17be68e0cc9310312e5f0eaa6b31f35_Traceguids
0x180034058: CRYPT32_NULL_THUNK_DATA_DLA
0x180028C28: "__cdecl _imp_BCryptOpenAlgorithmProvider" __imp_BCryptOpenAlgorithmProvider
0x180029920: "onecore\ds\security\cryptoapi\se" ??_C@_0DL@MPGFLNFH@onecore?2ds?2security?2cryptoapi?2se@
0x180028808: "__cdecl _imp_DisableThreadLibraryCalls" __imp_DisableThreadLibraryCalls
0x180028CF0: "__cdecl _imp_NtClose" __imp_NtClose
0x18002A910: "dwResult" ??_C@_08LKJCIBAA@dwResult?$AA@
0x180028EF8: ETW_LOG_DPAPI_PROVIDER
0x18001C6B4: "unsigned long __cdecl UpdateDomainUserMasterKey(void * __ptr64,unsigned short const * __ptr64,void * __ptr64,int,unsigned short * __ptr64 const,unsigned char * __ptr64 const,unsigned char * __ptr64 const)" ?UpdateDomainUserMasterKey@@YAKPEAXPEBG0HQEAGQEAE3@Z
0x180001DC8: "long __cdecl StringCchPrintfW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64,...)" ?StringCchPrintfW@@YAJPEAG_KPEBGZZ
0x18002E060: samcli_NULL_THUNK_DATA_DLN
0x1800340F0: "__cdecl _imp_LookupAccountNameW" __imp_LookupAccountNameW
0x180025F80: "void __cdecl TlgAggregateInternalProviderCallback(struct _GUID const * __ptr64,unsigned long,unsigned char,unsigned __int64,unsigned __int64,struct _EVENT_FILTER_DESCRIPTOR * __ptr64,void * __ptr64)" ?TlgAggregateInternalProviderCallback@@YAXPEBU_GUID@@KE_K1PEAU_EVENT_FILTER_DESCRIPTOR@@PEAX@Z
0x18000A400: FBCryptProviderSupportsAlg
0x18002E3E8: samcli_NULL_THUNK_DATA_DLB
0x180034180: samcli_NULL_THUNK_DATA_DLA
0x180009068: "unsigned long __cdecl RetrieveCurrentDerivedCredentialWithRetry(int,struct _LUID * __ptr64,struct _GUID * __ptr64,int,unsigned char * __ptr64,unsigned long,unsigned char * __ptr64 const,unsigned long * __ptr64)" ?RetrieveCurrentDerivedCredentialWithRetry@@YAKHPEAU_LUID@@PEAU_GUID@@HPEAEKQEAEPEAK@Z
0x180028900: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x180029098: "S-1-5-19" ??_C@_1BC@OGNCNKIA@?$AAS?$AA?9?$AA1?$AA?9?$AA5?$AA?9?$AA1?$AA9?$AA?$AA@
0x180028BC0: "__cdecl _imp_BCryptGenRandom" __imp_BCryptGenRandom
0x180028BB8: "__cdecl _imp_BCryptGenerateSymmetricKey" __imp_BCryptGenerateSymmetricKey
0x1800288A0: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x180031160: "struct _ALG_TO_STRING * g_AlgToString" ?g_AlgToString@@3PAU_ALG_TO_STRING@@A
0x18002ABE8: ETW_LOG_MASTERKEY_DECRYPTION_FAILED
0x180007760: "unsigned long __cdecl CPSIsLowIntegrityToken(void * __ptr64,int * __ptr64)" ?CPSIsLowIntegrityToken@@YAKPEAXPEAH@Z
0x18002E5B8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-crt-string-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-crt-string-l1-1-0
0x18000C4FA: "__cdecl _imp_load_LsaFreeMemory" __imp_load_LsaFreeMemory
0x180029760: "__cdecl _sz_samcli_dll" __sz_samcli_dll
0x18002AA48: "Kerberos,NTLM" ??_C@_1BM@DNILLNHA@?$AAK?$AAe?$AAr?$AAb?$AAe?$AAr?$AAo?$AAs?$AA?0?$AAN?$AAT?$AAL?$AAM?$AA?$AA@
0x180028D20: "__cdecl _imp_RtlEqualSid" __imp_RtlEqualSid
0x180031B90: "void * __ptr64 __ptr64 g_hKeyPreferredKey" ?g_hKeyPreferredKey@@3PEAXEA
0x180028CA8: "__cdecl _imp_EtwGetTraceEnableFlags" __imp_EtwGetTraceEnableFlags
0x180028FA8: "ObjectLength" ??_C@_1BK@GPNIFMAA@?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAL?$AAe?$AAn?$AAg?$AAt?$AAh?$AA?$AA@
0x18002DE40: "__cdecl _DELAY_IMPORT_DESCRIPTOR_CRYPTSP_dll" __DELAY_IMPORT_DESCRIPTOR_CRYPTSP_dll
0x18000C780: "__cdecl _acrt_uninitialize_critical" __acrt_uninitialize_critical
0x180028958: "__cdecl _imp_InitializeSRWLock" __imp_InitializeSRWLock
0x180017760: WPP_SF__guid_
0x180031B88: "unsigned long g_cbPreferredKey" ?g_cbPreferredKey@@3KA
0x180028D58: "__cdecl _imp_RtlLeaveCriticalSection" __imp_RtlLeaveCriticalSection
0x18000BDC6: free
0x18001D5EC: WPP_SF_ddS
0x180012E60: WPP_SF_Sdd
0x180003D4C: "unsigned long __cdecl GetIterationCount(unsigned int)" ?GetIterationCount@@YAKI@Z
0x18002AE70: "ERROR_NOT_ENOUGH_MEMORY" ??_C@_0BI@DDJDPHHD@ERROR_NOT_ENOUGH_MEMORY?$AA@
0x180028A48: "__cdecl _imp__initialize_narrow_environment" __imp__initialize_narrow_environment
0x18000BE78: "__cdecl _tailMerge_crypt32_dll" __tailMerge_crypt32_dll
0x180028838: "__cdecl _imp_CreateFileMappingW" __imp_CreateFileMappingW
0x18001D19C: WPP_SF_SSd
0x180028D50: "__cdecl _imp_NtOpenEvent" __imp_NtOpenEvent
0x180028820: "__cdecl _imp_VirtualQuery" __imp_VirtualQuery
0x1800287E8: "__cdecl _imp_InitializeSListHead" __imp_InitializeSListHead
0x180028690: "__cdecl _imp_RpcStringFreeW" __imp_RpcStringFreeW
0x1800288F8: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x18000A7D8: "unsigned long __cdecl StartBackupKeyServer(void)" ?StartBackupKeyServer@@YAKXZ
0x18002B5B8: "__cdecl _pfnDefaultDliFailureHook2" __pfnDefaultDliFailureHook2
0x18002AA74: "$" ??_C@_13PBOLBIIK@?$AA$?$AA?$AA@
0x180028AA8: "__cdecl _imp___stdio_common_vswprintf" __imp___stdio_common_vswprintf
0x18002DD00: "__cdecl _DELAY_IMPORT_DESCRIPTOR_CRYPT32_dll" __DELAY_IMPORT_DESCRIPTOR_CRYPT32_dll
0x18000C0C8: "__cdecl _tailMerge_api_ms_win_security_sddl_l1_1_0_dll" __tailMerge_api_ms_win_security_sddl_l1_1_0_dll
0x1800087AC: "unsigned long __cdecl CPSGetSidHistory(void * __ptr64,void * __ptr64 * __ptr64 * __ptr64,unsigned long * __ptr64)" ?CPSGetSidHistory@@YAKPEAXPEAPEAPEAXPEAK@Z
0x1800319C0: "int g_fcsInitializationSetup" ?g_fcsInitializationSetup@@3HA
0x180031320: "unsigned __int64 `__local_stdio_printf_options'::`2'::_OptionsStorage" ?_OptionsStorage@?1??__local_stdio_printf_options@@9@4_KA
0x180004C80: s_SSCryptUnprotectData
0x18001CF2C: McTemplateU0zd
0x180024DF0: MIDL_user_allocate
0x18000BB40: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x18000C917: memcmp
0x1800287C0: "__cdecl _imp_LocalReAlloc" __imp_LocalReAlloc
0x1800289E8: "__cdecl _imp_GetSystemDirectoryW" __imp_GetSystemDirectoryW
0x18002B540: "hr" ??_C@_02FLHDKHAB@hr?$AA@
0x1800285E8: "__cdecl _imp_LsaIDeriveCredentialKey" __imp_LsaIDeriveCredentialKey
0x18002AB88: ETW_LOG_DPAPI_PROTECT_FAILED
0x18000C780: "__cdecl _scrt_stub_for_acrt_uninitialize" __scrt_stub_for_acrt_uninitialize
0x18000C78C: "__cdecl _scrt_stub_for_is_c_termination_complete" __scrt_stub_for_is_c_termination_complete
0x180028BF0: "__cdecl _imp_BCryptGenerateKeyPair" __imp_BCryptGenerateKeyPair
0x180029970: WPP_98ab5b7cc0713217f80e80c4edcbd17e_Traceguids
0x1800340C0: "__cdecl _imp_GetUserProfileDirectoryForUserSidW" __imp_GetUserProfileDirectoryForUserSidW
0x1800071E0: "unsigned long __cdecl CPSRevertToSelf(void * __ptr64)" ?CPSRevertToSelf@@YAKPEAX@Z
0x18002B0A8: "SHA1-%d " ??_C@_1BC@NAHJMCNB@?$AAS?$AAH?$AAA?$AA1?$AA?9?$AA?$CF?$AAd?$AA?5?$AA?$AA@
0x18001EB44: "int __cdecl GetPreferredBackupKeyGuid(unsigned long,struct _GUID * __ptr64)" ?GetPreferredBackupKeyGuid@@YAHKPEAU_GUID@@@Z
0x18000A534: "unsigned long __cdecl DPAPIInitialize(void)" ?DPAPIInitialize@@YAKXZ
0x180034148: "__cdecl _imp_ConvertStringSecurityDescriptorToSecurityDescriptorW" __imp_ConvertStringSecurityDescriptorToSecurityDescriptorW
0x180028648: "__cdecl _imp_RpcServerUnregisterIfEx" __imp_RpcServerUnregisterIfEx
0x18002E798: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-interlocked-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-interlocked-l1-1-0
0x1800291E8: "Recovery Version" ??_C@_1CC@IOBPBGKA@?$AAR?$AAe?$AAc?$AAo?$AAv?$AAe?$AAr?$AAy?$AA?5?$AAV?$AAe?$AAr?$AAs?$AAi?$AAo?$AAn?$AA?$AA@
0x18002E66C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0
0x18001395C: "unsigned long __cdecl BackupKey(struct _LUID * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,struct _GUID const * __ptr64,unsigned char * __ptr64,unsigned long,unsigned char * __ptr64 * __ptr64,unsigned long * __ptr64,unsigned long)" ?BackupKey@@YAKPEAU_LUID@@PEBG1PEBU_GUID@@PEAEKPEAPEAEPEAKK@Z
0x18000C323: "__cdecl _imp_load_CertGetCertificateContextProperty" __imp_load_CertGetCertificateContextProperty
0x180028800: "__cdecl _imp_GetModuleHandleW" __imp_GetModuleHandleW
0x180009E00: TlgRegisterAggregateProviderEx
0x180034110: "__cdecl _imp_LsaOpenPolicy" __imp_LsaOpenPolicy
0x180001008: "unsigned long __cdecl CPSGetMediumIntegrityToken(void * __ptr64,void * __ptr64 * __ptr64)" ?CPSGetMediumIntegrityToken@@YAKPEAXPEAPEAX@Z
0x18002B120: "SEAL-%d " ??_C@_1BC@GDNGAAJC@?$AAS?$AAE?$AAA?$AAL?$AA?9?$AA?$CF?$AAd?$AA?5?$AA?$AA@
0x18000C208: "__cdecl _imp_load_CryptExportPublicKeyInfo" __imp_load_CryptExportPublicKeyInfo
0x180012DAC: "unsigned long __cdecl CPSSetWellKnownAccount(void * __ptr64,unsigned long)" ?CPSSetWellKnownAccount@@YAKPEAXK@Z
0x180034158: "__cdecl _imp_DsGetDcNameW" __imp_DsGetDcNameW
0x180028A80: "__cdecl _imp__o_wcscat_s" __imp__o_wcscat_s
0x18000BD42: "__cdecl initterm_e" _initterm_e
0x18000B8E0: "__cdecl _scrt_release_startup_lock" __scrt_release_startup_lock
0x180031128: "struct _WZR_RPC_BINDING_LIST * g_awzrBackupBindingList" ?g_awzrBackupBindingList@@3PAU_WZR_RPC_BINDING_LIST@@A
0x18002DE80: "__cdecl _DELAY_IMPORT_DESCRIPTOR_SspiCli_dll" __DELAY_IMPORT_DESCRIPTOR_SspiCli_dll
0x1800183B0: "unsigned long __cdecl BuildLocalKey(void * __ptr64,struct MASTERKEY_STORED * __ptr64,unsigned int,unsigned int)" ?BuildLocalKey@@YAKPEAXPEAUMASTERKEY_STORED@@II@Z
0x180028CC8: "__cdecl _imp_RtlImageNtHeader" __imp_RtlImageNtHeader
0x18000C530: "__cdecl _imp_load_LsaLookupNames2" __imp_load_LsaLookupNames2
0x1800020B4: "unsigned long __cdecl GetPreferredMasterKey(void * __ptr64,struct _GUID * __ptr64,unsigned char * __ptr64 * __ptr64,unsigned long * __ptr64)" ?GetPreferredMasterKey@@YAKPEAXPEAU_GUID@@PEAPEAEPEAK@Z
0x18002ABC8: ETW_LOG_DPAPI_PASSWORD_CHANGE_TRIGGERED
0x18000B6F4: "__cdecl _scrt_dllmain_uninitialize_critical" __scrt_dllmain_uninitialize_critical
0x180028D88: ntdll_NULL_THUNK_DATA
0x180028AC0: "__cdecl _imp_memcpy" __imp_memcpy
0x18000C3CC: "__cdecl _tailMerge_api_ms_win_security_lsalookup_l1_1_0_dll" __tailMerge_api_ms_win_security_lsalookup_l1_1_0_dll
0x180019DD8: "unsigned long __cdecl InitiateSynchronizeMasterKeys(void * __ptr64)" ?InitiateSynchronizeMasterKeys@@YAKPEAX@Z
0x18002B088: "MD4-%d " ??_C@_1BA@EDCIHDLI@?$AAM?$AAD?$AA4?$AA?9?$AA?$CF?$AAd?$AA?5?$AA?$AA@
0x18001D088: WPP_SF_DdD
0x1800319D8: "class CBCryptProvList * __ptr64 __ptr64 g_pBCProvList" ?g_pBCProvList@@3PEAVCBCryptProvList@@EA
0x180012F00: s_SSCryptUpdateProtectedState
0x18002040C: "int __cdecl INCORRECT_FMyPrimitiveCryptHMAC(unsigned char * __ptr64,unsigned long,unsigned char * __ptr64,unsigned long,void * __ptr64,unsigned long,void * __ptr64 * __ptr64)" ?INCORRECT_FMyPrimitiveCryptHMAC@@YAHPEAEK0KPEAXKPEAPEAX@Z
0x18001D3BC: WPP_SF_dSD
0x180021194: "unsigned long __cdecl ObtainPrivilege(struct _LUID)" ?ObtainPrivilege@@YAKU_LUID@@@Z
0x180007878: IsDomainController
0x18002AAC8: "onecore\ds\security\cryptoapi\se" ??_C@_0DJ@KEEDNOII@onecore?2ds?2security?2cryptoapi?2se@
0x180028CB8: "__cdecl _imp_EtwEventUnregister" __imp_EtwEventUnregister
0x18000C780: "__cdecl _scrt_stub_for_acrt_uninitialize_critical" __scrt_stub_for_acrt_uninitialize_critical
0x1800285F8: LSASRV_NULL_THUNK_DATA
0x180028B40: "__cdecl _imp_FreeSid" __imp_FreeSid
0x180028B58: "__cdecl _imp_GetSidSubAuthorityCount" __imp_GetSidSubAuthorityCount
0x180028CF8: "__cdecl _imp_EtwEventWriteTransfer" __imp_EtwEventWriteTransfer
0x18002DE60: "__cdecl _DELAY_IMPORT_DESCRIPTOR_KdsCli_dll" __DELAY_IMPORT_DESCRIPTOR_KdsCli_dll
0x180031970: "__cdecl _hmod__CRYPTSP_dll" __hmod__CRYPTSP_dll
0x180028F90: "%08x%08x_" ??_C@_1BE@CDNCIBNB@?$AA?$CF?$AA0?$AA8?$AAx?$AA?$CF?$AA0?$AA8?$AAx?$AA_?$AA?$AA@
0x18002B4C0: "ERROR_NOT_FOUND" ??_C@_0BA@JCCLAACP@ERROR_NOT_FOUND?$AA@
0x18002E694: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0
0x18001290C: WPP_SF_sDsd
0x180028A10: "__cdecl _imp_SetThreadpoolTimer" __imp_SetThreadpoolTimer
0x18002AD08: "ExternalDomainUserAccountType" ??_C@_1DM@LGNJAHEJ@?$AAE?$AAx?$AAt?$AAe?$AAr?$AAn?$AAa?$AAl?$AAD?$AAo?$AAm?$AAa?$AAi?$AAn?$AAU?$AAs?$AAe?$AAr?$AAA?$AAc?$AAc?$AAo?$AAu?$AAn?$AAt?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x180014418: "unsigned char __cdecl CompareNameToDnsName(unsigned short const * __ptr64,unsigned short const * __ptr64)" ?CompareNameToDnsName@@YAEPEBG0@Z
0x1800312D0: "__cdecl _security_cookie" __security_cookie
0x1800155C4: WPP_SF_SSSD
0x180006660: "unsigned long __cdecl GetSpecifiedMasterKey(void * __ptr64,struct _GUID * __ptr64,unsigned char * __ptr64 * __ptr64,unsigned long * __ptr64)" ?GetSpecifiedMasterKey@@YAKPEAXPEAU_GUID@@PEAPEAEPEAK@Z
0x1800288D8: "__cdecl _imp_RegQueryValueExW" __imp_RegQueryValueExW
0x180031AB8: "struct _TOKEN_SOURCE DPAPITokenSource" ?DPAPITokenSource@@3U_TOKEN_SOURCE@@A
0x18002E408: USERENV_NULL_THUNK_DATA_DLB
0x180029050: "S-1-5-18" ??_C@_1BC@FOGOLNOF@?$AAS?$AA?9?$AA1?$AA?9?$AA5?$AA?9?$AA1?$AA8?$AA?$AA@
0x180018DE4: "unsigned long __cdecl DpapiUpdateLsaSecret(void * __ptr64)" ?DpapiUpdateLsaSecret@@YAKPEAX@Z
0x180023950: "void __cdecl std::_Sort_unchecked<struct _MK_LOCATION * __ptr64,bool (__cdecl*)(struct _MK_LOCATION,struct _MK_LOCATION * __ptr64)>(struct _MK_LOCATION * __ptr64,struct _MK_LOCATION * __ptr64,__int64,bool (__cdecl*)(struct _MK_LOCATION,struct _MK_LOCATION))" ??$_Sort_unchecked@PEAU_MK_LOCATION@@P6A_NU1@0@Z@std@@YAXPEAU_MK_LOCATION@@0_JP6A_NU1@2@Z@Z
0x18000BEF7: "__cdecl _imp_load_CertFreeCertificateContext" __imp_load_CertFreeCertificateContext
0x180034038: "__cdecl _imp_CertAddCertificateContextToStore" __imp_CertAddCertificateContextToStore
0x1800299C0: WPP_54077b9855ed337eef79bfb4560cd0c2_Traceguids
0x18000B960: "__cdecl _scrt_fastfail" __scrt_fastfail
0x180028B98: "__cdecl _imp_CheckTokenMembership" __imp_CheckTokenMembership
0x180028A18: "__cdecl _imp_WaitForThreadpoolTimerCallbacks" __imp_WaitForThreadpoolTimerCallbacks
0x18001FCE8: "int __cdecl SetupPreferredBackupKeys(void)" ?SetupPreferredBackupKeys@@YAHXZ
0x180024B94: "unsigned long __cdecl UpdateLastMasterKeySync(void * __ptr64)" ?UpdateLastMasterKeySync@@YAKPEAX@Z
0x180017794: WPP_SF__guid__guid_
0x18002AA20: "ProtectedStorage" ??_C@_1CC@LDDGHCIP@?$AAP?$AAr?$AAo?$AAt?$AAe?$AAc?$AAt?$AAe?$AAd?$AAS?$AAt?$AAo?$AAr?$AAa?$AAg?$AAe?$AA?$AA@
0x180014210: "unsigned long __cdecl BackupRestoreData(void * __ptr64,struct MASTERKEY_STORED * __ptr64,unsigned char * __ptr64,unsigned long,unsigned char * __ptr64 * __ptr64,unsigned long * __ptr64,int)" ?BackupRestoreData@@YAKPEAXPEAUMASTERKEY_STORED@@PEAEKPEAPEAEPEAKH@Z
0x18002E5A4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-crt-runtime-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-crt-runtime-l1-1-0
0x1800287A8: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x18000C2ED: "__cdecl _imp_load_CertFindCertificateInStore" __imp_load_CertFindCertificateInStore
0x1800287C8: "__cdecl _imp_LocalFree" __imp_LocalFree
0x180028B70: "__cdecl _imp_GetLengthSid" __imp_GetLengthSid
0x180029AC0: "__stdcall _xmm" __xmm@36363636363636363636363636363636
0x180029AB0: "__cdecl _xmm@5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c" __xmm@5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c5c
0x18002AE08: "Storage error" ??_C@_0O@OGOFKAHP@Storage?5error?$AA@
0x18002E608: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0
0x1800287F0: api-ms-win-core-interlocked-l1-1-0_NULL_THUNK_DATA
0x18000A0E0: McGenControlCallbackV2
0x180001790: "unsigned char __cdecl DPAPICryptProtectDataEx(void * __ptr64,unsigned long,struct _UNICODE_STRING * __ptr64,void * __ptr64,unsigned long,void * __ptr64,void * __ptr64,unsigned long,unsigned char * __ptr64,unsigned long,void * __ptr64 * __ptr64,unsigned long * __ptr64)" ?DPAPICryptProtectDataEx@@YAEPEAXKPEAU_UNICODE_STRING@@0K00KPEAEKPEAPEAXPEAK@Z
0x1800147DC: "unsigned long __cdecl LocalBackupRestoreData(void * __ptr64,struct MASTERKEY_STORED * __ptr64,unsigned char * __ptr64,unsigned long,unsigned char * __ptr64 * __ptr64,unsigned long * __ptr64,struct _GUID const * __ptr64)" ?LocalBackupRestoreData@@YAKPEAXPEAUMASTERKEY_STORED@@PEAEKPEAPEAEPEAKPEBU_GUID@@@Z
0x180028AC8: api-ms-win-crt-private-l1-1-0_NULL_THUNK_DATA
0x18001E370: "int __cdecl GeneratePublicKeyCert(void * __ptr64,struct _GUID * __ptr64,unsigned long * __ptr64,unsigned char * __ptr64 * __ptr64)" ?GeneratePublicKeyCert@@YAHPEAXPEAU_GUID@@PEAKPEAPEAE@Z
0x18002AFD0: "Microsoft Software Key Storage P" ??_C@_1FA@OAAKELHB@?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?5?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?5?$AAK?$AAe?$AAy?$AA?5?$AAS?$AAt?$AAo?$AAr?$AAa?$AAg?$AAe?$AA?5?$AAP@
0x18000C147: "__cdecl _imp_load_LoadUserProfileW" __imp_load_LoadUserProfileW
0x18002A960: "onecore\ds\security\cryptoapi\se" ??_C@_0DM@LOMOFOKH@onecore?2ds?2security?2cryptoapi?2se@
0x180028B50: "__cdecl _imp_CopySid" __imp_CopySid
0x180028C08: "__cdecl _imp_BCryptImportKeyPair" __imp_BCryptImportKeyPair
0x1800288C8: "__cdecl _imp_RegCreateKeyExW" __imp_RegCreateKeyExW
0x180008A00: GetUserTextualSid
0x1800129D4: "unsigned long __cdecl CPSAudit(void * __ptr64,unsigned long,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned long,unsigned short const * __ptr64,unsigned long)" ?CPSAudit@@YAKPEAXKPEBG1K1K@Z
0x180028AB0: "__cdecl _imp__o___std_type_info_destroy_list" __imp__o___std_type_info_destroy_list
0x180028B68: "__cdecl _imp_ImpersonateSelf" __imp_ImpersonateSelf
0x180034050: "__cdecl _imp_CryptExportPublicKeyInfo" __imp_CryptExportPublicKeyInfo
0x1800312E0: "__cdecl _isa_available" __isa_available
0x1800203AC: "int __cdecl FIsLegacyCompliant(void)" ?FIsLegacyCompliant@@YAHXZ
0x180004130: "unsigned char __cdecl DPAPICryptUnprotectData(void * __ptr64,unsigned long,void * __ptr64,unsigned long,void * __ptr64,void * __ptr64,unsigned long,struct _UNICODE_STRING * __ptr64,void * __ptr64 * __ptr64,unsigned long * __ptr64)" ?DPAPICryptUnprotectData@@YAEPEAXK0K00KPEAU_UNICODE_STRING@@PEAPEAXPEAK@Z
0x180028C88: ncrypt_NULL_THUNK_DATA
0x180028628: "__cdecl _imp_RpcRevertToSelf" __imp_RpcRevertToSelf
0x180028720: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x180028860: "__cdecl _imp_GetCurrentThread" __imp_GetCurrentThread
0x18002E030: api-ms-win-security-sddl-l1-1-0_NULL_THUNK_DATA_DLN
0x18002DDC0: "__cdecl _DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_lsalookup_l2_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_lsalookup_l2_1_0_dll
0x18000AD74: "__cdecl _local_stdio_scanf_options" __local_stdio_scanf_options
0x18001BEA4: "unsigned long __cdecl SynchronizeMasterKeys(void * __ptr64,unsigned long,struct DP_KEK * __ptr64,struct DP_KEK * __ptr64,unsigned long,unsigned long * __ptr64,unsigned long * __ptr64)" ?SynchronizeMasterKeys@@YAKPEAXKPEAUDP_KEK@@1KPEAK2@Z
0x18000BE6C: "__cdecl _imp_load_CertCreateCertificateContext" __imp_load_CertCreateCertificateContext
0x180028A70: "__cdecl _imp__o_free" __imp__o_free
0x180028BE8: "__cdecl _imp_BCryptFinalizeKeyPair" __imp_BCryptFinalizeKeyPair
0x1800288B0: "__cdecl _imp_RegOpenKeyExW" __imp_RegOpenKeyExW
0x180028A50: "__cdecl _imp__o__initialize_onexit_table" __imp__o__initialize_onexit_table
0x18002ADE8: "Local backup" ??_C@_0N@KJHJMCCE@Local?5backup?$AA@
0x180031918: "__cdecl _favor" __favor
0x18002A940: "\PIPE\ntsvcs" ??_C@_1BK@HICHJHEL@?$AA?2?$AAP?$AAI?$AAP?$AAE?$AA?2?$AAn?$AAt?$AAs?$AAv?$AAc?$AAs?$AA?$AA@
0x180029880: "__cdecl _sz_KdsCli_dll" __sz_KdsCli_dll
0x18000B470: "__cdecl _security_init_cookie" __security_init_cookie
0x180028FC8: "HashDigestLength" ??_C@_1CC@DMMMEHOM@?$AAH?$AAa?$AAs?$AAh?$AAD?$AAi?$AAg?$AAe?$AAs?$AAt?$AAL?$AAe?$AAn?$AAg?$AAt?$AAh?$AA?$AA@
0x180028C50: "__cdecl _imp_LsaGetInterface" __imp_LsaGetInterface
0x1800026E0: "void __cdecl ReleaseExclusiveLockForUser(void * __ptr64)" ?ReleaseExclusiveLockForUser@@YAXPEAX@Z
0x180017DA4: WPP_SF_q
0x180028F70: "Local\DPAPI_" ??_C@_1BK@IOOBBGIN@?$AAL?$AAo?$AAc?$AAa?$AAl?$AA?2?$AAD?$AAP?$AAA?$AAP?$AAI?$AA_?$AA?$AA@
0x180028BC8: "__cdecl _imp_BCryptFinishHash" __imp_BCryptFinishHash
0x180031A10: "struct _LIST_ENTRY g_MasterKeyCacheList" ?g_MasterKeyCacheList@@3U_LIST_ENTRY@@A
0x18002DF60: KdsCli_NULL_THUNK_DATA_DLN
0x180028A90: "__cdecl _imp__cexit" __imp__cexit
0x18002E4F8: KdsCli_NULL_THUNK_DATA_DLB
0x180003BD0: s_SSCryptProtectData
0x180034080: KdsCli_NULL_THUNK_DATA_DLA
0x18000C2DB: "__cdecl _imp_load_CertCloseStore" __imp_load_CertCloseStore
0x180028D18: "__cdecl _imp_RtlUpcaseUnicodeString" __imp_RtlUpcaseUnicodeString
0x18000C658: "__cdecl _imp_load_SIDKeyProtect" __imp_load_SIDKeyProtect
0x1800034FC: "struct _PER_USER_LOCK_ENTRY * __ptr64 __cdecl InitPerUserLock(void * __ptr64)" ?InitPerUserLock@@YAPEAU_PER_USER_LOCK_ENTRY@@PEAX@Z
0x180028A68: "__cdecl _imp__o__wcsicmp" __imp__o__wcsicmp
0x180028A60: "__cdecl _imp_memmove" __imp_memmove
0x180028758: "__cdecl _imp_CompareFileTime" __imp_CompareFileTime
0x18000254C: FMyPrimitiveHash
0x18002B4F8: "3DES" ??_C@_19LEELFJDG@?$AA3?$AAD?$AAE?$AAS?$AA?$AA@
0x180028DE8: "__cdecl _xt_z" __xt_z
0x18000A390: "unsigned short const * __ptr64 __cdecl TranslateALGIDtoBCrypt(unsigned int)" ?TranslateALGIDtoBCrypt@@YAPEBGI@Z
0x18000A358: McGenEventRegister
0x180023864: "void __cdecl std::_Sort_heap_unchecked<struct _MK_LOCATION * __ptr64,bool (__cdecl*)(struct _MK_LOCATION,struct _MK_LOCATION * __ptr64)>(struct _MK_LOCATION * __ptr64,struct _MK_LOCATION * __ptr64,bool (__cdecl*)(struct _MK_LOCATION,struct _MK_LOCATION))" ??$_Sort_heap_unchecked@PEAU_MK_LOCATION@@P6A_NU1@0@Z@std@@YAXPEAU_MK_LOCATION@@0P6A_NU1@1@Z@Z
0x18000AB64: "long __cdecl OpenPolicy(unsigned short * __ptr64,unsigned long,void * __ptr64 * __ptr64)" ?OpenPolicy@@YAJPEAGKPEAPEAX@Z
0x180031B48: "int g_fBackupKeyServerStarted" ?g_fBackupKeyServerStarted@@3HA
0x180028678: "__cdecl _imp_UuidToStringW" __imp_UuidToStringW
0x18002DF48: CRYPTSP_NULL_THUNK_DATA_DLN
0x180028A78: "__cdecl _imp_malloc" __imp_malloc
0x180028C60: "__cdecl _imp_NCryptFinalizeKey" __imp_NCryptFinalizeKey
0x18000C3C0: "__cdecl _imp_load_LookupAccountSidLocalW" __imp_load_LookupAccountSidLocalW
0x1800157A4: "void __cdecl _TlgWriteActivityAutoStop<70368744177664,5>(struct _TlgProvider_t const * __ptr64,struct _GUID const * __ptr64)" ??$_TlgWriteActivityAutoStop@$0EAAAAAAAAAAA@$04@@YAXPEBU_TlgProvider_t@@PEBU_GUID@@@Z
0x180028F30: "Microsoft Primitive Provider" ??_C@_1DK@HJHMGPGD@?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?5?$AAP?$AAr?$AAi?$AAm?$AAi?$AAt?$AAi?$AAv?$AAe?$AA?5?$AAP?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AA?$AA@
0x18002226C: RecoverySetSupplementalCredential
0x180028B08: "__cdecl _imp_EventUnregister" __imp_EventUnregister
0x180028780: "__cdecl _imp_WriteFile" __imp_WriteFile
0x18000B5B0: "__cdecl _scrt_dllmain_after_initialize_c" __scrt_dllmain_after_initialize_c
0x18002AA14: "status" ??_C@_06DJIHEMFI@status?$AA@
0x18000A8FC: FMyProviderCacheInit
0x18002E5E0: "__cdecl _IMPORT_DESCRIPTOR_RPCRT4" __IMPORT_DESCRIPTOR_RPCRT4
0x18002AA78: WPP_f77cb5841adb359b6d80d407f2d5e458_Traceguids
0x18000C701: "__cdecl _tailMerge_samsrv_dll" __tailMerge_samsrv_dll
0x18002ABB8: ETW_LOG_DPAPI_MASTER_KEY_DELETED
0x180029A80: "\User" ??_C@_1M@FJLGADJM@?$AA?2?$AAU?$AAs?$AAe?$AAr?$AA?$AA@
0x180023790: "void __cdecl std::_Push_heap_by_index<struct _MK_LOCATION * __ptr64,struct _MK_LOCATION,bool (__cdecl*)(struct _MK_LOCATION,struct _MK_LOCATION * __ptr64)>(struct _MK_LOCATION * __ptr64,__int64,__int64,struct _MK_LOCATION &&,bool (__cdecl*)(struct _MK_LOCATION,struct _MK_LOCATION &&))" ??$_Push_heap_by_index@PEAU_MK_LOCATION@@U1@P6A_NU1@0@Z@std@@YAXPEAU_MK_LOCATION@@_J1$$QEAU1@P6A_NU1@3@Z@Z
0x180028750: "__cdecl _imp_GetFileSize" __imp_GetFileSize
0x180028BA8: "__cdecl _imp_DuplicateToken" __imp_DuplicateToken
0x180029730: "__cdecl _sz_CRYPT32_dll" __sz_CRYPT32_dll
0x180021FB4: RecoveryRetrieveSupplementalCredential
0x180028D70: "__cdecl _imp_RtlDeleteCriticalSection" __imp_RtlDeleteCriticalSection
0x18002B078: "MD2-%d " ??_C@_1BA@KMBFNGFI@?$AAM?$AAD?$AA2?$AA?9?$AA?$CF?$AAd?$AA?5?$AA?$AA@
0x1800286E0: RPCRT4_NULL_THUNK_DATA
0x18000B654: "__cdecl _scrt_dllmain_exception_filter" __scrt_dllmain_exception_filter
0x18002A7F4: "/" ??_C@_13CGOKJPIL@?$AA?1?$AA?$AA@
0x1800319B8: "int g_fDPAPIInitialized" ?g_fDPAPIInitialized@@3HA
0x18001A048: "int __cdecl IsNT4Domain(void)" ?IsNT4Domain@@YAHXZ
0x18000B1E0: "__cdecl _report_gsfailure" __report_gsfailure
0x18002B1F8: "SKIPJACK-%d " ??_C@_1BK@LNENIAAJ@?$AAS?$AAK?$AAI?$AAP?$AAJ?$AAA?$AAC?$AAK?$AA?9?$AA?$CF?$AAd?$AA?5?$AA?$AA@
0x18002DE00: "__cdecl _DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_lsalookup_l1_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_lsalookup_l1_1_0_dll
0x18001E324: "int __cdecl FreePreferredBackupKey(void)" ?FreePreferredBackupKey@@YAHXZ
0x18002E7FC: "__cdecl _IMPORT_DESCRIPTOR_NTASN1" __IMPORT_DESCRIPTOR_NTASN1
0x180028A40: api-ms-win-core-timezone-l1-1-0_NULL_THUNK_DATA
0x18000AD64: "__cdecl _local_stdio_printf_options" __local_stdio_printf_options
0x180018B5C: "void __cdecl DPAPISynchronizeMasterKeys(void * __ptr64,unsigned long,struct DP_KEK * __ptr64,struct DP_KEK * __ptr64)" ?DPAPISynchronizeMasterKeys@@YAXPEAXKPEAUDP_KEK@@1@Z
0x180029908: "dwLastError" ??_C@_0M@MODCOOBL@dwLastError?$AA@
0x1800289B0: "__cdecl _imp_LeaveCriticalSection" __imp_LeaveCriticalSection
0x18000C4D6: "__cdecl _imp_load_LsaOpenPolicy" __imp_load_LsaOpenPolicy
0x18001F5CC: "int __cdecl RestoreFromRecoverableBlobW2K(void * __ptr64,unsigned char * __ptr64,unsigned long,unsigned char * __ptr64 * __ptr64,unsigned long * __ptr64)" ?RestoreFromRecoverableBlobW2K@@YAHPEAXPEAEKPEAPEAEPEAK@Z
0x18002E7E8: "__cdecl _IMPORT_DESCRIPTOR_LSASRV" __IMPORT_DESCRIPTOR_LSASRV
0x18000C6F5: "__cdecl _imp_load_SamIChangePasswordForeignUser" __imp_load_SamIChangePasswordForeignUser
0x18002AE18: "Delegation error" ??_C@_0BB@DKBEPEFJ@Delegation?5error?$AA@
0x180029080: "ntdll.dll" ??_C@_1BE@GJOFHIHD@?$AAn?$AAt?$AAd?$AAl?$AAl?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x180031938: "__cdecl _hmod__samcli_dll" __hmod__samcli_dll
0x180014DC0: "unsigned long __cdecl RetrieveBackupPublicKeyFromStorage(void * __ptr64,void * __ptr64,unsigned short * __ptr64,unsigned char * __ptr64 * __ptr64,unsigned long * __ptr64)" ?RetrieveBackupPublicKeyFromStorage@@YAKPEAX0PEAGPEAPEAEPEAK@Z
0x18000C153: "__cdecl _tailMerge_userenv_dll" __tailMerge_userenv_dll
0x180017CE4: McTemplateU0dq
0x1800318C0: "struct __type_info_node __type_info_root_node" ?__type_info_root_node@@3U__type_info_node@@A
0x180025018: "public: void * __ptr64 __cdecl CBCryptProvList::`scalar deleting destructor'(unsigned int) __ptr64" ??_GCBCryptProvList@@QEAAPEAXI@Z
0x18000A2CC: SafeAllocaInitialize
0x180009D40: "long __cdecl ProtectCallback(void * __ptr64,void * __ptr64)" ?ProtectCallback@@YAJPEAX0@Z
0x180034008: "__cdecl _imp_CertGetCertificateContextProperty" __imp_CertGetCertificateContextProperty
0x180004440: "unsigned long __cdecl SPCryptProtect(void * __ptr64,unsigned char * __ptr64 * __ptr64,unsigned long * __ptr64,unsigned char * __ptr64,unsigned long,unsigned short const * __ptr64,unsigned char * __ptr64,unsigned long,struct _SSCRYPTPROTECTDATA_PROMPTSTRUCT * __ptr64,unsigned long,unsigned char * __ptr64,unsigned long)" ?SPCryptProtect@@YAKPEAXPEAPEAEPEAKPEAEKPEBG3KPEAU_SSCRYPTPROTECTDATA_PROMPTSTRUCT@@K3K@Z
0x180024048: "unsigned long __cdecl GetMasterKeySyncHash(void * __ptr64,struct _MK_LOCATION * __ptr64,unsigned long,unsigned long,unsigned char * __ptr64,unsigned long)" ?GetMasterKeySyncHash@@YAKPEAXPEAU_MK_LOCATION@@KKPEAEK@Z
0x18002AEC0: "SHA256" ??_C@_1O@HECGKAIN@?$AAS?$AAH?$AAA?$AA2?$AA5?$AA6?$AA?$AA@
0x18002B310: "Recovery" ??_C@_1BC@NDPNGGIP@?$AAR?$AAe?$AAc?$AAo?$AAv?$AAe?$AAr?$AAy?$AA?$AA@
0x18002AC38: "NTE_FAIL" ??_C@_08OCLNAKPD@NTE_FAIL?$AA@
0x180029770: "__cdecl _sz_api_ms_win_security_sddl_l1_1_0_dll" __sz_api_ms_win_security_sddl_l1_1_0_dll
0x180006420: "unsigned long __cdecl FMyDeriveBCryptKey(void * __ptr64,void * __ptr64,unsigned int,unsigned int,unsigned long,unsigned char * __ptr64,unsigned long,unsigned char * __ptr64 * __ptr64,unsigned long * __ptr64,void * __ptr64 * __ptr64)" ?FMyDeriveBCryptKey@@YAKPEAX0IIKPEAEKPEAPEAEPEAKPEAPEAX@Z
0x18000BD72: "__cdecl _stdio_common_vswprintf" __stdio_common_vswprintf
0x18002E6A8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-memory-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-memory-l1-1-0
0x180002C6C: "int __cdecl CloseMasterKey(void * __ptr64,struct MASTERKEY_STORED * __ptr64,int)" ?CloseMasterKey@@YAHPEAXPEAUMASTERKEY_STORED@@H@Z
0x18001E93C: "int __cdecl GetBackupKey(struct _GUID * __ptr64,unsigned char * __ptr64 * __ptr64,unsigned long * __ptr64,void * __ptr64 * __ptr64)" ?GetBackupKey@@YAHPEAU_GUID@@PEAPEAEPEAKPEAPEAX@Z
0x180028850: "__cdecl _imp_OpenThreadToken" __imp_OpenThreadToken
0x180034048: "__cdecl _imp_CryptSignAndEncodeCertificate" __imp_CryptSignAndEncodeCertificate
0x1800286C8: "__cdecl _imp_NdrClientCall3" __imp_NdrClientCall3
0x180028830: "__cdecl _imp_MapViewOfFile" __imp_MapViewOfFile
0x180028630: "__cdecl _imp_UuidCreate" __imp_UuidCreate
0x180028A88: "__cdecl _imp__configure_narrow_argv" __imp__configure_narrow_argv
0x180029960: ETW_LOG_MASTERKEY_FILE_OPEN_IN_STORAGE_FAILED
0x180029980: "onecore\ds\security\cryptoapi\se" ??_C@_0DK@LAFJGLEB@onecore?2ds?2security?2cryptoapi?2se@
0x180012FD4: "unsigned long __cdecl AttemptLocalBackup(int,void * __ptr64,struct MASTERKEY_STORED * __ptr64,unsigned char * __ptr64,unsigned long,unsigned char * __ptr64,unsigned long,unsigned char * __ptr64 * __ptr64,unsigned long * __ptr64)" ?AttemptLocalBackup@@YAKHPEAXPEAUMASTERKEY_STORED@@PEAEK2KPEAPEAEPEAK@Z
0x180029148: "Disable DC Recovery" ??_C@_1CI@LNEKDOEK@?$AAD?$AAi?$AAs?$AAa?$AAb?$AAl?$AAe?$AA?5?$AAD?$AAC?$AA?5?$AAR?$AAe?$AAc?$AAo?$AAv?$AAe?$AAr?$AAy?$AA?$AA@
0x18002B1D0: "KEA Exchange-%d " ??_C@_1CC@JIAIIMLG@?$AAK?$AAE?$AAA?$AA?5?$AAE?$AAx?$AAc?$AAh?$AAa?$AAn?$AAg?$AAe?$AA?9?$AA?$CF?$AAd?$AA?5?$AA?$AA@
0x18002B198: "DH-%d " ??_C@_1O@HIFMDJPM@?$AAD?$AAH?$AA?9?$AA?$CF?$AAd?$AA?5?$AA?$AA@
0x18001D2E8: WPP_SF__guid_D
0x18002E784: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0
0x18000C51E: "__cdecl _imp_load_LsaStorePrivateData" __imp_load_LsaStorePrivateData
0x18000C24A: "__cdecl _tailMerge_api_ms_win_security_lsalookup_l2_1_0_dll" __tailMerge_api_ms_win_security_lsalookup_l2_1_0_dll
0x1800286D0: "__cdecl _imp_NdrServerCall2" __imp_NdrServerCall2
0x180028AB0: "__cdecl _imp___std_type_info_destroy_list" __imp___std_type_info_destroy_list
0x18002ABD8: ETW_LOG_SYSTEM_CREDENTIALS_LSASS_CREATION_FAILED
0x180028A90: "__cdecl _imp__o__cexit" __imp__o__cexit
0x18000BD72: "__cdecl o___stdio_common_vswprintf" _o___stdio_common_vswprintf
0x18001554C: WPP_SF_SD
0x180028A70: "__cdecl _imp_free" __imp_free
0x18001CCE0: McTemplateU0
0x1800289C8: api-ms-win-core-synch-l1-2-0_NULL_THUNK_DATA
0x18001D0E8: WPP_SF_SS
0x1800286A0: "__cdecl _imp_RpcBindingSetAuthInfoExW" __imp_RpcBindingSetAuthInfoExW
0x18002E84C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-threadpool-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-threadpool-l1-2-0
0x180028858: "__cdecl _imp_OpenProcessToken" __imp_OpenProcessToken
0x180028D40: "__cdecl _imp_RtlDosPathNameToRelativeNtPathName_U" __imp_RtlDosPathNameToRelativeNtPathName_U
0x180017E90: "public: __cdecl ScopedSecureSSFree::ScopedSecureSSFree(unsigned char * __ptr64 & __ptr64,unsigned long & __ptr64) __ptr64" ??0ScopedSecureSSFree@@QEAA@AEAPEAEAEAK@Z
0x1800177E0: WPP_SF__guid_dd
0x1800289B8: api-ms-win-core-synch-l1-1-0_NULL_THUNK_DATA
0x18002E6E4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0
0x1800184DC: "int __cdecl ComputeMasterKeyUserEncryptionKey(void * __ptr64,void * __ptr64,unsigned long,unsigned char * __ptr64 const,unsigned char * __ptr64 const,unsigned char * __ptr64 const)" ?ComputeMasterKeyUserEncryptionKey@@YAHPEAX0KQEAE11@Z
0x18000BD96: "__cdecl execute_onexit_table" _execute_onexit_table
0x18002249C: SPRecoverQueryStatus
0x1800249E8: "unsigned long __cdecl SynchronizeOneMasterKey(void * __ptr64,struct _MK_LOCATION * __ptr64,unsigned long)" ?SynchronizeOneMasterKey@@YAKPEAXPEAU_MK_LOCATION@@K@Z
0x18001D45C: WPP_SF_s
0x180012E00: WPP_SF_S
0x18000BD4E: memset
0x18002E888: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x1800178E8: "unsigned long __cdecl SPCryptUpdateProtectedState(void * __ptr64,void * __ptr64,unsigned char * __ptr64,unsigned long,unsigned long,unsigned long * __ptr64,unsigned long * __ptr64)" ?SPCryptUpdateProtectedState@@YAKPEAX0PEAEKKPEAK2@Z
0x18000B2D4: "__cdecl _report_securityfailure" __report_securityfailure
0x1800176D8: McTemplateU0d
0x180028770: "__cdecl _imp_ReadFile" __imp_ReadFile
0x1800340A8: "__cdecl _imp_UnloadUserProfile" __imp_UnloadUserProfile
0x180002CB0: "void __cdecl FreeMasterKey(struct MASTERKEY_STORED * __ptr64)" ?FreeMasterKey@@YAXPEAUMASTERKEY_STORED@@@Z
0x180031328: "unsigned __int64 `__local_stdio_scanf_options'::`2'::_OptionsStorage" ?_OptionsStorage@?1??__local_stdio_scanf_options@@9@4_KA
0x1800340C8: USERENV_NULL_THUNK_DATA_DLA

[JEB Decompiler by PNF Software]