Generated by JEB on 2019/08/01

PE: C:\Windows\System32\drivers\SgrmAgent.sys Base=0x1C0000000 SHA-256=EC90E67A2D5055FB6792D28B0CCFE3A47F2D3EBD8C643966DD857C289F2E26A3
PDB: SgrmAgent.pdb GUID={12AABC47-2038-561B-6D056DCAC8F00653} Age=1

418 located named symbols:
0x1C00049E0: "RC" ??_C@_15IGNKAAHD@?$AAR?$AAC?$AA?$AA@
0x1C0003250: "Token_Lowbox" ??_C@_1BK@LBNJBCPB@?$AAT?$AAo?$AAk?$AAe?$AAn?$AA_?$AAL?$AAo?$AAw?$AAb?$AAo?$AAx?$AA?$AA@
0x1C00035E0: "MitigationFlags_DisableDynamicCo" ??_C@_1GO@MMOCNHFF@?$AAM?$AAi?$AAt?$AAi?$AAg?$AAa?$AAt?$AAi?$AAo?$AAn?$AAF?$AAl?$AAa?$AAg?$AAs?$AA_?$AAD?$AAi?$AAs?$AAa?$AAb?$AAl?$AAe?$AAD?$AAy?$AAn?$AAa?$AAm?$AAi?$AAc?$AAC?$AAo@
0x1C00043A0: "Invalid StringName values." ??_C@_0BL@IEAOBAAH@Invalid?5StringName?5values?4?$AA@
0x1C000A1E8: "__cdecl _imp_PsGetThreadProcess" __imp_PsGetThreadProcess
0x1C00036A0: "MitigationFlags_DisallowWin32kSy" ??_C@_1FE@KILCIPLN@?$AAM?$AAi?$AAt?$AAi?$AAg?$AAa?$AAt?$AAi?$AAo?$AAn?$AAF?$AAl?$AAa?$AAg?$AAs?$AA_?$AAD?$AAi?$AAs?$AAa?$AAl?$AAl?$AAo?$AAw?$AAW?$AAi?$AAn?$AA3?$AA2?$AAk?$AAS?$AAy@
0x1C00143B8: SepSddlGetAclForString
0x1C0002F30: "UNICODE_STRING_MaximumLength" ??_C@_1DK@GHJKHGKB@?$AAU?$AAN?$AAI?$AAC?$AAO?$AAD?$AAE?$AA_?$AAS?$AAT?$AAR?$AAI?$AAN?$AAG?$AA_?$AAM?$AAa?$AAx?$AAi?$AAm?$AAu?$AAm?$AAL?$AAe?$AAn?$AAg?$AAt?$AAh?$AA?$AA@
0x1C000A2D0: "__cdecl _imp_RtlFreeUnicodeString" __imp_RtlFreeUnicodeString
0x1C00024F8: "OctpHandleInitRequest() failed." ??_C@_0CA@FGBNHEEO@OctpHandleInitRequest?$CI?$CJ?5failed?4?$AA@
0x1C00025A8: "OctpGetNtosInfo" ??_C@_0BA@NNFJHFKD@OctpGetNtosInfo?$AA@
0x1C0002778: "UNICODE_STRING" ??_C@_1BO@JOMFLPFF@?$AAU?$AAN?$AAI?$AAC?$AAO?$AAD?$AAE?$AA_?$AAS?$AAT?$AAR?$AAI?$AAN?$AAG?$AA?$AA@
0x1C0002DE0: "DRIVER_OBJECT_DriverName" ??_C@_1DC@IILELPDB@?$AAD?$AAR?$AAI?$AAV?$AAE?$AAR?$AA_?$AAO?$AAB?$AAJ?$AAE?$AAC?$AAT?$AA_?$AAD?$AAr?$AAi?$AAv?$AAe?$AAr?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x1C0008678: "__cdecl _security_cookie_complement" __security_cookie_complement
0x1C0002CD0: "PEB_CrossProcessFlags" ??_C@_1CM@GPDDEGE@?$AAP?$AAE?$AAB?$AA_?$AAC?$AAr?$AAo?$AAs?$AAs?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AAF?$AAl?$AAa?$AAg?$AAs?$AA?$AA@
0x1C000A058: "__cdecl _imp_ObfDereferenceObject" __imp_ObfDereferenceObject
0x1C000FB8C: OctpHandleGetReferencedDriverObject
0x1C0008808: PfnIoCreateDeviceSecure
0x1C000BA80: OctpShutdown
0x1C001601C: OctpCreateDeviceObject
0x1C0004220: "Requested process is NOT referen" ??_C@_0CF@CKLAIFKH@Requested?5process?5is?5NOT?5referen@
0x1C000A228: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x1C0002188: "Failed to allocate memory for a " ??_C@_0DA@OACFALEJ@Failed?5to?5allocate?5memory?5for?5a?5@
0x1C00045E0: "Can't MmCopyMemory IO memory." ??_C@_0BO@DJHGPHCN@Can?8t?5MmCopyMemory?5IO?5memory?4?$AA@
0x1C00012F0: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x1C0002D00: "KUSER_SHARED_DATA_BootId" ??_C@_1DC@BCEHMOLC@?$AAK?$AAU?$AAS?$AAE?$AAR?$AA_?$AAS?$AAH?$AAA?$AAR?$AAE?$AAD?$AA_?$AAD?$AAA?$AAT?$AAA?$AA_?$AAB?$AAo?$AAo?$AAt?$AAI?$AAd?$AA?$AA@
0x1C0013980: OctpHandleGetMsrValue
0x1C0002760: "EPROCESS" ??_C@_1BC@MNAKGENP@?$AAE?$AAP?$AAR?$AAO?$AAC?$AAE?$AAS?$AAS?$AA?$AA@
0x1C00048B0: "Failed to allocate memory for ma" ??_C@_0CK@KABALGDN@Failed?5to?5allocate?5memory?5for?5ma@
0x1C000A1B0: "__cdecl _imp_PsLookupProcessByProcessId" __imp_PsLookupProcessByProcessId
0x1C00106F0: OctpHandleDereferenceDeviceObject
0x1C0003118: "SID_SubAuthority" ??_C@_1CC@GJBPGOG@?$AAS?$AAI?$AAD?$AA_?$AAS?$AAu?$AAb?$AAA?$AAu?$AAt?$AAh?$AAo?$AAr?$AAi?$AAt?$AAy?$AA?$AA@
0x1C0004CB8: "__cdecl TraceLoggingMetadata" _TraceLoggingMetadata
0x1C000A120: MmHighestUserAddress
0x1C000A0B0: "__cdecl _imp_ExpInterlockedPushEntrySList" __imp_ExpInterlockedPushEntrySList
0x1C000A238: "__cdecl _imp_IoCreateDevice" __imp_IoCreateDevice
0x1C000B55C: OctpPurgeAll
0x1C0004850: "Can't get information about requ" ??_C@_0DE@FNHKCCJD@Can?8t?5get?5information?5about?5requ@
0x1C000A240: "__cdecl _imp_IoDeviceObjectType" __imp_IoDeviceObjectType
0x1C0002840: "PS_PROTECTED_SIGNER_PsProtectedS" ??_C@_1GC@JKNEDANP@?$AAP?$AAS?$AA_?$AAP?$AAR?$AAO?$AAT?$AAE?$AAC?$AAT?$AAE?$AAD?$AA_?$AAS?$AAI?$AAG?$AAN?$AAE?$AAR?$AA_?$AAP?$AAs?$AAP?$AAr?$AAo?$AAt?$AAe?$AAc?$AAt?$AAe?$AAd?$AAS@
0x1C00089E8: OctKernelExtension
0x1C000A0C0: "__cdecl _imp_MmProbeAndLockPages" __imp_MmProbeAndLockPages
0x1C000EE98: OctpHandleGetNextReferencedProcessObject
0x1C00049E8: "WD" ??_C@_15ELMAKJHJ@?$AAW?$AAD?$AA?$AA@
0x1C000A088: "__cdecl _imp_IofCompleteRequest" __imp_IofCompleteRequest
0x1C000A288: "__cdecl _imp_RtlCreateSecurityDescriptor" __imp_RtlCreateSecurityDescriptor
0x1C000A1E0: IoDriverObjectType
0x1C000A168: "__cdecl _imp_ExInitializeRundownProtection" __imp_ExInitializeRundownProtection
0x1C0013D40: IoDevObjCreateDeviceSecure
0x1C000A278: "__cdecl _imp_wcschr" __imp_wcschr
0x1C0003A10: "MitigationFlags_AuditProhibitLow" ??_C@_1FG@EEMOFDHM@?$AAM?$AAi?$AAt?$AAi?$AAg?$AAa?$AAt?$AAi?$AAo?$AAn?$AAF?$AAl?$AAa?$AAg?$AAs?$AA_?$AAA?$AAu?$AAd?$AAi?$AAt?$AAP?$AAr?$AAo?$AAh?$AAi?$AAb?$AAi?$AAt?$AAL?$AAo?$AAw@
0x1C000BBD0: OctDispatchCreate
0x1C0001008: "__cdecl TlgWrite" _TlgWrite
0x1C000A300: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x1C0008814: PiRegStateDiscriptor
0x1C001292C: OctpHandleUnmapFile
0x1C000A018: "__cdecl _imp_ExDeletePagedLookasideList" __imp_ExDeletePagedLookasideList
0x1C000A2B8: "__cdecl _imp_RtlGetOwnerSecurityDescriptor" __imp_RtlGetOwnerSecurityDescriptor
0x1C000A280: "__cdecl _imp__wcsnicmp" __imp__wcsnicmp
0x1C00089F0: OctKernelInterface
0x1C0013EEC: IopDevObjApplyPostCreationSettings
0x1C0004628: "Invalid CopyMemory mode." ??_C@_0BJ@IKLPIIBM@Invalid?5CopyMemory?5mode?4?$AA@
0x1C0004008: "Failed to allocate memory for tr" ??_C@_0DA@KFKFLFNK@Failed?5to?5allocate?5memory?5for?5tr@
0x1C000A158: "__cdecl _imp_ExAcquirePushLockSharedEx" __imp_ExAcquirePushLockSharedEx
0x1C00029D0: "KPROCESS_UserDirectoryTableBase" ??_C@_1EA@KPNJFHIF@?$AAK?$AAP?$AAR?$AAO?$AAC?$AAE?$AAS?$AAS?$AA_?$AAU?$AAs?$AAe?$AAr?$AAD?$AAi?$AAr?$AAe?$AAc?$AAt?$AAo?$AAr?$AAy?$AAT?$AAa?$AAb?$AAl?$AAe?$AAB?$AAa?$AAs?$AAe?$AA?$AA@
0x1C0003270: "MitigationFlags_ControlFlowGuard" ??_C@_1FA@LMEEIGEC@?$AAM?$AAi?$AAt?$AAi?$AAg?$AAa?$AAt?$AAi?$AAo?$AAn?$AAF?$AAl?$AAa?$AAg?$AAs?$AA_?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAF?$AAl?$AAo?$AAw?$AAG?$AAu?$AAa?$AAr?$AAd@
0x1C0002DA8: "DRIVER_OBJECT_DriverSize" ??_C@_1DC@JHNCJMPP@?$AAD?$AAR?$AAI?$AAV?$AAE?$AAR?$AA_?$AAO?$AAB?$AAJ?$AAE?$AAC?$AAT?$AA_?$AAD?$AAr?$AAi?$AAv?$AAe?$AAr?$AAS?$AAi?$AAz?$AAe?$AA?$AA@
0x1C000A230: "__cdecl _imp_MmGetSystemRoutineAddress" __imp_MmGetSystemRoutineAddress
0x1C0002D70: "DRIVER_OBJECT_DriverStart" ??_C@_1DE@GDJCJHAC@?$AAD?$AAR?$AAI?$AAV?$AAE?$AAR?$AA_?$AAO?$AAB?$AAJ?$AAE?$AAC?$AAT?$AA_?$AAD?$AAr?$AAi?$AAv?$AAe?$AAr?$AAS?$AAt?$AAa?$AAr?$AAt?$AA?$AA@
0x1C0004350: "OctpHandleDereferenceDeviceObjec" ??_C@_0CC@IMNIACAF@OctpHandleDereferenceDeviceObjec@
0x1C000A200: "__cdecl _imp_MmCopyMemory" __imp_MmCopyMemory
0x1C00045C8: "Can't MmMapIoSpaceEx." ??_C@_0BG@BDGEFEJA@Can?8t?5MmMapIoSpaceEx?4?$AA@
0x1C0004A08: "GR" ??_C@_15DNGEKDKB@?$AAG?$AAR?$AA?$AA@
0x1C00022E0: "IoCreateDevice failed." ??_C@_0BH@JFJLAAOH@IoCreateDevice?5failed?4?$AA@
0x1C0004378: "OctpHandleGetStructureOffsetSize" ??_C@_0CB@MPKEOHPJ@OctpHandleGetStructureOffsetSize@
0x1C0003960: "MitigationFlags_AuditProhibitRem" ??_C@_1FI@PPBMCGDA@?$AAM?$AAi?$AAt?$AAi?$AAg?$AAa?$AAt?$AAi?$AAo?$AAn?$AAF?$AAl?$AAa?$AAg?$AAs?$AA_?$AAA?$AAu?$AAd?$AAi?$AAt?$AAP?$AAr?$AAo?$AAh?$AAi?$AAb?$AAi?$AAt?$AAR?$AAe?$AAm@
0x1C000A100: "__cdecl _imp_KeWaitForSingleObject" __imp_KeWaitForSingleObject
0x1C0002518: "ERROR: unrecognized IOCTL." ??_C@_0BL@GGDCFFIL@ERROR?3?5unrecognized?5IOCTL?4?$AA@
0x1C0002A50: "EPROCESS_UniqueProcessId" ??_C@_1DC@OCDJJAGA@?$AAE?$AAP?$AAR?$AAO?$AAC?$AAE?$AAS?$AAS?$AA_?$AAU?$AAn?$AAi?$AAq?$AAu?$AAe?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AAI?$AAd?$AA?$AA@
0x1C0001300: memcpy
0x1C0002998: "KPROCESS_DirectoryTableBase" ??_C@_1DI@NKIMDGBO@?$AAK?$AAP?$AAR?$AAO?$AAC?$AAE?$AAS?$AAS?$AA_?$AAD?$AAi?$AAr?$AAe?$AAc?$AAt?$AAo?$AAr?$AAy?$AAT?$AAa?$AAb?$AAl?$AAe?$AAB?$AAa?$AAs?$AAe?$AA?$AA@
0x1C000A090: "__cdecl _imp_IoRegisterShutdownNotification" __imp_IoRegisterShutdownNotification
0x1C0003FA8: "Failed to lock the page." ??_C@_0BJ@NPBCCKMI@Failed?5to?5lock?5the?5page?4?$AA@
0x1C0004058: "Input buffer size is insufficien" ??_C@_0CD@DIHOGNJL@Input?5buffer?5size?5is?5insufficien@
0x1C0002670: "Input/Ouput buffer size is insuf" ??_C@_0CJ@HFCNKDOA@Input?1Ouput?5buffer?5size?5is?5insuf@
0x1C0004690: "ZwQueryInformationFile() failed!" ??_C@_0EC@KHCBOLNG@ZwQueryInformationFile?$CI?$CJ?5failed?$CB@
0x1C00024A0: "Failed to allocate memory for ou" ??_C@_0DM@OOBFPJJH@Failed?5to?5allocate?5memory?5for?5ou@
0x1C0002F00: "UNICODE_STRING_Length" ??_C@_1CM@IGICBCGP@?$AAU?$AAN?$AAI?$AAC?$AAO?$AAD?$AAE?$AA_?$AAS?$AAT?$AAR?$AAI?$AAN?$AAG?$AA_?$AAL?$AAe?$AAn?$AAg?$AAt?$AAh?$AA?$AA@
0x1C0014200: SepSddlDaclFromSDDLString
0x1C000A108: "__cdecl _imp_ZwSetValueKey" __imp_ZwSetValueKey
0x1C00046D8: "ZwCreateSection() failed!" ??_C@_0BK@HCDFJPCC@ZwCreateSection?$CI?$CJ?5failed?$CB?$AA@
0x1C000F2FC: OctpHandleGetNextReferencedThreadObject
0x1C000A078: "__cdecl _imp_IoDeleteDevice" __imp_IoDeleteDevice
0x1C0004270: "Requested thread can't be NULL." ??_C@_0CA@IIMJADEI@Requested?5thread?5can?8t?5be?5NULL?4?$AA@
0x1C000A270: "__cdecl _imp_RtlAbsoluteToSelfRelativeSD" __imp_RtlAbsoluteToSelfRelativeSD
0x1C000A1C8: "__cdecl _imp_PsGetProcessStartKey" __imp_PsGetProcessStartKey
0x1C0004450: "Can't CopyMemory, no source proc" ??_C@_0FJ@JHENGFFN@Can?8t?5CopyMemory?0?5no?5source?5proc@
0x1C0004750: "Can't gather memory range info -" ??_C@_0DG@KJDEILHN@Can?8t?5gather?5memory?5range?5info?5?9@
0x1C000119D: "__cdecl _C_specific_handler" __C_specific_handler
0x1C00039C0: "MitigationFlags_ProhibitLowILIma" ??_C@_1EM@KKDKFCIF@?$AAM?$AAi?$AAt?$AAi?$AAg?$AAa?$AAt?$AAi?$AAo?$AAn?$AAF?$AAl?$AAa?$AAg?$AAs?$AA_?$AAP?$AAr?$AAo?$AAh?$AAi?$AAb?$AAi?$AAt?$AAL?$AAo?$AAw?$AAI?$AAL?$AAI?$AAm?$AAa@
0x1C000A1F0: "__cdecl _imp_KeInitializeApc" __imp_KeInitializeApc
0x1C0003028: "TOKEN_UserAndGroups" ??_C@_1CI@PODGKLNF@?$AAT?$AAO?$AAK?$AAE?$AAN?$AA_?$AAU?$AAs?$AAe?$AAr?$AAA?$AAn?$AAd?$AAG?$AAr?$AAo?$AAu?$AAp?$AAs?$AA?$AA@
0x1C0001300: memmove
0x1C0002968: "KPROCESS_ProcessFlags" ??_C@_1CM@NPLLPGAC@?$AAK?$AAP?$AAR?$AAO?$AAC?$AAE?$AAS?$AAS?$AA_?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AAF?$AAl?$AAa?$AAg?$AAs?$AA?$AA@
0x1C0014084: SepSddlSecurityDescriptorFromSDDLString
0x1C0003910: "MitigationFlags_ProhibitRemoteIm" ??_C@_1EO@ENGFKCKG@?$AAM?$AAi?$AAt?$AAi?$AAg?$AAa?$AAt?$AAi?$AAo?$AAn?$AAF?$AAl?$AAa?$AAg?$AAs?$AA_?$AAP?$AAr?$AAo?$AAh?$AAi?$AAb?$AAi?$AAt?$AAR?$AAe?$AAm?$AAo?$AAt?$AAe?$AAI?$AAm@
0x1C0002210: "SGRM Agent Driver failed to init" ??_C@_0CI@FKGDOAKE@SGRM?5Agent?5Driver?5failed?5to?5init@
0x1C000B9F4: OctpThawAllThreads
0x1C0004828: "Can't open a handle to the proce" ??_C@_0CE@KFOHBJJJ@Can?8t?5open?5a?5handle?5to?5the?5proce@
0x1C0004970: "IoCreateDeviceSecure" ??_C@_1CK@LEEDIGFP@?$AAI?$AAo?$AAC?$AAr?$AAe?$AAa?$AAt?$AAe?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAS?$AAe?$AAc?$AAu?$AAr?$AAe?$AA?$AA@
0x1C00026A0: "Failed to reference broker servi" ??_C@_0DD@KFJHEFOI@Failed?5to?5reference?5broker?5servi@
0x1C0003F80: "Can't allocate MDL for the page." ??_C@_0CB@BCHIFCJI@Can?8t?5allocate?5MDL?5for?5the?5page?4@
0x1C00011EC: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x1C000A0D8: "__cdecl _imp_IoGetDeviceObjectPointer" __imp_IoGetDeviceObjectPointer
0x1C0004888: "Error retrieving memory region i" ??_C@_0CE@DMPJMBBP@Error?5retrieving?5memory?5region?5i@
0x1C0003B30: "MitigationFlags_AuditBlockNonMic" ??_C@_1HC@FHAJFODE@?$AAM?$AAi?$AAt?$AAi?$AAg?$AAa?$AAt?$AAi?$AAo?$AAn?$AAF?$AAl?$AAa?$AAg?$AAs?$AA_?$AAA?$AAu?$AAd?$AAi?$AAt?$AAB?$AAl?$AAo?$AAc?$AAk?$AAN?$AAo?$AAn?$AAM?$AAi?$AAc@
0x1C0002BD8: "EPROCESS_SectionSignatureLevel" ??_C@_1DO@IKADMFLO@?$AAE?$AAP?$AAR?$AAO?$AAC?$AAE?$AAS?$AAS?$AA_?$AAS?$AAe?$AAc?$AAt?$AAi?$AAo?$AAn?$AAS?$AAi?$AAg?$AAn?$AAa?$AAt?$AAu?$AAr?$AAe?$AAL?$AAe?$AAv?$AAe?$AAl?$AA?$AA@
0x1C00040C8: "OctpHandleGetReferencedProcessOb" ??_C@_0CF@DPFLMCDC@OctpHandleGetReferencedProcessOb@
0x1C00010C0: OctDispatchShutdown
0x1C0002E50: "DRIVER_OBJECT_DriverStartIo" ??_C@_1DI@IOILACHF@?$AAD?$AAR?$AAI?$AAV?$AAE?$AAR?$AA_?$AAO?$AAB?$AAJ?$AAE?$AAC?$AAT?$AA_?$AAD?$AAr?$AAi?$AAv?$AAe?$AAr?$AAS?$AAt?$AAa?$AAr?$AAt?$AAI?$AAo?$AA?$AA@
0x1C0003650: "MitigationFlags_AuditDisableDyna" ??_C@_1FA@GIDPEOMM@?$AAM?$AAi?$AAt?$AAi?$AAg?$AAa?$AAt?$AAi?$AAo?$AAn?$AAF?$AAl?$AAa?$AAg?$AAs?$AA_?$AAA?$AAu?$AAd?$AAi?$AAt?$AAD?$AAi?$AAs?$AAa?$AAb?$AAl?$AAe?$AAD?$AAy?$AAn?$AAa@
0x1C0004958: "OctpHandleGetMsrValue" ??_C@_0BG@DENENKPC@OctpHandleGetMsrValue?$AA@
0x1C000A080: "__cdecl _imp_ObfReferenceObject" __imp_ObfReferenceObject
0x1C000A150: "__cdecl _imp_KeUnstackDetachProcess" __imp_KeUnstackDetachProcess
0x1C0003BB0: "MitigationFlags_LoaderIntegrityC" ??_C@_1GC@HIFCLLAA@?$AAM?$AAi?$AAt?$AAi?$AAg?$AAa?$AAt?$AAi?$AAo?$AAn?$AAF?$AAl?$AAa?$AAg?$AAs?$AA_?$AAL?$AAo?$AAa?$AAd?$AAe?$AAr?$AAI?$AAn?$AAt?$AAe?$AAg?$AAr?$AAi?$AAt?$AAy?$AAC@
0x1C00024E0: "Not enough data." ??_C@_0BB@LIKHKGEN@Not?5enough?5data?4?$AA@
0x1C0002750: "POINTER" ??_C@_1BA@OHECEHB@?$AAP?$AAO?$AAI?$AAN?$AAT?$AAE?$AAR?$AA?$AA@
0x1C001489C: SepSddlParseWideStringUlong
0x1C000A110: "__cdecl _imp_EtwSetInformation" __imp_EtwSetInformation
0x1C000A128: "__cdecl _imp_ExUnregisterExtension" __imp_ExUnregisterExtension
0x1C00021B8: "OctpInitialize" ??_C@_0P@CEJDEHLI@OctpInitialize?$AA@
0x1C0003C20: "MitigationFlags_AuditLoaderInteg" ??_C@_1FO@MLMLHFJB@?$AAM?$AAi?$AAt?$AAi?$AAg?$AAa?$AAt?$AAi?$AAo?$AAn?$AAF?$AAl?$AAa?$AAg?$AAs?$AA_?$AAA?$AAu?$AAd?$AAi?$AAt?$AAL?$AAo?$AAa?$AAd?$AAe?$AAr?$AAI?$AAn?$AAt?$AAe?$AAg@
0x1C000A0F0: "__cdecl _imp_ZwQueryInformationFile" __imp_ZwQueryInformationFile
0x1C0004A18: "GX" ??_C@_15FCNJEDMF@?$AAG?$AAX?$AA?$AA@
0x1C00049F0: "WO" ??_C@_15JMMBCOHI@?$AAW?$AAO?$AA?$AA@
0x1C000A098: "__cdecl _imp_IoCreateSymbolicLink" __imp_IoCreateSymbolicLink
0x1C0002E88: "DRIVER_OBJECT_MajorFunction" ??_C@_1DI@GDCAIBDD@?$AAD?$AAR?$AAI?$AAV?$AAE?$AAR?$AA_?$AAO?$AAB?$AAJ?$AAE?$AAC?$AAT?$AA_?$AAM?$AAa?$AAj?$AAo?$AAr?$AAF?$AAu?$AAn?$AAc?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x1C000A008: "__cdecl _imp_ExAllocatePoolWithTag" __imp_ExAllocatePoolWithTag
0x1C0003E20: "OctpHandleMapVirtualAddress" ??_C@_0BM@NJLDEBOJ@OctpHandleMapVirtualAddress?$AA@
0x1C00031D0: "ProcessFlags2_PrimaryTokenFrozen" ??_C@_1EC@NJAIAEFF@?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AAF?$AAl?$AAa?$AAg?$AAs?$AA2?$AA_?$AAP?$AAr?$AAi?$AAm?$AAa?$AAr?$AAy?$AAT?$AAo?$AAk?$AAe?$AAn?$AAF?$AAr?$AAo?$AAz?$AAe?$AAn@
0x1C0002F70: "UNICODE_STRING_Buffer" ??_C@_1CM@GJFCIMLM@?$AAU?$AAN?$AAI?$AAC?$AAO?$AAD?$AAE?$AA_?$AAS?$AAT?$AAR?$AAI?$AAN?$AAG?$AA_?$AAB?$AAu?$AAf?$AAf?$AAe?$AAr?$AA?$AA@
0x1C000A198: "__cdecl _imp_MmUserProbeAddress" __imp_MmUserProbeAddress
0x1C0004918: "OctpHandleGetThreadContext" ??_C@_0BL@BPPKMODB@OctpHandleGetThreadContext?$AA@
0x1C000A220: "__cdecl _imp_ZwQueryVirtualMemory" __imp_ZwQueryVirtualMemory
0x1C0002338: "IoCreateSymbolicLink failed." ??_C@_0BN@GCCIEFIC@IoCreateSymbolicLink?5failed?4?$AA@
0x1C000A180: "__cdecl _imp_PsGetCurrentProcessId" __imp_PsGetCurrentProcessId
0x1C000A2A0: "__cdecl _imp__snwprintf" __imp__snwprintf
0x1C0003F58: "TargetProcess is not referenced." ??_C@_0CB@KMNBALPA@TargetProcess?5is?5not?5referenced?4@
0x1C0013BB0: OctpRundownKernelRoutine
0x1C000A188: "__cdecl _imp_EtwWriteTransfer" __imp_EtwWriteTransfer
0x1C0002AA8: "EPROCESS_Protection" ??_C@_1CI@LFCCPNEG@?$AAE?$AAP?$AAR?$AAO?$AAC?$AAE?$AAS?$AAS?$AA_?$AAP?$AAr?$AAo?$AAt?$AAe?$AAc?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x1C00043F8: "OctpHandleThawThread" ??_C@_0BF@PPBOHCHA@OctpHandleThawThread?$AA@
0x1C0004300: "OctpHandleDereferenceDriverObjec" ??_C@_0CC@BKJHKNKG@OctpHandleDereferenceDriverObjec@
0x1C0001254: "__cdecl _GSHandlerCheck_SEH" __GSHandlerCheck_SEH
0x1C000A000: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x1C0004A8C: "A" ??_C@_13PNBDBPLL@?$AAA?$AA?$AA@
0x1C00025F8: "Allocation failed." ??_C@_0BD@BGPAKMNK@Allocation?5failed?4?$AA@
0x1C000A2A8: "__cdecl _imp_SeCaptureSecurityDescriptor" __imp_SeCaptureSecurityDescriptor
0x1C000A048: "__cdecl _imp_KeLeaveCriticalRegion" __imp_KeLeaveCriticalRegion
0x1C000A030: "__cdecl _imp_MmUnmapLockedPages" __imp_MmUnmapLockedPages
0x1C0003A70: "MitigationFlags_SignatureMitigat" ??_C@_1FC@HDOJNEEJ@?$AAM?$AAi?$AAt?$AAi?$AAg?$AAa?$AAt?$AAi?$AAo?$AAn?$AAF?$AAl?$AAa?$AAg?$AAs?$AA_?$AAS?$AAi?$AAg?$AAn?$AAa?$AAt?$AAu?$AAr?$AAe?$AAM?$AAi?$AAt?$AAi?$AAg?$AAa?$AAt@
0x1C00044B0: "Process is not referenced." ??_C@_0BL@MEHLEFGP@Process?5is?5not?5referenced?4?$AA@
0x1C00011C8: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x1C0004528: "Can't MmCopyMemory kernel-mode m" ??_C@_0CH@CHMBFLCE@Can?8t?5MmCopyMemory?5kernel?9mode?5m@
0x1C0002400: "Caller process is not a WinTCB s" ??_C@_0DJ@DBMMAHBB@Caller?5process?5is?5not?5a?5WinTCB?5s@
0x1C000A0B8: "__cdecl _imp_IoAllocateMdl" __imp_IoAllocateMdl
0x1C000A268: "__cdecl _imp_RtlAddAccessAllowedAce" __imp_RtlAddAccessAllowedAce
0x1C000A0A0: "__cdecl _imp_ExpInterlockedPopEntrySList" __imp_ExpInterlockedPopEntrySList
0x1C000A290: "__cdecl _imp_SeExports" __imp_SeExports
0x1C0003E70: "A kernel VA has been provided. T" ??_C@_0EL@OBKIIPCD@A?5kernel?5VA?5has?5been?5provided?4?5T@
0x1C000CCEC: OctpGetNtosInfo
0x1C00027F8: "TOKEN_SOURCE" ??_C@_1BK@BEHHKALA@?$AAT?$AAO?$AAK?$AAE?$AAN?$AA_?$AAS?$AAO?$AAU?$AAR?$AAC?$AAE?$AA?$AA@
0x1C0013B60: OctpNopKernelRoutine
0x1C0002FA0: "TOKEN_TokenSource" ??_C@_1CE@DBJGMNED@?$AAT?$AAO?$AAK?$AAE?$AAN?$AA_?$AAT?$AAo?$AAk?$AAe?$AAn?$AAS?$AAo?$AAu?$AAr?$AAc?$AAe?$AA?$AA@
0x1C0003430: "MitigationFlags_HighEntropyASLRE" ??_C@_1EO@GBNAPNLC@?$AAM?$AAi?$AAt?$AAi?$AAg?$AAa?$AAt?$AAi?$AAo?$AAn?$AAF?$AAl?$AAa?$AAg?$AAs?$AA_?$AAH?$AAi?$AAg?$AAh?$AAE?$AAn?$AAt?$AAr?$AAo?$AAp?$AAy?$AAA?$AAS?$AAL?$AAR?$AAE@
0x1C000F8E4: OctpHandleDereferenceThreadObject
0x1C000D164: OctpHandleInitRequest
0x1C000A070: "__cdecl _imp_IoDeleteSymbolicLink" __imp_IoDeleteSymbolicLink
0x1C00154BC: CmRegUtilWstrValueGetDword
0x1C0010C4C: OctpHandleFreezeThread
0x1C00049A0: "IoValidateDeviceIoControlAccess" ??_C@_1EA@BAHCLPHE@?$AAI?$AAo?$AAV?$AAa?$AAl?$AAi?$AAd?$AAa?$AAt?$AAe?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAI?$AAo?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAA?$AAc?$AAc?$AAe?$AAs?$AAs?$AA?$AA@
0x1C0002C18: "EPROCESS_MitigationFlags" ??_C@_1DC@PKCNAPGG@?$AAE?$AAP?$AAR?$AAO?$AAC?$AAE?$AAS?$AAS?$AA_?$AAM?$AAi?$AAt?$AAi?$AAg?$AAa?$AAt?$AAi?$AAo?$AAn?$AAF?$AAl?$AAa?$AAg?$AAs?$AA?$AA@
0x1C0003170: "CrossProcessFlags_ProcessImagesH" ??_C@_1FE@FFFFONIP@?$AAC?$AAr?$AAo?$AAs?$AAs?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AAF?$AAl?$AAa?$AAg?$AAs?$AA_?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AAI?$AAm?$AAa?$AAg?$AAe?$AAs?$AAH@
0x1C0002798: "DRIVER_OBJECT" ??_C@_1BM@CMFBJFCP@?$AAD?$AAR?$AAI?$AAV?$AAE?$AAR?$AA_?$AAO?$AAB?$AAJ?$AAE?$AAC?$AAT?$AA?$AA@
0x1C0003580: "MitigationFlags_DisableDynamicCo" ??_C@_1FM@CMCKNMLM@?$AAM?$AAi?$AAt?$AAi?$AAg?$AAa?$AAt?$AAi?$AAo?$AAn?$AAF?$AAl?$AAa?$AAg?$AAs?$AA_?$AAD?$AAi?$AAs?$AAa?$AAb?$AAl?$AAe?$AAD?$AAy?$AAn?$AAa?$AAm?$AAi?$AAc?$AAC?$AAo@
0x1C000A298: "__cdecl _imp_RtlLengthSecurityDescriptor" __imp_RtlLengthSecurityDescriptor
0x1C0002A30: "EPROCESS_Peb" ??_C@_1BK@MEPFIMCI@?$AAE?$AAP?$AAR?$AAO?$AAC?$AAE?$AAS?$AAS?$AA_?$AAP?$AAe?$AAb?$AA?$AA@
0x1C00049F8: "SD" ??_C@_15NAFBOLGP@?$AAS?$AAD?$AA?$AA@
0x1C0015244: CmRegUtilUcValueSetUcString
0x1C0013FC0: SeSddlSecurityDescriptorFromSDDL
0x1C0003C80: "MitigationFlags_EnableModuleTamp" ??_C@_1GA@ICBNMNJA@?$AAM?$AAi?$AAt?$AAi?$AAg?$AAa?$AAt?$AAi?$AAo?$AAn?$AAF?$AAl?$AAa?$AAg?$AAs?$AA_?$AAE?$AAn?$AAa?$AAb?$AAl?$AAe?$AAM?$AAo?$AAd?$AAu?$AAl?$AAe?$AAT?$AAa?$AAm?$AAp@
0x1C000A2C0: "__cdecl _imp_RtlGetGroupSecurityDescriptor" __imp_RtlGetGroupSecurityDescriptor
0x1C0004B70: "\Registry\Machine\System\Current" ??_C@_1HC@DKINPPAJ@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1C0003760: "MitigationFlags_EnableFilteredWi" ??_C@_1FC@NNDJBMGK@?$AAM?$AAi?$AAt?$AAi?$AAg?$AAa?$AAt?$AAi?$AAo?$AAn?$AAF?$AAl?$AAa?$AAg?$AAs?$AA_?$AAE?$AAn?$AAa?$AAb?$AAl?$AAe?$AAF?$AAi?$AAl?$AAt?$AAe?$AAr?$AAe?$AAd?$AAW?$AAi@
0x1C0015388: CmRegUtilOpenExistingWstrKey
0x1C0003810: "MitigationFlags_DisableNonSystem" ??_C@_1EM@GAPLHECG@?$AAM?$AAi?$AAt?$AAi?$AAg?$AAa?$AAt?$AAi?$AAo?$AAn?$AAF?$AAl?$AAa?$AAg?$AAs?$AA_?$AAD?$AAi?$AAs?$AAa?$AAb?$AAl?$AAe?$AAN?$AAo?$AAn?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm@
0x1C0003390: "MitigationFlags_DisallowStripped" ??_C@_1EO@NOMHJONL@?$AAM?$AAi?$AAt?$AAi?$AAg?$AAa?$AAt?$AAi?$AAo?$AAn?$AAF?$AAl?$AAa?$AAg?$AAs?$AA_?$AAD?$AAi?$AAs?$AAa?$AAl?$AAl?$AAo?$AAw?$AAS?$AAt?$AAr?$AAi?$AAp?$AAp?$AAe?$AAd@
0x1C0014B4C: PiRegStateReadStackCreationSettingsFromKey
0x1C0004038: "OctpHandleUnmapVirtualAddress" ??_C@_0BO@DAKFGEGC@OctpHandleUnmapVirtualAddress?$AA@
0x1C0014D1C: PiRegStateOpenClassKey
0x1C0001104: WdmlibRtlInitUnicodeStringEx
0x1C0003700: "MitigationFlags_AuditDisallowWin" ??_C@_1FO@PHAGKJNJ@?$AAM?$AAi?$AAt?$AAi?$AAg?$AAa?$AAt?$AAi?$AAo?$AAn?$AAF?$AAl?$AAa?$AAg?$AAs?$AA_?$AAA?$AAu?$AAd?$AAi?$AAt?$AAD?$AAi?$AAs?$AAa?$AAl?$AAl?$AAo?$AAw?$AAW?$AAi?$AAn@
0x1C0002BA8: "EPROCESS_SignatureLevel" ??_C@_1DA@FFGLCJOE@?$AAE?$AAP?$AAR?$AAO?$AAC?$AAE?$AAS?$AAS?$AA_?$AAS?$AAi?$AAg?$AAn?$AAa?$AAt?$AAu?$AAr?$AAe?$AAL?$AAe?$AAv?$AAe?$AAl?$AA?$AA@
0x1C0004AF0: "Security" ??_C@_1BC@FCJNIDNL@?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?$AA@
0x1C000A120: "__cdecl _imp_MmHighestUserAddress" __imp_MmHighestUserAddress
0x1C0002FF0: "TOKEN_IntegrityLevelIndex" ??_C@_1DE@BILCDDCP@?$AAT?$AAO?$AAK?$AAE?$AAN?$AA_?$AAI?$AAn?$AAt?$AAe?$AAg?$AAr?$AAi?$AAt?$AAy?$AAL?$AAe?$AAv?$AAe?$AAl?$AAI?$AAn?$AAd?$AAe?$AAx?$AA?$AA@
0x1C000A138: "__cdecl _imp_KeStackAttachProcess" __imp_KeStackAttachProcess
0x1C000A0F8: "__cdecl _imp_ZwMapViewOfSection" __imp_ZwMapViewOfSection
0x1C0003480: "MitigationFlags_StackRandomizati" ??_C@_1FG@GDAOIBNB@?$AAM?$AAi?$AAt?$AAi?$AAg?$AAa?$AAt?$AAi?$AAo?$AAn?$AAF?$AAl?$AAa?$AAg?$AAs?$AA_?$AAS?$AAt?$AAa?$AAc?$AAk?$AAR?$AAa?$AAn?$AAd?$AAo?$AAm?$AAi?$AAz?$AAa?$AAt?$AAi@
0x1C00043E0: "OctpHandleFreezeThread" ??_C@_0BH@CGHPHELI@OctpHandleFreezeThread?$AA@
0x1C00042D8: "ObReferenceObjectByHandle() fail" ??_C@_0CE@KPBPGIIP@ObReferenceObjectByHandle?$CI?$CJ?5fail@
0x1C0016150: GsDriverEntry
0x1C000A2F8: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x1C00023E0: "OctpIsCallingProcessProtected" ??_C@_0BO@MOLAAICF@OctpIsCallingProcessProtected?$AA@
0x1C00149A0: PpRegStateReadCreateClassCreationSettings
0x1C00142E0: SepSddlGetSidForString
0x1C0004B08: "DeviceType" ??_C@_1BG@KCOOGCNN@?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x1C000A0D0: "__cdecl _imp_ObReferenceObjectByHandle" __imp_ObReferenceObjectByHandle
0x1C0002480: "OctDispatchFastDeviceControl" ??_C@_0BN@KMOJPOGO@OctDispatchFastDeviceControl?$AA@
0x1C0002588: "Unrecognized mailbox operation." ??_C@_0CA@GGNAFDKL@Unrecognized?5mailbox?5operation?4?$AA@
0x1C000A1C0: "__cdecl _imp_ExRegisterExtension" __imp_ExRegisterExtension
0x1C00100D8: OctpHandleDereferenceDriverObject
0x1C0004BF0: "{%08X-%04X-%04X-%02X%02X-%02X%02" ??_C@_1GG@FCALANDO@?$AA?$HL?$AA?$CF?$AA0?$AA8?$AAX?$AA?9?$AA?$CF?$AA0?$AA4?$AAX?$AA?9?$AA?$CF?$AA0?$AA4?$AAX?$AA?9?$AA?$CF?$AA0?$AA2?$AAX?$AA?$CF?$AA0?$AA2?$AAX?$AA?9?$AA?$CF?$AA0?$AA2?$AAX?$AA?$CF?$AA0?$AA2@
0x1C0003340: "MitigationFlags_ControlFlowGuard" ??_C@_1EO@PGIAHAMA@?$AAM?$AAi?$AAt?$AAi?$AAg?$AAa?$AAt?$AAi?$AAo?$AAn?$AAF?$AAl?$AAa?$AAg?$AAs?$AA_?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAF?$AAl?$AAo?$AAw?$AAG?$AAu?$AAa?$AAr?$AAd@
0x1C0004718: "OctpHandleUnmapFile" ??_C@_0BE@JKNHPDMH@OctpHandleUnmapFile?$AA@
0x1C0004550: "Can't MmCopyMemory enough kernel" ??_C@_0CO@EHAPHFCO@Can?8t?5MmCopyMemory?5enough?5kernel@
0x1C0002B50: "EPROCESS_SequenceNumber" ??_C@_1DA@LOKIPHFO@?$AAE?$AAP?$AAR?$AAO?$AAC?$AAE?$AAS?$AAS?$AA_?$AAS?$AAe?$AAq?$AAu?$AAe?$AAn?$AAc?$AAe?$AAN?$AAu?$AAm?$AAb?$AAe?$AAr?$AA?$AA@
0x1C0002B80: "EPROCESS_CreateTime" ??_C@_1CI@GKECGBGA@?$AAE?$AAP?$AAR?$AAO?$AAC?$AAE?$AAS?$AAS?$AA_?$AAC?$AAr?$AAe?$AAa?$AAt?$AAe?$AAT?$AAi?$AAm?$AAe?$AA?$AA@
0x1C00045A0: "Can't MmCopyMemory enough PA mem" ??_C@_0CF@OBFAEBJB@Can?8t?5MmCopyMemory?5enough?5PA?5mem@
0x1C0004328: "OctpHandleGetReferencedDeviceObj" ??_C@_0CE@DCJMDGA@OctpHandleGetReferencedDeviceObj@
0x1C000A2E0: "__cdecl _imp_ZwQueryValueKey" __imp_ZwQueryValueKey
0x1C0002AD0: "EPROCESS_ImageFileName" ??_C@_1CO@LBICPNKH@?$AAE?$AAP?$AAR?$AAO?$AAC?$AAE?$AAS?$AAS?$AA_?$AAI?$AAm?$AAa?$AAg?$AAe?$AAF?$AAi?$AAl?$AAe?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x1C0003F20: "Can't lock the page. Requested V" ??_C@_0DH@MCKDKLIG@Can?8t?5lock?5the?5page?4?5Requested?5V@
0x1C000D750: "__cdecl TlgEnableCallback" _TlgEnableCallback
0x1C000BEA0: OctDispatchClose
0x1C0004A00: "GA" ??_C@_15HPMIFLNA@?$AAG?$AAA?$AA?$AA@
0x1C000A198: MmUserProbeAddress
0x1C00032C0: "MitigationFlags_ControlFlowGuard" ??_C@_1HC@FIAAJINI@?$AAM?$AAi?$AAt?$AAi?$AAg?$AAa?$AAt?$AAi?$AAo?$AAn?$AAF?$AAl?$AAa?$AAg?$AAs?$AA_?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAF?$AAl?$AAo?$AAw?$AAG?$AAu?$AAa?$AAr?$AAd@
0x1C00041F8: "OctpHandleGetNextReferencedThrea" ??_C@_0CI@HJANCAIF@OctpHandleGetNextReferencedThrea@
0x1C000A038: "__cdecl _imp_MmUnlockPages" __imp_MmUnlockPages
0x1C000A010: "__cdecl _imp_ExInitializePagedLookasideList" __imp_ExInitializePagedLookasideList
0x1C00043C0: "Invalid StringName buffer size." ??_C@_0CA@CGEGNCOF@Invalid?5StringName?5buffer?5size?4?$AA@
0x1C0004080: "OCTAGON_MBC_UNMAP_VIRTUALADDRESS" ??_C@_0EH@KJKABLJC@OCTAGON_MBC_UNMAP_VIRTUALADDRESS@
0x1C0002FC8: "TOKEN_Privileges" ??_C@_1CC@JNIDEHMO@?$AAT?$AAO?$AAK?$AAE?$AAN?$AA_?$AAP?$AAr?$AAi?$AAv?$AAi?$AAl?$AAe?$AAg?$AAe?$AAs?$AA?$AA@
0x1C0001160: "__cdecl _security_check_cookie" __security_check_cookie
0x1C0002130: "\Device\MSSGRMAGENTSYS" ??_C@_1CO@OOCFIEBD@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAM?$AAS?$AAS?$AAG?$AAR?$AAM?$AAA?$AAG?$AAE?$AAN?$AAT?$AAS?$AAY?$AAS?$AA?$AA@
0x1C0002658: "OctpHandleInitRequest" ??_C@_0BG@JMDGCGBF@OctpHandleInitRequest?$AA@
0x1C00037C0: "MitigationFlags_AuditFilteredWin" ??_C@_1FA@MBOFIHK@?$AAM?$AAi?$AAt?$AAi?$AAg?$AAa?$AAt?$AAi?$AAo?$AAn?$AAF?$AAl?$AAa?$AAg?$AAs?$AA_?$AAA?$AAu?$AAd?$AAi?$AAt?$AAF?$AAi?$AAl?$AAt?$AAe?$AAr?$AAe?$AAd?$AAW?$AAi?$AAn@
0x1C0002240: "D:P(A;;GRGWGX;;;S-1-5-80-3706850" ??_C@_1JO@NHEAMPAG@?$AAD?$AA?3?$AAP?$AA?$CI?$AAA?$AA?$DL?$AA?$DL?$AAG?$AAR?$AAG?$AAW?$AAG?$AAX?$AA?$DL?$AA?$DL?$AA?$DL?$AAS?$AA?9?$AA1?$AA?9?$AA5?$AA?9?$AA8?$AA0?$AA?9?$AA3?$AA7?$AA0?$AA6?$AA8?$AA5?$AA0@
0x1C000A308: "__cdecl _IMPORT_DESCRIPTOR_ntoskrnl" __IMPORT_DESCRIPTOR_ntoskrnl
0x1C0002550: "TLV length does not match the ac" ??_C@_0DC@IPHABADC@TLV?5length?5does?5not?5match?5the?5ac@
0x1C000687C: "__cdecl TraceLoggingMetadataEnd" _TraceLoggingMetadataEnd
0x1C0002738: "PEB" ??_C@_17KBHDNIDJ@?$AAP?$AAE?$AAB?$AA?$AA@
0x1C0003078: "SEP_TOKEN_PRIVILEGES_Present" ??_C@_1DK@GLLCIBNN@?$AAS?$AAE?$AAP?$AA_?$AAT?$AAO?$AAK?$AAE?$AAN?$AA_?$AAP?$AAR?$AAI?$AAV?$AAI?$AAL?$AAE?$AAG?$AAE?$AAS?$AA_?$AAP?$AAr?$AAe?$AAs?$AAe?$AAn?$AAt?$AA?$AA@
0x1C000E5C8: OctpHandleUnmapVirtualAddress
0x1C0004938: "Failed to get thread's context." ??_C@_0CA@EOJJMJDI@Failed?5to?5get?5thread?8s?5context?4?$AA@
0x1C00135B0: OctpHandleGetThreadContext
0x1C000A1F8: "__cdecl _imp_KeInsertQueueApc" __imp_KeInsertQueueApc
0x1C0004A20: "SeConvertStringSecurityDescripto" ??_C@_1GM@JINLDKKK@?$AAS?$AAe?$AAC?$AAo?$AAn?$AAv?$AAe?$AAr?$AAt?$AAS?$AAt?$AAr?$AAi?$AAn?$AAg?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AAD?$AAe?$AAs?$AAc?$AAr?$AAi?$AAp?$AAt?$AAo@
0x1C0003E40: "Input/Output buffer size is insu" ??_C@_0CK@EFPBECFJ@Input?1Output?5buffer?5size?5is?5insu@
0x1C0004600: "Can't MmCopyMemory enough IO mem" ??_C@_0CF@CKCCILGM@Can?8t?5MmCopyMemory?5enough?5IO?5mem@
0x1C0004290: "OctpHandleGetReferencedDriverObj" ??_C@_0CE@JFGGGMMD@OctpHandleGetReferencedDriverObj@
0x1C00042B8: "Invalid driver object name." ??_C@_0BM@BJLMALLF@Invalid?5driver?5object?5name?4?$AA@
0x1C0004128: "OctpHandleDereferenceProcessObje" ??_C@_0CD@CAMKGCE@OctpHandleDereferenceProcessObje@
0x1C0004580: "Can't MmCopyMemory PA memory." ??_C@_0BO@PCAEDNNA@Can?8t?5MmCopyMemory?5PA?5memory?4?$AA@
0x1C00102D8: OctpHandleGetReferencedDeviceObject
0x1C00030B8: "SID_AND_ATTRIBUTES_Sid" ??_C@_1CO@DBAFLJDJ@?$AAS?$AAI?$AAD?$AA_?$AAA?$AAN?$AAD?$AA_?$AAA?$AAT?$AAT?$AAR?$AAI?$AAB?$AAU?$AAT?$AAE?$AAS?$AA_?$AAS?$AAi?$AAd?$AA?$AA@
0x1C0002EC0: "DRIVER_OBJECT_FastIoDispatch" ??_C@_1DK@MIPOFGGO@?$AAD?$AAR?$AAI?$AAV?$AAE?$AAR?$AA_?$AAO?$AAB?$AAJ?$AAE?$AAC?$AAT?$AA_?$AAF?$AAa?$AAs?$AAt?$AAI?$AAo?$AAD?$AAi?$AAs?$AAp?$AAa?$AAt?$AAc?$AAh?$AA?$AA@
0x1C0013B70: OctpApcNormalRoutine
0x1C000A0A8: "__cdecl _imp_ProbeForWrite" __imp_ProbeForWrite
0x1C0011084: OctpHandleThawThread
0x1C00044F8: "Can't MmCopyMemory enough user-m" ??_C@_0CM@KGFOJNBB@Can?8t?5MmCopyMemory?5enough?5user?9m@
0x1C000B008: OctpInitialize
0x1C00025B8: "Invalid argument." ??_C@_0BC@PPKPNKFJ@Invalid?5argument?4?$AA@
0x1C000A130: "__cdecl _imp_EtwUnregister" __imp_EtwUnregister
0x1C0017000: "__cdecl _guard_fids_table" __guard_fids_table
0x1C000A248: "__cdecl _imp_ZwSetSecurityObject" __imp_ZwSetSecurityObject
0x1C0002020: "__cdecl load_config_used" _load_config_used
0x1C0008804: ExDefaultNonPagedPoolType
0x1C00033E0: "MitigationFlags_ForceRelocateIma" ??_C@_1EI@EDCMGJJH@?$AAM?$AAi?$AAt?$AAi?$AAg?$AAa?$AAt?$AAi?$AAo?$AAn?$AAF?$AAl?$AAa?$AAg?$AAs?$AA_?$AAF?$AAo?$AAr?$AAc?$AAe?$AAR?$AAe?$AAl?$AAo?$AAc?$AAa?$AAt?$AAe?$AAI?$AAm?$AAa@
0x1C0004A90: "Properties" ??_C@_1BG@COALCEMK@?$AAP?$AAr?$AAo?$AAp?$AAe?$AAr?$AAt?$AAi?$AAe?$AAs?$AA?$AA@
0x1C0002818: "FAST_IO_DISPATCH" ??_C@_1CC@FADFNLJG@?$AAF?$AAA?$AAS?$AAT?$AA_?$AAI?$AAO?$AA_?$AAD?$AAI?$AAS?$AAP?$AAA?$AAT?$AAC?$AAH?$AA?$AA@
0x1C0011230: OctpHandleCopyMemory
0x1C00089F8: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUhvxfirgbUlxgztlmUztvmgUhlfixvUpvimvoUztvmgUlyquivUznwGEUkivxlnkOlyq@SgrmAgent" __@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUhvxfirgbUlxgztlmUztvmgUhlfixvUpvimvoUztvmgUlyquivUznwGEUkivxlnkOlyq@SgrmAgent
0x1C000A060: "__cdecl _imp_ZwClose" __imp_ZwClose
0x1C000A190: "__cdecl _imp_ExAcquireRundownProtection" __imp_ExAcquireRundownProtection
0x1C0004150: "Requested process can't be NULL." ??_C@_0CB@FOBIFDNA@Requested?5process?5can?8t?5be?5NULL?4@
0x1C000A1D0: "__cdecl _imp_PsGetProcessId" __imp_PsGetProcessId
0x1C000A050: "__cdecl _imp_ZwUnmapViewOfSection" __imp_ZwUnmapViewOfSection
0x1C0003860: "MitigationFlags_AuditNonSystemFo" ??_C@_1FE@IONHPNLL@?$AAM?$AAi?$AAt?$AAi?$AAg?$AAa?$AAt?$AAi?$AAo?$AAn?$AAF?$AAl?$AAa?$AAg?$AAs?$AA_?$AAA?$AAu?$AAd?$AAi?$AAt?$AAN?$AAo?$AAn?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAF?$AAo@
0x1C0002440: "Failed to allocate memory for in" ??_C@_0DL@NELAONA@Failed?5to?5allocate?5memory?5for?5in@
0x1C001479C: SepSddlAddAceToAcl
0x1C00040F0: "Failed to allocate memory for tr" ??_C@_0DF@JONIOBM@Failed?5to?5allocate?5memory?5for?5tr@
0x1C00030E8: "SID_SubAuthorityCount" ??_C@_1CM@KOILKJL@?$AAS?$AAI?$AAD?$AA_?$AAS?$AAu?$AAb?$AAA?$AAu?$AAt?$AAh?$AAo?$AAr?$AAi?$AAt?$AAy?$AAC?$AAo?$AAu?$AAn?$AAt?$AA?$AA@
0x1C0003CE0: "MitigationFlags_EnableModuleTamp" ??_C@_1HC@MJGEAFMI@?$AAM?$AAi?$AAt?$AAi?$AAg?$AAa?$AAt?$AAi?$AAo?$AAn?$AAF?$AAl?$AAa?$AAg?$AAs?$AA_?$AAE?$AAn?$AAa?$AAb?$AAl?$AAe?$AAM?$AAo?$AAd?$AAu?$AAl?$AAe?$AAT?$AAa?$AAm?$AAp@
0x1C000A208: "__cdecl _imp_MmMapIoSpaceEx" __imp_MmMapIoSpaceEx
0x1C0015404: CmRegUtilCreateWstrKey
0x1C000A0E0: "__cdecl _imp_KeInitializeEvent" __imp_KeInitializeEvent
0x1C000A1B8: "__cdecl _imp_ObOpenObjectByPointer" __imp_ObOpenObjectByPointer
0x1C0008040: OctSymData
0x1C000A2B0: "__cdecl _imp_RtlGetSaclSecurityDescriptor" __imp_RtlGetSaclSecurityDescriptor
0x1C0004AB8: "NoDisplayClass" ??_C@_1BO@DAOBINHA@?$AAN?$AAo?$AAD?$AAi?$AAs?$AAp?$AAl?$AAa?$AAy?$AAC?$AAl?$AAa?$AAs?$AAs?$AA?$AA@
0x1C0003530: "MitigationFlags_DisableDynamicCo" ??_C@_1EG@LOCMEJAP@?$AAM?$AAi?$AAt?$AAi?$AAg?$AAa?$AAt?$AAi?$AAo?$AAn?$AAF?$AAl?$AAa?$AAg?$AAs?$AA_?$AAD?$AAi?$AAs?$AAa?$AAb?$AAl?$AAe?$AAD?$AAy?$AAn?$AAa?$AAm?$AAi?$AAc?$AAC?$AAo@
0x1C0002160: "\??\MSSGRMAGENTSYS" ??_C@_1CG@BKIFJONP@?$AA?2?$AA?$DP?$AA?$DP?$AA?2?$AAM?$AAS?$AAS?$AAG?$AAR?$AAM?$AAA?$AAG?$AAE?$AAN?$AAT?$AAS?$AAY?$AAS?$AA?$AA@
0x1C00034E0: "MitigationFlags_ExtensionPointDi" ??_C@_1EM@PCOHJNP@?$AAM?$AAi?$AAt?$AAi?$AAg?$AAa?$AAt?$AAi?$AAo?$AAn?$AAF?$AAl?$AAa?$AAg?$AAs?$AA_?$AAE?$AAx?$AAt?$AAe?$AAn?$AAs?$AAi?$AAo?$AAn?$AAP?$AAo?$AAi?$AAn?$AAt?$AAD?$AAi@
0x1C00021C8: "OctpCreateDeviceObject failed." ??_C@_0BP@BEFLLECC@OctpCreateDeviceObject?5failed?4?$AA@
0x1C000A2C8: "__cdecl _imp_RtlGetDaclSecurityDescriptor" __imp_RtlGetDaclSecurityDescriptor
0x1C0014EAC: PpRegStateUpdateStackCreationSettings
0x1C000A258: "__cdecl _imp_IoIsWdmVersionAvailable" __imp_IoIsWdmVersionAvailable
0x1C0004B20: "DeviceCharacteristics" ??_C@_1CM@DIJFBEC@?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAC?$AAh?$AAa?$AAr?$AAa?$AAc?$AAt?$AAe?$AAr?$AAi?$AAs?$AAt?$AAi?$AAc?$AAs?$AA?$AA@
0x1C00025D0: "Failed to retrieve module list s" ??_C@_0CF@ODEGAEOI@Failed?5to?5retrieve?5module?5list?5s@
0x1C000A148: "__cdecl _imp_ExReleasePushLockEx" __imp_ExReleasePushLockEx
0x1C00087D0: PiRegStateSysAllInherittedSecurityDescriptor
0x1C0008810: WdmlibInitialized
0x1C000A1D8: "__cdecl _imp_ObOpenObjectByName" __imp_ObOpenObjectByName
0x1C00048E0: "Failed to get information for th" ??_C@_0DG@BPGOCFEI@Failed?5to?5get?5information?5for?5th@
0x1C00011B0: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x1C0002310: "IoRegisterShutdownNotification f" ??_C@_0CH@PGALDDGH@IoRegisterShutdownNotification?5f@
0x1C0013C58: WdmlibIoCreateDeviceSecure
0x1C000A0C8: "__cdecl _imp_MmMapLockedPagesSpecifyCache" __imp_MmMapLockedPagesSpecifyCache
0x1C0004730: "OctpHandleGetMemoryRegionInfo" ??_C@_0BO@GFHNAKJK@OctpHandleGetMemoryRegionInfo?$AA@
0x1C0002E18: "DRIVER_OBJECT_DriverUnload" ??_C@_1DG@LHKPBFOK@?$AAD?$AAR?$AAI?$AAV?$AAE?$AAR?$AA_?$AAO?$AAB?$AAJ?$AAE?$AAC?$AAT?$AA_?$AAD?$AAr?$AAi?$AAv?$AAe?$AAr?$AAU?$AAn?$AAl?$AAo?$AAa?$AAd?$AA?$AA@
0x1C0003AD0: "MitigationFlags_AuditBlockNonMic" ??_C@_1FO@OODLGMHA@?$AAM?$AAi?$AAt?$AAi?$AAg?$AAa?$AAt?$AAi?$AAo?$AAn?$AAF?$AAl?$AAa?$AAg?$AAs?$AA_?$AAA?$AAu?$AAd?$AAi?$AAt?$AAB?$AAl?$AAo?$AAc?$AAk?$AAN?$AAo?$AAn?$AAM?$AAi?$AAc@
0x1C0003EC0: "Can't lock the page, no target p" ??_C@_0FJ@LOIFBHFG@Can?8t?5lock?5the?5page?0?5no?5target?5p@
0x1C000A178: "__cdecl _imp_PsGetCurrentProcess" __imp_PsGetCurrentProcess
0x1C00023A8: "A handle has previously been ope" ??_C@_0DE@GLDCGMEA@A?5handle?5has?5previously?5been?5ope@
0x1C0004AA8: "Class" ??_C@_1M@OAHBGIFG@?$AAC?$AAl?$AAa?$AAs?$AAs?$AA?$AA@
0x1C00047E0: "TargetProcess is not referenced " ??_C@_0ED@DDHCMDHN@TargetProcess?5is?5not?5referenced?5@
0x1C000A1A8: "__cdecl _imp_ZwQuerySystemInformation" __imp_ZwQuerySystemInformation
0x1C0002740: "ULONG" ??_C@_1M@GHFICIHL@?$AAU?$AAL?$AAO?$AAN?$AAG?$AA?$AA@
0x1C00044D0: "Can't MmCopyMemory user-mode mem" ??_C@_0CF@LHPNLPBM@Can?8t?5MmCopyMemory?5user?9mode?5mem@
0x1C0003FC8: "Failed to map the requested VA i" ??_C@_0DL@EGAHLCJE@Failed?5to?5map?5the?5requested?5VA?5i@
0x1C00108E4: OctpHandleGetStructureOffsetSize
0x1C0002390: "OctDispatchCreate" ??_C@_0BC@BMGNHGAJ@OctDispatchCreate?$AA@
0x1C0002630: "SGRM device was already initiali" ??_C@_0CF@NGKKKOPL@SGRM?5device?5was?5already?5initiali@
0x1C0004790: "Can't gather memory range info, " ??_C@_0EF@EOEOJMCF@Can?8t?5gather?5memory?5range?5info?0?5@
0x1C0008670: "__cdecl _security_cookie" __security_cookie
0x1C0004178: "OctpHandleGetNextReferencedProce" ??_C@_0CJ@NEENMBPC@OctpHandleGetNextReferencedProce@
0x1C0003D60: "MitigationFlags_RestrictIndirect" ??_C@_1GC@EDEOMLEF@?$AAM?$AAi?$AAt?$AAi?$AAg?$AAa?$AAt?$AAi?$AAo?$AAn?$AAF?$AAl?$AAa?$AAg?$AAs?$AA_?$AAR?$AAe?$AAs?$AAt?$AAr?$AAi?$AAc?$AAt?$AAI?$AAn?$AAd?$AAi?$AAr?$AAe?$AAc?$AAt@
0x1C00022F8: "OctpCreateDeviceObject" ??_C@_0BH@OEJGACFC@OctpCreateDeviceObject?$AA@
0x1C0004410: "OctpHandleCopyMemory" ??_C@_0BF@BGOHKHIA@OctpHandleCopyMemory?$AA@
0x1C00041D8: "Failed to reference process." ??_C@_0BN@MIOCIOPH@Failed?5to?5reference?5process?4?$AA@
0x1C0004B50: "Exclusive" ??_C@_1BE@DJHAJDEM@?$AAE?$AAx?$AAc?$AAl?$AAu?$AAs?$AAi?$AAv?$AAe?$AA?$AA@
0x1C000D8B8: OctpHandleMapVirtualAddress
0x1C00010B0: "__cdecl TlgDefineProvider_annotation__Tlgg_hTraceLoggingProviderProv" _TlgDefineProvider_annotation__Tlgg_hTraceLoggingProviderProv
0x1C0002718: "Cannot gather NTOS information." ??_C@_0CA@PFFPOKBF@Cannot?5gather?5NTOS?5information?4?$AA@
0x1C0015100: CmRegUtilUcValueGetFullBuffer
0x1C0012B24: OctpHandleGetMemoryRegionInfo
0x1C0002CA0: "PEB_ImageBaseAddress" ??_C@_1CK@MPCKAJJN@?$AAP?$AAE?$AAB?$AA_?$AAI?$AAm?$AAa?$AAg?$AAe?$AAB?$AAa?$AAs?$AAe?$AAA?$AAd?$AAd?$AAr?$AAe?$AAs?$AAs?$AA?$AA@
0x1C000A1E0: "__cdecl _imp_IoDriverObjectType" __imp_IoDriverObjectType
0x1C000A040: "__cdecl _imp_IoFreeMdl" __imp_IoFreeMdl
0x1C00026D8: "Failed to get a handle to the br" ??_C@_0DN@KMECNNHC@Failed?5to?5get?5a?5handle?5to?5the?5br@
0x1C000A0E8: "__cdecl _imp_MmUnmapIoSpace" __imp_MmUnmapIoSpace
0x1C0004AD8: "NoUseClass" ??_C@_1BG@OPOOGLJC@?$AAN?$AAo?$AAU?$AAs?$AAe?$AAC?$AAl?$AAa?$AAs?$AAs?$AA?$AA@
0x1C00028B0: "PS_PROTECTED_SIGNER_PsProtectedS" ??_C@_1FK@PANPCFJF@?$AAP?$AAS?$AA_?$AAP?$AAR?$AAO?$AAT?$AAE?$AAC?$AAT?$AAE?$AAD?$AA_?$AAS?$AAI?$AAG?$AAN?$AAE?$AAR?$AA_?$AAP?$AAs?$AAP?$AAr?$AAo?$AAt?$AAe?$AAc?$AAt?$AAe?$AAd?$AAS@
0x1C00038C0: "MitigationFlags_PreferSystem32Im" ??_C@_1EK@FKBJHFFG@?$AAM?$AAi?$AAt?$AAi?$AAg?$AAa?$AAt?$AAi?$AAo?$AAn?$AAF?$AAl?$AAa?$AAg?$AAs?$AA_?$AAP?$AAr?$AAe?$AAf?$AAe?$AAr?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AAI?$AAm@
0x1C0016184: "__cdecl _security_init_cookie" __security_init_cookie
0x1C000EBF4: OctpHandleDereferenceProcessObject
0x1C000A118: "__cdecl _imp_EtwRegister" __imp_EtwRegister
0x1C00027B8: "TOKEN" ??_C@_1M@IEEPGOKE@?$AAT?$AAO?$AAK?$AAE?$AAN?$AA?$AA@
0x1C000A068: "__cdecl _imp_KeSetEvent" __imp_KeSetEvent
0x1C0002D38: "DEVICE_OBJECT_DriverObject" ??_C@_1DG@LMKOHNGH@?$AAD?$AAE?$AAV?$AAI?$AAC?$AAE?$AA_?$AAO?$AAB?$AAJ?$AAE?$AAC?$AAT?$AA_?$AAD?$AAr?$AAi?$AAv?$AAe?$AAr?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AA?$AA@
0x1C0015018: SeUtilSecurityInfoFromSecurityDescriptor
0x1C000A240: IoDeviceObjectType
0x1C000A140: "__cdecl _imp_ExAcquirePushLockExclusiveEx" __imp_ExAcquirePushLockExclusiveEx
0x1C000A1A0: "__cdecl _imp_ExReleaseRundownProtection" __imp_ExReleaseRundownProtection
0x1C000BB00: OctDriverUnload
0x1C000A170: "__cdecl _imp_PsGetProcessProtection" __imp_PsGetProcessProtection
0x1C0004A10: "GW" ??_C@_15KLKFDJD@?$AAG?$AAW?$AA?$AA@
0x1C0008800: ExDefaultMdlProtection
0x1C000A260: "__cdecl _imp_RtlLengthSid" __imp_RtlLengthSid
0x1C0001190: "__cdecl _report_gsfailure" __report_gsfailure
0x1C0008820: OctAgentData
0x1C00046F8: "ZwMapViewOfSection() failed!" ??_C@_0BN@BPFFLFBE@ZwMapViewOfSection?$CI?$CJ?5failed?$CB?$AA@
0x1C000C760: OctpMailboxDispatcher
0x1C00021E8: "OctpRegisterKernelExtension fail" ??_C@_0CE@NACDHIG@OctpRegisterKernelExtension?5fail@
0x1C000A2D8: "__cdecl _imp_ZwCreateKey" __imp_ZwCreateKey
0x1C0002910: "PS_PROTECTED_SIGNER_PsProtectedS" ??_C@_1FI@EHBNHJHL@?$AAP?$AAS?$AA_?$AAP?$AAR?$AAO?$AAT?$AAE?$AAC?$AAT?$AAE?$AAD?$AA_?$AAS?$AAI?$AAG?$AAN?$AAE?$AAR?$AA_?$AAP?$AAs?$AAP?$AAr?$AAo?$AAt?$AAe?$AAc?$AAt?$AAe?$AAd?$AAS@
0x1C0002538: "OctpMailboxDispatcher" ??_C@_0BG@HIEMJCGH@OctpMailboxDispatcher?$AA@
0x1C0002610: "Failed to retrieve module list." ??_C@_0CA@IPBLKPOC@Failed?5to?5retrieve?5module?5list?4?$AA@
0x1C00041A8: "Out of memory, ExAllocatePoolWit" ??_C@_0CO@EJJDNEBL@Out?5of?5memory?0?5ExAllocatePoolWit@
0x1C000BEE0: OctDispatchFastDeviceControl
0x1C000A2F0: ntoskrnl_NULL_THUNK_DATA
0x1C000A020: "__cdecl _imp_ExFreePoolWithTag" __imp_ExFreePoolWithTag
0x1C000A028: "__cdecl _imp_KeEnterCriticalRegion" __imp_KeEnterCriticalRegion
0x1C0002C50: "EPROCESS_Flags2" ??_C@_1CA@FNKDBCGO@?$AAE?$AAP?$AAR?$AAO?$AAC?$AAE?$AAS?$AAS?$AA_?$AAF?$AAl?$AAa?$AAg?$AAs?$AA2?$AA?$AA@
0x1C000A210: "__cdecl _imp_ZwOpenFile" __imp_ZwOpenFile
0x1C0003140: "TOKEN_SOURCE_SourceName" ??_C@_1DA@LNBDHOHC@?$AAT?$AAO?$AAK?$AAE?$AAN?$AA_?$AAS?$AAO?$AAU?$AAR?$AAC?$AAE?$AA_?$AAS?$AAo?$AAu?$AAr?$AAc?$AAe?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x1C0004660: "ZwQueryInformationFile() failed!" ??_C@_0CB@NHOFCJIN@ZwQueryInformationFile?$CI?$CJ?5failed?$CB@
0x1C0004248: "OctpHandleDereferenceThreadObjec" ??_C@_0CC@OOMJBOCF@OctpHandleDereferenceThreadObjec@
0x1C00027F0: "SID" ??_C@_17HNFFEAHN@?$AAS?$AAI?$AAD?$AA?$AA@
0x1C0003218: "ProcessFlags_VaSpaceDeleted" ??_C@_1DI@DNGEBNDJ@?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AAF?$AAl?$AAa?$AAg?$AAs?$AA_?$AAV?$AAa?$AAS?$AAp?$AAa?$AAc?$AAe?$AAD?$AAe?$AAl?$AAe?$AAt?$AAe?$AAd?$AA?$AA@
0x1C000A250: "__cdecl _imp_RtlSetDaclSecurityDescriptor" __imp_RtlSetDaclSecurityDescriptor
0x1C0012130: OctpHandleMapFile
0x1C0016008: DriverEntry
0x1C0003050: "TOKEN_TokenFlags" ??_C@_1CC@LNPHICLG@?$AAT?$AAO?$AAK?$AAE?$AAN?$AA_?$AAT?$AAo?$AAk?$AAe?$AAn?$AAF?$AAl?$AAa?$AAg?$AAs?$AA?$AA@
0x1C0004428: "Output buffer size is insufficie" ??_C@_0CE@EFMHJFII@Output?5buffer?5size?5is?5insufficie@
0x1C000A160: "__cdecl _imp_ExWaitForRundownProtectionRelease" __imp_ExWaitForRundownProtectionRelease
0x1C0003DD0: "MitigationFlags_IsolateSecurityD" ??_C@_1EM@GHMKFFNI@?$AAM?$AAi?$AAt?$AAi?$AAg?$AAa?$AAt?$AAi?$AAo?$AAn?$AAF?$AAl?$AAa?$AAg?$AAs?$AA_?$AAI?$AAs?$AAo?$AAl?$AAa?$AAt?$AAe?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AAD@
0x1C0002A10: "EPROCESS_Pcb" ??_C@_1BK@BCKMGPDF@?$AAE?$AAP?$AAR?$AAO?$AAC?$AAE?$AAS?$AAS?$AA_?$AAP?$AAc?$AAb?$AA?$AA@
0x1C000E8AC: OctpHandleGetReferencedProcessObject
0x1C00027C8: "SID_AND_ATTRIBUTES" ??_C@_1CG@HNHPLBNC@?$AAS?$AAI?$AAD?$AA_?$AAA?$AAN?$AAD?$AA_?$AAA?$AAT?$AAT?$AAR?$AAI?$AAB?$AAU?$AAT?$AAE?$AAS?$AA?$AA@
0x1C000A2E8: "__cdecl _imp_ZwOpenKey" __imp_ZwOpenKey
0x1C0002A88: "EPROCESS_Token" ??_C@_1BO@PAMANICA@?$AAE?$AAP?$AAR?$AAO?$AAC?$AAE?$AAS?$AAS?$AA_?$AAT?$AAo?$AAk?$AAe?$AAn?$AA?$AA@
0x1C000A218: "__cdecl _imp_ZwCreateSection" __imp_ZwCreateSection
0x1C0002C70: "EPROCESS_ActiveThreads" ??_C@_1CO@ODBLDEE@?$AAE?$AAP?$AAR?$AAO?$AAC?$AAE?$AAS?$AAS?$AA_?$AAA?$AAc?$AAt?$AAi?$AAv?$AAe?$AAT?$AAh?$AAr?$AAe?$AAa?$AAd?$AAs?$AA?$AA@
0x1C0004648: "OctpHandleMapFile" ??_C@_0BC@PIAHHIMN@OctpHandleMapFile?$AA@
0x1C0002B00: "EPROCESS_InheritedFromUniqueProc" ??_C@_1EM@KKOBHFNP@?$AAE?$AAP?$AAR?$AAO?$AAC?$AAE?$AAS?$AAS?$AA_?$AAI?$AAn?$AAh?$AAe?$AAr?$AAi?$AAt?$AAe?$AAd?$AAF?$AAr?$AAo?$AAm?$AAU?$AAn?$AAi?$AAq?$AAu?$AAe?$AAP?$AAr?$AAo?$AAc@
0x1C0001640: memset
0x1C000A31C: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x1C000D7D0: TraceErrorCommon
0x1C0002358: "A non-permitted process is tryin" ??_C@_0DH@LFHHOFOG@A?5non?9permitted?5process?5is?5tryin@

[JEB Decompiler by PNF Software]