Generated by JEB on 2019/08/01

PE: C:\Windows\System32\fvenotify.exe Base=0x140000000 SHA-256=F0CDDBA84AC1DA81B4F340B7B14193FF85E80B6444FEBE5F7686DE6061ED7C67
PDB: fvenotify.pdb GUID={4EBCBDD3-2E6A-037B-319942B18FDA36B9} Age=1

402 located named symbols:
0x1400130A0: "NtQuerySystemInformation" ??_C@_0BJ@NDLOPGCH@NtQuerySystemInformation?$AA@
0x14000F1BC: "__cdecl _raise_securityfailure" __raise_securityfailure
0x14000EFE0: "__cdecl FindPESection" _FindPESection
0x140010288: "__cdecl _imp_AllocateAndInitializeSid" __imp_AllocateAndInitializeSid
0x14000E584: "long __cdecl StringCchCatW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64)" ?StringCchCatW@@YAJPEAG_KPEBG@Z
0x140010600: "__cdecl _imp_CoInitializeEx" __imp_CoInitializeEx
0x140010528: "__cdecl _imp_GetCursorPos" __imp_GetCursorPos
0x140014070: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-com-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-com-l1-1-0
0x140010950: "Software\Policies\Microsoft\FVE" ??_C@_1EA@NGGADBLF@?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAP?$AAo?$AAl?$AAi?$AAc?$AAi?$AAe?$AAs?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAF?$AAV?$AAE?$AA?$AA@
0x14000E770: "struct HBITMAP__ * __ptr64 __cdecl WARBIRD_DELAY_LOAD::CreateDIBSection(struct HDC__ * __ptr64,struct tagBITMAPINFO const * __ptr64,unsigned int,void * __ptr64 * __ptr64,void * __ptr64,unsigned long)" ?CreateDIBSection@WARBIRD_DELAY_LOAD@@YAPEAUHBITMAP__@@PEAUHDC__@@PEBUtagBITMAPINFO@@IPEAPEAXPEAXK@Z
0x1400106C0: "__cdecl _imp___getmainargs" __imp___getmainargs
0x140015180: "__cdecl _security_cookie_complement" __security_cookie_complement
0x140001340: "public: class BuiVolume & __ptr64 __cdecl BuiVolume::operator=(class BuiVolume const & __ptr64) __ptr64" ??4BuiVolume@@QEAAAEAV0@AEBV0@@Z
0x140010448: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x1400108D8: "imageres.dll" ??_C@_1BK@NLBLMKAC@?$AAi?$AAm?$AAa?$AAg?$AAe?$AAr?$AAe?$AAs?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x1400103B8: "__cdecl _imp_RegisterApplicationRestart" __imp_RegisterApplicationRestart
0x140010AB8: "SeShutdownPrivilege" ??_C@_1CI@NKKEIBLI@?$AAS?$AAe?$AAS?$AAh?$AAu?$AAt?$AAd?$AAo?$AAw?$AAn?$AAP?$AAr?$AAi?$AAv?$AAi?$AAl?$AAe?$AAg?$AAe?$AA?$AA@
0x14000DF0C: WinMain
0x14000F4A9: "__cdecl _CxxFrameHandler3" __CxxFrameHandler3
0x140010580: "__cdecl _imp_GetWindowLongPtrW" __imp_GetWindowLongPtrW
0x14000F580: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x1400104F8: SHELL32_NULL_THUNK_DATA
0x14000E770: "struct HDC__ * __ptr64 __cdecl WARBIRD_DELAY_LOAD::GetDC(struct HWND__ * __ptr64)" ?GetDC@WARBIRD_DELAY_LOAD@@YAPEAUHDC__@@PEAUHWND__@@@Z
0x140010450: "__cdecl _imp_CreateFileW" __imp_CreateFileW
0x140010890: GUID_IO_VOLUME_DISMOUNT
0x1400010A0: "public: bool __cdecl VolumeFveStatus::HasPassphraseProtector(void)const __ptr64" ?HasPassphraseProtector@VolumeFveStatus@@QEBA_NXZ
0x1400158B8: "struct HICON__ * __ptr64 __ptr64 g_hWarningIcon" ?g_hWarningIcon@@3PEAUHICON__@@EA
0x14000E770: "int __cdecl WARBIRD_DELAY_LOAD::EnumDisplaySettingsW(unsigned short const * __ptr64,unsigned long,struct _devicemodeW * __ptr64)" ?EnumDisplaySettingsW@WARBIRD_DELAY_LOAD@@YAHPEBGKPEAU_devicemodeW@@@Z
0x140001364: "long __cdecl _LoadCombinedIcon(struct HINSTANCE__ * __ptr64,unsigned short const * __ptr64,struct HINSTANCE__ * __ptr64,unsigned short const * __ptr64,int,int,struct HICON__ * __ptr64 * __ptr64)" ?_LoadCombinedIcon@@YAJPEAUHINSTANCE__@@PEBG01HHPEAPEAUHICON__@@@Z
0x1400104D8: "__cdecl _imp_CommandLineToArgvW" __imp_CommandLineToArgvW
0x140015318: "__cdecl commode" _commode
0x140015950: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxunrmrlUhvxfirgbUorxvmhrmtUhkxzooUoryUyfrowPxorvmgPfnUlyquivUznwGEUhgwzucOlyq@spcall_client_um" __@@_PchSym_@00@KxulyqvxgPillgKxunrmrlUhvxfirgbUorxvmhrmtUhkxzooUoryUyfrowPxorvmgPfnUlyquivUznwGEUhgwzucOlyq@spcall_client_um
0x1400102E8: "__cdecl _imp_?GetAllVolumes@BuiVolume@@SAJPEAPEAU_BuiVolumeNode@@@Z" __imp_?GetAllVolumes@BuiVolume@@SAJPEAPEAU_BuiVolumeNode@@@Z
0x140010308: "__cdecl _imp_?CanBeResumed@BuiVolume@@QEBA_NXZ" __imp_?CanBeResumed@BuiVolume@@QEBA_NXZ
0x140010510: "__cdecl _imp_TrackPopupMenu" __imp_TrackPopupMenu
0x140010568: "__cdecl _imp_RegisterDeviceNotificationW" __imp_RegisterDeviceNotificationW
0x140010860: GUID_IO_VOLUME_LOCK
0x1400102C0: "__cdecl _imp_InitiateShutdownW" __imp_InitiateShutdownW
0x14000E770: "int __cdecl WARBIRD_DELAY_LOAD::GetObjectW(void * __ptr64,int,void * __ptr64)" ?GetObjectW@WARBIRD_DELAY_LOAD@@YAHPEAXH0@Z
0x14000E770: "void * __ptr64 __cdecl WARBIRD_DELAY_LOAD::GetCurrentObject(struct HDC__ * __ptr64,unsigned int)" ?GetCurrentObject@WARBIRD_DELAY_LOAD@@YAPEAXPEAUHDC__@@I@Z
0x140010418: "__cdecl _imp_HeapSetInformation" __imp_HeapSetInformation
0x14000E770: "struct HBRUSH__ * __ptr64 __cdecl WARBIRD_DELAY_LOAD::CreateSolidBrush(unsigned long)" ?CreateSolidBrush@WARBIRD_DELAY_LOAD@@YAPEAUHBRUSH__@@K@Z
0x14000EEC0: "long __cdecl __CxxUnhandledExceptionFilter(struct _EXCEPTION_POINTERS * __ptr64)" ?__CxxUnhandledExceptionFilter@@YAJPEAU_EXCEPTION_POINTERS@@@Z
0x1400106F0: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x140015324: "__cdecl fmode" _fmode
0x140010340: "__cdecl _imp_?ManagementRequiresElevation@BuiVolume@@QEBA_NXZ" __imp_?ManagementRequiresElevation@BuiVolume@@QEBA_NXZ
0x1400103F0: "__cdecl _imp_FormatMessageW" __imp_FormatMessageW
0x140010488: "__cdecl _imp_GetModuleHandleExW" __imp_GetModuleHandleExW
0x1400151A0: "unsigned char * `WarbirdUmGetEncryptionCipher'::`2'::EncryptionCipher" ?EncryptionCipher@?1??WarbirdUmGetEncryptionCipher@@9@4PAEA
0x140010560: "__cdecl _imp_DispatchMessageW" __imp_DispatchMessageW
0x14000EF1E: "__cdecl XcptFilter" _XcptFilter
0x1400106F8: "__cdecl _xc_a" __xc_a
0x140010A40: "?InitialVolume==" ??_C@_1CC@HAELPIJA@?$AA?$DP?$AAI?$AAn?$AAi?$AAt?$AAi?$AAa?$AAl?$AAV?$AAo?$AAl?$AAu?$AAm?$AAe?$AA?$DN?$AA?$DN?$AA?$AA@
0x1400130C8: "__stdcall _real" __real@4059000000000000
0x140010548: "__cdecl _imp_SetWindowLongPtrW" __imp_SetWindowLongPtrW
0x140010420: "__cdecl _imp_GetStartupInfoW" __imp_GetStartupInfoW
0x14000E770: "int __cdecl WARBIRD_DELAY_LOAD::InvalidateRect(struct HWND__ * __ptr64,struct tagRECT const * __ptr64,int)" ?InvalidateRect@WARBIRD_DELAY_LOAD@@YAHPEAUHWND__@@PEBUtagRECT@@H@Z
0x140010300: "__cdecl _imp_?SuspendStatusRefreshing@BuiVolume@@QEAAXXZ" __imp_?SuspendStatusRefreshing@BuiVolume@@QEAAXXZ
0x140010378: COMCTL32_NULL_THUNK_DATA
0x140015000: "void * __ptr64 * WARBIRD::g_FuncAddress" ?g_FuncAddress@WARBIRD@@3PAPEAXA
0x14000E770: "struct HDC__ * __ptr64 __cdecl WARBIRD_DELAY_LOAD::GetDCEx(struct HWND__ * __ptr64,struct HRGN__ * __ptr64,unsigned long)" ?GetDCEx@WARBIRD_DELAY_LOAD@@YAPEAUHDC__@@PEAUHWND__@@PEAUHRGN__@@K@Z
0x1400102D0: "__cdecl _imp_?Init@BuiVolume@@QEAAJPEAG@Z" __imp_?Init@BuiVolume@@QEAAJPEAG@Z
0x14000E7D4: "public: void __cdecl SP<unsigned long,class SP_MEM<unsigned long> >::Reset(void) __ptr64" ?Reset@?$SP@KV?$SP_MEM@K@@@@QEAAXXZ
0x1400105D0: "__cdecl _imp_DestroyIcon" __imp_DestroyIcon
0x140012A68: "unsigned short const * const `public: static long __cdecl CUxDisplayStringsT<class CEmptyType>::GetAllPreferredStrings(unsigned short * __ptr64,unsigned int,unsigned short * __ptr64 * __ptr64 * __ptr64,int * __ptr64,struct _LANG_FONT_NAMES * __ptr64)'::`2'::wStringIds" ?wStringIds@?1??GetAllPreferredStrings@?$CUxDisplayStringsT@VCEmptyType@@@@SAJPEAGIPEAPEAPEAGPEAHPEAU_LANG_FONT_NAMES@@@Z@4QBGB
0x14000EE9C: "__cdecl callnewh" _callnewh
0x14000E888: "long __cdecl RegisterStatusChangeNotification(struct HWND__ * __ptr64,unsigned short const * __ptr64,void * __ptr64 * __ptr64)" ?RegisterStatusChangeNotification@@YAJPEAUHWND__@@PEBGPEAPEAX@Z
0x14000E7A0: "int __cdecl WARBIRD_DELAY_LOAD::MulDiv(int,int,int)" ?MulDiv@WARBIRD_DELAY_LOAD@@YAHHHH@Z
0x14000F546: memcpy
0x140010630: "__cdecl _imp__acmdln" __imp__acmdln
0x14000E770: "int __cdecl WARBIRD_DELAY_LOAD::FillRect(struct HDC__ * __ptr64,struct tagRECT const * __ptr64,struct HBRUSH__ * __ptr64)" ?FillRect@WARBIRD_DELAY_LOAD@@YAHPEAUHDC__@@PEBUtagRECT@@PEAUHBRUSH__@@@Z
0x14000E770: "int __cdecl WARBIRD_DELAY_LOAD::DeleteObject(void * __ptr64)" ?DeleteObject@WARBIRD_DELAY_LOAD@@YAHPEAX@Z
0x1400106B8: "__cdecl _imp_memset" __imp_memset
0x14000F19F: "__cdecl initterm" _initterm
0x140015980: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x1400103D0: "__cdecl _imp_Sleep" __imp_Sleep
0x1400105E0: "__cdecl _imp_GetSystemMetrics" __imp_GetSystemMetrics
0x140010728: "__cdecl _xi_z" __xi_z
0x140001100: "public: bool __cdecl VolumeFveStatus::IsOn(void)const __ptr64" ?IsOn@VolumeFveStatus@@QEBA_NXZ
0x1400104B0: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x1400106D8: "__cdecl _imp_wcscmp" __imp_wcscmp
0x1400103C0: "__cdecl _imp_GetCommandLineW" __imp_GetCommandLineW
0x14000E770: "struct HBITMAP__ * __ptr64 __cdecl WARBIRD_DELAY_LOAD::CreateCompatibleBitmap(struct HDC__ * __ptr64,int,int)" ?CreateCompatibleBitmap@WARBIRD_DELAY_LOAD@@YAPEAUHBITMAP__@@PEAUHDC__@@HH@Z
0x1400012B0: "public: unsigned long __cdecl VolumeFveStatus::GetStatusFlags(void)const __ptr64" ?GetStatusFlags@VolumeFveStatus@@QEBAKXZ
0x14000EE84: "__cdecl _C_specific_handler" __C_specific_handler
0x14000BC9C: "long __cdecl OpenControlPanel(class BuiVolume * __ptr64)" ?OpenControlPanel@@YAJPEAVBuiVolume@@@Z
0x1400104A0: "__cdecl _imp_HeapFree" __imp_HeapFree
0x140015954: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUmthxyUxlnnlmUfnUlyquivUznwGEUkivxlnkOlyq@ngscb_common_um" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUmthxyUxlnnlmUfnUlyquivUznwGEUkivxlnkOlyq@ngscb_common_um
0x14000E770: "struct HWND__ * __ptr64 __cdecl WARBIRD_DELAY_LOAD::GetDesktopWindow(void)" ?GetDesktopWindow@WARBIRD_DELAY_LOAD@@YAPEAUHWND__@@XZ
0x14000EE90: malloc
0x140010588: "__cdecl _imp_DestroyWindow" __imp_DestroyWindow
0x140010368: "__cdecl _imp_TaskDialog" __imp_TaskDialog
0x140001260: "public: bool __cdecl VolumeFveStatus::IsEDriveVolume(void)const __ptr64" ?IsEDriveVolume@VolumeFveStatus@@QEBA_NXZ
0x1400103A0: "__cdecl _imp_CreateCompatibleDC" __imp_CreateCompatibleDC
0x14000F4DC: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x14000E770: "int __cdecl WARBIRD_DELAY_LOAD::LCIDToLocaleName(unsigned long,unsigned short * __ptr64,int,unsigned long)" ?LCIDToLocaleName@WARBIRD_DELAY_LOAD@@YAHKPEAGHK@Z
0x1400158E0: "struct WARBIRD::_MODULE_INFO * WARBIRD::g_arModuleInfo" ?g_arModuleInfo@WARBIRD@@3PAU_MODULE_INFO@1@A
0x1400158D0: "struct HINSTANCE__ * __ptr64 __ptr64 g_hInst" ?g_hInst@@3PEAUHINSTANCE__@@EA
0x140001310: "public: class VolumeFveStatus & __ptr64 __cdecl VolumeFveStatus::operator=(class VolumeFveStatus &&) __ptr64" ??4VolumeFveStatus@@QEAAAEAV0@$$QEAV0@@Z
0x14000EFD3: "__cdecl amsg_exit" _amsg_exit
0x140010688: "__cdecl _imp__callnewh" __imp__callnewh
0x14000E790: "int __cdecl WARBIRD_DELAY_LOAD::GdiGradientFill(struct HDC__ * __ptr64,struct _TRIVERTEX * __ptr64,unsigned long,void * __ptr64,unsigned long,unsigned long)" ?GdiGradientFill@WARBIRD_DELAY_LOAD@@YAHPEAUHDC__@@PEAU_TRIVERTEX@@KPEAXKK@Z
0x140010390: "__cdecl _imp_DeleteDC" __imp_DeleteDC
0x14000E770: "void * __ptr64 __cdecl WARBIRD_DELAY_LOAD::SelectObject(struct HDC__ * __ptr64,void * __ptr64)" ?SelectObject@WARBIRD_DELAY_LOAD@@YAPEAXPEAUHDC__@@PEAX@Z
0x14000E770: "int __cdecl WARBIRD_DELAY_LOAD::GetDIBits(struct HDC__ * __ptr64,struct HBITMAP__ * __ptr64,unsigned int,unsigned int,void * __ptr64,struct tagBITMAPINFO * __ptr64,unsigned int)" ?GetDIBits@WARBIRD_DELAY_LOAD@@YAHPEAUHDC__@@PEAUHBITMAP__@@IIPEAXPEAUtagBITMAPINFO@@I@Z
0x140010830: "struct std::nothrow_t const std::nothrow" ?nothrow@std@@3Unothrow_t@1@B
0x140010660: "__cdecl _imp_exit" __imp_exit
0x1400130C0: "__stdcall _real" __real@4024000000000000
0x1400103B0: GDI32_NULL_THUNK_DATA
0x1400010D0: "public: bool __cdecl VolumeFveStatus::IsOsCriticalVolume(void)const __ptr64" ?IsOsCriticalVolume@VolumeFveStatus@@QEBA_NXZ
0x1400011C0: "public: bool __cdecl VolumeFveStatus::IsSecure(void)const __ptr64" ?IsSecure@VolumeFveStatus@@QEBA_NXZ
0x14000E790: "int __cdecl WARBIRD_DELAY_LOAD::DrawTextExW(struct HDC__ * __ptr64,unsigned short * __ptr64,int,struct tagRECT * __ptr64,unsigned int,struct tagDRAWTEXTPARAMS * __ptr64)" ?DrawTextExW@WARBIRD_DELAY_LOAD@@YAHPEAUHDC__@@PEAGHPEAUtagRECT@@IPEAUtagDRAWTEXTPARAMS@@@Z
0x1400108C8: GUID_IO_VOLUME_DISMOUNT_FAILED
0x1400010C0: "public: bool __cdecl VolumeFveStatus::IsOsVolume(void)const __ptr64" ?IsOsVolume@VolumeFveStatus@@QEBA_NXZ
0x14000E790: "int __cdecl WARBIRD_DELAY_LOAD::GdiAlphaBlend(struct HDC__ * __ptr64,int,int,int,int,struct HDC__ * __ptr64,int,int,int,int,struct _BLENDFUNCTION)" ?GdiAlphaBlend@WARBIRD_DELAY_LOAD@@YAHPEAUHDC__@@HHHH0HHHHU_BLENDFUNCTION@@@Z
0x1400105F8: "__cdecl _imp_CoUninitialize" __imp_CoUninitialize
0x140010B80: "%s " ??_C@_17GMPJMPF@?$AA?$CF?$AAs?$AA?5?$AA?$AA@
0x140010990: "System\CurrentControlSet\Policie" ??_C@_1GA@NOJPKCGE@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA?2?$AAP?$AAo?$AAl?$AAi?$AAc?$AAi?$AAe@
0x140010370: "__cdecl _imp_TaskDialogIndirect" __imp_TaskDialogIndirect
0x1400105C8: "__cdecl _imp_GetIconInfo" __imp_GetIconInfo
0x140010530: "__cdecl _imp_RegisterClassExW" __imp_RegisterClassExW
0x14000E770: "struct HDC__ * __ptr64 __cdecl WARBIRD_DELAY_LOAD::CreateCompatibleDC(struct HDC__ * __ptr64)" ?CreateCompatibleDC@WARBIRD_DELAY_LOAD@@YAPEAUHDC__@@PEAU2@@Z
0x1400103E0: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x140015190: "unsigned __int64 `WarbirdUmGetDecryptionKey'::`2'::nDecryptionKey" ?nDecryptionKey@?1??WarbirdUmGetDecryptionKey@@9@4_KA
0x140015970: "__cdecl _native_startup_lock" __native_startup_lock
0x14000E770: "unsigned __int64 __cdecl WARBIRD_DELAY_LOAD::GetTickCount64(void)" ?GetTickCount64@WARBIRD_DELAY_LOAD@@YA_KXZ
0x140015240: "unsigned __int64 `WarbirdUmGetEncryptionKey'::`2'::nEncryptionKey" ?nEncryptionKey@?1??WarbirdUmGetEncryptionKey@@9@4_KA
0x14000EF00: "__cdecl _CxxSetUnhandledExceptionFilter" __CxxSetUnhandledExceptionFilter
0x1400106B0: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x1400104C8: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x1400104D0: KERNEL32_NULL_THUNK_DATA
0x140010410: "__cdecl _imp_GetLastError" __imp_GetLastError
0x14000EA6C: "void * __ptr64 __cdecl operator new(unsigned __int64)" ??2@YAPEAX_K@Z
0x14001594C: g_WarbirdSecureFunctionsLock
0x14000F4B8: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x140012DC0: "unsigned short const * const `private: static long __cdecl CUxDisplayStringsT<class CEmptyType>::GetFontsForLCIDIndex(unsigned int,struct _LANG_FONT_NAMES * __ptr64)'::`2'::wszFontArray" ?wszFontArray@?1??GetFontsForLCIDIndex@?$CUxDisplayStringsT@VCEmptyType@@@@CAJIPEAU_LANG_FONT_NAMES@@@Z@4QBGB
0x1400012A0: "public: bool __cdecl VolumeFveStatus::IsDEAutoProvisioned(void)const __ptr64" ?IsDEAutoProvisioned@VolumeFveStatus@@QEBA_NXZ
0x140001110: "public: bool __cdecl VolumeFveStatus::IsPaused(void)const __ptr64" ?IsPaused@VolumeFveStatus@@QEBA_NXZ
0x140010620: "__cdecl _imp__commode" __imp__commode
0x140010640: "__cdecl _imp___setusermatherr" __imp___setusermatherr
0x140010B00: "FveNotifyAppWindow" ??_C@_1CG@DCDHNGML@?$AAF?$AAv?$AAe?$AAN?$AAo?$AAt?$AAi?$AAf?$AAy?$AAA?$AAp?$AAp?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AA?$AA@
0x140013FD0: "__cdecl _IMPORT_DESCRIPTOR_ADVAPI32" __IMPORT_DESCRIPTOR_ADVAPI32
0x1400102E0: "__cdecl _imp_?DeleteVolumeList@BuiVolume@@SAXPEAPEAU_BuiVolumeNode@@@Z" __imp_?DeleteVolumeList@BuiVolume@@SAXPEAPEAU_BuiVolumeNode@@@Z
0x140010440: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x14000E770: "int __cdecl WARBIRD_DELAY_LOAD::GetUserObjectInformationW(void * __ptr64,int,void * __ptr64,unsigned long,unsigned long * __ptr64)" ?GetUserObjectInformationW@WARBIRD_DELAY_LOAD@@YAHPEAXH0KPEAK@Z
0x140010578: "__cdecl _imp_LoadIconW" __imp_LoadIconW
0x140010348: "__cdecl _imp_?RefreshStatus@BuiVolume@@QEAAJ_N@Z" __imp_?RefreshStatus@BuiVolume@@QEAAJ_N@Z
0x140010360: BDEUI_NULL_THUNK_DATA
0x14000F090: "__cdecl ValidateImageBase" _ValidateImageBase
0x14000F484: "void * __ptr64 __cdecl operator new(unsigned __int64,struct std::nothrow_t const & __ptr64)" ??2@YAPEAX_KAEBUnothrow_t@std@@@Z
0x14000E65C: "long __cdecl StringCchCopyW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64)" ?StringCchCopyW@@YAJPEAG_KPEBG@Z
0x140001040: "public: bool __cdecl VolumeFveStatus::HasTpmProtector(void)const __ptr64" ?HasTpmProtector@VolumeFveStatus@@QEBA_NXZ
0x1400105B8: "__cdecl _imp_CreateIconIndirect" __imp_CreateIconIndirect
0x14000E770: "unsigned long __cdecl WARBIRD_DELAY_LOAD::SleepEx(unsigned long,int)" ?SleepEx@WARBIRD_DELAY_LOAD@@YAKKH@Z
0x140010590: "__cdecl _imp_PostMessageW" __imp_PostMessageW
0x140010468: "__cdecl _imp_HeapAlloc" __imp_HeapAlloc
0x140010400: "__cdecl _imp_FreeLibrary" __imp_FreeLibrary
0x140010330: "__cdecl _imp_BuisCreateProxyObject" __imp_BuisCreateProxyObject
0x1400158A0: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxuyzhvUmthxyUxlimvihglmvUuevmlgrubUlyquivUznwGEUkivxlnkOlyq@fvenotify" __@@_PchSym_@00@KxulyqvxgPillgKxuyzhvUmthxyUxlimvihglmvUuevmlgrubUlyquivUznwGEUkivxlnkOlyq@fvenotify
0x140015320: "__cdecl newmode" _newmode
0x140010638: "__cdecl _imp__initterm" __imp__initterm
0x140010668: "__cdecl _imp___set_app_type" __imp___set_app_type
0x140010870: GUID_IO_VOLUME_FVE_STATUS_CHANGE
0x14000E790: "__cdecl setargv" _setargv
0x14000E770: "int __cdecl WARBIRD_DELAY_LOAD::DeleteDC(struct HDC__ * __ptr64)" ?DeleteDC@WARBIRD_DELAY_LOAD@@YAHPEAUHDC__@@@Z
0x140010490: "__cdecl _imp_SetLastError" __imp_SetLastError
0x14000E770: "int __cdecl WARBIRD_DELAY_LOAD::GetSystemMetrics(int)" ?GetSystemMetrics@WARBIRD_DELAY_LOAD@@YAHH@Z
0x140010480: "__cdecl _imp_GetModuleFileNameW" __imp_GetModuleFileNameW
0x14000E770: "int __cdecl WARBIRD_DELAY_LOAD::MultiByteToWideChar(unsigned int,unsigned long,char const * __ptr64,int,unsigned short * __ptr64,int)" ?MultiByteToWideChar@WARBIRD_DELAY_LOAD@@YAHIKPEBDHPEAGH@Z
0x140010880: GUID_IO_VOLUME_LOCK_FAILED
0x140010358: "__cdecl _imp_??1BuiVolume@@QEAA@XZ" __imp_??1BuiVolume@@QEAA@XZ
0x140001230: "public: bool __cdecl VolumeFveStatus::FailedDryRun(void)const __ptr64" ?FailedDryRun@VolumeFveStatus@@QEBA_NXZ
0x140010C98: "Default" ??_C@_1BA@GHOECOCL@?$AAD?$AAe?$AAf?$AAa?$AAu?$AAl?$AAt?$AA?$AA@
0x140010540: "__cdecl _imp_RegisterWindowMessageW" __imp_RegisterWindowMessageW
0x140010550: "__cdecl _imp_GetMessageW" __imp_GetMessageW
0x140015960: "__cdecl _onexitend" __onexitend
0x1400158C0: "int g_tShowBalloonOnClose" ?g_tShowBalloonOnClose@@3HA
0x1400102B8: "__cdecl _imp_AdjustTokenPrivileges" __imp_AdjustTokenPrivileges
0x140010CB0: "unsigned char const * const `public: static long __cdecl CUxDisplayStringsT<class CEmptyType>::GetAllPreferredStrings(unsigned short * __ptr64,unsigned int,unsigned short * __ptr64 * __ptr64 * __ptr64,int * __ptr64,struct _LANG_FONT_NAMES * __ptr64)'::`2'::bEncryptedStringBuffer" ?bEncryptedStringBuffer@?1??GetAllPreferredStrings@?$CUxDisplayStringsT@VCEmptyType@@@@SAJPEAGIPEAPEAPEAGPEAHPEAU_LANG_FONT_NAMES@@@Z@4QBEB
0x140010658: "__cdecl _imp__exit" __imp__exit
0x1400106E8: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x1400105E8: "__cdecl _imp_CreateWindowExW" __imp_CreateWindowExW
0x14000E770: "struct HFONT__ * __ptr64 __cdecl WARBIRD_DELAY_LOAD::CreateFontIndirectW(struct tagLOGFONTW const * __ptr64)" ?CreateFontIndirectW@WARBIRD_DELAY_LOAD@@YAPEAUHFONT__@@PEBUtagLOGFONTW@@@Z
0x1400104A8: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x1400105F0: USER32_NULL_THUNK_DATA
0x140010500: "__cdecl _imp_DefWindowProcW" __imp_DefWindowProcW
0x14000E790: "int __cdecl WARBIRD_DELAY_LOAD::RedrawWindow(struct HWND__ * __ptr64,struct tagRECT const * __ptr64,struct HRGN__ * __ptr64,unsigned int)" ?RedrawWindow@WARBIRD_DELAY_LOAD@@YAHPEAUHWND__@@PEBUtagRECT@@PEAUHRGN__@@I@Z
0x14000E814: "public: void __cdecl SH<void * __ptr64,class SH_HANDLE>::Reset(void) __ptr64" ?Reset@?$SH@PEAXVSH_HANDLE@@@@QEAAXXZ
0x140010698: "__cdecl _imp_wcstol" __imp_wcstol
0x140010710: "__cdecl _xi_a" __xi_a
0x1400103D8: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x14000E790: "__cdecl matherr" _matherr
0x140010B48: "fvenotify.exe" ??_C@_1BM@NMLBCLCA@?$AAf?$AAv?$AAe?$AAn?$AAo?$AAt?$AAi?$AAf?$AAy?$AA?4?$AAe?$AAx?$AAe?$AA?$AA@
0x1400012C0: "public: unsigned __int64 __cdecl VolumeFveStatus::GetExtendedFlags(void)const __ptr64" ?GetExtendedFlags@VolumeFveStatus@@QEBA_KXZ
0x1400105A0: "__cdecl _imp_SetForegroundWindow" __imp_SetForegroundWindow
0x140010B74: "%s" ??_C@_15GANGMFKL@?$AA?$CF?$AAs?$AA?$AA@
0x14000E770: "int __cdecl WARBIRD_DELAY_LOAD::GetDeviceCaps(struct HDC__ * __ptr64,int)" ?GetDeviceCaps@WARBIRD_DELAY_LOAD@@YAHPEAUHDC__@@H@Z
0x140010B88: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x14000E790: "int __cdecl WARBIRD_DELAY_LOAD::LogicalToPhysicalPointForPerMonitorDPI(struct HWND__ * __ptr64,struct tagPOINT * __ptr64)" ?LogicalToPhysicalPointForPerMonitorDPI@WARBIRD_DELAY_LOAD@@YAHPEAUHWND__@@PEAUtagPOINT@@@Z
0x14000F378: "__cdecl _report_rangecheckfailure" __report_rangecheckfailure
0x1400106A0: "__cdecl _imp_towupper" __imp_towupper
0x1400103C8: "__cdecl _imp_CreateMutexW" __imp_CreateMutexW
0x140014034: "__cdecl _IMPORT_DESCRIPTOR_COMCTL32" __IMPORT_DESCRIPTOR_COMCTL32
0x14000EAAC: "void __cdecl operator delete(void * __ptr64)" ??3@YAXPEAX@Z
0x1400105C0: "__cdecl _imp_DrawIconEx" __imp_DrawIconEx
0x14000E770: "unsigned long __cdecl WARBIRD_DELAY_LOAD::SetTextColor(struct HDC__ * __ptr64,unsigned long)" ?SetTextColor@WARBIRD_DELAY_LOAD@@YAKPEAUHDC__@@K@Z
0x1400102D8: "__cdecl _imp_??0BuiVolume@@QEAA@_N@Z" __imp_??0BuiVolume@@QEAA@_N@Z
0x14000EE60: "__cdecl _security_check_cookie" __security_check_cookie
0x14000E7AC: "public: void __cdecl SP<unsigned char,class SP_HLOCAL<unsigned char> >::Reset(void) __ptr64" ?Reset@?$SP@EV?$SP_HLOCAL@E@@@@QEAAXXZ
0x14001405C: "__cdecl _IMPORT_DESCRIPTOR_BDEUI" __IMPORT_DESCRIPTOR_BDEUI
0x140010708: "__cdecl _xc_z" __xc_z
0x140001070: "public: bool __cdecl VolumeFveStatus::HasPBKDF2RecoveryPassword(void)const __ptr64" ?HasPBKDF2RecoveryPassword@VolumeFveStatus@@QEBA_NXZ
0x140010460: "__cdecl _imp_GetProcAddress" __imp_GetProcAddress
0x14000E770: "int __cdecl WARBIRD_DELAY_LOAD::GetLocaleInfoEx(unsigned short const * __ptr64,unsigned long,unsigned short * __ptr64,int)" ?GetLocaleInfoEx@WARBIRD_DELAY_LOAD@@YAHPEBGKPEAGH@Z
0x1400104E8: "__cdecl _imp_Shell_NotifyIconW" __imp_Shell_NotifyIconW
0x1400012D0: "public: long __cdecl VolumeFveStatus::GetLastConvertStatus(void)const __ptr64" ?GetLastConvertStatus@VolumeFveStatus@@QEBAJXZ
0x140015250: "unsigned char * `WarbirdUmGetDecryptionCipher'::`2'::DecryptionCipher" ?DecryptionCipher@?1??WarbirdUmGetDecryptionCipher@@9@4PAEA
0x140010618: "__cdecl _imp_?terminate@@YAXXZ" __imp_?terminate@@YAXXZ
0x140010608: "__cdecl _imp_CoCreateInstance" __imp_CoCreateInstance
0x140010498: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x14000E770: "struct HDESK__ * __ptr64 __cdecl WARBIRD_DELAY_LOAD::GetThreadDesktop(unsigned long)" ?GetThreadDesktop@WARBIRD_DELAY_LOAD@@YAPEAUHDESK__@@K@Z
0x140010BA0: "__cdecl GUID_ea1afb91_9e28_4b86_90e9_9e9f8a5eefaf" _GUID_ea1afb91_9e28_4b86_90e9_9e9f8a5eefaf
0x140010470: "__cdecl _imp_LocalAlloc" __imp_LocalAlloc
0x140010458: "__cdecl _imp_GetProcessHeap" __imp_GetProcessHeap
0x14000F5A0: "__cdecl _chkstk" __chkstk
0x14000E770: "int __cdecl WARBIRD_DELAY_LOAD::SystemParametersInfoW(unsigned int,unsigned int,void * __ptr64,unsigned int)" ?SystemParametersInfoW@WARBIRD_DELAY_LOAD@@YAHIIPEAXI@Z
0x140001160: "public: bool __cdecl VolumeFveStatus::IsEncrypting(void)const __ptr64" ?IsEncrypting@VolumeFveStatus@@QEBA_NXZ
0x140012950: "unsigned long const * const `public: static long __cdecl CUxDisplayStringsT<class CEmptyType>::GetAllPreferredStrings(unsigned short * __ptr64,unsigned int,unsigned short * __ptr64 * __ptr64 * __ptr64,int * __ptr64,struct _LANG_FONT_NAMES * __ptr64)'::`2'::uLanguageArray" ?uLanguageArray@?1??GetAllPreferredStrings@?$CUxDisplayStringsT@VCEmptyType@@@@SAJPEAGIPEAPEAPEAGPEAHPEAU_LANG_FONT_NAMES@@@Z@4QBKB
0x140010C60: "__cdecl GUID_d11ad862_66de_4df4_bf6c_1f5621996af1" _GUID_d11ad862_66de_4df4_bf6c_1f5621996af1
0x140001280: "public: bool __cdecl VolumeFveStatus::IsUnknownFveVersion(void)const __ptr64" ?IsUnknownFveVersion@VolumeFveStatus@@QEBA_NXZ
0x1400012E0: "protected: __cdecl VolumeFveStatus::VolumeFveStatus(void) __ptr64" ??0VolumeFveStatus@@IEAA@XZ
0x1400158D8: "union _NOTIFICATION_INFORMATION g_WarbirdNotificationInformation" ?g_WarbirdNotificationInformation@@3T_NOTIFICATION_INFORMATION@@A
0x140010730: "__cdecl _guard_fids_table" __guard_fids_table
0x140010538: "__cdecl _imp_MoveWindow" __imp_MoveWindow
0x140010B28: "Local\FveNotify" ??_C@_1CA@HILKGHCC@?$AAL?$AAo?$AAc?$AAa?$AAl?$AA?2?$AAF?$AAv?$AAe?$AAN?$AAo?$AAt?$AAi?$AAf?$AAy?$AA?$AA@
0x1400106E0: msvcrt_NULL_THUNK_DATA
0x140010180: "__cdecl load_config_used" _load_config_used
0x140010318: "__cdecl _imp_?ResumeConversion@BuiVolume@@QEAAJXZ" __imp_?ResumeConversion@BuiVolume@@QEAAJXZ
0x140010A70: "Microsoft.BitLockerDriveEncrypti" ??_C@_1EG@FNCHJKCL@?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?4?$AAB?$AAi?$AAt?$AAL?$AAo?$AAc?$AAk?$AAe?$AAr?$AAD?$AAr?$AAi?$AAv?$AAe?$AAE?$AAn?$AAc?$AAr?$AAy?$AAp?$AAt?$AAi@
0x1400129F0: ?LangFontIndexMapping@?1??GetFontsForLCIDIndex@?$CUxDisplayStringsT@VCEmptyType@@@@CAJIPEAU_LANG_FONT_NAMES@@@Z@4QBU_LANG_FONT_INDEX_INFO@?1??12@CAJI0@Z@B
0x1400012F0: "public: class VolumeFveStatus & __ptr64 __cdecl VolumeFveStatus::operator=(class VolumeFveStatus const & __ptr64) __ptr64" ??4VolumeFveStatus@@QEAAAEAV0@AEBV0@@Z
0x140010508: "__cdecl _imp_PostQuitMessage" __imp_PostQuitMessage
0x1400108F8: "RDVDenyWriteAccess" ??_C@_1CG@NENDOLID@?$AAR?$AAD?$AAV?$AAD?$AAe?$AAn?$AAy?$AAW?$AAr?$AAi?$AAt?$AAe?$AAA?$AAc?$AAc?$AAe?$AAs?$AAs?$AA?$AA@
0x1400158C4: "int g_tInitializePosition" ?g_tInitializePosition@@3HA
0x1400108A0: "public: static unsigned int const BuiVolume::NO_DRIVE_LETTER" ?NO_DRIVE_LETTER@BuiVolume@@2IB
0x1400102F0: "__cdecl _imp_?IsFveNotifyNecessary@BuiVolume@@QEBA_NXZ" __imp_?IsFveNotifyNecessary@BuiVolume@@QEBA_NXZ
0x14001400C: "__cdecl _IMPORT_DESCRIPTOR_USER32" __IMPORT_DESCRIPTOR_USER32
0x140010520: "__cdecl _imp_LoadMenuW" __imp_LoadMenuW
0x14000E770: "unsigned long __cdecl WARBIRD_DELAY_LOAD::LocaleNameToLCID(unsigned short const * __ptr64,unsigned long)" ?LocaleNameToLCID@WARBIRD_DELAY_LOAD@@YAKPEBGK@Z
0x140010670: "__cdecl _imp__amsg_exit" __imp__amsg_exit
0x140001180: "public: bool __cdecl VolumeFveStatus::IsDecrypting(void)const __ptr64" ?IsDecrypting@VolumeFveStatus@@QEBA_NXZ
0x1400158C8: "int g_tShowDialogOnOpen" ?g_tShowDialogOnOpen@@3HA
0x1400010B0: "public: bool __cdecl VolumeFveStatus::HasSmartCardProtector(void)const __ptr64" ?HasSmartCardProtector@VolumeFveStatus@@QEBA_NXZ
0x1400105B0: "__cdecl _imp_LoadStringW" __imp_LoadStringW
0x14000E6E4: "long __cdecl StringCchPrintfW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64,...)" ?StringCchPrintfW@@YAJPEAG_KPEBGZZ
0x1400158B0: "struct HICON__ * __ptr64 __ptr64 g_hSmallIcon" ?g_hSmallIcon@@3PEAUHICON__@@EA
0x1400104C0: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x140010438: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x14001531C: "__cdecl dowildcard" _dowildcard
0x1400108B8: GUID_IO_VOLUME_MOUNT
0x140001010: "public: __cdecl VolumeFveStatus::VolumeFveStatus(unsigned long,unsigned __int64,long,enum _FVE_WIPING_STATE) __ptr64" ??0VolumeFveStatus@@QEAA@K_KJW4_FVE_WIPING_STATE@@@Z
0x14000EEA8: free
0x1400104B8: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x14000F1B0: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x14000EF2C: RtlpImageNtHeader
0x1400158A8: "struct ITaskbarList3 * __ptr64 __ptr64 g_pTaskbarList" ?g_pTaskbarList@@3PEAUITaskbarList3@@EA
0x140010320: "__cdecl _imp_?ImplicitPauseConversion@BuiVolume@@QEAAJXZ" __imp_?ImplicitPauseConversion@BuiVolume@@QEAAJXZ
0x140001150: "public: bool __cdecl VolumeFveStatus::IsPartiallyConverted(void)const __ptr64" ?IsPartiallyConverted@VolumeFveStatus@@QEBA_NXZ
0x1400102F8: "__cdecl _imp_?ResumeStatusRefreshing@BuiVolume@@QEAAXXZ" __imp_?ResumeStatusRefreshing@BuiVolume@@QEAAXXZ
0x140001090: "public: bool __cdecl VolumeFveStatus::HasStartupKeyProtector(void)const __ptr64" ?HasStartupKeyProtector@VolumeFveStatus@@QEBA_NXZ
0x140010398: "__cdecl _imp_SelectObject" __imp_SelectObject
0x1400103E8: "__cdecl _imp_GetModuleHandleW" __imp_GetModuleHandleW
0x140010B68: "open" ??_C@_19BDAJEHDN@?$AAo?$AAp?$AAe?$AAn?$AA?$AA@
0x1400105A8: "__cdecl _imp_ShowWindow" __imp_ShowWindow
0x140010558: "__cdecl _imp_TranslateMessage" __imp_TranslateMessage
0x14000F478: "void * __ptr64 __cdecl operator new[](unsigned __int64,struct std::nothrow_t const & __ptr64)" ??_U@YAPEAX_KAEBUnothrow_t@std@@@Z
0x140001270: "public: bool __cdecl VolumeFveStatus::IsCsvMetadataVolume(void)const __ptr64" ?IsCsvMetadataVolume@VolumeFveStatus@@QEBA_NXZ
0x1400011A0: "public: bool __cdecl VolumeFveStatus::IsWiping(void)const __ptr64" ?IsWiping@VolumeFveStatus@@QEBA_NXZ
0x140015948: g_WarbirdSecureFunctionsRefCount
0x140010678: "__cdecl _imp__XcptFilter" __imp__XcptFilter
0x140010598: "__cdecl _imp_SendMessageW" __imp_SendMessageW
0x1400106D0: "__cdecl _imp_memcpy" __imp_memcpy
0x14000E790: "int __cdecl WARBIRD_DELAY_LOAD::OffsetRect(struct tagRECT * __ptr64,int,int)" ?OffsetRect@WARBIRD_DELAY_LOAD@@YAHPEAUtagRECT@@HH@Z
0x140010648: "__cdecl _imp__ismbblead" __imp__ismbblead
0x14000E7D4: "public: void __cdecl SP<unsigned char,class SP_MEM<unsigned char> >::Reset(void) __ptr64" ?Reset@?$SP@EV?$SP_MEM@E@@@@QEAAXXZ
0x14000E790: "struct HMONITOR__ * __ptr64 __cdecl WARBIRD_DELAY_LOAD::MonitorFromWindow(struct HWND__ * __ptr64,unsigned long)" ?MonitorFromWindow@WARBIRD_DELAY_LOAD@@YAPEAUHMONITOR__@@PEAUHWND__@@K@Z
0x140010298: "__cdecl _imp_FreeSid" __imp_FreeSid
0x140001190: "public: bool __cdecl VolumeFveStatus::IsDecrypted(void)const __ptr64" ?IsDecrypted@VolumeFveStatus@@QEBA_NXZ
0x1400106C8: "__cdecl _imp___CxxFrameHandler3" __imp___CxxFrameHandler3
0x140015178: "__cdecl _security_cookie" __security_cookie
0x14000F5A0: "__cdecl alloca_probe" _alloca_probe
0x140010290: "__cdecl _imp_CheckTokenMembership" __imp_CheckTokenMembership
0x1400011E0: "public: bool __cdecl VolumeFveStatus::IsDisabled(void)const __ptr64" ?IsDisabled@VolumeFveStatus@@QEBA_NXZ
0x1400108A8: GUID_IO_VOLUME_UNLOCK
0x140010338: "__cdecl _imp_BuisCreateElevatedProxyObject" __imp_BuisCreateElevatedProxyObject
0x140010428: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x140010388: "__cdecl _imp_DeleteObject" __imp_DeleteObject
0x1400103F8: "__cdecl _imp_LocalFree" __imp_LocalFree
0x140015170: "__cdecl _defaultmatherr" __defaultmatherr
0x140010610: api-ms-win-core-com-l1-1-0_NULL_THUNK_DATA
0x140010408: "__cdecl _imp_LoadLibraryW" __imp_LoadLibraryW
0x1400010F0: "public: bool __cdecl VolumeFveStatus::IsRoamingDevice(void)const __ptr64" ?IsRoamingDevice@VolumeFveStatus@@QEBA_NXZ
0x1400104E0: "__cdecl _imp_Shell_NotifyIconGetRect" __imp_Shell_NotifyIconGetRect
0x140010350: "__cdecl _imp_?GetConvertedPercent@BuiVolume@@QEBANXZ" __imp_?GetConvertedPercent@BuiVolume@@QEBANXZ
0x140015968: "__cdecl _onexitbegin" __onexitbegin
0x140001060: "public: bool __cdecl VolumeFveStatus::HasRecoveryPassword(void)const __ptr64" ?HasRecoveryPassword@VolumeFveStatus@@QEBA_NXZ
0x14000E368: "long __cdecl StringCchPrintfExW(unsigned short * __ptr64,unsigned __int64,unsigned short * __ptr64 * __ptr64,unsigned __int64 * __ptr64,unsigned long,unsigned short const * __ptr64,...)" ?StringCchPrintfExW@@YAJPEAG_KPEAPEAGPEA_KKPEBGZZ
0x140010C88: "WinSta0" ??_C@_1BA@IMLGMNLL@?$AAW?$AAi?$AAn?$AAS?$AAt?$AAa?$AA0?$AA?$AA@
0x14000E790: "int __cdecl WARBIRD_DELAY_LOAD::GetMonitorInfoW(struct HMONITOR__ * __ptr64,struct tagMONITORINFO * __ptr64)" ?GetMonitorInfoW@WARBIRD_DELAY_LOAD@@YAHPEAUHMONITOR__@@PEAUtagMONITORINFO@@@Z
0x1400106A8: "__cdecl _imp__vsnwprintf" __imp__vsnwprintf
0x140010430: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x14000EBF0: WinMainCRTStartup
0x140001130: "public: bool __cdecl VolumeFveStatus::IsConverting(void)const __ptr64" ?IsConverting@VolumeFveStatus@@QEBA_NXZ
0x140013FE4: "__cdecl _IMPORT_DESCRIPTOR_KERNEL32" __IMPORT_DESCRIPTOR_KERNEL32
0x14000E790: "int __cdecl WARBIRD_DELAY_LOAD::SetBkMode(struct HDC__ * __ptr64,int)" ?SetBkMode@WARBIRD_DELAY_LOAD@@YAHPEAUHDC__@@H@Z
0x140001170: "public: bool __cdecl VolumeFveStatus::IsEncrypted(void)const __ptr64" ?IsEncrypted@VolumeFveStatus@@QEBA_NXZ
0x14000F0C4: "__cdecl _security_init_cookie" __security_init_cookie
0x140010650: "__cdecl _imp__cexit" __imp__cexit
0x1400102A0: "__cdecl _imp_RegGetValueW" __imp_RegGetValueW
0x140010380: "__cdecl _imp_GetObjectW" __imp_GetObjectW
0x14000EF88: "__cdecl get_image_app_type" _get_image_app_type
0x140014020: "__cdecl _IMPORT_DESCRIPTOR_msvcrt" __IMPORT_DESCRIPTOR_msvcrt
0x14000F55E: wcscmp
0x1400105D8: "__cdecl _imp_LoadImageW" __imp_LoadImageW
0x1400109F0: "SecureStartupFeature-Enabled-Pre" ??_C@_1EK@MKCPFLPM@?$AAS?$AAe?$AAc?$AAu?$AAr?$AAe?$AAS?$AAt?$AAa?$AAr?$AAt?$AAu?$AAp?$AAF?$AAe?$AAa?$AAt?$AAu?$AAr?$AAe?$AA?9?$AAE?$AAn?$AAa?$AAb?$AAl?$AAe?$AAd?$AA?9?$AAP?$AAr?$AAe@
0x14000E770: "void * __ptr64 __cdecl WARBIRD_DELAY_LOAD::GetStockObject(int)" ?GetStockObject@WARBIRD_DELAY_LOAD@@YAPEAXH@Z
0x14000E770: "int __cdecl WARBIRD_DELAY_LOAD::GetUserPreferredUILanguages(unsigned long,unsigned long * __ptr64,unsigned short * __ptr64,unsigned long * __ptr64)" ?GetUserPreferredUILanguages@WARBIRD_DELAY_LOAD@@YAHKPEAKPEAG0@Z
0x140010310: "__cdecl _imp_BuisIsHardwareReadyForConversion" __imp_BuisIsHardwareReadyForConversion
0x140010690: "__cdecl _imp_malloc" __imp_malloc
0x1400102C8: ADVAPI32_NULL_THUNK_DATA
0x140001080: "public: bool __cdecl VolumeFveStatus::HasExternalKey(void)const __ptr64" ?HasExternalKey@VolumeFveStatus@@QEBA_NXZ
0x14000E770: "struct HWINSTA__ * __ptr64 __cdecl WARBIRD_DELAY_LOAD::GetProcessWindowStation(void)" ?GetProcessWindowStation@WARBIRD_DELAY_LOAD@@YAPEAUHWINSTA__@@XZ
0x140013FF8: "__cdecl _IMPORT_DESCRIPTOR_GDI32" __IMPORT_DESCRIPTOR_GDI32
0x1400102B0: "__cdecl _imp_LookupPrivilegeValueW" __imp_LookupPrivilegeValueW
0x14000F200: "__cdecl _report_gsfailure" __report_gsfailure
0x140001220: "public: bool __cdecl VolumeFveStatus::IsPreProvisioned(void)const __ptr64" ?IsPreProvisioned@VolumeFveStatus@@QEBA_NXZ
0x14000E7D4: "public: void __cdecl SP<unsigned short,class SP_MEM<unsigned short> >::Reset(void) __ptr64" ?Reset@?$SP@GV?$SP_MEM@G@@@@QEAAXXZ
0x140010B90: "__cdecl GUID_56fdf344_fd6d_11d0_958a_006097c9a090" _GUID_56fdf344_fd6d_11d0_958a_006097c9a090
0x140001210: "public: bool __cdecl VolumeFveStatus::HasRecoveryData(void)const __ptr64" ?HasRecoveryData@VolumeFveStatus@@QEBA_NXZ
0x140010C50: "__cdecl GUID_06622d85_6856_4460_8de1_a81921b41c4b" _GUID_06622d85_6856_4460_8de1_a81921b41c4b
0x140015978: "__cdecl _native_startup_state" __native_startup_state
0x140010C70: "ntdll.dll" ??_C@_1BE@GJOFHIHD@?$AAn?$AAt?$AAd?$AAl?$AAl?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x1400011D0: "public: bool __cdecl VolumeFveStatus::NeedsRestart(void)const __ptr64" ?NeedsRestart@VolumeFveStatus@@QEBA_NXZ
0x1400103A8: "__cdecl _imp_BitBlt" __imp_BitBlt
0x140001200: "public: bool __cdecl VolumeFveStatus::IsLocked(void)const __ptr64" ?IsLocked@VolumeFveStatus@@QEBA_NXZ
0x14000E770: "int __cdecl WARBIRD_DELAY_LOAD::BitBlt(struct HDC__ * __ptr64,int,int,int,int,struct HDC__ * __ptr64,int,int,unsigned long)" ?BitBlt@WARBIRD_DELAY_LOAD@@YAHPEAUHDC__@@HHHH0HHK@Z
0x140014048: "__cdecl _IMPORT_DESCRIPTOR_SHELL32" __IMPORT_DESCRIPTOR_SHELL32
0x140010628: "__cdecl _imp__fmode" __imp__fmode
0x140010920: "FDVDenyWriteAccess" ??_C@_1CG@DKNBOFKF@?$AAF?$AAD?$AAV?$AAD?$AAe?$AAn?$AAy?$AAW?$AAr?$AAi?$AAt?$AAe?$AAA?$AAc?$AAc?$AAe?$AAs?$AAs?$AA?$AA@
0x140010478: "__cdecl _imp_GetProcessMitigationPolicy" __imp_GetProcessMitigationPolicy
0x140010328: "__cdecl _imp_?SetProxyObject@BuiVolume@@QEAAXPEAUIDispatch@@@Z" __imp_?SetProxyObject@BuiVolume@@QEAAXPEAUIDispatch@@@Z
0x14000E7D4: "public: void __cdecl SP<unsigned short * __ptr64,class SP_MEM<unsigned short * __ptr64> >::Reset(void) __ptr64" ?Reset@?$SP@PEAGV?$SP_MEM@PEAG@@@@QEAAXXZ
0x140010AE0: "TaskbarCreated" ??_C@_1BO@NBGJACOC@?$AAT?$AAa?$AAs?$AAk?$AAb?$AAa?$AAr?$AAC?$AAr?$AAe?$AAa?$AAt?$AAe?$AAd?$AA?$AA@
0x140010518: "__cdecl _imp_GetSubMenu" __imp_GetSubMenu
0x140010680: "__cdecl _imp_free" __imp_free
0x1400104F0: "__cdecl _imp_ShellExecuteW" __imp_ShellExecuteW
0x14000F030: "__cdecl IsNonwritableInCurrentImage" _IsNonwritableInCurrentImage
0x1400102A8: "__cdecl _imp_OpenProcessToken" __imp_OpenProcessToken
0x140010570: "__cdecl _imp_UnregisterDeviceNotification" __imp_UnregisterDeviceNotification
0x140001050: "public: bool __cdecl VolumeFveStatus::HasPinProtector(void)const __ptr64" ?HasPinProtector@VolumeFveStatus@@QEBA_NXZ
0x14000E770: "int __cdecl WARBIRD_DELAY_LOAD::ReleaseDC(struct HWND__ * __ptr64,struct HDC__ * __ptr64)" ?ReleaseDC@WARBIRD_DELAY_LOAD@@YAHPEAUHWND__@@PEAUHDC__@@@Z
0x14000F552: memset
0x140014084: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x140015940: "unsigned __int64 g_WarbirdPaintInitTime" ?g_WarbirdPaintInitTime@@3_KA
0x14000E770: "unsigned long __cdecl WARBIRD_DELAY_LOAD::GetSysColor(int)" ?GetSysColor@WARBIRD_DELAY_LOAD@@YAKH@Z

[JEB Decompiler by PNF Software]