Generated by JEB on 2019/08/01

PE: C:\Windows\System32\seclogon.dll Base=0x180000000 SHA-256=F1555CA0D23D9FC065AF0D02355AFECEA9161029B402F74016B3F69E0BEBAD09
PDB: seclogon.pdb GUID={3B42FCCE-24E4-62F1-A6C282B59E664B99} Age=1

294 located named symbols:
0x180005C40: "__cdecl _sz_SspiCli_dll" __sz_SspiCli_dll
0x180002DEC: "__cdecl _raise_securityfailure" __raise_securityfailure
0x180005A58: "__cdecl _imp_ImpersonateLoggedOnUser" __imp_ImpersonateLoggedOnUser
0x180005930: "__cdecl _imp_GetCurrentDirectoryW" __imp_GetCurrentDirectoryW
0x180002950: "__cdecl _delayLoadHelper2" __delayLoadHelper2
0x180006BF0: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x180006BB4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-kernel32-legacy-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-kernel32-legacy-l1-1-0
0x180008008: "__cdecl _security_cookie_complement" __security_cookie_complement
0x180005C18: "ncalrpc" ??_C@_1BA@EONDGCCM@?$AAn?$AAc?$AAa?$AAl?$AAr?$AAp?$AAc?$AA?$AA@
0x180002A1C: "__cdecl CRT_INIT" _CRT_INIT
0x180005948: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x1800057C8: "__cdecl _imp_NdrServerCallAll" __imp_NdrServerCallAll
0x180005C60: "__cdecl _sz_CRYPTBASE_dll" __sz_CRYPTBASE_dll
0x1800057D8: "__cdecl _imp_RpcServerRegisterIfEx" __imp_RpcServerRegisterIfEx
0x180005B10: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x180003360: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x180006800: USERENV_NULL_THUNK_DATA_DLN
0x180005AB0: "__cdecl _imp_RtlSidDominates" __imp_RtlSidDominates
0x180003077: "__cdecl _imp_load_DestroyEnvironmentBlock" __imp_load_DestroyEnvironmentBlock
0x180005BB0: "seclogon" ??_C@_1BC@PNGPGJJC@?$AAs?$AAe?$AAc?$AAl?$AAo?$AAg?$AAo?$AAn?$AA?$AA@
0x180005918: "__cdecl _imp_ReadProcessMemory" __imp_ReadProcessMemory
0x18000A030: "__cdecl _imp_LsaDeregisterLogonProcess" __imp_LsaDeregisterLogonProcess
0x1800029D0: SeclSecurityCallback
0x180005978: "__cdecl _imp_InitializeProcThreadAttributeList" __imp_InitializeProcThreadAttributeList
0x180008640: g_state
0x180005FD0: "__cdecl _pfnDliFailureHook2" __pfnDliFailureHook2
0x1800085D8: "__cdecl _hmod__USERENV_dll" __hmod__USERENV_dll
0x180005808: "__cdecl _imp__initterm_e" __imp__initterm_e
0x180005B08: "__cdecl _imp_RtlQueryEnvironmentVariable" __imp_RtlQueryEnvironmentVariable
0x1800058B0: api-ms-win-core-heap-l2-1-0_NULL_THUNK_DATA
0x1800057B0: "__cdecl _imp_RpcServerUnregisterIf" __imp_RpcServerUnregisterIf
0x1800057E8: "__cdecl _imp_wcschr" __imp_wcschr
0x1800059E8: "__cdecl _imp_SetEvent" __imp_SetEvent
0x180005A70: "__cdecl _imp_PrivilegeCheck" __imp_PrivilegeCheck
0x180005B28: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x180003200: NdrServerCall2
0x180005A08: "__cdecl _imp_InitializeCriticalSection" __imp_InitializeCriticalSection
0x1800031C3: "__cdecl _imp_load_UnloadUserProfile" __imp_load_UnloadUserProfile
0x180005A68: "__cdecl _imp_RevertToSelf" __imp_RevertToSelf
0x180005A48: "__cdecl _imp_DecodePointer" __imp_DecodePointer
0x180008600: csForProcessCount
0x1800031D5: "__cdecl _imp_load_CreateEnvironmentBlock" __imp_load_CreateEnvironmentBlock
0x180005AA0: "__cdecl _imp_RtlInitString" __imp_RtlInitString
0x180003041: "__cdecl _imp_load_LsaDeregisterLogonProcess" __imp_load_LsaDeregisterLogonProcess
0x180005A90: "__cdecl _imp_RegisterServiceCtrlHandlerExW" __imp_RegisterServiceCtrlHandlerExW
0x180005B30: "__cdecl _xc_a" __xc_a
0x180004898: StringCbCopyW
0x180001150: SlrCreateProcessWithLogon
0x180006BDC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-job-l2-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-job-l2-1-0
0x180005898: api-ms-win-core-heap-l1-1-0_NULL_THUNK_DATA
0x1800025D0: ServiceMain
0x1800058F8: "__cdecl _imp_UnregisterWait" __imp_UnregisterWait
0x18000460C: SlpSetStdHandles
0x180005B9C: "__cdecl _guard_iat_table" __guard_iat_table
0x180005938: api-ms-win-core-processenvironment-l1-1-0_NULL_THUNK_DATA
0x1800057F8: "__cdecl _imp_memset" __imp_memset
0x1800059F8: "__cdecl _imp_CreateEventW" __imp_CreateEventW
0x180002DAB: "__cdecl initterm" _initterm
0x180006B78: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0
0x180005AD0: "__cdecl _imp_RtlSubAuthoritySid" __imp_RtlSubAuthoritySid
0x180005B48: "__cdecl _xi_z" __xi_z
0x180005858: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x180002A10: "__cdecl _C_specific_handler" __C_specific_handler
0x180002940: MIDL_user_free
0x180005C00: "Secondary Logon Service" ??_C@_0BI@KFEPHHFF@Secondary?5Logon?5Service?$AA@
0x1800058E0: "__cdecl _imp_TerminateJobObject" __imp_TerminateJobObject
0x180005888: "__cdecl _imp_HeapFree" __imp_HeapFree
0x180005AF0: "__cdecl _imp_RtlLengthRequiredSid" __imp_RtlLengthRequiredSid
0x180005878: api-ms-win-core-handle-l1-1-0_NULL_THUNK_DATA
0x180003260: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x180004524: SessionLogoffCallback
0x180003065: "__cdecl _imp_load_LsaLogonUser" __imp_load_LsaLogonUser
0x1800085E0: "__cdecl _hmod__CRYPTBASE_dll" __hmod__CRYPTBASE_dll
0x180006A60: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0
0x1800058D0: "__cdecl _imp_SetInformationJobObject" __imp_SetInformationJobObject
0x180005FCC: "__cdecl _DefaultResolveDelayLoadedAPIFlags" __DefaultResolveDelayLoadedAPIFlags
0x180006BC8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-threadpool-legacy-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-threadpool-legacy-l1-1-0
0x180002A00: SvchostPushServiceGlobals
0x180004128: MySetServiceStatus
0x180005A98: api-ms-win-service-core-l1-1-0_NULL_THUNK_DATA
0x180005CD0: "HOMEPATH" ??_C@_1BC@FOLDEGFM@?$AAH?$AAO?$AAM?$AAE?$AAP?$AAA?$AAT?$AAH?$AA?$AA@
0x1800059F0: "__cdecl _imp_EnterCriticalSection" __imp_EnterCriticalSection
0x180002CA4: "__cdecl decode_pointer" _decode_pointer
0x180006B50: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-util-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-util-l1-1-0
0x180005860: api-ms-win-core-errorhandling-l1-1-0_NULL_THUNK_DATA
0x180005900: api-ms-win-core-kernel32-legacy-l1-1-0_NULL_THUNK_DATA
0x180005958: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x18000A070: "__cdecl _imp_LoadUserProfileW" __imp_LoadUserProfileW
0x180006728: "__cdecl _DELAY_IMPORT_DESCRIPTOR_USERENV_dll" __DELAY_IMPORT_DESCRIPTOR_USERENV_dll
0x18000A010: "__cdecl _imp_GetUserNameExW" __imp_GetUserNameExW
0x180002DB8: DllMain
0x180003102: "__cdecl _imp_load_SystemFunction041" __imp_load_SystemFunction041
0x180005A50: api-ms-win-core-util-l1-1-0_NULL_THUNK_DATA
0x18000A050: SspiCli_NULL_THUNK_DATA_DLA
0x1800032C4: "__cdecl _GSHandlerCheck_SEH" __GSHandlerCheck_SEH
0x1800057F0: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x180005980: "__cdecl _imp_ResumeThread" __imp_ResumeThread
0x1800059D0: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x180005910: api-ms-win-core-libraryloader-l1-2-0_NULL_THUNK_DATA
0x180002B44: "__cdecl _DllMainCRTStartup" __DllMainCRTStartup
0x180006980: CRYPTBASE_NULL_THUNK_DATA_DLB
0x180005920: "__cdecl _imp_WriteProcessMemory" __imp_WriteProcessMemory
0x180005840: "__cdecl _imp_GetLastError" __imp_GetLastError
0x180005870: "__cdecl _imp_DuplicateHandle" __imp_DuplicateHandle
0x1800045B4: SlpGetPeb32Address
0x18000323C: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x180002990: ServiceHandler
0x180005C28: "SECLOGON" ??_C@_1BC@HDPGMCHB@?$AAS?$AAE?$AAC?$AAL?$AAO?$AAG?$AAO?$AAN?$AA?$AA@
0x180005AB8: "__cdecl _imp_RtlAdjustPrivilege" __imp_RtlAdjustPrivilege
0x180006C2C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-0
0x180005940: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x1800086A8: g_waitObject
0x180005FCC: "__cdecl _ResolveDelayLoadedAPIFlags" __ResolveDelayLoadedAPIFlags
0x180006948: SspiCli_NULL_THUNK_DATA_DLB
0x180002FC2: "__cdecl _tailMerge_sspicli_dll" __tailMerge_sspicli_dll
0x180002820: InitGlobalState
0x180006B8C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0
0x18000A008: CRYPTBASE_NULL_THUNK_DATA_DLA
0x180005AC0: "__cdecl _imp_RtlSetEnvironmentVar" __imp_RtlSetEnvironmentVar
0x180005880: "__cdecl _imp_HeapAlloc" __imp_HeapAlloc
0x180006768: "__cdecl _NULL_DELAY_IMPORT_DESCRIPTOR" __NULL_DELAY_IMPORT_DESCRIPTOR
0x1800059A0: "__cdecl _imp_OpenProcess" __imp_OpenProcess
0x180008628: GlobalData
0x180002B00: "__cdecl DllMainCRTStartup" _DllMainCRTStartup
0x1800031F0: NdrServerCallAll
0x180003F94: MakeAuthInfo
0x180005BD8: "MICROSOFT_AUTHENTICATION_PACKAGE" ??_C@_0CG@HOKJPAKA@MICROSOFT_AUTHENTICATION_PACKAGE@
0x180005810: "__cdecl _imp__initterm" __imp__initterm
0x180004220: MySetServiceStopped
0x1800057A0: "__cdecl _imp_RpcImpersonateClient" __imp_RpcImpersonateClient
0x180005848: "__cdecl _imp_SetLastError" __imp_SetLastError
0x180006C18: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-1" __IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-1
0x18000A040: "__cdecl _imp_LsaRegisterLogonProcess" __imp_LsaRegisterLogonProcess
0x180005818: api-ms-win-core-crt-l2-1-0_NULL_THUNK_DATA
0x18000A000: "__cdecl _imp_SystemFunction041" __imp_SystemFunction041
0x180005B20: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x1800057D0: "__cdecl _imp_RpcServerUseProtseqEpW" __imp_RpcServerUseProtseqEpW
0x180005800: api-ms-win-core-crt-l1-1-0_NULL_THUNK_DATA
0x180005970: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x180008698: g_hIOCP
0x180005A60: "__cdecl _imp_GetTokenInformation" __imp_GetTokenInformation
0x18000A060: "__cdecl _imp_CreateEnvironmentBlock" __imp_CreateEnvironmentBlock
0x1800025C0: SvcEntry_Seclogon
0x180005AA8: "__cdecl _imp_RtlNtStatusToDosError" __imp_RtlNtStatusToDosError
0x180003910: DestroyAuthInfo
0x180005A28: api-ms-win-core-sysinfo-l1-1-0_NULL_THUNK_DATA
0x180005B40: "__cdecl _xi_a" __xi_a
0x1800059A8: api-ms-win-core-processthreads-l1-1-1_NULL_THUNK_DATA
0x180005A20: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x180005830: "__cdecl _imp_ResolveDelayLoadedAPI" __imp_ResolveDelayLoadedAPI
0x180005A30: "__cdecl _imp_QueueUserWorkItem" __imp_QueueUserWorkItem
0x180005A80: api-ms-win-security-base-l1-1-0_NULL_THUNK_DATA
0x1800086A0: g_stopServiceEvent
0x180005FB8: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x180006AC4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0
0x180006B14: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-1" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-1
0x180005928: api-ms-win-core-memory-l1-1-0_NULL_THUNK_DATA
0x1800057B8: "__cdecl _imp_RpcRevertToSelfEx" __imp_RpcRevertToSelfEx
0x180005A38: api-ms-win-core-threadpool-legacy-l1-1-0_NULL_THUNK_DATA
0x180005AD8: "__cdecl _imp_RtlFreeSid" __imp_RtlFreeSid
0x180005A40: "__cdecl _imp_EncodePointer" __imp_EncodePointer
0x180006A88: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-l1-1-0
0x180005A00: "__cdecl _imp_DeleteCriticalSection" __imp_DeleteCriticalSection
0x180002C80: "__cdecl _security_check_cookie" __security_check_cookie
0x180005B38: "__cdecl _xc_z" __xc_z
0x1800058C0: "__cdecl _imp_GetQueuedCompletionStatus" __imp_GetQueuedCompletionStatus
0x180006C04: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0
0x180005998: api-ms-win-core-processthreads-l1-1-0_NULL_THUNK_DATA
0x180005990: "__cdecl _imp_CreateProcessAsUserW" __imp_CreateProcessAsUserW
0x1800058C8: api-ms-win-core-io-l1-1-0_NULL_THUNK_DATA
0x180005A18: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x1800058A0: "__cdecl _imp_LocalAlloc" __imp_LocalAlloc
0x1800085D0: "__cdecl _hmod__SspiCli_dll" __hmod__SspiCli_dll
0x180005820: "__cdecl _imp_DelayLoadFailureHook" __imp_DelayLoadFailureHook
0x180005890: "__cdecl _imp_GetProcessHeap" __imp_GetProcessHeap
0x180006790: CRYPTBASE_NULL_THUNK_DATA_DLN
0x180006748: "__cdecl _DELAY_IMPORT_DESCRIPTOR_CRYPTBASE_dll" __DELAY_IMPORT_DESCRIPTOR_CRYPTBASE_dll
0x180005A88: "__cdecl _imp_SetServiceStatus" __imp_SetServiceStatus
0x1800059D8: api-ms-win-core-rtlsupport-l1-1-0_NULL_THUNK_DATA
0x180008028: "__cdecl _dllonexit_data" __dllonexit_data
0x180005C50: "__cdecl _sz_USERENV_dll" __sz_USERENV_dll
0x1800058D8: "__cdecl _imp_CreateJobObjectW" __imp_CreateJobObjectW
0x180006BA0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0
0x1800059B8: api-ms-win-core-profile-l1-1-0_NULL_THUNK_DATA
0x180005B50: "__cdecl _guard_fids_table" __guard_fids_table
0x180003B74: LogonUserWrap
0x1800058E8: "__cdecl _imp_AssignProcessToJobObject" __imp_AssignProcessToJobObject
0x180005070: "__cdecl load_config_used" _load_config_used
0x18000319F: "__cdecl _imp_load_LsaLookupAuthenticationPackage" __imp_load_LsaLookupAuthenticationPackage
0x180005AC8: "__cdecl _imp_RtlCopySid" __imp_RtlCopySid
0x1800067D8: SspiCli_NULL_THUNK_DATA_DLN
0x180005A78: "__cdecl _imp_SetTokenInformation" __imp_SetTokenInformation
0x180005838: api-ms-win-core-delayload-l1-1-1_NULL_THUNK_DATA
0x180005828: api-ms-win-core-delayload-l1-1-0_NULL_THUNK_DATA
0x180004408: ServiceStop
0x180001CE0: SecondaryLogonProcessWatchdogNewProcess
0x180006AEC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-io-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-io-l1-1-0
0x180006B3C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processenvironment-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processenvironment-l1-1-0
0x1800058F0: api-ms-win-core-job-l2-1-0_NULL_THUNK_DATA
0x180005AE0: "__cdecl _imp_NtQueryInformationProcess" __imp_NtQueryInformationProcess
0x180005908: "__cdecl _imp_DisableThreadLibraryCalls" __imp_DisableThreadLibraryCalls
0x180002780: SeclStartRpcServer
0x18000321E: "__cdecl _imp_load_SeciAllocateAndSetIPAddress" __imp_load_SeciAllocateAndSetIPAddress
0x18000310E: "__cdecl _tailMerge_cryptbase_dll" __tailMerge_cryptbase_dll
0x180008690: g_fIsCsInitialized
0x1800059C0: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x1800059B0: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x18000320C: "__cdecl _imp_load_SeciFreeCallContext" __imp_load_SeciFreeCallContext
0x180002CB4: "__cdecl encoded_null" _encoded_null
0x1800059C8: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x180005FD0: "__cdecl _pfnDefaultDliFailureHook2" __pfnDefaultDliFailureHook2
0x180002920: MIDL_user_allocate
0x180002DE0: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x1800031B1: "__cdecl _imp_load_LsaFreeReturnBuffer" __imp_load_LsaFreeReturnBuffer
0x180003954: Free_SECONDARYLOGONINFOW
0x180006B00: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0
0x180002090: To_SECONDARYLOGONINFOW
0x1800086B0: g_fShutdown
0x180002D9F: "__cdecl initterm_e" _initterm_e
0x180006708: "__cdecl _DELAY_IMPORT_DESCRIPTOR_SspiCli_dll" __DELAY_IMPORT_DESCRIPTOR_SspiCli_dll
0x180005B18: ntdll_NULL_THUNK_DATA
0x180004840: StopServiceCallback
0x180003053: "__cdecl _imp_load_GetUserNameExW" __imp_load_GetUserNameExW
0x180006AB0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0
0x1800042D0: SecondaryLogonCleanupJob
0x180008000: "__cdecl _security_cookie" __security_cookie
0x180006970: USERENV_NULL_THUNK_DATA_DLB
0x180005868: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x1800058A8: "__cdecl _imp_LocalFree" __imp_LocalFree
0x180006A9C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0
0x18000A048: "__cdecl _imp_SeciAllocateAndSetIPAddress" __imp_SeciAllocateAndSetIPAddress
0x180006A4C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-crt-l2-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-crt-l2-1-0
0x18000318D: "__cdecl _imp_load_LoadUserProfileW" __imp_load_LoadUserProfileW
0x1800057A8: "__cdecl _imp_I_RpcBindingIsClientLocal" __imp_I_RpcBindingIsClientLocal
0x18000A028: "__cdecl _imp_LsaLookupAuthenticationPackage" __imp_LsaLookupAuthenticationPackage
0x180008694: g_fCleanupThreadActive
0x180005B00: "__cdecl _imp_RtlAllocateAndInitializeSid" __imp_RtlAllocateAndInitializeSid
0x18000A018: "__cdecl _imp_LsaLogonUser" __imp_LsaLogonUser
0x180005850: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x180005960: "__cdecl _imp_GetCurrentThread" __imp_GetCurrentThread
0x180001010: SeclCreateProcessWithLogonW
0x18000A068: "__cdecl _imp_DestroyEnvironmentBlock" __imp_DestroyEnvironmentBlock
0x180002CC4: "__cdecl _security_init_cookie" __security_init_cookie
0x180006B28: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-service-core-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-service-core-l1-1-0
0x180005FC0: "seclogon" ??_C@_08IINNMGNF@seclogon?$AA@
0x1800023B0: WaitForNextJobTermination
0x180006A38: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-crt-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-crt-l1-1-0
0x1800039A8: GetLogonSid
0x180004278: SeclStopRpcServer
0x180006AD8: "__cdecl _IMPORT_DESCRIPTOR_RPCRT4" __IMPORT_DESCRIPTOR_RPCRT4
0x180005AF8: "__cdecl _imp_RtlLengthSid" __imp_RtlLengthSid
0x1800057E0: RPCRT4_NULL_THUNK_DATA
0x180002E30: "__cdecl _report_gsfailure" __report_gsfailure
0x180005968: "__cdecl _imp_UpdateProcThreadAttribute" __imp_UpdateProcThreadAttribute
0x1800059E0: "__cdecl _imp_LeaveCriticalSection" __imp_LeaveCriticalSection
0x180003083: "__cdecl _tailMerge_userenv_dll" __tailMerge_userenv_dll
0x18000A020: "__cdecl _imp_LsaFreeReturnBuffer" __imp_LsaFreeReturnBuffer
0x180002FB6: "__cdecl _imp_load_LsaRegisterLogonProcess" __imp_load_LsaRegisterLogonProcess
0x180006A74: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-memory-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-memory-l1-1-0
0x180005950: "__cdecl _imp_OpenThreadToken" __imp_OpenThreadToken
0x18000A038: "__cdecl _imp_SeciFreeCallContext" __imp_SeciFreeCallContext
0x180005AE8: "__cdecl _imp_RtlInitializeSid" __imp_RtlInitializeSid
0x180005CE8: "HOMEDRIVE" ??_C@_1BE@DIJOKLDI@?$AAH?$AAO?$AAM?$AAE?$AAD?$AAR?$AAI?$AAV?$AAE?$AA?$AA@
0x1800058B8: "__cdecl _imp_CreateIoCompletionPort" __imp_CreateIoCompletionPort
0x180005BC8: "Negotiate" ??_C@_09OBFLGEDM@Negotiate?$AA@
0x180006B64: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0
0x1800057C0: "__cdecl _imp_NdrServerCall2" __imp_NdrServerCall2
0x180005988: "__cdecl _imp_OpenProcessToken" __imp_OpenProcessToken
0x180005A10: api-ms-win-core-synch-l1-1-0_NULL_THUNK_DATA
0x180003230: memset
0x180006C40: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x18000A058: "__cdecl _imp_UnloadUserProfile" __imp_UnloadUserProfile
0x18000A078: USERENV_NULL_THUNK_DATA_DLA

[JEB Decompiler by PNF Software]