Generated by JEB on 2019/08/01

PE: C:\Windows\System32\srclient.dll Base=0x180000000 SHA-256=F2C700EB3249636174704D8D7B248380E5B5704D96C327404E4B57206557B155
PDB: srclient.pdb GUID={FB65149C-6761-5E4D-5E981406BB4CFC47} Age=1

498 located named symbols:
0x18000E950: s_cszSRRegKey
0x1800125B8: ?ObjectTypeSystemLock@?A0x2c06287a@@3U_RTL_CRITICAL_SECTION@@A
0x18000E158: "__cdecl _imp_UnregisterTraceGuids" __imp_UnregisterTraceGuids
0x18000D74C: "__cdecl _raise_securityfailure" __raise_securityfailure
0x18000E350: POWRPROF_NULL_THUNK_DATA
0x18000F6C8: "raw" ??_C@_17EBOIPCKB@?$AAr?$AAa?$AAw?$AA?$AA@
0x18000D560: "__cdecl FindPESection" _FindPESection
0x18000FA58: "SxDeleteFile" ??_C@_0N@JNEKLOOJ@SxDeleteFile?$AA@
0x1800089F0: "long __cdecl SxCheckSupportedFsType(unsigned short const * __ptr64)" ?SxCheckSupportedFsType@@YAJPEBG@Z
0x18000E200: "__cdecl _imp_AllocateAndInitializeSid" __imp_AllocateAndInitializeSid
0x18000E4B0: "__cdecl _imp_CoInitializeEx" __imp_CoInitializeEx
0x180010A20: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x18000F3D8: "SeTakeOwnershipPrivilege" ??_C@_1DC@DAFGHJAD@?$AAS?$AAe?$AAT?$AAa?$AAk?$AAe?$AAO?$AAw?$AAn?$AAe?$AAr?$AAs?$AAh?$AAi?$AAp?$AAP?$AAr?$AAi?$AAv?$AAi?$AAl?$AAe?$AAg?$AAe?$AA?$AA@
0x180006B74: WPP_SF_sdsdd
0x18000F6D0: "fat" ??_C@_17KLKMGCJO@?$AAf?$AAa?$AAt?$AA?$AA@
0x18000E258: "__cdecl _imp_IsWow64Process" __imp_IsWow64Process
0x18000EF98: "_SRRemoveRestorePoint" ??_C@_0BG@ENEFCPJF@_SRRemoveRestorePoint?$AA@
0x18000F350: "SrInternalSysprepCleanup" ??_C@_0BJ@CHMBBELK@SrInternalSysprepCleanup?$AA@
0x180012020: "__cdecl _security_cookie_complement" __security_cookie_complement
0x18000CB00: "public: long __cdecl CBsString::ExpandEnvironmentStringsW(unsigned short const * __ptr64) __ptr64" ?ExpandEnvironmentStringsW@CBsString@@QEAAJPEBG@Z
0x18000F998: "CSxDiagnostics::Initialize" ??_C@_0BL@GPPPDOLL@CSxDiagnostics?3?3Initialize?$AA@
0x18000E398: "__cdecl _imp__vscwprintf" __imp__vscwprintf
0x180008614: "long __cdecl SxOpenThreadOrProcessToken(unsigned long,void * __ptr64 * __ptr64)" ?SxOpenThreadOrProcessToken@@YAJKPEAPEAX@Z
0x1800109F8: "__cdecl _IMPORT_DESCRIPTOR_SPP" __IMPORT_DESCRIPTOR_SPP
0x18000E290: "__cdecl _imp_DeviceIoControl" __imp_DeviceIoControl
0x18000FB48: "SrTranslatePath" ??_C@_0BA@LHHGELEA@SrTranslatePath?$AA@
0x1800069F0: "unsigned long __cdecl SysprepGeneralize(void)" ?SysprepGeneralize@@YAKXZ
0x18000F270: "Log_SR_INFO_REMOVERESTOREPOINT_S" ??_C@_0CI@GOFJNLEF@Log_SR_INFO_REMOVERESTOREPOINT_S@
0x180007C50: "long __cdecl SxQueryGroupPolicy(unsigned short const * __ptr64,unsigned short const * __ptr64,int * __ptr64)" ?SxQueryGroupPolicy@@YAJPEBG0PEAH@Z
0x18000ECE0: c_wszRestoreStatusRestore
0x18000D01C: "__cdecl CRT_INIT" _CRT_INIT
0x18000E2B0: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x1800011CC: WPP_SF_L
0x180003478: "long __cdecl ReadState(struct _SR_STATE * __ptr64)" ?ReadState@@YAJPEAU_SR_STATE@@@Z
0x180001010: WppControlCallback
0x18000F300: WPP_46ca1894a09d3ec50a13276250b01e75_Traceguids
0x18000D9C0: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x18000E248: "__cdecl _imp_CreateFileW" __imp_CreateFileW
0x18000F410: "SrInternalSysprepGeneralize" ??_C@_0BM@NKDMJAKE@SrInternalSysprepGeneralize?$AA@
0x18000F248: "Log_SR_INFO_CREATERESTOREPOINT_S" ??_C@_0CH@PHIGJCCJ@Log_SR_INFO_CREATERESTOREPOINT_S@
0x18000F068: "ReadState" ??_C@_09JKHIDOJK@ReadState?$AA@
0x18000EC20: WPP_ThisDir_CTLGUID_ControlGuid
0x18000E9D0: c_wszRestorePointCreationFrequencyWU
0x1800096C4: "long __cdecl SxGetSystemDirVolumeSize(unsigned __int64 * __ptr64)" ?SxGetSystemDirVolumeSize@@YAJPEA_K@Z
0x18000F188: WPP_ce1fb33321ab3c7de57f155a0b21f88c_Traceguids
0x180002F70: DisableSR
0x18000EF18: "_GetCurrentProcessName" ??_C@_0BH@HDLDEEON@_GetCurrentProcessName?$AA@
0x18000F488: WPP_37d9a2896bad3495ee15cb8430de76ce_Traceguids
0x180001280: WPP_SF_ddI
0x18000E3F8: "__cdecl _imp_wcschr" __imp_wcschr
0x18000EEE8: c_wszStartNesting
0x18000E4E0: ole32_NULL_THUNK_DATA
0x180007314: "long __cdecl SxRegReadString(struct HKEY__ * __ptr64,unsigned short const * __ptr64,class CBsString * __ptr64)" ?SxRegReadString@@YAJPEAUHKEY__@@PEBGPEAVCBsString@@@Z
0x18000E428: "__cdecl _imp_RtlGetNtSystemRoot" __imp_RtlGetNtSystemRoot
0x18000E4F0: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x180012620: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxuyzhvUhgliUhcUfgrohUlyquivUznwGEUfgrohsOlyq@exutils" __@@_PchSym_@00@KxulyqvxgPillgKxuyzhvUhgliUhcUfgrohUlyquivUznwGEUfgrohsOlyq@exutils
0x18000CD68: RtlpQueryDiskSpacePolicyByHandle
0x18000FA90: "SxSetFileAttributes" ??_C@_0BE@IIHJLHHB@SxSetFileAttributes?$AA@
0x18000E388: "__cdecl _imp__wcsnicmp" __imp__wcsnicmp
0x18000F660: "SxOpenThreadOrProcessToken" ??_C@_0BL@GNHLCEPO@SxOpenThreadOrProcessToken?$AA@
0x18000AD94: "long __cdecl SrConvertSppGroupToSrRpProp(enum _SR_RESTORE_SOURCE,struct _SPP_GROUP_PROP const * __ptr64,struct _SR_RP_PROP * __ptr64)" ?SrConvertSppGroupToSrRpProp@@YAJW4_SR_RESTORE_SOURCE@@PEBU_SPP_GROUP_PROP@@PEAU_SR_RP_PROP@@@Z
0x18000D548: "__cdecl XcptFilter" _XcptFilter
0x18000E4F8: "__cdecl _xc_a" __xc_a
0x18000FCC0: "\??\%s" ??_C@_1O@PAJNNBDG@?$AA?2?$AA?$DP?$AA?$DP?$AA?2?$AA?$CF?$AAs?$AA?$AA@
0x18000E370: "__cdecl _imp_SppFreeGroupPropArray" __imp_SppFreeGroupPropArray
0x18000E2D8: "__cdecl _imp_FindClose" __imp_FindClose
0x18000EC50: s_cszDisableSR
0x18000F2B8: "Log_SR_INFO_ENABLESR_SUCCEEDS" ??_C@_0BO@MFIMKIEP@Log_SR_INFO_ENABLESR_SUCCEEDS?$AA@
0x18000D53C: "__cdecl callnewh" _callnewh
0x18000E280: "__cdecl _imp_DeleteFileW" __imp_DeleteFileW
0x18000F790: "::GetVolumePathName( strPath, ST" ??_C@_0EA@DOABPAFE@?3?3GetVolumePathName?$CI?5strPath?0?5ST@
0x18000D99D: memcpy
0x18000367C: "long __cdecl WriteState(struct _SR_STATE * __ptr64)" ?WriteState@@YAJPEAU_SR_STATE@@@Z
0x18000F4A8: "SxRegReadULONGLONG" ??_C@_0BD@IOJKFFFM@SxRegReadULONGLONG?$AA@
0x18000FBD0: "\Registry\Machine\SYSTEM\Current" ??_C@_1IG@EPMAHCPK@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x18000E390: "__cdecl _imp_memset" __imp_memset
0x18000D71F: "__cdecl initterm" _initterm
0x18000E160: "__cdecl _imp_TraceMessage" __imp_TraceMessage
0x180012658: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x18000E2C8: "__cdecl _imp_Sleep" __imp_Sleep
0x18000CA68: "public: void __cdecl CBsString::Transfer(class CBsString * __ptr64) __ptr64" ?Transfer@CBsString@@QEAAXPEAV1@@Z
0x18000F620: "RPSessionInterval" ??_C@_1CE@NALCDHCL@?$AAR?$AAP?$AAS?$AAe?$AAs?$AAs?$AAi?$AAo?$AAn?$AAI?$AAn?$AAt?$AAe?$AAr?$AAv?$AAa?$AAl?$AA?$AA@
0x18000E518: "__cdecl _xi_z" __xi_z
0x18000E228: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x18000E320: "__cdecl _imp_GetCommandLineW" __imp_GetCommandLineW
0x18000D72B: "__cdecl _C_specific_handler" __C_specific_handler
0x180012608: WPP_REGISTRATION_GUIDS
0x18000F1E8: "Log_SR_ERROR_CREATERESTOREPOINT_" ??_C@_0CG@KFNGIJGP@Log_SR_ERROR_CREATERESTOREPOINT_@
0x18000F648: "SxIsAdminOrSystem" ??_C@_0BC@NFFEBLIO@SxIsAdminOrSystem?$AA@
0x18000D530: malloc
0x180007510: "long __cdecl SxRegReadMultiStringAsBlob(struct HKEY__ * __ptr64,unsigned short const * __ptr64,unsigned char * __ptr64 * __ptr64,unsigned long * __ptr64)" ?SxRegReadMultiStringAsBlob@@YAJPEAUHKEY__@@PEBGPEAPEAEPEAK@Z
0x18000F74C: "dwErr" ??_C@_05HABMCAIK@dwErr?$AA@
0x18000E178: "__cdecl _imp_RegCloseKey" __imp_RegCloseKey
0x18000E268: "__cdecl _imp_GetVolumeInformationW" __imp_GetVolumeInformationW
0x18000D93C: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x1800032C0: SRNewSystemId
0x18000F948: "\\?\Volume%s" ??_C@_1BK@PNKBDPMP@?$AA?2?$AA?2?$AA?$DP?$AA?2?$AAV?$AAo?$AAl?$AAu?$AAm?$AAe?$AA?$CF?$AAs?$AA?$AA@
0x1800125E0: WPP_MAIN_CB
0x18000F470: "FAILED[TRACK]" ??_C@_0O@HMCJKGCN@FAILED?$FLTRACK?$FN?$AA@
0x18000E710: s_cszSRSetupLastRegKey
0x18000F198: "EnableVolume" ??_C@_0N@BGFPAJHI@EnableVolume?$AA@
0x18000E1A8: "__cdecl _imp_RegSetValueExW" __imp_RegSetValueExW
0x18000D554: "__cdecl amsg_exit" _amsg_exit
0x18000E3C8: "__cdecl _imp__callnewh" __imp__callnewh
0x18000F4F0: "SxRegReadMultiString" ??_C@_0BF@BEFHNIFA@SxRegReadMultiString?$AA@
0x18000FA08: "(Leave)" ??_C@_1BA@HNMMKEFI@?$AA?$CI?$AAL?$AAe?$AAa?$AAv?$AAe?$AA?$CJ?$AA?$AA@
0x1800071EC: "long __cdecl SxRegReadULONGLONG(struct HKEY__ * __ptr64,unsigned short const * __ptr64,unsigned __int64 * __ptr64,int)" ?SxRegReadULONGLONG@@YAJPEAUHKEY__@@PEBGPEA_KH@Z
0x18000E460: "__cdecl _imp_RtlSetThreadErrorMode" __imp_RtlSetThreadErrorMode
0x1800087EC: "long __cdecl SxCheckWow64(int * __ptr64)" ?SxCheckWow64@@YAJPEAH@Z
0x18000F390: "D:P(A;OICI;GA;;;SY)(A;OICI;GA;;;" ??_C@_1EI@GMNPGAMC@?$AAD?$AA?3?$AAP?$AA?$CI?$AAA?$AA?$DL?$AAO?$AAI?$AAC?$AAI?$AA?$DL?$AAG?$AAA?$AA?$DL?$AA?$DL?$AA?$DL?$AAS?$AAY?$AA?$CJ?$AA?$CI?$AAA?$AA?$DL?$AAO?$AAI?$AAC?$AAI?$AA?$DL?$AAG?$AAA?$AA?$DL?$AA?$DL?$AA?$DL@
0x18000EF08: "_CheckPolicy" ??_C@_0N@NIMNEGMH@_CheckPolicy?$AA@
0x18000EF30: "_DisableSR" ??_C@_0L@OEMALKOF@_DisableSR?$AA@
0x180005AA8: ?Release@?$CSxArrayBuilder@PEAG$1?Free_String@@YAXPEAPEAG@Z$1??$SxDefaultInit@PEAG@@YAX0@Z$1??$SxDefaultTransfer@PEAG@@YAX00@Z@@QEAAKXZ
0x1800079B4: "long __cdecl SxRegWriteMultiString(struct HKEY__ * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64)" ?SxRegWriteMultiString@@YAJPEAUHKEY__@@PEBG1@Z
0x18000E590: GUID_NULL
0x18000EDD8: c_wszFirstRun
0x180012618: "int g_fAmWow64Cached" ?g_fAmWow64Cached@@3HA
0x18000FB58: "SrPublishRPCreationSQM" ??_C@_0BH@KGHGDABC@SrPublishRPCreationSQM?$AA@
0x18000F140: "CreateRestorePoint" ??_C@_0BD@DOJFGDBH@CreateRestorePoint?$AA@
0x18000F530: "SxRegWriteMultiString" ??_C@_0BG@NOFGJMJ@SxRegWriteMultiString?$AA@
0x180009E50: "public: long __cdecl CSxDiagnostics::Initialize(unsigned short const * __ptr64) __ptr64" ?Initialize@CSxDiagnostics@@QEAAJPEBG@Z
0x18000E490: "__cdecl _imp_RtlInitializeCriticalSection" __imp_RtlInitializeCriticalSection
0x18000F558: "SxRegDeleteValue" ??_C@_0BB@KFJBEPMF@SxRegDeleteValue?$AA@
0x18000F878: " " ??_C@_13HOIJIPNN@?$AA?5?$AA?$AA@
0x18000E4B8: "__cdecl _imp_CoUninitialize" __imp_CoUninitialize
0x180002E80: EnableSREx
0x18000FA18: "CSxDiagnostics::LogDiagnostic" ??_C@_0BO@PEFPOGFG@CSxDiagnostics?3?3LogDiagnostic?$AA@
0x18000E150: "__cdecl _imp_GetTraceLoggerHandle" __imp_GetTraceLoggerHandle
0x18000E148: "__cdecl _imp_GetTraceEnableLevel" __imp_GetTraceEnableLevel
0x18000E450: "__cdecl _imp_NtQueryInformationFile" __imp_NtQueryInformationFile
0x18000E238: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x18000F120: "CreateRestorePointWithRetry" ??_C@_0BM@HDEPJIAL@CreateRestorePointWithRetry?$AA@
0x180004C84: "long __cdecl DeleteRestorePoint(unsigned long,int,class CBsString * __ptr64)" ?DeleteRestorePoint@@YAJKHPEAVCBsString@@@Z
0x18000C710: "public: long __cdecl CBsString::Set(unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64) __ptr64" ?Set@CBsString@@QEAAJPEBG000@Z
0x18000FAF0: "SrConvertSppGroupToSrRpProp" ??_C@_0BM@EPMMOJFJ@SrConvertSppGroupToSrRpProp?$AA@
0x180012648: "__cdecl _native_startup_lock" __native_startup_lock
0x18000FB90: "private: static unsigned short const * const CBsString::s_wszEmpty" ?s_wszEmpty@CBsString@@0QBGB
0x180001098: DllMain
0x1800088D4: "long __cdecl SxCheckSupportedDriveType(unsigned short const * __ptr64)" ?SxCheckSupportedDriveType@@YAJPEBG@Z
0x180003424: WPP_SF_ii
0x18000C8F4: "public: long __cdecl CBsString::Append(unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64) __ptr64" ?Append@CBsString@@QEAAJPEBG00@Z
0x180012624: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUhgliUhcUyhhgirmtUlyquivUznwGEUhgwzucOlyq@bsstring" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUhgliUhcUyhhgirmtUlyquivUznwGEUhgwzucOlyq@bsstring
0x18000EB88: s_cszAoACAPIResult
0x18000E3F0: "__cdecl _imp__wcsicmp" __imp__wcsicmp
0x18000AA84: "long __cdecl SxLogEvent(unsigned short const * __ptr64,unsigned long,unsigned short,unsigned short,unsigned short const * __ptr64 * __ptr64 const,struct SX_EVENT_LOG_BINARY_DATA const * __ptr64)" ?SxLogEvent@@YAJPEBGKGGQEAPEBGPEBUSX_EVENT_LOG_BINARY_DATA@@@Z
0x18000E3A8: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x1800070A4: "long __cdecl SxRegReadDWORD(struct HKEY__ * __ptr64,unsigned short const * __ptr64,unsigned long * __ptr64,int)" ?SxRegReadDWORD@@YAJPEAUHKEY__@@PEBGPEAKH@Z
0x18000F8F8: "SxQueryPersistentVolumeState" ??_C@_0BN@GFPMMBIA@SxQueryPersistentVolumeState?$AA@
0x18000E318: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x18000ED10: c_wszRestoreStatusTimeStamp
0x18000E340: KERNEL32_NULL_THUNK_DATA
0x180003B00: "long __cdecl ResetNestingCount(void)" ?ResetNestingCount@@YAJXZ
0x18000EF40: "_EnableSREx" ??_C@_0M@OAANDJDN@_EnableSREx?$AA@
0x1800076F4: "long __cdecl SxRegReadMultiString(struct HKEY__ * __ptr64,unsigned short const * __ptr64,unsigned short * __ptr64 * __ptr64)" ?SxRegReadMultiString@@YAJPEAUHKEY__@@PEBGPEAPEAG@Z
0x18000E2E0: "__cdecl _imp_GetLastError" __imp_GetLastError
0x18000CF9C: "void * __ptr64 __cdecl operator new(unsigned __int64)" ??2@YAPEAX_K@Z
0x180012010: "__cdecl _native_dllmain_reason" __native_dllmain_reason
0x18000D918: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x18000E470: "__cdecl _imp_EtwTraceMessage" __imp_EtwTraceMessage
0x180008C30: GetLastFailureAsHRESULT
0x18000F210: "%#8x" ??_C@_19IEFKDHBL@?$AA?$CF?$AA?$CD?$AA8?$AAx?$AA?$AA@
0x18000F570: "Software\Microsoft\Windows NT\Cu" ??_C@_1HG@FDPPJLPH@?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAN?$AAT?$AA?2?$AAC?$AAu@
0x18000C6DC: "public: long __cdecl CBsString::Format(unsigned short const * __ptr64,...) __ptr64" ?Format@CBsString@@QEAAJPEBGZZ
0x18000E3D0: "__cdecl _imp_strchr" __imp_strchr
0x18000F600: "SxUpdateSystemRestoreEnabled" ??_C@_0BN@IILMDDIN@SxUpdateSystemRestoreEnabled?$AA@
0x18000FAE0: "(null)" ??_C@_1O@CEDCILHN@?$AA?$CI?$AAn?$AAu?$AAl?$AAl?$AA?$CJ?$AA?$AA@
0x180008358: "long __cdecl SxIsAdminOrSystem(void)" ?SxIsAdminOrSystem@@YAJXZ
0x18000F9B8: "disabled" ??_C@_1BC@LGPIFEA@?$AAd?$AAi?$AAs?$AAa?$AAb?$AAl?$AAe?$AAd?$AA?$AA@
0x180010A48: "__cdecl _IMPORT_DESCRIPTOR_ADVAPI32" __IMPORT_DESCRIPTOR_ADVAPI32
0x18000EF50: "SetSRInitialState" ??_C@_0BC@PCKGOPNA@SetSRInitialState?$AA@
0x18000F048: "NULL" ??_C@_19CIJIHAKK@?$AAN?$AAU?$AAL?$AAL?$AA?$AA@
0x18000E2B8: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x180006074: "long __cdecl DeleteMachineGuidFile(void)" ?DeleteMachineGuidFile@@YAJXZ
0x18000E1B8: "__cdecl _imp_RegDeleteValueW" __imp_RegDeleteValueW
0x18000C9A8: "private: long __cdecl CBsString::_Append(unsigned long,unsigned long,unsigned long * __ptr64 const,unsigned short const * __ptr64 * __ptr64 const) __ptr64" ?_Append@CBsString@@AEAAJKKQEAKQEAPEBG@Z
0x18000D610: "__cdecl ValidateImageBase" _ValidateImageBase
0x18000F9E0: "SrCreateRp" ??_C@_1BG@PGIPNPGL@?$AAS?$AAr?$AAC?$AAr?$AAe?$AAa?$AAt?$AAe?$AAR?$AAp?$AA?$AA@
0x180003944: "long __cdecl GetTimeNow(unsigned __int64 * __ptr64)" ?GetTimeNow@@YAJPEA_K@Z
0x18000F098: "CheckTimeout" ??_C@_0N@ELCBCFDB@CheckTimeout?$AA@
0x18000F0C0: "CheckSkipRestorePointCreation" ??_C@_0BO@DOKPDIGN@CheckSkipRestorePointCreation?$AA@
0x1800057E0: "long __cdecl IsSRDisabled(int)" ?IsSRDisabled@@YAJH@Z
0x18000F918: "?:" ??_C@_15CEIHPDOB@?$AA?$DP?$AA?3?$AA?$AA@
0x1800031C0: SRSetRestorePointInternal
0x180003BE8: "long __cdecl CheckSkipRestorePointCreation(unsigned long,unsigned long,struct _SR_RP_PROP * __ptr64,unsigned char * __ptr64,unsigned long * __ptr64)" ?CheckSkipRestorePointCreation@@YAJKKPEAU_SR_RP_PROP@@PEAEPEAK@Z
0x180002EF0: EnableSRInternal
0x180009C04: "long __cdecl SxQueryIsSystemWimBooted(int * __ptr64)" ?SxQueryIsSystemWimBooted@@YAJPEAH@Z
0x18000E5A0: "\" ??_C@_13FPGAJAPJ@?$AA?2?$AA?$AA@
0x18000335C: WPP_SF_
0x18000E2A0: "__cdecl _imp_GetVolumeNameForVolumeMountPointW" __imp_GetVolumeNameForVolumeMountPointW
0x18000F8C0: "SxQueryVolumeSpace" ??_C@_0BD@HICJDHED@SxQueryVolumeSpace?$AA@
0x18000F370: "DeleteMachineGuidFile" ??_C@_0BG@CAHEJDBE@DeleteMachineGuidFile?$AA@
0x180010A34: "__cdecl _IMPORT_DESCRIPTOR_ole32" __IMPORT_DESCRIPTOR_ole32
0x180007BA0: "long __cdecl SxRegDeleteValue(struct HKEY__ * __ptr64,unsigned short const * __ptr64)" ?SxRegDeleteValue@@YAJPEAUHKEY__@@PEBG@Z
0x18000D260: "__cdecl DllMainCRTStartup" _DllMainCRTStartup
0x18000EC30: s_cszDisableConfig
0x18000E3B0: "__cdecl _imp__initterm" __imp__initterm
0x18000E270: "__cdecl _imp_GetDiskFreeSpaceExW" __imp_GetDiskFreeSpaceExW
0x18000E360: "__cdecl _imp_SxTracerDebuggerBreak" __imp_SxTracerDebuggerBreak
0x18000B5D4: "long __cdecl SrValidateRestorePoint(struct _SR_RP_PROP const * __ptr64,int)" ?SrValidateRestorePoint@@YAJPEBU_SR_RP_PROP@@H@Z
0x18000E4D8: "__cdecl _imp_StringFromGUID2" __imp_StringFromGUID2
0x18000E308: "__cdecl _imp_SetLastError" __imp_SetLastError
0x18000E670: s_cszSRUnattendKey
0x18000ABD0: "void __cdecl Free_SPP_CLIENT_PROP(struct _SPP_CLIENT_PROP * __ptr64)" ?Free_SPP_CLIENT_PROP@@YAXPEAU_SPP_CLIENT_PROP@@@Z
0x180008B70: "long __cdecl SxCheckSupportedVolumeSize(unsigned short const * __ptr64)" ?SxCheckSupportedVolumeSize@@YAJPEBG@Z
0x18000E328: "__cdecl _imp_GetModuleFileNameW" __imp_GetModuleFileNameW
0x180012610: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUhgliUhcUgizxrmtUlyquivUznwGEUhgwzucOlyq@tracing" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUhgliUhcUgizxrmtUlyquivUznwGEUhgwzucOlyq@tracing
0x1800078F8: "long __cdecl SxRegWriteULONGLONG(struct HKEY__ * __ptr64,unsigned short const * __ptr64,unsigned __int64)" ?SxRegWriteULONGLONG@@YAJPEAUHKEY__@@PEBG_K@Z
0x18000C884: "public: long __cdecl CBsString::Append(unsigned short const * __ptr64,unsigned short const * __ptr64) __ptr64" ?Append@CBsString@@QEAAJPEBG0@Z
0x18000F078: "WriteState" ??_C@_0L@HILFOLJI@WriteState?$AA@
0x18000F6D8: "fat32" ??_C@_1M@INLGEFHF@?$AAf?$AAa?$AAt?$AA3?$AA2?$AA?$AA@
0x18000F328: "SrCleanupRegistry" ??_C@_0BC@GDBPCPDA@SrCleanupRegistry?$AA@
0x18000E358: "__cdecl _imp_SxTracerShouldTrackFailure" __imp_SxTracerShouldTrackFailure
0x180012638: "__cdecl _onexitend" __onexitend
0x18000E410: "__cdecl _imp_NtCreateFile" __imp_NtCreateFile
0x18000E1D0: "__cdecl _imp_AdjustTokenPrivileges" __imp_AdjustTokenPrivileges
0x18000EBA8: c_wszRestoreStatusResult
0x18000E4E8: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x18000F690: "SxCheckSupportedDriveType" ??_C@_0BK@FMDKAOMM@SxCheckSupportedDriveType?$AA@
0x18000F680: "SxCheckWow64" ??_C@_0N@ENPLHPCN@SxCheckWow64?$AA@
0x180008574: "long __cdecl SxCopyString(unsigned short const * __ptr64,unsigned short * __ptr64 * __ptr64)" ?SxCopyString@@YAJPEBGPEAPEAG@Z
0x18000E2F0: "__cdecl _imp_FindFirstFileW" __imp_FindFirstFileW
0x18000F468: "NULL" ??_C@_04HIBGFPH@NULL?$AA@
0x18000E240: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x18000F8D8: "SxGetSystemDirVolumeSize" ??_C@_0BJ@NNNPGGPF@SxGetSystemDirVolumeSize?$AA@
0x18000F480: "FAILED" ??_C@_06OHCJKBJM@FAILED?$AA@
0x1800082CC: HRESULTFromNTSTATUS
0x18000E208: "__cdecl _imp_RegisterEventSourceW" __imp_RegisterEventSourceW
0x18000AC50: "void __cdecl Free_SR_ENVIRONMENT_PROP(struct _SR_ENVIRONMENT_PROP * __ptr64)" ?Free_SR_ENVIRONMENT_PROP@@YAXPEAU_SR_ENVIRONMENT_PROP@@@Z
0x18000E468: "__cdecl _imp_RtlNtStatusToDosError" __imp_RtlNtStatusToDosError
0x18000EBD0: c_wszSystemRestoreTempPath
0x180003FA8: "long __cdecl CreateRestorePointHelper(unsigned long,unsigned short const * __ptr64,unsigned long * __ptr64,int,int * __ptr64)" ?CreateRestorePointHelper@@YAJKPEBGPEAKHPEAH@Z
0x18000E508: "__cdecl _xi_a" __xi_a
0x18000E260: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x180006900: "long __cdecl SrInvokeWithinCoInitialize(long (__cdecl*)(void))" ?SrInvokeWithinCoInitialize@@YAJP6AJXZ@Z
0x18000C410: "private: static long __cdecl CBsString::_AllocateData(unsigned long,unsigned short * __ptr64 * __ptr64,unsigned long * __ptr64)" ?_AllocateData@CBsString@@CAJKPEAPEAGPEAK@Z
0x18000E190: "__cdecl _imp_SetNamedSecurityInfoW" __imp_SetNamedSecurityInfoW
0x1800059B4: ?Append@?$CSxArrayBuilder@PEAG$1?Free_String@@YAXPEAPEAG@Z$1??$SxDefaultInit@PEAG@@YAX0@Z$1??$SxDefaultTransfer@PEAG@@YAX00@Z@@QEAAJPEAPEAG@Z
0x18000F988: WPP_245ca6ba484f3b877d348a92c59d10f2_Traceguids
0x18000EA80: c_wszLastRestoreId
0x18000F100: "SystemRestore" ??_C@_1BM@KICGOAAP@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAe?$AAs?$AAt?$AAo?$AAr?$AAe?$AA?$AA@
0x18000CE1C: RtlpQueryDiskSpacePolicy
0x18000E2A8: "__cdecl _imp_QueryDosDeviceW" __imp_QueryDosDeviceW
0x18000E4A8: "__cdecl _imp_CoTaskMemFree" __imp_CoTaskMemFree
0x18000F758: WPP_fe0b416e53013f034f3eec1b5711a87b_Traceguids
0x180008018: WPP_SF_dD
0x180004ECC: WPP_SF_dd
0x18000E438: "__cdecl _imp_RtlRunOnceExecuteOnce" __imp_RtlRunOnceExecuteOnce
0x180006FEC: "public: long __cdecl CSxFunctionTracer::LogEvent(unsigned short const * __ptr64,unsigned long,unsigned short,unsigned long,unsigned short,unsigned short const * __ptr64 * __ptr64 const)const __ptr64" ?LogEvent@CSxFunctionTracer@@QEBAJPEBGKGKGQEAPEBG@Z
0x18000F830: "::GetVolumeNameForVolumeMountPoi" ??_C@_0EH@IPBHDHIB@?3?3GetVolumeNameForVolumeMountPoi@
0x180012000: WPP_GLOBAL_Control
0x18000C7E0: "public: long __cdecl CBsString::Set(struct _GUID const & __ptr64) __ptr64" ?Set@CBsString@@QEAAJAEBU_GUID@@@Z
0x18000F440: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x18000CC40: RtlpTestHookInitialize
0x180003320: WPP_SF_d
0x180003320: WPP_SF_D
0x18000E418: "__cdecl _imp_NtQueryVolumeInformationFile" __imp_NtQueryVolumeInformationFile
0x180012660: "__cdecl pRawDllMain" _pRawDllMain
0x18000782C: "long __cdecl SxRegWriteDWORD(struct HKEY__ * __ptr64,unsigned short const * __ptr64,unsigned long)" ?SxRegWriteDWORD@@YAJPEAUHKEY__@@PEBGK@Z
0x18000EFC0: "__cdecl GUID_adcf3f49_521f_48a6_babc_8e20d5d3e861" _GUID_adcf3f49_521f_48a6_babc_8e20d5d3e861
0x18000E440: "__cdecl _imp_WinSqmAddToStreamEx" __imp_WinSqmAddToStreamEx
0x18000E338: "__cdecl _imp_GetDriveTypeW" __imp_GetDriveTypeW
0x18000E480: "__cdecl _imp_RtlSetCurrentTransaction" __imp_RtlSetCurrentTransaction
0x18000CF90: "void __cdecl operator delete(void * __ptr64)" ??3@YAXPEAX@Z
0x18000AB60: "void __cdecl Free_StringArray(unsigned long * __ptr64,unsigned short * __ptr64 * __ptr64 * __ptr64)" ?Free_StringArray@@YAXPEAKPEAPEAPEAG@Z
0x18000F0A8: "ResetNestingCount" ??_C@_0BC@CJJMPODA@ResetNestingCount?$AA@
0x18000E408: "__cdecl _imp_NtQueryValueKey" __imp_NtQueryValueKey
0x18000D500: "__cdecl _security_check_cookie" __security_check_cookie
0x18000E7A0: s_cszSRUpgradeKey
0x18000E500: "__cdecl _xc_z" __xc_z
0x18000E8F8: c_wszLastIndex
0x18000F7D0: "::GetVolumeNameForVolumeMountPoi" ??_C@_0FB@HOKIJDAC@?3?3GetVolumeNameForVolumeMountPoi@
0x18000F548: "SxRegDeleteKey" ??_C@_0P@CMMMNDJM@SxRegDeleteKey?$AA@
0x18000F2D8: "Log_SR_INFO_NEWSYSTEMID_SUCCEEDS" ??_C@_0CB@HPIPLJPN@Log_SR_INFO_NEWSYSTEMID_SUCCEEDS@
0x180005D90: "long __cdecl SrInternalSysprepCleanup(void)" ?SrInternalSysprepCleanup@@YAJXZ
0x18000F508: "SxRegWriteDWORD" ??_C@_0BA@DGLOAICN@SxRegWriteDWORD?$AA@
0x180012614: "int g_fAmWow64" ?g_fAmWow64@@3HA
0x18000EB70: s_cszSRInitDone
0x18000E4C0: "__cdecl _imp_CoCreateInstance" __imp_CoCreateInstance
0x18000E2F8: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x180003060: SetSRStateAfterSetup
0x18000EDF0: c_wszRestoreStatusDetails
0x18000B83C: "long __cdecl SrEnumRestorePointsHelper(enum _SR_RESTORE_SOURCE,unsigned char,unsigned long,struct _SPP_GROUP_PROP * __ptr64,unsigned long * __ptr64,struct _SR_RP_PROP * __ptr64 * __ptr64)" ?SrEnumRestorePointsHelper@@YAJW4_SR_RESTORE_SOURCE@@EKPEAU_SPP_GROUP_PROP@@PEAKPEAPEAU_SR_RP_PROP@@@Z
0x18000E1C0: "__cdecl _imp_ReportEventW" __imp_ReportEventW
0x18000F170: "DeleteRestorePoint" ??_C@_0BD@OKBHGHK@DeleteRestorePoint?$AA@
0x18000E2E8: "__cdecl _imp_FindNextFileW" __imp_FindNextFileW
0x1800125B0: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxuyzhvUhgliUhcUhiUhixorvmgUlyquivUznwGEUhixorvmgsOlyq@srclient" __@@_PchSym_@00@KxulyqvxgPillgKxuyzhvUhgliUhcUhiUhixorvmgUlyquivUznwGEUhixorvmgsOlyq@srclient
0x180003140: SRSetRestorePointA
0x18000E5A8: c_wszNestingLevel
0x180008F28: "long __cdecl SxGetUniqueVolumeForPath(unsigned short const * __ptr64,unsigned short * __ptr64,unsigned long)" ?SxGetUniqueVolumeForPath@@YAJPEBGPEAGK@Z
0x18000E298: "__cdecl _imp_GetVolumePathNameW" __imp_GetVolumePathNameW
0x18000E848: c_wszRestoreStatusSource
0x18000F1D8: WPP_9dc1f72e94cb38393cacd2c79efb111a_Traceguids
0x18000E310: "__cdecl _imp_MultiByteToWideChar" __imp_MultiByteToWideChar
0x18000FA68: "_GetFileAttributesTag" ??_C@_0BG@OMCHLOLL@_GetFileAttributesTag?$AA@
0x18000F968: "SxQueryIsSystemWimBooted" ??_C@_0BJ@JOOLIBEG@SxQueryIsSystemWimBooted?$AA@
0x18000E520: "__cdecl _guard_fids_table" __guard_fids_table
0x18000E870: c_wszVolatileKey
0x18000E188: "__cdecl _imp_CreateWellKnownSid" __imp_CreateWellKnownSid
0x18000C258: ?Append@?$CSxArrayBuilder@U_SR_RP_PROP@@$1?Free_SR_RP_PROP@@YAXPEAU1@@Z$1??$SxDefaultInit@U_SR_RP_PROP@@@@YAX0@Z$1??$SxDefaultTransfer@U_SR_RP_PROP@@@@YAX00@Z@@QEAAJPEAU_SR_RP_PROP@@@Z
0x18000543C: "long __cdecl DisableVolume(unsigned short const * __ptr64,int)" ?DisableVolume@@YAJPEBGH@Z
0x18000E400: msvcrt_NULL_THUNK_DATA
0x18000E030: "__cdecl load_config_used" _load_config_used
0x18001261C: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUhgliUhcUfgrohUlyquivUznwGEUfgrohsOlyq@utils" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUyzhvUhgliUhcUfgrohUlyquivUznwGEUfgrohsOlyq@utils
0x180010A5C: "__cdecl _IMPORT_DESCRIPTOR_POWRPROF" __IMPORT_DESCRIPTOR_POWRPROF
0x180004F14: "long __cdecl EnableVolume(unsigned short const * __ptr64,int)" ?EnableVolume@@YAJPEBGH@Z
0x18000FB10: "SrValidateRestorePoint" ??_C@_0BH@BDIEIPNH@SrValidateRestorePoint?$AA@
0x18000E378: SPP_NULL_THUNK_DATA
0x18000A430: "long __cdecl SxDeleteFile(unsigned short const * __ptr64)" ?SxDeleteFile@@YAJPEBG@Z
0x18000E348: "__cdecl _imp_CallNtPowerInformation" __imp_CallNtPowerInformation
0x18000942C: "long __cdecl SxGetBootVolume(unsigned short * __ptr64,unsigned long)" ?SxGetBootVolume@@YAJPEAGK@Z
0x18000F088: "GetTimeNow" ??_C@_0L@IDEOEDAD@GetTimeNow?$AA@
0x18000C5B8: "public: long __cdecl CBsString::FormatV(unsigned short const * __ptr64,char * __ptr64) __ptr64" ?FormatV@CBsString@@QEAAJPEBGPEAD@Z
0x18000F498: "SxRegReadDWORD" ??_C@_0P@CADLPMOB@SxRegReadDWORD?$AA@
0x18000817C: Win32FromHRESULT
0x18000E3B8: "__cdecl _imp__amsg_exit" __imp__amsg_exit
0x18000F768: "SxGetUniqueVolumeForPath" ??_C@_0BJ@CLLECMMB@SxGetUniqueVolumeForPath?$AA@
0x18000EA20: c_wszSystemIdPathname
0x18000F6E8: "SxCheckSupportedVolumeSize" ??_C@_0BL@CHAFEPBL@SxCheckSupportedVolumeSize?$AA@
0x18000EE20: s_cszSRSetupRegKey
0x18000E330: "__cdecl _imp_DisableThreadLibraryCalls" __imp_DisableThreadLibraryCalls
0x18000E430: "__cdecl _imp_NtClose" __imp_NtClose
0x180009DD0: "long __cdecl StringCchPrintfW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64,...)" ?StringCchPrintfW@@YAJPEAG_KPEBGZZ
0x180005B3C: "long __cdecl SrCleanupSVI(void)" ?SrCleanupSVI@@YAJXZ
0x18000E218: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x18000E2C0: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x18000FA38: "SxClearDifficultAttributes" ??_C@_0BL@KCBBCC@SxClearDifficultAttributes?$AA@
0x18000E420: "__cdecl _imp_RtlGetSuiteMask" __imp_RtlGetSuiteMask
0x18000D524: free
0x180003380: WPP_SF_DDS
0x180006AE4: WPP_SF_sdd
0x18000E1C8: "__cdecl _imp_DeregisterEventSource" __imp_DeregisterEventSource
0x18000A328: "long __cdecl SxClearDifficultAttributes(unsigned short const * __ptr64,unsigned long * __ptr64)" ?SxClearDifficultAttributes@@YAJPEBGPEAK@Z
0x18000FB28: "SrEnumRestorePointsHelper" ??_C@_0BK@FMLPPAJB@SrEnumRestorePointsHelper?$AA@
0x1800080AC: WPP_SF_sSd
0x18000E220: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x180004810: "long __cdecl CreateRestorePoint(unsigned long,unsigned long,unsigned short const * __ptr64,unsigned long * __ptr64,int,unsigned short const * __ptr64)" ?CreateRestorePoint@@YAJKKPEBGPEAKH0@Z
0x18000EB48: c_wszRestoreStatusUndo
0x18000F9F8: "(Enter)" ??_C@_1BA@IPGILBFB@?$AA?$CI?$AAE?$AAn?$AAt?$AAe?$AAr?$AA?$CJ?$AA?$AA@
0x180006C5C: "public: __cdecl CSxFunctionTracer::CSxFunctionTracer(char const * __ptr64,unsigned short,unsigned short) __ptr64" ??0CSxFunctionTracer@@QEAA@PEBDGG@Z
0x18000D740: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x18000E278: "__cdecl _imp_ExpandEnvironmentStringsW" __imp_ExpandEnvironmentStringsW
0x18000E288: "__cdecl _imp_GetSystemDirectoryW" __imp_GetSystemDirectoryW
0x18000E380: "__cdecl _imp_wcsrchr" __imp_wcsrchr
0x18000F058: WPP_82e6a9e7a15e370198493ea91da6f0c4_Traceguids
0x18000989C: "long __cdecl SxQueryPersistentVolumeState(unsigned short const * __ptr64,struct _FILE_FS_PERSISTENT_VOLUME_INFORMATION * __ptr64)" ?SxQueryPersistentVolumeState@@YAJPEBGPEAU_FILE_FS_PERSISTENT_VOLUME_INFORMATION@@@Z
0x18000E180: "__cdecl _imp_ConvertStringSecurityDescriptorToSecurityDescriptorW" __imp_ConvertStringSecurityDescriptorToSecurityDescriptorW
0x1800095A0: "long __cdecl SxQueryVolumeSpace(unsigned short const * __ptr64,unsigned __int64 * __ptr64,unsigned __int64 * __ptr64,unsigned __int64 * __ptr64)" ?SxQueryVolumeSpace@@YAJPEBGPEA_K11@Z
0x180012630: RtlpTestHookInit
0x18000E4D0: "__cdecl _imp_CoTaskMemAlloc" __imp_CoTaskMemAlloc
0x18000F8B0: "SxGetBootVolume" ??_C@_0BA@MPONBCFN@SxGetBootVolume?$AA@
0x18000F518: "SxRegWriteULONGLONG" ??_C@_0BE@LCOMAGLB@SxRegWriteULONGLONG?$AA@
0x18000A144: "public: long __cdecl CSxDiagnostics::LogDiagnostic(enum SX_DIAG_OPERATION,enum SX_DIAG_TYPE,long,struct _GUID) __ptr64" ?LogDiagnostic@CSxDiagnostics@@QEAAJW4SX_DIAG_OPERATION@@W4SX_DIAG_TYPE@@JU_GUID@@@Z
0x18000C350: "void __cdecl SxDefaultTransfer<struct _SR_RP_PROP>(struct _SR_RP_PROP * __ptr64,struct _SR_RP_PROP * __ptr64)" ??$SxDefaultTransfer@U_SR_RP_PROP@@@@YAXPEAU_SR_RP_PROP@@0@Z
0x18000E3C0: "__cdecl _imp__XcptFilter" __imp__XcptFilter
0x18000C57C: "public: void __cdecl CBsString::BoundUpdateLength(unsigned long) __ptr64" ?BoundUpdateLength@CBsString@@QEAAXK@Z
0x18000EEA8: s_cszAoACAPIError
0x18000F5E8: "SxQueryGroupPolicy" ??_C@_0BD@IJEPMCPH@SxQueryGroupPolicy?$AA@
0x180003250: SRRemoveRestorePoint
0x18000E4A0: ntdll_NULL_THUNK_DATA
0x18000C48C: "private: void __cdecl CBsString::_Release(void) __ptr64" ?_Release@CBsString@@AEAAXXZ
0x18000E3A0: "__cdecl _imp_memcpy" __imp_memcpy
0x18000AC88: "void __cdecl Free_SR_RP_PROP(struct _SR_RP_PROP * __ptr64)" ?Free_SR_RP_PROP@@YAXPEAU_SR_RP_PROP@@@Z
0x18000AC0C: "void __cdecl Free_SR_VOLUME_PROP(struct _SR_VOLUME_PROP * __ptr64)" ?Free_SR_VOLUME_PROP@@YAXPEAU_SR_VOLUME_PROP@@@Z
0x18000E198: "__cdecl _imp_GetSecurityDescriptorDacl" __imp_GetSecurityDescriptorDacl
0x18000F340: "SrCleanupRPs" ??_C@_0N@HCGAIKNO@SrCleanupRPs?$AA@
0x18000ED40: c_wszRegistryKeySecurity
0x18000F708: "AssertPrivilegeOnTokenPreserveOr" ??_C@_0CD@DJFFCBHK@AssertPrivilegeOnTokenPreserveOr@
0x180007F30: WPP_SF_Ddd
0x18000BB24: "long __cdecl SrTranslatePath(struct _SR_RP_PROP const * __ptr64,unsigned short const * __ptr64,class CBsString * __ptr64,class CBsString * __ptr64,class CBsString * __ptr64,class CBsString * __ptr64,unsigned long * __ptr64)" ?SrTranslatePath@@YAJPEBU_SR_RP_PROP@@PEBGPEAVCBsString@@222PEAK@Z
0x18000A710: "long __cdecl SxSetFileAttributes(unsigned short const * __ptr64,unsigned long)" ?SxSetFileAttributes@@YAJPEBGK@Z
0x18000EEC8: c_wszEventSourceSystemRestore
0x18000F1A8: "DisableVolume" ??_C@_0O@CLPGFAML@DisableVolume?$AA@
0x18000F9D0: "MakeIdentifier" ??_C@_0P@MEMJJCKA@MakeIdentifier?$AA@
0x18000923C: "long __cdecl SxIsBootVolume(unsigned short const * __ptr64)" ?SxIsBootVolume@@YAJPEBG@Z
0x18000E1F0: "__cdecl _imp_FreeSid" __imp_FreeSid
0x18000E140: "__cdecl _imp_GetTraceEnableFlags" __imp_GetTraceEnableFlags
0x18000F1B8: "IsSRDisabled" ??_C@_0N@EKIHKIEG@IsSRDisabled?$AA@
0x1800064B0: "long __cdecl SrInternalSysprepGeneralize(void)" ?SrInternalSysprepGeneralize@@YAJXZ
0x18000E138: "__cdecl _imp_RegisterTraceGuidsW" __imp_RegisterTraceGuidsW
0x180012018: "__cdecl _security_cookie" __security_cookie
0x18000E1A0: "__cdecl _imp_RegQueryValueExW" __imp_RegQueryValueExW
0x18000F0E0: "CreateRestorePointHelper" ??_C@_0BJ@CPBPGLCK@CreateRestorePointHelper?$AA@
0x180007E2C: "long __cdecl SxUpdateSystemRestoreEnabled(int)" ?SxUpdateSystemRestoreEnabled@@YAJH@Z
0x18000E478: "__cdecl _imp_RtlGetCurrentTransaction" __imp_RtlGetCurrentTransaction
0x18000E1F8: "__cdecl _imp_CheckTokenMembership" __imp_CheckTokenMembership
0x180012628: RtlpUserPolicies
0x18000CBB4: StringCbPrintfW
0x18000E2D0: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x18000CABC: "public: long __cdecl CBsString::Trailing(unsigned short) __ptr64" ?Trailing@CBsString@@QEAAJG@Z
0x18000E300: "__cdecl _imp_LocalFree" __imp_LocalFree
0x18000EAA0: c_wszDiagnosticsKey
0x180002E80: EnableSR
0x18000F158: "CancelRestorePoint" ??_C@_0BD@JLFFGIPD@CancelRestorePoint?$AA@
0x18000E458: "__cdecl _imp_RtlGetLastNtStatus" __imp_RtlGetLastNtStatus
0x18000F320: "\*" ??_C@_15PKPONJIK@?$AA?2?$AA?$CK?$AA?$AA@
0x18000E170: "__cdecl _imp_RegCreateKeyExW" __imp_RegCreateKeyExW
0x180012640: "__cdecl _onexitbegin" __onexitbegin
0x18000F730: "RestoreOrigPrivilegeOnToken" ??_C@_0BM@BNPADBJL@RestoreOrigPrivilegeOnToken?$AA@
0x18000C4C8: "public: long __cdecl CBsString::ExtendBuffer(unsigned long) __ptr64" ?ExtendBuffer@CBsString@@QEAAJK@Z
0x18000E3D8: "__cdecl _imp__vsnwprintf" __imp__vsnwprintf
0x180008E7C: WPP_SF_qD
0x18000E230: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x18000E250: "__cdecl _imp_GetCurrentThread" __imp_GetCurrentThread
0x18000C830: "public: long __cdecl CBsString::Append(unsigned short const * __ptr64) __ptr64" ?Append@CBsString@@QEAAJPEBG@Z
0x18000EFB0: "_SRNewSystemId" ??_C@_0P@HPHCMKNI@_SRNewSystemId?$AA@
0x180008ED4: WPP_SF_qq
0x18000E1B0: "__cdecl _imp_RegDeleteTreeW" __imp_RegDeleteTreeW
0x180010A0C: "__cdecl _IMPORT_DESCRIPTOR_KERNEL32" __IMPORT_DESCRIPTOR_KERNEL32
0x18000F920: "\\?\GLOBALROOT%s" ??_C@_1CC@FLBLPCHL@?$AA?2?$AA?2?$AA?$DP?$AA?2?$AAG?$AAL?$AAO?$AAB?$AAA?$AAL?$AAR?$AAO?$AAO?$AAT?$AA?$CF?$AAs?$AA?$AA@
0x18000E168: "__cdecl _imp_RegOpenKeyExW" __imp_RegOpenKeyExW
0x18000D644: "__cdecl _security_init_cookie" __security_init_cookie
0x18000F6B0: "SxCheckSupportedFsType" ??_C@_0BH@PGHPMGFC@SxCheckSupportedFsType?$AA@
0x180008068: WPP_SF_q
0x18000F4D0: "SxRegReadMultiStringAsBlob" ??_C@_0BL@NALHMHNA@SxRegReadMultiStringAsBlob?$AA@
0x18000C140: ?Append@?$CSxArrayBuilder@U_SR_VOLUME_PROP@@$1?Free_SR_VOLUME_PROP@@YAXPEAU1@@Z$1??$SxDefaultInit@U_SR_VOLUME_PROP@@@@YAX0@Z$1??$SxDefaultTransfer@U_SR_VOLUME_PROP@@@@YAX00@Z@@QEAAJPEAU_SR_VOLUME_PROP@@@Z
0x18000FC80: "C:\data\programs\windowsapps" ??_C@_1DK@LFAIJJDD@?$AAC?$AA?3?$AA?2?$AAd?$AAa?$AAt?$AAa?$AA?2?$AAp?$AAr?$AAo?$AAg?$AAr?$AAa?$AAm?$AAs?$AA?2?$AAw?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AAa?$AAp?$AAp?$AAs?$AA?$AA@
0x180003A04: "long __cdecl CheckTimeout(struct _SR_STATE * __ptr64)" ?CheckTimeout@@YAJPEAU_SR_STATE@@@Z
0x1800109E4: "__cdecl _IMPORT_DESCRIPTOR_msvcrt" __IMPORT_DESCRIPTOR_msvcrt
0x180006D6C: "public: __cdecl CSxFunctionTracer::~CSxFunctionTracer(void) __ptr64" ??1CSxFunctionTracer@@QEAA@XZ
0x18000E4C8: "__cdecl _imp_CoTaskMemRealloc" __imp_CoTaskMemRealloc
0x18000F458: CLSID_SPP
0x18000E498: "__cdecl _imp_NtOpenKey" __imp_NtOpenKey
0x18000E3E0: "__cdecl _imp_malloc" __imp_malloc
0x18000E950: c_wszRegistryKey
0x18000E210: ADVAPI32_NULL_THUNK_DATA
0x18000FAA8: WPP_2e3e846db9fc3d2626ab6421027a8f10_Traceguids
0x18000E448: "__cdecl _imp_NtSetInformationFile" __imp_NtSetInformationFile
0x18000EF80: "_SRSetRestorePointA" ??_C@_0BE@GCMKDAMG@_SRSetRestorePointA?$AA@
0x18000FB70: WPP_546d7c1786a234790e4aa592d8f1e5c5_Traceguids
0x18000E488: "__cdecl _imp_RtlDeleteCriticalSection" __imp_RtlDeleteCriticalSection
0x18000E1D8: "__cdecl _imp_LookupPrivilegeValueW" __imp_LookupPrivilegeValueW
0x18000D790: "__cdecl _report_gsfailure" __report_gsfailure
0x18000F880: "SxIsBootVolume" ??_C@_0P@ODDLFFNK@SxIsBootVolume?$AA@
0x18000F448: WPP_940f0d37c86831ed0df4ac65a242f6e2_Traceguids
0x180007B04: "long __cdecl SxRegDeleteKey(struct HKEY__ * __ptr64,unsigned short const * __ptr64)" ?SxRegDeleteKey@@YAJPEAUHKEY__@@PEBG@Z
0x18000EF68: "_SRSetRestorePointW" ??_C@_0BE@HOFCIFBB@_SRSetRestorePointW?$AA@
0x18000F4C0: "SxRegReadString" ??_C@_0BA@JFJBABAL@SxRegReadString?$AA@
0x180012650: "__cdecl _native_startup_state" __native_startup_state
0x18000F220: "Log_SR_INFO_CREATERESTOREPOINT_S" ??_C@_0CI@DDNAAEPJ@Log_SR_INFO_CREATERESTOREPOINT_S@
0x18000EB00: c_wszRestorePointCreationFrequency
0x18000F310: "SrCleanupSVI" ??_C@_0N@OLPIEPHA@SrCleanupSVI?$AA@
0x18000E5D0: s_cszSRGeneralizeKey
0x1800069D0: "unsigned long __cdecl SysprepCleanup(void)" ?SysprepCleanup@@YAKXZ
0x18000FC58: "ResourcePolicies" ??_C@_1CC@NNGJHDFE@?$AAR?$AAe?$AAs?$AAo?$AAu?$AAr?$AAc?$AAe?$AAP?$AAo?$AAl?$AAi?$AAc?$AAi?$AAe?$AAs?$AA?$AA@
0x18000F890: "%SystemDrive%\" ??_C@_1BO@FNBCDJKF@?$AA?$CF?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAD?$AAr?$AAi?$AAv?$AAe?$AA?$CF?$AA?2?$AA?$AA@
0x18000F298: "Log_SR_INFO_DISABLESR_SUCCEEDS" ??_C@_0BP@INBOGDF@Log_SR_INFO_DISABLESR_SUCCEEDS?$AA@
0x18000EC70: s_cszGroupPolicy
0x18000E1E8: "__cdecl _imp_OpenThreadToken" __imp_OpenThreadToken
0x180004AEC: "long __cdecl CancelRestorePoint(unsigned long,unsigned long * __ptr64)" ?CancelRestorePoint@@YAJKPEAK@Z
0x180002FE0: DisableSRInternal
0x18000E910: c_wszRestoreStatusDescription
0x18000FA80: "sh.IsValid()" ??_C@_0N@DFEAELIA@sh?4IsValid?$CI?$CJ?$AA@
0x180007F90: WPP_SF_SD
0x180006A74: WPP_SF_sd
0x18000E3E8: "__cdecl _imp_free" __imp_free
0x18000D5B0: "__cdecl IsNonwritableInCurrentImage" _IsNonwritableInCurrentImage
0x18000E1E0: "__cdecl _imp_OpenProcessToken" __imp_OpenProcessToken
0x180008CBC: "long __cdecl AssertPrivilegeOnTokenPreserveOrig(void * __ptr64,unsigned short const * __ptr64,struct _TOKEN_PRIVILEGES * __ptr64,unsigned long)" ?AssertPrivilegeOnTokenPreserveOrig@@YAJPEAXPEBGPEAU_TOKEN_PRIVILEGES@@K@Z
0x180006A10: WPP_SF_s
0x180001218: WPP_SF_S
0x18000D9A9: memset
0x180010A70: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x1800030C0: SRSetRestorePointW
0x18000E368: "__cdecl _imp_SxTracerGetThreadContextRetail" __imp_SxTracerGetThreadContextRetail
0x18000BDCC: "long __cdecl SrPublishRPCreationSQM(unsigned long,unsigned long,struct _SR_RP_PROP * __ptr64,unsigned char,long)" ?SrPublishRPCreationSQM@@YAJKKPEAU_SR_RP_PROP@@EJ@Z

[JEB Decompiler by PNF Software]