Generated by JEB on 2019/08/01

PE: C:\Windows\System32\drivers\qwavedrv.sys Base=0x1C0000000 SHA-256=F46E4842EC1F8F6DBD0A8B6548EB2B3639148DB4F79775EB6D28FDC8A8135868
PDB: qwavedrv.pdb GUID={B752F14B-21B4-69CC-08E1482B8AA59A93} Age=1

235 located named symbols:
0x1C0009250: "RC" ??_C@_15IGNKAAHD@?$AAR?$AAC?$AA?$AA@
0x1C000D050: "__cdecl _imp_SeCaptureSubjectContext" __imp_SeCaptureSubjectContext
0x1C000E768: SepSddlGetAclForString
0x1C000D208: "__cdecl _imp_RtlFreeUnicodeString" __imp_RtlFreeUnicodeString
0x1C000B2A0: g_PendingRequestList
0x1C000B088: "__cdecl _security_cookie_complement" __security_cookie_complement
0x1C000D080: "__cdecl _imp_ObfDereferenceObject" __imp_ObfDereferenceObject
0x1C0001150: DrvDispatchCreate
0x1C000B220: PfnIoCreateDeviceSecure
0x1C000B270: g_ClientList
0x1C000D000: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x1C0007500: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x1C000B268: g_DriverLock
0x1C000D060: "__cdecl _imp_SeAccessCheck" __imp_SeAccessCheck
0x1C0006518: DrvCleanupServiceContext
0x1C000D198: "__cdecl _imp_IoCreateDevice" __imp_IoCreateDevice
0x1C000D1A0: "__cdecl _imp_IoDeviceObjectType" __imp_IoDeviceObjectType
0x1C000D0E0: "__cdecl _imp_MmProbeAndLockPages" __imp_MmProbeAndLockPages
0x1C0009258: "WD" ??_C@_15ELMAKJHJ@?$AAW?$AAD?$AA?$AA@
0x1C000D018: "__cdecl _imp_IofCompleteRequest" __imp_IofCompleteRequest
0x1C000D160: "__cdecl _imp_RtlCreateSecurityDescriptor" __imp_RtlCreateSecurityDescriptor
0x1C000E0F0: IoDevObjCreateDeviceSecure
0x1C000D1C0: "__cdecl _imp_wcschr" __imp_wcschr
0x1C000625C: DrvCreateServiceContext
0x1C0001340: DrvDispatchDeviceControl
0x1C000D238: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x1C000B22C: PiRegStateDiscriptor
0x1C000D1F8: "__cdecl _imp_RtlGetOwnerSecurityDescriptor" __imp_RtlGetOwnerSecurityDescriptor
0x1C000D1D0: "__cdecl _imp__wcsnicmp" __imp__wcsnicmp
0x1C000E29C: IopDevObjApplyPostCreationSettings
0x1C000D190: "__cdecl _imp_MmGetSystemRoutineAddress" __imp_MmGetSystemRoutineAddress
0x1C000D010: "__cdecl _imp_KeInitializeSpinLock" __imp_KeInitializeSpinLock
0x1C0009278: "GR" ??_C@_15DNGEKDKB@?$AAG?$AAR?$AA?$AA@
0x1C0007198: DrvSetObjectSecurityDescriptor
0x1C000D0A8: "__cdecl _imp_IoReleaseCancelSpinLock" __imp_IoReleaseCancelSpinLock
0x1C0006A04: DrvBuildDeviceAcl
0x1C0007540: memcpy
0x1C000D0C8: "__cdecl _imp_PsGetCurrentThreadId" __imp_PsGetCurrentThreadId
0x1C0009000: SDDL_DEVOBJ_SYS_ALL_ADM_RWX_IU_R_UD_R
0x1C000D110: "__cdecl _imp_IoGetCurrentProcess" __imp_IoGetCurrentProcess
0x1C00034BC: DrvIoctlStopTracking
0x1C000E5B0: SepSddlDaclFromSDDLString
0x1C000D188: "__cdecl _imp_ZwSetValueKey" __imp_ZwSetValueKey
0x1C000D008: "__cdecl _imp_IoDeleteDevice" __imp_IoDeleteDevice
0x1C000D1B8: "__cdecl _imp_RtlAbsoluteToSelfRelativeSD" __imp_RtlAbsoluteToSelfRelativeSD
0x1C000743D: "__cdecl _C_specific_handler" __C_specific_handler
0x1C0007540: memmove
0x1C000E434: SepSddlSecurityDescriptorFromSDDLString
0x1C000D138: "__cdecl _imp_RtlLengthRequiredSid" __imp_RtlLengthRequiredSid
0x1C000D150: "__cdecl _imp_RtlCreateAcl" __imp_RtlCreateAcl
0x1C00091D8: "IoCreateDeviceSecure" ??_C@_1CK@LEEDIGFP@?$AAI?$AAo?$AAC?$AAr?$AAe?$AAa?$AAt?$AAe?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAS?$AAe?$AAc?$AAu?$AAr?$AAe?$AA?$AA@
0x1C000748C: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x1C000EC4C: SepSddlParseWideStringUlong
0x1C000B240: g_AdminSD
0x1C000B290: g_ClientCancelList
0x1C0009288: "GX" ??_C@_15FCNJEDMF@?$AAG?$AAX?$AA?$AA@
0x1C0009260: "WO" ??_C@_15JMMBCOHI@?$AAW?$AAO?$AA?$AA@
0x1C000D1C8: "__cdecl _imp_ExAllocatePoolWithTag" __imp_ExAllocatePoolWithTag
0x1C00052D0: DrvServiceUpcall
0x1C000D0C0: "__cdecl _imp_PsGetCurrentProcessId" __imp_PsGetCurrentProcessId
0x1C000D1E0: "__cdecl _imp__snwprintf" __imp__snwprintf
0x1C000B238: g_MhnDeviceObject
0x1C0001CEC: DrvIoctlRemoveFlow
0x1C000D078: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x1C000370C: DrvIoctlEnumrateFlows
0x1C0006080: DrvServiceCancel
0x1C00092FC: "A" ??_C@_13PNBDBPLL@?$AAA?$AA?$AA@
0x1C0001774: DrvIoctlAddFlow
0x1C000D1E8: "__cdecl _imp_SeCaptureSecurityDescriptor" __imp_SeCaptureSecurityDescriptor
0x1C0007020: DrvBuildServiceAcl
0x1C0007468: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x1C000D170: "__cdecl _imp_RtlSetOwnerSecurityDescriptor" __imp_RtlSetOwnerSecurityDescriptor
0x1C000D0D8: "__cdecl _imp_IoAllocateMdl" __imp_IoAllocateMdl
0x1C000D158: "__cdecl _imp_RtlAddAccessAllowedAce" __imp_RtlAddAccessAllowedAce
0x1C000D0B8: "__cdecl _imp_ExAllocatePoolWithQuotaTag" __imp_ExAllocatePoolWithQuotaTag
0x1C000D108: "__cdecl _imp_IoAcquireCancelSpinLock" __imp_IoAcquireCancelSpinLock
0x1C000D148: "__cdecl _imp_SeExports" __imp_SeExports
0x1C0002B8C: DrvIoctlNotifyFlow
0x1C0003FD8: DrvIoctlDiag
0x1C000F86C: CmRegUtilWstrValueGetDword
0x1C0009210: "IoValidateDeviceIoControlAccess" ??_C@_1EA@BAHCLPHE@?$AAI?$AAo?$AAV?$AAa?$AAl?$AAi?$AAd?$AAa?$AAt?$AAe?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAI?$AAo?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAA?$AAc?$AAc?$AAe?$AAs?$AAs?$AA?$AA@
0x1C000206C: DrvIoctlSetFlow
0x1C000D1D8: "__cdecl _imp_RtlLengthSecurityDescriptor" __imp_RtlLengthSecurityDescriptor
0x1C0009268: "SD" ??_C@_15NAFBOLGP@?$AAS?$AAD?$AA?$AA@
0x1C000F5F4: CmRegUtilUcValueSetUcString
0x1C000E370: SeSddlSecurityDescriptorFromSDDL
0x1C000D200: "__cdecl _imp_RtlGetGroupSecurityDescriptor" __imp_RtlGetGroupSecurityDescriptor
0x1C00093E0: "\Registry\Machine\System\Current" ??_C@_1HC@DKINPPAJ@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1C00044AC: DrvCreateClientContext
0x1C000F738: CmRegUtilOpenExistingWstrKey
0x1C00091C0: "\Driver\AFD" ??_C@_1BI@PFDJPJAE@?$AA?2?$AAD?$AAr?$AAi?$AAv?$AAe?$AAr?$AA?2?$AAA?$AAF?$AAD?$AA?$AA@
0x1C000EEFC: PiRegStateReadStackCreationSettingsFromKey
0x1C000F0CC: PiRegStateOpenClassKey
0x1C000D0B0: "__cdecl _imp_IoIs32bitProcess" __imp_IoIs32bitProcess
0x1C00073A0: WdmlibRtlInitUnicodeStringEx
0x1C000D070: "__cdecl _imp_SeReleaseSubjectContext" __imp_SeReleaseSubjectContext
0x1C0009360: "Security" ??_C@_1BC@FCJNIDNL@?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?$AA@
0x1C00055DC: DrvServiceDowncall
0x1C0006910: DrvAllocateAndInitializeSid
0x1C0010010: GsDriverEntry
0x1C000D230: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x1C000B2B0: g_Service
0x1C000ED50: PpRegStateReadCreateClassCreationSettings
0x1C000E690: SepSddlGetSidForString
0x1C0009378: "DeviceType" ??_C@_1BG@KCOOGCNN@?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x1C000D0F0: "__cdecl _imp_ObReferenceObjectByHandle" __imp_ObReferenceObjectByHandle
0x1C0009460: "{%08X-%04X-%04X-%02X%02X-%02X%02" ??_C@_1GG@FCALANDO@?$AA?$HL?$AA?$CF?$AA0?$AA8?$AAX?$AA?9?$AA?$CF?$AA0?$AA4?$AAX?$AA?9?$AA?$CF?$AA0?$AA4?$AAX?$AA?9?$AA?$CF?$AA0?$AA2?$AAX?$AA?$CF?$AA0?$AA2?$AAX?$AA?9?$AA?$CF?$AA0?$AA2?$AAX?$AA?$CF?$AA0?$AA2@
0x1C0003D88: DrvIoctlStartDiagnosing
0x1C000D218: "__cdecl _imp_ZwQueryValueKey" __imp_ZwQueryValueKey
0x1C0009270: "GA" ??_C@_15HPMIFLNA@?$AAG?$AAA?$AA?$AA@
0x1C000D0A0: "__cdecl _imp_KeReleaseInStackQueuedSpinLockFromDpcLevel" __imp_KeReleaseInStackQueuedSpinLockFromDpcLevel
0x1C000D048: "__cdecl _imp_IoGetFileObjectGenericMapping" __imp_IoGetFileObjectGenericMapping
0x1C000D088: "__cdecl _imp_MmUnlockPages" __imp_MmUnlockPages
0x1C000D028: "__cdecl _imp_KeReleaseInStackQueuedSpinLock" __imp_KeReleaseInStackQueuedSpinLock
0x1C000D100: "__cdecl _imp_RtlCompareUnicodeString" __imp_RtlCompareUnicodeString
0x1C0007400: "__cdecl _security_check_cookie" __security_check_cookie
0x1C000D240: "__cdecl _IMPORT_DESCRIPTOR_ntoskrnl" __IMPORT_DESCRIPTOR_ntoskrnl
0x1C0001210: DrvDispatchClose
0x1C0009290: "SeConvertStringSecurityDescripto" ??_C@_1GM@JINLDKKK@?$AAS?$AAe?$AAC?$AAo?$AAn?$AAv?$AAe?$AAr?$AAt?$AAS?$AAt?$AAr?$AAi?$AAn?$AAg?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AAD?$AAe?$AAs?$AAc?$AAr?$AAi?$AAp?$AAt?$AAo@
0x1C0006134: DrvIoctlService
0x1C000D128: "__cdecl _imp_KeDetachProcess" __imp_KeDetachProcess
0x1C000D0D0: "__cdecl _imp_ProbeForWrite" __imp_ProbeForWrite
0x1C0011000: "__cdecl _guard_fids_table" __guard_fids_table
0x1C000D1A8: "__cdecl _imp_ZwSetSecurityObject" __imp_ZwSetSecurityObject
0x1C0004714: DrvCleanupClientContext
0x1C0009010: "__cdecl load_config_used" _load_config_used
0x1C00011B0: DrvDispatchCleanup
0x1C0009300: "Properties" ??_C@_1BG@COALCEMK@?$AAP?$AAr?$AAo?$AAp?$AAe?$AAr?$AAt?$AAi?$AAe?$AAs?$AA?$AA@
0x1C000D180: "__cdecl _imp_ZwClose" __imp_ZwClose
0x1C000B280: g_ClientRequestList
0x1C000EB4C: SepSddlAddAceToAcl
0x1C000D178: "__cdecl _imp_NtSetSecurityObject" __imp_NtSetSecurityObject
0x1C000D118: "__cdecl _imp_KeAttachProcess" __imp_KeAttachProcess
0x1C000D058: "__cdecl _imp_SeLockSubjectContext" __imp_SeLockSubjectContext
0x1C000F7B4: CmRegUtilCreateWstrKey
0x1C000D0F8: IoFileObjectType
0x1C000D120: "__cdecl _imp_ObOpenObjectByPointer" __imp_ObOpenObjectByPointer
0x1C000D1F0: "__cdecl _imp_RtlGetSaclSecurityDescriptor" __imp_RtlGetSaclSecurityDescriptor
0x1C0009328: "NoDisplayClass" ??_C@_1BO@DAOBINHA@?$AAN?$AAo?$AAD?$AAi?$AAs?$AAp?$AAl?$AAa?$AAy?$AAC?$AAl?$AAa?$AAs?$AAs?$AA?$AA@
0x1C000D038: "__cdecl _imp_RtlGetDaclSecurityDescriptor" __imp_RtlGetDaclSecurityDescriptor
0x1C000F25C: PpRegStateUpdateStackCreationSettings
0x1C0006DF8: DrvBuildAdminAcl
0x1C000D1B0: "__cdecl _imp_IoIsWdmVersionAvailable" __imp_IoIsWdmVersionAvailable
0x1C0009390: "DeviceCharacteristics" ??_C@_1CM@DIJFBEC@?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAC?$AAh?$AAa?$AAr?$AAa?$AAc?$AAt?$AAe?$AAr?$AAi?$AAs?$AAt?$AAi?$AAc?$AAs?$AA?$AA@
0x1C000B1E0: PiRegStateSysAllInherittedSecurityDescriptor
0x1C000B228: WdmlibInitialized
0x1C0007450: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x1C000E008: WdmlibIoCreateDeviceSecure
0x1C000D0E8: "__cdecl _imp_MmMapLockedPagesSpecifyCache" __imp_MmMapLockedPagesSpecifyCache
0x1C000D130: "__cdecl _imp_PsGetCurrentProcess" __imp_PsGetCurrentProcess
0x1C0009120: "\Device\QWAVEdrv" ??_C@_1CC@GGDKPMI@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAQ?$AAW?$AAA?$AAV?$AAE?$AAd?$AAr?$AAv?$AA?$AA@
0x1C0009318: "Class" ??_C@_1M@OAHBGIFG@?$AAC?$AAl?$AAa?$AAs?$AAs?$AA?$AA@
0x1C00072E4: DrvGetAdminSecurityDescriptor
0x1C000D068: "__cdecl _imp_SeUnlockSubjectContext" __imp_SeUnlockSubjectContext
0x1C000B080: "__cdecl _security_cookie" __security_cookie
0x1C0001640: MhnDrvClientCancel
0x1C000326C: DrvIoctlStartTracking
0x1C00093C0: "Exclusive" ??_C@_1BE@DJHAJDEM@?$AAE?$AAx?$AAc?$AAl?$AAu?$AAs?$AAi?$AAv?$AAe?$AA?$AA@
0x1C00012C0: DrvUnload
0x1C000D020: "__cdecl _imp_KeAcquireInStackQueuedSpinLock" __imp_KeAcquireInStackQueuedSpinLock
0x1C000F4B0: CmRegUtilUcValueGetFullBuffer
0x1C000D090: "__cdecl _imp_IoFreeMdl" __imp_IoFreeMdl
0x1C0009150: SDDL_DEVOBJ_SYS_ALL_ADM_RWX_IU_R_UD_R_buffer
0x1C0009348: "NoUseClass" ??_C@_1BG@OPOOGLJC@?$AAN?$AAo?$AAU?$AAs?$AAe?$AAC?$AAl?$AAa?$AAs?$AAs?$AA?$AA@
0x1C0010044: "__cdecl _security_init_cookie" __security_init_cookie
0x1C000D040: "__cdecl _imp_RtlMapGenericMask" __imp_RtlMapGenericMask
0x1C0004EE0: MhnDrvServiceCopyFromRequest
0x1C00015A0: FreeClientRequest
0x1C000B230: g_CookieJug
0x1C000F3C8: SeUtilSecurityInfoFromSecurityDescriptor
0x1C000D1A0: IoDeviceObjectType
0x1C0009280: "GW" ??_C@_15KLKFDJD@?$AAG?$AAW?$AA?$AA@
0x1C000D140: "__cdecl _imp_RtlLengthSid" __imp_RtlLengthSid
0x1C000B2B8: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUmvgUjlhUnsmUwireviUlyquivUznwGEUnsmwiekOlyq@qwavedrv" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUmvgUjlhUnsmUwireviUlyquivUznwGEUnsmwiekOlyq@qwavedrv
0x1C0007430: "__cdecl _report_gsfailure" __report_gsfailure
0x1C000D210: "__cdecl _imp_ZwCreateKey" __imp_ZwCreateKey
0x1C000D0F8: "__cdecl _imp_IoFileObjectType" __imp_IoFileObjectType
0x1C000250C: DrvIoctlQueryFlow
0x1C000D228: ntoskrnl_NULL_THUNK_DATA
0x1C000D030: "__cdecl _imp_ExFreePoolWithTag" __imp_ExFreePoolWithTag
0x1C000D168: "__cdecl _imp_RtlSetDaclSecurityDescriptor" __imp_RtlSetDaclSecurityDescriptor
0x1C0001008: DriverEntry
0x1C000D220: "__cdecl _imp_ZwOpenKey" __imp_ZwOpenKey
0x1C000D098: "__cdecl _imp_KeAcquireInStackQueuedSpinLockAtDpcLevel" __imp_KeAcquireInStackQueuedSpinLockAtDpcLevel
0x1C0004B0C: MhnDrvServiceCopyFromRequest32
0x1C0007880: memset
0x1C000D254: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR

[JEB Decompiler by PNF Software]