Generated by JEB on 2019/08/01

PE: C:\Windows\System32\userinitext.dll Base=0x180000000 SHA-256=F8E9958B4AC8F06EFF9EBB05B03447370C50D33C50462AC4F79E70AA8A320CEC
PDB: userinitext.pdb GUID={632C7F1A-AEE6-4998-D23F06E1D0C3D17D} Age=1

224 located named symbols:
0x1800026CC: "__cdecl _raise_securityfailure" __raise_securityfailure
0x1800039B8: "Keyboard Layout\Toggle" ??_C@_1CO@DODNJEHC@?$AAK?$AAe?$AAy?$AAb?$AAo?$AAa?$AAr?$AAd?$AA?5?$AAL?$AAa?$AAy?$AAo?$AAu?$AAt?$AA?2?$AAT?$AAo?$AAg?$AAg?$AAl?$AAe?$AA?$AA@
0x1800024E0: "__cdecl FindPESection" _FindPESection
0x180001114: InitializeMisc
0x180001F40: "__cdecl _delayLoadHelper2" __delayLoadHelper2
0x1800044E8: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x180005010: "__cdecl _security_cookie_complement" __security_cookie_complement
0x180001FBC: "__cdecl CRT_INIT" _CRT_INIT
0x180003238: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x180003B50: "Software\Microsoft\Windows\Curre" ??_C@_1GG@BOCMHPKL@?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe@
0x180007020: "__cdecl _imp_WinStationFreeMemory" __imp_WinStationFreeMemory
0x180003348: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x180002A70: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x180003A68: "TSAppCompat" ??_C@_1BI@LIHNICPI@?$AAT?$AAS?$AAA?$AAp?$AAp?$AAC?$AAo?$AAm?$AAp?$AAa?$AAt?$AA?$AA@
0x180003AC0: "Software\Microsoft\Windows\Curre" ??_C@_1IE@FOJFBGON@?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe@
0x1800029BE: "__cdecl _imp_load_WinStationGetInitialApplication" __imp_load_WinStationGetInitialApplication
0x180003BC0: "__cdecl _pfnDliFailureHook2" __pfnDliFailureHook2
0x180005668: ExecApplication
0x180003A00: "System\CurrentControlSet\Control" ??_C@_1GC@BOHKHHOK@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA?2?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl@
0x1800050B0: szNoPageFile
0x1800031C8: api-ms-win-core-heap-l2-1-0_NULL_THUNK_DATA
0x1800029AC: "__cdecl _imp_load_WinStationQueryInformationW" __imp_load_WinStationQueryInformationW
0x1800032C8: "__cdecl _imp_SetEvent" __imp_SetEvent
0x18000292D: "__cdecl _tailMerge_winsta_dll" __tailMerge_winsta_dll
0x180003378: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x1800031F8: "__cdecl _imp_FormatMessageW" __imp_FormatMessageW
0x1800024C4: "__cdecl XcptFilter" _XcptFilter
0x180003380: "__cdecl _xc_a" __xc_a
0x180003760: "vmapplet" ??_C@_1BC@JHAKKBEE@?$AAv?$AAm?$AAa?$AAp?$AAp?$AAl?$AAe?$AAt?$AA?$AA@
0x180003218: "__cdecl _imp_SetCurrentDirectoryW" __imp_SetCurrentDirectoryW
0x180003400: "__cdecl _guard_iat_table" __guard_iat_table
0x180003220: api-ms-win-core-processenvironment-l1-1-0_NULL_THUNK_DATA
0x180003118: "__cdecl _imp_MessageBoxW" __imp_MessageBoxW
0x1800031E0: "__cdecl _imp_LoadLibraryExW" __imp_LoadLibraryExW
0x180001490: RegCheckCtfmon
0x180003338: "__cdecl _imp_memset" __imp_memset
0x1800037F8: "ShellDesktopSwitchEvent" ??_C@_1DA@JNJPEACF@?$AAS?$AAh?$AAe?$AAl?$AAl?$AAD?$AAe?$AAs?$AAk?$AAt?$AAo?$AAp?$AAS?$AAw?$AAi?$AAt?$AAc?$AAh?$AAE?$AAv?$AAe?$AAn?$AAt?$AA?$AA@
0x18000269F: "__cdecl initterm" _initterm
0x1800044C0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0
0x1800056A8: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x1800032D8: "__cdecl _imp_Sleep" __imp_Sleep
0x180003128: "__cdecl _imp_GetSystemMetrics" __imp_GetSystemMetrics
0x1800033A0: "__cdecl _xi_z" __xi_z
0x180003180: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x180003158: USERENV_NULL_THUNK_DATA
0x1800026AB: "__cdecl _C_specific_handler" __C_specific_handler
0x180005670: ExecProcesses
0x1800031B0: api-ms-win-core-handle-l1-1-0_NULL_THUNK_DATA
0x180003290: "__cdecl _imp_RegCloseKey" __imp_RegCloseKey
0x1800029F4: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x1800038C0: "USERINIT: Failed to start ctfmon" ??_C@_0DP@PIGNIKBD@USERINIT?3?5Failed?5to?5start?5ctfmon@
0x180004128: CRYPT32_NULL_THUNK_DATA_DLN
0x180004148: WINSTA_NULL_THUNK_DATA_DLN
0x180007028: WINSTA_NULL_THUNK_DATA_DLA
0x1800041D8: WINSTA_NULL_THUNK_DATA_DLB
0x180003280: "__cdecl _imp_RegSetValueExW" __imp_RegSetValueExW
0x1800024D0: "__cdecl amsg_exit" _amsg_exit
0x180003830: "USERINIT: Logging off session si" ??_C@_0EO@LEPALJEA@USERINIT?3?5Logging?5off?5session?5si@
0x1800015D0: SetShellDesktopSwitchEvent
0x180003420: "__cdecl _sz_WINSTA_dll" __sz_WINSTA_dll
0x180003BB8: "__cdecl _DefaultResolveDelayLoadedAPIFlags" __DefaultResolveDelayLoadedAPIFlags
0x180003918: "ImmDisableIME" ??_C@_0O@IBBIJLBJ@ImmDisableIME?$AA@
0x180005680: "struct HWND__ * __ptr64 (__cdecl* __ptr64 pHtmlHelpA)(struct HWND__ * __ptr64,char const * __ptr64,unsigned int,unsigned __int64)" ?pHtmlHelpA@@3P6APEAUHWND__@@PEAU1@PEBDI_K@ZEA
0x1800037E0: "ctfmon.exe" ??_C@_1BG@ENNAMINJ@?$AAc?$AAt?$AAf?$AAm?$AAo?$AAn?$AA?4?$AAe?$AAx?$AAe?$AA?$AA@
0x180005650: "__cdecl _hmod__CRYPT32_dll" __hmod__CRYPT32_dll
0x180003298: api-ms-win-core-registry-l1-1-0_NULL_THUNK_DATA
0x1800031A0: api-ms-win-core-errorhandling-l1-1-0_NULL_THUNK_DATA
0x180003230: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x180005698: "__cdecl _native_startup_lock" __native_startup_lock
0x180001F30: DllMain
0x180003308: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x1800032A8: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x1800031F0: api-ms-win-core-libraryloader-l1-2-0_NULL_THUNK_DATA
0x180003188: "__cdecl _imp_GetLastError" __imp_GetLastError
0x180005000: "__cdecl _native_dllmain_reason" __native_dllmain_reason
0x1800029D0: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x180005678: "struct HWND__ * __ptr64 (__cdecl* __ptr64 pHtmlHelpW)(struct HWND__ * __ptr64,unsigned short const * __ptr64,unsigned int,unsigned __int64)" ?pHtmlHelpW@@3P6APEAUHWND__@@PEAU1@PEBGI_K@ZEA
0x180004524: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-0
0x180003240: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x180001F30: UserinitExt
0x180003BB8: "__cdecl _ResolveDelayLoadedAPIFlags" __ResolveDelayLoadedAPIFlags
0x180002590: "__cdecl ValidateImageBase" _ValidateImageBase
0x180004484: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0
0x180004434: "__cdecl _IMPORT_DESCRIPTOR_USERENV" __IMPORT_DESCRIPTOR_USERENV
0x1800031E8: "__cdecl _imp_FreeLibrary" __imp_FreeLibrary
0x1800040FC: "__cdecl _NULL_DELAY_IMPORT_DESCRIPTOR" __NULL_DELAY_IMPORT_DESCRIPTOR
0x180002200: "__cdecl DllMainCRTStartup" _DllMainCRTStartup
0x180003310: "__cdecl _imp__initterm" __imp__initterm
0x180003198: "__cdecl _imp_SetLastError" __imp_SetLastError
0x180004510: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-1" __IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-1
0x1800043D0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0
0x180001008: StringCchPrintfW
0x180003950: "Software\Microsoft\Windows\Curre" ??_C@_1GE@DEDPOGHK@?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe@
0x180005688: "__cdecl _onexitend" __onexitend
0x180003370: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x180003248: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x180003148: USER32_NULL_THUNK_DATA
0x1800041C8: CRYPT32_NULL_THUNK_DATA_DLB
0x1800036C0: "%SystemRoot%\System32\RunDll32.e" ??_C@_1JM@EEIGOMHN@?$AA?$CF?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAo?$AAo?$AAt?$AA?$CF?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAR?$AAu?$AAn?$AAD?$AAl?$AAl?$AA3?$AA2?$AA?4?$AAe@
0x1800032F8: api-ms-win-core-sysinfo-l1-1-0_NULL_THUNK_DATA
0x180003390: "__cdecl _xi_a" __xi_a
0x180003880: "USERINIT: Failed to set working " ??_C@_0EA@JHGMPKDE@USERINIT?3?5Failed?5to?5set?5working?5@
0x1800032E8: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x180003170: "__cdecl _imp_ResolveDelayLoadedAPI" __imp_ResolveDelayLoadedAPI
0x180001D90: ProcessTermSrvIniFiles
0x180003130: "__cdecl _imp_ExitWindowsEx" __imp_ExitWindowsEx
0x1800043F8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0
0x180007018: "__cdecl _imp_WinStationQueryInformationW" __imp_WinStationQueryInformationW
0x1800056B0: "__cdecl pRawDllMain" _pRawDllMain
0x180001610: ProcesRemoteSessionInitialCommand
0x180003140: "__cdecl _imp_SystemParametersInfoW" __imp_SystemParametersInfoW
0x1800024A0: "__cdecl _security_check_cookie" __security_check_cookie
0x1800040DC: "__cdecl _DELAY_IMPORT_DESCRIPTOR_WINSTA_dll" __DELAY_IMPORT_DESCRIPTOR_WINSTA_dll
0x180003388: "__cdecl _xc_z" __xc_z
0x180001540: IsSubDesktopSession
0x180004448: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0
0x180003250: api-ms-win-core-processthreads-l1-1-0_NULL_THUNK_DATA
0x1800031D8: "__cdecl _imp_GetProcAddress" __imp_GetProcAddress
0x180005020: szMemMan
0x180001A40: ImmWorker
0x1800032F0: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x180007010: "__cdecl _imp_WinStationGetInitialApplication" __imp_WinStationGetInitialApplication
0x1800031B8: "__cdecl _imp_LocalAlloc" __imp_LocalAlloc
0x180003160: "__cdecl _imp_DelayLoadFailureHook" __imp_DelayLoadFailureHook
0x180001460: LoadRemoteFontsAndInitMiscWorker
0x1800032B8: api-ms-win-core-rtlsupport-l1-1-0_NULL_THUNK_DATA
0x180003AA0: "TermsrvCheckNewIniFiles" ??_C@_0BI@EKFCHMOB@TermsrvCheckNewIniFiles?$AA@
0x180003138: "__cdecl _imp_GetKeyboardLayout" __imp_GetKeyboardLayout
0x1800044D4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0
0x180003260: api-ms-win-core-profile-l1-1-0_NULL_THUNK_DATA
0x1800033A8: "__cdecl _guard_fids_table" __guard_fids_table
0x180003340: msvcrt_NULL_THUNK_DATA
0x180003010: "__cdecl load_config_used" _load_config_used
0x180001090: DisplayMessageAndExitWindows
0x180003178: api-ms-win-core-delayload-l1-1-1_NULL_THUNK_DATA
0x180003168: api-ms-win-core-delayload-l1-1-0_NULL_THUNK_DATA
0x180001AB0: SetupHotKeyForKeyboardLayout
0x18000440C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processenvironment-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processenvironment-l1-1-0
0x1800032C0: "__cdecl _imp_OpenEventW" __imp_OpenEventW
0x1800044FC: "__cdecl _IMPORT_DESCRIPTOR_USER32" __IMPORT_DESCRIPTOR_USER32
0x180003328: "__cdecl _imp__amsg_exit" __imp__amsg_exit
0x180007008: CRYPT32_NULL_THUNK_DATA_DLA
0x180002896: "__cdecl _imp_load_CryptProtectData" __imp_load_CryptProtectData
0x180003928: "ctfmon.exe /n" ??_C@_1BM@GGDHBMHC@?$AAc?$AAt?$AAf?$AAm?$AAo?$AAn?$AA?4?$AAe?$AAx?$AAe?$AA?5?$AA?1?$AAn?$AA?$AA@
0x180003358: "__cdecl _imp_NtClose" __imp_NtClose
0x1800031D0: "__cdecl _imp_LoadStringW" __imp_LoadStringW
0x1800032A0: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x180003258: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x1800028A2: "__cdecl _tailMerge_crypt32_dll" __tailMerge_crypt32_dll
0x1800032B0: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x180003BC0: "__cdecl _pfnDefaultDliFailureHook2" __pfnDefaultDliFailureHook2
0x1800040BC: "__cdecl _DELAY_IMPORT_DESCRIPTOR_CRYPT32_dll" __DELAY_IMPORT_DESCRIPTOR_CRYPT32_dll
0x1800034E0: "\Registry\Machine\System\Current" ??_C@_1JM@BJEJIDOF@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1800026C0: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x180003210: "__cdecl _imp_ExpandEnvironmentStringsW" __imp_ExpandEnvironmentStringsW
0x180003208: api-ms-win-core-localization-l1-2-0_NULL_THUNK_DATA
0x180004470: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0
0x180003330: "__cdecl _imp__XcptFilter" __imp__XcptFilter
0x180003368: ntdll_NULL_THUNK_DATA
0x180007000: "__cdecl _imp_CryptProtectData" __imp_CryptProtectData
0x18000445C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0
0x180005008: "__cdecl _security_cookie" __security_cookie
0x180003270: "__cdecl _imp_RegQueryValueExW" __imp_RegQueryValueExW
0x180003660: "CLSID\{16d12736-7a9e-4765-bec6-f" ??_C@_1FK@LJNLMLPJ@?$AAC?$AAL?$AAS?$AAI?$AAD?$AA?2?$AA?$HL?$AA1?$AA6?$AAd?$AA1?$AA2?$AA7?$AA3?$AA6?$AA?9?$AA7?$AAa?$AA9?$AAe?$AA?9?$AA4?$AA7?$AA6?$AA5?$AA?9?$AAb?$AAe?$AAc?$AA6?$AA?9?$AAf@
0x180003900: "imm32.dll" ??_C@_1BE@CHKPGCLC@?$AAi?$AAm?$AAm?$AA3?$AA2?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x1800031A8: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x1800031C0: "__cdecl _imp_LocalFree" __imp_LocalFree
0x180003430: "\Registry\Machine\System\Current" ??_C@_1KC@NFBFJBCF@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1800043E4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0
0x180003268: "__cdecl _imp_RegCreateKeyExW" __imp_RegCreateKeyExW
0x180005690: "__cdecl _onexitbegin" __onexitbegin
0x180003300: "__cdecl _imp__vsnwprintf" __imp__vsnwprintf
0x180003360: "__cdecl _imp_DbgPrint" __imp_DbgPrint
0x180003190: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x180003628: "RasAutodialNewLogonUser" ??_C@_1DA@COMGLKIN@?$AAR?$AAa?$AAs?$AAA?$AAu?$AAt?$AAo?$AAd?$AAi?$AAa?$AAl?$AAN?$AAe?$AAw?$AAL?$AAo?$AAg?$AAo?$AAn?$AAU?$AAs?$AAe?$AAr?$AA?$AA@
0x180003278: "__cdecl _imp_RegDeleteTreeW" __imp_RegDeleteTreeW
0x180003288: "__cdecl _imp_RegOpenKeyExW" __imp_RegOpenKeyExW
0x1800025C4: "__cdecl _security_init_cookie" __security_init_cookie
0x180003200: "__cdecl _imp_GetUserDefaultLangID" __imp_GetUserDefaultLangID
0x1800043BC: "__cdecl _IMPORT_DESCRIPTOR_msvcrt" __IMPORT_DESCRIPTOR_msvcrt
0x1800039E8: "Hotkey" ??_C@_1O@DKEPHEHG@?$AAH?$AAo?$AAt?$AAk?$AAe?$AAy?$AA?$AA@
0x180003350: "__cdecl _imp_NtOpenKey" __imp_NtOpenKey
0x180003318: "__cdecl _imp_malloc" __imp_malloc
0x180001CE0: IsTSAppCompatOn
0x180005658: "__cdecl _hmod__WINSTA_dll" __hmod__WINSTA_dll
0x180003410: "__cdecl _sz_CRYPT32_dll" __sz_CRYPT32_dll
0x180002710: "__cdecl _report_gsfailure" __report_gsfailure
0x180003780: "Software\Microsoft\Windows\Curre" ??_C@_1FM@OEMODDEO@?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe@
0x1800056A0: "__cdecl _native_startup_state" __native_startup_state
0x180003A80: "tsappcmp.dll" ??_C@_1BK@DDOBMONM@?$AAt?$AAs?$AAa?$AAp?$AAp?$AAc?$AAm?$AAp?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x180001E00: CreateExplorerSessionKey
0x180003580: "\Registry\Machine\System\Current" ??_C@_1KE@LMFDPGHK@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1800010C0: PerformXForestLogonCheck
0x1800044AC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0
0x180003320: "__cdecl _imp_free" __imp_free
0x180002530: "__cdecl IsNonwritableInCurrentImage" _IsNonwritableInCurrentImage
0x1800032E0: api-ms-win-core-synch-l1-2-0_NULL_THUNK_DATA
0x180003228: "__cdecl _imp_OpenProcessToken" __imp_OpenProcessToken
0x180004420: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-localization-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-localization-l1-2-0
0x1800032D0: api-ms-win-core-synch-l1-1-0_NULL_THUNK_DATA
0x180004498: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0
0x180003150: "__cdecl _imp_CheckXForestLogon" __imp_CheckXForestLogon
0x180002921: "__cdecl _imp_load_WinStationFreeMemory" __imp_load_WinStationFreeMemory
0x180002A55: memset
0x180004538: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x180003120: "__cdecl _imp_LoadRemoteFonts" __imp_LoadRemoteFonts

[JEB Decompiler by PNF Software]