Generated by JEB on 2019/08/01

PE: C:\Windows\System32\advapi32.dll Base=0x180000000 SHA-256=FAE7F170429952777D45641E68F4E0B8E5CE31A38159179CB17B2CB84D8E63F0
PDB: advapi32.pdb GUID={EADAB9BB-FE4F-B81E-5A372145906E4C2B} Age=1

3600 located named symbols:
0x180071B28: "unsigned short const * const ObjListValue" ?ObjListValue@@3QBGB
0x180070380: "__cdecl _imp_RtlInitUnicodeStringEx" __imp_RtlInitUnicodeStringEx
0x180042790: ObjectOpenAuditAlarmA
0x18001AF50: GetSecurityDescriptorSaclStub
0x18007D334: "RC" ??_C@_15IGNKAAHD@?$AAR?$AAC?$AA?$AA@
0x1800552B4: WmipBuildMofAddRemoveEvent
0x18006FE58: "__cdecl _imp_EnumServicesStatusExW" __imp_EnumServicesStatusExW
0x180031250: "struct HINSTANCE__ * __ptr64 __cdecl AppmgmtGetHandleForCallingDll(void)" ?AppmgmtGetHandleForCallingDll@@YAPEAUHINSTANCE__@@XZ
0x18002AD10: FreeEncryptedFileKeyInfo
0x180046C94: GetOperandValue
0x180032650: CodeAuthzpInvertPrivs
0x18006F988: "__cdecl _imp_RegDeleteKeyValueW" __imp_RegDeleteKeyValueW
0x180018860: "long __cdecl QueryExtensibleData(struct _COLLECT_THREAD_DATA * __ptr64)" ?QueryExtensibleData@@YAJPEAU_COLLECT_THREAD_DATA@@@Z
0x180072710: pszRegHwProfileGuid
0x1800701D8: "__cdecl _imp_RtlEnumerateGenericTableWithoutSplaying" __imp_RtlEnumerateGenericTableWithoutSplaying
0x1800027CC: "void __cdecl PerflibciInitDataProperties(struct _PERFLIBCI_QUERY_PROVIDER_NODE * __ptr64,struct _PERF_COUNTER_IDENTIFIER * __ptr64,struct _PERFLIBCI_DATABLOCK * __ptr64)" ?PerflibciInitDataProperties@@YAXPEAU_PERFLIBCI_QUERY_PROVIDER_NODE@@PEAU_PERF_COUNTER_IDENTIFIER@@PEAU_PERFLIBCI_DATABLOCK@@@Z
0x180098410: PMCritSectInitialized
0x1800456BC: LocalGetAceCondition
0x18005BD20: NewAbortShutdownCallback
0x1800718A0: "\Paths" ??_C@_1O@JENDPEOF@?$AA?2?$AAP?$AAa?$AAt?$AAh?$AAs?$AA?$AA@
0x18006F4A0: "__cdecl _imp_LockResource" __imp_LockResource
0x180073CE0: "__cdecl _sz_SspiCli_dll" __sz_SspiCli_dll
0x180018670: SetSecurityDescriptorSaclStub
0x180070350: "__cdecl _imp_RtlUnicodeToMultiByteSize" __imp_RtlUnicodeToMultiByteSize
0x18001D6A8: "__cdecl _imp_load_SystemFunction004" __imp_load_SystemFunction004
0x18002BAF0: CredEnumerateAStub
0x18007DDF8: "SupportUrl" ??_C@_1BG@DIBHDOCK@?$AAS?$AAu?$AAp?$AAp?$AAo?$AAr?$AAt?$AAU?$AAr?$AAl?$AA?$AA@
0x18001C2C4: "__cdecl _raise_securityfailure" __raise_securityfailure
0x18003C6B8: "int __cdecl CompStringNode(void * __ptr64,void * __ptr64)" ?CompStringNode@@YAHPEAX0@Z
0x18001C702: "__cdecl _imp_load_CryptGetProvParam" __imp_load_CryptGetProvParam
0x18002C500: QueryServiceObjectSecurityStub
0x18002C3B0: MapGenericMaskStub
0x18003A210: ConvertAccessToSecurityDescriptorW
0x18003A2E0: ConvertSecurityDescriptorToAccessW
0x18006FD80: "__cdecl _imp_ImpersonateLoggedOnUser" __imp_ImpersonateLoggedOnUser
0x1800993BC: CachedWow64ProcessEnvironment
0x180070710: "__cdecl _imp_NtOpenKeyEx" __imp_NtOpenKeyEx
0x18005C0D8: wRegConn_Netbios
0x18006F648: "__cdecl _imp_RegKrnGetClassesEnumTableAddressInternal" __imp_RegKrnGetClassesEnumTableAddressInternal
0x180009874: LsaQueryInformationPolicy
0x18006FCE8: "__cdecl _imp_GetSecurityDescriptorOwner" __imp_GetSecurityDescriptorOwner
0x1800718D0: "NameResource" ??_C@_1BK@HBCDCHLE@?$AAN?$AAa?$AAm?$AAe?$AAR?$AAe?$AAs?$AAo?$AAu?$AAr?$AAc?$AAe?$AA?$AA@
0x18007F278: "<=" ??_C@_15DPMELJPG@?$AA?$DM?$AA?$DN?$AA?$AA@
0x180017B90: EnumerateTraceGuids
0x180015E40: EtwClientDllInitialize
0x18001C91E: "__cdecl _imp_load_CryptSetProvParam" __imp_load_CryptSetProvParam
0x180071A70: "unsigned short const * const cszSuccessfulFileData" ?cszSuccessfulFileData@@3QBGB
0x18007E210: "Hashes" ??_C@_1O@NAJAFLJG@?$AAH?$AAa?$AAs?$AAh?$AAe?$AAs?$AA?$AA@
0x18002BFE0: GetServiceKeyNameWStub
0x1800704B0: "__cdecl _imp_EtwUnregisterTraceGuids" __imp_EtwUnregisterTraceGuids
0x18001C8C4: "__cdecl _imp_load_CryptSetProviderA" __imp_load_CryptSetProviderA
0x18003E080: BaseRegLoadKey
0x18002CE70: OperationStart
0x180098400: "unsigned long g_SizeSD" ?g_SizeSD@@3KA
0x18004AA00: NotifyChangeEventLog
0x18007D410: "IO" ??_C@_15KFBNENJD@?$AAI?$AAO?$AA?$AA@
0x180052AF4: StringCchCatA
0x18002C620: RegLoadKeyAStub
0x18002C2B0: LsaLookupSids2Stub
0x18009708C: "long lPerflibConfigFlags" ?lPerflibConfigFlags@@3JA
0x18001C978: "__cdecl _imp_load_CryptDestroyKey" __imp_load_CryptDestroyKey
0x18004FBC0: "void __cdecl PerfpExceptionHandler(unsigned long)" ?PerfpExceptionHandler@@YAXK@Z
0x18009F2B0: "__cdecl _imp_CredIsProtectedW" __imp_CredIsProtectedW
0x180070650: "__cdecl _imp_NtSaveMergedKeys" __imp_NtSaveMergedKeys
0x18006FB58: "__cdecl _imp_AllocateAndInitializeSid" __imp_AllocateAndInitializeSid
0x1800806C8: "__cdecl _real@43f0000000000000" __real@43f0000000000000
0x18006F370: "__cdecl _imp_OutputDebugStringW" __imp_OutputDebugStringW
0x180010FB0: SaferpPol_GetInfoCommon_DefaultLevelFlags
0x180018394: StringCchCatW
0x18002DDB0: LsaEnumerateTrustedDomains
0x1800705E0: "__cdecl _imp_RtlReleaseRelativeName" __imp_RtlReleaseRelativeName
0x18006F640: "__cdecl _imp_RegKrnGetHKEY_ClassesRootAddress" __imp_RegKrnGetHKEY_ClassesRootAddress
0x180057158: WmipEnumerateGuids
0x180098420: "struct _EXT_OBJECT * __ptr64 __ptr64 ExtensibleObjects" ?ExtensibleObjects@@3PEAU_EXT_OBJECT@@EA
0x180042C34: "long __cdecl StringCchCatW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64)" ?StringCchCatW@@YAJPEAG_KPEBG@Z
0x180018680: DestroyPrivateObjectSecurityStub
0x18007EF48: "\\%ws" ??_C@_1M@MAEIBGOC@?$AA?2?$AA?2?$AA?$CF?$AAw?$AAs?$AA?$AA@
0x18002B750: AreAllAccessesGrantedStub
0x18002B770: AuditComputeEffectivePolicyBySidStub
0x18006FDE8: "__cdecl _imp_AddAce" __imp_AddAce
0x18006F7F0: "__cdecl _imp_SetThreadToken" __imp_SetThreadToken
0x180043D90: ConvertSDToStringSDDomainW
0x180015740: "__cdecl _delayLoadHelper2" __delayLoadHelper2
0x180070690: "__cdecl _imp_RtlFreeUnicodeString" __imp_RtlFreeUnicodeString
0x18000CB10: "void __cdecl OpenExtensibleObjects(void)" ?OpenExtensibleObjects@@YAXXZ
0x18006F408: "__cdecl _imp_CompareStringOrdinal" __imp_CompareStringOrdinal
0x18008FD0C: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x18007F620: "Application" ??_C@_0M@NJALGCHB@Application?$AA@
0x18004C820: "long __cdecl StringCchCopyExW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64,unsigned short * __ptr64 * __ptr64,unsigned __int64 * __ptr64,unsigned long)" ?StringCchCopyExW@@YAJPEAG_KPEBGPEAPEAGPEA_KK@Z
0x18009F370: "__cdecl _imp_CredpConvertOneCredentialSize" __imp_CredpConvertOneCredentialSize
0x18007E348: ") identified " ??_C@_1BM@MNNICOHD@?$AA?$CJ?$AA?5?$AAi?$AAd?$AAe?$AAn?$AAt?$AAi?$AAf?$AAi?$AAe?$AAd?$AA?5?$AA?$AA@
0x18002B6F0: AddAccessDeniedObjectAceStub
0x18004BC90: ElfReadEventLogA
0x18002BE40: CryptHashSessionKeyStub
0x1800370B4: SaferpLoadUnicodeResourceString
0x18003CDD0: "unsigned long __cdecl ConvertStringWToStringA(unsigned short * __ptr64,char * __ptr64 * __ptr64)" ?ConvertStringWToStringA@@YAKPEAGPEAPEAD@Z
0x180045970: LocalGetStringForSid
0x18007D9D0: Microsoft_Windows_EventlogKeywords
0x18002EA80: LsaQueryCAPs
0x180071790: "%d" ??_C@_15KNBIKKIN@?$AA?$CF?$AAd?$AA?$AA@
0x180098370: "unsigned int (__cdecl* __ptr64 gpfnMsiIsProductElevated)(unsigned short const * __ptr64,int * __ptr64)" ?gpfnMsiIsProductElevated@@3P6AIPEBGPEAH@ZEA
0x18001CB10: StartTraceA
0x180002504: "unsigned char __cdecl PerfpBoostPriority(long,long * __ptr64)" ?PerfpBoostPriority@@YAEJPEAJ@Z
0x18002C770: SetServiceObjectSecurityStub
0x18002C740: SetPrivateObjectSecurityStub
0x180014B00: SVCCTL_HANDLEW_unbind
0x18006FC80: "__cdecl _imp_AccessCheckByTypeResultList" __imp_AccessCheckByTypeResultList
0x18005BF38: EndpointConn_np
0x180004174: BaseRegGetKeySemantics
0x18001C1B0: CreateProcessAsUserWStub
0x180015790: RegQueryValueExAStub
0x18002ECA0: LsaQuerySecurityObject
0x18002BFB0: GetPrivateObjectSecurityStub
0x18007EA98: "DefaultOwner" ??_C@_1BK@LOAJAKPB@?$AAD?$AAe?$AAf?$AAa?$AAu?$AAl?$AAt?$AAO?$AAw?$AAn?$AAe?$AAr?$AA?$AA@
0x1800956D8: "__cdecl _security_cookie_complement" __security_cookie_complement
0x18006F400: "__cdecl _imp_InitOnceBeginInitialize" __imp_InitOnceBeginInitialize
0x18002C3A0: MakeSelfRelativeSDStub
0x1800442F0: ConvertStringSDToSDRootDomainA
0x18006F558: "__cdecl _imp_RaiseException" __imp_RaiseException
0x18005664C: WmipMakeEventCallbacks
0x18007DA38: Microsoft_Windows_PerflibKeywords
0x18007F150: "ldap_search_ext_sA" ??_C@_0BD@GMPFPPBN@ldap_search_ext_sA?$AA@
0x18007F268: ">=" ??_C@_15HCAMBIPN@?$AA?$DO?$AA?$DN?$AA?$AA@
0x1800700C0: "__cdecl _imp__stricmp" __imp__stricmp
0x180070020: "__cdecl _imp_wcsncpy_s" __imp_wcsncpy_s
0x180002B20: ITRPC_HANDLE_bind
0x18002AD7C: LoadAndInitFeClient
0x18007F228: "%ws%wc" ??_C@_1O@KEANMPML@?$AA?$CF?$AAw?$AAs?$AA?$CF?$AAw?$AAc?$AA?$AA@
0x18001A220: RegFlushKeyStub
0x18001B350: OpenEventLogW
0x18001A844: LogonUserCommonW
0x180019E70: AddAceStub
0x18006F430: "__cdecl _imp_AreFileApisANSI" __imp_AreFileApisANSI
0x1800398F0: BuildTrusteeWithNameA
0x18006F530: "__cdecl _imp_DeviceIoControl" __imp_DeviceIoControl
0x18002BC80: CredUnmarshalCredentialWStub
0x18007D9C0: Microsoft_Windows_EventlogLevels
0x18007F478: " (){}" ??_C@_1M@NOBIFNHC@?$AA?5?$AA?$CI?$AA?$CJ?$AA?$HL?$AA?$HN?$AA?$AA@
0x18004ABE0: OpenEventLogA
0x18006FA48: "__cdecl _imp_EventAccessControl" __imp_EventAccessControl
0x18008FDE8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-service-private-l1-1-4" __IMPORT_DESCRIPTOR_api-ms-win-service-private-l1-1-4
0x18008FDFC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-service-private-l1-1-2" __IMPORT_DESCRIPTOR_api-ms-win-service-private-l1-1-2
0x180002080: "unsigned long __cdecl PerfpSaveKernelData(struct _PCW_QUERYITEM_BUFFER * __ptr64,struct _PERF_QUERY * __ptr64)" ?PerfpSaveKernelData@@YAKPEAU_PCW_QUERYITEM_BUFFER@@PEAU_PERF_QUERY@@@Z
0x180016560: OpenTraceWStub
0x18008FE10: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-service-private-l1-1-3" __IMPORT_DESCRIPTOR_api-ms-win-service-private-l1-1-3
0x1800723A0: "ncalrpc" ??_C@_1BA@EONDGCCM@?$AAn?$AAc?$AAa?$AAl?$AAr?$AAp?$AAc?$AA?$AA@
0x18006F7B0: "__cdecl _imp_GetProcessId" __imp_GetProcessId
0x180031E88: "public: void __cdecl CEventsBase::Report(unsigned long,int,unsigned short,...) __ptr64" ?Report@CEventsBase@@QEAAXKHGZZ
0x18008FE24: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-service-private-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-service-private-l1-1-0
0x18007EA50: "DisallowExecution" ??_C@_1CE@MKPCMNKP@?$AAD?$AAi?$AAs?$AAa?$AAl?$AAl?$AAo?$AAw?$AAE?$AAx?$AAe?$AAc?$AAu?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x180005260: RegSetValueExAStub
0x1800564EC: WmipInitializeEventPump
0x1800398F0: BuildTrusteeWithNameW
0x18002F560: LsaEnumerateTrustedDomainsEx
0x18007DCE0: "ShellExecuteExW" ??_C@_0BA@LIPPODFA@ShellExecuteExW?$AA@
0x180059700: "unsigned long __cdecl WctGetThreadWaitChain(struct _WCT_ENTRY * __ptr64,unsigned long,unsigned long,unsigned long * __ptr64,struct _WAITCHAIN_NODE_INFO * __ptr64,int * __ptr64)" ?WctGetThreadWaitChain@@YAKPEAU_WCT_ENTRY@@KKPEAKPEAU_WAITCHAIN_NODE_INFO@@PEAH@Z
0x18007E1F8: "Description" ??_C@_1BI@DLMANABL@?$AAD?$AAe?$AAs?$AAc?$AAr?$AAi?$AAp?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x1800983A0: g_pSystemSid
0x18007DCC0: "%hx" ??_C@_17GBGHEJOA@?$AA?$CF?$AAh?$AAx?$AA?$AA@
0x180008970: LookupSidInTable
0x180056B18: WmipRemoveFromGNList
0x1800804E0: "\REGISTRY\USER\*_Classes\Wow6432" ??_C@_1EK@BFDNIFFD@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAU?$AAS?$AAE?$AAR?$AA?2?$AA?$CK?$AA_?$AAC?$AAl?$AAa?$AAs?$AAs?$AAe?$AAs?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4?$AA3?$AA2@
0x18009F0A8: "__cdecl _imp_CryptDecrypt" __imp_CryptDecrypt
0x180080050: "127.0.0.1" ??_C@_1BE@KGBJBGOH@?$AA1?$AA2?$AA7?$AA?4?$AA0?$AA?4?$AA0?$AA?4?$AA1?$AA?$AA@
0x180059418: "unsigned long __cdecl WctGetSocketInfo(struct _WCT_CLIENT_HANDLE * __ptr64,struct _WAITCHAIN_NODE_INFO * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64)" ?WctGetSocketInfo@@YAKPEAU_WCT_CLIENT_HANDLE@@PEAU_WAITCHAIN_NODE_INFO@@PEAK2@Z
0x180034088: SaferpIsDllAllowed
0x18002D460: AuditQueryGlobalSaclA
0x18006F7D0: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x18002DC60: LsaEnumeratePrivileges
0x180014090: "enum _RTL_GENERIC_COMPARE_RESULTS __cdecl PerflibCompareResources(struct _RTL_AVL_TABLE * __ptr64,void * __ptr64,void * __ptr64)" ?PerflibCompareResources@@YA?AW4_RTL_GENERIC_COMPARE_RESULTS@@PEAU_RTL_AVL_TABLE@@PEAX1@Z
0x18006FDD8: "__cdecl _imp_SetSecurityDescriptorControl" __imp_SetSecurityDescriptorControl
0x1800374F4: CodeAuthzPol_GetInfoCached_LevelListRaw
0x180073CD0: "__cdecl _sz_CRYPTBASE_dll" __sz_CRYPTBASE_dll
0x18002B800: AuditSetPerUserPolicyStub
0x18006EF30: ClassesStringKey
0x1800702B0: "__cdecl _imp_NtEnumerateKey" __imp_NtEnumerateKey
0x1800703F8: "__cdecl _imp_RtlAddAuditAccessAceEx" __imp_RtlAddAuditAccessAceEx
0x180042CFC: "unsigned long __cdecl To_SECL_BLOB_A(void * __ptr64,struct _SECL_BLOB * __ptr64)" ?To_SECL_BLOB_A@@YAKPEAXPEAU_SECL_BLOB@@@Z
0x1800724F8: "MsiReinstallProductW" ??_C@_0BF@GIBHBAAP@MsiReinstallProductW?$AA@
0x18004B660: ElfNumberOfRecords
0x18009F2C8: "__cdecl _imp_CredMarshalCredentialA" __imp_CredMarshalCredentialA
0x180052500: "unsigned long __cdecl PerfpConvertToSingleCounter(struct _PCW_QUERYITEM_BUFFER * __ptr64,void * __ptr64 * __ptr64)" ?PerfpConvertToSingleCounter@@YAKPEAU_PCW_QUERYITEM_BUFFER@@PEAPEAX@Z
0x18001CCDC: "__cdecl _imp_load_GetProcessWindowStation" __imp_load_GetProcessWindowStation
0x18006F920: "__cdecl _imp_RegSaveKeyExW" __imp_RegSaveKeyExW
0x1800164C0: RegDisablePredefinedCache
0x180038F60: TreeSetNamedSecurityInfoA
0x1800161B0: SetThreadTokenStub
0x18001C780: "__cdecl _imp_load_CryptEnumProviderTypesA" __imp_load_CryptEnumProviderTypesA
0x18007EBA0: "Restrictions\RestrictingSidsAdde" ??_C@_1EE@FFIPNDPD@?$AAR?$AAe?$AAs?$AAt?$AAr?$AAi?$AAc?$AAt?$AAi?$AAo?$AAn?$AAs?$AA?2?$AAR?$AAe?$AAs?$AAt?$AAr?$AAi?$AAc?$AAt?$AAi?$AAn?$AAg?$AAS?$AAi?$AAd?$AAs?$AAA?$AAd?$AAd?$AAe@
0x180070730: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x18002BBA0: CredMarshalCredentialAStub
0x18001C8D6: "__cdecl _imp_load_CryptEnumProvidersW" __imp_load_CryptEnumProvidersW
0x1800703B0: "__cdecl _imp_RtlAddAce" __imp_RtlAddAce
0x18001AD70: LsaCloseStub
0x18004D350: WppControlCallback
0x18009F250: "__cdecl _imp_CredReadDomainCredentialsA" __imp_CredReadDomainCredentialsA
0x1800556CC: WmipGetLanguageList
0x18002F9A0: LsaQueryTrustedDomainInfo
0x18001D830: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x18006FE50: "__cdecl _imp_EnumDependentServicesW" __imp_EnumDependentServicesW
0x18007F808: PERFLIB_INCORRECT_OBJECT_LENGTH
0x18004E480: "unsigned long __cdecl PerflibTimerFunction(unsigned long * __ptr64)" ?PerflibTimerFunction@@YAKPEAK@Z
0x18006F918: "__cdecl _imp_RegSaveKeyExA" __imp_RegSaveKeyExA
0x1800397C0: TreeSetNamedSecurityInfoW
0x18006F290: WowAmd64NodeString
0x18001A910: ConvertStringSDToSDDomainW
0x1800579DC: WmipQueryInstanceInfo
0x180071DF0: "SOFTWARE\Microsoft\Windows NT\Cu" ??_C@_1GK@EDCNPJHK@?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAN?$AAT?$AA?2?$AAC?$AAu@
0x1800993B8: g_Win64Registry
0x180071E60: "unsigned short const * const COUNTER_STRING" ?COUNTER_STRING@@3QBGB
0x18006F358: "__cdecl _imp_CreateFileW" __imp_CreateFileW
0x18005E35C: LsapCreatePrivateSecretHandleFromPrivateHandle
0x18006F9E0: "__cdecl _imp_GetSystemWindowsDirectoryW" __imp_GetSystemWindowsDirectoryW
0x18006FEB0: "__cdecl _imp_StartServiceW" __imp_StartServiceW
0x180072770: "%s\%04u" ??_C@_1BA@DOOOBNCO@?$AA?$CF?$AAs?$AA?2?$AA?$CF?$AA0?$AA4?$AAu?$AA?$AA@
0x18007D2D4: "NW" ??_C@_15CNLFACFL@?$AAN?$AAW?$AA?$AA@
0x18006ECF0: Operators
0x18001D6BA: "__cdecl _imp_load_SystemFunction005" __imp_load_SystemFunction005
0x18006FFF0: "__cdecl _imp_StartServiceA" __imp_StartServiceA
0x180073EA0: "__cdecl _sz_api_ms_win_security_provider_l1_1_0_dll" __sz_api_ms_win_security_provider_l1_1_0_dll
0x18007E890: "%HKEY_LOCAL_MACHINE\SOFTWARE\Mic" ??_C@_1JK@FHCLLANF@?$AA?$CF?$AAH?$AAK?$AAE?$AAY?$AA_?$AAL?$AAO?$AAC?$AAA?$AAL?$AA_?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc@
0x180070460: "__cdecl _imp_RtlCopyString" __imp_RtlCopyString
0x180030234: "unsigned long __cdecl GetManagedApplicationsInternal(struct _GUID * __ptr64,unsigned long,unsigned long,unsigned long * __ptr64,struct _MANAGEDAPPLICATION * __ptr64 * __ptr64)" ?GetManagedApplicationsInternal@@YAKPEAU_GUID@@KKPEAKPEAPEAU_MANAGEDAPPLICATION@@@Z
0x1800151C0: SC_MIDL_user_allocate
0x18005BC00: EnumSubtreeStateClear
0x180030C90: GetLocalManagedApplicationData
0x1800980F0: g_DefaultCodeLevel
0x18001C140: GetSecurityDescriptorOwnerStub
0x18007F454: "TD" ??_C@_15MNFENLNH@?$AAT?$AAD?$AA?$AA@
0x18006F468: "__cdecl _imp_LocalLock" __imp_LocalLock
0x180040CA0: QueryServiceLockStatusW
0x180054110: WmiQuerySingleInstanceMultipleW
0x18002C5F0: RegGetValueAStub
0x18006F798: "__cdecl _imp_PcwSendNotification" __imp_PcwSendNotification
0x18007DA80: "__cdecl TraceLoggingMetadata" _TraceLoggingMetadata
0x18005F4F4: Wow64DetectMachineTypeInternal
0x1800719E0: "Software\Policies\Microsoft\Wind" ??_C@_1HE@GBMPBBJH@?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAP?$AAo?$AAl?$AAi?$AAc?$AAi?$AAe?$AAs?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd@
0x180095678: g_AlgSHA256
0x18007F7A8: PERFLIB_HEAP_ERROR
0x18001AFE4: WsdpCheckForHiberboot
0x180016600: ElfDeregisterEventSource
0x180015EC0: SetSecurityDescriptorOwnerStub
0x180005034: PerflibciOpenLocalQueryHandle
0x18006FEB8: "__cdecl _imp_CreateServiceW" __imp_CreateServiceW
0x18007F048: "mpr.dll" ??_C@_07DJIBAOMD@mpr?4dll?$AA@
0x180003F64: BaseRegReleaseKeySemantics
0x180053F80: WmiQuerySingleInstanceMultipleA
0x18009F1C8: "__cdecl _imp_CryptCATAdminEnumCatalogFromHash" __imp_CryptCATAdminEnumCatalogFromHash
0x1800725B0: "MsiConfigureProductExW" ??_C@_0BH@NLHAJFDG@MsiConfigureProductExW?$AA@
0x180076280: "P" ??_C@_13BFLGCPEB@?$AAP?$AA?$AA@
0x18007F204: "0x" ??_C@_15OEMMNBIC@?$AA0?$AAx?$AA?$AA@
0x180040B30: QueryServiceLockStatusA
0x18006F518: "__cdecl _imp_CancelIoEx" __imp_CancelIoEx
0x18001C98A: EnableTraceEx2
0x1800029D0: "unsigned char __cdecl PerflibciWildcardInstance(unsigned short const * __ptr64)" ?PerflibciWildcardInstance@@YAEPEBG@Z
0x1800716F0: "Installing" ??_C@_1BG@IBEMJDPO@?$AAI?$AAn?$AAs?$AAt?$AAa?$AAl?$AAl?$AAi?$AAn?$AAg?$AA?$AA@
0x180052F30: WmiExecuteMethodA
0x18007FF38: "ncacn_nb_ipx" ??_C@_1BK@DNMDBNPI@?$AAn?$AAc?$AAa?$AAc?$AAn?$AA_?$AAn?$AAb?$AA_?$AAi?$AAp?$AAx?$AA?$AA@
0x18006FC70: "__cdecl _imp_GetSidIdentifierAuthority" __imp_GetSidIdentifierAuthority
0x18002C560: RegDeleteKeyValueWStub
0x18007DBB8: "FeClientInitialize" ??_C@_0BD@LFLBPJNK@FeClientInitialize?$AA@
0x180058110: "struct _WCT_ENTRY * __ptr64 __cdecl WctFindAndReferenceEntry(void * __ptr64)" ?WctFindAndReferenceEntry@@YAPEAU_WCT_ENTRY@@PEAX@Z
0x1800060B0: "unsigned long __cdecl PerflibciEnsurePerflibV2StringTable(unsigned long,unsigned short,unsigned char * __ptr64 * __ptr64,unsigned long * __ptr64)" ?PerflibciEnsurePerflibV2StringTable@@YAKKGPEAPEAEPEAK@Z
0x180071EF0: "unsigned short const * const ADDHELP_STRING" ?ADDHELP_STRING@@3QBGB
0x180072570: "MsiDecomposeDescriptorW" ??_C@_0BI@JGPIAHBO@MsiDecomposeDescriptorW?$AA@
0x180053020: WmiExecuteMethodW
0x180070560: "__cdecl _imp_NtReadFile" __imp_NtReadFile
0x18006FA38: "__cdecl _imp_QueryTraceProcessingHandle" __imp_QueryTraceProcessingHandle
0x180070728: "__cdecl _imp_LdrGetDllHandle" __imp_LdrGetDllHandle
0x180072780: pszRegKnownDockingStates
0x180011530: CodeAuthzLevelObjpLoadTable
0x180016570: QueryServiceStatusExStub
0x18000F578: "long __cdecl PerfRegQueryValueEx(struct HKEY__ * __ptr64,struct _UNICODE_STRING const * __ptr64,struct _UNICODE_STRING const * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64,unsigned char * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64)" ?PerfRegQueryValueEx@@YAJPEAUHKEY__@@PEBU_UNICODE_STRING@@1PEAK2PEAE22@Z
0x180016530: ProcessTraceStub
0x18006FF28: "__cdecl _imp_WaitServiceState" __imp_WaitServiceState
0x18007D39C: "KR" ??_C@_15EKKGGDNK@?$AAK?$AAR?$AA?$AA@
0x180070080: "__cdecl _imp_wcstoul" __imp_wcstoul
0x18007F030: "seclogon" ??_C@_1BC@PNGPGJJC@?$AAs?$AAe?$AAc?$AAl?$AAo?$AAg?$AAo?$AAn?$AA?$AA@
0x18009F178: CRYPTSP_NULL_THUNK_DATA_DLA
0x18007F1F8: "S" ??_C@_13HADIAKP@?$AAS?$AA?$AA@
0x18006F4D8: "__cdecl _imp_ReadProcessMemory" __imp_ReadProcessMemory
0x18002B810: AuditSetSecurityStub
0x18002D830: CredIsMarshaledCredentialA
0x18002BF90: GetExplicitEntriesFromAclA
0x18006F620: "__cdecl _imp_DisablePredefinedHandleTableInternal" __imp_DisablePredefinedHandleTableInternal
0x18006F848: "__cdecl _imp_RegLoadKeyW" __imp_RegLoadKeyW
0x180046B60: GetDigitFromChar2
0x18006F668: "__cdecl _imp_RegKrnGetTermsrvRegistryExtensionFlags" __imp_RegKrnGetTermsrvRegistryExtensionFlags
0x180098A08: FnSamCloseHandle
0x180073FEE: "" ??_C@_00CNPNBAHC@?$AA@
0x18002BBF0: CredProtectAStub
0x18007F560: "(%ls %ls)" ??_C@_1BE@KAFBMKIO@?$AA?$CI?$AA?$CF?$AAl?$AAs?$AA?5?$AA?$CF?$AAl?$AAs?$AA?$CJ?$AA?$AA@
0x18006FBF8: "__cdecl _imp_MapGenericMask" __imp_MapGenericMask
0x18007DC38: "SamLookupNamesInDomain" ??_C@_0BH@KINHPCEF@SamLookupNamesInDomain?$AA@
0x1800365E0: SaferiIsExecutableFileType
0x18001CA39: "__cdecl _imp_load_WTHelperIsChainedToMicrosoftFromStateData" __imp_load_WTHelperIsChainedToMicrosoftFromStateData
0x18000F404: "long __cdecl GetPerflibKeyValue(unsigned short const * __ptr64,unsigned long,unsigned long,void * __ptr64,unsigned long,void * __ptr64,struct HKEY__ * __ptr64 * __ptr64)" ?GetPerflibKeyValue@@YAJPEBGKKPEAXK1PEAPEAUHKEY__@@@Z
0x180002A58: "unsigned long __cdecl PerfpCreateProvider(struct _PERFLIBCI_QUERY_PROVIDER_NODE * __ptr64 * __ptr64,struct _PERFLIBCI_COUNTERSET_NODE * __ptr64,struct _PERF_QUERY * __ptr64)" ?PerfpCreateProvider@@YAKPEAPEAU_PERFLIBCI_QUERY_PROVIDER_NODE@@PEAU_PERFLIBCI_COUNTERSET_NODE@@PEAU_PERF_QUERY@@@Z
0x18007E5B0: "Disallowed" ??_C@_1BG@EDDCLAEJ@?$AAD?$AAi?$AAs?$AAa?$AAl?$AAl?$AAo?$AAw?$AAe?$AAd?$AA?$AA@
0x1800161E0: CryptGenRandomStub
0x180015E50: QueryServiceStatusStub
0x1800144C0: PLSAPR_SERVER_NAME_bind
0x180072680: "PeekMessageW" ??_C@_0N@BPNBPMKA@PeekMessageW?$AA@
0x180080280: "\{FE10D39B-A7F1-412c-83BA-D00788" ??_C@_1FA@JLMFPFOH@?$AA?2?$AA?$HL?$AAF?$AAE?$AA1?$AA0?$AAD?$AA3?$AA9?$AAB?$AA?9?$AAA?$AA7?$AAF?$AA1?$AA?9?$AA4?$AA1?$AA2?$AAc?$AA?9?$AA8?$AA3?$AAB?$AAA?$AA?9?$AAD?$AA0?$AA0?$AA7?$AA8?$AA8@
0x18009F448: "__cdecl _imp_BCryptDestroyKey" __imp_BCryptDestroyKey
0x18009F1A0: "__cdecl _imp_GetThreadDesktop" __imp_GetThreadDesktop
0x180070490: "__cdecl _imp_EtwGetTraceLoggerHandle" __imp_EtwGetTraceLoggerHandle
0x18005859C: "void __cdecl WctGetCOMServerInfo(struct _WCT_CLIENT_HANDLE * __ptr64,struct _SYSTEM_PROCESS_INFORMATION * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64)" ?WctGetCOMServerInfo@@YAXPEAU_WCT_CLIENT_HANDLE@@PEAU_SYSTEM_PROCESS_INFORMATION@@PEAK2@Z
0x180046B1C: GetDigitFromChar
0x180046238: SddlpAnsiStringToUnicodeString
0x180080180: "__cdecl _pfnDliFailureHook2" __pfnDliFailureHook2
0x18006F970: "__cdecl _imp_RegLoadKeyA" __imp_RegLoadKeyA
0x18004B950: ElfOpenBackupEventLogW
0x180015810: GetCurrentHwProfileW
0x18006F8F8: "__cdecl _imp_RegDeleteKeyExW" __imp_RegDeleteKeyExW
0x18007F020: ".exe" ??_C@_19DOGDICKI@?$AA?4?$AAe?$AAx?$AAe?$AA?$AA@
0x18004A980: GetNumberOfEventLogRecords
0x180036500: SaferpAcquireBCryptAlgorithmProvider
0x18003D7E0: StopTraceA
0x18006FCF0: "__cdecl _imp_ImpersonateAnonymousToken" __imp_ImpersonateAnonymousToken
0x18002F4E0: LsaDeleteTrustedDomain
0x18007D33C: "WD" ??_C@_15ELMAKJHJ@?$AAW?$AAD?$AA?$AA@
0x18006FEF0: "__cdecl _imp_QueryServiceObjectSecurity" __imp_QueryServiceObjectSecurity
0x1800581AC: "void __cdecl WctFreeClient(struct _WCT_CLIENT_HANDLE * __ptr64)" ?WctFreeClient@@YAXPEAU_WCT_CLIENT_HANDLE@@@Z
0x180003CCC: "unsigned long __cdecl StartInfo_To_SECL_STARTUPINFOW(struct _STARTUPINFOW * __ptr64,struct _SECL_STARTUPINFOW * __ptr64)" ?StartInfo_To_SECL_STARTUPINFOW@@YAKPEAU_STARTUPINFOW@@PEAU_SECL_STARTUPINFOW@@@Z
0x18007FB90: ".SYS" ??_C@_19GEHBKJLM@?$AA?4?$AAS?$AAY?$AAS?$AA?$AA@
0x18006F838: "__cdecl _imp_RegEnumValueA" __imp_RegEnumValueA
0x18004B220: ElfBackupEventLogFileW
0x18001C738: "__cdecl _imp_load_CryptSignHashW" __imp_load_CryptSignHashW
0x180099370: "unsigned long g_COM_OUT_Offset" ?g_COM_OUT_Offset@@3KA
0x18007FB50: "%SystemRoot%\System32\Drivers\" ??_C@_1DO@CCAPDOPB@?$AA?$CF?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAo?$AAo?$AAt?$AA?$CF?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAD?$AAr?$AAi?$AAv?$AAe?$AAr?$AAs?$AA?2?$AA?$AA@
0x18006F968: "__cdecl _imp_RegDeleteKeyExA" __imp_RegDeleteKeyExA
0x18003A620: GetAccessPermissionsForObjectW
0x180080418: "\REGISTRY\MACHINE\SOFTWARE" ??_C@_1DG@IOMDFJHH@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?$AA@
0x18001C858: "__cdecl _imp_load_CryptSignHashA" __imp_load_CryptSignHashA
0x18007DCC8: "shell32.dll" ??_C@_1BI@BNFKGMFK@?$AAs?$AAh?$AAe?$AAl?$AAl?$AA3?$AA2?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x18006F870: "__cdecl _imp_RegEnumValueW" __imp_RegEnumValueW
0x180071740: "LoadPerf" ??_C@_1BC@MKAFMGMP@?$AAL?$AAo?$AAa?$AAd?$AAP?$AAe?$AAr?$AAf?$AA?$AA@
0x18002CB5C: MSChapSrvInitializeChangePasswordFunctions
0x180070700: "__cdecl _imp_RtlUnicodeStringToAnsiString" __imp_RtlUnicodeStringToAnsiString
0x18007D540: "struct _serverint_MIDL_PROC_FORMAT_STRING const serverint__MIDL_ProcFormatString" ?serverint__MIDL_ProcFormatString@@3U_serverint_MIDL_PROC_FORMAT_STRING@@B
0x18007D4E0: "struct _serverint_MIDL_TYPE_FORMAT_STRING const serverint__MIDL_TypeFormatString" ?serverint__MIDL_TypeFormatString@@3U_serverint_MIDL_TYPE_FORMAT_STRING@@B
0x180097F08: winreg_bhandle
0x180006A20: "unsigned long __cdecl PerflibciLocalQueryCounterSetRegInfoEx(unsigned char,struct _GUID const * __ptr64,enum _PerfRegInfoType,unsigned long,unsigned char * __ptr64,unsigned long,unsigned long * __ptr64)" ?PerflibciLocalQueryCounterSetRegInfoEx@@YAKEPEBU_GUID@@W4_PerfRegInfoType@@KPEAEKPEAK@Z
0x18003ED60: RemoteRegEnumKeyWrapper
0x1800701A0: "__cdecl _imp_RtlCreateSecurityDescriptor" __imp_RtlCreateSecurityDescriptor
0x180071AD0: "unsigned short const * const cszFailureLimit" ?cszFailureLimit@@3QBGB
0x180070578: "__cdecl _imp_RtlQueryPerformanceCounter" __imp_RtlQueryPerformanceCounter
0x18007F548: "(%ls%ls)" ??_C@_1BC@DENFCPFO@?$AA?$CI?$AA?$CF?$AAl?$AAs?$AA?$CF?$AAl?$AAs?$AA?$CJ?$AA?$AA@
0x1800704E8: "__cdecl _imp_RtlRunOnceBeginInitialize" __imp_RtlRunOnceBeginInitialize
0x1800025EC: "void __cdecl PerflibciReindexQuery(struct _PERF_QUERY * __ptr64)" ?PerflibciReindexQuery@@YAXPEAU_PERF_QUERY@@@Z
0x18006FC10: "__cdecl _imp_GetAce" __imp_GetAce
0x18007FD80: "WSACleanup" ??_C@_0L@OPKENMEN@WSACleanup?$AA@
0x18001CCC0: QueryUserServiceName
0x180070558: "__cdecl _imp_NtWriteFile" __imp_NtWriteFile
0x1800703A8: "__cdecl _imp_NtSetInformationThread" __imp_NtSetInformationThread
0x18007E368: " (PID = " ??_C@_1BC@FNLOFEIN@?$AA?5?$AA?$CI?$AAP?$AAI?$AAD?$AA?5?$AA?$DN?$AA?5?$AA?$AA@
0x180070328: "__cdecl _imp_RtlDetermineDosPathNameType_U" __imp_RtlDetermineDosPathNameType_U
0x18006B3D0: "struct _MIDL_STUB_DESC const PerfHost_StubDesc" ?PerfHost_StubDesc@@3U_MIDL_STUB_DESC@@B
0x18005A1E0: "struct _WCT_ENTRY * __ptr64 __cdecl WctRemoveEntry(void * __ptr64)" ?WctRemoveEntry@@YAPEAU_WCT_ENTRY@@PEAX@Z
0x180042510: LookupPrivilegeNameW
0x180071F80: "\Registry\Machine\SOFTWARE\Micro" ??_C@_1IO@CBBKAEAH@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo@
0x18001481C: CodeAuthzGuidIdentsEntireTableFree
0x180014930: SaferCloseLevel
0x180012CA0: CodeAuthzpExpandWildcardList
0x180057620: WmipQueryAllInstanceInfo
0x180041370: AccessCheckByTypeResultListAndAuditAlarmByHandleA
0x180070110: "__cdecl _imp_wcschr" __imp_wcschr
0x180070298: "__cdecl _imp_RtlInitializeHandleTable" __imp_RtlInitializeHandleTable
0x18009F310: "__cdecl _imp_CredFree" __imp_CredFree
0x18003DFC0: BaseRegDeleteKeyEx
0x18001A800: LogonUserW
0x18005F258: PathReplaceGreedy
0x18009F0D0: "__cdecl _imp_CryptEncrypt" __imp_CryptEncrypt
0x180039A10: GetMultipleTrusteeOperationW
0x18002C530: RegDeleteKeyExAStub
0x180045DB0: SddlAddProcessTrustLabelAce
0x18006EF40: UserStringKey
0x180097C78: "__cdecl _hmod__WINTRUST_dll" __hmod__WINTRUST_dll
0x18006FD60: "__cdecl _imp_AddAuditAccessObjectAce" __imp_AddAuditAccessObjectAce
0x18002FB20: LsaSetDomainInformationPolicy
0x18006F4A8: "__cdecl _imp_SetEvent" __imp_SetEvent
0x180080190: "\{1BD51F8C-8CFC-4708-A88D-5690DE" ??_C@_1FA@NFDDCOIJ@?$AA?2?$AA?$HL?$AA1?$AAB?$AAD?$AA5?$AA1?$AAF?$AA8?$AAC?$AA?9?$AA8?$AAC?$AAF?$AAC?$AA?9?$AA4?$AA7?$AA0?$AA8?$AA?9?$AAA?$AA8?$AA8?$AAD?$AA?9?$AA5?$AA6?$AA9?$AA0?$AAD?$AAE@
0x18009F010: "__cdecl _imp_SystemFunction028" __imp_SystemFunction028
0x18006F948: "__cdecl _imp_RegFlushKey" __imp_RegFlushKey
0x18006FD28: "__cdecl _imp_PrivilegeCheck" __imp_PrivilegeCheck
0x1800805E0: "\WOW6432Node" ??_C@_1BK@GKBHLFGI@?$AA?2?$AAW?$AAO?$AAW?$AA6?$AA4?$AA3?$AA2?$AAN?$AAo?$AAd?$AAe?$AA?$AA@
0x180073BC0: "GetMartaExtensionInterface" ??_C@_0BL@BJIODDPH@GetMartaExtensionInterface?$AA@
0x18007F958: "perfc004.dat" ??_C@_1BK@INFKACJF@?$AAp?$AAe?$AAr?$AAf?$AAc?$AA0?$AA0?$AA4?$AA?4?$AAd?$AAa?$AAt?$AA?$AA@
0x18003DF30: BaseRegCloseKey
0x180071BB8: "unsigned short const * const OpenTimeout" ?OpenTimeout@@3QBGB
0x180016520: QueryTraceW
0x180098100: g_SaferPolicyTimeStamp
0x180035F20: SaferiPopulateDefaultsInRegistry
0x18004F27C: WPP_SF_diii
0x18002BAB0: CredBackupCredentialsStub
0x18003D2FC: AccProvpGetProviderForPath
0x18001B770: ElfCloseEventLog
0x18009F138: "__cdecl _imp_CryptReleaseContext" __imp_CryptReleaseContext
0x18007DC70: "SamFreeMemory" ??_C@_0O@IEICEKAG@SamFreeMemory?$AA@
0x18008FD5C: "__cdecl _IMPORT_DESCRIPTOR_KERNELBASE" __IMPORT_DESCRIPTOR_KERNELBASE
0x1800706E0: "__cdecl _imp_RtlEnterCriticalSection" __imp_RtlEnterCriticalSection
0x18004F500: "__cdecl TlgWrite" _TlgWrite
0x180057014: WmipEnumRegGuids
0x18006F9D8: "__cdecl _imp_GetLocalTime" __imp_GetLocalTime
0x18002A770: CloseEncryptedFileRaw
0x180009728: CacheDomainAndDnsDomainSids
0x18004AA40: OpenBackupEventLogA
0x180070760: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x1800723C4: "." ??_C@_13JOFGPIOO@?$AA?4?$AA?$AA@
0x1800988F8: "void * __ptr64 __ptr64 hGlobalDataMutex" ?hGlobalDataMutex@@3PEAXEA
0x18002E410: LsaLookupPrivilegeDisplayName
0x18007F8C8: "Collect" ??_C@_07GOPPECED@Collect?$AA@
0x18009F358: "__cdecl _imp_CredRestoreCredentials" __imp_CredRestoreCredentials
0x180071C60: "\System32\AppLocker\MDM" ??_C@_1DA@OEGBFAIE@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA3?$AA2?$AA?2?$AAA?$AAp?$AAp?$AAL?$AAo?$AAc?$AAk?$AAe?$AAr?$AA?2?$AAM?$AAD?$AAM?$AA?$AA@
0x18003D7D0: QueryTraceA
0x180073ED0: "__cdecl _sz_api_ms_win_devices_config_l1_1_1_dll" __sz_api_ms_win_devices_config_l1_1_1_dll
0x18004AB20: OpenBackupEventLogW
0x18006F5D0: "__cdecl _imp_GetSystemDefaultUILanguage" __imp_GetSystemDefaultUILanguage
0x180098300: "int (__cdecl* __ptr64 pfnPeekMessageW)(struct tagMSG * __ptr64,struct HWND__ * __ptr64,unsigned int,unsigned int,unsigned int)" ?pfnPeekMessageW@@3P6AHPEAUtagMSG@@PEAUHWND__@@III@ZEA
0x18005BA90: OpenCombinedClassesRoot
0x1800705E8: "__cdecl _imp_RtlInitializeSRWLock" __imp_RtlInitializeSRWLock
0x180043E20: ConvertSDToStringSDRootDomainA
0x180034644: "__cdecl _GetEffectiveLevelId" __GetEffectiveLevelId
0x1800700B0: "__cdecl _imp__ui64tow_s" __imp__ui64tow_s
0x18001C230: BuildExplicitAccessWithNameA
0x18006FA78: "__cdecl _imp_EventAccessRemove" __imp_EventAccessRemove
0x18001D4B8: "__cdecl _imp_load_GetSecurityInfo" __imp_load_GetSecurityInfo
0x18007DB70: "feclient.dll" ??_C@_1BK@KEFJJPFN@?$AAf?$AAe?$AAc?$AAl?$AAi?$AAe?$AAn?$AAt?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x18001C954: "__cdecl _imp_load_CryptDuplicateHash" __imp_load_CryptDuplicateHash
0x18006F490: "__cdecl _imp_InitializeCriticalSection" __imp_InitializeCriticalSection
0x1800705B8: "__cdecl _imp_RtlEnumerateGenericTableAvl" __imp_RtlEnumerateGenericTableAvl
0x18007EEA0: "AccProvHandleGetAllRights" ??_C@_0BK@JPENBADI@AccProvHandleGetAllRights?$AA@
0x1800537A0: WmiFreeBuffer
0x18007F658: "%TEMP%\Perflib_Perfdata_" ??_C@_1DC@JAFAHIFN@?$AA?$CF?$AAT?$AAE?$AAM?$AAP?$AA?$CF?$AA?2?$AAP?$AAe?$AAr?$AAf?$AAl?$AAi?$AAb?$AA_?$AAP?$AAe?$AAr?$AAf?$AAd?$AAa?$AAt?$AAa?$AA_?$AA?$AA@
0x18006F360: "__cdecl _imp_FormatMessageW" __imp_FormatMessageW
0x1800720C0: "unsigned short const * const PerfSubKey" ?PerfSubKey@@3QBGB
0x180070408: "__cdecl _imp_RtlGetOwnerSecurityDescriptor" __imp_RtlGetOwnerSecurityDescriptor
0x180070050: "__cdecl _imp__wcsnicmp" __imp__wcsnicmp
0x180014278: DeleteAdvapiCriticalSections
0x18006F338: "__cdecl _imp_GetModuleHandleExW" __imp_GetModuleHandleExW
0x18002B8F0: CreatePrivateObjectSecurityExStub
0x18006FDD0: "__cdecl _imp_RevertToSelf" __imp_RevertToSelf
0x18006F4E0: "__cdecl _imp_DecodePointer" __imp_DecodePointer
0x18002EDD0: LsaSetCAPs
0x180009040: LocalGetSDDLDeliminator
0x180074000: WPP_4f338d5f38b13f4b2fbcb88d1ed0d3cd_Traceguids
0x18002BF40: EventAccessControlStub
0x18007D4B8: "struct _NDR64_RANGE_FORMAT const __midl_frag20" ?__midl_frag20@@3U_NDR64_RANGE_FORMAT@@B
0x18009F338: "__cdecl _imp_CredpEncodeSecret" __imp_CredpEncodeSecret
0x18007E420: "\Registry\Machine\System\Current" ??_C@_1IM@IJHBDCNC@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x18001CCD0: QueryUserServiceNameForContext
0x180080328: "\MediaFoundation" ??_C@_1CC@FEPMIPGD@?$AA?2?$AAM?$AAe?$AAd?$AAi?$AAa?$AAF?$AAo?$AAu?$AAn?$AAd?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?$AA@
0x18003D238: AccProvpGetProviderForHandle
0x18001C7EC: "__cdecl _imp_load_CryptDeriveKey" __imp_load_CryptDeriveKey
0x18007EDC0: "AccProvGetAccessInfoPerObjectTyp" ??_C@_0CC@OLNLEDEE@AccProvGetAccessInfoPerObjectTyp@
0x180097CD8: "__cdecl _hmod__api_ms_win_devices_config_l1_1_1_dll" __hmod__api_ms_win_devices_config_l1_1_1_dll
0x1800313A8: "void __cdecl FreeApplicationInfo(struct __MIDL_appmgmt_0004 * __ptr64)" ?FreeApplicationInfo@@YAXPEAU__MIDL_appmgmt_0004@@@Z
0x18006F350: "__cdecl _imp_SetFilePointer" __imp_SetFilePointer
0x18004DB94: "unsigned long __cdecl PerfpSendNotification(void * __ptr64,unsigned long,void * __ptr64,unsigned long,void * __ptr64 * __ptr64,unsigned long * __ptr64)" ?PerfpSendNotification@@YAKPEAXK0KPEAPEAXPEAK@Z
0x18001D143: "__cdecl _imp_load_CredDeleteA" __imp_load_CredDeleteA
0x18001AAF4: LocalOpenPredefHandle
0x18007F8B8: "Open" ??_C@_04DNCDCIAE@Open?$AA@
0x18005F8EC: Wow64RedirectKeyPathInternal
0x18006FA98: api-ms-win-eventing-controller-l1-1-0_NULL_THUNK_DATA
0x180097090: "long lEventLogLevel" ?lEventLogLevel@@3JA
0x18001D336: "__cdecl _imp_load_CredProfileLoaded" __imp_load_CredProfileLoaded
0x180070628: "__cdecl _imp_RtlInitString" __imp_RtlInitString
0x18001A9D0: "unsigned long __cdecl DestroyPerflibFunctionTimer(void)" ?DestroyPerflibFunctionTimer@@YAKXZ
0x18001C846: "__cdecl _imp_load_CryptDecrypt" __imp_load_CryptDecrypt
0x1800983E0: "struct _PERFLIBCI_RED_BLACK_NODE * __ptr64 __ptr64 g_ObjectTree" ?g_ObjectTree@@3PEAU_PERFLIBCI_RED_BLACK_NODE@@EA
0x180070370: "__cdecl _imp_RtlSetLastWin32Error" __imp_RtlSetLastWin32Error
0x180003D68: "unsigned long __cdecl To_SECL_BLOB_W(void * __ptr64,struct _SECL_BLOB * __ptr64)" ?To_SECL_BLOB_W@@YAKPEAXPEAU_SECL_BLOB@@@Z
0x18005C0C0: RegConn_spx
0x18003186C: "void __cdecl _DebugMsg(unsigned long,unsigned long,...)" ?_DebugMsg@@YAXKKZZ
0x18004679C: FreeOperandValue
0x18006FFC0: "__cdecl _imp_QueryServiceStatus" __imp_QueryServiceStatus
0x180015EE0: ImpersonateLoggedOnUserStub
0x18007F8A8: "unsigned short const * const FOREIGN_STRING" ?FOREIGN_STRING@@3QBGB
0x18006FCB0: "__cdecl _imp_GetSecurityDescriptorControl" __imp_GetSecurityDescriptorControl
0x180098920: fWaitSddlLookup
0x18001CEC5: "__cdecl _imp_load_BCryptGenRandom" __imp_load_BCryptGenRandom
0x180001194: PerflibciLocalQueryCounterInfo
0x18002A790: DecryptFileA
0x180087770: api-ms-win-security-lsalookup-l1-1-0_NULL_THUNK_DATA_DLN
0x18002C4A0: PrivilegedServiceAuditAlarmWStub
0x18009F3C0: api-ms-win-security-lsalookup-l1-1-0_NULL_THUNK_DATA_DLA
0x18009F200: "__cdecl _imp_CryptCATCatalogInfoFromContext" __imp_CryptCATCatalogInfoFromContext
0x18007FAC0: "_%d" ??_C@_17PFPODFCN@?$AA_?$AA?$CF?$AAd?$AA?$AA@
0x18006F600: "__cdecl _imp_MapPredefinedHandleInternal" __imp_MapPredefinedHandleInternal
0x18006FE38: "__cdecl _imp_RegisterServiceCtrlHandlerExW" __imp_RegisterServiceCtrlHandlerExW
0x1800558C4: WmipProcessMofAddRemoveEvent
0x180088610: api-ms-win-security-lsalookup-l1-1-0_NULL_THUNK_DATA_DLB
0x180014EE0: RegEnumKeyW
0x18006F930: "__cdecl _imp_RegSetKeySecurity" __imp_RegSetKeySecurity
0x18006FC48: "__cdecl _imp_MakeSelfRelativeSD" __imp_MakeSelfRelativeSD
0x18006FDB8: "__cdecl _imp_FindFirstFreeAce" __imp_FindFirstFreeAce
0x180098910: "long lExtCounterTestLevel" ?lExtCounterTestLevel@@3JA
0x18006F8A0: "__cdecl _imp_RegSetValueExA" __imp_RegSetValueExA
0x18001CF0D: "__cdecl _imp_load_BCryptFinishHash" __imp_load_BCryptFinishHash
0x180070028: "__cdecl _imp_wcsstr" __imp_wcsstr
0x18001AEB0: RegEnumKeyA
0x18007F290: "&" ??_C@_13FLOCNAAB@?$AA?$CG?$AA?$AA@
0x18006FFD8: "__cdecl _imp_RegisterServiceCtrlHandlerExA" __imp_RegisterServiceCtrlHandlerExA
0x18007D32C: "CR" ??_C@_15KGPFOBLH@?$AAC?$AAR?$AA?$AA@
0x180099360: "unsigned long g_COM_IN_Offset" ?g_COM_IN_Offset@@3KA
0x180088398: CRYPTSP_NULL_THUNK_DATA_DLB
0x180098AA8: Logon32MprHandle
0x18002CF70: ItCliUnregisterIdleTask
0x18003F0F0: RegQueryValueA
0x180014140: "__cdecl DllInitialize" _DllInitialize
0x18003F330: RemoteRegQueryValueWrapper
0x18002D870: CredRenameW
0x180017E0C: WmipOpenKernelGuid
0x18002D890: LsaAddPrivilegesToAccount
0x18005C0A0: RegConn_np
0x18004805C: IsValueSizeFixed
0x180004390: BaseRegCchSpecialKeyLen
0x18007D35C: "GR" ??_C@_15DNGEKDKB@?$AAG?$AAR?$AA?$AA@
0x18002D870: CredRenameA
0x18008FF28: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-timezone-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-timezone-l1-1-0
0x18009F0C8: "__cdecl _imp_CryptGenRandom" __imp_CryptGenRandom
0x180070548: "__cdecl _imp_RtlValidRelativeSecurityDescriptor" __imp_RtlValidRelativeSecurityDescriptor
0x18002C4F0: QueryServiceDynamicInformationStub
0x180059034: "unsigned long __cdecl WctGetObjectInfo(struct _WCT_CLIENT_HANDLE * __ptr64,void * __ptr64,void * __ptr64 * __ptr64,enum _WCT_OBJECT_TYPE * __ptr64)" ?WctGetObjectInfo@@YAKPEAU_WCT_CLIENT_HANDLE@@PEAXPEAPEAXPEAW4_WCT_OBJECT_TYPE@@@Z
0x18009F428: "__cdecl _imp_BCryptCreateHash" __imp_BCryptCreateHash
0x18004C72C: ElfSetUseLegacyReportEvent
0x180098998: g_RegHandleEventsProvider
0x18006F570: "__cdecl _imp_FindClose" __imp_FindClose
0x18002B600: AccessCheckByTypeStub
0x18007D2EC: "RP" ??_C@_15MEHGPIAC@?$AAR?$AAP?$AA?$AA@
0x180070588: "__cdecl _imp_RtlAcquireSRWLockExclusive" __imp_RtlAcquireSRWLockExclusive
0x180076270: "AI" ??_C@_15GMCFJACC@?$AAA?$AAI?$AA?$AA@
0x18007E6F0: "Software\Policies\Microsoft\Wind" ??_C@_1HG@FELAFNOA@?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAP?$AAo?$AAl?$AAi?$AAc?$AAi?$AAe?$AAs?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd@
0x18006F9C8: "__cdecl _imp_GetComputerNameExW" __imp_GetComputerNameExW
0x180041050: AccessCheckByTypeAndAuditAlarmA
0x18002C630: RegLoadKeyWStub
0x18006FE78: "__cdecl _imp_GetServiceKeyNameW" __imp_GetServiceKeyNameW
0x18005D4F0: LsaAddAccountRights
0x18003443C: SaferpLoadV2
0x180039F7C: "unsigned long __cdecl SetEntriesInAListW(unsigned long,struct _ACTRL_ACCESS_ENTRYW * __ptr64,enum _ACCESS_MODE,unsigned long,unsigned short const * __ptr64,struct _ACTRL_ALISTW * __ptr64,struct _ACTRL_ALISTW * __ptr64 * __ptr64)" ?SetEntriesInAListW@@YAKKPEAU_ACTRL_ACCESS_ENTRYW@@W4_ACCESS_MODE@@KPEBGPEAU_ACTRL_ALISTW@@PEAPEAU3@@Z
0x180098A30: FnSamFreeMemory
0x1800702C8: "__cdecl _imp_RtlAppendUnicodeStringToString" __imp_RtlAppendUnicodeStringToString
0x18006FA00: "__cdecl _imp_GetDynamicTimeZoneInformationEffectiveYears" __imp_GetDynamicTimeZoneInformationEffectiveYears
0x180010BE0: StringCchCopyW
0x18007D420: "TP" ??_C@_15BCCPBLBP@?$AAT?$AAP?$AA?$AA@
0x18007EC60: "HonorUserIdentities" ??_C@_1CI@NAOMADND@?$AAH?$AAo?$AAn?$AAo?$AAr?$AAU?$AAs?$AAe?$AAr?$AAI?$AAd?$AAe?$AAn?$AAt?$AAi?$AAt?$AAi?$AAe?$AAs?$AA?$AA@
0x18004C720: ElfReportEventAndSourceW
0x18007DC28: "SamOpenDomain" ??_C@_0O@GHHMGBGJ@SamOpenDomain?$AA@
0x18001CAA5: "__cdecl _imp_load_CryptCATAdminEnumCatalogFromHash" __imp_load_CryptCATAdminEnumCatalogFromHash
0x18006F520: "__cdecl _imp_CancelThreadpoolIo" __imp_CancelThreadpoolIo
0x18002C190: LsaICLookupNamesWithCredsStub
0x1800725E0: "msiltcfg.dll" ??_C@_1BK@JNCEEGNJ@?$AAm?$AAs?$AAi?$AAl?$AAt?$AAc?$AAf?$AAg?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x18002BB40: CredGetSessionTypesStub
0x1800802F8: "\Interface" ??_C@_1BG@GLFHKKME@?$AA?2?$AAI?$AAn?$AAt?$AAe?$AAr?$AAf?$AAa?$AAc?$AAe?$AA?$AA@
0x1800150E0: RegCloseKeyStub
0x18005ECC4: LsapCrClearValueToUnicode
0x1800980F8: g_DefaultCodeLevelFlags
0x18001AB70: LsaLookupSidsStub
0x18002C490: PrivilegeCheckStub
0x18007F5A0: LegalAttributeCharEnd
0x18006FD10: "__cdecl _imp_SetSecurityDescriptorOwner" __imp_SetSecurityDescriptorOwner
0x180059EC8: "int __cdecl WctInitPackage(void)" ?WctInitPackage@@YAHXZ
0x18002BD30: CredpEncodeCredentialStub
0x180014CF0: Wow64NtOpenKey
0x18002F770: LsaOpenTrustedDomainByName
0x18006E6D0: CodeAuthzpBuildRestrictedTokenTable
0x180098688: "struct _ERROR_LOG PerfpErrorLog" ?PerfpErrorLog@@3U_ERROR_LOG@@A
0x180038E50: GetEffectiveRightsFromAclA
0x18004666C: EncodeAttributeName
0x180070268: "__cdecl _imp_NtSetValueKey" __imp_NtSetValueKey
0x18007F248: "Not_Exists" ??_C@_1BG@IAIKOKIO@?$AAN?$AAo?$AAt?$AA_?$AAE?$AAx?$AAi?$AAs?$AAt?$AAs?$AA?$AA@
0x180071E90: "unsigned short const * const OLD_STRING" ?OLD_STRING@@3QBGB
0x180017B60: RegDisableReflectionKey
0x180016450: ChangeServiceConfigWStub
0x180072620: "CloseWindowStation" ??_C@_0BD@KOKEIHOF@CloseWindowStation?$AA@
0x180031748: "int __cdecl DebugLevelOn(unsigned long)" ?DebugLevelOn@@YAHK@Z
0x18007F6D0: WPP_d9c5eeb16f5530161408911d922cfa74_Traceguids
0x18009F078: "__cdecl _imp_CryptHashData" __imp_CryptHashData
0x18007D374: "FA" ??_C@_15LEJEIIHF@?$AAF?$AAA?$AA?$AA@
0x180032E44: "__cdecl _CodeAuthzpGetAuthzLevelInfo" __CodeAuthzpGetAuthzLevelInfo
0x18007F4D8: "(%ls)" ??_C@_1M@OEKLHGCN@?$AA?$CI?$AA?$CF?$AAl?$AAs?$AA?$CJ?$AA?$AA@
0x18001C170: NotifyServiceStatusChangeWStub
0x18003CEB8: "unsigned long __cdecl ConvertTrusteeAToTrusteeW(struct _TRUSTEE_A * __ptr64,struct _TRUSTEE_W * __ptr64,int)" ?ConvertTrusteeAToTrusteeW@@YAKPEAU_TRUSTEE_A@@PEAU_TRUSTEE_W@@H@Z
0x18002FF94: LsapEncryptAuthInfo
0x18002BA20: CreateServiceWStub
0x18002BD20: CredpDecodeCredentialStub
0x180070348: "__cdecl _imp_RtlNtStatusToDosErrorNoTeb" __imp_RtlNtStatusToDosErrorNoTeb
0x18007E658: SrpEvt_AccessDisabledByPolicyDefault
0x18000C740: "__cdecl _CodeAuthzpCheckIdentityPathRules" __CodeAuthzpCheckIdentityPathRules
0x18007F758: PERFLIB_OPEN_PROC_FAILURE
0x180014B00: PSECURITY_SOURCE_NAME_unbind
0x18001CCB0: QueryLocalUserServiceName
0x180072010: S_Perflib
0x18007EB78: "InvertGroups" ??_C@_1BK@JMIEMGJG@?$AAI?$AAn?$AAv?$AAe?$AAr?$AAt?$AAG?$AAr?$AAo?$AAu?$AAp?$AAs?$AA?$AA@
0x180079FD0: "LogFileName" ??_C@_1BI@PDFAFEGC@?$AAL?$AAo?$AAg?$AAF?$AAi?$AAl?$AAe?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x180072750: pszCurrentDockInfo
0x18001A260: LsapLookupSids
0x18006FEC8: "__cdecl _imp_NotifyServiceStatusChangeW" __imp_NotifyServiceStatusChangeW
0x18006F378: "__cdecl _imp_DeleteFileW" __imp_DeleteFileW
0x180014B30: RegQueryInfoKeyWStub
0x18007FA08: "%ws\%ws.tmp" ??_C@_1BI@DLEDEKKD@?$AA?$CF?$AAw?$AAs?$AA?2?$AA?$CF?$AAw?$AAs?$AA?4?$AAt?$AAm?$AAp?$AA?$AA@
0x18001D3C6: "__cdecl _imp_load_CredpConvertTargetInfo" __imp_load_CredpConvertTargetInfo
0x180097EE0: Logon32Lock
0x1800700D8: "__cdecl _imp_wcsncmp" __imp_wcsncmp
0x1800716D4: "__cdecl _guard_iat_table" __guard_iat_table
0x18001CF31: "__cdecl _imp_load_BCryptCloseAlgorithmProvider" __imp_load_BCryptCloseAlgorithmProvider
0x18009F320: "__cdecl _imp_CredEnumerateA" __imp_CredEnumerateA
0x180054AD0: EnumUILanguageCallback
0x180098180: g_LevelHandleTable
0x180039AC4: "unsigned long __cdecl ConvertSDToAccessA(enum _SE_OBJECT_TYPE,void * __ptr64,struct _ACTRL_ALISTA * __ptr64 * __ptr64,struct _ACTRL_ALISTA * __ptr64 * __ptr64,char * __ptr64 * __ptr64,char * __ptr64 * __ptr64)" ?ConvertSDToAccessA@@YAKW4_SE_OBJECT_TYPE@@PEAXPEAPEAU_ACTRL_ALISTA@@2PEAPEAD3@Z
0x180019DA4: "int __cdecl MonBuildPerfDataBlock(struct _PERF_DATA_BLOCK * __ptr64,void * __ptr64 * __ptr64,unsigned long,unsigned long)" ?MonBuildPerfDataBlock@@YAHPEAU_PERF_DATA_BLOCK@@PEAPEAXKK@Z
0x18002B720: AddAuditAccessObjectAceStub
0x18001D11F: "__cdecl _imp_load_CredGetSessionTypes" __imp_load_CredGetSessionTypes
0x180039CA8: "unsigned long __cdecl ConvertSDToAccessW(enum _SE_OBJECT_TYPE,void * __ptr64,struct _ACTRL_ALISTW * __ptr64 * __ptr64,struct _ACTRL_ALISTW * __ptr64 * __ptr64,unsigned short * __ptr64 * __ptr64,unsigned short * __ptr64 * __ptr64)" ?ConvertSDToAccessW@@YAKW4_SE_OBJECT_TYPE@@PEAXPEAPEAU_ACTRL_ALISTW@@2PEAPEAG3@Z
0x18009F0F8: "__cdecl _imp_CryptAcquireContextW" __imp_CryptAcquireContextW
0x1800018F0: PerflibciLocalQueryCounterData
0x18001D7EC: memcpy
0x18002BC30: CredReadDomainCredentialsAStub
0x18002BE00: CryptGetDefaultProviderAStub
0x18002B590: AccessCheckByTypeResultListStub
0x18001D464: IsTermsrvOpenUserClassesPresent
0x18007EFC0: "765294BA-60BC-48B8-92E9-89FD7776" ??_C@_1EK@CDBCGHNF@?$AA7?$AA6?$AA5?$AA2?$AA9?$AA4?$AAB?$AAA?$AA?9?$AA6?$AA0?$AAB?$AAC?$AA?9?$AA4?$AA8?$AAB?$AA8?$AA?9?$AA9?$AA2?$AAE?$AA9?$AA?9?$AA8?$AA9?$AAF?$AAD?$AA7?$AA7?$AA7?$AA6@
0x18006F2F8: "__cdecl _imp_LoadLibraryExW" __imp_LoadLibraryExW
0x18001D0E9: "__cdecl _imp_load_CredMarshalCredentialA" __imp_load_CredMarshalCredentialA
0x180070130: "__cdecl _imp_RtlConvertSidToUnicodeString" __imp_RtlConvertSidToUnicodeString
0x180032728: CodeAuthzpModifyTokenPermissions
0x180073CF0: "__cdecl _sz_USER32_dll" __sz_USER32_dll
0x18002BD70: CryptDeriveKeyStub
0x18007181C: "SP" ??_C@_15PCKCLKH@?$AAS?$AAP?$AA?$AA@
0x18001D0FB: "__cdecl _imp_load_CredMarshalCredentialW" __imp_load_CredMarshalCredentialW
0x180055AB4: WmipRegistryToImagePath
0x18001C6DE: "__cdecl _imp_load_CryptSetProviderExW" __imp_load_CryptSetProviderExW
0x180007680: "struct _PERFLIBCI_PROVIDER_NODE * __ptr64 __cdecl PerflibciFindProvider(struct _GUID * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,int)" ?PerflibciFindProvider@@YAPEAU_PERFLIBCI_PROVIDER_NODE@@PEAU_GUID@@PEBG1H@Z
0x18007E0C0: "8c7daf44-b6dc-11d1-9a4c-0020af6e" ??_C@_1EK@MHILKFNH@?$AA8?$AAc?$AA7?$AAd?$AAa?$AAf?$AA4?$AA4?$AA?9?$AAb?$AA6?$AAd?$AAc?$AA?9?$AA1?$AA1?$AAd?$AA1?$AA?9?$AA9?$AAa?$AA4?$AAc?$AA?9?$AA0?$AA0?$AA2?$AA0?$AAa?$AAf?$AA6?$AAe@
0x1800415C0: LookupAccountNameA
0x18002C540: RegDeleteKeyExWStub
0x18005A850: "unsigned long __cdecl WctCreateSystemSnapshot(struct _SYSTEM_PROCESS_INFORMATION * __ptr64 * __ptr64)" ?WctCreateSystemSnapshot@@YAKPEAPEAU_SYSTEM_PROCESS_INFORMATION@@@Z
0x180014BD0: LocalBaseRegDeleteKeyEx
0x180042B14: "unsigned long __cdecl StartSeclogonService(void)" ?StartSeclogonService@@YAKXZ
0x1800970C0: SidLookupDomOrRootDomRelative
0x180057BD0: UnicodeToAnsi
0x18002B260: UsePinForEncryptedFilesW
0x18005EBA4: LsapCreateCapRpcBindingHandle
0x1800509D0: "unsigned long __cdecl ExtpAlignBuffer(char * __ptr64,char * __ptr64 * __ptr64,unsigned long)" ?ExtpAlignBuffer@@YAKPEADPEAPEADK@Z
0x18002BF80: GetDynamicTimeZoneInformationEffectiveYearsStub
0x180070100: "__cdecl _imp_memset" __imp_memset
0x18007FF18: "ncacn_nb_tcp" ??_C@_1BK@JKILGBNI@?$AAn?$AAc?$AAa?$AAc?$AAn?$AA_?$AAn?$AAb?$AA_?$AAt?$AAc?$AAp?$AA?$AA@
0x180087570: USER32_NULL_THUNK_DATA_DLN
0x180070440: "__cdecl _imp_RtlSetGroupSecurityDescriptor" __imp_RtlSetGroupSecurityDescriptor
0x180098388: g_pAdminSid
0x180010D30: SaferpPol_GetInfoCommon_DefaultLevel
0x18006F318: "__cdecl _imp_CreateEventW" __imp_CreateEventW
0x18002BB60: CredGetTargetInfoWStub
0x18006FF78: api-ms-win-service-private-l1-1-4_NULL_THUNK_DATA
0x180070510: "__cdecl _imp_NtCreateMutant" __imp_NtCreateMutant
0x18009F1C0: USER32_NULL_THUNK_DATA_DLA
0x180088578: USER32_NULL_THUNK_DATA_DLB
0x1800704B8: "__cdecl _imp_NtWaitForSingleObject" __imp_NtWaitForSingleObject
0x1800580E0: "int __cdecl WctDereferenceEntry(struct _WCT_ENTRY * __ptr64)" ?WctDereferenceEntry@@YAHPEAU_WCT_ENTRY@@@Z
0x18007D400: "OI" ??_C@_15FGCPPBFC@?$AAO?$AAI?$AA?$AA@
0x180009190: FContainCallBackAce
0x18006F4C0: "__cdecl _imp_FileTimeToDosDateTime" __imp_FileTimeToDosDateTime
0x18003D06C: "unsigned long __cdecl GetTrusteeWForSid(void * __ptr64,struct _TRUSTEE_W * __ptr64)" ?GetTrusteeWForSid@@YAKPEAXPEAU_TRUSTEE_W@@@Z
0x1800164F0: SetServiceStatusStub
0x180030C08: "unsigned short * __ptr64 __cdecl StringDuplicate(unsigned short const * __ptr64)" ?StringDuplicate@@YAPEAGPEBG@Z
0x18007E4D0: "\Device\SrpDevice" ??_C@_1CE@KLMMFFPN@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAS?$AAr?$AAp?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?$AA@
0x1800703B8: "__cdecl _imp_RtlValidAcl" __imp_RtlValidAcl
0x180058910: "struct HINSTANCE__ * __ptr64 __cdecl WctGetCurrentModule(void)" ?WctGetCurrentModule@@YAPEAUHINSTANCE__@@XZ
0x18002BE10: CryptGetKeyParamStub
0x18008FEEC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0
0x180039DC4: "unsigned long __cdecl SetEntriesInAListA(unsigned long,struct _ACTRL_ACCESS_ENTRYA * __ptr64,enum _ACCESS_MODE,unsigned long,char const * __ptr64,struct _ACTRL_ALISTA * __ptr64,struct _ACTRL_ALISTA * __ptr64 * __ptr64)" ?SetEntriesInAListA@@YAKKPEAU_ACTRL_ACCESS_ENTRYA@@W4_ACCESS_MODE@@KPEBDPEAU_ACTRL_ALISTA@@PEAPEAU3@@Z
0x18001BE50: EnableTraceEx
0x18009F080: "__cdecl _imp_CryptDeriveKey" __imp_CryptDeriveKey
0x18006F650: "__cdecl _imp_Sleep" __imp_Sleep
0x18006FE60: "__cdecl _imp_QueryServiceDynamicInformation" __imp_QueryServiceDynamicInformation
0x18007E678: "ItemData" ??_C@_1BC@PHIHPDEN@?$AAI?$AAt?$AAe?$AAm?$AAD?$AAa?$AAt?$AAa?$AA?$AA@
0x180070410: "__cdecl _imp_RtlSubAuthoritySid" __imp_RtlSubAuthoritySid
0x18001D1D3: "__cdecl _imp_load_CredProtectA" __imp_load_CredProtectA
0x1800806C0: "__cdecl _real@43e0000000000000" __real@43e0000000000000
0x1800029F4: "void __cdecl PerfpUpdateCounterIndices(void * __ptr64,struct _PERFLIBCI_QUERY_PROVIDER_NODE * __ptr64)" ?PerfpUpdateCounterIndices@@YAXPEAXPEAU_PERFLIBCI_QUERY_PROVIDER_NODE@@@Z
0x180071C20: "unsigned short const * const ExportValue" ?ExportValue@@3QBGB
0x18006F9D0: "__cdecl _imp_GetSystemTime" __imp_GetSystemTime
0x18005D98C: LsaQuerySecret
0x180097F80: pbSystemSidByte
0x180071D90: "\Software\Policies\Microsoft\Win" ??_C@_1FG@CGKNOKNN@?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAP?$AAo?$AAl?$AAi?$AAc?$AAi?$AAe?$AAs?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn@
0x18001D028: "__cdecl _imp_load_CredProtectW" __imp_load_CredProtectW
0x180036F98: SaferpLevelObjpCleanupEntry
0x180071824: "RA" ??_C@_15CMNDMIPI@?$AAR?$AAA?$AA?$AA@
0x18002E220: LsaGetSystemAccessAccount
0x18002B300: AccessCheckAndAuditAlarmWStub
0x18006F300: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x18006FF70: "__cdecl _imp_CreateServiceEx" __imp_CreateServiceEx
0x18007F4A0: "@RESOURCE." ??_C@_1BG@ILPAMDME@?$AA?$EA?$AAR?$AAE?$AAS?$AAO?$AAU?$AAR?$AAC?$AAE?$AA?4?$AA?$AA@
0x18005B918: ExtractClassKey
0x180070178: "__cdecl _imp_NtOpenProcessToken" __imp_NtOpenProcessToken
0x180038B70: BuildSecurityDescriptorA
0x180070418: "__cdecl _imp_RtlAbsoluteToSelfRelativeSD" __imp_RtlAbsoluteToSelfRelativeSD
0x18007DB90: "Unable to load client dll, error" ??_C@_0CH@GMKANLFA@Unable?5to?5load?5client?5dll?0?5error@
0x1800717C4: "SA" ??_C@_15OHIPBLFN@?$AAS?$AAA?$AA?$AA@
0x180014BB0: CryptGetHashParamStub
0x180070118: "__cdecl _imp_wcscmp" __imp_wcscmp
0x18006F330: "__cdecl _imp_GetCommandLineW" __imp_GetCommandLineW
0x18005F6C8: Wow64SelectWowNodePathInternal
0x180070590: "__cdecl _imp_RtlInsertElementGenericTableAvl" __imp_RtlInsertElementGenericTableAvl
0x1800722F0: "prfc" ??_C@_19PDHHDAFG@?$AAp?$AAr?$AAf?$AAc?$AA?$AA@
0x1800704A8: "__cdecl _imp_EtwRegisterTraceGuidsW" __imp_EtwRegisterTraceGuidsW
0x1800072B0: "unsigned long __cdecl PerflibciEnsureCounterSetList(void)" ?PerflibciEnsureCounterSetList@@YAKXZ
0x18001C260: "__cdecl _C_specific_handler" __C_specific_handler
0x18007E638: SrpEvt_AccessAuditByPolicy
0x180031DD0: "public: void __cdecl CEventsBase::Install(unsigned long,unsigned short const * __ptr64,unsigned short const * __ptr64) __ptr64" ?Install@CEventsBase@@QEAAXKPEBG0@Z
0x18007D3AC: "KX" ??_C@_15CFBLIDLO@?$AAK?$AAX?$AA?$AA@
0x18006F5A8: "__cdecl _imp_lstrlenW" __imp_lstrlenW
0x18007F3E0: "Device_Member_of_any" ??_C@_1CK@GKLPGIJI@?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA_?$AAM?$AAe?$AAm?$AAb?$AAe?$AAr?$AA_?$AAo?$AAf?$AA_?$AAa?$AAn?$AAy?$AA?$AA@
0x18007D38C: "FX" ??_C@_15JJIFJAGA@?$AAF?$AAX?$AA?$AA@
0x18007FD00: "GetSendMessageReceiver" ??_C@_0BH@IJBKMLHC@GetSendMessageReceiver?$AA@
0x18002C510: QueryTraceProcessingHandleStub
0x18002CF60: MIDL_user_free
0x180080580: "\REGISTRY\USER\*\SOFTWARE\Classe" ??_C@_1FM@HBIDDIMP@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAU?$AAS?$AAE?$AAR?$AA?2?$AA?$CK?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAC?$AAl?$AAa?$AAs?$AAs?$AAe@
0x180071E70: "unsigned short const * const COSTLY_STRING" ?COSTLY_STRING@@3QBGB
0x180098A38: FnSamLookupNamesInDomain
0x18006F4D0: "__cdecl _imp_TermsrvOpenUserClasses" __imp_TermsrvOpenUserClasses
0x180054934: WmipConvertWADToAnsi
0x180034680: SaferRecordEventLogEntry
0x180099318: WmipEventPumpOverlappedEvent
0x18002FC50: LsaSetTrustedDomainInfoByName
0x18005D01C: LsaSetInformationPolicy
0x18009F098: "__cdecl _imp_CryptHashSessionKey" __imp_CryptHashSessionKey
0x180071AA0: "unsigned short const * const cszLibraryValidationData" ?cszLibraryValidationData@@3QBGB
0x180054E30: WmiMofEnumerateResourcesW
0x18009F180: "__cdecl _imp_GetUserNameExA" __imp_GetUserNameExA
0x18005A650: OpenThreadWaitChainSession
0x18007F998: "perfc016.dat" ??_C@_1BK@PMGOHNHM@?$AAp?$AAe?$AAr?$AAf?$AAc?$AA0?$AA1?$AA6?$AA?4?$AAd?$AAa?$AAt?$AA?$AA@
0x180038840: AipGetFileSignature
0x1800044C4: BaseRegGetUserPrefixLength
0x180071D10: "\Registry\Machine\Software\Polic" ??_C@_1HI@MEIHDIIM@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAP?$AAo?$AAl?$AAi?$AAc@
0x18001AF70: EnumerateTraceGuidsExStub
0x18006FC38: "__cdecl _imp_AddAccessAllowedAce" __imp_AddAccessAllowedAce
0x180079FB8: "PolicyScope" ??_C@_1BI@FDKMPOEA@?$AAP?$AAo?$AAl?$AAi?$AAc?$AAy?$AAS?$AAc?$AAo?$AAp?$AAe?$AA?$AA@
0x180054C10: WmiMofEnumerateResourcesA
0x1800724E0: "*" ??_C@_13BBDEGPLJ@?$AA?$CK?$AA?$AA@
0x18001D7F8: memmove
0x18002B6C0: AddAccessAllowedObjectAceStub
0x18005BC40: EnumTableRemoveKey
0x18006F3C0: "__cdecl _imp_HeapFree" __imp_HeapFree
0x18005DA28: LsaQuerySecret_Old
0x18002D500: AuditSetGlobalSaclA
0x18001C65F: "__cdecl _tailMerge_cryptsp_dll" __tailMerge_cryptsp_dll
0x180040AB0: LockServiceDatabase
0x1800157E0: AddAccessAllowedAceStub
0x1800986D0: WPP_REGISTRATION_GUIDS
0x18001CF55: "__cdecl _imp_load_BCryptGetProperty" __imp_load_BCryptGetProperty
0x180080064: "\\" ??_C@_15LEKKCGMK@?$AA?2?$AA?2?$AA?$AA@
0x180070720: "__cdecl _imp_LdrGetProcedureAddress" __imp_LdrGetProcedureAddress
0x180072048: "unsigned short const * const OpenProcedureWaitTime" ?OpenProcedureWaitTime@@3QBGB
0x18001C7FE: "__cdecl _imp_load_CryptCreateHash" __imp_load_CryptCreateHash
0x18003824C: "__cdecl _CodeAuthzpCompareImagePathHelper" __CodeAuthzpCompareImagePathHelper
0x18007F070: "MSV1_0:Interactive" ??_C@_1CG@JBLKCOHK@?$AAM?$AAS?$AAV?$AA1?$AA_?$AA0?$AA?3?$AAI?$AAn?$AAt?$AAe?$AAr?$AAa?$AAc?$AAt?$AAi?$AAv?$AAe?$AA?$AA@
0x18005EFA0: Wow64NtCreateKey
0x180033F34: SaferpGetExtensionDllName
0x18001A160: GetAceStub
0x180015BF0: CryptReleaseContextStub
0x180045F0C: SddlAddScopedPolicyIDAce
0x18009F2E0: "__cdecl _imp_CredGetSessionTypes" __imp_CredGetSessionTypes
0x18001ABD0: LsaFreeMemoryStub
0x1800701E0: "__cdecl _imp_RtlCopyUnicodeString" __imp_RtlCopyUnicodeString
0x18005E5E4: LsapRetrievePrivateData2
0x1800705A0: "__cdecl _imp_RtlAcquireSRWLockShared" __imp_RtlAcquireSRWLockShared
0x180070540: "__cdecl _imp_RtlCreateAcl" __imp_RtlCreateAcl
0x18001B7EC: ElfGetTheRpcHandle
0x18006FF98: "__cdecl _imp_ControlServiceExA" __imp_ControlServiceExA
0x18006F540: "__cdecl _imp_GetFileMUIPath" __imp_GetFileMUIPath
0x18002C380: LsaStorePrivateDataStub
0x18002DFD0: LsaGetQuotasForAccount
0x18003C660: "void __cdecl CleanupConvertNode(void * __ptr64)" ?CleanupConvertNode@@YAXPEAX@Z
0x18006FE88: "__cdecl _imp_OpenServiceW" __imp_OpenServiceW
0x18009F1E0: "__cdecl _imp_WTHelperProvDataFromStateData" __imp_WTHelperProvDataFromStateData
0x18001A1B0: GetNamedSecurityInfoWStub
0x18001C6F0: "__cdecl _imp_load_CryptGenKey" __imp_load_CryptGenKey
0x18002C520: RegCopyTreeWStub
0x180009CB0: LsapFreePrivateHandle
0x18002CF60: SC_MIDL_user_free
0x18009F020: "__cdecl _imp_SystemFunction002" __imp_SystemFunction002
0x180040174: WsdpAbortShutdown
0x18009F108: "__cdecl _imp_CryptSetProvParam" __imp_CryptSetProvParam
0x18009F030: "__cdecl _imp_SystemFunction005" __imp_SystemFunction005
0x1800700D0: "__cdecl _imp_iswalpha" __imp_iswalpha
0x18009F028: "__cdecl _imp_SystemFunction004" __imp_SystemFunction004
0x18001A190: SetNamedSecurityInfoWStub
0x180098340: "__int64 (__cdecl* __ptr64 pfnDispatchMessageW)(struct tagMSG const * __ptr64)" ?pfnDispatchMessageW@@3P6A_JPEBUtagMSG@@@ZEA
0x1800704C8: "__cdecl _imp_NtQueryInformationThread" __imp_NtQueryInformationThread
0x18006F880: "__cdecl _imp_RegCloseKey" __imp_RegCloseKey
0x18006FE90: "__cdecl _imp_ControlServiceExW" __imp_ControlServiceExW
0x18009F268: "__cdecl _imp_CredGetTargetInfoW" __imp_CredGetTargetInfoW
0x180039340: LookupSecurityDescriptorPartsW
0x18003E030: BaseRegFlushKey
0x180070688: "__cdecl _imp_NtQueryInformationToken" __imp_NtQueryInformationToken
0x18001D6F0: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x18006FDF0: "__cdecl _imp_AddAuditAccessAce" __imp_AddAuditAccessAce
0x1800877A8: api-ms-win-security-provider-l1-1-0_NULL_THUNK_DATA_DLN
0x180070438: "__cdecl _imp_RtlFirstFreeAce" __imp_RtlFirstFreeAce
0x180031C3C: "unsigned long __cdecl GetBindingHandle(void * __ptr64 * __ptr64)" ?GetBindingHandle@@YAKPEAPEAX@Z
0x180097CA8: "__cdecl _hmod__api_ms_win_security_lsalookup_l1_1_0_dll" __hmod__api_ms_win_security_lsalookup_l1_1_0_dll
0x18003E200: SafeBaseRegGetKeySecurity
0x18001D3A2: "__cdecl _imp_load_CredRestoreCredentials" __imp_load_CredRestoreCredentials
0x18004B5B0: ElfFlushEventLog
0x18007F690: PERFLIB_ACCESS_DENIED
0x18006F6C0: "__cdecl _imp_RpcSsDestroyClientContext" __imp_RpcSsDestroyClientContext
0x18005D898: LsaOpenSecret
0x180071F10: "unsigned short const * const HKLMPerflibKey" ?HKLMPerflibKey@@3QBGB
0x18002BF00: EnumDependentServicesWStub
0x180052914: RtlStringCbCatW
0x18006F550: "__cdecl _imp_SetErrorMode" __imp_SetErrorMode
0x18006FA28: "__cdecl _imp_OpenTraceW" __imp_OpenTraceW
0x18002BC60: CredRestoreCredentialsStub
0x1800702E8: "__cdecl _imp_RtlLookupElementGenericTable" __imp_RtlLookupElementGenericTable
0x18007E598: "Untrusted" ??_C@_1BE@JFNOEEFJ@?$AAU?$AAn?$AAt?$AAr?$AAu?$AAs?$AAt?$AAe?$AAd?$AA?$AA@
0x180098328: "enum tagINSTALLUILEVEL (__cdecl* __ptr64 gpfnMsiSetInternalUI)(enum tagINSTALLUILEVEL,struct HWND__ * __ptr64 * __ptr64)" ?gpfnMsiSetInternalUI@@3P6A?AW4tagINSTALLUILEVEL@@W41@PEAPEAUHWND__@@@ZEA
0x18007F110: "ldap_initA" ??_C@_0L@NBCCOCDA@ldap_initA?$AA@
0x18003B350: SetEntriesInAccessListW
0x1800701D0: "__cdecl _imp_RtlIsGenericTableEmpty" __imp_RtlIsGenericTableEmpty
0x180035E44: CodeAuthzpFormatLevelKeyPath
0x180072540: "MsiAdvertiseScriptW" ??_C@_0BE@PGOCEOH@MsiAdvertiseScriptW?$AA@
0x18006F938: "__cdecl _imp_RegEnumKeyExW" __imp_RegEnumKeyExW
0x180057CBC: "void __cdecl WctAddEntry(struct _WCT_ENTRY * __ptr64)" ?WctAddEntry@@YAXPEAU_WCT_ENTRY@@@Z
0x18005C13C: wRegConn_bind
0x18003B300: SetEntriesInAccessListA
0x18002BB10: CredFindBestCredentialAStub
0x18007DF10: "RunDiagnosticLoggingApplicationM" ??_C@_1FE@IHEFIKGA@?$AAR?$AAu?$AAn?$AAD?$AAi?$AAa?$AAg?$AAn?$AAo?$AAs?$AAt?$AAi?$AAc?$AAL?$AAo?$AAg?$AAg?$AAi?$AAn?$AAg?$AAA?$AAp?$AAp?$AAl?$AAi?$AAc?$AAa?$AAt?$AAi?$AAo?$AAn?$AAM@
0x18004A4FC: ULongAddStringSize
0x18007DE10: "LoadStringW" ??_C@_0M@DPBIDBBE@LoadStringW?$AA@
0x180097E20: gDomainSidLookup
0x18006FDC8: "__cdecl _imp_ObjectOpenAuditAlarmW" __imp_ObjectOpenAuditAlarmW
0x18006F878: "__cdecl _imp_RegEnumKeyExA" __imp_RegEnumKeyExA
0x18007F610: LegalAttributeChar
0x18002C0F0: LsaCreateSecretStub
0x180097C80: "__cdecl _hmod__CRYPTBASE_dll" __hmod__CRYPTBASE_dll
0x18006F9A0: api-ms-win-core-registry-l1-1-1_NULL_THUNK_DATA
0x18002FEA0: LsaSetTrustedDomainInformation
0x1800705C0: "__cdecl _imp_RtlDeleteElementGenericTableAvl" __imp_RtlDeleteElementGenericTableAvl
0x180070698: "__cdecl _imp_RtlAllocateHeap" __imp_RtlAllocateHeap
0x1800873B8: CRYPT32_NULL_THUNK_DATA_DLN
0x18006FF68: api-ms-win-service-private-l1-1-3_NULL_THUNK_DATA
0x18006F840: "__cdecl _imp_RegUnLoadKeyW" __imp_RegUnLoadKeyW
0x18006F508: "__cdecl _imp_FreeLibraryWhenCallbackReturns" __imp_FreeLibraryWhenCallbackReturns
0x18001D0C5: "__cdecl _imp_load_CredDeleteW" __imp_load_CredDeleteW
0x18003EB70: RegCreateKeyTransactedA
0x180098900: "unsigned long `unsigned long __cdecl PerflibciValidateCode(void)'::`2'::lValidateFlag" ?lValidateFlag@?1??PerflibciValidateCode@@YAKXZ@4KA
0x180098A6C: "unsigned long gDebugEnabled" ?gDebugEnabled@@3KA
0x18001D640: "__cdecl _imp_load_CM_Get_DevNode_Registry_PropertyW" __imp_load_CM_Get_DevNode_Registry_PropertyW
0x180071ED8: "unsigned short const * const ADDCOUNTER_STRING" ?ADDCOUNTER_STRING@@3QBGB
0x18007DB28: "prf00000.dat" ??_C@_1BK@BKMMMPBN@?$AAp?$AAr?$AAf?$AA0?$AA0?$AA0?$AA0?$AA0?$AA?4?$AAd?$AAa?$AAt?$AA?$AA@
0x1800986A8: WPP_MAIN_CB
0x180035A68: CodeAuthzReloadCacheTables
0x18006FCD0: "__cdecl _imp_DeleteAce" __imp_DeleteAce
0x18001BF30: RegCreateKeyTransactedW
0x180070098: "__cdecl _imp__ultow" __imp__ultow
0x18006F958: "__cdecl _imp_RegUnLoadKeyA" __imp_RegUnLoadKeyA
0x180071988: "CounterBlock" ??_C@_1BK@DNAEGFKI@?$AAC?$AAo?$AAu?$AAn?$AAt?$AAe?$AAr?$AAB?$AAl?$AAo?$AAc?$AAk?$AA?$AA@
0x18007F298: ">" ??_C@_13MOEPKPHB@?$AA?$DO?$AA?$AA@
0x18002CD70: OperationEnd
0x18009F230: "__cdecl _imp_CM_Get_DevNode_Registry_PropertyW" __imp_CM_Get_DevNode_Registry_PropertyW
0x180071E80: "unsigned short const * const GLOBAL_STRING" ?GLOBAL_STRING@@3QBGB
0x18002A840: DecryptFileW
0x180015E60: InitializeAclStub
0x1800321C0: "public: void __cdecl CEvents::ZAPInstall(unsigned long,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64) __ptr64" ?ZAPInstall@CEvents@@QEAAXKPEBG00@Z
0x180070378: "__cdecl _imp_RtlInitAnsiStringEx" __imp_RtlInitAnsiStringEx
0x180072238: "\CodeIdentifiers" ??_C@_1CC@IGOKEFMC@?$AA?2?$AAC?$AAo?$AAd?$AAe?$AAI?$AAd?$AAe?$AAn?$AAt?$AAi?$AAf?$AAi?$AAe?$AAr?$AAs?$AA?$AA@
0x1800721F0: "perfc" ??_C@_1M@IOOFFFBH@?$AAp?$AAe?$AAr?$AAf?$AAc?$AA?$AA@
0x18006FA70: "__cdecl _imp_EventAccessQuery" __imp_EventAccessQuery
0x18002BF10: EnumDynamicTimeZoneInformationStub
0x1800149F0: RegOpenKeyExWStub
0x18008FE88: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0
0x18009F128: "__cdecl _imp_CryptGetUserKey" __imp_CryptGetUserKey
0x18006F8B8: "__cdecl _imp_RegSetValueExW" __imp_RegSetValueExW
0x18006FCC8: "__cdecl _imp_IsWellKnownSid" __imp_IsWellKnownSid
0x18004A680: CheckEventLogBuffer
0x180098908: "void * __ptr64 __ptr64 g_hGlobalMutex" ?g_hGlobalMutex@@3PEAXEA
0x18007F2D8: "Any_of" ??_C@_1O@FCCEHFMB@?$AAA?$AAn?$AAy?$AA_?$AAo?$AAf?$AA?$AA@
0x18006FD68: "__cdecl _imp_AllocateLocallyUniqueId" __imp_AllocateLocallyUniqueId
0x180005450: RegDeleteValueAStub
0x180015700: RegOpenKeyExAStub
0x18003E000: BaseRegDeleteValue
0x180045680: LocalConvertStringSidToSid
0x18007F130: "ldap_bind_sA" ??_C@_0N@HLHJGJIG@ldap_bind_sA?$AA@
0x1800151E0: RegQueryValueW
0x18003E310: PerfDeleteCounters
0x180046A38: GetBinaryOperandLen
0x18001D251: "__cdecl _imp_load_CredIsMarshaledCredentialW" __imp_load_CredIsMarshaledCredentialW
0x1800989C0: Microsoft_Windows_PerflibEnableBits
0x1800989F0: FeClientInfo
0x18007F3B8: "Not_Member_of_any" ??_C@_1CE@IIEKAIJP@?$AAN?$AAo?$AAt?$AA_?$AAM?$AAe?$AAm?$AAb?$AAe?$AAr?$AA_?$AAo?$AAf?$AA_?$AAa?$AAn?$AAy?$AA?$AA@
0x180097D28: eventlog_handle
0x180015050: WmiDllInitialize
0x180014B00: PAUTHZ_AUDIT_EVENT_TYPE_OLD_unbind
0x180080178: "__cdecl _DefaultResolveDelayLoadedAPIFlags" __DefaultResolveDelayLoadedAPIFlags
0x18002B8E0: ConvertToAutoInheritPrivateObjectSecurityStub
0x18007FE58: "Classes\" ??_C@_1BC@JNJCKBJF@?$AAC?$AAl?$AAa?$AAs?$AAs?$AAe?$AAs?$AA?2?$AA?$AA@
0x18005AB70: "unsigned long __cdecl WctIsSocketRestorable(struct _WCT_CLIENT_HANDLE * __ptr64,unsigned __int64,int * __ptr64,int,unsigned long,unsigned short * __ptr64,union _SOCKADDR_INET * __ptr64,union _SOCKADDR_INET * __ptr64)" ?WctIsSocketRestorable@@YAKPEAU_WCT_CLIENT_HANDLE@@_KPEAHHKPEAGPEAT_SOCKADDR_INET@@4@Z
0x18007FBA0: "\SystemRoot\" ??_C@_1BK@DHFJHPDK@?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAo?$AAo?$AAt?$AA?2?$AA?$AA@
0x180070598: "__cdecl _imp_RtlReleaseSRWLockExclusive" __imp_RtlReleaseSRWLockExclusive
0x180072840: "%08lX-%04X-%04X-%02X%02X-%02X%02" ??_C@_1GE@PJOKKCLH@?$AA?$CF?$AA0?$AA8?$AAl?$AAX?$AA?9?$AA?$CF?$AA0?$AA4?$AAX?$AA?9?$AA?$CF?$AA0?$AA4?$AAX?$AA?9?$AA?$CF?$AA0?$AA2?$AAX?$AA?$CF?$AA0?$AA2?$AAX?$AA?9?$AA?$CF?$AA0?$AA2?$AAX?$AA?$CF?$AA0?$AA2@
0x180071CE8: "default" ??_C@_1BA@HANLFFFG@?$AAd?$AAe?$AAf?$AAa?$AAu?$AAl?$AAt?$AA?$AA@
0x18002B820: AuditSetSystemPolicyStub
0x18009F090: "__cdecl _imp_CryptExportKey" __imp_CryptExportKey
0x18006F4C8: "__cdecl _imp_TermsrvDeleteKey" __imp_TermsrvDeleteKey
0x180035648: SaferpSetSingleIdentificationPath
0x18002C390: MakeAbsoluteSD2Stub
0x18006FB50: "__cdecl _imp_AccessCheckByTypeResultListAndAuditAlarmByHandleW" __imp_AccessCheckByTypeResultListAndAuditAlarmByHandleW
0x180072650: "DispatchMessageW" ??_C@_0BB@KAKAGNBE@DispatchMessageW?$AA@
0x18002C010: I_ScSetServiceBitsWStub
0x18001CBB9: "__cdecl _imp_load_SystemFunction040" __imp_load_SystemFunction040
0x180016550: CloseTraceStub
0x18009F388: "__cdecl _imp_CredProfileLoaded" __imp_CredProfileLoaded
0x18001CCA0: I_ScReparseServiceDatabase
0x18006FD38: "__cdecl _imp_AccessCheck" __imp_AccessCheck
0x18002A540: StringCchCopyA
0x180095000: AdvapiCriticalSections
0x18003FD20: RemoteRegQueryMultipleValuesWrapper
0x180072588: "MsiProvideComponentFromDescripto" ??_C@_0CD@GMHHCECA@MsiProvideComponentFromDescripto@
0x18007F4C8: "@TOKEN." ??_C@_1BA@DDPCKNJI@?$AA?$EA?$AAT?$AAO?$AAK?$AAE?$AAN?$AA?4?$AA?$AA@
0x18007F140: "ldap_unbind" ??_C@_0M@GBFFPFNJ@ldap_unbind?$AA@
0x180080698: "RtlWow64IsWowGuestMachineSupport" ??_C@_0CD@GEHPEKNJ@RtlWow64IsWowGuestMachineSupport@
0x18002BDF0: CryptGenKeyStub
0x18007EE20: "AccProvHandleGrantAccessRights" ??_C@_0BP@BAEHALCH@AccProvHandleGrantAccessRights?$AA@
0x18003DB00: InitiateShutdownA
0x180073E00: "ext-ms-win-advapi32-registry-l1-" ??_C@_1EI@LLNCKGIP@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAa?$AAd?$AAv?$AAa?$AAp?$AAi?$AA3?$AA2?$AA?9?$AAr?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?9?$AAl?$AA1?$AA?9@
0x18007F728: PERFLIB_LIBRARY_DISABLED
0x18002E880: LsaOpenPolicySce
0x1800993A0: "int (__cdecl* __ptr64 g_getsockopt)(unsigned __int64,int,int,char * __ptr64,int * __ptr64)" ?g_getsockopt@@3P6AH_KHHPEADPEAH@ZEA
0x18002C3D0: ObjectCloseAuditAlarmWStub
0x18008FF3C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-audit-l1-1-1" __IMPORT_DESCRIPTOR_api-ms-win-security-audit-l1-1-1
0x180072990: EVENT_REGISTEREVENTSOURCE
0x18007E290: "AuthenticodeEnabled" ??_C@_1CI@DPNOOGKB@?$AAA?$AAu?$AAt?$AAh?$AAe?$AAn?$AAt?$AAi?$AAc?$AAo?$AAd?$AAe?$AAE?$AAn?$AAa?$AAb?$AAl?$AAe?$AAd?$AA?$AA@
0x18001C7DA: "__cdecl _imp_load_CryptHashData" __imp_load_CryptHashData
0x180070638: "__cdecl _imp_RtlOpenCurrentUser" __imp_RtlOpenCurrentUser
0x18003EEC0: RemoteRegEnumValueWrapper
0x180038EC0: GetEffectiveRightsFromAclW
0x180018690: InitiateShutdownW
0x18002B850: ChangeServiceConfigAStub
0x18007DCF0: "PackageCode" ??_C@_1BI@OHNCAFFE@?$AAP?$AAa?$AAc?$AAk?$AAa?$AAg?$AAe?$AAC?$AAo?$AAd?$AAe?$AA?$AA@
0x18007FC58: WmipInternalGuidList
0x18002B4E0: AccessCheckByTypeResultListAndAuditAlarmWStub
0x180060710: AdvapiInitRoutines
0x180079CF0: "\??\" ??_C@_19JHEHLFPM@?$AA?2?$AA?$DP?$AA?$DP?$AA?2?$AA?$AA@
0x180098AA0: Logon32LogonNotify
0x18006F960: "__cdecl _imp_RegOpenUserClassesRoot" __imp_RegOpenUserClassesRoot
0x18001A434: LsaICLookupSids
0x1800722A8: "LevelObjects" ??_C@_1BK@DCOHCEEC@?$AAL?$AAe?$AAv?$AAe?$AAl?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAs?$AA?$AA@
0x18002C3C0: NotifyServiceStatusChangeAStub
0x180048088: LocalGetConditionForString
0x180034A88: CodeAuthzpSetAuthzLevelInfo
0x180073DB0: "ext-ms-win-advapi32-registry-l1-" ??_C@_1EI@DGOMBOK@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAa?$AAd?$AAv?$AAa?$AAp?$AAi?$AA3?$AA2?$AA?9?$AAr?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?9?$AAl?$AA1?$AA?9@
0x18007F120: "ldap_set_option" ??_C@_0BA@FFLOJAMJ@ldap_set_option?$AA@
0x1800980E4: g_dwKeyOptions
0x180073B68: "RequireUniqueAccessibility" ??_C@_1DG@KCMEDP@?$AAR?$AAe?$AAq?$AAu?$AAi?$AAr?$AAe?$AAU?$AAn?$AAi?$AAq?$AAu?$AAe?$AAA?$AAc?$AAc?$AAe?$AAs?$AAs?$AAi?$AAb?$AAi?$AAl?$AAi?$AAt?$AAy?$AA?$AA@
0x180015DF4: "unsigned long __cdecl PerflibciValidateCode(void)" ?PerflibciValidateCode@@YAKXZ
0x180097C98: "__cdecl _hmod__CRYPT32_dll" __hmod__CRYPT32_dll
0x18007D36C: "GX" ??_C@_15FCNJEDMF@?$AAG?$AAX?$AA?$AA@
0x180032108: "public: void __cdecl CEventsBase::Uninstall(unsigned long,unsigned short const * __ptr64,unsigned short const * __ptr64) __ptr64" ?Uninstall@CEventsBase@@QEAAXKPEBG0@Z
0x18006F660: "__cdecl _imp_lstrcmpiW" __imp_lstrcmpiW
0x180073CB0: "__cdecl _sz_CRYPTSP_dll" __sz_CRYPTSP_dll
0x18002B990: CreateServiceAStub
0x1800723D0: "WindowsShutdown" ??_C@_1CA@ENPDKOBA@?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AAS?$AAh?$AAu?$AAt?$AAd?$AAo?$AAw?$AAn?$AA?$AA@
0x18006F2B8: "__cdecl _imp_WideCharToMultiByte" __imp_WideCharToMultiByte
0x18007D3E0: "OL" ??_C@_15GBPBABGA@?$AAO?$AAL?$AA?$AA@
0x1800705F8: "__cdecl _imp_RtlDestroyQueryDebugBuffer" __imp_RtlDestroyQueryDebugBuffer
0x180071A58: "unsigned short const * const LinkageKey" ?LinkageKey@@3QBGB
0x18001D18B: "__cdecl _imp_load_CredFree" __imp_load_CredFree
0x18007E768: "ExecutableTypes" ??_C@_1CA@DJNPIFLN@?$AAE?$AAx?$AAe?$AAc?$AAu?$AAt?$AAa?$AAb?$AAl?$AAe?$AAT?$AAy?$AAp?$AAe?$AAs?$AA?$AA@
0x18006FA08: "__cdecl _imp_EnumDynamicTimeZoneInformation" __imp_EnumDynamicTimeZoneInformation
0x18007F060: "SvcCtl" ??_C@_1O@MCNIDBHL@?$AAS?$AAv?$AAc?$AAC?$AAt?$AAl?$AA?$AA@
0x18001C180: ControlTraceWStub
0x18006FFB8: "__cdecl _imp_NotifyServiceStatusChangeA" __imp_NotifyServiceStatusChangeA
0x180004880: "unsigned long __cdecl PerfpAddInstanceToBuffer(unsigned char * __ptr64,unsigned long,unsigned long * __ptr64,unsigned long,unsigned short const * __ptr64)" ?PerfpAddInstanceToBuffer@@YAKPEAEKPEAKKPEBG@Z
0x1800053A0: RegQueryInfoKeyAStub
0x18007D344: "WO" ??_C@_15JMMBCOHI@?$AAW?$AAO?$AA?$AA@
0x180098A50: "unsigned long gDebugLevel" ?gDebugLevel@@3KA
0x18004E2A8: "long __cdecl GetPerfDllFileInfo(unsigned short const * __ptr64,struct _DLL_VALIDATION_DATA * __ptr64)" ?GetPerfDllFileInfo@@YAJPEBGPEAU_DLL_VALIDATION_DATA@@@Z
0x18009F280: "__cdecl _imp_CredEnumerateW" __imp_CredEnumerateW
0x18008FD34: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-eventing-consumer-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-eventing-consumer-l1-1-0
0x18007DC50: "SamOpenUser" ??_C@_0M@OGOLHKAM@SamOpenUser?$AA@
0x18008FD48: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-eventing-consumer-l1-1-1" __IMPORT_DESCRIPTOR_api-ms-win-eventing-consumer-l1-1-1
0x1800706C0: "__cdecl _imp_RtlInitializeCriticalSection" __imp_RtlInitializeCriticalSection
0x18001CBCB: "__cdecl _imp_load_LogonUserExExW" __imp_load_LogonUserExExW
0x180070320: "__cdecl _imp_RtlPrefixUnicodeString" __imp_RtlPrefixUnicodeString
0x18002B7B0: AuditLookupCategoryNameWStub
0x1800056F0: PerfQueryCounterSetRegistrationInfo
0x18009F110: "__cdecl _imp_CryptAcquireContextA" __imp_CryptAcquireContextA
0x1800720A0: "unsigned short const * const EventLogLevel" ?EventLogLevel@@3QBGB
0x180015E80: CryptGetDefaultProviderWStub
0x180073C00: "System\CurrentControlSet\Control" ??_C@_1GK@GONGFEHN@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA?2?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl@
0x1800981C0: g_TableCritSec
0x18002BC40: CredReadDomainCredentialsWStub
0x18007ED48: "AccProvIsObjectAccessible" ??_C@_0BK@JIAIIJCC@AccProvIsObjectAccessible?$AA@
0x180007A28: LeaveWaitSddlSidLookup
0x18006F458: "__cdecl _imp_LoadLibraryExA" __imp_LoadLibraryExA
0x18002F910: LsaQueryForestTrustInformation
0x180071930: "Last Counter" ??_C@_1BK@KDEBHAFE@?$AAL?$AAa?$AAs?$AAt?$AA?5?$AAC?$AAo?$AAu?$AAn?$AAt?$AAe?$AAr?$AA?$AA@
0x180070150: "__cdecl _imp_RtlFreeHandle" __imp_RtlFreeHandle
0x180071830: "ProviderName" ??_C@_1BK@IDHMMGND@?$AAP?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x180005430: ITRPC_HANDLE_unbind
0x18009F050: "__cdecl _imp_CryptEnumProviderTypesA" __imp_CryptEnumProviderTypesA
0x18009F360: "__cdecl _imp_CredReadByTokenHandle" __imp_CredReadByTokenHandle
0x18003D0F0: "public: unsigned long __cdecl CSList::Insert(void * __ptr64) __ptr64" ?Insert@CSList@@QEAAKPEAX@Z
0x18006FE48: api-ms-win-service-core-l1-1-0_NULL_THUNK_DATA
0x18001C1A0: SetFileSecurityWStub
0x180017904: AccProvpLoadMartaFunctions
0x18009F270: "__cdecl _imp_CredReadW" __imp_CredReadW
0x18006FB88: "__cdecl _imp_GetSidLengthRequired" __imp_GetSidLengthRequired
0x1800049D0: CommandLineFromMsiDescriptor
0x18001C75C: "__cdecl _imp_load_CryptSetProviderExA" __imp_load_CryptSetProviderExA
0x18006F610: "__cdecl _imp_RemapPredefinedHandleInternal" __imp_RemapPredefinedHandleInternal
0x18009F0D8: "__cdecl _imp_CryptEnumProviderTypesW" __imp_CryptEnumProviderTypesW
0x180007070: "unsigned long __cdecl PerflibciLoadString(struct HINSTANCE__ * __ptr64 * __ptr64,struct _PERFLIBCI_PROVIDER_NODE * __ptr64,unsigned long,unsigned long,unsigned short * __ptr64,unsigned long * __ptr64)" ?PerflibciLoadString@@YAKPEAPEAUHINSTANCE__@@PEAU_PERFLIBCI_PROVIDER_NODE@@KKPEAGPEAK@Z
0x18001C120: AuditFreeStub
0x18002D0D0: ProcessIdleTasksW
0x18006F2C0: "__cdecl _imp_EnterCriticalSection" __imp_EnterCriticalSection
0x18009F2D8: "__cdecl _imp_CredReadA" __imp_CredReadA
0x18001CB00: QueryAllTracesA
0x1800155D0: LookupAccountNameW
0x180070058: "__cdecl _imp_tolower" __imp_tolower
0x18002BFA0: GetFileSecurityWStub
0x18007D4D0: "struct _NDR64_CONTEXT_HANDLE_FORMAT const __midl_frag24" ?__midl_frag24@@3U_NDR64_CONTEXT_HANDLE_FORMAT@@B
0x18002B1E0: UsePinForEncryptedFilesA
0x18007E380: "%s%s%Id%s%s%s%s%s%s%s{%08lx-%04x" ??_C@_1JG@JIILINJE@?$AA?$CF?$AAs?$AA?$CF?$AAs?$AA?$CF?$AAI?$AAd?$AA?$CF?$AAs?$AA?$CF?$AAs?$AA?$CF?$AAs?$AA?$CF?$AAs?$AA?$CF?$AAs?$AA?$CF?$AAs?$AA?$CF?$AAs?$AA?$HL?$AA?$CF?$AA0?$AA8?$AAl?$AAx?$AA?9?$AA?$CF?$AA0?$AA4?$AAx@
0x1800726B0: "user32.dll" ??_C@_1BG@OILDLIOJ@?$AAu?$AAs?$AAe?$AAr?$AA3?$AA2?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x18002DD30: LsaEnumeratePrivilegesOfAccount
0x18007FD90: "closesocket" ??_C@_0M@ODDJDCDK@closesocket?$AA@
0x180046074: SddlFilterSacl
0x18007D418: "ID" ??_C@_15HCBMMKJC@?$AAI?$AAD?$AA?$AA@
0x18001D5B0: "__cdecl _imp_load_CM_Locate_DevNodeW" __imp_load_CM_Locate_DevNodeW
0x18006F978: api-ms-win-core-registry-l1-1-0_NULL_THUNK_DATA
0x18002D7B4: AuditpUnicodeToAnsi
0x18002BB50: CredGetTargetInfoAStub
0x18003EC40: RegOverridePredefKey
0x18006FF58: api-ms-win-service-private-l1-1-2_NULL_THUNK_DATA
0x180039D60: "unsigned short * __ptr64 __cdecl ResizeTempBuffer(unsigned short * __ptr64,unsigned long & __ptr64,unsigned long)" ?ResizeTempBuffer@@YAPEAGPEAGAEAKK@Z
0x18006FE68: api-ms-win-service-core-l1-1-1_NULL_THUNK_DATA
0x18001D2B7: "__cdecl _tailMerge_api_ms_win_security_credentials_l2_1_0_dll" __tailMerge_api_ms_win_security_credentials_l2_1_0_dll
0x180079FE8: "Levels" ??_C@_1O@JABJGAKP@?$AAL?$AAe?$AAv?$AAe?$AAl?$AAs?$AA?$AA@
0x18007F868: PERFLIB_NOT_TRUSTED_FILE
0x180098AB8: "void * __ptr64 __ptr64 hPerflibSectionMap" ?hPerflibSectionMap@@3PEAXEA
0x180072260: "SaferFlags" ??_C@_1BG@ICGFHEHF@?$AAS?$AAa?$AAf?$AAe?$AAr?$AAF?$AAl?$AAa?$AAg?$AAs?$AA?$AA@
0x18007EDE8: "AccProvCancelOperation" ??_C@_0BH@NEPENAND@AccProvCancelOperation?$AA@
0x1800705B0: "__cdecl _imp_RtlReleaseSRWLockShared" __imp_RtlReleaseSRWLockShared
0x18006FC30: "__cdecl _imp_GetSecurityDescriptorLength" __imp_GetSecurityDescriptorLength
0x18002BE90: CryptSetProviderExWStub
0x18007F878: PERFLIB_CLOSE_PROC_NOT_FOUND
0x18003D3B0: AccProvpLoadDllEntryPoints
0x180059E00: "unsigned long __cdecl WctInitClient(unsigned long,unsigned long,struct _WCT_CLIENT_HANDLE * __ptr64)" ?WctInitClient@@YAKKKPEAU_WCT_CLIENT_HANDLE@@@Z
0x18007F2A0: "Contains" ??_C@_1BC@KFLLKCKJ@?$AAC?$AAo?$AAn?$AAt?$AAa?$AAi?$AAn?$AAs?$AA?$AA@
0x1800157C0: GetSidSubAuthorityStub
0x18002D040: ProcessIdleTasks
0x180046C10: GetNextNoneWhiteSpace
0x18007D37C: "FR" ??_C@_15PGDIHAAE@?$AAF?$AAR?$AA?$AA@
0x180099364: "unsigned long g_COM_CLSID_Offset" ?g_COM_CLSID_Offset@@3KA
0x180098CD0: "unsigned short * szPerflibSectionFile" ?szPerflibSectionFile@@3PAGA
0x18002BFD0: GetServiceDisplayNameWStub
0x18007ED30: "AccProvGetAllRights" ??_C@_0BE@BIKMNMLP@AccProvGetAllRights?$AA@
0x18001AF20: GetSecurityDescriptorLengthStub
0x18003808C: CodeAuthzpCompareUnicodeImagePath
0x18006FE80: api-ms-win-service-core-l1-1-2_NULL_THUNK_DATA
0x18007EE40: "AccProvHandleSetAccessRights" ??_C@_0BN@HPNOADFE@AccProvHandleSetAccessRights?$AA@
0x1800358C0: SaferpSetSingleIdentificationZone
0x180072980: EVENT_REPORTEVENT
0x18006FAF8: "__cdecl _imp_AuditQueryGlobalSaclW" __imp_AuditQueryGlobalSaclW
0x1800145E0: CodeAuthzInitializeGlobals
0x18006FF50: "__cdecl _imp_QueryLocalUserServiceName" __imp_QueryLocalUserServiceName
0x18001D348: "__cdecl _imp_load_CredpDecodeCredential" __imp_load_CredpDecodeCredential
0x180070330: "__cdecl _imp_NtQueryInformationFile" __imp_NtQueryInformationFile
0x18007D46C: "struct _NDR64_CONFORMANT_STRING_FORMAT const __midl_frag11" ?__midl_frag11@@3U_NDR64_CONFORMANT_STRING_FORMAT@@B
0x18002C310: LsaSetSecretStub
0x18006F800: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x18002B760: AreAnyAccessesGrantedStub
0x18006FE10: "__cdecl _imp_AddAccessDeniedAce" __imp_AddAccessDeniedAce
0x18006FAD0: "__cdecl _imp_AuditLookupSubCategoryNameW" __imp_AuditLookupSubCategoryNameW
0x18002B670: AccessCheckStub
0x18002C660: RegOpenUserClassesRootStub
0x18001D3D8: "__cdecl _imp_load_CredEncryptAndMarshalBinaryBlob" __imp_load_CredEncryptAndMarshalBinaryBlob
0x18006FCE0: "__cdecl _imp_InitializeSid" __imp_InitializeSid
0x180098700: "unsigned long * g_RuntimeSD" ?g_RuntimeSD@@3PAKA
0x18001B8A0: BuildSecurityDescriptorW
0x18007ED10: "AccProvRevokeAuditRights" ??_C@_0BJ@IBAGAPBE@AccProvRevokeAuditRights?$AA@
0x18006F8B0: "__cdecl _imp_RegLoadMUIStringA" __imp_RegLoadMUIStringA
0x18003D63C: AccProvpProbeProviderForObject
0x1800574AC: WmipGetDevInstProperty
0x18004D804: "unsigned long __cdecl PerflibciSendCounterUpdateRequest(struct _PERF_QUERY * __ptr64,struct _PERFLIBCI_QUERY_PROVIDER_NODE * __ptr64,int)" ?PerflibciSendCounterUpdateRequest@@YAKPEAU_PERF_QUERY@@PEAU_PERFLIBCI_QUERY_PROVIDER_NODE@@H@Z
0x180033314: "__cdecl _CodeAuthzpQueryIdentityRegValue" __CodeAuthzpQueryIdentityRegValue
0x18005D648: LsaEnumerateAccountsWithUserRight
0x18002D910: LsaClearAuditLog
0x18007F02C: """ ??_C@_13NEIAEHFG@?$AA?$CC?$AA?$AA@
0x18005BCBC: StateObjectListFind
0x18006F8C0: "__cdecl _imp_RegLoadMUIStringW" __imp_RegLoadMUIStringW
0x18005C060: RegConn_nb_nb
0x180014F60: CryptExportKeyStub
0x1800983B8: fCSInitialized
0x18009F188: "__cdecl _imp_GetUserNameExW" __imp_GetUserNameExW
0x18007EA78: "Restrictions" ??_C@_1BK@NILCLPDE@?$AAR?$AAe?$AAs?$AAt?$AAr?$AAi?$AAc?$AAt?$AAi?$AAo?$AAn?$AAs?$AA?$AA@
0x180098418: "unsigned char bPerflibOpen" ?bPerflibOpen@@3EA
0x18007FCA8: "Process" ??_C@_1BA@NMDNJJOO@?$AAP?$AAr?$AAo?$AAc?$AAe?$AAs?$AAs?$AA?$AA@
0x18009F430: "__cdecl _imp_BCryptHashData" __imp_BCryptHashData
0x180079CD8: "RuleCount" ??_C@_1BE@BFHKPIB@?$AAR?$AAu?$AAl?$AAe?$AAC?$AAo?$AAu?$AAn?$AAt?$AA?$AA@
0x180070300: "__cdecl _imp_RtlUpcaseUnicodeChar" __imp_RtlUpcaseUnicodeChar
0x180042900: ObjectPrivilegeAuditAlarmA
0x1800983D8: "unsigned long `unsigned long __cdecl PerflibciValidateCode(void)'::`2'::lValidateCode" ?lValidateCode@?1??PerflibciValidateCode@@YAKXZ@4KA
0x1800465A0: EncloseSubCondition
0x180040E60: UnlockServiceDatabase
0x18002C220: LsaICLookupSidsWithCredsStub
0x18007F654: "" ??_C@_13BLAPAIAM@?$AA?$AI?$AA?$AA@
0x18007ECF0: "AccProvRevokeAccessRights" ??_C@_0BK@JCGILDPM@AccProvRevokeAccessRights?$AA@
0x18007EA28: "exe" ??_C@_17OJFPAGNE@?$AAe?$AAx?$AAe?$AA?$AA@
0x18002F630: LsaManageSidNameMapping
0x18006F6F8: "__cdecl _imp_RpcExceptionFilter" __imp_RpcExceptionFilter
0x180014FB4: MartaInitialize
0x180034DC0: SaferpCreateNewSingleIdentification
0x18002B980: CreateRestrictedTokenStub
0x180004700: PerflibciLocalEnumerateCounterSetInstances
0x18001D1AF: "__cdecl _imp_load_CredEnumerateA" __imp_load_CredEnumerateA
0x18007FA90: WPP_259a3a3e8b5835f0b5600c573fa28814_Traceguids
0x18007ED68: "AccProvHandleIsObjectAccessible" ??_C@_0CA@DNOBIDMA@AccProvHandleIsObjectAccessible?$AA@
0x18009F198: SspiCli_NULL_THUNK_DATA_DLA
0x18001D35A: "__cdecl _imp_load_CredBackupCredentials" __imp_load_CredBackupCredentials
0x18007F010: "host/" ??_C@_1M@MAKFBKFH@?$AAh?$AAo?$AAs?$AAt?$AA?1?$AA?$AA@
0x18006F6E8: "__cdecl _imp_UuidFromStringW" __imp_UuidFromStringW
0x18007DA50: Microsoft_Windows_PerflibLevels
0x18003D154: "public: unsigned long __cdecl CSList::InsertIfUnique(void * __ptr64,int (__cdecl*)(void * __ptr64,void * __ptr64)) __ptr64" ?InsertIfUnique@CSList@@QEAAKPEAXP6AH00@Z@Z
0x180017EC0: WmiQuerySingleInstanceW
0x180039910: BuildTrusteeWithObjectsAndNameW
0x18004F3BC: WPP_SF_id
0x18007FE70: "Software\Classes\" ??_C@_1CE@BMEBBCEF@?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAC?$AAl?$AAa?$AAs?$AAs?$AAe?$AAs?$AA?2?$AA?$AA@
0x180050338: McTemplateU0zzq
0x18001D754: "__cdecl _GSHandlerCheck_SEH" __GSHandlerCheck_SEH
0x18001D209: "__cdecl _imp_load_CredEnumerateW" __imp_load_CredEnumerateW
0x180070128: "__cdecl _imp_RtlSubAuthorityCountSid" __imp_RtlSubAuthorityCountSid
0x18008FF50: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-audit-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-audit-l1-1-0
0x18006F900: "__cdecl _imp_RegOpenCurrentUser" __imp_RegOpenCurrentUser
0x180070048: "__cdecl _imp__wcsicmp" __imp__wcsicmp
0x180070038: "__cdecl _imp_wcscat_s" __imp_wcscat_s
0x18006FD90: "__cdecl _imp_IsValidSid" __imp_IsValidSid
0x18007F288: "||" ??_C@_15BDDEIMMC@?$AA?$HM?$AA?$HM?$AA?$AA@
0x18002BF20: EqualDomainSidStub
0x18005D57C: LsaEnumerateAccountRights
0x18007D324: "DT" ??_C@_15JOJLIOND@?$AAD?$AAT?$AA?$AA@
0x1800703A0: "__cdecl _imp_RtlIsTextUnicode" __imp_RtlIsTextUnicode
0x180053EB0: WmiQuerySingleInstanceA
0x180039910: BuildTrusteeWithObjectsAndNameA
0x180070010: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x18002C3E0: ObjectDeleteAuditAlarmWStub
0x18004EC8C: "unsigned long __cdecl PerfpThrottleError(unsigned long,struct HKEY__ * __ptr64,struct _ERROR_LOG * __ptr64)" ?PerfpThrottleError@@YAKKPEAUHKEY__@@PEAU_ERROR_LOG@@@Z
0x180060280: g_LsapBindingHandleSecurity
0x18007FA58: "%s\%s" ??_C@_1M@DFKENGJN@?$AA?$CF?$AAs?$AA?2?$AA?$CF?$AAs?$AA?$AA@
0x180070608: "__cdecl _imp_NtAlpcQueryInformation" __imp_NtAlpcQueryInformation
0x18007F5E0: NotEncodedAttributeChar
0x180070088: "__cdecl _imp__wcstoui64" __imp__wcstoui64
0x180005460: PerfpInitializeInstallationMutex
0x1800706B8: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x18007F7F8: PERFLIB_OPEN_PROC_TIMEOUT
0x1800717BC: "RO" ??_C@_15MMAMLPML@?$AAR?$AAO?$AA?$AA@
0x18006FFE8: "__cdecl _imp_OpenServiceA" __imp_OpenServiceA
0x180070400: "__cdecl _imp_RtlxAnsiStringToUnicodeSize" __imp_RtlxAnsiStringToUnicodeSize
0x18007D3B4: "A" ??_C@_13PNBDBPLL@?$AAA?$AA?$AA@
0x18007DF68: "AppMgmtDebugLevel" ??_C@_1CE@ELAHOEFC@?$AAA?$AAp?$AAp?$AAM?$AAg?$AAm?$AAt?$AAD?$AAe?$AAb?$AAu?$AAg?$AAL?$AAe?$AAv?$AAe?$AAl?$AA?$AA@
0x180070060: "__cdecl _imp_strstr" __imp_strstr
0x18006FCA8: "__cdecl _imp_SetSecurityAccessMask" __imp_SetSecurityAccessMask
0x180056124: WmipConvertEventToAnsi
0x18000A7D0: "struct _PERFLIBCI_COUNTERSET_NODE * __ptr64 __cdecl PerflibciBuildCounterSet(struct HKEY__ * __ptr64,unsigned short * __ptr64,unsigned long * __ptr64,struct _PERFLIBCI_PROVIDER_NODE * __ptr64)" ?PerflibciBuildCounterSet@@YAPEAU_PERFLIBCI_COUNTERSET_NODE@@PEAUHKEY__@@PEAGPEAKPEAU_PERFLIBCI_PROVIDER_NODE@@@Z
0x18006F270: Wowx86NodeString
0x180073C70: "ProviderPath" ??_C@_1BK@GMKIPMAG@?$AAP?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AAP?$AAa?$AAt?$AAh?$AA?$AA@
0x1800702E0: "__cdecl _imp_RtlQueryRegistryValuesEx" __imp_RtlQueryRegistryValuesEx
0x18005EE00: LsapCrEncryptValue
0x180070530: "__cdecl _imp_RtlCreateBoundaryDescriptor" __imp_RtlCreateBoundaryDescriptor
0x180071BA0: "char const * const CollectValue" ?CollectValue@@3QBDB
0x18004C994: McTemplateU0zz
0x18002B740: AllocateLocallyUniqueIdStub
0x18009F248: "__cdecl _imp_CredGetTargetInfoA" __imp_CredGetTargetInfoA
0x18006FE70: "__cdecl _imp_GetServiceDisplayNameW" __imp_GetServiceDisplayNameW
0x1800390D0: LookupSecurityDescriptorPartsA
0x180035D10: CodeAuthzpFormatIdentityKeyPath
0x18006F5A0: KERNEL32_NULL_THUNK_DATA
0x1800185B0: WmiCloseBlock
0x1800568B0: WmipProcessEventBuffer
0x180014AF0: LsaNtStatusToWinError
0x18002BDC0: CryptEnumProviderTypesWStub
0x18004F5A0: McTemplateU0sz
0x1800723B0: "eventlog" ??_C@_1BC@PJIKPPIJ@?$AAe?$AAv?$AAe?$AAn?$AAt?$AAl?$AAo?$AAg?$AA?$AA@
0x180088530: CRYPTBASE_NULL_THUNK_DATA_DLB
0x18001BFC0: LocalGetSidForString
0x180098398: g_pServiceSid
0x18006F2D0: "__cdecl _imp_GetLastError" __imp_GetLastError
0x18003323C: "__cdecl _CodeAuthzpOpenIdentifierKey" __CodeAuthzpOpenIdentifierKey
0x180005B30: "void __cdecl PerflibciRotateRight(struct _PERFLIBCI_RED_BLACK_NODE * __ptr64 * __ptr64,struct _PERFLIBCI_RED_BLACK_NODE * __ptr64)" ?PerflibciRotateRight@@YAXPEAPEAU_PERFLIBCI_RED_BLACK_NODE@@PEAU1@@Z
0x180099378: "long (__cdecl* __ptr64 g_ActivationStateCallback)(struct _GUID,unsigned long,unsigned long * __ptr64)" ?g_ActivationStateCallback@@3P6AJU_GUID@@KPEAK@ZEA
0x18006F4F0: "__cdecl _imp_DuplicateHandle" __imp_DuplicateHandle
0x18009F158: "__cdecl _imp_CryptGenKey" __imp_CryptGenKey
0x18001D543: "__cdecl _imp_load_SetSecurityInfo" __imp_load_SetSecurityInfo
0x180038B40: BuildImpersonateExplicitAccessWithNameA
0x18002BCF0: CredpConvertCredentialStub
0x18001D155: "__cdecl _imp_load_CredWriteA" __imp_load_CredWriteA
0x18009F060: "__cdecl _imp_CryptDestroyHash" __imp_CryptDestroyHash
0x18001D6CC: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x18009F160: "__cdecl _imp_CryptSetProviderExW" __imp_CryptSetProviderExW
0x180010C64: "unsigned long __cdecl PerfpDosError(long)" ?PerfpDosError@@YAKJ@Z
0x18006F998: "__cdecl _imp_RegDeleteKeyValueA" __imp_RegDeleteKeyValueA
0x180005D2C: LocalGetSDControlForString
0x1800701A8: "__cdecl _imp_RtlSetOwnerSecurityDescriptor" __imp_RtlSetOwnerSecurityDescriptor
0x18001D299: "__cdecl _imp_load_CredWriteW" __imp_load_CredWriteW
0x18003E0B0: BaseRegOpenKey
0x180038B40: BuildImpersonateExplicitAccessWithNameW
0x180071B40: "unsigned short const * const LastCounter" ?LastCounter@@3QBGB
0x18007F0E8: "rootDomainNamingContext" ??_C@_0BI@MFGAHGOP@rootDomainNamingContext?$AA@
0x180014DA0: ConstructKernelKeyPath
0x18001CB95: "__cdecl _imp_load_SystemFunction002" __imp_load_SystemFunction002
0x18005BE10: NewShutdownCallbackEx
0x18001AD80: LsaOpenPolicyStub
0x18002B6D0: AddAccessDeniedAceExStub
0x18009F040: "__cdecl _imp_CryptSetProviderExA" __imp_CryptSetProviderExA
0x18002BB00: CredEnumerateWStub
0x180070488: "__cdecl _imp_EtwTraceMessage" __imp_EtwTraceMessage
0x18009F190: "__cdecl _imp_LogonUserExExW" __imp_LogonUserExExW
0x180032374: CodeAuthzHandleToLevelStruct
0x18001D58B: "__cdecl _imp_load_GetExplicitEntriesFromAclW" __imp_load_GetExplicitEntriesFromAclW
0x1800723F0: "SECLOGON" ??_C@_1BC@HDPGMCHB@?$AAS?$AAE?$AAC?$AAL?$AAO?$AAG?$AAO?$AAN?$AA?$AA@
0x180071BD4: "char const * const OpenValue" ?OpenValue@@3QBDB
0x18003A0A0: ConvertAccessToSecurityDescriptorA
0x18003A2A0: ConvertSecurityDescriptorToAccessA
0x1800700E8: "__cdecl _imp_memcmp" __imp_memcmp
0x180070718: "__cdecl _imp_NtSetInformationKey" __imp_NtSetInformationKey
0x180015320: OpenProcessTokenStub
0x18001D034: "__cdecl _tailMerge_api_ms_win_security_credentials_l1_1_0_dll" __tailMerge_api_ms_win_security_credentials_l1_1_0_dll
0x180070630: "__cdecl _imp_RtlAddAccessAllowedAce" __imp_RtlAddAccessAllowedAce
0x180017A50: AccProvpGetStringFromRegistry
0x18006FF48: "__cdecl _imp_QueryUserServiceName" __imp_QueryUserServiceName
0x180070648: "__cdecl _imp_NtSaveKey" __imp_NtSaveKey
0x18002B6E0: AddAccessDeniedAceStub
0x1800983C8: gbLookupTableInitialized
0x18002E980: LsaOpenTrustedDomain
0x18006F678: "__cdecl _imp_RpcBindingCreateW" __imp_RpcBindingCreateW
0x18001D390: "__cdecl _imp_load_CredReadByTokenHandle" __imp_load_CredReadByTokenHandle
0x18001C714: "__cdecl _imp_load_CryptSetProviderW" __imp_load_CryptSetProviderW
0x18002C000: I_ScSetServiceBitsAStub
0x18002BD90: CryptDuplicateKeyStub
0x180070240: "__cdecl _imp_NtDeviceIoControlFile" __imp_NtDeviceIoControlFile
0x180080310: "\Media Type" ??_C@_1BI@IHAIEPGC@?$AA?2?$AAM?$AAe?$AAd?$AAi?$AAa?$AA?5?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x18003F7A0: RegSaveKeyW
0x18007E258: "LastModified" ??_C@_1BK@MAANCIIH@?$AAL?$AAa?$AAs?$AAt?$AAM?$AAo?$AAd?$AAi?$AAf?$AAi?$AAe?$AAd?$AA?$AA@
0x18009F300: "__cdecl _imp_CredIsProtectedA" __imp_CredIsProtectedA
0x18006F8E8: "__cdecl _imp_RegGetKeySecurity" __imp_RegGetKeySecurity
0x18007EB40: "Restrictions\SidsToDisable" ??_C@_1DG@NGMFIBIF@?$AAR?$AAe?$AAs?$AAt?$AAr?$AAi?$AAc?$AAt?$AAi?$AAo?$AAn?$AAs?$AA?2?$AAS?$AAi?$AAd?$AAs?$AAT?$AAo?$AAD?$AAi?$AAs?$AAa?$AAb?$AAl?$AAe?$AA?$AA@
0x180070068: "__cdecl _imp_strchr" __imp_strchr
0x18006FD40: "__cdecl _imp_AdjustTokenGroups" __imp_AdjustTokenGroups
0x180070468: "__cdecl _imp_RtlAdjustPrivilege" __imp_RtlAdjustPrivilege
0x18009F408: "__cdecl _imp_BCryptCloseAlgorithmProvider" __imp_BCryptCloseAlgorithmProvider
0x180072148: EVENTLOG
0x18006FD00: "__cdecl _imp_EqualSid" __imp_EqualSid
0x18002E780: LsaOpenAccount
0x18007F368: "Not_Device_Member_of" ??_C@_1CK@LMDPKLKD@?$AAN?$AAo?$AAt?$AA_?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA_?$AAM?$AAe?$AAm?$AAb?$AAe?$AAr?$AA_?$AAo?$AAf?$AA?$AA@
0x18003F5F0: RegSaveKeyA
0x1800717FC: "XA" ??_C@_15INEIOLJO@?$AAX?$AAA?$AA?$AA@
0x18007F6A0: "NULL" ??_C@_19CIJIHAKK@?$AAN?$AAU?$AAL?$AAL?$AA?$AA@
0x18003E4D8: BaseBindToMachine
0x18006FB90: "__cdecl _imp_CreatePrivateObjectSecurityWithMultipleInheritance" __imp_CreatePrivateObjectSecurityWithMultipleInheritance
0x180098390: g_CachedUserSid
0x18004D3D8: "__cdecl TlgDefineProvider_annotation__Tlgg_hPerfLibProviderProv" _TlgDefineProvider_annotation__Tlgg_hPerfLibProviderProv
0x180004F90: PerfOpenQueryHandle
0x18006F7D8: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x180072158: "unsigned short const * const DisablePerformanceCounters" ?DisablePerformanceCounters@@3QBGB
0x1800157A0: IsValidSidStub
0x18004BDF0: ElfReadEventLogW
0x18006F3F8: "__cdecl _imp_WaitForSingleObject" __imp_WaitForSingleObject
0x18009F000: "__cdecl _imp_CertVerifyCertificateChainPolicy" __imp_CertVerifyCertificateChainPolicy
0x1800956C0: WmipGNHead
0x180039570: SetEntriesInAclA
0x18006F3C8: "__cdecl _imp_GetLongPathNameW" __imp_GetLongPathNameW
0x18005E9EC: LspVerifyResponse_RPC_LspReadPrivateData
0x18007EF38: GUID_MOF_RESOURCE_REMOVED_NOTIFICATION
0x18004E154: "void __cdecl DisablePerfLibrary(struct _EXT_OBJECT * __ptr64,unsigned long,unsigned long,unsigned __int64,unsigned __int64)" ?DisablePerfLibrary@@YAXPEAU_EXT_OBJECT@@KK_K1@Z
0x180039A74: "public: __cdecl CSList::~CSList(void) __ptr64" ??1CSList@@QEAA@XZ
0x18001AF80: IsWellKnownSidStub
0x18006F868: "__cdecl _imp_RegDeleteValueA" __imp_RegDeleteValueA
0x180070580: "__cdecl _imp_RtlReAllocateHeap" __imp_RtlReAllocateHeap
0x180070040: "__cdecl _imp_swprintf_s" __imp_swprintf_s
0x1800137EC: IsSystemProcessOrService
0x18004B61C: ElfGetUseLegacyReportEvent
0x180014B00: SVCCTL_HANDLEA_unbind
0x180073E50: "ext-ms-win-kernel32-registry-l1-" ??_C@_1EI@ELGCODIK@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAk?$AAe?$AAr?$AAn?$AAe?$AAl?$AA3?$AA2?$AA?9?$AAr?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?9?$AAl?$AA1?$AA?9@
0x18009F208: "__cdecl _imp_WTHelperIsChainedToMicrosoftFromStateData" __imp_WTHelperIsChainedToMicrosoftFromStateData
0x18001A200: RegDeleteValueWStub
0x18002B910: CreateProcessAsUserAStub
0x1800982A0: FeClientLoadCritical
0x18006F538: "__cdecl _imp_StartThreadpoolIo" __imp_StartThreadpoolIo
0x1800148C0: RegQueryValueExWStub
0x180032590: SaferCreateLevel
0x180014F30: IsTextUnicode
0x1800704C0: "__cdecl _imp_RtlGetVersion" __imp_RtlGetVersion
0x18006F858: "__cdecl _imp_RegDeleteValueW" __imp_RegDeleteValueW
0x1800377E4: CodeAuthzPol_SetInfoDual_DefaultLevelFlags
0x1800443A0: ConvertStringSDToSDRootDomainW
0x180080178: "__cdecl _ResolveDelayLoadedAPIFlags" __ResolveDelayLoadedAPIFlags
0x180071BF0: "_Perf_Library_Lock_PID_" ??_C@_1DA@MPDMDONG@?$AA_?$AAP?$AAe?$AAr?$AAf?$AA_?$AAL?$AAi?$AAb?$AAr?$AAa?$AAr?$AAy?$AA_?$AAL?$AAo?$AAc?$AAk?$AA_?$AAP?$AAI?$AAD?$AA_?$AA?$AA@
0x180005270: RegisterIdleTask
0x1800993C0: CachedMachine
0x180088558: SspiCli_NULL_THUNK_DATA_DLB
0x180080640: "\WowAA64Node" ??_C@_1BK@BOJDEMAO@?$AA?2?$AAW?$AAo?$AAw?$AAA?$AAA?$AA6?$AA4?$AAN?$AAo?$AAd?$AAe?$AA?$AA@
0x18002C070: LogonUserExExWStub
0x180052308: "unsigned long __cdecl PerfpConvertToCounterSet(struct _PCW_QUERYITEM_BUFFER * __ptr64,struct _PERFLIBCI_MULTI_INSTS * __ptr64 * __ptr64,unsigned long * __ptr64)" ?PerfpConvertToCounterSet@@YAKPEAU_PCW_QUERYITEM_BUFFER@@PEAPEAU_PERFLIBCI_MULTI_INSTS@@PEAK@Z
0x180043364: LogonUserCommonA
0x1800703D8: "__cdecl _imp_RtlAddAuditAccessObjectAce" __imp_RtlAddAuditAccessObjectAce
0x180097F60: g_DefaultCodeLevelMachine
0x18004F714: WPP_SF_Zd
0x18005AD8C: LsapDsMarshalAuthInfo
0x18001CBD7: "__cdecl _tailMerge_sspicli_dll" __tailMerge_sspicli_dll
0x18002BC70: CredUnmarshalCredentialAStub
0x18006F498: "__cdecl _imp_SizeofResource" __imp_SizeofResource
0x1800472EC: GetOperatorIndexByName
0x180098428: "unsigned short * __ptr64 __ptr64 pComputerName" ?pComputerName@@3PEAGEA
0x18005A400: CloseThreadWaitChainSession
0x180015E70: RegSetValueExWStub
0x18006F6C8: "__cdecl _imp_RpcEpResolveBinding" __imp_RpcEpResolveBinding
0x180010BE0: "long __cdecl StringCchCopyW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64)" ?StringCchCopyW@@YAJPEAG_KPEBG@Z
0x1800983F0: "struct _PERFLIBCI_RED_BLACK_NODE * __ptr64 __ptr64 g_ProviderTree" ?g_ProviderTree@@3PEAU_PERFLIBCI_RED_BLACK_NODE@@EA
0x18007FBC0: "%SystemRoot%\" ??_C@_1BM@EGAEJFL@?$AA?$CF?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AAR?$AAo?$AAo?$AAt?$AA?$CF?$AA?2?$AA?$AA@
0x18007DF90: "AppMgmtDebugBreak" ??_C@_1CE@JDDGOBLK@?$AAA?$AAp?$AAp?$AAM?$AAg?$AAm?$AAt?$AAD?$AAe?$AAb?$AAu?$AAg?$AAB?$AAr?$AAe?$AAa?$AAk?$AA?$AA@
0x180057C58: "long __cdecl StringCchCopyNW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64,unsigned __int64)" ?StringCchCopyNW@@YAJPEAG_KPEBG1@Z
0x18002BB20: CredFindBestCredentialWStub
0x18008FD70: "__cdecl _IMPORT_DESCRIPTOR_SECHOST" __IMPORT_DESCRIPTOR_SECHOST
0x18006FC08: "__cdecl _imp_AddAccessAllowedAceEx" __imp_AddAccessAllowedAceEx
0x18001C822: "__cdecl _imp_load_CryptHashSessionKey" __imp_load_CryptHashSessionKey
0x18006F778: "__cdecl _imp_PcwRemoveQueryItem" __imp_PcwRemoveQueryItem
0x18006F618: "__cdecl _imp_RegCreateKeyExInternalA" __imp_RegCreateKeyExInternalA
0x18009F068: "__cdecl _imp_CryptContextAddRef" __imp_CryptContextAddRef
0x1800703F0: "__cdecl _imp_RtlGetAce" __imp_RtlGetAce
0x180079E90: "\Registry\MACHINE\System\Current" ??_C@_1IG@HDHPCFON@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x18005A9F0: "int __cdecl WctInitWinsock(void)" ?WctInitWinsock@@YAHXZ
0x180019B70: PerfRegCloseKey
0x18005E110: LsaStorePrivateData_Old
0x180099330: WmipEventPumpOverlapped
0x180070678: "__cdecl _imp_RtlFreeHeap" __imp_RtlFreeHeap
0x18007E4B0: "ExtensionDll" ??_C@_1BK@IDBPDIMA@?$AAE?$AAx?$AAt?$AAe?$AAn?$AAs?$AAi?$AAo?$AAn?$AAD?$AAl?$AAl?$AA?$AA@
0x18006FC20: "__cdecl _imp_DuplicateTokenEx" __imp_DuplicateTokenEx
0x180044534: LocalConvertAclToString
0x18002A670: AddUsersToEncryptedFile
0x180080600: "\Wow6464Node" ??_C@_1BK@JDOKLMCN@?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4?$AA6?$AA4?$AAN?$AAo?$AAd?$AAe?$AA?$AA@
0x180015EB0: CheckTokenMembershipStub
0x180032274: CodeAuthzCreateLevelHandle
0x18006F5E8: "__cdecl _imp_RegCreateKeyExInternalW" __imp_RegCreateKeyExInternalW
0x18009F148: "__cdecl _imp_CryptSetProviderW" __imp_CryptSetProviderW
0x18001D1E5: "__cdecl _imp_load_CredUnmarshalCredentialA" __imp_load_CredUnmarshalCredentialA
0x180005150: TreeResetNamedSecurityInfoW
0x18005A944: "unsigned long __cdecl WctGetThreadWaitStatus(unsigned long,unsigned long,struct _SYSTEM_PROCESS_INFORMATION * __ptr64,struct _SYSTEM_EXTENDED_THREAD_INFORMATION * __ptr64)" ?WctGetThreadWaitStatus@@YAKKKPEAU_SYSTEM_PROCESS_INFORMATION@@PEAU_SYSTEM_EXTENDED_THREAD_INFORMATION@@@Z
0x180099368: "void * __ptr64 __ptr64 g_InitMutex" ?g_InitMutex@@3PEAXEA
0x18009F2D0: "__cdecl _imp_CredMarshalCredentialW" __imp_CredMarshalCredentialW
0x18001C8B2: "__cdecl _imp_load_CryptEnumProviderTypesW" __imp_load_CryptEnumProviderTypesW
0x18004D1DC: WPP_SF_Z
0x18009F038: CRYPTBASE_NULL_THUNK_DATA_DLA
0x18002B160: SetUserFileEncryptionKeyEx
0x18002BBB0: CredMarshalCredentialWStub
0x18002BED0: CryptVerifySignatureAStub
0x18001C8E8: "__cdecl _imp_load_CryptEnumProvidersA" __imp_load_CryptEnumProvidersA
0x18007F168: "ldap_first_entry" ??_C@_0BB@BLMAOMEM@ldap_first_entry?$AA@
0x18004EA7C: "struct _ERROR_LOG * __ptr64 __cdecl PerfpFindError(unsigned long,struct _ERROR_LOG * __ptr64)" ?PerfpFindError@@YAPEAU_ERROR_LOG@@KPEAU1@@Z
0x18001D0B3: "__cdecl _imp_load_CredIsProtectedW" __imp_load_CredIsProtectedW
0x180031774: "int __cdecl GetDebugLogFileName(unsigned short * __ptr64,long)" ?GetDebugLogFileName@@YAHPEAGJ@Z
0x1800047B4: "unsigned long __cdecl PerfpEnumerateKernelInstances(struct _PERFLIBCI_COUNTERSET_NODE * __ptr64,struct _PERF_INSTANCE_HEADER * __ptr64,unsigned long,unsigned long * __ptr64)" ?PerfpEnumerateKernelInstances@@YAKPEAU_PERFLIBCI_COUNTERSET_NODE@@PEAU_PERF_INSTANCE_HEADER@@KPEAK@Z
0x180038F60: TreeResetNamedSecurityInfoA
0x18002D68C: AuditpSetGlobalSacl
0x180057FCC: "int __cdecl WctCheckChain(struct _SYSTEM_PROCESS_INFORMATION * __ptr64,unsigned long * __ptr64,struct _WAITCHAIN_NODE_INFO * __ptr64)" ?WctCheckChain@@YAHPEAU_SYSTEM_PROCESS_INFORMATION@@PEAKPEAU_WAITCHAIN_NODE_INFO@@@Z
0x18009F0E0: "__cdecl _imp_CryptSetProviderA" __imp_CryptSetProviderA
0x18009F288: "__cdecl _imp_CredReadDomainCredentialsW" __imp_CredReadDomainCredentialsW
0x18001D131: "__cdecl _imp_load_CredUnmarshalCredentialW" __imp_load_CredUnmarshalCredentialW
0x180072638: "GetProcessWindowStation" ??_C@_0BI@DFKBFLJE@GetProcessWindowStation?$AA@
0x18005734C: WmipGetDevInstInfo
0x18001D167: "__cdecl _imp_load_CredIsProtectedA" __imp_load_CredIsProtectedA
0x18001B840: NotifyBootConfigStatus
0x180010294: "unsigned long __cdecl PerflibciOpenKey(struct HKEY__ * __ptr64,unsigned short const * __ptr64,unsigned long,struct HKEY__ * __ptr64 * __ptr64)" ?PerflibciOpenKey@@YAKPEAUHKEY__@@PEBGKPEAPEAU1@@Z
0x180015F00: CryptVerifySignatureWStub
0x18005F224: Wow64pNtCreateKeyInternal
0x180070658: "__cdecl _imp_RtlLengthSecurityDescriptor" __imp_RtlLengthSecurityDescriptor
0x180071D0C: "\" ??_C@_13FPGAJAPJ@?$AA?2?$AA?$AA@
0x18007D3D8: "OU" ??_C@_15EMOABJHF@?$AAO?$AAU?$AA?$AA@
0x180015EF0: GetSecurityDescriptorDaclStub
0x18003A750: GetNamedSecurityInfoExA
0x18004D0BC: WPP_SF_
0x180070640: "__cdecl _imp_NtReplaceKey" __imp_NtReplaceKey
0x18003B840: SetNamedSecurityInfoExW
0x1800441E0: ConvertStringSDToSDDomainA
0x180038DB0: GetAuditedPermissionsFromAclW
0x18002BEE0: DeleteServiceStub
0x18006F3A0: "__cdecl _imp_HeapAlloc" __imp_HeapAlloc
0x18002AE70: OpenEncryptedFileRawA
0x18002C720: SetAclInformationStub
0x180098378: "unsigned int (__cdecl* __ptr64 gpfnMsiReinstallProduct)(unsigned short const * __ptr64,unsigned long)" ?gpfnMsiReinstallProduct@@3P6AIPEBGK@ZEA
0x180014A40: LookupAccountSidW
0x180080148: "securityevent" ??_C@_1BM@MLFHKLND@?$AAs?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AAe?$AAv?$AAe?$AAn?$AAt?$AA?$AA@
0x18007D34C: "SD" ??_C@_15NAFBOLGP@?$AAS?$AAD?$AA?$AA@
0x18007FDA0: "NOT_TCPIP" ??_C@_1BE@BKDNKJD@?$AAN?$AAO?$AAT?$AA_?$AAT?$AAC?$AAP?$AAI?$AAP?$AA?$AA@
0x18006F2E0: "__cdecl _imp_FreeLibrary" __imp_FreeLibrary
0x18005AF40: LsapDsSizeAuthInfo
0x18006FD20: "__cdecl _imp_EqualDomainSid" __imp_EqualDomainSid
0x1800180F4: WmipSendWmiKMRequest
0x180070340: "__cdecl _imp_RtlUnicodeToMultiByteN" __imp_RtlUnicodeToMultiByteN
0x180038D30: GetAuditedPermissionsFromAclA
0x180015B80: SetSecurityDescriptorDaclStub
0x18002BE30: CryptGetUserKeyStub
0x18003B420: SetNamedSecurityInfoExA
0x18003DF50: BaseRegCreateKey
0x18003A9B0: GetNamedSecurityInfoExW
0x180070520: "__cdecl _imp_NtCreatePrivateNamespace" __imp_NtCreatePrivateNamespace
0x180070450: "__cdecl _imp_RtlDosPathNameToNtPathName_U" __imp_RtlDosPathNameToNtPathName_U
0x18001C7B6: "__cdecl _imp_load_CryptContextAddRef" __imp_load_CryptContextAddRef
0x18002AF20: OpenEncryptedFileRawW
0x18008738C: "__cdecl _NULL_DELAY_IMPORT_DESCRIPTOR" __NULL_DELAY_IMPORT_DESCRIPTOR
0x180041A60: LookupAccountSidA
0x18001A1A0: GetAclInformationStub
0x18007FC98: "Thread" ??_C@_1O@CDOGJPJJ@?$AAT?$AAh?$AAr?$AAe?$AAa?$AAd?$AA?$AA@
0x18007EA30: "CodeIdentifiers" ??_C@_1CA@JFMIED@?$AAC?$AAo?$AAd?$AAe?$AAI?$AAd?$AAe?$AAn?$AAt?$AAi?$AAf?$AAi?$AAe?$AAr?$AAs?$AA?$AA@
0x18003A030: CancelOverlappedAccess
0x1800706A0: "__cdecl _imp_RtlGetGroupSecurityDescriptor" __imp_RtlGetGroupSecurityDescriptor
0x18006F9B8: api-ms-win-core-registry-l1-1-2_NULL_THUNK_DATA
0x18006F810: "__cdecl _imp_OpenProcess" __imp_OpenProcess
0x180099290: "struct _RTL_SRWLOCK g_HashLock" ?g_HashLock@@3U_RTL_SRWLOCK@@A
0x18004B01C: StringCheck
0x180016310: RegGetValueWStub
0x18006FF38: api-ms-win-service-private-l1-1-0_NULL_THUNK_DATA
0x18009F3B0: "__cdecl _imp_LookupAccountNameLocalW" __imp_LookupAccountNameLocalW
0x18007E690: "ItemSize" ??_C@_1BC@FEHIIEEO@?$AAI?$AAt?$AAe?$AAm?$AAS?$AAi?$AAz?$AAe?$AA?$AA@
0x18001D36C: "__cdecl _imp_load_CredpConvertOneCredentialSize" __imp_load_CredpConvertOneCredentialSize
0x18006FAF0: "__cdecl _imp_AuditEnumerateSubCategories" __imp_AuditEnumerateSubCategories
0x18007FDB8: "NOT_CONNECTED" ??_C@_1BM@MJPODMGG@?$AAN?$AAO?$AAT?$AA_?$AAC?$AAO?$AAN?$AAN?$AAE?$AAC?$AAT?$AAE?$AAD?$AA?$AA@
0x180072690: "MsgWaitForMultipleObjects" ??_C@_0BK@LPJAAOIP@MsgWaitForMultipleObjects?$AA@
0x18000D030: "struct _EXT_OBJECT * __ptr64 __cdecl AllocateAndInitializeExtObject(struct HKEY__ * __ptr64,struct HKEY__ * __ptr64,struct _UNICODE_STRING * __ptr64)" ?AllocateAndInitializeExtObject@@YAPEAU_EXT_OBJECT@@PEAUHKEY__@@0PEAU_UNICODE_STRING@@@Z
0x18006F688: "__cdecl _imp_RpcBindingFree" __imp_RpcBindingFree
0x18006FB68: "__cdecl _imp_GetSidSubAuthority" __imp_GetSidSubAuthority
0x18001276C: "void __cdecl PerfGetLangId(unsigned long,unsigned char,unsigned short * __ptr64,unsigned long)" ?PerfGetLangId@@YAXKEPEAGK@Z
0x18006FFD0: "__cdecl _imp_CreateServiceA" __imp_CreateServiceA
0x18005E404: LsapDuplicateSecretName
0x180072828: "\WmiGuid\" ??_C@_1BE@BICDJNGE@?$AA?2?$AAW?$AAm?$AAi?$AAG?$AAu?$AAi?$AAd?$AA?2?$AA?$AA@
0x180017094: ElfDestroyReconnectionInfo
0x18009F3A8: "__cdecl _imp_LookupAccountNameLocalA" __imp_LookupAccountNameLocalA
0x18002BE50: CryptSetKeyParamStub
0x18007F888: PERFLIB_COLLECT_PROC_EXCEPTION
0x18007ECB8: "AccProvGrantAccessRights" ??_C@_0BJ@PDPIICAA@AccProvGrantAccessRights?$AA@
0x18002BDB0: CryptEnumProviderTypesAStub
0x18009F1F0: "__cdecl _imp_WTHelperGetProvCertFromChain" __imp_WTHelperGetProvCertFromChain
0x180031468: "unsigned long __cdecl ReadStringValue(struct HKEY__ * __ptr64,unsigned short const * __ptr64,unsigned short * __ptr64 * __ptr64)" ?ReadStringValue@@YAKPEAUHKEY__@@PEBGPEAPEAG@Z
0x18006F708: "__cdecl _imp_RpcStringBindingComposeW" __imp_RpcStringBindingComposeW
0x180074070: "\??\X:" ??_C@_1O@KBDNNIJO@?$AA?2?$AA?$DP?$AA?$DP?$AA?2?$AAX?$AA?3?$AA?$AA@
0x18005A480: GetThreadWaitChain
0x18002C550: RegDeleteKeyValueAStub
0x18002B900: CreatePrivateObjectSecurityWithMultipleInheritanceStub
0x18007F238: "Exists" ??_C@_1O@CPAMBBMC@?$AAE?$AAx?$AAi?$AAs?$AAt?$AAs?$AA?$AA@
0x1800592C8: "unsigned long __cdecl WctGetSmbInfo(struct _WCT_CLIENT_HANDLE * __ptr64,struct _WAITCHAIN_NODE_INFO * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64)" ?WctGetSmbInfo@@YAKPEAU_WCT_CLIENT_HANDLE@@PEAU_WAITCHAIN_NODE_INFO@@PEAK2@Z
0x18004A560: BackupEventLogA
0x18006F380: "__cdecl _imp_MoveFileW" __imp_MoveFileW
0x18004396C: SddlpGetRootDomainSid
0x180045A60: LookupAccessMaskInTable
0x180080370: "\Microsoft\Windows\CurrentVersio" ??_C@_1HG@DJPIFFNN@?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAV?$AAe?$AAr?$AAs?$AAi?$AAo@
0x18004A5E0: BackupEventLogW
0x18005A144: "unsigned long __cdecl WctLoadUser32(struct HINSTANCE__ * __ptr64 * __ptr64,struct HWND__ * __ptr64 (__cdecl* * __ptr64)(unsigned long))" ?WctLoadUser32@@YAKPEAPEAUHINSTANCE__@@PEAP6APEAUHWND__@@K@Z@Z
0x18006F5F8: "__cdecl _imp_CLOSE_LOCAL_HANDLE_INTERNAL" __imp_CLOSE_LOCAL_HANDLE_INTERNAL
0x18003CF28: "unsigned long __cdecl ConvertTrusteeWToTrusteeA(struct _TRUSTEE_W * __ptr64,struct _TRUSTEE_A * __ptr64 * __ptr64)" ?ConvertTrusteeWToTrusteeA@@YAKPEAU_TRUSTEE_W@@PEAPEAU_TRUSTEE_A@@@Z
0x18007E308: " rule, Guid = " ??_C@_1BO@LOMKAHPC@?$AA?5?$AAr?$AAu?$AAl?$AAe?$AA?0?$AA?5?$AAG?$AAu?$AAi?$AAd?$AA?5?$AA?$DN?$AA?5?$AA?$AA@
0x18009F3D8: "__cdecl _imp_SetEntriesInAclW" __imp_SetEntriesInAclW
0x18000FBF0: "unsigned long __cdecl PerfOpenKey(struct HKEY__ * __ptr64)" ?PerfOpenKey@@YAKPEAUHKEY__@@@Z
0x18002C100: LsaDeleteStub
0x18002F2F0: LsaSetSystemAccessAccount
0x18002BD50: CryptContextAddRefStub
0x18001CA6F: "__cdecl _imp_load_WTHelperGetProvCertFromChain" __imp_load_WTHelperGetProvCertFromChain
0x18001CE34: "__cdecl _tailMerge_bcrypt_dll" __tailMerge_bcrypt_dll
0x18006F598: "__cdecl _imp_SetLastError" __imp_SetLastError
0x180040920: EnumServicesStatusW
0x180016340: CryptSetHashParamStub
0x18007F198: "ldap_msgfree" ??_C@_0N@IHCDPDIF@ldap_msgfree?$AA@
0x18005E978: LspUpdatePrivateData
0x180034570: "__cdecl _CodeAuthzpEnsureMapped" __CodeAuthzpEnsureMapped
0x18006FF18: "__cdecl _imp_I_ScSetServiceBitsW" __imp_I_ScSetServiceBitsW
0x180070070: "__cdecl _imp__ultow_s" __imp__ultow_s
0x18002BC00: CredProtectWStub
0x1800374B0: SaferpGuidIdentsTableCompare
0x180039A60: GetTrusteeTypeW
0x18009F2A8: "__cdecl _imp_CredFindBestCredentialA" __imp_CredFindBestCredentialA
0x18009F350: "__cdecl _imp_CredpConvertCredential" __imp_CredpConvertCredential
0x180098350: "int (__cdecl* __ptr64 pfnGetUserObjectInformationW)(void * __ptr64,int,void * __ptr64,unsigned long,unsigned long * __ptr64)" ?pfnGetUserObjectInformationW@@3P6AHPEAXH0KPEAK@ZEA
0x1800406E0: EnumServicesStatusA
0x180013080: SaferiCompareTokenLevels
0x18006F560: "__cdecl _imp_SetFileInformationByHandle" __imp_SetFileInformationByHandle
0x1800566BC: WmipNotificationRegistration
0x180058940: "unsigned long __cdecl WctGetLockInfo(struct _WCT_ENTRY * __ptr64,unsigned long,struct _WCT_CLIENT_HANDLE * __ptr64,struct _WCT_LOCK_CONTEXT * __ptr64,unsigned long,struct _SYSTEM_PROCESS_INFORMATION * __ptr64,struct HWND__ * __ptr64 (__cdecl*)(unsigned long),struct _WAITCHAIN_NODE_INFO * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64)" ?WctGetLockInfo@@YAKPEAU_WCT_ENTRY@@KPEAU_WCT_CLIENT_HANDLE@@PEAU_WCT_LOCK_CONTEXT@@KPEAU_SYSTEM_PROCESS_INFORMATION@@P6APEAUHWND__@@K@ZPEAU_WAITCHAIN_NODE_INFO@@PEAK6@Z
0x180097CD0: "__cdecl _hmod__api_ms_win_security_provider_l1_1_0_dll" __hmod__api_ms_win_security_provider_l1_1_0_dll
0x180046B98: GetFlags
0x180070008: "__cdecl _imp_swscanf_s" __imp_swscanf_s
0x180039A60: GetTrusteeTypeA
0x18006FD30: "__cdecl _imp_ObjectCloseAuditAlarmW" __imp_ObjectCloseAuditAlarmW
0x18009F258: "__cdecl _imp_CredFindBestCredentialW" __imp_CredFindBestCredentialW
0x18006FF20: "__cdecl _imp_I_ScSetServiceBitsA" __imp_I_ScSetServiceBitsA
0x18004B820: ElfOpenBackupEventLogA
0x18002A430: GetCurrentHwProfileA
0x18006F428: "__cdecl _imp_GetModuleFileNameW" __imp_GetModuleFileNameW
0x1800163B0: LsapIsLocalServerName
0x180070388: "__cdecl _imp_RtlCreateUnicodeStringFromAsciiz" __imp_RtlCreateUnicodeStringFromAsciiz
0x180070430: "__cdecl _imp_RtlAddAccessDeniedObjectAce" __imp_RtlAddAccessDeniedObjectAce
0x18007E4F8: "IGNORESRPV2" ??_C@_1BI@EPJLDGBJ@?$AAI?$AAG?$AAN?$AAO?$AAR?$AAE?$AAS?$AAR?$AAP?$AAV?$AA2?$AA?$AA@
0x18005E774: LsapStorePrivateData2
0x18006FB48: "__cdecl _imp_ObjectDeleteAuditAlarmW" __imp_ObjectDeleteAuditAlarmW
0x18002C040: IsTokenRestrictedStub
0x180015644: IsLocalServer
0x1800705F0: "__cdecl _imp_RtlEqualUnicodeString" __imp_RtlEqualUnicodeString
0x180070568: "__cdecl _imp_RtlWaitOnAddress" __imp_RtlWaitOnAddress
0x180055688: WmipCopyMRString
0x18004B130: ElfBackupEventLogFileA
0x18006FE08: "__cdecl _imp_IsValidSecurityDescriptor" __imp_IsValidSecurityDescriptor
0x18002B780: AuditEnumerateCategoriesStub
0x18006F280: WowArmNodeString
0x18003A320: GetAccessPermissionsForObjectA
0x18006FA20: "__cdecl _imp_CloseTrace" __imp_CloseTrace
0x1800171A0: EnumServicesStatusExA
0x18000527C: ItCliRegisterIdleTask
0x18001AC80: "unsigned long __cdecl ConvertStringAToStringW(char * __ptr64,unsigned short * __ptr64 * __ptr64)" ?ConvertStringAToStringW@@YAKPEADPEAPEAG@Z
0x18003CCC4: "void __cdecl ConvertAccessRightToAccessMask(unsigned long,unsigned long * __ptr64)" ?ConvertAccessRightToAccessMask@@YAXKPEAK@Z
0x180015490: RegDeleteKeyW
0x18008FEB0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0
0x18008FEC4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-1" __IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-1
0x18008FED8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-2" __IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-2
0x18001A3D4: LsapVerifyReturnedNames
0x18005EC90: PSECURITY_SOURCE_NAME_bind
0x18006F628: "__cdecl _imp_RegOpenKeyExInternalA" __imp_RegOpenKeyExInternalA
0x180073FF0: WPP_5e7b08e799553f534c096488c0c42f3a_Traceguids
0x180098450: "struct _RTL_CRITICAL_SECTION NtMartaLoadCritical" ?NtMartaLoadCritical@@3U_RTL_CRITICAL_SECTION@@A
0x180045AF8: LookupAceTypeInTable
0x180049E74: LocalpGetStringForCondition
0x18007F4B8: "@USER." ??_C@_1O@PJNANMOG@?$AA?$EA?$AAU?$AAS?$AAE?$AAR?$AA?4?$AA?$AA@
0x1800078E8: "unsigned long __cdecl PerflibciCloseKey(struct HKEY__ * __ptr64)" ?PerflibciCloseKey@@YAKPEAUHKEY__@@@Z
0x18002B840: ChangeServiceConfig2WStub
0x18006FE28: api-ms-win-security-base-private-l1-1-0_NULL_THUNK_DATA
0x1800729A0: "Security" ??_C@_1BC@FCJNIDNL@?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?$AA@
0x18002C2F0: LsaRetrievePrivateDataStub
0x180004EF0: RegDeleteKeyA
0x180097C90: "__cdecl _hmod__USER32_dll" __hmod__USER32_dll
0x18007FC48: PnPDeviceIdGuid
0x180098918: "struct _RTL_SRWLOCK PerflibResourceTableLock" ?PerflibResourceTableLock@@3U_RTL_SRWLOCK@@A
0x18002D990: LsaCreateAccount
0x18002B830: ChangeServiceConfig2AStub
0x180080138: "audit" ??_C@_1M@LILKJADD@?$AAa?$AAu?$AAd?$AAi?$AAt?$AA?$AA@
0x18006F5F0: "__cdecl _imp_RegOpenKeyExInternalW" __imp_RegOpenKeyExInternalW
0x180033430: "__cdecl _CodeAuthzpQuerySingleIdentification" __CodeAuthzpQuerySingleIdentification
0x180015AE4: StringCchPrintfW
0x180070570: "__cdecl _imp_RtlWakeAddressAll" __imp_RtlWakeAddressAll
0x18006FBC8: "__cdecl _imp_InitializeSecurityDescriptor" __imp_InitializeSecurityDescriptor
0x1800423A0: LookupPrivilegeNameA
0x1800702B8: "__cdecl _imp_RtlIntegerToUnicodeString" __imp_RtlIntegerToUnicodeString
0x180071CD8: "Default" ??_C@_1BA@GHOECOCL@?$AAD?$AAe?$AAf?$AAa?$AAu?$AAl?$AAt?$AA?$AA@
0x1800399F0: GetMultipleTrusteeA
0x18005D708: LsaRemoveAccountRights
0x18002F140: LsaSetQuotasForAccount
0x18002B7A0: AuditEnumerateSubCategoriesStub
0x18007ECD8: "AccProvSetAccessRights" ??_C@_0BH@CLOGEEHK@AccProvSetAccessRights?$AA@
0x180080678: "RtlWow64GetCurrentMachine" ??_C@_0BK@HIPGPEMP@RtlWow64GetCurrentMachine?$AA@
0x1800317B0: "void * __ptr64 __cdecl OpenUnicodeLogFile(unsigned short const * __ptr64)" ?OpenUnicodeLogFile@@YAPEAXPEBG@Z
0x180043320: LogonUserA
0x180039A10: GetMultipleTrusteeOperationA
0x180070368: "__cdecl _imp_NtTraceControl" __imp_NtTraceControl
0x18009F018: "__cdecl _imp_SystemFunction040" __imp_SystemFunction040
0x180098438: "unsigned __int64 g_LastRefreshTime" ?g_LastRefreshTime@@3_KA
0x18007F398: "Member_of_any" ??_C@_1BM@PDCOAMPN@?$AAM?$AAe?$AAm?$AAb?$AAe?$AAr?$AA_?$AAo?$AAf?$AA_?$AAa?$AAn?$AAy?$AA?$AA@
0x18009F150: "__cdecl _imp_CryptGetProvParam" __imp_CryptGetProvParam
0x180070550: "__cdecl _imp_NtCreateFile" __imp_NtCreateFile
0x18006F7B8: "__cdecl _imp_CreateThread" __imp_CreateThread
0x18002C130: LsaICLookupNamesStub
0x18006FDA0: "__cdecl _imp_AdjustTokenPrivileges" __imp_AdjustTokenPrivileges
0x18002B7C0: AuditLookupSubCategoryNameWStub
0x180037490: SaferpGenericTableFree
0x18001B3A4: ElfGetLogInformation
0x18002C7D0: MSChapSrvChangePassword
0x1800399F0: GetMultipleTrusteeW
0x18007FA48: "Perf" ??_C@_19GFMNLLAL@?$AAP?$AAe?$AAr?$AAf?$AA?$AA@
0x18002BE80: CryptSetProviderExAStub
0x180070758: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x18001A670: "unsigned long __cdecl CloseExtObjectLibrary(struct _EXT_OBJECT * __ptr64,int)" ?CloseExtObjectLibrary@@YAKPEAU_EXT_OBJECT@@H@Z
0x18001CA4B: "__cdecl _imp_load_WTHelperProvDataFromStateData" __imp_load_WTHelperProvDataFromStateData
0x18004C300: ElfReportEventA
0x18002AD70: SetEncryptedFileMetadata
0x18001C726: "__cdecl _imp_load_CryptGetHashParam" __imp_load_CryptGetHashParam
0x18002E050: LsaGetRemoteUserName
0x180072198: "unsigned short const * const cszPerflibFlags" ?cszPerflibFlags@@3QBGB
0x18006F670: KERNELBASE_NULL_THUNK_DATA
0x180037968: CodeAuthzPol_SetInfoDual_HonorUserIdentities
0x180015390: GetLengthSidStub
0x18009F418: "__cdecl _imp_BCryptGetProperty" __imp_BCryptGetProperty
0x180070140: "__cdecl _imp_RtlAllocateHandle" __imp_RtlAllocateHandle
0x18002AD70: GetEncryptedFileMetadata
0x180043F70: ConvertSDToStringSDRootDomainW
0x18007DA58: "\REGISTRY\MACHINE" ??_C@_1CE@BGEMHEPM@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?$AA@
0x180076278: "AR" ??_C@_15OLDNEALM@?$AAA?$AAR?$AA?$AA@
0x180016AD0: ElfReportEventW
0x18001C7C8: "__cdecl _imp_load_CryptSetHashParam" __imp_load_CryptSetHashParam
0x18001C230: BuildExplicitAccessWithNameW
0x180006990: "long __cdecl StringCbPrintfW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64,...)" ?StringCbPrintfW@@YAJPEAG_KPEBGZZ
0x180016540: RegOpenCurrentUserStub
0x18006F910: "__cdecl _imp_RegGetValueA" __imp_RegGetValueA
0x18002BDD0: CryptEnumProvidersAStub
0x18007F92C: "NULL" ??_C@_04HIBGFPH@NULL?$AA@
0x18009F450: "__cdecl _imp_BCryptEncrypt" __imp_BCryptEncrypt
0x18009F0B8: "__cdecl _imp_CryptSignHashW" __imp_CryptSignHashW
0x18006FBB8: "__cdecl _imp_AccessCheckAndAuditAlarmW" __imp_AccessCheckAndAuditAlarmW
0x18006F7E0: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x18002BAC0: CredDeleteAStub
0x18006F368: "__cdecl _imp_GetFileAttributesExW" __imp_GetFileAttributesExW
0x18001D4C4: "__cdecl _tailMerge_api_ms_win_security_provider_l1_1_0_dll" __tailMerge_api_ms_win_security_provider_l1_1_0_dll
0x18001CFF2: "__cdecl _imp_load_LookupAccountNameLocalW" __imp_load_LookupAccountNameLocalW
0x18002C730: SetPrivateObjectSecurityExStub
0x18001C150: QueryServiceConfig2WStub
0x18002BEC0: CryptSignHashWStub
0x18007F848: PERFLIB_BUFFER_ALIGNMENT_ERROR
0x18003B3E0: SetEntriesInAuditListW
0x18006FB28: "__cdecl _imp_SetSecurityDescriptorRMControl" __imp_SetSecurityDescriptorRMControl
0x180070278: "__cdecl _imp_RtlAppendUnicodeToString" __imp_RtlAppendUnicodeToString
0x180098338: "unsigned int (__cdecl* __ptr64 gpfnMsiConfigureProductEx)(unsigned short const * __ptr64,int,enum tagINSTALLSTATE,unsigned short const * __ptr64)" ?gpfnMsiConfigureProductEx@@3P6AIPEBGHW4tagINSTALLSTATE@@0@ZEA
0x1800700C8: "__cdecl _imp__resetstkoflw" __imp__resetstkoflw
0x180073BE0: "MartaExtension" ??_C@_1BO@NFNDPLAO@?$AAM?$AAa?$AAr?$AAt?$AAa?$AAE?$AAx?$AAt?$AAe?$AAn?$AAs?$AAi?$AAo?$AAn?$AA?$AA@
0x180001010: PerfAddCounters
0x1800701B8: "__cdecl _imp_NtCompareTokens" __imp_NtCompareTokens
0x18007FA38: WPP_e3cc73f330eb39bc551f8ff7f089e30a_Traceguids
0x180097CA0: "__cdecl _hmod__bcrypt_dll" __hmod__bcrypt_dll
0x180047EC0: GetValueType
0x18002BB90: CredIsProtectedWStub
0x180018610: RegOpenKeyA
0x18005CFB0: LsaLookupNames2
0x18006FC78: "__cdecl _imp_GetTokenInformation" __imp_GetTokenInformation
0x180070250: "__cdecl _imp_EtwEventRegister" __imp_EtwEventRegister
0x180015150: "void * __ptr64 __cdecl PerflibAllocateMemory(struct _RTL_AVL_TABLE * __ptr64,unsigned long)" ?PerflibAllocateMemory@@YAPEAXPEAU_RTL_AVL_TABLE@@K@Z
0x1800885A0: CRYPT32_NULL_THUNK_DATA_DLB
0x18004BA80: ElfOpenEventLogA
0x18002BCA0: CredUnprotectWStub
0x1800153A0: RegOpenKeyW
0x1800706F0: "__cdecl _imp_RtlNtStatusToDosError" __imp_RtlNtStatusToDosError
0x180079D00: "\Device\" ??_C@_1BC@IDABLMPM@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AA?$AA@
0x180010330: WevtInitialize
0x18002E2A0: LsaLookupNames
0x18009F410: "__cdecl _imp_BCryptDestroyHash" __imp_BCryptDestroyHash
0x18002B2E0: WriteEncryptedFileRaw
0x18007E528: "SRPv2" ??_C@_1M@KAFBMKCJ@?$AAS?$AAR?$AAP?$AAv?$AA2?$AA?$AA@
0x18007E328: " using " ??_C@_1BA@GEDDEMBE@?$AA?5?$AAu?$AAs?$AAi?$AAn?$AAg?$AA?5?$AA?$AA@
0x18003A2A0: ConvertSecurityDescriptorToAccessNamedA
0x1800411E0: AccessCheckByTypeResultListAndAuditAlarmA
0x180072510: "MsiIsProductElevatedW" ??_C@_0BG@NADHBNJN@MsiIsProductElevatedW?$AA@
0x18006FBE0: "__cdecl _imp_SetPrivateObjectSecurityEx" __imp_SetPrivateObjectSecurityEx
0x18007D3B8: "OA" ??_C@_15JDJLNJLN@?$AAO?$AAA?$AA?$AA@
0x18006F9F8: api-ms-win-core-sysinfo-l1-1-0_NULL_THUNK_DATA
0x180071970: "NeutralName" ??_C@_1BI@HHOOHKAG@?$AAN?$AAe?$AAu?$AAt?$AAr?$AAa?$AAl?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x18003A2E0: ConvertSecurityDescriptorToAccessNamedW
0x1800986D8: "struct _RTL_CRITICAL_SECTION PerfpCritSect" ?PerfpCritSect@@3U_RTL_CRITICAL_SECTION@@A
0x18006F818: api-ms-win-core-processthreads-l1-1-1_NULL_THUNK_DATA
0x1800476CC: GetPrintableOperandValue
0x1800028D8: "unsigned long __cdecl PerfpAddCounter(struct _PERF_QUERY * __ptr64,struct _PERFLIBCI_COUNTERSET_NODE * __ptr64,struct _PERF_COUNTER_IDENTIFIER * __ptr64)" ?PerfpAddCounter@@YAKPEAU_PERF_QUERY@@PEAU_PERFLIBCI_COUNTERSET_NODE@@PEAU_PERF_COUNTER_IDENTIFIER@@@Z
0x18007EE00: "AccProvGetOperationResults" ??_C@_0BL@BOFFFNDO@AccProvGetOperationResults?$AA@
0x18006F9E8: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x1800165B0: RegisterServiceCtrlHandlerWStub
0x180070420: "__cdecl _imp_RtlAddAccessDeniedAceEx" __imp_RtlAddAccessDeniedAceEx
0x180015480: CryptDestroyKeyStub
0x18007E2B8: "%HKEY_CURRENT_USER" ??_C@_1CG@OPBOOIKI@?$AA?$CF?$AAH?$AAK?$AAE?$AAY?$AA_?$AAC?$AAU?$AAR?$AAR?$AAE?$AAN?$AAT?$AA_?$AAU?$AAS?$AAE?$AAR?$AA?$AA@
0x18006F2F0: "__cdecl _imp_ResolveDelayLoadedAPI" __imp_ResolveDelayLoadedAPI
0x18003D1C4: "unsigned long __cdecl TrusteeAllocationSizeAToW(struct _TRUSTEE_A * __ptr64)" ?TrusteeAllocationSizeAToW@@YAKPEAU_TRUSTEE_A@@@Z
0x18001C810: "__cdecl _imp_load_CryptExportKey" __imp_load_CryptExportKey
0x18009F3C8: "__cdecl _imp_SetNamedSecurityInfoW" __imp_SetNamedSecurityInfoW
0x18001D3B4: "__cdecl _imp_load_CredpConvertCredential" __imp_load_CredpConvertCredential
0x18001CAF0: ControlTraceA
0x18001CAC9: "__cdecl _imp_load_CryptCATAdminReleaseCatalogContext" __imp_load_CryptCATAdminReleaseCatalogContext
0x18007F768: PERFLIB_BUFFER_OVERFLOW
0x180070138: "__cdecl _imp_RtlUnicodeStringToInteger" __imp_RtlUnicodeStringToInteger
0x180071B60: "unsigned short const * const FirstCounter" ?FirstCounter@@3QBGB
0x18007F708: PERFLIB_CANNOT_LOAD_PERF_DLL
0x18006FA40: api-ms-win-eventing-consumer-l1-1-1_NULL_THUNK_DATA
0x18007F340: "Device_Member_of" ??_C@_1CC@OAGDEENH@?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA_?$AAM?$AAe?$AAm?$AAb?$AAe?$AAr?$AA_?$AAo?$AAf?$AA?$AA@
0x180015410: AppmgmtInitialize
0x18001C996: ControlTraceW
0x180079F20: "\Registry\Machine\Software\Polic" ??_C@_1JI@JGOADMNK@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAP?$AAo?$AAl?$AAi?$AAc@
0x1800724C0: "\Registry\User" ??_C@_1BO@MLIOGHOC@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAU?$AAs?$AAe?$AAr?$AA?$AA@
0x18003E120: BaseRegSaveKeyEx
0x180009980: LookupPrivilegeValueW
0x18007F2B8: "Not_Contains" ??_C@_1BK@OGFIFIKJ@?$AAN?$AAo?$AAt?$AA_?$AAC?$AAo?$AAn?$AAt?$AAa?$AAi?$AAn?$AAs?$AA?$AA@
0x180031200: UninstallApplication
0x18007FD60: "getsockname" ??_C@_0M@ODFENJLC@getsockname?$AA@
0x18006FE18: api-ms-win-security-base-l1-1-0_NULL_THUNK_DATA
0x180098308: "unsigned int (__cdecl* __ptr64 gpfnMsiDecomposeDescriptor)(unsigned short const * __ptr64,unsigned short * __ptr64,unsigned short * __ptr64,unsigned short * __ptr64,unsigned long * __ptr64)" ?gpfnMsiDecomposeDescriptor@@3P6AIPEBGPEAG11PEAK@ZEA
0x180071B80: "unsigned short const * const CollectTimeout" ?CollectTimeout@@3QBGB
0x1800387E8: AipFreeFileSignature
0x180098A00: FnSamOpenDomain
0x18007F050: "WNetLogonNotify" ??_C@_0BA@OFNHFDJP@WNetLogonNotify?$AA@
0x18007D2D0: "D" ??_C@_13MKMNOPIJ@?$AAD?$AA?$AA@
0x180016240: LookupPrivilegeValueA
0x18007E790: "`string'" ??_C@_1PI@FBFAHOAL@?$AAA?$AAD?$AAE?$AA?$AA?$AAA?$AAD?$AAP?$AA?$AA?$AAB?$AAA?$AAS?$AA?$AA?$AAB?$AAA?$AAT?$AA?$AA?$AAC?$AAH?$AAM?$AA?$AA?$AAC?$AAM?$AAD?$AA?$AA?$AAC?$AAO?$AAM?$AA?$AA?$AAC?$AAP?$AAL?$AA?$AA@
0x18009F168: "__cdecl _imp_CryptImportKey" __imp_CryptImportKey
0x18007EF28: GUID_MOF_RESOURCE_ADDED_NOTIFICATION
0x180070170: "__cdecl _imp_NtOpenThreadToken" __imp_NtOpenThreadToken
0x18007F8C0: "Close" ??_C@_05LGELBCGM@Close?$AA@
0x18006DAA0: "struct __midl_frag2_t const __midl_frag2" ?__midl_frag2@@3U__midl_frag2_t@@B
0x18006DAF0: "struct __midl_frag8_t const __midl_frag8" ?__midl_frag8@@3U__midl_frag8_t@@B
0x180042220: LookupPrivilegeDisplayNameW
0x18003B000: GetSecurityInfoExW
0x180053E10: WmiQueryGuidInformation
0x18009F298: "__cdecl _imp_CredProtectA" __imp_CredProtectA
0x18005A814: "void __cdecl WctCleanupWinsock(void)" ?WctCleanupWinsock@@YAXXZ
0x180014BC0: AllocateAndInitializeSidStub
0x1800955E0: EVENTLOG_Context
0x18006F528: "__cdecl _imp_CreateThreadpoolIo" __imp_CreateThreadpoolIo
0x180052600: RpcpBindRpc
0x18007E580: "Restricted" ??_C@_1BG@HGEFIHHK@?$AAR?$AAe?$AAs?$AAt?$AAr?$AAi?$AAc?$AAt?$AAe?$AAd?$AA?$AA@
0x180097098: "unsigned long dwExtCtrOpenProcWaitMs" ?dwExtCtrOpenProcWaitMs@@3KA
0x18006FD98: "__cdecl _imp_SetPrivateObjectSecurity" __imp_SetPrivateObjectSecurity
0x18006FED0: "__cdecl _imp_SetServiceObjectSecurity" __imp_SetServiceObjectSecurity
0x18004A850: ClearEventLogA
0x180037168: CodeAuthzpConvertWildcardStringSidToSidW
0x18004D11C: WPP_SF_Dd
0x18004D254: WPP_SF_dD
0x18002C590: RegDisablePredefinedCacheExStub
0x18004FA24: WPP_SF_dZ
0x180032A20: IsTokenUntrusted
0x18005D7A4: LsaCreateSecret
0x180098368: "unsigned int (__cdecl* __ptr64 gpfnMsiAdvertiseScript)(unsigned short const * __ptr64,unsigned long,struct HKEY__ * __ptr64 * __ptr64,int)" ?gpfnMsiAdvertiseScript@@3P6AIPEBGKPEAPEAUHKEY__@@H@ZEA
0x18002BCB0: CredWriteAStub
0x1800704E0: "__cdecl _imp_RtlRunOnceExecuteOnce" __imp_RtlRunOnceExecuteOnce
0x18006FEA8: "__cdecl _imp_CloseServiceHandle" __imp_CloseServiceHandle
0x18003BF30: SetSecurityInfoExW
0x180042070: LookupPrivilegeDisplayNameA
0x18004F1EC: WPP_SF_dS
0x18007D3A4: "KW" ??_C@_15HNHIJDOI@?$AAK?$AAW?$AA?$AA@
0x18004F300: WPP_SF_dq
0x18004E994: "void __cdecl PerfpDeleteErrorLogs(struct _ERROR_LOG * __ptr64)" ?PerfpDeleteErrorLogs@@YAXPEAU_ERROR_LOG@@@Z
0x18002C210: LsaICLookupSidsStub
0x180072528: "MsiQueryProductStateW" ??_C@_0BG@IDDLHEOM@MsiQueryProductStateW?$AA@
0x1800165C0: OpenSCManagerAStub
0x18001C86A: "__cdecl _imp_load_CryptGetDefaultProviderW" __imp_load_CryptGetDefaultProviderW
0x180057594: WmipInternalProvider
0x18002C680: RegQueryMultipleValuesWStub
0x18002C710: RegisterServiceCtrlHandlerExAStub
0x18001CCE8: "__cdecl _tailMerge_user32_dll" __tailMerge_user32_dll
0x18006FA90: "__cdecl _imp_EnumerateTraceGuidsEx" __imp_EnumerateTraceGuidsEx
0x18006F750: api-ms-win-core-namedpipe-l1-1-0_NULL_THUNK_DATA
0x180017148: McGenEventWrite
0x1800992E8: "unsigned short * NativeLangId" ?NativeLangId@@3PAGA
0x180095040: WPP_GLOBAL_Control
0x180002C70: CreateProcessWithTokenW
0x18002B070: ReadEncryptedFileRaw
0x180098A64: "unsigned long gDebugInitialized" ?gDebugInitialized@@3KA
0x18001A250: RegisterServiceCtrlHandlerExWStub
0x18007FB18: "MofImagePath" ??_C@_1BK@NLMOABHB@?$AAM?$AAo?$AAf?$AAI?$AAm?$AAa?$AAg?$AAe?$AAP?$AAa?$AAt?$AAh?$AA?$AA@
0x18001C792: "__cdecl _imp_load_CryptGetDefaultProviderA" __imp_load_CryptGetDefaultProviderA
0x18009F100: "__cdecl _imp_CryptGetKeyParam" __imp_CryptGetKeyParam
0x18002BF30: EqualPrefixSidStub
0x18006F8D0: "__cdecl _imp_RegDisablePredefinedCacheEx" __imp_RegDisablePredefinedCacheEx
0x18005BB88: EnumStateDestroy
0x180072398: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x18008FE60: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0
0x18004A9C0: GetOldestEventLogRecord
0x18008FE74: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-1" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-1
0x18006DB70: "struct __midl_frag15_t const __midl_frag15" ?__midl_frag15@@3U__midl_frag15_t@@B
0x18002D0E0: UnregisterIdleTask
0x180070228: "__cdecl _imp_LdrLoadDll" __imp_LdrLoadDll
0x180016350: "__cdecl TlgEnableCallback" _TlgEnableCallback
0x180070218: "__cdecl _imp_NtQueryKey" __imp_NtQueryKey
0x18003EFE0: RemoteRegQueryInfoKeyWrapper
0x18000BA00: "__cdecl _CodeAuthzpIdentifyOneCodeAuthzLevel" __CodeAuthzpIdentifyOneCodeAuthzLevel
0x180012720: SaferGetPolicyInformation
0x18007D354: "GA" ??_C@_15HPMIFLNA@?$AAG?$AAA?$AA?$AA@
0x18001CA5D: "__cdecl _imp_load_WTHelperGetProvSignerFromChain" __imp_load_WTHelperGetProvSignerFromChain
0x18001486C: CodeAuthzLevelObjpEntireTableFree
0x18004D0E0: WPP_SF_D
0x18004D0E0: WPP_SF_d
0x18006F3D8: "__cdecl _imp_FindResourceExW" __imp_FindResourceExW
0x18007F538: "%ls, " ??_C@_1M@DNOAINIG@?$AA?$CF?$AAl?$AAs?$AA?0?$AA?5?$AA?$AA@
0x180070308: "__cdecl _imp_NtQueryVolumeInformationFile" __imp_NtQueryVolumeInformationFile
0x18001D654: IsGetUserObjectInformationWPresent
0x18001C478: "__cdecl _report_rangecheckfailure" __report_rangecheckfailure
0x1800429B0: PrivilegedServiceAuditAlarmA
0x18008FE38: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-service-winsvc-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-service-winsvc-l1-1-0
0x180073F50: "ext-ms-win-ntuser-windowstation-" ??_C@_1EO@OAMAPFNA@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAn?$AAt?$AAu?$AAs?$AAe?$AAr?$AA?9?$AAw?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AAt?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?9@
0x18006F7A0: api-ms-win-core-perfcounters-l1-1-0_NULL_THUNK_DATA
0x18001C942: "__cdecl _imp_load_CryptVerifySignatureA" __imp_load_CryptVerifySignatureA
0x1800721C0: "%ws\%ws%ws%ws" ??_C@_1BM@DLCGNMPA@?$AA?$CF?$AAw?$AAs?$AA?2?$AA?$CF?$AAw?$AAs?$AA?$CF?$AAw?$AAs?$AA?$CF?$AAw?$AAs?$AA?$AA@
0x1800157F0: CryptAcquireContextWStub
0x18002BD00: CredpConvertOneCredentialSizeStub
0x18006FB20: api-ms-win-security-audit-l1-1-1_NULL_THUNK_DATA
0x18006FAC0: api-ms-win-security-audit-l1-1-0_NULL_THUNK_DATA
0x180043580: NpGetUserName
0x18005D3D0: LsapNeutralizeNt4Emulation
0x18006F6B0: "__cdecl _imp_I_RpcExceptionFilter" __imp_I_RpcExceptionFilter
0x180073D20: "__cdecl _sz_api_ms_win_security_lsalookup_l1_1_0_dll" __sz_api_ms_win_security_lsalookup_l1_1_0_dll
0x180017B60: RegEnableReflectionKey
0x18007F260: "==" ??_C@_15PEJIGKFD@?$AA?$DN?$AA?$DN?$AA?$AA@
0x18008FDD4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-service-management-l2-1-0" __IMPORT_DESCRIPTOR_api-ms-win-service-management-l2-1-0
0x180097F68: g_DefaultCodeLevelUserFlags
0x18007FBE0: "{%08x-%04x-%04x-%02x%02x-%02x%02" ??_C@_1GG@HENFDGCJ@?$AA?$HL?$AA?$CF?$AA0?$AA8?$AAx?$AA?9?$AA?$CF?$AA0?$AA4?$AAx?$AA?9?$AA?$CF?$AA0?$AA4?$AAx?$AA?9?$AA?$CF?$AA0?$AA2?$AAx?$AA?$CF?$AA0?$AA2?$AAx?$AA?9?$AA?$CF?$AA0?$AA2?$AAx?$AA?$CF?$AA0?$AA2@
0x180042EC4: GetUshortStringSize
0x18007F45C: "TS" ??_C@_15JKLEPB@?$AAT?$AAS?$AA?$AA@
0x1800701C8: "__cdecl _imp_RtlFreeSid" __imp_RtlFreeSid
0x18009F2B8: "__cdecl _imp_CredDeleteW" __imp_CredDeleteW
0x180070390: "__cdecl _imp_NtRenameKey" __imp_NtRenameKey
0x18006FA80: "__cdecl _imp_TraceSetInformation" __imp_TraceSetInformation
0x18001C7A4: "__cdecl _imp_load_CryptDestroyHash" __imp_load_CryptDestroyHash
0x180013700: CodeAuthzpGetTokenInformation
0x18007E278: "advapi32" ??_C@_1BC@DNHGCMLG@?$AAa?$AAd?$AAv?$AAa?$AAp?$AAi?$AA3?$AA2?$AA?$AA@
0x180043920: GetStringConditionFromBinary
0x18006FD88: "__cdecl _imp_SetSecurityDescriptorSacl" __imp_SetSecurityDescriptorSacl
0x1800875E8: api-ms-win-devices-config-l1-1-1_NULL_THUNK_DATA_DLN
0x1800887D0: api-ms-win-devices-config-l1-1-1_NULL_THUNK_DATA_DLB
0x180080168: "lsacap" ??_C@_1O@BDGOHPEN@?$AAl?$AAs?$AAa?$AAc?$AAa?$AAp?$AA?$AA@
0x18007EFA0: "ncacn_ip_tcp" ??_C@_1BK@BPGFLIHL@?$AAn?$AAc?$AAa?$AAc?$AAn?$AA_?$AAi?$AAp?$AA_?$AAt?$AAc?$AAp?$AA?$AA@
0x18007E558: "zone" ??_C@_19MKNDFJNE@?$AAz?$AAo?$AAn?$AAe?$AA?$AA@
0x18002BF70: FindFirstFreeAceStub
0x18009F238: api-ms-win-devices-config-l1-1-1_NULL_THUNK_DATA_DLA
0x18001CADB: "__cdecl _imp_load_CryptCATAdminReleaseContext" __imp_load_CryptCATAdminReleaseContext
0x18009F2F0: "__cdecl _imp_CredDeleteA" __imp_CredDeleteA
0x18006F480: "__cdecl _imp_CreateMutexW" __imp_CreateMutexW
0x1800150F0: RegEnumValueWStub
0x1800705D0: "__cdecl _imp_RtlWakeAddressSingle" __imp_RtlWakeAddressSingle
0x1800988F0: "long volatile dwExtObjListRefCount" ?dwExtObjListRefCount@@3JC
0x180098310: "unsigned long (__cdecl* __ptr64 pfnMsgWaitForMultipleObjects)(unsigned long,void * __ptr64 const * __ptr64,int,unsigned long,unsigned long)" ?pfnMsgWaitForMultipleObjects@@3P6AKKPEBQEAXHKK@ZEA
0x18003EAF0: RegCreateKeyA
0x1800727D0: pszRegIDConfigDB
0x18002C690: RegRestoreKeyAStub
0x180056930: WmipReceiveNotifications
0x18006FFA0: "__cdecl _imp_OpenSCManagerA" __imp_OpenSCManagerA
0x18002BD60: CryptDecryptStub
0x18003C9C4: "unsigned long __cdecl ConvertAListToNamedBasedW(struct _ACTRL_ALISTW * __ptr64,class CSList & __ptr64)" ?ConvertAListToNamedBasedW@@YAKPEAU_ACTRL_ALISTW@@AEAVCSList@@@Z
0x180070508: "__cdecl _imp_RtlDeleteBoundaryDescriptor" __imp_RtlDeleteBoundaryDescriptor
0x18002C110: LsaEnumerateAccountRightsStub
0x180015330: RegCreateKeyW
0x18007F484: "@" ??_C@_13EFKPHINO@?$AA?$EA?$AA?$AA@
0x18006F500: "__cdecl _imp_EncodePointer" __imp_EncodePointer
0x18001CEFB: "__cdecl _imp_load_BCryptHashData" __imp_load_BCryptHashData
0x1800989C8: "void * __ptr64 __ptr64 lpPerflibSectionAddr" ?lpPerflibSectionAddr@@3PEAXEA
0x18002C5A0: RegEnumValueAStub
0x18007E648: SrpEvt_AccessDisabledNoSaferUIByPolicy
0x1800719A8: "CodeIdentifiers\" ??_C@_1CC@MPDAOGML@?$AAC?$AAo?$AAd?$AAe?$AAI?$AAd?$AAe?$AAn?$AAt?$AAi?$AAf?$AAi?$AAe?$AAr?$AAs?$AA?2?$AA?$AA@
0x18001C8A0: "__cdecl _imp_load_CryptEncrypt" __imp_load_CryptEncrypt
0x18005CD88: LsaICLookupSidsWithCreds
0x18006FB60: "__cdecl _imp_GetSecurityDescriptorGroup" __imp_GetSecurityDescriptorGroup
0x18007DBD0: "Unable to locate init routine, e" ??_C@_0CL@ELOMEINF@Unable?5to?5locate?5init?5routine?0?5e@
0x1800017F0: PerfQueryCounterData
0x180015540: SaferiSearchMatchingHashRules
0x180070160: "__cdecl _imp_NtQueryValueKey" __imp_NtQueryValueKey
0x18006F3F0: "__cdecl _imp_DeleteCriticalSection" __imp_DeleteCriticalSection
0x18009F368: "__cdecl _imp_CredProfileLoadedEx" __imp_CredProfileLoadedEx
0x1800700E0: "__cdecl _imp__vsnprintf" __imp__vsnprintf
0x18002A960: EncryptFileA
0x18002BDA0: CryptEncryptStub
0x180070200: "__cdecl _imp_RtlCreateUnicodeString" __imp_RtlCreateUnicodeString
0x18000F3A4: "int __cdecl PerflibciHeapFree(void * __ptr64)" ?PerflibciHeapFree@@YAHPEAX@Z
0x18001C280: "__cdecl _security_check_cookie" __security_check_cookie
0x180098A18: gAreChangePasswordFunctionsInitialized
0x180031170: GetManagedApplicationCategories
0x180097CB0: "__cdecl _hmod__api_ms_win_security_credentials_l1_1_0_dll" __hmod__api_ms_win_security_credentials_l1_1_0_dll
0x18007DC18: "SamConnect" ??_C@_0L@CFAHGMDF@SamConnect?$AA@
0x18006F808: api-ms-win-core-processthreads-l1-1-0_NULL_THUNK_DATA
0x180011414: GetCurrentUserSid
0x18002C6E0: RegSetKeyValueWStub
0x180042700: ObjectDeleteAuditAlarmA
0x18002BD10: CredpConvertTargetInfoStub
0x18006F2D8: "__cdecl _imp_GetProcAddress" __imp_GetProcAddress
0x1800802D0: "\CLSID" ??_C@_1O@HEJDOEN@?$AA?2?$AAC?$AAL?$AAS?$AAI?$AAD?$AA?$AA@
0x18007F44C: "TU" ??_C@_15CFPBOLCN@?$AAT?$AAU?$AA?$AA@
0x18006F5C0: "__cdecl _imp_CreateProcessAsUserW" __imp_CreateProcessAsUserW
0x18006FB98: "__cdecl _imp_AreAllAccessesGranted" __imp_AreAllAccessesGranted
0x1800444B0: ConvertStringSidToSidA
0x18004CC40: PerfRegSetValue
0x180013B20: "__cdecl _CodeAuthzpComputeAccessTokenFromCodeAuthzObject" __CodeAuthzpComputeAccessTokenFromCodeAuthzObject
0x18006FD48: "__cdecl _imp_CreatePrivateObjectSecurityEx" __imp_CreatePrivateObjectSecurityEx
0x180005EA0: ConvertStringSecurityDescriptorToSecurityDescriptorW
0x18006F9B0: "__cdecl _imp_RegQueryMultipleValuesA" __imp_RegQueryMultipleValuesA
0x180055EC0: WmipAddToGNList
0x18006F7C0: "__cdecl _imp_GetPriorityClass" __imp_GetPriorityClass
0x18006FA30: api-ms-win-eventing-consumer-l1-1-0_NULL_THUNK_DATA
0x18003C590: "unsigned long __cdecl AllocAndInsertCNode(class CSList & __ptr64,unsigned short * __ptr64 * __ptr64,unsigned short * __ptr64,unsigned short * __ptr64,unsigned long * __ptr64,unsigned long,unsigned long,unsigned long * __ptr64,unsigned long,unsigned long)" ?AllocAndInsertCNode@@YAKAEAVCSList@@PEAPEAGPEAG2PEAKKK3KK@Z
0x18009F390: "__cdecl _imp_CredProfileUnloaded" __imp_CredProfileUnloaded
0x1800701B0: "__cdecl _imp_NtDuplicateToken" __imp_NtDuplicateToken
0x18003EA70: RegCopyTreeA
0x180043018: L32pNotifyMpr
0x18009F058: "__cdecl _imp_CryptGetDefaultProviderA" __imp_CryptGetDefaultProviderA
0x18001D555: "__cdecl _imp_load_GetNamedSecurityInfoW" __imp_load_GetNamedSecurityInfoW
0x18007D3D0: "AL" ??_C@_15FLPLGABA@?$AAA?$AAL?$AA?$AA@
0x18007E170: "CEvents::Report called with more" ??_C@_1HA@NAJDKFGF@?$AAC?$AAE?$AAv?$AAe?$AAn?$AAt?$AAs?$AA?3?$AA?3?$AAR?$AAe?$AAp?$AAo?$AAr?$AAt?$AA?5?$AAc?$AAa?$AAl?$AAl?$AAe?$AAd?$AA?5?$AAw?$AAi?$AAt?$AAh?$AA?5?$AAm?$AAo?$AAr?$AAe@
0x18002AAF0: EncryptionDisable
0x18000A110: "unsigned long __cdecl PerflibciQueryValue(struct HKEY__ * __ptr64,unsigned short const * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64,unsigned char * __ptr64)" ?PerflibciQueryValue@@YAKPEAUHKEY__@@PEBGPEAK2PEAE@Z
0x18006FBE8: "__cdecl _imp_AddAccessAllowedObjectAce" __imp_AddAccessAllowedObjectAce
0x180015310: RevertToSelfStub
0x180070740: "__cdecl _imp_RtlFreeAnsiString" __imp_RtlFreeAnsiString
0x180070670: "__cdecl _imp_RtlMakeSelfRelativeSD" __imp_RtlMakeSelfRelativeSD
0x18006F9A8: "__cdecl _imp_RegQueryMultipleValuesW" __imp_RegQueryMultipleValuesW
0x1800723C8: "\\." ??_C@_17KDPFNGJO@?$AA?2?$AA?2?$AA?4?$AA?$AA@
0x180045B90: SddlAddAccessFilterAce
0x18006FBF0: "__cdecl _imp_GetKernelObjectSecurity" __imp_GetKernelObjectSecurity
0x180002760: PerflibciIsLocalQueryFromHandle
0x1800993A8: "int (__cdecl* __ptr64 g_WSACleanup)(void)" ?g_WSACleanup@@3P6AHXZEA
0x18009F1D8: "__cdecl _imp_CryptCATAdminReleaseCatalogContext" __imp_CryptCATAdminReleaseCatalogContext
0x180033BD8: SaferIdentifyLevel2
0x180098850: "struct _RTL_AVL_TABLE PerflibResourceTable" ?PerflibResourceTable@@3U_RTL_AVL_TABLE@@A
0x18002BBE0: CredProfileUnloadedStub
0x18004D2FC: WppCleanupUm
0x18007D394: "KA" ??_C@_15IAKJLKL@?$AAK?$AAA?$AA?$AA@
0x18007F7E8: PERFLIB_INCORRECT_INSTANCE_LENGTH
0x1800728D0: "unsigned short const * const HelpValue" ?HelpValue@@3QBGB
0x18001CEE9: "__cdecl _imp_load_BCryptCreateHash" __imp_load_BCryptCreateHash
0x18003F920: RegSetValueA
0x180070480: "__cdecl _imp_RtlTimeToSecondsSince1970" __imp_RtlTimeToSecondsSince1970
0x18002D2D0: AuditLookupCategoryIdFromCategoryGuid
0x180040290: EnumDependentServicesA
0x18005BEA4: BaseBindToMachineShutdownInterface
0x18000BE30: SaferIdentifyLevel
0x18005E804: LspReadPrivateData
0x18007EF78: "ncacn_np" ??_C@_1BC@CCHMBIKG@?$AAn?$AAc?$AAa?$AAc?$AAn?$AA_?$AAn?$AAp?$AA?$AA@
0x18009F088: "__cdecl _imp_CryptCreateHash" __imp_CryptCreateHash
0x1800565E4: WmipInternalNotification
0x18001C220: AuditQueryPerUserPolicyStub
0x18007E6A8: "HashAlg" ??_C@_1BA@PCOPGGCI@?$AAH?$AAa?$AAs?$AAh?$AAA?$AAl?$AAg?$AA?$AA@
0x18006F898: "__cdecl _imp_RegCopyTreeW" __imp_RegCopyTreeW
0x18002CF60: MIDL_user_free_Ext
0x18009F378: "__cdecl _imp_CredBackupCredentials" __imp_CredBackupCredentials
0x18007E1E0: "%u" ??_C@_15EFLNJKHH@?$AA?$CF?$AAu?$AA?$AA@
0x1800434C0: LogonUserExA
0x18006F630: "__cdecl _imp_GetPackagePath" __imp_GetPackagePath
0x18001B320: GetEventLogInformation
0x18002C020: ImpersonateAnonymousTokenStub
0x180073C90: "AccProvGetCapabilities" ??_C@_0BH@IHOMPJKJ@AccProvGetCapabilities?$AA@
0x1800090B0: LocalGetAceCount
0x18002BB30: CredFreeStub
0x18006F860: "__cdecl _imp_RegRestoreKeyA" __imp_RegRestoreKeyA
0x18007DB11: "__cdecl TraceLoggingMetadataEnd" _TraceLoggingMetadataEnd
0x18005F56C: Wow64DetermineEnvironment
0x18006FC40: "__cdecl _imp_AddAccessDeniedObjectAce" __imp_AddAccessDeniedObjectAce
0x18001CD8B: "__cdecl _imp_load_GetWindowThreadProcessId" __imp_load_GetWindowThreadProcessId
0x18006FEE0: "__cdecl _imp_QueryServiceConfig2W" __imp_QueryServiceConfig2W
0x18001C653: "__cdecl _imp_load_CryptReleaseContext" __imp_load_CryptReleaseContext
0x180044120: ConvertSecurityDescriptorToStringSecurityDescriptorW
0x18006F9C0: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x18008728C: "__cdecl _DELAY_IMPORT_DESCRIPTOR_USER32_dll" __DELAY_IMPORT_DESCRIPTOR_USER32_dll
0x18007FD40: "WSAStartup" ??_C@_0L@EEFLCHHA@WSAStartup?$AA@
0x18009F0E8: "__cdecl _imp_CryptEnumProvidersW" __imp_CryptEnumProvidersW
0x18007EE80: "AccProvHandleRevokeAccessRights" ??_C@_0CA@DHIBLJBO@AccProvHandleRevokeAccessRights?$AA@
0x18007A030: "struct _svcctl_MIDL_TYPE_FORMAT_STRING const svcctl__MIDL_TypeFormatString" ?svcctl__MIDL_TypeFormatString@@3U_svcctl_MIDL_TYPE_FORMAT_STRING@@B
0x18006F488: "__cdecl _imp_HeapReAlloc" __imp_HeapReAlloc
0x18004F358: WPP_SF_dqq
0x18004F49C: WPP_SF_qqd
0x18003C250: TrusteeAccessToObjectA
0x180005AD4: "unsigned long __cdecl PerflibciLocalWaitForMutex(void * __ptr64)" ?PerflibciLocalWaitForMutex@@YAKPEAX@Z
0x18006F8F0: "__cdecl _imp_RegLoadAppKeyW" __imp_RegLoadAppKeyW
0x18007F7D8: PERFLIB_GUARD_PAGE_VIOLATION
0x18009F0F0: "__cdecl _imp_CryptEnumProvidersA" __imp_CryptEnumProvidersA
0x18007F778: PERFLIB_BUFFER_POINTER_MISMATCH
0x18007F1D8: "(objectClass=*)" ??_C@_0BA@LDCHLLGP@?$CIobjectClass?$DN?$CK?$CJ?$AA@
0x18007FF00: "ncacn_nb_nb" ??_C@_1BI@IJHJECAH@?$AAn?$AAc?$AAa?$AAc?$AAn?$AA_?$AAn?$AAb?$AA_?$AAn?$AAb?$AA?$AA@
0x18009F120: "__cdecl _imp_CryptDuplicateHash" __imp_CryptDuplicateHash
0x1800463E8: DecodeAttributeName
0x18007DC00: "samlib.dll" ??_C@_1BG@KIPJBCPD@?$AAs?$AAa?$AAm?$AAl?$AAi?$AAb?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x18004C760: EVENTLOG_HANDLE_A_bind
0x180002CDC: "int __cdecl CreateProcessWithLogonCommonW(void * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned long,unsigned short const * __ptr64,unsigned short * __ptr64,unsigned long,void * __ptr64,unsigned short const * __ptr64,struct _STARTUPINFOW * __ptr64,struct _PROCESS_INFORMATION * __ptr64)" ?CreateProcessWithLogonCommonW@@YAHPEAXPEBG11K1PEAGK01PEAU_STARTUPINFOW@@PEAU_PROCESS_INFORMATION@@@Z
0x18004D3E4: "struct _PERFLIBCI_INSTANCE_NODE * __ptr64 __cdecl PerflibciFindInstance(struct _PERFLIBCI_COUNTERSET_NODE * __ptr64,unsigned short * __ptr64,unsigned long,unsigned long,int)" ?PerflibciFindInstance@@YAPEAU_PERFLIBCI_INSTANCE_NODE@@PEAU_PERFLIBCI_COUNTERSET_NODE@@PEAGKKH@Z
0x18006F5B0: "__cdecl _imp_LocalAlloc" __imp_LocalAlloc
0x180070498: "__cdecl _imp_EtwGetTraceEnableLevel" __imp_EtwGetTraceEnableLevel
0x18001CD9D: "__cdecl _imp_load_CertVerifyCertificateChainPolicy" __imp_load_CertVerifyCertificateChainPolicy
0x1800595D0: "unsigned long __cdecl WctGetThreadInfo(unsigned long,struct _SYSTEM_PROCESS_INFORMATION * __ptr64,struct _WAITCHAIN_NODE_INFO * __ptr64,struct _WCT_CLIENT_HANDLE * __ptr64)" ?WctGetThreadInfo@@YAKKPEAU_SYSTEM_PROCESS_INFORMATION@@PEAU_WAITCHAIN_NODE_INFO@@PEAU_WCT_CLIENT_HANDLE@@@Z
0x180033D70: SaferiIsDllAllowed
0x18007DE90: "Software\Microsoft\Windows NT\Cu" ??_C@_1HC@DIPLOEMO@?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAN?$AAT?$AA?2?$AAC?$AAu@
0x180015140: CryptCreateHashStub
0x1800549CC: WmipCountedUnicodeToCountedAnsi
0x180097C88: "__cdecl _hmod__SspiCli_dll" __hmod__SspiCli_dll
0x18006F2E8: "__cdecl _imp_DelayLoadFailureHook" __imp_DelayLoadFailureHook
0x18009F140: "__cdecl _imp_CryptGetHashParam" __imp_CryptGetHashParam
0x180013FD0: EVENTLOG_HANDLE_W_bind
0x18008FE9C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-base-private-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-base-private-l1-1-0
0x18001AF30: RegSetKeySecurityStub
0x18000A2A0: "unsigned long __cdecl PerflibciGuidFromString(unsigned short * __ptr64,struct _GUID * __ptr64)" ?PerflibciGuidFromString@@YAKPEAGPEAU_GUID@@@Z
0x18006F3A8: "__cdecl _imp_GetProcessHeap" __imp_GetProcessHeap
0x18006F258: WowArm64NodeString
0x180030EB0: GetLocalManagedApplications
0x18006F780: "__cdecl _imp_PcwCreateNotifier" __imp_PcwCreateNotifier
0x1800801E0: "\{36BBB745-0999-4FD8-A538-4D4D84" ??_C@_1FA@NMDPIOEE@?$AA?2?$AA?$HL?$AA3?$AA6?$AAB?$AAB?$AAB?$AA7?$AA4?$AA5?$AA?9?$AA0?$AA9?$AA9?$AA9?$AA?9?$AA4?$AAF?$AAD?$AA8?$AA?9?$AAA?$AA5?$AA3?$AA8?$AA?9?$AA4?$AAD?$AA4?$AAD?$AA8?$AA4@
0x180098040: pbAdminSidByte
0x18008734C: "__cdecl _DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_provider_l1_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_provider_l1_1_0_dll
0x1800873E8: CRYPTBASE_NULL_THUNK_DATA_DLN
0x18007D2DC: "NR" ??_C@_15BKGLPCGJ@?$AAN?$AAR?$AA?$AA@
0x18002BE60: CryptSetProvParamStub
0x180014A10: SaferpLevelObjpTableCompare
0x1800702D0: "__cdecl _imp_RtlFormatCurrentUserKeyPath" __imp_RtlFormatCurrentUserKeyPath
0x18002C120: LsaEnumerateAccountsWithUserRightStub
0x18007DD10: "Software\Microsoft\Windows\Curre" ??_C@_1HO@GJKBMELE@?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe@
0x18006F578: "__cdecl _imp_FindNextFileW" __imp_FindNextFileW
0x18006FB18: "__cdecl _imp_AuditSetSecurity" __imp_AuditSetSecurity
0x18007DDA8: "Deployment Name" ??_C@_1CA@JAGKEKPE@?$AAD?$AAe?$AAp?$AAl?$AAo?$AAy?$AAm?$AAe?$AAn?$AAt?$AA?5?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x18007E6C8: "LevelObjects\" ??_C@_1BM@HPJHELKL@?$AAL?$AAe?$AAv?$AAe?$AAl?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAs?$AA?2?$AA?$AA@
0x18004B310: ElfChangeNotify
0x18006FC50: "__cdecl _imp_AccessCheckByType" __imp_AccessCheckByType
0x1800706F8: "__cdecl _imp_RtlInitAnsiString" __imp_RtlInitAnsiString
0x1800720E0: "unsigned short const * const ExtPath" ?ExtPath@@3QBGB
0x18002C4B0: QueryAllTracesWStub
0x18009F3B8: "__cdecl _imp_LookupAccountSidLocalW" __imp_LookupAccountSidLocalW
0x18008724C: "__cdecl _DELAY_IMPORT_DESCRIPTOR_CRYPTBASE_dll" __DELAY_IMPORT_DESCRIPTOR_CRYPTBASE_dll
0x18006FE40: "__cdecl _imp_SetServiceStatus" __imp_SetServiceStatus
0x180070748: "__cdecl _imp_RtlGetThreadPreferredUILanguages" __imp_RtlGetThreadPreferredUILanguages
0x18000F2B0: SaferpLogResultsToFile
0x180098EE0: "struct _LIST_ENTRY * g_HashTable" ?g_HashTable@@3PAU_LIST_ENTRY@@A
0x18006F590: "__cdecl _imp_DosDateTimeToFileTime" __imp_DosDateTimeToFileTime
0x18007D4D4: "unsigned char const __midl_frag25" ?__midl_frag25@@3EB
0x18008FDC0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-service-management-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-service-management-l1-1-0
0x18006FF88: "__cdecl _imp_RegisterServiceCtrlHandlerW" __imp_RegisterServiceCtrlHandlerW
0x18006FAE8: "__cdecl _imp_AuditSetPerUserPolicy" __imp_AuditSetPerUserPolicy
0x18009F1D0: "__cdecl _imp_CryptCATAdminReleaseContext" __imp_CryptCATAdminReleaseContext
0x1800700A8: "__cdecl _imp__errno" __imp__errno
0x18002C780: SetTokenInformationStub
0x18007F6B0: WPP_e7d234ecbfbf322e274d1e47a3a97375_Traceguids
0x180071AF8: "unsigned short const * const KeepResident" ?KeepResident@@3QBGB
0x1800161A0: RegNotifyChangeKeyValueStub
0x180070270: "__cdecl _imp_RtlDeleteElementGenericTable" __imp_RtlDeleteElementGenericTable
0x18006F6D8: "__cdecl _imp_I_RpcSNCHOption" __imp_I_RpcSNCHOption
0x18002D290: AuditLookupCategoryGuidFromCategoryId
0x18006FFA8: "__cdecl _imp_RegisterServiceCtrlHandlerA" __imp_RegisterServiceCtrlHandlerA
0x180005FD0: LsaGetUserName
0x18002C670: RegQueryMultipleValuesAStub
0x18006F8D8: "__cdecl _imp_RegNotifyChangeKeyValue" __imp_RegNotifyChangeKeyValue
0x18006F3B8: "__cdecl _imp_UnmapViewOfFile" __imp_UnmapViewOfFile
0x180033EE0: SaferiRegisterExtensionDll
0x18007F1E8: "<SID=" ??_C@_05LJFBFGIE@?$DMSID?$DN?$AA@
0x180014A00: GetTokenInformationStub
0x18006F730: SECHOST_NULL_THUNK_DATA
0x18007FAB0: "\PIPE\" ??_C@_1O@PGAGHCON@?$AA?2?$AAP?$AAI?$AAP?$AAE?$AA?2?$AA?$AA@
0x180097EA0: SddlSidLookupCritical
0x18009F330: "__cdecl _imp_CredpEncodeCredential" __imp_CredpEncodeCredential
0x18003421C: SaferpIsV2PolicyPresent
0x180057A50: WmipQuerySingleInstanceInfo
0x180070610: "__cdecl _imp_RtlCreateQueryDebugBuffer" __imp_RtlCreateQueryDebugBuffer
0x18003CCF0: "unsigned long __cdecl ConvertExplicitAccessAToExplicitAccessW(unsigned long,struct _EXPLICIT_ACCESS_A * __ptr64,struct _EXPLICIT_ACCESS_W * __ptr64 * __ptr64)" ?ConvertExplicitAccessAToExplicitAccessW@@YAKKPEAU_EXPLICIT_ACCESS_A@@PEAPEAU_EXPLICIT_ACCESS_W@@@Z
0x180015F30: "int __cdecl PerflibCreateSD(unsigned long)" ?PerflibCreateSD@@YAHK@Z
0x18006F3E8: "__cdecl _imp_GetVolumePathNameW" __imp_GetVolumePathNameW
0x18002C6B0: RegSaveKeyExAStub
0x18005BD90: NewShutdownCallback
0x1800537E0: WmiNotificationRegistrationA
0x18001D1C1: "__cdecl _imp_load_CredFindBestCredentialA" __imp_load_CredFindBestCredentialA
0x1800101D0: PerfRegQueryValue
0x18006F5E0: "__cdecl _imp_RegDeleteKeyExInternalW" __imp_RegDeleteKeyExInternalW
0x18002C6C0: RegSaveKeyExWStub
0x18002C610: RegLoadAppKeyWStub
0x18003E0F0: BaseRegRestoreKey
0x18002B710: AddAuditAccessAceStub
0x18006F608: "__cdecl _imp_RegDeleteKeyExInternalA" __imp_RegDeleteKeyExInternalA
0x180003E90: BaseRegOpenClassKey
0x18007F788: PERFLIB_LIBRARY_TEMP_DISABLED
0x18001CEB3: "__cdecl _imp_load_BCryptDestroyKey" __imp_load_BCryptDestroyKey
0x18006FC88: "__cdecl _imp_GetPrivateObjectSecurity" __imp_GetPrivateObjectSecurity
0x18007EAF0: "DisableMaxPrivilege" ??_C@_1CI@JIJBAPOC@?$AAD?$AAi?$AAs?$AAa?$AAb?$AAl?$AAe?$AAM?$AAa?$AAx?$AAP?$AAr?$AAi?$AAv?$AAi?$AAl?$AAe?$AAg?$AAe?$AA?$AA@
0x18001D410: IsPerfRegCloseKeyPresent
0x180072200: "%.*ls\%ls" ??_C@_1BE@IHEFAICJ@?$AA?$CF?$AA?4?$AA?$CK?$AAl?$AAs?$AA?2?$AA?$CF?$AAl?$AAs?$AA?$AA@
0x18007F818: PERFLIB_CLOSE_PROC_EXCEPTION
0x180059FD0: "int __cdecl WctIsRpcssPid(unsigned long)" ?WctIsRpcssPid@@YAHK@Z
0x18002BD40: CredpEncodeSecretStub
0x18005D124: LsapCreateBindingHandleForLookup
0x1800722C8: "TransparentEnabled" ??_C@_1CG@KIHJPCIJ@?$AAT?$AAr?$AAa?$AAn?$AAs?$AAp?$AAa?$AAr?$AAe?$AAn?$AAt?$AAE?$AAn?$AAa?$AAb?$AAl?$AAe?$AAd?$AA?$AA@
0x180039970: BuildTrusteeWithObjectsAndSidA
0x1800123DC: SaferpEnumerateHiddenLevels
0x18005A750: RegisterWaitChainCOMCallback
0x180097CB8: "__cdecl _hmod__api_ms_win_security_credentials_l2_1_0_dll" __hmod__api_ms_win_security_credentials_l2_1_0_dll
0x1800313FC: "int __cdecl LoadLoadString(void)" ?LoadLoadString@@YAHXZ
0x18001C88E: "__cdecl _imp_load_CryptGenRandom" __imp_load_CryptGenRandom
0x18007EF58: "\PIPE\winreg" ??_C@_1BK@HNEMJPAC@?$AA?2?$AAP?$AAI?$AAP?$AAE?$AA?2?$AAw?$AAi?$AAn?$AAr?$AAe?$AAg?$AA?$AA@
0x1800728A8: "\\.\WMIDataDevice" ??_C@_1CE@GMGHJOGN@?$AA?2?$AA?2?$AA?4?$AA?2?$AAW?$AAM?$AAI?$AAD?$AAa?$AAt?$AAa?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?$AA@
0x18007EEE0: "AccProvHandleIsAccessAudited" ??_C@_0BN@PJHEHIIL@AccProvHandleIsAccessAudited?$AA@
0x18007FD28: "ws2_32.dll" ??_C@_1BG@KNJGGOFB@?$AAw?$AAs?$AA2?$AA_?$AA3?$AA2?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x180009D20: "struct _PERFLIBCI_PROVIDER_NODE * __ptr64 __cdecl PerflibciBuildProvider(struct HKEY__ * __ptr64,unsigned short * __ptr64,unsigned long * __ptr64)" ?PerflibciBuildProvider@@YAPEAU_PERFLIBCI_PROVIDER_NODE@@PEAUHKEY__@@PEAGPEAK@Z
0x180097094: "unsigned long dwThreadAndLibraryTimeout" ?dwThreadAndLibraryTimeout@@3KA
0x180097DC0: RootDomSidBuf
0x180040A10: GetServiceKeyNameA
0x18001CD67: "__cdecl _imp_load_GetUserObjectInformationW" __imp_load_GetUserObjectInformationW
0x180070660: "__cdecl _imp_RtlValidSecurityDescriptor" __imp_RtlValidSecurityDescriptor
0x18007E338: " as " ??_C@_19GCONOECN@?$AA?5?$AAa?$AAs?$AA?5?$AA?$AA@
0x18007EF00: "AccProvHandleGetAccessInfoPerObj" ??_C@_0CI@HNCGELK@AccProvHandleGetAccessInfoPerObj@
0x18002F870: LsaQueryDomainInformationPolicy
0x18001CED7: "__cdecl _imp_load_BCryptGenerateSymmetricKey" __imp_load_BCryptGenerateSymmetricKey
0x1800010D0: PerfQueryCounterInfo
0x18009F130: "__cdecl _imp_CryptDestroyKey" __imp_CryptDestroyKey
0x1800970B0: g_dwLevelHandleSequence
0x180052D80: WmiEnumerateGuids
0x18006F2A8: "__cdecl _imp_MultiByteToWideChar" __imp_MultiByteToWideChar
0x180099308: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUhxivtUdrmivtUkviuoryUxfiivmgUlyquivUznwGEUkviukOlyq@perflib" __@@_PchSym_@00@KxulyqvxgPillgKxunrmpvimvoUhxivtUdrmivtUkviuoryUxfiivmgUlyquivUznwGEUkviukOlyq@perflib
0x18009F228: "__cdecl _imp_CM_Locate_DevNodeW" __imp_CM_Locate_DevNodeW
0x180031AFC: "unsigned long __cdecl Bind(void)" ?Bind@@YAKXZ
0x18006FA60: "__cdecl _imp_StopTraceW" __imp_StopTraceW
0x18006F568: "__cdecl _imp_CopyFileExW" __imp_CopyFileExW
0x180033AA4: GetPackagePathForMoniker
0x180052BC0: WmiDevInstToInstanceNameA
0x1800726D0: "LSARPC_ENDPOINT" ??_C@_1CA@CFBBCIJN@?$AAL?$AAS?$AAA?$AAR?$AAP?$AAC?$AA_?$AAE?$AAN?$AAD?$AAP?$AAO?$AAI?$AAN?$AAT?$AA?$AA@
0x1800989F8: FeClientModule
0x18006FEF8: "__cdecl _imp_QueryServiceStatusEx" __imp_QueryServiceStatusEx
0x18003ECA0: RegRenameKey
0x1800717B4: "EA" ??_C@_15DCAAPKNL@?$AAE?$AAA?$AA?$AA@
0x18006FEC0: api-ms-win-service-management-l1-1-0_NULL_THUNK_DATA
0x1800701E8: "__cdecl _imp_RtlDuplicateUnicodeString" __imp_RtlDuplicateUnicodeString
0x1800124B0: CodeAuthzPol_GetInfoRegistry_MachineDword
0x18006FF08: api-ms-win-service-management-l2-1-0_NULL_THUNK_DATA
0x18002D160: AuditComputeEffectivePolicyByToken
0x18001D3EA: "__cdecl _imp_load_CredpEncodeSecret" __imp_load_CredpEncodeSecret
0x180036664: "__cdecl _CodeAuthzIsExecutableFileTypeHelper" __CodeAuthzIsExecutableFileTypeHelper
0x180052CA0: WmiDevInstToInstanceNameW
0x1800983C4: gbDomainSidCached
0x180071EB8: "unsigned short const * const HELP_STRING" ?HELP_STRING@@3QBGB
0x18008FF64: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-apiquery-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-apiquery-l1-1-0
0x1800398D0: BuildImpersonateTrusteeA
0x1800983C0: gbDnsDomainSidCached
0x1800543B0: WmiReceiveNotificationsW
0x18001D37E: "__cdecl _imp_load_CredProfileLoadedEx" __imp_load_CredProfileLoadedEx
0x180070198: "__cdecl _imp_NtSetInformationToken" __imp_NtSetInformationToken
0x180070768: "__cdecl _guard_fids_table" __guard_fids_table
0x180070030: "__cdecl _imp_wcscpy_s" __imp_wcscpy_s
0x18006FD08: "__cdecl _imp_GetSecurityDescriptorRMControl" __imp_GetSecurityDescriptorRMControl
0x18001BA8C: AccProvpInitProviders
0x18006F658: "__cdecl _imp_lstrcmpW" __imp_lstrcmpW
0x18001A240: SetSecurityDescriptorGroupStub
0x1800474A0: GetPrintableAttributeName
0x18005AE24: LsapDsMarshalAuthInfoHalf
0x18001AFB0: RegisterServiceCtrlHandlerAStub
0x180009AF0: LsaOpenPolicy
0x18007F898: PERFLIB_COLLECT_PROC_FAILURE
0x18002FA80: LsaQueryTrustedDomainInfoByName
0x18001CD79: "__cdecl _imp_load_GetThreadDesktop" __imp_load_GetThreadDesktop
0x18006FC90: "__cdecl _imp_CreateWellKnownSid" __imp_CreateWellKnownSid
0x180059D5C: "unsigned long __cdecl WctGetWaitThreadOrProcInfo(void * __ptr64,enum _WCT_OBJECT_TYPE,struct _WAITCHAIN_NODE_INFO * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64)" ?WctGetWaitThreadOrProcInfo@@YAKPEAXW4_WCT_OBJECT_TYPE@@PEAU_WAITCHAIN_NODE_INFO@@PEAK3@Z
0x18001AF60: GetSecurityDescriptorGroupStub
0x18006FA18: "__cdecl _imp_ProcessTrace" __imp_ProcessTrace
0x180070120: msvcrt_NULL_THUNK_DATA
0x1800983F8: "struct _PERFLIBCI_RED_BLACK_NODE * __ptr64 __ptr64 g_ProviderList" ?g_ProviderList@@3PEAU_PERFLIBCI_RED_BLACK_NODE@@EA
0x180098108: g_DefaultCodeLevelUser
0x180056F64: WmipCountedToSzAndTrim
0x180001F28: "unsigned long __cdecl PerfpCollectKernelData(struct _PERF_QUERY * __ptr64)" ?PerfpCollectKernelData@@YAKPEAU_PERF_QUERY@@@Z
0x18002F1C0: LsaSetSecurityObject
0x180060570: "__cdecl load_config_used" _load_config_used
0x18005D228: LsapCreateNullTerminatedServerName
0x180004C08: "int __cdecl LoadUser32Funcs(void)" ?LoadUser32Funcs@@YAHXZ
0x18005C040: RegConn_nb_ipx
0x18007D4A8: "struct __midl_frag17_t const __midl_frag17" ?__midl_frag17@@3U__midl_frag17_t@@B
0x180073D10: "__cdecl _sz_bcrypt_dll" __sz_bcrypt_dll
0x18007D2FC: "CC" ??_C@_15EOFANBEN@?$AAC?$AAC?$AA?$AA@
0x180005698: "void __cdecl PerflibciSetObjectsValidityState(unsigned char)" ?PerflibciSetObjectsValidityState@@YAXE@Z
0x18008FF78: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-perfcounters-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-perfcounters-l1-1-0
0x18001AFC0: CheckForHiberboot
0x180070290: "__cdecl _imp_RtlCopySid" __imp_RtlCopySid
0x18007E240: "UrlZones" ??_C@_1BC@EKMDLNB@?$AAU?$AAr?$AAl?$AAZ?$AAo?$AAn?$AAe?$AAs?$AA?$AA@
0x180087548: SspiCli_NULL_THUNK_DATA_DLN
0x18006F410: "__cdecl _imp_ReleaseMutex" __imp_ReleaseMutex
0x180017B80: FreeEncryptedFileMetadata
0x18009F260: "__cdecl _imp_CredIsMarshaledCredentialW" __imp_CredIsMarshaledCredentialW
0x18009F3F0: "__cdecl _imp_GetExplicitEntriesFromAclW" __imp_GetExplicitEntriesFromAclW
0x18007F7C8: PERFLIB_COLLECT_PROC_NOT_FOUND
0x18003FFA0: RegDeleteKeyTransactedW
0x18007C020: "OptionValue" ??_C@_1BI@CBOLNBDL@?$AAO?$AAp?$AAt?$AAi?$AAo?$AAn?$AAV?$AAa?$AAl?$AAu?$AAe?$AA?$AA@
0x1800802E0: "\DirectShow" ??_C@_1BI@PJOGKDFE@?$AA?2?$AAD?$AAi?$AAr?$AAe?$AAc?$AAt?$AAS?$AAh?$AAo?$AAw?$AA?$AA@
0x18007E668: MS_Software_Restriction_Policies_Provider
0x18006FAD8: "__cdecl _imp_AuditQueryPerUserPolicy" __imp_AuditQueryPerUserPolicy
0x180098318: "int (__cdecl* __ptr64 pfnTranslateMessage)(struct tagMSG const * __ptr64)" ?pfnTranslateMessage@@3P6AHPEBUtagMSG@@@ZEA
0x180010398: "long __cdecl PerfGetNames(unsigned long,struct _UNICODE_STRING const * __ptr64,struct _UNICODE_STRING const * __ptr64,unsigned char * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64,unsigned short const * __ptr64)" ?PerfGetNames@@YAJKPEBU_UNICODE_STRING@@0PEAEPEAK2PEBG@Z
0x18002C7B0: TraceSetInformationStub
0x18006FB38: "__cdecl _imp_SetTokenInformation" __imp_SetTokenInformation
0x1800143B0: ConvertSidToStringSidW
0x18003D800: UpdateTraceA
0x180017B80: PREGISTRY_SERVER_NAME_unbind
0x18004E7D0: "unsigned long __cdecl PerfpCheckErrorTime(struct _ERROR_LOG * __ptr64,__int64,struct HKEY__ * __ptr64)" ?PerfpCheckErrorTime@@YAKPEAU_ERROR_LOG@@_JPEAUHKEY__@@@Z
0x180098380: g_bInitializedFirstTime
0x180087808: bcrypt_NULL_THUNK_DATA_DLN
0x18001CE28: "__cdecl _imp_load_BCryptEncrypt" __imp_load_BCryptEncrypt
0x18009F458: bcrypt_NULL_THUNK_DATA_DLA
0x1800885B0: bcrypt_NULL_THUNK_DATA_DLB
0x18003ED20: RegDeleteKeyTransactedA
0x180018470: WmipOpenWmiDevice
0x18006F478: "__cdecl _imp_GetComputerNameA" __imp_GetComputerNameA
0x180080038: "localhost" ??_C@_1BE@JDLPANCI@?$AAl?$AAo?$AAc?$AAa?$AAl?$AAh?$AAo?$AAs?$AAt?$AA?$AA@
0x18007F978: "perfh004.dat" ??_C@_1BK@HAINHBPL@?$AAp?$AAe?$AAr?$AAf?$AAh?$AA0?$AA0?$AA4?$AA?4?$AAd?$AAa?$AAt?$AA?$AA@
0x18001C90C: "__cdecl _imp_load_CryptGetKeyParam" __imp_load_CryptGetKeyParam
0x18009F1B0: "__cdecl _imp_GetWindowThreadProcessId" __imp_GetWindowThreadProcessId
0x18007F410: "Not_Device_Member_of_any" ??_C@_1DC@DBOCMLEK@?$AAN?$AAo?$AAt?$AA_?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA_?$AAM?$AAe?$AAm?$AAb?$AAe?$AAr?$AA_?$AAo?$AAf?$AA_?$AAa?$AAn?$AAy?$AA?$AA@
0x180012484: McGenEventUnregister
0x18001C966: "__cdecl _imp_load_CryptGetUserKey" __imp_load_CryptGetUserKey
0x18006FEE8: "__cdecl _imp_ChangeServiceConfigW" __imp_ChangeServiceConfigW
0x180038678: AiVerifyTrustedPublisherPolicy
0x180070428: "__cdecl _imp_RtlAddAccessAllowedObjectAce" __imp_RtlAddAccessAllowedObjectAce
0x18007FCB8: "RPCSS" ??_C@_1M@BJMOGEFA@?$AAR?$AAP?$AAC?$AAS?$AAS?$AA?$AA@
0x18001B674: ElfRevertThreadPrivilege
0x18001C76E: "__cdecl _imp_load_CryptSetKeyParam" __imp_load_CryptSetKeyParam
0x18007D3C8: "AU" ??_C@_15HGOKHIAF@?$AAA?$AAU?$AA?$AA@
0x1800721E0: ".dat" ??_C@_19DOLFOBJP@?$AA?4?$AAd?$AAa?$AAt?$AA?$AA@
0x18002BAD0: CredDeleteWStub
0x18003D920: OpenTraceA
0x180046A90: GetConditionToken
0x18002BDE0: CryptEnumProvidersWStub
0x18002BD80: CryptDuplicateHashStub
0x18002A8C0: DuplicateEncryptionInfoFile
0x18007F858: PERFLIB_NO_PERFORMANCE_SUBKEY
0x18007F098: "Windows NT Network Provider" ??_C@_1DI@IDODLLLE@?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAN?$AAT?$AA?5?$AAN?$AAe?$AAt?$AAw?$AAo?$AAr?$AAk?$AA?5?$AAP?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AA?$AA@
0x18005EF48: GetKeyPath
0x180005B88: "void __cdecl PerflibciRotateLeft(struct _PERFLIBCI_RED_BLACK_NODE * __ptr64 * __ptr64,struct _PERFLIBCI_RED_BLACK_NODE * __ptr64)" ?PerflibciRotateLeft@@YAXPEAPEAU_PERFLIBCI_RED_BLACK_NODE@@PEAU1@@Z
0x18009F2E8: "__cdecl _imp_CredUnmarshalCredentialW" __imp_CredUnmarshalCredentialW
0x1800161D0: CloseServiceHandleStub
0x1800467D4: GetAttributeName
0x180040E10: SVCCTL_HANDLEA_bind
0x180003A4C: "long __cdecl StringCchLengthW(unsigned short const * __ptr64,unsigned __int64,unsigned __int64 * __ptr64)" ?StringCchLengthW@@YAJPEBG_KPEA_K@Z
0x180098330: "struct HWINSTA__ * __ptr64 (__cdecl* __ptr64 pfnGetProcessWindowStation)(void)" ?pfnGetProcessWindowStation@@3P6APEAUHWINSTA__@@XZEA
0x1800989B8: WmipEventPumpState
0x1800705C8: "__cdecl _imp_RtlInitializeGenericTableAvl" __imp_RtlInitializeGenericTableAvl
0x1800146DC: CreateGlobalSids
0x18009930C: WmipEventPumpFlags
0x18006F700: "__cdecl _imp_RpcBindingSetAuthInfoW" __imp_RpcBindingSetAuthInfoW
0x18002BFC0: GetSecurityDescriptorRMControlStub
0x18004FAD0: "unsigned long __cdecl PerfpExceptionFilter(unsigned long,struct _EXCEPTION_POINTERS const * __ptr64,struct _EXT_OBJECT * __ptr64,unsigned long)" ?PerfpExceptionFilter@@YAKKPEBU_EXCEPTION_POINTERS@@PEAU_EXT_OBJECT@@K@Z
0x180015460: CryptHashDataStub
0x18009F3D0: "__cdecl _imp_GetNamedSecurityInfoW" __imp_GetNamedSecurityInfoW
0x18007FE98: "\Registry\Machine\Software" ??_C@_1DG@NGKIBMLA@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?$AA@
0x180003DE0: BaseRegTranslateToMachineClassKey
0x18006F928: "__cdecl _imp_RegQueryValueExA" __imp_RegQueryValueExA
0x18005EAD4: LsapCreateBindingHandleForLocal
0x18001B740: CloseEventLog
0x18007F798: PERFLIB_COLLECTION_HUNG
0x180098480: "unsigned short * szUpdatingServiceName" ?szUpdatingServiceName@@3PAGA
0x18002C760: SetSecurityDescriptorRMControlStub
0x180011238: CodeAuthzpImmediateReloadCacheTables
0x180097F58: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxuwhUhvxfirgbUdrmhzuviUlyquivUznwGEUkxsOlyq@winsafer" __@@_PchSym_@00@KxulyqvxgPillgKxuwhUhvxfirgbUdrmhzuviUlyquivUznwGEUkxsOlyq@winsafer
0x1800131E0: "__cdecl _CodeAuthzpCompareCodeAuthzLevelWithToken" __CodeAuthzpCompareCodeAuthzLevelWithToken
0x180034FE4: SaferpDeleteSingleIdentificationGuid
0x180015004: AccProvUnload
0x18002BB70: CredIsMarshaledCredentialWStub
0x18002BF90: GetExplicitEntriesFromAclWStub
0x18006FCD8: "__cdecl _imp_PrivilegedServiceAuditAlarmW" __imp_PrivilegedServiceAuditAlarmW
0x18007FFA0: "SYSTEM\CurrentControlSet\Service" ??_C@_0ED@LMBGCJEI@SYSTEM?2CurrentControlSet?2Service@
0x18006F980: "__cdecl _imp_RegSetKeyValueW" __imp_RegSetKeyValueW
0x18004E078: "unsigned long __cdecl DisableLibrary(struct HKEY__ * __ptr64,unsigned short * __ptr64,unsigned long)" ?DisableLibrary@@YAKPEAUHKEY__@@PEAGK@Z
0x18002DE80: LsaGetAppliedCAPIDs
0x18007FD50: "getsockopt" ??_C@_0L@DEFCDCGF@getsockopt?$AA@
0x18001D579: "__cdecl _imp_load_SetEntriesInAclW" __imp_load_SetEntriesInAclW
0x18001A230: SetKernelObjectSecurityStub
0x18009F1A8: "__cdecl _imp_GetUserObjectInformationW" __imp_GetUserObjectInformationW
0x180070668: "__cdecl _imp_RtlGetNtProductType" __imp_RtlGetNtProductType
0x18006FB70: "__cdecl _imp_DestroyPrivateObjectSecurity" __imp_DestroyPrivateObjectSecurity
0x18007F520: "SID(%ls)" ??_C@_1BC@CNNNAONL@?$AAS?$AAI?$AAD?$AA?$CI?$AA?$CF?$AAl?$AAs?$AA?$CJ?$AA?$AA@
0x18006F990: "__cdecl _imp_RegSetKeyValueA" __imp_RegSetKeyValueA
0x180037638: CodeAuthzPol_SetInfoDual_DefaultLevel
0x18006FC00: "__cdecl _imp_SetKernelObjectSecurity" __imp_SetKernelObjectSecurity
0x18007D304: "DC" ??_C@_15FDFFOBPF@?$AAD?$AAC?$AA?$AA@
0x18009F2F8: "__cdecl _imp_CredWriteA" __imp_CredWriteA
0x18001A210: GetKernelObjectSecurityStub
0x180097D30: Microsoft_Windows_EventlogEnableBits
0x180098248: g_bNeedCacheReload
0x18006F6A0: "__cdecl _imp_RpcBindingFromStringBindingW" __imp_RpcBindingFromStringBindingW
0x180014790: CodeAuthzDeinitializeGlobals
0x180099390: "int (__cdecl* __ptr64 g_closesocket)(unsigned __int64)" ?g_closesocket@@3P6AH_K@ZEA
0x1800045D0: EnumServicesStatusExWStub
0x18002C790: StartServiceAStub
0x18007EC40: "Priv" ??_C@_19CKLLCGPO@?$AAP?$AAr?$AAi?$AAv?$AA?$AA@
0x180032C80: SaferGetLevelInformation
0x18005DD4C: LsaRetrievePrivateData_Old
0x18007F294: "<" ??_C@_13GEEGGHPK@?$AA?$DM?$AA?$AA@
0x18004ADE0: ReportEventA
0x180019E80: PerfRegQueryInfoKey
0x18007F100: "wldap32.dll" ??_C@_0M@CDHLALNO@wldap32?4dll?$AA@
0x18003DA80: AbortSystemShutdownW
0x18006FAC8: "__cdecl _imp_AuditQuerySecurity" __imp_AuditQuerySecurity
0x18007EEC0: "AccProvHandleGetTrusteesAccess" ??_C@_0BP@IOFHNHLD@AccProvHandleGetTrusteesAccess?$AA@
0x180073CC0: "__cdecl _sz_WINTRUST_dll" __sz_WINTRUST_dll
0x180039A30: GetTrusteeFormA
0x18006FF10: "__cdecl _imp_I_ScRpcBindA" __imp_I_ScRpcBindA
0x18007DFB8: " " ??_C@_17FLPEJEEO@?$PO?$PP?$AA?$AN?$AA?6?$AA?$AA@
0x18002C570: RegDeleteTreeAStub
0x18002A6E0: AddUsersToEncryptedFileEx
0x18009F008: CRYPT32_NULL_THUNK_DATA_DLA
0x18009F380: "__cdecl _imp_CredpDecodeCredential" __imp_CredpDecodeCredential
0x18001D1F7: "__cdecl _imp_load_CredReadDomainCredentialsW" __imp_load_CredReadDomainCredentialsW
0x180098A48: hSamlib
0x180097F6C: g_DefaultCodeLevelMachineFlags
0x18002B7E0: AuditQuerySecurityStub
0x18003E160: BaseRegSetKeySecurity
0x180014F50: CryptImportKeyStub
0x18009F420: "__cdecl _imp_BCryptOpenAlgorithmProvider" __imp_BCryptOpenAlgorithmProvider
0x180070208: "__cdecl _imp_NtQueryInformationProcess" __imp_NtQueryInformationProcess
0x18001AF90: StartServiceWStub
0x18009F1B8: "__cdecl _imp_GetProcessWindowStation" __imp_GetProcessWindowStation
0x18007DB48: WPP_ThisDir_CTLGUID_PerfLib
0x18002D3D0: AuditLookupSubCategoryNameA
0x18006FF40: "__cdecl _imp_I_ScReparseServiceDatabase" __imp_I_ScReparseServiceDatabase
0x18001D275: "__cdecl _imp_load_CredReadDomainCredentialsA" __imp_load_CredReadDomainCredentialsA
0x180039A30: GetTrusteeFormW
0x18006FA50: "__cdecl _imp_QueryAllTracesW" __imp_QueryAllTracesW
0x180070168: "__cdecl _imp_NtClose" __imp_NtClose
0x18001D22D: "__cdecl _imp_load_CredReadW" __imp_load_CredReadW
0x180098A20: FnSamOpenUser
0x18003F3C0: RegReplaceKeyA
0x18001AF00: GetSecurityDescriptorControlStub
0x18001D179: "__cdecl _imp_load_CredWriteDomainCredentialsA" __imp_load_CredWriteDomainCredentialsA
0x1800196AC: "unsigned long __cdecl OpenExtObjectLibrary(struct _EXT_OBJECT * __ptr64)" ?OpenExtObjectLibrary@@YAKPEAU_EXT_OBJECT@@@Z
0x180035EE0: SaferiChangeRegistryScope
0x18007F6F8: PERFLIB_OPEN_PROC_EXCEPTION
0x180010B64: "long __cdecl StringCchPrintfW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64,...)" ?StringCchPrintfW@@YAJPEAG_KPEBGZZ
0x18005A104: "int __cdecl WctIsWow64(void * __ptr64)" ?WctIsWow64@@YAHPEAX@Z
0x18005B1B8: LocalOpenUsers
0x18006F460: "__cdecl _imp_LoadLibraryA" __imp_LoadLibraryA
0x18006F720: "__cdecl _imp_QueryAllTracesA" __imp_QueryAllTracesA
0x18007D2E4: "NX" ??_C@_15HFNGBCAN@?$AAN?$AAX?$AA?$AA@
0x18007F488: "@DEVICE." ??_C@_1BC@BELPDGGJ@?$AA?$EA?$AAD?$AAE?$AAV?$AAI?$AAC?$AAE?$AA?4?$AA?$AA@
0x18007F838: PERFLIB_INVALID_WOW32_PERF_DLL
0x18004CA60: PerfRegEnumKey
0x180080530: "\REGISTRY\USER\*\SOFTWARE\Classe" ??_C@_1EE@HDBCEPHC@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAU?$AAS?$AAE?$AAR?$AA?2?$AA?$CK?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAC?$AAl?$AAa?$AAs?$AAs?$AAe@
0x18001CB16: "__cdecl _tailMerge_cryptbase_dll" __tailMerge_cryptbase_dll
0x18001AF40: SetSecurityDescriptorControlStub
0x18004EE20: "void * __ptr64 __cdecl StartPerflibFunctionTimer(struct _OPEN_PROC_WAIT_INFO * __ptr64)" ?StartPerflibFunctionTimer@@YAPEAXPEAU_OPEN_PROC_WAIT_INFO@@@Z
0x1800706B0: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x18007F948: "prfh" ??_C@_19CEHGLHFH@?$AAp?$AAr?$AAf?$AAh?$AA?$AA@
0x18005EF04: LsapCrUnicodeToClearValue
0x18007FA68: "S-1-5-19" ??_C@_1BC@OGNCNKIA@?$AAS?$AA?9?$AA1?$AA?9?$AA5?$AA?9?$AA1?$AA9?$AA?$AA@
0x18009F440: "__cdecl _imp_BCryptGenRandom" __imp_BCryptGenRandom
0x18009F438: "__cdecl _imp_BCryptGenerateSymmetricKey" __imp_BCryptGenerateSymmetricKey
0x18002AF90: QueryRecoveryAgentsOnEncryptedFile
0x180070220: "__cdecl _imp_RtlValidSid" __imp_RtlValidSid
0x18007F828: PERFLIB_INVALID_WIN64_PERF_DLL
0x18004B4E0: ElfClearEventLogFileW
0x180098A40: FnSamiChangePasswordUser
0x18006F310: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x1800703E8: "__cdecl _imp_RtlGetSaclSecurityDescriptor" __imp_RtlGetSaclSecurityDescriptor
0x1800989A8: "void * __ptr64 __ptr64 hPerflibSectionFile" ?hPerflibSectionFile@@3PEAXEA
0x1800535B0: WmiFileHandleToInstanceNameW
0x1800138F0: SaferComputeTokenFromLevel
0x18005DECC: LsaSetSecret_Old
0x180042EA0: GetUserNameA
0x18007FB38: "ImagePath" ??_C@_1BE@CMLCLKJK@?$AAI?$AAm?$AAa?$AAg?$AAe?$AAP?$AAa?$AAt?$AAh?$AA?$AA@
0x18009F348: "__cdecl _imp_CredpConvertTargetInfo" __imp_CredpConvertTargetInfo
0x1800728E0: "unsigned short const * const CounterValue" ?CounterValue@@3QBGB
0x1800980A0: pbCachedUserSid
0x180098A10: FnSamiChangePasswordUser2
0x18007EF90: "HOST/" ??_C@_1M@GJBDKFBP@?$AAH?$AAO?$AAS?$AAT?$AA?1?$AA?$AA@
0x18002BBC0: CredProfileLoadedExStub
0x18005C310: LsaICLookupNames
0x180070180: "__cdecl _imp_RtlEqualSid" __imp_RtlEqualSid
0x18004B410: ElfClearEventLogFileA
0x180070448: "__cdecl _imp_RtlGetDaclSecurityDescriptor" __imp_RtlGetDaclSecurityDescriptor
0x18009F220: WINTRUST_NULL_THUNK_DATA_DLA
0x18008FE4C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-namedpipe-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-namedpipe-l1-1-0
0x1800704A0: "__cdecl _imp_EtwGetTraceEnableFlags" __imp_EtwGetTraceEnableFlags
0x1800884D8: WINTRUST_NULL_THUNK_DATA_DLB
0x18007E9D0: "ObjectLength" ??_C@_1BK@GPNIFMAA@?$AAO?$AAb?$AAj?$AAe?$AAc?$AAt?$AAL?$AAe?$AAn?$AAg?$AAt?$AAh?$AA?$AA@
0x18007FAC8: "_%d" ??_C@_03HCMCBFLP@_?$CFd?$AA@
0x180070738: "__cdecl _imp_RtlAnsiStringToUnicodeString" __imp_RtlAnsiStringToUnicodeString
0x18008720C: "__cdecl _DELAY_IMPORT_DESCRIPTOR_CRYPTSP_dll" __DELAY_IMPORT_DESCRIPTOR_CRYPTSP_dll
0x18002C6D0: RegSetKeyValueAStub
0x180070360: "__cdecl _imp_RtlMultiByteToUnicodeN" __imp_RtlMultiByteToUnicodeN
0x180035184: SaferpSetSingleIdentificationHash
0x180098348: "int (__cdecl* __ptr64 pfnCloseWindowStation)(struct HWINSTA__ * __ptr64)" ?pfnCloseWindowStation@@3P6AHPEAUHWINSTA__@@@ZEA
0x1800875D0: WINTRUST_NULL_THUNK_DATA_DLN
0x18005C18C: MapSAToRpcSA
0x18007D464: "struct _NDR64_CONTEXT_HANDLE_FORMAT const __midl_frag4" ?__midl_frag4@@3U_NDR64_CONTEXT_HANDLE_FORMAT@@B
0x18007FC88: "Mutant" ??_C@_1O@FBKOCLFA@?$AAM?$AAu?$AAt?$AAa?$AAn?$AAt?$AA?$AA@
0x18002BF60: EventAccessRemoveStub
0x1800195B4: "unsigned long __cdecl GetNextNumberFromList(unsigned short const * __ptr64,unsigned short const * __ptr64 * __ptr64)" ?GetNextNumberFromList@@YAKPEBGPEAPEBG@Z
0x18007FAA0: WPP_e1718bf12a503f6f2b7f56d59ccb6631_Traceguids
0x180016F20: ElfCreateReconnInfo
0x180071720: "_V2Providers" ??_C@_1BK@CDNLPEJE@?$AA_?$AAV?$AA2?$AAP?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AAs?$AA?$AA@
0x18009F318: "__cdecl _imp_CredUnprotectW" __imp_CredUnprotectW
0x18006FDC0: "__cdecl _imp_GetSecurityDescriptorSacl" __imp_GetSecurityDescriptorSacl
0x18007D468: "struct _NDR64_CONTEXT_HANDLE_FORMAT const __midl_frag9" ?__midl_frag9@@3U_NDR64_CONTEXT_HANDLE_FORMAT@@B
0x18001D5A0: ApiSetQueryApiSetPresence
0x1800075B8: "unsigned long __cdecl PerflibciLocalReleaseMutex(void * __ptr64)" ?PerflibciLocalReleaseMutex@@YAKPEAX@Z
0x1800706D8: "__cdecl _imp_RtlLeaveCriticalSection" __imp_RtlLeaveCriticalSection
0x1800704D0: "__cdecl _imp_NtQuerySecurityObject" __imp_NtQuerySecurityObject
0x180070148: "__cdecl _imp_RtlIsValidIndexHandle" __imp_RtlIsValidIndexHandle
0x180050744: WPP_SF_Sdd
0x180037F44: CodeAuthzpCompareImagePath
0x18006F770: "__cdecl _imp_PcwEnumerateInstances" __imp_PcwEnumerateInstances
0x18007F9D8: "%ws\%ws??%ws%ws" ??_C@_1CA@OLONGMFJ@?$AA?$CF?$AAw?$AAs?$AA?2?$AA?$CF?$AAw?$AAs?$AA?$DP?$AA?$DP?$AA?$CF?$AAw?$AAs?$AA?$CF?$AAw?$AAs?$AA?$AA@
0x18004747C: GetOperatorIndexByToken
0x18007FCC8: "\Device\LanmanRedirector" ??_C@_1DC@HPJECOGA@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAL?$AAa?$AAn?$AAm?$AAa?$AAn?$AAR?$AAe?$AAd?$AAi?$AAr?$AAe?$AAc?$AAt?$AAo?$AAr?$AA?$AA@
0x180005420: ControlServiceStub
0x18002C2E0: LsaRemoveAccountRightsStub
0x18006FC68: "__cdecl _imp_SetSecurityDescriptorGroup" __imp_SetSecurityDescriptorGroup
0x18005EC50: PAUTHZ_AUDIT_EVENT_TYPE_OLD_bind
0x18004AD70: RegisterEventSourceA
0x18001CDA9: "__cdecl _tailMerge_crypt32_dll" __tailMerge_crypt32_dll
0x18006F398: "__cdecl _imp_CreateFileMappingW" __imp_CreateFileMappingW
0x18007F9B8: "perfh016.dat" ??_C@_1BK@BLJAOBC@?$AAp?$AAe?$AAr?$AAf?$AAh?$AA0?$AA1?$AA6?$AA?4?$AAd?$AAa?$AAt?$AA?$AA@
0x180050E48: WPP_SF_SSD
0x180050F88: WPP_SF_Ssd
0x180071BE0: "unsigned short const * const DLLValue" ?DLLValue@@3QBGB
0x18000F3D8: "void * __ptr64 __cdecl PerflibciHeapAlloc(unsigned __int64)" ?PerflibciHeapAlloc@@YAPEAX_K@Z
0x180071910: "First Counter" ??_C@_1BM@IBDHKGGM@?$AAF?$AAi?$AAr?$AAs?$AAt?$AA?5?$AAC?$AAo?$AAu?$AAn?$AAt?$AAe?$AAr?$AA?$AA@
0x18002B090: RemoveUsersFromEncryptedFile
0x18001BD68: AccProvpGetProviderCapabilities
0x18006FAB0: "__cdecl _imp_AuditComputeEffectivePolicyBySid" __imp_AuditComputeEffectivePolicyBySid
0x18006F690: "__cdecl _imp_RpcStringFreeW" __imp_RpcStringFreeW
0x180034870: SaferpRecordEventLogEntryHelper
0x180002574: "void __cdecl PerflibciNotifyQuery(struct _PERF_QUERY * __ptr64)" ?PerflibciNotifyQuery@@YAXPEAU_PERF_QUERY@@@Z
0x18007D478: "struct __midl_frag16_t const __midl_frag16" ?__midl_frag16@@3U__midl_frag16_t@@B
0x1800706A8: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x18006F8C8: "__cdecl _imp_RegDeleteTreeA" __imp_RegDeleteTreeA
0x18006F908: "__cdecl _imp_RegQueryInfoKeyW" __imp_RegQueryInfoKeyW
0x18006F390: "__cdecl _imp_GetFileSizeEx" __imp_GetFileSizeEx
0x180016440: CreateWellKnownSidStub
0x18006FFF8: "__cdecl _imp_ControlService" __imp_ControlService
0x180080180: "__cdecl _pfnDefaultDliFailureHook2" __pfnDefaultDliFailureHook2
0x18001C87C: "__cdecl _imp_load_CryptDuplicateKey" __imp_load_CryptDuplicateKey
0x18005C284: LsaDelete
0x18007FAD0: "System\CurrentControlSet\Service" ??_C@_1EG@GFAIDJBN@?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA?2?$AAS?$AAe?$AAr?$AAv?$AAi?$AAc?$AAe@
0x180071BB0: "char const * const CloseValue" ?CloseValue@@3QBDB
0x1800872AC: "__cdecl _DELAY_IMPORT_DESCRIPTOR_CRYPT32_dll" __DELAY_IMPORT_DESCRIPTOR_CRYPT32_dll
0x180051C0C: "unsigned long __cdecl PerflibciQueryV2Provider(unsigned long,unsigned short const * __ptr64,struct _EXT_OBJ_LIST * __ptr64,unsigned long,void * __ptr64 * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64)" ?PerflibciQueryV2Provider@@YAKKPEBGPEAU_EXT_OBJ_LIST@@KPEAPEAXPEAK3@Z
0x18005DC58: LsaRetrievePrivateData
0x18005B210: OpenClassesRootInternal
0x18007FA20: "%ws%ws%ws" ??_C@_1BE@MFOEGDMN@?$AA?$CF?$AAw?$AAs?$AA?$CF?$AAw?$AAs?$AA?$CF?$AAw?$AAs?$AA?$AA@
0x18001D654: IsGetProcessWindowStationPresent
0x1800538E0: WmiQueryAllDataA
0x180005E18: "long __cdecl StringCbCopyW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64)" ?StringCbCopyW@@YAJPEAG_KPEBG@Z
0x18004B740: ElfOldestRecord
0x18000791C: "void __cdecl PerflibciInsertRedBlackNode(struct _PERFLIBCI_RED_BLACK_NODE * __ptr64 * __ptr64,struct _PERFLIBCI_RED_BLACK_NODE * __ptr64)" ?PerflibciInsertRedBlackNode@@YAXPEAPEAU_PERFLIBCI_RED_BLACK_NODE@@PEAU1@@Z
0x180099320: WmipEventPumpModule
0x180016320: BuildTrusteeWithSidW
0x180032D34: "__cdecl _CodeAuthzpCountIdentsForLevel" __CodeAuthzpCountIdentsForLevel
0x18002C7A0: StopTraceWStub
0x180016510: OpenServiceWStub
0x1800539D0: WmiQueryAllDataMultipleW
0x18003D790: FlushTraceA
0x1800151C0: MIDL_user_allocate
0x180017B80: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x18006F348: "__cdecl _imp_ExpandEnvironmentStringsW" __imp_ExpandEnvironmentStringsW
0x18001D7E0: memcmp
0x18002B8D0: ControlServiceExWStub
0x18006F5B8: "__cdecl _imp_LocalReAlloc" __imp_LocalReAlloc
0x18006F9F0: "__cdecl _imp_GetSystemDirectoryW" __imp_GetSystemDirectoryW
0x18002AB40: FileEncryptionStatusA
0x180098200: g_CodeLevelObjTable
0x1800726C8: "unsigned short const * const DefaultLangId" ?DefaultLangId@@3QBGB
0x180059C80: "unsigned long __cdecl WctGetThreadWaitChainWorker(void * __ptr64)" ?WctGetThreadWaitChainWorker@@YAKPEAX@Z
0x18006F420: "__cdecl _imp_ExpandEnvironmentStringsA" __imp_ExpandEnvironmentStringsA
0x180070018: "__cdecl _imp_wcsrchr" __imp_wcsrchr
0x18002B8C0: ControlServiceExAStub
0x18003D7B0: FlushTraceW
0x18007FF70: "\PIPE\InitShutdown" ??_C@_1CG@BKMGCEOH@?$AA?2?$AAP?$AAI?$AAP?$AAE?$AA?2?$AAI?$AAn?$AAi?$AAt?$AAS?$AAh?$AAu?$AAt?$AAd?$AAo?$AAw?$AAn?$AA?$AA@
0x18002C7C0: WaitServiceStateStub
0x180050678: WPP_SF_SSdd
0x18001D654: IsGetThreadDesktopPresent
0x180019578: "__int64 __cdecl GetTimeAsLongLong(void)" ?GetTimeAsLongLong@@YA_JXZ
0x18002ABF0: FileEncryptionStatusW
0x18006FBA8: "__cdecl _imp_EqualPrefixSid" __imp_EqualPrefixSid
0x18001AD90: GetSidIdentifierAuthorityStub
0x18007D470: "unsigned char const __midl_frag13" ?__midl_frag13@@3EB
0x1800702F8: "__cdecl _imp_RtlGUIDFromString" __imp_RtlGUIDFromString
0x18007D3F8: "CI" ??_C@_15CBONDBCJ@?$AAC?$AAI?$AA?$AA@
0x18005B3A0: LocalBaseRegReplaceKey
0x180098358: "unsigned int (__cdecl* __ptr64 gpfnMsiProvideComponentFromDescriptor)(unsigned short const * __ptr64,unsigned short * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64)" ?gpfnMsiProvideComponentFromDescriptor@@3P6AIPEBGPEAGPEAK2@ZEA
0x180070090: "__cdecl _imp__wcstoi64" __imp__wcstoi64
0x180099328: WmipEventPumpTarget
0x180071798: "ProviderType" ??_C@_1BK@KDOGOMCJ@?$AAP?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x18006F450: "__cdecl _imp_SleepEx" __imp_SleepEx
0x18006FDF8: "__cdecl _imp_AccessCheckByTypeResultListAndAuditAlarmW" __imp_AccessCheckByTypeResultListAndAuditAlarmW
0x1800417BC: LookupAccountNameInternal
0x18001A180: InitializeSidStub
0x180070618: "__cdecl _imp_NtQueryObject" __imp_NtQueryObject
0x1800700B8: "__cdecl _imp__i64tow_s" __imp__i64tow_s
0x180071708: "unsigned short const * const LastHelp" ?LastHelp@@3QBGB
0x18007FED0: "\Registry\Machine" ??_C@_1CE@NMBJJGCH@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?$AA@
0x18003DC00: InitiateSystemShutdownA
0x180071CB8: "WLDPCONFIGCI" ??_C@_1BK@LDJKOBFI@?$AAW?$AAL?$AAD?$AAP?$AAC?$AAO?$AAN?$AAF?$AAI?$AAG?$AAC?$AAI?$AA?$AA@
0x18006FB30: "__cdecl _imp_AreAnyAccessesGranted" __imp_AreAnyAccessesGranted
0x18001D263: "__cdecl _imp_load_CredFindBestCredentialW" __imp_load_CredFindBestCredentialW
0x180015800: FreeSidStub
0x180039A50: GetTrusteeNameW
0x180053860: WmiNotificationRegistrationW
0x1800604D8: "struct _MIDL_STUBLESS_PROXY_INFO const PerfHost_ProxyInfo" ?PerfHost_ProxyInfo@@3U_MIDL_STUBLESS_PROXY_INFO@@B
0x180073D80: "__cdecl _sz_api_ms_win_security_credentials_l2_1_0_dll" __sz_api_ms_win_security_credentials_l2_1_0_dll
0x1800337E8: CodeAuthzpComputeImageHash
0x180031288: "void * __ptr64 __cdecl AppmgmtGetUserSid(void * __ptr64)" ?AppmgmtGetUserSid@@YAPEAXPEAX@Z
0x1800165A0: EqualSidStub
0x180004904: "unsigned long __cdecl PerfpAllocateAndEnumerateKernelInstances(struct _UNICODE_STRING const * __ptr64,struct _PCW_INSTANCE_NAMES * __ptr64 * __ptr64,unsigned long * __ptr64)" ?PerfpAllocateAndEnumerateKernelInstances@@YAKPEBU_UNICODE_STRING@@PEAPEAU_PCW_INSTANCE_NAMES@@PEAK@Z
0x18003DE20: InitiateSystemShutdownW
0x18002C600: RegLoadAppKeyAStub
0x18006F768: "__cdecl _imp_PcwCollectData" __imp_PcwCollectData
0x18007DC98: "SamiChangePasswordUser2" ??_C@_0BI@ENIBDMMK@SamiChangePasswordUser2?$AA@
0x1800876D8: api-ms-win-security-credentials-l1-1-0_NULL_THUNK_DATA_DLN
0x18006DB90: "struct __midl_frag22_t const __midl_frag22" ?__midl_frag22@@3U__midl_frag22_t@@B
0x180088638: api-ms-win-security-credentials-l1-1-0_NULL_THUNK_DATA_DLB
0x18006FC98: "__cdecl _imp_CreatePrivateObjectSecurity" __imp_CreatePrivateObjectSecurity
0x18009F328: api-ms-win-security-credentials-l1-1-0_NULL_THUNK_DATA_DLA
0x180039A50: GetTrusteeNameA
0x18006F388: "__cdecl _imp_GetModuleHandleW" __imp_GetModuleHandleW
0x180097D00: PMCritSect
0x18000B550: CodeAuthzGuidIdentsLoadTableAll
0x18002BF50: EventAccessQueryStub
0x18002AD70: "unsigned long __cdecl I_ScGetCurrentGroupStateW(struct SC_HANDLE__ * __ptr64,unsigned short * __ptr64,unsigned long * __ptr64)" ?I_ScGetCurrentGroupStateW@@YAKPEAUSC_HANDLE__@@PEAGPEAK@Z
0x18006F548: "__cdecl _imp_EnumUILanguagesW" __imp_EnumUILanguagesW
0x18006F718: "__cdecl _imp_ControlTraceA" __imp_ControlTraceA
0x180039970: BuildTrusteeWithObjectsAndSidW
0x18002B7D0: AuditQueryGlobalSaclWStub
0x18006F6B8: "__cdecl _imp_I_RpcMapWin32Status" __imp_I_RpcMapWin32Status
0x180073D50: "__cdecl _sz_api_ms_win_security_credentials_l1_1_0_dll" __sz_api_ms_win_security_credentials_l1_1_0_dll
0x18006F788: "__cdecl _imp_PcwSendStatelessNotification" __imp_PcwSendStatelessNotification
0x180009C30: LsaClose
0x18005D2BC: LsapCreateNullTerminatedString
0x18001CBA7: "__cdecl _imp_load_SystemFunction028" __imp_load_SystemFunction028
0x1800704F8: "__cdecl _imp_RtlRunOnceInitialize" __imp_RtlRunOnceInitialize
0x18007F1FC: "DA" ??_C@_15PJFMCJHO@?$AAD?$AAA?$AA?$AA@
0x180087748: api-ms-win-security-credentials-l2-1-0_NULL_THUNK_DATA_DLN
0x18005AF74: "unsigned long __cdecl ScMapRpcError(unsigned long,unsigned long)" ?ScMapRpcError@@YAKKK@Z
0x18009F398: api-ms-win-security-credentials-l2-1-0_NULL_THUNK_DATA_DLA
0x180098960: svcctl_handle
0x18005AFD8: InitSecurityAcls
0x18006FA88: "__cdecl _imp_ControlTraceW" __imp_ControlTraceW
0x18006F680: "__cdecl _imp_RpcBindingBind" __imp_RpcBindingBind
0x180088728: api-ms-win-security-credentials-l2-1-0_NULL_THUNK_DATA_DLB
0x18001CF1F: "__cdecl _imp_load_BCryptDestroyHash" __imp_load_BCryptDestroyHash
0x1800976E8: "unsigned long volatile g_WFABTID_Id" ?g_WFABTID_Id@@3KC
0x180016580: StartServiceCtrlDispatcherWStub
0x180038CE0: FreeInheritedFromArray
0x18006F7A8: "__cdecl _imp_OpenThread" __imp_OpenThread
0x18005B314: BaseRegCloseKeyInternal
0x18001020C: "struct HKEY__ * __ptr64 __cdecl PerflibciGetKeyPerflib(void)" ?PerflibciGetKeyPerflib@@YAPEAUHKEY__@@XZ
0x18002ED50: LsaRemovePrivilegesFromAccount
0x180099380: "int (__cdecl* __ptr64 g_WSAStartup)(unsigned short,struct WSAData * __ptr64)" ?g_WSAStartup@@3P6AHGPEAUWSAData@@@ZEA
0x18003D834: AnsiToUnicode
0x18008726C: "__cdecl _DELAY_IMPORT_DESCRIPTOR_SspiCli_dll" __DELAY_IMPORT_DESCRIPTOR_SspiCli_dll
0x180055624: WmipCopyCountedString
0x18002C2A0: LsaLookupNames2Stub
0x18007E6B8: "\SHA256" ??_C@_1BA@CGFNIJLD@?$AA?2?$AAS?$AAH?$AAA?$AA2?$AA5?$AA6?$AA?$AA@
0x18007E110: "appmgmt" ??_C@_1BA@OEEIJHCA@?$AAa?$AAp?$AAp?$AAm?$AAg?$AAm?$AAt?$AA?$AA@
0x18004E380: "unsigned long __cdecl KillPerflibFunctionTimer(void * __ptr64)" ?KillPerflibFunctionTimer@@YAKPEAX@Z
0x18000B7F0: CodeAuthzpOpenPolicyRootKey
0x1800700A0: "__cdecl _imp_wcstok_s" __imp_wcstok_s
0x18002C050: IsValidAclStub
0x180070230: "__cdecl _imp_RtlImageNtHeader" __imp_RtlImageNtHeader
0x180054340: WmiReceiveNotificationsA
0x180015E90: AddAccessAllowedAceExStub
0x1800398D0: BuildImpersonateTrusteeW
0x180035118: SaferpSetExistingSingleIdentification
0x18002C3F0: ObjectOpenAuditAlarmWStub
0x18003E240: PerfCloseQueryHandle
0x180073F00: "ext-ms-win-ntuser-windowstation-" ??_C@_1EO@FIHMJCLF@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAn?$AAt?$AAu?$AAs?$AAe?$AAr?$AA?9?$AAw?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AAt?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?9@
0x180099350: WmipEventPumpBuffer
0x1800544E0: WmiSetSingleInstanceW
0x1800117EC: SaferpEnforceDefaultLevelDefinitions
0x18008732C: "__cdecl _DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_credentials_l2_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_credentials_l2_1_0_dll
0x18007F210: "%ws%wc%ws" ??_C@_1BE@OCEKOCCF@?$AA?$CF?$AAw?$AAs?$AA?$CF?$AAw?$AAc?$AA?$CF?$AAw?$AAs?$AA?$AA@
0x180054420: WmiSetSingleInstanceA
0x180070750: ntdll_NULL_THUNK_DATA
0x18007E618: SrpEvt_AccessDisabledByPolicyPath
0x1800700F0: "__cdecl _imp_memcpy" __imp_memcpy
0x1800804A0: "\REGISTRY\USER\*_Classes" ??_C@_1DC@OCGJAOPP@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAU?$AAS?$AAE?$AAR?$AA?2?$AA?$CK?$AA_?$AAC?$AAl?$AAa?$AAs?$AAs?$AAe?$AAs?$AA?$AA@
0x18006FD70: "__cdecl _imp_GetSecurityDescriptorDacl" __imp_GetSecurityDescriptorDacl
0x18001CF73: "__cdecl _tailMerge_api_ms_win_security_lsalookup_l1_1_0_dll" __tailMerge_api_ms_win_security_lsalookup_l1_1_0_dll
0x18001C190: StartTraceWStub
0x18004CAC0: PerfRegEnumValue
0x18007C038: "MD5" ??_C@_17HLHJLHED@?$AAM?$AAD?$AA5?$AA?$AA@
0x180036A90: SaferpBuildRestrictedToken
0x18005EC1C: LsapCreateLspPrivateDataBindingHandle
0x18006FD58: "__cdecl _imp_SetFileSecurityW" __imp_SetFileSecurityW
0x1800989B0: "void * __ptr64 __ptr64 PerfpCachedBinding" ?PerfpCachedBinding@@3PEAXEA
0x1800507D4: WPP_SF_ddD
0x180050834: WPP_SF_ddd
0x1800148D0: RegBaseInitialize
0x180057B6C: AnsiSizeForUnicodeString
0x180015710: EVENTLOG_HANDLE_W_unbind
0x18007D3C0: "OD" ??_C@_15KEEFCJIP@?$AAO?$AAD?$AA?$AA@
0x1800983BC: gbLsaLookupSucceeded
0x18007D30C: "LC" ??_C@_15LPAGGDJI@?$AAL?$AAC?$AA?$AA@
0x18001C9AE: "__cdecl _imp_load_WinVerifyTrust" __imp_load_WinVerifyTrust
0x1800601A0: gMachineClassesName
0x18006AB40: g_LsapBindingHandleSecurityQos
0x18001C0A0: MakeAbsoluteSDStub
0x18008722C: "__cdecl _DELAY_IMPORT_DESCRIPTOR_WINTRUST_dll" __DELAY_IMPORT_DESCRIPTOR_WINTRUST_dll
0x18001ADA0: ConvertSidToStringSidA
0x1800173EC: "int __cdecl ScConvertOffsets64(enum SC_API_NUMBER,struct SC_HANDLE__ * __ptr64,unsigned long,unsigned long,unsigned char * __ptr64,unsigned long,unsigned long * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64,void * __ptr64,unsigned long * __ptr64)" ?ScConvertOffsets64@@YAHW4SC_API_NUMBER@@PEAUSC_HANDLE__@@KKPEAEKPEAK33PEAX3@Z
0x18007DDC8: "GPO Name" ??_C@_1BC@CAKCJGKO@?$AAG?$AAP?$AAO?$AA?5?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x18002B790: AuditEnumeratePerUserPolicyStub
0x18007E1E8: "Paths" ??_C@_1M@DDEDBBPN@?$AAP?$AAa?$AAt?$AAh?$AAs?$AA?$AA@
0x18003D820: UpdateTraceW
0x180047DF4: GetStringOperandValue
0x180070238: "__cdecl _imp_LdrUnloadDll" __imp_LdrUnloadDll
0x1800311F0: InstallApplication
0x18001AF10: LsaQueryInformationPolicyStub
0x1800702A8: "__cdecl _imp_EtwEventUnregister" __imp_EtwEventUnregister
0x18007D408: "NP" ??_C@_15LAGCDKOC@?$AAN?$AAP?$AA?$AA@
0x180072460: "\Registry\Machine\Software\Class" ??_C@_1EG@FMJFMKGB@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAC?$AAl?$AAa?$AAs?$AAs@
0x180031528: "void __cdecl ApplyDebugSettings(void)" ?ApplyDebugSettings@@YAXXZ
0x18004C7C0: EVENTLOG_HANDLE_A_unbind
0x18006F2A0: "__cdecl _imp_GetComputerNameW" __imp_GetComputerNameW
0x180037E8C: SaferpPol_GetInfoCommon_HonorUserIdentities
0x180070458: "__cdecl _imp_NtQuerySystemTime" __imp_NtQuerySystemTime
0x1800311E0: GetManagedApplications
0x180098A60: "unsigned long gDebugRequestedMode" ?gDebugRequestedMode@@3KA
0x18001B6BC: ElfAssertThreadPrivilege
0x1800075E8: "unsigned long __cdecl PerflibciExpandPath(unsigned short * __ptr64 * __ptr64)" ?PerflibciExpandPath@@YAKPEAPEAG@Z
0x18003E1D0: BaseRegUnLoadKey
0x180042E20: CreateProcessWithLogonW
0x18001CC68: "__cdecl _imp_load_GetUserNameExA" __imp_load_GetUserNameExA
0x18003DD10: InitiateSystemShutdownExA
0x18006FF90: "__cdecl _imp_ChangeServiceConfigA" __imp_ChangeServiceConfigA
0x180010CDC: "unsigned long __cdecl GetLangIdFromSzLang(unsigned short const * __ptr64)" ?GetLangIdFromSzLang@@YAKPEBG@Z
0x18006FBA0: "__cdecl _imp_FreeSid" __imp_FreeSid
0x18001C9A2: OpenTraceW
0x18001CC56: "__cdecl _imp_load_GetUserNameExW" __imp_load_GetUserNameExW
0x180015F20: DuplicateTokenExStub
0x18006FB40: "__cdecl _imp_GetSidSubAuthorityCount" __imp_GetSidSubAuthorityCount
0x18009F3E8: "__cdecl _imp_GetSecurityInfo" __imp_GetSecurityInfo
0x180070470: "__cdecl _imp_EtwEventWriteTransfer" __imp_EtwEventWriteTransfer
0x18009F048: "__cdecl _imp_CryptSetKeyParam" __imp_CryptSetKeyParam
0x180097C70: "__cdecl _hmod__CRYPTSP_dll" __hmod__CRYPTSP_dll
0x18009F290: "__cdecl _imp_CredUnmarshalCredentialA" __imp_CredUnmarshalCredentialA
0x18007F1A8: "ldap_value_freeA" ??_C@_0BB@JCKACIEI@ldap_value_freeA?$AA@
0x1800161C0: SetEntriesInAclWStub
0x18003FE60: InitiateSystemShutdownExW
0x18001C160: SVCCTL_HANDLEW_bind
0x1800803E8: "\Classes\Wow6432Node" ??_C@_1CK@GDGDGMEP@?$AA?2?$AAC?$AAl?$AAa?$AAs?$AAs?$AAe?$AAs?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4?$AA3?$AA2?$AAN?$AAo?$AAd?$AAe?$AA?$AA@
0x180099388: "int (__cdecl* __ptr64 g_getpeername)(unsigned __int64,struct sockaddr * __ptr64,int * __ptr64)" ?g_getpeername@@3P6AH_KPEAUsockaddr@@PEAH@ZEA
0x18009F3F8: api-ms-win-security-provider-l1-1-0_NULL_THUNK_DATA_DLA
0x18007180C: "ZA" ??_C@_15MAIAEKJF@?$AAZ?$AAA?$AA?$AA@
0x180033740: SaferSetPolicyInformation
0x180032D8C: "__cdecl _CodeAuthzpFetchIdentsForLevel" __CodeAuthzpFetchIdentsForLevel
0x180072218: "perf0000.dat" ??_C@_1BK@PAPEMIPA@?$AAp?$AAe?$AAr?$AAf?$AA0?$AA0?$AA0?$AA0?$AA?4?$AAd?$AAa?$AAt?$AA?$AA@
0x180072600: "GetUserObjectInformationW" ??_C@_0BK@DEKFELLI@GetUserObjectInformationW?$AA@
0x18003838C: SaferpIsNetworkVolume
0x1800157B0: GetSidSubAuthorityCountStub
0x18001CC90: CreateServiceEx
0x180015BA0: GetSecurityInfoStub
0x180037344: CodeLoadHashInfoFromKey
0x18006F6D0: "__cdecl _imp_RpcBindingSetAuthInfoA" __imp_RpcBindingSetAuthInfoA
0x180018240: WmipBuildGuidObjectAttributes
0x18007F1F4: "G" ??_C@_13NIHIEAGH@?$AAG?$AA?$AA@
0x1800718B0: "InstanceType" ??_C@_1BK@JKJLDDIO@?$AAI?$AAn?$AAs?$AAt?$AAa?$AAn?$AAc?$AAe?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x180071BA8: "char const * const QueryValue" ?QueryValue@@3QBDB
0x180041CD0: LookupAccountSidInternal
0x18006F738: "__cdecl _imp_ApiSetQueryApiSetPresence" __imp_ApiSetQueryApiSetPresence
0x1800956D0: "__cdecl _security_cookie" __security_cookie
0x18007F180: "ldap_get_valuesA" ??_C@_0BB@JHBKPLAL@ldap_get_valuesA?$AA@
0x18008FD98: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-service-core-l1-1-1" __IMPORT_DESCRIPTOR_api-ms-win-service-core-l1-1-1
0x18007D31C: "LO" ??_C@_15PFNANMCA@?$AAL?$AAO?$AA?$AA@
0x180098A28: FnSamConnect
0x180098924: "long NumberOfOpens" ?NumberOfOpens@@3JA
0x180015ED0: SetSecurityInfoStub
0x18006F890: "__cdecl _imp_RegQueryValueExW" __imp_RegQueryValueExW
0x18000C8A0: CodeAuthzFullyQualifyFilename
0x180016430: DuplicateTokenStub
0x1800587E0: "unsigned long __cdecl WctGetCritSecInfo(struct _WCT_CLIENT_HANDLE * __ptr64,void * __ptr64,unsigned long,struct _WAITCHAIN_NODE_INFO * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64)" ?WctGetCritSecInfo@@YAKPEAU_WCT_CLIENT_HANDLE@@PEAXKPEAU_WAITCHAIN_NODE_INFO@@PEAK3@Z
0x180098408: "struct _PERFI_THREAD_QUERY * __ptr64 __ptr64 g_QueryList" ?g_QueryList@@3PEAU_PERFI_THREAD_QUERY@@EA
0x18007E930: "%HKEY_LOCAL_MACHINE\SOFTWARE\Mic" ??_C@_1JO@DGEHNJPJ@?$AA?$CF?$AAH?$AAK?$AAE?$AAY?$AA_?$AAL?$AAO?$AAC?$AAA?$AAL?$AA_?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc@
0x18002C650: RegLoadMUIStringWStub
0x1800529F8: StringCbPrintfA
0x18003E790: RegConnectRegistryA
0x180098A78: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxunrmrlUhvxfirgbUzxxxgioCUhixUlyquivUznwGEUzxokxsOlyq@accsrc" __@@_PchSym_@00@KxulyqvxgPillgKxunrmrlUhvxfirgbUzxxxgioCUhixUlyquivUznwGEUzxokxsOlyq@accsrc
0x18002BE70: CryptSetProviderAStub
0x180056300: WmipDereferenceGNEntry
0x18002C640: RegLoadMUIStringAStub
0x180014B00: PLSAPR_SERVER_NAME_unbind
0x18006FCA0: "__cdecl _imp_AddAccessDeniedAceEx" __imp_AddAccessDeniedAceEx
0x180070708: "__cdecl _imp_RtlGetCurrentTransaction" __imp_RtlGetCurrentTransaction
0x180098360: "enum tagINSTALLSTATE (__cdecl* __ptr64 gpfnMsiQueryProductState)(unsigned short const * __ptr64)" ?gpfnMsiQueryProductState@@3P6A?AW4tagINSTALLSTATE@@PEBG@ZEA
0x180071758: "D:(A;;GA;;;BA)(A;;GA;;;SY)" ??_C@_1DG@MBIIGLFH@?$AAD?$AA?3?$AA?$CI?$AAA?$AA?$DL?$AA?$DL?$AAG?$AAA?$AA?$DL?$AA?$DL?$AA?$DL?$AAB?$AAA?$AA?$CJ?$AA?$CI?$AAA?$AA?$DL?$AA?$DL?$AAG?$AAA?$AA?$DL?$AA?$DL?$AA?$DL?$AAS?$AAY?$AA?$CJ?$AA?$AA@
0x180015B90: InitializeSecurityDescriptorStub
0x18006FBC0: "__cdecl _imp_CheckTokenMembership" __imp_CheckTokenMembership
0x18003FBD0: RemoteRegQueryMultipleValues2Wrapper
0x1800976EC: "unsigned long volatile g_WFSO_Id" ?g_WFSO_Id@@3KC
0x18009F240: "__cdecl _imp_CredWriteW" __imp_CredWriteW
0x18002BEA0: CryptSetProviderWStub
0x180052A74: StringCbPrintfW
0x18001AA70: RegConnectRegistryW
0x180071878: "\UrlZones" ??_C@_1BE@GKGKFJMJ@?$AA?2?$AAU?$AAr?$AAl?$AAZ?$AAo?$AAn?$AAe?$AAs?$AA?$AA@
0x18005519C: WmipBuildMUIPath
0x18007F640: "EVENTLOG" ??_C@_1BC@HHBDFEGK@?$AAE?$AAV?$AAE?$AAN?$AAT?$AAL?$AAO?$AAG?$AA?$AA@
0x180071CF8: ""default"" ??_C@_1BE@EFCHDKIA@?$AA?$CC?$AAd?$AAe?$AAf?$AAa?$AAu?$AAl?$AAt?$AA?$CC?$AA?$AA@
0x180004630: PerfEnumerateCounterSetInstances
0x180014F70: MartaDllInitialize
0x18002BEF0: EnableTraceEx2Stub
0x180016880: ReportEventW
0x18003DA00: AbortSystemShutdownA
0x18006F4B0: "__cdecl _imp_ResetEvent" __imp_ResetEvent
0x18002C580: RegDeleteTreeWStub
0x18009F210: "__cdecl _imp_WinVerifyTrust" __imp_WinVerifyTrust
0x18006FF30: "__cdecl _imp_I_ScRpcBindW" __imp_I_ScRpcBindW
0x18006F440: "__cdecl _imp_GetFullPathNameW" __imp_GetFullPathNameW
0x18006F320: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x1800729B8: EVENT_OPENEVENTLOG
0x18003EC00: RegOpenKeyTransactedA
0x18006FA58: "__cdecl _imp_EnableTraceEx2" __imp_EnableTraceEx2
0x18007F270: "!=" ??_C@_15IAIMKILD@?$AA?$CB?$AA?$DN?$AA?$AA@
0x18008FD20: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-eventing-controller-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-eventing-controller-l1-1-0
0x18007D384: "FW" ??_C@_15MBOGIADG@?$AAF?$AAW?$AA?$AA@
0x1800043F8: BaseRegTranslateToUserClassKey
0x1800523AC: "unsigned long __cdecl PerfpConvertToMultiCounters(struct _PCW_QUERYITEM_BUFFER * __ptr64,void * __ptr64 * __ptr64)" ?PerfpConvertToMultiCounters@@YAKPEAU_PCW_QUERYITEM_BUFFER@@PEAPEAX@Z
0x18007DD90: "AppState" ??_C@_1BC@MMHPLDLC@?$AAA?$AAp?$AAp?$AAS?$AAt?$AAa?$AAt?$AAe?$AA?$AA@
0x18006F2B0: "__cdecl _imp_LocalFree" __imp_LocalFree
0x180016200: RegOpenKeyTransactedW
0x18005B618: LocalBaseRegSaveKey
0x18006FD78: "__cdecl _imp_GetLengthSid" __imp_GetLengthSid
0x18006FB00: "__cdecl _imp_AuditEnumerateCategories" __imp_AuditEnumerateCategories
0x180070528: "__cdecl _imp_RtlAddSIDToBoundaryDescriptor" __imp_RtlAddSIDToBoundaryDescriptor
0x18007F320: "Not_Member_of" ??_C@_1BM@FJMGANEC@?$AAN?$AAo?$AAt?$AA_?$AAM?$AAe?$AAm?$AAb?$AAe?$AAr?$AA_?$AAo?$AAf?$AA?$AA@
0x18001D10D: "__cdecl _imp_load_CredReadA" __imp_load_CredReadA
0x180009A80: LsaLookupPrivilegeValue
0x180098AC0: "unsigned short * szPerflibSectionName" ?szPerflibSectionName@@3PAGA
0x18009F0A0: "__cdecl _imp_CryptVerifySignatureW" __imp_CryptVerifySignatureW
0x18001C930: "__cdecl _imp_load_CryptAcquireContextA" __imp_load_CryptAcquireContextA
0x180038F70: GetInheritanceSourceW
0x180070280: "__cdecl _imp_NtDeleteKey" __imp_NtDeleteKey
0x18003FFE0: RegReplaceKeyW
0x18004A404: RtlStringCbLengthW
0x1800142D0: McGenControlCallbackV2
0x18002B420: AccessCheckByTypeResultListAndAuditAlarmByHandleWStub
0x180045844: LocalGetStringForControl
0x18001D21B: "__cdecl _imp_load_CredWriteDomainCredentialsW" __imp_load_CredWriteDomainCredentialsW
0x1800976F4: DefaultGuestMachine
0x18007D3E8: "ML" ??_C@_15CMDJKAGL@?$AAM?$AAL?$AA?$AA@
0x1800560E4: WmipCloseNotifyee
0x18004954C: LocalGetStringForRelativeAttribute
0x180016500: QueryServiceConfigWStub
0x18006F580: "__cdecl _imp_FindFirstFileExW" __imp_FindFirstFileExW
0x180071C50: "APPX" ??_C@_19DKBMCHGL@?$AAA?$AAP?$AAP?$AAX?$AA?$AA@
0x18007DCB0: Audit_System
0x18009F118: "__cdecl _imp_CryptVerifySignatureA" __imp_CryptVerifySignatureA
0x18001C8FA: "__cdecl _imp_load_CryptAcquireContextW" __imp_load_CryptAcquireContextW
0x18003291C: CodeAuthzpSidInSidAndAttributes
0x180038F60: GetInheritanceSourceA
0x18006F4E8: "__cdecl _imp_LoadLibraryW" __imp_LoadLibraryW
0x180070288: "__cdecl _imp_RtlInsertElementGenericTable" __imp_RtlInsertElementGenericTable
0x18006F448: "__cdecl _imp_GetFileAttributesW" __imp_GetFileAttributesW
0x18002CA80: MSChapSrvChangePassword2
0x18001D5BC: "__cdecl _tailMerge_api_ms_win_devices_config_l1_1_1_dll" __tailMerge_api_ms_win_devices_config_l1_1_1_dll
0x180071814: "XU" ??_C@_15FCDDCLFG@?$AAX?$AAU?$AA?$AA@
0x1800581EC: "unsigned long __cdecl WctGetAlpcInfo(struct _WCT_CLIENT_HANDLE * __ptr64,struct _WAITCHAIN_NODE_INFO * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64)" ?WctGetAlpcInfo@@YAKPEAU_WCT_CLIENT_HANDLE@@PEAU_WAITCHAIN_NODE_INFO@@PEAK2@Z
0x18006FCB8: "__cdecl _imp_CopySid" __imp_CopySid
0x180005F08: LookupAceFlagsInTable
0x18009F308: "__cdecl _imp_CredWriteDomainCredentialsA" __imp_CredWriteDomainCredentialsA
0x180072020: "unsigned short const * const LibraryUnloadTime" ?LibraryUnloadTime@@3QBGB
0x180097F20: gAccProviders
0x18006F940: "__cdecl _imp_RegCreateKeyExA" __imp_RegCreateKeyExA
0x1800727A8: pszRegCurrentConfig
0x180070210: "__cdecl _imp_RtlGetLastNtStatus" __imp_RtlGetLastNtStatus
0x180053360: WmiFileHandleToInstanceNameA
0x18007EB18: "Count" ??_C@_1M@NBCIMFHI@?$AAC?$AAo?$AAu?$AAn?$AAt?$AA?$AA@
0x18001D287: "__cdecl _imp_load_CredGetTargetInfoA" __imp_load_CredGetTargetInfoA
0x18001C74A: "__cdecl _imp_load_CryptImportKey" __imp_load_CryptImportKey
0x180070500: "__cdecl _imp_NtQueryPerformanceCounter" __imp_NtQueryPerformanceCounter
0x18007DC60: "SamCloseHandle" ??_C@_0P@PMHCCKNO@SamCloseHandle?$AA@
0x18006F950: "__cdecl _imp_RegCreateKeyExW" __imp_RegCreateKeyExW
0x18009F278: "__cdecl _imp_CredWriteDomainCredentialsW" __imp_CredWriteDomainCredentialsW
0x180079C60: "\Registry\Machine\System\Current" ??_C@_1HG@GFIGAPAF@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x180015190: GetUserNameW
0x1800702A0: "__cdecl _imp_RtlDestroyHandleTable" __imp_RtlDestroyHandleTable
0x18001D567: "__cdecl _imp_load_SetNamedSecurityInfoW" __imp_load_SetNamedSecurityInfoW
0x180017B60: SaferpIsAllowed
0x18006FE98: "__cdecl _imp_DeleteService" __imp_DeleteService
0x18001D23F: "__cdecl _imp_load_CredGetTargetInfoW" __imp_load_CredGetTargetInfoW
0x1800140F0: DllInitialize
0x18007E2E0: "%HKEY_LOCAL_MACHINE" ??_C@_1CI@FJHLHLLM@?$AA?$CF?$AAH?$AAK?$AAE?$AAY?$AA_?$AAL?$AAO?$AAC?$AAA?$AAL?$AA_?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?$AA@
0x180055790: WmipGetMofResourceList
0x18006FAA8: "__cdecl _imp_AuditSetSystemPolicy" __imp_AuditSetSystemPolicy
0x18005B81C: BaseRegGetUserAndMachineClass
0x180056BF4: WmipRunEventPump
0x18007E568: "Basic User" ??_C@_1BG@DCBPPJPL@?$AAB?$AAa?$AAs?$AAi?$AAc?$AA?5?$AAU?$AAs?$AAe?$AAr?$AA?$AA@
0x18006FCF8: "__cdecl _imp_ImpersonateSelf" __imp_ImpersonateSelf
0x180070318: "__cdecl _imp_NtQuerySymbolicLinkObject" __imp_NtQuerySymbolicLinkObject
0x18005C020: RegConn_ip_tcp
0x1800157D0: RegCreateKeyExWStub
0x180003F78: BaseRegOpenClassKeyFromLocation
0x18006FAB8: "__cdecl _imp_AuditFree" __imp_AuditFree
0x18007F500: "%I64x" ??_C@_1M@BENFCOCA@?$AA?$CF?$AAI?$AA6?$AA4?$AAx?$AA?$AA@
0x1800717D0: "NO_ACCESS_CONTROL" ??_C@_1CE@KMLBPDC@?$AAN?$AAO?$AA_?$AAA?$AAC?$AAC?$AAE?$AAS?$AAS?$AA_?$AAC?$AAO?$AAN?$AAT?$AAR?$AAO?$AAL?$AA?$AA@
0x18006F470: "__cdecl _imp_LocalUnlock" __imp_LocalUnlock
0x18002BFF0: GetWindowsAccountDomainSidStub
0x180017D30: WmiOpenBlock
0x180043670: AddConditionalAce
0x18002BC20: CredReadByTokenHandleStub
0x18007FFE8: "SYSTEM\CurrentControlSet\Service" ??_C@_0DG@MKBHFNPC@SYSTEM?2CurrentControlSet?2Service@
0x1800724E8: "WinSta0" ??_C@_1BA@IMLGMNLL@?$AAW?$AAi?$AAn?$AAS?$AAt?$AAa?$AA0?$AA?$AA@
0x18009F2C0: "__cdecl _imp_CredUnprotectA" __imp_CredUnprotectA
0x1800701C0: "__cdecl _imp_RtlAllocateAndInitializeSid" __imp_RtlAllocateAndInitializeSid
0x18007F6E0: "\syswow64\" ??_C@_1BG@OKEANEGD@?$AA?2?$AAs?$AAy?$AAs?$AAw?$AAo?$AAw?$AA6?$AA4?$AA?2?$AA?$AA@
0x18007F280: "&&" ??_C@_15BKJBEIJF@?$AA?$CG?$AA?$CG?$AA?$AA@
0x18007F738: PERFLIB_INVALID_DEFINITION_BLOCK
0x18007DC80: "SamiChangePasswordUser" ??_C@_0BH@PLIKMDOA@SamiChangePasswordUser?$AA@
0x18002B000: QueryUsersOnEncryptedFile
0x180070108: "__cdecl _imp__vsnwprintf" __imp__vsnwprintf
0x18001A170: GetSidLengthRequiredStub
0x180080450: "\REGISTRY\MACHINE\SOFTWARE\Wow64" ??_C@_1EO@PMMLBCDN@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAW?$AAo?$AAw?$AA6?$AA4@
0x180070478: "__cdecl _imp_RtlImpersonateSelf" __imp_RtlImpersonateSelf
0x1800702C0: "__cdecl _imp_RtlStringFromGUID" __imp_RtlStringFromGUID
0x18004D2B0: WPP_SF_qd
0x180040430: EnumServiceGroupW
0x18000B600: SaferpGuidIdentsLoadTable
0x18007EBF0: "Restrictions\RestrictingSidsInve" ??_C@_1EK@IPHFIJB@?$AAR?$AAe?$AAs?$AAt?$AAr?$AAi?$AAc?$AAt?$AAi?$AAo?$AAn?$AAs?$AA?2?$AAR?$AAe?$AAs?$AAt?$AAr?$AAi?$AAc?$AAt?$AAi?$AAn?$AAg?$AAS?$AAi?$AAd?$AAs?$AAI?$AAn?$AAv?$AAe@
0x1800166A0: RegisterEventSourceW
0x18002FBB0: LsaSetForestTrustInformation
0x1800706E8: "__cdecl _imp_DbgPrint" __imp_DbgPrint
0x18006F760: "__cdecl _imp_PcwSetQueryItemUserData" __imp_PcwSetQueryItemUserData
0x18006F308: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x18007F2E8: "Not_Any_of" ??_C@_1BG@PNKCIOIN@?$AAN?$AAo?$AAt?$AA_?$AAA?$AAn?$AAy?$AA_?$AAo?$AAf?$AA?$AA@
0x18006F7C8: "__cdecl _imp_GetCurrentThread" __imp_GetCurrentThread
0x18004F44C: WPP_SF_qq
0x18001CA93: "__cdecl _imp_load_CryptCATAdminAcquireContext" __imp_load_CryptCATAdminAcquireContext
0x18007EAB8: "Restrictions\PrivsToRemove" ??_C@_1DG@LEEBPPGB@?$AAR?$AAe?$AAs?$AAt?$AAr?$AAi?$AAc?$AAt?$AAi?$AAo?$AAn?$AAs?$AA?2?$AAP?$AAr?$AAi?$AAv?$AAs?$AAT?$AAo?$AAR?$AAe?$AAm?$AAo?$AAv?$AAe?$AA?$AA@
0x18002BAE0: CredEncryptAndMarshalBinaryBlobStub
0x1800563B0: WmipEventPumpIoCompletion
0x18006F4F8: "__cdecl _imp_FreeLibraryAndExitThread" __imp_FreeLibraryAndExitThread
0x180098930: WmipKMHandle
0x180072078: "unsigned short const * const ExtCounterTestLevel" ?ExtCounterTestLevel@@3QBGB
0x180018660: CreatePrivateObjectSecurityStub
0x18006F830: "__cdecl _imp_RegQueryInfoKeyA" __imp_RegQueryInfoKeyA
0x18006F8E0: "__cdecl _imp_RegDeleteTreeW" __imp_RegDeleteTreeW
0x18006F820: "__cdecl _imp_RegOpenKeyExA" __imp_RegOpenKeyExA
0x18008FF00: "__cdecl _IMPORT_DESCRIPTOR_KERNEL32" __IMPORT_DESCRIPTOR_KERNEL32
0x180080620: "\WowAA32Node" ??_C@_1BK@HFANIHID@?$AA?2?$AAW?$AAo?$AAw?$AAA?$AAA?$AA3?$AA2?$AAN?$AAo?$AAd?$AAe?$AA?$AA@
0x18002CD60: RegQueryReflectionKey
0x180098260: MSChapChangePassword
0x18000C810: "__cdecl _CodeAuthzpCheckIdentityHashRules" __CodeAuthzpCheckIdentityHashRules
0x18006F758: "__cdecl _imp_PcwAddQueryItem" __imp_PcwAddQueryItem
0x18009F070: "__cdecl _imp_CryptSetHashParam" __imp_CryptSetHashParam
0x18007DE20: "{%08lx-%04x-%04x-%02x%02x-%02x%0" ??_C@_1GI@JHCBPFLC@?$AA?$HL?$AA?$CF?$AA0?$AA8?$AAl?$AAx?$AA?9?$AA?$CF?$AA0?$AA4?$AAx?$AA?9?$AA?$CF?$AA0?$AA4?$AAx?$AA?9?$AA?$CF?$AA0?$AA2?$AAx?$AA?$CF?$AA0?$AA2?$AAx?$AA?9?$AA?$CF?$AA0?$AA2?$AAx?$AA?$CF?$AA0@
0x18006F888: "__cdecl _imp_RegOpenKeyExW" __imp_RegOpenKeyExW
0x18006FE00: "__cdecl _imp_SetAclInformation" __imp_SetAclInformation
0x18001C130: RegGetKeySecurityStub
0x18007F1C0: "LdapMapErrorToWin32" ??_C@_0BE@MHAIEGPK@LdapMapErrorToWin32?$AA@
0x180053BD0: WmiQueryAllDataW
0x18007E510: "certificate" ??_C@_1BI@INLKPGOJ@?$AAc?$AAe?$AAr?$AAt?$AAi?$AAf?$AAi?$AAc?$AAa?$AAt?$AAe?$AA?$AA@
0x1800705A8: "__cdecl _imp_RtlLookupElementGenericTableAvl" __imp_RtlLookupElementGenericTableAvl
0x18007E548: "hash" ??_C@_19LBCANDKL@?$AAh?$AAa?$AAs?$AAh?$AA?$AA@
0x180070600: "__cdecl _imp_RtlQueryProcessDebugInformation" __imp_RtlQueryProcessDebugInformation
0x180005BE0: SddlAddMandatoryAce
0x180016320: BuildTrusteeWithSidA
0x180097FE0: pbServiceSidByte
0x18003E834: Rpc_OpenPredefHandle
0x18001C578: "__cdecl _security_init_cookie" __security_init_cookie
0x18007E9F0: "HashDigestLength" ??_C@_1CC@DMMMEHOM@?$AAH?$AAa?$AAs?$AAh?$AAD?$AAi?$AAg?$AAe?$AAs?$AAt?$AAL?$AAe?$AAn?$AAg?$AAt?$AAh?$AA?$AA@
0x18002C480: OpenServiceAStub
0x180071CA8: "WLDPMSI" ??_C@_1BA@BJEHFCHC@?$AAW?$AAL?$AAD?$AAP?$AAM?$AAS?$AAI?$AA?$AA@
0x180053950: WmiQueryAllDataMultipleA
0x18006FB80: "__cdecl _imp_GetWindowsAccountDomainSid" __imp_GetWindowsAccountDomainSid
0x18003E7B0: RegConnectRegistryExA
0x18004F410: WPP_SF_q
0x18006FDB0: "__cdecl _imp_AccessCheckByTypeAndAuditAlarmW" __imp_AccessCheckByTypeAndAuditAlarmW
0x18002BCD0: CredWriteDomainCredentialsWStub
0x180048028: IsLegalAttributeChar2
0x18009F400: "__cdecl _imp_BCryptFinishHash" __imp_BCryptFinishHash
0x18002BE20: CryptGetProvParamStub
0x180071C90: "WLDPSCRIPT" ??_C@_1BG@BBEBHPNB@?$AAW?$AAL?$AAD?$AAP?$AAS?$AAC?$AAR?$AAI?$AAP?$AAT?$AA?$AA@
0x18001AA90: RegConnectRegistryExW
0x18006F5D8: "__cdecl _imp_GetUserDefaultUILanguage" __imp_GetUserDefaultUILanguage
0x18008FD84: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-service-core-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-service-core-l1-1-0
0x18007FD70: "getpeername" ??_C@_0M@MBAJPNG@getpeername?$AA@
0x180070248: "__cdecl _imp_NtQuerySystemInformation" __imp_NtQuerySystemInformation
0x180080128: "lsarpc" ??_C@_1O@CJFJGHLH@?$AAl?$AAs?$AAa?$AAr?$AAp?$AAc?$AA?$AA@
0x180052240: "unsigned long __cdecl PerfpAllocateCounterSetMultiInsts(struct _PERFLIBCI_MULTI_INSTS * __ptr64 * __ptr64,unsigned __int64)" ?PerfpAllocateCounterSetMultiInsts@@YAKPEAPEAU_PERFLIBCI_MULTI_INSTS@@_K@Z
0x18006FD18: "__cdecl _imp_IsTokenRestricted" __imp_IsTokenRestricted
0x18005E078: LsaStorePrivateData
0x180095630: S_Perflib_Context
0x18006F850: "__cdecl _imp_RegGetValueW" __imp_RegGetValueW
0x1800717F4: "XD" ??_C@_15LKJGBLKM@?$AAX?$AAD?$AA?$AA@
0x18007D314: "SW" ??_C@_15JCPNBDBO@?$AAS?$AAW?$AA?$AA@
0x18009F0B0: "__cdecl _imp_CryptSignHashA" __imp_CryptSignHashA
0x180070518: "__cdecl _imp_NtOpenPrivateNamespace" __imp_NtOpenPrivateNamespace
0x1800165D0: DeregisterEventSource
0x18005CB9C: LsaICLookupNamesWithCreds
0x18001D004: "__cdecl _imp_load_LookupAccountNameLocalA" __imp_load_LookupAccountNameLocalA
0x18002BEB0: CryptSignHashAStub
0x18006FDA8: "__cdecl _imp_SetSecurityDescriptorDacl" __imp_SetSecurityDescriptorDacl
0x18002C4D0: QueryServiceConfig2AStub
0x18001D464: IsTermsrvDeleteKeyPresent
0x180080230: "\{963F9E1B-197A-4664-B7D1-BCF544" ??_C@_1FA@DCDCJLCC@?$AA?2?$AA?$HL?$AA9?$AA6?$AA3?$AAF?$AA9?$AAE?$AA1?$AAB?$AA?9?$AA1?$AA9?$AA7?$AAA?$AA?9?$AA4?$AA6?$AA6?$AA4?$AA?9?$AAB?$AA7?$AAD?$AA1?$AA?9?$AAB?$AAC?$AAF?$AA5?$AA4?$AA4@
0x180058758: "unsigned long __cdecl WctGetComServerActivationInfo(struct _WCT_CLIENT_HANDLE * __ptr64,struct _WCT_LOCK_CONTEXT * __ptr64,struct _WAITCHAIN_NODE_INFO * __ptr64,unsigned long * __ptr64)" ?WctGetComServerActivationInfo@@YAKPEAU_WCT_CLIENT_HANDLE@@PEAU_WCT_LOCK_CONTEXT@@PEAU_WAITCHAIN_NODE_INFO@@PEAK@Z
0x18009F218: "__cdecl _imp_CryptCATAdminAcquireContext" __imp_CryptCATAdminAcquireContext
0x18003B3A0: SetEntriesInAuditListA
0x18006FC58: "__cdecl _imp_AddAuditAccessAceEx" __imp_AddAuditAccessAceEx
0x180080080: "SYSTEM\CurrentControlSet\Control" ??_C@_1EK@PENFFGPM@?$AAS?$AAY?$AAS?$AAT?$AAE?$AAM?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAS?$AAe?$AAt?$AA?2?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl@
0x180035B6C: CodeAuthzpDeleteKeyRecursively
0x180030300: "unsigned long __cdecl InstallApplicationInternal(struct _INSTALLDATA * __ptr64)" ?InstallApplicationInternal@@YAKPEAU_INSTALLDATA@@@Z
0x18006F328: "__cdecl _imp_GetThreadUILanguage" __imp_GetThreadUILanguage
0x180070310: "__cdecl _imp_NtOpenSymbolicLinkObject" __imp_NtOpenSymbolicLinkObject
0x1800982D0: AdvapiInitRoutinesCompletedFlags
0x18007FE10: "\REGISTRY\MACHINE\SOFTWARE\CLASS" ??_C@_1EG@HOBPNEJK@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAM?$AAA?$AAC?$AAH?$AAI?$AAN?$AAE?$AA?2?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAC?$AAL?$AAA?$AAS?$AAS@
0x180097088: "unsigned long dwBoostPriority" ?dwBoostPriority@@3KA
0x180001288: PerflibciLocalValidateCounters
0x18002E6D0: LsaLookupPrivilegeName
0x18007B940: g_LsapLocalSystemSid
0x18002BB80: CredIsProtectedAStub
0x180004F40: RegEnumKeyExAStub
0x18008FCF8: "__cdecl _IMPORT_DESCRIPTOR_msvcrt" __IMPORT_DESCRIPTOR_msvcrt
0x18007F444: "TI" ??_C@_15DPDOADAK@?$AAT?$AAI?$AA?$AA@
0x18001D810: wcscmp
0x18003E050: BaseRegGetVersion
0x180069820: "struct _GENERIC_BINDING_ROUTINE_PAIR const * const BindingRoutines" ?BindingRoutines@@3QBU_GENERIC_BINDING_ROUTINE_PAIR@@B
0x1800546A0: WmiSetSingleItemA
0x180070338: "__cdecl _imp_RtlGetFullPathName_U" __imp_RtlGetFullPathName_U
0x18002A5B8: UnicodeToMultiByte
0x18006FE30: "__cdecl _imp_StartServiceCtrlDispatcherW" __imp_StartServiceCtrlDispatcherW
0x180099358: WmipEventPumpIo
0x1800700F8: "__cdecl _imp_memmove" __imp_memmove
0x18006F3D0: "__cdecl _imp_CompareFileTime" __imp_CompareFileTime
0x18001B480: ElfOpenEventLogW
0x18006FBB0: "__cdecl _imp_GetFileSecurityW" __imp_GetFileSecurityW
0x18006FFC8: "__cdecl _imp_StartServiceCtrlDispatcherA" __imp_StartServiceCtrlDispatcherA
0x180005AF4: "void * __ptr64 __cdecl PerflibciHeapReAlloc(void * __ptr64,unsigned __int64)" ?PerflibciHeapReAlloc@@YAPEAXPEAX_K@Z
0x180054770: WmiSetSingleItemW
0x18002BC90: CredUnprotectAStub
0x180098320: "unsigned int (__cdecl* __ptr64 gpfnMsiGetProductInfo)(unsigned short const * __ptr64,unsigned short const * __ptr64,unsigned short * __ptr64,unsigned long * __ptr64)" ?gpfnMsiGetProductInfo@@3P6AIPEBG0PEAGPEAK@ZEA
0x1800145A0: RegEnumKeyExWStub
0x180058098: "int __cdecl WctCompareNode(struct _WAITCHAIN_NODE_INFO * __ptr64,struct _WAITCHAIN_NODE_INFO * __ptr64)" ?WctCompareNode@@YAHPEAU_WAITCHAIN_NODE_INFO@@0@Z
0x180007A50: LocalConvertStringSDToSD_Rev1
0x180072558: "MsiGetProductInfoW" ??_C@_0BD@LPFBFPAK@MsiGetProductInfoW?$AA@
0x180071950: "CounterCount" ??_C@_1BK@BEAJOLDA@?$AAC?$AAo?$AAu?$AAn?$AAt?$AAe?$AAr?$AAC?$AAo?$AAu?$AAn?$AAt?$AA?$AA@
0x18009F3E0: "__cdecl _imp_SetSecurityInfo" __imp_SetSecurityInfo
0x180071850: "ApplicationIdentity" ??_C@_1CI@JLLFEFFG@?$AAA?$AAp?$AAp?$AAl?$AAi?$AAc?$AAa?$AAt?$AAi?$AAo?$AAn?$AAI?$AAd?$AAe?$AAn?$AAt?$AAi?$AAt?$AAy?$AA?$AA@
0x18007E120: "Application Management Group Pol" ??_C@_1EI@KHPALFJ@?$AAA?$AAp?$AAp?$AAl?$AAi?$AAc?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?5?$AAM?$AAa?$AAn?$AAa?$AAg?$AAe?$AAm?$AAe?$AAn?$AAt?$AA?5?$AAG?$AAr?$AAo?$AAu?$AAp?$AA?5?$AAP?$AAo?$AAl@
0x180040E20: SetServiceBits
0x18002C4C0: QuerySecurityAccessMaskStub
0x18007EE60: "AccProvHandleRevokeAuditRights" ??_C@_0BP@GCLJIGDD@AccProvHandleRevokeAuditRights?$AA@
0x18002D340: AuditLookupCategoryNameA
0x18005E534: LsapFallBackIsAllowed
0x180046308: AppendCondition
0x18003E190: BaseRegSetValue
0x180010374: McGenEventRegister
0x180071C30: "Unrestricted" ??_C@_1BK@OACEHMFI@?$AAU?$AAn?$AAr?$AAe?$AAs?$AAt?$AAr?$AAi?$AAc?$AAt?$AAe?$AAd?$AA?$AA@
0x18001D3FC: "__cdecl _imp_load_CredpEncodeCredential" __imp_load_CredpEncodeCredential
0x18002AC50: FlushEfsCache
0x180070158: "__cdecl _imp_NtOpenKey" __imp_NtOpenKey
0x18006FDE0: "__cdecl _imp_CreateRestrictedToken" __imp_CreateRestrictedToken
0x180003AC8: "unsigned long __cdecl c_SeclCreateProcessWithLogonW(struct _SECL_SLI * __ptr64,struct _SECL_SLRI * __ptr64)" ?c_SeclCreateProcessWithLogonW@@YAKPEAU_SECL_SLI@@PEAU_SECL_SLRI@@@Z
0x18006F6F0: "__cdecl _imp_UuidToStringW" __imp_UuidToStringW
0x18006FB10: "__cdecl _imp_AuditLookupCategoryNameW" __imp_AuditLookupCategoryNameW
0x18006F6E0: "__cdecl _imp_NdrClientCall2" __imp_NdrClientCall2
0x18007F0D0: "1.2.840.113556.1.4.529" ??_C@_0BH@PNCBBPAM@1?42?4840?4113556?41?44?4529?$AA@
0x1800872CC: "__cdecl _DELAY_IMPORT_DESCRIPTOR_bcrypt_dll" __DELAY_IMPORT_DESCRIPTOR_bcrypt_dll
0x18002C6F0: RegUnLoadKeyAStub
0x180087528: CRYPTSP_NULL_THUNK_DATA_DLN
0x18002AD40: FreeEncryptionCertificateHashList
0x18007EDA8: "AccProvIsAccessAudited" ??_C@_0BH@KNEMDPKF@AccProvIsAccessAudited?$AA@
0x1800602F0: "struct _MIDL_STUB_DESC const svcctl_StubDesc" ?svcctl_StubDesc@@3U_MIDL_STUB_DESC@@B
0x18007B1C0: "struct _svcctl_MIDL_EXPR_FORMAT_STRING const svcctl__MIDL_ExprFormatString" ?svcctl__MIDL_ExprFormatString@@3U_svcctl_MIDL_EXPR_FORMAT_STRING@@B
0x1800800D0: "LsarpcClientAllowRemotedSecretOp" ??_C@_1FC@MNBJNKPF@?$AAL?$AAs?$AAa?$AAr?$AAp?$AAc?$AAC?$AAl?$AAi?$AAe?$AAn?$AAt?$AAA?$AAl?$AAl?$AAo?$AAw?$AAR?$AAe?$AAm?$AAo?$AAt?$AAe?$AAd?$AAS?$AAe?$AAc?$AAr?$AAe?$AAt?$AAO?$AAp@
0x18005E92C: LspSecureFreeSecretValue
0x18007FDE8: "\REGISTRY\USER" ??_C@_1BO@PBBLJICK@?$AA?2?$AAR?$AAE?$AAG?$AAI?$AAS?$AAT?$AAR?$AAY?$AA?2?$AAU?$AAS?$AAE?$AAR?$AA?$AA@
0x18001CF67: "__cdecl _imp_load_LookupAccountSidLocalW" __imp_load_LookupAccountSidLocalW
0x18007DB20: "unsigned short const * const NULL_STRING" ?NULL_STRING@@3QBGB
0x18007D3F0: "TL" ??_C@_15IOAPDDI@?$AAT?$AAL?$AA?$AA@
0x18002B370: AccessCheckByTypeAndAuditAlarmWStub
0x180037AD8: CodeAuthzPol_SetInfoRegistry_MachineDword
0x18002C700: RegUnLoadKeyWStub
0x18006FC18: "__cdecl _imp_QuerySecurityAccessMask" __imp_QuerySecurityAccessMask
0x18002D150: SystemFunction019
0x18006F340: "__cdecl _imp_WriteFile" __imp_WriteFile
0x18002D100: SystemFunction017
0x18001D016: "__cdecl _imp_load_LookupAccountSidLocalA" __imp_load_LookupAccountSidLocalA
0x180098120: g_CodeIdentitiesTable
0x180080020: "NeutralizeNt4Emulator" ??_C@_0BG@ICCLOMHM@NeutralizeNt4Emulator?$AA@
0x1800980E8: g_bHonorScopeUser
0x1800725C8: "MsiSetInternalUI" ??_C@_0BB@FEPICOJF@MsiSetInternalUI?$AA@
0x180098A68: "unsigned long gDebugBreak" ?gDebugBreak@@3KA
0x180073BA0: "ProviderOrder" ??_C@_1BM@FBFHHHJN@?$AAP?$AAr?$AAo?$AAv?$AAi?$AAd?$AAe?$AAr?$AAO?$AAr?$AAd?$AAe?$AAr?$AA?$AA@
0x18006FAE0: "__cdecl _imp_AuditSetGlobalSaclW" __imp_AuditSetGlobalSaclW
0x180070190: "__cdecl _imp_RtlAddAccessAllowedAceEx" __imp_RtlAddAccessAllowedAceEx
0x18008FF14: "__cdecl _IMPORT_DESCRIPTOR_RPCRT4" __IMPORT_DESCRIPTOR_RPCRT4
0x18007D364: "GW" ??_C@_15KLKFDJD@?$AAG?$AAW?$AA?$AA@
0x18001AFA0: StartServiceCtrlDispatcherAStub
0x180070188: "__cdecl _imp_RtlLengthSid" __imp_RtlLengthSid
0x1800728F0: "unsigned short const * const PerflibKey" ?PerflibKey@@3QBGB
0x18006F790: "__cdecl _imp_PcwCreateQuery" __imp_PcwCreateQuery
0x18009F1F8: "__cdecl _imp_CryptCATAdminCalcHashFromFileHandle" __imp_CryptCATAdminCalcHashFromFileHandle
0x18006F588: "__cdecl _imp_GetFileSize" __imp_GetFileSize
0x18001CAB7: "__cdecl _imp_load_CryptCATCatalogInfoFromContext" __imp_load_CryptCATCatalogInfoFromContext
0x18006F4B8: "__cdecl _imp_GetFileTime" __imp_GetFileTime
0x18005C1E4: MapSDToRpcSD
0x18006FBD8: "__cdecl _imp_DuplicateToken" __imp_DuplicateToken
0x1800724A8: "_Classes" ??_C@_1BC@PGMOPNLK@?$AA_?$AAC?$AAl?$AAa?$AAs?$AAs?$AAe?$AAs?$AA?$AA@
0x1800058E0: PerfEnumerateCounterSet
0x180073D00: "__cdecl _sz_CRYPT32_dll" __sz_CRYPT32_dll
0x180050504: McTemplateU0zzqq
0x1800706C8: "__cdecl _imp_RtlDeleteCriticalSection" __imp_RtlDeleteCriticalSection
0x18003ADD0: GetSecurityInfoExA
0x180015180: OpenThreadTokenStub
0x18007DDE0: "Product ID" ??_C@_1BG@MGFCBHLP@?$AAP?$AAr?$AAo?$AAd?$AAu?$AAc?$AAt?$AA?5?$AAI?$AAD?$AA?$AA@
0x18002B100: SetUserFileEncryptionKey
0x1800703D0: "__cdecl _imp_RtlGetControlSecurityDescriptor" __imp_RtlGetControlSecurityDescriptor
0x18006F710: RPCRT4_NULL_THUNK_DATA
0x180015D6C: "unsigned char __cdecl PerflibciInitialize(void)" ?PerflibciInitialize@@YAEXZ
0x18009F2A0: "__cdecl _imp_CredProtectW" __imp_CredProtectW
0x180002190: "unsigned long __cdecl PerfpAddInstance(struct _PERFLIBCI_MULTI_INSTS * __ptr64,struct _PCW_INSTANCE_BUFFER * __ptr64,unsigned __int64)" ?PerfpAddInstance@@YAKPEAU_PERFLIBCI_MULTI_INSTS@@PEAU_PCW_INSTANCE_BUFFER@@_K@Z
0x18001CC80: NotifyServiceStatusChangeW
0x18001D0D7: "__cdecl _imp_load_CredUnprotectA" __imp_load_CredUnprotectA
0x180058E9C: "unsigned long __cdecl WctGetMutantInfo(void * __ptr64,struct _WAITCHAIN_NODE_INFO * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64)" ?WctGetMutantInfo@@YAKPEAXPEAU_WAITCHAIN_NODE_INFO@@PEAK2@Z
0x18004A8D0: ClearEventLogW
0x18004F664: McTemplateU0zqq
0x18001C9BA: "__cdecl _tailMerge_wintrust_dll" __tailMerge_wintrust_dll
0x18002BCE0: CredWriteWStub
0x18002C300: LsaSetInformationPolicyStub
0x18007EC50: "Group" ??_C@_1M@LHGLMLD@?$AAG?$AAr?$AAo?$AAu?$AAp?$AA?$AA@
0x18001BE10: EnableTrace
0x18003BB50: SetSecurityInfoExA
0x18001C300: "__cdecl _report_gsfailure" __report_gsfailure
0x18007E220: "FriendlyName" ??_C@_1BK@BFIEKNFP@?$AAF?$AAr?$AAi?$AAe?$AAn?$AAd?$AAl?$AAy?$AAN?$AAa?$AAm?$AAe?$AA?$AA@
0x180098A80: Logon32DomainName
0x180050250: McTemplateU0zzpq
0x1800059A0: PerflibciLocalEnumerateCounterSet
0x1800872EC: "__cdecl _DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_lsalookup_l1_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_lsalookup_l1_1_0_dll
0x18006F740: api-ms-win-core-apiquery-l1-1-0_NULL_THUNK_DATA
0x180058334: "unsigned long __cdecl WctGetCOMInfo(struct _WCT_CLIENT_HANDLE * __ptr64,struct _SYSTEM_PROCESS_INFORMATION * __ptr64,unsigned long,struct _WAITCHAIN_NODE_INFO * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64,struct _WCT_LOCK_CONTEXT * __ptr64)" ?WctGetCOMInfo@@YAKPEAU_WCT_CLIENT_HANDLE@@PEAU_SYSTEM_PROCESS_INFORMATION@@KPEAU_WAITCHAIN_NODE_INFO@@PEAK3PEAU_WCT_LOCK_CONTEXT@@@Z
0x18001D19D: "__cdecl _imp_load_CredUnprotectW" __imp_load_CredUnprotectW
0x180070258: "__cdecl _imp_EtwEventWrite" __imp_EtwEventWrite
0x18006F638: "__cdecl _imp_PackageIdFromFullName" __imp_PackageIdFromFullName
0x18001CF43: "__cdecl _imp_load_BCryptOpenAlgorithmProvider" __imp_load_BCryptOpenAlgorithmProvider
0x18006FA10: api-ms-win-core-timezone-l1-1-0_NULL_THUNK_DATA
0x1800161F0: OpenSCManagerWStub
0x18002F368: LsapCreatePrivateHandleFromPrivateHandle
0x18001138C: CodeAuthzpRecomputeEffectiveDefaultLevel
0x18007F4F0: "%I64o" ??_C@_1M@NJBLEBAG@?$AA?$CF?$AAI?$AA6?$AA4?$AAo?$AA?$AA@
0x180056168: WmipDeliverAllEvents
0x180098430: "unsigned long ComputerNameLength" ?ComputerNameLength@@3KA
0x1800701F8: "__cdecl _imp_NtOpenFile" __imp_NtOpenFile
0x18004DF4C: "unsigned char __cdecl CleanupV2Resources(unsigned char)" ?CleanupV2Resources@@YAEE@Z
0x18006FAA0: "__cdecl _imp_AuditQuerySystemPolicy" __imp_AuditQuerySystemPolicy
0x1800701F0: "__cdecl _imp_RtlExpandEnvironmentStrings_U" __imp_RtlExpandEnvironmentStrings_U
0x18006F2C8: "__cdecl _imp_LeaveCriticalSection" __imp_LeaveCriticalSection
0x180042670: ObjectCloseAuditAlarmA
0x18007FDD8: "SHARED" ??_C@_1O@GONJGFOA@?$AAS?$AAH?$AAA?$AAR?$AAE?$AAD?$AA?$AA@
0x180044FB4: LocalConvertSDToStringSD_Rev1
0x180070000: api-ms-win-service-winsvc-l1-1-0_NULL_THUNK_DATA
0x1800983A8: "struct _MARTA_NTMARTA_INFO gNtMartaInfo" ?gNtMartaInfo@@3U_MARTA_NTMARTA_INFO@@A
0x18007F510: "%I64u" ??_C@_1M@OGLPPGPN@?$AA?$CF?$AAI?$AA6?$AA4?$AAu?$AA?$AA@
0x1800127F0: CodeAuthzpInvertAndAddSids
0x18007FF58: "ncacn_spx" ??_C@_1BE@KCAEANMM@?$AAn?$AAc?$AAa?$AAc?$AAn?$AA_?$AAs?$AAp?$AAx?$AA?$AA@
0x1800564B0: WmipFindGuidNotification
0x18007F578: "(%ls %ls %ls)" ??_C@_1BM@HKDMMLMD@?$AA?$CI?$AA?$CF?$AAl?$AAs?$AA?5?$AA?$CF?$AAl?$AAs?$AA?5?$AA?$CF?$AAl?$AAs?$AA?$CJ?$AA?$AA@
0x180050DA4: McTemplateU0zq
0x18007F464: "TX" ??_C@_15NHJLDDPA@?$AAT?$AAX?$AA?$AA@
0x18004DC60: "unsigned long __cdecl PerfpSendStateLessNotification(struct _GUID const * __ptr64,unsigned long,void * __ptr64,unsigned long,void * __ptr64 * __ptr64,unsigned long * __ptr64)" ?PerfpSendStateLessNotification@@YAKPEBU_GUID@@KPEAXKPEAPEAXPEAK@Z
0x18002C0E0: LsaAddAccountRightsStub
0x18006FA68: "__cdecl _imp_StartTraceW" __imp_StartTraceW
0x18006F438: "__cdecl _imp_SearchPathW" __imp_SearchPathW
0x180007F00: LocalGetAclForString
0x18002DB90: LsaEnumerateAccounts
0x18006FF00: "__cdecl _imp_QueryServiceConfigW" __imp_QueryServiceConfigW
0x18002B700: AddAuditAccessAceExStub
0x18002C060: IsValidSecurityDescriptorStub
0x18007F630: "Security" ??_C@_08EDKKPLCC@Security?$AA@
0x180080660: "ntdll.dll" ??_C@_1BE@GJOFHIHD@?$AAn?$AAt?$AAd?$AAl?$AAl?$AA?4?$AAd?$AAl?$AAl?$AA?$AA@
0x18001C834: "__cdecl _imp_load_CryptVerifySignatureW" __imp_load_CryptVerifySignatureW
0x18006FC28: "__cdecl _imp_IsValidAcl" __imp_IsValidAcl
0x180015780: CryptAcquireContextAStub
0x180070680: "__cdecl _imp_RtlxUnicodeStringToAnsiSize" __imp_RtlxUnicodeStringToAnsiSize
0x18006F728: "__cdecl _imp_StartTraceA" __imp_StartTraceA
0x180098384: g_dwNumHandlesAllocated
0x18005ECF8: LsapCrDecryptValue
0x18007FC78: "Event" ??_C@_1M@JJBFPLJB@?$AAE?$AAv?$AAe?$AAn?$AAt?$AA?$AA@
0x180003BD0: "unsigned long __cdecl SetupLocalRPCSecurity(void * __ptr64)" ?SetupLocalRPCSecurity@@YAKPEAX@Z
0x18006FFB0: "__cdecl _imp_QueryServiceConfigA" __imp_QueryServiceConfigA
0x18006FCC0: "__cdecl _imp_ObjectPrivilegeAuditAlarmW" __imp_ObjectPrivilegeAuditAlarmW
0x18006EBA0: conn_functions
0x180070358: "__cdecl _imp_RtlAnsiCharToUnicodeChar" __imp_RtlAnsiCharToUnicodeChar
0x18006FB78: "__cdecl _imp_ConvertToAutoInheritPrivateObjectSecurity" __imp_ConvertToAutoInheritPrivateObjectSecurity
0x180098A58: "int (__cdecl* __ptr64 pfnLoadStringW)(struct HINSTANCE__ * __ptr64,unsigned int,unsigned short * __ptr64,int)" ?pfnLoadStringW@@3P6AHPEAUHINSTANCE__@@IPEAGH@ZEA
0x18009F1E8: "__cdecl _imp_WTHelperGetProvSignerFromChain" __imp_WTHelperGetProvSignerFromChain
0x18002DA90: LsaCreateTrustedDomain
0x18006F3E0: "__cdecl _imp_LoadResource" __imp_LoadResource
0x180042F14: L32GetDefaultDomainName
0x1800702D8: "__cdecl _imp_RtlInitializeGenericTable" __imp_RtlInitializeGenericTable
0x180034D20: SaferSetLevelInformation
0x18007E628: SrpEvt_AccessDisabledByPolicyOther
0x18004D628: "struct _PERFLIBCI_RED_BLACK_NODE * __ptr64 __cdecl PerflibciFindOutputInstance(struct _PERFLIBCI_MULTI_INSTS * __ptr64,struct _PERF_INSTANCE_HEADER * __ptr64,struct _PERF_COUNTER_DATA * __ptr64,unsigned long,int)" ?PerflibciFindOutputInstance@@YAPEAU_PERFLIBCI_RED_BLACK_NODE@@PEAU_PERFLIBCI_MULTI_INSTS@@PEAU_PERF_INSTANCE_HEADER@@PEAU_PERF_COUNTER_DATA@@KH@Z
0x18009F340: "__cdecl _imp_CredEncryptAndMarshalBinaryBlob" __imp_CredEncryptAndMarshalBinaryBlob
0x18006FEA0: "__cdecl _imp_OpenSCManagerW" __imp_OpenSCManagerW
0x18007C040: "SHA256" ??_C@_1O@HECGKAIN@?$AAS?$AAH?$AAA?$AA2?$AA5?$AA6?$AA?$AA@
0x18004AC50: ReadEventLogA
0x18002C6A0: RegRestoreKeyWStub
0x180072730: pszRegDockingState
0x180040970: GetServiceDisplayNameA
0x18002C2D0: LsaQuerySecretStub
0x180056C60: WmipSendEventPumpRequest
0x18001B0EC: WsdpBindClient
0x18007F748: PERFLIB_INVALID_SIZE_RETURNED
0x18003ACB0: GetOverlappedAccessResults
0x18007F6C0: "_Total" ??_C@_1O@NKAIMMPD@?$AA_?$AAT?$AAo?$AAt?$AAa?$AAl?$AA?$AA@
0x18004ACE0: ReadEventLogW
0x18002BCC0: CredWriteDomainCredentialsAStub
0x18007E538: "path" ??_C@_19JIFMCCAP@?$AAp?$AAa?$AAt?$AAh?$AA?$AA@
0x18002BC10: CredReadAStub
0x18001C110: AuditQuerySystemPolicyStub
0x180015B60: SaferpGenericTableAllocate
0x18004BF44: ElfReconnect
0x18002AA00: EncryptFileW
0x18002B7F0: AuditSetGlobalSaclWStub
0x1800093A0: LocalpConvertStringSidToSid
0x18006FD50: "__cdecl _imp_GetAclInformation" __imp_GetAclInformation
0x18006FE20: "__cdecl _imp_MakeAbsoluteSD2" __imp_MakeAbsoluteSD2
0x18007F46C: "TB" ??_C@_15OIDPIEAL@?$AAT?$AAB?$AA?$AA@
0x18002C750: SetSecurityAccessMaskStub
0x18006FF60: "__cdecl _imp_QueryUserServiceNameForContext" __imp_QueryUserServiceNameForContext
0x180039030: GetNamedSecurityInfoA
0x180070538: "__cdecl _imp_NtWaitForMultipleObjects" __imp_NtWaitForMultipleObjects
0x18001AB18: LocalOpenLocalMachine
0x18005E2E8: LsapCrClientGetSessionKey
0x18006F418: "__cdecl _imp_InitOnceComplete" __imp_InitOnceComplete
0x18002BC50: CredReadWStub
0x1800956B8: g_ExtensionCallbacks
0x18006F7E8: "__cdecl _imp_OpenThreadToken" __imp_OpenThreadToken
0x18008736C: "__cdecl _DELAY_IMPORT_DESCRIPTOR_api_ms_win_devices_config_l1_1_1_dll" __DELAY_IMPORT_DESCRIPTOR_api_ms_win_devices_config_l1_1_1_dll
0x18006FC60: "__cdecl _imp_MakeAbsoluteSD" __imp_MakeAbsoluteSD
0x18001ABF0: SetNamedSecurityInfoA
0x18004DDDC: PerflibciCloseLocalQueryHandle
0x1800602A8: MachineStringKey
0x1800983E8: "struct _PERFLIBCI_RED_BLACK_NODE * __ptr64 __ptr64 g_ObjectList" ?g_ObjectList@@3PEAU_PERFLIBCI_RED_BLACK_NODE@@EA
0x180016300: RegCreateKeyExAStub
0x1800487DC: LocalGetRelativeAttributeForString
0x180071804: "FL" ??_C@_15EGPOFAKI@?$AAF?$AAL?$AA?$AA@
0x18006F6A8: "__cdecl _imp_NdrClientCall3" __imp_NdrClientCall3
0x18006F3B0: "__cdecl _imp_MapViewOfFile" __imp_MapViewOfFile
0x1800092F0: ConvertStringSidToSidW
0x18006F5C8: "__cdecl _imp_CreateProcessAsUserA" __imp_CreateProcessAsUserA
0x18007F9F8: "%ws\%ws" ??_C@_1BA@NPEHGALP@?$AA?$CF?$AAw?$AAs?$AA?2?$AA?$CF?$AAw?$AAs?$AA?$AA@
0x180060680: ControlLookup
0x18002C2C0: LsaOpenSecretStub
0x180070260: "__cdecl _imp_NtCreateKey" __imp_NtCreateKey
0x18002B730: AdjustTokenGroupsStub
0x1800703C0: "__cdecl _imp_RtlSetSaclSecurityDescriptor" __imp_RtlSetSaclSecurityDescriptor
0x180098168: g_hKeyCustomRoot
0x180044410: ConvertStringSecurityDescriptorToSecurityDescriptorA
0x1800703C8: "__cdecl _imp_RtlInitializeSid" __imp_RtlInitializeSid
0x18007F4E8: "SID" ??_C@_17HNFFEAHN@?$AAS?$AAI?$AAD?$AA?$AA@
0x180015EA0: DeleteAceStub
0x1800525F0: "void __cdecl PerflibFreeMemory(struct _RTL_AVL_TABLE * __ptr64,void * __ptr64)" ?PerflibFreeMemory@@YAXPEAU_RTL_AVL_TABLE@@PEAX@Z
0x18009F170: "__cdecl _imp_CryptGetDefaultProviderW" __imp_CryptGetDefaultProviderW
0x18000FA18: "unsigned long __cdecl GetQueryType(unsigned short * __ptr64)" ?GetQueryType@@YAKPEAG@Z
0x1800706D0: "__cdecl _imp_NtSetSystemInformation" __imp_NtSetSystemInformation
0x180018740: WsdpInitiateShutdown
0x18002EF00: LsaSetInformationTrustedDomain
0x1800703E0: "__cdecl _imp_RtlSetDaclSecurityDescriptor" __imp_RtlSetDaclSecurityDescriptor
0x18006FBD0: "__cdecl _imp_InitializeAcl" __imp_InitializeAcl
0x18006FF80: "__cdecl _imp_ChangeServiceConfig2A" __imp_ChangeServiceConfig2A
0x1800992F8: "void * __ptr64 * `PerfpInstallationMutexHandles'::`2'::handles" ?handles@?1??PerfpInstallationMutexHandles@@9@4PAPEAXA
0x180099398: "int (__cdecl* __ptr64 g_getsockname)(unsigned __int64,struct sockaddr * __ptr64,int * __ptr64)" ?g_getsockname@@3P6AH_KPEAUsockaddr@@PEAH@ZEA
0x18002C4E0: QueryServiceConfigAStub
0x180098AB0: RootDomInited
0x180004D7C: "public: __cdecl CLoadMsi::CLoadMsi(unsigned long & __ptr64) __ptr64" ??0CLoadMsi@@QEAA@AEAK@Z
0x180071890: "\Hashes" ??_C@_1BA@ICOLHCKI@?$AA?2?$AAH?$AAa?$AAs?$AAh?$AAe?$AAs?$AA?$AA@
0x18005C080: RegConn_nb_tcp
0x18008730C: "__cdecl _DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_credentials_l1_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_credentials_l1_1_0_dll
0x18003C6C8: "unsigned long __cdecl ConvertAListAToNamedBasedW(struct _ACTRL_ALISTA * __ptr64,class CSList & __ptr64,int,struct _ACTRL_ALISTW * __ptr64 * __ptr64)" ?ConvertAListAToNamedBasedW@@YAKPEAU_ACTRL_ALISTA@@AEAVCSList@@HPEAPEAU_ACTRL_ALISTW@@@Z
0x18003FA70: RegSetValueW
0x18009841C: "unsigned long NumExtensibleObjects" ?NumExtensibleObjects@@3KA
0x18007F300: "!" ??_C@_13MGDFOILI@?$AA?$CB?$AA?$AA@
0x18007F1F0: "O" ??_C@_13BNMMGIII@?$AAO?$AA?$AA@
0x18006FED8: "__cdecl _imp_ChangeServiceConfig2W" __imp_ChangeServiceConfig2W
0x180015470: CopySidStub
0x180050414: McTemplateU0zzqp
0x180043520: LogonUserExW
0x180016590: ImpersonateSelfStub
0x180098990: "void * __ptr64 __ptr64 ghRpc" ?ghRpc@@3PEAXEA
0x18006F828: "__cdecl _imp_RegRestoreKeyW" __imp_RegRestoreKeyW
0x18006F510: "__cdecl _imp_CloseThreadpoolIo" __imp_CloseThreadpoolIo
0x18006FFE0: "__cdecl _imp_QueryServiceConfig2A" __imp_QueryServiceConfig2A
0x18003CB14: "unsigned long __cdecl ConvertAListWToAlistAInplace(struct _ACTRL_ALISTW * __ptr64)" ?ConvertAListWToAlistAInplace@@YAKPEAU_ACTRL_ALISTW@@@Z
0x180042A80: SetFileSecurityA
0x18001AB9C: EnterWaitSddlSidLookup
0x18002AA70: EncryptedFileKeyInfo
0x180043FF0: ConvertSecurityDescriptorToStringSecurityDescriptorA
0x180095698: g_AlgMD5
0x180051044: WPP_SF_sd
0x1800505F4: WPP_SF_SD
0x18004F174: WPP_SF_Sd
0x18002BBD0: CredProfileLoadedStub
0x1800718F0: "ExplainResource" ??_C@_1CA@DHKAACNH@?$AAE?$AAx?$AAp?$AAl?$AAa?$AAi?$AAn?$AAR?$AAe?$AAs?$AAo?$AAu?$AAr?$AAc?$AAe?$AA?$AA@
0x180015450: CryptDestroyHashStub
0x1800702F0: "__cdecl _imp_RtlNumberGenericTableElements" __imp_RtlNumberGenericTableElements
0x18002D59C: AuditpQueryGlobalSacl
0x180008C90: InitializeSidLookupTable
0x18003C4A0: TrusteeAccessToObjectW
0x18007EB28: "InvertPrivs" ??_C@_1BI@OGOOMLJO@?$AAI?$AAn?$AAv?$AAe?$AAr?$AAt?$AAP?$AAr?$AAi?$AAv?$AAs?$AA?$AA@
0x18007D2F4: "WP" ??_C@_15JELLGJLB@?$AAW?$AAP?$AA?$AA@
0x18007ED88: "AccProvGetTrusteesAccess" ??_C@_0BJ@GNOIFOJE@AccProvGetTrusteesAccess?$AA@
0x180056EB4: GuidToWString
0x18007DB58: pszRegDockState
0x18006F8A8: "__cdecl _imp_RegLoadAppKeyA" __imp_RegLoadAppKeyA
0x180050F04: WPP_SF_Sq
0x18004F7AC: WPP_SF_sS
0x180041510: GetFileSecurityA
0x180072278: "DefaultLevel" ??_C@_1BK@PFFEIDOG@?$AAD?$AAe?$AAf?$AAa?$AAu?$AAl?$AAt?$AAL?$AAe?$AAv?$AAe?$AAl?$AA?$AA@
0x18006F698: "__cdecl _imp_RpcBindingSetAuthInfoExW" __imp_RpcBindingSetAuthInfoExW
0x18007F938: WPP_685eceeac0e43666e40e36eb5dc162e8_Traceguids
0x1800704D8: "__cdecl _imp_EtwEventSetInformation" __imp_EtwEventSetInformation
0x1800704F0: "__cdecl _imp_RtlDllShutdownInProgress" __imp_RtlDllShutdownInProgress
0x180032468: CodeAuthzpCreateLevelHandleFromRecord
0x18005EED4: LsapCrFreeMemoryValue
0x18006F7F8: "__cdecl _imp_OpenProcessToken" __imp_OpenProcessToken
0x1800705D8: "__cdecl _imp_RtlDosPathNameToRelativeNtPathName_U" __imp_RtlDosPathNameToRelativeNtPathName_U
0x1800726F0: pszRegFriendlyName
0x180099310: WmipEventPumpBufferSize
0x180052594: "void __cdecl PerflibDeleteV2ResourceTable(void)" ?PerflibDeleteV2ResourceTable@@YAXXZ
0x180017B70: PREGISTRY_SERVER_NAME_bind
0x1800993B0: "struct HINSTANCE__ * __ptr64 __ptr64 g_ws2_32" ?g_ws2_32@@3PEAUHINSTANCE__@@EA
0x180072668: "TranslateMessage" ??_C@_0BB@DHHKBNMB@TranslateMessage?$AA@
0x180080350: "\Classes" ??_C@_1BC@BMEICANI@?$AA?2?$AAC?$AAl?$AAa?$AAs?$AAs?$AAe?$AAs?$AA?$AA@
0x180016710: ElfRegisterEventSourceW
0x18007F7B8: PERFLIB_PROC_NAME_NOT_FOUND
0x18001D2AB: "__cdecl _imp_load_CredProfileUnloaded" __imp_load_CredProfileUnloaded
0x18006FB08: "__cdecl _imp_AuditEnumeratePerUserPolicy" __imp_AuditEnumeratePerUserPolicy
0x180072410: "Security=impersonation static fa" ??_C@_1EI@OGDDMHHA@?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?$DN?$AAi?$AAm?$AAp?$AAe?$AAr?$AAs?$AAo?$AAn?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?5?$AAs?$AAt?$AAa?$AAt?$AAi?$AAc?$AA?5?$AAf?$AAa@
0x18001BC98: AccProvpLoadProviderDef
0x180070078: "__cdecl _imp_iswctype" __imp_iswctype
0x180047FDC: IsEncodedAttributeChar
0x180073FA0: "ext-ms-win-ntuser-windowstation-" ??_C@_1EO@PCHFFKDO@?$AAe?$AAx?$AAt?$AA?9?$AAm?$AAs?$AA?9?$AAw?$AAi?$AAn?$AA?9?$AAn?$AAt?$AAu?$AAs?$AAe?$AAr?$AA?9?$AAw?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AAt?$AAa?$AAt?$AAi?$AAo?$AAn?$AA?9@
0x18004C1B0: ElfRegisterEventSourceA
0x180040EE0: AccessCheckAndAuditAlarmA
0x18007F308: "Member_of" ??_C@_1BE@EKOFFKD@?$AAM?$AAe?$AAm?$AAb?$AAe?$AAr?$AA_?$AAo?$AAf?$AA?$AA@
0x18009F0C0: "__cdecl _imp_CryptDuplicateKey" __imp_CryptDuplicateKey
0x18001C2A4: "__cdecl DllMainCRTStartupForGS2" _DllMainCRTStartupForGS2
0x180015F10: AdjustTokenPrivilegesStub
0x180088798: api-ms-win-security-provider-l1-1-0_NULL_THUNK_DATA_DLB
0x180097D40: gDnsDomainSidLookup
0x18006F748: "__cdecl _imp_ImpersonateNamedPipeClient" __imp_ImpersonateNamedPipeClient
0x18005D354: LsapCreatePrivateHandleFromString
0x180010000: "long __cdecl PrivateRegQueryValueExT(struct HKEY__ * __ptr64,void * __ptr64,unsigned long * __ptr64,unsigned long * __ptr64,unsigned char * __ptr64,unsigned long * __ptr64,int)" ?PrivateRegQueryValueExT@@YAJPEAUHKEY__@@PEAXPEAK2PEAE2H@Z
0x18005E260: LsapCopyPrivateDataValueToUnicodeString
0x18004D17C: WPP_SF_S
0x18004F0EC: McTemplateU0z
0x18002C470: ObjectPrivilegeAuditAlarmWStub
0x180070398: "__cdecl _imp_RtlOemStringToUnicodeString" __imp_RtlOemStringToUnicodeString
0x180070620: "__cdecl _imp_NtQueryMutant" __imp_NtQueryMutant
0x18001D804: memset
0x18008FF8C: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x18007F718: PERFLIB_OPEN_PROC_NOT_FOUND
0x18002C030: ImpersonateNamedPipeClientStub
0x18004A47C: RtlStringCchPrintfW
0x1800145B0: CodeAuthzInitialize
0x18008FDAC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-service-core-l1-1-2" __IMPORT_DESCRIPTOR_api-ms-win-service-core-l1-1-2
0x18002EBE0: LsaQueryInfoTrustedDomain
0x180050C88: McTemplateU0szzq
0x18009F3A0: "__cdecl _imp_LookupAccountSidLocalA" __imp_LookupAccountSidLocalA
0x18002F3A0: LsaCreateTrustedDomainEx
0x18001CA81: "__cdecl _imp_load_CryptCATAdminCalcHashFromFileHandle" __imp_load_CryptCATAdminCalcHashFromFileHandle
0x1800729D0: "struct _svcctl_MIDL_PROC_FORMAT_STRING const svcctl__MIDL_ProcFormatString" ?svcctl__MIDL_ProcFormatString@@3U_svcctl_MIDL_PROC_FORMAT_STRING@@B
0x1800170D4: McTemplateU0uzr0

[JEB Decompiler by PNF Software]