PDB Symbols - fileinfo.sys (0xFB868054A068344C9357CE15650BAA292DA4F611EA96FE7731896FE873EB5549)

Generated by JEB on 2019/08/01

PE: C:\Windows\System32\drivers\fileinfo.sys Base=0x1C0000000 SHA-256=FB868054A068344C9357CE15650BAA292DA4F611EA96FE7731896FE873EB5549
PDB: fileinfo.pdb GUID={87B97925-DC12-2F16-602CBC652F6BE73B} Age=1

469 located named symbols:
0x1C0009208: "__cdecl _imp_RtlInitUnicodeStringEx" __imp_RtlInitUnicodeStringEx
0x1C0009368: "__cdecl _imp_PsGetThreadId" __imp_PsGetThreadId
0x1C000484C: "RC" ??_C@_15IGNKAAHD@?$AAR?$AAC?$AA?$AA@
0x1C001461C: FIPfVolumeRundownAllPrefetchStart
0x1C000C1F0: FIPfFileFSOpStart
0x1C00090C8: "__cdecl _imp_FltIs32bitProcess" __imp_FltIs32bitProcess
0x1C0013A08: FIPfFileFSOpPreventOpensForFailedStreamGet
0x1C0001840: FIPfFilePfContextDereference
0x1C00041B0: "FIForcedNameTracking" ??_C@_1CK@FHLNPJHE@?$AAF?$AAI?$AAF?$AAo?$AAr?$AAc?$AAe?$AAd?$AAN?$AAa?$AAm?$AAe?$AAT?$AAr?$AAa?$AAc?$AAk?$AAi?$AAn?$AAg?$AA?$AA@
0x1C0014AEC: SepSddlGetAclForString
0x1C000EC60: FIPfGetFileInfoRelatedObjectsFromFileObject
0x1C0009300: "__cdecl _imp_RtlFreeUnicodeString" __imp_RtlFreeUnicodeString
0x1C0001B90: FIPfFileFSOpEnd
0x1C00090F8: "__cdecl _imp_FltGetFileNameInformation" __imp_FltGetFileNameInformation
0x1C0007088: "__cdecl _security_cookie_complement" __security_cookie_complement
0x1C0009420: "__cdecl _imp_ObfDereferenceObject" __imp_ObfDereferenceObject
0x1C0007A40: PfnIoCreateDeviceSecure
0x1C0009248: "__cdecl _imp_KeSetKernelStackSwapEnable" __imp_KeSetKernelStackSwapEnable
0x1C0012DBC: FIFileObjectContextsDeleteAll
0x1C0009400: "__cdecl _imp_RtlInitUnicodeString" __imp_RtlInitUnicodeString
0x1C0009460: "__cdecl _imp_ExEventObjectType" __imp_ExEventObjectType
0x1C0002250: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x1C0009130: "__cdecl _imp_FltGetFileNameInformationUnsafe" __imp_FltGetFileNameInformationUnsafe
0x1C001388C: FIPfBlockersRelease
0x1C0009418: "__cdecl _imp_ExpInterlockedPushEntrySList" __imp_ExpInterlockedPushEntrySList
0x1C0009268: "__cdecl _imp_IoCreateDevice" __imp_IoCreateDevice
0x1C0009270: "__cdecl _imp_IoDeviceObjectType" __imp_IoDeviceObjectType
0x1C000CE30: FIStreamSetFileInfo
0x1C0004854: "WD" ??_C@_15ELMAKJHJ@?$AAW?$AAD?$AA?$AA@
0x1C00091B0: "__cdecl _imp_PsSetCurrentThreadPrefetching" __imp_PsSetCurrentThreadPrefetching
0x1C0009318: "__cdecl _imp_IofCompleteRequest" __imp_IofCompleteRequest
0x1C00092B8: "__cdecl _imp_RtlCreateSecurityDescriptor" __imp_RtlCreateSecurityDescriptor
0x1C0001D30: FIPreQueryInformationCallback
0x1C00093D8: "__cdecl _imp_ExInitializeRundownProtection" __imp_ExInitializeRundownProtection
0x1C0009148: "__cdecl _imp_FltAllocateContext" __imp_FltAllocateContext
0x1C0010CD0: IoDevObjCreateDeviceSecure
0x1C000F1B0: FIVolumeCleanup
0x1C00092A8: "__cdecl _imp_wcschr" __imp_wcschr
0x1C000B2A4: FIVolumeGetInfo
0x1C00106E0: FIStreamFillStreamInfo
0x1C000D990: FIPfFileFSOpPostCreate
0x1C0009480: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x1C0009080: "__cdecl _imp_FltCreateFileEx2" __imp_FltCreateFileEx2
0x1C0007A4C: PiRegStateDiscriptor
0x1C0009128: "__cdecl _imp_FltGetDestinationFileNameInformation" __imp_FltGetDestinationFileNameInformation
0x1C0002064: FIPagefileQueueQuery
0x1C00092E8: "__cdecl _imp_RtlGetOwnerSecurityDescriptor" __imp_RtlGetOwnerSecurityDescriptor
0x1C00092B0: "__cdecl _imp__wcsnicmp" __imp__wcsnicmp
0x1C0010E18: IopDevObjApplyPostCreationSettings
0x1C00144A0: FIPfUserOpenNotifyConflictStart
0x1C0009140: "__cdecl _imp_FltDoCompletionProcessingWhenSafe" __imp_FltDoCompletionProcessingWhenSafe
0x1C0004000: SDDL_DEVOBJ_SYS_ALL_ADM_ALL
0x1C0009260: "__cdecl _imp_MmGetSystemRoutineAddress" __imp_MmGetSystemRoutineAddress
0x1C000FC7C: FIPfOpenAttemptsInitialize
0x1C0001FC0: FIFindPagefile
0x1C0002008: FIQueryPhysicalMemorySize
0x1C0009070: "__cdecl _imp_FltIsIoCanceled" __imp_FltIsIoCanceled
0x1C0001670: FILockSharedAcquire
0x1C000F810: FIPreCreateCallback
0x1C0004874: "GR" ??_C@_15DNGEKDKB@?$AAG?$AAR?$AA?$AA@
0x1C00091C0: "__cdecl _imp_RtlRbInsertNodeEx" __imp_RtlRbInsertNodeEx
0x1C0009310: "__cdecl _imp_KeWaitForSingleObject" __imp_KeWaitForSingleObject
0x1C00090B8: "__cdecl _imp_FltSetInstanceContext" __imp_FltSetInstanceContext
0x1C00041E0: "FIDbgVolume2ndAttempt" ??_C@_1CM@BMEEAEOD@?$AAF?$AAI?$AAD?$AAb?$AAg?$AAV?$AAo?$AAl?$AAu?$AAm?$AAe?$AA2?$AAn?$AAd?$AAA?$AAt?$AAt?$AAe?$AAm?$AAp?$AAt?$AA?$AA@
0x1C001586C: CmRegUtilUcValueGetDword
0x1C0009048: "__cdecl _imp_FltFreeExtraCreateParameter" __imp_FltFreeExtraCreateParameter
0x1C0001F2C: FIPreOperationCommonCallback
0x1C000D3D0: FIPreCloseCallback
0x1C0001C90: FIPfOpenAttemptsRundownEnd
0x1C0009360: "__cdecl _imp_IoGetBaseFileSystemDeviceObject" __imp_IoGetBaseFileSystemDeviceObject
0x1C0002280: memcpy
0x1C00014E0: FIPreSetInformationCallback
0x1C0009228: "__cdecl _imp_PsGetCurrentThreadId" __imp_PsGetCurrentThreadId
0x1C0002EBC: FIETWLogOperationEnd
0x1C0001AF8: FITruncationLog
0x1C00091E0: "__cdecl _imp_IoGetCurrentProcess" __imp_IoGetCurrentProcess
0x1C0014A0C: SepSddlDaclFromSDDLString
0x1C0009238: "__cdecl _imp_ZwSetValueKey" __imp_ZwSetValueKey
0x1C0009448: "__cdecl _imp_ExfReleasePushLock" __imp_ExfReleasePushLock
0x1C00093E8: "__cdecl _imp_IoDeleteDevice" __imp_IoDeleteDevice
0x1C00092A0: "__cdecl _imp_RtlAbsoluteToSelfRelativeSD" __imp_RtlAbsoluteToSelfRelativeSD
0x1C000218D: "__cdecl _C_specific_handler" __C_specific_handler
0x1C0002280: memmove
0x1C001104C: SepSddlSecurityDescriptorFromSDDLString
0x1C0013B64: FIPfFilePfLinkDereference
0x1C000B008: FIControlDispatchSystemControl
0x1C00044C0: "IoCreateDeviceSecure" ??_C@_1CK@LEEDIGFP@?$AAI?$AAo?$AAC?$AAr?$AAe?$AAa?$AAt?$AAe?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAS?$AAe?$AAc?$AAu?$AAr?$AAe?$AA?$AA@
0x1C0009450: "__cdecl _imp_ExfAcquirePushLockShared" __imp_ExfAcquirePushLockShared
0x1C000B914: FIStreamGetInfo
0x1C00021DC: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x1C00093C8: "__cdecl _imp_IoGetDeviceObjectPointer" __imp_IoGetDeviceObjectPointer
0x1C0002F8C: FIETWLogPreSetInformation
0x1C0009008: "__cdecl _imp_FltCreateFileEx" __imp_FltCreateFileEx
0x1C000C6E0: FIStreamCleanup
0x1C0009150: "__cdecl _imp_FltRegisterFilter" __imp_FltRegisterFilter
0x1C00090E0: "__cdecl _imp_FltReleaseFileNameInformation" __imp_FltReleaseFileNameInformation
0x1C0004710: "FILEINFO: A file system operatio" ??_C@_0FE@OKKCFJNC@FILEINFO?3?5A?5file?5system?5operatio@
0x1C00032A0: FIPostFSControlCallback
0x1C0009028: "__cdecl _imp_FltClose" __imp_FltClose
0x1C0004240: "FIDbgVolumeFailurePercent" ??_C@_1DE@PHEMHEPG@?$AAF?$AAI?$AAD?$AAb?$AAg?$AAV?$AAo?$AAl?$AAu?$AAm?$AAe?$AAF?$AAa?$AAi?$AAl?$AAu?$AAr?$AAe?$AAP?$AAe?$AAr?$AAc?$AAe?$AAn?$AAt?$AA?$AA@
0x1C0004160: FiEvt_FileNameDelete_Info
0x1C0012F88: FIFileObjectDeleteContext
0x1C0009358: "__cdecl _imp_FsRtlAreVolumeStartupApplicationsComplete" __imp_FsRtlAreVolumeStartupApplicationsComplete
0x1C0009350: "__cdecl _imp_ObfReferenceObject" __imp_ObfReferenceObject
0x1C0004140: CSE_ECP_TYPE_GUID
0x1C000EB00: FIVolumeGet
0x1C0004370: "\Registry\Machine\System\Current" ??_C@_1NA@JBNHLOOM@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1C0001100: FIPostReadWriteCallback
0x1C0014FF4: SepSddlParseWideStringUlong
0x1C00042B0: "FIMaxQueryWorkers" ??_C@_1CE@OOCDLMFE@?$AAF?$AAI?$AAM?$AAa?$AAx?$AAQ?$AAu?$AAe?$AAr?$AAy?$AAW?$AAo?$AAr?$AAk?$AAe?$AAr?$AAs?$AA?$AA@
0x1C0013704: FIPfBlockedOpInsert
0x1C000C860: FIPfGetVolumeContextFromFileObject
0x1C0013818: FIPfBlockedOpRemove
0x1C0004190: "SfTracingState" ??_C@_1BO@LJEPHKHJ@?$AAS?$AAf?$AAT?$AAr?$AAa?$AAc?$AAi?$AAn?$AAg?$AAS?$AAt?$AAa?$AAt?$AAe?$AA?$AA@
0x1C0009398: "__cdecl _imp_ZwDeleteValueKey" __imp_ZwDeleteValueKey
0x1C0004884: "GX" ??_C@_15FCNJEDMF@?$AAG?$AAX?$AA?$AA@
0x1C00100FC: WdmlibInit
0x1C0009378: "__cdecl _imp_IoGetTopLevelIrp" __imp_IoGetTopLevelIrp
0x1C0002D10: FIETWLogMdlReadWrite
0x1C000485C: "WO" ??_C@_15JMMBCOHI@?$AAW?$AAO?$AA?$AA@
0x1C0009018: "__cdecl _imp_FltFreeExtraCreateParameterList" __imp_FltFreeExtraCreateParameterList
0x1C0004210: "FIDbgStream2ndAttempt" ??_C@_1CM@OKKKHNDA@?$AAF?$AAI?$AAD?$AAb?$AAg?$AAS?$AAt?$AAr?$AAe?$AAa?$AAm?$AA2?$AAn?$AAd?$AAA?$AAt?$AAt?$AAe?$AAm?$AAp?$AAt?$AA?$AA@
0x1C0009340: "__cdecl _imp_ExAllocatePoolWithTag" __imp_ExAllocatePoolWithTag
0x1C000BCE0: FIStreamQueryWorker
0x1C0009430: "__cdecl _imp_ExpInterlockedFlushSList" __imp_ExpInterlockedFlushSList
0x1C00091F0: "__cdecl _imp_PsGetCurrentProcessId" __imp_PsGetCurrentProcessId
0x1C00092D0: "__cdecl _imp__snwprintf" __imp__snwprintf
0x1C0010480: FIStreamLogForNL
0x1C001452C: FIPfVolumeFSOpPreventConflicts
0x1C00091C8: "__cdecl _imp_RtlUpcaseUnicodeChar" __imp_RtlUpcaseUnicodeChar
0x1C00093A0: "__cdecl _imp_KeInitializeSemaphore" __imp_KeInitializeSemaphore
0x1C0009170: FLTMGR_NULL_THUNK_DATA
0x1C00093A8: "__cdecl _imp_PfFileInfoNotify" __imp_PfFileInfoNotify
0x1C0009468: "__cdecl _imp_ExfAcquirePushLockExclusive" __imp_ExfAcquirePushLockExclusive
0x1C0004278: "FIDbgStreamFailurePercent" ??_C@_1DE@ONBEEPPO@?$AAF?$AAI?$AAD?$AAb?$AAg?$AAS?$AAt?$AAr?$AAe?$AAa?$AAm?$AAF?$AAa?$AAi?$AAl?$AAu?$AAr?$AAe?$AAP?$AAe?$AAr?$AAc?$AAe?$AAn?$AAt?$AA?$AA@
0x1C0009438: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x1C0013988: FIPfDisableUntilTickMsSet
0x1C000488C: "A" ??_C@_13PNBDBPLL@?$AAA?$AA?$AA@
0x1C00092D8: "__cdecl _imp_SeCaptureSecurityDescriptor" __imp_SeCaptureSecurityDescriptor
0x1C0001DD0: FIPreQuerySecurityCallback
0x1C0009440: "__cdecl _imp_KeLeaveCriticalRegion" __imp_KeLeaveCriticalRegion
0x1C00021B8: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x1C0009168: "__cdecl _imp_FltPerformSynchronousIo" __imp_FltPerformSynchronousIo
0x1C0009010: "__cdecl _imp_FltAllocateExtraCreateParameterList" __imp_FltAllocateExtraCreateParameterList
0x1C000F124: FIPfOpenListRemove
0x1C0009298: "__cdecl _imp_RtlAddAccessAllowedAce" __imp_RtlAddAccessAllowedAce
0x1C000E730: FIPfFileOpenAdd
0x1C0001FB0: FIPostPnpCallback
0x1C0009428: "__cdecl _imp_ExpInterlockedPopEntrySList" __imp_ExpInterlockedPopEntrySList
0x1C00092C0: "__cdecl _imp_SeExports" __imp_SeExports
0x1C000ED30: FIStreamGet
0x1C0009100: "__cdecl _imp_FltIsDirectory" __imp_FltIsDirectory
0x1C000B980: FIPfInterfaceQueryVolume
0x1C0009088: "__cdecl _imp_FltEnumerateInstances" __imp_FltEnumerateInstances
0x1C0004180: "%ws%wZ" ??_C@_1O@CJCOHIOA@?$AA?$CF?$AAw?$AAs?$AA?$CF?$AAw?$AAZ?$AA?$AA@
0x1C0009160: "__cdecl _imp_FltGetInstanceContext" __imp_FltGetInstanceContext
0x1C0015B3C: CmRegUtilWstrValueGetDword
0x1C0004480: "IoValidateDeviceIoControlAccess" ??_C@_1EA@BAHCLPHE@?$AAI?$AAo?$AAV?$AAa?$AAl?$AAi?$AAd?$AAa?$AAt?$AAe?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAI?$AAo?$AAC?$AAo?$AAn?$AAt?$AAr?$AAo?$AAl?$AAA?$AAc?$AAc?$AAe?$AAs?$AAs?$AA?$AA@
0x1C0001640: FILockSharedRelease
0x1C0009108: "__cdecl _imp_FltReleaseContext" __imp_FltReleaseContext
0x1C00092C8: "__cdecl _imp_RtlLengthSecurityDescriptor" __imp_RtlLengthSecurityDescriptor
0x1C0004864: "SD" ??_C@_15NAFBOLGP@?$AAS?$AAD?$AA?$AA@
0x1C0015A2C: CmRegUtilUcValueSetUcString
0x1C0010FE8: SeSddlSecurityDescriptorFromSDDL
0x1C0001230: FIPostSetInformationCallback
0x1C000B1A0: FIVolumeQueryWorker
0x1C000EF40: FIPfDriverCreateContextSetup
0x1C00092F0: "__cdecl _imp_RtlGetGroupSecurityDescriptor" __imp_RtlGetGroupSecurityDescriptor
0x1C0004970: "\Registry\Machine\System\Current" ??_C@_1HC@DKINPPAJ@?$AA?2?$AAR?$AAe?$AAg?$AAi?$AAs?$AAt?$AAr?$AAy?$AA?2?$AAM?$AAa?$AAc?$AAh?$AAi?$AAn?$AAe?$AA?2?$AAS?$AAy?$AAs?$AAt?$AAe?$AAm?$AA?2?$AAC?$AAu?$AAr?$AAr?$AAe?$AAn?$AAt@
0x1C0004800: "FILEINFO: To reenable the checks" ??_C@_0EL@FOAAIDIP@FILEINFO?3?5To?5reenable?5the?5checks@
0x1C0015838: CmRegUtilOpenExistingWstrKey
0x1C00107A4: FIVolumeLogForNL
0x1C0015288: PiRegStateReadStackCreationSettingsFromKey
0x1C0004170: FiEvt_FileNameRundown_Info
0x1C00150F8: PiRegStateOpenClassKey
0x1C0001C10: RtlStringCbPrintfW
0x1C000FA50: FIPreFSControlCallback
0x1C00036E4: WdmlibRtlInitUnicodeStringEx
0x1C0004350: "BaseTime" ??_C@_1BC@FBKCDMNG@?$AAB?$AAa?$AAs?$AAe?$AAT?$AAi?$AAm?$AAe?$AA?$AA@
0x1C0013CCC: FIPfNotifiedContextsDelete
0x1C00048F0: "Security" ??_C@_1BC@FCJNIDNL@?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AA?$AA@
0x1C0004150: FiEvt_FileNameCreate_Info
0x1C0004450: "\Device\FileInfo" ??_C@_1CC@DPPHACFF@?$AA?2?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AA?2?$AAF?$AAi?$AAl?$AAe?$AAI?$AAn?$AAf?$AAo?$AA?$AA@
0x1C0016010: GsDriverEntry
0x1C0009478: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x1C0012CB8: FIETWLogSimpleOperationInit
0x1C0009460: ExEventObjectType
0x1C0004328: "FIPrefetchDelayMs" ??_C@_1CE@PMKKAECL@?$AAF?$AAI?$AAP?$AAr?$AAe?$AAf?$AAe?$AAt?$AAc?$AAh?$AAD?$AAe?$AAl?$AAa?$AAy?$AAM?$AAs?$AA?$AA@
0x1C0009380: "__cdecl _imp_KeReleaseSemaphore" __imp_KeReleaseSemaphore
0x1C0015458: PpRegStateReadCreateClassCreationSettings
0x1C0014E84: SepSddlGetSidForString
0x1C0004908: "DeviceType" ??_C@_1BG@KCOOGCNN@?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAT?$AAy?$AAp?$AAe?$AA?$AA@
0x1C000C550: FIEnumerate
0x1C000F4A8: FIPfFileGetFileObjectFromPath
0x1C0009390: "__cdecl _imp_ObReferenceObjectByHandle" __imp_ObReferenceObjectByHandle
0x1C0012B20: FIETWLogFileCreate
0x1C000FC40: FIPreFlushBuffersCallback
0x1C0009000: "__cdecl _imp_FltGetVolumeFromFileObject" __imp_FltGetVolumeFromFileObject
0x1C0010A44: FIVolumeAddPagefile
0x1C00010C8: PfDeviceCharsTranslate
0x1C00049F0: "{%08X-%04X-%04X-%02X%02X-%02X%02" ??_C@_1GG@FCALANDO@?$AA?$HL?$AA?$CF?$AA0?$AA8?$AAX?$AA?9?$AA?$CF?$AA0?$AA4?$AAX?$AA?9?$AA?$CF?$AA0?$AA4?$AAX?$AA?9?$AA?$CF?$AA0?$AA2?$AAX?$AA?$CF?$AA0?$AA2?$AAX?$AA?9?$AA?$CF?$AA0?$AA2?$AAX?$AA?$CF?$AA0?$AA2@
0x1C0001940: FIPreReadWriteCallback
0x1C000FCC0: FIPfUserOpenNotifyConflictEnd
0x1C00047B0: "Break (b), Ignore (i), Ignore Al" ??_C@_0FA@HINCMEKD@Break?5?$CIb?$CJ?0?5Ignore?5?$CIi?$CJ?0?5Ignore?5Al@
0x1C00042D8: "FIBlockDbgBreak" ??_C@_1CA@LONKPAKH@?$AAF?$AAI?$AAB?$AAl?$AAo?$AAc?$AAk?$AAD?$AAb?$AAg?$AAB?$AAr?$AAe?$AAa?$AAk?$AA?$AA@
0x1C000F290: FIPfFileFSOpPostSetInformation
0x1C00034A8: FIPfBlockTimeoutDbgBreak
0x1C0009210: "__cdecl _imp_IoSetThreadHardErrorMode" __imp_IoSetThreadHardErrorMode
0x1C000FC10: FIPreCleanupCallback
0x1C0009330: "__cdecl _imp_ZwQueryValueKey" __imp_ZwQueryValueKey
0x1C00090F0: "__cdecl _imp_FltQueryVolumeInformation" __imp_FltQueryVolumeInformation
0x1C0004700: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x1C00109A0: FIPagefileQueryWorker
0x1C000486C: "GA" ??_C@_15HPMIFLNA@?$AAG?$AAA?$AA?$AA@
0x1C00035B8: FIPfBlockedOpsForceRelease
0x1C0009020: "__cdecl _imp_FltInsertExtraCreateParameter" __imp_FltInsertExtraCreateParameter
0x1C000B0F0: FIVolumeGetNext
0x1C0007090: FIUnknown
0x1C00090C0: "__cdecl _imp_FltStartFiltering" __imp_FltStartFiltering
0x1C0009120: "__cdecl _imp_FltAllocateGenericWorkItem" __imp_FltAllocateGenericWorkItem
0x1C0009078: "__cdecl _imp_FltAllocateCallbackData" __imp_FltAllocateCallbackData
0x1C000FF78: FIGetParameter
0x1C00016A0: FIPfFileFSOpPostCallbackCleanup
0x1C0002150: "__cdecl _security_check_cookie" __security_check_cookie
0x1C0004440: FileInfoEventProvider
0x1C0004010: FIPfRmMetadata
0x1C0009118: "__cdecl _imp_FltObjectDereference" __imp_FltObjectDereference
0x1C000949C: "__cdecl _IMPORT_DESCRIPTOR_FLTMGR" __IMPORT_DESCRIPTOR_FLTMGR
0x1C0009488: "__cdecl _IMPORT_DESCRIPTOR_ntoskrnl" __IMPORT_DESCRIPTOR_ntoskrnl
0x1C00091A8: "__cdecl _imp_KdDebuggerEnabled" __imp_KdDebuggerEnabled
0x1C000108C: PfDeviceTypeTranslate
0x1C000BC80: FIPfUserOpenDispatchCleanup
0x1C0001050: PfVolumeSupportedForPrefetch
0x1C0001640: FILockExclusiveRelease
0x1C0009138: "__cdecl _imp_FltGetVolumeProperties" __imp_FltGetVolumeProperties
0x1C00044F0: "SeConvertStringSecurityDescripto" ??_C@_1GM@JINLDKKK@?$AAS?$AAe?$AAC?$AAo?$AAn?$AAv?$AAe?$AAr?$AAt?$AAS?$AAt?$AAr?$AAi?$AAn?$AAg?$AAS?$AAe?$AAc?$AAu?$AAr?$AAi?$AAt?$AAy?$AAD?$AAe?$AAs?$AAc?$AAr?$AAi?$AAp?$AAt?$AAo@
0x1C0014420: FIPfUserOpenInitialize
0x1C00093B0: "__cdecl _imp_PsIsCurrentThreadPrefetching" __imp_PsIsCurrentThreadPrefetching
0x1C00138D8: FIPfDisableUntilTickMsCheck
0x1C000211C: FIPfVolumeRundownFilePrefetchEnd
0x1C0004130: GUID_ECP_PREFETCH_OPEN
0x1C000FCD0: FIPrePnpCallback
0x1C001403C: FIPfUserOpenDispatchIOCTL
0x1C0001010: FIPreMdlOperationCallback
0x1C00093C0: "__cdecl _imp_ProbeForWrite" __imp_ProbeForWrite
0x1C000CC30: FIStreamQueryInfo
0x1C0009050: "__cdecl _imp_FltReferenceContext" __imp_FltReferenceContext
0x1C0009370: "__cdecl _imp_EtwUnregister" __imp_EtwUnregister
0x1C0009068: "__cdecl _imp_FltAllocateExtraCreateParameterFromLookasideList" __imp_FltAllocateExtraCreateParameterFromLookasideList
0x1C0017000: "__cdecl _guard_fids_table" __guard_fids_table
0x1C0009278: "__cdecl _imp_ZwSetSecurityObject" __imp_ZwSetSecurityObject
0x1C00090D0: "__cdecl _imp_FltGetStreamContext" __imp_FltGetStreamContext
0x1C0004020: "__cdecl load_config_used" _load_config_used
0x1C00132B0: FIUnload
0x1C001340C: FIPfBlockedOpBlock
0x1C0004890: "Properties" ??_C@_1BG@COALCEMK@?$AAP?$AAr?$AAo?$AAp?$AAe?$AAr?$AAt?$AAi?$AAe?$AAs?$AA?$AA@
0x1C0009058: "__cdecl _imp_FltFindExtraCreateParameter" __imp_FltFindExtraCreateParameter
0x1C000C7F0: FIPfFilePfContextAllocate
0x1C0003664: FIPfUserOpenFind
0x1C000CB80: FIStreamGetNext
0x1C0009258: "__cdecl _imp_ZwClose" __imp_ZwClose
0x1C00130DC: FIReleaseFileInfos
0x1C0009388: "__cdecl _imp_ExAcquireRundownProtection" __imp_ExAcquireRundownProtection
0x1C0015B6C: CmRegUtilWstrValueSetFullBuffer
0x1C001490C: SepSddlAddAceToAcl
0x1C0015780: CmRegUtilCreateWstrKey
0x1C000335C: FIPostMoveFile
0x1C00093B8: IoFileObjectType
0x1C0009200: "__cdecl _imp_NtClose" __imp_NtClose
0x1C0009220: "__cdecl _imp_KeInitializeEvent" __imp_KeInitializeEvent
0x1C00091E8: "__cdecl _imp_ObOpenObjectByPointer" __imp_ObOpenObjectByPointer
0x1C0009090: "__cdecl _imp_FltInitExtraCreateParameterLookasideList" __imp_FltInitExtraCreateParameterLookasideList
0x1C00092E0: "__cdecl _imp_RtlGetSaclSecurityDescriptor" __imp_RtlGetSaclSecurityDescriptor
0x1C00048B8: "NoDisplayClass" ??_C@_1BO@DAOBINHA@?$AAN?$AAo?$AAD?$AAi?$AAs?$AAp?$AAl?$AAa?$AAy?$AAC?$AAl?$AAa?$AAs?$AAs?$AA?$AA@
0x1C00092F8: "__cdecl _imp_RtlGetDaclSecurityDescriptor" __imp_RtlGetDaclSecurityDescriptor
0x1C0009198: "__cdecl _imp_MmBadPointer" __imp_MmBadPointer
0x1C00155B0: PpRegStateUpdateStackCreationSettings
0x1C0009288: "__cdecl _imp_IoIsWdmVersionAvailable" __imp_IoIsWdmVersionAvailable
0x1C0004920: "DeviceCharacteristics" ??_C@_1CM@DIJFBEC@?$AAD?$AAe?$AAv?$AAi?$AAc?$AAe?$AAC?$AAh?$AAa?$AAr?$AAa?$AAc?$AAt?$AAe?$AAr?$AAi?$AAs?$AAt?$AAi?$AAc?$AAs?$AA?$AA@
0x1C0007200: PiRegStateSysAllInherittedSecurityDescriptor
0x1C0007A48: WdmlibInitialized
0x1C0009308: "__cdecl _imp_InitializeSListHead" __imp_InitializeSListHead
0x1C0009098: "__cdecl _imp_FltFreeGenericWorkItem" __imp_FltFreeGenericWorkItem
0x1C0009060: "__cdecl _imp_FltFreeCallbackData" __imp_FltFreeCallbackData
0x1C00157D4: CmRegUtilOpenExistingUcKey
0x1C0003490: FIPostOperationCommonCallback
0x1C00021A0: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x1C000FCB0: FIPfRegisterGlobalBlockNotify
0x1C0010084: WdmlibIoCreateDeviceSecure
0x1C00091D8: "__cdecl _imp_PsIsSystemThread" __imp_PsIsSystemThread
0x1C000C110: FIPostCleanupCallback
0x1C0009030: "__cdecl _imp_FltReissueSynchronousIo" __imp_FltReissueSynchronousIo
0x1C000F6AC: FIRegisterLogger
0x1C000BFA0: FIPfVolumeOpenAdd
0x1C00048A8: "Class" ??_C@_1M@OAHBGIFG@?$AAC?$AAl?$AAa?$AAs?$AAs?$AA?$AA@
0x1C000BDF0: FIStreamQueueQuery
0x1C000F0D8: FIPfFilePfContextReference
0x1C000E8E8: FIGetFileNameOptions
0x1C0009320: "__cdecl _imp_IoWMIRegistrationControl" __imp_IoWMIRegistrationControl
0x1C0015C0C: CmpRegUtilAllocateUnicodeString
0x1C00091D0: "__cdecl _imp_IoGetRelatedDeviceObject" __imp_IoGetRelatedDeviceObject
0x1C000CFE0: FIStreamLog
0x1C00046B0: "$RmMetadata" ??_C@_1BI@ICDMCLPB@?$AA$?$AAR?$AAm?$AAM?$AAe?$AAt?$AAa?$AAd?$AAa?$AAt?$AAa?$AA?$AA@
0x1C0009250: "__cdecl _imp_ZwQuerySystemInformation" __imp_ZwQuerySystemInformation
0x1C0009408: "__cdecl _imp_FsRtlIsPagingFile" __imp_FsRtlIsPagingFile
0x1C0013D04: FIPfOpenListNotifyConflictStart
0x1C0001930: FILockInitialize
0x1C0001F10: FIPreSetEACallback
0x1C0014F5C: SepSddlLookupAccessMaskInTable
0x1C0007080: "__cdecl _security_cookie" __security_cookie
0x1C00091A8: KdDebuggerEnabled
0x1C0015BC0: CmRegUtilWstrValueSetWstrString
0x1C000E680: FIPfOpenAttemptsOpenEnd
0x1C0009038: "__cdecl _imp_FltIsEcpFromUserMode" __imp_FltIsEcpFromUserMode
0x1C00046C8: SDDL_DEVOBJ_SYS_ALL_ADM_ALL_buffer
0x1C000F304: FIPfFileGetFileObjectPostFailedCreate
0x1C00046A0: "__cdecl _xmm@ffffffffffffffffffffffffffffffff" __xmm@ffffffffffffffffffffffffffffffff
0x1C0004950: "Exclusive" ??_C@_1BE@DJHAJDEM@?$AAE?$AAx?$AAc?$AAl?$AAu?$AAs?$AAi?$AAv?$AAe?$AA?$AA@
0x1C0010C30: FIAddPagefile
0x1C000DD60: FIPfInterfaceClose
0x1C00090D8: "__cdecl _imp_FltDeleteExtraCreateParameterLookasideList" __imp_FltDeleteExtraCreateParameterLookasideList
0x1C0009180: "__cdecl _imp_ProbeForRead" __imp_ProbeForRead
0x1C0009040: "__cdecl _imp_FltGetEcpListFromCallbackData" __imp_FltGetEcpListFromCallbackData
0x1C00158E8: CmRegUtilUcValueGetFullBuffer
0x1C000C00C: FIPfFileFSOpUnbufferedWriteStart
0x1C0009348: "__cdecl _imp_EtwWrite" __imp_EtwWrite
0x1C0009158: "__cdecl _imp_FltUnregisterFilter" __imp_FltUnregisterFilter
0x1C000F170: FIStreamSafeToQuery
0x1C00091A0: "__cdecl _imp__vsnwprintf" __imp__vsnwprintf
0x1C0009240: "__cdecl _imp_DbgPrint" __imp_DbgPrint
0x1C000E950: FIStreamCreate
0x1C00048D8: "NoUseClass" ??_C@_1BG@OPOOGLJC@?$AAN?$AAo?$AAU?$AAs?$AAe?$AAC?$AAl?$AAa?$AAs?$AAs?$AA?$AA@
0x1C000FB80: FIPreDirectoryControlCallback
0x1C000BB70: FIControlDispatch
0x1C0001900: FILockExclusiveAcquire
0x1C0016044: "__cdecl _security_init_cookie" __security_init_cookie
0x1C000DF80: FIPfInterfaceOpen
0x1C0009110: "__cdecl _imp_FltReferenceFileNameInformation" __imp_FltReferenceFileNameInformation
0x1C0009338: "__cdecl _imp_EtwRegister" __imp_EtwRegister
0x1C0001E60: FIPreQueryEACallback
0x1C0009410: "__cdecl _imp_RtlUpcaseUnicodeString" __imp_RtlUpcaseUnicodeString
0x1C0009198: MmBadPointer
0x1C00091F8: "__cdecl _imp_KeSetEvent" __imp_KeSetEvent
0x1C00110CC: FIPfVolumeRundownFilePrefetchStart
0x1C000D540: FIPostCreateCallback
0x1C000B5A0: FIVolumeQueueQuery
0x1C0010180: FIIterate
0x1C00090E8: "__cdecl _imp_FltGetVolumeFromInstance" __imp_FltGetVolumeFromInstance
0x1C000BA70: FIVolumeLog
0x1C0010EFC: SeUtilSecurityInfoFromSecurityDescriptor
0x1C0009270: IoDeviceObjectType
0x1C0009178: "__cdecl _imp_ExReleaseRundownProtection" __imp_ExReleaseRundownProtection
0x1C000487C: "GW" ??_C@_15KLKFDJD@?$AAG?$AAW?$AA?$AA@
0x1C00090A8: "__cdecl _imp_FltSetStreamContext" __imp_FltSetStreamContext
0x1C0009290: "__cdecl _imp_RtlLengthSid" __imp_RtlLengthSid
0x1C000C950: FIPfInterfaceQueryFile
0x1C0001EF0: FIPreSetSecurityCallback
0x1C0002180: "__cdecl _report_gsfailure" __report_gsfailure
0x1C00090B0: "__cdecl _imp_FltGetActivityIdCallbackData" __imp_FltGetActivityIdCallbackData
0x1C0013F30: FIPfUserOpenCleanup
0x1C00090A0: "__cdecl _imp_FltQueueGenericWorkItem" __imp_FltQueueGenericWorkItem
0x1C0010038: FIParametersFix
0x1C00093D0: "__cdecl _imp_ExQueryDepthSList" __imp_ExQueryDepthSList
0x1C00093F8: "__cdecl _imp_ZwCreateKey" __imp_ZwCreateKey
0x1C0013C20: FIPfFilePfLinkReference
0x1C00093B8: "__cdecl _imp_IoFileObjectType" __imp_IoFileObjectType
0x1C0009218: "__cdecl _imp_ZwSetInformationFile" __imp_ZwSetInformationFile
0x1C0004768: "FILEINFO: Please contact sprfetc" ??_C@_0DP@IPPBNKME@FILEINFO?3?5Please?5contact?5sprfetc@
0x1C00093E0: "__cdecl _imp_rand" __imp_rand
0x1C0009470: ntoskrnl_NULL_THUNK_DATA
0x1C0009328: "__cdecl _imp_ExFreePoolWithTag" __imp_ExFreePoolWithTag
0x1C000FCF0: FIGetRegistryParameters
0x1C0009458: "__cdecl _imp_KeEnterCriticalRegion" __imp_KeEnterCriticalRegion
0x1C0011410: FIEtwEnableCallback
0x1C00042F8: "FIFSOpMaxBlockTimeMs" ??_C@_1CK@FOMMGCJA@?$AAF?$AAI?$AAF?$AAS?$AAO?$AAp?$AAM?$AAa?$AAx?$AAB?$AAl?$AAo?$AAc?$AAk?$AAT?$AAi?$AAm?$AAe?$AAM?$AAs?$AA?$AA@
0x1C0009280: "__cdecl _imp_RtlSetDaclSecurityDescriptor" __imp_RtlSetDaclSecurityDescriptor
0x1C0016078: DriverEntry
0x1C000B6D8: FIVolumeCreate
0x1C0007240: FIGlobals
0x1C00156D8: CmRegUtilCreateUcKey
0x1C0009230: "__cdecl _imp_ExGetPreviousMode" __imp_ExGetPreviousMode
0x1C000F608: FIFileInfoStateChange
0x1C00093F0: "__cdecl _imp_ExWaitForRundownProtectionRelease" __imp_ExWaitForRundownProtectionRelease
0x1C0009188: "__cdecl _imp_ZwOpenKey" __imp_ZwOpenKey
0x1C001317C: FISfTracingStateUpdate
0x1C000BF0C: FIPfVolumeOpenRemove
0x1C0009190: "__cdecl _imp_DbgPrompt" __imp_DbgPrompt
0x1C000F714: FIPfOpenAttemptsRundownStart
0x1C00025C0: memset
0x1C00094B0: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x1C00091B8: "__cdecl _imp_PsIsThreadTerminating" __imp_PsIsThreadTerminating

[JEB Decompiler by PNF Software]