Generated by JEB on 2019/08/01

PE: C:\Windows\System32\RdpSaProxy.exe Base=0x140000000 SHA-256=FD58018194B07A634AD8F7D900BC8F97CA13D09A7C5064842D250A84F42D764D
PDB: RdpSaProxy.pdb GUID={CF63A1DA-EF76-E2FF-9E5B2522F3A45471} Age=1

300 located named symbols:
0x140005290: "__cdecl _imp_UnregisterTraceGuids" __imp_UnregisterTraceGuids
0x14000479C: "__cdecl _raise_securityfailure" __raise_securityfailure
0x1400045B0: "__cdecl FindPESection" _FindPESection
0x140001860: "public: virtual void * __ptr64 __cdecl COutOfProcFactory::`scalar deleting destructor'(unsigned int) __ptr64" ??_GCOutOfProcFactory@@UEAAPEAXI@Z
0x140005548: "__cdecl _imp_CoInitializeEx" __imp_CoInitializeEx
0x1400052C8: "__cdecl _imp_AddAce" __imp_AddAce
0x14000601C: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x140006058: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-com-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-com-l1-1-0
0x1400045A0: "__cdecl wsetargv" _wsetargv
0x140005568: "__cdecl _imp_CoInitializeSecurity" __imp_CoInitializeSecurity
0x140007070: "__cdecl _security_cookie_complement" __security_cookie_complement
0x1400054C8: "__cdecl _imp___wgetmainargs" __imp___wgetmainargs
0x140005878: IID_IRdpSessionAgentProxy
0x1400053A8: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x140002050: "public: virtual void * __ptr64 __cdecl CRdpSessionAgentProxy::`scalar deleting destructor'(unsigned int) __ptr64" ??_GCRdpSessionAgentProxy@@UEAAPEAXI@Z
0x1400039E8: "public: static long __cdecl CRdpSaUtils::s_ModifySystemAccessInDacl(void * __ptr64,void * __ptr64,unsigned long,unsigned long * __ptr64)" ?s_ModifySystemAccessInDacl@CRdpSaUtils@@SAJPEAX0KPEAK@Z
0x140001A50: "public: virtual long __cdecl COutOfProcFactory::LockServer(int) __ptr64" ?LockServer@COutOfProcFactory@@UEAAJH@Z
0x140001130: WppControlCallback
0x140003E58: "public: static long __cdecl CRdpSaShellUtils::s_GetKnownFolderFilePath(struct _GUID const & __ptr64,unsigned short const * __ptr64,unsigned __int64,unsigned short * __ptr64)" ?s_GetKnownFolderFilePath@CRdpSaShellUtils@@SAJAEBU_GUID@@PEBG_KPEAG@Z
0x140004A30: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x140005408: SHELL32_NULL_THUNK_DATA
0x140007080: "unsigned long g_originalProcessAccessMaskForSystem" ?g_originalProcessAccessMaskForSystem@@3KA
0x140006030: "__cdecl _IMPORT_DESCRIPTOR_OLEAUT32" __IMPORT_DESCRIPTOR_OLEAUT32
0x140007708: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxugvinhieUmvdhexUiwkhzUfgrohUlyquivUznwGEUkxsOlyq@RdpSaUtils" __@@_PchSym_@00@KxulyqvxgPillgKxugvinhieUmvdhexUiwkhzUfgrohUlyquivUznwGEUkxsOlyq@RdpSaUtils
0x140005560: "__cdecl _imp_CoRevokeClassObject" __imp_CoRevokeClassObject
0x1400070B8: "__cdecl commode" _commode
0x140002870: "public: virtual long __cdecl CRdpSessionAgentProxy::SetKey(unsigned short * __ptr64) __ptr64" ?SetKey@CRdpSessionAgentProxy@@UEAAJPEAG@Z
0x1400052D0: "__cdecl _imp_GetAce" __imp_GetAce
0x140005580: ole32_NULL_THUNK_DATA
0x140005370: "__cdecl _imp_HeapSetInformation" __imp_HeapSetInformation
0x140004480: "long __cdecl __CxxUnhandledExceptionFilter(struct _EXCEPTION_POINTERS * __ptr64)" ?__CxxUnhandledExceptionFilter@@YAJPEAU_EXCEPTION_POINTERS@@@Z
0x140005590: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x140005558: "__cdecl _imp_CoImpersonateClient" __imp_CoImpersonateClient
0x1400058B0: "m_pFactoryData->CreateInstance f" ??_C@_0CH@GCBAMJAI@m_pFactoryData?9?$DOCreateInstance?5f@
0x1400070C4: "__cdecl fmode" _fmode
0x140005868: WPP_cc388f3e9828378439b8c22081504a8b_Traceguids
0x1400011B8: wWinMain
0x1400076F8: "private: static class CRdpSessionAgentProxy * __ptr64 __ptr64 CRdpSessionAgentProxy::s_pSingleton" ?s_pSingleton@CRdpSessionAgentProxy@@0PEAV1@EA
0x140005900: "CoRegisterClassObject failed!" ??_C@_0BO@IKOMGJLL@CoRegisterClassObject?5failed?$CB?$AA@
0x1400076E0: "private: static class SlimRWLock CRdpSessionAgentProxy::s_lockSingleton" ?s_lockSingleton@CRdpSessionAgentProxy@@0VSlimRWLock@@A
0x140005418: "__cdecl _imp_DispatchMessageW" __imp_DispatchMessageW
0x140001860: "public: virtual void * __ptr64 __cdecl COutOfProcFactory::`vector deleting destructor'(unsigned int) __ptr64" ??_ECOutOfProcFactory@@UEAAPEAXI@Z
0x1400044DE: "__cdecl XcptFilter" _XcptFilter
0x140005598: "__cdecl _xc_a" __xc_a
0x140005770: "ModifySystemAccessInDacl failed!" ??_C@_0CB@DJPALCEI@ModifySystemAccessInDacl?5failed?$CB@
0x140005948: "RdpSa.exe" ??_C@_1BE@BGFEGOIC@?$AAR?$AAd?$AAp?$AAS?$AAa?$AA?4?$AAe?$AAx?$AAe?$AA?$AA@
0x140001760: "public: virtual long __cdecl COutOfProcFactory::QueryInterface(struct _GUID const & __ptr64,void * __ptr64 * __ptr64) __ptr64" ?QueryInterface@COutOfProcFactory@@UEAAJAEBU_GUID@@PEAPEAX@Z
0x140005388: "__cdecl _imp_GetStartupInfoW" __imp_GetStartupInfoW
0x140004957: "__cdecl lock" _lock
0x140005998: "spNewObject->Initialize failed!" ??_C@_0CA@MNEHALMO@spNewObject?9?$DOInitialize?5failed?$CB?$AA@
0x1400076F0: "public: static long COutOfProcFactory::s_cServerLocks" ?s_cServerLocks@COutOfProcFactory@@2JA
0x1400053E8: "__cdecl _imp_SysStringByteLen" __imp_SysStringByteLen
0x140002050: "public: virtual void * __ptr64 __cdecl CRdpSessionAgentProxy::`vector deleting destructor'(unsigned int) __ptr64" ??_ECRdpSessionAgentProxy@@UEAAPEAXI@Z
0x14000446D: "__cdecl callnewh" _callnewh
0x140001E10: "public: virtual long __cdecl CRdpSessionAgentProxy::QueryInterface(struct _GUID const & __ptr64,void * __ptr64 * __ptr64) __ptr64" ?QueryInterface@CRdpSessionAgentProxy@@UEAAJAEBU_GUID@@PEAPEAX@Z
0x140005688: "__cdecl _guard_iat_table" __guard_iat_table
0x140005508: "__cdecl _imp_memset" __imp_memset
0x140007704: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUgvinhieUiwkUdrmUhbhgvnUlyquivUznwGEUkxsOlyq@RdpWinSystem" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUgvinhieUiwkUdrmUhbhgvnUlyquivUznwGEUkxsOlyq@RdpWinSystem
0x14000476F: "__cdecl initterm" _initterm
0x140005268: "__cdecl _imp_TraceMessage" __imp_TraceMessage
0x140007730: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x140005380: "__cdecl _imp_Sleep" __imp_Sleep
0x1400055D8: "__cdecl _xi_z" __xi_z
0x1400053C0: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x140005888: IID_IRdpSessionAgent
0x14000477B: "__cdecl _C_specific_handler" __C_specific_handler
0x140005068: "const COutOfProcFactory::`vftable'" ??_7COutOfProcFactory@@6B@
0x140005328: "__cdecl _imp_ReleaseSRWLockExclusive" __imp_ReleaseSRWLockExclusive
0x1400052F8: "__cdecl _imp_AddAccessAllowedAce" __imp_AddAccessAllowedAce
0x140005458: "__cdecl _imp__onexit" __imp__onexit
0x140007678: WPP_REGISTRATION_GUIDS
0x140004461: malloc
0x140002710: "public: virtual long __cdecl CRdpSessionAgentProxy::GetSessionAgentProcessHandle(__int64 * __ptr64) __ptr64" ?GetSessionAgentProcessHandle@CRdpSessionAgentProxy@@UEAAJPEA_J@Z
0x1400049AC: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x140005350: "__cdecl _imp_GetModuleHandleExA" __imp_GetModuleHandleExA
0x140007650: WPP_MAIN_CB
0x140004593: "__cdecl amsg_exit" _amsg_exit
0x1400054E0: "__cdecl _imp__callnewh" __imp__callnewh
0x140005A30: WPP_d9d6405fcc2a3b83fa0f52be2eb17b4a_Traceguids
0x140005A50: IID_IClassFactory
0x140005578: "__cdecl _imp_CoRegisterClassObject" __imp_CoRegisterClassObject
0x140001DC0: "public: virtual long __cdecl CTSUnknown::NonDelegatingQueryInterface(struct _GUID const & __ptr64,void * __ptr64 * __ptr64) __ptr64" ?NonDelegatingQueryInterface@CTSUnknown@@UEAAJAEBU_GUID@@PEAPEAX@Z
0x1400056F0: TRACE_ENT
0x1400054B8: "__cdecl _imp_exit" __imp_exit
0x140005500: "__cdecl _imp__lock" __imp__lock
0x1400053F0: OLEAUT32_NULL_THUNK_DATA
0x140005A80: "SHGetKnownFolderPath" ??_C@_0BF@OMOLCJCE@SHGetKnownFolderPath?$AA@
0x140004438: atexit
0x140005A08: "CRdpSaUtils::s_CheckTokenUser fa" ??_C@_0CG@FDOJLLMH@CRdpSaUtils?3?3s_CheckTokenUser?5fa@
0x140005830: "EventActivityIdControl" ??_C@_0BH@HMPLKEEO@EventActivityIdControl?$AA@
0x140005570: "__cdecl _imp_CoUninitialize" __imp_CoUninitialize
0x140005488: "__cdecl _imp__wcmdln" __imp__wcmdln
0x140005270: "__cdecl _imp_GetTraceLoggerHandle" __imp_GetTraceLoggerHandle
0x140005278: "__cdecl _imp_GetTraceEnableLevel" __imp_GetTraceEnableLevel
0x140005348: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x140005700: TRACE_INF
0x14000496F: "__cdecl _dllonexit" __dllonexit
0x1400052D8: "__cdecl _imp_AddAccessDeniedAce" __imp_AddAccessDeniedAce
0x140003280: "[thunk]:public: virtual unsigned long __cdecl CRdpSessionAgentProxy::AddRef`adjustor{8}' (void) __ptr64" ?AddRef@CRdpSessionAgentProxy@@W7EAAKXZ
0x140007710: "__cdecl _native_startup_lock" __native_startup_lock
0x1400044C0: "__cdecl _CxxSetUnhandledExceptionFilter" __CxxSetUnhandledExceptionFilter
0x140005490: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x140005530: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x1400076E8: "public: static struct HINSTANCE__ * __ptr64 __ptr64 COutOfProcFactory::s_hInstance" ?s_hInstance@COutOfProcFactory@@2PEAUHINSTANCE__@@EA
0x1400053D0: KERNEL32_NULL_THUNK_DATA
0x140005368: "__cdecl _imp_GetLastError" __imp_GetLastError
0x140003F6C: "void * __ptr64 __cdecl operator new(unsigned __int64)" ??2@YAPEAX_K@Z
0x140004988: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x1400054F8: "__cdecl _imp_memcmp" __imp_memcmp
0x1400056C0: WPP_ThisDir_CTLGUID_RdpSa
0x140005478: "__cdecl _imp__commode" __imp__commode
0x140001E50: "public: virtual unsigned long __cdecl CRdpSessionAgentProxy::Release(void) __ptr64" ?Release@CRdpSessionAgentProxy@@UEAAKXZ
0x1400054A0: "__cdecl _imp___setusermatherr" __imp___setusermatherr
0x1400052B0: "__cdecl _imp_EqualSid" __imp_EqualSid
0x140005FB8: "__cdecl _IMPORT_DESCRIPTOR_ADVAPI32" __IMPORT_DESCRIPTOR_ADVAPI32
0x1400059B8: "User not authorized" ??_C@_0BE@KNLKPDIF@User?5not?5authorized?$AA@
0x140001A70: "public: static long __cdecl COutOfProcFactory::s_StartFactories(struct HINSTANCE__ * __ptr64)" ?s_StartFactories@COutOfProcFactory@@SAJPEAUHINSTANCE__@@@Z
0x1400017A0: "public: virtual unsigned long __cdecl COutOfProcFactory::Release(void) __ptr64" ?Release@COutOfProcFactory@@UEAAKXZ
0x140005318: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x1400059D0: "CreateShadowInvitation failed!" ??_C@_0BP@FMGFMGDG@CreateShadowInvitation?5failed?$CB?$AA@
0x140004350: wWinMainCRTStartup
0x140005550: "__cdecl _imp_CoRevertToSelf" __imp_CoRevertToSelf
0x140004660: "__cdecl ValidateImageBase" _ValidateImageBase
0x140005A40: IID_IUnknown
0x140001DA0: "public: virtual long __cdecl CTSObject::Initialize(void) __ptr64" ?Initialize@CTSObject@@UEAAJXZ
0x140003250: "[thunk]:public: virtual unsigned long __cdecl CRdpSessionAgentProxy::Release`adjustor{8}' (void) __ptr64" ?Release@CRdpSessionAgentProxy@@W7EAAKXZ
0x1400056B0: TRACE_EXIT
0x140002128: "public: long __cdecl CRdpSessionAgentProxy::Initialize(struct HINSTANCE__ * __ptr64) __ptr64" ?Initialize@CRdpSessionAgentProxy@@QEAAJPEAUHINSTANCE__@@@Z
0x140005100: "const CRdpSessionAgentProxy::`vftable'{for `IRdpSessionAgentProxy'}" ??_7CRdpSessionAgentProxy@@6BIRdpSessionAgentProxy@@@
0x140006008: "__cdecl _IMPORT_DESCRIPTOR_ole32" __IMPORT_DESCRIPTOR_ole32
0x140005360: "__cdecl _imp_FreeLibrary" __imp_FreeLibrary
0x140002E90: "public: virtual long __cdecl CRdpSessionAgentProxy::NotifyInitializationComplete(void) __ptr64" ?NotifyInitializationComplete@CRdpSessionAgentProxy@@UEAAJXZ
0x140005330: "__cdecl _imp_AcquireSRWLockExclusive" __imp_AcquireSRWLockExclusive
0x140005320: "__cdecl _imp_ProcessIdToSessionId" __imp_ProcessIdToSessionId
0x140002320: "public: static long __cdecl CRdpSessionAgentProxy::s_CreateInstance(struct HINSTANCE__ * __ptr64,struct IUnknown * __ptr64,struct IUnknown * __ptr64 * __ptr64)" ?s_CreateInstance@CRdpSessionAgentProxy@@SAJPEAUHINSTANCE__@@PEAUIUnknown@@PEAPEAU3@@Z
0x1400070C0: "__cdecl newmode" _newmode
0x140005498: "__cdecl _imp__initterm" __imp__initterm
0x1400054C0: "__cdecl _imp___set_app_type" __imp___set_app_type
0x1400057B8: "CoInitializeEx failed!" ??_C@_0BH@LINEJBNA@CoInitializeEx?5failed?$CB?$AA@
0x140005A60: FOLDERID_System
0x14000606C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-path-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-path-l1-1-0
0x1400057D0: "CoInitializeSecurity failed!" ??_C@_0BN@BDHDCMEK@CoInitializeSecurity?5failed?$CB?$AA@
0x140005428: "__cdecl _imp_GetMessageW" __imp_GetMessageW
0x140007720: "__cdecl _onexitend" __onexitend
0x1400054B0: "__cdecl _imp__exit" __imp__exit
0x140004963: "__cdecl unlock" _unlock
0x140005588: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x140001F30: "void __cdecl RevertToOriginalSystemAccess(unsigned long)" ?RevertToOriginalSystemAccess@@YAXK@Z
0x140005720: "NULL" ??_C@_04HIBGFPH@NULL?$AA@
0x1400053C8: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x140005430: USER32_NULL_THUNK_DATA
0x140001D60: "public: virtual void * __ptr64 __cdecl CTSObject::`vector deleting destructor'(unsigned int) __ptr64" ??_ECTSObject@@UEAAPEAXI@Z
0x1400052A8: "__cdecl _imp_GetTokenInformation" __imp_GetTokenInformation
0x140005518: "__cdecl _imp_EtwEventRegister" __imp_EtwEventRegister
0x1400055C0: "__cdecl _xi_a" __xi_a
0x1400053B8: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x1400045A0: "__cdecl matherr" _matherr
0x140005468: "__cdecl _imp__unlock" __imp__unlock
0x140005438: "__cdecl _imp_CoTaskMemFree" __imp_CoTaskMemFree
0x140001054: WPP_SF_DD
0x140001054: WPP_SF_Dd
0x1400056E0: TRACE_ERR
0x140007000: WPP_GLOBAL_Control
0x140005A98: "PathCchCombine" ??_C@_0P@OACMJJFK@PathCchCombine?$AA@
0x140001D50: "[thunk]:public: virtual void * __ptr64 __cdecl CTSUnknown::`vector deleting destructor'`adjustor{8}' (unsigned int) __ptr64" ??_ECTSUnknown@@W7EAAPEAXI@Z
0x140005460: "__cdecl _imp___dllonexit" __imp___dllonexit
0x140005048: "const CTSObject::`vftable'" ??_7CTSObject@@6B@
0x140003F60: "void __cdecl operator delete(void * __ptr64)" ??3@YAXPEAX@Z
0x140005820: "Advapi32.dll" ??_C@_0N@DOHINHCI@Advapi32?4dll?$AA@
0x140004380: "__cdecl _security_check_cookie" __security_check_cookie
0x1400055B8: "__cdecl _xc_z" __xc_z
0x140003768: "public: static long __cdecl CRdpSaUtils::s_CheckTokenUser(void * __ptr64,enum WELL_KNOWN_SID_TYPE,int * __ptr64)" ?s_CheckTokenUser@CRdpSaUtils@@SAJPEAXW4WELL_KNOWN_SID_TYPE@@PEAH@Z
0x140005358: "__cdecl _imp_GetProcAddress" __imp_GetProcAddress
0x140001C70: "[thunk]:public: virtual void * __ptr64 __cdecl COutOfProcFactory::`vector deleting destructor'`adjustor{8}' (unsigned int) __ptr64" ??_ECOutOfProcFactory@@W7EAAPEAXI@Z
0x1400058D8: "pNewComponent->QueryInterface fa" ??_C@_0CG@JOGGPMGF@pNewComponent?9?$DOQueryInterface?5fa@
0x1400057F0: "COutOfProcFactory::s_StartFactor" ??_C@_0CM@HBPMGDAK@COutOfProcFactory?3?3s_StartFactor@
0x140005470: "__cdecl _imp_?terminate@@YAXXZ" __imp_?terminate@@YAXXZ
0x1400053B0: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x140005378: "__cdecl _imp_LocalAlloc" __imp_LocalAlloc
0x140001D60: "public: virtual void * __ptr64 __cdecl CTSObject::`scalar deleting destructor'(unsigned int) __ptr64" ??_GCTSObject@@UEAAPEAXI@Z
0x140007640: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxugvinhieUmvdhexUiwkhzUkilcbUlyquivUznwGEUkivxlnkrovwOlyq@RdpSaProxy" __@@_PchSym_@00@KxulyqvxgPillgKxugvinhieUmvdhexUiwkhzUkilcbUlyquivUznwGEUkivxlnkrovwOlyq@RdpSaProxy
0x140005448: "__cdecl _imp_PathCchCombine" __imp_PathCchCombine
0x1400055E0: "__cdecl _guard_fids_table" __guard_fids_table
0x140005710: TRACE_WRN
0x1400052B8: "__cdecl _imp_CreateWellKnownSid" __imp_CreateWellKnownSid
0x140005510: msvcrt_NULL_THUNK_DATA
0x1400056A0: S_TermService
0x140005160: "__cdecl load_config_used" _load_config_used
0x140001C80: "public: virtual unsigned long __cdecl CTSUnknown::NonDelegatingAddRef(void) __ptr64" ?NonDelegatingAddRef@CTSUnknown@@UEAAKXZ
0x140005420: "__cdecl _imp_PostQuitMessage" __imp_PostQuitMessage
0x140002CD0: "public: virtual long __cdecl CRdpSessionAgentProxy::Unadvise(unsigned short * __ptr64) __ptr64" ?Unadvise@CRdpSessionAgentProxy@@UEAAJPEAG@Z
0x140005690: TRACE_FATAL
0x140005FE0: "__cdecl _IMPORT_DESCRIPTOR_USER32" __IMPORT_DESCRIPTOR_USER32
0x140005140: "const CRdpSessionAgentProxy::`vftable'{for `IRdpSessionAgent'}" ??_7CRdpSessionAgentProxy@@6BIRdpSessionAgent@@@
0x140001DB0: "public: virtual long __cdecl CTSObject::Terminate(void) __ptr64" ?Terminate@CTSObject@@UEAAJXZ
0x1400054D0: "__cdecl _imp__amsg_exit" __imp__amsg_exit
0x1400050C8: "const CRdpSessionAgentProxy::`vftable'{for `CTSObject'}" ??_7CRdpSessionAgentProxy@@6BCTSObject@@@
0x140005960: "CRdpSaComUtils::s_GetKnownFolder" ??_C@_0DB@NPHGAGAG@CRdpSaComUtils?3?3s_GetKnownFolder@
0x140005920: WPP_d017747f08ba3c0c0e116606256045fa_Traceguids
0x140005898: "COutOfProcFactory" ??_C@_0BC@JGPECBGD@COutOfProcFactory?$AA@
0x140005528: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x1400053A0: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x140005798: "RestrictProcessDacl failed!" ??_C@_0BM@OAGAHFAH@RestrictProcessDacl?5failed?$CB?$AA@
0x1400070BC: "__cdecl dowildcard" _dowildcard
0x140001E30: "public: virtual unsigned long __cdecl CRdpSessionAgentProxy::AddRef(void) __ptr64" ?AddRef@CRdpSessionAgentProxy@@UEAAKXZ
0x140005338: "__cdecl _imp_InitializeSRWLock" __imp_InitializeSRWLock
0x140004455: free
0x140005930: "CRdpSessionAgentProxy" ??_C@_0BG@JDIIOFBO@CRdpSessionAgentProxy?$AA@
0x140005090: "const COutOfProcFactory::`vftable'{for `CTSObject'}" ??_7COutOfProcFactory@@6BCTSObject@@@
0x1400016D4: "unsigned int __cdecl RdpWppGetCurrentThreadActivityIdPrefix(void)" ?RdpWppGetCurrentThreadActivityIdPrefix@@YAIXZ
0x140005520: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x140003270: "[thunk]:public: virtual void * __ptr64 __cdecl CRdpSessionAgentProxy::`vector deleting destructor'`adjustor{24}' (unsigned int) __ptr64" ??_ECRdpSessionAgentProxy@@WBI@EAAPEAXI@Z
0x140003290: "public: static long __cdecl CRdpSaUtils::s_RestrictProcessDacl(void * __ptr64,void * __ptr64)" ?s_RestrictProcessDacl@CRdpSaUtils@@SAJPEAX0@Z
0x1400059F0: "CoImpersonateClient" ??_C@_0BE@LENMDAB@CoImpersonateClient?$AA@
0x140004790: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x140004A0D: memcmp
0x140001780: "public: virtual unsigned long __cdecl COutOfProcFactory::AddRef(void) __ptr64" ?AddRef@COutOfProcFactory@@UEAAKXZ
0x1400044EC: RtlpImageNtHeader
0x140001CAC: "public: virtual void * __ptr64 __cdecl CTSUnknown::`vector deleting destructor'(unsigned int) __ptr64" ??_ECTSUnknown@@UEAAPEAXI@Z
0x140007010: "class COutOfProcFactoryData * g_rgFactoryData" ?g_rgFactoryData@@3PAVCOutOfProcFactoryData@@A
0x140005398: "__cdecl _imp_GetModuleHandleW" __imp_GetModuleHandleW
0x140005410: "__cdecl _imp_TranslateMessage" __imp_TranslateMessage
0x1400054D8: "__cdecl _imp__XcptFilter" __imp__XcptFilter
0x140005748: "RdpSessionAgent.1.0" ??_C@_1CI@OMPAEELN@?$AAR?$AAd?$AAp?$AAS?$AAe?$AAs?$AAs?$AAi?$AAo?$AAn?$AAA?$AAg?$AAe?$AAn?$AAt?$AA?4?$AA1?$AA?4?$AA0?$AA?$AA@
0x140005540: ntdll_NULL_THUNK_DATA
0x140001E70: "public: virtual long __cdecl CRdpSessionAgentProxy::NonDelegatingQueryInterface(struct _GUID const & __ptr64,void * __ptr64 * __ptr64) __ptr64" ?NonDelegatingQueryInterface@CRdpSessionAgentProxy@@UEAAJAEBU_GUID@@PEAPEAX@Z
0x14000109C: WPP_SF_DsD
0x1400017C0: "public: virtual long __cdecl COutOfProcFactory::NonDelegatingQueryInterface(struct _GUID const & __ptr64,void * __ptr64 * __ptr64) __ptr64" ?NonDelegatingQueryInterface@COutOfProcFactory@@UEAAJAEBU_GUID@@PEAPEAX@Z
0x140005538: "__cdecl _imp_EtwEventUnregister" __imp_EtwEventUnregister
0x1400052F0: "__cdecl _imp_GetSecurityInfo" __imp_GetSecurityInfo
0x140005280: "__cdecl _imp_GetTraceEnableFlags" __imp_GetTraceEnableFlags
0x140005288: "__cdecl _imp_RegisterTraceGuidsW" __imp_RegisterTraceGuidsW
0x140007068: "__cdecl _security_cookie" __security_cookie
0x140001D90: "public: virtual int __cdecl CTSObject::IsValid(void) __ptr64" ?IsValid@CTSObject@@UEAAHXZ
0x140002590: "public: virtual long __cdecl CRdpSessionAgentProxy::CreateShadowInvitation(unsigned short * __ptr64,enum SHADOW_CONTROL_REQUEST,enum SHADOW_PERMISSION_REQUEST,enum SHADOW_REQUEST_RESPONSE * __ptr64,unsigned short * __ptr64 * __ptr64) __ptr64" ?CreateShadowInvitation@CRdpSessionAgentProxy@@UEAAJPEAGW4SHADOW_CONTROL_REQUEST@@W4SHADOW_PERMISSION_REQUEST@@PEAW4SHADOW_REQUEST_RESPONSE@@PEAPEAG@Z
0x140005340: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x140005010: "const CTSUnknown::`vftable'{for `INonDelegatingUnknown'}" ??_7CTSUnknown@@6BINonDelegatingUnknown@@@
0x140005308: "__cdecl _imp_LocalFree" __imp_LocalFree
0x1400052E8: "__cdecl _imp_GetLengthSid" __imp_GetLengthSid
0x140007060: "__cdecl _defaultmatherr" __defaultmatherr
0x140005440: api-ms-win-core-com-l1-1-0_NULL_THUNK_DATA
0x140003260: "[thunk]:public: virtual long __cdecl CRdpSessionAgentProxy::QueryInterface`adjustor{8}' (struct _GUID const & __ptr64,void * __ptr64 * __ptr64) __ptr64" ?QueryInterface@CRdpSessionAgentProxy@@W7EAAJAEBU_GUID@@PEAPEAX@Z
0x140007680: "private: static class CrimsonHelper CrimsonHelper::s_instance" ?s_instance@CrimsonHelper@@0V1@A
0x140007728: "__cdecl _onexitbegin" __onexitbegin
0x140005858: CLSID_RdpSessionAgent
0x140005390: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x140005310: "__cdecl _imp_GetCurrentThread" __imp_GetCurrentThread
0x1400018B0: "public: virtual long __cdecl COutOfProcFactory::CreateInstance(struct IUnknown * __ptr64,struct _GUID const & __ptr64,void * __ptr64 * __ptr64) __ptr64" ?CreateInstance@COutOfProcFactory@@UEAAJPEAUIUnknown@@AEBU_GUID@@PEAPEAX@Z
0x140005028: "const CTSUnknown::`vftable'{for `CTSObject'}" ??_7CTSUnknown@@6BCTSObject@@@
0x140002A90: "public: virtual long __cdecl CRdpSessionAgentProxy::Advise(unsigned short * __ptr64,struct IRdpSessionAgent * __ptr64) __ptr64" ?Advise@CRdpSessionAgentProxy@@UEAAJPEAGPEAUIRdpSessionAgent@@@Z
0x140005FCC: "__cdecl _IMPORT_DESCRIPTOR_KERNEL32" __IMPORT_DESCRIPTOR_KERNEL32
0x140005728: "RdpSessionAgent" ??_C@_1CA@NJLKNILF@?$AAR?$AAd?$AAp?$AAS?$AAe?$AAs?$AAs?$AAi?$AAo?$AAn?$AAA?$AAg?$AAe?$AAn?$AAt?$AA?$AA@
0x140005A70: WPP_8680567bb90d34a661d71d2e41dc7be4_Traceguids
0x140004694: "__cdecl _security_init_cookie" __security_init_cookie
0x1400054A8: "__cdecl _imp__cexit" __imp__cexit
0x140004548: "__cdecl get_image_app_type" _get_image_app_type
0x140001CAC: "public: virtual void * __ptr64 __cdecl CTSUnknown::`scalar deleting destructor'(unsigned int) __ptr64" ??_GCTSUnknown@@UEAAPEAXI@Z
0x140005FF4: "__cdecl _IMPORT_DESCRIPTOR_msvcrt" __IMPORT_DESCRIPTOR_msvcrt
0x1400052C0: "__cdecl _imp_SetSecurityInfo" __imp_SetSecurityInfo
0x1400054E8: "__cdecl _imp_malloc" __imp_malloc
0x140005300: ADVAPI32_NULL_THUNK_DATA
0x1400047E0: "__cdecl _report_gsfailure" __report_gsfailure
0x1400043A4: "__cdecl onexit" _onexit
0x140007718: "__cdecl _native_startup_state" __native_startup_state
0x1400053E0: "__cdecl _imp_SysAllocStringByteLen" __imp_SysAllocStringByteLen
0x140005400: "__cdecl _imp_SHGetKnownFolderPath" __imp_SHGetKnownFolderPath
0x140005AA8: WPP_b724107cf4f33ef055f82e55630bf5af_Traceguids
0x1400050B0: "const COutOfProcFactory::`vftable'{for `INonDelegatingUnknown'}" ??_7COutOfProcFactory@@6BINonDelegatingUnknown@@@
0x140001CF0: "public: virtual unsigned long __cdecl CTSUnknown::NonDelegatingRelease(void) __ptr64" ?NonDelegatingRelease@CTSUnknown@@UEAAKXZ
0x140005450: api-ms-win-core-path-l1-1-0_NULL_THUNK_DATA
0x1400053F8: "__cdecl _imp_ShellExecuteExW" __imp_ShellExecuteExW
0x140006044: "__cdecl _IMPORT_DESCRIPTOR_SHELL32" __IMPORT_DESCRIPTOR_SHELL32
0x140005480: "__cdecl _imp__fmode" __imp__fmode
0x1400052A0: "__cdecl _imp_OpenThreadToken" __imp_OpenThreadToken
0x140002EB8: "private: long __cdecl CRdpSessionAgentProxy::AccessCheckWellKnownUser(enum WELL_KNOWN_SID_TYPE) __ptr64" ?AccessCheckWellKnownUser@CRdpSessionAgentProxy@@AEAAJW4WELL_KNOWN_SID_TYPE@@@Z
0x1400052E0: "__cdecl _imp_InitializeAcl" __imp_InitializeAcl
0x1400053D8: "__cdecl _imp_SysFreeString" __imp_SysFreeString
0x1400050E8: "const CRdpSessionAgentProxy::`vftable'{for `INonDelegatingUnknown'}" ??_7CRdpSessionAgentProxy@@6BINonDelegatingUnknown@@@
0x1400054F0: "__cdecl _imp_free" __imp_free
0x140004600: "__cdecl IsNonwritableInCurrentImage" _IsNonwritableInCurrentImage
0x140005298: "__cdecl _imp_OpenProcessToken" __imp_OpenProcessToken
0x140004A19: memset
0x140006080: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x1400056D0: TRACE_DUMP
0x140007700: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUgvinhieUiwkkozgulinUxlnnlmUwvekozgulinUkozgPrmwUdrmDCfUlyquivUznwGEUwvekozgkozgkrkxsOlyq@piplatformu" __@@_PchSym_@00@KxulyqvxgPillgKxulmvxlivUgvinhieUiwkkozgulinUxlnnlmUwvekozgulinUkozgPrmwUdrmDCfUlyquivUznwGEUwvekozgkozgkrkxsOlyq@piplatformu

[JEB Decompiler by PNF Software]