Generated by JEB on 2019/08/01

PE: C:\Windows\System32\efsui.exe Base=0x140000000 SHA-256=FE57813687D951FFA8ACC02BD4CA2AD8D7D4BC70584072DB66C46A404186DDF3
PDB: efsui.pdb GUID={2F744E00-E019-28F4-ADD95AC7318F9CD0} Age=1

158 located named symbols:
0x140003490: "/installdra" ??_C@_1BI@NFICAHKD@?$AA?1?$AAi?$AAn?$AAs?$AAt?$AAa?$AAl?$AAl?$AAd?$AAr?$AAa?$AA?$AA@
0x140003438: "/selectcard" ??_C@_1BI@CMMIJEBB@?$AA?1?$AAs?$AAe?$AAl?$AAe?$AAc?$AAt?$AAc?$AAa?$AAr?$AAd?$AA?$AA@
0x14000211C: "__cdecl _raise_securityfailure" __raise_securityfailure
0x140001F30: "__cdecl FindPESection" _FindPESection
0x140003990: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x140003160: "__cdecl _imp_EfsUIUtilInstallDra" __imp_EfsUIUtilInstallDra
0x140003410: "/setkey" ??_C@_1BA@JAEDMNJL@?$AA?1?$AAs?$AAe?$AAt?$AAk?$AAe?$AAy?$AA?$AA@
0x1400017D0: "long __cdecl EfsUIpGetUserSidString(unsigned short * __ptr64 * __ptr64)" ?EfsUIpGetUserSidString@@YAJPEAPEAG@Z
0x1400032C0: "__cdecl _imp___getmainargs" __imp___getmainargs
0x140005010: "__cdecl _security_cookie_complement" __security_cookie_complement
0x14000397C: "__cdecl _IMPORT_DESCRIPTOR_EFSUTIL" __IMPORT_DESCRIPTOR_EFSUTIL
0x140003238: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x14000196C: WinMain
0x1400022F0: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x1400031F0: SHELL32_NULL_THUNK_DATA
0x1400013F0: "long __cdecl EfsUIpIsAnotherInstanceRunning(unsigned long,int * __ptr64,unsigned char * __ptr64,unsigned long)" ?EfsUIpIsAnotherInstanceRunning@@YAJKPEAHPEAEK@Z
0x140003148: "__cdecl _imp_CertFreeCertificateContext" __imp_CertFreeCertificateContext
0x1400031E8: "__cdecl _imp_CommandLineToArgvW" __imp_CommandLineToArgvW
0x140005600: g_ulAdditionalProbeSize
0x140005048: "__cdecl commode" _commode
0x140001E00: "long __cdecl __CxxUnhandledExceptionFilter(struct _EXCEPTION_POINTERS * __ptr64)" ?__CxxUnhandledExceptionFilter@@YAJPEAU_EXCEPTION_POINTERS@@@Z
0x140003348: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x140005054: "__cdecl fmode" _fmode
0x140001E5E: "__cdecl XcptFilter" _XcptFilter
0x140003350: "__cdecl _xc_a" __xc_a
0x140003220: "__cdecl _imp_GetStartupInfoW" __imp_GetStartupInfoW
0x140003190: EFSADU_NULL_THUNK_DATA
0x1400032A8: "__cdecl _imp__acmdln" __imp__acmdln
0x1400020EF: "__cdecl initterm" _initterm
0x140003954: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0
0x1400055F8: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x140003278: "__cdecl _imp_Sleep" __imp_Sleep
0x140003380: "__cdecl _xi_z" __xi_z
0x1400031F8: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x1400031A8: "__cdecl _imp_GetCommandLineW" __imp_GetCommandLineW
0x1400020FB: "__cdecl _C_specific_handler" __C_specific_handler
0x1400033B0: "Local\{A55C3BEE-5BFF-4c61-8833-3" ??_C@_1FK@KEEOFEOH@?$AAL?$AAo?$AAc?$AAa?$AAl?$AA?2?$AA?$HL?$AAA?$AA5?$AA5?$AAC?$AA3?$AAB?$AAE?$AAE?$AA?9?$AA5?$AAB?$AAF?$AAF?$AA?9?$AA4?$AAc?$AA6?$AA1?$AA?9?$AA8?$AA8?$AA3?$AA3?$AA?9?$AA3@
0x140001F13: "__cdecl amsg_exit" _amsg_exit
0x1400034E0: "%s%s%s" ??_C@_1O@JBBHAGJJ@?$AA?$CF?$AAs?$AA?$CF?$AAs?$AA?$CF?$AAs?$AA?$AA@
0x1400034A8: "/encryptmydocs" ??_C@_1BO@PKOHKGNF@?$AA?1?$AAe?$AAn?$AAc?$AAr?$AAy?$AAp?$AAt?$AAm?$AAy?$AAd?$AAo?$AAc?$AAs?$AA?$AA@
0x140003300: "__cdecl _imp_exit" __imp_exit
0x140001008: "long __cdecl DoPinPrompt(unsigned short * __ptr64 * __ptr64,int)" ?DoPinPrompt@@YAJPEAPEAGH@Z
0x1400034F0: "/efs" ??_C@_19JNAPICDO@?$AA?1?$AAe?$AAf?$AAs?$AA?$AA@
0x140003208: api-ms-win-core-errorhandling-l1-1-0_NULL_THUNK_DATA
0x1400031B0: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x140003178: "__cdecl _imp_EfsUIUtilPromptForPin" __imp_EfsUIUtilPromptForPin
0x1400055E8: "__cdecl _native_startup_lock" __native_startup_lock
0x140001E40: "__cdecl _CxxSetUnhandledExceptionFilter" __CxxSetUnhandledExceptionFilter
0x1400032D0: "__cdecl _imp__wcsicmp" __imp__wcsicmp
0x1400032B0: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x140003260: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x140003218: api-ms-win-core-libraryloader-l1-2-0_NULL_THUNK_DATA
0x1400031E0: KERNEL32_NULL_THUNK_DATA
0x1400031B8: "__cdecl _imp_GetLastError" __imp_GetLastError
0x140003120: "__cdecl _imp_ConvertSidToStringSidW" __imp_ConvertSidToStringSidW
0x1400032A0: "__cdecl _imp__commode" __imp__commode
0x1400032F0: "__cdecl _imp___setusermatherr" __imp___setusermatherr
0x14000388C: "__cdecl _IMPORT_DESCRIPTOR_ADVAPI32" __IMPORT_DESCRIPTOR_ADVAPI32
0x140003228: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x140001FE0: "__cdecl ValidateImageBase" _ValidateImageBase
0x14000392C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0
0x140003170: "__cdecl _imp_EfsUIUtilShowBalloonAndWait" __imp_EfsUIUtilShowBalloonAndWait
0x140005050: "__cdecl newmode" _newmode
0x1400032E8: "__cdecl _imp__initterm" __imp__initterm
0x1400032F8: "__cdecl _imp___set_app_type" __imp___set_app_type
0x140001F20: "__cdecl setargv" _setargv
0x140003150: CRYPT32_NULL_THUNK_DATA
0x1400055D8: "__cdecl _onexitend" __onexitend
0x140003308: "__cdecl _imp__exit" __imp__exit
0x140003340: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x140003230: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x140003198: "__cdecl _imp_EfsUtilGetCurrentKey" __imp_EfsUtilGetCurrentKey
0x140003118: "__cdecl _imp_GetTokenInformation" __imp_GetTokenInformation
0x140003298: api-ms-win-core-sysinfo-l1-1-0_NULL_THUNK_DATA
0x140003368: "__cdecl _xi_a" __xi_a
0x140003290: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x140001F20: "__cdecl matherr" _matherr
0x1400034C8: "%s-%u-%s" ??_C@_1BC@HBACOIEJ@?$AA?$CF?$AAs?$AA?9?$AA?$CF?$AAu?$AA?9?$AA?$CF?$AAs?$AA?$AA@
0x140003180: "__cdecl _imp_EfsUIUtilEnrollEfsCertificate" __imp_EfsUIUtilEnrollEfsCertificate
0x1400038C8: "__cdecl _IMPORT_DESCRIPTOR_EFSADU" __IMPORT_DESCRIPTOR_EFSADU
0x140003904: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0
0x1400031C0: "__cdecl _imp_CreateMutexW" __imp_CreateMutexW
0x140001DD0: "__cdecl _security_check_cookie" __security_check_cookie
0x140003360: "__cdecl _xc_z" __xc_z
0x140003240: api-ms-win-core-processthreads-l1-1-0_NULL_THUNK_DATA
0x1400032B8: "__cdecl _imp_?terminate@@YAXXZ" __imp_?terminate@@YAXXZ
0x140003288: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x1400031D0: "__cdecl _imp_LocalAlloc" __imp_LocalAlloc
0x140003270: api-ms-win-core-rtlsupport-l1-1-0_NULL_THUNK_DATA
0x140003138: "__cdecl _imp_CryptBinaryToStringW" __imp_CryptBinaryToStringW
0x140003140: "__cdecl _imp_CryptStringToBinaryW" __imp_CryptStringToBinaryW
0x14000149C: "long __cdecl EfsUIpConstructMutexName(unsigned long,unsigned short * __ptr64 * __ptr64,unsigned char * __ptr64,unsigned long)" ?EfsUIpConstructMutexName@@YAJKPEAPEAGPEAEK@Z
0x140003968: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0
0x140003250: api-ms-win-core-profile-l1-1-0_NULL_THUNK_DATA
0x140003388: "__cdecl _guard_fids_table" __guard_fids_table
0x140003328: msvcrt_NULL_THUNK_DATA
0x140003010: "__cdecl load_config_used" _load_config_used
0x1400038DC: "__cdecl _IMPORT_DESCRIPTOR_CRYPT32" __IMPORT_DESCRIPTOR_CRYPT32
0x140003168: "__cdecl _imp_EfsUIUtilSelectCard" __imp_EfsUIUtilSelectCard
0x140003320: "__cdecl _imp__amsg_exit" __imp__amsg_exit
0x1400018EC: "long __cdecl StringCchPrintfW(unsigned short * __ptr64,unsigned __int64,unsigned short const * __ptr64,...)" ?StringCchPrintfW@@YAJPEAG_KPEBGZZ
0x140003258: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x140003248: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x14000504C: "__cdecl dowildcard" _dowildcard
0x140003480: "/enroll" ??_C@_1BA@LGDNJGJH@?$AA?1?$AAe?$AAn?$AAr?$AAo?$AAl?$AAl?$AA?$AA@
0x140003468: "/keybackup" ??_C@_1BG@EGEMOPBK@?$AA?1?$AAk?$AAe?$AAy?$AAb?$AAa?$AAc?$AAk?$AAu?$AAp?$AA?$AA@
0x140003268: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x140003420: "/certhash" ??_C@_1BE@FJAEIILK@?$AA?1?$AAc?$AAe?$AAr?$AAt?$AAh?$AAa?$AAs?$AAh?$AA?$AA@
0x140002110: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x140001E6C: RtlpImageNtHeader
0x140003158: "__cdecl _imp_EfsUIUtilEncryptMyDocuments" __imp_EfsUIUtilEncryptMyDocuments
0x1400031A0: EFSUTIL_NULL_THUNK_DATA
0x140003210: "__cdecl _imp_GetModuleHandleW" __imp_GetModuleHandleW
0x140003330: "__cdecl _imp_RtlImageNtHeader" __imp_RtlImageNtHeader
0x1400032C8: "__cdecl _imp__XcptFilter" __imp__XcptFilter
0x140003338: ntdll_NULL_THUNK_DATA
0x140003318: "__cdecl _imp__ismbblead" __imp__ismbblead
0x140005008: "__cdecl _security_cookie" __security_cookie
0x1400055D0: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxuwhUhvxfirgbUvuhUvuhfrUlyquivUznwGEUkivxlnkOlyq@efsui" __@@_PchSym_@00@KxulyqvxgPillgKxuwhUhvxfirgbUvuhUvuhfrUlyquivUznwGEUkivxlnkOlyq@efsui
0x1400031C8: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x1400031D8: "__cdecl _imp_LocalFree" __imp_LocalFree
0x140005000: "__cdecl _defaultmatherr" __defaultmatherr
0x140003918: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0
0x1400055E0: "__cdecl _onexitbegin" __onexitbegin
0x1400032E0: "__cdecl _imp__vsnwprintf" __imp__vsnwprintf
0x140003200: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x140001B60: WinMainCRTStartup
0x1400038A0: "__cdecl _IMPORT_DESCRIPTOR_KERNEL32" __IMPORT_DESCRIPTOR_KERNEL32
0x140003188: "__cdecl _imp_EfsUIUtilKeyBackup" __imp_EfsUIUtilKeyBackup
0x140002014: "__cdecl _security_init_cookie" __security_init_cookie
0x1400011C8: "void __cdecl DoEfs(unsigned short * __ptr64 * __ptr64,int)" ?DoEfs@@YAXPEAPEAGH@Z
0x140003310: "__cdecl _imp__cexit" __imp__cexit
0x140001EC8: "__cdecl get_image_app_type" _get_image_app_type
0x1400038B4: "__cdecl _IMPORT_DESCRIPTOR_msvcrt" __IMPORT_DESCRIPTOR_msvcrt
0x140003130: ADVAPI32_NULL_THUNK_DATA
0x140002160: "__cdecl _report_gsfailure" __report_gsfailure
0x1400055F0: "__cdecl _native_startup_state" __native_startup_state
0x1400039A4: "__cdecl _IMPORT_DESCRIPTOR_SHELL32" __IMPORT_DESCRIPTOR_SHELL32
0x1400032D8: "__cdecl _imp__fmode" __imp__fmode
0x140003940: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0
0x140003450: "/pinprompt" ??_C@_1BG@GMHJEIIG@?$AA?1?$AAp?$AAi?$AAn?$AAp?$AAr?$AAo?$AAm?$AAp?$AAt?$AA?$AA@
0x140001F80: "__cdecl IsNonwritableInCurrentImage" _IsNonwritableInCurrentImage
0x140003280: api-ms-win-core-synch-l1-2-0_NULL_THUNK_DATA
0x140003128: "__cdecl _imp_OpenProcessToken" __imp_OpenProcessToken
0x1400038F0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0
0x1400039B8: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR

[JEB Decompiler by PNF Software]