Generated by JEB on 2019/08/01
PE: C:\Windows\System32\dimsroam.dll Base=0x180000000 SHA-256=FF1202EEE357C3A00EE3C1789FF2A42319EF90F419D86C714D2EDE564ABBF89C
PDB: dimsroam.pdb GUID={01C92A71-26AB-B88B-B225EDF30FCA1E1B} Age=1
365 located named symbols:
0x1800060EC: FilterPolicyUpdateCheck
0x18000779C: "__cdecl _raise_securityfailure" __raise_securityfailure
0x1800091B0: api-ms-win-core-file-l1-1-0_NULL_THUNK_DATA
0x1800093E0: "__cdecl _imp_EtwUnregisterTraceGuids" __imp_EtwUnregisterTraceGuids
0x1800075B0: "__cdecl FindPESection" _FindPESection
0x180007D92: "__cdecl _imp_load_CryptDestroyKey" __imp_load_CryptDestroyKey
0x1800098D8: DRR_LOG_ERROR_NETSTOREWRITE
0x180006FF0: "__cdecl _delayLoadHelper2" __delayLoadHelper2
0x18000AAF4: "__cdecl _IMPORT_DESCRIPTOR_ntdll" __IMPORT_DESCRIPTOR_ntdll
0x180007C0A: "__cdecl _tailMerge_dsrole_dll" __tailMerge_dsrole_dll
0x18000A668: DSROLE_NULL_THUNK_DATA_DLN
0x1800098C8: DRR_LOG_ERROR_STATEFILEREAD
0x18000E098: DSROLE_NULL_THUNK_DATA_DLA
0x18000A8F0: DSROLE_NULL_THUNK_DATA_DLB
0x18000C020: "__cdecl _security_cookie_complement" __security_cookie_complement
0x1800033E8: "int __cdecl _drr_MarshalKeyProvInfoContextProperty(struct _CERT_CONTEXT const * __ptr64,void * __ptr64 * __ptr64,unsigned long * __ptr64)" ?_drr_MarshalKeyProvInfoContextProperty@@YAHPEBU_CERT_CONTEXT@@PEAPEAXPEAK@Z
0x180009500: "__cdecl _sz_DSROLE_dll" __sz_DSROLE_dll
0x180009A18: WPP_de881cee005f38aa5ff98c1b3bec41c3_Traceguids
0x18000707C: "__cdecl CRT_INIT" _CRT_INIT
0x180009228: "__cdecl _imp_GetCurrentThreadId" __imp_GetCurrentThreadId
0x180001070: WppControlCallback
0x180007E60: "__cdecl guard_dispatch_icall_nop" _guard_dispatch_icall_nop
0x180009390: "__cdecl _imp_wcscspn" __imp_wcscspn
0x18000A678: USERENV_NULL_THUNK_DATA_DLN
0x18000E000: "__cdecl _imp_CertFreeCertificateContext" __imp_CertFreeCertificateContext
0x1800091A8: "__cdecl _imp_CreateFileW" __imp_CreateFileW
0x180005FCC: myRetrieveLogLevel
0x180009A28: "
" ??_C@_15JNBOKNOG@?$AA?$AN?$AA?6?$AA?$AA@
0x180009668: "__cdecl GUID_435eb1b8_b681_4569_b862_551e13764315" _GUID_435eb1b8_b681_4569_b862_551e13764315
0x18000E080: CRYPTSP_NULL_THUNK_DATA_DLA
0x18000C5F0: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxuwhUdrmDCUmgxibkglUpvbilznCUwrnhilznUlyquivUznwGEUkivxlnkOlyq@dimsroam" __@@_PchSym_@00@KxulyqvxgPillgKxuwhUdrmDCUmgxibkglUpvbilznCUwrnhilznUlyquivUznwGEUkivxlnkOlyq@dimsroam
0x180009400: "__cdecl _imp_EtwGetTraceLoggerHandle" __imp_EtwGetTraceLoggerHandle
0x180009CF0: "__cdecl _pfnDliFailureHook2" __pfnDliFailureHook2
0x18000C5D8: "__cdecl _hmod__USERENV_dll" __hmod__USERENV_dll
0x18000AA90: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-file-l1-1-0
0x180002C04: DRR_WriteState
0x1800091E0: api-ms-win-core-heap-l2-1-0_NULL_THUNK_DATA
0x18000A880: api-ms-win-security-sddl-l1-1-0_NULL_THUNK_DATA_DLB
0x18000E060: "__cdecl _imp_CryptReleaseContext" __imp_CryptReleaseContext
0x180009B58: DRR_POLICY_ROAM_SCCERTS
0x180009428: "__cdecl _guard_dispatch_icall_fptr" __guard_dispatch_icall_fptr
0x1800098B8: DRR_LOG_ERROR_STATEFILEWRITE
0x1800091F8: "__cdecl _imp_FormatMessageW" __imp_FormatMessageW
0x1800033C0: "int __cdecl CmpEKUOIDs(void const * __ptr64,void const * __ptr64)" ?CmpEKUOIDs@@YAHPEBX0@Z
0x1800091A0: "__cdecl _imp_SetFilePointer" __imp_SetFilePointer
0x180007590: "__cdecl XcptFilter" _XcptFilter
0x18000E020: "__cdecl _imp_CertAddSerializedElementToStore" __imp_CertAddSerializedElementToStore
0x180009430: "__cdecl _xc_a" __xc_a
0x180007B4F: "__cdecl _imp_load_CertOpenStore" __imp_load_CertOpenStore
0x18000A908: CRYPTSP_NULL_THUNK_DATA_DLB
0x18000A510: "__cdecl _DELAY_IMPORT_DESCRIPTOR_api_ms_win_core_com_l1_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_api_ms_win_core_com_l1_1_0_dll
0x180009658: "__cdecl GUID_ff8a71c2_7eb8_418b_950d_3b49f43f024f" _GUID_ff8a71c2_7eb8_418b_950d_3b49f43f024f
0x18000AA18: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-timezone-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-timezone-l1-1-0
0x180009948: DRR_LOG_SUCCESS_HEAL
0x180009938: DRR_LOG_WARNING_CONFLICT
0x18000E0C8: api-ms-win-security-sddl-l1-1-0_NULL_THUNK_DATA_DLA
0x18000E078: "__cdecl _imp_CryptHashData" __imp_CryptHashData
0x18000E010: "__cdecl _imp_CertOpenStore" __imp_CertOpenStore
0x180009190: "__cdecl _imp_DeleteFileW" __imp_DeleteFileW
0x180009488: "__cdecl _guard_iat_table" __guard_iat_table
0x18000E068: "__cdecl _imp_CryptAcquireContextW" __imp_CryptAcquireContextW
0x180007E35: memcpy
0x1800093B8: "__cdecl _imp_memset" __imp_memset
0x18000776F: "__cdecl initterm" _initterm
0x18000AA40: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-sysinfo-l1-1-0
0x18000C6F8: "__cdecl _dyn_tls_init_callback" __dyn_tls_init_callback
0x1800092F0: "__cdecl _imp_Sleep" __imp_Sleep
0x180009450: "__cdecl _xi_z" __xi_z
0x180009308: "__cdecl _imp_GetSystemTime" __imp_GetSystemTime
0x180009138: "__cdecl _imp_UnhandledExceptionFilter" __imp_UnhandledExceptionFilter
0x180009410: "__cdecl _imp_EtwRegisterTraceGuidsW" __imp_EtwRegisterTraceGuidsW
0x18000777B: "__cdecl _C_specific_handler" __C_specific_handler
0x1800097E8: DRR_REG_VALUE_DISABLED
0x180007CA7: "__cdecl _tailMerge_cryptsp_dll" __tailMerge_cryptsp_dll
0x18000C6C0: WPP_REGISTRATION_GUIDS
0x180007D38: "__cdecl _imp_load_CryptCreateHash" __imp_load_CryptCreateHash
0x180009388: "__cdecl _imp__wtoi" __imp__wtoi
0x1800091C0: api-ms-win-core-handle-l1-1-0_NULL_THUNK_DATA
0x1800092C8: "__cdecl _imp_InitializeCriticalSectionAndSpinCount" __imp_InitializeCriticalSectionAndSpinCount
0x180009AA8: "AEEventLogLevel" ??_C@_1CA@ICANKNCD@?$AAA?$AAE?$AAE?$AAv?$AAe?$AAn?$AAt?$AAL?$AAo?$AAg?$AAL?$AAe?$AAv?$AAe?$AAl?$AA?$AA@
0x180009288: "__cdecl _imp_RegCloseKey" __imp_RegCloseKey
0x180007DC8: "__cdecl _GSHandlerCheckCommon" __GSHandlerCheckCommon
0x18000A608: CRYPT32_NULL_THUNK_DATA_DLN
0x1800092C0: api-ms-win-core-string-l1-1-0_NULL_THUNK_DATA
0x18000C698: WPP_MAIN_CB
0x180001674: DRR_InitRoaming
0x18000AA04: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-security-base-l1-1-0
0x18000E058: "__cdecl _imp_CryptGetUserKey" __imp_CryptGetUserKey
0x180009268: "__cdecl _imp_RegSetValueExW" __imp_RegSetValueExW
0x18000759C: "__cdecl amsg_exit" _amsg_exit
0x180009CE8: "__cdecl _DefaultResolveDelayLoadedAPIFlags" __DefaultResolveDelayLoadedAPIFlags
0x1800093B0: "__cdecl _imp_iswdigit" __imp_iswdigit
0x18000C6D0: "__cdecl _@@_PchSym_@00@KxulyqvxgPillgKxuwhUdrmDCUmgxibkglUpvbilznCUhgliztvkilerwvihUxivwilznfgroUlyquivUznwGEUkivxlnkOlyq@credroamutil" __@@_PchSym_@00@KxulyqvxgPillgKxuwhUdrmDCUmgxibkglUpvbilznCUhgliztvkilerwvihUxivwilznfgroUlyquivUznwGEUkivxlnkOlyq@credroamutil
0x180009A90: "LogLevel" ??_C@_1BC@CBHKINIM@?$AAL?$AAo?$AAg?$AAL?$AAe?$AAv?$AAe?$AAl?$AA?$AA@
0x18000C5C8: "__cdecl _hmod__api_ms_win_core_com_l1_1_0_dll" __hmod__api_ms_win_core_com_l1_1_0_dll
0x180009968: DIMS_ROAM_LOG
0x18000C5C0: "__cdecl _hmod__api_ms_win_security_sddl_l1_1_0_dll" __hmod__api_ms_win_security_sddl_l1_1_0_dll
0x180007D4A: "__cdecl _imp_load_CryptHashData" __imp_load_CryptHashData
0x180007BFE: "__cdecl _imp_load_DsRoleGetPrimaryDomainInformation" __imp_load_DsRoleGetPrimaryDomainInformation
0x18000146C: DRR_GetStateFile
0x18000C5D0: "__cdecl _hmod__CRYPT32_dll" __hmod__CRYPT32_dll
0x180009510: "__cdecl _sz_CRYPTSP_dll" __sz_CRYPTSP_dll
0x180009648: "__cdecl GUID_062c7f3f_5d6c_426b_95d9_69dddcf524ad" _GUID_062c7f3f_5d6c_426b_95d9_69dddcf524ad
0x180009160: "__cdecl _imp_SetEndOfFile" __imp_SetEndOfFile
0x180009AD0: "\AppData\Local\Microsoft\DIMS\cr" ??_C@_1FK@HILEJILM@?$AA?2?$AAA?$AAp?$AAp?$AAD?$AAa?$AAt?$AAa?$AA?2?$AAL?$AAo?$AAc?$AAa?$AAl?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAD?$AAI?$AAM?$AAS?$AA?2?$AAc?$AAr@
0x1800092E0: "__cdecl _imp_EnterCriticalSection" __imp_EnterCriticalSection
0x180009290: api-ms-win-core-registry-l1-1-0_NULL_THUNK_DATA
0x180009158: api-ms-win-core-errorhandling-l1-1-0_NULL_THUNK_DATA
0x180009898: DRR_LOG_ERROR_NOATTRIBUTE
0x180009210: "__cdecl _imp_GetCurrentProcess" __imp_GetCurrentProcess
0x18000E018: "__cdecl _imp_CryptHashCertificate" __imp_CryptHashCertificate
0x180006088: "__cdecl RetrieveLogLevel" _RetrieveLogLevel
0x1800095E8: "LastSucceedTimestamp" ??_C@_1CK@NMHCPLNA@?$AAL?$AAa?$AAs?$AAt?$AAS?$AAu?$AAc?$AAc?$AAe?$AAe?$AAd?$AAT?$AAi?$AAm?$AAe?$AAs?$AAt?$AAa?$AAm?$AAp?$AA?$AA@
0x18000A550: "__cdecl _DELAY_IMPORT_DESCRIPTOR_USERENV_dll" __DELAY_IMPORT_DESCRIPTOR_USERENV_dll
0x180009878: WPP_197ec3cc31cb389b2761023047111617_Traceguids
0x18000C6E8: "__cdecl _native_startup_lock" __native_startup_lock
0x1800024F4: DllMain
0x180002E78: "void __cdecl _drr_UninitChangeSet(struct DRR_CHANGE_SET * __ptr64)" ?_drr_UninitChangeSet@@YAXPEAUDRR_CHANGE_SET@@@Z
0x180009258: "__cdecl _imp_RegOpenCurrentUser" __imp_RegOpenCurrentUser
0x18000AAE0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-string-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-string-l1-1-0
0x180009398: "__cdecl _imp_wcscat_s" __imp_wcscat_s
0x18000652C: "__cdecl drr_IsEncryptionCert" _drr_IsEncryptionCert
0x180009350: "__cdecl _imp___C_specific_handler" __imp___C_specific_handler
0x1800032A0: "unsigned long __cdecl _drr_AdjustNetChangeSet(struct DRR_CHANGE_SET * __ptr64,struct DRR_ROAMING_TOKEN_SET * __ptr64,struct IRoamLocalStore * __ptr64,struct DRR_ROAMING_TOKEN_SET * __ptr64)" ?_drr_AdjustNetChangeSet@@YAKPEAUDRR_CHANGE_SET@@PEAUDRR_ROAMING_TOKEN_SET@@PEAUIRoamLocalStore@@1@Z
0x1800092A0: "__cdecl _imp_RtlCaptureContext" __imp_RtlCaptureContext
0x1800091F0: api-ms-win-core-libraryloader-l1-2-0_NULL_THUNK_DATA
0x18000E008: "__cdecl _imp_CertCloseStore" __imp_CertCloseStore
0x18000E028: "__cdecl _imp_CertGetEnhancedKeyUsage" __imp_CertGetEnhancedKeyUsage
0x180009150: "__cdecl _imp_GetLastError" __imp_GetLastError
0x18000E0C0: "__cdecl _imp_ConvertSidToStringSidW" __imp_ConvertSidToStringSidW
0x18000E070: "__cdecl _imp_CryptDestroyHash" __imp_CryptDestroyHash
0x18000C010: "__cdecl _native_dllmain_reason" __native_dllmain_reason
0x180007DA4: "__cdecl _GSHandlerCheck" __GSHandlerCheck
0x1800094C0: "__cdecl _sz_api_ms_win_core_com_l1_1_0_dll" __sz_api_ms_win_core_com_l1_1_0_dll
0x180009408: "__cdecl _imp_EtwTraceMessage" __imp_EtwTraceMessage
0x180009358: "__cdecl _imp_memcmp" __imp_memcmp
0x1800068A8: DRR_SecureFreeRoamingToken
0x18000A688: api-ms-win-core-com-l1-1-0_NULL_THUNK_DATA_DLN
0x18000A890: api-ms-win-core-com-l1-1-0_NULL_THUNK_DATA_DLB
0x18000E0B8: api-ms-win-core-com-l1-1-0_NULL_THUNK_DATA_DLA
0x18000AB1C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-0
0x180009230: "__cdecl _imp_GetCurrentProcessId" __imp_GetCurrentProcessId
0x180009580: "Software\Microsoft\Windows NT\Cu" ??_C@_1GE@NCAEGIAP@?$AAS?$AAo?$AAf?$AAt?$AAw?$AAa?$AAr?$AAe?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAW?$AAi?$AAn?$AAd?$AAo?$AAw?$AAs?$AA?5?$AAN?$AAT?$AA?2?$AAC?$AAu@
0x180009CE8: "__cdecl _ResolveDelayLoadedAPIFlags" __ResolveDelayLoadedAPIFlags
0x180007660: "__cdecl ValidateImageBase" _ValidateImageBase
0x180006C58: DRR_GetRoamingTokenFromSet
0x180009958: DRR_LOG_SUCCESS
0x1800068E0: DRR_UninitRoamingTokenSet
0x180009198: "__cdecl _imp_FlushFileBuffers" __imp_FlushFileBuffers
0x18000AA7C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-libraryloader-l1-2-0
0x1800064B0: "__cdecl drr_IsEncryptionKey" _drr_IsEncryptionKey
0x180001008: WPP_SF_
0x180006B38: DRR_CreateDirectory
0x18000A5B0: "__cdecl _NULL_DELAY_IMPORT_DESCRIPTOR" __NULL_DELAY_IMPORT_DESCRIPTOR
0x180006758: DRR_InsertAnyGrowableArray
0x180009B30: DRR_POLICY_ROAM_UNAFF_DPAPI_KEYS
0x1800072C0: "__cdecl DllMainCRTStartup" _DllMainCRTStartup
0x1800093A0: "__cdecl _imp_iswspace" __imp_iswspace
0x180009380: "__cdecl _imp__initterm" __imp__initterm
0x180009148: "__cdecl _imp_SetLastError" __imp_SetLastError
0x180003624: "int __cdecl _drr_MarshalEKUContextProperty(struct _CERT_CONTEXT const * __ptr64,void * __ptr64 * __ptr64,unsigned long * __ptr64)" ?_drr_MarshalEKUContextProperty@@YAHPEBU_CERT_CONTEXT@@PEAPEAXPEAK@Z
0x18000AB08: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-1" __IMPORT_DESCRIPTOR_api-ms-win-core-delayload-l1-1-1
0x18000A9B4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-registry-l1-1-0
0x180006DF8: DRR_WtoI
0x1800098E8: DRR_LOG_ERROR_NETSTOREREAD
0x18000C6D8: "__cdecl _onexitend" __onexitend
0x180009420: "__cdecl _guard_check_icall_fptr" __guard_check_icall_fptr
0x180007D5C: "__cdecl _imp_load_CryptGetHashParam" __imp_load_CryptGetHashParam
0x1800099C8: "NULL" ??_C@_04HIBGFPH@NULL?$AA@
0x180009238: "__cdecl _imp_TerminateProcess" __imp_TerminateProcess
0x180009330: "__cdecl _imp_GetTokenInformation" __imp_GetTokenInformation
0x1800093E8: "__cdecl _imp_EtwEventRegister" __imp_EtwEventRegister
0x18000A8A0: CRYPT32_NULL_THUNK_DATA_DLB
0x1800079F1: "__cdecl _imp_load_CoCreateInstance" __imp_load_CoCreateInstance
0x180009318: api-ms-win-core-sysinfo-l1-1-0_NULL_THUNK_DATA
0x180009440: "__cdecl _xi_a" __xi_a
0x180002CB0: DRR_HashState
0x180009310: "__cdecl _imp_GetTickCount" __imp_GetTickCount
0x180009128: "__cdecl _imp_ResolveDelayLoadedAPI" __imp_ResolveDelayLoadedAPI
0x180009338: api-ms-win-security-base-l1-1-0_NULL_THUNK_DATA
0x18000C000: WPP_GLOBAL_Control
0x1800099D0: "" ??_C@_11LOCGONAA@?$AA?$AA@
0x18000A9DC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-processthreads-l1-1-0
0x180009888: WPP_ThisDir_CTLGUID_CtlGuid
0x18000102C: WPP_SF_D
0x18000C700: "__cdecl pRawDllMain" _pRawDllMain
0x180007D6E: "__cdecl _imp_load_CryptDestroyHash" __imp_load_CryptDestroyHash
0x1800033B0: "int __cdecl CmpProvParams(void const * __ptr64,void const * __ptr64)" ?CmpProvParams@@YAHPEBX0@Z
0x18000702C: "void __cdecl operator delete(void * __ptr64)" ??3@YAXPEAX@Z
0x180007C89: "__cdecl _imp_load_DsRoleFreeMemory" __imp_load_DsRoleFreeMemory
0x180007966: "__cdecl _imp_load_ConvertSidToStringSidW" __imp_load_ConvertSidToStringSidW
0x1800092D0: "__cdecl _imp_DeleteCriticalSection" __imp_DeleteCriticalSection
0x180007560: "__cdecl _security_check_cookie" __security_check_cookie
0x180009438: "__cdecl _xc_z" __xc_z
0x18000E088: "__cdecl _imp_DsRoleGetPrimaryDomainInformation" __imp_DsRoleGetPrimaryDomainInformation
0x18000A9C8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-heap-l2-1-0
0x180009240: api-ms-win-core-processthreads-l1-1-0_NULL_THUNK_DATA
0x180006928: DRR_AddRoamingTokenToSet
0x18000E0A0: "__cdecl _imp_GetUserProfileDirectoryW" __imp_GetUserProfileDirectoryW
0x18000E050: "__cdecl _imp_CryptCreateHash" __imp_CryptCreateHash
0x180005F48: "__cdecl LogErrorCodeAndText" _LogErrorCodeAndText
0x180003A58: "unsigned long __cdecl _drr_AdjustChangeSet(struct DRR_CHANGE_SET * __ptr64,struct IUnknown * __ptr64,int)" ?_drr_AdjustChangeSet@@YAKPEAUDRR_CHANGE_SET@@PEAUIUnknown@@H@Z
0x18000E0B0: "__cdecl _imp_CoCreateInstance" __imp_CoCreateInstance
0x180007D26: "__cdecl _imp_load_CryptReleaseContext" __imp_load_CryptReleaseContext
0x180009300: "__cdecl _imp_GetSystemTimeAsFileTime" __imp_GetSystemTimeAsFileTime
0x1800091D8: "__cdecl _imp_LocalAlloc" __imp_LocalAlloc
0x1800093F8: "__cdecl _imp_EtwGetTraceEnableLevel" __imp_EtwGetTraceEnableLevel
0x180009118: "__cdecl _imp_DelayLoadFailureHook" __imp_DelayLoadFailureHook
0x18000E040: "__cdecl _imp_CryptGetHashParam" __imp_CryptGetHashParam
0x180007B19: "__cdecl _imp_load_CertAddSerializedElementToStore" __imp_load_CertAddSerializedElementToStore
0x1800098F8: DRR_LOG_ERROR_LOCSTOREWRITE
0x1800092B8: "__cdecl _imp_FoldStringW" __imp_FoldStringW
0x1800093D8: "__cdecl _imp_EtwEventEnabled" __imp_EtwEventEnabled
0x18000A570: "__cdecl _DELAY_IMPORT_DESCRIPTOR_DSROLE_dll" __DELAY_IMPORT_DESCRIPTOR_DSROLE_dll
0x180009170: "__cdecl _imp_CreateDirectoryW" __imp_CreateDirectoryW
0x1800092B0: api-ms-win-core-rtlsupport-l1-1-0_NULL_THUNK_DATA
0x1800094F0: "__cdecl _sz_USERENV_dll" __sz_USERENV_dll
0x180006694: IsTokenType
0x180009320: "__cdecl _imp_SystemTimeToFileTime" __imp_SystemTimeToFileTime
0x18000E048: "__cdecl _imp_CryptDestroyKey" __imp_CryptDestroyKey
0x180007B73: "__cdecl _imp_load_GetUserProfileDirectoryW" __imp_load_GetUserProfileDirectoryW
0x18000AAB8: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-rtlsupport-l1-1-0
0x180009250: api-ms-win-core-profile-l1-1-0_NULL_THUNK_DATA
0x180009458: "__cdecl _guard_fids_table" __guard_fids_table
0x1800093A8: "__cdecl _imp_iswxdigit" __imp_iswxdigit
0x180009918: DRR_LOG_ERROR_FAILED
0x180006D28: DRR_IsValidPastTime
0x1800093C0: msvcrt_NULL_THUNK_DATA
0x180009010: "__cdecl load_config_used" _load_config_used
0x18000A4F0: "__cdecl _DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_sddl_l1_1_0_dll" __DELAY_IMPORT_DESCRIPTOR_api_ms_win_security_sddl_l1_1_0_dll
0x180009130: api-ms-win-core-delayload-l1-1-1_NULL_THUNK_DATA
0x180009120: api-ms-win-core-delayload-l1-1-0_NULL_THUNK_DATA
0x180007D80: "__cdecl _imp_load_CryptGetUserKey" __imp_load_CryptGetUserKey
0x1800037F4: "unsigned long __cdecl _drr_GetCertificateHash(struct DRR_ROAMING_TOKEN const * __ptr64,unsigned char * __ptr64,unsigned long * __ptr64)" ?_drr_GetCertificateHash@@YAKPEBUDRR_ROAMING_TOKEN@@PEAEPEAK@Z
0x180009340: "__cdecl _imp_qsort" __imp_qsort
0x180009638: "__cdecl GUID_f91b9abc_985b_4c04_b5e7_9c7099fc2cda" _GUID_f91b9abc_985b_4c04_b5e7_9c7099fc2cda
0x180009368: "__cdecl _imp__amsg_exit" __imp__amsg_exit
0x18000E038: CRYPT32_NULL_THUNK_DATA_DLA
0x1800091E8: "__cdecl _imp_DisableThreadLibraryCalls" __imp_DisableThreadLibraryCalls
0x1800099B8: WPP_18486e52a3b7307f19ca2b438bb04bde_Traceguids
0x180005934: DRR_ForceDownload
0x180002280: DimsRoamEntry
0x1800092A8: "__cdecl _imp_RtlLookupFunctionEntry" __imp_RtlLookupFunctionEntry
0x180009248: "__cdecl _imp_QueryPerformanceCounter" __imp_QueryPerformanceCounter
0x1800093F0: "__cdecl _imp_EtwGetTraceEnableFlags" __imp_EtwGetTraceEnableFlags
0x18000A590: "__cdecl _DELAY_IMPORT_DESCRIPTOR_CRYPTSP_dll" __DELAY_IMPORT_DESCRIPTOR_CRYPTSP_dll
0x180009B90: DRR_POLICY_ROAM_UNAFF_KEYS
0x180007584: free
0x180002D8C: WPP_SF_sDd
0x180007A88: "__cdecl _tailMerge_crypt32_dll" __tailMerge_crypt32_dll
0x180009298: "__cdecl _imp_RtlVirtualUnwind" __imp_RtlVirtualUnwind
0x180009CF0: "__cdecl _pfnDefaultDliFailureHook2" __pfnDefaultDliFailureHook2
0x180009520: "Microsoft Enhanced Cryptographic" ??_C@_1FO@GBKEFGLF@?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?5?$AAE?$AAn?$AAh?$AAa?$AAn?$AAc?$AAe?$AAd?$AA?5?$AAC?$AAr?$AAy?$AAp?$AAt?$AAo?$AAg?$AAr?$AAa?$AAp?$AAh?$AAi?$AAc@
0x18000A530: "__cdecl _DELAY_IMPORT_DESCRIPTOR_CRYPT32_dll" __DELAY_IMPORT_DESCRIPTOR_CRYPT32_dll
0x180007972: "__cdecl _tailMerge_api_ms_win_security_sddl_l1_1_0_dll" __tailMerge_api_ms_win_security_sddl_l1_1_0_dll
0x180007790: "__cdecl guard_check_icall_nop" _guard_check_icall_nop
0x180009200: api-ms-win-core-localization-l1-2-0_NULL_THUNK_DATA
0x180007E29: memcmp
0x1800091D0: "__cdecl _imp_LocalReAlloc" __imp_LocalReAlloc
0x1800079FD: "__cdecl _tailMerge_api_ms_win_core_com_l1_1_0_dll" __tailMerge_api_ms_win_core_com_l1_1_0_dll
0x18000AA2C: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-handle-l1-1-0
0x180007A7C: "__cdecl _imp_load_CertGetCertificateContextProperty" __imp_load_CertGetCertificateContextProperty
0x180009CD8: WPP_95596e7e712e3fe1e6dccd93cce9e794_Traceguids
0x180009BC0: DRR_POLICY_KEY
0x180009370: "__cdecl _imp__XcptFilter" __imp__XcptFilter
0x180009418: ntdll_NULL_THUNK_DATA
0x180009348: "__cdecl _imp_memcpy" __imp_memcpy
0x1800093D0: "__cdecl _imp_EtwEventUnregister" __imp_EtwEventUnregister
0x18000C5E8: "__cdecl _hmod__CRYPTSP_dll" __hmod__CRYPTSP_dll
0x18000AA68: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-1-0
0x18000C018: "__cdecl _security_cookie" __security_cookie
0x180009278: "__cdecl _imp_RegQueryValueExW" __imp_RegQueryValueExW
0x18000A8E0: USERENV_NULL_THUNK_DATA_DLB
0x180007B3D: "__cdecl _imp_load_CertFreeCertificateContext" __imp_load_CertFreeCertificateContext
0x1800091B8: "__cdecl _imp_CloseHandle" __imp_CloseHandle
0x1800091C8: "__cdecl _imp_LocalFree" __imp_LocalFree
0x18000A9F0: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-errorhandling-l1-1-0
0x180007B2B: "__cdecl _imp_load_CryptHashCertificate" __imp_load_CryptHashCertificate
0x180007C9B: "__cdecl _imp_load_CryptAcquireContextW" __imp_load_CryptAcquireContextW
0x18000E090: "__cdecl _imp_DsRoleFreeMemory" __imp_DsRoleFreeMemory
0x180009270: "__cdecl _imp_RegCreateKeyExW" __imp_RegCreateKeyExW
0x18000C6E0: "__cdecl _onexitbegin" __onexitbegin
0x18000C600: DimsRoam
0x180004B70: DRR_SyncLocAndNetStores
0x180009140: "__cdecl _imp_SetUnhandledExceptionFilter" __imp_SetUnhandledExceptionFilter
0x180009208: "__cdecl _imp_GetCurrentThread" __imp_GetCurrentThread
0x18000A698: api-ms-win-security-sddl-l1-1-0_NULL_THUNK_DATA_DLN
0x18000C030: g_dwLoglevel
0x180009260: "__cdecl _imp_RegOpenKeyExW" __imp_RegOpenKeyExW
0x180009A30: "SOFTWARE\Microsoft\Cryptography\" ??_C@_1FO@NFGOFEGK@?$AAS?$AAO?$AAF?$AAT?$AAW?$AAA?$AAR?$AAE?$AA?2?$AAM?$AAi?$AAc?$AAr?$AAo?$AAs?$AAo?$AAf?$AAt?$AA?2?$AAC?$AAr?$AAy?$AAp?$AAt?$AAo?$AAg?$AAr?$AAa?$AAp?$AAh?$AAy?$AA?2@
0x180007694: "__cdecl _security_init_cookie" __security_init_cookie
0x180009908: DRR_LOG_ERROR_LOCSTOREREAD
0x180007B61: "__cdecl _imp_load_CertCloseStore" __imp_load_CertCloseStore
0x180009280: "__cdecl _imp_RegGetValueW" __imp_RegGetValueW
0x18000A9A0: "__cdecl _IMPORT_DESCRIPTOR_msvcrt" __IMPORT_DESCRIPTOR_msvcrt
0x180009188: "__cdecl _imp_CompareFileTime" __imp_CompareFileTime
0x18000A650: CRYPTSP_NULL_THUNK_DATA_DLN
0x180009360: "__cdecl _imp_malloc" __imp_malloc
0x180009168: "__cdecl _imp_WriteFile" __imp_WriteFile
0x1800094E0: "__cdecl _sz_CRYPT32_dll" __sz_CRYPT32_dll
0x1800077E0: "__cdecl _report_gsfailure" __report_gsfailure
0x180009800: DRR_REG_SUBKEY
0x1800093C8: "__cdecl _imp_EtwEventWrite" __imp_EtwEventWrite
0x180009328: api-ms-win-core-timezone-l1-1-0_NULL_THUNK_DATA
0x1800092D8: "__cdecl _imp_LeaveCriticalSection" __imp_LeaveCriticalSection
0x18000C6F0: "__cdecl _native_startup_state" __native_startup_state
0x180006848: DRR_DeleteAnyGrowableArray
0x180007B7F: "__cdecl _tailMerge_userenv_dll" __tailMerge_userenv_dll
0x180006A20: DRR_WriteFile
0x18000C5E0: "__cdecl _hmod__DSROLE_dll" __hmod__DSROLE_dll
0x18000E030: "__cdecl _imp_CertGetCertificateContextProperty" __imp_CertGetCertificateContextProperty
0x180009490: "__cdecl _sz_api_ms_win_security_sddl_l1_1_0_dll" __sz_api_ms_win_security_sddl_l1_1_0_dll
0x180009220: "__cdecl _imp_OpenThreadToken" __imp_OpenThreadToken
0x1800098A8: DRR_LOG_ERROR_LOCSTORELIMIT
0x18000AAA4: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0" __IMPORT_DESCRIPTOR_api-ms-win-core-profile-l1-1-0
0x180009928: DRR_LOG_WARNING_NEEDHEAL
0x180001E08: DRR_ProcRoaming
0x180009378: "__cdecl _imp_free" __imp_free
0x180007600: "__cdecl IsNonwritableInCurrentImage" _IsNonwritableInCurrentImage
0x1800092F8: api-ms-win-core-synch-l1-2-0_NULL_THUNK_DATA
0x180009218: "__cdecl _imp_OpenProcessToken" __imp_OpenProcessToken
0x180009180: "__cdecl _imp_SetFileAttributesW" __imp_SetFileAttributesW
0x18000AACC: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-localization-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-localization-l1-2-0
0x1800092E8: api-ms-win-core-synch-l1-1-0_NULL_THUNK_DATA
0x180006758: DRR_InsertGrowableArray
0x18000AA54: "__cdecl _IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0" __IMPORT_DESCRIPTOR_api-ms-win-core-synch-l1-2-0
0x180007B07: "__cdecl _imp_load_CertGetEnhancedKeyUsage" __imp_load_CertGetEnhancedKeyUsage
0x180007E41: memset
0x18000AB30: "__cdecl _NULL_IMPORT_DESCRIPTOR" __NULL_IMPORT_DESCRIPTOR
0x180006AAC: DRR_ReadFile
0x180009178: "__cdecl _imp_ReadFile" __imp_ReadFile
0x18000E0A8: USERENV_NULL_THUNK_DATA_DLA
[JEB Decompiler by PNF Software]